# changelog

author: Denys Vlasenko <dvlasenk@redhat.com> - 4:20250512-1
changelog:
  - Add a caveat to provide ability to persistently disable SPR-EE updates
    beyond 0x2b0005c0 on systems where absence of latency spikes
    is more important than lack of the latest CVE mitigations (RHEL-95245)
  - Update Intel CPU microcode to microcode-20250512 release, addresses
    CVE-2024-28956, CVE-2025-20103, CVE-2025-20054, CVE-2024-43420,
    CVE-2025-20623, CVE-2024-45332, CVE-2025-24495, CVE-2025-20012
    (RHEL-92231)
    - Addition of 06-8f-04/0x10 microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7;
    - Addition of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639;
    - Addition of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7;
    - Addition of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639;
    - Addition of 06-8f-06/0x10 microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7;
    - Addition of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639;
    - Addition of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639;
    - Addition of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7;
    - Addition of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639;
    - Addition of 06-ad-01/0x20 (GNR-AP/SP H0) microcode at revision
      0xa0000d1;
    - Addition of 06-ad-01/0x95 (GNR-AP/SP B0) microcode at revision
      0x10003a2;
    - Addition of 06-b5-00/0x80 (ARL-U A1) microcode at revision 0xa;
    - Addition of 06-bd-01/0x80 (LNL B0) microcode at revision 0x11f;
    - Addition of 06-c5-02/0x82 (ARL-H A1) microcode at revision 0x118;
    - Addition of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode (in
      intel-ucode/06-c5-02) at revision 0x118;
    - Addition of 06-c6-04/0x82 microcode (in intel-ucode/06-c5-02) at
      revision 0x118;
    - Addition of 06-ca-02/0x82 microcode (in intel-ucode/06-c5-02) at
      revision 0x118;
    - Addition of 06-c5-02/0x82 (ARL-H A1) microcode (in
      intel-ucode/06-c6-02) at revision 0x118;
    - Addition of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode at revision
      0x118;
    - Addition of 06-c6-04/0x82 microcode (in intel-ucode/06-c6-02) at
      revision 0x118;
    - Addition of 06-ca-02/0x82 microcode (in intel-ucode/06-c6-02) at
      revision 0x118;
    - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in
      intel-06-8c-01/intel-ucode/06-8c-01) from revision 0xb8 up to 0xbc;
    - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
      microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0c) from
      revision 0xfc up to 0x100;
    - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0x102 up
      to 0x104;
    - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
      0x5003707 up to 0x5003901;
    - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x7002904
      up to 0x7002b01;
    - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd0003f5
      up to 0xd000404;
    - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x10002c0
      up to 0x10002d0;
    - Update of 06-7a-08/0x01 (GLK-R R0) microcode from revision 0x24 up
      to 0x26;
    - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xc6
      up to 0xca;
    - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x38 up
      to 0x3c;
    - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x52 up
      to 0x56;
    - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-05) from
      revision 0x2c0003e0 up to 0x2c0003f7;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode from revision
      0x2c0003e0 up to 0x2c0003f7;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode from revision 0x2b000620
      up to 0x2b000639;
    - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-05) from
      revision 0x2c0003e0 up to 0x2c0003f7;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-ucode/06-8f-05) from revision 0x2c0003e0 up to 0x2c0003f7;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-06) from
      revision 0x2c0003e0 up to 0x2c0003f7;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-ucode/06-8f-06) from revision 0x2c0003e0 up to 0x2c0003f7;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-06/0x10 microcode from revision 0x2c0003e0 up to
      0x2c0003f7;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode from revision 0x2b000620
      up to 0x2b000639;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-ucode/06-8f-06) from revision 0x2c0003e0 up to 0x2c0003f7;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision
      0x2b000620 up to 0x2b000639;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision
      0x38 up to 0x3a;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-97-02) from revision 0x38 up to 0x3a;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x38 up to 0x3a;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x38 up to 0x3a;
    - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-97-02) from
      revision 0x38 up to 0x3a;
    - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-97-02) from
      revision 0x38 up to 0x3a;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-97-05) from revision 0x38 up to 0x3a;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x38
      up to 0x3a;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x38 up to 0x3a;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x38 up to 0x3a;
    - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-97-05) from
      revision 0x38 up to 0x3a;
    - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-97-05) from
      revision 0x38 up to 0x3a;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision
      0x436 up to 0x437;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in
      intel-ucode/06-9a-03) from revision 0x436 up to 0x437;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
      intel-ucode/06-9a-04) from revision 0x436 up to 0x437;
    - Update of 06-9a-04/0x40 (AZB A0) microcode from revision 0x9 up
      to 0xa;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x436
      up to 0x437;
    - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xfc up
      to 0x100;
    - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xfc
      up to 0x100;
    - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xfc
      up to 0x100;
    - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xfe
      up to 0x102;
    - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K1) microcode from revision
      0xfc up to 0x100;
    - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x63 up
      to 0x64;
    - Update of 06-aa-04/0xe6 (MTL-H/U C0) microcode from revision 0x20
      up to 0x24;
    - Update of 06-af-03/0x01 (SRF-SP C0) microcode from revision 0x3000330
      up to 0x3000341;
    - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x12c up
      to 0x12f;
    - Update of 06-b7-04/0x32 microcode (in intel-ucode/06-b7-01) from
      revision 0x12c up to 0x12f;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision
      0x4124 up to 0x4128;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in
      intel-ucode/06-ba-02) from revision 0x4124 up to 0x4128;
    - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from
      revision 0x4124 up to 0x4128;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in
      intel-ucode/06-ba-03) from revision 0x4124 up to 0x4128;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4124
      up to 0x4128;
    - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from
      revision 0x4124 up to 0x4128;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in
      intel-ucode/06-ba-08) from revision 0x4124 up to 0x4128;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in
      intel-ucode/06-ba-08) from revision 0x4124 up to 0x4128;
    - Update of 06-ba-08/0xe0 microcode from revision 0x4124 up to 0x4128;
    - Update of 06-be-00/0x19 (ADL-N A0) microcode from revision 0x1c up
      to 0x1d;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-02) from revision 0x38 up to 0x3a;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-02) from revision 0x38 up to 0x3a;
    - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x38 up
      to 0x3a;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02)
      from revision 0x38 up to 0x3a;
    - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-02) from
      revision 0x38 up to 0x3a;
    - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-02) from
      revision 0x38 up to 0x3a;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-05) from revision 0x38 up to 0x3a;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-05) from revision 0x38 up to 0x3a;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05)
      from revision 0x38 up to 0x3a;
    - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x38 up
      to 0x3a;
    - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-05) from
      revision 0x38 up to 0x3a;
    - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-05) from
      revision 0x38 up to 0x3a;
    - Update of 06-cf-01/0x87 (EMR-SP A0) microcode from revision 0x21000291
      up to 0x210002a9;
    - Update of 06-cf-02/0x87 (EMR-SP A1) microcode (in
      intel-ucode/06-cf-01) from revision 0x21000291 up to 0x210002a9;
    - Update of 06-cf-01/0x87 (EMR-SP A0) microcode (in
      intel-ucode/06-cf-02) from revision 0x21000291 up to 0x210002a9;
    - Update of 06-cf-02/0x87 (EMR-SP A1) microcode from revision 0x21000291
      up to 0x210002a9.


author: Ales Matej <amatej@redhat.com> - 3.4.0-1
changelog:
  - Update to 3.4.0
  - Fix: do not download metadata in remove command
  - Add reinstall command
  - Add "--setopt=tsflags=test" support
  - Add "--setopt=reposdir=<path>" and "--setopt=varsdir=<path1>,<path2>,..." support
  - Add "--config=<path_to_config_file>" support
  - Add "--disableplugin", "--enableplugin" support (RhBug:1781126)
  - Add "--noplugins" support
  - Add "--setopt=cachedir=<path_to_cache_directory>" support
  - Add "--installroot=<path_to_installroot_directory>" support
  - Add "--refresh" support
  - Support "install_weak_deps" conf option and "--setopt=install_weak_deps=0/1"
  - Respect reposdir from conf file
  - Respect "metadata_expire" conf file opton (RhBug:1771147)
  - [repolist] Print padding spaces only if output is terminal


author: Nicola Sella <nsella@redhat.com> - 3.4.0-3
changelog:
  - Patch: Add support for setting a platform module ID
  - Rename "update" command to "upgrade", "update" remain as compatibility alias


author: Pavla Kratochvilova <pkratoch@redhat.com> - 3.8.0-1
changelog:
  - Update to 3.8.0
  - Don't set default value of "assumeyes" to TRUE
  - Support for user confirmation and assumeyes, assumeno, defaultyes
  - Add commands: distro-sync, makecache
  - Add subcommands support
  - Add support for command aliases
  - Added alias "update" to "upgrade" command
  - Relicense to GPLv2+
  - Add support for setting allow_vendor_change
  - [download] Support for "--resolve", "--alldeps" and "--archlist=" arguments
  - [download] several optimizations
  - Support "--setopt=keepcache=0/1"
  - Extend "--setopt" to support repository options


author: Michal Hlavinka <mhlavink@redhat.com> 56-1
changelog:
  - Upgrade to 56 (#1479800)
  - fixes wait exit codes of co-processes when run in interactive mode (#1479320)


author: Michal Sekletar <msekleta@redhat.com> - 0.26-14
changelog:
  - start timer after the installation (#1278587)
  - make mlocate-updatedb.service of the type simple, systemd will then not wait for its completion (#1282232)


author: Javier Martinez Canillas <javierm@redhat.com> - 0.3.0-10
changelog:
  - Add mokutil code to consume data from /sys/firmware/efi/mok-variables/
    as well as attempting to consume numbered mok variables from efivarfs
    when mok-variables aren't present (pjones)
    Resolves: rhbz#1907418


author: James Paul Turner <jamesturner246@fedoraproject.org> - 3.1.6-1
changelog:
  - Update to MPFR version 3.1.6
  - Use autosetup specfile macro for applying patches (patches 1 and 2 applied)
  - Removed iconv calls, as they were breaking .info files, which are now unicode
    resolves #1299649
  - Other minor cleanups
  - BuildRequire gcc per https://fedoraproject.org/wiki/Packaging:C_and_C%2B%2B#BuildRequires_and_Requires


author: Pavel Cahyna <pcahyna@redhat.com> - 4.0.18-15
changelog:
  - Add dependency on glibc-gconv-extra
    mtools need codepage 850, which was split from glibc into a subpackage.
    (Fedora bug #2021637, RHEL bug #2073842)


author: Jason L Tibbitts III <tibbs@math.uh.edu> - 2.0.6-3
changelog:
  - Pass rnano.1 through iconv to silence the final rpmlint complaint
    and finish up the merge review.


author: Kamil Dudka <kdudka@redhat.com> - 2.0.9-1
changelog:
  - new upstream release
  - dropped patch no longer needed (possible change in behavior though negligible)
  - fixed broken HTML doc in FR locales (#523951)


author: Kamil Dudka <kdudka@redhat.com> - 2.0.9-4
changelog:
  - ship a system-wide configuration file along with the nano package
  - disable line wrapping by default (#528359)


author: Kamil Dudka <kdudka@redhat.com> - 2.2.6-1
changelog:
  - new upstream release (#655978)
  - increase code robustness (patches related to CVE-2010-1160, CVE-2010-1161)


author: Kamil Dudka <kdudka@redhat.com> - 2.3.0-1
changelog:
  - new upstream release (#680736)
  - use hunspell as default spell-checker (#681000)
  - fix for http://thread.gmane.org/gmane.editors.nano.devel/2911


author: Kamil Dudka <kdudka@redhat.com> - 2.4.2-2
changelog:
  - enable syntax highlighting by default (#1270712)
  - remove installed HTML documentation (to prevent a build failure in rawhide)


author: Kamil Dudka <kdudka@redhat.com> - 2.6.3-1
changelog:
  - use %autosetup in %prep
  - build out of source tree
  - do not recode man pages, they are UTF-8 encoded since v2.3.6
  - new upstream release


author: Lukáš Zaoral <lzaoral@redhat.com> - 2.9.8-3
changelog:
  - fix incomplete backport of the fix for the emergency file replacement
    vulnerability (RHEL-35236)


author: Miroslav Lichvar <mlichvar@redhat.com> 6.1-5.20180224
changelog:
  - fix crash in parsing of terminfo use capability (CVE-2018-10754)
  - add gcc-c++ to build requirements


author: Miroslav Lichvar <mlichvar@redhat.com> 6.1-8.20180224
changelog:
  - fix buffer overflow in terminfo entry hashtable (CVE-2019-17594)
  - handle missing character after backslash in terminfo entry (CVE-2019-17595)


author: Jeff Moyer <jmoyer@redhat.com> - 67-1.el8
changelog:
  - Rebase to v67.  This brings in the following features:
    - support for the 'security frozen' sysfs attribute
    - support for using pmem as system ram
    - various cleanup and bug fixes
  - Fix load-keys failure in initramfs (Jeff Moyer)
  - Resolves: bz#1724531 bz#1730673 bz#1741164 bz#1741165 bz#1749888 bz#1749889


author: Jeff Moyer <jmoyer@redhat.com> - 71.1-4.el8
changelog:
  - Pull in fixes from upstream v72 and v73 (Jeff Moyer)
    - Fix enable-namespace all reporting errors incorrectly
    - Add support for inject-smart on papr scm
  - Related: bz#2090190 bz#1986185 bz#2040074


author: Josef Ridky <jridky@redhat.com> - 1:5.8-27
changelog:
  - fix memory leak due of proc file creating (#2105957)
  - fix CVE-2022-44792 and CVE-2022-44793 (#2141901) and (#2141905)
  - fix memory leak when ipv6 disable set to 1 (#2151537)
  - fix proxy timeout issue (#2160723)


author: Josef Ridky <jridky@redhat.com> - 1:5.8-30
changelog:
  - fix crash when configured as proxy - issue 82 (RHEL-14454)
  - log once truncating issue (RHEL-13597)
  - fix CVE-2022-24805, CVE-2022-24806, CVE-2022-24807, CVE-2022-24808,
    CVE-2022-24809 and CVE-2022-24810 (RHEL-26650)


author: Michal Ruprich <mruprich@redhat.com> - 2.0-0.50.20160912git
changelog:
  - Resolves: 1557470 - netstat -i cut's interface names
  - Resolves: 1566084 - netstat -agn only shows 10 character interface name for IPv4 addressing


author: Michal Ruprich <michalruprich@gmail.com> - 2.0-0.52.20160912git
changelog:
  - Resolves: #1711119 - netstat says "packetes" instead of "packets"
  - Resolves: #1670355 - Exit code on wrong parameter is zero for many net-tools binaries
  - Resolves: #1807989 - The output of `route -A inet6` does not display properly when the 'Use' column output is over 6 digits


author: Tomáš Mráz <tmraz@redhat.com> - 3.4-4
changelog:
  - Cover the gaps in annotation coverage for assembler sources
  - Add .hmac checksums for FIPS mode integrity checking


author: Daiki Ueno <dueno@redhat.com> - 3.4.1-5
changelog:
  - Backport powerpc64 optimization patches from upstream (#1855228)
    Patch from Christopher M. Riedl.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.52.20-4
changelog:
  - Python 2 binary package renamed to python2-newt
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Miroslav Lichvar <mlichvar@redhat.com> - 0.52.20-8
changelog:
  - rename newt-python3 subpackage to python3-newt
  - build python3 subpackage unconditionally
  - don't use unversioned python_sitearch macro
  - drop static subpackage
  - use macro for ldconfig scriptlets
  - add gcc to build requirements
  - fix description of python2-newt


author: Miroslav Lichvar <mlichvar@redhat.com> - 0.52.20-10
changelog:
  - move snack provides to python3-newt subpackage (#1640153)
  - fix radio button selection check in snack (#1714517)


author: Steve Dickson <steved@redhat.com> 2.3.3-59
changelog:
  - Covscan Scan: Wrong Check of Return Value (bz 2151966)
  - Covscan Scan: Clang (experimental) (bz 2151971)


author: Scott Mayhew <smayhew@redhat.com> 2.3.3-61
changelog:
  - gssd: unconditionally use krb5_get_init_creds_opt_alloc (RHEL-62422)
  - gssd: do not use krb5_cc_initialize (RHEL-62422)


author: Steve Dickson <steved@redhat.com> 0.3.5-2
changelog:
  - nfs4_getfacl: Add new option -c/--omit-header (bz 1698281)
  - nfs4_setfacl: Skip comment field while reading ACE(s) (bz 1687299)


author: Phil Sutter <psutter@redhat.com> [0.9.3-22.el8]
changelog:
  - json: Drop pointless assignment in exthdr_expr_json() (Phil Sutter) [1999059]
  - parser_json: Fix for memleak in tcp option error path (Phil Sutter) [1999059]
  - parser_bison: Fix for implicit declaration of isalnum (Phil Sutter) [1999059]
  - parser_json: Fix error reporting for invalid syntax (Phil Sutter) [1994141]


author: Phil Sutter <psutter@redhat.com> [0.9.3-23.el8]
changelog:
  - tests: cover baecd1cf2685 ("segtree: Fix segfault when restoring a huge interval set") (Phil Sutter) [1908127]
  - segtree: Fix segfault when restoring a huge interval set (Phil Sutter) [1908127]


author: Phil Sutter <psutter@redhat.com> [0.9.3-24.el8]
changelog:
  - tests: shell: better parameters for the interval stack overflow test (Phil Sutter) [1908127]
  - tests: shell: $NFT needs to be invoked unquoted (Phil Sutter) [1908127]


author: Phil Sutter <psutter@redhat.com> [0.9.3-25.el8]
changelog:
  - mnl: do not build nftnl_set element list (Phil Sutter) [2047821]
  - tests: py: add dnat to port without defining destination address (Phil Sutter) [2030773]
  - evaluate: fix inet nat with no layer 3 info (Phil Sutter) [2030773]
  - evaluate: attempt to set_eval flag if dynamic updates requested (Phil Sutter) [2039594]
  - src: support for restoring element counters (Phil Sutter) [2039594]
  - netlink: remove unused parameter from netlink_gen_stmt_stateful() (Phil Sutter) [2039594]


author: Phil Sutter <psutter@redhat.com> [0.9.3-26.el8]
changelog:
  - libnftables: call nft_cmd_expand() only with CMD_ADD (Phil Sutter) [2073287]
  - src: add CMD_OBJ_SETELEMS (Phil Sutter) [2073287]
  - src: rename CMD_OBJ_SETELEM to CMD_OBJ_ELEMENTS (Phil Sutter) [2073287]
  - rule: fix element cache update in __do_add_setelems() (Phil Sutter) [2073287]
  - rule: memleak in __do_add_setelems() (Phil Sutter) [2073287]
  - tests: shell: auto-removal of chain hook on netns removal (Phil Sutter) [2070924]
  - mnl: do not use expr->identifier to fetch device name (Phil Sutter) [2070924]


author: Phil Sutter <psutter@redhat.com> [1.0.4-1.el8]
changelog:
  - Synchronize patch level with nftables-1.0.4-10.el9 (Phil Sutter) [2211076]
  - Rebase onto version 1.0.4 (Phil Sutter) [2211076]


author: Phil Sutter <psutter@redhat.com> [1.0.4-2.el8]
changelog:
  - Add expected error records for testsuite runs (Phil Sutter) [2211076]
  - tests: monitor: Summarize failures per test case (Phil Sutter) [2211076]


author: Phil Sutter <psutter@redhat.com> [1.0.4-3.el8]
changelog:
  - spec: Rename variables to avoid a clash (Phil Sutter) [INTERNAL]
  - rule: check address family in set collapse (Phil Sutter) [RHEL-5160]


author: Phil Sutter <psutter@redhat.com> [1.0.4-5.el8]
changelog:
  - xt: Fix fallback printing for extensions matching keywords (Phil Sutter) [RHEL-5806]
  - xt: Fall back to generic printing from translation (Phil Sutter) [RHEL-5806]
  - xt: Rewrite unsupported compat expression dumping (Phil Sutter) [RHEL-5806]
  - xt: Purify enum nft_xt_type (Phil Sutter) [RHEL-5806]
  - xt: Delay libxtables access until translation (Phil Sutter) [RHEL-5806]
  - Warn for tables with compat expressions in rules (Phil Sutter) [RHEL-5806]


author: Dridi Boukelmoune <dridi@fedoraproject.org>- 2.1-1
changelog:
  - Update to 2.1
  - Upstream moved to github
  - Upstream switched to autotools
  - Disable --as-needed until it's patched upstream
  - Drop defunct 32bit x86 support
  - Add ppc64le support
  - Run the new test suite


author: Than Ngo <than@redhat.com> - 3.21.0-7
changelog:
  - Resolves: #2222595, p11sak tool: slot option does not accept argument 0 for slot index 0
  - Resolves: #2222594, p11sak fails as soon as there reside non-key objects


author: Than Ngo <than@redhat.com> - 3.22.0-2
changelog:
  - timing side-channel in handling of RSA PKCS#1 v1.5 padded ciphertexts (Marvin)
  Resolves: RHEL-22791


author: Bill Nottingham <notting@redhat.com>
changelog:
  - update to 1.2.7
  - fix some bugs from bugzilla (#4885, #4887, #4888, #4967)
  - take include files out of base package


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add -D_REENTRANT to make threaded stuff more stable, even though it looks
    like the sources define it, too
  - mark *.ph files in migration tools as config files


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - move the defaults for databases and whatnot to /var/lib/ldap (bug #10714)
  - fix some possible string-handling problems


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 1.2.10
  - add revamped version of patch from kos@bastard.net to allow execution as
    any non-root user
  - remove test suite from %build because of weirdness in the build system


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - more minimalistic fix for bug #11111 after consultation with OpenLDAP team
  - backport replacement for the ldapuser patch


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 1.2.11
  - add condrestart logic to init script
  - munge migration scripts so that you don't have to be
    /usr/share/openldap/migration to run them
  - add code to create pid files in /var/run


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - tweak init script to return error codes properly
  - change initscripts dependency to one on /etc/init.d


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - switch to gdbm; I'm getting off the db merry-go-round
  - tweak the init script some more
  - add instdir to @INC in migration scripts


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - split off clients and servers to shrink down the package and remove the
    base package's dependency on Perl
  - make certain that the binaries have sane permissions


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - build a semistatic slurpd with threads, everything else without
  - disable reverse lookups, per email on OpenLDAP mailing lists
  - make sure the execute bits are set on the shared libraries


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add the nis.schema and inetorgperson.schema to the default server config
  - make ldapadd a hard link to ldapmodify because they're identical binaries


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.0.6
  - add buildprereq on cyrus-sasl-devel, krb5-devel, openssl-devel
  - take the -s flag off of slapadd invocations in migration tools
  - add the cosine.schema to the default server config, needed by inetorgperson


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - try adding the suffix first when doing online migrations
  - force ldapadd to use simple authentication in migration scripts
  - add indexing of a few attributes to the default configuration
  - add commented-out section on using TLS to default configuration


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add missing required attributes to conversion scripts to comply with schema
  - add schema for mail aliases, autofs, and kerberosSecurityObject rooted in
    our own OID tree to define attributes and classes migration scripts expect
  - tweak automounter migration script


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - reorganize the patch list to separate MigrationTools and OpenLDAP patches
  - switch to Luke Howard's rfc822MailMember schema instead of the aliases.schema
  - configure slapd to run as the non-root user "ldap" (#19370)
  - chdir() before chroot() (we don't use chroot, though) (#19369)
  - disable saving of the pid file because the parent thread which saves it and
    the child thread which listens have different pids


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add Norbert Klasen's patch (via Del) to fix searches using ldaps URLs
    (OpenLDAP ITS #889)
  - add "-h ldaps:///" to server init when TLS is enabled, in order to support
    ldaps in addition to the regular STARTTLS (suggested by Del)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - change automount object OID from 1.3.6.1.1.1.2.9 to 1.3.6.1.1.1.2.13,
    per mail from the ldap-nis mailing list


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add support for additional OPTIONS, SLAPD_OPTIONS, and SLURPD_OPTIONS in
    a /etc/sysconfig/ldap file (#23549)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - back out pidfile patches, which interact weirdly with Linux threads
  - mark non-standard schema as such by moving them to a different directory


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - build dummy certificate in %post, use it in default config
  - configure-time shenanigans to help a confused configure script


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - move shared libraries to /lib
  - redo init script for better internationalization (#26154)
  - don't use ldaprc files in the current directory (#38402) (patch from
    hps@intermeta.de)
  - add BuildPrereq on tcp wrappers since we configure with
    --enable-wrappers (#43707)
  - don't overflow debug buffer in mail500 (#41751)
  - don't call krb5_free_creds instead of krb5_free_cred_contents any
    more (#43159)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - require cyrus-sasl-md5 (support for DIGEST-MD5 is required for RFC
    compliance) by name (follows from #43079, which split cyrus-sasl's
    cram-md5 and digest-md5 modules out into cyrus-sasl-md5)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add a build-time requirement on pam-devel
  - add a build-time requirement on a sufficiently-new libtool to link
    shared libraries to other shared libraries (which is needed in order
    for prelinking to work)


author: Nalin Dahyabhai <nalin@redhat.com> 2.0.12-1
changelog:
  - update to 2.0.12 to pull in fixes for setting of default TLS options, among
    other things
  - update to migration tools 39
  - drop tls patch, which was fixed better in this release


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - disable kbind support (deprecated, and I suspect unused)
  - configure with --with-kerberos=k5only instead of --with-kerberos=k5
  - build slapd with threads


author: Nalin Dahyabhai <nalin@redhat.com> 2.0.20-2
changelog:
  - temporarily disable optimizations for ia64 arches
  - specify pthreads at configure-time instead of letting configure guess


author: Nalin Dahyabhai <nalin@redhat.com> 2.0.22-2
changelog:
  - switch to an internalized Berkeley DB as the ldbm back-end  (NOTE: this breaks
    access to existing on-disk directory data)
  - add slapcat/slapadd with gdbm for migration purposes
  - remove Kerberos dependency in client libs (the direct Kerberos dependency
    is used by the server for checking {kerberos} passwords)


author: Nalin Dahyabhai <nalin@redhat.com> 2.0.25-1
changelog:
  - update to 2.0.25 "stable", ldbm-over-gdbm (putting off migration of LDBM
    slapd databases until we move to 2.1.x)
  - use %{_smp_mflags} when running make
  - update to MigrationTools 44
  - enable dynamic module support in slapd


author: Nalin Dahyabhai <nalin@redhat.com> 2.0.25-2
changelog:
  - change LD_FLAGS to refer to /usr/kerberos/_libdir instead of
    /usr/kerberos/lib, which might not be right on some arches


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - incorporate fixes from SuSE's security audit, except for fixes to ITS 1963,
    1936, 2007, 2009, which were included in 2.0.26.
  - add two more patches for db 4.1.24 from sleepycat's updates page
  - use openssl pkgconfig data, if any is available


author: Nalin Dahyabhai <nalin@redhat.com> 2.0.27-8
changelog:
  - back down to db 4.0.x, which 2.0.x can compile with in ldbm-over-db setups
  - tweak SuSE patch to fix a few copy-paste errors and a NULL dereference


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.1.17
  - disable the shell backend, not expected to work well with threads
  - drop the kerberosSecurityObject schema, the krbName attribute it
    contains is only used if slapd is built with v2 kbind support


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - install the db utils for the bundled libdb as %{_sbindir}/slapd_db_*
  - install slapcat/slapadd from 2.0.x for migration purposes


author: Nalin Dahyabhai <nalin@redhat.com> 2.1.22-0
changelog:
  - 2.1.22 now badged stable
  - be more aggressive in what we index by default
  - use/require libtool 1.5


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - actually require newer libtool, as was intended back in 2.1.22-0, noted as
    missed by Jim Richardson


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - build bundled libdb for slapd dynamically to make the package smaller,
    among other things
  - on tls-capable arches, build libdb both with and without shared posix
    mutexes, otherwise just without
  - disable posix mutexes unconditionally for db 4.0, which shouldn't need
    them for the migration cases where it's used
  - update to MigrationTools 45


author: Nalin Dahyabhai <nalin@redhat.com> 2.1.22-8
changelog:
  - add another section to the ABI note for the TLS libdb so that it's marked as
    not needing an executable stack (from Arjan Van de Ven)


author: Nalin Dahyabhai <nalin@redhat.com> 2.1.25-1
changelog:
  - change logging facility used from daemon to local4 (#112730, reversing #11047)
    BEHAVIOR CHANGE - SHOULD BE MENTIONED IN THE RELEASE NOTES.


author: Nalin Dahyabhai <nalin@redhat.com> 2.1.25-2
changelog:
  - fix incorrect use of find when attempting to detect a common permissions
    error in the init script (#114866)


author: Thomas Woerner <twoerner@redhat.com> 2.1.29-3
changelog:
  - removed rpath
  - added pie patch: slapd and slurpd are now pie
  - requires libtool >= 1.5.6-2 (PIC libltdl.a)


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.13-1
changelog:
  - add compat-openldap subpackage
  - default to bdb, as upstream does, gambling that we're only going to be
    on systems with nptl now


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.13-2
changelog:
  - build a separate, static set of libraries for openldap-devel with the
    non-standard ntlm bind patch applied, for use by the evolution-connector
    package (#125579), and installing them under
    evolution_connector_prefix)
  - provide openldap-evolution-devel = version-release in openldap-devel
    so that evolution-connector's source package can require a version of
    openldap-devel which provides what it wants


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - move slapd startup to earlier in the boot sequence (#103160)
  - update to 2.2.15 (stable-20040822)
  - change version number on compat-openldap to include the non-compat version
    from which it's compiled, otherwise would have to start 2.2.15 at release 3
    so that it upgrades correctly


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.2.17 (stable-20040923) (#135188)
  - move nptl libraries into arch-specific subdirectories on x86 boxes
  - require a newer glibc which can provide nptl libpthread on i486/i586


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.20-1
changelog:
  - update to 2.2.20 (stable-20050103)
  - warn about unreadable krb5 keytab files containing "ldap" keys
  - warn about unreadable TLS-related files
  - own a ref to subdirectories which we create under _libdir/tls


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.23-1
changelog:
  - update to 2.2.23 (stable-20050125)
  - update notes on upgrading from earlier versions
  - drop slapcat variations for 2.0/2.1, which choke on 2.2's config files


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.24-1
changelog:
  - update to 2.2.24 (stable 20050318)
  - export KRB5_KTNAME in the init script, in case it was set in the sysconfig
    file but not exported


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.2.26 (stable 20050429)
  - enable the lmpasswd scheme
  - print a warning if slaptest fails, slaptest -u succeeds, and one of the
    directories listed as the storage location for a given suffix in slapd.conf
    contains a readable file named __db.001 (#118678)


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.26-1
changelog:
  - run slaptest with the -u flag if no id2entry db files are found, because
    you can't check for read-write access to a non-existent database (#156787)
  - add _sysconfdir/openldap/cacerts, which authconfig sets as the
    TLS_CACERTDIR path in /etc/openldap/ldap.conf now
  - use a temporary wrapper script to launch slapd, in case we have arguments
    with embedded whitespace (#158111)


author: Jay Fenlason <fenlason@redhat.com>
changelog:
  - Add the tls-fix-connection-test patch to close
    bz#161991 openldap password disclosure issue
  - add the hop patches to prevent infinite looping when chasing referrals.
    OpenLDAP ITS #3578


author: Jay Fenlason <fenlason@redhat.com> 2.2.26-2
changelog:
  - Move the slapd.pem file to /etc/pki/tls/certs
    and edit the -config patch to match to close
    bz#143393  Creates certificates + keys at an insecure/bad place
  - also use _sysconfdir instead of hard-coding /etc


author: Jay Fenlason <fenlason@redhat.com> 2.3.11-2
changelog:
  - Upgrade to 2.3.11, which upstream now considers stable.
  - Switch compat-openldap to 2.2.29
  - remove references to nss_ldap_build from the spec file
  - remove references to 2.0 and 2.1 from the spec file.
  - reorganize the build() function slightly in the spec file to limit the
    number of redundant and conflicting options passedto configure.
  - Remove the attempt to hardlink ldapmodify and ldapadd together, since
    the current make install make ldapadd a symlink to ldapmodify.
  - Include the -ads patches to allow SASL binds to an Active Directory
    server to work.  Nalin <nalin@redhat.com> wrote the patch, based on my
    broken first attempt.


author: Jay Fenlason <fenlason@redhat.com> 2.3.11-3
changelog:
  - Remove Requires: cyrus-sasl and cyrus-sasl-md5 from openldap- and
    compat-openldap- to close
    bz#173313 Remove exlicit 'Requires: cyrus-sasl" + 'Requires: cyrus-sasl-md5'


author: Jay Fenlason <fenlason@redhat.com> 2.3.19-2
changelog:
  - Upgrade to 2.3.19, which upstream now considers stable
  - Modify the -config.patch, ldap.init, and this spec file to put the
    pid file and args file in an ldap-owned openldap subdirectory under
    /var/run.
  - Move back_sql* out of _sbindir/openldap , which requires
    hand-moving slapd and slurpd to _sbindir, and recreating symlinks
    by hand.
  - Retire openldap-2.3.11-ads.patch, which went upstream.
  - Update the ldap.init script to run slaptest as the ldap user rather
    than as root.  This solves
    bz#150172 Startup failure after database problem
  - Add to the servers post and preun scriptlets so that on preun, the
    database is slapcatted to /var/lib/ldap/upgrade.ldif and the
    database files are saved to /var/lib/ldap/rpmorig.  On post, if
    /var/lib/ldap/upgrade.ldif exists, it is slapadded.  This means that
    on upgrades from 2.3.16-2 to higher versions, the database files may
    be automatically upgraded.  Unfortunatly, because of the changes to
    the preun scriptlet, users have to do the slapcat, etc by hand when
    upgrading to 2.3.16-2.  Also note that the /var/lib/ldap/rpmorig
    files need to be removed by hand because automatically removing your
    emergency fallback files is a bad idea.
  - Upgrade internal bdb to db-4.4.20.  For a clean upgrade, this will
    require that users slapcat their databases into a temp file, move
    /var/lib/ldap someplace safe, upgrade the openldap rpms, then
    slapadd the temp file.


author: Jay Fenlason <fenlason@redhat.com> 2.3.27-2
changelog:
  - New upstream release
  - Include the gethostbyname_r patch so that nss_ldap won't hang
    on recursive attemts to ldap_initialize.


author: Jay Fenlason <fenlason@redhat.com> 2.3.27-3
changelog:
  - Include --enable-multimaster to close
    bz#185821: adding slapd_multimaster to the configure options
  - Upgade guide.html to the correct one for openladp-2.3.27, closing
    bz#190383: openldap 2.3 packages contain the administrator's guide for 2.2
  - Remove the quotes from around the slaptestflags in ldap.init
    This closes one part of
    bz#204593: service ldap fails after having added entries to ldap
  - include __db.* in the list of files to check ownership of in
    ldap.init, as suggested in
    bz#199322: RFE: perform cleanup in ldap.init


author: Thomas Woerner <twoerner@redhat.com> 2.3.30-1.1
changelog:
  - tcp_wrappers has a new devel and libs sub package, therefore changing build
    requirement for tcp_wrappers to tcp_wrappers-devel


author: Jay Fenlason <fenlason<redhat.com> 2.3.34-1
changelog:
  - New upstream release
  - Upgrade the scripts for migrating the database so that they might
    actually work.
  - change bind-libbind-devel to bind-devel in BuildPreReq


author: Jan Safranek <jsafranek@redhat.com> 2.3.34-2
changelog:
  - slapadd during package update is now quiet (bz#224581)
  - use _localstatedir instead of var/ during build (bz#220970)
  - bind-libbind-devel removed from BuildRequires (bz#216851)
  - slaptest is now quiet during service ldap start, if
    there is no error/warning (bz#143697)
  - libldap_r.so now links with pthread (bz#198226)
  - do not strip binaries to produce correct .debuginfo packages
    (bz#152516)


author: Jan Safranek <jsafranek@redhat.com> 2.3.34-3
changelog:
  - do not create script in /tmp on startup (bz#188298)
  - add compat-slapcat to openldap-compat (bz#179378)
  - do not import ddp services with migrate_services.pl
    (bz#201183)
  - sort the hosts by adders, preventing duplicities
    in migrate*nis*.pl (bz#201540)
  - start slupd for each replicated database (bz#210155)
  - add ldconfig to devel post/postun (bz#240253)
  - include misc.schema in default slapd.conf (bz#147805)


author: Jan Safranek <jsafranek@redhat.com> 2.3.34-4
changelog:
  - Fix initscript return codes (#242667)
  - Provide overlays (as modules; #246036, #245896)
  - Add available modules to config file


author: Jan Safranek <jsafranek@redhat.com> 2.3.34-6
changelog:
  - fix compat-slapcat compilation. Now it can be found in
    /usr/lib/compat-openldap/slapcat, because the tool checks argv[0]
    (#246581)


author: Jan Safranek <jsafranek@redhat.com> 2.3.37-2
changelog:
  - do not use specific automake and autoconf
  - do not distinguish between NPTL and non-NPTL platforms, we have NPTL
    everywhere
  - db-4.6.18 integrated
  - updated openldap-servers License: field to reference BDB license


author: Jan Safranek <jsafranek@redhat.com> 2.3.38-2
changelog:
  - skeleton /etc/sysconfig/ldap added
  - new SLAPD_LDAP option to turn off listening on ldap:/// (#292591)
  - fixed checking of SSL (#292611)
  - fixed upgrade with empty database


author: Jan Safranek <jsafranek@redhat.com> 2.4.7-4
changelog:
  - fixed rpmlint warnings and errors
    - /etc/openldap/schema/README moved to /usr/share/doc/openldap


author: Jan Safranek <jsafranek@redhat.com> 2.4.8-3
changelog:
  - reworked the upgrade logic, slapcat/slapadd of the whole database
    is needed only if minor version changes (2.3.x -> 2.4.y)
  - do not try to save database in LDIF format, if openldap-servers package
    is  being removed (it's up to the admin to do so manually)


author: Jan Safranek <jsafranek@redhat.com> 2.4.8-4
changelog:
  - bdb upgraded to 4.6.21
  - reworked upgrade logic again to run db_upgrade when bdb version
    changes


author: Jan Safranek <jsafranek@redhat.com> 2.4.11-3
changelog:
  - add SLAPD_SHUTDOWN_TIMEOUT to /etc/sysconfig/ldap, allowing admins
    to set non-default slapd shutdown timeout
  - add checkpoint to default slapd.conf file (#458679)


author: Jan Zeleny <jzeleny@redhat.com> 2.4.15-3
changelog:
  - extended previous patch (#481310) to remove options cfMP
    from some client tools
  - correction of patch setugid (#494330)


author: Jan Zeleny <jzeleny@redhat.com> 2.4.16-1
changelog:
  - rebase of openldap to 2.4.16
  - fixed minor issue in spec file (output looking interactive
    when installing servers)


author: Jan Zeleny <jzeleny@redhat.com> 2.4.18-2
changelog:
  - changed configuration approach. Instead od slapd.conf slapd
    is using slapd.d directory now
  - fix of some issues caused by renaming of init script
  - fix of buffer overflow issue in ldif.c pointed out by new glibc


author: Jan Zeleny <jzeleny@redhat.com> 2.4.18-4
changelog:
  - updated smbk5pwd patch to be linked with libldap (#526500)
  - the last buffer overflow patch replaced with the one from upstream
  - added /etc/openldap/slapd.d and /etc/openldap/slapd.conf.bak
    to files owned by openldap-servers


author: Jan Zeleny <jzeleny@redhat.com> - 2.4.19-2
changelog:
  - fixed tls connection accepting when TLSVerifyClient = allow
  - /etc/openldap/ldap.conf removed from files owned by openldap-servers
  - minor changes in spec file to supress warnings
  - some changes in init script, so it would be possible to use it when
    using old configuration style


author: Jan Zeleny <jzeleny@redhat.com> - 2.4.22-1
changelog:
  - rebased to 2.4.22 (mostly bugfixes, added back-ldif, back-null testing support)
  - due to some possible issues pointed out in last update testing phase, I'm
    pulling back the last change (slapd can't be moved since it depends on /usr
    possibly mounted from network)


author: Rich Megginson <rmeggins@redhat.com> - 2.4.22-3
changelog:
  - added ldif.h to the public api in the devel package
  - added -lldif to the public api
  - added HAVE_MOZNSS and other flags to use Mozilla NSS for crypto


author: Jan Vcelak <jvcelak@redhat.com> - 2.4.22-6
changelog:
  - CVE-2010-0211 openldap: modrdn processing uninitialized pointer free (#605448)
  - CVE-2010-0212 openldap: modrdn processing IA5StringNormalize NULL pointer dereference (#605452)
  - obsolete configuration file moved to /usr/share/openldap-servers (#612602)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.22-7
changelog:
  - Mozilla NSS - delay token auth until needed (#616552)
  - Mozilla NSS - support use of self signed CA certs as server certs (#614545)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-1
changelog:
  - rebase to 2.4.23
  - embeded db4 library removed
  - removed bogus links in "SEE ALSO" in several man-pages (#624616)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-2
changelog:
  - fix possible infinite loop when checking permissions of TLS files (#641946)
  - removed outdated autofs.schema (#643045)
  - removed outdated README.upgrade
  - removed relics of migrationtools


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-3
changelog:
  - add support for multiple prefixed Mozilla NSS database files in TLS_CACERTDIR
  - reject non-file keyfiles in TLS_CACERTDIR (#652315)
  - TLS_CACERTDIR precedence over TLS_CACERT (#652304)
  - accept only files in hash.0 format in TLS_CACERTDIR (#650288)
  - improve SSL/TLS trace messages (#652818)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-4
changelog:
  - Mozilla NSS - implement full non-blocking semantics
    ldapsearch -Z hangs server if starttls fails (#652822)
  - updated list of all overlays in slapd.conf (#655899)
  - fix database upgrade process (#656257)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-5
changelog:
  - initscript: slaptest with '-u' to skip database opening (#667768)
  - removed slurpd options from sysconfig/ldap
  - fix: verification of self issued certificates (#657984)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-6
changelog:
  - fix: some server certificates refused with inadequate type error (#668899)
  - fix: default encryption strength dropped in switch to using NSS (#669446)
  - systemd compatibility: add configuration file (#656647, #668223)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-7
changelog:
  - fix: openldap can't use TLS after a fork() (#636956)
  - fix: openldap-server upgrade gets stuck when the database is damaged (#664433)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.24-2
changelog:
  - new: system resource limiting for slapd using ulimit
  - fix update: openldap can't use TLS after a fork() (#636956)
  - fix: possible null pointer dereference in NSS implementation
  - fix: openldap-servers upgrade hangs or do not upgrade the database (#664433)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.25-1
changelog:
  - rebase to new upstream release
  - change default database type from BDB to HDB
  - enable ldapi:/// interface by default
  - set cn=config management ACLs for root user, SASL external schema (#712495)
  - fix: server scriptlets require initscripts package (#716857)
  - fix: connection fails if TLS_CACERTDIR doesn't exist but TLS_REQCERT
    is set to 'never' (#716854)
  - fix: segmentation fault caused by double-free in ldapexop (#699683)
  - fix: segmentation fault of client tool when input line in LDIF file
    is splitted but indented incorrectly (#716855)
  - fix: segmentation fault of client tool when LDIF input file is not terminated
    by a new line character (#716858)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.26-2
changelog:
  - security hardening: library needs partial RELRO support added (#733071)
  - fix: NSS_Init* functions are not thread safe (#731112)
  - fix: incorrect behavior of allow/try options of VerifyCert and TLS_REQCERT (#725819)
  - fix: memleak - free the return of tlsm_find_and_verify_cert_key (#725818)
  - fix: conversion of constraint overlay settings to cn=config is incorrect (#733067)
  - fix: DDS overlay tolerance parametr doesn't function and breakes default TTL (#733069)
  - manpage fix: errors in manual page slapo-unique (#733070)
  - fix: matching wildcard hostnames in certificate Subject field does not work (#733073)
  - new feature: honor priority/weight with ldap_domain2hostlist (#733078)
  - manpage fix: wrong ldap_sync_destroy() prototype in ldap_sync(3) manpage (#717722)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.26-3
changelog:
  - fix: SSL_ForceHandshake function is not thread safe (#701678)
  - fix: allow unsetting of tls_* syncrepl options (#734187)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.26-5
changelog:
  - rebuild: openldap does not work after libdb rebase (#743824)
  - regression fix: openldap built without tcp_wrappers (#743213)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.26-6
changelog:
  - package cleanup:
    + hardened build: switch from LDFLAGS to RPM macros
    + remove old provides and obsoletes
    + add new slapd maintainance scripts
    + drop defattr macros, clean up permissions in specfile
    + fix rpmlint warnings: macros in comments/changelog
    + fix rpmlint warnings: non UTF-8 documentation
    + rename environment file to be more consistent (ldap -> slapd)
  - replace sysv initscript with systemd service file (#
  - new format of environment file due to switch to systemd
    (automatic conversion is performed)
  - patch OpenLDAP to skip empty command line arguments
    (arguments expansion in systemd works different than in shell)
  - CVE-2011-4079: one-byte buffer overflow in slapd (#749324)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.28-1
changelog:
  - new upstream release
    + server: support for delta-syncrepl in multi master replication
    + server: add experimental backend - MDB
    + server: dynamic configuration for passwd, perl, shell, sock, and sql backends
    + server: support passwords in APR1
    + library: support for Wahl (draft)
    + a lot of bugfixes
  - remove patches which were merged upstream
  - compile backends as modules (except BDB, HDB, and monitor)
  - reload systemd daemon after installation


author: Jan Vcelak <jvcelak@redhat.com> 2.4.28-3
changelog:
  - fix: replication (syncrepl) with TLS causes segfault (#783431)
  - fix: slapd segfaults when PEM certificate is used and key is not set (#772890)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.29-1
changelog:
  - new upstream release
    + MozNSS fixes
    + connection handling fixes
    + server: buxfixes in mdb backend
    + server: buxfixes in overlays (syncrepl, meta, monitor, perl, sql, dds, rwm)
  - openldap-servers now provide ldib2ldbm (#437104)
  - certificates management improvements
    + create empty Mozilla NSS certificate database during installation
    + enable builtin Root CA in generated database (#789088)
    + generate server certificate using Mozilla NSS tools instead of OpenSSL tools
    + fix: correct path to check-config.sh in service file (Jan Synáček <jsynacek@redhat.com>)
  - temporarily disable certificates checking in check-config.sh script
  - fix: check-config.sh get stuck when executing command as a ldap user


author: Jan Vcelak <jvcelak@redhat.com> 2.4.29-2
changelog:
  - fix update: provide ldif2ldbm, not ldib2ldbm (#437104)
  - Jan Synáček <jsynacek@redhat.com>:
    + unify systemctl binary paths throughout the specfile and make them usrmove compliant
    + make path to chkconfig binary usrmove compliant


author: Jan Vcelak <jvcelak@redhat.com> 2.4.29-3
changelog:
  - fix: ldap_result does not succeed for sssd (#771484)
  - Jan Synáček <jsynacek@redhat.com>:
    + fix: count constraint broken when using multiple modifications (#795766)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.29-4
changelog:
  - fix: missing options in manual pages of client tools (#796232)
  - fix: SASL_NOCANON option missing in ldap.conf manual page (#732915)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.30-1
changelog:
  - new upstream release
    + server: fixes in mdb backend
    + server: fixes in manual pages
    + server: fixes in syncprov, syncrepl, and pcache
  - removed patches which were merged upstream


author: Jan Vcelak <jvcelak@redhat.com> 2.4.31-1
changelog:
  - new upstream release
    + library: IPv6 url detection
    + library: rebinding to failed connections
    + server: various fixes in mdb backend
    + server: various fixes in replication
    + server: various fixes in overlays and minor backends
    + documentation fixes
  - remove patches which were merged upstream


author: Jan Vcelak <jvcelak@redhat.com> 2.4.31-2
changelog:
  - fix: nss-tools package is required by the base package, not the server subpackage
  - fix: MozNSS CA certdir does not work together with PEM CA cert file (#819536)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.31-3
changelog:
  - update fix: count constraint broken when using multiple modifications (#795766)
  - fix: invalid order of TLS shutdown operations (#808464)
  - fix: TLS error messages overwriting in tlsm_verify_cert() (#810462)
  - fix: reading pin from file can make all TLS connections hang (#829317)
  - CVE-2012-2668: cipher suite selection by name can be ignored (#825875)
  - fix: slapd fails to start on reboot (#829272)
  - fix: default cipher suite is always selected (#828790)
  - fix: less influence between individual TLS contexts:
    - replication with TLS does not work (#795763)
    - possibly others


author: Jan Vcelak <jvcelak@redhat.com> 2.4.31-4
changelog:
  - modify the package build process
    + fix autoconfig files to detect Mozilla NSS library using pkg-config
    + remove compiler flags which are not needed currently
    + build server, client and library together
    + avoid stray dependencies by using --as-needed linker flag
    + enable SLAPI interface in slapd


author: Jan Vcelak <jvcelak@redhat.com> 2.4.31-5
changelog:
  - fix: querying for IPv6 DNS records when IPv6 is disabled on the host (#835013)
  - fix: smbk5pwd module computes invalid LM hashes (#841560)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.32-1
changelog:
  - new upstream release
    + library: double free, SASL handling
    + tools: read SASL_NOCANON from config file
    + slapd: config index renumbering, duplicate error response
    + backends: various fixes in mdb, bdb/hdb, ldap
    + accesslog, syncprov: fix memory leaks in with replication
    + sha2: portability, thread safety, support SSHA256,384,512
    + documentation fixes


author: Jan Vcelak <jvcelak@redhat.com> 2.4.32-2
changelog:
  - enhancement: TLS, prefer private keys from authenticated slots
  - enhancement: TLS, allow certificate specification including token name
  - resolve TLS failures in replication in 389 Directory Server


author: Jan Vcelak <jvcelak@redhat.com> 2.4.32-3
changelog:
  - fix: some TLS ciphers cannot be enabled (#852338)
  - fix: connection hangs after fallback to second server when certificate hostname verification fails (#852476)
  - fix: not all certificates in OpenSSL compatible CA certificate directory format are loaded (#852786)
  - fix: MozNSS certificate database in SQL format cannot be used (#857373)
  - fix: libldap does not load PEM certificate if certdb is used as TLS_CACERTDIR (#857455)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.33-1
changelog:
  - new upstream release:
    + slapd: ACLs, syncrepl
    + backends: locking and memory management in MDB
    + manpages: slapo-refint
  - patch update: MozNSS certificate database in SQL format cannot be used (#860317)
  - fix: slapd.service should not use /tmp (#859019)


author: Jan Vcelak <jvcelak@fedoraproject.org> 2.4.34-1
changelog:
  - new upstream release (#917603)
  - fix: slapcat segfaults if cn=config.ldif not present (#872784)
  - use systemd-rpm macros in spec file (#850247)


author: Jan Synáček <jsynacek@redhat.com> 2.4.34-1
changelog:
  - enable perl backend (#820547)
  - package ppolicy-check-password (#829749)
  - add perl specific BuildRequires
  - fix bogus dates


author: Jan Synáček <jsynacek@redhat.com> 2.4.34-2
changelog:
  - fix: syncrepl push DELETE operation does not recover (#920482)
  - run autoreconf every build, drop autoreconf patch (#926280)


author: Jan Synáček <jsynacek@redhat.com> 2.4.35-1
changelog:
  - new upstream release (#947235)
  - fix: slapd.service should ensure that network is up before starting (#946921)
  - fix: NSS related resource leak (#929357)


author: Jan Synáček <jsynacek@redhat.com> 2.4.35-3
changelog:
  - fix: minor documentation fixes
  - set SASL_NOCANON to on by default (#949864)
  - remove trailing spaces


author: Jan Synáček <jsynacek@redhat.com> 2.4.35-4
changelog:
  - do not needlessly run ldconfig after installing openldap-devel
  - fix: LDAPI with GSSAPI does not work if SASL_NOCANON=on (#960222)
  - fix: lt_dlopen() with back_perl (#960048)


author: Jan Synáček <jsynacek@redhat.com> - 2.4.37-1
changelog:
  - new upstream release (#1023916)
  - fix: missing a linefeed at the end of file /etc/openldap/ldap.conf (#1019836)


author: Jan Synáček <jsynacek@redhat.com> - 2.4.39-3
changelog:
  - remove redundant sysconfig-related stuff
  - add documentation reference to service file
  - alias slapd.service as openldap.service


author: Jan Synáček <jsynacek@redhat.com> - 2.4.40-5
changelog:
  - harden the build
  - improve check_password
  - provide an unversioned symlink to check_password.so.1.1


author: Jan Synáček <jsynacek@redhat.com> - 2.4.40-6
changelog:
  - remove openldap-fedora-systemd.patch
  - remove openldap-ldaprc-currentdir.patch
  - remove openldap-userconfig-setgid.patch
  - remove openldap-syncrepl-unset-tls-options.patch
  - remove unneeded configure flags, disable sql backend and aci
  - make mdb default after a new installation
  - remove pid file and args file
  - renumber patches and sources


author: Jan Synáček <jsynacek@redhat.com> - 2.4.40-7
changelog:
  - remove tmpfiles config since it's no longer needed
  - fix invalid ldif
  - simplify checking for missing server configuration


author: Matus Honek <mhonek@redhat.com> - 2.4.44-3
changelog:
  - fix: Setting olcTLSProtocolMin does not change supported protocols (#1375432)
  - fix: slapd should start after network-online.service (#1336487)


author: Matus Honek <mhonek@redhat.com> - 2.4.44-9
changelog:
  - NSS: Enhance OpenLDAP to support TLSv1.3 protocol with NSS (#1435692)
  - NSS: Rearrange ciphers-, parsing-, and protocol-related patches (#1435692)


author: Matus Honek <mhonek@redhat.com> - 2.4.45-1
changelog:
  - Rebase to version 2.4.45 (#1458081)
    * fixes CVE-2017-9287 (#1456712, #1456713)
  - Update the 'sources' file with new SHA512 hashes


author: Matus Honek <mhonek@redhat.com> - 2.4.45-5
changelog:
  - Fix issues in MozNSS compatibility layer (#1400570)
    + Force write file with fsync to avoid race conditions
    + Always filestamp both sql and dbm NSS DB variants to not rely on default DB type prefix
    + Allow missing cert and key which is a valid usecase
    + Create extraction folder only in /tmp to simplify selinux rules
    + Fix Covscan issues


author: Matus Honek <mhonek@redhat.com> - 2.4.45-7
changelog:
  - MozNSS Compat. Layer fixes (#1400570)
    - fix incorrect parsing of CACertDir (orig. #1533955)
    - fix PIN disclaimer not always shown (orig. #1516409)
    - fix recursive directory deletion (orig. #1516409)
    - Ensure consistency of a PEM dir before usage (orig. #1516409)
      + Warn just before use of a PIN about key file extraction
    - Enable usage of NSS DB with PEM cert/key (orig. #1525485)
      + Fix a possible invalid dereference (covscan)


author: Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 2.4.45-9
changelog:
  - Escape macros in %changelog
  - Disable TLSMC in F29+
  - Remove obsolete Group tag
  - Don't call ldconfig in servers subpackage
  - Switch to %ldconfig_scriptlets
  - Remove unneeded Requires(post): systemd-sysv, chkconfig
  - Switch to %systemd_requires
  - Change BuildRequires: systemd-units to systemd


author: Matus Honek <mhonek@redhat.com> - 2.4.45-12
changelog:
  - MozNSS Compat. Layer: fix: libldap tlsmc continues even after it fails to extract CA certificates (#1550110)


author: Matus Honek <mhonek@redhat.com> - 2.4.45-13
changelog:
  - fix: openldap does not use Fedora build flags
    + makes use of redhat-rpm-config package
  - Drop superfluous back-sql linking patch


author: Jitka Plesnikova <jplesnik@redhat.com> - 2.4.46-2
changelog:
  - Perl 5.28 rebuild
  - MozNSS Compat. Layer: Fix typos, and spelling in the README file header (#1564161)


author: Matus Honek <mhonek@redhat.com> - 2.4.46-3
changelog:
  - MozNSS Compat. Layer: Make log messages more clear (#1598103)
  - MozNSS Compat. Layer: Fix memleaks reported by valgrind (#1595203)


author: Matus Honek <mhonek@redhat.com> - 2.4.46-6
changelog:
  - Build with LDAP_USE_NON_BLOCKING_TLS (#1594928)
  - Remove unused leftover MozNSS Compat. Layer references (cont.) (#1557967)


author: Simon Pichugin <spichugi@redhat.com> - 2.4.46-19
changelog:
  - Bump version to 2.4.46-19
  - Resolves: RHEL-34283 - openldap: null pointer dereference in ber_memalloc_x function


author: Simon Pichugin <spichugi@redhat.com> - 2.4.46-21
changelog:
  - Bump version to 2.4.46-21
  - Resolves: RHEL-75823 - Fix double file close when first TLS connection fails


author: Jakub Jelen <jjelen@redhat.com> - 0.20.0-3
changelog:
  - Support PIN change for HID Alt tokens (#1830901)
  - Fix CVE-2020-26570, CVE-2020-26571 and CVE-2020-26572
  - Fix right padding of token labels of some cards (#1877973)


author: Jakub Jelen <jjelen@redhat.com> - 0.20.0-5
changelog:
  - Avoid potential crash because of missing list terminator (#2196234)
  - Fix CVE-2023-2977: potential buffer overrun in pkcs15 cardos_have_verifyrc_package (#2211093)
  - Backport upstream changes regarding to reader removal (#2097048)


author: Jakub Jelen <jjelen@redhat.com> - 0.20.0-7
changelog:
  - Fix file caching with different offsets (RHEL-4077)
  - Fix CVE-2023-40660: Potential PIN bypass
  - Fix CVE-2023-40661: Dynamic analyzers reports in pkcs15init
  - Fix CVE-2023-5992: Marvin: Side-channel leaks while stripping encryption PKCS#1.5 padding


author: Dmitry Belyavskiy - 8.0p1-17
changelog:
  - Fix parsing of IPv6 IPs in sftp client (#2151334)
  - Avoid ssh banner one-byte overflow (#2138344)
  - Avoid crash of sshd when Include folder does not exist (#2133087)


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.0p1-20
changelog:
  - Limit artificial delays in sshd while login using AD user
    Resolves: RHEL-1684
  - Add comment to OpenSSH server config about FIPS-incompatible key
    Resolves: RHEL-5221
  - Avoid killing all processes on system in case of race condition
    Resolves: RHEL-11548
  - Avoid sshd_config 256K limit
    Resolves: RHEL-5279
  - Using DigestSign/DigestVerify functions for better FIPS compatibility
    Resolves: RHEL-5217
  - Fix GSS KEX causing ssh failures when connecting to WinSSHD
    Resolves: RHEL-5321


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.0p1-22
changelog:
  - Fix Terrapin attack
    Resolves: RHEL-19308
  - Forbid shell metasymbols in username/hostname
    Resolves: RHEL-19788


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Patch to build with neither RSA nor RSAref.
  - Miscellaneous FHS-compliance tweaks.
  - Fix for possibly-compressed man pages.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Move condrestart to server postun.
  - Move key generation to init script.
  - Actually use the right patch for moving the key generation to the init script.
  - Clean up the init script a bit.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update to 2.1.1p4, which includes fixes for config file parsing problems.
  - Move the init script back.
  - Add Damien's quick fix for wackiness.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update to 20000823 snapshot.
  - Change subpackage requirements from %{version} to %{version}-%{release}
  - Back out the pipe patch.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update x11-askpass to 1.0.2. (#17835)
  - Add BuildPreReqs for /bin/login and /usr/bin/rsh so that configure will
    always find them in the right place. (#17909)
  - Set the default path to be the same as the one supplied by /bin/login, but
    add /usr/X11R6/bin. (#17909)
  - Try to handle obsoletion of ssh-server more cleanly.  Package names
    are different, but init script name isn't. (#17865)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Add BuildPreReq on /usr/include/security/pam_appl.h to be sure we always
    build PAM authentication in.
  - Try setting SSH_ASKPASS if gnome-ssh-askpass is installed.
  - Clean out no-longer-used patches.
  - Patch ssh-add to try to add both identity and id_dsa, and to error only
    when neither exists.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update to OpenSSH 2.3.0p1.
  - Update to x11-askpass 1.1.0.
  - Enable keyboard-interactive authentication.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Resync with conditional options in Damien Miller's .spec file for an errata.
  - Change libexecdir from %{_libexecdir}/ssh to %{_libexecdir}/openssh.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Add the primes file from the latest snapshot to the main package (#20884).
  - Add the dev package to the prereq list (#19984).
  - Remove the default path and mimic login's behavior in the server itself.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Disable the built-in MD5 password support.  We're using PAM.
  - Take a crack at doing keyboard-interactive authentication with PAM, and
    enable use of it in the default client configuration so that the client
    will try it when the server disallows password authentication.
  - Build with debugging flags.  Build root policies strip all binaries anyway.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Merge multiple PAM text messages into subsequent prompts when possible when
    doing keyboard-interactive authentication.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update to x11-askpass 1.1.1. (#21301)
  - Don't second-guess fixpaths, which causes paths to get fixed twice. (#21290)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Don't treat pam_setcred() failure as fatal unless pam_authenticate() has
    succeeded, to allow public-key authentication after a failure with "none"
    authentication.  (#21268)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - More gettextizing.
  - Close all files after going into daemon mode (needs more testing).
  - Extract patch from CVS to handle auth banners (in the client).
  - Extract patch from CVS to handle compat weirdness.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Don't open a PAM session until we've forked and become the user (#25690).
  - Apply Andrew Bartlett's patch for letting pam_authenticate() know which
    host the user is attempting a login from.
  - Resync with parts of Damien Miller's openssh.spec from CVS.
  - Don't expose KbdInt responses in debug messages (from CVS).
  - Detect and handle errors in rsa_{public,private}_decrypt (from CVS).


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update for 2.5.0p1.
  - Use $RPM_OPT_FLAGS instead of -O when building gnome-ssh-askpass
  - Resync with parts of Damien Miller's openssh.spec from CVS, including
    update of x11 askpass to 1.2.0.
  - Only require openssl (don't prereq) because we generate keys in the init
    script now.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update for 2.5.1p1.
  - Add init script mods from Pekka Savola.
  - Tweak the init script to match the CVS contrib script more closely.
  - Redo patch to ssh-add to try to adding both identity and id_dsa to also try
    adding id_rsa.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Redo patch to move pam_open_session after the server setuid()s to the user.
  - Rework the nopam patch to use be picked up by autoconf.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Chuck the closing patch.
  - Add a trigger to add host keys for protocol 2 to the config file, now that
    configuration file syntax requires us to specify it with HostKey if we
    specify any other HostKey values, which we do.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Revert the patch to move pam_open_session.
  - Init script and spec file changes from Pekka Savola. (#28750)
  - Patch sftp to recognize '-o protocol' arguments. (#29540)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.5.2p1 (includes endianness fixes in the rijndael implementation)
  - don't enable challenge-response by default until we find a way to not
    have too many userauth requests (we may make up to six pubkey and up to
    three password attempts as it is)
  - remove build dependency on rsh to match openssh.com's packages more closely


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.5.2p2
  - call setcred() again after initgroups, because the "creds" could actually
    be group memberships


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - make do_pam_setcred() smart enough to know when to establish creds and
    when to reinitialize them
  - add in a couple of other fixes from Damien for inclusion in the errata


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - mention that challengereponse supports PAM, so disabling password doesn't
    limit users to pubkey and rsa auth (#34378)
  - bypass the daemon() function in the init script and call initlog directly,
    because daemon() won't start a daemon it detects is already running (like
    open connections)
  - require the version of openssl we had when we were built


author: Preston Brown <pbrown@redhat.com>
changelog:
  - remove explicit openssl requirement, fixes builddistro issue
  - make initscript stop() function wait until sshd really dead to avoid 
    races in condrestart


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - finish marking strings in the init script for translation
  - modify init script to source /etc/sysconfig/sshd and pass $OPTIONS to sshd
    at startup (change merged from openssh.com init script, originally by
    Pekka Savola)
  - refuse to do X11 forwarding if xauth isn't there, handy if you enable
    it by default on a system that doesn't have X installed


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add in Simon Wilkinson's GSSAPI patch to give it some testing in-house,
    to be removed before the next beta cycle because it's a big departure
    from the upstream version


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix an error parsing the new default sshd_config
  - add a fix from Markus Friedl (via openssh-unix-dev) for ssh-keygen not
    dealing with comments right


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - change Copyright: BSD to License: BSD
  - add Markus Friedl's unverified patch for the cookie file deletion problem
    so that we can verify it
  - drop patch to check if xauth is present (was folded into cookie patch)
  - don't apply gssapi patches for the errata candidate
  - clear supplemental groups list at startup


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pull cvs patch to add session initialization to no-pty sessions
  - pull cvs patch to not cut off challengeresponse auth needlessly
  - refuse to do X11 forwarding if xauth isn't there, handy if you enable
    it by default on a system that doesn't have X installed (#49263)


author: Nalin Dahyabhai <nalin@redhat.com> 2.9p2-7
changelog:
  - fix scp's server's reporting of file sizes, and build with the proper
    preprocessor define to get large-file capable open(), stat(), etc.
    (sftp has been doing this correctly all along) (#51827)
  - configure without --with-ipv4-default on RHL 7.x and newer (#45987,#52247)
  - pull cvs patch to fix support for /etc/nologin for non-PAM logins (#47298)
  - mark profile.d scriptlets as config files (#42337)
  - refer to Jason Stone's mail for zsh workaround for exit-hanging quasi-bug
  - change a couple of log() statements to debug() statements (#50751)
  - pull cvs patch to add -t flag to sshd (#28611)
  - clear fd_sets correctly (one bit per FD, not one byte per FD) (#43221)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 3.0p1
  - update to x11-ssh-askpass 1.2.4.1
  - change build dependency on a file from pam-devel to the pam-devel package
  - replace primes with moduli


author: Nalin Dahyabhai <nalin@redhat.com> 3.0p1-1
changelog:
  - merge some of Damien Miller <djm@mindrot.org> changes from the upstream
    3.0p1 spec file and init script


author: Nalin Dahyabhai <nalin@redhat.com> 3.0.2p1-3
changelog:
  - add patches from Simon Wilkinson and Nicolas Williams for GSSAPI key
    exchange, authentication, and named key support


author: Nalin Dahyabhai <nalin@redhat.com> SNAP-20020220
changelog:
  - update to SNAP-20020220 for testing purposes (you've been warned, if there's
    anything to be warned about, gss patches won't apply, I don't mind)


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-1
changelog:
  - require sharutils for building (mindrot #137)
  - require db1-devel only when building for 6.x (#55105), which probably won't
    work anyway (3.1 requires OpenSSL 0.9.6 to build), but what the heck
  - require pam-devel by file (not by package name) again
  - add Markus's patch to compile with OpenSSL 0.9.5a (from
    http://bugzilla.mindrot.org/show_bug.cgi?id=141) and apply it if we're
    building for 6.x


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-2gss
changelog:
  - reintroduce Simon's gssapi patches
  - add buildprereq for autoconf253, which is needed to regenerate configure
    after applying the gssapi patches
  - refresh to the latest version of Markus's patch to build properly with
    older versions of OpenSSL


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-3
changelog:
  - pull patch from CVS to avoid printing error messages when some of the
    default keys aren't available when running ssh-add
  - refresh to current revisions of Simon's patches


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-4
changelog:
  - drop buildreq on db1-devel
  - require pam-devel by package name
  - require autoconf instead of autoconf253 again


author: Nalin Dahyabhai <nalin@redhat.com> 3.3p1-1
changelog:
  - update to 3.3p1
  - merge in spec file changes from upstream (remove setuid from ssh, ssh-keysign)
  - disable gtk2 askpass
  - require pam-devel by filename rather than by package for erratum
  - include patch from Solar Designer to work around anonymous mmap failures


author: Nalin Dahyabhai <nalin@redhat.com> 3.3p1-2
changelog:
  - rework the close-on-exit docs
  - include configuration file man pages
  - make use of nologin as the privsep shell optional


author: Nalin Dahyabhai <nalin@redhat.com> 3.5p1-2
changelog:
  - patch PAM configuration to use relative path names for the modules, allowing
    us to not worry about which arch the modules are built for on multilib systems


author: Nalin Dahyabhai <nalin@redhat.com> 3.5p1-6
changelog:
  - move scp to the -clients subpackage, because it directly depends on ssh
    which is also in -clients (#84329)


author: Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-6
changelog:
  - modify patch which clears the supplemental group list at startup to only
    complain if setgroups() fails if sshd has euid == 0
  - handle krb5 installed in %{_prefix} or elsewhere by using krb5-config


author: Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-11
changelog:
  - apply patch to store the correct buffer size in allocated buffers
    (CAN-2003-0693)
  - skip the initial PAM authentication attempt with an empty password if
    empty passwords are not permitted in our configuration (#103998)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - additional fix for apparently-never-happens double-free in buffer_free()
  - extend fix for #103998 to cover SSH1


author: Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-34
changelog:
  * Wed Mar 03 2004 Phil Knirsch <pknirsch@redhat.com> 3.6.1p2-33.30.1
  - Built RHLE3 U2 update package.


author: Nalin Dahyabhai <nalin@redhat.com> 3.8.1p1-1
changelog:
  - request gssapi-with-mic by default but not delegation (flag day for anyone
    who used previous gssapi patches)
  - no longer request x11 forwarding by default


author: Nalin Dahyabhai <nalin@redhat.com> 3.9p1-8
changelog:
  - add a --enable-vendor-patchlevel option which allows a ShowPatchLevel option
    to enable display of a vendor patch level during version exchange (#120285)
  - configure with --disable-strip to build useful debuginfo subpackages


author: Tomas Mraz <tmraz@redhat.com>
changelog:
  - change permissions on pam.d/sshd to 0644 (#64697)
  - patch initscript so it doesn't kill opened sessions if
    the sshd daemon isn't running anymore (#67624)


author: Tomas Mraz <tmraz@redhat.com> 3.9p1-10
changelog:
  - enable trusted forwarding by default if X11 forwarding is 
    required by user (#137685 and duplicates)
  - disable protocol 1 support by default in sshd server config (#88329)
  - keep the gnome-askpass dialog above others (#69131)


author: Tomas Mraz <tmraz@redhat.com> 3.9p1-11
changelog:
  - don't call syslog in signal handler
  - allow password authentication when copying from remote
    to remote machine (#103364)


author: Tomas Mraz <tmraz@redhat.com> 4.0p1-2
changelog:
  - fixed Local/RemoteForward in ssh_config.5 manpage
  - fix fatal when Local/RemoteForward is used and scp run (#153258)
  - don't leak user validity when using krb5 authentication


author: Tomas Mraz <tmraz@redhat.com> 4.1p1-3
changelog:
  - fix small regression caused by the nologin patch (#161956)
  - fix race in getpeername error checking (mindrot #1054)


author: Tomas Mraz <tmraz@redhat.com> 4.1p1-4
changelog:
  - don't deadlock on exit with multiple X forwarded channels (#152432)
  - don't use X11 port which can't be bound on all IP families (#163732)


author: Tomas Mraz <tmraz@redhat.com> 4.1p1-5
changelog:
  - use x11-ssh-askpass if openssh-askpass-gnome is not installed (#165207)
  - install ssh-copy-id from contrib (#88707)


author: Tomas Mraz <tmraz@redhat.com> 4.2p1-2
changelog:
  - use include instead of pam_stack in pam config
  - use fork+exec instead of system in scp - CVE-2006-0225 (#168167)
  - upstream patch for displaying authentication errors


author: Warren Togami <wtogami@redhat.com> - 4.2p1-7
changelog:
  - xorg-x11-devel -> libXt-devel
  - rebuild for new xauth location so X forwarding works
  - buildreq audit-libs-devel
  - buildreq automake for aclocal
  - buildreq imake for xmkmf
  -  -D_GNU_SOURCE in flags in order to get it to build
     Ugly hack to workaround openssh defining __USE_GNU which is
     not allowed and causes problems according to Ulrich Drepper
     fix this the correct way after FC5test1


author: Nalin Dahyabhai <nalin@redhat.com> - 4.2p1-8
changelog:
  - work around missing gccmakedep by wrapping makedepend in a local script
  - remove now-obsolete build dependency on "xauth"


author: Tomas Mraz <tmraz@redhat.com> - 4.2p1-9
changelog:
  - drop x11-ssh-askpass from the package
  - drop old build_6x ifs from spec file
  - improve gnome-ssh-askpass so it doesn't reveal number of passphrase 
    characters to person looking at the display
  - less hackish fix for the __USE_GNU problem


author: Tomas Mraz <tmraz@redhat.com> - 4.3p1-2
changelog:
  - fixed another place where syslog was called in signal handler
  - pass locale environment variables to server, accept them there (#179851)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-3
changelog:
  - enable the subprocess in chroot to send messages to system log
  - sshd should prevent login if audit call fails


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-6
changelog:
  - improve selinux patch (by Jan Kiszka)
  - upstream patch for buffer append space error (#191940)
  - fixed typo in configure.ac (#198986)
  - added pam_keyinit to pam configuration (#198628)
  - improved error message when askpass dialog cannot grab
    keyboard input (#198332)
  - buildrequires xauth instead of xorg-x11-xauth
  - fixed a few rpmlint warnings


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-7
changelog:
  - dropped old ssh obsoletes
  - call the pam_session_open/close from the monitor when privsep is
    enabled so it is always called as root (patch by Darren Tucker)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-8
changelog:
  - drop the pam-session patch from the previous build (#201341)
  - don't set IPV6_V6ONLY sock opt when listening on wildcard addr (#201594)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-9
changelog:
  - don't report duplicate syslog messages, use correct local time (#189158)
  - don't allow spnego as gssapi mechanism (from upstream)
  - fixed memleaks found by Coverity (from upstream)
  - allow ip options except source routing (#202856) (patch by HP)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-10
changelog:
  - improve gssapi-no-spnego patch (#208102)
  - CVE-2006-4924 - prevent DoS on deattack detector (#207957)
  - CVE-2006-5051 - don't call cleanups from signal handler (#208459)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-11
changelog:
  - merge sshd initscript patches
  - kill all ssh sessions when stop is called in halt or reboot runlevel
  - remove -TERM option from killproc so we don't race on sshd restart


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-13
changelog:
  - improved pam_session patch so it doesn't regress, the patch is necessary
    for the pam_session_close to be called correctly as uid 0


author: Tomas Mraz <tmraz@redhat.com> - 4.5p1-2
changelog:
  - support mls on labeled networks (#220487)
  - support mls level selection on unlabeled networks
  - allow / in usernames in scp (only beginning /, ./, and ../ is special)


author: Tomas Mraz <tmraz@redhat.com> - 4.5p1-8
changelog:
  - fix sftp client problems on write error (#247802)
  - allow disabling autocreation of server keys (#235466)


author: Tomas Mraz <tmraz@redhat.com> - 4.7p1-1
changelog:
  - upgrade to latest upstream
  - use libedit in sftp (#203009)
  - fixed audit log injection problem (CVE-2007-3102)


author: Tomas Mraz <tmraz@redhat.com> - 4.7p1-4
changelog:
  - do not copy /etc/localtime into the chroot as it is not
    necessary anymore (#193184)
  - call setkeycreatecon when selinux context is established
  - test for NULL privk when freeing key (#391871) - patch by
    Pierre Ossman


author: Tomas Mraz <tmraz@redhat.com> - 4.7p1-9
changelog:
  - set FD_CLOEXEC on client socket
  - apply real fix for window size problem (#286181) from upstream
  - apply fix for the spurious failed bind from upstream
  - apply open handle leak in sftp fix from upstream


author: Tomas Mraz <tmraz@redhat.com> - 4.7p1-10
changelog:
  - fix race on control master and cleanup stale control socket (#436311)
    patches by David Woodhouse


author: Tomas Mraz <tmraz@redhat.com> - 5.0p1-1
changelog:
  - upgrade to new upstream (#441066)
  - prevent initscript from killing itself on halt with upstart (#438449)
  - initscript status should show that the daemon is running
    only when the main daemon is still alive (#430882)


author: Tomas Mraz <tmraz@redhat.com> - 5.0p1-2
changelog:
  - add LANGUAGE to accepted/sent environment variables (#443231)
  - use pam_selinux to obtain the user context instead of doing it itself
  - unbreak server keep alive settings (patch from upstream)
  - small addition to scp manpage


author: Tomas Mraz <tmraz@redhat.com> - 5.1p1-1
changelog:
  - upgrade to new upstream release
  - fixed a problem with public key authentication and explicitely
    specified SELinux role


author: Tomas Mraz <tmraz@redhat.com> - 5.1p1-4
changelog:
  - set FD_CLOEXEC on channel sockets (#475866)
  - adjust summary
  - adjust nss-keys patch so it is applicable without selinux patches (#470859)


author: Tomas Mraz <tmraz@redhat.com> - 5.1p1-5
changelog:
  - remove obsolete --with-rsh (#478298)
  - add pam_sepermit to allow blocking confined users in permissive mode
    (#471746)
  - move system-auth after pam_selinux in the session stack


author: Jan F. Chadima <jchadima@redhat.com> - 5.2p1-20
changelog:
  - merged xmodifiers to redhat patch
  - merged gssapi-role to selinux patch
  - merged cve-2007_3102 to audit patch
  - sesftp patch only with WITH_SELINUX flag
  - rearange sesftp patch according to upstream request


author: Jan F. Chadima <jchadima@redhat.com> - 5.2p1-28
changelog:
  - Repair initscript to be acord to guidelines (#521860)
  - Add bugzilla# to application of edns and xmodifiers patch


author: Jan F. Chadima <jchadima@redhat.com> - 5.5p1-10 + 0.9.2-26
changelog:
  - Repair the reference in man ssh-ldap-helper(8)
  - Repair the PubkeyAgent section in sshd_config(5)
  - Provide example ldap.conf


author: Jan F. Chadima <jchadima@redhat.com> - 5.6p1-20 + 0.9.2-29
changelog:
  - reapair clientloop crash (#627332)
  - properly restore euid in case connect to the ssh-agent socket fails


author: Jan F. Chadima <jchadima@redhat.com> - 5.8p1-18 + 0.9.2-30
changelog:
  - add periodical reseeding of random generator 
  - change selinux contex for internal sftp in do_usercontext
  - exit(0) after sigterm


author: Jan F. Chadima <jchadima@redhat.com> - 5.8p1-20 + 0.9.2-30
changelog:
  - use /dev/random or /dev/urandom for seeding prng
  - improve periodical reseeding of random generator


author: Jan F. Chadima <jchadima@redhat.com> - 5.8p2-12 + 0.9.2-31
changelog:
  - Systemd compatibility according to Mathieu Bridon <bochecha@fedoraproject.org>
  - Split out the host keygen into their own command, to ease future migration
    to systemd. Compatitbility with the init script was kept.
  - Migrate the package to full native systemd unit files, according to the Fedora
    packaging guidelines.
  - Prepate the unit files for running an ondemand server. (do not add it actually)


author: Tomas Mraz <tmraz@redhat.com> - 5.9p1-11 + 0.9.2-32
changelog:
  - remove unnecessary requires on initscripts
  - set VerifyHostKeyDNS to ask in the default configuration (#739856)


author: Tomas Mraz <tmraz@redhat.com> - 5.9p1-12 + 0.9.2-32
changelog:
  - still support /etc/sysconfig/sshd loading in sshd service (#754732)
  - fix incorrect key permissions generated by sshd-keygen script (#754779)


author: Tomas Mraz <tmraz@redhat.com> - 5.9p1-13 + 0.9.2-32
changelog:
  - add back the restorecon call to ssh-copy-id - it might be needed on older
    distributions (#739989)


author: Petr Lautrbach <plautrba@redhat.com> 5.9p1-18 + 0.9.2-32
changelog:
  - replace TwoFactorAuth with RequiredAuthentications[12]
    https://bugzilla.mindrot.org/show_bug.cgi?id=983


author: Tomas Mraz <tmraz@redhat.com> 5.9p1-23 + 0.9.3-1
changelog:
  - fix segfault in su when pam_ssh_agent_auth is used and the ssh-agent
    is not running, most probably not exploitable
  - update pam_ssh_agent_auth to 0.9.3 upstream version


author: Petr Lautrbach <plautrba@redhat.com> 6.1p1-1 + 0.9.3-3
changelog:
  - new upstream release (#852651)
  - use DIR: kerberos type cache (#848228)
  - don't use chroot_user_t for chrooted users (#830237)
  - replace scriptlets with systemd macros (#850249)
  - don't use /bin and /sbin paths (#856590)


author: Petr Lautrbach <plautrba@redhat.com> 6.1p1-2
changelog:
  - add SELinux comment to /etc/ssh/sshd_config about SELinux command to modify port (#861400)
  - drop required chkconfig (#865498)
  - drop openssh-5.9p1-sftp-chroot.patch (#830237)


author: Petr Lautrbach <plautrba@redhat.com> 6.1p1-3 + 0.9.3-3
changelog:
  - replace RequiredAuthentications2 with AuthenticationMethods based on upstream
  - obsolete RequiredAuthentications[12] options
  - fix openssh-6.1p1-privsep-selinux.patch


author: Petr Lautrbach <plautrba@redhat.com> 6.2p1-2 + 0.9.3-4
changelog:
  - keep track of which IndentityFile options were manually supplied and
    which were default options, and don't warn if the latter are missing.
    (mindrot#2084)


author: Petr Lautrbach <plautrba@redhat.com> 6.2p1-3 + 0.9.3-4
changelog:
  - sshd.service: use KillMode=process (#890376)
  - add latest config.{sub,guess} to support aarch64 (#926284)


author: Petr Lautrbach <plautrba@redhat.com> 6.2p2-4 + 0.9.3-5
changelog:
  - don't show Success for EAI_SYSTEM (#985964)
  - make sftp's libedit interface marginally multibyte aware (#841771)


author: Petr Lautrbach <plautrba@redhat.com> 6.2p2-7 + 0.9.3-5
changelog:
  - use hmac_suffix for ssh{,d} hmac checksums
  - bump the minimum value of SSH_USE_STRONG_RNG to 14 according to SP800-131A
  - automatically restart sshd.service on-failure after 42s interval


author: Petr Lautrbach <plautrba@redhat.com> 6.2p2-8 + 0.9.3-5
changelog:
  - sshd-keygen: generate only RSA keys by default (#1010092)
  - use dist tag in suffixes for hmac checksum files


author: Petr Lautrbach <plautrba@redhat.com> 6.2p2-9 + 0.9.3-5
changelog:
  - use dracut-fips package to determine if a FIPS module is installed
  - revert -fips subpackages and hmac files suffixes


author: Petr Lautrbach <plautrba@redhat.com> 6.3p1-2 + 0.9.3-6
changelog:
  - use default_ccache_name from /etc/krb5.conf for a kerberos cache (#991186)
  - increase the size of the Diffie-Hellman groups (#1010607)
  - sshd-keygen to generate ECDSA keys <i.grok@comcast.net> (#1019222)


author: Petr Lautrbach <plautrba@redhat.com> 6.3p1-5 + 0.9.3-7
changelog:
  - adjust gss kex mechanism to the upstream changes (#1024004)
  - don't use xfree in pam_ssh_agent_auth sources <geertj@gmail.com> (#1024965)


author: Petr Lautrbach <plautrba@redhat.com> 6.4p1-2 + 0.9.3-1
changelog:
  - fix fatal() cleanup in the audit patch (#1029074)
  - fix parsing logic of ldap.conf file (#1033662)


author: Petr Lautrbach <plautrba@redhat.com> 6.4p1-3 + 0.9.3-1
changelog:
  - sshd-keygen - use correct permissions on ecdsa host key (#1023945)
  - use only rsa and ecdsa host keys by default


author: Petr Lautrbach <plautrba@redhat.com> 6.4p1-4 + 0.9.3-1
changelog:
  - use SSH_COPY_ID_LEGACY variable to run ssh-copy-id in the legacy mode
  - make /etc/ssh/moduli file public (#1043661)
  - test existence of /etc/ssh/ssh_host_ecdsa_key in sshd-keygen.service
  - don't clean up gssapi credentials by default (#1055016)
  - ssh-agent - try CLOCK_BOOTTIME with fallback (#1091992)
  - prevent a server from skipping SSHFP lookup - CVE-2014-2653 (#1081338)
  - ignore environment variables with embedded '=' or '\0' characters - CVE-2014-2532
    (#1077843)


author: Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-1 + 0.9.3-2
changelog:
  - disable the curve25519 KEX when speaking to OpenSSH 6.5 or 6.6
  - add support for ED25519 keys to sshd-keygen and sshd.sysconfig
  - drop openssh-server-sysvinit subpackage
  - slightly change systemd units logic - use sshd-keygen.service (#1066615)


author: Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-5 + 0.9.3-3
changelog:
  - set a client's address right after a connection is set (mindrot#2257)
  - apply RFC3454 stringprep to banners when possible (mindrot#2058)
  - don't consider a partial success as a failure (mindrot#2270)


author: Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-6 + 0.9.3-3
changelog:
  - privsep_preauth: use SELinux context from selinux-policy (#1008580)
  - change audit trail for unknown users (mindrot#2245)
  - fix kuserok patch which checked for the existence of .k5login
    unconditionally and hence prevented other mechanisms to be used properly
  - revert the default of KerberosUseKuserok back to yes (#1153076)
  - ignore SIGXFSZ in postauth monitor (mindrot#2263)
  - sshd-keygen - don't generate DSA and ED25519 host keys in FIPS mode


author: Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-9 + 0.9.3-3
changelog:
  - the .local domain example should be in ssh_config, not in sshd_config
  - use different values for DH for Cisco servers (#1026430)


author: Jakub Jelen <jjelen@redhat.com> 6.6.1p1-11.1 + 0.9.3-3
changelog:
  - error message if scp when directory doesn't exist (#1142223)
  - parsing configuration file values (#1130733)
  - documentation in service and socket files for systemd (#1181593)
  - updated ldap patch (#981058)
  - fixed vendor-patchlevel
  - add new option GSSAPIEnablek5users and disable using ~/.k5users by default CVE-2014-9278 (#1170745)


author: Jakub Jelen <jjelen@redhat.com> 6.7p1-3 + 0.9.3-4
changelog:
  - update coverity patch
  - make output of sshd -T more consistent (#1187521)
  - enable seccomp for sandboxing instead of rlimit (#1062953)
  - update hardening to compile on gcc5
  - Add SSH KDF CAVS test driver (#1193045)
  - Fix ssh-copy-id on non-sh remote shells (#1045191)


author: Jakub Jelen <jjelen@redhat.com> 6.7p1-6 + 0.9.3-4
changelog:
  - Update seccomp filter to work on i686 architectures (#1194401)
  - Fix previous failing build (#1195065)


author: Jakub Jelen <jjelen@redhat.com> 6.7p1-9 + 0.9.3-4
changelog:
  - Adjust seccomp filter for primary architectures and solve aarch64 issue (#1197051)
  - Solve issue with ssh-copy-id and keys without trailing newline (#1093168)


author: Jakub Jelen <jjelen@redhat.com> 6.7p1-11 + 0.9.3-4
changelog:
  - Ability to specify LDAP filter in ldap.conf for ssh-ldap-helper
  - Fix auditing when using combination of ForceCommand and PTY
  - Add sftp option to force mode of created files (from rhel)
  - Fix tmpfiles.d entries to be more consistent (#1196807)


author: Jakub Jelen <jjelen@redhat.com> 6.8p1-1 + 0.9.3-5
changelog:
  - new upstream release openssh-6.8p1 (#1203245)
  - Resolve segfault with auditing commands (#1203900)
  - Workaround krb5-config bug (#1204646)


author: Jakub Jelen <jjelen@redhat.com> 6.8p1-3 + 0.9.3-5
changelog:
  - Fixed issue with GSSAPI key exchange (#1207719)
  - Add pam_namespace to sshd pam stack (based on #1125110)
  - Remove krb5-config workaround for #1203900
  - Fix handling SELinux context in MLS systems
  - Regression: solve sshd segfaults if other instance already running


author: Jakub Jelen <jjelen@redhat.com> 6.8p1-6 + 0.9.3-5
changelog:
  - Resolve problem with pam_ssh_agent_auth after rebase (#1225106)
  - ssh-copy-id: tcsh doesnt work with multiline strings
  - Fix upstream memory problems
  - Add missing options in testmode output and manual pages
  - Provide LDIF version of LPK schema
  - Document required selinux boolean for working ssh-ldap-helper


author: Jakub Jelen <jjelen@redhat.com> 6.9p1-1 + 0.9.3-6
changelog:
  - New upstream release (#1238253)
  - Increase limitation number of files which can be listed using glob in sftp
  - Correctly revert "PermitRootLogin no" option from upstream sources (#89216)


author: Jakub Jelen <jjelen@redhat.com> 6.9p1-2 + 0.9.3-6
changelog:
  - Enable SECCOMP filter for s390* architecture (#1195065)
  - Fix race condition when multiplexing connection (#1242682)


author: Jakub Jelen <jjelen@redhat.com> 7.0p1-1 + 0.9.3-7
changelog:
  - New upstream release (#1252639)
  - Fix pam_ssh_agent_auth package (#1251777)
  - Security: Use-after-free bug related to PAM support (#1252853)
  - Security: Privilege separation weakness related to PAM support (#1252854)
  - Security: Incorrectly set TTYs to be world-writable (#1252862)


author: Jakub Jelen <jjelen@redhat.com> 7.0p1-2 + 0.9.3-7
changelog:
  - Fix problem with DSA keys using pam_ssh_agent_auth (#1251777)
  - Add GSSAPIKexAlgorithms option for server and client application
  - Possibility to validate legacy systems by more fingerprints (#1249626)


author: Jakub Jelen <jjelen@redhat.com> 7.1p1-3 + 0.9.2-8
changelog:
  - Fix FIPS mode for DH kex (#1260253)
  - Provide full RELRO and PIE form askpass helper (#1264036)
  - Fix gssapi key exchange on server and client (#1261414)
  - Allow gss-keyex root login when without-password is set (upstream #2456)
  - Fix obsolete usage of SELinux constants (#1261496)


author: Jakub Jelen <jjelen@redhat.com> 7.1p1-4 + 0.9.2-8
changelog:
  - Review SELinux user context handling after authentication (#1269072)
  - Handle root logins the same way as other users (#1269072)
  - Audit implicit mac, if mac is covered in cipher (#1271694)
  - Increase size limit for remote glob over sftp


author: Jakub Jelen <jjelen@redhat.com> 7.1p1-6 + 0.9.2-8
changelog:
  - Preserve IUTF8 tty mode flag over ssh connections (#1270248)
  - Do not require sysconfig file to start service (#1279521)
  - Update ssh-copy-id to upstream version
  - GSSAPI Key Exchange documentation improvements
  - Remove unused patches


author: Jakub Jelen <jjelen@redhat.com> 7.1p1-7 + 0.9.2-8
changelog:
  - Change RPM define macros to global according to packaging guidelines
  - Fix wrong handling of SSH_COPY_ID_LEGACY environment variable
  - Update ssh-agent and ssh-keysign permissions (#1296724)
  - Fix few problems with alternative builds without GSSAPI or openSSL
  - Fix condition to run sshd-keygen


author: Jakub Jelen <jjelen@redhat.com> 7.1p2-2 + 0.10.2-1
changelog:
  - Rebased to recent version of pam_ssh_agent_auth
  - Upstream fix for CVE-2016-1908
  - Remove useless defattr


author: Jakub Jelen <jjelen@redhat.com> 7.1p2-3 + 0.10.2-1
changelog:
  - Fix segfaults with pam_ssh_agent_auth (#1303036)
  - Silently disable X11 forwarding on problems
  - Systemd service should be forking to detect immediate failures


author: Jakub Jelen <jjelen@redhat.com> 7.1p2-4.1 + 0.10.2-1
changelog:
  - Fix race condition in auditing events when using multiplexing (#1308295)
  - Fix X11 forwarding CVE according to upstream
  - Fix problem when running without privsep (#1303910)
  - Remove hard glob limit in SFTP


author: Jakub Jelen <jjelen@redhat.com> 7.2p2-2 + 0.10.2-3
changelog:
  - Fix GSSAPI Key Exchange according to RFC (#1323622)
  - Remove init.d/functions dependency from sshd-keygen (#1317722)
  - Do not use MD5 in pam_ssh_agent_auth in FIPS mode


author: Jakub Jelen <jjelen@redhat.com> 7.2p2-3 + 0.10.2-3
changelog:
  - Make sshd-keygen comply with packaging guidelines (#1325535)
  - Soft-deny socket() syscall in seccomp sandbox (#1324493)
  - Remove *sha1 Kex in FIPS mode (#1324493)
  - Remove *gcm ciphers in FIPS mode (#1324493)


author: Jakub Jelen <jjelen@redhat.com> - 7.2p2-5 + 0.10.2-3
changelog:
  - CVE-2015-8325: ignore PAM environment vars when UseLogin=yes (#1328013)
  - Fix typo in sysconfig/sshd (#1325535)


author: Jakub Jelen <jjelen@redhat.com> - 7.2p2-7
changelog:
  - Fix regression in certificate-based authentication (#1333498)
  - Check for real location of .k5login file (#1328243)
  - Fix unchecked dereference in pam_ssh_agent_auth
  - Clean up old patches
  - Build with seccomp filter on ppc64(le) (#1195065)


author: Jakub Jelen <jjelen@redhat.com> - 7.2p2-8 + 0.10.2-3
changelog:
  - Enable seccomp filter for MIPS architectures
  - UseLogin=yes is not supported in Fedora
  - SFTP server forced permissions should restore umask
  - pam_ssh_agent_auth: Fix conflict bewteen two getpwuid() calls (#1349551)


author: Jakub Jelen <jjelen@redhat.com> - 7.2p2-10 + 0.10.2-3
changelog:
  - CVE-2016-6210: User enumeration via covert timing channel (#1357443)
  - Expose more information about authentication to PAM
  - Make closefrom() ignore softlinks to the /dev/ devices on s390


author: Jakub Jelen <jjelen@redhat.com> - 7.3p1-5 + 0.10.2-4
changelog:
  - Build against OpenSSL 1.1.0 with compat changes
  - Recommend crypto-policies
  - Fix chroot dropping capabilities (#1386755)


author: Jakub Jelen <jjelen@redhat.com> - 7.3p1-7 + 0.10.2-4
changelog:
  - Properly deserialize received RSA certificates in ssh-agent (#1402029)
  - Move MAX_DISPLAYS to a configuration option


author: Jakub Jelen <jjelen@redhat.com> - 7.4p1-1 + 0.10.2-5
changelog:
  - New upstream release (#1406204)
  - Cache supported OIDs for GSSAPI key exchange (#1395288)
  - Fix typo causing heap corruption (use-after-free) (#1409433)
  - Prevent hangs with long MOTD


author: Jakub Jelen <jjelen@redhat.com> - 7.4p1-2 + 0.10.2-5
changelog:
  - Fix ssh-agent cert signing error (#1416584)
  - Fix wrong path to crypto policies
  - Attempt to resolve issue with systemd


author: Jakub Jelen <jjelen@redhat.com> - 7.4p1-3 + 0.10.3-1
changelog:
  - Properly report errors from included files (#1408558)
  - New pam_ssh_agent_auth 0.10.3 release
  - Switch to SD_NOTIFY to make systemd happy


author: Jakub Jelen <jjelen@redhat.com> - 7.4p1-4 + 0.10.3-1
changelog:
  - Avoid sending the SD_NOTIFY messages from wrong processes (#1427526)
  - Address reports by coverity


author: Jakub Jelen <jjelen@redhat.com> - 7.5p1-2 + 0.10.3-2
changelog:
  - Fix various after-release typos including failed build in s390x (#1434341)
  - Revert chroot magic with SELinux


author: Jakub Jelen <jjelen@redhat.com> - 7.5p1-4 + 0.10.3-2
changelog:
  - Remove SSH-1 subpackage for Fedora 27 (#1474942)
  - Follow system-wide crypto policy in server (#1479271)


author: Jakub Jelen <jjelen@redhat.com> - 7.5p1-6 + 0.10.3-2
changelog:
  - Do not export KRB5CCNAME if the default path is used (#1199363)
  - Add enablement for openssl-ibmca and openssl-ibmpkcs11 (#1477636)
  - Add new GSSAPI kex algorithms with SHA-2, but leave them disabled for now
  - Enforce pam_sepermit for all logins in SSH (#1492313)
  - Remove pam_reauthorize, since it is not needed by cockpit anymore (#1492313)


author: Jakub Jelen <jjelen@redhat.com> - 7.6p1-1 + 0.10.3-3
changelog:
  - New upstream release OpenSSH 7.6
  - Addressing review remarks for OpenSSL 1.1.0 patch
  - Fix PermitOpen bug in OpenSSH 7.6
  - Drop support for ExposeAuthenticationMethods option


author: Jakub Jelen <jjelen@redhat.com> - 7.6p1-3 + 0.10.3-3
changelog:
  - Do not segfault during audit cleanup (#1524233)
  - Avoid gcc warnings about uninitialized variables


author: Jakub Jelen <jjelen@redhat.com> - 7.6p1-5 + 0.10.3-3
changelog:
  - Drop support for TCP wrappers (#1530163)
  - Do not pass hostnames to audit -- UseDNS is usually disabled (#1534577)


author: Jakub Jelen <jjelen@redhat.com> - 7.7p1-1 + 0.10.3-4
changelog:
  - New upstream release (#1563223)
  - Add support for ECDSA keys in PKCS#11 (#1354510)
  - Add support for PKCS#11 URIs


author: Jakub Jelen <jjelen@redhat.com> - 7.7p1-6 + 0.10.3-4
changelog:
  - Fix listing of kex algoritms in FIPS mode
  - Allow aes-gcm cipher modes in FIPS mode
  - Coverity fixes


author: Jakub Jelen <jjelen@redhat.com> - 7.8p1-2 + 0.10.3-5
changelog:
  - New upstream release fixing CVE 2018-15473
  - Remove unused patches
  - Remove reference to unused enviornment variable SSH_USE_STRONG_RNG
  - Address coverity issues
  - Unbreak scp between two IPv6 hosts (#1620333)
  - Unbreak GSSAPI key exchange (#1624323)
  - Unbreak rekeying with GSSAPI key exchange (#1624344)


author: Jakub Jelen <jjelen@redhat.com> - 7.8p1-3 + 0.10.3-5
changelog:
  - Disable OpenSSH hardening flags and use the ones provided by system (#1630615)
  - Ignore unknown parts of PKCS#11 URI (#1631478)
  - Do not fail with GSSAPI enabled in match blocks (#1580017)
  - Fix the segfaulting cavs test (#1629692)


author: Jakub Jelen <jjelen@redhat.com> - 7.8p1-4 + 0.10.3-5
changelog:
  - Unbreak PKCS#11 URI tests (#1648262)
  - Allow to disable RSA signatures with SHA1 (#1648898)
  - Dump missing GSS options from client configuration (#1649505)
  - Minor fixes from Fedora related to GSSAPI and keberos
  - Follow the system-wide PATH settings


author: Jakub Jelen <jjelen@redhat.com> - 8.0p1-1 + 0.10.3-7
changelog:
  - New upstream release (#1691045)
  - Remove support for unused VendorPatchLevel configuration option
  - Fix kerberos cleanup procedures (#1683295)
  - Do not negotiate arbitrary primes with DH GEX in FIPS (#1685096)
  - Several GSSAPI key exchange improvements and sync with Debian
  - Allow to use labels in PKCS#11 URIs even if they do not match on private key (#1671262)
  - Do not fall back to sshd_net_t SELinux context (#1678695)
  - Use FIPS compliant high-level signature OpenSSL API and KDF
  - Mention crypto-policies in manual pages
  - Do not fail if non-FIPS approved algorithm is enabled in FIPS
  - Generate the PEM files in new PKCS#8 format without the need of MD5 (#1712436)


author: Jakub Jelen <jjelen@redhat.com> - 8.0p1-2 + 0.10.3-7
changelog:
  - Allow specifying a pin-value in PKCS #11 URI in ssh-add (#1639698)
  - Whitelist another syscall variant for s390x cryptographic module (ibmca engine) (#1714915)


author: Jakub Jelen <jjelen@redhat.com> - 8.0p1-3 + 0.10.3-7
changelog:
  - Fix typos in manual pages (#1668325)
  - Use the upstream support for PKCS#8 PEM files alongside with the legacy PEM files (#1712436)
  - Unbreak ssh-keygen -A in FIPS mode (#1732424)
  - Add missing RSA certificate types to offered hostkey types in FIPS mode (#1732449)


author: Jakub Jelen <jjelen@redhat.com> - 8.0p1-5 + 0.10.3-7
changelog:
  - Do not print "no slots" warning by default (#1744220)
  - Unbreak connecting using gssapi through proxy commands (#1749862)
  - Document in manual pages that CASignatureAlgorithms are handled by crypto policies (#1790604)
  - Use SHA2-based signature algorithms by default for signing certificates (#1790610)
  - Prevent simple ProxyJump loops in configuration files (#1804099)
  - Teach ssh-keyscan to use SHA2 RSA variants (#1744108)
  - Do not fail hard if getrandom() is not available and no SSH_USE_STRONG_RNG is specified (#1812120)
  - Improve wording of crypto policies references in manual pages (#1812854)
  - Do not break X11 forwarding if IPv6 is disabled (#1662189)
  - Enable SHA2-based GSSAPI key exchange algorithms by default (#1816226)
  - Mark RDomain server configuration option unsupported in RHEL (#1807686)
  - Clarify crypto policies defaults in manual pages (#1724195)
  - Mention RSA SHA2 variants in ssh-keygen manual page (#1665900)


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.0p1-7 + 0.10.3-7
changelog:
  - SFTP sort upon the modification time (#1909988)
  - ssh-keygen printing fingerprint issue with Windows keys (#1901518)
  - PIN is lost when iterating over tokens when adding pkcs11 keys to ssh-agent (#1843372)
  - ssh-agent segfaults during ssh-add -s pkcs11 (#1868996)
  - ssh-copy-id could not resolve ipv6 address ends with colon (#1933517)
  - sshd provides PAM an incorrect error code (#1879503)


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.0p1-9
changelog:
  - CVE-2020-14145 openssh: Observable Discrepancy leading to an information
    leak in the algorithm negotiation (#1882252)
  - Hostbased ssh authentication fails if session ID contains a '/' (#1944125)


author: Zoltan Fridrich <zfridric@redhat.com> - 8.0p1-14
changelog:
  - Upstream: add a local implementation of BSD realpath() for sftp-server (#2064249)
  - Change product name from Fedora to RHEL in openssh-7.8p1-UsePAM-warning.patch (#1953807)
  - Include caveat for crypto-policy in sshd manpage (#2044354)
  - Change log level of FIPS specific log message to verbose (#2050511)
  - Clarify force_file_perms (-m) documentation in sftp-server manpage (#1862504)
  - Minimize the use of SHA1 as a proof of possession for RSA key (#2093897)


author: Sahana Prasad <sahana@redhat.com> - 1:1.1.1k-4
changelog:
  - Fixes bugs in s390x AES code.
  - Uses the first detected address family if IPv6 is not available
  - Reverts the changes in https://github.com/openssl/openssl/pull/13305
    as it introduces a regression if server has a DSA key pair, the handshake fails
    when the protocol is not explicitly set to TLS 1.2. However, if the patch is reverted,
    it has an effect on the "ssl_reject_handshake" feature in nginx. Although, this feature
    will continue to work, TLS 1.3 protocol becomes unavailable/disabled. This is already
    known - https://trac.nginx.org/nginx/ticket/2071#comment:1
    As per https://github.com/openssl/openssl/issues/16075#issuecomment-879939938, nginx
    could early callback instead of servername callback.
  - Resolves: rhbz#1978214
  - Related: rhbz#1934534


author: Sahana Prasad <sahana@redhat.com> - 1:1.1.1k-5
changelog:
  - Fixes CVE-2021-3712 openssl: Read buffer overruns processing ASN.1 strings
  - Resolves: rhbz#2005402


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-6
changelog:
  - Fixes CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  - Resolves: rhbz#2067146


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-7
changelog:
  - Fix CVE-2022-2097: AES OCB fails to encrypt some bytes on 32-bit x86
    Resolves: CVE-2022-2097
  - Update expired certificates used in the testsuite
    Resolves: rhbz#2092462
  - Fix CVE-2022-1292: openssl: c_rehash script allows command injection
    Resolves: rhbz#2090372
  - Fix CVE-2022-2068: the c_rehash script allows command injection
    Resolves: rhbz#2098279


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.1.1k-9
changelog:
  - Fixed Timing Oracle in RSA Decryption
    Resolves: CVE-2022-4304
  - Fixed Double free after calling PEM_read_bio_ex
    Resolves: CVE-2022-4450
  - Fixed Use-after-free following BIO_new_NDEF
    Resolves: CVE-2023-0215
  - Fixed X.400 address type confusion in X.509 GeneralName
    Resolves: CVE-2023-0286


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-10
changelog:
  - Fix CVE-2023-3446: Excessive time spent checking DH keys and parameters
    Resolves: RHEL-14245
  - Fix CVE-2023-3817: Excessive time spent checking DH q parameter value
    Resolves: RHEL-14239


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-11
changelog:
  - Fix CVE-2023-5678: Generating excessively long X9.42 DH keys or checking
    excessively long X9.42 DH keys or parameters may be very slow
    Resolves: RHEL-16538


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.1.1k-12
changelog:
  - Backport implicit rejection mechanism for RSA PKCS#1 v1.5 to RHEL-8 series
    (a proper fix for CVE-2020-25659)
    Resolves: RHEL-17696


author: Bernhard Rosenkrdnzer <bero@redhat.de>
changelog:
  - inital packaging
  - changes from base:
    - Move /usr/local/ssl to /usr/share/ssl for FHS compliance
    - handle RPM_OPT_FLAGS


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 0.9.5a, modified for U.S.
  - add perl as a build-time requirement
  - move certificate makefile to another package
  - disable RC5, IDEA, RSA support
  - remove optimizations for now


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - byte-compile python extensions without the build-root
  - adjust the makefile to not remove temporary files (like .key files when
    building .csr files) by marking them as .PRECIOUS


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - remove -Wa,* and -m* compiler flags from the default Configure file (#20656)
  - add the CA.pl man page to the perl subpackage


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - disable some inline assembly, which on x86 is Pentium-specific
  - re-enable MD2 (see http://www.ietf.org/ietf/IPR/RSA-MD-all)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - re-disable MD2 -- the EVP_MD_CTX structure would grow from 100 to 152
    bytes or so, causing EVP_DigestInit() to zero out stack variables in
    apps built against a version of the library without it


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 0.9.6
  - enable MD2
  - use the libcrypto.so and libssl.so targets to build shared libs with
  - bump the soversion to 1 because we're no longer compatible with any of
    the various 0.9.5a packages circulating around, which provide lib*.so.0


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 0.9.6a
  - use the build-shared target to build shared libraries
  - bump the soversion to 2 because we're no longer compatible with
    our 0.9.5a packages or our 0.9.6 packages
  - drop the patch for making rsatest a no-op when rsa null support is used
  - put all man pages into <section>ssl instead of <section>
  - break the m2crypto modules into a separate package


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add a script for creating dummy certificates
  - move man pages from %{_mandir}/man?/foo.?ssl to %{_mandir}/man?ssl/foo.?


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-3
changelog:
  - add patches for AEP hardware support
  - add patch to keep trying when we fail to load a cert from a file and
    there are more in the file
  - add missing prototype for ENGINE_ubsec() in engine_int.h


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-4
changelog:
  - move man pages back to %{_mandir}/man?/foo.?ssl from
    %{_mandir}/man?ssl/foo.?
  - add an [ engine ] section to the default configuration file


author: Gary Benson <gbenson@redhat.com> stronghold-0.9.6c-1
changelog:
  - upgrade to 0.9.6c
  - bump BuildArch to i686 and enable assembler on all platforms
  - synchronise with shrimpy and rawhide
  - bump soversion to 3


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-30
changelog:
  - add configuration stanza for x86_64 and use it on x86_64
  - build for linux-ppc on ppc
  - start running the self-tests again


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.7-6
changelog:
  - EVP_DecryptInit should call EVP_CipherInit() instead of EVP_CipherInit_ex(),
    to get the right behavior when passed uninitialized context structures
    (#83766)
  - build with -mcpu=ev5 on alpha family (#83828)


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.7-8
changelog:
  - add fix to guard against attempts to allocate negative amounts of memory
  - add patch for CAN-2003-0078, fixing a timing attack


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-5
changelog:
  - add patch to harden against Klima-Pokorny-Rosa extension of Bleichenbacher's
    attack (CAN-2003-0131)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - backport fix for engine-used-for-everything from 0.9.7b
  - backport fix for prng not being seeded causing problems, also from 0.9.7b
  - add a check at build-time to ensure that RSA is thread-safe
  - keep perlpath from stomping on the libica configure scripts


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add security fixes for protocol parsing bugs (CAN-2003-0543, CAN-2003-0544)
    and heap corruption (CAN-2003-0545)
  - update RHNS-CA-CERT files
  - ease back on the number of threads used in the threading test


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-22
changelog:
  - add -Wa,--noexecstack to RPM_OPT_FLAGS so that assembled modules get tagged
    as not needing executable stacks


author: Phil Knirsch <pknirsch@redhat.com> 0.9.7a-24
changelog:
  - Use /dev/urandom instead of PRNG for libica.
  - Apply libica-1.3.5 fix for /dev/urandom in icalinux.c
  - Use latest ICA engine patch from IBM.


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-25
changelog:
  - add dependency on zlib-devel for the -devel package, which depends on zlib
    symbols because we enable zlib for libssl (#102962)


author: Joe Orton <jorton@redhat.com> 0.9.7a-27
changelog:
  - updated ca-bundle.crt: removed expired GeoTrust roots, added
    freessl.com root, removed trustcenter.de Class 0 root


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-33
changelog:
  - add an intermediate <openssl/opensslconf.h> which points to the right
    arch-specific opensslconf.h on multilib arches


author: Tomas Mraz <tmraz@redhat.com> 0.9.7e-1
changelog:
  - new upstream source, updated patches
  - added patch so we are hopefully ABI compatible with upcoming
    0.9.7f


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-1
changelog:
  - reenable optimizations on ppc64 and assembly code on ia64
  - upgrade to new upstream version (no soname bump needed)
  - disable thread test - it was testing the backport of the
    RSA blinding - no longer needed
  - added support for changing serial number to
    Makefile.certificate (#151188)
  - make ca-bundle.crt a config file (#118903)


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-2
changelog:
  - add back RC4_CHAR on ia64 and x86_64 so the ABI isn't broken
  - disable broken bignum assembly on x86_64


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-3
changelog:
  - uninitialized variable mustn't be used as input in inline
    assembly
  - reenable the x86_64 assembly again


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-4
changelog:
  - move certificates to _sysconfdir/pki/tls (#143392)
  - move CA directories to _sysconfdir/pki/CA
  - patch the CA script and the default config so it points to the
    CA directories


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-6
changelog:
  - use poll instead of select in rand (#128285)
  - fix Makefile.certificate to point to /etc/pki/tls
  - change the default string mask in ASN1 to PrintableString+UTF8String


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-7
changelog:
  - fix CAN-2005-0109 - use constant time/memory access mod_exp
    so bits of private key aren't leaked by cache eviction (#157631)
  - a few more fixes from upstream 0.9.7g


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-9
changelog:
  - add *.so.soversion as symlinks in /lib (#165264)
  - remove unpackaged symlinks (#159595)
  - fixes from upstream (constant time fixes for DSA,
    bn assembler div on ppc arch, initialize memory on realloc)


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-10
changelog:
  - fix CAN-2005-2969 - remove SSL_OP_MSIE_SSLV2_RSA_PADDING which
    disables the countermeasure against man in the middle attack in SSLv2
    (#169863)
  - use sha1 as default for CA and cert requests - CAN-2005-2946 (#169803)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8a-4
changelog:
  - fix build (-lcrypto was erroneusly dropped) of the updated libica
  - updated ICA engine to 1.3.6-rc3


author: Tomas Mraz <tmraz@redhat.com> - 0.9.8a-6
changelog:
  - fix stale open handles in libica (#177155)
  - fix build if 'rand' or 'passwd' in buildroot path (#178782)
  - initialize VIA Padlock engine (#186857)


author: Tomas Mraz <tmraz@redhat.com> - 0.9.8b-1
changelog:
  - upgrade to new version, stays ABI compatible
  - there is no more linux/config.h (it was empty anyway)


author: Tomas Mraz <tmraz@redhat.com>
changelog:
  - add ipv6 support to s_client and s_server (by Jan Pazdziora) (#198737)
  - add patches for BN threadsafety, AES cache collision attack hazard fix and
    pkcs7 code memleak fix from upstream CVS


author: Tomas Mraz <tmraz@redhat.com> 0.9.8b-7
changelog:
  - fix CVE-2006-2937 - mishandled error on ASN.1 parsing (#207276)
  - fix CVE-2006-2940 - parasitic public keys DoS (#207274)
  - fix CVE-2006-3738 - buffer overflow in SSL_get_shared_ciphers (#206940)
  - fix CVE-2006-4343 - sslv2 client DoS (#206940)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8b-13
changelog:
  - allow building on ARM architectures (#245417)
  - use reference timestamps to prevent multilib conflicts (#218064)
  - -devel package must require pkgconfig (#241031)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8b-14
changelog:
  - use localhost in testsuite, hopefully fixes slow build in koji
  - CVE-2007-3108 - fix side channel attack on private keys (#250577)
  - make ssl session cache id matching strict (#233599)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8b-16
changelog:
  - fix CVE-2007-5135 - off-by-one in SSL_get_shared_ciphers (#309801)
  - fix CVE-2007-4995 - out of order DTLS fragments buffer overflow (#321191)
  - add alpha sub-archs (#296031)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8g-2
changelog:
  - enable some new crypto algorithms and features
  - add some more important bug fixes from openssl CVS


author: Tomas Mraz <tmraz@redhat.com> 0.9.8g-3
changelog:
  - set default paths when no explicit paths are set (#418771)
  - do not add tls extensions to client hello for SSLv3 (#422081)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8g-9
changelog:
  - fix CVE-2008-0891 - server name extension crash (#448492)
  - fix CVE-2008-1672 - server key exchange message omit crash (#448495)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8j-1
changelog:
  - new upstream version with necessary soname bump (#455753)
  - temporarily provide symlink to old soname to make it possible to rebuild
    the dependent packages in rawhide
  - add eap-fast support (#428181)
  - add possibility to disable zlib by setting
  - add fips mode support for testing purposes
  - do not null dereference on some invalid smime files
  - add buildrequires pkgconfig (#479493)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8j-6
changelog:
  - drop the temporary triggerpostun and symlinking in post
  - fix the pkgconfig files and drop the unnecessary buildrequires
    on pkgconfig as it is a rpmbuild dependency (#481419)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8j-7
changelog:
  - must also verify checksum of libssl.so in the FIPS mode
  - obtain the seed for FIPS rng directly from the kernel device
  - drop the temporary symlinks


author: Tomas Mraz <tmraz@redhat.com> 0.9.8k-1
changelog:
  - update to new upstream release (minor bug fixes, security
    fixes and machine code optimizations only)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8k-6
changelog:
  - abort if selftests failed and random number generator is polled
  - mention EVP_aes and EVP_sha2xx routines in the manpages
  - add README.FIPS
  - make CA dir absolute path (#445344)
  - change default length for RSA key generation to 2048 (#484101)


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-0.11.beta4
changelog:
  - update to new upstream version, no soname bump needed
  - fix CVE-2009-3555 - note that the fix is bypassed if SSL_OP_ALL is used
    so the compatibility with unfixed clients is not broken. The
    protocol extension is also not final.


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-0.12.beta4
changelog:
  - keep the beta status in version number at 3 so we do not have to rebuild
    openssh and possibly other dependencies with too strict version check


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-0.13.beta4
changelog:
  - disable enforcement of the renegotiation extension on the client (#537962)
  - add fixes from the current upstream snapshot


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-0.17.beta4
changelog:
  - upstream fix compression handling on session resumption
  - various null checks and other small fixes from upstream
  - upstream changes for the renegotiation info according to the latest draft


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-0.19.beta4
changelog:
  - fix CVE-2009-4355 - leak in applications incorrectly calling
    CRYPTO_free_all_ex_data() before application exit (#546707)
  - upstream fix for future TLS protocol version handling


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-0.21.beta5
changelog:
  - gracefully handle zero length in assembler implementations of
    OPENSSL_cleanse (#564029)
  - do not fail in s_server if client hostname not resolvable (#561260)


author: Tomas Mraz <tmraz@redhat.com> 1.0.0c-2
changelog:
  - listen on ipv6 wildcard in s_server so we accept connections
    from both ipv4 and ipv6 (#601612)
  - fix openssl speed command so it can be used in the FIPS mode
    with FIPS allowed ciphers


author: Tomas Mraz <tmraz@redhat.com> 1.0.0c-3
changelog:
  - add -x931 parameter to openssl genrsa command to use the ANSI X9.31
    key generation method
  - use FIPS-186-3 method for DSA parameter generation
  - add OPENSSL_FIPS_NON_APPROVED_MD5_ALLOW environment variable
    to allow using MD5 when the system is in the maintenance state
    even if the /proc fips flag is on
  - make openssl pkcs12 command work by default in the FIPS mode


author: Tomas Mraz <tmraz@redhat.com> 1.0.0d-3
changelog:
  - add support for VIA Padlock on 64bit arch from upstream (#617539)
  - do not return bogus values from load_certs (#652286)


author: Tomas Mraz <tmraz@redhat.com> 1.0.0d-6
changelog:
  - add support for newest Intel acceleration improvements backported
    from upstream by Intel in form of a separate engine


author: Tomas Mraz <tmraz@redhat.com> 1.0.0d-7
changelog:
  - correct openssl cms help output (#636266)
  - more tolerant starttls detection in XMPP protocol (#608239)


author: Tomas Mraz <tmraz@redhat.com> 1.0.0d-8
changelog:
  - drop the separate engine for Intel acceleration improvements
    and merge in the AES-NI, SHA1, and RC4 optimizations
  - add support for OPENSSL_DISABLE_AES_NI environment variable
    that disables the AES-NI support


author: Tomas Mraz <tmraz@redhat.com> 1.0.0e-3
changelog:
  - do not use AVX instructions when osxsave bit not set
  - add direct known answer tests for SHA2 algorithms


author: Tomas Mraz <tmraz@redhat.com> 1.0.0g-1
changelog:
  - new upstream release fixing CVE-2012-0050 - DoS regression in
    DTLS support introduced by the previous release (#782795)


author: Tomas Mraz <tmraz@redhat.com> 1.0.1-0.1.beta2
changelog:
  - new upstream release from the 1.0.1 branch, ABI compatible
  - add documentation for the -no_ign_eof option


author: Tomas Mraz <tmraz@redhat.com> 1.0.1-0.2.beta3
changelog:
  - epoch bumped to 1 due to revert to 1.0.0g on Fedora 17
  - new upstream release from the 1.0.1 branch
  - fix s390x build (#798411)
  - versioning for the SSLeay symbol (#794950)
  - add -DPURIFY to build flags (#797323)
  - filter engine provides
  - split the libraries to a separate -libs package
  - add make to requires on the base package (#783446)


author: Tomas Mraz <tmraz@redhat.com> 1.0.1c-3
changelog:
  - fix DSA key generation in FIPS mode (#833866)
  - allow duplicate FIPS_mode_set(1)
  - enable build on ppc64 subarch (#834652)


author: Tomas Mraz <tmraz@redhat.com> 1.0.1c-4
changelog:
  - do not move libcrypto to /lib
  - do not use environment variables if __libc_enable_secure is on
  - fix strict aliasing problems in modes


author: Tomas Mraz <tmraz@redhat.com> 1.0.1c-7
changelog:
  - add missing initialization of str in aes_ccm_init_key (#853963)
  - add important patches from upstream CVS
  - use the secure_getenv() with new glibc


author: Tomas Mraz <tmraz@redhat.com> 1.0.1c-8
changelog:
  - use 1024 bit DH parameters in s_server as 512 bit is not allowed
    in FIPS mode and it is quite weak anyway


author: Tomas Mraz <tmraz@redhat.com> 1.0.1c-11
changelog:
  - add script for renewal of a self-signed cert by Philip Prindeville (#871566)
  - allow X509_issuer_and_serial_hash() produce correct result in
    the FIPS mode (#881336)


author: Kyle McMartin <kyle@redhat.com> 1.0.1e-21
changelog:
  - [arm] use elf auxv to figure out armcap.c instead of playing silly
    games with SIGILL handlers. (#1006474)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-26
changelog:
  - make DTLS1 work in FIPS mode
  - avoid RSA and DSA 512 bits and Whirlpool in 'openssl speed' in FIPS mode


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-32
changelog:
  - disable verification of certificate, CRL, and OCSP signatures
    using MD5 if OPENSSL_ENABLE_MD5_VERIFY environment variable
    is not set


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-35
changelog:
  - drop weak ciphers from the default TLS ciphersuite list
  - add back some symbols that were dropped with update to 1.0.1 branch
  - more FIPS validation requirement changes


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-36
changelog:
  - fix CVE-2013-6449 - crash when version in SSL structure is incorrect
  - more FIPS validation requirement changes


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-37
changelog:
  - fix CVE-2013-4353 - Invalid TLS handshake crash
  - fix CVE-2013-6450 - possible MiTM attack on DTLS1


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-39
changelog:
  - make expiration and key length changeable by DAYS and KEYLEN
    variables in the certificate Makefile (#1058108)
  - change default hash to sha256 (#1062325)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-40
changelog:
  - print ephemeral key size negotiated in TLS handshake (#1057715)
  - add DH_compute_key_padded needed for FIPS CAVS testing


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1g-1
changelog:
  - new upstream release 1.0.1g
  - do not include ECC ciphersuites in SSLv2 client hello (#1090952)
  - fail on hmac integrity check if the .hmac file is empty


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1h-3
changelog:
  - make FIPS mode keygen bit length restriction enforced only when
    OPENSSL_ENFORCE_MODULUS_BITS is set
  - fix CVE-2014-0224 fix that broke EAP-FAST session resumption support


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1h-5
changelog:
  - disable SSLv2 and SSLv3 protocols by default (can be enabled
    via appropriate SSL_CTX_clear_options() call)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1i-1
changelog:
  - new upstream release fixing multiple moderate security issues
  - for now disable only SSLv2 by default


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1j-3
changelog:
  - disable SSLv3 by default again (mail servers and possibly
    LDAP servers should probably allow it explicitly for legacy
    clients)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1k-2
changelog:
  - test in the non-FIPS RSA keygen for minimal distance of p and q
    similarly to the FIPS RSA keygen


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1k-6
changelog:
  - fix CVE-2015-0209 - potential use after free in d2i_ECPrivateKey()
  - fix CVE-2015-0286 - improper handling of ASN.1 boolean comparison
  - fix CVE-2015-0287 - ASN.1 structure reuse decoding memory corruption
  - fix CVE-2015-0289 - NULL dereference decoding invalid PKCS#7 data
  - fix CVE-2015-0293 - triggerable assert in SSLv2 server


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1k-7
changelog:
  - drop the AES-GCM restriction of 2^32 operations because the IV is
    always 96 bits (32 bit fixed field + 64 bit invocation field)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2e-1
changelog:
  - minor upstream release 1.0.2e fixing moderate severity security issues
  - enable fast assembler implementation for NIST P-256 and P-521
    elliptic curves (#1164210)
  - filter out unwanted link options from the .pc files (#1257836)
  - do not set serial to 0 in Makefile.certificate (#1135719)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2f-1
changelog:
  - minor upstream release 1.0.2f fixing security issues
  - add support for MIPS secondary architecture


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2g-2
changelog:
  - reenable SSL2 in the build to avoid ABI break (it does not
    make the openssl vulnerable to DROWN attack)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2i-1
changelog:
  - minor upstream release 1.0.2i fixing security issues
  - move man pages for perl based scripts to perl subpackage (#1377617)


author: Tomáš Mráz <tmraz@redhat.com> 1.1.0b-4
changelog:
  - use a random seed if the supplied one did not generate valid
    parameters in dsa_builtin_paramgen2()


author: Tomáš Mráz <tmraz@redhat.com> 1.1.0c-2
changelog:
  - EC curve NIST P-224 is now allowed, still kept disabled in TLS due
    to less than optimal security


author: Tomáš Mráz <tmraz@redhat.com> 1.1.0c-3
changelog:
  - revert SSL_read() behavior change - patch from upstream (#1394677)
  - fix behavior on client certificate request in renegotiation (#1393579)


author: Tomáš Mráz <tmraz@redhat.com> 1.1.0e-1
changelog:
  - update to upstream version 1.1.0e
  - add documentation of the PROFILE=SYSTEM special cipher string (#1420232)


author: Tomáš Mráz <tmraz@redhat.com> 1.1.0f-1
changelog:
  - update to upstream version 1.1.0f
  - SRP and GOST is now allowed, note that GOST support requires
    adding GOST engine which is not part of openssl anymore


author: Petr Pisar <ppisar@redhat.com> - 1:1.1.0f-6
changelog:
  - perl dependency renamed to perl-interpreter
    <https://fedoraproject.org/wiki/Changes/perl_Package_to_Install_Core_Modules>


author: Tomáš Mráz <tmraz@redhat.com> 1.1.0g-6
changelog:
  - one more try to apply RPM_LD_FLAGS properly (#1541033)
  - dropped unneeded starttls xmpp patch (#1417017)


author: Tomáš Mráz <tmraz@redhat.com> 1.1.1-1
changelog:
  - update to the final 1.1.1 version
  - for consistent support of security policies we build
    RC4 support in TLS (not default) and allow SHA1 in SECLEVEL 2
  - use only /dev/urandom if getrandom() is not available
  - disable SM4


author: Tomáš Mráz <tmraz@redhat.com> 1.1.1b-1
changelog:
  - update to the 1.1.1b release
  - EVP_KDF API backport from master
  - SSH KDF implementation for EVP_KDF API backport from master
  - add S390x chacha20-poly1305 assembler support from master branch


author: Tomáš Mráz <tmraz@redhat.com> 1.1.1c-2
changelog:
  - do not try to use EC groups disallowed in FIPS mode
    in TLS
  - fix Valgrind regression with constant-time code


author: Tomáš Mráz <tmraz@redhat.com> 1.1.1c-6
changelog:
  - backport of S390x ECC CPACF enhancements from master
  - FIPS mode: properly disable 1024 bit DSA key generation
  - FIPS mode: skip ED25519 and ED448 algorithms in openssl speed
  - FIPS mode: allow AES-CCM ciphersuites


author: Tomáš Mráz <tmraz@redhat.com> 1.1.1c-8
changelog:
  - fix CVE-2019-1547 - side-channel weak encryption vulnerability
  - fix CVE-2019-1563 - padding oracle in CMS API
  - fix CVE-2019-1549 - ensure fork safety of the DRBG
  - fix handling of non-FIPS allowed EC curves in FIPS mode
  - fix TLS compliance issues


author: Tomáš Mráz <tmraz@redhat.com> 1.1.1c-14
changelog:
  - fix incorrect error return value from FIPS_selftest_dsa
  - S390x: properly restore SIGILL signal handler


author: Tomáš Mráz <tmraz@redhat.com> 1.1.1g-7
changelog:
  - Disallow dropping Extended Master Secret extension
    on renegotiation
  - Return alert from s_server if ALPN protocol does not match
  - SHA1 is allowed in @SECLEVEL=2 only if allowed by
    TLS SigAlgs configuration


author: Tomáš Mráz <tmraz@redhat.com> 1.1.1g-9
changelog:
  - Rewire FIPS_drbg API to use the RAND_DRBG
  - Use the well known DH groups in TLS even for 2048 and 1024 bit parameters


author: Tomáš Mráz <tmraz@redhat.com> 1.1.1g-12
changelog:
  - Implemented new FIPS requirements in regards to KDF and DH selftests
  - Disallow certificates with explicit EC parameters


author: Sahana Prasad <sahana@redhat.com> 1.1.1g-14
changelog:
  - Fix CVE-2021-3450 openssl: CA certificate check bypass with
    X509_V_FLAG_X509_STRICT
  - Fix CVE-2021-3449 NULL pointer deref in signature_algorithms processing


author: Daiki Ueno <dueno@redhat.com> 1.1.1g-16
changelog:
  - Use AI_ADDRCONFIG only when explicit host name is given
  - Allow only curves defined in RFC 8446 in TLS 1.3


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.1.1k-2
changelog:
  - Fixes FIPS_selftest to work in FIPS mode. Resolves: rhbz#1940085
  - Using safe primes for FIPS DH self-test


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-6
changelog:
  - Fixes CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  - Resolves: rhbz#2067145


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-7
changelog:
  - Fix CVE-2022-2097: AES OCB fails to encrypt some bytes on 32-bit x86
    Resolves: CVE-2022-2097
  - Update expired certificates used in the testsuite
    Resolves: rhbz#2100554
  - Fix CVE-2022-1292: openssl: c_rehash script allows command injection
    Resolves: rhbz#2090371
  - Fix CVE-2022-2068: the c_rehash script allows command injection
    Resolves: rhbz#2098278


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.1.1k-9
changelog:
  - Fixed Timing Oracle in RSA Decryption
    Resolves: CVE-2022-4304
  - Fixed Double free after calling PEM_read_bio_ex
    Resolves: CVE-2022-4450
  - Fixed Use-after-free following BIO_new_NDEF
    Resolves: CVE-2023-0215


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-10
changelog:
  - Fix CVE-2023-3446: Excessive time spent checking DH keys and parameters
    Resolves: RHEL-14243
  - Fix CVE-2023-3817: Excessive time spent checking DH q parameter value
    Resolves: RHEL-14237


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-11
changelog:
  - Fix CVE-2023-5678: Generating excessively long X9.42 DH keys or checking
    excessively long X9.42 DH keys or parameters may be very slow
    Resolves: RHEL-16536


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.1.1k-12
changelog:
  - Backport implicit rejection mechanism for RSA PKCS#1 v1.5 to RHEL-8 series
    (a proper fix for CVE-2020-25659)
    Resolves: RHEL-17694


author: Anderson Sasaki <ansasaki@redhat.com> - 0.4.8-1
changelog:
  - Update to 0.4.8-1
  - RSA key generation on the token
  - RSA-OAEP and RSA-PKCS encryption support
  - RSA-PSS signature support
  - Support for OpenSSL 1.1.1 beta
  - Removed support for OpenSSL 0.9.8
  - Various bug fixes and enhancements


author: Anderson Sasaki <ansasaki@redhat.com> - 0.4.8-2
changelog:
  - Require OpenSSL >= 1.0.2
  - Fixed missing declaration of ERR_get_CKR_code()
  - Add support to use EC keys and tests (#1625338)
  - Exposed check_fork() API
  - Fixed memory leak of RSA objects in pkcs11_store_key()
  - Updated OpenSSL license in eng_front.c
  - Fixed build for old C dialects
  - Allow engine to use private key without PIN
  - Require DEBUG to be defined to print debug messages
  - Changed package description


author: Anderson Sasaki <ansasaki@redhat.com> - 0.4.10-1
changelog:
  - Update to 0.4.10 (#1745082)
  - Add BuildRequires for OpenSSL >= 1.0.2, required for testing
  - Print tests logs if failed during build
  - Small bug fixes such as removal of unused variable
  - Search objects in all matching tokens (#1705505)


author: Neal Gompa <ngompa13@gmail.com> - 1.74-1
changelog:
  - Update to upstream version 1.74
  - Drop merged patches
  - Rediff remaining patches
  - Move newns to /usr/libexec/os-prober (debuginfo generation works)
  - Mark copyright file as license file


author: Peter Jones <pjones@redhat.com> - 1.74-7
changelog:
  - Make gcc use -Wl,-z,now -Wl,-z,relro -pie.  Dunno why the default didn't
    pick this up.
    Resolves: rhbz#1624158


author: Daiki Ueno <dueno@redhat.com> - 0.23.21-4
changelog:
  - Fix realloc usage on proxy cleanup (#1894979)
  - Make 'trust anchor --store' preserve all attributes from .p11-kit files


author: Daiki Ueno <dueno@redhat.com> - 0.23.22-1
changelog:
  - Rebase to 0.23.22 to fix memory safety issues (CVE-2020-29361, CVE-2020-29362, and CVE-2020-29363)
  - Preserve DT_NEEDED information from the previous version, flagged by rpmdiff
  - Add xsltproc to BR


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.3.1-25
changelog:
  - pam_motd: avoid unnecessary logging. Resolves: #2091062
  - pam_lastlog: check localtime_r() return value. Resolves: #2012871
  - pam_faillock: clarify missing user faillock files after reboot. Resolves: #2062512
  - pam_faillock: avoid logging an erroneous consecutive login failure message. Resolves: #2082442


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.3.1-33
changelog:
  - pam_namespace: protect_dir(): use O_DIRECTORY to prevent local DoS
    situations. CVE-2024-22365. Resolves: RHEL-21242


author: Michael K. Johnson <johnsonm@redhat.com>
changelog:
  - changed /dev/cdrom default user permissions back to 0600 in console.perms
    because some cdrom players open O_RDWR.


author: Michael K. Johnson <johnsonm@redhat.com>
changelog:
  - fixed glob/regexp confusion in pam_console, added kbd and fixed fb devices
  - added pam_xauth module


author: Michael K. Johnson <johnsonm@redhat.com>
changelog:
  - many bug fixes in pam_xauth
  - pam_console can now handle broken applications that do not set
    the PAM_TTY item.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 0.72
  - fix pam_unix password-changing bug
  - fix pam_unix's cracklib support
  - change package URL


author: Elliot Lee <sopwith@redhat.com>
changelog:
  - Add a patch to accept 'pts/N' in /etc/securetty as a match for tty '5'
    (which is what other pieces of the system think it is). Fixes bug #7641.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Add new pam_stack module.
  - Install pwdb_chkpwd and unix_chkpwd as the current user for non-root builds


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add system-auth control file
  - let gethostname() call in pam_access.c be implicitly declared to avoid
    conflicting types if unistd.c declares it


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add account management wrappers for pam_listfile, pam_nologin, pam_securetty,
    pam_shells, and pam_wheel


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - symlink libpam.so to libpam.so.%{version}, and likewise for libpam_misc
  - reverse order of checks in _unix_getpwnam for pam_unix


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix installation of pam_xauth man pages (#12417)
  - forcibly strip helpers (#12430)
  - try to make pam_console a little more discriminating


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - make pam_console's extra checks disableable
  - simplify extra check to just check if the device owner is root
  - add a debug log when pam_stack comes across a NULL item
  - have pam_stack hand items up to the parent from the child


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - need to make pam_console's checking a little stronger
  - only pass data up from pam_stack if the parent didn't already define it


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add a broken_shadow option to pam_unix
  - add all module README files to the documentation list (#16456)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - move pam_filter modules to /lib/security/pam_filter (#16111)
  - add pam_tally's application to allow counts to be reset (#16456)
  - move README files to the txts subdirectory


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - give users /dev/cdrom* instead of /dev/cdrom in console.perms (#16768)
  - add nvidia control files to console.perms


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix problems when looking for headers in /usr/include (#17236)
  - clean up a couple of compile warnings


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - modify the files list to make sure #16456 stays fixed
  - make pam_stack track PAM_AUTHTOK and PAM_OLDAUTHTOK items
  - add pam_chroot module
  - self-hosting fixes from the -devel split
  - update generated docs in the tree


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - patch from Dmitry V. Levin to have pam_stack propagate the PAM fail_delay
  - roll back the README for pam_xauth to actually be the right one
  - tweak pam_stack to use the parent's service name when calling the substack


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - tweak pre script to be called in all upgrade cases
  - get pam_unix to only care about the significant pieces of passwords it checks
  - add /usr/include/db1/db.h as a build prereq to pull in the right include
    files, no matter whether they're in glibc-devel or db1-devel
  - pam_userdb.c: include db1/db.h instead of db.h


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add RLIMIT_LOCKS to pam_limits (patch from Jes Sorensen) (#20542)
  - link pam_userdb to Berkeley DB 2.x to match 6.2's setup correctly


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix similar() function in pam_cracklib (#14740)
  - fix example in access.conf (#21467)
  - add conditional compilation for building for 6.2 (for pam_userdb)
  - tweak post to not use USESHADOW any more


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix handling of "nis" when changing passwords by adding the checks for the
    data source to the password-updating module in pam_unix
  - add the original copyright for pam_access (fix from Michael Gerdts)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - merge to 0.74
  - make console.perms match perms set by MAKEDEV, and add some devfs device names
  - add 'sed' to the buildprereq list (#24666)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - actually time out when attempting to lckpwdf() (#25889)
  - include time.h in pam_issue (#25923)
  - update the default system-auth to the one generated by authconfig 4.1.1
  - handle getpw??? and getgr??? failures more gracefully (#26115)
  - get rid of some extraneous {set,end}{pw,gr}ent() calls


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_limits: change the documented default config file to reflect the defaults
  - pam_limits: you should be able to log in a total of maxlogins times, not
    (maxlogins - 1)
  - handle group limits on maxlogins correctly (#25690)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - own /etc/security
  - be more descriptive when logging messages from pam_limits
  - pam_listfile: remove some debugging code (#28346)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add pam_console_apply
  - /dev/pilot's usually a serial port (or a USB serial port), so revert its
    group to 'uucp' instead of 'tty' in console.perms
  - change pam_console's behavior wrt directories -- directories which are
    mount points according to /etc/fstab are taken to be synonymous with
    their device special nodes, and directories which are not mount points
    are ignored


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_console: error out on undefined classes in pam_console config file
  - console.perms: actually change the permissions on the new device classes
  - pam_console: add an fstab= argument, and -f and -c flags to pam_console_apply
  - pam_console: use g_log instead of g_critical when bailing out
  - console.perms: logins on /dev/vc/* are also console logins, from Douglas
    Gilbert via Tim Waugh


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_wheel: make 'trust' and 'deny' work together correctly
  - pam_wheel: also check the user's primary gid
  - pam_group: also initialize groups when called with PAM_REINITIALIZE_CRED


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - remove /dev/dri from console.perms -- XFree86 munges it, so it's outside of
    our control (reminder from Daryll Strauss)
  - add /dev/3dfx to console.perms


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - merge up to 0.75
  - pam_unix: temporarily ignore SIGCHLD while running the helper
  - pam_pwdb: temporarily ignore SIGCHLD while running the helper
  - pam_dispatch: default to uncached behavior if the cached chain is empty


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_access: compare IP addresses with the terminating ".", as documented
    (patch from Carlo Marcelo Arenas Belon, I think) (#16505)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - console.perms: add apm_bios to the list of devices the console owner can use
  - console.perms: add beep to the list of sound devices


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - console.perms: change js* to js[0-9]*
  - include pam_aconf.h in more modules (patches from Harald Welte)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_console: fix logic bug when changing permissions on single
    file and/or lists of files
  - pam_console: return the proper error code (reported and patches
    for both from Frederic Crozat)
  - change deprecated Copyright: tag in .spec file to License:


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_wheel: don't error out if the group has no members, but is the user's
    primary GID (reported by David Vos)
  - pam_unix: preserve permissions on files which are manipulated (#43706)
  - pam_securetty: check if the user is the superuser before checking the tty,
    thereby allowing regular users access to services which don't set the
    PAM_TTY item (#39247)
  - pam_access: define NIS and link with libnsl (#36864)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_console: use /var/run/console instead of /var/lock/console for lock files
  - pam_issue: read the right number of bytes from the file


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-10
changelog:
  - pam_xauth: fix errors due to uninitialized data structure (fix from Tse Huong
    Choo)
  - pam_xauth: random cleanups
  - pam_console: use /var/run/console instead of /var/lock/console at install-time
  - pam_unix: fix preserving of permissions on files which are manipulated


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_stack: perform deep copy of conversation structures
  - include the static libpam in the -devel subpackage (#52321)
  - move development .so and .a files to %{_libdir}
  - pam_unix: don't barf on empty passwords (#51846)
  - pam_unix: redo compatibility with "hash,age" data wrt bigcrypt (#42394)
  - console.perms: add usb camera, scanner, and rio devices (#15528)
  - pam_cracklib: initialize all options properly (#49613)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - modules: use getpwnam_r and friends instead of non-reentrant versions
  - pam_console: clear generated .c and .h files in "clean" makefile target


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-12
changelog:
  - noreplace configuration files in /etc/security
  - pam_console: update pam_console_apply and man pages to reflect
    /var/lock -> /var/run move


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_unix: use crypt() instead of bigcrypt() when salted field is less than
    the critical size which lets us know it was generated with bigcrypt()
  - use a wrapper to handle ERANGE errors when calling get....._r functions:
    defining PAM_GETPWNAM_R and such (for getpwnam, getpwuid, getgrnam,
    getgrgid, and getspnam) before including _pam_macros.h will cause them
    to be implemented as static functions, similar to how defining PAM_SM_xxx
    is used to control whether or not PAM declares prototypes for certain
    functions


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_userdb: fix the key_only flag so that the null-terminator of the
    user-password string isn't expected to be part of the key in the db file,
    matching the behavior of db_load 3.2.9


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_xauth: rewrite to skip refcounting and just use a temporary file
    created using mkstemp() in /tmp


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_xauth: close a possible DoS due to use of dotlock-style locking in
    world-writable directories by relocating the temporary file to the target
    user's home directory
  - general: include headers local to this tree using relative paths so that
    system headers for PAM won't be pulled in, in case include paths don't
    take care of it


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add cracklib as a buildprereq
  - pam_wheel: don't ignore out if the user is attempting to switch to a
    unprivileged user (this lets pam_wheel do its thing when users attempt
    to get to system accounts or accounts of other unprivileged users)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_mkhomedir: recurse into subdirectories properly
  - pam_mkhomedir: handle symlinks
  - pam_mkhomedir: skip over special items in the skeleton directory


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_limits: don't just return if the user is root -- we'll want to set the
    priority (it could be negative to elevate root's sessions)
  - pam_issue: fix off-by-one error allocating space for the prompt string


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_tally: don't try to read past the end of faillog -- it probably contains
    garbage, which if written into the file later on will confuse /usr/bin/faillog


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_rhosts: allow "+hostname" as a synonym for "hostname" to jive better
    with the hosts.equiv(5) man page
  - use the automake install-sh instead of the autoconf install-sh, which
    disappeared somewhere between 2.50 and now


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-15
changelog:
  - reorder patches so that the reentrancy patch is applied last -- we never
    came to a consensus on how to guard against the bugs in calling applications
    which this sort of change addresses, and having them last allows for dropping
    in a better strategy for addressing this later on


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-16
changelog:
  - pam_xauth: always return PAM_SUCCESS or PAM_SESSION_ERR instead of PAM_IGNORE,
    matching the previous behavior (libpam treats PAM_IGNORE from a single module
    in a stack as a session error, leading to false error messages if we just
    return PAM_IGNORE for all cases)


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-19
changelog:
  - fix a bug in the getpwnam_r wrapper which sometimes resulted in false
    positives for non-existent users


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-20
changelog:
  - pam_stack: fix some memory leaks (reported by Fernando Trias)
  - pam_chroot: integrate Owl patch to report the more common causes of failures


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-31
changelog:
  - libpam_misc: fix possible infinite loop in misc_conv (#62195)
  - pam_xauth: fix cases where DISPLAY is "localhost:screen" and the xauth
    key is actually stored using the system's hostname (#61524)


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-36
changelog:
  - pam_timestamp: chown intermediate directories when creating them
  - pam_timestamp_check: add -d flag to poll


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-40
changelog:
  - pam_timestamp_check: check that stdio descriptors are open before we're
    invoked
  - add missing chroot.conf


author: Elliot Lee <sopwith@redhat.com> 0.75-42
changelog:
  - Since cracklib-dicts location will not be correctly detected without 
    that package being installed, add buildreq for cracklib-dicts.
  - Add patch57: makes configure use $LIBNAME when searching for cracklib 
    dicts, and error out if not found.


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-44
changelog:
  - fix syntax errors in pam_console's yacc parser which newer bison chokes on
  - forcibly set FAKEROOT at make install time


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-45
changelog:
  - create /lib/security, even if it isn't /%{_lib}/security, because we
    can't locate /lib/security/$ISA without it (noted by Arnd Bergmann)
  - clear out the duplicate docs directory created during %install


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-46
changelog:
  - pam_xauth: reintroduce ACL support, per the original white paper
  - pam_xauth: default root's export ACL to none instead of everyone


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-49
changelog:
  - modify calls to getlogin() to check the directory of the current TTY before
    searching for an entry in the utmp/utmpx file (#98020, #98826, CAN-2003-0388)


author: Nalin Dahyabhai <nalin@redhat.com> 0.77-0
changelog:
  - update to 0.77 upstream release
    - pam_limits: limits now affect root as well
    - pam_nologin: returns PAM_IGNORE instead of PAM_SUCCESS unless "successok"
      is given as an argument
    - pam_userdb: correctly return PAM_AUTH_ERR instead of PAM_USER_UNKNOWN when
      invoked with the "key_only" argument and the database has an entry of the
      form "user-<wrongpassword>"
  - use a bundled libdb for pam_userdb.so because the system copy uses threads,
    and demand-loading a shared library which uses threads into an application
    which doesn't is a Very Bad Idea


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_succeed_if: fix thinko in argument parsing which would walk past the
    end of the argument list


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - make pam_pwdb.so link with libnsl again so that it loads (#107093)
  - remove now-bogus buildprereq on db4-devel (we use a bundled copy for
    pam_userdb to avoid symbol collisions with other db libraries in apps)


author: Nalin Dahyabhai <nalin@redhat.com> 0.77-15
changelog:
  - don't install _pam_aconf.h -- apps don't use it, other PAM headers which
    are installed don't use it, and its contents may be different for arches
    on a multilib system
  - check for linkage problems in modules at %install-time (kill #107093 dead)
  - add buildprereq on flex (#101563)


author: Dan Walsh <dwalsh@redhat.com> 0.77-19.sel
changelog:
  - Change unix_chkpwd to handle unix_passwd and unix_acct
  - This eliminates the need for pam modules to have read/write access to /etc/shadow.


author: Tomas Mraz <tmraz@redhat.com> 0.77-56
changelog:
  - #75454 fixed locking when changing password
  - #127054 
  - #125653 removed unnecessary getgrouplist call
  - #124979 added quiet option to pam_succeed_if


author: Tomas Mraz <tmraz@redhat.com> 0.77-61
changelog:
  - #129328 pam_env shouldn't abort on missing /etc/environment
  - #126985 pam_stack should always copy the conversation function 
  - #127524 add /etc/security/opasswd to files


author: Tomas Mraz <tmraz@redhat.com> 0.77-63
changelog:
  - Fix checking of group %group syntax in pam_limits
  - Drop fencepost patch as it was already fixed 
    by upstream change from 0.75 to 0.77
  - Fix brokenshadow patch


author: Tomas Mraz <tmraz@redhat.com>
changelog:
  - #87628 pam_timestamp remembers authorization after logout
  - #116956 fixed memory leaks in pam_stack


author: Tomas Mraz <tmraz@redhat.com> 0.77-66
changelog:
  - #77646 log failures when renaming the files when changing password
  - Log failure on missing /etc/security/opasswd when remember option is present


author: Tomas Mraz <tmraz@redhat.com> 0.78-1
changelog:
  - update to Linux-PAM-0.78
  - #140451 parse passwd entries correctly and test for failure
  - #137802 allow using pam_console for authentication


author: Tomas Mraz <tmraz@redhat.com> 0.78-5
changelog:
  - echo why tests failed when rebuilding
  - fixed some warnings and errors in pam_console for gcc4 build
  - improved parsing pam_console config file


author: Tomas Mraz <tmraz@redhat.com> 0.78-6
changelog:
  - add functionality for running handler executables from pam_console
    when console lock was obtained/lost
  - removed patches merged to pam-redhat


author: Tomas Mraz <tmraz@redhat.com> 0.78-8
changelog:
  - remove ownership and permissions handling from pam_console call
    pam_console_apply as a handler instead


author: Tomas Mraz <tmraz@redhat.com> 0.78-9
changelog:
  - fix wrong logging in pam_console handlers
  - add executing ainit handler for alsa sound dmix
  - #147879, #112777 - change permissions for dri devices


author: Tomas Mraz <tmraz@redhat.com> 0.79-3
changelog:
  - make pam_unix LSB 2.0 compliant even when SELinux enabled
  - #88127 - change both local and NIS passwords to keep them in sync,
    also fix a regression in passwd functionality on NIS master server


author: Tomas Mraz <tmraz@redhat.com> 0.79-5
changelog:
  - added auditing patch by Steve Grubb
  - added cleanup patches for bugs found by Steve Grubb
  - don't clear the shadow option of pam_unix if nis option used


author: Tomas Mraz <tmraz@redhat.com> 0.79-7
changelog:
  - pam_xauth: unset the XAUTHORITY variable on error, fix
    potential memory leaks
  - modify path to IDE floppy devices in console.perms (#155560)


author: Tomas Mraz <tmraz@redhat.com> 0.79-9
changelog:
  - update the pam audit patch to support newest audit library,
    audit also pam_setcred calls (Steve Grubb)
  - don't use the audit_fd as global static variable
  - don't unset the XAUTHORITY when target user is root


author: Tomas Mraz <tmraz@redhat.com> 0.79-10
changelog:
  - add the Requires dependency on audit-libs (#159885)
  - pam_loginuid shouldn't report error when /proc/self/loginuid
    is missing (#159974)


author: Tomas Mraz <tmraz@redhat.com> 0.80-1
changelog:
  - upgrade to new upstream sources
  - removed obsolete patches
  - pam_selinux module shouldn't fail on broken configs unless
    policy is set to enforcing (Dan Walsh)


author: Tomas Mraz <tmraz@redhat.com> 0.80-2
changelog:
  - fixed module tests so the pam doesn't require itself to build (#163502)
  - added buildprereq for building the documentation (#163503)
  - relaxed permissions of binaries (u+w)


author: Tomas Mraz <tmraz@redhat.com> 0.80-8
changelog:
  - process limit values other than RLIMIT_NICE correctly (#168790)
  - pam_unix: always honor nis flag on password change (by Aaron Hope)


author: Tomas Mraz <tmraz@redhat.com> 0.80-9
changelog:
  - don't include ps and pdf docs (#168823)
  - new common config file for configuration utilities
  - remove glib2 dependency (#166979)


author: Tomas Mraz <tmraz@redhat.com> 0.80-13
changelog:
  - fixed CAN-2005-2977 unix_chkpwd should skip user verification only if
    run as root (#168181)
  - link pam_loginuid to libaudit
  - support no tty in pam_access (#170467)
  - updated audit patch (by Steve Grubb)
  - the previous pam_selinux change was not applied properly
  - pam_xauth: look for the xauth binary in multiple directories (#171164)


author: Tomas Mraz <tmraz@redhat.com> 0.99.2.1-1
changelog:
  - support netgroup matching in pam_succeed_if
  - upgrade to new release
  - drop pam_pwdb as it was obsolete long ago
  - we don't build static libraries anymore


author: Tomas Mraz <tmraz@redhat.com> 0.99.2.1-2
changelog:
  - fix dangling symlinks in -devel (#175929)
  - link libaudit only where necessary
  - actually compile in audit support


author: Tomas Mraz <tmraz@redhat.com> 0.99.3.0-1
changelog:
  - new upstream version
  - updated db4 to 4.3.29
  - added module pam_tally2 with auditing support
  - added manual pages for system-auth and config-util (#179584)


author: Tomas Mraz <tmraz@redhat.com> 0.99.3.0-2
changelog:
  - added try_first_pass option to pam_cracklib
  - use try_first_pass for pam_unix and pam_cracklib in
    system-auth (#182350)


author: Tomas Mraz <tmraz@redhat.com> 0.99.3.0-3
changelog:
  - added pam_namespace module written by Janak Desai (per-user /tmp
  support)
  - new pam-redhat modules version


author: Tomas Mraz <tmraz@redhat.com> 0.99.3.0-4
changelog:
  - fixed console device class for irda (#189966)
  - make pam_console_apply fail gracefully when a class is missing


author: Tomas Mraz <tmraz@redhat.com> 0.99.3.0-5
changelog:
  - the namespace instance init script is now in /etc/security (#190148)
  - pam_namespace: added missing braces (#190026)
  - pam_tally(2): never call fclose twice on the same FILE (from upstream)


author: Tomas Mraz <tmraz@redhat.com> 0.99.4.0-1
changelog:
  - upgrade to new upstream version
  - make pam_console_apply not dependent on glib
  - support large uids in pam_tally, pam_tally2


author: Tomas Mraz <tmraz@redhat.com> 0.99.4.0-2
changelog:
  - pam_console_apply shouldn't access /var when called with -r (#191401)
  - actually apply the large-uid patch
  - don't build hmactest in pam_timestamp so openssl-devel is not required
  - add missing buildrequires (#191915)


author: Tomas Mraz <tmraz@redhat.com> 0.99.4.0-3
changelog:
  - use md5 implementation from pam_unix in pam_namespace
  - pam_namespace should call setexeccon only when selinux is enabled


author: Tomas Mraz <tmraz@redhat.com> 0.99.4.0-5
changelog:
  - updated pam_namespace with latest patch by Janak Desai
  - merged pam_namespace patches
  - added buildrequires libtool
  - fixed a few rpmlint warnings


author: Tomas Mraz <tmraz@redhat.com> 0.99.5.0-1
changelog:
  - updated to a new upstream release
  - added service as value to be matched and list matching to
    pam_succeed_if
  - namespace.init was missing from EXTRA_DIST


author: Tomas Mraz <tmraz@redhat.com> 0.99.5.0-3
changelog:
  - don't report error in pam_selinux for nonexistent tty (#188722)
  - add pam_keyinit to the default system-auth file (#198623)


author: Tomas Mraz <tmraz@redhat.com> 0.99.5.0-6
changelog:
  - revoke keyrings properly when pam_keyinit called more than once (#201048)
    patch by David Howells


author: Tomas Mraz <tmraz@redhat.com> 0.99.5.0-7
changelog:
  - revoke keyrings properly when pam_keyinit called as root (#201048)
  - pam_succeed_if should return PAM_USER_UNKNOWN when getpwnam fails (#197748)


author: Tomas Mraz <tmraz@redhat.com> 0.99.6.2-1
changelog:
  - upgrade to new upstream version, as there are mostly bugfixes except
    improved documentation
  - add support for session and password service for pam_access and
    pam_succeed_if
  - system-auth: skip session pam_unix for crond service


author: Tomas Mraz <tmraz@redhat.com> 0.99.6.2-2
changelog:
  - silence pam_succeed_if in default system-auth (#205067)
  - round the pam_timestamp_check sleep up to wake up at the start of the
    wallclock second (#205068)


author: Tomas Mraz <tmraz@redhat.com> 0.99.6.2-3.1
changelog:
  - preserve effective uid in namespace.init script (LSPP for newrole)
  - include /var/log/faillog and tallylog to filelist (#209646)
  - add ids to .xml docs so the generated html is always the same (#210569)


author: Tomas Mraz <tmraz@redhat.com> 0.99.6.2-4
changelog:
  - update internal db4 to 4.5.20 version
  - move setgid before setuid in pam_keyinit (#212329)
  - make username check in pam_unix consistent with useradd (#212153)


author: Tomas Mraz <tmraz@redhat.com> 0.99.6.2-5
changelog:
  - add select-context option to pam_selinux (#213812)
  - autoreconf won't work with autoconf-2.61 as configure.in is not yet adjusted
    for it


author: Tomas Mraz <tmraz@redhat.com> 0.99.6.2-8
changelog:
  - properly include /var/log/faillog and tallylog as ghosts
    and create them in post script (#209646)
  - update gmo files as we patch some po files (#218271)
  - add use_current_range option to pam_selinux (#220487)
  - improve the role selection in pam_selinux
  - remove shortcut on Password: in ja locale (#218271)
  - revert to old euid and not ruid when setting euid in pam_keyinit (#219486)
  - rename selinux-namespace patch to namespace-level


author: Tomas Mraz <tmraz@redhat.com> 0.99.7.0-1
changelog:
  - upgrade to new upstream version
  - drop pam_stack module as it is obsolete
  - some changes to silence rpmlint


author: Tomas Mraz <tmraz@redhat.com> 0.99.7.1-1
changelog:
  - upgrade to new upstream version resolving CVE-2007-0003
  - pam_namespace: unmount poly dir for override users


author: Tomas Mraz <tmraz@redhat.com> 0.99.7.1-3
changelog:
  - correctly relabel tty in the default case (#229542)
  - pam_unix: cleanup of bigcrypt support
  - pam_unix: allow modification of '*' passwords to root


author: Tomas Mraz <tmraz@redhat.com> 0.99.7.1-4
changelog:
  - pam_console: always decrement use count (#230823)
  - pam_namespace: use raw context for poly dir name (#227345)
  - pam_namespace: truncate long poly dir name (append hash) (#230120)
  - we don't patch any po files anymore


author: Tomas Mraz <tmraz@redhat.com> 0.99.7.1-5
changelog:
  - pam_selinux: improve context change auditing (#234781)
  - pam_namespace: fix parsing config file with unknown users (#234513)


author: Tomas Mraz <tmraz@redhat.com> 0.99.7.1-6
changelog:
  - pam_namespace: better document behavior on failure (#237249)
  - pam_unix: split out passwd change to a new helper binary (#236316)
  - pam_namespace: add support for temporary logons (#241226)


author: Tomas Mraz <tmraz@redhat.com> 0.99.8.1-3
changelog:
  - updated db4 to 4.6.18 (#249740)
  - added user and new instance parameters to namespace init
  - document the new features of pam_namespace
  - do not log an audit error when uid != 0 (#249870)


author: Tomas Mraz <tmraz@redhat.com> 0.99.8.1-5
changelog:
  - most devices are now handled by HAL and not pam_console (patch by davidz)
  - license tag fix
  - multifunction scanner device support (#251468)


author: Tomas Mraz <tmraz@redhat.com> 0.99.8.1-6
changelog:
  - do not ask for blank password when SELinux confined (#254044)
  - initialize homedirs in namespace init script (original patch by dwalsh)


author: Tomas Mraz <tmraz@redhat.com> 0.99.8.1-9
changelog:
  - do not preserve contexts when copying skel and other namespace.init
    fixes (#298941)
  - do not free memory sent to putenv (#231698)


author: Tomas Mraz <tmraz@redhat.com> 0.99.8.1-17
changelog:
  - test for setkeycreatecon correctly
  - add exclusive login mode of operation to pam_selinux_permit (original
    patch by Dan Walsh)


author: Tomas Mraz <tmraz@redhat.com> 0.99.10.0-1
changelog:
  - new upstream release
  - add default soft limit for nproc of 1024 to prevent
    accidental fork bombs (#432903)


author: Tomas Mraz <tmraz@redhat.com> 0.99.10.0-2
changelog:
  - if shadow is readable for an user do not prevent him from
    authenticating any user with unix_chkpwd (#433459)
  - call audit from unix_chkpwd when appropriate


author: Tomas Mraz <tmraz@redhat.com> 0.99.10.0-4
changelog:
  - pam_namespace: fix problem with level polyinst (#438264)
  - pam_namespace: improve override checking for umount
  - pam_selinux: fix syslogging a context after free() (#438338)


author: Tomas Mraz <tmraz@redhat.com> 1.0.1-4
changelog:
  - pam_namespace: allow safe creation of directories owned by user (#437116)
  - pam_unix: fix multiple error prompts on password change (#443872)


author: Tomas Mraz <tmraz@redhat.com> 1.0.2-1
changelog:
  - pam_loginuid: uids are unsigned (#460241)
  - new minor upstream release
  - use external db4
  - drop tests for not pulling in libpthread (as NPTL should
    be safe)


author: Tomas Mraz <tmraz@redhat.com> 1.0.2-2
changelog:
  - new password quality checks in pam_cracklib
  - report failed logins from btmp in pam_lastlog
  - allow larger groups in modutil functions
  - fix leaked file descriptor in pam_tally


author: Tomas Mraz <tmraz@redhat.com> 1.0.90-4
changelog:
  - fix parsing of config files containing non-ASCII characters
  - fix CVE-2009-0579 (mininimum days for password change ignored) (#487216)
  - pam_access: improve handling of hostname resolution


author: Tomas Mraz <tmraz@redhat.com> 1.0.91-6
changelog:
  - add password-auth, fingerprint-auth, and smartcard-auth
    for applications which can use them namely gdm (#494874)
    patch by Ray Strode


author: Tomas Mraz <tmraz@redhat.com> 1.1.0-5
changelog:
  - do not change permissions with pam_console_apply
  - drop obsolete pam_tally module and the faillog file (#461258)


author: Tomas Mraz <tmraz@redhat.com> 1.1.0-7
changelog:
  - pam_console: fix memory corruption when executing handlers (patch by
    Stas Sergeev) and a few more fixes in the handler execution code (#532302)


author: Tomas Mraz <tmraz@redhat.com> 1.1.2-1
changelog:
  - add pam_faillock module implementing temporary account lock out based
    on authentication failures during a specified interval
  - do not build some auxiliary tools that are not installed that require
    flex-static to build
  - upgrade to new upstream release


author: Tomas Mraz <tmraz@redhat.com> 1.1.3-1
changelog:
  - upgrade to new upstream release fixing CVE-2010-3316 CVE-2010-3435
    CVE-2010-3853
  - try to connect to an abstract X-socket first to verify we are
    at real console (#647191)


author: Tomas Mraz <tmraz@redhat.com> 1.1.3-3
changelog:
  - fix segfault in faillock utility
  - remove some cases where the information of existence of
    an user account could be leaked by the pam_faillock,
    document the remaining case


author: Tomas Mraz <tmraz@redhat.com> 1.1.3-5
changelog:
  - add config for autocreation of subdirectories in /var/run (#656655)
  - automatically enable kernel console in pam_securetty


author: Tomas Mraz <tmraz@redhat.com> 1.1.3-10
changelog:
  - detect the shared / and make the polydir mounts private based on that
  - fix memory leak and other small errors in pam_namespace


author: Tomas Mraz <tmraz@redhat.com> 1.1.5-7
changelog:
  - add inactive account lock out functionality to pam_lastlog
  - fix pam_unix remember user name matching
  - add gecoscheck and maxclassrepeat functionality to pam_cracklib
  - correctly check for crypt() returning NULL in pam_unix
  - pam_unix - do not fallback to MD5 on password change
    if requested algorithm not supported by crypt() (#818741)
  - install empty directories


author: Tomas Mraz <tmraz@redhat.com> - 1.1.5-8
changelog:
  - fix build failure in pam_unix
  - add display of previous bad login attempts to postlogin.pamd
  - put the tmpfiles.d config to /usr/lib and rename it to pam.conf
  - build against libdb-5


author: Tomas Mraz <tmraz@redhat.com> 1.1.6-2
changelog:
  - link setuid binaries with full relro (#853158)
  - add rhost and tty to auditing data in modules (#677664)


author: Tomáš Mráz <tmraz@redhat.com> 1.1.6-9
changelog:
  - do not fail if btmp file is corrupted (#906852)
  - fix strict aliasing warnings in build
  - UsrMove
  - use authtok_type with pam_pwquality in system-auth
  - remove manual_context handling from pam_selinux (#876976)
  - other minor specfile cleanups


author: Tomáš Mráz <tmraz@redhat.com> 1.1.6-12
changelog:
  - add auditing of SELinux policy violation in pam_rootok (#965723)
  - add SELinux helper to pam_pwhistory


author: Tomáš Mráz <tmraz@redhat.com> 1.1.6-14
changelog:
  - use links instead of w3m to create txt documentation
  - recognize login session in pam_sepermit to prevent gdm from locking (#969174)
  - add support for disabling password logging in pam_tty_audit


author: Tomáš Mráz <tmraz@redhat.com> 1.1.8-7
changelog:
  - rename the 90-nproc.conf to 20-nproc.conf (#1071618)
  - canonicalize user name in pam_selinux (#1071010)
  - refresh the pam-redhat tarball


author: Tomáš Mráz <tmraz@redhat.com> 1.1.8-17
changelog:
  - update the audit-grantor patch with the upstream changes
  - pam_userdb: correct the example in man page (#1078784)
  - pam_limits: check whether the utmp login entry is valid (#1080023)
  - pam_console_apply: do not print error if console.perms.d is empty
  - pam_limits: nofile refers to open file descriptors (#1111220)
  - apply PIE and full RELRO to all binaries built


author: Tomáš Mráz <tmraz@redhat.com> 1.3.1-5
changelog:
  - pam_faillock: Support configuration file /etc/security/faillock.conf
  - pam_faillock: Support local_users_only option
  - pam_namespace: Support noexec, nosuid and nodev flags for tmpfs mounts
  - Drop tallylog and pam_tally[2] documentation
  - pam_lastlog: Do not display failed attempts with PAM_SILENT flag
  - pam_lastlog: Support unlimited option to override fsize limit
  - pam_unix: Log if user authenticated without password
  - pam_tty_audit: Improve manual page
  - Optimize closing fds when spawning helpers
  - Fix duplicate password verification in pam_authtok_verify()


author: Iker Pedrosa <ipedrosa@redhat.com> 1.3.1-9
changelog:
  - pam_usertype: new module to tell if uid is in login.defs ranges (#1810474)
  - pam_tty_audit: if kernel audit is disabled return PAM_IGNORE (#1775357)


author: Peter Robinson <pbrobinson@redhat.com> - 1.3.1-12
changelog:
  - Add the motd.d directories (empty) to silence warnings and to
    provide proper ownership for them (#1847501)


author: Iker Pedrosa <ipedrosa@redhat.com> 1.3.1-13
changelog:
  - pam_wheel: if getlogin fails fallback to PAM_RUSER: fixed malformed patch (#1866866)
  - pam_namespace: polyinstantiation refer to gdm doc (#1861841)


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.3.1-17
changelog:
  - pam_keyinit: thread-safe implementation. Resolves: #1997969
  - pam_motd: support multiple motd paths specified, with filename overrides. Resolves: #2014458


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.3.1-19
changelog:
  - Add the motd.d directories (empty) to silence warnings and to
    provide proper ownership for them. Resolves: #2014458


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.3.1-35
changelog:
  - pam_unix: always run the helper to obtain shadow password file entries.
    CVE-2024-10041. Resolves: RHEL-62877
  - pam_access: always match local address and clarify LOCAL keyword behaviour.
    Resolves: RHEL-23018
  - libpam: support long lines in service files. Resolves: RHEL-5051


author: Brian C. Lane <bcl@redhat.com> - 3.2-33
changelog:
  - Switch gpt-header-move and msdos-overlap to python3 (bcl)
    Resolves: rhbz#1595810
  - Modify gpt-header-move and msdos-overlap to work with py2 or py3 (bcl)
    Related: rhbz#1595810


author: Brian C. Lane <bcl@redhat.com> - 3.2-34
changelog:
  - Fix the length of several strncpy calls (bcl)
    Related: rhbz#1602652
  - parted.c: Always free peek_word (bcl)
    Related: rhbz#1602652
  - parted.c: Make sure dev_name is freed (bcl)
    Related: rhbz#1602652
  - t6100-mdraid-partitions: Use v0.90 metadata for the test (bcl)
  - Fix msdos-overlap to work correctly with py2 or py3 (bcl)
    Related: rhbz#1595810


author: Brian C. Lane <bcl@redhat.com> - 3.2-35
changelog:
  - Use python3-devel in buildroot
    Resolves: rhbz#1615576
  - linux.c: Use sys/sysmacros.h for major/minor
    Resolves: rhbz#1615592


author: Brian C. Lane <bcl@redhat.com> - 3.2-37
changelog:
  - Add CI tests
    Resolves: rhbz#1653912
  - t6000-dm: Stop using private lvm root
    Related: rhbz#1653912


author: Brian C. Lane <bcl@redhat.com> - 3.2-39
changelog:
  - tests: Add a test for resizepart on a busy partition (bcl)
    Related: rhbz#1861804
  - parted: Preserve resizepart End when prompted for busy partition (bcl)
    Resolves: rhbz#1861804
  - Fix end_input usage in do_resizepart (bcl)
    Related: rhbz#1861804
  - tests: Test incomplete resizepart command (bcl)
    Related: rhbz#1861804
  - Fix resizepart iec unit end sector (psusi)
    Related: rhbz#1861804
  - libparted: Fix endian bug in bsd.c (AWilcox)
    Resolves: rhbz#1980105


author: Than Ngo <than@redhat.com> - 2.7.6-10
changelog:
  - CVE-2019-13636 , Don't follow symlinks unless --follow-symlinks is given
  - Resolves: #1665928, patch has a huge error output and segfaults when the file to be patched does not exist


author: Michal Hlavinka <mhlavink@redhat.com> - 3.7.0-1
changelog:
  - pciutils updated to 3.7.0, add support for basic DVSEC and CXL DVSEC (#1856436)
  - add support for RCEC Associated Endpoint (#1856440)


author: Petr Pisar <ppisar@redhat.com> - 8.41-6
changelog:
  - Fix returning unset groups in POSIX interface if REG_STARTEND has a non-zero
    starting offset (upstream bug #2244)


author: Petr Pisar <ppisar@redhat.com> - 8.42-2
changelog:
  - Fix handling UTF and start-of-pattern options in C++ wrapper
    (upstream bug #2283)
  - Fix an error message and locale handling in pcregrep tool


author: Petr Pisar <ppisar@redhat.com> - 8.42-3
changelog:
  - Fix autopossessifying a repeated negative class with no characters less than
    256 that is followed by a positive class with only characters less than 256
    (bug #1619228)


author: Petr Pisar <ppisar@redhat.com> - 8.42-5
changelog:
  - Fix CVE-2019-20838 (a subject buffer overread in JIT when UTF is disabled
    and \X or \R has a greater than 1 fixed quantifier) (bug #1852252)
  - Fix CVE-2020-14155 (an integer overflow when parsing numbers after "(?C"))
    (bug #1851552)


author: Petr Pisar <ppisar@redhat.com> - 10.31-6
changelog:
  - Fix global search/replace in pcre2test and pcre2_substitute() when the pattern
    matches an empty string, but never at the starting offset


author: Petr Pisar <ppisar@redhat.com> - 10.31-7
changelog:
  - Fix checking that a lookbehind assertion has a fixed length if the
    lookbehind assertion is used inside a lookahead assertion
  - Fix parsing VERSION conditions


author: Petr Pisar <ppisar@redhat.com> - 10.31-8
changelog:
  - Fix backtracking atomic groups when they are not separated by something with
    a backtracking point


author: Petr Pisar <ppisar@redhat.com> - 10.31-9
changelog:
  - Recognize all Unicode space characters with /x option in a pattern
    (bug #1617960)
  - Fix changing dynamic options (bug #1617960)
  - Fix autopossessifying a repeated negative class with no characters less than
    256 that is followed by a positive class with only characters less than 255,
    (bug #1617960)
  - Fix autopossessifying a repeated negative class with no characters less than
    256 that is followed by a positive class with only characters less than 256,
    (bug #1617960)


author: Petr Pisar <ppisar@redhat.com> - 10.32-1
changelog:
  - 10.32 bump (bug #1628200)
  - Fix a subject buffer overread in JIT when UTF is disabled and \X or \R has
    a greater than 1 fixed quantifier (bug #1628200)
  - Fix matching a zero-repeated subroutine call at a start of a pattern
    (bug #1628200)
  - Fix heap limit checking overflow in pcre2_dfa_match() (bug #1628200)


author: Jakub Jelen <jjelen@redhat.com> - 1.9.5-1
changelog:
  - Rebase to 1.9.5 version to address race conditions (#2014641)
  - Drop dowstream polkit policy to avoid repeated authentication requests in remote sessions (#1928154)


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.26.3-416
changelog:
  - 5.26.3 bump (bug #1655526)
  - Fix CVE-2018-18311 (integer overflow leading to buffer overflow) (bug #1654920)
  - Fix CVE-2018-18312 (heap buffer overflow in regcomp.c) (bug #1654922)
  - Fix CVE-2018-18313 (heap buffer overflow read in regcomp.c) (bug #1654924)
  - Fix CVE-2018-18314 (heap based buffer overflow) (bug #1654925)


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.26.3-417
changelog:
  - Fix Time-Local tests to pass after year 2019 (bug #1807120)
  - Run-require perl(Encode) by perl-libs (bug #1903503)


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.26.3-419
changelog:
  - Fix CVE-2020-10543 (bug #1839273)
  - Fix CVE-2020-10878 (bug #1839276)
  - Fix a file mode of a perl-example.stp example (bug #1913693)


author: Paul Howarth <paul@city-fan.org> - 1.1903-1
changelog:
  - Update to 1.1903
    - Fix documentation typos (CPAN RT#84981)
    - Add -w and -i switches to diffnew.pl (CPAN RT#69945)
    - Remove Algorithm::DiffOld from the index; the module is still distributed
      with Algorithm::Diff, but is not indexed on CPAN because this is an
      ***UNAUTHORIZED*** release of Algorithm::DiffOld
  - Add patch to generate provide for perl(Algorithm::DiffOld)
  - Drop %defattr, redundant since rpm 4.4
  - General spec tidy-up


author: Jitka Plesnikova <jplesnik@redhat.com> - 1.54-6
changelog:
  - Adjust to sqlite-3.22.0 (bug #1543286)
  - Add new index constraint ops introduced in SQLite 3.21.0 to PerlData


author: Jitka Plesnikova <jplesnik@redhat.com> - 6.60-3
changelog:
  - Replace versioned MODULE_COMPAT by non-versioned perl-libs
  - Package tests
  - Resolves: rhbz#2219504


author: Petr Pisar <ppisar@redhat.com> - 2.12-367
changelog:
  - Fix CVE-2017-6512 (setting arbitrary mode on an arbitrary file in rmtree()
    and remove_tree()) (bug #1457834)


author: Paul Howarth <paul@city-fan.org> - 2.059-1
changelog:
  - Update to 2.059 (bug #1610017)
    - Fix memory leak when CRLs are used (CPAN RT#125867)
    - Fix memory leak when using stop_SSL and threads
      (https://rt.cpan.org/Ticket/Display.html?id=125867#txn-1797132)


author: Petr Pisar <ppisar@redhat.com> - 2.059-2
changelog:
  - Adapt to OpenSSL 1.1.1, it requires patched Net-SSLeay (bug #1610017)
  - Enable tests (bug #1610017)


author: Paul Howarth <paul@city-fan.org> - 2.060-1
changelog:
  - Update to 2.060 (bug #1610017)
    - Support for TLS 1.3 with OpenSSL 1.1.1 (needs Net::SSLeay ≥ 1.86); see
      also CPAN RT#126899
    - TLS 1.3 support is not complete yet for session reuse


author: Petr Pisar <ppisar@redhat.com> - 2.060-3
changelog:
  - Client sends a post-handshake-authentication extension if a client key and
    a certificate are available (bug #1633636)


author: Paul Howarth <paul@city-fan.org> - 1.85-1
changelog:
  - Update to 1.85
    - Preparations for transferring maintenace to a new maintainer
    - Fixed test failure in t/local/33_x509_create_cert.t for some versions of
      OpenSSL
    - Fixed free() error that causes "Free to wrong pool ..." message on Windows


author: Petr Pisar <ppisar@redhat.com> - 1.85-3
changelog:
  - Adapt to OpenSSL 1.1.1 (bug #1610376)
  - Adapt tests to system-wide crypto policy (bug #1610376)
  - Adapt tests to security level 2 system-wide crypt policy (bug #1610376)


author: Petr Pisar <ppisar@redhat.com> - 1.85-5
changelog:
  - Revert retry in Net::SSLeay::{read,write}() (bug #1610376)
  - Revert retry in Net::SSLeay::write_partial() (bug #1610376)


author: Petr Pisar <ppisar@redhat.com> - 3.28-2
changelog:
  - Introduce a build-condition on groff
  - Rename a _without_tk build-condition to
    _without_perl_Pod_Perldoc_enables_tk_test


author: Paul Howarth <paul@city-fan.org> - 1.71-5
changelog:
  - Soften Business::ISBN dependency from Requires: to Suggests: to avoid
    pulling in gd and X libraries (#1380152)


author: Petr Pisar <ppisar@redhat.com> - 3.10-2
changelog:
  - Net::libnetFAQ document replaced with a hyper link because of the Artistic
    license (CPAN RT#117888)


author: Paul Howarth <paul@city-fan.org> - 1:0.236-1
changelog:
  - Update to 0.236
    - Add Travis test configuration
    - Make test for PMC availability more reliable
    - Disable benchmark test rt62341.t as it runs out of memory on many smoker
      systems (CPAN RT#118310)
  - Simplify find command using -delete


author: Paul Howarth <paul@city-fan.org> - 1:0.237-1
changelog:
  - Update to 0.237
    - Don't load vars.pm (CPAN RT#132077)
  - Drop legacy Group: tag
  - Drop buildroot cleaning in %install section


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-19
changelog:
  - semodule: move module hashing into libsemanage (requires libsemanage-2.9-7)
  - semodule: add command-line option to detect module changes (#2049189)


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-20
changelog:
  - python: Split "semanage import" into two transactions (#2063353)
  - semodule: rename --rebuild-if-modules-changed to --refresh (#2089802)
  - selinux-autorelabel: Do not force reboot (#2093133)


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-21.1
changelog:
  - python: Harden tools against "rogue" modules (#2128976)
  - Update "pathfix" arguments to match ^^^ (#2128976)
  - python: Do not query the local database if the fcontext is non-local (#2124825)


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-25
changelog:
  - Harden more tools against "rogue" modules (RHEL-17351)
  - sepolicy: port to dnf4 python API (RHEL-17398)


author: Dan Walsh <dwalsh@redhat.com> 1.9-9
changelog:
  - Change restorecon to not follow symlinks.  It is too difficult and confusing
  - to figure out the file context for the file pointed to by a symlink.


author: Colin Walters <walters@redhat.com> 1.10-3
changelog:
  - Add patch to fall back to authenticating via uid if
    the current user's SELinux user identity is the default
    identity
  - Add BuildRequires pam-devel


author: Dan Walsh <dwalsh@redhat.com> 1.13.3-1
changelog:
  - Update latest from NSA
  - Add -o option to setfiles to save output of any files with incorrect context.


author: Dan Walsh <dwalsh@redhat.com> 1.14.1-2
changelog:
  - Fix fixfiles.cron to not run on non SELinux boxes
  - Fix several problems in fixfiles and fixfiles.cron


author: Dan Walsh <dwalsh@redhat.com> 1.17.3-4
changelog:
  - Add Steve Grub patches for
          * Fix fixfiles.cron MAILTO
          * Several problems in sestatus


author: Dan Walsh <dwalsh@redhat.com> 1.17.6-1
changelog:
  - Update with NSA
          * Added -l option to setfiles to log changes via syslog.
          * Merged -e option to setfiles to exclude directories.
          * Merged -R option to restorecon for recursive descent.


author: Dan Walsh <dwalsh@redhat.com> 1.19.1-1
changelog:
  - Update to latest from NSA
          * Removed fixfiles.cron.
          * Merged run_init.8 patch from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 1.19.2-1
changelog:
  - Update to latest from NSA
          * Changed restorecon to ignore ENOENT errors from matchpathcon.
          * Merged nonls patch from Chris PeBenito.


author: Dan Walsh <dwalsh@redhat.com> 1.19.2-4
changelog:
  - Fix fixfiles handling of rpm
  - Fix restorecon to not warn on symlinks unless -v -v
  - Fix output of verbose to show old context as well as new context


author: Dan Walsh <dwalsh@redhat.com> 1.19.3-1
changelog:
  - Update to latest from NSA
          * Merged fixfiles and restorecon patches from Dan Walsh.
          * Don't display change if only user part changed.


author: Dan Walsh <dwalsh@redhat.com> 1.20.1-1
changelog:
  - Update to latest from NSA
          * Merged fixfiles rewrite from Dan Walsh.
          * Merged restorecon patch from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 1.21.1-3
changelog:
  - Don't change user componant if it is all that changed unless forced.
  - Change fixfiles to concatinate file_context.local for setfiles


author: Dan Walsh <dwalsh@redhat.com> 1.21.3-1
changelog:
  - Upgrade to latest from NSA
          * Fixed restorecon to not treat errors from is_context_customizable()
            as a customizable context.
          * Merged setfiles/restorecon patch to not reset user field unless
            -F option is specified from Dan Walsh.
          * Merged open_init_pty helper for run_init from Manoj Srivastava.
          * Merged audit2allow and genhomedircon man pages from Manoj Srivastava.


author: Dan Walsh <dwalsh@redhat.com> 1.21.4-1
changelog:
  - Upgrade to latest from NSA
          * Merged fixfiles patch for file_contexts.local from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 1.21.5-1
changelog:
  - Upgrade to latest from NSA
          * Merged newrole -l support from Darrel Goeddel (TCS).
  - Fix genhomedircon STARTING_UID


author: Dan Walsh <dwalsh@redhat.com> 1.21.7-3
changelog:
  - Fix fixfiles patch
  - Upgrade to latest from NSA
          * Prevent overflow of spec array in setfiles.
  - Add diff comparason between file_contexts to fixfiles
  - Allow restorecon to give an warning on file not found instead of exiting


author: Dan Walsh <dwalsh@redhat.com> 1.21.9-1
changelog:
  - More cleanup of sed patch
  - Upgrade to latest from NSA
          * Merged updated fixfiles script from Dan Walsh.
          * Merged updated man page for fixfiles from Dan Walsh and re-added unzipped.
          * Reverted fixfiles patch for file_contexts.local;
            obsoleted by setfiles rewrite.
          * Merged error handling patch for restorecon from Dan Walsh.
          * Merged semi raw mode for open_init_pty helper from Manoj Srivastava.
          * Rewrote setfiles to use matchpathcon and the new interfaces
            exported by libselinux (>= 1.21.5).


author: Dan Walsh <dwalsh@redhat.com> 1.21.10-1
changelog:
  - More cleanup of fixfiles sed patch
  - Upgrade to latest from NSA
          * Merged patch for open_init_pty from Manoj Srivastava.


author: Dan Walsh <dwalsh@redhat.com> 1.21.12-1
changelog:
  - More cleanup of fixfiles sed patch
          * Merged further patches for restorecon/setfiles -e and fixfiles -C.


author: Dan Walsh <dwalsh@redhat.com> 1.21.13-1
changelog:
  - Update from NSA
          * Merged further change to fixfiles -C from Dan Walsh.
          * Merged updated fixfiles script from Dan Walsh.
  - Fix error handling of restorecon


author: Dan Walsh <dwalsh@redhat.com> 1.21.17-1
changelog:
  - Update to latest from NSA
          * Merged new genhomedircon script from Dan Walsh.
          * Changed load_policy to call sepol_genusers().


author: Dan Walsh <dwalsh@redhat.com> 1.21.18-1
changelog:
  - Update to latest from NSA
          * Changed load_policy to fall back to the original policy upon
            an error from sepol_genusers().


author: Dan Walsh <dwalsh@redhat.com> 1.21.18-2
changelog:
  - Apply Uli patch
          * The Makefiles should use the -Wall option even if compiled in beehive
          * Add -W, too
          * use -Werror when used outside of beehive.  This could also be used unconditionally
          * setfiles/setfiles.c: fix resulting warning
          * restorecon/restorecon.c: Likewise
          * run_init/open_init_pty.c: argc hasn't been checked, the program would crash if
  called without parameters.  ignore the return value of nice properly.
          * run_init: don't link with -ldl lutil
          * load_policy: that's the bad bug.  pointer to unsigned int is passed, size_t is
  written to.  fails on 64-bit archs
          * sestatus: signed vs unsigned problem
          * newrole: don't link with -ldl


author: Dan Walsh <dwalsh@redhat.com> 1.23.1-1
changelog:
  - Update to released version from NSA
          * Merged rewrite of genhomedircon by Eric Paris.
          * Changed fixfiles to relabel jfs since it now supports security xattrs
            (as of 2.6.11).  Removed reiserfs until 2.6.12 is released with
            fixed support for reiserfs and selinux.


author: Dan Walsh <dwalsh@redhat.com> 1.23.2-1
changelog:
  - Update to version from NSA
          * Changed setfiles -c to call set_matchpathcon_flags(3) to
            turn off processing of .homedirs and .local.


author: Dan Walsh <dwalsh@redhat.com> 1.23.3-1
changelog:
  - Update to version from NSA
          * Merged context validation patch for genhomedircon from Eric Paris.
  - Fix verbose output of restorecon


author: Dan Walsh <dwalsh@redhat.com> 1.23.4-1
changelog:
  - Update to version from NSA
          * Merged load_policy is_selinux_enabled patch from Dan Walsh.
          * Merged restorecon verbose output patch from Dan Walsh.
          * Merged setfiles altroot patch from Chris PeBenito.


author: Dan Walsh <dwalsh@redhat.com> 1.23.5-1
changelog:
  - Update to match NSA
          * Reverted load_policy is_selinux_enabled patch from Dan Walsh.
            Otherwise, an initial policy load cannot be performed using
            load_policy, e.g. for anaconda.


author: Dan Walsh <dwalsh@redhat.com> 1.23.6-1
changelog:
  - Update to match NSA
          * Fixed signed/unsigned pointer bug in load_policy.
          * Reverted context validation patch for genhomedircon.


author: Dan Walsh <dwalsh@redhat.com> 1.23.7-1
changelog:
  - Change -f flag in fixfiles to remove stuff from /tmp
  - Change -F flag to pass -F flag  to restorecon/fixfiles.  (IE Force relabel).


author: Dan Walsh <dwalsh@redhat.com> 1.23.9-1
changelog:
  - Update to match NSA
          * Updated audit2why for sepol_ prefixes on Flask types to
            avoid namespace collision with libselinux, and to
            include <selinux/selinux.h> now.


author: Dan Walsh <dwalsh@redhat.com> 1.23.10-1
changelog:
  - Update to match NSA
          * Extended audit2why to incorporate booleans and local user
            settings when analyzing audit messages.


author: Dan Walsh <dwalsh@redhat.com> 1.23.11-1
changelog:
  - Update to match NSA
          * Merged fixfiles and newrole patch from Dan Walsh.
          * Merged audit2why man page from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 1.25.2-1
changelog:
  - Update to match NSA
          * Merged load_policy, newrole, and genhomedircon patches from Red Hat.


author: Dan Walsh <dwalsh@redhat.com> 1.25.5-1
changelog:
  - Update to match NSA
          * Merged patch to move module read/write code from libsemanage
            to libsepol from Jason Tang (Tresys).


author: Dan Walsh <dwalsh@redhat.com> 1.25.6-1
changelog:
  - Update to match NSA
          * Merged fixes for semodule_link and sestatus from Serge Hallyn (IBM).
            Bugs found by Coverity.


author: Dan Walsh <dwalsh@redhat.com> 1.25.9-1
changelog:
  - Update to match NSA
          * Changed setfiles -c to translate the context to raw format
          prior to calling libsepol.


author: Dan Walsh <dwalsh@redhat.com> 1.27.1-1
changelog:
  - Update to match NSA
          * Merged error shadowing bug fix for restorecon from Dan Walsh.
          * Merged setfiles usage/man page update for -r option from Dan Walsh.
          * Merged fixfiles -C patch to ignore :s0 addition on update
            to a MCS/MLS policy from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 1.27.2-1
changelog:
  - Update to match NSA
          * Merged run_init open_init_pty bug fix from Manoj Srivastava
            (unblock SIGCHLD).  Bug reported by Erich Schubert.


author: Dan Walsh <dwalsh@redhat.com> 1.27.3-1
changelog:
  - Update to match NSA
          * Merged patch to update semodule to the new libsemanage API
          and improve the user interface from Karl MacMillan (Tresys).
          * Modified semodule for the create/connect API split.


author: Dan Walsh <dwalsh@redhat.com> 1.27.5-1
changelog:
  - Update to match NSA
          * Fixed warnings in load_policy.
          * Rewrote load_policy to use the new selinux_mkload_policy()
          interface provided by libselinux.


author: Dan Walsh <dwalsh@redhat.com> 1.27.6-1
changelog:
  - Update to match NSA
          * Updated for changes to libsepol.
          Changed semodule and semodule_package to use the shared libsepol.
          Disabled build of semodule_link and semodule_expand for now.
          Updated audit2why for relocated policydb internal headers,
          still needs to be converted to a shared lib interface.


author: Dan Walsh <dwalsh@redhat.com> 1.27.7-1
changelog:
  - Update to match NSA
          * Updated semodule_link and semodule_expand to use shared libsepol.
          Fixed audit2why to call policydb_init prior to policydb_read (still
          uses the static libsepol).


author: Dan Walsh <dwalsh@redhat.com> 1.27.11-1
changelog:
  - Update to match NSA
          * Updated semodule_expand to use get interfaces for hidden sepol_module_package type.
          * Merged newrole and run_init pam config patches from Dan Walsh (Red Hat).
          * Merged fixfiles patch from Dan Walsh (Red Hat).
          * Updated semodule for removal of semanage_strerror.


author: Dan Walsh <dwalsh@redhat.com> 1.27.12-1
changelog:
  - Update to match NSA
          * Merged non-PAM Makefile support for newrole and run_init from Timothy Wood.


author: Dan Walsh <dwalsh@redhat.com> 1.27.18-1
changelog:
  - Update to match NSA
          * Cleaned up usage and error messages and releasing of memory by
          semodule utilities.
          * Corrected error reporting by semodule.
          * Updated semodule_expand for change to sepol interface.
          * Merged fixes for make DESTDIR= builds from Joshua Brindle.


author: Dan Walsh <dwalsh@redhat.com> 1.27.19-1
changelog:
  - Update to match NSA
          * Merged semodule support for reload, noreload, and store options
            from Joshua Brindle.
          * Merged semodule_package rewrite from Joshua Brindle.


author: Dan Walsh <dwalsh@redhat.com> 1.27.20-1
changelog:
  - Update to match NSA
          * Merged setsebool patch from Ivan Gyurdiev.
            This moves setsebool from libselinux/utils to policycoreutils,
            and rewrites it to use libsemanage for permanent boolean changes.


author: Dan Walsh <dwalsh@redhat.com> 1.27.23-1
changelog:
  - Update to match NSA
          * Changed setfiles for the context canonicalization support.
          * Changed setsebool to call semanage_is_managed() interface
            and fall back to security_set_boolean_list() if policy is
            not managed.
          * Merged setsebool memory leak fix from Ivan Gyurdiev.
          * Merged setsebool patch to call semanage_set_reload_bools()
            interface from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.27.26-1
changelog:
  * Added -B (--build) option to semodule to force a rebuild.
          * Reverted setsebool patch to call semanage_set_reload_bools().
          * Changed setsebool to disable policy reload and to call
            security_set_boolean_list to update the runtime booleans.
          * Changed setfiles -c to use new flag to set_matchpathcon_flags()
            to disable context translation by matchpathcon_init().


author: Dan Walsh <dwalsh@redhat.com> 1.27.28-2
changelog:
  - Update to match NSA
          * Merged genhomedircon rewrite from Dan Walsh.
  - Rewrite audit2allow to python


author: Dan Walsh <dwalsh@redhat.com> 1.27.28-3
changelog:
  - Audit2allow
          * Add more error checking
          * Add gen policy package
          * Add gen requires


author: Dan Walsh <dwalsh@redhat.com> 1.27.29-1
changelog:
  - Update to match NSA
          * Merged audit2allow python script from Dan Walsh.
            (old script moved to audit2allow.perl, will be removed later).
          * Merged genhomedircon fixes from Dan Walsh.
          * Merged semodule quieting patch from Dan Walsh
            (inverts default, use -v to restore original behavior).


author: Dan Walsh <dwalsh@redhat.com> 1.27.30-1
changelog:
  - Update to match NSA
          * Merged sestatus, audit2allow, and semanage patch from Dan Walsh.
          * Fixed semodule -v option.


author: Dan Walsh <dwalsh@redhat.com> 1.27.31-1
changelog:
  - Update to match NSA
          * Changed genhomedircon to always use user_r for the role in the
            managed case since user_get_defrole is broken.
  - Add te file capabilities to audit2allow
  - Add man pages for semodule


author: Dan Walsh <dwalsh@redhat.com> 1.27.33-1
changelog:
  - Update to match NSA
          * Merged audit2allow --tefile and --fcfile support from Dan Walsh.
          * Merged genhomedircon fix from Dan Walsh.
          * Merged semodule* man pages from Dan Walsh, and edited them.
          * Changed setfiles to set the MATCHPATHCON_VALIDATE flag to
            retain validation/canonicalization of contexts during init.


author: Dan Walsh <dwalsh@redhat.com> 1.27.35-1
changelog:
  - Update to match NSA
          * Merged genhomedircon bug fix from Dan Walsh.
          * Revised semodule* man pages to refer to checkmodule and
            to include example sections.


author: Dan Walsh <dwalsh@redhat.com> 1.27.36-1
changelog:
  - Update to match NSA
          * Changed genhomedircon to warn on use of ROLE in homedir_template
            if using managed policy, as libsemanage does not yet support it.


author: Dan Walsh <dwalsh@redhat.com> 1.29.1-1
changelog:
  - Update to match NSA
          * Merged fix for audit2allow long option list from Dan Walsh.
          * Merged -r option for restorecon (alias for -R) from Dan Walsh.
          * Merged chcat script and man page from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 1.29.2-1
changelog:
  - Fix genhomedircon to work in installer
  - Update to match NSA
          * Merged patch for chcat script from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 1.29.3-1
changelog:
  - Update to match NSA
          * Merged semanage getpwnam bug fix from Serge Hallyn (IBM).
          * Merged patch series from Ivan Gyurdiev.
            This includes patches to:
            - cleanup setsebool
            - update setsebool to apply active booleans through libsemanage
            - update semodule to use the new semanage_set_rebuild() interface
            - fix various bugs in semanage
          * Merged patch from Dan Walsh (Red Hat).
            This includes fixes for restorecon, chcat, fixfiles, genhomedircon,
            and semanage.


author: Dan Walsh <dwalsh@redhat.com> 1.29.4-1
changelog:
  - Update to match NSA
          * Merged genhomedircon and semanage patch from Dan Walsh.
          * Changed semodule error reporting to include argv[0].


author: Dan Walsh <dwalsh@redhat.com> 1.29.7-1
changelog:
  - Update to match NSA
          * Merged newrole cleanup patch from Steve Grubb.
          * Merged setfiles/restorecon performance patch from Russell Coker.
          * Merged genhomedircon and semanage patches from Dan Walsh.
          * Merged remove add_local/set_local patch from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.29.8-1
changelog:
  - Update to match NSA
          * Merged semanage fixes from Ivan Gyurdiev.
          * Merged semanage fixes from Russell Coker.
          * Merged chcat, genhomedircon, and semanage diffs from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 1.29.11-1
changelog:
  - Added translation support to semanage
  - Update from upstream
          * Modified newrole and run_init to use the loginuid when
            supported to obtain the Linux user identity to re-authenticate,
            and to fall back to real uid.  Dropped the use of the SELinux
            user identity, as Linux users are now mapped to SELinux users
            via seusers and the SELinux user identity space is separate.
          * Merged semanage bug fixes from Ivan Gyurdiev.
          * Merged semanage fixes from Russell Coker.
          * Merged chcat.8 and genhomedircon patches from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 1.29.15-1
changelog:
  - Update from upstream
          * Merged newrole audit patch from Steve Grubb.
          * Merged seuser -> seuser local rename patch from Ivan Gyurdiev.
          * Merged semanage and semodule access check patches from Joshua Brindle.


author: Dan Walsh <dwalsh@redhat.com> 1.29.17-1
changelog:
  - Update from upstream
          * Merged genhomedircon fix from Dan Walsh.
          * Merged seusers.system patch from Ivan Gyurdiev.
          * Merged improve port/fcontext API patch from Ivan Gyurdiev.
          * Merged genhomedircon patch from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 1.29.20-1
changelog:
  - Update from upstream
          * Merged seuser/user_extra support patch to semodule_package
            from Joshua Brindle.
          * Merged getopt type fix for semodule_link/expand and sestatus
            from Chris PeBenito.
  - Fix genhomedircon output


author: Dan Walsh <dwalsh@redhat.com> 1.29.23-1
changelog:
  - Update from upstream
          * Merged newrole -V/--version support from Glauber de Oliveira Costa.
          * Merged genhomedircon prefix patch from Dan Walsh.
          * Merged optionals in base patch from Joshua Brindle.


author: Dan Walsh <dwalsh@redhat.com> 1.29.26-1
changelog:
  - Update from upstream
          * Merged semanage bug fix patch from Ivan Gyurdiev.
          * Merged improve bindings patch from Ivan Gyurdiev.
          * Merged semanage usage patch from Ivan Gyurdiev.
          * Merged use PyList patch from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.30.1-1
changelog:
  - Make audit2allow translate dontaudit as well as allow rules
  - Update from upstream
          * Merged semanage labeling prefix patch from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.30.4-1
changelog:
  - Update from upstream
          * Merged audit2allow fixes for refpolicy from Dan Walsh.
          * Merged fixfiles patch from Dan Walsh.
          * Merged restorecond daemon from Dan Walsh.
          * Merged semanage non-MLS fixes from Chris PeBenito.
          * Merged semanage and semodule man page examples from Thomas Bleher.


author: Dan Walsh <dwalsh@redhat.com> 1.30.6-1
changelog:
  - Add /etc/samba/secrets.tdb to restorecond.conf
  - Update from upstream
          * Merged semanage prefix support from Russell Coker.
          * Added a test to setfiles to check that the spec file is
            a regular file.


author: Dan Walsh <dwalsh@redhat.com> 1.30.8-1
changelog:
  - Update to upstream
          * Merged fix warnings patch from Karl MacMillan.
          * Merged patch from Dan Walsh.
            This includes audit2allow changes for analysis plugins,
            internationalization support for several additional programs
            and added po files, some fixes for semanage, and several cleanups.
            It also adds a new secon utility.


author: Dan Walsh <dwalsh@redhat.com> 1.30.9-1
changelog:
  - Update to upstream
          * Fixed audit2allow and po Makefiles for DESTDIR= builds.
          * Merged .po file patch from Dan Walsh.
          * Merged bug fix for genhomedircon.


author: Dan Walsh <dwalsh@redhat.com> 1.30.10-1
changelog:
  - Update to upstream
          * Merged patch with updates to audit2allow, secon, genhomedircon,
            and semanage from Dan Walsh.


author: James Antill <jantill@redhat.com> 1.30.10-2
changelog:
  - secon fixes for --self-exec etc.
  - secon change from level => sensitivity, add clearance.
  - Add mass relabel AUDIT patch, but disable it until kernel problem solved.


author: Dan Walsh <dwalsh@redhat.com> 1.30.11-1
changelog:
  - Update to upstream
          * Merged more translations from Dan Walsh.
          * Merged patch to relocate setfiles to /sbin for early relabel
            when /usr might not be mounted from Dan Walsh.
          * Merged semanage/seobject patch to preserve fcontext ordering in list.
          * Merged secon patch from James Antill.


author: Dan Walsh <dwalsh@redhat.com> 1.30.14-1
changelog:
  - Update to upstream
          * Merged fix for setsebool error path from Serge Hallyn.
          * Merged patch from Dan Walsh with:
          *    Updated po files.
          *    Fixes for genhomedircon and seobject.
          *    Audit message for mass relabel by setfiles.


author: Dan Walsh <dwalsh@redhat.com> 1.30.17-1
changelog:
  - Update to upstream
          * Lindent.
          * Merged patch from Dan Walsh with:
            * -p option (progress) for setfiles and restorecon.
            * disable context translation for setfiles and restorecon.
            * on/off values for setsebool.
          * Merged setfiles and semodule_link fixes from Joshua Brindle.


author: Dan Walsh <dwalsh@redhat.com> 1.30.22-1
changelog:
  - Update to upstream
          * Merged restorecond size_t fix from Joshua Brindle.
          * Merged secon keycreate patch from Michael LeMay.
          * Merged restorecond fixes from Dan Walsh.
            Merged updated po files from Dan Walsh.
          * Merged python gettext patch from Stephen Bennett.
          * Merged semodule_deps from Karl MacMillan.


author: Dan Walsh <dwalsh@redhat.com> 1.30.25-1
changelog:
  - Update to upstream
          * Merged patch from Dan Walsh with:
                  * audit2allow: process MAC_POLICY_LOAD events
                  * newrole: run shell with - prefix to start a login shell
                  * po: po file updates
                  * restorecond: bail if SELinux not enabled
                  * fixfiles: omit -q
                  * genhomedircon:  fix exit code if non-root
                  * semodule_deps:  install man page
          * Merged secon Makefile fix from Joshua Brindle.
          * Merged netfilter contexts support patch from Chris PeBenito.


author: Dan Walsh <dwalsh@redhat.com> 1.30.26-1
changelog:
  - Update to upstream
          * Merged semanage local file contexts patch from Chris PeBenito.
  - Fix fixfiles log creation
  - More translations


author: Dan Walsh <dwalsh@redhat.com> 1.30.27-4
changelog:
  - Add -i qualified to restorecon to tell it to ignore files that do not exist
  - Fixfiles also modified for this change


author: Dan Walsh <dwalsh@redhat.com> 1.30.28-1
changelog:
  - Security fixes to run python in a more locked down manner
  - More Translations
  - Update to upstream
          * Merged fix for restorecon // handling from Erich Schubert.
          * Merged translations update and fixfiles fix from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 1.30.28-6
changelog:
  - Change setfiles and restorecon to use stderr except for -o flag
  - Also -o flag will now output files


author: Dan Walsh <dwalsh@redhat.com> 1.30.30-1
changelog:
  - Update to upstream
          * Merged newrole auditing of failures due to user actions from
            Michael Thompson.


author: Dan Walsh <dwalsh@redhat.com> 1.32-1
changelog:
  - Add newrole audit patch from sgrubb
  - Update to upstream
          * Merged audit2allow -l fix from Yuichi Nakamura.
          * Merged restorecon -i and -o - support from Karl MacMillan.
          * Merged semanage/seobject fix from Dan Walsh.
          * Merged fixfiles -R and verify changes from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 1.33.1-1
changelog:
  - Update to upstream
          * Merged newrole patch set from Michael Thompson.
  - Add policycoreutils-gui


author: Dan Walsh <dwalsh@redhat.com> 1.33.4-1
changelog:
  - Upstream accepted my patches
          * Merged setsebool patch from Karl MacMillan.
            This fixes a bug reported by Yuichi Nakamura with
            always setting booleans persistently on an unmanaged system.


author: Dan Walsh <dwalsh@redhat.com> 1.33.6-1
changelog:
  - Update to upstream
          * Patch from Dan Walsh to add an pam_acct_msg call to run_init
          * Patch from Dan Walsh to fix error code returns in newrole
          * Patch from Dan Walsh to remove verbose flag from semanage man page
          * Patch from Dan Walsh to make audit2allow use refpolicy Makefile
            in /usr/share/selinux/<SELINUXTYPE>


author: Dan Walsh <dwalsh@redhat.com> 1.33.6-5
changelog:
  - Update po files
  - Fix newrole to open stdout and stderr rdrw so more will work on MLS machines
  Resolves: #216920


author: Dan Walsh <dwalsh@redhat.com> 1.33.6-6
changelog:
  - Fix audit2allow generating reference policy
  - Fix semanage to manage user roles properly
  Resolves: #220071


author: Dan Walsh <dwalsh@redhat.com> 1.33.6-7
changelog:
  - add exists switch to semanage to tell it not to check for existance of Linux user
  Resolves: #219421


author: Dan Walsh <dwalsh@redhat.com> 1.33.6-9
changelog:
  - Fix fixfiles script to use tty command correctly.  If this command fails, it
  should set the LOGFILE to /dev/null
  Resolves: #220879


author: Dan Walsh <dwalsh@redhat.com> 1.33.8-1
changelog:
  - Update to upstream
          * Merged patches from Dan Walsh to:
            - omit the optional name from audit2allow
            - use the installed python version in the Makefiles
            - re-open the tty with O_RDWR in newrole


author: Dan Walsh <dwalsh@redhat.com> 1.33.10-1
changelog:
  - Update to upstream
          * Merged patch to correctly handle a failure during semanage handle
            creation from Karl MacMillan.
          * Merged patch to fix seobject role modification from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 1.33.11-1
changelog:
  - Update to upstream
          * Merged fixfiles and seobject fixes from Dan Walsh.
          * Merged semodule support for list of modules after -i from Karl MacMillan.


author: Dan Walsh <dwalsh@redhat.com> 1.33.12-1
changelog:
  - Want to update to match api
  - Update to upstream
          * Merged newrole securetty check from Dan Walsh.
          * Merged semodule patch to generalize list support from Karl MacMillan.
  Resolves: #200110


author: Dan Walsh <dwalsh@redhat.com> 1.33.14-1
changelog:
  * Merged newrole man page patch from Michael Thompson.
          * Merged patch to fix python unicode problem from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 1.33.15-1
changelog:
  - Update to upstream
          * Merged unicode-to-string fix for seobject audit from Dan Walsh.
          * Merged man page updates to make "apropos selinux" work from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 1.34.1-1
changelog:
  - Fix system-config-selinux ports view
  - Update to upstream
          * Fixed newrole non-pam build.
          * Updated version for stable branch.


author: Dan Walsh <dwalsh@redhat.com> 2.0.0-1
changelog:
  - Update to upstream
          * Merged new audit2allow from Karl MacMillan.
            This audit2allow depends on the new sepolgen python module.
            Note that you must run the sepolgen-ifgen tool to generate
            the data needed by audit2allow to generate refpolicy.
          * Fixed newrole non-pam build.
  - Fix Changelog and spelling error in man page


author: Dan Walsh <dwalsh@redhat.com> 2.0.1-1
changelog:
  - Update to upstream
          * Merged small fix to correct include of errcodes.h in semodule_deps from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 2.0.2-1
changelog:
  - Update to upstream
          * Merged seobject exception handler fix from Caleb Case.
          * Merged setfiles memory leak patch from Todd Miller.


author: Dan Walsh <dwalsh@redhat.com> 2.0.3-1
changelog:
  - Update to upstream
          * Merged translations update from Dan Walsh.
          * Merged chcat fixes from Dan Walsh.
          * Merged man page fixes from Dan Walsh.
          * Merged seobject prefix validity checking from Dan Walsh.
          * Merged Makefile and refparser.py patch from Dan Walsh.
            Fixes PYTHONLIBDIR definition and error handling on interface files.


author: Dan Walsh <dwalsh@redhat.com> 2.0.6-1
changelog:
  - Update to upstream
    - policycoreutils
          * Merged newrole O_NONBLOCK fix from Linda Knippers.
          * Merged sepolgen and audit2allow patches to leave generated files
            in the current directory from Karl MacMillan.
          * Merged restorecond memory leak fix from Steve Grubb.
    -sepolgen
          * Merged patch to leave generated files (e.g. local.te) in current directory from Karl MacMillan.
          * Merged patch to make run-tests.py use unittest.main from Karl MacMillan.
          * Merged patch to update PLY from Karl MacMillan.
          * Merged patch to update the sepolgen parser to handle the latest reference policy from Karl MacMillan.


author: Dan Walsh <dwalsh@redhat.com> 2.0.6-3
changelog:
  - Update to upstream
    -sepolgen
          * Merged support for enabling parser debugging from Karl MacMillan.
  - Add sgrupp cleanup of restorcon init script


author: Dan Walsh <dwalsh@redhat.com> 2.0.7-1
changelog:
  - Update to upstream
          * Merged restorecond init script LSB compliance patch from Steve Grubb.
    -sepolgen
          * Merged better matching for refpolicy style from Karl MacMillan
          * Merged support for extracting interface paramaters from interface calls from Karl MacMillan
          * Merged support for parsing USER_AVC audit messages from Karl MacMillan.


author: Dan Walsh <dwalsh@redhat.com> 2.0.7-5
changelog:
  - Change location of audit2allow and sepol-ifgen to sbin
  - Updated version of sepolgen
          * Merged patch to move the sepolgen runtime data from /usr/share to /var/lib to facilitate a read-only /usr from Karl MacMillan.


author: Dan Walsh <dwalsh@redhat.com> 2.0.7-6
changelog:
  - Updated version of sepolgen
          * Merged patch to discard self from types when generating requires from Karl MacMillan.


author: Dan Walsh <dwalsh@redhat.com> 2.0.7-8
changelog:
  - system-config-selinux should be able to run on a disabled system,
  - at least enough to get it enabled.


author: Dan Walsh <dwalsh@redhat.com> 2.0.8-1
changelog:
  - Updated version of sepolgen
          * Merged updates to sepolgen-ifgen from Karl MacMillan.
          * Merged updates to sepolgen parser and tools from Karl MacMillan.
            This includes improved debugging support, handling of interface
            calls with list parameters, support for role transition rules,
            updated range transition rule support, and looser matching.


author: Dan Walsh <dwalsh@redhat.com> 2.0.9-1
changelog:
  - Updated version of sepolgen
          * Merged seobject setransRecords patch to return the first alias from Xavier Toth.


author: Dan Walsh <dwalsh@redhat.com> 2.0.10-1
changelog:
  - Updated version of policycoreutils
          * Merged chcat, fixfiles, genhomedircon, restorecond, and restorecon patches from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 2.0.13-1
changelog:
  - Updated version of policycoreutils
          * Merged setsebool patch to only use libsemanage for persistent boolean changes from Stephen Smalley.
          * Merged genhomedircon patch to use the __default__ setting from Dan Walsh.
          * Dropped -b option from load_policy in preparation for always preserving booleans across reloads in the kernel.


author: Dan Walsh <dwalsh@redhat.com> 2.0.15-1
changelog:
  - Updated version of policycoreutils
          * Merged po file updates from Dan Walsh.
  - Fix semanage to be able to modify prefix in user record


author: Dan Walsh <dwalsh@redhat.com> 2.0.16-1
changelog:
  - Updated version of policycoreutils
          * Merged support for modifying the prefix via semanage from Dan Walsh.
  - Fixed genhomedircon to find homedirs correctly.


author: Dan Walsh <dwalsh@redhat.com> 2.0.20-1
changelog:
  - Update to match NSA
          * Merged genhomedircon fixes from Dan Walsh.
          * Merged setfiles -c usage fix from Dan Walsh.
          * Merged restorecon fix from Yuichi Nakamura.
          * Dropped -lsepol where no longer needed.


author: Dan Walsh <dwalsh@redhat.com> 2.0.22-13
changelog:
  - Speed up genhomedircon by an order of magnitude by compiling regex
  - Allow semanage fcontext -a -t <<none>> /path to work


author: Dan Walsh <dwalsh@redhat.com> 2.0.25-1
changelog:
  - Update semodule man page
          * Fix genhomedircon searching for USER from Todd Miller
          * Install run_init with mode 0755 from Dan Walsh.
          * Fix chcat from Dan Walsh.
          * Fix fixfiles pattern expansion and error reporting from Dan Walsh.
          * Optimize genhomedircon to compile regexes once from Dan Walsh.
          * Fix semanage gettext call from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 2.0.25-13
changelog:
  - Upgrade version of sepolgen from NSA
          * Expand the sepolgen parser to parse all current refpolicy modules from Karl MacMillan.
          * Suppress generation of rules for non-denials from Karl MacMillan (take 3).


author: Dan Walsh <dwalsh@redhat.com> 2.0.28-1
changelog:
  - Update to upstream
          * Update semodule man page for -D from Dan Walsh.
          * Add boolean, locallist, deleteall, and store support to semanage from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 2.0.29-1
changelog:
  - Update to upstream
          * Add genhomedircon script to invoke semodule -Bn from Dan Walsh.
  - Add deleteall for ports and fcontext


author: Dan Walsh <dwalsh@redhat.com> 2.0.31-1
changelog:
  - Remove no.po
  - Update to upstream
          * Fix semodule option handling from Dan Walsh.
          * Add deleteall support for ports and fcontexts in semanage from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 2.0.33-1
changelog:
  - Upgrade from NSA
          * Drop verbose output on fixfiles -C from Dan Walsh.
          * Fix argument handling in fixfiles from Dan Walsh.
          * Enhance boolean support in semanage, including using the .xml description when available, from Dan Walsh.
  - Fix handling of final screen in polgengui


author: Dan Walsh <dwalsh@redhat.com> 2.0.33-4
changelog:
  - Fix sepolgen to be able to parse Fedora 9 policy
        Handle ifelse statements
        Handle refpolicywarn inside of define
        Add init.if and inetd.if into parse
        Add parse_file to syntax error message


author: Dan Walsh <dwalsh@redhat.com> 2.0.34-1
changelog:
  - Update to upstream
          * Update Makefile to not build restorecond if
            /usr/include/sys/inotify.h is not present


author: Dan Walsh <dwalsh@redhat.com> 2.0.34-2
changelog:
  - Make sepolgen set error exit code when partial failure
  - audit2why now checks booleans for avc diagnosis


author: Dan Walsh <dwalsh@redhat.com> 2.0.35-1
changelog:
  - Update to upstream
          * Merged support for non-interactive newrole command invocation from Tim Reed.


author: Dan Walsh <dwalsh@redhat.com> 2.0.36-1
changelog:
  - Update to upstream
          * Merged update to chcat, fixfiles, and semanage scripts from Dan Walsh.
          * Merged sepolgen fixes from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 2.0.38-1
changelog:
  - Update to upstream
    * Merged audit2allow cleanups and boolean descriptions from Dan Walsh.
    * Merged setfiles -0 support by Benny Amorsen via Dan Walsh.
    * Merged fixfiles fixes and support for ext4 and gfs2 from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 2.0.39-1
changelog:
  - Don't initialize audit2allow for audit2why call.  Use default
  - Update to upstream
          * Merged fixfiles -C fix from Marshall Miller.


author: Dan Walsh <dwalsh@redhat.com> 2.0.41-1
changelog:
  - Update to upstream
          * Merged audit2why fix and semanage boolean --on/--off/-1/-0 support from Dan Walsh.
          * Merged a second fixfiles -C fix from Marshall Miller.


author: Dan Walsh <dwalsh@redhat.com> 2.0.42-1
changelog:
  - Update to upstream
          * Make semodule_expand use sepol_set_expand_consume_base to reduce
            peak memory usage.


author: Dan Walsh <dwalsh@redhat.com> 2.0.43-1
changelog:
  - Update to upstream
          * Merged fix fixfiles option processing from Vaclav Ovsik.
  - Added existing users, staff and user_t users to polgengui


author: Dan Walsh <dwalsh@redhat.com> 2.0.46-1
changelog:
  - Update to upstream
          * Update audit2allow to report dontaudit cases from Dan Walsh.
          * Fix semanage port to use --proto from Caleb Case.


author: Dan Walsh <dwalsh@redhat.com> 2.0.47-1
changelog:
  - Make restorecond not start by default
  - Fix polgengui to allow defining of confined roles.
  - Add patches from Lubomir Rintel <lkundrak@v3.sk>
    * Add necessary runtime dependencies on setools-console for -gui
    * separate stderr when run seinfo commands
  - Update to upstream
    * Update semanage man page for booleans from Dan Walsh.
    * Add further error checking to seobject.py for setting booleans.


author: Dan Walsh <dwalsh@redhat.com> 2.0.47-2
changelog:
  - Add rm -rf /tmp/gconfd-* /tmp/pulse-* /tmp/orbit-* to fixfiles restore
  - So that mislabeled files will get removed on full relabel


author: Dan Walsh <dwalsh@redhat.com> 2.0.49-1
changelog:
  - Update to upstream
          * Remove security_check_context calls for prefix validation from semanage.
          * Change setfiles and restorecon to not relabel if the file already has the correct context value even if -F/force is specified.


author: Dan Walsh <dwalsh@redhat.com> 2.0.52-2
changelog:
  - Add lockdown wizard
  - Allow semanage booleans to take an input file an process lots of booleans at once.


author: Dan Walsh <dwalsh@redhat.com> 2.0.53-1
changelog:
  - Update to upstream
          * Change setfiles to validate all file_contexts files when using -c from Stephen Smalley.


author: Dan Walsh <dwalsh@redhat.com> 2.0.54-1
changelog:
  - Update to upstream
          * Add support for boolean files and group support for seusers from Dan Walsh.
          * Ensure that setfiles -p output is newline terminated from Russell Coker.


author: Dan Walsh <dwalsh@redhat.com> 2.0.56-1
changelog:
  - Fix semanage help display
  - Update to upstream
          * fixfiles will now remove all files in /tmp and will check for
            unlabeled_t in /tmp and /var/tmp from Dan Walsh.
          * add glob support to restorecond from Dan Walsh.
          * allow semanage to handle multi-line commands in a single transaction
            from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 2.0.58-1
changelog:
  - Update to upstream
          * Allow local file context entries to override policy entries in
          semanage from Dan Walsh.
          * Newrole error message corrections from Dan Walsh.
          * Add exception to audit2why call in audit2allow from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 2.0.61-1
changelog:
  - Update to upstream
          * chcat: cut categories at arbitrary point (25) from Dan Walsh
          * semodule: use new interfaces in libsemanage for compressed files
            from Dan Walsh
          * audit2allow: string changes for usage


author: Dan Walsh <dwalsh@redhat.com> 2.0.61-3
changelog:
  - Add Domains Page to system-config-selinux
  - Add ability to create dbus confined applications to polgen


author: Dan Walsh <dwalsh@redhat.com> 2.0.62-1
changelog:
  - Update to upstream
          * Add btrfs to fixfiles from Dan Walsh.
          * Remove restorecond error for matching globs with multiple hard links
          and fix some error messages from Dan Walsh.
          * Make removing a non-existant module a warning rather than an error
            from Dan Walsh.
          * Man page fixes from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 2.0.63-1
changelog:
  - Update to upstream
          * Fix transaction checking from Dan Walsh.
          * Make fixfiles -R (for rpm) recursive.
          * Make semanage permissive clean up after itself from Dan Walsh.
          * add /root/.ssh/* to restorecond.conf


author: Dan Walsh <dwalsh@redhat.com> 2.0.64-1
changelog:
  - Update to upstream
          * Keep setfiles from spamming console from Dan Walsh.
          * Fix chcat's category expansion for users from Dan Walsh.
  - Update po files
  - Fix sepolgen


author: Dan Walsh <dwalsh@redhat.com> 2.0.68-1
changelog:
  - Fix location of man pages
  - Update to upstream
          * Modify setfiles to exclude mounts without seclabel option in
          /proc/mounts on kernels >= 2.6.30 from Thomas Liu.
          * Re-enable disable_dontaudit rules upon semodule -B from Christopher
          Pardy and Dan Walsh.
          * setfiles converted to fts from Thomas Liu.


author: Dan Walsh <dwalsh@redhat.com> 2.0.70-1
changelog:
  - Update to upstream
          * Modify restorecon to only call realpath() on user-supplied pathnames
          from Stephen Smalley.
          * Fix typo in fixfiles that prevented it from relabeling btrfs
            filesystems from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 2.0.71-1
changelog:
  - Fix chcat to report error on non existing file
  - Update to upstream
          * Modify setfiles/restorecon checking of exclude paths.  Only check
          user-supplied exclude paths (not automatically generated ones based on
          lack of seclabel support), don't require them to be directories, and
          ignore permission denied errors on them (it is ok to exclude a path to
          which the caller lacks permission).


author: Ville Skyttä <ville.skytta@iki.fi> - 2.0.71-9
changelog:
  - Don't try to remove restorecond after last erase (done already in %preun).
  - Ensure scriptlets exit with status 0.
  - Fix %post and %pr


author: Dan Walsh <dwalsh@redhat.com> 2.0.73-1
changelog:
  - Update to upstream
          * Add semanage dontaudit to turn off dontaudits from Dan Walsh.
          * Fix semanage to set correct mode for setrans file from Dan Walsh.
          * Fix malformed dictionary in portRecord from Dan Walsh.
          * Restore symlink handling support to restorecon based on a patch by
          Martin Orr.  This fixes the restorecon /dev/stdin performed by Debian
          udev scripts that was broken by policycoreutils 2.0.70.


author: Dan Walsh <dwalsh@redhat.com> 2.0.74-1
changelog:
  - Update to upstream
          * Change semodule upgrade behavior to install even if the module
            is not present from Dan Walsh.
          * Make setfiles label if selinux is disabled and a seclabel aware
            kernel is running from Caleb Case.
          * Clarify forkpty() error message in run_init from Manoj Srivastava.


author: Dan Walsh <dwalsh@redhat.com> 2.0.74-8
changelog:
  - Add check to sandbox to verify save changes - Chris Pardy
  - Fix memory leak in restorecond - Steve Grubb


author: Dan Walsh <dwalsh@redhat.com> 2.0.74-14
changelog:
  - Allow semanage -i and semanage -o to generate customization files.
  - semanage -o will generate a customization file that semanage -i can read and set a machines to the same selinux configuration


author: Dan Walsh <dwalsh@redhat.com> 2.0.76-1
changelog:
  - Update to upstream
          * Remove setrans management from semanage, as it does not work
            from Dan Walsh.
          * Move load_policy from /usr/sbin to /sbin from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 2.0.77-1
changelog:
  - Update to upstream
          * Fixed bug preventing semanage node -a from working
            from Chad Sellers
          * Fixed bug preventing semanage fcontext -l from working
            from Chad Sellers
  - Change semanage to use unicode


author: Dan Walsh <dwalsh@redhat.com> 2.0.78-1
changelog:
  - Update to upstream
          * Remove non-working OUTFILE from fixfiles from Dan Walsh.
          * Additional exception handling in chcat from Dan Walsh.

          * fix sepolgen to read a "type 1403" msg as a policy load by Stephen
            Smalley <sds@tycho.nsa.gov>
          * Add support for Xen ocontexts from Paul Nuzzi.


author: Dan Walsh <dwalsh@redhat.com> 2.0.78-14
changelog:
  - Add session capability to sandbox
  - sandbox -SX -H ~/.homedir -t unconfined_t -l s0:c15 /etc/gdm/Xsession


author: Dan Walsh <dwalsh@redhat.com> 2.0.81-4
changelog:
  - Update to upstream - sepolgen
          * Add since-last-boot option to audit2allow from Dan Walsh.
          * Fix sepolgen output to match what Chris expects for upstream
            refpolicy from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 2.0.82-1
changelog:
  - Update to upstream
          * Add avc's since boot from Dan Walsh.
          * Fix unit tests from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 2.0.82-7
changelog:
  - Fix crash when args are empty
  Resolves: #582542
  - Fix semange to exit on bad options
  - Fix semanage dontaudit man page section
  Resolves: #582533


author: Dan Walsh <dwalsh@redhat.com> 2.0.82-13
changelog:
  - Make semanage boolean work on disabled machines and during livecd xguest
  - Fix homedir and tmpdir handling in sandbox
  Resolves: #587263


author: Dan Walsh <dwalsh@redhat.com> 2.0.82-17
changelog:
  - Fix policy tool to have correct name in menus
  - Fix seunshare to handle /tmp being in ~/home
  - Fix saving of altered files
  - Update translations


author: Dan Walsh <dwalsh@redhat.com> 2.0.82-23
changelog:
  - Fix seunshare translations
  - Fix seunshare to work on all arches
  - Fix icon for system-config-selinux
  Resolves: #595276


author: Dan Walsh <dwalsh@redhat.com> 2.0.82-27
changelog:
  - Move genhomedircon.8 to same package as genhomedircon
  - Fix sandbox to pass unit test
  Resolves: #595796


author: Dan Walsh <dwalsh@redhat.com> 2.0.83-1
changelog:
  - Update to upstream
          * Add sandbox support from Dan Walsh with modifications from Steve Lawrence.


author: Dan Walsh <dwalsh@redhat.com> 2.0.83-17
changelog:
  - Apply patch to restorecond from Chris Adams, which will cause restorecond
  - to watch first user that logs in.


author: Dan Walsh <dwalsh@redhat.com> 2.0.83-20
changelog:
  - Tighten down seunshare to create /tmp dir with sticky bit and MS_NODEV | MS_NOSUID | MS_NOEXEC;
  - Remove setsid on seunshare so ^c on sandbox will cause apps to exit
  - Add dbus-launch --exit-with-session so all processes launched within the sandbox exit with the sandbox
  - Clean up error handling so error will get sent back to sandbox tool


author: Dan Walsh <dwalsh@redhat.com> 2.0.83-32
changelog:
  - Remove setuid flag and replace with file capabilities
  - Fix sandbox handling of files with spaces in them


author: Dan Walsh <dwalsh@redhat.com> 2.0.83-33
changelog:
  - Move /etc/pam.d/newrole in to polcicycoreutils-newrole
  - Additional capability checking in sepolgen


author: Dan Walsh <dwalsh@redhat.com> 2.0.85-3
changelog:
  - Polgengui raises the wrong type of exception.  #471078
  - Change semanage to not allow it to semanage module -D
  - Change setsebool to suggest run as root on failure


author: Dan Walsh <dwalsh@redhat.com> 2.0.85-10
changelog:
  - Cleaup selinux-polgengui to be a little more modern, fix comments and use selected name
  - Cleanup chcat man page


author: Dan Walsh <dwalsh@redhat.com> 2.0.85-13
changelog:
  - Rewrite seunshare to make sure /tmp is mounted stickybit owned by root
  - Only allow names in polgengui that contain letters and numbers
  - Fix up node handling in semanage command
  - Update translations


author: Dan Walsh <dwalsh@redhat.com> 2.0.85-16
changelog:
  - Require python-IPy for policycoreutils-python package
  - Fixes for sepologen
    - Usage statement needs -n name
    - Names with _ are being prevented
    - dbus apps should get _chat interface


author: Dan Walsh <dwalsh@redhat.com> 2.0.85-18
changelog:
  - put back in old handling of -T in sandbox command
  - Put back setsid in seunshare
  - Fix rsync to maintain times


author: Dan Walsh <dwalsh@redhat.com> 2.0.85-20
changelog:
  - Change sepolgen-ifgen to search all available policy files
  - Exit in restorecond if it can not find a UID in the passwd database


author: Dan Walsh <dwalsh@redhat.com> 2.0.85-21
changelog:
  - change default location of HOMEDIR in sandbox to /tmp/.sandbox_home_*
  - This will allow default sandboxes to work on NFS homedirs without allowing
    access to homedir data


author: Dan Walsh <dwalsh@redhat.com> 2.0.85-23
changelog:
  - Fix sepolgen to generate network polcy using generic_if and genric_node versus all_if and all_node


author: Dan Walsh <dwalsh@redhat.com> 2.0.86-6
changelog:
  - Apply patches from Christoph A.
    * fix sandbox title
    * stop xephyr from li
  - Also ignore errors on sandbox include of directory missing files


author: Dan Walsh <dwalsh@redhat.com> 2.0.86-10
changelog:
  - Allow semodule to pick alternate root for selinux files
  - Add ~/.config/* to restorcond_user.conf, so restorecond will watch for mislabeled files in this directory.


author: Dan Walsh <dwalsh@redhat.com> 2.0.86-16
changelog:
  - Add -C option to sandbox and seunshare to maintain capabilities, otherwise
  the bounding set will be dropped.
  - Change --cgroups short name -c rather then -C for consistancy
  - Fix memory and fd leaks in seunshare


author: Dan Walsh <dwalsh@redhat.com> 2.0.86-17
changelog:
  - Add -k qualifier to seunshare to have it attempt to kill all processes with
  the matching MCS label.


author: Dan Walsh <dwalsh@redhat.com> 2.0.86-18
changelog:
  - Change seunshare to send kill signals to the childs session.
  - Also add signal handler to catch sigint, so if user enters ctrl-C sandbox will shutdown.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.4-1
changelog:
  -Update to upstream
  2.1.4 2011-08-17
          * run_init: clarification of the usage in the
          * semanage: fix usage header around booleans
          * semanage: remove useless empty lines
          * semanage: update man page with new examples
          * semanage: update usage text
          * semanage: introduce file context equivalencies
          * semanage: enable and disable modules
          * semanage: output all local modifications
          * semanage: introduce extraction of local configuration
          * semanage: cleanup error on invalid operation
          * semanage: handle being called with no arguments
          * semanage: return sooner to save CPU time
          * semanage: surround getopt with try/except
          * semanage: use define/raise instead of lots of
          * semanage: some options are only valid for
          * semanage: introduce better deleteall support
          * semanage: do not allow spaces in file
          * semanage: distinguish between builtin and local permissive
          * semanage: centralized ip node handling
          * setfiles: make the restore function exclude() non-static
          * setfiles: use glob to handle ~ and
          * fixfiles: do not hard code types
          * fixfiles: stop trying to be smart about
          * fixfiles: use new kernel seclabel option
          * fixfiles: pipe everything to cat before sending
          * fixfiles: introduce /etc/selinux/fixfiles_exclude_dirs
          * semodule: support for alternative root paths

  2.1.3 2011-08-03
          * semanage: fix indention
          * semodule_package: fix man page typo
          * semodule_expand: update man page with -a
          * semanage: handle os errors
          * semanage: fix traceback with bad options
          * semanage: show usage on -h or --help
          * semanage: introduce more deleteall options
          * semanage: verify ports < 65536
          * transaction into semanageRecords
          * make get_handle a method of semanageRecords
          * remove a needless blank line
          * make process_one error if not initialized correctly
          * fixfiles: correct usage for r_opts.rootpath
          * put -p in help for restorecon and
          * fixfiles: do not try to only label
          * fixfiles clean up /var/run and /var/lib/debug
          * fixfiles delete tmp sockets and pipes rather
          * fixfile use find -delete instead of pipe
          * chcat man page typo
          * add man page for genhomedircon
          * setfiles fix typo
          * setsebool should inform users they need to
          * setsebool typos
          * open_init_tty man page typos
          * Don't add user site directory to sys.path
          * newrole retain CAP_SETPCAP

  2.1.2 2011-08-02
          * seunshare: define _GNU_SOURCE earlier
          * make ignore_enoent do something
          * restorecond: first user logged in is not noticed
          * Repo: update .gitignore

  2.1.1 2011-08-01
          * Man page updates
          * restorecon fix for bad inotify assumptions

  2.1.0 2011-07-27
          * Release, minor version bump


author: Dan Walsh <dwalsh@redhat.com> - 2.1.5-1
changelog:
  -Update to upstream
     * policycoreutils
          * setfiles: Fix process_glob to handle error situations
          * sandbox: Allow seunshare to run as root
          * sandbox: trap sigterm to make sure sandbox
          * sandbox: pass DPI from the desktop
          * sandbox: seunshare: introduce helper spawn_command
          * sandbox: seunshare: introduce new filesystem helpers
          * sandbox: add -C option to not drop
          * sandbox: split seunshare caps dropping
          * sandbox: use dbus-launch
          * sandbox: numerous simple updates to sandbox
          * sandbox: do not require selinux context
          * sandbox: Makefile: new man pages
          * sandbox: rename dir to srcdir
          * sandbox: allow users specify sandbox window size
          * sandbox: check for paths up front
          * sandbox: use defined values for paths rather
          * sandbox: move seunshare globals to the top
          * sandbox: whitespace fix
          * semodule_package: Add semodule_unpackage executable
          * setfiles: get rid of some stupid globals
          * setfiles: move exclude_non_seclabel_mounts to a generic location
     * sepolgen
          * refparser: include open among valid permissions
          * refparser: add support for filename_trans rules


author: Dan Walsh <dwalsh@redhat.com> - 2.1.5-4
changelog:
  - Maintain the LANG environment Variable into the sandbox
  - Change restorecon/setfiles to only change type part of the context unless
    -f qualifier is given


author: Dan Walsh <dwalsh@redhat.com> - 2.1.6-1
changelog:
  -Update to upstream
      policycoreutils-2.1.6
          * sepolgen-ifgen: new attr-helper does something
          * audit2allow: use alternate policy file
          * audit2allow: sepolgen-ifgen use the attr helper
          * setfiles: switch from stat to stat64
          * setfiles: Fix potential crash using dereferenced ftsent
          * setfiles: do not wrap * output at 80 characters
          * sandbox: add -Wall and -Werror to makefile
          * sandbox: add sandbox cgroup support
          * sandbox: rewrite /tmp handling
          * sandbox: do not bind mount so much
          * sandbox: add level based kill option
          * sandbox: cntrl-c should kill entire process control group
          * Create a new preserve_tunables flag in sepol_handle_t.
          * semanage: show running and disk setting for booleans
          * semanage: Dont print heading if no items selected
          * sepolgen: audit2allow is mistakakenly not allowing valid module names
          * semanage: Catch RuntimeErrors, that can be generated when SELinux is disabled
          * More files to ignore
          * tree: default make target to all not install
          * sandbox: do not load unused generic init functions
      sepolgen-1.1.2
          * src: sepolgen: add attribute storing infrastructure
          * Change perm-map and add open to try to get better results on
          * look for booleans that might solve problems
          * sepolgen: audit2allow is mistakakenly not allowing valid module names
          * tree: default make target to all not install


author: Dan Walsh <dwalsh@redhat.com> - 2.1.7-5
changelog:
  - A couple of minor coverity fixes for a potential leaked file descriptor
  - An an unchecked return code.
  - Add ~/.local/share/* to restorecond_user watches


author: Dan Walsh <dwalsh@redhat.com> - 2.1.8-1
changelog:
  - Upgrade to policycoreutils upstream
          * sandbox: Maintain the LANG environment into the sandbox
          * audit2allow: use audit2why internally
          * fixfiles: label /root but not /var/lib/BackupPC
          * semanage: update local boolean settings is dealing with localstore
          * semanage: missing modify=True
          * semanage: set modified correctly
          * restorecond: make restorecond dbuss-able
          * restorecon: Always check return code on asprintf
          * restorecond: make restorecond -u exit when terminal closes
          * sandbox: introduce package name and language stuff
          * semodule_package: remove semodule_unpackage on clean
          * fix sandbox Makefile to support DESTDIR
          * semanage: Add -o description to the semanage man page
          * make use of the new realpath_not_final function
          * setfiles: close /proc/mounts file when finished
          * semodule: Document semodule -p in man page
          * setfiles: fix use before initialized
          * restorecond: Add .local/share as a directory to watch
  - Upgrade to sepolgen upstream
          * Ignore permissive qualifier if found in an interface
          * Return name field in avc data


author: Dan Walsh <dwalsh@redhat.com> - 2.1.8-4
changelog:
  - sandbox init script should always return 0
  - sandbox command needs to check range of categories and report error if not big enough


author: Dan Walsh <dwalsh@redhat.com> - 2.1.8-6
changelog:
  - Add listing of distribution equivalence class from semanage fcontext -l
  - Add checking to semanage fcontext -a to guarantee a file specification will not be masked by an equivalence


author: Dan Walsh <dwalsh@redhat.com> - 2.1.8-7
changelog:
  - Fix dpi handling in sandbox
  - Make sure semanage fcontext -l -C prints if only local equiv have changed


author: Dan Walsh <dwalsh@redhat.com> - 2.1.9-1
changelog:
  - Upgrade to upstream
          * sandbox: move sandbox.conf.5 to just sandbox.5
          * po: Makefile use -p to preserve times to allow multilib simultatious installs
          * of po files
          * sandbox: Allow user to specify the DPI value for X in a sandbox
          * sandbox: make sure the domain launching sandbox has at least 100 categories
          * sandbox: do not try forever to find available category set
          * sandbox: only complain if sandbox unable to launch
          * sandbox: init script run twice is still successful
          * semanage: print local and dristo equiv rules
          * semanage: check file equivalence rules for conflict
          * semanage: Make sure semanage fcontext -l -C prints even if local keys
          * are not defined
          * semanage: change src,dst to target,substitute for equivalency
          * sestatus: Updated sestatus and man pages.
          * Added SELinux config file man page.
          * add clean target to man Makefile


author: Dan Walsh <dwalsh@redhat.com> - 2.1.10-1
changelog:
  -Update to upstream
  - sepolgen
          * better analysis of why things broke
  - policycoreutils
          * Remove excess whitespace
          * sandbox: Add back in . functions to sandbox.init script
          * Fix Makefile to match other policycoreutils Makefiles
          * semanage: drop unused translation getopt


author: Dan Walsh <dwalsh@redhat.com> - 2.1.10-4
changelog:
  - Fix the handling of namespaces in seunshare/sandbox.
  - Currently mounting of directories within sandbox is propogating to the
  - parent namesspace.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.10-11
changelog:
  - restorecond fixes:
    Stop using depracated g_io interfaces
    Exit with non zero exit code if wrong options given
    Add -h option


author: Dan Walsh <dwalsh@redhat.com> - 2.1.10-17
changelog:
  - Change semanage to produce proper audit records for Common Criteria
  - Cleanup packaging for usrmove


author: Dan Walsh <dwalsh@redhat.com> - 2.1.10-22
changelog:
  - Change to use new selinux_binary_policy_path()
  - Add systemd_passwd_agent_exec($1), and systemd_read_fifo_file_passwd_run($1) to templates for _admin interface


author: Dan Walsh <dwalsh@redhat.com> - 2.1.11-1
changelog:
  - Update to upstream
    - policycoreutils
          * sandbox: do not propogate inside mounts outside
          * sandbox: Removing sandbox init script, should no longer be necessary
          * restorecond: Stop using deprecated interfaces for g_io
          * semanage: proper auditting of user changes for LSPP
          * semanage: audit message to show what record(s) and item(s) have chaged
          * scripts: Update Makefiles to handle /usrmove
          * mcstrans: Version should have been bumped on last check in
          * seunshare: Only drop caps not the Bounding Set from seunshare
          * Add bash-completion scripts for setsebool and semanage
          * newrole: Use correct capng calls in newrole
          * Fix infinite loop with inotify on 2.6.31 kernels
          * fix ftbfs with hardening flags
          * Only run setfiles if we found read-write filesystems to run it on
          * update .po files
          * remove empty po files
          * do not fail to install if unable to make load_policy lnk file

     - sepolgen
          * Fix dead links to www.nsa.gov/selinux
          * audit.py Dont crash if empty data is passed to sepolgen
          * do not use md5 when calculating hash signatures
          * fix detection of policy loads


author: Dan Walsh <dwalsh@redhat.com> - 2.1.11-6
changelog:
  - Rebuild to get latest libsepol which fixes the file_name transition problems
  - Update translations
  - Fix calls to close fd for restorecond


author: Dan Walsh <dwalsh@redhat.com> - 2.1.11-12
changelog:
  - Add -N qualifier to semanage, setsebool and semodule to allow you to update
  - policy without reloading it into the kernel.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.11-15
changelog:
  - Allow stream sock_files to be stored in /tmp and etc_rw_t directories by sepolgen
  - Trigger on selinux-policy needs to change to selinux-policy-devel
  - Update translations
  - Fix semanage dontaudit off/on exception


author: Dan Walsh <dwalsh@redhat.com> - 2.1.11-1
changelog:
  - Update to upstream
    - policycoreutils
          * restorecond: wrong options should exit with non-zero error code
          * restorecond: Add -h option to get usage command
          * resorecond: user: fix fd leak
          * mcstrans: add -f to run in foreground
          * semanage: fix man page range and level defaults
          * semanage: bash completion for modules should include -a,-m, -d
          * semanage: manpage update for -e
          * semanage: dontaudit off should work
          * semanage: locallist option does not take an argument
          * sepolgen: Make use of setools optional within sepolgen
     - sepolgen
          * Make use of setools optional within sepolgen
          * We need to support files that have a + in them


author: Dan Walsh <dwalsh@redhat.com> - 2.1.11-4
changelog:
  - Fix restorecon to generate a better percentage of completion on restorecon -R /.
  - Have audit2allow look at the constaint violation and tell the user whether it
  - is because of user,role or level


author: Dan Walsh <dwalsh@redhat.com> - 2.1.11-6
changelog:
  - Change polgen to generate dbus apps as optional so they can compile on minimal policy system, patch from Miroslav Grepl


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-1
changelog:
  - Update to upstream
          * genhomedircon: manual page improvements
          * setfiles/restorecon minor improvements
          * run_init: If open_init_pty is not available then just use exec
          * newrole: do not drop capabilities when newrole is run as
          * restorecon: only update type by default
          * scripts: Don't syslog setfiles changes on a fixfiles restore
          * setfiles: do not syslog if no changes
          * Disable user restorecond by default
          * Make restorecon return 0 when a file has changed context
          * setfiles: Fix process_glob error handling
          * semanage: allow enable/disable under -m
          * add .tx to gitignore
          * translations: commit translations from Fedora community
          * po: silence build process
          * gui: Checking in policy to support polgengui and sepolgen.
          * gui: polgen: search for systemd subpackage when generating policy
          * gui: for exploring booleans
          * gui: system-config-selinux gui
          * Add Makefiles to support new gui code
          * gui: remove lockdown wizard
          * return equivalency records in fcontext customized
          * semanage: option to not load new policy into kernel after
          * sandbox: manpage update to describe standard types
          * setsebool: -N should not reload policy on changes
          * semodule: Add -N qualifier to no reload kernel policy
          * gui: polgen: sort selinux types of user controls
          * gui: polgen: follow symlinks and get the real path to
          * gui: Fix missing error function
          * setfiles: return errors when bad paths are given
          * fixfiles: tell restorecon to ignore missing paths
          * setsebool: error when setting multiple options
          * semanage: use boolean subs.
          * sandbox: Make sure Xephyr never listens on tcp ports
          * sepolgen: return and output constraint violation information
          * semanage: skip comments while reading external configuration files
          * restorecond: relabel all mount runtime files in the restorecond example
          * genhomedircon: dynamically create genhomedircon
          * Allow returning of bastard matches
          * sepolgen: return and output constraint violation information
          * audit2allow: one role/type pair per line


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-3
changelog:
  - Allow fixfiles to specify -v, so they can get verbosity rather then progress.
  - Fix load_file Makefile to use SBINDIR rather then real OS.
  - Fix man pages in setfiles and restorecon to reflect what happens when you relabel the entire OS.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-7
changelog:
  - Fix manpage generation, missing import
  - Add equiv_dict to get samba booleans into smbd_selinux
  - Add proper translations for booleans and remove selinux.tbl


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-8
changelog:
  - Fix typo in preunstall line for restorecond
  - Add mgrepl patch to consolidate file context generated by sepolicy generate


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-9
changelog:
  - Fix semanage to verify that types are appropriate for commands.
    * Patch initiated by mgrepl
    * Fixes problem of specifying non file_types for fcontext, or not port_types for semanage port


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-10
changelog:
  - Update sepolicy generate with patch to create spec file and man page.
  - Patch initiated by Miroslav Grepl


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-12
changelog:
  - Add missing spec.py from templates directory needed for sepolicy generate
  - Add /var/tmp as collection point for sandbox apps.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-14
changelog:
  - Add role_allow to sepolicy.search python bindings, this allows us to remove last requirement for setools-cmdline in gui tools.
  - Fix man page generator.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-16
changelog:
  - Add Miroslav Grepl patch to generate html man pages
  - Update Translations
  - Add option to sandbox to shred files before deleting


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-19
changelog:
  - Change sepolicy python bindings to have python pick policy file, fixes weird memory problems in sepolicy network


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-24
changelog:
  - Fix manpage to generate proper man pages for alternate policy,
  basically allow me to build RHEL6 man pages on a Fedora 18 box, as long as
  I pull the policy, policy.xml and file_contexts and file_contexts.homedir


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-25
changelog:
  - Remove run_init, no longer needed with systemd.
  - Fix sepolicy generate to not include subdirs in generated fcontext file.  (mgrepl patch)


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-26
changelog:
  - Fix semanage booleans -l, move more boolean_dict handling into sepolicy
  - Update translations
  - Fixup sepolicy generate to discover /var/log, /var/run and /var/lib directories if they match the name
  - Fix kill function call should indicate signal_perms not kill capability
  - Error out cleanly in system-config-selinux, if it can not contact XServer


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-27
changelog:
  - Only report restorecon warning for missing default label, if not running
  recusively
  - Update translations


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-37
changelog:
  - Move sepogen python bindings back into policycoreutils-python out of -devel, since sepolicy is using the


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-41
changelog:
  - Add --path as a parameter to sepolicy generate
  - Print warning message if program does not exists when generating policy, and do not attempt to run nm command
  - Fix sepolicy generate -T to not take an argument, and supress the help message
  - Since this is really just a testing tool


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-44
changelog:
  - Additional fixes for disabled SELinux Box
  - system-config-selinux no longer relies on lokkit for /etc/selinux/config


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-45
changelog:
  - Apply patch from Miroslav to display proper range description in man pages g
  - Should print warning on missing default label when run in recusive mode iff
  - Remove extra -R description, and fix recursive description


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-46
changelog:
  - sepolicy transition was blowing up. Also cleanup output when only source is specified.
  - sepolicy generate should allow policy modules names that include - or _


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-50
changelog:
  - Update translations
  - update sepolicy manpage to generate fcontext equivalence data and to list
  default file context paths.
  - Add ability to generate policy for confined admins and domains like puppet.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-51
changelog:
  - Update translations
  - Fix sepolicy booleans to handle autogenerated booleans descriptions
  - Cleanups of sepolicy manpage
  - Fix crash on git_shell man page generation


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-52
changelog:
  - Update to latest patches from eparis/Upstream
  -    secon: add support for setrans color information in prompt output
  - Update translations


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-53
changelog:
  - Update with Miroslav patch to handle role attributes
  - Update Translations
  - import sepolicy will only throw exception on missing policy iff selinux is enabled


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-55
changelog:
  - Update Translations
  - Fix handling of semanage generate --cgi -n MODULE PATHTO/CGI
  -   This fixes the spec file and script file getting wrong names for modules and types.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-56
changelog:
  -  Additional changes for bash completsion and generate man page to match the w
  -  Add newtype as a new qualifier to sepolicy generate.  This new mechanism wil
  -  a policy write to generate types after the initial policy has been written a
  -  will autogenerate all of the interfaces.
  -  I also added a -w options to allow policy writers from the command line to s
  -  the writable directories of files.
  -
  -  Modify network.py to include interface definitions for newly created port type
  -  Standardize of te_types just like all of the other templates.

  -  Change permissive domains creation to raise exception if sepolgen is not ins
  -  get_te_results no longer needs or uses the opts parameter.
  -  The compliler was complaining so I just removed the option.
  -  Start returning analysis data for audit2allow


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-57
changelog:
  - Update to latest patches from eparis/Upstream
  - fixfiles onboot will write any flags handed to it to /.autorelabel.
  -   * Patch sent to initscripts to have fedora-autorelabel pass flags back to fixfiles restore
  -   * This should allow fixfiles -F onboot, to force a hard relabel.
  - Add -p to show progress on full relabel.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-58
changelog:
  - Reorginize sepolicy so all get_all functions are in main module
  - Add -B capability to fixfiles onboot and fixfiles restore, basically searches for all files created since the last boot.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-1
changelog:
  - Update to upstream
          * setfiles: estimate percent progress
          * load_policy: make link at the destination directory
          * Rebuild polgen.glade with glade-3
          * sepolicy: new command to unite small utilities
          * sepolicy: Update Makefiles and po files
          * sandbox: use sepolicy to look for sandbox_t
          * gui: switch to use sepolicy
          * gui: sepolgen: use sepolicy to generate
          * semanage: use sepolicy for boolean dictionary
          * add po file configuration information
          * po: stop running update-po on all
          * semanage: seobject verify policy types before allowing you to assign them.
          * gui: Start using Popen, instead of os.spawnl
          * sandbox: Copy /var/tmp to /tmp as they are the same inside
          * qualifier to shred content
          * semanage: Fix handling of boolean_sub names when using the -F flag
          * semanage: man: roles instead of role
          * gui: system-config-selinux: Catch no DISPLAY= error
          * setfiles: print error if no default label found
          * semanage: list logins file entries in semanage login -l
          * semanage: good error message is sepolgen python module missing
          * gui: system-config-selinux: do not use lokkit
          * secon: add support for setrans color information in prompt output
          * restorecond: remove /etc/mtab from default list
          * gui: If you are not able to read enforcemode set it to False
          * genhomedircon: regenerate genhomedircon more often
          * restorecond: Add /etc/udpatedb.conf to restorecond.conf
          * genhomedircon generation to allow spec file to pass in SEMODULE_PATH
          * fixfiles: relabel only after specific date
          * po: update translations
          * sandbox: seunshare: do not reassign realloc value
          * seunshare: do checking on setfsuid
          * sestatus: rewrite to shut up coverity


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-4
changelog:
  - Revert some changes which are causing the wrong policy version file to be created
  - Switch sandbox to start using openbox rather then matchbox
  - Make sepolgen a symlink to sepolicy
  - update translations


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-6
changelog:
  - Fix newrole to retain cap_audit_write when compiled with namespace, also
  do not drop capabilities when run as root.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-7
changelog:
  - Add --root/-r flag to sepolicy manpage,
  - This allows us to generate man pages on the fly in the selinux-policy build


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-8
changelog:
  - Sepolixy should not throw an exception on an SELinux disabled machine
  - Switch from using console app to using pkexec, so we will work better
  with policykit.
  - Add missing import to fix system-config-selinux startup
  - Add comment to pamd files about pam_rootok.so
  - Fix sepolicy generate to not comment out the first line


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-10
changelog:
  - Fix sepolicy to be able to work on an SELinux disabled system.
  - Needed to be able to build man pages in selinux-policy package


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-12
changelog:
  - Do not load interface file by default when sepolicy is called, mov get_all_methods to the sepolicy package


author: Rahul Sundaram <sundaram@fedoraproject.org> - 2.1.14-13
changelog:
  - remove vendor tag from desktop file. https://fedorahosted.org/fpc/ticket/247
  - clean up spec to follow current guidelines


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-14
changelog:
  - Allow users with symlinked homedirs to work. call realpath on homedir
  - Fix sepolicy reorganization of helper functions.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-20
changelog:
  - Mention creation of permissive domains in sepolicy generate man page
  - Change sepolicy manpage to use shortname with an "_" to stop accidently grabbing unrelated types for a domain.
  - Fix audit2allow to show better information on constraint violations.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-21
changelog:
  - sepolicy generate should look for booleans that effect equivalence names, and add them to the man page


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-22
changelog:
  - Fix newrole to not drop capabilities from the bounding set.
  - Stop dropping capabilities from its children.
  - Add better error messages.
  - Change location of bash_completion files to /usr/share/bash-completion/compl


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-23
changelog:
  - sepolicy manpage:
  -   use nroff instead of man2html
  -   Remove checking for name of person who created the man page
  - audit2allow
  -   Fix output to show the level that is different.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-26
changelog:
  - Can not unshare IPC in sandbox, since it blows up Xephyr
  - Remove bogus error message sandbox about reseting setfsuid


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-28
changelog:
  - Fix audit2allow output to better align analysys with the allow rules
  - Apply Miroslav Grepl patch to clean up sepolicy generate usage
  - Apply Miroslav Grepl patch to fixupt handing of admin_user generation
  - Update Tranlslations


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-30
changelog:
  - Add buildrequires for OpenBox to prevent me from accidently building into RHEL7
  - Add support for returning alias data to sepolicy.info python bindings


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-31
changelog:
  - Add post install scripts for gui to make sure Icon Cache is refreshed.
  - Fix grammar issue in secon man page
  - Update Translations


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-32
changelog:
  - Move sepolicy to policycoreutils-devel pacage, since most of it is used for devel
  - Apply Miroslav Grepl Patches for sepolicy
  -- Fix generate mutually groups option handling
  -- EUSER is used for existing policy
  -- customize options can be used together with admin_domain option
  -- Fix manpage.py to generate correct man pages for SELinux users
  -- Fix policy *.te file generated by customize+writepaths options
  -- Fix install script for confined_admin option


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-34
changelog:
  - Update translations
  - Add patch inspired by Miroslav Grepl to add extended information for sepolicy interface command.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-35
changelog:
  - Update translations
  - Add patch by Miroslav Grepl to add compile test for sepolicy interface command.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-37
changelog:
  - Fix exceptionion hanling in audit2allow -o
  - Generate Man pages for everydomain, not just ones with exec_t entrypoints
  - sepolicy comunicate should return ValueError not TypeError
  - Trim header line in sepolicy manpage to use less space
  - Add missing options to restorecon man page


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-38
changelog:
  - No longer run sepolgen-ifgen at install time.
  - Run sepolgen-ifgen in audit2allow and sepolicy generate, if needed.
  - Update Translations


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-39
changelog:
  - Run sepolgen-ifgen in audit2allow and sepolicy generate, if needed, first time
  - Add  Sven Vermeulen  patches to cleanup man pages


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-40
changelog:
  - Only require selinux-policy-devel for policycoreutils-devel, this will shrink the size of the livecd.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-42
changelog:
  - Add support for Xephyr -resizable, so sandbox can now resize window
  - Add support for compressed policy.xml
  - Miroslav Grepl patch to allow sepolicy interface on individual interface fil
  - Also add capability to test interfaces for correctness.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-44
changelog:
  - Fix sepolicy-generate man page to clear up options/policy type
  - Add Miroslav Grepl to not generate man page when doing
    sepolicy generate --customize
  - Add support for executing semanage user within spec file
  - Fix generation of confined admin domains, to handle booleans properly.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-46
changelog:
  - Fix the name of the spec file generated in the build script
  - Add mgrepl patch to support argparse for semanage command parsing


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-48
changelog:
  - Fix audit2allow -o to open file for append
  - Fix the name of the spec file generated in the build script


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-50
changelog:
  - Fix sepolicy generate --confined_admin to generate tunables
  - Add new interface to generate entrypoints for use with new gui


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-56
changelog:
  - Fix semanage export/import commands
  - Fix semange module command
  - Remove --version option from sandbox


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-57
changelog:
  - Remove requires for systemd-sysv
  - Move systemd-units require to restorecond section
  - Update Tranlasions
  - More sepolicy interfaces for gui
  - Cleanup man pages for sepolicy generate


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-63
changelog:
  - Update sepolicy gui.
  - Error out of you call sepolicy gui without policycoreutils-gui package installed
  - Fix semanage login -d command
  - Update Translations


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-65
changelog:
  - Do not generate shell script or spec file for sepolicy generate --newtype
  - Update translations
  - Fix sepolicy generate --admin_user man page again
  - Fix setsebool to print less verbose error messages by default, add -V for ve


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-68
changelog:
  - Fix bugs introduced by previous patch.  semanage port
  - Update Translations
  - Add test suite for sepolicy command lines


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-75
changelog:
  - Update sepolicy gui code, cleanups and add file transition tab
  - Fix semanage fcontext -a --ftype code to work.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-79
changelog:
  - Add Miroslav Grepl setsebool patch to give better error message on bad boolean names
  - Additional help screens for sepolicy gui


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-80
changelog:
  - Random fixes for sepolicy gui
    * Do not prompt for password until you make a change
    * Add user mappings and selinux users page
    * lots of code cleanup

  - Verify homedir is owned by user before mounting over it with seunshare
  - Fix fixfiles to handle Relabel properly
  - Fix semanage fcontext -e / command to allow "/"


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-82
changelog:
  - Improvements to sepolicy gui
    - Add more help information
    - Cleanup code
    - Add deny_ptrace on lockdown screen
    - Make unconfined/permissivedomains lockdown work
    - Add more support for file equivalency


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-85
changelog:
  - Fixes for fixfiles
    * exclude_from_dirs should apply to all types of restorecon calls
    * fixfiles check now works
    * exit with the correct status

  - semanage no longer import selinux


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-86
changelog:
  - sepolicy gui
    - mgrepl added delete screens for users and login
    - Fix lots of bugs.
  - Update Translations.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-88
changelog:
  - Cleanup errors found by pychecker
  - Apply patch from Michal Trunecka to allow restorecon to handle {} in globs


author: Dan Walsh <dwalsh@redhat.com> - 2.2-1
changelog:
  - Update to upstream 
          * Properly build the swig exception file from Laurent Bigonville.
          * Fix man pages from Laurent Bigonville.
          * Support overriding PATH and INITDIR in Makefile from Laurent Bigonville.
          * Fix LDFLAGS usage from Laurent Bigonville.
          * Fix init_policy warning from Laurent Bigonville.
          * Fix semanage logging from Laurent Bigonville.
          * Open newrole stdin as read/write from Sven Vermeulen.
          * Fix sepolicy transition from Sven Vermeulen.
          * Support overriding CFLAGS from Simon Ruderich.
          * Create correct man directory for run_init from Russell Coker.
          * restorecon GLOB_BRACE change from Michal Trunecka.
          * Extend audit2why to report additional constraint information.
          * Catch IOError errors within audit2allow from Dan Walsh.
          * semanage export/import fixes from Dan Walsh.
          * Improve setfiles progress reporting from Dan Walsh.
          * Document setfiles -o option in usage from Dan Walsh.
          * Change setfiles to always return -1 on failure from Dan Walsh.
          * Improve setsebool error r eporting from Dan Walsh.
          * Major overhaul of gui from Dan Walsh.
          * Fix sepolicy handling of non-MLS policy from Dan Walsh.
          * Support returning type aliases from Dan Walsh.
          * Add sepolicy tests from Dan Walsh.
          * Add org.selinux.config.policy from Dan Walsh.
          * Improve range and user input checking by semanage from Dan Walsh.
          * Prevent source or target arguments that end with / for substitutions from Dan Walsh.
          * Allow use of <<none>> for semanage fcontext from Dan Walsh.
          * Report customized user levels from Dan Walsh.
          * Support deleteall for restoring disabled modules from Dan Walsh.
          * Improve semanage error reporting from Dan Walsh.
          * Only list disabled modules for module locallist from Dan Walsh.
          * Fix logging from Dan Walsh.
          * Define new constants for file type character codes from Dan Walsh.
          * Improve bash completions from Dan Walsh.
          * Convert semanage to argparse from Dan Walsh (originally by Dave Quigley).
          * Add semanage tests from Dan Walsh.
          * Split semanage man pages from Dan Walsh.
          * Move bash completion scripts from Dan Walsh.
          * Replace genhomedircon script with a link to semodule from Dan Walsh.
          * Fix fixfiles from Dan Walsh.
          * Add support for systemd service for restorecon from Dan Walsh.
          * Spelling corrections from Dan Walsh.
          * Improve sandbox support for home dir symlinks and file caps from Dan Walsh.
          * Switch sandbox to openbox window manager from Dan Walsh.
          * Coalesce audit2why and audit2allow from Dan Walsh.
          * Change audit2allow to append to output file from Dan Walsh.
          * Update translations from Dan Walsh.
          * Change audit2why to use selinux_current_policy_path from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> - 2.2-2
changelog:
  - Shift around some of the files to more appropriate packages.
          * semodule_* packages are required for devel.


author: Dan Walsh <dwalsh@redhat.com> - 2.2.2-1
changelog:
  - Speed up startup time of sepolicy gui
  - Clean up ports screen to only show enabled ports.
  - Update to upstream 
          * Remove import policycoreutils.default_encoding_utf8 from semanage from Dan Walsh.
          * Make yum/extract_rpms optional for sepolicy generate from Dan Walsh.
          * Add test suite for audit2allow and sepolgen-ifgen from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> - 2.2.3-1
changelog:
  - Update to upstream 
          * Apply polkit check on all dbus interfaces and restrict to active user from Dan Walsh.
          * Fix typo in sepolicy gui dbus.relabel_on_boot call from Dan Walsh.
  - Apply Miroslav Grepl patch to fix TEMPLATETYPE_domtrans description in sepolicy generate


author: Dan Walsh <dwalsh@redhat.com> - 2.2.4-1
changelog:
  - Update to upstream 
          * Revert automatic setting of serange and seuser in seobject; was breaking non-MLS systems.
  - Add patches for sepolicy gui from mgrepl to
    Fix advanced_item_button_push() to allow to select an application in advanced search menu
    Fix previously_modified_initialize() to show modified changes properly for all selections


author: Dan Walsh <dwalsh@redhat.com> - 2.2.4-5
changelog:
  - Fix semanage man page description of import command
  - Fix policy kit file to allow changing to permissive mode


author: Dan Walsh <dwalsh@redhat.com> - 2.2.4-6
changelog:
  - Fix sepolicy gui selection for advanced screen
  - Update Translations
  - Move requires checkpolicy requirement into policycoreutils-python


author: Dan Walsh <dwalsh@redhat.com> - 2.2.5-3
changelog:
  - Add Miroslav patch to
  - Fix previously_modified_initialize() to show modified changes properly for all selections


author: Dan Walsh <dwalsh@redhat.com> - 2.2.5-8
changelog:
  - Update Translations
  - Make selinux-policy build working also on another architectures related to s
  - Miroslav grepl patch to fix the creation of man pages on different architectures.
  - Add ability to list the actual active modules
  - Fix spelling mistake on sesearch in generate man pages.


author: Dan Walsh <dwalsh@redhat.com> - 2.2.5-9
changelog:
  - mgrepl [PATCH] Deleteall user customization fails if there is a user used
  - for the default login. We do not want to fail on it and continue to delete
  - customizations for users which are not used for default login.


author: Miroslav Grepl <mgrepl@redhat.com> - 2.2.5-10
changelog:
  - Add support for Fedora21 html manpage structure
  - Fix broken dependencies to require only usermode-gtk


author: Miroslav Grepl <mgreplh@redhat.com> - 2.2.5-12
changelog:
  - Add policycoreutils-rhat-revert.patch to revert the last two commits to make build working
  - Add 0001-Fix-STANDARD_FILE_CONTEXT-section-in-man-pages patch


author: Dan Walsh <dwalsh@redhat.com> - 2.3-1
changelog:
  - Update to upstream 
          * Add -P semodule option to man page from Dan Walsh.
          * selinux_current_policy_path will return none on a disabled SELinux system from Dan Walsh.
          * Add new icons for sepolicy gui from Dan Walsh.
          * Only return writeable files that are enabled from Dan Walsh.
          * Add domain to short list of domains, when -t and -d from Dan Walsh.
          * Fix up desktop files to match current standards from Dan Walsh.
          * Add support to return sensitivities and categories for python from Dan Walsh.
          * Cleanup whitespace from Dan Walsh.
          * Add message to tell user to install sandbox policy from Dan Walsh.
          * Add systemd unit file for mcstrans from Laurent Bigonville.
          * Improve restorecond systemd unit file from Laurent Bigonville.
          * Minor man pages improvements from Laurent Bigonville.


author: Dan Walsh <dwalsh@redhat.com> - 2.3-3
changelog:
  - Update Miroslav Grepl Patches
    * If there is no executable we don't want to print a part of STANDARD FILE CON
    * Add-manpages-for-typealiased-types
    * Make fixfiles_exclude_dirs working if there is a substituion for the given d


author: Miroslav Grepl <mgrepl@redhat.com> - 2.3-7
changelog:
  - Examples are no longer in the main semanage man page (#1084390)
  - Add support for Fedora22 man pages. We need to fix it to not using hardcoding.
  - Print usage for all mutually exclusive options.
  - Fix selinux man page to refer seinfo and sesearch tools.


author: Miroslav Grepl <mgrepl@redhat.com> - 2.3-11
changelog:
  - Improvements to audit2allow from rhallise@redhat.com
      * Check for mislabeled files.
      * Check for base file use and
      * Suggest writable files as alternatives


author: Dan Walsh <dwalsh@redhat.com> - 2.3-14
changelog:
  - Audit2allow will check for mislabeled files, and tells user to fix the label.
  - Also checks for basefiles and suggests creating a different label.
  - Patch from Ryan Hallisey


author: Petr Lautrbach <plautrba@redhat.com> 2.3-15
changelog:
  - We need to cover file_context.XXX.homedir to have fixfiles with exclude_dirs working correctly
  - Use dnf instead of yum (#1156547)


author: Petr Lautrbach <plautrba@redhat.com> 2.3-16
changelog:
  - Temporary removed Requires:audit-libs-python from policycoreutils-python3 subpackage (#1195139)
  - Simplication of sepolicy-manpage web functionality (#1193552)


author: Petr Lautrbach <plautrba@redhat.com> 2.4-0.6
changelog:
  - policycoreutils: semanage: update to new source policy infrastructure
  - semanage: move permissive module creation to /tmp


author: Petr Lautrbach <plautrba@redhat.com> 2.4-5
changelog:
  - Move python utilities from -python to -python-utilities
  - All scripts originally from policycoreutils-python use python 3 now


author: Petr Lautrbach <plautrba@redhat.com> 2.4-12
changelog:
  - Fix several semanage issue (#1247714)
  - Decode output from subprocess, if error occurred (#1247039)


author: Petr Lautrbach <plautrba@redhat.com> 2.4-18
changelog:
  - Improve sepolicy command line interface
  - Fix sandbox to propagate specified MCS/MLS Security Level. (#1279006)
  - Fix 'audit2allow -R' (#1280418)


author: Petr Lautrbach <plautrba@redhat.com> - 2.4-20
changelog:
  - Fix 'semanage permissive -l' subcommand (#1286325)
  - Several 'sepolicy gui' fixes (#1281309,#1281309,#1282382)


author: Petr Lautrbach <plautrba@redhat.com> 2.5-2
changelog:
  - policycoreutils/sepolicy: selinux_server.py to use GLib instead of gobject
  - policycoreutils-gui requires python-slip-dbus (#1314685)


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-10
changelog:
  - Fix typos in semanage manpages
  - Fix the documentation of -l,--list for semodule
  - Minor fix in a French translation
  - Fix the extract example in semodule.8
  - Update sandbox.8 man page
  - Remove typos from chcat --help
  - sepolgen: Remove additional files when cleaning


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-12
changelog:
  - open_init_pty: Do not error on EINTR
  - Fix [-s STORE] typos in semanage
  - Update sandbox types in sandbox manual
  - Update translations


author: Petr Lautrbach <plautrba@redhat.com> 2.5-16
changelog:
  - Remove unused autoconf files from po/
  - Remove duplicate, empty translation files
  - Rebuilt with libsepol-2.5-9, libselinux-2.5-11, libsemanage-2.5-7


author: Petr Lautrbach <plautrba@redhat.com> 2.5-17
changelog:
  - sandbox: Use dbus-run-session instead of dbus-launch when available
  - hll/pp: Change warning for module name not matching filename to match new behavior
  - Remove LDFLAGS from CFLAGS
  - sandbox: create a new session for sandboxed processes
  - sandbox: do not try to setup directories without -X or -M
  - sandbox: do not run xmodmap in a new X session
  - sandbox: Use GObject introspection binding instead of pygtk2
  - sandbox: fix file labels on copied files
  - sandbox: tests - close stdout of p
  - sandbox: tests - use sandbox from cwd
  - audit2allow: tests should use local copy not system
  - audit2allow: fix audit2why import from seobject
  - audit2allow: remove audit2why so that it gets symlinked
  - semanage: fix man page and help message for import option
  - semanage: fix error message for fcontext -m
  - semanage: Fix semanage fcontext -D
  - semanage: Correct fcontext auditing
  - semanage: Default serange to "s0" for port modify
  - semanage: Use socket.getprotobyname for protocol
  - semanage: fix modify action in node and interface
  - fixfiles: Pass -n to restorecon for fixfiles check
  - sepolicy: Check get_rpm_nvr_list() return value
  - Don't use subprocess.getstatusoutput() in Python 2 code
  - semanage: Add auditing of changes in records
  - Remove unused 'q' from semodule getopt string


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-19
changelog:
  - seobject: Handle python error returns correctly
  - policycoreutils/sepolicy/gui: fix current selinux state radiobutton
  - policycoreutils: semodule_package: do not fail with an empty fc file


author: Petr Lautrbach <plautrba@redhat.com> - 2.6-5
changelog:
  - semanage: Unify argument handling (#1398987)
  - setfiles: set up a logging callback for libselinux
  - setfiles: Fix setfiles progress indicator
  - setfiles: stdout messages don't need program prefix
  - setfiles: don't scramble stdout and stderr together (#1435894)
  - restorecond: Decrease loglevel of termination message (#1264505)
  - fixfiles should handle path arguments more robustly
  - fixfiles: handle unexpected spaces in command
  - fixfiles: remove useless use of cat (#1435894)
  - semanage: Add checks if a module name is passed in (#1420707)
  - semanage: fix export of fcontext socket entries (#1435127)
  - selinux-autorelabel: remove incorrect redirection to /dev/null (#1415674)


author: Petr Lautrbach <plautrba@redhat.com> - 2.6-7
changelog:
  - Make 'sepolicy manpage' and 'sepolicy transition' faster
  - open_init_pty: restore stdin/stdout to blocking upon exit
  - fixfiles: do not dereference link files in tmp
  - fixfiles: use a consistent order for options to restorecon
  - fixfiles: don't ignore `-F` when run in `-C` mode
  - fixfiles: remove bad modes of "relabel" command
  - fixfiles: refactor into the `set -u` dialect
  - fixfiles: if restorecon aborts, we should too
  - fixfiles: usage errors are fatal
  - fixfiles: syntax error
  - fixfiles: remove two unused variables
  - fixfiles: tidy up usage(), manpage synopsis
  - fixfiles: deprecate -l option
  - fixfiles: move logit call outside of redirected function
  - fixfiles: fix logging about R/O filesystems
  - fixfiles: clarify exclude_dirs()
  - fixfiles: remove (broken) redundant code


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2.7-2
changelog:
  - Python 2 binary package renamed to python2-policycoreutils
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Petr Lautrbach <plautrba@redhat.com> - 2.7-4
changelog:
  - restorecond: check write() and daemon() results
  - sepolicy: do not fail when file_contexts.local or .subs do not exist
  - sepolicy: remove stray space in section "SEE ALSO"
  - sepolicy: fix misspelling of _ra_content_t suffix
  - gui: port to Python 3 by migrating to PyGI
  - gui: remove the status bar
  - gui: fix parsing of "semodule -lfull" in tab Modules
  - gui: delete overridden definition of usersPage.delete()
  - Enable listing file_contexts.homedirs (#1409813)
  - remove semodule_deps


author: Petr Lautrbach <plautrba@redhat.com> - 2.7-5
changelog:
  - sepolicy: Fix sepolicy manpage
  - semanage: Update Infiniband code to work on python3
  - semanage: Fix export of ibendport entries
  - semanage: Enforce noreload only if it's requested by -N option


author: Petr Lautrbach <plautrba@redhat.com> - 2.7-6
changelog:
  - semanage: make seobject.py backward compatible
  - Own %{pythonX_sitelib}/site-packages/sepolicy directories (#1522942)


author: Miro Hrončok <mhroncok@redhat.com> - 2.7-12
changelog:
  - Rename the python3 subpackage to have prefix, not suffix
  - Use python3 prefixes in requires where possible


author: Petr Lautrbach <plautrba@redhat.com> - 2.7-15
changelog:
  - sepolicy: Fix translated strings with parameters
  - sepolicy: Support non-MLS policy
  - sepolicy: Initialize policy.ports as a dict in generate.py
  - gui/polgengui.py: Use stop_emission_by_name instead of emit_stop_by_name
  - Minor update for bash completion
  - semodule_package: fix semodule_unpackage man page
  - gui/semanagePage: Close "edit" and "add" dialogues when successfull
  - gui/fcontextPage: Set default object class in addDialog\
  - sepolgen: fix typo in PolicyGenerator
  - build: follow standard semantics for DESTDIR and PREFIX


author: Petr Lautrbach <plautrba@redhat.com> - 2.7-19
changelog:
  - selinux-autorelabel: set UEFI boot order (BootNext) same as BootCurrent
  - selinux-autorelabel: synchronize cached writes before reboot (#1385272)


author: Petr Lautrbach <plautrba@redhat.com> - 2.8-4
changelog:
  - selinux-autorelabel: Use plymouth --quit rather then --hide-splash (#1592221)
  - selinux-autorelabel: Increment boot_indeterminate grub environment variable (#1592221)
  - Do not require libcgroup - it's not used anymore


author: Petr Lautrbach <plautrba@redhat.com> - 2.8-7
changelog:
  - setfiles: Improve description of -d switch
  - Fix typo in newrole.1 manpage
  - semanage: Stop rejecting aliases in semanage commands
  - sepolicy: Stop rejecting aliases in sepolicy commands
  - sepolicy: Fix "info" to search aliases as well
  - sepolgen: fix refpolicy parsing of "permissive"
  - sepolgen: return NotImplemented instead of raising it
  - semanage: fix Python syntax of catching several exceptions
  - semanage: Replace bare except with specific one
  - semanage: Fix logger class definition
  - semanage: Stop logging loginRecords changes
  - add xperms support to audit2allow
  - sepolgen: fix access vector initialization
  - sepolgen: print all AV rules correctly


author: Petr Lautrbach <plautrba@redhat.com> - 2.8-15
changelog:
  - chcat: use check_call instead of getstatusoutput
  - semanage: Use standard argparse.error() method
  - semanage: Fix handling of -a/-e/-d/-r options


author: Petr Lautrbach <plautrba@redhat.com> - 2.8-16.1
changelog:
  - semanage: move valid_types initialisations to class constructors
  - semanage: import sepolicy only when it's needed
  - sepolicy: Add sepolicy.load_store_policy(store)
  - semanage: Start exporting "ibendport" and "ibpkey" entries


author: Petr Lautrbach <plautrba@redhat.com> - 2.9-4
changelog:
  - semanage: Do not use default s0 range in "semanage login -a" (#1554360)
  - gui: Fix remove module in system-config-selinux (#1748763)


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-5
changelog:
  - fixfiles: Fix "verify" option (#1647532)
  - semanage: Improve handling of "permissive" statements (#1417455)
  - semanage: fix moduleRecords.customized()
  - semanage: Add support for DCCP and SCTP protocols (#1563742)


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-10
changelog:
  - python/semanage: Sort imports in alphabetical order
  - python/semanage: empty stdout before exiting on BrokenPipeError (#1822100)


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-26
changelog:
  - python/semanage: Allow modifying records on "add" (RHEL-28167)
  - python/semanage: Do not sort local fcontext definitions (RHEL-24461)


author: David Zeuthen <davidz@redhat.com> - 0.94-3
changelog:
  - Add desktop_admin_r and desktop_user_r groups along with a first cut
    of default authorizations for users in these groups.


author: David Zeuthen <davidz@redhat.com> - 0.94-4
changelog:
  - Add some patches from git master
  - Sort pkaction(1) output
  - Bug 23867 – UnixProcess vs. SystemBusName aliasing


author: David Zeuthen <davidz@redhat.com> - 0.95-0.git20090913
changelog:
  - Update to git snapshot
  - Drop upstreamed patches
  - Turn on GObject introspection
  - Don't delete desktop_admin_r and desktop_user_r groups when
    uninstalling polkit-desktop-policy


author: David Zeuthen <davidz@redhat.com> - 0.95-0.git20090913.1
changelog:
  - Add bugfix for polkit_unix_process_new_full() (thanks Bastien Nocera)
  - Obsolete old PolicyKit packages


author: David Zeuthen <davidz@redhat.com> - 0.97-1
changelog:
  - Update to 0.97. This release contains a port from EggDBus to the
    GDBus code available in recent GLib releases.


author: David Zeuthen <davidz@redhat.com> - 0.97-3
changelog:
  - Add a patch to make pkcheck(1) work the way libvirtd uses it (#623257)
  - Require GLib >= 2.25.12 instead of 2.25.11
  - Ensure polkit-gnome packages earlier than 0.97 are not used with
    these packages


author: David Zeuthen <davidz@redhat.com> - 0.101-2
changelog:
  - Nuke desktop_admin_r and desktop_user_r groups - just use the
    wheel group instead (#688363)
  - Update the set of configuration directives that gives users
    in the wheel group extra privileges


author: David Zeuthen <davidz@redhat.com> 0.102-2.el8_10
changelog:
  - Add patch to neuter the annoying systemd behavior where stdout/stderr
    is sent to the system logs


author: David Zeuthen <davidz@redhat.com> 0.103-1.el8_10
changelog:
  - Update to upstream release 0.103
  - Drop upstreamed patch
  - Drop Fedora-specific policy, it is now upstream (fdo #41008)


author: David Zeuthen <davidz@redhat.com> 0.104-1.el8_10
changelog:
  - Update to upstream release 0.104
  - Force usage of systemd (instead of ConsoleKit) for session tracking


author: David Zeuthen <davidz@redhat.com> 0.105-1.el8_10
changelog:
  - Update to upstream release 0.105
  - Nuke patches that are now upstream
  - Change 'PolicyKit' to 'polkit' in summary and descriptions


author: David Zeuthen <davidz@redhat.com> 0.106-1.el8_10
changelog:
  - Update to upstream release 0.106
  - Authorizations are no longer controlled by .pkla files - from now
    on, use the new .rules files described in the polkit(8) man page


author: David Zeuthen <davidz@redhat.com> 0.108-1.el8_10
changelog:
  - Update to upstream release 0.108
  - Drop upstreamed patches
  - This release dynamically loads the JavaScript interpreter and can
    cope with it not being available. In this case, polkit authorization
    rules are not processed and the defaults for an action - as defined
    in its .policy file - are used for authorization decisions.
  - Add new meta-package, polkit-js-engine, that pulls in the required
    JavaScript bits to make polkit authorization rules work. The default
    install - not the minimal install - should include this package


author: David Zeuthen <davidz@redhat.com> 0.108-3.el8_10
changelog:
  - Attempt to open the correct libmozjs185 library, otherwise polkit
    authz rules will not work unless js-devel is installed (fdo #57146)


author: Miloslav Trmač <mitr@redhat.com> - 0.110-4
changelog:
  - Make the JavaScript engine mandatory.  The polkit-js-engine package has been
    removed, main polkit package Provides:polkit-js-engine for compatibility.
  - Add Requires: polkit-pkla-compat
    Resolves: #908808


author: Miloslav Trmač <mitr@redhat.com> - 0.110-4
changelog:
  - Shut up rpmlint about Summary:
  - Build with V=1
  - Use %{_unitdir} instead of hard-coding the path
  - Use the new systemd macros, primarily to run (systemctl daemon-reload)
    Resolves: #857382


author: Miloslav Trmač <mitr@redhat.com> - 0.111-1
changelog:
  - Update to polkit-0.111
    Resolves: #917888
  - Use SpiderMonkey from mozjs17 instead of js
  - Ship the signature in the srpm
  - Try to preserve timestamps in (make install)


author: Miloslav Trmač <mitr@redhat.com> - 0.112-2
changelog:
  - Workaround pam_systemd setting broken XDG_RUNTIME_DIR
    Resolves: #1033774
  - Always use mozjs-17.0 even if js-devel is installed


author: Colin Walters <walters@redhat.com> - 0.112-8
changelog:
  - Split separate -libs package, so that NetworkManager can just depend on
    that, without dragging in the daemon (as well as libmozjs17).  This
    allows the creation of more minimal systems that want programs like NM,
    but do not need the configurability of the daemon; it would be ok if only
    root is authorized.


author: Rex Dieter <rdieter@fedoraproject.org> - 0.112-9
changelog:
  - polkit doesn't release reference counters of GVariant data (#1180886)
  - fix ldconfig scriptlets (move to -libs subpkg)


author: Miloslav Trmač <mitr@redhat.com> - 0.113-1
changelog:
  - Update to polkit-0.113 (CVE-2015-3218, CVE-2015-3255, CVE-2015-3256,
    CVE-2015-4625)
    Resolves: #910262, #1175061, #1177930, #1194391, #1228739, #1233810


author: Miloslav Trmač <mitr@redhat.com> - 0.113-2
changelog:
  - Add a fully versioned dependency from polkit to polkit-libs
    Resolves: #1241759
  - Require polkit-libs, not polkit, in polkit-devel


author: Peter Robinson <pbrobinson@fedoraproject.org> 0.113-8
changelog:
  - Use %license, license needs to be in -libs as it's the only guaranteed installed package
  - Move to mozjs38
  - Other upstream fixes
  - Spec cleanups


author: Miloslav Trmač <mitr@redhat.com> - 0.113-12
changelog:
  - Fix a memory leak in PolkitPermission.
    Patch by Rui Matos <tiagomatos@gmail.com>
    Resolves: #1433915


author: Jan Rybar <jrybar@redhat.com> - 0.115-2
changelog:
  - Error message about getting authority is too elaborate (forward of #1342855)
  - Bus disconnection report moved to debug mode (forward of #1249627)


author: Jan Rybar <jrybar@redhat.com> - 0.115-7
changelog:
  - pkttyagent: polkit-agent-helper-1 timeout leaves tty echo disabled
  - Mitigation of regression caused by fix of CVE-2018-19788
  - Resolves: rhbz#1693781
  - Resolves: rhbz#1693814


author: Jan Rybar <jrybar@redhat.com> - 0.115-15.1
changelog:
  - reduce waking session monitor on uninteresting session changes
  - make polkit-pkla-compat uninstallable (for cases when no .pkla on system)
  - Resolves: RHEL-34029


author: Panu Matilainen <pmatilai@redhat.com> - 1.18-1
changelog:
  - Rebase to popt 1.18 (https://github.com/rpm-software-management/popt/releases/tag/popt-1.18-release)
  - Update URLs to rebooted upstream
  - Clean up ancient cruft from spec, use modern build macros


author: Michal Ruprich <mruprich@redhat.com> - 0.0.5-20
changelog:
  - RHEL-2863 - Creating tmp files for systemd on behalf of portreserve references legacy directory /var/run/ instead of /run


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2:3.5.8-2
changelog:
  - Fixed cleanup crash when processing messages with whitespace only fullname
    Resolves: rhbz#1977732


author: Tomas Korbar <tkorbar@redhat.com> - 2:3.5.8-5
changelog:
  - Backport dns SRV record resolution feature (RFC6186)
    Resolves: rhbz#1787010
  - Fix building in ZUUL CI
    Resolves: rhbz#2196577


author: Erik Troan <ewt@redhat.com>
changelog:
  - added a patch to use our own route.h, rather then glibc's (which has
    alignment problems on Alpha's) -- I only applied this patch on the Alpha,
    though it should be safe everywhere


author: Cristian Gafton <gafton@redhat.com>
changelog:
  - updated to ppp-2.3.3, build against glibc-2.0.6 - previous patches not
    required any more.
  - added buildroot
  - fixed the PAM support, which was really, completely broken and against any
    standards (session support is still not here... :-( )
  - we build against running kernel and pray that it will work
  - added a samples patch; updated glibc patch


author: Michael K. Johnson <johnsonm@redhat.com>
changelog:
  - New version 2.3.9 required for kernel 2.3.13 and will be required
    for new initscripts.  auth patch removed; 2.3.9 does the same thing
    more readably than the previous patch.


author: Nalin Dahyabhai <nalin@redhat.com> 2.4.1-2
changelog:
  - add buildprereq on pam-devel (#49559)
  - add patch to respond to CBCP LCP requests (#15738)
  - enable cbcp support at build-time
  - change the Copyright: tag to a License: tag


author: Florian La Roche <Florian.LaRoche@redhat.de>
changelog:
  - add patch:
  	* Thu Jun 06 2002 Phil Knirsch <pknirsch@redhat.com>
  	- Fixed varargs problem for s390/s390x.


author: Thomas Woerner <twoerner@redhat.com> 2.4.2-5
changelog:
  - example scripts are using change_resolv_conf to modify /etc/resolv.conf
    (#132482)
  - require new libpcap library (>= 0.8.3-6) with a fix for inbound/outbound
    filter processing
  - not using internal libpcap structures anymore, fixes inbound/outbound
    filter processing (#128053)


author: David Woodhouse <dwmw2@redhat.com> 2.4.2-6.2
changelog:
  - Link pppoatm plugin against libresolv.
  - Revert to linux-atm headers without the workaround for #127098


author: Thomas Woerner <twoerner@redhat.com> 2.4.3-1
changelog:
  - new version 2.4.3
    - updated patches: make, lib64, dontwriteetc, fix, fix64, no_strip,
      radiusplugin
    - dropped patches: bpf, signal, pcap, pppoatm, pkgcheck


author: Thomas Woerner <twoerner@redhat.com> 2.4.3-2
changelog:
  - dropped all executable bits in scripts directory to prevent rpm requiring
    programs used in there


author: Thomas Woerner <twoerner@redhat.com> 2.4.4-1
changelog:
  - new version 2.4.4 with lots of fixes
  - fixed reesolv.conf docs (#165072)
    Thanks to Matt Domsch for the initial patch
  - enabled CBCP (#199278)


author: Martin Nagy <mnagy@redhat.com> 2.4.4-6
changelog:
  - call closelog earlier (#222295)
  - fix ChapMS2 (#217076)
  - moving header files to new -devel package (#203542)


author: Jiri Skala <jskala@redhat.com> - 2.4.4-14
changelog:
  - fixed #519042 - ppp package is missing URL in spec
  - fixed #524575 - ppp: no_strip patch modifies backup files created by previous patches


author: Jiri Skala <jskala@redhat.com> - 2.4.5-10
changelog:
  - fixes #613717 - Missing line in example script ip-up.local.add
  - removed /usr/kerberos/include from eaptls patch


author: Jiri Skala <jskala@redhat.com> - 2.4.5-12
changelog:
  - fixes #637513 - Missing: README.eap-tls
  - updated to latest eaptls upstream
  - fixes #637886 - EAP-TLS not working with enabled PPP Multilink Framing option


author: Jiri Skala <jskala@redhat.com> - 2.4.5-18
changelog:
  - fixes #682381 - hardcodes eth0
  - fixes #708260 - SELinux is preventing access on the file LCK..ttyUSB3


author: Michal Sekletar <msekleta@redhat.com> - 2.4.5-32
changelog:
  - don't ship /var/lock/ppp in rpm payload and create it in %post instead
  - fix installation of tmpfiles.d configuration
  - enable hardened build
  - fix bogus dates in changelog
  - compile all binaries with hardening flags


author: Michal Sekletar <msekleta@redhat.com> - 2.4.7-7
changelog:
  - prevent running into issues caused by undefined behavior (pointers of incompatible types aliasing the same object)


author: Michal Sekletár <msekleta@redhat.com> - 0.1.0-5
changelog:
  - if interface has name in expected format print it to stdout (#1643515)
  - don't assign names to virtual devices (#1644294)


author: Jan Rybar <jrybar@redhat.com> - 3.3.15-8
changelog:
  - vmstat: added -y option to omit first report
  - Resolves: rhbz#2027350
  - sysctl: backport config directory order, align with systemd
  - Resolves: rhbz#2111915


author: Jan Rybar <jrybar@redhat.com> - 6.6.3-2
changelog:
  - lastcomm: added new --pid option to show process PID and PPID
  - changelog update: 6.6.3-1 author change
  - spec file update: added correct access mode to created /var/account/pacct


author: Jan Rybar <jrybar@redhat.com> - 23.1
changelog:
  - Rebase to the newest upstream official release
  - Source0 updated to latest functional SourceForge URL format
  - peekfd manpage now not present if peekfd binary missing on given architecture
  - URL of the project updated
  - new tool pslog added with rebase
  - Resolves: #1460695


author: Ray Strode <rstrode@redhat.com> - 3.28.3-2
changelog:
  - Add lock to avoid two type object wrappers getting generated at
    the same time in multi-threaded programs.
    Resolves: #1844578


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.0.4-3
changelog:
  - Python 2 binary package renamed to python2-chardet
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1:1.1.fb23-4
changelog:
  - Python 2 binary package renamed to python2-configshell
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Christian Heimes <cheimes@redhat.com> - 3.2.1-1
changelog:
  - Rebase to upstream release 3.2.1
  - Resolves: rhbz#1873581
  - Resolves: rhbz#1778939
  - Removed dependencies on python-asn1crypto, python-idna


author: Christian Heimes <cheimes@redhat.com> - 3.2.1-4
changelog:
  - CVE-2020-36242: Fixed a bug where certain sequences of update() calls
    when symmetrically encrypting very large payloads (>2GB) could result
    in an integer overflow, leading to buffer overflows.
  - Resolves: rhbz#1926528


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.12.2-9
changelog:
  - Python 2 binary package renamed to python2-dmidecode
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Jeffrey C. Ollie <jeff@ocjtech.us> - 1.7.0-1
changelog:
  - New since 1.6.0:
  -
  -        Rdatas now have a to_digestable() method, which returns the
  -        DNSSEC canonical form of the rdata, suitable for use in
  -        signature computations.
  -
  -        The NSEC3, NSEC3PARAM, DLV, and HIP RR types are now supported.
  -
  -        An entropy module has been added and is used to randomize query ids.
  -
  -        EDNS0 options are now supported.
  -
  -        UDP IXFR is now supported.
  -
  -        The wire format parser now has a 'one_rr_per_rrset' mode, which
  -        suppresses the usual coalescing of all RRs of a given type into a
  -        single RRset.
  -
  -        Various helpful DNSSEC-related constants are now defined.
  -
  -        The resolver's query() method now has an optional 'source' parameter,
  -        allowing the source IP address to be specified.
  -
  - Bugs fixed since 1.6.0:
  -
  -        On Windows, the resolver set the domain incorrectly.
  -
  -        DS RR parsing only allowed one Base64 chunk.
  -
  -        TSIG validation didn't always use absolute names.
  -
  -        NSEC.to_text() only printed the last window.
  -
  -        We did not canonicalize IPv6 addresses before comparing them; we
  -        would thus treat equivalent but different textual forms, e.g.
  -        "1:00::1" and "1::1" as being non-equivalent.
  -
  -        If the peer set a TSIG error, we didn't raise an exception.
  -
  -        Some EDNS bugs in the message code have been fixed (see the ChangeLog
  -        for details).


author: Jeffrey C. Ollie <jeff@ocjtech.us> - 1.7.1-1
changelog:
  - New since 1.7.0:
  -
  -        Nothing
  -
  - Bugs fixed since 1.7.0:
  -
  -        The 1.7.0 kitting process inadventently omitted the code for the
  -        DLV RR.
  -
  -        Negative DDNS prerequisites are now handled correctly.


author: Jeffrey C. Ollie <jeff@ocjtech.us> - 1.8.0-1
changelog:
  - New since 1.7.1:
  -
  -  Support for hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384 and
  -  hmac-sha512 has been contributed by Kevin Chen.
  -
  -  The tokenizer's tokens are now Token objects instead of (type,
  -  value) tuples.
  -
  - Bugs fixed since 1.7.1:
  -
  -  Escapes in masterfiles now work correctly.  Previously they were
  -  only working correctly when the text involved was part of a domain
  -  name.
  -
  -  When constructing a DDNS update, if the present() method was used
  -  with a single rdata, a zero TTL was not added.
  -
  -  The entropy pool needed locking to be thread safe.
  -
  -  The entropy pool's reading of /dev/random could cause dnspython to
  -  block.
  -
  -  The entropy pool did buffered reads, potentially consuming more
  -  randomness than we needed.
  -
  -  The entropy pool did not seed with high quality randomness on
  -  Windows.
  -
  -  SRV records were compared incorrectly.
  -
  -  In the e164 query function, the resolver parameter was not used.


author: Jeffrey C. Ollie <jeff@ocjtech.us> - 1.9.1-1
changelog:
  - New since 1.9.0:
  -
  -        Nothing.
  -
  - Bugs fixed since 1.9.0
  -
  -        The dns.dnssec module didn't work with DSA due to namespace
  -        contamination from a "from"-style import.
  -
  - New since 1.8.0:
  -
  -        dnspython now uses poll() instead of select() when available.
  -
  -        Basic DNSSEC validation can be done using dns.dnsec.validate()
  -        and dns.dnssec.validate_rrsig() if you have PyCrypto 2.3 or
  -        later installed.  Complete secure resolution is not yet
  -        available.
  -
  -        Added key_id() to the DNSSEC module, which computes the DNSSEC
  -        key id of a DNSKEY rdata.
  -
  -        Added make_ds() to the DNSSEC module, which returns the DS RR
  -        for a given DNSKEY rdata.
  -
  -        dnspython now raises an exception if HMAC-SHA284 or
  -        HMAC-SHA512 are used with a Python older than 2.5.2.  (Older
  -        Pythons do not compute the correct value.)
  -
  -        Symbolic constants are now available for TSIG algorithm names.
  -
  - Bugs fixed since 1.8.0
  -
  -        dns.resolver.zone_for_name() didn't handle a query response
  -        with a CNAME or DNAME correctly in some cases.
  -
  -        When specifying rdata types and classes as text, Unicode
  -        strings may now be used.
  -
  -        Hashlib compatibility issues have been fixed.
  -
  -        dns.message now imports dns.edns.
  -
  -        The TSIG algorithm value was passed incorrectly to use_tsig()
  -        in some cases.


author: Jeffrey C. Ollie <jeff@ocjtech.us> - 1.9.2-1
changelog:
  - It's brown paper bag time :) The fix for the import problems was
  - actually bad, but didn't show up in testing because the test suite's
  - conditional importing code hid the problem.
  -
  - Any, 1.9.2 is out.
  -
  - Sorry for the churn!


author: Jeffrey C. Ollie <jeff@ocjtech.us> - 1.9.3-1
changelog:
  -
  - New since 1.9.2:
  -
  -     A boolean parameter, 'raise_on_no_answer', has been added to
  - the query() methods.  In no-error, no-data situations, this
  - parameter determines whether NoAnswer should be raised or not.
  - If True, NoAnswer is raised.  If False, then an Answer()
  - object with a None rrset will be returned.
  -
  - Resolver Answer() objects now have a canonical_name field.
  -
  - Rdata now have a __hash__ method.
  -
  - Bugs fixed since 1.9.2:
  -
  -        Dnspython was erroneously doing case-insensitive comparisons
  - of the names in NSEC and RRSIG RRs.
  -
  - We now use "is" and not "==" when testing what section an RR
  - is in.
  -
  - The resolver now disallows metaqueries.


author: Jeffrey C. Ollie <jeff@ocjtech.us> - 1.9.4-1
changelog:
  -
  - dnspython 1.9.4 has been released and is available at
  - http://www.dnspython.org/kits/1.9.4/
  -
  - There is no new functionality in this release; just a few bug fixes
  - in RRSIG and SIG code.
  -
  - I will be eliminating legacy code for earlier versions of DNSSEC in a
  - future release of dnspython.


author: Jeffrey C. Ollie <jeff@ocjtech.us> - 1.11.0-1
changelog:
  - New since 1.10.0:
  -
  -         $GENERATE support
  -
  -         TLSA RR support
  -
  -         Added set_flags() method to dns.resolver.Resolver
  -
  - Bugs fixed since 1.10.0:
  -
  -         Names with offsets >= 2^14 are no longer added to the
  -         compression table.
  -
  -         The "::" syntax is not used to shorten a single 16-bit section
  -         of the text form an IPv6 address.
  -
  -         Caches are now locked.
  -
  -         YXDOMAIN is raised if seen by the resolver.
  -
  -         Empty rdatasets are not printed.
  -
  -         DNSKEY key tags are no longer assumed to be unique.


author: Jeffrey C. Ollie <jeff@ocjtech.us> - 1.11.1-1
changelog:
  - New since 1.11.0:
  -
  -         Nothing
  -
  - Bugs fixed since 1.11.1:
  -
  -         dns.resolver.Resolver erroneously referred to 'retry_servfail'
  -         instead of 'self.retry_servfail'.
  -
  -         dns.tsigkeyring.to_text() would fail trying to convert the
  -         keyname to text.
  -
  -         Multi-message TSIGs were broken for algorithms other than
  -         HMAC-MD5 because we weren't passing the right digest module to
  -         the HMAC code.
  -
  -         dns.dnssec._find_candidate_keys() tried to extract the key
  -         from the wrong variable name.
  -
  -         $GENERATE tests were not backward compatible with python 2.4.
  -
  -         APL RR trailing zero suppression didn't work due to insufficient
  -         python 3 porting.   [dnspython3 only]


author: Petr Spacek <pspacek@redhat.com> - 1.12.0GIT465785f
changelog:
  - Rebase to GIT snapshots 465785f85f87508209117264c677080e901e957c (Python 2)
    and 1b0c15086f0e5f6eacc06d77a119280c31731b3c (Python 3)
    to pull in latest fixes


author: Avram Lubkin <aviso@fedoraproject.org> - 1.12.0GITa4774ee-1
changelog:
  - Latest Snapshot
  - Drop EPEL5 from master spec
  - Patch to support EL6
  - Disable python2 package for EPEL7+


author: Lumír Balhar <lbalhar@redhat.com> - 0.14-3
changelog:
  - Backport patch from upstream/rhel7 which allows pifconfig to show
    multiple IPv4 addresses for each interface
  - Move patches to dist-git
  - Resolves: rhbz#1652174


author: Carl George <carl@george.computer> - 1.6.1-1
changelog:
  - Latest upstream
  - Add patch0 to remove pytest-{cov,runner} deps
  - Share doc and license dir between subpackages
  - Enable EPEL PY3 build


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.9-16
changelog:
  - Python 2 binary package renamed to python2-kmod
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: John Kacur <jkacur@redhat.com> - 0.6.3-4
changelog:
  - various clean-ups including using 'with' context managers in try-except
  - Fix to ignore UnicodeDecodeError when it occurs
  Resolves: rhbz#2016204


author: John Kacur <jkacur@redhat.com> - 0.7.3-1
changelog:
  - Rebase to upstream python-linux-procfs-0.7.3
  - This rebase removes upstream spec files and
  - syncs the git tag with version
  Resolves: RHEL-9195


author: Lumír Balhar <lbalhar@redhat.com> - 9.0.3-16
changelog:
  - Add four new patches for CVEs in bundled urllib3 and requests
  CVE-2018-20060, CVE-2019-11236, CVE-2019-11324, CVE-2018-18074
  Resolves: rhbz#1649153
  Resolves: rhbz#1700824
  Resolves: rhbz#1702473
  Resolves: rhbz#1643829


author: Tomas Orsava <torsava@redhat.com> - 9.0.3-18
changelog:
  - Patch for pip install <url> allow directory traversal, leading to arbitrary file write
  Resolves: rhbz#1868016


author: Lumír Balhar <lbalhar@redhat.com> - 9.0.3-20
changelog:
  - Fix for CVE-2021-3572 - pip incorrectly handled unicode separators in git references
  Resolves: rhbz#1962856


author: mulhern <amulhern@redhat.com> - 0.20.0
changelog:
  - Remove parsing code added in previous release
  - No longer do CI for Python 2.6
  - Eliminate all wildcard imports and __all__ statements
  - No longer use deprecated Device.from_sys_path() method
  - Minor pylint induced changes
  - Documentation fixes


author: mulhern <amulhern@redhat.com> - 0.21.1
changelog:
  - Deprecate use of Device object as mapping from udev property names to values
  - Add a Properties class and a Device.properties() method for udev properties
  - Fix places where Device object was incorrectly used in a boolean context
  - Return an empty string, not None, if the property value is an empty string
  - Exceptions re-raised from libudev calls now have a message string
  - Insert a warning about using a Device in a boolean context in docs
  - Infrastructure for vagrant tests is removed
  - Various internal refactorings
  - Extensive test improvements
  - Numerous documentation fixes


author: Lumír Balhar <lbalhar@redhat.com> - 2.20.0-3
changelog:
  - Bump release to fix upgrade path
    from 2.20.0-2.1.el8_1 via 2.20.0-3.el8_8 to 2.20.0-4.el8
  Related: rhbz#2209469


author: Arun SAG <sagarun@gmail.com> - 0.5.1-2
changelog:
  - Remove OPT_FLAGS from build section since it is a noarch package
  - Fix use of mixed tabs and space
  - Remove extra space around the word cumbersome in description


author: Arun SAG <sagarun@gmail.com> - 0.9.3-1
changelog:
  - Updated to new upstream version 0.9.3
  - Include python-gevent as a dependency for requests.async
  - Clean up shebangs in requests/setup.py,test_requests.py and test_requests_ext.py


author: Arun S A G <sagarun@gmail.com> 0.13.1-1
changelog:
  - Updated to latest upstream release 0.13.1
  - Use system provided ca-certificates
  - No more async requests use grrequests https://github.com/kennethreitz/grequests
  - Remove gevent as it is no longer required by requests


author: Toshio Kuratomi <toshio@fedoraproject.org> - 0.14.1-4
changelog:
  - Let brp_python_bytecompile run again, take care of the non-python{2,3} modules
    by removing them from the python{,3}-requests package that they did not belong
    in.
  - Use the certificates in the ca-certificates package instead of the bundled one
    + https://bugzilla.redhat.com/show_bug.cgi?id=904614
  - Fix a problem with cookie handling
    + https://bugzilla.redhat.com/show_bug.cgi?id=906924


author: Ralph Bean <rbean@redhat.com> - 1.1.0-1
changelog:
  - Latest upstream.
  - Relicense to ASL 2.0 with upstream.
  - Removed cookie handling patch (fixed in upstream tarball).
  - Updated cert unbundling patch to match upstream.
  - Added check section, but left it commented out for koji.


author: Ralph Bean <rbean@redhat.com> - 1.1.0-2
changelog:
  - Unbundled python-charade/chardet.  Using system python-chardet now.
  - Removed deprecated comments and actions against oauthlib unbundling.
    Those are no longer necessary in 1.1.0.
  - Added links to bz tickets over Patch declarations.


author: Ralph Bean <rbean@redhat.com> - 1.1.0-3
changelog:
  - Unbundled python-urllib3.  Using system python-urllib3 now.
  - Conditionally include python-ordereddict for el6.


author: Ralph Bean <rbean@redhat.com> - 2.0.0-1
changelog:
  - Latest upstream.
  - Add doc macro to the python3 files section.
  - Require python-urllib3 greater than or at 1.7.1.


author: Ralph Bean <rbean@redhat.com> - 2.7.0-3
changelog:
  - Lock down the python-urllib3 version to the specific version we unbundled.
    https://bugzilla.redhat.com/show_bug.cgi?id=1253823


author: Ralph Bean <rbean@redhat.com> - 2.7.0-6
changelog:
  - Replace the provides macro with a plain provides field for now until we can
    re-organize this package into two different subpackages.


author: Ralph Bean <rbean@redhat.com> - 2.7.0-7
changelog:
  - Tell setuptools about what version of urllib3 we're unbundling
    for https://github.com/kennethreitz/requests/issues/2816


author: Tomas Orsava <torsava@redhat.com> - 2.18.4-6
changelog:
  - Skip all tests needing httpbin: httpbin has too many dependencies to be
    shipped in RHEL just for build-time package tests


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.5-5
changelog:
  - Python 2 binary package renamed to python2-schedutils
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Lumír Balhar <lbalhar@redhat.com> - 39.2.0-4
changelog:
  - New subpackage platform-python-setuptools without files from /usr/bin/*
  - python3-setuptools contains only files from /usr/bin/* and depends
    on platform-python-setuptools
  - Resolves: rhbz#1641973


author: Toshio Kuratomi <toshio@fedoraproject.org> - 0.6.4-1
changelog:
  - First build from the distribute codebase -- distribute-0.6.4.
  - Remove svn patch as upstream has chosen to go with an easier change for now.


author: Toshio Kuratomi <toshio@fedoraproject.org> - 0.6.7-1
changelog:
  - Move easy_install back into the main package as the needed files have been
    moved from python-devel to the main python package.
  - Update to 0.6.7 bugfix.


author: Toshio Kuratomi <toshio@fedoraproject.org> - 0.6.9-4
changelog:
  - Fix install to make /usr/bin/easy_install the py2 version
  - Don't need python3-tools since the library is now in the python3 package
  - Few other changes to cleanup style


author: Toshio Kuratomi <toshio@fedoraproject.org> - 0.6.10-1
changelog:
  - Update the python3 portions but disable for now.
  - Update to 0.6.10
  - Remove %pre scriptlet as the file has a different name than the old
    package's directory


author: Toshio Kuratomi <toshio@fedoraproject.org> - 0.6.13-5
changelog:
  - Upstream patch for compatibility problem with setuptools
  - Minor spec cleanups
  - Provide python-distribute for those who see an import distribute and need
    to get the proper package.


author: Toshio Kuratomi <toshio@fedoraproject.org> - 0.6.28-1
changelog:
  - New upstream release:
    - python-3.3 fixes
    - honor umask when setuptools is used to install other modules


author: Toshio Kuratomi <toshio@fedoraproject.org> - 0.8-1
changelog:
  - Update to upstream 0.8  release.  Codebase now runs on anything from
    python-2.4 to python-3.3 without having to be translated by 2to3.


author: Toshio Kuratomi <toshio@fedoraproject.org> - 0.9.5-1
changelog:
  - Update to 0.9.5
    - package_index can handle hashes other than md5
    - Fix security vulnerability in SSL certificate validation
    - https://bugzilla.redhat.com/show_bug.cgi?id=963260


author: Toshio Kuratomi <toshio@fedoraproject.org> - 1.1.6-1
changelog:
  - Update to newer upstream release.  Some minor incompatibilities listed but
    they should affect few, if any consumers.


author: Toshio Kuratomi <toshio@fedoraproject.org> - 1.1.7-1
changelog:
  - Update to newer upstream release that has our patch to the unittests
  - Fix for http://bugs.python.org/issue17997#msg194950 which affects us since
    setuptools copies that code. Changed to use
    python-backports-ssl_match_hostname so that future issues can be fixed in
    that package.


author: Toshio Kuratomi <toshio@fedoraproject.org> - 2.0-1
changelog:
  - Update to new upstream release with a few things removed from the API:
    Changelog: https://pypi.python.org/pypi/setuptools#id139


author: Toshio Kuratomi <toshio@fedoraproject.org> - 2.0-8
changelog:
  - Remove the python-setuptools-devel Virtual Provides as per this Fedora 21
    Change: http://fedoraproject.org/wiki/Changes/Remove_Python-setuptools-devel


author: Ralph Bean <rbean@redhat.com> - 6.0.2-2
changelog:
  - Modernized python2 macros.
  - Inlined locale environment variables in the %check section.
  - Remove bundled egg-info and .exes.


author: Kevin Fenzi <kevin@scrye.com> 17.1.1-3
changelog:
  - Drop no longer needed Requires/BuildRequires on python-backports-ssl_match_hostname
  - Fixes bug #1231325


author: Kevin Fenzi <kevin@scrye.com> - 34.1.1-1
changelog:
  - Update to 34.1.1. Fixes bug #1412268
  - Fix License tag. Fixes bug #1412268
  - Add Requires for fomerly bundled projects: six, packaging appdirs


author: Michal Cyprian <mcyprian@redhat.com> - 36.2.0-3
changelog:
  - Revert "Add --executable option to easy_install command"
    This enhancement is currently not needed and it can possibly
    collide with `pip --editable`option


author: Tomas Orsava <torsava@redhat.com> - 36.2.0-4
changelog:
  - Switch macros to bcond's and make Python 2 optional to facilitate building
    the Python 2 and Python 3 modules.


author: Tomas Orsava <torsava@redhat.com> - 36.2.0-5
changelog:
  - Add Patch 0 that fixes a test suite failure on Python 3 in absence of
    the Python 2 version of pip
  - Move docs to their proper place


author: Tomas Orsava <torsava@redhat.com> - 36.2.0-6
changelog:
  - Add the platform-python subpackage
  - Disable tests so platform-python stack can be bootstrapped
    (https://fedoraproject.org/wiki/Changes/Platform_Python_Stack)


author: Tomas Orsava <torsava@redhat.com> - 36.2.0-7
changelog:
  - Re-enable tests to finish bootstrapping the platform-python stack
    (https://fedoraproject.org/wiki/Changes/Platform_Python_Stack)


author: Miro Hrončok <mhroncok@redhat.com> - 37.0.0-1
changelog:
  - Update to 37.0.0 (fixes #1474126)
  - Removed not needed pip3 patch (upstream included different version of fix)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.6.4-8
changelog:
  - Python 2 binary package renamed to python2-slip
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.6.4-10
changelog:
  - Also rename python-slip-dbus and python-slip-gtk to python2-*
  - Add missing %python_provide macros
  - Use new python2- names in dependencies


author: Charalampos Stratakis <cstratak@redhat.com> - 0.6.4-12
changelog:
  - Make firewalld to not log errors when running commands as root
    in the absence of polkitd.
  Resolves: rhbz#2076606


author: Tomas Orsava <torsava@redhat.com> - 1.24.2-1
changelog:
  - Rebased to 1.24.2 to fix CVE-2019-11324
  - Added patches for CVE-2019-11236 (AKA CVE-2019-9740)
  - Resolves: rhbz#1703361 rhbz#1706026


author: Lumír Balhar <lbalhar@redhat.com> - 1.24.2-3
changelog:
  - Enable TLS 1.3 post-handshake authentication
  - Adjust RECENT_DATE variable according to rules
  Resolves: rhbz#1726743


author: Ralph Bean <rbean@redhat.com> - 1.5-3
changelog:
  - Renamed patches to python-urllib3-*
  - Fixed ssl check patch to use the correct cert path for Fedora.
  - Included dependency on ca-certificates
  - Cosmetic indentation changes to the .spec file.


author: Ralph Bean <rbean@redhat.com> - 1.5-4
changelog:
  - Upstream patch to fix Accept header when behind a proxy.
  - Reorganize patch numbers to more clearly distinguish them.


author: Ralph Bean <rbean@redhat.com> - 1.7-1
changelog:
  - Update to latest upstream.
  - Removed the accept-header proxy patch which is included in upstream now.
  - Removed py2.6 compat patch which is included in upstream now.


author: Ralph Bean <rbean@redhat.com> - 1.10-1
changelog:
  - Latest upstream 1.10, for python-requests-2.5.0.
  - Re-do unbundling without patch, with symlinks.
  - Modernize python2 macros.
  - Remove the with_dummyserver tests which fail only sometimes.


author: Ralph Bean <rbean@redhat.com> - 1.10.4-3.20150503gita91975b
changelog:
  - Apply pyopenssl injection for an outdated cpython as per upstream advice
    https://urllib3.readthedocs.org/en/latest/security.html#insecureplatformwarning
    https://urllib3.readthedocs.org/en/latest/security.html#pyopenssl


author: Ralph Bean <rbean@redhat.com> - 1.15.1-2
changelog:
  - Remove broken symlinks to unbundled python3-six files
    https://bugzilla.redhat.com/show_bug.cgi?id=1295015


author: Lukas Slebodnik <lslebodn@fedoraproject.org> - 1.22-9
changelog:
  - Do not lowercase hostnames with custom-protocol (rhbz 1567862)
  - upstream: https://github.com/urllib3/urllib3/issues/1267


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.3.0-11
changelog:
  - Python 2 binary package renamed to python2-urwid
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: David Cantrell <dcantrell@redhat.com> - 1.3.1-2
changelog:
  - Apply upstream fix for EINTR handling in test_vterm test case
  - Apply upstream fix for test_remove_watch_file flakiness
  - Apply upstream fix for test_vterm handling of NUL characters


author: Lumír Balhar <lbalhar@redhat.com> - 3.6.8-58
changelog:
  - Security fix for CVE-2022-48564
  Resolves: RHEL-16674
  - Skip tests failing on s390x
  Resolves: RHEL-19252


author: David Malcolm <dmalcolm@redhat.com> - 3.1.1-2
changelog:
  - disable invocation of brp-python-bytecompile in postprocessing, since
  it would be with the wrong version of python (adapted from ivazquez'
  python3000 specfile)
  - use a custom implementation of __find_provides in order to filter out bogus
  provides lines for the various .so modules
  - fixup distutils/unixccompiler.py to remove standard library path from rpath
  (patch 1, was Patch0 in ivazquez' python3000 specfile)
  - split out libraries into a -libs subpackage
  - update summaries and descriptions, basing content on ivazquez' specfile
  - fixup executable permissions on .py, .xpm and .xbm files, based on work in
  ivazquez's specfile
  - get rid of DOS batch files
  - fixup permissions for shared libraries from non-standard 555 to standard 755
  - move /usr/bin/python*-config to the -devel subpackage
  - mark various directories as being documentation


author: David Malcolm <dmalcolm@redhat.com> - 3.1.1-3
changelog:
  - remove executable flag from various files that shouldn't have it
  - fix end-of-line encodings
  - fix a character encoding


author: David Malcolm <dmalcolm@redhat.com> - 3.1.1-4
changelog:
  - update patch0's setup of the crypt module to link it against libcrypt
  - update patch0 to comment "datetimemodule" back out, so that it is built
  using setup.py (see Setup, option 3), thus linking it statically against
  timemodule.c and thus avoiding a run-time "undefined symbol:
  _PyTime_DoubleToTimet" failure on "import datetime"


author: David Malcolm <dmalcolm@redhat.com> - 3.1.1-5
changelog:
  - fixup importlib/_bootstrap.py so that it correctly handles being unable to
  open .pyc files for writing (patch 2, upstream issue 7187)
  - actually apply the rpath patch (patch 1)


author: David Malcolm <dmalcolm@redhat.com> - 3.1.1-6
changelog:
  - reword description, based on suggestion by amcnabb
  - fix the test_email and test_imp selftests (patch 3 and patch 4 respectively)
  - fix the test_tk and test_ttk_* selftests (patch 5)
  - fix up the specfile's handling of shebang/perms to avoid corrupting
  test_httpservers.py (sed command suggested by amcnabb)


author: David Malcolm <dmalcolm@redhat.com> - 3.1.1-7
changelog:
  - remove commented-away patch 51 (python-2.6-distutils_rpm.patch): the -O1
  flag is used by default in the upstream code
  - "Makefile" and the config-32/64.h file are needed by distutils/sysconfig.py
  _init_posix(), so we include them in the core package, along with their parent
  directories (bug 531901)


author: David Malcolm <dmalcolm@redhat.com> - 3.1.1-8
changelog:
  - add a provides of "python(abi)" (see bug 532118)
  - fix issues identified by a.badger in package review (bug 526126, comment 39):
    - use "3" thoughout metadata, rather than "3.*"
    - remove conditional around "pkg-config openssl"
    - use standard cleanup of RPM_BUILD_ROOT
    - replace hardcoded references to /usr with _prefix macro
    - stop removing egg-info files
    - use /usr/bin/python3.1 rather than /use/bin/env python3.1 when fixing
  up shebang lines
    - stop attempting to remove no-longer-present .cvsignore files
    - move the post/postun sections above the "files" sections


author: David Malcolm <dmalcolm@redhat.com> - 3.1.1-9
changelog:
  - add macros.python3 to the -devel subpackage, containing common macros for use
  when packaging python3 modules


author: Andrew McNabb <amcnabb@mcnabbs.org> - 3.1.1-10
changelog:
  - switched a few instances of "find |xargs" to "find -exec" for consistency.
  - made the description of __os_install_post more accurate.


author: David Malcolm <dmalcolm@redhat.com> - 3.1.1-11
changelog:
  - add %check section (thanks to Thomas Spura)
  - update patch 4 to use correct shebang line
  - get rid of stray patch file from buildroot


author: David Malcolm <dmalcolm@redhat.com> - 3.1.1-12
changelog:
  - remove build-time requirements on tix and tk, since we already have
  build-time requirements on the -devel subpackages for each of these (Thomas
  Spura)
  - replace usage of %define with %global (Thomas Spura)
  - remove forcing of CC=gcc as this old workaround for bug 109268 appears to
  longer be necessary
  - move various test files from the "tools"/"tkinter" subpackages to the "test"
  subpackage


author: David Malcolm <dmalcolm@redhat.com> - 3.1.1-14
changelog:
  - replace references to /usr with %{_prefix}; replace references to
  /usr/include with %{_includedir} (Toshio)


author: David Malcolm <dmalcolm@redhat.com> - 3.1.1-15
changelog:
  - fix the URLs output by pydoc so they point at python.org's 3.1 build of the
  docs, rather than the 2.6 build


author: David Malcolm <dmalcolm@redhat.com> - 3.1.1-16
changelog:
  - use the %{_isa} macro to ensure that the python-devel dependency on python
  is for the correct multilib arch (#555943)
  - delete bundled copy of libffi to make sure we use the system one


author: David Malcolm <dmalcolm@redhat.com> - 3.1.1-19
changelog:
  - add %py3dir macro to macros.python3 (to be used during unified python 2/3
  builds for setting up the python3 copy of the source tree)


author: David Malcolm <dmalcolm@redhat.com> - 3.1.1-20
changelog:
  - change python-3.1.1-config.patch to remove our downstream change to curses
  configuration in Modules/Setup.dist, so that the curses modules are built using
  setup.py with the downstream default (linking against libncursesw.so, rather
  than libncurses.so), rather than within the Makefile; add a test to %install
  to verify the dso files that the curses module is linked against the correct
  DSO (bug 539917; changes _cursesmodule.so -> _curses.so)


author: David Malcolm <dmalcolm@redhat.com> - 3.1.1-21
changelog:
  - introduce %{dynload_dir} macro
  - explicitly list all lib-dynload files, rather than dynamically gathering the
  payload into a temporary text file, so that we can be sure what we are
  shipping
  - introduce a macros.pybytecompile source file, to help with packaging python3
  modules (Source3; written by Toshio)
  - rename "2to3-3" to "python3-2to3" to better reflect python 3 module packaging
  plans


author: David Malcolm <dmalcolm@redhat.com> - 3.1.1-22
changelog:
  - update python-3.1.1-config.patch to remove downstream customization of build
  of pyexpat and elementtree modules
  - add patch adapted from upstream (patch 7) to add support for building against
  system expat; add --with-system-expat to "configure" invocation
  - remove embedded copies of expat and zlib from source tree during "prep"


author: David Malcolm <dmalcolm@redhat.com> - 3.1.1-24
changelog:
  - move the -gdb.py file from %{_libdir}/INSTSONAME-gdb.py to
  %{_prefix}/lib/debug/%{_libdir}/INSTSONAME.debug-gdb.py to avoid noise from
  ldconfig (bug 562980), and which should also ensure it becomes part of the
  debuginfo subpackage, rather than the libs subpackage
  - introduce %{py_SOVERSION} and %{py_INSTSONAME} to reflect the upstream
  configure script, and to avoid fragile scripts that try to figure this out
  dynamically (e.g. for the -gdb.py change)


author: David Malcolm <dmalcolm@redhat.com> - 3.1.1-25
changelog:
  - split configure options into multiple lines for easy of editing
  - add systemtap static markers (wcohen, mjw, dmalcolm; patch 8), a systemtap
  tapset defining "python.function.entry" and "python.function.return" to make
  the markers easy to use (dmalcolm; source 5), and an example of using the
  tapset to the docs (dmalcolm; source 6) (rhbz:545179)


author: Thomas Spura <tomspur@fedoraproject.org> - 3.1.1-26
changelog:
  - rebuild for new package of redhat-rpm-config (rhbz:564527)
  - use 'install -p' when running 'make install'


author: David Malcolm <dmalcolm@redhat.com> - 3.1.1-27
changelog:
  - add pyfuntop.stp example (source 7)
  - convert usage of $$RPM_BUILD_ROOT to %{buildroot} throughout, for
  consistency with python.spec


author: David Malcolm <dmalcolm@redhat.com> - 3.1.2-1
changelog:
  - update to 3.1.2: http://www.python.org/download/releases/3.1.2/
  - drop upstreamed patch 2 (.pyc permissions handling)
  - drop upstream patch 5 (fix for the test_tk and test_ttk_* selftests)
  - drop upstreamed patch 200 (path-fixing script)


author: David Malcolm <dmalcolm@redhat.com> - 3.1.2-3
changelog:
  - update python-gdb.py from v3 to v4 (fixing infinite recursion on reference
  cycles and tracebacks on bytes 0x80-0xff in strings, adding handlers for sets
  and exceptions)


author: David Malcolm <dmalcolm@redhat.com> - 3.1.2-5
changelog:
  - exclude test_http_cookies when running selftests, due to hang seen on
  http://koji.fedoraproject.org/koji/taskinfo?taskID=2088463 (cancelled after
  11 hours)
  - update python-gdb.py from v5 to py3k version submitted upstream


author: David Malcolm <dmalcolm@redhat.com> - 3.1.2-6
changelog:
  - build and install two different configurations of Python 3: debug and
  standard, packaging the debug build in a new "python3-debug" subpackage
  (patch 103)


author: David Malcolm <dmalcolm@redhat.com> - 3.1.2-7
changelog:
  - add configure-time support for COUNT_ALLOCS and CALL_PROFILE debug options
  (patch 104); enable them and the WITH_TSC option within the debug build


author: David Malcolm <dmalcolm@redhat.com> - 3.1.2-10
changelog:
  - ensure that the compiler is invoked with "-fwrapv" (rhbz#594819)
  - reformat whitespace in audioop.c (patch 106)
  - CVE-2010-1634: fix various integer overflow checks in the audioop
  module (patch 107)
  - CVE-2010-2089: further checks within the audioop module (patch 108)
  - CVE-2008-5983: the new PySys_SetArgvEx entry point from r81399 (patch 109)


author: David Malcolm <dmalcolm@redhat.com> - 3.1.2-11
changelog:
  - Fix an incompatibility between pyexpat and the system expat-2.0.1 that led to
  a segfault running test_pyexpat.py (patch 110; upstream issue 9054; rhbz#610312)


author: David Malcolm <dmalcolm@redhat.com> - 3.2-0.0.a1
changelog:
  - 3.2a1; add alphatag
  - rework %files in the light of PEP 3147 (__pycache__)
  - drop our configuration patch to Setup.dist (patch 0): setup.py should do a
  better job of things, and the %files explicitly lists our modules (r82746
  appears to break the old way of doing things).  This leads to various modules
  changing from "foomodule.so" to "foo.so".  It also leads to the optimized build
  dropping the _sha1, _sha256 and _sha512 modules, but these are provided by
  _hashlib; _weakref becomes a builtin module; xxsubtype goes away (it's only for
  testing/devel purposes)
  - fixup patches 3, 4, 6, 8, 102, 103, 105, 111 for the rebase
  - remove upstream patches: 7 (system expat), 106, 107, 108 (audioop reformat
  plus CVE-2010-1634 and CVE-2010-2089), 109 (CVE-2008-5983)
  - add machinery for rebuilding "configure" and friends, using the correct
  version of autoconf (patch 300)
  - patch the debug build's usage of COUNT_ALLOCS to be less verbose (patch 125)
  - "modulator" was removed upstream
  - drop "-b" from patch applications affecting .py files to avoid littering the
  installation tree


author: Thomas Spura <tomspur@fedoraproject.org> - 3.2-0.1.a1
changelog:
  - on 64bit "stdlib" was still "/usr/lib/python*" (modify *lib64.patch)
  - make find-provides-without-python-sonames.sh 64bit aware


author: David Malcolm <dmalcolm@redhat.com> - 3.2-0.3.a1
changelog:
  - Move test.support to core package (rhbz#596258)
  - Add various missing __pycache__ directories to payload


author: David Malcolm <dmalcolm@redhat.com> - 3.2-0.4.a1
changelog:
  - move most of the content of the core package to the libs subpackage, given
  that the libs aren't meaningfully usable without the standard libraries


author: David Malcolm <dmalcolm@redhat.com> - 3.2-0.5.b2
changelog:
  - 3.2b2
  - rework patch 3 (removal of mimeaudio tests), patch 6 (no static libs),
  patch 8 (systemtap), patch 102 (lib64)
  - remove patch 4 (rendered redundant by upstream r85537), patch 103 (PEP 3149),
  patch 110 (upstreamed expat fix), patch 111 (parallel build fix for grammar
  fixed upstream)
  - regenerate patch 300 (autotool intermediates)
  - workaround COUNT_ALLOCS weakref issues in test suite (patch 126, patch 127,
  patch 128)
  - stop using runtest.sh in %check (dropped by upstream), replacing with
  regrtest; fixup list of failing tests
  - introduce "pyshortver", "SOABI_optimized" and "SOABI_debug" macros
  - rework manifests of shared libraries to use "SOABI_" macros, reflecting
  PEP 3149
  - drop itertools, operator and _collections modules from the manifests as py3k
  commit r84058 moved these inside libpython; json/tests moved to test/json_tests
  - move turtle code into the tkinter subpackage


author: David Malcolm <dmalcolm@redhat.com> - 3.2-0.8.b2
changelog:
  - set EXTRA_CFLAGS to our CFLAGS, rather than overriding OPT, fixing a linker
  error with dynamic annotations (when configured using --with-valgrind)
  - fix the ppc build of the debug configuration (patch 130; rhbz#661510)


author: David Malcolm <dmalcolm@redhat.com> - 3.2-0.9.rc1
changelog:
  - 3.2rc1
  - rework patch 6 (static lib removal)
  - remove upstreamed patch 130 (ppc debug build)
  - regenerate patch 300 (autotool intermediates)
  - updated packaging to reflect upstream rewrite of "Demo" (issue 7962)
  - added libpython3.so and 2to3-3.2


author: David Malcolm <dmalcolm@redhat.com> - 3.2.1-1
changelog:
  - 3.2.1; refresh lib64 patch (102), subprocess unit test patch (129), disabling
  of static library build (due to Modules/_testembed; patch 6), autotool
  intermediates (patch 300)


author: David Malcolm <dmalcolm@redhat.com> - 3.2.1-5
changelog:
  - re-enable and fix the --with-tsc option on ppc64, and rework it on 32-bit
  ppc to avoid aliasing violations (patch 130; rhbz#698726)


author: David Malcolm <dmalcolm@redhat.com> - 3.2.2-2
changelog:
  - rewrite of "check", introducing downstream-only hooks for skipping specific
  cases in an rpmbuild (patch 132), and fixing/skipping failing tests in a more
  fine-grained manner than before; (patches 106, 133-142 sparsely, moving
  patches for consistency with python.spec: 128 to 134, 126 to 135, 127 to 141)


author: David Malcolm <dmalcolm@redhat.com> - 3.2.2-3
changelog:
  - renumber and rename patches for consistency with python.spec (8 to 55, 106
  to 104, 6 to 111, 104 to 113, 105 to 114, 125, 131, 130 to 143)


author: David Malcolm <dmalcolm@redhat.com> - 3.2.2-5
changelog:
  - support OpenSSL FIPS mode in _hashlib and hashlib; don't build the _md5 and
  _sha* modules, relying on _hashlib in hashlib (rhbz#563986; patch 146)


author: David Malcolm <dmalcolm@redhat.com> - 3.2.3-1
changelog:
  - 3.2.3; refresh patch 102 (lib64); drop upstream patches 148 (gdbm magic
  values), 149 (__pycache__ fix); add patch 152 (test_gdb regex)


author: David Malcolm <dmalcolm@redhat.com> - 3.2.3-4
changelog:
  - avoid allocating thunks in ctypes unless absolutely necessary, to avoid
  generating SELinux denials on "import ctypes" and "import uuid" when embedding
  Python within httpd (patch 155; rhbz#814391)


author: David Malcolm <dmalcolm@redhat.com> - 3.2.3-7
changelog:
  - update uid/gid handling to avoid int overflows seen with uid/gid
  values >= 2^31 on 32-bit architectures (patch 157; rhbz#697470)


author: David Malcolm <dmalcolm@redhat.com> - 3.3.0-0.1.b1
changelog:
  * Fri Jun 22 2012 David Malcolm <dmalcolm@redhat.com> - 3.2.3-10
  - use macro for power64 (rhbz#834653)


author: David Malcolm <dmalcolm@redhat.com> - 3.3.0-0.1.b1
changelog:
  - 3.2 -> 3.3: https://fedoraproject.org/wiki/Features/Python_3.3
  - 3.3.0b1: refresh patches 3, 55, 102, 111, 113, 114, 134, 157; drop upstream
  patch 147; regenenerate autotools patch; drop "--with-wide-unicode" from
  configure (PEP 393); "plat-linux2" -> "plat-linux" (upstream issue 12326);
  "bz2" -> "_bz2" and "crypt" -> "_crypt"; egg-info files are no longer shipped
  for stdlib (upstream issues 10645 and 12218); email/test moved to
  test/test_email; add /usr/bin/pyvenv[-3.3] and venv module (PEP 405); add
  _decimal and _lzma modules; make collections modules explicit in payload again
  (upstream issue 11085); add _testbuffer module to tests subpackage (added in
  upstream commit 3f9b3b6f7ff0); fix test failures (patches 160 and 161);
  workaround erroneously shared _sysconfigdata.py upstream issue #14774; fix
  distutils.sysconfig traceback (patch 162); add BuildRequires: xz-devel (for
  _lzma module); skip some tests within test_socket (patch 163)


author: David Malcolm <dmalcolm@redhat.com> - 3.3.0-0.3.b2
changelog:
  - 3.3b1 -> 3.3b2; drop upstreamed patch 152; refresh patches 3, 102, 111,
  134, 153, 160; regenenerate autotools patch; rework systemtap patch to work
  correctly when LANG=C (patch 55); importlib.test was moved to
  test.test_importlib upstream


author: Toshio Kuratomi <toshio@fedoraproject.org> - 3.3.0-8
changelog:
  - Fix error in platform.platform() when non-ascii byte strings are decoded to
    unicode (rhbz#922149)


author: Bohuslav Kabrda <bkabrda@redhat.com> - 3.3.1-1
changelog:
  - Updated to Python 3.3.1.
  - Refreshed patches: 55 (systemtap), 111 (no static lib), 146 (hashlib fips),
  153 (fix test_gdb noise), 157 (uid, gid overflow - fixed upstream, just
  keeping few more downstream tests)
  - Removed patches: 3 (audiotest.au made it to upstream tarball)
  - Removed workaround for http://bugs.python.org/issue14774, discussed in
  http://bugs.python.org/issue15298 and fixed in revision 24d52d3060e8.


author: Bohuslav Kabrda <bkabrda@redhat.com> - 3.3.1-3
changelog:
  - Add patch that enables building on ppc64p7 (replace the sed, so that
  we get consistent with python2 spec and it's more obvious that we're doing it.


author: Bohuslav Kabrda <bkabrda@redhat.com> - 3.3.2-1
changelog:
  - Updated to Python 3.3.2.
  - Refreshed patches: 153 (gdb test noise)
  - Dropped patches: 175 (configure -Wformat, fixed upstream), 182 (gdb
  test threads)
  - Synced patch numbers with python.spec.


author: Bohuslav Kabrda <bkabrda@redhat.com> - 3.4.0-0.1.a4
changelog:
  - Update to Python 3.4 alpha 4.
  - Refreshed patches: 55 (systemtap), 102 (lib64), 111 (no static lib),
  114 (statvfs flags), 132 (unittest rpmbuild hooks), 134 (fix COUNT_ALLOCS in
  test_sys), 143 (tsc on ppc64), 146 (hashlib fips), 153 (test gdb noise),
  157 (UID+GID overflows), 173 (ENOPROTOOPT in bind_port), 186 (dont raise
  from py_compile)
  - Removed patches: 129 (test_subprocess nonreadable dir - no longer fails in
  Koji), 142 (the mock issue that caused this is fixed)
  - Added patch 187 (remove thread atfork) - will be in next version
  - Refreshed script for checking pyc and pyo timestamps with new ignored files.
  - The fips patch is disabled for now until upstream makes a final decision
  what to do with sha3 implementation for 3.4.0.


author: Bohuslav Kabrda <bkabrda@redhat.com> - 3.4.0-0.1.b1
changelog:
  - Update to Python 3.4 beta 1.
  - Refreshed patches: 102 (lib64), 111 (no static lib), 125 (less verbose COUNT
  ALLOCS), 141 (fix COUNT_ALLOCS in test_module), 146 (hashlib fips),
  157 (UID+GID overflows), 173 (ENOPROTOOPT in bind_port)
  - Removed patch 00187 (remove pthread atfork; upstreamed)


author: Bohuslav Kabrda <bkabrda@redhat.com> - 3.4.0-0.1.b2
changelog:
  - Update to Python 3.4 beta 2.
  - Refreshed patches: 55 (systemtap), 146 (hashlib-fips), 154 (test_gdb noise)
  - Dropped patches: 114 (statvfs constants), 177 (platform unicode)


author: Matej Stuchlik <mstuchli@redhat.com> - 3.4.0-5
changelog:
  - Don't add Werror=declaration-after-statement for extension
    modules through setup.py (PyBT#21121)


author: Dan Horák <dan[at]danny.cz> - 3.4.1-7
changelog:
  - update the arch list where valgrind exists - %power64 includes also
      ppc64le which is not supported yet


author: Matej Stuchlik <mstuchli@redhat.com> - 3.4.2-1
changelog:
  - Update to 3.4.2
  - Refreshed patches: 156 (gdb autoload)
  - Removed: 195 (Werror declaration), 197 (CVE-2014-4650)


author: Matej Stuchlik <mstuchli@redhat.com> - 3.4.2-7
changelog:
  - Fixed undefined behaviour in faulthandler which caused test to hang on x86_64
    (http://bugs.python.org/issue23433)


author: Matej Stuchlik <mstuchli@redhat.com> - 3.4.3-1
changelog:
  - Updated to 3.4.3
  - BuildPython now accepts additional build options
  - Temporarily disabled test_gdb on arm (rhbz#1196181)


author: Matej Stuchlik <mstuchli@redhat.com> - 3.4.3-4
changelog:
  - Use 1024bit DH key in test_ssl
  - Use -O0 when compiling -debug build
  - Update pip version variable to the version we actually ship


author: Thomas Spura <tomspur@fedoraproject.org> - 3.4.3-4
changelog:
  - python3-devel: Require python-macros for version independant macros such as
    python_provide. See fpc#281 and fpc#534.


author: Tomas Orsava <torsava@redhat.com> - 3.5.1-9
changelog:
  - Fix for: CVE-2016-0772 python: smtplib StartTLS stripping attack
  - Raise an error when STARTTLS fails
  - rhbz#1303647: https://bugzilla.redhat.com/show_bug.cgi?id=1303647
  - rhbz#1346345: https://bugzilla.redhat.com/show_bug.cgi?id=1346345
  - Fixed upstream: https://hg.python.org/cpython/rev/d590114c2394


author: Tomas Orsava <torsava@redhat.com> - 3.5.2-1
changelog:
  - Rebased to version 3.5.2
  - Set to work with pip version 8.1.2
  - Removed patches 207, 237, 241 as fixes are already contained in Python 3.5.2
  - Removed arch or environment specific patches 194, 196, 203, and 208
    as test builds indicate they are no longer needed
  - Updated patches 102, 146, and 242 to work with the new Python codebase
  - Removed patches 200, 201, 5000 which weren't even being applied


author: Tomas Orsava <torsava@redhat.com> - 3.5.2-2
changelog:
  - Updated .pyc 'bytecompilation with the newly installed interpreter' to also
    recompile optimized .pyc files
  - Removed .pyo 'bytecompilation with the newly installed interpreter', as .pyo
    files are no more
  - Resolves rhbz#1373635


author: Charalampos Stratakis <cstratak@redhat.com> - 3.5.2-6
changelog:
  - Use proper patch numbering and base upstream branch for
  porting ssl and hashlib modules to OpenSSL 1.1.0
  - Drop hashlib patch for now
  - Add riscv64 arch to 64bit and no-valgrind arches


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.0-7
changelog:
  - Fix error check, so that Random.seed actually uses OS randomness (rhbz#1412275)
  - Skip test_aead_aes_gcm during rpmbuild


author: Tomas Orsava <torsava@redhat.com> - 3.6.0-8
changelog:
  - Modify the runtime dependency of python3-libs on system-python-libs to use
    just the version and release number, but not the dist tag due to Modularity


author: Tomas Orsava <torsava@redhat.com> - 3.6.0-9
changelog:
  - Modify the runtime dependency of python3-libs on system-python-libs again,
    because previous attempt didn't work properly with dnf resolving mechanism


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.0-12
changelog:
  - BuildRequire the new dependencies of setuptools when rewheel mode is enabled
  in order for the virtualenvs to work properly


author: Michal Cyprian <mcyprian@redhat.com> - 3.6.0-18
changelog:
  - Set values of prefix and exec_prefix to /usr/local for
    /usr/bin/python* executables
  - Use new %_module_build macro


author: Michal Cyprian <mcyprian@redhat.com> - 3.6.0-19
changelog:
  - Revert "Set values of prefix and exec_prefix to /usr/local for
    /usr/bin/python* executables..." to prevent build failures
    of packages using alternate build tools


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.0-21
changelog:
  - Use proper command line parsing in _testembed
  - Backport of PEP 538: Coercing the legacy C locale to a UTF-8 based locale
    https://fedoraproject.org/wiki/Changes/python3_c.utf-8_locale


author: Iryna Shcherbina <ishcherb@redaht.com> - 3.6.1-0.1.rc1
changelog:
  - Update to Python 3.6.1 release candidate 1
  - Add patch 264 to skip a known test failure on aarch64


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.1-6
changelog:
  - Enable profile guided optimizations for x86_64 and i686 architectures
  - Update to a newer implementation of PEP 538
  - Update description to reflect that Python 3 is now the default Python


author: Tomas Orsava <torsava@redhat.com> - 3.6.1-7
changelog:
  - Added a dependency to the devel subpackage on python3-rpm-generators which
    have been excised out of rpm-build
  - Updated notes on bootstrapping Python on top of this specfile accordingly
  - Involves: rhbz#1410631, rhbz#1444925


author: Florian Weimer <fweimer@redhat.com> - 3.6.2-4
changelog:
  - Do not generate debuginfo subpackages (#1476593)
  - Rebuild with binutils fix for ppc64le (#1475636)


author: Tomas Orsava <torsava@redhat.com> - 3.6.2-5
changelog:
  - Dropped BuildRequires on db4-devel which was useful for Python 2 (module
    bsddb), however, no longer needod for Python 3
  - Tested building Python 3 with and without the dependency, all tests pass and
    filelists of resulting RPMs are identical


author: Michal Cyprian <mcyprian@redhat.com> - 3.6.2-7
changelog:
  - Revert "Add --executable option to install.py command"
    This enhancement is currently not needed and it can possibly
    collide with `pip --editable`option


author: Miro Hrončok <mhroncok@redhat.com> - 3.6.2-8
changelog:
  - Have /usr/bin/2to3 (rhbz#1111275)
  - Provide 2to3 and idle3, list them in summary and description (rhbz#1076401)


author: Petr Viktorin <pviktori@redhat.com> - 3.6.2-11
changelog:
  - Add bcond for --without optimizations
  - Reword package descriptions
  - Remove Group declarations
  - Skip failing test_float_with_comma


author: Michal Cyprian <mcyprian@redhat.com> - 3.6.2-12
changelog:
  - Use python3 style of calling super() without arguments in rpath
    patch to prevent recursion in UnixCCompiler subclasses
  Resolves: rhbz#1458122


author: Petr Viktorin <pviktori@redhat.com> - 3.6.2-13
changelog:
  - Rename patch files to be consistent
  - Run autotools to generate the configure script before building
  - Merge lib64 patches (104 into 102)
  - Skip test_bdist_rpm using test config rather than a patch (removes patch 137)
  - Remove patches 157 and 186, which had test changes left over after upstreaming
  - Remove patch 188, a temporary workaround for hashlib tests
  - Merge patches 180, 206, 243, 5001 (architecture naming) into new patch 274
  - Move python2-tools conflicts to tools subpackage (it was wrongly in tkinter)


author: Miro Hrončok <mhroncok@redhat.com> - 3.6.2-14
changelog:
  - Expat >= 2.1.0 is everywhere, remove explicit requires
  - Conditionalize systemtap-devel BuildRequires
  - For consistency, require /usr/sbin/ifconfig instead of net-tools


author: Petr Viktorin <pviktori@redhat.com> - 3.6.2-16
changelog:
  - Specfile cleanup
  - Make the main description also applicable to the SRPM
  - Add audiotest.au to the test package


author: Miro Hrončok <mhroncok@redhat.com> - 3.6.2-19
changelog:
  - Move pathfix.py to bindir, https://github.com/fedora-python/python-rpm-porting/issues/24
  - Make the -devel package require redhat-rpm-config
  Resolves: rhbz#1496757


author: Björn Esser <besser82@fedoraproject.org> - 3.6.4-8
changelog:
  - Add patch to explicitly link _ctypes module with -ldl (#1537489)
  - Refactored patch for libxcrypt
  - Re-enable strict symbol checks in the link editor


author: Tomas Orsava <torsava@redhat.com> - 3.6.4-10
changelog:
  - Disable test_gdb for all arches and test_buffer for ppc64le in anticipation
    of the F28 mass rebuild
  - Re-enable these tests after the mass rebuild when they can be properly
    addressed


author: Iryna Shcherbina <ishcherb@redhat.com> - 3.6.4-14
changelog:
  - Remove the python3-tools package (#rhbz 1312030)
  - Move /usr/bin/2to3 to python3-devel
  - Move /usr/bin/idle and idlelib to python3-idle
  - Provide python3-tools from python3-idle


author: Miro Hrončok <mhroncok@redhat.com> - 3.6.4-15
changelog:
  - Filter out automatic /usr/bin/python3.X requirement,
    recommend the main package from libs instead
  Resolves: rhbz#1547131


author: Miro Hrončok <mhroncok@redhat.com> - 3.6.4-18
changelog:
  - Fix the py_byte_compile macro to work on Python 2
  - Remove the pybytecompile macro file from the flat package
  Resolves: rhbz#1484993


author: Tomas Orsava <torsava@redhat.com> - 3.6.5-3
changelog:
  - Platform-Python: Rebase implementation from RHEL8 Alpha:
  - Move the main executable to /usr/libexec/platform-python
  - Move /usr/bin/python*-config and /usr/bin/pythonX.Ym scripts to /usr/libexec/
  - Provide symlink to the main executable and other scripts from /usr/bin/,
    these will be later shipped only in the python36 module


author: Tomas Orsava <torsava@redhat.com> - 3.6.5-7
changelog:
  - Fix %py_byte_compile macro: when invoked with a Python 2 binary it also
    mistakenly ran py3_byte_compile


author: Tomas Orsava <torsava@redhat.com> - 3.6.6-4
changelog:
  - Create the `libs-devel` subpackage and move `devel` contents there
  - `devel` subpackage is only for the buildroot and requires `python36-devel`
    to get /usr/bin/python3{,-config} symlinks there
  - `devel` subpackage will not be shipped into RHEL8, only `libs-devel` will
  - `debug` subpackage now runtime requires `libs-devel` instead of `devel`


author: Petr Viktorin <pviktori@redhat.com> - 3.6.6-5
changelog:
  - Fix the `devel` subpackage to require python3, rather than python36-devel,
    and provide /usr/bin/python3-config itself.


author: Petr Viktorin <pviktori@redhat.com> - 3.6.6-6
changelog:
  - Make `devel` subpackage require python36-devel again
    (and get /usr/bin/python3 and /usr/bin/python3-config from that).
  - Remove /usr/bin/python3* executables
  - Use pip36 instead of `pip3`


author: Tomas Orsava <torsava@redhat.com> - 3.6.6-9
changelog:
  - Rename the python3 subpackage to platform-python
  - Provide the `python3` name for backwards compatibility until it's taken over
    by the python36 component
  - The python36 component that contains /usr/bin/python3 will Provide the
    name `python3` in its upcoming update
  - Resolves: rhbz#1619153


author: Tomas Orsava <torsava@redhat.com> - 3.6.6-11
changelog:
  - Implement `alternatives` for chosing /usr/bin/python
  - Provide the default `no-python` alternative
  - Resolves: rhbz#1632625


author: Tomas Orsava <torsava@redhat.com> - 3.6.6-12
changelog:
  - Rename the python3-debug subpackage to platform-python-debug
  - Provide the `python3-debug` name for backwards compatibility until it's taken
    over by the python36 component
  - Rename the python3-libs-devel subpackage to platform-python-devel for
    symmetry with the `platform-python` and `platform-python-debug` package
  - Add symlink /usr/libexec/platform-python-debug that was mistakenly omitted
  - Related: rhbz#1619153


author: Tomas Orsava <torsava@redhat.com> - 3.6.6-13
changelog:
  - Stop providing the `python3` and `python3-debug` names from the
    platform-python/-debug subpackages
  - The `python3` and `python3-debug` names are now provided from the python36
    component
  - Conflict with older versions of `python3` and `python3-debug`
  - Related: rhbz#1619153


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.7-1
changelog:
  - Update to 3.6.7 (rhbz#1627739)
  - Re-enable test_gdb (rhbz#1639536)
  - Re-enable test_faulthandler (rhbz#1640147)


author: Tomas Orsava <torsava@redhat.com> - 3.6.7-2
changelog:
  - Switch to requiring platform-python-pip/setuptools instead of the python3-
    versions
  - Resolves: rhbz#1638836


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-7
changelog:
  - Disallow control chars in http URLs
  - Fixes CVE-2019-9740 and CVE-2019-9947
  Resolves: rhbz#1704365 and rhbz#1703531


author: Miro Hrončok <mhroncok@redhat.com> - 3.6.8-9
changelog:
  - Reduced default build flags used to build extension modules
    https://fedoraproject.org/wiki/Changes/Python_Extension_Flags
  Resolves: rhbz#1634784


author: Miro Hrončok <mhroncok@redhat.com> - 3.6.8-12
changelog:
  - Use RPM built wheels of pip and setuptools in ensurepip instead of our rewheel patch
  - Require platform-python-setuptools from platform-python-devel to prevent packaging errors
  Resolves: rhbz#1701286


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-13
changelog:
  - Do not set PHA verify flag on client side (rhbz#1725721)
  - Enable TLS 1.3 post-handshake authentication in http.client (rhbz#1671353)


author: Tomas Orsava <torsava@redhat.com> - 3.6.8-14
changelog:
  - Adding a new patch 329 that adds support for OpenSSL FIPS mode
  - Explicitly listing man pages in files section to fix an RPM warning
  Resolves: rhbz#1731424


author: Tomas Orsava <torsava@redhat.com> - 3.6.8-15
changelog:
  - Patch 329 that adds support for OpenSSL FIPS mode has been improved and
    bugfixed
  Resolves: rhbz#1744670 rhbz#1745499 rhbz#1745685


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-16
changelog:
  - Properly pass the -Og optimization flag to the debug build
  Resolves: rhbz#1712977 and rhbz#1714733


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-18
changelog:
  - Reduce the number of tests running during the profile guided optimizations build
  - Enable profile guided optimizations for all the supported architectures
  Resolves: rhbz#1749576


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-19
changelog:
  - Skip windows specific test_get_exe_bytes test case and enable test_distutils
  Resolves: rhbz#1754040


author: Tomas Orsava <torsava@redhat.com> - 3.6.8-21
changelog:
  - Patch 329 (FIPS) modified: Added workaround for mod_ssl:
    Skip error checking in _Py_hashlib_fips_error
  Resolves: rhbz#1760106


author: Tomas Orsava <torsava@redhat.com> - 3.6.8-22
changelog:
  - Changed Requires into Recommends for python3-pip to allow a lower RHEL8
    footprint for containers and other minimal environments
  Resolves: rhbz#1756217


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-23
changelog:
  - Modify the test suite to better handle disabled SSL/TLS versions and FIPS mode
  - Use OpenSSL's DRBG and disable os.getrandom() function in FIPS mode
  Resolves: rhbz#1754028, rhbz#1754027, rhbz#1754026, rhbz#1774471


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-24
changelog:
  - Build Python with -fno-semantic-interposition for better performance
  - https://fedoraproject.org/wiki/Changes/PythonNoSemanticInterpositionSpeedup
  - Also fix test_gdb failures with Link Time Optimizations
  Resolves: rhbz#1724996


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-26
changelog:
  - Skip test_startup_imports from test_site if we have a .pth file in sys.path
  Resolves: rhbz#1814392


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-27
changelog:
  - Add a sentinel value on the Hmac_members table of the fips compliant hmac module
  Resolves: rhbz#1800512


author: Victor Stinner <vstinner@python.org> - 3.6.8-30
changelog:
  - Remove downstream 00178-dont-duplicate-flags-in-sysconfig.patch which
    introduced a bug on distutils.sysconfig.get_config_var('LIBPL')
    (rhbz#1851090).


author: Tomas Orsava <torsava@redhat.com> - 3.6.8-31
changelog:
  - Avoid infinite loop when reading specially crafted TAR files (CVE-2019-20907)
  Resolves: rhbz#1856481
  - Resolve hash collisions for Pv4Interface and IPv6Interface (CVE-2020-14422)
  Resolves: rhbz#1854926


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-32
changelog:
  - Security fix for CVE-2020-26116: Reject control chars in HTTP method in http.client
  Resolves: rhbz#1883257


author: Lumír Balhar <lbalhar@redhat.com> - 3.6.8-33
changelog:
  - Add support for upstream architecture names
  https://fedoraproject.org/wiki/Changes/Python_Upstream_Architecture_Names
  Resolves: rhbz#1868003


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-34
changelog:
  - Security fix for CVE-2020-27619: eval() call on content received via HTTP in the CJK codec tests
  Resolves: rhbz#1890237


author: Victor Stinner <vstinner@redhat.com> - 3.6.8-39
changelog:
  - Fix reentrant call to threading.enumerate() (rhbz#1959459)
  - Don't exit Python with abort() when a thread exit and there is no available
    file descriptor to load dynamically the libgcc_s.so.1 library (rhbz#1972293)


author: Lumír Balhar <lbalhar@redhat.com> - 3.6.8-41
changelog:
  - Security fix for CVE-2021-3733: Denial of service when identifying crafted invalid RFCs
  Resolves: rhbz#1995234


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-43
changelog:
  - Change shouldRollover() methods of logging.handlers to only rollover regular files
  Resolves: rhbz#2009200


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-44
changelog:
  - Use the monotonic clock for theading.Condition
  - Use the monotonic clock for the global interpreter lock
  Resolves: rhbz#2003758


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-45
changelog:
  - Security fix for CVE-2021-4189: ftplib should not use the host from the PASV response
  Resolves: rhbz#2036020


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-46
changelog:
  - Security fix for CVE-2022-0391: urlparse does not sanitize URLs containing ASCII newline and tabs
  - Fix the test suite support for Expat >= 2.4.5
  Resolves: rhbz#2047376, rhbz#2060435


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-50
changelog:
  - Security fix for CVE-2022-45061
  - Strip the LTO bytecode from python.o
  Resolves: rhbz#2144072, rhbz#2137707


author: Lumír Balhar <lbalhar@redhat.com> - 3.6.8-70
changelog:
  - Security fixes for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138, CVE-2024-12718, CVE-2025-4435
  Resolves: RHEL-98030, RHEL-97987, RHEL-98232, RHEL-98065, RHEL-98189


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.10.0-3
changelog:
  - Python 2 binary package renamed to python2-pywbem
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Tony Asleson <tasleson@redhat.com> - 0.11.0-8
changelog:
  - Fix the conflict with sblim-wbemcli: RHBZ #1757855
  - Corrected warning about multiple file inclusion


author: Aristeu Rozanski <aris@redhat.com> 0.6.1-9
changelog:
  - Prevent ras-mc-ctl trying to access extlog and mce tables if rasdaemon was built without support for them [2011404]


author: Honggang Li <honli@redhat.com> - 37.1-1
changelog:
  - Update to upstream v37.1 release for features and fixes
  - Resolves: bz1982200, bz1990120, bz1982131


author: Kamal Heib <kheib@redhat.com> - 46.0-1
changelog:
  - Rebase to upstream release v46.0
  - Resolves: rhbz#2170066, rhbz#2209685, rhbz#2159635, rhbz#2167517


author: Sumit Bose <sbose@redhat.com> - 0.16.3-19
changelog:
  - Realm join fails with error 'Failed to join domain: failed to lookup
    DC info ...'
    Resolves: rhbz#1859503
  - realm command to use option like dnshostname=fqdn
    Resolves: rhbz#1867912


author: Sumit Bose <sbose@redhat.com> - 0.16.3-20
changelog:
  - realmd should handle default_realm in krb5.conf
    Resolves: rhbz#1791016
  - [RFE] Enable LDAPS functionality in realmd join
    Resolves: rhbz#1826964


author: Sumit Bose <sbose@redhat.com> - 0.16.3-24
changelog:
  - Avoid duplicated log messages and use Samba's new CLI options
    Resolves: rhbz#2024248
    Resolves: rhbz#2028528


author: Sumit Bose <sbose@redhat.com> - 0.17.1-2
changelog:
  - Use make macros https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
  - migrated to SPDX license
  - allow multiple names and _srv_ ad_server option
    Resolves: RHEL-12113
  - fix ccache handling for leave operation
    Resolves: RHEL-26166


author: Vladis Dronov <vdronov@redhat.com> - 6.8-4
changelog:
  - There is no need to hardcode _sbindir anymore, also the old value is
    incorrect
  - Update the rngd.service file
  - Fix a busyloop bug (bz 1956248)
  - Fix /dev/hwrng permission issue (bz 1955522)


author: Vladis Dronov <vdronov@redhat.com> - 6.8-6
changelog:
  - Adjust rngd-wake-threshold.service and post section so udevadm is not
    run in a container (bz 1975554)


author: Vladis Dronov <vdronov@redhat.com> - 6.13-1.git.d207e0b6
changelog:
  - Update to the upstream v6.13 + tip of origin/master + onecpu
    branch + revert of 2ce93190
  - Rebuild rng-tools against the latest jitterentropy library
    3.0.2-2.git.409828cf with fixes for an important issue
  - Fix a number of issues (bz 1974103, bz 1980421, bz 1859154)


author: Vladis Dronov <vdronov@redhat.com> - 6.14-4.git.b2b7934e
changelog:
  - Update rng-tools to v6.14 @ b2b7934e (bz 2015570)
  - Update jitterentropy library to v3.3.1 @ 887c9871
  - Add a config file for storing rngd options
  - Fix a security issue found by a covscan in jitterentropy library


author: Vladis Dronov <vdronov@redhat.com> - 6.15-1
changelog:
  - Update rng-tools to v6.15 @ 172bf0e3 (bz 2075974)
  - Update jitterentropy library to v3.4.0 @ 887c9871
  - Allow rngd process to drop privileges with "-D user:group"
  - Fix an error building with jitterentropy-3.4.0
  - Add a requirement for selinux-policy of a certain version
  - Fix a build failure on ppc64
  - Small edits in test scripts


author: Vladis Dronov <vdronov@redhat.com> - 6.15-2
changelog:
  - Update rng-tools to v6.15 @ 6dcc9ec2 (bz 2124602)
  - Update jitterentropy library to v3.4.1 @ 4544e113
  - Do not require selinux-policy if it is not present


author: Vladis Dronov <vdronov@redhat.com> - 6.15-3
changelog:
  - Update rng-tools to v6.15 @ cb8cc624 (bz 2141379)
  - Update jitterentropy library to v3.4.1 @ 7bf9f85d
  - Fix a stack corruption on s390x
  - Fix a number of issues found by covscan code scanner
  - Add a jitter init timeout for tests
  - Add a start condition for the FIPS mode (bz 2154804)


author: Vladis Dronov <vdronov@redhat.com> - 6.16-1
changelog:
  - Update rng-tools to v6.16 @ 0e560296 (bz 2174908)
  - Get rid of text relocations in -fPIE build
  - Add a hint for opensc package (bz 1845854)


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-20
changelog:
  - Add --path query option (#1940895)
  - Macroize find-debuginfo script location (#2019540)
  - Validate and require subkey binding sigs on PGP pubkeys (#1958480)
  - Fixes CVE-2021-3521


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-22
changelog:
  - Fix spurious %transfiletriggerpostun execution (#2023693)
  - Skip recorded symlinks in --setperms (#1900662)


author: Florian Festi <ffesti@redhat.com> - 4.14.3-31
changelog:
  - Backport file handling code from rpm-4.19 to fix CVE-2021-35937,
    CVE-2021-35938 and CVE-2021-35939


author: Panu Matilainen <pmatilai@redhat.com>
changelog:
  - adjust for rpmdb index name change
  - drop unnecessary vendor-macro patch for real
  - add ISA-dependencies among rpm subpackages
  - make lzma and sqlite deps conditional and disabled by default for now


author: Panu Matilainen <pmatilai@redhat.com>
changelog:
  - rpm 4.5.90-0.git8424.1 (alpha snapshot)
  - adjust to build against Berkeley DB 4.5.20 from compat-db for now
  - add posttrans to clean up db environment mismatch after upgrade
  - forward-port devel autodeps patch


author: Panu Matilainen <pmatilai@redhat.com>
changelog:
  - 4.5.90-0.git8426.5
  - flip back to external bdb
  - fix tab vs spaces complaints from rpmlint
  - add dep for lzma and require unzip instead of zip in build (#310694)
  - add pkgconfig dependency to rpm-devel
  - drop ISA-dependencies for initial introduction
  - new snapshot from upstream for documentation fixes


author: Florian Festi <ffesti@redhat.com>
changelog:
  - 4.5.90-0.git8426.10
  - rpm-4.5.90-posttrans.patch
  - use header from rpmdb in posttrans to make anaconda happy


author: Panu Matilainen <pmatilai@redhat.com>
changelog:
  - 4.5.90-0.git8461.1
  - new snapshot from upstream
  - fixes #68290, #455972, #446202, #453364, #456708, #456103, #456321, #456913,
    - partial fix for #457360


author: Jindrich Novy <jnovy@redhat.com>
changelog:
  - add support for noarch subpackages
  - fix segfault in case of insufficient disk space detected (#460146)


author: Jindrich Novy <jnovy@redhat.com>
changelog:
  - fix parsing of boolean expressions in spec (#456103)
    (unbreaks pam, jpilot and maybe other builds)


author: Jindrich Novy <jnovy@redhat.com>
changelog:
  - create directory structure for rpmbuild prior to build if it doesn't exist (#455387)
  - create _topdir if it doesn't exist when installing SRPM
  - don't generate broken cpio in case of hardlink pointing on softlink,
    thanks to pixel@mandriva.com


author: Panu Matilainen <pmatilai@redhat.com>
changelog:
  - add hack to support extracting gstreamer plugin provides (#438225)
  - fix another macro argument handling regression (#461180)


author: Panu Matilainen <pmatilai@redhat.com>
changelog:
  - update to official 4.5.90 alpha tarball 
  - a big pile of misc bugfixes + translation updates
  - isa-macro generation fix for ppc (#464754)
  - avoid pulling in pile of perl dependencies for an unused script
  - handle both "invalid argument" and clear env version mismatch on posttrans


author: Panu Matilainen <pmatilai@redhat.com>
changelog:
  - update to 4.6.0-rc1 
  - fixes #465586, #466597, #465409, #216221, #466503, #466009, #463447...
  - avoid using %configure macro for now, it has unwanted side-effects on rpm


author: Panu Matilainen <pmatilai@redhat.com>
changelog:
  - Make noarch sub-packages actually work
  - Fix defaultdocdir logic in installplatform to avoid hardwiring mandir


author: Panu Matilainen <pmatilai@redhat.com>
changelog:
  - update to 4.6.0-rc2
  - fixes #471820, #473167, #469355, #468319, #472507, #247374, #426672, #444661
  - enable automatic generation of pkg-config and libtool dependencies #465377


author: Panu Matilainen <pmatilai@redhat.com> - 4.6.0-0.rc4.2
changelog:
  - change platform sharedstatedir to something more sensible (#185862)
  - add rpmdb_foo links to db utils for documentation compatibility


author: Panu Matilainen <pmatilai@redhat.com> - 4.6.0-0.rc4.3
changelog:
  - extract mimehandler provides from .desktop files
  - preliminaries for extracting font provides (not enabled yet)
  - dont classify font metrics data as fonts
  - only run script dep extraction once per file, duh


author: Panu Matilainen <pmatilai@redhat.com> - 4.6.0-1
changelog:
  - update to 4.6.0 final
  - revert libmagic looking into compressed files for now, breaks ooffice build


author: Jindrich Novy <jnovy@redhat.com> - 4.6.0-4
changelog:
  - inherit group tag from the main package (#470714)
  - ignore BuildArch tags for anyarch actions (#442105)
  - don't check package BuildRequires when doing --rmsource (#452477)
  - don't fail because of missing sources when only spec removal
    is requested (#472427)


author: Jindrich Novy <jnovy@redhat.com> - 4.6.0-5
changelog:
  - remove two offending hunks from anyarch patch causing that
    RPMTAG_BUILDARCHS isn't written to SRPMs


author: Panu Matilainen <pmatilai@redhat.com> - 4.6.0-7
changelog:
  - loosen up restrictions on dependency names (#455119)
  - handle inter-dependent pkg-config files for requires too (#473814)
  - error/warn on elf binaries in noarch package in build


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.0-0.beta1.9
changelog:
  - fix recorded file state of otherwise skipped files (#492947)
  - compress ChangeLog, drop old CHANGES file (#492440)


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.0-1
changelog:
  - update to 4.7.0 final (http://rpm.org/wiki/Releases/4.7.0)
  - fixes #494049, #495429
  - dont permit test-suite failure anymore


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.0-2
changelog:
  - file classification tweaks for text files (#494817)
    - disable libmagic text token checks, it's way too error-prone
    - consistently classify all text as such and include description


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.0-3
changelog:
  - couple of merge-review fixes (#226377)
    - eliminate bogus leftover rpm:rpm rpmdb ownership
    - unescaped macro in changelog
  - fix find-lang --with-kde with KDE3 (#466009)
  - switch back to default file digest algorithm


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.0-4
changelog:
  - split cron-job into a sub-package to avoid silly deps on core rpm (#500722)
  - rpm requires coreutils but not in %post
  - build with libcap and libacl
  - fix pgp pubkey signature tag parsing


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.0-5
changelog:
  - don't mess up problem altNEVR in python ts.check() (#501068)
  - fix hardlink size calculation on build (#503020)


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.0-8
changelog:
  - updated OSGi dependency extractor (#506471)
  - fix segfault in symlink fingerprinting (#505777)
  - fix invalid memory access causing bogus file dependency errors (#506323)


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.1-5
changelog:
  - fix duplicate dependency filtering on build (#490378)
  - permit absolute paths in file lists again (#521760)
  - use permissions 444 for all .debug files (#522194)
  - add support for optional bugurl tag (#512774)


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.1-6
changelog:
  - use relative paths within db environment (related to #507309, #507309...)
  - remove db environment on close in chrooted operation (related to above)
  - initialize rpmlib earlier in rpm2cpio (#523260)
  - fix file dependency tag extension formatting (#523282)


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.1-7
changelog:
  - fix build with BDB 4.8.x by removing XA "support" from BDB backend 
  - perl dep extractor heredoc parsing improvements (#524929)


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.1-8
changelog:
  - support multiple python implementations in brp-python-bytecompile (#531117)
  - make disk space problem reporting a bit saner (#517418)


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.2-2
changelog:
  - missing error exit code from signing password checking (#496754)
  - dont fail build on unrecognized data files (#532489)
  - dont try to parse subkeys and secret keys (#436812)
  - fix chmod test on selinux, breaking %{_fixperms} macro (#543035)


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-0.beta1.1
changelog:
  - update to 4.8.0-beta1 (http://rpm.org/wiki/Releases/4.8.0)
  - rpm-build conflicts with current ocaml-runtime


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-0.beta1.2
changelog:
  - fix noise from python bytecompile on non-python packages (#539635)
  - make all our -devel [build]requires isa-specific
  - trim out superfluous -devel dependencies from rpm-devel


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-3
changelog:
  - fix segfault on failed url retrieval
  - fix verification error code depending on verbosity level
  - if anything in testsuite fails, dump out the log


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-8
changelog:
  - more fixes to postscript provides extractor (#562228)
  - avoid accessing unrelated mount points in disk space checking (#547548)
  - fix disk space checking with erasures present in transaction (#561160)


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-11
changelog:
  - support single PPD providing driver for devices (#568351)
  - merge the psdriver patch pile into one
  - preserve empty lines in spec prep section (#573339)
  - teach python bindings about RPMTRANS_FLAG_NOCONTEXTS (related to #573111)
  - dont own localized man directories through find_lang (#569536)


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-15
changelog:
  - handle non-existent dependency sets correctly in python (#593553)
  - make find-lang look in all locale dirs (#584866)


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-16
changelog:
  - adjust to new pkg-config behavior wrt private dependencies (#596433)
  - rpm-build now requires pkgconfig >= 0.24


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.1-1
changelog:
  - update to 4.8.1 (http://rpm.org/wiki/Releases/4.8.1)
  - drop no longer needed patches
  - fix source url pointing to testing directory


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.1-2
changelog:
  - fix a potential getOutputFrom() error from font provide extraction
  - debug-friendlier message to aid finding other similar cases (#565223)


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.1-5
changelog:
  - create gdb index on debuginfo generation (#617166)
  - rpm-build now requires /usr/bin/gdb-add-index for consistent index creation
  - include COPYING in -apidocs for licensing guidelines compliance


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.1-7
changelog:
  - bunch of spec tweaks, cleanups + corrections:
    - shorten rpm-build filelist a bit with glob use, reorder for saner grouping
    - missing isa in popt version dependency
    - only add rpmdb_foo symlinks for actually relevant db_* utils
    - drop no longer necessary file-devel dependency from rpm-devel
    - drop sqlite backend build-conditional
    - preliminaries for moving from db4 to libdb
  - use gnupg2 for signing as that's more likely to be installed by default


author: Panu Matilainen <pmatilai@redhat.com> - 4.9.0-0.beta1.1
changelog:
  - rpm 4.9.0-beta1 (http://rpm.org/wiki/Releases/4.9.0)
    - drop no longer needed patches
    - adjust requires + buildrequires to match current needs
    - adjust rpmdb index ghosts to match the new release
    - split librpmbuild and librpmsign to a separate rpm-build-libs package
    - split rpmsign to its own package to allow signing without all the build goo
    - build-conditionalize plugins, disabled for now
    - gstreamer and printer dependency generation moving out
    - handle .so symlink dependencies with fileattrs
    - use gnupg2 for signing as that's what typically installed by default


author: Panu Matilainen <pmatilai@redhat.com> - 4.9.0-0.beta1.3
changelog:
  - avoid division by zero in rpmdb size calculation (#671056)
  - fix secondary index iteration returing duplicate at end (#671149)
  - fix rebuilddb creating duplicate indexes for first header


author: Panu Matilainen <pmatilai@redhat.com> - 4.9.0-0.beta1.5
changelog:
  - dont try to remove environment files if private env used (related to #671200)
  - unbreak mono dependency extraction (#673663)
  - complain instead of silent abort if cwd is not readable (#672576)


author: Panu Matilainen <pmatilai@redhat.com> - 4.9.0-0.rc1.1
changelog:
  - update to 4.9.0-rc1
  - drop upstream patches
  - nss packaging has changed, buildrequire nss-softokn-freebl-devel


author: Panu Matilainen <pmatilai@redhat.com> - 4.9.0-0.rc1.4
changelog:
  - spec cosmetics clean up extra whitespace + group more logically
  - wipe out BDB environment at boot via tmpfiles.d


author: Panu Matilainen <pmatilai@redhat.com> - 4.9.0-5
changelog:
  - verify some properties of replaced and wrong-colored files (#528383)
  - only list packages that would be generated on spec query (#693338)
  - preferred color packages should be erased last (#680261)
  - fix leaks when freeing a populated transaction set
  - take file state into account for file dependencies


author: Panu Matilainen <pmatilai@redhat.com> - 4.9.0-8
changelog:
  - add dwarf-4 support to debugedit (#707677)
  - generate build-id symlinks for all filenames sharing a build-id (#641377)


author: Panu Matilainen <pmatilai@redhat.com> - 4.9.0-9
changelog:
  - fix crash if prep or changelog section in spec is empty (#706959)
  - fix crash on macro which undefines itself
  - fix script dependency generation with file 5.07 string changes (#712251)


author: Panu Matilainen <pmatilai@redhat.com> - 4.9.1.2-3
changelog:
  - adjust db util prefix & dependency due to #749293
  - warn but dont fail the build if STABS encountered by debugedit (#725378)


author: Kay Sievers <kay@redhat.com> - 4.9.1.2-8
changelog:
  - add temporary rpmlib patch to support filesystem transition
    https://fedoraproject.org/wiki/Features/UsrMove


author: Panu Matilainen <pmatilai@redhat.com> - 4.9.1.2-13
changelog:
  - fix memory corruption on rpmdb size estimation (#766260)
  - fix couple of memleaks in python bindings (#782147)
  - fix regression in verify output formatting (#797964)
  - dont process spec include in false branch of if (#782970)
  - only warn on missing excluded files on build (#745629)
  - dont free up file info sets on test transactions


author: Panu Matilainen <pmatilai@redhat.com> - 4.9.90-0.git11505.5
changelog:
  - add temporary fake library provides to get around deltarpm "bootstrap"
    dependency (yes its dirty)


author: Panu Matilainen <pmatilai@redhat.com> - 4.9.90-0.git11519.1
changelog:
  - newer git snapshot to keep patch-count down
  - fixes CVE-2012-0060, CVE-2012-0061 and CVE-2012-0815
  - fix obsoletes in installing set getting matched on provides (#810077)


author: Panu Matilainen <pmatilai@redhat.com> - 4.9.90-0.git11536.1
changelog:
  - newer git snapshot (#809402, #808750)
  - adjust posttrans script wrt bdb string change (#803866, #805613)


author: Panu Matilainen <pmatilai@redhat.com> - 4.10.90-0.git11989.1
changelog:
  - update to 4.11 (http://rpm.org/wiki/Releases/4.11.0) post-alpha snapshot
  - drop/adjust patches as necessary


author: Panu Matilainen <pmatilai@redhat.com> - 4.10.90-0.git11989.3
changelog:
  - package /usr/lib/rpm/macros.d directory (related to #846679)
  - fixup a bunch of old incorrect dates in spec changelog


author: Panu Matilainen <pmatilai@redhat.com> - 4.11.0-0.beta1.2
changelog:
  - armv7hl and armv7hnl should not have -mthumb (#901901)
  - fix duplicate directory ownership between rpm and rpm-build (#894201)
  - fix regression on paths shared between a real file/dir and a ghost


author: Panu Matilainen <pmatilai@redhat.com> - 4.11.1-7
changelog:
  - fix build-time double-free on file capability processing (#956190)
  - fix relocation related regression on file sanity check (#1001553)
  - fix segfault on empty -p <lua> scriptlet body (#1004062)
  - fix source url, once again


author: Panu Matilainen <pmatilai@redhat.com> - 4.11.1-11
changelog:
  - generate kmod(module.ko) provides for kernel (#1025513)
  - dont override CONFIG_SITE if already set (related to #962837)


author: Panu Matilainen <pmatilai@redhat.com> - 4.11.2-0.rc1.1
changelog:
  - update to 4.11.2-rc1 (http://rpm.org/wiki/Releases/4.11.2)
  - drop upstreamed patches, adjust others as needed
  - handle python egg-info's version munging in file lists


author: Panu Matilainen <pmatilai@redhat.com> - 4.11.2-3
changelog:
  - dont eat newlines on parametrized macro invocations (#1045723)
  - fully reset file actions between rpmtsRun() calls (#1076552)
  - fix build and sign module initialization in python3 (#1064758)


author: Panu Matilainen <pmatilai@redhat.com> - 4.11.2-6
changelog:
  - build with -fsanitize=address and -fsanitize=undefined for now
  - add spec build conditional for sanitizer build


author: Tom Callaway <spot@fedoraproject.org> - 4.11.2-10
changelog:
  - remove _isa from all BuildRequires (bz 554854)
    See: https://fedoraproject.org/wiki/Packaging:Guidelines#BuildRequires_and_.25.7B_isa.7D


author: Panu Matilainen <pmatilai@redhat.com> - 4.11.90-0.git12844.1
changelog:
  - Update to rpm 4.12-alpha ((http://rpm.org/wiki/Releases/4.12.0)
  - Drop/adjust patches as appropriate
  - New sub-package(s) for plugins


author: Panu Matilainen <pmatilai@redhat.com> - 4.12.0-0.beta1.1
changelog:
  - Update to 4.12.0-beta1 (http://rpm.org/wiki/Releases/4.12.0)
  - Fixes #1122004, #1111349, #1117912, #1123722
  - Drop upstreamed patches


author: Panu Matilainen <pmatilai@redhat.com> - 4.12.0.1-1
changelog:
  - Update to rpm-4.12.0.1 final (http://rpm.org/wiki/Releases/4.12.0.1)
  - Temporary workaround payload size mismatch issue in rpm2cpio (#1142949)


author: Panu Matilainen <pmatilai@redhat.com> - 4.12.0.1-3
changelog:
  - Skip ghost files in payload (#1156497)
  - Fix size and archice size tag generation on big-endian systems


author: Lubos Kardos <lkardos@redhat.com> - 4.12.0.1-5
changelog:
  - Add check against malicious CPIO file name size (#1168715)
  - Fixes CVE-2014-8118
  - Fix race condidition where unchecked data is exposed in the file system
    (#1039811)
  - Fixes CVE-2013-6435


author: Lubos Kardos <lkardos@redhat.com> 4.12.0-11
changelog:
  - Pass _find_debuginfo_opts -g to eu-strip for executables (#1186563)
  - add_minidebug is not ran when strip_g is set (#1186563)


author: Lubos Kardos <lkardos@redhat.com> - 4.12.90-5
changelog:
  - If globbing of a filename fails, try use the filename without globbing.
    (#1246743)
  - Modify rpmIsGlob() to be more precise and compatible with glob().
    (#1246743)


author: Lubos Kardos <lkardos@redhat.com> - 4.13-0.rc1.6
changelog:
  - If %_wrong_version_format_terminate_build is 1 then terminate build in case
    that version format is wrong i. e. epoch is not unsigned integer or version
    contains more separators (":", "-"). %_wrong_version_format_terminate_build
    is 1 by deafault (#1265700)


author: Lubos Kardos <lkardos@redhat.com> - 4.13-0.rc1.7
changelog:
  - Fix reading a memory right after the end of an allocated area (#1260248)
  - Add support for various types of dependencies to rpmdeps tool (#1247092)
  - fix %autopatch when patch do not exist (#1244172)


author: Lubos Kardos <lkardos@rpm.org> - 4.13.0-0.rc1.13
changelog:
  - Add possibility to disable file triggers
  - Fix unwanted multiple execution of filetriggers in dnf (#1282115)


author: Lubos Kardos <lkardos@redhat.com> - 4.13.0-0.rc1.20
changelog:
  - Revert using %configure, it causes problems
  - Temporary set %_gnu macro explictly, just for one build (#1303265)


author: Florian Festi <ffesti@rpm.org> - 4.13.0-0.rc1.24
changelog:
  - Also block idle and sleep in the systemd-inhibit plugin (#1297984)
  - Add support for MIPS release 6
  - Add mips32 mips64 mipsel and mipseb macros (#1285116)


author: Lubos Kardos <lkardos@redhat.com> 4.13.0-0.rc1.31
changelog:
  - Enable --no-backup-if-mismatch by default in %patch macro (#884755)
  - Add %{_default_patch_flags} to %__patch which is used in %autosetup
  - Use fuzz settings for %autopatch/%autosetup


author: Lubos Kardos <lkardos@redhat.com> 4.13.0-0.rc1.33
changelog:
  - Fix sigsegv in stringFormat() (#1316903)
  - Fix reading rpmtd behind its size in formatValue() (#1316896)


author: Igor Gnatenko <ignatenko@redhat.com> - 4.13.0-0.rc1.41
changelog:
  - Add %{?system_python_abi}
  - rpm-python -> python2-rpm && rpm-python3 -> python3-rpm with providing old names
  - Fixes and cleanups


author: Thierry Vignaud <tvignaud@redhat.com> - 4.13.0-2
changelog:
  - Fix package name references in python sub-packages to match reality
  - Re-enable test-suite now that it works again


author: Panu Matilainen <pmatilai@redhat.com> - 4.13.0-11
changelog:
  - Fix malformed packages being generated around 4GB boundary (#1405570)
  - Resurrect debuginfo GDB index generation (#1410907)


author: Mark Wielaard <mjw@redhat.com> - 4.13.0.1-13
changelog:
  - Add tests fix for sed file build-id regexp matching.
  - Add fix for build-ids in non-executable ELF files (#1433837).


author: Panu Matilainen <pmatilai@redhat.com> - 4.13.0.1-17
changelog:
  - Work around missing python[23] during build dependency parse
  - Include ISA in the new python library version dependencies too


author: Mark Wielaard <mjw@fedoraproject.org> - 4.13.0.1-19
changelog:
  - Minisymtab should only be added for executables or shared libraries.
  - Add find-debuginfo.sh -n (debugedit --no-recompute-build-id) option.


author: Mark Wielaard <mjw@fedoraproject.org> - 4.13.0.1-25
changelog:
  - Add support for debugsource and debuginfo subpackages
    - find-debuginfo-untangle-unique-build-options.patch
    - debugsrc-and-sub-debuginfo-packages.patch


author: Mark Wielaard <mjw@fedoraproject.org> - 4.13.0.1-28
changelog:
  - Add debugedit-prefix.patch.
  - Add find-debuginfo-filter-built-ins.patch.
  - Add find-debuginfo-dwz-multi.patch.
  - Add find-debuginfo-and-macro-docs.patch.


author: Mark Wielaard <mjw@fedoraproject.org> - 4.13.0.1-29
changelog:
  - Track patches using https://pagure.io/rpm-fedora
  - Use file list to explicitly set mode for build-id dirs/files
    (#1452893, #1458839)


author: Miro Hrončok <mhroncok@redhat.com> - 4.13.90-0.git14000.4
changelog:
  - Add platform-python bytecompilation patch: platform-python-bytecompile.patch
  - Add platform python deps generator patch: platform-python-abi.patch
  - Add a platform-python subpackage and remove system python related declarations
  - Build rpm without platform_python for bytecompilation
    (https://fedoraproject.org/wiki/Changes/Platform_Python_Stack)


author: Panu Matilainen <pmatilai@redhat.com> - 4.14.0-0.rc1.1
changelog:
  - Rebase to rpm 4.14.0-rc1 (http://rpm.org/wiki/Releases/4.14.0)
  - Re-enable SHA256 header digest generation (see #1480407)


author: Panu Matilainen <pmatilai@redhat.com> - 4.14.0-0.rc1.2
changelog:
  - Actually honor with/without libimaevm option
  - ima-evm-utils-devel >= 1.0 is required for rpm >= 4.14.0


author: Tomas Orsava <torsava@redhat.com> - 4.14.1-5
changelog:
  - Add envvar that will be present during RPM build,
    Part of a Fedora Change for F28: "Avoid /usr/bin/python in RPM build"
    https://fedoraproject.org/wiki/Changes/Avoid_usr_bin_python_in_RPM_Build


author: Panu Matilainen <pmatilai@redhat.com> - 4.14.1-6
changelog:
  - Avoid unnecessary macro helper dependency on /usr/bin/python (#1538657)
  - Fix release of previous changelog entry


author: Panu Matilainen <pmatilai@redhat.com> - 4.14.2-0.rc2.1
changelog:
  - Update to rpm 4.14.2-rc2
  - Fixes a regression in rpmlog error handling (#1597274)
  - Fixes several resource leaks found by covscan (#1602681)
  - Fixes DISTTAG not getting copied to source rpms (#1596193)


author: Panu Matilainen <pmatilai@redhat.com> - 4.14.2-1
changelog:
  - Buildrequire audit-libs-devel to actually enable the feature (#1607612)
  - Update to rpm 4.14.2 final (http://rpm.org/wiki/Releases/4.14.2)


author: Panu Matilainen <pmatilai@redhat.com> - 4.14.2-7
changelog:
  - Move python-macro-helper to main package where the macros are (#1651926)
  - Document --noverify in the man page (#1646458)
  - Handle unsupported digests the same as disabled ones (#1652529)


author: Panu Matilainen <pmatilai@redhat.com> - 4.14.2-11
changelog:
  - Revised patch for Py3 string data as surrogate-escaped utf-8 (#1631292)
  - Add a .decode() method to returned Py3 strings for compatibility


author: Panu Matilainen <pmatilai@redhat.com> - 4.14.2-14
changelog:
  - Verify packages before signing (#1646388)
  - Make rpmsign exist values more consistent with our other tools


author: Florian Festi <ffesti@redhat.com> - 4.14.2-16
changelog:
  - Sort list of hard linked files in find-debuginfo.sh (#1421272)
  - Correct rpm -ql exit value when optional -p is omitted (#1680610)
  - Show list of files only once when use rpm -ql and multiple rpm files (#1689898)


author: Florian Festi <ffesti@redhat.com> - 4.14.2-23
changelog:
  - Use --dpbath only with full path (#1696408)
  - Fix memory leaks (#1714657)
  - Remove capabilities instead of setting empty caps via. --setcaps (#1700920)
  - Fix bash warning from solution for #1689810


author: Panu Matilainen <pmatilai@redhat.com> - 4.14.2-27
changelog:
  - Support generating build-id's from compressed ELF files (#1650074)
  - Compress annobit notes in find-debuginfo (#1719837)


author: Florian Festi <ffesti@redhat.com> - 4.14.2-31
changelog:
  - Parallelize /usr/lib/rpm/brp-strip-static-archive (#1691824)
  - Parallelize /usr/lib/rpm/check-buildroot (#1704354)


author: Florian Festi <ffesti@redhat.com> - 4.14.3-5
changelog:
  - Don't error out when replacing an invalid signature (#1874062)
  - Raise an expection when erasing a package fails in Python (#1872623)
  - Fix builds on NFS filesystems (#1840728)


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-12
changelog:
  - Bump up the limit of signature header to 64MB (#1918777)
  - Add fapolicyd plugin (#1923167)
  - Unblock signals in forked scriptlets (#1913765)
  - Fix ambiguous diagnostics output on file triggers (#1883338)
  - Ensure ELF files get stripped when debuginfo is disabled (#1634084)


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-13
changelog:
  - Fix minor issues found by COVSCAN in fapolicyd plugin
  - Actually honor libarchive bcond at configure time (#1902887)


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-15
changelog:
  - Add out-of-bounds checks to hdrblobInit() (#1929445)
  - Fixes CVE-2021-20266
  - Fix regression in brp-strip causing kmods to lose SecureBoot sig (#1967291)


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-16
changelog:
  - Add support for read-only sqlite rpmdb (#1938928)
  - Drop compat .decode() method from returned Py3 strings (#1840142)


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-32
changelog:
  - Fix FA_TOUCH'ed files getting removed on failed update (RHEL-63069)
  - Fix IMA signature lengths assumed constant (RHEL-39896)
  - Fix root relocation regression (RHEL-49494)
  - Report unsafe symlinks during installation as a specific case (RHEL-39897)
  - Don't segfault on missing priority tag (RHEL-39894)


