# changelog

author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.100-2
changelog:
  - Refresh existing VG before autoactivating (event retrigger/device reappeared).
  - Move mpath device filter before partitioned filter (which opens devices).
  - Fix vgck to notice on-disk corruption even if lvmetad is used.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.100-3
changelog:
  - Do not allow passing empty new name for dmsetup rename.
  - Check for exactly one lv segment in validation of thin pools and volumes.
  - Fix dmeventd unmonitoring of thin pools.
  - Fix lvresize for stacked thin pool volumes (i.e. mirrors).
  - Support most of lvchange operations on stacked thin pool meta/data LVs.
  - Disable pvmove of merging or converting logical volumes.
  - Enable pvmove of snapshots and snapshot origins.
  - Fix inability to specify LV name when pvmove'ing a RAID, mirror, or thin-LV.
  - Add ability to pvmove RAID, mirror, and thin volumes.
  - Avoid unlimited recursion when creating dtree containing inactive pvmove LV.
  - Add man page entries for lvmdump's -u and -l options.
  - Remove "mpath major is not dm major" msg for mpath component scan (2.02.94).
  - Don't assume stdin file descriptor is readable.
  - Write Completed debug message before reinstating log defaults after command.
  - Use pvscan -b in udev rules to avoid a deadlock on udev process count limit.
  - Add pvscan -b/--background for the command to be processed in the background.
  - Direct udev to use 3min timeout for LVM devices. Recent udev has default 30s.
  - Do not scan multipath or RAID components and avoid incorrect autoactivation.
  - Fix MD/loop udev handling to fire autoactivation after setup or coldplug only.
  - Fix ignored lvmetad update on loop device configuration (2.02.99)
  - Fix lvm2app segfault while using lvm_list_pvs_free fn if there are no PVs.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.100-4
changelog:
  - Fix RAID calculation for sufficient allocatable space.
  - Conversion from linear to mirror or RAID1 now honors mirror_segtype_default.
  - Fix contiguous & cling allocation policies for parity RAID. (2.02.100)
  - lvconvert no longer converts LVs of "mirror" segment type to thinpool.
  - lvconvert no longer converts thinpool sub-LVs to "mirror" segment type.
  - Make RAID capable of single-machine exclusive operations in a cluster.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.100-5
changelog:
  - Fix failing metadata repair when lvmetad is used.
  - Fix incorrect memory handling when reading messages from lvmetad.
  - Fix locking in lvmetad when handling the PV which is gone.
  - Fix lvconvert when converting to a thin pool and thin LV at once.
  - Recognize new flag to skip udev scanning in udev rules and act appropriately.
  - Add support for flagging an LV to skip udev scanning during activation.
  - Improve message when unable to change discards setting on active thin pool.
  - Add --ignoreskippedcluster for exit status success when clustered VGs skipped.
  - Define symbolic names for subsystem udev flags in libdevmapper for easier use.
  - Make subsystem udev rules responsible for importing DM_SUBSYSTEM_UDEV_FLAG*.
  - Remove extra GOTO jump in lvmetad udev rules causing incorrect lvmetad update.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.100-6
changelog:
  - Fix lvconvert swap of poolmetadata volume for active thin pool
  - Check for open count with a timeout before removal/deactivation of an LV.
  - Add workaround for deactivation problem of opened virtual snapshot.
  - Report RAID images split with tracking as out-of-sync ("I").
  - Recognise NVM Express devices in filter.
  - Fix possible race while creating/destroying memory pools.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.100-7
changelog:
  - Add ignore_lvm_mirrors to config file to read/ignore labels on mirrors.
  - Revert to using devices/obtain_device_list_from_udev=0 by default.
  - Add internal flag for temporary LVs to properly direct udev to not interfere.
  - Fix endless loop in blkdeactivate <device>... if unable to umount/deactivate.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.107-2
changelog:
  - Add report/list_item_separator lvm.conf option.
  - Add lv_active_{locally,remotely,exclusively} LV reporting fields.
  - Comment out devices/{preferred_names,filter} in default lvm.conf file.
  - Enhance lvconvert thin, thinpool, cache and cachepool command line support.
  - Display 'C' only for cache and cache-pool target types in lvs.
  - Prompt for confirmation before change LV into a snapshot exception store.
  - Return proper error codes for some failing lvconvert funtions.
  - Add initial code to use cache tools (cache_check|dump|repair|restore).
  - Add --activationmode degraded to activate degraded raid volumes by default.
  - Add separate lv_active_{locally,remotely,exclusively} LV reporting fields.
  - Recognize "auto"/"unmanaged" values in selection for appropriate fields only.
  - Add report/binary_values_as_numeric lvm.conf option for binary values as 0/1.
  - Add --binary arg to pvs,vgs,lvs and {pv,vg,lv}display -C for 0/1 on reports.
  - Add separate reporting fields for each each {pv,vg,lv}_attr bit.
  - Separate LV device status reporting fields out of LV fields.
  - Fix regression causing PVs not in VGs to be marked as allocatable (2.02.59).
  - Fix VG component of lvid in vgsplit/vgmerge and check in vg_validate.
  - Add lv_full_name, lv_parent and lv_dm_path fields to reports.
  - Change lv_path field to suppress devices that never appear in /dev/vg.
  - Postpone thin pool lvconvert prompts (2.02.107).
  - Require --yes option to skip prompt to lvconvert thin pool chunksize.
  - Support lvremove -ff to remove thin volumes from broken thin pools.
  - Require --yes to skip raid repair prompt.
  - Change makefile %.d generation to handle filename changes without make clean.
  - Fix use of buildir in make pofile.
  - Enhance private volumes UUIDs with suffixed for easier detection.
  - Do not use reserved _[tc]meta volumes for temporary LVs.
  - Leave backup pool metadata with _meta%d suffix instead of reserved _tmeta%d.
  - Allow RAID repair to reuse PVs from same image that suffered a failure.
  - New RAID images now avoid allocation on any PVs in the same parent RAID LV.
  - Always reevaluate filters just before creating PV.
  - Fix dm_report_field_string_list to handle delimiter with multiple chars.
  - Add dm_report_field_reserved_value for per-field reserved value definition.


author: Alasdair Kergon <agk@redhat.com> - 2.02.108-1
changelog:
  - Add lvscan --cache which re-scans constituents of a particular LV.
  - Make dmeventd's RAID plugin re-scan failed PVs when lvmetad is in use.
  - Improve lvconvert --merge and --splitsnapshot validation.


author: Alasdair Kergon <agk@redhat.com> - 2.02.109-1
changelog:
  - Allow approximate allocation with +%FREE in lvextend.
  - Fix a segfault in lvscan --cache when devices were already missing. (2.02.108)
  - Display actual size changed when resizing LV.
  - Remove possible spurious "not found" message on PV create before wiping.
  - Handle upgrade from 2.02.105 when an LV now gaining a uuid suffix is active.
  - Remove lv_volume_type field from reports. (2.02.108)
  - Fix incorrect persistent .cache after vgcreate with PV creation. (2.02.108)
  - Add dm_tree_set_optional_uuid_suffixes to libdevmapper to handle upgrades.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.109-2
changelog:
  - Fix pvcreate_check() to update cache correctly after signature wiping.
  - Fix primary device lookup failure for partition when processing mpath filter.
  - Remove spurious "Skipping mirror LV" message on pvmove of clustered mirror.
  - If LV inactive and non-clustered, do not issue "Cannot deactivate" on -aln.
  - Cleanly error when creating RAID with stripe size < PAGE_SIZE.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.110-1
changelog:
  - Fix manipulation with thin-pools which are excluded via volume_list.
  - Support lv/vgremove -ff to remove thin vols from broken/inactive thin pools.
  - Fix typo breaking configure --with-lvm1=shared.
  - Modify lvresize code to handle raid/mirrors and physical extents.
  - Don't allow pvcreate to proceed if scanning or filtering fails.
  - Print name of LV which on activation triggers delayed snapshot merge.
  - Add lv_layout and lv_role LV reporting fields.
  - Properly display lvs lv_attr volume type and target type bit for cache origin.
  - Improve libdevmapper-event select() error handling.
  - Add extra check for matching transation_id after message submitting.
  - Add dm_report_field_string_list_unsorted for str. list report without sorting.
  - Support --deferred with dmsetup remove to defer removal of open devices.
  - Update dm-ioctl.h to include DM_DEFERRED_REMOVE flag.
  - Add support for selection to match string list subset, recognize { } operator.
  - Fix string list selection with '[value]' to not match list that's superset.
  - Fix string list selection to match whole words only, not prefixes.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.111-1
changelog:
  - Reinstate nosync logic when extending mirror. (2.02.110)
  - Fix total area extent calculation when allocating cache pool. (2.02.110)
  - Pass properly sized char buffers for sscanf when initializing clvmd.
  - Restore proper buffer size for parsing mountinfo line (1.02.89)


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.117-1
changelog:
  - Update to latest upstream release with various fixes and
    enhancementsdetailed in WHATS_NEW and WHATS_NEW_DM file.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.118-1
changelog:
  - Fix LV processing with selection to always do the selection on initial state.
  - Store metadata size + checksum in lvmcache and add struct lvmcache_vgsummary.
  - Remove inaccessible clustered PVs from 'pvs -a'.
  - Don't invalidate cached orphan information while global lock is held.
  - Avoid rescan of all devices when requested pvscan for removed device.
  - Measure configuration timestamps with nanoseconds when available.
  - Disable lvchange of major and minor of pool LVs.
  - Fix pvscan --cache to not scan and read ignored metadata areas on PVs.
  - Disallow vgconvert from changing metadata format when lvmetad is used.
  - Don't do a full read of VG when creating a new VG with an existing name.
  - Reduce amount of VG metadata parsing when looking for vgname on a PV.
  - Avoid reparsing same metadata when reading same metadata from multiple PVs.
  - Save extra device open/close when scanning device for size.
  - Fix seg_monitor field to report status also for mirrors and thick snapshots.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.118-2
changelog:
  - Don't skip invalidation of cached orphans if vg write lck is held (2.02.118).
  - Add --enable-halvm and --disable-halvm options to lvmconf script.
  - Add --services, --mirrorservice and --startstopservices option to lvmconf.
  - Use proper default value of global/use_lvmetad when processing lvmconf script.
  - Set correct vgid when updating cache when writing PV metadata.
  - Don't silently accept lvcreate -m with raid4/5/6.
  - Add A_PARTITION_BY_TAGS set when allocated areas should not share tags.
  - Respect allocation/cling_tag_list during intial contiguous allocation.
  - Don't skip invalidation of cached orphans if vg write lck is held (2.02.118).
  - Log relevant PV tags when using cling allocation.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.118-3.el6_7.2
changelog:
  - Fix alloc segfault when extending LV with fewer stripes than in first seg.
  - Fix regression in cache causing some PVs to bypass filters (2.02.105).


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.140-1
changelog:
  - Initialise udev in clvmd for use in device scanning. (2.02.116)
  - Add seg_le_ranges report field for common format when displaying seg devices.
  - Change LV sizes in seg_pe_ranges report field to match underlying devices.
  - Add kernel_cache_settings report field for cache LV settings used in kernel.
  - Update to latest upstream release with various fixes and
    enhancementsdetailed in WHATS_NEW and WHATS_NEW_DM file.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.141-1
changelog:
  - Do not check for suspended devices if scanning for lvmetad update.
  - Fix part. table filter with external_device_info_source="udev" and blkid<2.20.
  - Add metadata/check_pv_device_sizes switch to lvm.conf for device size checks.
  - Warn if device size is less than corresponding PV size in metadata.
  - Cache device sizes internally.
  - Restore support for command breaking in process_each_lv_in_vg() (2.02.118).
  - Use correct mempool when process_each_lv_in_vg() (2.02.118).
  - Fix lvm.8 man to show again prohibited suffixes.
  - Fix configure to set proper use_blkid_wiping if autodetected as disabled.
  - Initialise udev in clvmd for use in device scanning. (2.02.116)
  - Add seg_le_ranges report field for common format when displaying seg devices.
  - Honour report/list_item_separator for seg_metadata_le_ranges report field.
  - Don't mark hidden devs in -o devices,metadata_devices,seg_pe_ranges.(2.02.140)
  - Change LV sizes in seg_pe_ranges report field to match underlying devices.
  - Add kernel_cache_settings report field for cache LV settings used in kernel.
  - Fix man page for dmsetup udevcreatecookie.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.143-1
changelog:
  - Use uninitilized pool header detection in all cases.
  - Fix read error detection when checking for uninitialized thin-pool header.
  - Fix error path for internal error in lvmetad vg lookup code.
  - Fix error path when sending thin-pool message fails in update_pool_lv().
  - Support reporting CheckNeeded and Fail state for thin-pool and thin LV.
  - For failing thin-pool and thin volume correctly report percentage as INVALID.
  - Report -1, not 'unkown' for lv_{snapshot_invalid,merge_failed} with --binary.
  - If PV belongs to some VG and metadata missing, skip it if system ID is used.
  - Automatically change PV header extension to latest version if writing PV/VG.
  - Identify used PVs in pv_attr field by new 'u' character.
  - Add pv_in_use reporting field to report if PV is used or not.
  - Add pv_ext_vsn reporting field to report PV header extension version.
  - Add protective flag marking PVs as used even if no metadata available.
  - Fix memory pool corruption in pvmove (2.02.141).
  - Support control of spare metadata creation when repairing thin-pool.
  - Fix config type of 'log/verbose' from bool to int (2.02.99).
  - Fix inverted data LV thinp watermark calc for dmeventd response (2.02.133).
  - Use use_blkid_wiping=0 if not defined in lvm.conf and support not compiled in.
  - Clear cached bootloader areas when PV format changed.
  - Fix string boundary check in _get_canonical_field_name().
  - Always initialized hist struct in _stats_parse_histogram().
  - Improve status parsing for thin-pool and thin devices.
  - Use fully aligned allocations for dm_pool_strdup/strndup() (1.02.64).
  - Fix thin-pool table parameter feature order to match kernel output.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.143-2
changelog:
  - Fix resize of stacked raid thin data volume (2.02.141).
  - Allow for raid leg replacement if not both data and metadata image are on pvs.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.143-3
changelog:
  - Detect and warn about mismatch between devices used and assumed for an LV.
  - If available, use /proc/self/mountinfo to detect mounted volume in fsadm.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.143-4
changelog:
  - Remove spurious error about no value in /sys/dev/block/major:minor/dm/uuid.
  - Fix device mismatch detection for LV if persistent .cache file is used.
  - Fix holder device not being found in /dev while sysfs has it during dev scan.
  - Document that lvmlockd and lvmpolld features are available only if compiled in
    (RHEL6 lvm2 doesn't have lvmlockd and lvmpolld compiled in).


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.143-7
changelog:
  - Workaround for raid leg allocation failure after not-in-sync raid leg failure.
  - Fix flushing of outstanding IO for mirror target (2.02.133).


author: <gleblanc@localhost.localdomain>
changelog:
  - beautification
  - made mdadm.conf non-replaceable config
  - renamed Copyright to License in the header
  - added missing license file
  - used macros for file paths


author: Doug Ledford <dledford@redhat.com> 1.5.0-2
changelog:
  - Add a default MAILADDR line to the mdadm.conf file installed by default
    (Bugzilla #92447)
  - Make it build with gcc-3.4


author: Doug Ledford <dledford@redhat.com> 1.5.0-4
changelog:
  - Update mdmonitor script to start daemon more cleanly
  - Repackage mdmpd tarball to include gcc-3.4 changes and to make
    mdmpd properly daemonize at startup instead of forking and leaving
    the child attached to the terminal.


author: Doug Ledford <dledford@redhat.com> 1.5.0-5
changelog:
  - Disable service mdmpd by default to avoid [Failed] messages on
    current 2.6 kernels.  Possibly re-enable it by default once the
    2.6 kernels have the md event interface.


author: Doug Ledford <dledford@redhat.com> 2.5.0-6
changelog:
  - Fix a bug in the postun scriptlet related to downgrading to a version
    of mdadm that doesn't include the mdmpd daemon.


author: Doug Ledford <dledford@redhat.com> - 1.5.0-9
changelog:
  - Fix Makefile and build method to satisfy bz #123769
  - Add mdmpd man page, update mdmpd version to 0.3 - bz #117160
  - Make sure mdadm --monitor closes all md device files so that md devices
    can be stopped while mdadm is still running - bz #119532


author: Doug Ledford <dledford@redhat.com> 1.6.0-1
changelog:
  - Update to newer upstream version
  - Make mdmpd work on kernels that don't have the event interface patch


author: Doug Ledford <dledford@redhat.com> 1.11.0-2.fc4
changelog:
  - Change the default auto= mode so it need not be on the command line to
    work with udev, however it is still supported on the command line (#132706)
  - Add a man page (from Luca Berra) for mdassemble


author: Doug Ledford <dledford@redhat.com> 1.11.0-4.fc4
changelog:
  - Make the mdmonitor init script use the pid-file option, major cleanup
    of the script now possible (#134459)


author: Warren Togami <wtogami@redhat.com> 2.2-1
changelog:
  - 2.2 upgrade (#167897)
  - disable diet because we don't ship it anymore
    and we don't actually use mdassemble now


author: Doug Ledford <dledford@redhat.com> - 2.5.4-1
changelog:
  - Update to 2.5.4 (listed as a bugfix update by upstream)
  - Remove previous bitmap patch that's now part of 2.5.4


author: Doug Ledford <dledford@redhat.com> - 2.6-1
changelog:
  - Update to latest upstream version
  - Remove the mdmpd daemon entirely.  Now that multipath tools from the lvm/dm
    packages handles multipath devices well, this is no longer needed.
  - Various cleanups in the spec file


author: Doug Ledford <dledford@redhat.com> - 2.6.2-1
changelog:
  - Update to latest upstream
  - Remove requirement for /usr/sbin/sendmail - it's optional and not on by
    default, and sendmail isn't *required* for mdadm itself to work, and isn't
    even required for the monitoring capability to work, just if you want to
    have the monitoring capability do the automatic email thing instead of
    run your own program (and if you use the program option of the monitor
    capability, your program could email you in a different manner entirely)


author: Doug Ledford <dledford@redhat.com> - 2.6.2-2
changelog:
  - Fix a file leak issue when mdadm is in monitor mode
  - Update mdadm init script so that status will always run and so
    return codes are standards compliant
  - Fix assembly of version 1 superblock devices
  - Make the attempt to create an already running device have a clearer
    error message
  - Allow the creation of a degraded raid4 array like we allow for raid5
  - Make mdadm actually pay attention to raid4 devices when in monitor mode
  - Make the mdmonitor script use daemon() correctly
  - Fix a bug where manage mode would not add disks correctly under certain
    conditions
  - Resolves: bz244582, bz242688, bz230207, bz169516, bz171862, bz171938
  - Resolves: bz174642, bz224272, bz186524


author: Doug Ledford <dledford@redhat.com> - 2.6.2-3
changelog:
  - Oops, had to update the file leak patch, missed one thing
  - Minor tweak to return codes in init script and add LSB header
  - Resolves: bz244582, bz246980


author: Doug Ledford <dledford@redhat.com> - 2.6.2-4
changelog:
  - Oops, if we call -C -e1, minor_version is no longer properly set, fix that
    up
  - Related: bz230207


author: Bill Nottingham <notting@redhat.com> - 2.6.4-4
changelog:
  - make /dev/md if necessary in incremental mode (#429604)
  - open RAID devices with O_EXCL to avoid racing against other --incremental processes (#433932)


author: Doug Ledford <dledford@redhat.com> - 2.6.7-1
changelog:
  - Update to latest upstream version (should resolve #444237)
  - Drop incremental patch as it's now part of upstream
  - Clean up all the open() calls in the code (#437145)
  - Fix the build process to actually generate mdassemble (#446988)
  - Update the udev rules to get additional info about arrays being assembled
    from the /etc/mdadm.conf file (--scan option) (#447818)
  - Update the udev rules to run degraded arrays (--run option) (#452459)


author: Doug Ledford <dledford@redhat.com> - 2.6.7.1-1
changelog:
  - Updated to latest upstream stable release (#466803)
  - Change udev rule to not assemble degraded arrays (#453314)
  - Fix metadata matching in config file (#466078)
  - Fix assembly of raid10 devices (#444237)
  - Fix incremental assembly of partitioned raid devices (#447818)


author: Doug Ledford <dledford@redhat.com> - 3.0-0.devel2.1
changelog:
  - Update to latest upstream devel release
  - Use the udev rules file included with mdadm instead of our own
  - Drop all the no longer relevant patches
  - Fix a build error in mdopen.c
  - Fix the udev rules path in Makefile
  - Fix a compile issue with the __le32_to_cpu() macro usage (bad juju to
    to operations on the target of the macro as it could get executed
    multiple times, and gcc now throws an error on that)
  - Add some casts to some print statements to keep gcc from complaining


author: Doug Ledford <dledford@redhat.com> - 3.0-0.devel2.2
changelog:
  - Readd our old mdadm rules file that does incremental assembly
  - Remove the new mdadm rules file from upstream as we already have this in
    our udev package (and the one in the udev package already has a bug fixed)


author: Doug Ledford <dledford@redhat.com> - 3.0-0.devel3.1
changelog:
  - Update to latest devel release
  - Remove the no longer necessary udev patch
  - Remove the no longer necessary warn patch
  - Remove the no longer necessary alias patch
  - Update the mdadm.rules file to only pay attention to device adds, not
    changes and to enable incremental assembly
  - Add a cron job to run a weekly repair of the array to correct bad sectors
  - Resolves: bz474436, bz490972


author: Doug Ledford <dledford@redhat.com> - 3.0-0.devel3.3
changelog:
  - Slightly tweak the udev rules to make sure we don't start arrays
    while running in rc.sysinit...leave array starting to it instead
  - Modify mdadm to put its mapfile in /dev/md instead of /var/run/mdadm
    since at startup /var/run/mdadm is read-only by default and this
    breaks incremental assembly
  - Change how mdadm decides to assemble incremental devices using their 
    preferred name or a random name to avoid possible conflicts when plugging
    a foreign array into a host


author: Doug Ledford <dledford@redhat.com> - 3.0-0.devel3.5
changelog:
  - Fix a few issues with the new code to determine when a device gets to
    keep its name and when it doesn't


author: Doug Ledford <dledford@redhat.com> - 3.0-0.devel3.6
changelog:
  - Only check raid devices automatically, do not attempt to repair them
    during the weekly data scrubbing


author: Doug Ledford <dledford@redhat.com> - 3.0-0.devel3.7
changelog:
  - Move the mdadm.map file from /dev/md/ to /dev/ so the installer doesn't
    need to precreate the /dev/md/ directory in order for incremental
    assembly to work


author: Doug Ledford <dledford@redhat.com> - 3.0-1
changelog:
  - Remove stale patches already accepted by upstream
  - Fix the raid-check script to only try and check a device if it is
    checkable
  - Update to official mdadm-3.0 version
  - Resolves: bz505587, bz505552


author: Doug Ledford <dledford@redhat.com> - 3.0-2
changelog:
  - Improved raid-check script as well as the ability to configure what devices
    get checked
  - Endian patch for uuid generation


author: Doug Ledford <dledford@redhat.com> - 3.0-3
changelog:
  - Update to current head of upstream git repo for various imsm related fixes
    (fixes bz523262)
  - Fix display of metadata version in output of Detail mode
  - Add UUID output to --detail --export (bz523314)


author: Hans de Goede <hdegoede@redhat.com> - 3.0.2-1
changelog:
  - New upstream release 3.0.2
  - Add a patch fixing mdadm --detail -export segfaults (bz526761, bz523862)
  - Add a patch making mdmon store its state under /dev/.mdadm for initrd
    mdmon, rootfs mdmon handover
  - Restart mdmon from initscript (when running) for rootfs mdmon handover


author: Doug Ledford <dledford@redhat.com> - 3.0.3-1
changelog:
  - New upstream release 3.0.3 (bz523320, bz527281)
  - Update a couple internal patches
  - Drop a patch in that was in Neil's tree for 3.0.3 that we had pulled for
    immediate use to resolve a bug
  - Drop the endian patch because it no longer applied cleanly and all attempts
    to reproduce the original problem as reported in bz510605 failed, even up
    to and including downloading the specific package that was reported as
    failing in that bug and trying to reproduce with it on both ppc and ppc64
    hardware and with both ppc and ppc64 versions on the 64bit hardware.
    Without a reproducer, it is impossible to determine if a rehashed patch
    to apply to this code would actually solve the problem, so remove the patch
    entirely since the original problem, as reported, was an easy to detect DOA
    issue where installing to a raid array was bound to fail on reboot and so
    we should be able to quickly and definitively tell if the problem resurfaces.
  - Update the mdmonitor init script for LSB compliance (bz527957)
  - Link from mdadm.static man page to mdadm man page (bz529314)
  - Fix a problem in the raid-check script (bz523000)
  - Fix the intel superblock handler so we can test on non-scsi block devices


author: Doug Ledford <dledford@redhat.com> - 3.1.1-0.gcd9a8b5.1
changelog:
  - Update to head of upstream git repo, which contains a significant number
    of bug fixes we need (bz543746)


author: Doug Ledford <dledford@redhat.com> - 3.1.1-0.gcd9a8b5.3
changelog:
  - Don't run the raid-check script if the kernel doesn't support
    md devices (bz557053)
  - Don't report any mismatch_cnt issues on raid1 devices as there are
    legitimate reasons why the count may not be 0 and we are getting enough
    false positives that it renders the check useless (bz554217, bz547128)


author: Doug Ledford <dledford@redhat.com> - 3.1.1-0.gcd9a8b5.4
changelog:
  - Fix problem with booting multiple imsm containers when they aren't listed
    "just so" in the mdadm.conf file (bz554974)


author: Doug Ledford <dledford@redhat.com> - 3.1.1-0.gcd9a8b5.5
changelog:
  - The uuid patch cause a different problem during assembly, so use a gross
    hack to work around the uuid issue that won't break assembly until fixed
    properly upstream (bz567132)


author: Doug Ledford <dledford@redhat.com> - 3.1.1-0.gcd9a8b5.6
changelog:
  - Newer version of imsm patch that leaves warning, but only when there
    actually are too many devices on the command line (bz554974)


author: Doug Ledford <dledford@redhat.com> - 3.1.2-1
changelog:
  - Grab latest upstream release instead of git repo snapshot (bz552344, bz572561)
  - The lack of /dev/md is causing problems, so add code to mapfile.c to cause
    us to create /dev/md if it doesn't exist (bz569019)


author: Doug Ledford <dledford@redhat.com> - 3.1.2-2
changelog:
  - Add a little more paranoia checking to the RebuildMap code to avoid ever
    having the same infinite loop as in bz569019 again even if we change file
    locations to somewhere where we can't create a mapfile


author: Doug Ledford <dledford@redhat.com> - 3.1.2-7
changelog:
  - Fix up directory in mdmonitor init script so that we restart mdmon like we
    are supposed to
  - Add a rule to run incremental assembly on containers in case there are
    multiple volumes in a container and we only started some of them in the
    initramfs
  - Make -If work with imsm arrays.  We had too restrictive of a test in
    sysfs_unique_holder.
  - Make incremental assembly of containers act like incremental assembly of
    regular devices (aka, --run is needed to start a degraded array)


author: Doug Ledford <dledford@redhat.com> - 3.1.3-0.git07202010.1
changelog:
  - Update to latest git repo (3.1.2 plus pending changes, bz617280)
  - Remove mdadm.static as its no longer used in initrd creation
  - Remove glibc-static buildreq
  - Resolves: bz617280


author: Doug Ledford <dledford@redhat.com> - 3.1.3-0.git20100722.1
changelog:
  - Change git date format to the correct format (YYYYMMDD)
  - Update to latest upstream push (fixes bz604023)
  - Resolves: bz604023


author: Doug Ledford <dledford@redhat.com> - 3.1.3-1
changelog:
  - Update to official 3.1.3 release instead of a git snapshot
  - Add patch for return code in the case that a container is not assembled
    due to insufficient drives (bz622408)
  - Add patch to allow the deprecated --no-degraded option to be passed in,
    just not honored (bz622408)
  - Resolves: bz622408


author: Doug Ledford <dledford@redhat.com> - 3.2-1
changelog:
  - Update to latest upstream release
  - Related: bz633306, bz633667, bz633671, bz633688, bz633690, bz633692
  - Fix mdadm udev rules file
  - Resolves: bz605710
  - Process the Y option
  - Resolves: bz636883


author: Doug Ledford <dledford@redhat.com> - 3.2.1-1
changelog:
  - Update to latest upstream release
  - Don't report mismatch counts on either raid1 or raid10 devices
  - Check both active and idle arrays during raid check runs
  - Move raid-check script to /usr/sbin, add a crontab entry to /etc/cron.d
    and mark it config(noreplace) so that users can select their own
    raid check frequency and it will be preserved across updates
  - Allow the raid check script to set both the cpu and io priority on the
    raid check process in an effort to minimize the impact to users on the
    system
  - Related: bz633306


author: Doug Ledford <dledford@redhat.com> - 3.2.2-1
changelog:
  - Update to latest upstream release (many bugfixes related to the new
    automatic rebuild support: bz716413, bz694083, bz694092, bz694103,
    bz694121, bz694779, bz695336, bz702270)
  - Correct typo in /etc/sysconfig/raid-check file (bz708280)
  - Fix a bug related to readding devices into an array (bz706500)
  - Resolves: bz716413, bz694083, bz694092, bz694103, bz694121, bz694779
  - Resolves: bz695336, bz702270, bz708280, bz706500


author: Doug Ledford <dledford@redhat.com> - 3.2.2-2
changelog:
  - When using writemostly on a raid1 array, if you remove a device that
    is readwrite and then readd it, it can end up being listed as writemostly
    if the device used to pull the superblock info from was writemostly.
    Properly clear the writemostly bit when adding/readding a device.
  - Related: bz706500


author: Doug Ledford <dledford@redhat.com> - 3.2.2-3
changelog:
  - Be robust when running on a version 3.0 kernel
  - Properly set the default chunk size on orom devices
  - Fix getinfo_super_imsm so a hack in create.c can be dropped
  - Make the output of --detail more accurately communicate the state of
    a device that is waiting on a resync because another resync is
    already running
  - A few tweaks to the man page for mdadm to clarify usage in relation to
    imsm arrays
  - Resolves: bz727216, bz727207, bz727210, bz727212, bz727203


author: Doug Ledford <dledford@redhat.com> - 3.2.2-4
changelog:
  - Minor tweaks to wording in the comments of the /etc/sysconfig/raid-check
    file
  - Resolves: bz708280


author: Doug Ledford <dledford@redhat.com> - 3.2.2-5
changelog:
  - Fix multiple issues in the udev incremental assembly rules file.  We should
    now properly support:
    1) Nested md raid arrays
    2) md raid arrays built on top of dm device (like LUKS encrypted devices)
    3) md raid arrays build on top of dm multipath devices (we should no longer
      attempt to grab the path device instead of waiting for the logical
      multipath device to come live and grabbing it for our md raid usage)
  - Resolves: bz598513, bz609122


author: Doug Ledford <dledford@redhat.com> - 3.2.2-6
changelog:
  - Fix several new coverity issues introduced by changes between the rhel6.1
    and rhel6.2 mdadm package (this does not attempt to address coverity
    issues that also exist in rhel6.1)
  - Resolves: bz734716


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.2.2-7
changelog:
  - Fix problem where a dirty IMSM RAID isn't assembled correctly during
    boot, preventing booting from this RAID device.
  - Resolves: bz692261


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.2.2-8
changelog:
  - Fix problem where an IMSM RAID is rejected because of unexpected
    attribute settings.
  - Resolves: bz733153


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.2.2-9
changelog:
  - Fix problem where an IMSM RAID is rejected because of unexpected
    attribute settings. Additional fix being extra cautious from -8.
  - Resolves: bz733153


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.2.3-3
changelog:
  - Really enable fix for problem where a device fails to remove from
  - an IMSM container
  - Resolves: bz771332


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.2.3-4
changelog:
  - Fix bug where IMSM arrays stay inactive in case a reboot is
  - performed during the reshape process.
  - Resolves: bz730052


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.2.3-5
changelog:
  - Fix issue with devices failing to be added to a raid using bitmaps,
    due to trying to write the bitmap with mis-aligned buffers using
    O_DIRECT 
  - Resolves: bz790394


author: Doug Ledford <dledford@redhat.com> - 3.2.3-7
changelog:
  - Fix Monitor mode sometimes crashes when a resync completes
  - Fix missing symlink for mdadm container device when incremental creates
    the array
  - Make sure when creating a second array in a container that the second
    array uses all available space since leaving space for a third array
    is invalid
  - Validate the number of imsm volumes per controller
  - Fix issues with imsm arrays and disks larger than 2TB
  - Add support for expanding imsm arrays/containers
  - Resolves: bz808424, bz808519, bz808492, bz808438, bz808507,
  	    bz808475


author: Doug Ledford <dledford@redhat.com> - 3.2.3-8
changelog:
  - The support for expanding imsm arrays/containers was accepted upstream,
    update to the official patches from there
  - Fix for the issue of --add not being very smart
  - Fix an issue causing rebuilds to fail to restart on reboot (data
    corrupter level problem)
  - Reset the bad flag on map file updates
  - bitmap_offset is signed, treat it as such
  - Related: bz808475
  - Resolves: bz808776, bz812001, bz814743, bz811282


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.2.3-11
changelog:
  - Fix case where reshape of IMSM RAID fails because we don't check the
    return value when trying to read the word 'degraded' from sysfs,
    resulting in the use of random stack data.
  - Resolves bz824815


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.2.5-1
changelog:
  - Update mdadm to upstream release v3.2.5
    This includes all current patches, except for
    mdadm-3.2.3-imsm-fix-correct-checking-volume-s-degradation.patch
  - Resolved bz812358


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.2.5-3
changelog:
  - Avoid corruption by prohibiting an IMSM array from spanning multiple
    controllers (bz878810)
  - Prevent creation of a second IMSM array of size 0 (bz880208)
  - Avoid segfault when running mdadm --detail on an IMSM raid1 array
    where two drives have been disabled (bz880225)
  - Resolves bz878810, bz880208, bz880225


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.2.5-6
changelog:
  - Fix problem with IMSM metadata where resync progress would be lost
    if an array was stopped during ongoing expansion of a RAID1/5 volume.
  - Resolves bz903212


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.2.6-1
changelog:
  - Update mdadm to upstream release v3.2.6
    This includes all current patches, except for
    mdadm-3.2.5-imsm-Forbid-spanning-between-multiple-controllers.patch and
    mdadm-3.2.5-Create.c-check-if-freesize-is-equal-0.patch
  - Fix problem with arrays marked <ignored> in mdadm.conf still being
    auto-assembled
  - Fix problem with it not being possible to use <ignore> more than
    once in mdadm.conf
  - Resolves bz922971
  - Resolves bz902142
  - Resolves bz902137


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.2.6-2
changelog:
  - Enhance raid-check to allow the admin to specify the max number of
    concurrent arrays to be checked at any given time.
  - Resolves bz819943


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.2.6-3
changelog:
  - Fix problem where first stop command doesn't stop container during
    IMSM volume's reshape
  - Fix annoying build noise caused by latest rpmbuild
  - Resolves bz956016


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.2.6-4
changelog:
  - Fix problem with RAID10 resync failing to restart if it has been
    stopped after 50% completion.
  - Resolves bz995105


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.2.6-7
changelog:
  - Check for DM_UDEV_DISABLE_OTHER_RULES_FLAG instead of
    DM_UDEV_DISABLE_DISK_RULES_FLAG in 65-md-incremental.rules 
  - Resolves bz1015514


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.2.6-8
changelog:
  - Work around udev sporadically not updating ID_FS_TYPE field of block
    device entry in its database when array is being created.
  - Resolves bz1040006


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.2.6-9
changelog:
  - Change permissions of /etc/cron.d/raid-check to 600
  - Resolves bz1012505
  - Avoid double close() issue reported by Coverity
  - Resolves bz991041


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.2.6-10
changelog:
  - Fix problem of IMSM platform capabilities not being detected in UEFI
    mode when only the second SATA controller is enabled.
  - Resolves bz1075529


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.2.6-11
changelog:
  - Fix problem where mdadm would crash if trying to create an IMSM array with
    missing drives.
  - Resolves bz1059307


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.3-2
changelog:
  - Fix problem with path=* policy not working, due to lack of /dev/disk/by-path/
  - Resolves bz1059193


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.3-6
changelog:
  - Fix problem with reshape of IMSM RAID arrays failing to start
  - Disallow IMSM arrays spanning multiple controllers
  - Fix problem with reshape failing to restart when reassembling IMSM RAID
  - Resolves bz1136880, bz1136891, bz1136903


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.3.2-4
changelog:
  - Fix problem where mdadm allowed the creation of more arrays than
    supported by the BIOS.
  - Resolves bz1211564


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.3.4-1.el6_8.3
changelog:
  - Retry reading sync_completed state to avoid a reshape not continuing after
    restarting a reshape
    This is an additional patch to resolve this bug.
  - Resolves bz1331331


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.3.4-1.el6_8.4
changelog:
  - Fix problem with mdadm large device names overflowing an internal buffer,
    potentially leading to segfaults.
  - Resolves bz1347808


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.3.4-1.el6_8.5
changelog:
  - Fix problem with reshaping IMSM arrays, where a new reshape could be
    launched before the first reshape had fully completed, leading to
    unpected results.
  - Resolves bz1348544


author: Paul Lindner <lindner@inuus.com> - 1.2.2-3
changelog:
  - Enable build-time regression tests
  - add dependency on initscripts
  - remove memcached-debug (not needed in dist)
  - above suggestions from Bernard Johnson


author: root <lindner@inuus.com> - 1.2.3-2
changelog:
  - Upgrade to 1.2.3 upstream
  - Adjust make install to preserve man page timestamp
  - Conform with LSB init scripts standards, add force-reload


author: Paul Lindner <lindner@inuus.com> - 1.4.3-1
changelog:
  - Add explicit require on memcached for memcached-devel (resolves 537046)
  - enable-threads option no longer needed
  - Update web site address


author: Paul Lindner <lindner@inuus.com> - 0:1.4.4-1
changelog:
  - Upgraded to upstream memcached-1.4.4 (http://code.google.com/p/memcached/wiki/ReleaseNotes144)
  - Add explicit Epoch to fix issue with broken devel dependencies (resolves 542001)


author: Miroslav Lichvar <mlichvar@redhat.com> - 0:1.4.4-3.el6_8.1
changelog:
  - fix vulnerabilities allowing remote code execution (CVE-2016-8704,
    CVE-2016-8705, CVE-2016-8706)


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - tkmib doco had #!/usr/bin/perl55
  - include snmpcheck and tkmib again (still needs some CPAN module, however).


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - don't depend on /etc/init.d so that package will work with 6.2.
  - perl path fiddles no longer needed.
  - rely on brp-compress frpm rpm to compress man pages.
  - patch from ucd-snmp CVS (Wes Hardaker).
  - configure.in needs to check for rpm libraries correctly (#23033).
  - add simple logrotate script (#21399).
  - add options to create pidfile and log with syslog with addresses (#23476).


author: Matt Wilson <msw@redhat.com>
changelog:
  - configure with --enable-reentrant and added "smux" and "agentx" to
    --with-mib-modules= argument (#29626)


author: Philipp Knirsch <pknirsch@redhat.de>
changelog:
  - Updated to 4.2.1. Removed 2 obsolete patches (fromcvs and #18153)
  - Include /usr/share/snmp/snmpconf in %files


author: Philipp Knirsch <pknirsch@redhat.de>
changelog:
  - Enabled IPv6 support (RFE #47764)
  - Hopefully final fix of snmpwalk problem (#42153). Thanks to Douglas Warzecha
    for the patch and Matt Domsch for reporting the problem.


author: Philipp Knirsch <pknirsch@redhat.de>
changelog:
  - Removed tkmib from the package once again as we don't ship the Tk.pm CPAN
    perl module required to run it (#49363)
  - Added missing Provides for the .so.0 libraries as rpm doesn't seem to find
    those during the build anymore (it used to) (#46388)


author: Philipp Knirsch <pknirsch@redhat.de>
changelog:
  - Fixed a couple of security issues:
    o /tmp race and setgroups() privilege problem
    o Various buffer overflow and format string issues.
    o One signedness problem in ASN handling.
  - Fixed an important RFE to support bcm5820 cards. (#51125)


author: Philipp Knirsch <pknirsch@redhat.de>
changelog:
  - Final bcm5820 fix. Last one was broken.
  - Fixed bugzilla bug (#51960) where the binaries contained rpath references.


author: Philipp Knirsch <pknirsch@redhat.de>
changelog:
  - Fixed a server segfault for snmpset operation (#53640). Thanks to Josh Giles
    and Wes Hardaker for the patch.


author: Phil Knirsch <phil@redhat.de> 4.2.3-1
changelog:
  - Update to 4.2.3 final.
  - Fixed libtool/rpath buildroot pollution problem.
  - Fixed library naming problem.


author: Phil Knirsch <pknirsch@redhat.com> 4.2.3-4
changelog:
  - Added the snmptrapd init script as per request (#49205)
  - Fixed the again broken rpm query stuff (#57444)
  - Removed all old and none-used db related stuff (libs and header checks/files)


author: Phil Knirsch <pknirsch@redhat.com> 5.0.1-5
changelog:
  - Added --enable-ucd-snmp-compatibility for compatibility with older version
    and fixed installation thereof.
  - Got rid of the perl(Tk) dependancy by removing snmpcheck.
  - Include /usr/include/ucd-snmp in the filelist.
  - Fixed a problem with the ucd-snmp/version.h file.


author: Phil Knirsch <pknirsch@redhat.com> 5.0.8-2
changelog:
  - Hack to make it build on 64bit platforms with /usr/lib64 correctly.
  - Fixed bug #85071 (leak of open descriptors for ipv6).


author: Phil Knirsch <pknirsch@redhat.com> 5.0.9-1
changelog:
  - Updated to latest upstream version net-snmp-5.0.9
  - Added patch to fix net-snmp-perl problems (#105842).


author: Phil Knirsch <pknirsch@redhat.com> 5.1-1
changelog:
  - Updated to latest net-snmp-5.1 upstream version.
  - Tons of specfile and patch cleanup.
  - Cleaned up perl stuff (mib2c etc, see #107707).
  - Added lm_sensors support patch for x86 archs from Kaj J. Niemi (#107618).
  - Added support for custom mib paths and mibs to snmptrapd initscript (#102762)


author: Phil Knirsch <pknirsch@redhat.com> 5.1-2
changelog:
  - Included BuildPrereq on lm_sensors-devel on x86 archs (#110616).
  - Fixed deprecated initscript options (#110618).


author: Phil Knirsch <pknirsch@redhat.com> 5.1-3
changelog:
  - Removed snmpcheck again, needs perl(Tk) which we don't ship (#111194).
  - Fixed getopt definition in include file (#111209).
  - Included Kaj J. Niemi's patch for broken perl module (#111319).
  - Included Kaj J. Niemi's patch for broken async getnext perl call (#111479).
  - Included Kaj J. Niemi's patch for broken hr_storage (#111502).


author: Phil Knirsch <pknirsch@redhat.com> 5.1-9
changelog:
  - Reverted removal of _includir redefiniton due to php-snmp dependancy.
  - Remove SO_BSDCOMPAT setsockopt() call, deprecated.


author: Phil Knirsch <pknirsch@redhat.com> 5.1-12
changelog:
  - Hacked an ugly perl hack to get rid of perl RPATH problems.
  - Fixed 64bit patch and applied it. ;-)


author: Phil Knirsch <pknirsch@redhat.com> 5.1.1-2
changelog:
  - Added Kaj J. Niemi that fixes ipAdEntIfIndex problem (#119106)
  - Added Kaj J. Niemi to shut up memshared message for 2.6 kernel (#119203)


author: Radek Vokal <rvokal@redhat.com> 5.1.2-4
changelog:
  - New prereq for net-snmp-devel
  - lelf check removed from configure.in (#128748)
  - fixed snmpd coredump when sent SIGHUP (#127314)


author: Phil Knirsch <pknirsch@redhat.com> 5.1.2-9
changelog:
  - Droped obsolete lm-sensors patch and enabled lmSensors module
  - Marked several patches to be removed for 5.1.3


author: Radek Vokal <rvokal@redhat.com> 5.1.2-12
changelog:
  - snmpd crash with 'interfaces' directives in snmpd.conf fixed #139010
  - rather dirty patch fixing conf directory for net-snmp-config


author: Radek Vokal <rvokal@redhat.com> - 5.1.2-3
changelog:
  - patch from CVS - kill extra carriage return (#144917)
  - removed patch for interface indexing - doesn't show virtual interfaces


author: Radek Vokal <rvokal@redhat.com> - 5.2.1-5
changelog:
  - 64bit needed some changes, was causing timeouts on 64bit archs!? 
  - affects bugs #125432 and #132058


author: Radek Vokal <rvokal@redhat.com> - 5.2.1-12
changelog:
  - session free fixed, agentx modules build fine (#157851)
  - fixed dependency for net-snmp libs (#156932)


author: Radek Vokal <rvokal@redhat.com> - 5.2.2-0.rc6.1
changelog:
  - update to rc6, snmpnetstat changes due to license problems
  - persistent files in directory defined by snmp.conf persistentDir are 
    loaded at startup


author: Radek Vokal <rvokal@redhat.com> - 5.2.2-4
changelog:
  - check for header files in configure
  - patch for SNMPv3 traps / session user creation (net-snmp bz#1374087)


author: Radek Vokal <rvokal@redhat.com> 5.3-2
changelog:
  -  Security fix. Bug granting write access to read-only users 
     or communities which were configured  using the "rocommunity" 
     or "rouser" snmpd.conf tokens fixed


author: Radek Vokál <rvokal@redhat.com> 5.3-7
changelog:
  - fix parsing of /proc/diskstats
  - fix disman monitor crash
  - fix perl vendor name
  - fix OID lookup fail


author: Radek Vokal <rvokal@redhat.com> 5.3.1.pre2-1
changelog:
  - update to 5.3.1.pre2
  - fix multilib issues (#192736)
    On system with /usr/lib64 use net-snmp-config64 and net-snmp-config64.h


author: Radek Vokal <rvokal@redhat.com> 5.3.1.0-5
changelog:
  - SMUX support is still needed .. will disappear later!
  - static libs should be in devel not libs (#203571)
  - fix lm_sensors issues


author: Radek Vokál <rvokal@redhat.com> - 1:5.4-13
changelog:
  - fix overly verbose log message (#221911)
  - few minor tweaks for review - still not perfect
  - fix linking with lcrypto (#231805)


author: Jan Safranek <jsafranek@redhat.com> 5.4-14
changelog:
  - fix snmptrapd hostname logging (#238587)
  - fix udpEndpointProcess remote IP address (#236551)
  - fix -M option of net-snmp-utils (#244784)
  - default snmptrapd.conf added (#243536)
  - fix crash when multiple exec statements have the same name
    (#243536)
  - fix ugly error message when more interfaces share
    one IP address (#209861)


author: Jan Safranek <jsafranek@redhat.com> 5.4-16
changelog:
  - supported lm_sensors on ppc64 (#249255)
  - snmpconf generates config files with proper selinux context
    (#247462)
  - fix leak  in udp transport (#247771)
  - add alpha to supported archs in net-snmp-config (#246825)
  - fix hrSWInst (#250237)


author: Jan Safranek <jsafranek@redhat.com> 5.4.1-3
changelog:
  - include these tables: ip-mib/ipv4InterfaceTable
    ip-mib/ipv6InterfaceTable, ip-mib/ipAddressPrefixTable
  - fix Requires of net-snmp-devel to include lmsensors-devel on supported
    architectures


author: Jan Safranek <jsafranek@redhat.com> 5.4.1-5
changelog:
  - move mib2c-update from net-snmp-utils to net-snmp-perl, where
    mib2c is located
  - add tkmib to net-snmp-gui package (#167933)


author: Jan Safranek <jsafranek@redhat.com> 5.4.1-6
changelog:
  - add support of lm_sensors v3
  - added procps to build dependencies (#380321)
  - removed beecrypt from dependencies
  - fixed crash on reading xen interfaces (#386611)


author: Jan Safranek <jsafranek@redhat.com> 5.4.1-9
changelog:
  - introduce /etc/sysconfig/snmpd. Use it to specify snmpd command line options.
    /etc/snmp/snmpd.options is not used anymore (#431391)


author: Jan Safranek <jsafranek@redhat.com> 5.4.1-15
changelog:
  - explicitly require lm_sensor > 3 for build (#442718)
  - create multilib net-snmp-config on multilib architectures only


author: Jan Safranek <jsafranek@redhat.com> 5.4.2-2
changelog:
  - redistribute the perl scripts to the net-snmp package,
    net-snmp-utils doesn't depend on perl now (#462484)


author: Jan Safranek <jsafranek@redhat.com> 5.4.2.1-1
changelog:
  - explicitly require the right version and release of net-snmp and
    net-snmp-libs
  - update to net-snmp-5.4.2.1 to fix CVE-2008-4309


author: Jan Safranek <jsafranek@redhat.com> 5.4.2.1-12
changelog:
  - make the default configuration less noisy, i.e. do not print "Connection from
    UDP:" and "Received SNMP packet(s) from UDP:" messages on each connection.
    (#509055)


author: Jan Safranek <jsafranek@redhat.com> 5.4.2.1-13
changelog:
  - package cleanup, remove unnecessary patches
  - move local state file from /var/net-snmp/ to /var/lib/net-snmp


author: Jan Safranek <jsafrane@redhat.com> 1:5.5-2
changelog:
  - introduce /etc/sysconfig/snmptrapd. Use it to specify snmptrapd command
    line options.  /etc/snmp/snmptrapd.options is not used anymore (#540799)
  - build-in ipAddressPrefixTable, ipDefaultRouterTable, ipv6ScopeZoneIndexTable,
    ipIfStatsTable, SCTP-MIB, RMON-MIB and Etherlike-MIBs
  - remove ucd5820stat helper script, it depends on get5820stats, which is not
    available in Fedora
  - move sample services ipf-mod.pl to documentation
  - remove logrotate config, snmpd logs into syslog


author: Jan Safranek <jsafrane@redhat.com> 1:5.5-3
changelog:
  - prepare the .spec file for review
  - run automatic regression suite after the compilation of the package
    to check for obvious regressions
  - remove unnecessary package dependencies


author: Jan Safranek <jsafrane@redhat.com> 1:5.5-4
changelog:
  - fix udpTable indexes on big-endian systems (#543352)
  - fix snmptrapd init script to survive with empty /etc/sysconfig/snmptrapd
  - lower the default log level of snmpd to get rid of the debug messages


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-7
changelog:
  - fix invalid access to memory in tcpListenerTable (#551030)
  - fix crash with interfaces without broadcast addresses (like OpenVPN's tun0)
    (#549390)
  - fix responding to broadcast SNMP requests (#549390)
  - port patches from RHEL-5 to avoid regressions


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-14
changelog:
  - store temporary files in /var/run/net-snmp instead of /tmp (SELinux does
    not allow writing /tmp) (#560081)
  - fix filedescriptor leak in RMON-MIB and Etherlike-MIB (#562108)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-15
changelog:
  - remove net-snmp-gui subpackage, perl-Tk is being removed from
    distro (#568786)
  - fix IF-MIB::ifSpeed of inactive interfaces (#561884)
  - correct the package license


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-19
changelog:
  - fixed exit code of snmp utilities when wrong argument to '-A' option
    is specified (#574061)
  - fixed BER parsing of incoming packets - siletnly discard the invalid ones
    according to RFC (#568651)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-21
changelog:
  - fixed hrFSTable and hrStorageTable to provide persistent table indexes
    according to RFS 2790 (#595325)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-22
changelog:
  - fixed value of ipIfStatsTable.Ip6ReasmReqds (#597265)
  - added missing include files from util_funcs directory (#604636)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-23
changelog:
  - fixed segfault when parsing snmpd.conf with disman entries (#607080)
  - fixed value of IP-MIB::ipv6InterfaceForwarding (#607074)
  - fixed output of snmptranslate tool when displaying ranges of UNSIGNED
    type (#606874)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-27.1
changelog:
  - fixed truncation of sysObjectID (#641113)
  - fixed assertions in calculating of statistics in IF-MIB (#621664)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-28
changelog:
  - fixed recompilation of the package on machine without IPv6 (#657835)
  - fixed SMUX getting stuck on big-endian platforms (#665053)
  - fixed OID comparsion in snmpwalk, now the output does not include
    objects outside requested subtree (#636890)
  - fixed IPv4 address creation in ipAddressTable (#616764)
  - added IPv6 address creation to ipAddressTable (#616336)
  - fixed value of ipAddressPrefixAutonomousFlag OID (#625262)
  - fixed ipv6IfTable - new interfaces were not added there (#627564)
  - extended BRIDGE-MIB implementation to cover RFC 4363 (#630157)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-31
changelog:
  - fixed BRIDGE-MIB implementation in /usr/bin/snmp-bridge-mib,
    now it supports embedded perl and answers GETNEXT requests correctly
    (#630157).


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-32
changelog:
  - fixed varbind parsing in python netsnmp module (#711481)
  - fixed session initialization in python netsnmp module (#710667)
  - fixed crash when getting out-of-memory in inetNetToMediaTable (#708947)
  - added xfs and jfs filesystem support to hrStorageTable (#707912)
  - fixed snmpd to purge zombies resulted from pass_persist process exit
    (#703682)
  - added a log message when snmpd detects two interfaces with the same
    IP address and thus having only one ipTable entry for both (#702171)
  - added new snmpd.conf options 'interface_fadeout' and
    'interface_replace_old' to controll snmpd behavior when more
    interfaces get the same name (#702165)
  - fixed snmptrapd leaking memory when processing traps in embedded perl
    (#678314)
  - fixed hrSystemDate timezone sign (#683680)
  - fixed snmp logging 'truncating integer value > 32 bits' for
    UCD-SNMP-MIB::systemStats (#681949)
  - fixed rare race condition in hrSWRunTable (#683563)
  - recompiled with relro for better security (#725657)
  - snmpd should not change request-id when sending multiple SMUX messages
    (#708370)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-38
changelog:
  - fixed snmpd crashing with many AgentX subagent (#749227)
  - fixed SNMPv2-MIB::sysObjectID value when "sysObjectID" config file
    option with long OID was used (#786931)
  - fixed value of BRIDGE-MIB::dot1dBasePortIfIndex.1 (#740172)
  - fixed parsing of "proxy" snmpd.conf option not to enable
    verbose logging by default (#746903)
  - added new "realStorageUnits" config file option to support
    disks > 16 TB in hrStorageTable (#741789)
  - added vxfs, reiserfs and ocfs2 filesystem support to hrStorageTable
    (#746903)
  - fixed snmpd sigsegv when embedded perl script registers one handler
    twice (#748907)
  - fixed setting of SNMP-TARGET-MIB::snmpTargetAddrRowStatus via
    SNMP-SET request on 64-bit platforms (#754275)
  - fixed crash when /var/lib/net-snmp/mib_indexes/ files have wrong
    SELinux context (#754971)
  - fixed memory leak when agentx subagent disconnects in the middle
    of request processing (#736580)
  - fixed slow (re-)loads of TCP-MIB::tcpConnectionTable (#789909)
  - removed 'error finding row index in _ifXTable_container_row_restore'
    error message (#788954)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-43
changelog:
  - fixed value of UCD-SNMP-MIB::extCommand to contain full command
    line (#842279)
  - fixed rpath to perl.so (#848319)
  - added support for port numbers in 'clientaddr' configuration
    option (#833013)
  - fixed rare snmptrapd crash on SIGHTERM handling when embedded perl
    is used (#824402)
  - fixed engineID of outgoing traps if 'trapsess -e <engineID>' is used in
    snmpd.conf (#800671)
  - updated documentation of '-c' option of snmptrapd (#784502)
  - fixed endless loop when SIGTEM arrives in middle of internal query
    processing (#851637)
  - fixed UCD-DISKIO-MIB::diskIOLA values (#848155)
  - removed various error log messages related to counte64 expansions
    (#846906)
  - removed various error log messages when IPv6 is disabled (#845157)
  - added support of cvfs filesystem in hrStorageTable (#846532)
  - fixed rare race condintion when populating UCD-SNMP-MIB::prTable,
    which could result in some entries missing in the table (#846436)
  - added support of simfs filesystem in hrStorageTable (#861152)
  - fixed responding to requests on a multihost machine (#825889)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-45
changelog:
  - fixed potential memory leak on realloc failure when processing 'extend'
    option (#893119)
  - added precise enumeration of configuration files searched to
    snmp_config(5) man page (#907571)
  - set permissions of snmpd.conf and snmptrapd conf to 0600 (#919239)
  - fixed kernel threads in hrSWRunTable (#919952)
  - fixed various error codes in Python module (#955771)
  - fixed snmpd crashing in the middle of agentx request processing when
    a subagent disconnects (#955511)
  - allow 'includeFile' and 'includeDir' options in configuration files
    (#917816)
  - fixed netlink message size (#927474)
  - fixed IF-MIB::ifSpeedHi on systems with non-standard interface speeds
    (#947973)
  - fixed BRIDGE-MIB::dot1dBasePortTable not to include the bridge itself
    as a port (#960568)
  - fixed snmpd segfault when 'agentaddress' configuration options is used
    and too many SIGHUP signals are received (#968898)
  - updated UCD-SNMP-MIB::dskTable to dynamically add/remove disks
    if 'includeAllDisks' is specified in snmpd.conf (#922691)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-46
changelog:
  - fixed parsing of bulk responses (#983116)
  - added support of vzfs filesystem in hrStorageTable (#989498)
  - fixed endless loop when parsing sendmail configuration file with
    queue groups (#991213)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-49
changelog:
  - fixed snmp daemons and utilities crashing in FIPS mode (#1001830)
  - added support of btrfs filesystem in hrStorageTable (#1006706)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-50
changelog:
  - added 'diskio' option to snmpd.conf, it's possible to monitor only selected
    devices in diskIOTable (#990674)
  - fixed CVE-2014-2284: denial of service flaw in Linux implementation of
    ICMP-MIB (#1073223)
  - added cache to hrSWRunTable to provide consistent results (#1007634)
  - skip 'mvfs' (ClearCase) when skipNFSInHostResources is enabled (#1073237)
  - fixed snmptrapd crashing on forwarding SNMPv3 traps (#1131844)
  - fixed HOST-RESOURCES-MIB::hrSystemProcesses (#1134335)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-51
changelog:
  - added faster caching into IP-MIB::ipNetToMediaTable (#789500)
  - fixed compilation with "-Werror=format-security" (#1181994)
  - added clear error message when port specified in 'clientaddrr' config
    option cannot be bound (#886468)
  - fixed error check in IP-MIB::ipAddressTable (#1012430)
  - fixed agentx client crash on failed response (#1023570)
  - fixed dashes in net-snmp-config.h (#1034441)
  - fixed crash on monitor trigger (#1050970)
  - fixed 'netsnmp_assert 1 == new_val->high failed' message in system log
    (#1065210)
  - fixed parsing of 64bit counters from SMUX subagents (#1069046)
  - Fixed HOST-RESOURCES-MIB::hrProcessorTable on machines with >100 CPUs
    (#1070075)
  - fixed net-snmp-create-v3-user to have the same content on 32 and 64bit
    installations (#1073544)
  - fixed IPADDRESS value length in Python bindings (#1100099)
  - fixed hrStorageTable to contain 31 bits integers (#1104293)
  - fixed links to developer man pages (#1119567)
  - fixed storageUseNFS functionality in hrStorageTable (#1125793)
  - fixed netsnmp_set Python bindings call truncating at the first '\000'
    character (#1126914)
  - fixed log level of SMUX messages (#1140234)
  - use python/README to net-snmp-python subpackage (#1157373)
  - fixed forwarding of traps with RequestID=0 in snmptrapd (#1146948)
  - fixed typos in NET-SNMP-PASS-MIB and SMUX-MIB (#1162040)
  - fixed close() overhead of extend commands (#1188295)
  - fixed lmSensorsTable not reporting sensors with duplicate names (#967871)
  - fixed hrDeviceTable with interfaces with large ifIndex (#1195547)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-52
changelog:
  - Fixed snmptrapd crash when '-OQ' parameter is used and invalid trap is
    received (#CVE-2014-3565)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-55.el6
changelog:
  - Fixed 'clientaddr' option for UDPv6 client messages (#1279501)
  - Increased maximum size of AgentX packets (#1271196).
  - Fixed IP-MIB::ipSystemStatsInOctets and similar counters for IPv4
    (#1250023).
  - Fixed client utilities reporting 'read_config_store open failure on
    /var/lib/net-snmp/snmpapp.conf' (#1246568)
  - Fixed typos in NET-SNMP-AGENT-MIB.txt (#1241865)
  - Allow clients to use UDPv6 addresses without 'udp6:' prefix (#1227640)
  - Restored message about duplicate IP address (#1227374)
  - Fixed fd leak in sctp statistics (#1291054)


author: Josef Ridky <jridky@redhat.com> - 1:5.5-57.el6_8.1
changelog:
  - Resolves: #1363606 - An SNMPv3 request with a small max message size can lead to SNMPv1/2c bulk requests timing out


author: Cristian Gafton <gafton@redhat.com>
changelog:
  - switch to nfs-utils as the base tree
  - fix the statfs patch for the new code base
  - single package that obsoletes everything we had before (if I am to keep
    some traces of my sanity with me...)


author: Bob Matthews <bmatthews@redhat.com>
changelog:
  - Fix incorrect file specifications in statd manpage.
  - Require gawk 'cause it's used in nfslock init script.


author: Bob Matthews <bmatthews@redhat.com>
changelog:
  - don't install any rquota pages in _mandir: (#39707, #44119)
  - don't try to manipulate rpc.rquotad in init scripts 
  -   unless said program actually exists: (#43340)


author: Bob Matthews <bmatthews@redhat.com>
changelog:
  - "service nfs restart" should start services even if currently 
  -   not running (#59469)
  - bump version to 0.3.3-4


author: Steve Dickson <SteveD@RedHat.com>
changelog:
  - Added the setting of lockd ports via sysclt interface
  - Removed queue setting code since its no longer needed


author: <SteveD@RedHat.com>
changelog:
  - Removed gssd tarball and old nfsv4 patch.
  - Added new nfsv4 patches that include both the
     gssd and idmapd daemons
  - Added redhat-only v4 patch that reduces the
     static librpc.a to only contain gss rpc related
     routines (I would rather have gssd use the glibc 
     rpc routines)
  -Changed the gssd svcgssd init scripts to only
     start up if SECURE_NFS is set to 'yes' in
     /etc/sysconfig/nfs


author: <SteveD@RedHat.com>
changelog:
  - Added the addition and deletion of rpc_pipefs to /etc/fstab
  - Added the addition and deletion of module aliases to /etc/modules.conf


author: <SteveD@RedHat.com>
changelog:
  - Added the shutting down of the rpc v4 daemons.
  - Updated the Red Hat only patch with some init script changes.


author: <SteveD@RedHat.com>
changelog:
  - Made the nfs4 daemons initscripts work better when 
    sunrpc is not a module
  - added more checks to see if modules are being used.


author: <SteveD@RedHat.com>
changelog:
  - Created a pipe between the parent and child so 
    the parent process can report the correct exit
    status to the init scripts
  - Added SIGHUP processing to rpc.idmapd and the 
    rpcidmapd init script.


author: <SteveD@RedHat.com>
changelog:
  - Changed the permission on idmapd.conf to 644
  - Added mydaemon code to svcgssd
  - Updated the add_gssd.patch from upstream


author: <SteveD@RedHat.com>
changelog:
  - Removed the auto option from MOUNTD_NFS_V2 and
    MOUNTD_NFS_V3 variables. Since v2 and v3 are on
    by default, there only needs to be away of 
    turning them off.


author: <SteveD@RedHat.com>
changelog:
  - Fixed syntax error in nfs initscripts when
    NETWORKING is not defined
  - Removed sync warning on readonly exports.
  - Changed run levels in rpc initscripts.
  - Replaced modinfo with lsmod when checking
    for loaded modules.


author: <SteveD@RedHat.com>
changelog:
  - nfslock stop is now done on package removals
  - Eliminate 3 syslog messages that are logged for
    successful events.


author: Steve Dickson <SteveD@RedHat.com>
changelog:
  - Major clean up. 
  - Removed all unused/old patches
  - Rename and condensed a number of patches
  - Updated to CITI's nfs-utils-1.0.6-13 patches


author: <SteveD@RedHat.com>
changelog:
  - Make sure the uid/gid of nfsnobody is the
    correct value for all archs (bz# 123900)
  - Fixed some security issues found by SGI (bz# 133556)


author: <SteveD@RedHat.com
changelog:
  - Incorporate some clean up code from Ulrich Drepper (bz# 134025)
  - Fixed the chkconfig number in the rpcgssd, rpcidmapd, and 
    rpcsvcgssd initscrpts (bz# 132284)


author: Steve Dickson <SteveD@RedHat.com>
changelog:
  - Added "$RQUOTAD_PORT" variable to nfs.init which
    allows the rpc.rquotad to use a predefined port
    (bz# 124676)


author: Steve Dickson <SteveD@RedHat.com>
changelog:
  - Replaced a memcopy with explicit assignments
    in getquotainfo() of rquotad to fix potential overflow
    that can occur on 64bit machines. (bz 138068)


author: Steve Dickson <SteveD@RedHat.com>
changelog:
  - Fix problem in idmapd that was causing "xdr error 10008"
    errors (bz 142813)
  - make sure the correct hostname is used in the SM_NOTIFY
    message that is sent from a rebooted server which has 
    multiple network interfaces. (bz 139101)

  - Changed nfslock to send lockd a -KILL signal
    when coming down. (bz 125257)


author: Steve Dickson <SteveD@RedHat.com>
changelog:
  - Added support to rpcgssd.init and rpcsvcgssd.init scripts
    to insmod security modules.
  - Changed the nfs.init script to bring rpc.svcgssd up and down,
    since rpc.svcgssd is only needed with the NFS server is running.


author: Steve Dickson <SteveD@RedHat.com> 1.0.7-3
changelog:
  - Changed xlog to use LOG_INFO instead of LOG_DEBUG
    so debug messages will appear w/out any config
    changes to syslog.conf.
  - Reworked how /etc/exports is setup (bz 151389)


author: Steve Dickson <SteveD@RedHat.com> 1.0.7-4
changelog:
  - Fixed a compile error on x86_64 machines in the gss code.
  - Updated the statd-notify-hostname.patch to eliminate 
    a segmentation fault in rpc.statd when an network 
    interface was down. (bz 151828)


author: Steve Dickson <SteveD@RedHat.com> 1.0.7-12
changelog:
  - Changed useradd to use new -l flag (bz149407)
  - 64bit fix in gssd code (bz 163139)
  - updated broken dependencies
  - updated rquotad to compile with latest
    quota version.


author: Steve Dickson <SteveD@RedHat.com> 1.0.7-16
changelog:
  - Reworked the nfslock init script so if lockd is running
    it will be killed which is what the HA community needs. (bz 162446)
  - Stopped rpcidmapd.init from doing extra echoing when
    condstart-ed.


author: Steve Dickson <SteveD@RedHat.com> 1.0.7-17
changelog:
  - Updated to latest nfs-utils code in upstream CVS tree
  - Updated libevent from 1.0b to 1.1a
  - Added libgssapi-0.4 and librpcsecgss-0.6 libs from CITI


author: Steve Dickson <SteveD@RedHat.com> 1.0.7-18
changelog:
  - Updated libnfsidmap to 0.11
  - Updated libgssapi to 0.5
  - Made sure the gss daemons and new libs are
    all using the same include files.
  - Removed code from the tree that is no longer used.
  - Add ctlbits patch that introduced the -N -T and -U
    command line flags to rpc.nfsd.


author: Steve Dickson <SteveD@RedHat.com> 1.0.7-19
changelog:
  - Updated to latest code in SourceForge CVS
  - Updated to latest CITI patches (1.0.7-4)
  - Fix bug in nfsdreopen by compiling in server defaults


author: Steve Dickson <SteveD@RedHat.com> 1.0.8.rc2-1.FC5
changelog:
  - Updated to 1.0.8-rc2 release
  - Broke out libgssapi into its own rpm
  - Move librpcsecgss and libnfsidmap in the new nfs-utils-lib rpm
  - Removed libevent code; Required to be installed.


author: Steve Dickson <SteveD@RedHat.com> 1.0.8.rc2-3.FC5
changelog:
  - Added innetgr patch that changes configure scripts to 
    check for the innetgr function. (bz 177899)


author: Steve Dickson <SteveD@RedHat.com> 1.0.8.rc2-4.FC5
changelog:
  - Added new libnfsidmap call, nfs4_set_debug(), to rpc.idmapd
    which turns on debugging in the libarary.


author: <SteveD@RedHat.com> 1.0.8-3
changelog:
  - Split the controlling of nfs version, ports, and protocol 
    into two different patches
  - Fixed and added debugging statements to rpc.mountd.
  - Fixed -p arg to work with priviledged ports (bz 156655)
  - Changed nfslock initscript to set LOCKD_TCPPORT and
    LOCKD_UDPPORT (bz 162133)
  - Added MOUNTD_NFS_V1 variable to version 1 of the
    mount protocol can be turned off. (bz 175729)
  - Fixed gssd to handel mixed case characters in
    the domainname. (bz 186069)


author: <SteveD@RedHat.com> 1.0.9-2
changelog:
  - Enabled the creating of mount.nfs and umount.nfs binaries
  - Added mount option fixes suggested by upstream.
  - Fix lazy umounts (bz 169299)
  - Added -o fsc mount option.


author: <SteveD@RedHat.com> 1.0.9-5
changelog:
  - Changed gssd daemons to cache things in memory
    instead of /tmp which makes selinux much happier.
    (bz 203078)


author: <SteveD@RedHat.com> 1.0.9-6
changelog:
  - Removed the compiling of getiversion and getkversion since
    UTS_RELEASE is no longer defined and these binary are
    not installed.


author: Karel Zak <kzak@redhat.com> 1.0.9-7
changelog:
  - Added support for the mount -s (sloppy) option (#205038)
  - Added nfs.5 man page from util-linux
  - Added info about [u]mount.nfs to the package description


author: Steve Dickson <steved@redhat.com> 1.0.10-2
changelog:
  - Fixed -o remount (bz 210346)
  - fix memory leak in rpc.idmapd (bz 212547)
  - fix use after free bug in dirscancb (bz 212547)
  - Made no_subtree_check a default export option (bz 212218)


author: Steve Dickson <steved@redhat.com> 1.0.10-4
changelog:
  - Doing a connect on UDP sockets causes the linux network
    stack to reject UDP patches from multi-home server with
    nic on the same subnet. (bz 212471)


author: Steve Dickson <steved@redhat.com> 1.0.12-2
changelog:
  - Added condstop to all the initscripts (bz 196934)
  - Made no_subtree_check a default export option (bz 212218)


author: Steve Dickson <steved@redhat.com> 1.0.12-5
changelog:
  - Fix mount.nfs4 to display correct error message (bz 227212)
  - Updated mountd and showmount reverse lookup flags (bz 220772)
  - Eliminate timeout on nfsd shutdowns (bz 222001)
  - Eliminate memory leak in mountd (bz 239536)
  - Make sure statd uses correct uid/gid by chowning
    the /var/lib/nfs/statd with the rpcuser id. (bz 235216)
  - Correct some sanity checking in rpc.nfsd. (bz 220887) 
  - Added missing unlock_mtab() call in moutnd
  - Have mountd hold open etab file to force inode number to change (bz 236823)
  - Create a /etc/sysconfig/nfs with all the possible init script
    variables (bz 234543)
  - Changed nfs initscript to exit with correct value (bz 221874)


author: Steve Dickson <steved@redhat.com> 1.0.10-6
changelog:
  - Make sure the condrestarts exit with a zero value (bz 240225)
  - Stopped /etc/sysconfig/nfs from being overwritten on updates (bz 234543)
  - Added -o nordirplus mount option to disable READDIRPLUS (bz 240357)
  - Disabled the FSCache patch, for now...


author: Steve Dickson <steved@redhat.com> 1.1.0-4
changelog:
  - Make sure the open() system calling in exportfs uses
    mode bits when creating the etab file (bz 252440).


author: Steve Dickson <steved@redhat.com> 1.1.0-5
changelog:
  - Changed the default paths in sm-notify to 
    /var/lib/nfs/statd (bz 258461)
  - Updated exportfs manpage (bz 262861)


author: Steve Dickson <steved@redhat.com> 1.1.1-1
changelog:
  - Updated to latest upstream release, nfs-utils-1.1.1
  - Added the removal of sm-notify.pid to nfslock init script.
  - Changed spec file to use condrestart instead of condstop
    when calling init scripts.
  - Fixed typo in rpc.mountd man page 
  - Turn on 'nohide' automatically for all refer exports (bz 313561)


author: Steve Dickson <steved@redhat.com> 1.1.1-2
changelog:
  - Added -S/--since to the nfsstat(1) manpage
  - The wording in the exportfs man page can be a bit confusing, implying
    that "exportfs -u :/foo" will unexport /foo from all hosts, which it won't
  - Removed nfsprog option since the kernel no longer supports it.
  - Removed mountprog option since the kernel no longer supports it.
  - Stop segfaults on amd64 during warnings messages.
  - Fix bug when both crossmnt and fsid are set.


author: Steve Dickson <steved@redhat.com> 1.1.1-3
changelog:
  - Added in relatime mount option so mount.nfs stays
    compatible with the mount command in util-linux-ng (bz 274301)


author: Steve Dickson <steved@redhat.com> 1.1.1-5
changelog:
  - Stopped mountd from incorrectly logging an error
    (commit 9dd9b68c4c44f0d9102eb85ee2fa36a8b7f638e3)
  - Stop gssd from ignoring the machine credential caches
    (commit 46d439b17f22216ce8f9257a982c6ade5d1c5931)
  - Fixed typo in the nfsstat command line arugments.
    (commit acf95d32a44fd8357c24e8a04ec53fc6900bfc58)
  - Added test to stop buffer overflow in idmapd
    (commit bcd0fcaf0966c546da5043be700587f73174ae25)


author: Steve Dickson <steved@redhat.com> 1.1.2-3
changelog:
  - Documented how to turn off/on protocol support for
    rpc.nfsd in /etc/sysconfig/nfs (bz443625)
  - Corrected the nfslock initscript 'status' return code (bz 441605)
  - Removed obsolete code from the nfslock initscript (bz 441604)


author: Steve Dickson <steved@redhat.com> 1.1.2-7
changelog:
  - Added -D_FILE_OFFSET_BITS=64 to CFLAGS
  - make nfsstat read and print stats as unsigned integers
  - Added (but not installed) the mountstats and nfs-iostat
    python scripts.


author: Steve Dickson <steved@redhat.com> 1.1.2-12
changelog:
  - Changed the default directories for sm-notify (bz 435480)
  - Added 'condstop' to init scripts so service are not
    started when nfs-utils is removed.


author: Steve Dickson <steved@redhat.com> 1.1.3-5
changelog:
  - Reworked init scripts so service will be able to
    stop when some of the checks fail. (bz 462508)
  - Pre-load nfsd when args to rpc.nfsd are given (bz 441983)


author: Steve Dickson <steved@redhat.com> 1.1.4-4
changelog:
  - gssd: unblock DNOTIFY_SIGNAL in case it was blocked
  - Ensure statd gets started if required when non-root
    user mounts an NFS filesystem


author: Steve Dickson <steved@redhat.com> 1.1.4-5
changelog:
  - Make sure /proc/fs/nfsd exists when the nfs init script
    does the exports (bz 473396)
  - Fixed typo in nfs init script that caused rpc.rquotad daemons
    to be started but not stoppped (bz 473929)


author: Steve Dickson <steved@redhat.com> 1.1.4-6
changelog:
  - mount command: remove local getport() implementation
  - mount command: Replace clnt_ping() and getport() calls in probe_port()
  - mount command: Use nfs_error() instead of perror()
  - mount command: Use nfs_pmap_getport() in probe_statd()


author: Steve Dickson <steved@redhat.com> 1.1.4-8
changelog:
  - mount command: AF_INET6 support for probe_bothports()
  - mount command: support AF_INET6 in probe_nfsport() and probe_mntport()
  - mount command: full support for AF_INET6 addresses in probe_port()
  - gssd/svcgssd: add support to retrieve actual context expiration
  - svcgssd: use the actual context expiration for cache


author: Steve Dickson <steved@redhat.com> 1.1.4-9
changelog:
  - text-based mount command: add function to parse numeric mount options
  - text-based mount command: use po_get_numeric() for handling retry
  - sm-notify command: fix a use-after-free bug
  - statd: not unlinking host files


author: Steve Dickson <steved@redhat.com> 1.1.4-11
changelog:
  - Added warnings to tcp wrapper code when mounts are 
    denied due to misconfigured DNS configurations.
  - gssd: By default, don't spam syslog when users' credentials expire
  - mount: revert recent fix for build problems on old systems
  - mount: use gethostbyname(3) when building on old systems
  - mount: getport: don't use getaddrinfo(3) on old systems
  - mount: Random clean up
  - configure: use "--disable-uuid" instead of	"--without-uuid"


author: Steve Dickson <steved@redhat.com> 1.1.4-12
changelog:
  - configure: Remove inet_ntop(3) check from configure.ac
  - configure: Add new build option "--enable-tirpc"
  - showmount command: Quiesce warning when TI-RPC is disabled


author: Steve Dickson <steved@redhat.com> 1.1.4-14
changelog:
  - text-based mount command: make po_rightmost() work for N options
  - text-based mount command: Function to stuff "struct pmap" from mount options
  - text-based mount options: Use new pmap stuffer when	rewriting mount options
  - text-based mount command: fix mount option rewriting logic
  - text-based mount command: support AF_INET6 in rewrite_mount_options()


author: Steve Dickson <steved@redhat.com> 1.1.4-15
changelog:
  - Reworked tcp wrapper code to correctly use API (bz 480223)
  - General clean up of tcp wrapper code.


author: Steve Dickson <steved@redhat.com> 1.1.4-18
changelog:
  - umount.nfs command: Add an AF_INET6-capable version of nfs_call_unmount()
  - umount.nfs command: Support AF_INET6 server addresses
  - umount command: remove do_nfs_umount23 function


author: Steve Dickson <steved@redhat.com> 1.1.5-2
changelog:
  - Fixed lockd not using settings in sysconfig/nfs (bz 461043)
  - Fixed some lost externs in the tcpwrapper code


author: Steve Dickson <steved@redhat.com> 1.1.5-4
changelog:
  - Added upstream rc3 patch
    - gssd: initialize fakeseed in prepare_krb5_rfc1964_buffer
    - gssd: NULL-terminate buffer after read in read_service_info (try #2)
    - gssd: free buffer allocated by gssd_k5_err_msg
    - gssd: fix potential double-frees in gssd
    - Removed a number of warn_unused_result warnings


author: Steve Dickson <steved@redhat.com> 1.1.6-3
changelog:
  - Added upstream 1.1.7-rc1 patch 
    - utils/nfsd: add support for minorvers4
    - sm-notify: Don't orphan addrinfo structs
    - sm-notify: Failed DNS lookups should be retried
    - mount: remove legacy version of nfs_name_to_address()
    - compiling error in rpcgen
    - nfs-utils: Fix IPv6 support in support/nfs/rpc_socket.c
    - umount.nfs: Harden umount.nfs error reportin


author: Steve Dickson <steved@redhat.com> 1.2.0-4
changelog:
  - Added upstream 1.2.1-rc1 patch 
    - Fix to check in closeall()
    - Make --enable-tirpc the default
    - Set all verbose types in gssd daemons
    - Retry exports if getfh() fails


author: Steve Dickson <steved@redhat.com> 1.2.0-6
changelog:
  - Added NFSD v4 dynamic pseudo root patch which allows
    NFS v3 exports to be mounted by v4 clients.


author: Steve Dickson <steved@redhat.com> 1.2.0-9
changelog:
  - Added upstream 1.2.1-rc3 patch
    - Add IPv6 support to nfsd
    - Allow nfssvc_setfds to properly deal with AF_INET6
    - Convert nfssvc_setfds to use getaddrinfo
    - Move check for active knfsd to helper function
    - Declare a static common buffer for nfssvc.c routine
    - Convert rpc.nfsd to use xlog() and add --debug and --syslog options


author: Steve Dickson <steved@redhat.com> 1.2.0-10
changelog:
  - Added upstream 1.2.1-rc4 patch
    - Fix bug when both crossmnt
    - nfs(5): Add description of lookupcache mount option
    - nfs(5): Remove trailing blanks
    - Added nfs41 support to nfssat
    - Added support for mount to us a configuration file.


author: Steve Dickson <steved@redhat.com> 1.2.0-11
changelog:
  - Added upstream 1.2.1-rc5 patch
    - Added --sort --list functionality to nfs-iostat.py
    - Fixed event handler in idmapd
    - Added -o v4 support
    - Disabled IPv6 support in nfsd
    - Don't give client an empty flavor list
    - Fixed gssed so it does not blindly caches machine credentials


author: Steve Dickson <steved@redhat.com> 1.2.0-13
changelog:
  - Added upstream 1.2.1-rc5 patch
    - mount.nfs: Support negotiation between v4, v3, and v2
    - mount.nfs: Keep server's address in nfsmount_info
    - mount.nfs: Sandbox each mount attempt
    - mount.nfs: Support negotiation between v4, v3, and v2


author: Steve Dickson <steved@redhat.com> 1.2.0-14
changelog:
  - Change the nfsmount.conf file to define v3 as the default 
    protocol version.
  - Make sure versions set on the command line override version
    set in nfsmount.conf
  - Make version rollbacks still work when versions are set in
    nfsmount.conf


author: Steve Dickson <steved@redhat.com> 1.2.0-17
changelog:
  - Updated to the latest pseudo root release (rel7).
  - Added upstream 1.2.1-rc7 patch which fixes:
     - Stop ignoring the -o v4 option (bz 529407)
     - Allow network protocol roll backs when proto is set
        in the config file (bz 529864)


author: Steve Dickson <steved@redhat.com> 1.2.1-1
changelog:
  - Updated to latest upstream release 1.2.1
  - Updated to the latest pseudo root release (rel8).
  - Stop rpc.nfsd from failing to startup when the network
    is down (bz 532270)


author: Steve Dickson <steved@redhat.com> 1.2.1-3
changelog:
  - Updated to the latest pseudo root release (rel9).
  - mount.nfs: Retry v4 mounts with v3 on ENOENT error


author: Steve Dickson <steved@redhat.com> 1.2.1-4
changelog:
  - Updated to latest upstream RC release: nfs-utils-1-2-2-rc6
    which fixes bz(479362) and contains the upstream pseudo 
    root release.


author: Steve Dickson <steved@redhat.com> 1.2.1-5
changelog:
  - Updated to latest upstream RC release: nfs-utils-1-2-2-rc7
    which includes Ipv6 support for statd (disabled by default).


author: Steve Dickson <steved@redhat.com> 1.2.1-6
changelog:
  - Updated to latest upstream RC release: nfs-utils-1-2-2-rc8
    which includes Ipv6 support for tcpwrapper (disabled by default).


author: Steve Dickson <steved@redhat.com> 1.2.1-7
changelog:
  - mount.nfs: Configuration file parser ignoring options
  - mount.nfs: Set the default family for lookups based on 
      defaultproto= setting
  - Enabled ipv6  (bz 556484)


author: Steve Dickson <steved@redhat.com> 1.2.2-3
changelog:
  - Allow mountd to not listen for RPC calls when v2/v3 disabled (bz 538922)
  - Added portmap to init script dependencies (bz 583007)
  - Added in the mount.nfs4 and umount.nfs4 man pages (bz 528951)
  - Did some initscripts improvement (bz 596095)
  - Added error message for an invaild mount option value (bz 588886)
  - Added error message for an invaild proto option value (bz 588879)


author: Steve Dickson <steved@redhat.com> 1.2.2-5
changelog:
  - Removed the inconsistent default anonuid/anongid values. (bz 566888)
  - Created the rpcuser group (bz 594206)


author: Steve Dickson <steved@redhat.com> 1.2.3-1
changelog:
  - Initscripts changes needed to support NFS over RDMA (bz 631012)
  - Initscripts changes needed for NFS to shutdown cleanly (bz 636513)
  - Initscripts changes needed for rpcbind to be running 
    when nfs is started (bz 641291)


author: Steve Dickson <steved@redhat.com> 1.2.3-6
changelog:
  - Added support for AD style kerberos to rpc.gssd (bz 671474)
  - Disabled the installing of the nfsidmap command


author: Steve Dickson <steved@redhat.com> 1.2.3-8
changelog:
  - initscripts: just try to mount rpc_pipefs always (bz 692702) 
  - Rely on crypto module autoloading in init scripts
  - svcgssd: Document "-n" for svcgssd (bz 697359)
  - mount.nfs: anticipate RLIMIT_FSIZE (bz 697981)
  - exportfs manpage: Ipv6 update (bz 715078)
  - mountd: Stop segfault in mtab code (bz 723438)
  - exportfs: wilcards in exports can lead to unintended mounts (bz 715391)
  - umount: allow spaces in unmount paths (bz 702273)
  - specfile: reordered how libgssglue is linked in (bz 720479)


author: Steve Dickson <steved@redhat.com> 1.2.3-9
changelog:
  - umount.nfs: Got IPV6 unmounts working again (bz 732673)
  - mountd: return multiple hosts exporting the same directory (bz 726112) 
  - mount: Better error message for invalid version (bz 723780)


author: Steve Dickson <steved@redhat.com> 1.2.3-15
changelog:
  - mout.nfs: Don't roll back to IPv4 whe IPv6 fails (bz 744657)
  - rpcdebug: Added pNFS and FSCache debugging (bz 747400)


author: Steve Dickson <steved@redhat.com> 1.2.3-16
changelog:
  - Enable the keyring based idmapping (bz 772496)
  - Correct nfs(5) man page on how TCP retries are done (bz 737990)
  - Fixed sigio problem in rpc.idmapd (bz 751089)
  - Only link in libtirpc to binaries that need it (bz 772050)
  - Increase the stdio file buffer size for procfs files (bz 736741)
  - Fixed gssd from picking the wrong creds (bz 738774)
  - Mounts fail with using -o bg,vers= options (bz 740472)


author: Steve Dickson <steved@redhat.com> 1.2.3-17
changelog:
  - Used correct locking file in nfs.init script (bz 772543)
  - Create a locking file for rpc.rquotad (bz 766472)
  - Normalized umount paths (bz 758000)
  - Fixed parsing error in nfsmount.conf code (bz 754666)


author: Steve Dickson <steved@redhat.com> 1.2.3-18
changelog:
  - Fixed nfs initscript to handle reloads correctly (bz 784022)
  - Add support for umlauts in group names in idmapper (bz 772619)
  - Stoppped racing exportfs in clusters (bz 800335)


author: Steve Dickson <steved@redhat.com> 1.2.3-19
changelog:
  - Fixed decode group names with spaces in idmapd (bz 787970)
  - Remove two unused gss commands (bz 738932)


author: Steve Dickson <steved@redhat.com> 1.2.3-22
changelog:
  - NFS initscript needs to do a rpcidmapd condrestart not a condstart (bz 809201)
  - Allow v2|v3 background mounts to retry when server is down (bz 740472) 
  - Fix the umounting of symbolic links (bz 801085)


author: Steve Dickson <steved@redhat.com> 1.2.3-26
changelog:
  - Fixed typo in the checking of nfsnobody (bz 816149)
  - Fixed the exporting of subdirectories (bz 816162)


author: Steve Dickson <steved@redhat.com> 1.2.3-29
changelog:
  - V4 mounts hang on exports to netgroups (bz 815673)
  - Strip the '[]' off of ipv6 addresses (bz 811882)
  - Removed a use_ipaddr race in mountd (bz 797209)


author: Steve Dickson <steved@redhat.com> 1.2.3-30
changelog:
  - gssd: Don't link with libgssapi_krb5 (bz 784909)
  - Fix referrals that use IPv6 addresses (bz 820737)
  - Add -l option to gssd to force legacy behaviour (bz 802469)
  - Add support to svcgssd to limit the negotiated enctypes (bz 802469)
  - Changed nfs.init to allow umounts to happen cleanly during 
    system shutdown (bz 856923)


author: Steve Dickson <steved@redhat.com> 1.2.3-34
changelog:
  - Update the default encryption types in svcgssd (bz 877636)
  - Added the -v 4.1 mount option (bz 877052)


author: Steve Dickson <steved@redhat.com> 1.2.3-35
changelog:
  - Fixed a regession in mountd that cause a localhost mounts to hang (bz 797209)
  - Make sure mount tries all the addresses returned by getaddrinfo (bz 876847)


author: Steve Dickson <steved@redhat.com> 1.2.3-38
changelog:
  - Fixed typo in nfsstat's output (bz 890146)
  - Fixed retrans defaults in nfs(5) man page (bz 952560)
  - Clean rpc.idmapd messages when nfsd starts (bz 892235)
  - Fixed sm-notify to work with localhost (bz 950324)
  - Fixed pNFS stats (bz 962602)
  - Remove no_acl from exports(5) man page (bz 991302)
  - Improve nfsmount.conf configuration parsing (bz 889272)
  - Fixed sm-notify -v (bz 995484)


author: Steve Dickson <steved@redhat.com> 1.2.3-42
changelog:
  - gssd: Added GSS_contest lifetime to the kernel (bz 1081208)
  - rpc.idmapd: Ignore open failures in dirscancb() (bz 1040135)
  - gssd: always reply to rpc-pipe requests from kernel (bz 1070927)


author: Steve Dickson <steved@redhat.com> 1.2.3-44
changelog:
  - Allow -o remounts to work (bz 1079047)
  - Put state flag in rpcdebug (bz 1087878)
  - Added more options to nfsmount.conf (bz 918319)
  - Fixed error reporting in nfsidmap (bz 1061505)
  - Fixed socket binding loop in rpc.statd (bz 1075224)


author: Steve Dickson <steved@redhat.com> 1.2.3-45
changelog:
  - Smothed out upgrads from rhel6 to rhel7 (bz 1086625)
  - rpc.statd: Bind downcall socket to loopback address (bz 1018358)
  - nfsiostat: periodically flush stdout (bz 1007195)
  - Fixed a buffer overflow in exportfs (bz 1008381)


author: Steve Dickson <steved@redhat.com> 1.2.3-47
changelog:
  - Stop Treat IP addresses a FQDN rather than SUBNETs. (bz 1098592)
  - Removed the local_lock not supported line in man page (bz 1017477)


author: Steve Dickson <steved@redhat.com> 1.2.3-50
changelog:
  - gssd: Drop full domain when constructing the Ad hostname (bz 1067423)
  - Explained nfsiostat output in man page (bz 869684)
  - mountd.man: Added missing arguments in man page (bz 1003555)


author: Steve Dickson <steved@redhat.com> 1.2.3-53
changelog:
  - gssd: Error out when rpc_pipefs directory is empty (bz 1116698)
  - exportfs: Removed a warning from exportfs.c (bz 1133562)
  - nfsiostat: Corrected the cache hits (bz 1066314)
  - mountd: optimize libblkid usage (bz 1113204)


author: Steve Dickson <steved@redhat.com> 1.2.3-55
changelog:
  - Fixed typo in exports manpage  (bz 1152554)
  - mountd need to ignore vroots on v3 mounts (bz 1164317)
  - Added support for /etc/exports.d (bz 1123099)
  - Print error message on remount failures (bz 1026446)
  - Update mountstats to upstream version (bz 1172827)


author: Steve Dickson <steved@redhat.com> 1.2.3-56
changelog:
  - Fixed return values in mountstats (bz 1172827)
  - mountstats: Normalize the mountpoints passed on the command line (bz 1007281)


author: Steve Dickson <steved@redhat.com> 1.2.3-58
changelog:
  - Fixed pseudo exports without security flavors  (bz 1187277)
  - Made the posttrans conditional (bz 1078829)


author: Steve Dickson <steved@redhat.com> 1.2.3-60
changelog:
  - Remove SPKM-3 support from gssd (bz 1187277)
  - Enable all auth flavors on pseudofs exports (bz 1187277)


author: Steve Dickson <steved@redhat.com> 1.2.3-65
changelog:
  - nfsidmap: make sure give arguments are valid (bz 1230600)
  - nfsidmap: Display the effective NFSv4 domain name (bz 948680)
  - gssd: allow gssd and svcgssd to set the libtirpc debug level (bz 1273161)
  - gssd: select non-conventional principal (bz 1268031)
  - gssd:  Don't assume the machine account will be in uppercase (bz 1273166)
  - sm-notify: delete files in sm.bak after a NOTIFY reply (bz 1278921)


author: Steve Dickson <steved@redhat.com> 1.2.3-66
changelog:
  - svc_create: Make sure errors are logged (bz 1156647)
  - gssd: suppress error message if rpc_pipefs dir disappears (bz 1220156)
  - gssd: set $HOME to prevent recursion (bz 1223661)
  - statd: Update existing record if we receive SM_MON... (bz 1280024)
  - mountstats.man: fixed typo in man page (bz 1263968)


author: Steve Dickson <steved@redhat.com> 1.2.3-67
changelog:
  - mount.nfs: Fix fallback from tcp to udp (bz 1287894)
  - exportfs: escape path for function test_export (bz 735696)
  - nfs-utils.spec: No verification on runtime configuration files (bz 1118176)
  - idmapd: added usage statement (bz 1001439)
  - mountd: fix netgroup lookup for short hostnames (bz 1231998)
  - mountd: fix bug affecting exports of dirs with 64bit inode number (bz 994564)


author: Christopher Aillon <caillon@redhat.com> 3.11-0.cvs
changelog:
  - Initial import into Fedora Core, based on a CVS snapshot of
    the NSS_3_11_RTM tag
  - Fix up the pkcs11-devel subpackage to contain the proper headers
  - Build with RPM_OPT_FLAGS
  - No need to have rpath of /usr/lib in the pc file


author: Kai Engert <kengert@redhat.com> - 3.11.3-2
changelog:
  - Revert the attempt to require latest NSPR, as it is not yet available
    in the build infrastructure.


author: Kai Engert <kengert@redhat.com> - 3.11.5-1
changelog:
  - Update to 3.11.5
  - This update fixes two security vulnerabilities with SSL 2
  - Do not use -rpath link option
  - Added several unsupported tools to tools package


author: Kai Engert <kengert@redhat.com> - 3.11.5-2
changelog:
  - Fix rhbz#230545, failure to enable FIPS mode
  - Fix rhbz#220542, make NSS more tolerant of resets when in the 
    middle of prompting for a user password.


author: Kai Engert <kengert@redhat.com> - 3.11.7-2
changelog:
  - Update to 3.11.7, but freebl/softokn remain at 3.11.5.
  - Use a workaround to avoid mozilla bug 51429.


author: Kai Engert <kengert@redhat.com> - 3.11.7-10
changelog:
  - Add /etc/prelink.conf.d/nss-prelink.conf in order to blacklist
    our signed libraries and protect them from modification.


author: Kai Engert <kengert@redhat.com> - 3.11.99.3-2
changelog:
  - Build against gcc 4.3.0, use workaround for bug 432146
  - Run the test suite after the build and abort on failures.


author: Kai Engert <kengert@redhat.com> - 3.12.0.3-3
changelog:
  - nss package should own /etc/prelink.conf.d folder, rhbz#452062
  - use upstream patch to fix test suite abort


author: Kai Engert <kaie@redhat.com> - 3.12.3-3
changelog:
  - ship .chk files instead of running shlibsign at install time
  - include .chk file in softokn-freebl subpackage
  - add patch for upstream nss bug 488350


author: Kai Engert <kaie@redhat.com> - 3.12.3-7
changelog:
  - re-enable test suite
  - add patch for upstream bug 488646 and add newer paypal
    certs in order to make the test suite pass


author: Elio Maldonado <emaldona@redhat.com> - 3.12.3.99.3-5
changelog:
  - updated pem module incorporates various patches
  - fix off-by-one error when computing size to reduce memory leak. (483855)
  - fix data type to work on x86_64 systems. (429175)
  - fix various memory leaks and free internal objects on module unload. (501080)
  - fix to not clone internal objects in collect_objects().  (501118)
  - fix to not bypass initialization if module arguments are omitted. (501058)
  - fix numerous gcc warnings. (500815)
  - fix to support arbitrarily long password while loading a private key. (500180) 
  - fix memory leak in make_key and memory leaks and return values in pem_mdSession_Login (501191)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.3.99.3-10
changelog:
  - must install libnssutil3.since nss-util is untagged at the moment
  - preserve time stamps when installing various files


author: Elio Maldonado+emaldona@redhat.com - 3.12.3.99.3-11
changelog:
  - split off nss-softokn and nss-util as subpackages with their own rpms
  - first phase of splitting nss-softokn and nss-util as their own packages


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-19
changelog:
  - remove patches that are now in nss-softokn and
  - remove spurious exec-permissions for nss.pc per rpmlint
  - single requires line in nss.pc.in


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-22
changelog:
  - Fix nss-config not to include nssutil
  - Add BuildRequires on nss-softokn and nss-util since build also runs the test suite


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-25
changelog:
  - Remove nss-prelink.conf as signed all shared libraries moved to nss-softokn
  - Add a temprary hack to nss.pc.in to unblock builds


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-29
changelog:
  - Restoring patches 2 and 7 as we still compile all sources
  - Applying the nss-nolocalsql.patch solves nss-tools sqlite dependency problems


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-30
changelog:
  - Fix FORTIFY_SOURCE buffer overflows in test suite on ppc and ppc64 - bug 519766
  - Fixed requires and buildrequires as per recommendations in spec file review


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-2
changelog:
  - Remove symbolic links to shared libraries from devel - 521155
  - No rpath-link in nss-softokn-config


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-3
changelog:
  - PEM module implements memory management for internal objects - 509705
  - PEM module doesn't crash when processing malformed key files - 512019


author: Elio Maldonado<emaldona@redhat.com - 3.12.4-9
changelog:
  - Install blank databases and configuration file for system shared database
  - nsssysinit queries system for fips mode before relying on environment variable


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-14
changelog:
  - Fix bug where user was prompted for a password when listing keys on an empty system database (#527048)
  - Fix setup-nsssysinit to handle more general flags formats (#527051)


author: Elio Maldonado<emaldona@redhat.com> - 3.12.5-1.8
changelog:
  - Fix nsssysinit to set the default flags on the crypto module (#545779)
  - Fix nsssysinit to enable apps to use the system cert store, patch contributed by David Woodhouse (#546221)
  - Fix segmentation fault when listing keys or certs in the database, patch contributed by Kamil Dudka (#540387)
  - Sysinit requires coreutils for post install scriplet (#547067)
  - Remove redundant header from the pem module


author: Elio Maldonado <emaldona@redhat.com> - 3.12.5-7.1
changelog:
  - Updated to 3.12.5 from CVS import from Fedora 12
  - Moved blank legacy databases to the lookaside cache
  - Reenabled the full test suite
  - Retagging for a RHEL-6-test-build


author: Elio Maldonado <emaldona@redhat.com> - 3.12.5-7.3
changelog:
  - Resolves: #551784 rebuilt after nss-softokn and nss-util builds
  - this will generate the coorect nss.spec


author: Elio Maldonado <emaldona@redhat.com> - 3.12.6-5
changelog:
  - Appying the changes in previous log
  - Changing some BuildRequires to >= as well
  - Temporarily disabling all tests for faster builds


author: Elio Maldonado <emaldona@redhat.com> - 3.12.8-2
changelog:
  - Add suppport for pkcs8 formatted keys in the pem module
  - Add verify(not md5 size mtime) to configuration files attributes
  - Prevent nss-sysinit disabling on package upgrade
  - Create pkcs11.txt with correct permissions regardless of current umask
  - Add option to setup-nsssysinit.sh to report nss-sysinit status
  - Update test certificate which had expired


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-2
changelog:
  - Prefer user database ca cert trust settings system's ones
  - Swap internal key slot on fips mode switches


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-3
changelog:
  - Add requires for pkcs11-devel on nss-softokn-freebl devel
  - Run the test suites in check section per packaging guidelines


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-7
changelog:
  - Update expired PayPayEE.cert test certificate
  - Conditionalize some database tests on user not being root


author: Elio Maldonado <emaldona@redhat.com> - 3.13.1-1
changelog:
  - Resolves: Bug 744070 - Update to 3.13.1
  - Resolves: Bug 784674 - nss should protect against being called before nss_Init
  - Resolves: Bug 784490 - CVE-2011-3389 HTTPS: block-wise chosen-plaintext attack against SSL/TLS (BEAST)


author: Elio Maldonado <emaldona@redhat.com> - 3.13.1-4
changelog:
  - Add two needed patches
  - Resolves: rhbz#783315 - Need nss workaround for freebl bug that causes openswan to drop connections
  - Resolves: rhbz#747387 - Unable to contact LDAP Server during winsync


author: Elio Maldonado <emaldona@redhat.com> - 3.13.3-1
changelog:
  - Update to 3.13.3
  - Resolves: rhbz#798539 - Distrust MITM subCAs issued by TrustWave
  - Remove builtins-nssckbi_1_88_rtm.patch which the rebase obsoletes


author: Elio Maldonado <emaldona@redhat.com> - 3.13.3-2
changelog:
  - Resolves: rhbz#746632 - pem_CreateObject mem leak on non existing file name
  - Resolves: rhbz#768669 - PEM unregistered callback causes SIGSEGV


author: Elio Maldonado <emaldona@redhat.com> - 3.13.3-3
changelog:
  - Resolves: rhbz#746632 - pem_CreateObject mem leak on non existing file name
  - Use completed patch per code review


author: Elio Maldonado <emaldona@redhat.com> - 3.14.0.0-1
changelog:
  - Rebase to nss-3.14.0.0-1
  - Resolves: rhbz#837089
  - Update ssl-cbc-random-iv patch for new sources
  - Remove patches rendered obsoleted by rebase to 3.14
  - Add a patch to enforce no pkcs11 bypass


author: Elio Maldonado <emaldona@redhat.com> - 3.14.0.0-7
changelog:
  - Add dummy sources file to test for and prevent breaking rhpkg commands
  - Enable testing for 'rhpk upload' and 'rhpk new-sources' breakage such as hangs
  - Related: rhbz#837089


author: Elio Maldonado <emaldona@redhat.com> - 3.14.0.0-8
changelog:
  - PEM peminit returns CKR_CANT_LOCK when needed to inform caller module isn't thread safe
  - Resolves: rhbz#555019 - [PEM] invalid writes in multi-threaded libcurl based application


author: Elio Maldonado <emaldona@redhat.com> - 3.14.0.0-9
changelog:
  - Fix locking issue causing curl hangs and authenticate to the correct session
  - Resolves: rhbz#872838


author: Elio Maldonado <emaldona@redhat.com> - 3.14.0.0-12
changelog:
  - Recreate the distrust patch by backporting the upstream one
  - Resolves: rhpbz#890914 - Dis-trust TURKTRUST mis-issued *.google.com certificate


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-1
changelog:
  - Update to NSS_3.14.3_RTM
  - Resolves: rhbz#918950 - [RFE][RHEL6] Rebase to nss-3.14.3 to fix the lucky-13 issue
  - Update expired test certificates (fixed in upstream bug 852781)
  - Sync up pem module's rsawrapr.c with softoken's upstream changes for nss-3.14.3
  - Reactivate the aia tests


author: Elio Maldonado - 3.14.3-2
changelog:
  - Install sechash.h and secmodt.h which are now provided by nss-devel
  - Resolves: rhbz#918950 - [RFE][RHEL6] Rebase to nss-3.14.3 to fix the lucky-13 issue
  - Remove unsafe -r option from commands that remove headers already shipped by nss-util and nss-softoken


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-3
changelog:
  - Ensure pem uses system freebl as with this update freebl brings in new API's
  - Resolves: rhbz#918950 - [RFE][RHEL6] Rebase to nss-3.14.3 to fix the lucky-13 issue


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-4
changelog:
  - Revert to accepting MD5 on digital signatures by default
  - Resolves: rhbz#918136 - nss 3.14 - MD5 hash algorithm disabled


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-5
changelog:
  - Syncup with uptream changes for aes gcm and ecc suiteb
  - Enable ecc support for suite b
  - Apply several upstream AES GCM fixes
  - Use the pristine nss upstream sources with ecc included
  - Export NSS_ENABLE_ECC=1 in both the build and the check sections
  - Make failed requests for unsupoprted ssl pkcs 11 bypass non fatal
  - Resolves: rhbz#882408 - NSS_NO_PKCS11_BYPASS must preserve ABI
  - Related:  rhbz#918950  - rebase nss to 3.14.3


author: Kai Engert <kaie@redhat.com> - 3.14.3-33
changelog:
  - Configure libnssckbi.so to use the alternatives system
    in order to prepare for a drop in replacement.
    Please ensure that older packages that don't use the alternatives
    system for libnssckbi.so have a smaller n-v-r.


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-34
changelog:
  - Fix race condition in cert code related to smart cards
  - Resolves: rhbz#903017 - Firefox hang when CAC/PIV smart card certificates are viewed in the certificate manager


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-37
changelog:
  - Do not hold issuer certificate handles in the crl cache
  - Resolves: rhbz#961659 - SQL backend does not reload certificates


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-1
changelog:
  - Rebase to NSS_3.15.1_RTM
  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for FF 24.x) 
  - Update patches on account of the shallow tree with the rebase to 3.15.1
  - Update the pem module sources  nss-pem-20130405.tar.bz2 with latest patches applied
  - Remove patches rendered obsolete by the nss rebase and the updated nss-pem sources
  - Enable the iquote.patch to access newly introduced types


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-2
changelog:
  - Fix relative path in %check section to prevent undetected test failures
  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for FF 24.x)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-4
changelog:
  - Require nss-softokn-fips
  - Resolves: rhbz#993441 - NSS needs to conform to new FIPS standard. [rhel-6.5.0]


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-5
changelog:
  - Disable the cipher suite already run as part of the nss-softokn build
  - Resolves: rhbz#993441 - NSS needs to conform to new FIPS standard. [rhel-6.5.0]


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-6
changelog:
  - Fix all.sh test for which application was last build by updating nss-versus-softoken-test.path
  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for FF 24.x)


author: Kai Engert <kaie@redhat.com> - 3.15.1-7
changelog:
  - Additional syntax fixes in nss-versus-softoken-test.patch
  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for FF 24.x)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-8
changelog:
  - Don't require nss-softokn-fips
  - Resolves: rhbz#993441 - NSS needs to conform to new FIPS standard. [rhel-6.5.0]


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-9
changelog:
  - Rebuild for the pem module to link with freel from nss-softokn-3.14.3-6.el6
  - Related: rhbz#993441 - NSS needs to conform to new FIPS standard. [rhel-6.5.0]
  - Related: rhbz#1010224 - NSS 3.15 breaks SSL in OpenLDAP clients


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-10
changelog:
  - Restore a mistakenly removed patch
  - Resolves: rhbz#961659 - SQL backend does not reload certificates


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-11
changelog:
  - Fix the test for zero failures in the %check section
  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for FF 24.x)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-12
changelog:
  - Add a zero default value to the DISABLETEST and TEST_FAILURES checks
  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for FF 24.x)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-13
changelog:
  - Add zero default value to DISABLETEST check and fix the TEST_FAILURES check and reporting
  - Resolves: rhbz#990631 - file permissions of pkcs11.txt/secmod.db must be kept when modified by NSS
  - Related: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for FF 24.x)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-14
changelog:
  - Add s390x and ia64 to the %define multilib_arches list used for defining alt_ckbi
  - Resolves: rhbz#1016044 - nss.s390: primary link for libnssckbi.so must be /usr/lib64/libnssckbi.so


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-15
changelog:
  - Using export NSS_DISABLE_HW_GCM=1 to deal with some problemmatic build systems
  - Resolves: rhbz#1016044 - nss.s390: primary link for libnssckbi.so must be /usr/lib64/libnssckbi.so


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-1
changelog:
  - Update to NSS_3_15_3_RTM
  - Resolves: Bug 1032472 - CVE-2013-5605 CVE-2013-5606 CVE-2013-1741
  - Resolves: Bug 1031238 - deadlock in trust domain lock and object lock


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-2
changelog:
  - Build nss without softoken, freebl, or util sources in the build source tree
  - Resolves: Bug 1032472 - CVE-2013-5605 CVE-2013-5606 CVE-2013-1741


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-3
changelog:
  - Disable hw gcm on rhel-5 based build environments where OS lacks support
  - Rollback changes to build nss without softokn until Bug 689919 is approved
  - Cipher suite was run as part of the nss-softokn build


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-4
changelog:
  - Revoke trust in one mis-issued anssi certificate
  - Resolves: Bug 1042686 - nss: Mis-issued ANSSI/DCSSI certificate (MFSA 2013-117) [rhel-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-5
changelog:
  - Resolves: Bug 895339 - [PEM] active FTPS with encrypted client key ends up with SSL_ERROR_TOKEN_INSERTION_REMOVAL


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-6
changelog:
  - make derEncodingsMatch work with encrypted keys
  - rename a patch, dropped the experimental moniker from it
  - Resolves: Bug 895339 - [PEM] active FTPS with encrypted client key ends up with SSL_ERROR_TOKEN_INSERTION_REMOVAL


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-7
changelog:
  - Fix the numbering and naming of the patches
  - Resolves: Bug 895339 - [PEM] active FTPS with encrypted client key ends up with SSL_ERROR_TOKEN_INSERTION_REMOVAL


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-8
changelog:
  - Install man pages for the nss security tools
  - Resolves: Bug 606022 - nss security tools lack man pages


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-9
changelog:
  - Improve support for ECDSA algorithm via pluggable ECC
  - Document the purpose of the iquote.patch
  - Resolves: Bug 1057224 - Pluggable ECC in NSS not enabled on RHEL 6 and above


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-10
changelog:
  - Prevent users from disabling the internal crypto module
  - Resolves: Bug 1059176 - nss segfaults with opencryptoki module


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-11
changelog:
  - Resolves: Bug 689919 - build without any softoken or util sources in the tree
  - Add define-uint32.patch to deal with using older version of nss-softokn
  - Fix suboptimal test failure detection shell code in the %check
  unset DISPLAY
   section


author: Elio Maldonado <emaldona@redhat.com> - 3.16.1-2
changelog:
  - Restore use of indentation patch until another bug is resolved
  - Resolves: Bug 606022 - nss security tools lack man pages


author: Elio Maldonado <emaldona@redhat.com> - 3.16.1-3
changelog:
  - Fix pem module trashing of private keys on failed login
  - Resolves: Bug 1002205 - PEM module trashes private keys if login fails


author: Elio Maldonado <emaldona@redhat.com> - 3.16.1-5
changelog:
  - Move removal of directories to the end of the %prep section
  - Resolves: Bug 689919 - build without any softoken or util sources in the tree


author: Elio Maldonado <emaldona@redhat.com> - 3.16.1-6
changelog:
  - Update pem sources to the same ones used on rhel-7
  - Remove no longer needed patches on account of this update
  - Resolves: Bug 1002205


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-3
changelog:
  - Resolves: Bug 1158160 - Upgrade to NSS 3.16.2.3 for Firefox 31.3
  - Remove unused indentation pseudo patch
  - require nss util 3.16.2.3
  - Restore patch for certutil man page
  - supply missing options descriptions to the man page


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-4
changelog:
  - Keep the same cipher suite order as we had in NSS_3_15_3_RTM
  - Resolves: Bug 1123092 - openldap-2.4.23-34.el6_5.1.i686 fails after updating nss to nss-3.16.1-4.el6_5.i686


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-1
changelog:
  - Resolves: Bug 1200900 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-6.6]
  - Resolves: Bug 1131311 - rhel65 ns-slapd crash, segfault error 4 in libnss3.so in PK11_DoesMechanism at pk11slot.c:1824
  - Temporarily disable some tests until expired PayPalEE.cert is renewed


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-2
changelog:
  - Replace expired PayPal test certificate that breaks the build
  - Resolves: Bug 1200900 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-3
changelog:
  - Restore a patch that had been mistakenly disabled
  - Resolves: Bug 1200900 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-4
changelog:
  - Fix shell syntax error in nss/tests/all.sh
  - Resolves: Bug 1200900 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-5
changelog:
  - Update and reeneable nss-646045.patch on account of the rebase
  - Resolves: Bug 1200900 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL7.1]


author: Kai Engert <kaie@redhat.com> - 3.18.0-5.3
changelog:
  - On RHEL 6.x keep the TLS version defaults unchanged.
  - Require softokn build 22 to ensure runtime compatibility.
  - Relax the requirement from pkcs11-devel to nss-softokn-freebl-devel
    to allow same or newer.
  - Update to CKBI 2.4 from NSS 3.18.1 (the only change in NSS 3.18.1)


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-9
changelog:
  - Prevent TLS 1.2 Transcript Collision attacks against MD5 in key exchange protocol
  - Resolves: Bug 1289890


author: Elio Maldonado <emaldona@redhat.com> - 3.21.0-2
changelog:
  - Enable two additional ciphers and keep another one disabled
  - Prevent enabling extended masker key derive


author: Elio Maldonado <emaldona@redhat.com> - 3.21.0-6
changelog:
  - Fix syntax errors in patch that disables sslv2 tests
  - Resolves: Bug 1297888 - Rebase RHEL 6.8 to NSS 3.21 for Firefox 45


author: Kai Engert <kaie@redhat.com> - 3.21.3-2
changelog:
  - Mozilla #1314604 / Red Hat CVE-2016-8635
  - remove disable_hw_gcm.patch which hasn't been used since 3.16.1


author: Elio Maldonado <emaldona@redhat.com> - 3.12.4-11
changelog:
  - Move libfreebl3.so and its .chk file to /lib{64} keeping
  - symbolic links to them in /usr/lib{64} so as not break others


author: Elio Maldonado <emaldona@redhat.com> - 3.12.4-16
changelog:
  - allow prelink of softoken and freebl. Change the verify code to use
    prelink -u if prelink is installed. Fix by Robert Relyea


author: Elio Maldonado <emaldona@redhat.com> - 3.12.6-2.1
changelog:
  - Don't enable FIPS when CONFIG_CRYPTO_FIPS=n
  - Fix typo in the package description
  - Fix capitalization error in prelink conflict statement
  - Require nspr 4.8.4


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-4
changelog:
  - Resolves: rhbz#710298 - fix intel optimized aes code to handle case where input and ouput are in the same buffer


author: Elio Maldonado - 3.12.9-12
changelog:
  - Bootstrapping of the builroot in preparation for rebase to 3.14.3
  - Remove hasht.h from the %files devel list to prevent update conflicts with nss-util
  - With 3.14.3 hasht.h will be provided by nss-util-devel
  - Related: rhbz#919172 - rebase nss-softokn to 3.14.3


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-1
changelog:
  - Update to NSS_3_14_3_RTM
  - Resolves: rhbz#919172 - Rebase to nss-softokn 3.14.3 to fix the lucky-13 issue
  - Add export LD_LIBRARY_PATH=$RPM_BUILD_ROOT//usr/lib64 before the signing commands in __spec_install_post scriplet
    to ensure signing tool links with in-tree freebl so verification uses same algorithm as in signing
  - Add %check section to run the upstream crypto reqression test suite as per packaging guidelines
  - Don't install sechash.h or secmodt.h which as per 3.14 are provided by nss-devel
  - Update the licence to MPLv2.0


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-3
changelog:
  - Add patch to conditionally compile according to old or new sqlite api
  - new is used on rhel-6 while rhel-5 uses old but we need the same code for both
  - Resolves: rhbz#919172 - Rebase to nss-softokn 3.14.3 to fix the lucky-13 issue


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-4
changelog:
  - Enable ECC support for suite b and add upstream fixes for aec gcm
  - Use the unstripped upstream sources with ecc support
  - Limit the ECC support to suite b
  - Apply several upstream aes gcm fixes
  - Rename macros EC_MIN_KEY_BITS and EC_MAX_KEY_BITS per upstream
  - Resolves: rhbz#960208 - Enable ECC in nss-softoken
  - Related: rhbz#919172


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-5
changelog:
  - Resolves: rhbz#976572 - Pick up various upstream GCM code fixes applied since nss-3.14.3 was released
  - Display cpuifo as part of the tests and make NSS_DISABLE_HW_GCM the environment variable to test for
  - When appling the patches use a backup file suffix that better describes the patch purpose


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-6
changelog:
  - create -fips packages 
  - patch submitted by Bob Relyea <rrelyea@redhat.com>
  - fix the script that splits softoken off from nss
  - patch nss/cmd/lib/basicutil.c to build against nss-util-3.15.1
  - Resolves: rhbz#993441 - NSS needs to conform to new FIPS standard. [rhel-6.5.0]


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-7
changelog:
  - Fix the PR_Access stub to actually access the correct permissions
  - Resolves: rhbz#1008513 - Unable to login in fips mode
  - Run the lowhash tests
  - Require nspr-4.0.0 and nss-util-3.15.1


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-8
changelog:
  - Enable new packaging but don't apply nss-fips-post.patch
  - Related: rhbz#1008513 - Unable to login in fips mode


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-11
changelog:
  - Skip calls to CHECK_FORK in {C & NSC}_GetFunctionList
  - Resolves: Bug 1053437 - Admin server segfault when configuration DS configured on SSL port


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-12
changelog:
  - Avoid call to sdb_measureAccess in lib/softoken/sdb.c s_open if NSS_SDB_USE_CACHE is "yes" or "no"
  - Resolves: Bug 1044666 - Can curl HTTPS requests make fewer access system calls?


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-15
changelog:
  - Fix shlibsign to return non-zero on failure
  - Resolves: Bug 587634 - shlibsign returns 0 although if fails


author: Bob Relyea <rrelyea@redhat.com> - 3.14.3-21
changelog:
  - Require nss-softokn-freebl of at least the same version and release
  - Resolves: Bug 1182662 - nss-softokn-3.14.3-19.el6_6 breaking yum and rpm


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-23
changelog:
  - Pick up upstream freebl patch for CVE-2015-2730
  - Check for P == Q or P ==-Q before adding P and Q


author: Dennis Gilmore <dennis@ausil.us> 3.12.3.99.3-10
changelog:
  - dont include the headers in nss-util only in the -devel package
  - nss-util-devel Requires nss-devel since its only providing a subset of the headers.


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-11
changelog:
  - Remove spurious executable permissions from nss-util-config
  - Shorten some descriptions to keep rpmlint happy


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-3
changelog:
  - Remove symbolic links to shared libraries from devel - 521155
  - Apply nss-nolocalsql patch subset for nss-util
  - No rpath-link in nss-util-config


author: Elio Maldonado <emaldona@redhat.com> - 3.13.3-2
changelog:
  - Resolves: rhbz#799192 - Update to 3.13.3
  - Update minimum nspr version for Requires and BuildRequires to 4.9
  - Fix version/release in changelog to match the Version and Release tags, now 3.13.3-2


author: Elio Maldonado <emaldona@redhat.com> - 3.13.5-1
changelog:
  - Update to NSS_3_13_5_RTM
  - Resolves: rhbz#833480 - Update nss-util on RHEL 6.x to NSS 3.13.5 for Mozilla 10.0.6
  - Add -L${libdir}/nss3 to Libs: line in nspr.pc.in


author: Elio Maldonado <emaldona@redhat.com> - 3.13.5-3
changelog:
  - Update to nss-3.14.0.0-1
  - Add temporary patch so utilmod doesn't include any headers from softoken
  - Keep the hasht.h from current nss-softokn-devel
  - Remove the long obsoleted nss-nolocalsql.patch


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-1
changelog:
  - Update to NSS_3_14_3_RTM
  - Resolves: rhbz#919174 - Rebase to 3.14.3 as part of the fix for the lucky-13 issue


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-4
changelog:
  - Resolves: rhbz#976572 - Pick up various upstream GCM code fixes applied since nss-3.14.3 was released


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-5
changelog:
  - Update to NSS_3_15_1_RTM
  - Resolves: rhbz#1002644 - Rebase RHEL 6 to NSS-UTIL 3.15.1 (for FF 24.x)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-3
changelog:
  - Preserve existing permissions when replacing existing pkcs11.txt file, but keep strict default permissions for new files
  - Resolves: rhbz#990631 - file permissions of pkcs11.txt/secmod.db must be kept when modified by NSS


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-2
changelog:
  - Add nss-util portion of a fix for pluggable ecc bug in nss and nss-util
  - Resolves: Bug 1057224 - Pluggable ECC in NSS not enabled on RHEL 6 and above


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-3
changelog:
  - Apply the patch for the pluggable ecc fix
  - Resolves: Bug 1057224 - Pluggable ECC in NSS not enabled on RHEL 6 and above


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-4
changelog:
  - nssutil_growList and nssutil_ReadSecmodDB cleanup
  - Resolves: Bug 1019529 - New defect found in nss-util-3.14.0.0-2.el6


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-1
changelog:
  - Resolves: Bug 1158160 - Upgrade to NSS 3.16.2.3 for Firefox 31.3
  - Remove patches rendered obsolete by the rebase


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-2
changelog:
  - Fix the required nspr version to be 4.10.6
  - Resolves: Bug 1158160 - Upgrade to NSS 3.16.2.3 for Firefox 31.3


author: Elio Maldonado <emaldona@redhat.com> - 3.21.0-1
changelog:
  - Rebase to nss-util from nss 3.21
  - Resolves: Bug 1297890 - Rebase RHEL 6.8 to NSS-util 3.21 in preparation for Firefox 45


author: Daiki Ueno <dueno@redhat.com> - 3.21.3-1
changelog:
  - Rebase to nss-3.21.3
  - Remove patch for CVE-2016-1950, which is included in the release
  - Related: Bug 1347908


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - comment out default values for keys, warn about starting with -A (#19316).
  - take out -A from ntpd startup as well.
  - update to 4.0.99k.


author: Preston Brown <pbrown@redhat.com>
changelog:
  - allow comments in %{_sysconfdir}/ntp/step-tickers file (#28786).
  - need patch0 (glibc patch) on ia64 too


author: Pekka Savola <pekkas@netcore.fi>
changelog:
  - require/buildprereq libcap/libcap-devel
  - use 'ntp' user, tune the pre/post scripts, %files
  - add $OPTIONS to the init script


author: Pekka Savola <pekkas@netcore.fi>
changelog:
  - Add the remote root exploit patch (based on ntp-hackers).
  - Enhance droproot patch (more documentation, etc.) <Jarno.Huuskonen@uku.fi>
  - Tweak the droproot patch to include sys/prctl.h, not linux/prctl.h
  (implicit declarations)
  - Remote groupdel commands, shouldn't be needed.
  - Removed -Wcast-qual and -Wconversion due to excessive warnings (hackish).
  - Make ntp compilable with both glibc 2.1 and 2.2.x (very dirty hack)
  - Add %{_sysconfdir}/sysconfig/ntpd which drops root privs by default


author: Harald Hoyer <harald@redhat.de>
changelog:
  - new snapshot
  - removed typos and security patch (already there)
  - commented multicastclient in config file


author: Harald Hoyer <harald@redhat.de> 4.1.0-1
changelog:
  - wow, how stupid can a man be ;).. fixed #50698 
  - updated to 4.1.0 (changes are small and in non-critical regions)


author: Harald Hoyer <harald@redhat.de> 4.1.0b-4
changelog:
  - created drift with dummy value #58294
  - grep for timeservers in ntp.conf also for ntpdate #57837
  - check return value of ntpdate #58836


author: Harald Hoyer <harald@redhat.de> 4.1.1b-1
changelog:
  - updated to version 4.1.1b
  - improved initscript - use ntpdate on -x
  - improved initscript - open firewall only for timeservers
  - ntp-4.1.1a-adjtime.patch removed (already in source)
  - ntp-4.1.1a-mfp.patch removed (already in source)
  - ntp-4.0.99j-vsnprintf.patch removed (already in source)


author: Harald Hoyer <harald@redhat.com> - 4.2.0.a.20040617-4
changelog:
  - removed firewall hole punching from the initscript; rely on iptables
    ESTABLISHED,RELATED or manual firewall configuration


author: Jindrich Novy <jnovy@redhat.com> 4.2.0.a.20050816-1
changelog:
  - update to the latest stable 4.2.0.a.20050816
  - drop upstreamed .gcc4, .vsnprintf patches
  - remove obsolete .autofoo patch
  - make patch numbering less chaotic
  - don't package backup for .droproot patch


author: Petr Raszyk <praszyk@redhat.com> 4.2.0.a.20050816-2
changelog:
  - Fix fails on upgrade, if ntpd is disabled (#166773)
  - A cosmetic patch. There are some comments and braces '{' '}' added.
  - One unprintable character was converted to octal-form .
  - It can be removed anytime (conversion of the cvs-projets for C-Frame 121,
  - (auto-debug, auto-trace for cfr-printnet server).


author: Petr Raszyk <praszyk@redhat.com> 4.2.0.a.20050816-3
changelog:
  - A similar patch as ntp-4.0.99j-vsnprintf.patch in FEDORA CORE 4
  - (current patch is ntp-stable-4.2.0a-20050816-vsnprintf.patch)


author: Petr Raszyk <praszyk@redhat.com> 4.2.0.a.20050816-10
changelog:
  - ntpd does not submit his local clock (if there is no peer).
    ntpdate->ntpd #163862 , Patch13: ntp-stable-4.2.0a-20050816-loconly.patch


author: Miroslav Lichvar <mlichvar@redhat.com> - 4.2.0.a.20050816-11
changelog:
  - update man pages (#153195, #162856)
  - drop C-Frame-121, vsnprintf, minusTi and loconly patch
  - prevent segfault when loopback interface is not configured (#159056)
  - spec cleanup


author: Miroslav Lichvar <mlichvar@redhat.com> - 4.2.0.a.20050816-12
changelog:
  - fix initscript:
    - replace -U with -u in getopts (#187003)
    - don't pass group to ntpdate -U argument and ignore -i in options (#142926)
    - set ntpconf for -c
    - remove -p 8 from ntpdate arguments
    - don't call ntpdate when step-tickers doesn't contain anything useful
      and -x isn't in options
  - fix default keyfile for ntpdate (#183196)


author: Miroslav Lichvar <mlichvar@redhat.com> - 4.2.0.a.20050816-14
changelog:
  - modify ntp.conf, change default restrict, remove broadcastdelay,
    use fedora.pool.ntp.org (#189667)
  - don't install drift file
  - remove unsupported options from ntptrace manpage (#137717)
  - fix default paths in manpages for ntp-keygen and ntpdate


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.2-3
changelog:
  - fix manycast support in ntpdate (#194329)
  - reply to manycast requests with null refid
  - enable mlockall (#195617)
  - correct threshold value in ntpdate manpage


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.2p4-1
changelog:
  - update to 4.2.2p4
  - fix buffer overflow in WWV Audio driver (#216309)
  - don't mark init script as config


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4-1
changelog:
  - update to 4.2.4 (#146884)
  - don't use local clock in default config
  - autogenerate man pages from HTML
  - clean up spec a bit


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4-3
changelog:
  - disable autoopts option preset mechanisms for ntpd
  - document -I option of ntpd
  - generate makewhatis friendly man pages


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4-4
changelog:
  - don't wake up every second (#204748)
  - add option to enable memory locking (#195617)
  - fix broadcast client
  - use option values in ntp-keygen
  - improve man pages


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p0-1
changelog:
  - update to 4.2.4p0
  - fix init script
    - don't add second -g to ntpd options (#228424)
    - update getopts
    - skip all refclocks when parsing ntp.conf
  - spec cleanup


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p0-3
changelog:
  - fix interface updates with -I or -L option (#240254)
  - accept multiple -I options
  - fix broadcast client/server to accept/allow sending
    broadcasts on 255.255.255.255 (#226958)
  - fix return codes in init script (#240120)
  - exit with nonzero code if ntpd -q did not set clock (#240134)
  - drop revert452 patch, fixed in kernel 2.6.19
  - make with _smp_mflags


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p2-2
changelog:
  - ignore tentative addresses (#246297)
  - improve init script (#247003)
  - fix sleep patch
  - ease Autokey setup (#139673)
    - change default keysdir to /etc/ntp/crypto
    - set crypto password in /etc/ntp/crypto/pw
    - don't use randfile if /dev/urandom is used by OpenSSL
  - change default statsdir to /var/log/ntpstats/, use statistics type
    as default filename
  - package more doc files


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p2-5
changelog:
  - avoid use of uninitialized floating-point values in clock_select
  - update license tag (Tom "spot" Callaway)
  - drop sntp, MSNTP license is non-free


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p4-1
changelog:
  - update to 4.2.4p4
  - fix default NTP version for outgoing packets in ntpdate man page
    (#245408)
  - replace BSD with advertising code in ntpdc and ntpq


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p4-4
changelog:
  - reset kernel frequency when -x option is used
  - create separate init script for ntpdate
  - add note about paths and exit codes to ntpd man page


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p4-5
changelog:
  - fix building IPv6 support with new glibc-headers (#436713)
  - avoid unaligned memory access (#435301)
  - fix receiving broadcasts on 255.255.255.255


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p4-7
changelog:
  - reload resolv.conf after temporary failure in name resolution (#456743)
  - use clock_gettime
  - make subpackages for perl scripts and ntpdate (#452097, #456116)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p5-2
changelog:
  - retry failed name resolution few times before giving up (#460561)
  - don't write drift file upon exit
  - run ntpq with full path in ntp-wait script


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p6-1
changelog:
  - update to 4.2.4p6 (CVE-2009-0021)
  - include dhclient script (David Cantrell)
  - convert COPYRIGHT to UTF-8


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p6-4
changelog:
  - don't restart ntpd in dhclient script with every renewal
  - fix buffer overflow in ntpq (#490617)
  - check status in condrestart (#481261)
  - don't crash when compiled with HAVE_TIMER_CREATE (#486217)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p7-1
changelog:
  - update to 4.2.4p7 (CVE-2009-1252)
  - improve PLL response when kernel discipline is disabled
  - don't log STA_MODE changes
  - enable nanokernel support
  - allow minpoll 3
  - increase memlock limit
  - move html documentation to -doc subpackage (#492444)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p7-2
changelog:
  - fix frequency calculation when starting with no drift file
  - reduce phase adjustments beyond Allan intercept in daemon PLL


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p7-3
changelog:
  - handle system time jumps better
  - don't wake up every second for refclocks without timer
  - don't crash in ntpstat when unknown clock type is received (#505564)
  - make ntpstat process first packet in multipacket response
  - switch to editline
  - set pool.ntp.org vendor zone in spec (#512711)
  - compile with -fno-strict-aliasing


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-1
changelog:
  - update to 4.2.6p5 (#654004, #641800, #714079, #714084, #716968, #819781,
    - bind broadcast client to new interfaces (#973807)
  - allow selection of cipher for private key files (#749530)
  - retry few times in ntpdate init script before giving up (#673198)
  - print synchronization distance instead of dispersion in ntpstat (#830821)
  - ignore duplicate servers from dhclient (#862983)
  - add fourth server to default ntp.conf and use iburst (#667524, #623616)
  - drop comment enabling local driver in default config (#816645)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-2
changelog:
  - don't generate weak control key for resolver (CVE-2014-9293)
  - don't generate weak MD5 keys in ntp-keygen (CVE-2014-9294)
  - fix buffer overflows via specially-crafted packets (CVE-2014-9295)
  - don't mobilize passive association when authentication fails (CVE-2014-9296)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-3
changelog:
  - validate lengths of values in extension fields (CVE-2014-9297)
  - drop packets with spoofed source address ::1 (CVE-2014-9298)
  - add nanosecond support to SHM refclock (#1117704)
  - allow creating all SHM segments with owner-only access (#1122015)
  - allow symmetric keys up to 32 bytes again (#1053551)
  - fix calculation of root dispersion (#1045376)
  - fix crash in ntpq mreadvar command (#1165141)
  - don't step clock for leap second with -x option (#1190619)
  - don't drop packets with source port below 123 (#1171630)
  - use larger RSA exponent in ntp-keygen (#1184421)
  - refresh peers on routing updates (#1193850)
  - increase memlock limit again (#1053568)
  - warn when monitor can't be disabled due to limited restrict (#1166596)
  - improve documentation of restrict command (#1069019)
  - update logconfig documentation for patched default (#1193849)
  - don't build ntpsnmpd (#995134)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-5
changelog:
  - reject packets without MAC when authentication is enabled (CVE-2015-1798)
  - protect symmetric associations with symmetric key against DoS attack
    (CVE-2015-1799)
  - fix generation of MD5 keys with ntp-keygen on big-endian systems
    (CVE-2015-3405)
  - log when stepping clock for leap second or ignoring it with -x (#1204625)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-7
changelog:
  - check origin timestamp before accepting KoD RATE packet (CVE-2015-7704)
  - allow only one step larger than panic threshold with -g (CVE-2015-5300)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-9
changelog:
  - fix crash with invalid logconfig command (CVE-2015-5194)
  - fix crash when referencing disabled statistic type (CVE-2015-5195)
  - don't hang in sntp with crafted reply (CVE-2015-5219)
  - don't crash with crafted autokey packet (CVE-2015-7691, CVE-2015-7692,
    CVE-2015-7702)
  - fix memory leak with autokey (CVE-2015-7701)
  - don't allow setting driftfile and pidfile remotely (CVE-2015-7703)
  - don't crash in ntpq with crafted packet (CVE-2015-7852)
  - add option to set Differentiated Services Code Point (DSCP) (#1228314)
  - extend rawstats log (#1242895)
  - fix resetting of leap status (#1243034)
  - report clock state changes related to leap seconds (#1242937)
  - allow -4/-6 on restrict lines with mask (#1232146)
  - retry joining multicast groups (#1288534)
  - explain synchronised state in ntpstat man page (#1286969)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-10
changelog:
  - don't accept server/peer packets with zero origin timestamp (CVE-2015-8138)
  - fix crash with reslist command (CVE-2015-7977, CVE-2015-7978)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-10.el6_8.1
changelog:
  - don't allow spoofed packets to demobilize associations (CVE-2015-7979,
    CVE-2016-1547)
  - don't allow spoofed packet to enable symmetric interleaved mode
    (CVE-2016-1548)
  - check mode of new source in config command (CVE-2016-2518)
  - make MAC check resilient against timing attack (CVE-2016-1550)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Patch to build with neither RSA nor RSAref.
  - Miscellaneous FHS-compliance tweaks.
  - Fix for possibly-compressed man pages.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Move condrestart to server postun.
  - Move key generation to init script.
  - Actually use the right patch for moving the key generation to the init script.
  - Clean up the init script a bit.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update to 2.1.1p4, which includes fixes for config file parsing problems.
  - Move the init script back.
  - Add Damien's quick fix for wackiness.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update to 20000823 snapshot.
  - Change subpackage requirements from %{version} to %{version}-%{release}
  - Back out the pipe patch.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update x11-askpass to 1.0.2. (#17835)
  - Add BuildPreReqs for /bin/login and /usr/bin/rsh so that configure will
    always find them in the right place. (#17909)
  - Set the default path to be the same as the one supplied by /bin/login, but
    add /usr/X11R6/bin. (#17909)
  - Try to handle obsoletion of ssh-server more cleanly.  Package names
    are different, but init script name isn't. (#17865)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Add BuildPreReq on /usr/include/security/pam_appl.h to be sure we always
    build PAM authentication in.
  - Try setting SSH_ASKPASS if gnome-ssh-askpass is installed.
  - Clean out no-longer-used patches.
  - Patch ssh-add to try to add both identity and id_dsa, and to error only
    when neither exists.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update to OpenSSH 2.3.0p1.
  - Update to x11-askpass 1.1.0.
  - Enable keyboard-interactive authentication.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Resync with conditional options in Damien Miller's .spec file for an errata.
  - Change libexecdir from %{_libexecdir}/ssh to %{_libexecdir}/openssh.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Add the primes file from the latest snapshot to the main package (#20884).
  - Add the dev package to the prereq list (#19984).
  - Remove the default path and mimic login's behavior in the server itself.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Disable the built-in MD5 password support.  We're using PAM.
  - Take a crack at doing keyboard-interactive authentication with PAM, and
    enable use of it in the default client configuration so that the client
    will try it when the server disallows password authentication.
  - Build with debugging flags.  Build root policies strip all binaries anyway.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Merge multiple PAM text messages into subsequent prompts when possible when
    doing keyboard-interactive authentication.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update to x11-askpass 1.1.1. (#21301)
  - Don't second-guess fixpaths, which causes paths to get fixed twice. (#21290)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Don't treat pam_setcred() failure as fatal unless pam_authenticate() has
    succeeded, to allow public-key authentication after a failure with "none"
    authentication.  (#21268)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - More gettextizing.
  - Close all files after going into daemon mode (needs more testing).
  - Extract patch from CVS to handle auth banners (in the client).
  - Extract patch from CVS to handle compat weirdness.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Don't open a PAM session until we've forked and become the user (#25690).
  - Apply Andrew Bartlett's patch for letting pam_authenticate() know which
    host the user is attempting a login from.
  - Resync with parts of Damien Miller's openssh.spec from CVS.
  - Don't expose KbdInt responses in debug messages (from CVS).
  - Detect and handle errors in rsa_{public,private}_decrypt (from CVS).


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update for 2.5.0p1.
  - Use $RPM_OPT_FLAGS instead of -O when building gnome-ssh-askpass
  - Resync with parts of Damien Miller's openssh.spec from CVS, including
    update of x11 askpass to 1.2.0.
  - Only require openssl (don't prereq) because we generate keys in the init
    script now.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update for 2.5.1p1.
  - Add init script mods from Pekka Savola.
  - Tweak the init script to match the CVS contrib script more closely.
  - Redo patch to ssh-add to try to adding both identity and id_dsa to also try
    adding id_rsa.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Redo patch to move pam_open_session after the server setuid()s to the user.
  - Rework the nopam patch to use be picked up by autoconf.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Chuck the closing patch.
  - Add a trigger to add host keys for protocol 2 to the config file, now that
    configuration file syntax requires us to specify it with HostKey if we
    specify any other HostKey values, which we do.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Revert the patch to move pam_open_session.
  - Init script and spec file changes from Pekka Savola. (#28750)
  - Patch sftp to recognize '-o protocol' arguments. (#29540)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.5.2p1 (includes endianness fixes in the rijndael implementation)
  - don't enable challenge-response by default until we find a way to not
    have too many userauth requests (we may make up to six pubkey and up to
    three password attempts as it is)
  - remove build dependency on rsh to match openssh.com's packages more closely


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.5.2p2
  - call setcred() again after initgroups, because the "creds" could actually
    be group memberships


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - make do_pam_setcred() smart enough to know when to establish creds and
    when to reinitialize them
  - add in a couple of other fixes from Damien for inclusion in the errata


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - mention that challengereponse supports PAM, so disabling password doesn't
    limit users to pubkey and rsa auth (#34378)
  - bypass the daemon() function in the init script and call initlog directly,
    because daemon() won't start a daemon it detects is already running (like
    open connections)
  - require the version of openssl we had when we were built


author: Preston Brown <pbrown@redhat.com>
changelog:
  - remove explicit openssl requirement, fixes builddistro issue
  - make initscript stop() function wait until sshd really dead to avoid 
    races in condrestart


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - finish marking strings in the init script for translation
  - modify init script to source /etc/sysconfig/sshd and pass $OPTIONS to sshd
    at startup (change merged from openssh.com init script, originally by
    Pekka Savola)
  - refuse to do X11 forwarding if xauth isn't there, handy if you enable
    it by default on a system that doesn't have X installed


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add in Simon Wilkinson's GSSAPI patch to give it some testing in-house,
    to be removed before the next beta cycle because it's a big departure
    from the upstream version


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix an error parsing the new default sshd_config
  - add a fix from Markus Friedl (via openssh-unix-dev) for ssh-keygen not
    dealing with comments right


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - change Copyright: BSD to License: BSD
  - add Markus Friedl's unverified patch for the cookie file deletion problem
    so that we can verify it
  - drop patch to check if xauth is present (was folded into cookie patch)
  - don't apply gssapi patches for the errata candidate
  - clear supplemental groups list at startup


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pull cvs patch to add session initialization to no-pty sessions
  - pull cvs patch to not cut off challengeresponse auth needlessly
  - refuse to do X11 forwarding if xauth isn't there, handy if you enable
    it by default on a system that doesn't have X installed (#49263)


author: Nalin Dahyabhai <nalin@redhat.com> 2.9p2-7
changelog:
  - fix scp's server's reporting of file sizes, and build with the proper
    preprocessor define to get large-file capable open(), stat(), etc.
    (sftp has been doing this correctly all along) (#51827)
  - configure without --with-ipv4-default on RHL 7.x and newer (#45987,#52247)
  - pull cvs patch to fix support for /etc/nologin for non-PAM logins (#47298)
  - mark profile.d scriptlets as config files (#42337)
  - refer to Jason Stone's mail for zsh workaround for exit-hanging quasi-bug
  - change a couple of log() statements to debug() statements (#50751)
  - pull cvs patch to add -t flag to sshd (#28611)
  - clear fd_sets correctly (one bit per FD, not one byte per FD) (#43221)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 3.0p1
  - update to x11-ssh-askpass 1.2.4.1
  - change build dependency on a file from pam-devel to the pam-devel package
  - replace primes with moduli


author: Nalin Dahyabhai <nalin@redhat.com> 3.0p1-1
changelog:
  - merge some of Damien Miller <djm@mindrot.org> changes from the upstream
    3.0p1 spec file and init script


author: Nalin Dahyabhai <nalin@redhat.com> 3.0.2p1-3
changelog:
  - add patches from Simon Wilkinson and Nicolas Williams for GSSAPI key
    exchange, authentication, and named key support


author: Nalin Dahyabhai <nalin@redhat.com> SNAP-20020220
changelog:
  - update to SNAP-20020220 for testing purposes (you've been warned, if there's
    anything to be warned about, gss patches won't apply, I don't mind)


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-1
changelog:
  - require sharutils for building (mindrot #137)
  - require db1-devel only when building for 6.x (#55105), which probably won't
    work anyway (3.1 requires OpenSSL 0.9.6 to build), but what the heck
  - require pam-devel by file (not by package name) again
  - add Markus's patch to compile with OpenSSL 0.9.5a (from
    http://bugzilla.mindrot.org/show_bug.cgi?id=141) and apply it if we're
    building for 6.x


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-2gss
changelog:
  - reintroduce Simon's gssapi patches
  - add buildprereq for autoconf253, which is needed to regenerate configure
    after applying the gssapi patches
  - refresh to the latest version of Markus's patch to build properly with
    older versions of OpenSSL


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-3
changelog:
  - pull patch from CVS to avoid printing error messages when some of the
    default keys aren't available when running ssh-add
  - refresh to current revisions of Simon's patches


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-4
changelog:
  - drop buildreq on db1-devel
  - require pam-devel by package name
  - require autoconf instead of autoconf253 again


author: Nalin Dahyabhai <nalin@redhat.com> 3.3p1-1
changelog:
  - update to 3.3p1
  - merge in spec file changes from upstream (remove setuid from ssh, ssh-keysign)
  - disable gtk2 askpass
  - require pam-devel by filename rather than by package for erratum
  - include patch from Solar Designer to work around anonymous mmap failures


author: Nalin Dahyabhai <nalin@redhat.com> 3.3p1-2
changelog:
  - rework the close-on-exit docs
  - include configuration file man pages
  - make use of nologin as the privsep shell optional


author: Nalin Dahyabhai <nalin@redhat.com> 3.5p1-2
changelog:
  - patch PAM configuration to use relative path names for the modules, allowing
    us to not worry about which arch the modules are built for on multilib systems


author: Nalin Dahyabhai <nalin@redhat.com> 3.5p1-6
changelog:
  - move scp to the -clients subpackage, because it directly depends on ssh
    which is also in -clients (#84329)


author: Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-6
changelog:
  - modify patch which clears the supplemental group list at startup to only
    complain if setgroups() fails if sshd has euid == 0
  - handle krb5 installed in %{_prefix} or elsewhere by using krb5-config


author: Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-11
changelog:
  - apply patch to store the correct buffer size in allocated buffers
    (CAN-2003-0693)
  - skip the initial PAM authentication attempt with an empty password if
    empty passwords are not permitted in our configuration (#103998)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - additional fix for apparently-never-happens double-free in buffer_free()
  - extend fix for #103998 to cover SSH1


author: Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-34
changelog:
  * Wed Mar 03 2004 Phil Knirsch <pknirsch@redhat.com> 3.6.1p2-33.30.1
  - Built RHLE3 U2 update package.


author: Nalin Dahyabhai <nalin@redhat.com> 3.8.1p1-1
changelog:
  - request gssapi-with-mic by default but not delegation (flag day for anyone
    who used previous gssapi patches)
  - no longer request x11 forwarding by default


author: Nalin Dahyabhai <nalin@redhat.com> 3.9p1-8
changelog:
  - add a --enable-vendor-patchlevel option which allows a ShowPatchLevel option
    to enable display of a vendor patch level during version exchange (#120285)
  - configure with --disable-strip to build useful debuginfo subpackages


author: Tomas Mraz <tmraz@redhat.com>
changelog:
  - change permissions on pam.d/sshd to 0644 (#64697)
  - patch initscript so it doesn't kill opened sessions if
    the sshd daemon isn't running anymore (#67624)


author: Tomas Mraz <tmraz@redhat.com> 3.9p1-10
changelog:
  - enable trusted forwarding by default if X11 forwarding is 
    required by user (#137685 and duplicates)
  - disable protocol 1 support by default in sshd server config (#88329)
  - keep the gnome-askpass dialog above others (#69131)


author: Tomas Mraz <tmraz@redhat.com> 3.9p1-11
changelog:
  - don't call syslog in signal handler
  - allow password authentication when copying from remote
    to remote machine (#103364)


author: Tomas Mraz <tmraz@redhat.com> 4.0p1-2
changelog:
  - fixed Local/RemoteForward in ssh_config.5 manpage
  - fix fatal when Local/RemoteForward is used and scp run (#153258)
  - don't leak user validity when using krb5 authentication


author: Tomas Mraz <tmraz@redhat.com> 4.1p1-3
changelog:
  - fix small regression caused by the nologin patch (#161956)
  - fix race in getpeername error checking (mindrot #1054)


author: Tomas Mraz <tmraz@redhat.com> 4.1p1-4
changelog:
  - don't deadlock on exit with multiple X forwarded channels (#152432)
  - don't use X11 port which can't be bound on all IP families (#163732)


author: Tomas Mraz <tmraz@redhat.com> 4.1p1-5
changelog:
  - use x11-ssh-askpass if openssh-askpass-gnome is not installed (#165207)
  - install ssh-copy-id from contrib (#88707)


author: Tomas Mraz <tmraz@redhat.com> 4.2p1-2
changelog:
  - use include instead of pam_stack in pam config
  - use fork+exec instead of system in scp - CVE-2006-0225 (#168167)
  - upstream patch for displaying authentication errors


author: Warren Togami <wtogami@redhat.com> - 4.2p1-7
changelog:
  - xorg-x11-devel -> libXt-devel
  - rebuild for new xauth location so X forwarding works
  - buildreq audit-libs-devel
  - buildreq automake for aclocal
  - buildreq imake for xmkmf
  -  -D_GNU_SOURCE in flags in order to get it to build
     Ugly hack to workaround openssh defining __USE_GNU which is
     not allowed and causes problems according to Ulrich Drepper
     fix this the correct way after FC5test1


author: Nalin Dahyabhai <nalin@redhat.com> - 4.2p1-8
changelog:
  - work around missing gccmakedep by wrapping makedepend in a local script
  - remove now-obsolete build dependency on "xauth"


author: Tomas Mraz <tmraz@redhat.com> - 4.2p1-9
changelog:
  - drop x11-ssh-askpass from the package
  - drop old build_6x ifs from spec file
  - improve gnome-ssh-askpass so it doesn't reveal number of passphrase 
    characters to person looking at the display
  - less hackish fix for the __USE_GNU problem


author: Tomas Mraz <tmraz@redhat.com> - 4.3p1-2
changelog:
  - fixed another place where syslog was called in signal handler
  - pass locale environment variables to server, accept them there (#179851)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-3
changelog:
  - enable the subprocess in chroot to send messages to system log
  - sshd should prevent login if audit call fails


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-6
changelog:
  - improve selinux patch (by Jan Kiszka)
  - upstream patch for buffer append space error (#191940)
  - fixed typo in configure.ac (#198986)
  - added pam_keyinit to pam configuration (#198628)
  - improved error message when askpass dialog cannot grab
    keyboard input (#198332)
  - buildrequires xauth instead of xorg-x11-xauth
  - fixed a few rpmlint warnings


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-7
changelog:
  - dropped old ssh obsoletes
  - call the pam_session_open/close from the monitor when privsep is
    enabled so it is always called as root (patch by Darren Tucker)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-8
changelog:
  - drop the pam-session patch from the previous build (#201341)
  - don't set IPV6_V6ONLY sock opt when listening on wildcard addr (#201594)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-9
changelog:
  - don't report duplicate syslog messages, use correct local time (#189158)
  - don't allow spnego as gssapi mechanism (from upstream)
  - fixed memleaks found by Coverity (from upstream)
  - allow ip options except source routing (#202856) (patch by HP)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-10
changelog:
  - improve gssapi-no-spnego patch (#208102)
  - CVE-2006-4924 - prevent DoS on deattack detector (#207957)
  - CVE-2006-5051 - don't call cleanups from signal handler (#208459)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-11
changelog:
  - merge sshd initscript patches
  - kill all ssh sessions when stop is called in halt or reboot runlevel
  - remove -TERM option from killproc so we don't race on sshd restart


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-13
changelog:
  - improved pam_session patch so it doesn't regress, the patch is necessary
    for the pam_session_close to be called correctly as uid 0


author: Tomas Mraz <tmraz@redhat.com> - 4.5p1-2
changelog:
  - support mls on labeled networks (#220487)
  - support mls level selection on unlabeled networks
  - allow / in usernames in scp (only beginning /, ./, and ../ is special)


author: Tomas Mraz <tmraz@redhat.com> - 4.5p1-8
changelog:
  - fix sftp client problems on write error (#247802)
  - allow disabling autocreation of server keys (#235466)


author: Tomas Mraz <tmraz@redhat.com> - 4.7p1-1
changelog:
  - upgrade to latest upstream
  - use libedit in sftp (#203009)
  - fixed audit log injection problem (CVE-2007-3102)


author: Tomas Mraz <tmraz@redhat.com> - 4.7p1-4
changelog:
  - do not copy /etc/localtime into the chroot as it is not
    necessary anymore (#193184)
  - call setkeycreatecon when selinux context is established
  - test for NULL privk when freeing key (#391871) - patch by
    Pierre Ossman


author: Tomas Mraz <tmraz@redhat.com> - 4.7p1-9
changelog:
  - set FD_CLOEXEC on client socket
  - apply real fix for window size problem (#286181) from upstream
  - apply fix for the spurious failed bind from upstream
  - apply open handle leak in sftp fix from upstream


author: Tomas Mraz <tmraz@redhat.com> - 4.7p1-10
changelog:
  - fix race on control master and cleanup stale control socket (#436311)
    patches by David Woodhouse


author: Tomas Mraz <tmraz@redhat.com> - 5.0p1-1
changelog:
  - upgrade to new upstream (#441066)
  - prevent initscript from killing itself on halt with upstart (#438449)
  - initscript status should show that the daemon is running
    only when the main daemon is still alive (#430882)


author: Tomas Mraz <tmraz@redhat.com> - 5.0p1-2
changelog:
  - add LANGUAGE to accepted/sent environment variables (#443231)
  - use pam_selinux to obtain the user context instead of doing it itself
  - unbreak server keep alive settings (patch from upstream)
  - small addition to scp manpage


author: Tomas Mraz <tmraz@redhat.com> - 5.1p1-1
changelog:
  - upgrade to new upstream release
  - fixed a problem with public key authentication and explicitely
    specified SELinux role


author: Tomas Mraz <tmraz@redhat.com> - 5.1p1-4
changelog:
  - set FD_CLOEXEC on channel sockets (#475866)
  - adjust summary
  - adjust nss-keys patch so it is applicable without selinux patches (#470859)


author: Tomas Mraz <tmraz@redhat.com> - 5.1p1-5
changelog:
  - remove obsolete --with-rsh (#478298)
  - add pam_sepermit to allow blocking confined users in permissive mode
    (#471746)
  - move system-auth after pam_selinux in the session stack


author: Jan F. Chadima <jchadima@redhat.com> - 5.2p1-20
changelog:
  - merged xmodifiers to redhat patch
  - merged gssapi-role to selinux patch
  - merged cve-2007_3102 to audit patch
  - sesftp patch only with WITH_SELINUX flag
  - rearange sesftp patch according to upstream request


author: Jan F. Chadima <jchadima@redhat.com> - 5.2p1-28
changelog:
  - Repair initscript to be acord to guidelines (#521860)
  - Add bugzilla# to application of edns and xmodifiers patch


author: Jan F. Chadima <jchadima@redhat.com> - 5.5p1-36
changelog:
  - add ldap backend (#455350)
  - skip sshd init's rsa1 creation in fips mode (#672870)
  - improve audit session key destroy (#642792)


author: Petr Lautrbach <plautrba@redhat.com> 5.3p1-71
changelog:
  - enable aes-ctr ciphers use the EVP engines from OpenSSL such as the AES-NI (#756929)
  - add CAVS test driver for the aes-ctr ciphers (#782091)


author: Petr Lautrbach <plautrba@redhat.com> 5.3p1-73
changelog:
  - remove openssh-4.3p2-no-v6only.patch (#732955)
  - adjust Linux out-of-memory killer (#744236)
  - fix sshd init script - check existence of crypto (#797384)
  - add RequiredAuthentications[12] (#657378)
  - run privsep slave process as the users SELinux context (#798241)


author: Petr Lautrbach <plautrba@redhat.com> 5.3p1-82
changelog:
  - check return value of PK11_Authenticate in ssh-add -n (#782912)
  - document available methods to RequiredAuthentications[12] (#821641)
  - fix ssh-copy-id (#836650)
  - fix segmentation fault in ssh client (#836655)
  - update pam_ssh_agent_auth to 0.9.3 upstream version
  - fix segfault in su when pam_ssh_agent_auth is used and the ssh-agent
    is not running (#834404)


author: Petr Lautrbach <plautrba@redhat.com> 5.3p1-85
changelog:
  - fix chroot logging issue (#872169)
  - change the bad key permissions error message (#880575)
  - fix a race condition in ssh-agent (#896561)
  - backport support for PKCS11 from openssh-5.4p1 (#908038)
  - add a KexAlgorithms knob to the client and server configuration (#951704)
  - fix parsing logic of ldap.conf file (#954094)
  - Add HMAC-SHA2 algorithm support (#969565)
  - store krb5 credentials after a pam session is created (#974096)


author: Petr Lautrbach <plautrba@redhat.com> 5.3p1-86
changelog:
  - Add support for certificate key types for users and hosts (#906872)
  - Apply RFC3454 stringprep to banners when possible (#955792)


author: Petr Lautrbach <plautrba@redhat.com> 5.3p1-87
changelog:
  - bump the minimum value of SSH_USE_STRONG_RNG to 14 according to SP800-131A (#993577)
  - fixed an issue with broken 'ssh -I pkcs11' (#908038)
  - abort non-subsystem sessions to forced internal sftp-server (#993509)
  - reverted 'store krb5 credentials after a pam session is created (#974096)'


author: Petr Lautrbach <plautrba@redhat.com> 5.3p1-90
changelog:
  - change default value of MaxStartups - CVE-2010-5107 - #908707
  - add -fips subpackages that contains the FIPS module files (#1001565)


author: Petr Lautrbach <plautrba@redhat.com> 5.3p1-95
changelog:
  - adjust the key echange DH groups and ssh-keygen according to SP800-131A (#993580)
  - log failed integrity test if /etc/system-fips exists (#1020803)
  - backport ECDSA and ECDH support (#1028335)


author: Petr Lautrbach <plautrba@redhat.com> 5.3p1-96
changelog:
  - prevent a server from skipping SSHFP lookup (#1081338) CVE-2014-2653
  - ignore environment variables with embedded '=' or '\0' characters CVE-2014-2532
  - backport ControlPersist option (#953088)
  - log when a client requests an interactive session and only sftp is allowed (#997377)
  - don't try to load RSA1 host key in FIPS mode (#1009959)
  - restore Linux oom_adj setting when handling SIGHUP to maintain behaviour over restart
    (#1010429)
  - ssh-keygen -V - relative-specified certificate expiry time should be relative to current time
    (#1022459)


author: Petr Lautrbach <plautrba@redhat.com> 5.3p1-97
changelog:
  - x11 forwarding - be less restrictive when can't bind to one of available addresses
    (#1027197)
  - better fork error detection in audit patch (#1028643)
  - fix openssh-5.3p1-x11.patch for non-linux platforms (#1100913)


author: Petr Lautrbach <plautrba@redhat.com> 5.3p1-98
changelog:
  - add possibility to autocreate only RSA key into initscript (#1111568)
  - fix several issues reported by coverity


author: Jakub Jelen <jjelen@redhat.com> 5.3p1-105
changelog:
  - Fix ControlPersist option with ProxyCommand (#1160487)
  - Backport fix of ssh-keygen with error : gethostname: File name too long (#1161454)
  - Backport show remote address instead of UNKNOWN after timeout at password prompt (#1161449)
  - Fix printing of extensions in v01 certificates (#1093869)
  - Fix confusing audit trail for unsuccessful logins (#1127312)
  - Don't close fds for internal sftp sessions (#1085710)
  - Fix config parsing quotes (backport) (#1134938)
  - Enable logging in chroot into separate file (#1172224)
  - Fix auditing when using combination of ForcedCommand and PTY (#1131585)
  - Fix ssh-copy-id on non-sh remote shells (#1135521)


author: Jakub Jelen <jjelen@redhat.com> 5.3p1-106
changelog:
  - Add missing ControlPersist option to man ssh (#1197763)
  - Add sftp option to force mode of created files (#1191055)
  - Do not load RSA1 keys in FIPS mode (#1197072)
  - Add missing support for ECDSA in ssh-keyscan (#1196331)
  - Fix coverity/gcc issues (#1196063)
  - Backport wildcard functionality for PermitOpen in sshd_config file (#1159055)
  - Ability to specify an arbitrary LDAP filter in ldap.conf (#1119506)


author: Jakub Jelen <jjelen@redhat.com> 5.3p1-109
changelog:
  - Fix problems with failing persistent connections (#1131585)
  - Fix memory leaks in auditing patch (#1208584)


author: Jakub Jelen <jjelen@redhat.com> 5.3p1-110
changelog:
  - Fix minor problems found by covscan/gcc (#1196063)
  - Add missing options in man ssh (#1197763)
  - Add KbdInteractiveAuthentication documentation to man sshd_config (#1109251)
  - Correct freeing newkeys structure when privileged monitor exits (#1208584)


author: Jakub Jelen <jjelen@redhat.com> 5.3p1-113
changelog:
  - Fix segfaulting agent during removal of CAC credentials (#1253612)
  - Make  pam_namespace  usage consistent across system-wide (#1250069)
  - Add GSSAPIKexAlgorithms option for both server and client (#1253060)
  - ECDSA host key not loaded by sshd by default (fix man page) (#1218070)
  - Resolve segfault in pam_ssh_agent_auth in FIPS mode (#1278315)
  - Backport Match LocalAddress from OpenSSH 6.1 (#1211673)
  - Backport security patches from openssh-6.9 and 7.0 (#1281468)
  -  CVE-2015-5352: XSECURITY restrictions bypass under certain conditions
  -  CVE-2015-5600: MaxAuthTries limit bypass via duplicates in KbdInteractiveDevices
  -  CVE-2015-6563: Privilege separation weakness related to PAM support
  -  CVE-2015-6564: Use-after-free bug related to PAM support
  -  weakness of agent locking (ssh-add -x) to password guessing (#1238238)
  - Clarify a keyword that appears in multiple matching Match blocks (#1219820)
  - Clarity of TERM variable in AcceptEnv and SendEnv options (#1285003)
  - Enhance AllowGroups documentation in man page (#1284997)


author: Jakub Jelen <jjelen@redhat.com> 5.3p1-114
changelog:
  - pam_ssh_agent_auth: Provide authorized_keys_command= feature (#1299555)
  - CVE-2016-1908: Prevent possible fallback from untrusted X11 forwarding (#1299048)


author: Jakub Jelen <jjelen@redhat.com> 5.3p1-116
changelog:
  - Restore functionallity of pam_ssh_agent_auth in FIPS mode (#1278315)
  - Initialize devices_done variable for challenge response (#1281468)
  - Update behaviour of X11 forwarding to match upstream (#1299048)


author: Bernhard Rosenkrdnzer <bero@redhat.de>
changelog:
  - inital packaging
  - changes from base:
    - Move /usr/local/ssl to /usr/share/ssl for FHS compliance
    - handle RPM_OPT_FLAGS


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 0.9.5a, modified for U.S.
  - add perl as a build-time requirement
  - move certificate makefile to another package
  - disable RC5, IDEA, RSA support
  - remove optimizations for now


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - byte-compile python extensions without the build-root
  - adjust the makefile to not remove temporary files (like .key files when
    building .csr files) by marking them as .PRECIOUS


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - remove -Wa,* and -m* compiler flags from the default Configure file (#20656)
  - add the CA.pl man page to the perl subpackage


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - disable some inline assembly, which on x86 is Pentium-specific
  - re-enable MD2 (see http://www.ietf.org/ietf/IPR/RSA-MD-all)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - re-disable MD2 -- the EVP_MD_CTX structure would grow from 100 to 152
    bytes or so, causing EVP_DigestInit() to zero out stack variables in
    apps built against a version of the library without it


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 0.9.6
  - enable MD2
  - use the libcrypto.so and libssl.so targets to build shared libs with
  - bump the soversion to 1 because we're no longer compatible with any of
    the various 0.9.5a packages circulating around, which provide lib*.so.0


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 0.9.6a
  - use the build-shared target to build shared libraries
  - bump the soversion to 2 because we're no longer compatible with
    our 0.9.5a packages or our 0.9.6 packages
  - drop the patch for making rsatest a no-op when rsa null support is used
  - put all man pages into <section>ssl instead of <section>
  - break the m2crypto modules into a separate package


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add a script for creating dummy certificates
  - move man pages from %{_mandir}/man?/foo.?ssl to %{_mandir}/man?ssl/foo.?


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-3
changelog:
  - add patches for AEP hardware support
  - add patch to keep trying when we fail to load a cert from a file and
    there are more in the file
  - add missing prototype for ENGINE_ubsec() in engine_int.h


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-4
changelog:
  - move man pages back to %{_mandir}/man?/foo.?ssl from
    %{_mandir}/man?ssl/foo.?
  - add an [ engine ] section to the default configuration file


author: Gary Benson <gbenson@redhat.com> stronghold-0.9.6c-1
changelog:
  - upgrade to 0.9.6c
  - bump BuildArch to i686 and enable assembler on all platforms
  - synchronise with shrimpy and rawhide
  - bump soversion to 3


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-30
changelog:
  - add configuration stanza for x86_64 and use it on x86_64
  - build for linux-ppc on ppc
  - start running the self-tests again


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.7-6
changelog:
  - EVP_DecryptInit should call EVP_CipherInit() instead of EVP_CipherInit_ex(),
    to get the right behavior when passed uninitialized context structures
    (#83766)
  - build with -mcpu=ev5 on alpha family (#83828)


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.7-8
changelog:
  - add fix to guard against attempts to allocate negative amounts of memory
  - add patch for CAN-2003-0078, fixing a timing attack


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-5
changelog:
  - add patch to harden against Klima-Pokorny-Rosa extension of Bleichenbacher's
    attack (CAN-2003-0131)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - backport fix for engine-used-for-everything from 0.9.7b
  - backport fix for prng not being seeded causing problems, also from 0.9.7b
  - add a check at build-time to ensure that RSA is thread-safe
  - keep perlpath from stomping on the libica configure scripts


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add security fixes for protocol parsing bugs (CAN-2003-0543, CAN-2003-0544)
    and heap corruption (CAN-2003-0545)
  - update RHNS-CA-CERT files
  - ease back on the number of threads used in the threading test


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-22
changelog:
  - add -Wa,--noexecstack to RPM_OPT_FLAGS so that assembled modules get tagged
    as not needing executable stacks


author: Phil Knirsch <pknirsch@redhat.com> 0.9.7a-24
changelog:
  - Use /dev/urandom instead of PRNG for libica.
  - Apply libica-1.3.5 fix for /dev/urandom in icalinux.c
  - Use latest ICA engine patch from IBM.


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-25
changelog:
  - add dependency on zlib-devel for the -devel package, which depends on zlib
    symbols because we enable zlib for libssl (#102962)


author: Joe Orton <jorton@redhat.com> 0.9.7a-27
changelog:
  - updated ca-bundle.crt: removed expired GeoTrust roots, added
    freessl.com root, removed trustcenter.de Class 0 root


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-33
changelog:
  - add an intermediate <openssl/opensslconf.h> which points to the right
    arch-specific opensslconf.h on multilib arches


author: Tomas Mraz <tmraz@redhat.com> 0.9.7e-1
changelog:
  - new upstream source, updated patches
  - added patch so we are hopefully ABI compatible with upcoming
    0.9.7f


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-1
changelog:
  - reenable optimizations on ppc64 and assembly code on ia64
  - upgrade to new upstream version (no soname bump needed)
  - disable thread test - it was testing the backport of the
    RSA blinding - no longer needed
  - added support for changing serial number to
    Makefile.certificate (#151188)
  - make ca-bundle.crt a config file (#118903)


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-2
changelog:
  - add back RC4_CHAR on ia64 and x86_64 so the ABI isn't broken
  - disable broken bignum assembly on x86_64


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-3
changelog:
  - uninitialized variable mustn't be used as input in inline
    assembly
  - reenable the x86_64 assembly again


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-4
changelog:
  - move certificates to _sysconfdir/pki/tls (#143392)
  - move CA directories to _sysconfdir/pki/CA
  - patch the CA script and the default config so it points to the
    CA directories


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-6
changelog:
  - use poll instead of select in rand (#128285)
  - fix Makefile.certificate to point to /etc/pki/tls
  - change the default string mask in ASN1 to PrintableString+UTF8String


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-7
changelog:
  - fix CAN-2005-0109 - use constant time/memory access mod_exp
    so bits of private key aren't leaked by cache eviction (#157631)
  - a few more fixes from upstream 0.9.7g


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-9
changelog:
  - add *.so.soversion as symlinks in /lib (#165264)
  - remove unpackaged symlinks (#159595)
  - fixes from upstream (constant time fixes for DSA,
    bn assembler div on ppc arch, initialize memory on realloc)


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-10
changelog:
  - fix CAN-2005-2969 - remove SSL_OP_MSIE_SSLV2_RSA_PADDING which
    disables the countermeasure against man in the middle attack in SSLv2
    (#169863)
  - use sha1 as default for CA and cert requests - CAN-2005-2946 (#169803)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8a-4
changelog:
  - fix build (-lcrypto was erroneusly dropped) of the updated libica
  - updated ICA engine to 1.3.6-rc3


author: Tomas Mraz <tmraz@redhat.com> - 0.9.8a-6
changelog:
  - fix stale open handles in libica (#177155)
  - fix build if 'rand' or 'passwd' in buildroot path (#178782)
  - initialize VIA Padlock engine (#186857)


author: Tomas Mraz <tmraz@redhat.com> - 0.9.8b-1
changelog:
  - upgrade to new version, stays ABI compatible
  - there is no more linux/config.h (it was empty anyway)


author: Tomas Mraz <tmraz@redhat.com>
changelog:
  - add ipv6 support to s_client and s_server (by Jan Pazdziora) (#198737)
  - add patches for BN threadsafety, AES cache collision attack hazard fix and
    pkcs7 code memleak fix from upstream CVS


author: Tomas Mraz <tmraz@redhat.com> 0.9.8b-7
changelog:
  - fix CVE-2006-2937 - mishandled error on ASN.1 parsing (#207276)
  - fix CVE-2006-2940 - parasitic public keys DoS (#207274)
  - fix CVE-2006-3738 - buffer overflow in SSL_get_shared_ciphers (#206940)
  - fix CVE-2006-4343 - sslv2 client DoS (#206940)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8b-13
changelog:
  - allow building on ARM architectures (#245417)
  - use reference timestamps to prevent multilib conflicts (#218064)
  - -devel package must require pkgconfig (#241031)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8b-14
changelog:
  - use localhost in testsuite, hopefully fixes slow build in koji
  - CVE-2007-3108 - fix side channel attack on private keys (#250577)
  - make ssl session cache id matching strict (#233599)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8b-16
changelog:
  - fix CVE-2007-5135 - off-by-one in SSL_get_shared_ciphers (#309801)
  - fix CVE-2007-4995 - out of order DTLS fragments buffer overflow (#321191)
  - add alpha sub-archs (#296031)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8g-2
changelog:
  - enable some new crypto algorithms and features
  - add some more important bug fixes from openssl CVS


author: Tomas Mraz <tmraz@redhat.com> 0.9.8g-3
changelog:
  - set default paths when no explicit paths are set (#418771)
  - do not add tls extensions to client hello for SSLv3 (#422081)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8g-9
changelog:
  - fix CVE-2008-0891 - server name extension crash (#448492)
  - fix CVE-2008-1672 - server key exchange message omit crash (#448495)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8j-1
changelog:
  - new upstream version with necessary soname bump (#455753)
  - temporarily provide symlink to old soname to make it possible to rebuild
    the dependent packages in rawhide
  - add eap-fast support (#428181)
  - add possibility to disable zlib by setting
  - add fips mode support for testing purposes
  - do not null dereference on some invalid smime files
  - add buildrequires pkgconfig (#479493)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8j-6
changelog:
  - drop the temporary triggerpostun and symlinking in post
  - fix the pkgconfig files and drop the unnecessary buildrequires
    on pkgconfig as it is a rpmbuild dependency (#481419)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8j-7
changelog:
  - must also verify checksum of libssl.so in the FIPS mode
  - obtain the seed for FIPS rng directly from the kernel device
  - drop the temporary symlinks


author: Tomas Mraz <tmraz@redhat.com> 0.9.8k-1
changelog:
  - update to new upstream release (minor bug fixes, security
    fixes and machine code optimizations only)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8k-6
changelog:
  - abort if selftests failed and random number generator is polled
  - mention EVP_aes and EVP_sha2xx routines in the manpages
  - add README.FIPS
  - make CA dir absolute path (#445344)
  - change default length for RSA key generation to 2048 (#484101)


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-0.11.beta4
changelog:
  - update to new upstream version, no soname bump needed
  - fix CVE-2009-3555 - note that the fix is bypassed if SSL_OP_ALL is used
    so the compatibility with unfixed clients is not broken. The
    protocol extension is also not final.


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-0.12.beta4
changelog:
  - keep the beta status in version number at 3 so we do not have to rebuild
    openssh and possibly other dependencies with too strict version check


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-0.13.beta4
changelog:
  - disable enforcement of the renegotiation extension on the client (#537962)
  - add fixes from the current upstream snapshot


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-0.17.beta4
changelog:
  - upstream fix compression handling on session resumption
  - various null checks and other small fixes from upstream
  - upstream changes for the renegotiation info according to the latest draft


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-0.19.beta4
changelog:
  - fix CVE-2009-4355 - leak in applications incorrectly calling
    CRYPTO_free_all_ex_data() before application exit (#546707)
  - upstream fix for future TLS protocol version handling


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-0.21.beta5
changelog:
  - gracefully handle zero length in assembler implementations of
    OPENSSL_cleanse (#564029)
  - do not fail in s_server if client hostname not resolvable (#561260)


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-2
changelog:
  - make CA dir readable - the private keys are in private subdir (#584810)
  - a few fixes from upstream CVS
  - make X509_NAME_hash_old work in FIPS mode (#568395)


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-3
changelog:
  - fix wrong ASN.1 definition of OriginatorInfo - CVE-2010-0742 (#598738)
  - fix information leak in rsa_verify_recover - CVE-2010-1633 (#598732)


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-7
changelog:
  - listen on ipv6 wildcard in s_server so we accept connections
    from both ipv4 and ipv6 (#601612)
  - fix openssl speed command so it can be used in the FIPS mode
    with FIPS allowed ciphers (#619762)


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-8
changelog:
  - add -x931 parameter to openssl genrsa command to use the ANSI X9.31
    key generation method
  - use FIPS-186-3 method for DSA parameter generation
  - add OPENSSL_FIPS_NON_APPROVED_MD5_ALLOW environment variable
    to allow using MD5 when the system is in the maintenance state
    even if the /proc fips flag is on
  - make openssl pkcs12 command work by default in the FIPS mode


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-15
changelog:
  - better documentation of the available digests in apps (#693858)
  - backported CHIL engine fixes (#693863)
  - allow testing build without downstream patches (#708511)
  - enable partial RELRO when linking (#723994)
  - add intelx engine with improved performance on new Intel CPUs
  - add OPENSSL_DISABLE_AES_NI environment variable which disables
    the AES-NI support (does not affect the intelx engine)


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-16
changelog:
  - merge the optimizations for AES-NI, SHA1, and RC4 from the intelx
    engine to the internal implementations


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-21
changelog:
  - fix for CVE-2011-4108 & CVE-2012-0050 - DTLS plaintext recovery
    vulnerability and additional DTLS fixes (#771770)
  - fix for CVE-2011-4576 - uninitialized SSL 3.0 padding (#771775)
  - fix for CVE-2011-4577 - possible DoS through malformed RFC 3779 data (#771778)
  - fix for CVE-2011-4619 - SGC restart DoS attack (#771780)


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-23
changelog:
  - fix problem with the SGC restart patch that might terminate handshake
    incorrectly
  - fix for CVE-2012-0884 - MMA weakness in CMS and PKCS#7 code (#802725)
  - fix for CVE-2012-1165 - NULL read dereference on bad MIME headers (#802489)


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-25
changelog:
  - fix for CVE-2012-2333 - improper checking for record length in DTLS (#820686)
  - properly initialize tkeylen in the CVE-2012-0884 fix


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-26
changelog:
  - use PKCS#8 when writing private keys in FIPS mode as the old
    PEM encryption mode is not FIPS compatible (#812348)


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-27
changelog:
  - fix sslrand(1) and sslpasswd(1) reference in openssl(1) manpage (#841645)
  - drop superfluous lib64 fixup in pkgconfig .pc files (#770872)
  - force BIO_accept_new(*:<port-number>) to listen on IPv4


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-28
changelog:
  - fix for CVE-2013-0169 - SSL/TLS CBC timing attack (#907589)
  - fix for CVE-2013-0166 - DoS in OCSP signatures checking (#908052)
  - enable compression only if explicitly asked for or OPENSSL_DEFAULT_ZLIB
    environment variable is set (fixes CVE-2012-4929 #857051)
  - use __secure_getenv() everywhere instead of getenv() (#839735)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-15
changelog:
  - make DTLS1 work in FIPS mode
  - avoid RSA and DSA 512 bits and Whirlpool in 'openssl speed' in FIPS mode


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-21
changelog:
  - add DH_compute_key_padded needed for FIPS CAVS testing
  - make 3des strength to be 128 bits instead of 168 (#1056616)
  - FIPS mode: do not generate DSA keys and DH parameters < 2048 bits
  - FIPS mode: use approved RSA keygen (allows only 2048 and 3072 bit keys)
  - FIPS mode: add DH selftest
  - FIPS mode: reseed DRBG properly on RAND_add()
  - FIPS mode: add RSA encrypt/decrypt selftest
  - FIPS mode: add hard limit for 2^32 GCM block encryptions with the same key
  - use the key length from configuration file if req -newkey rsa is invoked


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-25
changelog:
  - fix CVE-2010-5298 - possible use of memory after free
  - fix CVE-2014-0195 - buffer overflow via invalid DTLS fragment
  - fix CVE-2014-0198 - possible NULL pointer dereference
  - fix CVE-2014-0221 - DoS from invalid DTLS handshake packet
  - fix CVE-2014-0224 - SSL/TLS MITM vulnerability
  - fix CVE-2014-3470 - client-side DoS when using anonymous ECDH


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-26
changelog:
  - drop EXPORT, RC2, and DES from the default cipher list (#1057520)
  - print ephemeral key size negotiated in TLS handshake (#1057715)
  - do not include ECC ciphersuites in SSLv2 client hello (#1090952)
  - properly detect encryption failure in BIO (#1100819)
  - fail on hmac integrity check if the .hmac file is empty (#1105567)
  - FIPS mode: make the limitations on DSA, DH, and RSA keygen
    length enforced only if OPENSSL_ENFORCE_MODULUS_BITS environment
    variable is set


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-29
changelog:
  - fix CVE-2014-3505 - doublefree in DTLS packet processing
  - fix CVE-2014-3506 - avoid memory exhaustion in DTLS
  - fix CVE-2014-3507 - avoid memory leak in DTLS
  - fix CVE-2014-3508 - fix OID handling to avoid information leak
  - fix CVE-2014-3509 - fix race condition when parsing server hello
  - fix CVE-2014-3510 - fix DoS in anonymous (EC)DH handling in DTLS
  - fix CVE-2014-3511 - disallow protocol downgrade via fragmentation


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-31
changelog:
  - fix CVE-2014-3567 - memory leak when handling session tickets
  - fix CVE-2014-3513 - memory leak in srtp support
  - add support for fallback SCSV to partially mitigate CVE-2014-3566
    (padding attack on SSL3)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-33
changelog:
  - fix CVE-2014-3570 - incorrect computation in BN_sqr()
  - fix CVE-2014-3571 - possible crash in dtls1_get_record()
  - fix CVE-2014-3572 - possible downgrade of ECDH ciphersuite to non-PFS state
  - fix CVE-2014-8275 - various certificate fingerprint issues
  - fix CVE-2015-0204 - remove support for RSA ephemeral keys for non-export
    ciphersuites and on server
  - fix CVE-2015-0205 - do not allow unauthenticated client DH certificate
  - fix CVE-2015-0206 - possible memory leak when buffering DTLS records


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-34
changelog:
  - copy digest algorithm when handling SNI context switch
  - improve documentation of ciphersuites - patch by Hubert Kario
  - add support for setting Kerberos service and keytab in
    s_server and s_client


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-35
changelog:
  - fix CVE-2015-0209 - potential use after free in d2i_ECPrivateKey()
  - fix CVE-2015-0286 - improper handling of ASN.1 boolean comparison
  - fix CVE-2015-0287 - ASN.1 structure reuse decoding memory corruption
  - fix CVE-2015-0288 - X509_to_X509_REQ NULL pointer dereference
  - fix CVE-2015-0289 - NULL dereference decoding invalid PKCS#7 data
  - fix CVE-2015-0292 - integer underflow in base64 decoder
  - fix CVE-2015-0293 - triggerable assert in SSLv2 server


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-37
changelog:
  - drop the AES-GCM restriction of 2^32 operations because the IV is
    always 96 bits (32 bit fixed field + 64 bit invocation field)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-38
changelog:
  - fix CVE-2015-4000 - prevent the logjam attack on client - restrict
    the DH key size to at least 768 bits (limit will be increased in future)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-39
changelog:
  - fix CVE-2015-3216 - regression in RAND locking that can cause segfaults on
    read in multithreaded applications


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-40
changelog:
  - fix CVE-2014-8176 - invalid free in DTLS buffering code
  - fix CVE-2015-1789 - out-of-bounds read in X509_cmp_time
  - fix CVE-2015-1790 - PKCS7 crash with missing EncryptedContent
  - fix CVE-2015-1791 - race condition handling NewSessionTicket
  - fix CVE-2015-1792 - CMS verify infinite loop with unknown hash function


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-41
changelog:
  - improved fix for CVE-2015-1791
  - add missing parts of CVE-2015-0209 fix for corectness although unexploitable


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-43
changelog:
  - fix CVE-2015-3194 - certificate verify crash with missing PSS parameter
  - fix CVE-2015-3195 - X509_ATTRIBUTE memory leak
  - fix CVE-2015-3196 - race condition when handling PSK identity hint


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-46
changelog:
  - fix 1-byte memory leak in pkcs12 parse (#1229871)
  - document some options of the speed command (#1197095)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-48
changelog:
  - fix CVE-2016-0702 - side channel attack on modular exponentiation
  - fix CVE-2016-0705 - double-free in DSA private key parsing
  - fix CVE-2016-0797 - heap corruption in BN_hex2bn and BN_dec2bn


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-48.1
changelog:
  - fix CVE-2016-2105 - possible overflow in base64 encoding
  - fix CVE-2016-2106 - possible overflow in EVP_EncryptUpdate()
  - fix CVE-2016-2107 - padding oracle in stitched AES-NI CBC-MAC
  - fix CVE-2016-2108 - memory corruption in ASN.1 encoder
  - fix CVE-2016-2109 - possible DoS when reading ASN.1 data from BIO
  - fix CVE-2016-0799 - memory issues in BIO_printf


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-48.3
changelog:
  - fix CVE-2016-2177 - possible integer overflow
  - fix CVE-2016-2178 - non-constant time DSA operations
  - fix CVE-2016-2179 - further DoS issues in DTLS
  - fix CVE-2016-2180 - OOB read in TS_OBJ_print_bio()
  - fix CVE-2016-2181 - DTLS1 replay protection and unprocessed records issue
  - fix CVE-2016-2182 - possible buffer overflow in BN_bn2dec()
  - fix CVE-2016-6302 - insufficient TLS session ticket HMAC length check
  - fix CVE-2016-6304 - unbound memory growth with OCSP status request
  - fix CVE-2016-6306 - certificate message OOB reads
  - mitigate CVE-2016-2183 - degrade all 64bit block ciphers and RC4 to
    112 bit effective strength
  - replace expired testing certificates


author: Weiping Pan <wpan@redhat.com> 2.0.8.rh1 2
changelog:
  - rebuild oracleasm for RHEL6.5, sync to upstream commit d368091e98dc
  - (oracleasm: Add support for new error return codes from block/SCSI)


author: Weiping Pan <wpan@redhat.com> 2.0.8 4
changelog:
  - add  .clear_inode callback, fix bug 1157408.
  - rebuild oracleasm for RHEL6.6 in brew, update the version to 2.0.8-4


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.4-2
changelog:
  - Reference authors from the project AUTHORS file instead of listing in description
  - Change Source0 to reference the project's Mercurial repo
  - Cleaned up the summaries and descriptions
  - Incorporate the results of Fedora package self-review


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.4-3
changelog:
  - Include an AUTHORS and license file in each package
  - Change the library package name to pacemaker-libs to be more
    Fedora compliant
  - Remove execute permissions from xml related files
  - Reference the new cluster-glue devel package name
  - Update the tarball from upstream to version c9120a53a6ae
    + High: PE: Only prevent migration if the clone dependancy is stopping/starting on the target node
    + High: PE: Bug 2160 - Dont shuffle clones due to colocation
    + High: PE: New implementation of the resource migration (not stop/start) logic
    + Medium: Tools: crm_resource - Prevent use-of-NULL by requiring a resource name for the -A and -a options
    + Medium: PE: Prevent use-of-NULL in find_first_action()
    + Low: Build: Include licensing files


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.5-0.4.c9120a53a6ae.hg
changelog:
  - Incorporate the feedback from the cluster-glue review
  - Realistically, the version is a 1.0.5 pre-release
  - Use the global directive instead of define for variables
  - Use the haclient/hacluster group/user instead of daemon
  - Use the _configure macro
  - Fix install dependancies


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.5-1
changelog:
  - Add dependancy on resource-agents
  - Use the version of the configure macro that supplies --prefix, --libdir, etc
  - Update the tarball from upstream to version 462f1569a437 (Pacemaker 1.0.5 final)
    + High: Tools: crm_resource - Advertise --move instead of --migrate
    + Medium: Extra: New node connectivity RA that uses system ping and attrd_updater
    + Medium: crmd: Note that dc-deadtime can be used to mask the brokeness of some switches


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.5-2
changelog:
  - Add versioned perl dependancy as specified by
      https://fedoraproject.org/wiki/Packaging/Perl#Packages_that_link_to_libperl
  - No longer remove RPATH data, it prevents us finding libperl.so and no other
    libraries were being hardcoded
  - Compile in support for heartbeat
  - Conditionally add heartbeat-devel and corosynclib-devel to the -devel requirements
    depending on which stacks are supported


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.5-3
changelog:
  - Update the tarball from upstream to version 38cd629e5c3c
    + High: Core: Bug lf#2169 - Allow dtd/schema validation to be disabled
    + High: PE: Bug lf#2106 - Not all anonymous clone children are restarted after configuration change
    + High: PE: Bug lf#2170 - stop-all-resources option had no effect
    + High: PE: Bug lf#2171 - Prevent groups from starting if they depend on a complex resource which can't
    + High: PE: Disable resource management if stonith-enabled=true and no stonith resources are defined
    + High: PE: Don't include master score if it would prevent allocation
    + High: ais: Avoid excessive load by checking for dead children every 1s (instead of 100ms)
    + High: ais: Bug rh#525589 - Prevent shutdown deadlocks when running on CoroSync
    + High: ais: Gracefully handle changes to the AIS nodeid
    + High: crmd: Bug bnc#527530 - Wait for the transition to complete before leaving S_TRANSITION_ENGINE
    + High: crmd: Prevent use-after-free with LOG_DEBUG_3
    + Medium: xml: Mask the "symmetrical" attribute on rsc_colocation constraints (bnc#540672)
    + Medium (bnc#520707): Tools: crm: new templates ocfs2 and clvm
    + Medium: Build: Invert the disable ais/heartbeat logic so that --without (ais|heartbeat) is available to rpmbuild
    + Medium: PE: Bug lf#2178 - Indicate unmanaged clones
    + Medium: PE: Bug lf#2180 - Include node information for all failed ops
    + Medium: PE: Bug lf#2189 - Incorrect error message when unpacking simple ordering constraint
    + Medium: PE: Correctly log resources that would like to start but can't
    + Medium: PE: Stop ptest from logging to syslog
    + Medium: ais: Include version details in plugin name
    + Medium: crmd: Requery the resource metadata after every start operation


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.5-4
changelog:
  - Include the fixes from CoroSync integration testing
  - Move the resource templates - they're not documentation
  - Ensure documentation is placed in a standard location
  - Exclude documentation that is included elsewhere in the package

  - Update the tarball from upstream to version ee19d8e83c2a
    + High: cib: Correctly clean up when both plaintext and tls remote ports are requested
    + High: PE: Bug bnc#515172 - Provide better defaults for lt(e) and gt(e) comparisions
    + High: PE: Bug lf#2197 - Allow master instances placemaker to be influenced by colocation constraints
    + High: PE: Make sure promote/demote pseudo actions are created correctly
    + High: PE: Prevent target-role from promoting more than master-max instances
    + High: ais: Bug lf#2199 - Prevent expected-quorum-votes from being populated with garbage
    + High: ais: Prevent deadlock - dont try to release IPC message if the connection failed
    + High: cib: For validation errors, send back the full CIB so the client can display the errors
    + High: cib: Prevent use-after-free for remote plaintext connections
    + High: crmd: Bug lf#2201 - Prevent use-of-NULL when running heartbeat


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.5-6
changelog:
  - Let snmp automatically pull in lm_sensors-devel if required
    and available on that arch (its not on s390x)


author: Andrew Beekhof <andrew@beekhof.net> - 1.1.0-0.1-00d9bcac8775.hg
changelog:
  - Related: rhbz#rhbz#543948
  - Update the tarball from upstream to version 00d9bcac8775
    + High: PE: Bug 2213 - Ensure groups process location constraints so that clone-node-max works for cloned groups
    + High: PE: Bug lf#2153 - Update regression tests
    + High: PE: Bug lf#2153 - non-clones shouldn't restart when clones stop/start on other nodes
    + High: PE: Bug lf#2209 - Clone ordering should be able to prevent startup of dependant clones
    + High: PE: Bug lf#2216 - Correctly identify the state of anonymous clones when deciding when to probe
    + High: PE: Bug lf#2225 - Operations that require fencing should wait for 'stonith_complete' not 'all_stopped'.
    + High: PE: Bug lf#2225 - Prevent clone peers from stopping while another is instance is (potentially) being fenced
    + High: PE: Correctly anti-colocate with a group
    + High: PE: Correctly unpack ordering constraints for resource sets to avoid graph loops
    + High: Replace stonithd with the new fencing subsystem
    + High: cib: Ensure the loop searching for a remote login message terminates
    + High: cib: Finally fix reliability of receiving large messages over remote plaintext connections
    + High: cib: Fix remote notifications
    + High: cib: For remote connections, default to CRM_DAEMON_USER since thats the only one that the cib can validate the password for using PAM
    + High: cib: Remote plaintext - Retry sending parts of the message that didn't fit the first time
    + Medium: PE: Bug lf#2206 - rsc_order constraints always use score at the top level
    + Medium: PE: Provide a default action for resource-set ordering
    + Medium: PE: Silently fix requires=fencing for stonith resources so that it can be set in op_defaults
    + Medium: ais: Some clients such as gfs_controld want a cluster name, allow one to be specified in corosync.conf
    + Medium: cib: Create valid notification control messages
    + Medium: cib: Indicate where the remote connection came from
    + Medium: cib: Send password prompt to stderr so that stdout can be redirected
    + Medium: extra: Add the daemon parameter to the controld metadata
    + Medium: fencing: Re-engineer the stonith daemon to support RHCS agents
    + Medium: tools: Make crm_mon functional with remote connections
    + Medium: xml: Bug bnc#552713 - Treat node unames as text fields not IDs
    + Medium: xml: Bug lf#2215 - Create an always-true expression for empty rules when upgrading from 0.6


author: Andrew Beekhof <andrew@beekhof.net> - 1.1.0-1
changelog:
  - Related: rhbz#543948
  - Update the tarball from upstream to version 07ab245be519
    + High: crmd: Always connect to stonith
    + High: crmd: Ensure batch-limit is correctly enforced
    + High: crmd: Ensure we have the latest status after a transition abort
    + High: Fencing: Overhaul the fencing daemon
    + High: PE: Bug lf#2153 - non-clones shouldn't restart when clones stop/start on other nodes - improved
    + Medium: PE: Allow resource sets to be reused between ordering and colocation constraints
    + Medium: PE: Implement serializing order constraints that dont cause restarts or inhibit migration
    + Medium: PE: Include node attributes for the node to be fenced
    + Medium: PE: Make crm_simulate a full replacement for ptest
    + Medium: PE: Only complain about target-role=master for non m/s resources
    + Medium: PE: Prevent non-multistate resources from being promoted through target-role
    + Medium: PE: Simplify the rsc_order syntax - don't make funky inferences based on score
    + Medium: PE: Support serialized sets of resources
    + Medium: Tools: Bug lf#2286 - Allow the shell to accept template parameters on the command line
    + Medium: Tools: Bug lf#2307 - Provide a way to determin the nodeid of past cluster members
    + Medium: Tools: crm: add update method to template apply (LF 2289)
    + Medium: Tools: crm: direct RA interface for stonith class resource agents (LF 2270)
    + Medium: Tools: crm: don't remove sets which contain id-ref attribute (LF 2304)
    + Medium: Tools: crm: exclude locations when testing for pathological constraints (LF 2300)
    + Medium: Tools: crm: fix exit code on single shot commands
    + Medium: Tools: crm: fix node delete (LF 2305)
    + Medium: Tools: crm: implement -F (--force) option
    + Medium: Tools: crm: rename status to cibstatus (LF 2236)
    + Medium: Tools: crm: stay in crm if user specified level only (LF 2286)


author: Andrew Beekhof <andrew@beekhof.net> - 1.1.1-1
changelog:
  - Resolves: rhbz#559868
  - Split off the doc package as it has grown quite large
  - Split off the cluster test suite (CTS) so that it can be used by other projects
  - Update the tarball from upstream to version 46e288ab9014
    + High: PE: Repair handling of unordered groups in RHS ordering constraints
    + High: Agents: Prevent shell expansion of '*' when there are files in /var/lib/heartbeat/cores/root
    + High: ais: Bug lf#2340 - Force rogue child processes to terminate after waiting 2.5 minutes
    + High: ais: Bug lf#2359 - Default expected votes to 2 inside Corosync/OpenAIS plugin
    + High: ais: Bug lf#2359 - expected-quorum-votes not correctly updated after membership change
    + High: ais: Bug rhbz#525552 - Move non-threadsafe calls to setenv() to after the fork()
    + High: crmd: Bug bnc#578644 - Improve handling of cancelled operations caused by resource cleanup
    + High: crmd: Make sure we wait for fencing to complete before continuing
    + High: crmd: Prevent use-of-NULL when non-DCs get stonith callbacks
    + High: Fencing: Account for stonith_get_info() always returning a pointer to the same static buffer
    + High: Fencing: Bug bnc#577007 - Correctly parse the hostlist output from stonith agents
    + High: Fencing: Correctly parse arg maps and do not return a provider for unknown agents
    + High: fencing: Fix can_fence_host_with_device() logic and improve hostlist output parsing
    + High: PE: Bug lf#2358 - Fix master-master anti-colocation
    + High: PE: Correctly implement optional colocation between primitives and clone resources
    + High: PE: Suppress duplicate ordering constraints to achieve orders of magnitude speed increases for large clusters
    + High: Shell: move scores from resource sets to the constraint element (lf#2331)
    + High: Shell: recovery from bad/outdated help index file
    + Medium: Shell: implement lifetime for rsc migrate and node standby (lf#2353)
    + Medium: Shell: node attributes update in configure (bnc#582767)


author: Andrew Beekhof <andrew@beekhof.net> 1.1.2-2
changelog:
  - Do not build on ppc and ppc64.
    Resolves: rhbz#590992
  - Rebase on new upstream release
    + High: ais: Do not count votes from offline nodes and calculate current votes before sending quorum data
    + High: ais: Ensure the list of active processes sent to clients is always up-to-date
    + High: ais: Look for the correct conf variable for turning on file logging
    + High: ais: Use the threadsafe version of getpwnam
    + High: Core: Bug lf#2414 - Prevent use-after-free reported by valgrind when doing xpath based deletions
    + High: Core: fix memory leaks exposed by valgrind
    + High: crmd: Bug 2401 - Improved detection of partially active peers
    + High: crmd: Bug lf#2379 - Ensure the cluster terminates when the PE is not available
    + High: crmd: Bug lf#2414 - Prevent use-after-free of the PE connection after it dies
    + High: crmd: Bug lf#2414 - Prevent use-after-free of the stonith-ng connection
    + High: crmd: Do not allow the target_rc to be misused by resource agents
    + High: crmd: Do not ignore action timeouts based on FSA state
    + High: crmd: Ensure we dont get stuck in S_PENDING if we loose an election to someone that never talks to us again
    + High: crmd: Fix memory leaks exposed by valgrind
    + High: crmd: Remove race condition that could lead to multiple instances of a clone being active on a machine
    + High: crmd: Send erase_status_tag() calls to the local CIB when the DC is fenced, since there is no DC to accept them
    + High: crmd: Use global fencing notifications to prevent secondary fencing operations of the DC
    + High: PE: Bug lf#2317 - Avoid needless restart of primitive depending on a clone
    + High: PE: Bug lf#2361 - Ensure clones observe mandatory ordering constraints if the LHS is unrunnable
    + High: PE: Bug lf#2383 - Combine failcounts for all instances of an anonymous clone on a host
    + High: PE: Bug lf#2384 - Fix intra-set colocation and ordering
    + High: PE: Bug lf#2403 - Enforce mandatory promotion (colocation) constraints
    + High: PE: Bug lf#2412 - Correctly locate clone instances by their prefix
    + High: PE: Don ot be so quick to pull the trigger on nodes that are coming up
    + High: PE: Fix memory leaks exposed by valgrind
    + High: PE: Repair handling of unordered groups in RHS ordering constraints
    + High: PE: Rewrite native_merge_weights() to avoid Fix use-after-free
    + High: Shell: always reload status if working with the cluster (bnc#590035)
    + High: Shell: check timeouts also against the default-action-timeout property
    + High: Shell: Default to using the status section from the live CIB (bnc#592762)
    + High: Shell: edit multiple meta_attributes sets in resource management (lf#2315)
    + High: Shell: enable comments (lf#2221)
    + High: Tools: crm_mon - fix memory leaks exposed by valgrind


author: Andrew Beekhof <andrew@beekhof.net> 1.1.2-3
changelog:
  - Resolves: rhbz#590667
  - Rebase on new upstream release
    + High: Core: Bug lf#2401 - Backed out changeset 6e6980376f01


author: Andrew Beekhof <andrew@beekhof.net> 1.1.2-5
changelog:
  - Resolves: rhbz#594296 - rpmdiff checks
    + Remove legacy scripts
    + Add missing man pages
    + Fix sub-package version requires


author: Andrew Beekhof <andrew@beekhof.net> 1.1.2-6
changelog:
  - Resolves: rhbz#610815 - add cman support
    + High: cib: Also free query result for xpath operations that return more than one hit
    + High: cib: Fix the application of unversioned diffs
    + High: Core: Correctly unpack HA_Messages containing multiple entries with the same name
    + High: Core: Resolve coverity RESOURCE_LEAK defects
    + High: crmd: All nodes should see status updates, not just he DC
    + High: crmd: Allow non-DC nodes to clear failcounts too
    + High: crmd: Base DC election on process relative uptime
    + High: crmd: Make sure the membership cache is accurate after a sucessful fencing operation
    + High: crmd: Make sure we always poke the FSA after a transition to clear any TE_HALT actions
    + High: crmd: Prevent segmentation fault
    + High: PE: Avoid creating invalid ordering constraints for probes that are not needed
    + High: PE: Bug lf#1959 - Fail unmanaged resources should not prevent other services from shutting down
    + High: PE: Bug lf#2422 - Ordering dependencies on partially active groups not observed properly
    + High: PE: Bug lf#2424 - Use notify oepration definition if it exists in the configuration
    + High: PE: Bug lf#2433 - No services should be stopped until probes finish
    + High: PE: Correctly detect when there is a real failcount that expired and needs to be cleared
    + High: PE: Correctly handle pseudo action creation
    + High: PE: Fix colocation for interleaved clones
    + High: PE: Fix colocation with partially active groups
    + High: PE: Fix potential use-after-free defect from coverity
    + High: PE: Fix use-after-free in order_actions() reported by valgrind
    + High: PE: Prevent endless loop when looking for operation definitions in the configuration
    + High: stonith: Correctly parse pcmk_host_list parameters that appear on a single line
    + High: tools: crm_simulate - Resolve coverity USE_AFTER_FREE defect


author: Andrew Beekhof <andrew@beekhof.net> 1.1.2-7
changelog:
  - Resolves: rhbz#610815 - add cman support
    + High: ais: Use service slot 10 to avoid conflicting with cman


author: Andrew Beekhof <andrew@beekhof.net> 1.1.4-1
changelog:
  - Resolves: rhbz#668466
  - Update tarball to upstream version: 3ac6ac993d6d
    + Performance improvements for larger clusters
    + Miscellaneous bug fixes


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.5-1
changelog:
  - Fix rpmlint warnings
  - Rebase on new upstream release
    See included ChangeLog file or http://hg.clusterlabs.org/pacemaker/1.1/file/tip/ChangeLog for details
    + Bugs lf#2445, lf#2493, lf#2508, lf#2518, lf#2527, lf#2544,
           lf#2545, lf#2550, lf#2551, lf#2554, lf#2558, bnc#665131
  - Resolves: rhbz#676286 - Add per device 'diag' option to pacemaker stonith action


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.5-2
changelog:
  - Fix cman integration
  - Resolves: rhbz#684838 - Correctly notify fenced of a successful fencing event
  - Resolves: rhbz#684825 - Ensure Pacemaker uses the most recent membership/quorum information


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.5-6
changelog:
  - Update tarball to upstream version: b933cbea41b5
  - Resolves: rhbz#708797
  - Resolves: rhbz#451848
  - Resolves: rhbz#708722
  - Resolves: rhbz#720136


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.6-1
changelog:
  - Update tarball to upstream version: a02c0f1
    See included ChangeLog file or, for full details:
      https://github.com/ClusterLabs/pacemaker/compare/a12de08...a02c0f1
  - Do not build in support for snmp, esmtp by default
  - Create a package for cluster unaware libraries to minimze our footprint
    on non-cluster nodes
  - Better subpackage descriptions
  - Resolves: rhbz#743175


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.7-1
changelog:
  - Update tarball to upstream version: 148fccf
    See included ChangeLog file or, for full details:
      https://github.com/ClusterLabs/pacemaker/compare/148fccf...a12de08
  - Add libqb-devel as a build dependancy
  - Resolves: rhbz#782255 rhbz#754216 rhbz#729035
  - Related:  rhbz#790627


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.7-2
changelog:
  - Update patch level to upstream version: c26e624
  - Resolves: rhbz#720214 rhbz#720218 rhbz#754216 rhbz#789397
    For full details, see:
      https://github.com/ClusterLabs/pacemaker/compare/c26e624...148fccf


author: David Vossel <dvossel@redhat.com> - 1.1.7-3
changelog:
  - Add libqb-devel as a dependancy of pacemaker-libs-devel
  - Medium: PE: Report resources as active in correct data about resource location
    Resolves:  rhbz#799070
  - Low: Tools: Bug rhbz#801351 - Fix crm_report help text
    Resolves: rhbz#801351


author: David Vossel <dvossel@redhat.com> - 1.1.7-5
changelog:
  - Use default value for HB_DAEMON_DIR define when clusterglue does not provide one.
    Resolves: rhbz#808557


author: Andrew Beekhof <andrew@beekhof.net> 1.1.8-1
changelog:
  - Rebuild for upstream 1.1.8 release
  - Resolves: rhbz#816875

  - See included ChangeLog file or https://raw.github.com/ClusterLabs/pacemaker/master/ChangeLog for full details

    + New IPC implementation from libqb
    + New logging implementation from libqb
    + Quieter - info, debug and trace logs are no longer sent to syslog
    + Dropped dependancy on cluster-glue
    + Config and core directories no longer located in heartbeat directories
    + Support for managing systemd services
    + Rewritten local resource management daemon
    + Version bumps for every shared library due to API cleanups
    + Removes crm shell, install/use pcs shell and GUI instead


author: Andrew Beekhof <andrew@beekhof.net> 1.1.8-2
changelog:
  - Fix internal package dependancies
  - Resolves: rhbz#816875

  - Update to upstream 0b45588
    + Correctly disable syslog output when requested
    + Warn about node names containing a capital letter
    + Do not start fencing until entire device topology is found or query results timeout.
    + Allow nodes to use a name other than uname()


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.8-4
changelog:
  - Resolves: rhbz#816875
  - Update to upstream db9410b

    + Cluster: Detect node name collisions in corosync
    + Cluster: Strip domains from node names by default
    + Core: Prevent ordering changes when applying xml diffs
    + Fencing: On failure, only try a topology device once from the remote level.
    + Fencing: Retry stonith device for duration of action's timeout period.
    + Fencing: Support 'on_target' option in fencing device metadata for forcing unfence on target node
    + mcp: Re-attach to existing pacemaker components when mcp fails
    + pengine: Bug cl#5101 - Ensure stop order is preserved for partially active groups
    + pengine: Bug cl#5111 - When clone/master child rsc has on-fail=stop, insure all children stop on failure.
    + pengine: Correctly unpack active anonymous clones
    + pengine: Support a 'requires' resource meta-attribute for controlling whether it needs quorum, fencing or nothing
    + pengine: Support resources that require unfencing before start


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.8-5
changelog:
  - Resolves: rhbz#877364
  - Update to upstream e69dfc1

    + attrd: Correctly handle deletion of non-existant attributes
    + cib: Do not pass local variables to mainloop_add_fd() when creating remote connections
    + Cluster: Do not strip the domain from node names calculated from uname(2)
    + Core: Supply the correct number of arguments for the format string
    + corosync: Avoid errors when closing failed connections
    + fencing: Automatically append 'nodeid' to fencing agent args if it is detected agent supports 'nodeid' parameter
    + mcp: chmod the correct directory instead of /var/run
    + pengine: Prevent double-free for cloned primitive from template


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.8-6
changelog:
  - Resolves: rhbz#877364
  - Update to upstream d20d06f

    + cib: Avoid use-after-free by correctly support cib_no_children for non-xpath queries
    + cib: Remove text nodes from cib replace operations
    + Cluster: Preserve corosync membership state when matching node name/id entries
    + cman: Do not wait for unmanaged resources during shutdown
    + cman: Ensure reliable shutdown
    + cman: Ignore qdisk 'nodes'
    + Core: Prevent use-of_NULL in IPC code
    + corosync: Ensure peer state is preserved when matching names to nodeids
    + crmd: Avoid filling the ipc queue with data we don't need
    + crmd: Prevent election storms caused by getrusage() values being too close
    + Fencing: Correctly terminate when all device options have been exhausted
    + Fencing: Record delegated self-fencing operations in case they fail
    + legacy: Re-enable logging from the pacemaker plugin
    + pengine: Bug rhbz#880249 - Ensure orphan masters are demoted before being stopped
    + pengine: Bug rhbz#880249 - Teach the PE how to recover masters into primitives
    + pengine: Ensure previous migrations are completed before attempting another one
    + tools: crm_report - Fix node list detection


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.8-7
changelog:
  - Resolves: rhbz#880249
  - Update to upstream ca7bf5e

    + Fencing: Only try peers for non-topology based operations once
    + tools: Have crm_resource generate a valid transition key when sending resource commands to the crmd


author: Andrew Beekhof <andrew@beekhof.net> 1.1.10-1
changelog:
  - Update source tarball to revision: Pacemaker-1.1.10
  - See included ChangeLog file or https://raw.github.com/ClusterLabs/pacemaker/master/ChangeLog for full details

  - Resolves: rhbz#891766
  - Resolves: rhbz#902407
  - Resolves: rhbz#908450
  - Resolves: rhbz#913093
  - Resolves: rhbz#951340
  - Resolves: rhbz#951371
  - Related: rhbz#987355


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-3
changelog:
  + Fix: pengine: Do not restart resources that depend on unmanaged resources
    + Fix: crmd: Prevent recurring monitors being cancelled due to notify operations


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-4
changelog:
  + Fix: crmd: Prevent crash by passing log arguments in the correct order
    + Fix: pengine: Do not re-allocate clone instances that are blocked in the Stopped state
    + Fix: pengine: Do not allow colocation with blocked clone instances


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-5
changelog:
  + Fix: systemd: Prevent glib assertion - only call g_error_free with non-NULL arguments
    + Fix: systemd: Prevent additional use-of-NULL assertions in g_error_free
    + Fix: logging: glib CRIT messages should not produce core files in the background
    + Fix: crmd: Correcty update the history cache when recurring ops change their return code
    + Log: crm_mon: Unmangle the output for failed operations
    + Log: cib: Correctly log short-form xml diffs
    + Log: pengine: Better indicate when a resource has failed


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-7
changelog:
  + Fencing: Support agents that need the host to be unfenced at startup
      Resolves: rhbz#996850
    + Fix: crm_report: Collect corosync quorum data
      Resolves: rhbz#989292


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-8
changelog:
  + Fix: mcp: Remove LSB hints that instruct chkconfig to start pacemaker at boot time
      Resolves: rhbz#997346


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-9
changelog:
  + Fix: xml: Location constraints are allowed to specify a role
    + Bug rhbz#902407 - crm_resource: Handle --ban for master/slave resources as advertised
      Resolves: rhbz#902407


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-10
changelog:
  - Remove unsupported resource agent
      Resolves: rhbz#1005678
  - Provide a meaningful error if --master is used for primitives and groups


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-11
changelog:
  + Fix: cman: Do not start pacemaker if cman startup fails
    + Fix: Fencing: Observe pcmk_host_list during automatic unfencing
      Resolves: rhbz#996850


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-12
changelog:
  - Fix: Consistently use 'Slave' as the role for unpromoted master/slave resources
      Resolves: rhbz#1011618
  - Fix: pengine: Location constraints with role=Started should prevent masters from running at all
      Resolves: rhbz#902407
  - Fix: crm_resource: Observe --master modifier for --move
      Resolves: rhbz#902407


author: Andrew Beekhof <beekhof@redhat.com> - 1.1.10-14
changelog:
  - Log: crmd: Supply arguments in the correct order
      Resolves: rhbz#996850
  - Fix: Invalid formatting of log message causes crash
      Resolves: rhbz#996850


author: David Vossel <dvossel@redhat.com> - 1.1.10-15
changelog:
  - Fix: Removes unnecessary newlines in crm_resource -O output
      Resolves: rhbz#1038155
  - Fix: lrmd: Correctly cancel monitor actions for lsb/systemd/service resources on cleaning up (cherry picked from commit 1c14b9d69470ff56fd814091867394cd0a1cf61d)
      Resolves: rhbz#1046131
  - Fix: services: Fixes segfault associated with cancelling in-flight recurring operations.
      Resolves: rhbz#1046131


author: David Vossel <dvossel@redhat.com> - 1.1.10-16
changelog:
  - Fix: pengine: fixes invalid transition caused by clones with more than 10 instances
      Resolves: rhbz#1078954


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.12-1
changelog:
  - Update to upstream release 1.1.12-rc3
  - The CIB has O(2) better performance and updates are applied with greater reliablity
  - Transient attributes are now recorded in a truely atomic manner
  - Supports fencing agents that need the host to be unfenced at startup
  - CIB ACLs have been reimplemented and are now enabled 
  - Various bugs squashed

  - Resolves: rhbz#1020210 rhbz#1036631 rhbz#1069279
  - Resolves: rhbz#1069795 rhbz#1071995


author: Andrew Beekhof <beekhof@redhat.com> - 1.1.12-2
changelog:
  - Bug rhbz#1054307 - cname pattern match should be more restrictive in init script
      Resolves: rhbz#1054307


author: Andrew Beekhof <beekhof@redhat.com> - 1.1.12-3
changelog:
  - Fix: crmd: avoid double free caused by nested hash table removal
  - Fix: ignore SIGPIPE with gnutls is in use
  - Fix: cib: cl#5222 - Prevent assert in xml_calculate_changes() on performing cib operations
      Resolves: rhbz#1071995


author: David Vossel <dvossel@redhat.com> - 1.1.12-5
changelog:
  - Properly clear shutdown transient attribute after node leaves
    membership.

    Resolves: rhbz#1198638


author: David Vossel <dvossel@redhat.com> - 1.1.12-6
changelog:
  - Fixes invalid free in attrd
  - Fixes crm_mon -E option for external script.
  - Fixes acl read-only access role assignment.

    Resolves: rhbz#1205292
    Resolves: rhbz#1208896
    Resolves: rhbz#1207621


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.12-7
changelog:
  - Ensure relevant components clear cache entries are cleared when peers leave the cluster

    Resolves: rhbz#1193499


author: David Vossel <dvossel@redhat.com> - 1.1.12-8
changelog:
  - Reduce log severity for style upgrade notice.
   - Properly export pacemaker related sysconfig variables
   - Remove warning during yum update of pacemaker packages.

    Resolves: rhbz#1163982
    Resolves: rhbz#1177821
    Resolves: rhbz#1210291


author: Klaus Wenninger <kwenning@redhat.com> - 1.1.14-1.0
changelog:
  - Update to upstream release 1.1.14
   - added README_RGManager_porting to document replacement of
       ccs2cib, ccs_flatten & disable_rgmanager
   - added patchset (0100-0111) from master to implement graceful
       stop of pacemaker_remote
   - require minimum-version 0.17.0 of libqb

    Resolves: rhbz#1193499
    Resolves: rhbz#1195500
    Resolves: rhbz#1200853
    Resolves: rhbz#1215809
    Resolves: rhbz#1219103
    Resolves: rhbz#1235316
    Resolves: rhbz#1246490
    Resolves: rhbz#1246563
    Resolves: rhbz#1252206
    Resolves: rhbz#1257333
    Resolves: rhbz#1275223
    Resolves: rhbz#1287535
    Resolves: rhbz#1297564


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.14-3
changelog:
  - prevent crmd crash after unexpected Pacemaker Remote connection takeover
   - ensure package URL is displayed correctly

    Resolves: rhbz#1252206


author: Chris Feist <cfeist@redhat.com> - 0.9.26-6
changelog:
  - Added additional specific steps for configuring pcs on Red Hat Enterprise
    Linux 6
  - Resolves: rhbz#878682


author: Chris Feist <cfeist@redhat.com> - 0.9.26-9
changelog:
  - pcs now allows assigning constraints to group/clone/multistate resources
  - pcs no longer deletes resources from the lrm during resource removal
  - Resolves: rhbz#894174 rhbz#893221


author: Chris Feist <cfeist@redhat.com> - 0.9.26-10
changelog:
  - Removed one extra place where pcs incorrectly deleted resources from the lrm
  - Resolves: rhbz#893221


author: Chris Feist <cfeist@redhat.com> - 0.9.73-1
changelog:
  - Cluster name is now viewable on RHEL 6
  - Cluster.conf is now removed on destroy
  - Misc man page & usage updates
  - When removing the last resource from a group, remove any constraints still
    remaining on group


author: Chris Feist <cfeist@redhat.com> - 0.9.74-1
changelog:
  - pcs cluster edit should now work properly
  - Allow removal of group and resources inside group with
    pcs resource delete <group name>


author: Chris Feist <cfeist@redhat.com> - 0.9.75-1
changelog:
  - Removing a resource that is part of a resource set is now allowed
  - When you try to remove a group from a master that has more than one
    resource you now recieve a helpful error
  - Unclone works on clones where constraints have been added
  - Removing a group with constraints now works properly
  - Master/Slave groups now have constraints properly removed before being
    deleted


author: Chris Feist <cfeist@redhat.com> - 0.9.76-1
changelog:
  - Renamed resource group remove/delete to ungroup
  - Fixed moving resource masters
  - Allow cloing/mastering last resource in a group


author: Chris Feist <cfeist@redhat.com> - 0.9.77-1
changelog:
  - Fixed managing/unmanaging groups/clones/masters of resources
  - Fixed issue when using --group when creating a resource


author: Chris Feist <cfeist@redhat.com> - 0.9.78-1
changelog:
  - Fixed error codes and stdout/stderr output on errors from pcs resource
    enable/disable
  - Automatically add interval to operations which don't specify an interval


author: Chris Feist <cfeist@redhat.com> - 0.9.79-1
changelog:
  - Fixed OCF_CHECK_LEVEL operation setting in resource update
  - Return proper error codes when stopping/starting/enable/disabling resources
  - Return proper error code on auth


author: Chris Feist <cfeist@redhat.com> - 0.9.80-1
changelog:
  - More fixes for OCF_CHECK_LEVEL issues
  - Fix traceback when adding a resourcew with a provider that doesn't exist
  - Create proper two_node cluster when only two nodes are specified in cluster
    setup
  - Give useful error when bad options are used with 'op'


author: Chris Feist <cfeist@redhat.com> - 0.9.81-1
changelog:
  - Fix issues when updating resource with multiple operations with the same
    action
  - Fixed constraint rules and improved usage documentation


author: Chris Feist <cfeist@redhat.com> - 0.9.82-1
changelog:
  - Show constraint id when printing out location rules
  - Improve error messages when adding location rules with errors
  - Add ability to remove constraint rules
  - Allow move of master/slave resources if --master is present


author: Chris Feist <cfeist@redhat.com> - 0.9.87-1
changelog:
  - Allow two ordering constraints with same resources
  - Improved error messages when trying to master/clone resources
  - Updated error message when attempting to move a master/slave without
    --master


author: Chris Feist <cfeist@redhat.com> - 0.9.88-1
changelog:
  - Don't allow order/colocation constraints created for master primitives
  - Check in clones for stonith resources
  - Clarify 'constraint rule add' in man page/usage
  - Fixed minor usage issue with colocation sets


author: Chris Feist <cfeist@redhat.com> - 0.9.89-1
changelog:
  - Show location constraint role in pcs status/constraint
  - Disable resource before removing
  - Misc man/usage fixes


author: Chris Feist <cfeist@redhat.com> - 0.9.90-1
changelog:
  - Add ability to set node attributes
  - Fix issue setting meta attributes on a master when creating a resource


author: Chris Feist <cfeist@redhat.com> - 0.9.101-1
changelog:
  - Rebase for new features
  - Added ability to set uidgid in cluster.conf
  - Stonith level add now properly recognizes nodes
  - Resolves: rhbz#1025053 rhbz#1019410


author: Chris Feist <cfeist@redhat.com> - 0.9.101-3
changelog:
  - When creating a resource using --group/--clone/--master put the group
    inside the master/clone/group before putting it into the live CIB
  - Resolves: rhbz#1066927


author: Chris Feist <cfeist@redhat.com> - 0.9.118-2
changelog:
  - Re-synced to upstream sources
  - Fixed dependency on rubygems
  - Fixed pam long timeouts due to fprintd
  - Resolves: rhbz#1102836


author: Chris Feist <cfeist@redhat.com> - 0.9.120-2
changelog:
  - Use /usr/sbin/pcs for pcs instead of /sbin/pcs
  - Use Open4 instead of POpen4 for running commands
  - Fixed cluster setup for RHEL6
  - Resolves: rhbz#1102836


author: Chris Feist <cfeist@redhat.com> - 0.9.121-1
changelog:
  - Don't try to get metadata for fence_check, fence_tool & fence_node
  - Cloned M/S groups can now be deleted
  - Clone options can now follow --clone
  - Cloned resources with globally-unique=true can now be deleted
  - Resolves: rhbz#1102836


author: Chris Feist <cfeist@redhat.com> - 0.9.123-3
changelog:
  - Added ability to upgrade cluster cib and we auto upgrade cib if we're running
    an acl command (except show or help)
  - Resolves: rhbz#1112727


author: Chris Feist <cfeist@redhat.com> - 0.9.123-4
changelog:
  - Fixed resource delete for clones of groups with more than one resource
  - Fixed unclone of group so all resources are removed
  - Resolves: rhbz#1107612 rhbz#1108778


author: Chris Feist <cfeist@redhat.com> - 0.9.123-6
changelog:
  - Fixed issue with sync cluster.conf & adding uid/gid across cluster on RHEL6 w/ pcsd
  - Resolves: rhbz#1102836


author: Tomas Jelinek <tojeline@redhat.com> - 0.9.138-1
changelog:
  - Rebased to latest upstream packages
  - Fixed creating default resource operations
  - Added support for RRP and corosync options for cman based clusters
  - Allowed scope=configuration in cib commands
  - Added support for configuring a cluster remotely using pcsd
  - Fixed globally-unique clone resources in pcsd
  - Added resource location to resources / stonith devices list
  - Fixed formatting of resource / fence agent description
  - Fence agent description now contains information about the agent
  - Parallelized cluster start and cluster stop
  - Added warning when nodes stop will cause a loss of the quorum
  - pcs status --full now displays Node attributes and Migration summary
  - Resolves: rhbz#1185738 rhbz#1031141 rhbz#1121769 rhbz#1126835 rhbz#1160359 rhbz#1168986 rhbz#1174244 rhbz#1174793 rhbz#1174798 rhbz#1174801 rhbz#1184763 rhbz#1184922


author: Tomas Jelinek <tojeline@redhat.com> - 0.9.139-1
changelog:
  - Rebased to latest upstream packages
  - Fixed constraints removal and node standby/unstandby using remote GUI
  - Fixed displaying of fence / resource agent metadata in GUI
  - Added Pacemaker Resource defaults and Op defaults to 'pcs config' output
  - Fixed 'pcs resource clear' used on cloned group
  - Added support for scope option in cib commands
  - Added warning when creating a cluster with UDPU transport
  - Reload cluster.conf after node addition / removal
  - Resolves: rhbz#1185738 rhbz#1168982 rhbz#1174793 rhbz#1187488 rhbz#1190167 rhbz#1190168 rhbz#1191898 rhbz#1193433


author: Tomas Jelinek <tojeline@redhat.com> - 0.9.145-1
changelog:
  - Rebased to latest upstream packages
  - Added a warning to "pcs cluster setup" when a node is already in a cluster
  - Fixes in help text and man page
  - Rubygems built with RELRO
  - Added option to put a node into maintenance mode
  - Ungrouping the last resource from a cloned group no longer produces an invalid CIB
  - Removing a resource from a group no longer removes constraints referencing that group
  - Fixed session and cookies processing
  - Fixed command injection vulnerability
  - Added support for exporting cluster configuration to a list of pcs commands using clufter
  - Added automatic removal of old config file backups
  - Fixed removing a fence device from fence levels on deleting the device
  - Resolves: rhbz#1260021 rhbz#1190732 rhbz#1203802 rhbz#1230368 rhbz#1242158 rhbz#1243744 rhbz#1245721 rhbz#1247883 rhbz#1247979 rhbz#1253288 rhbz#1253292 rhbz#1264795 rhbz#1273391 rhbz#1275254


author: Tomas Jelinek <tojeline@redhat.com> - 0.9.146-1
changelog:
  - Rebased to latest upstream packages
  - Rubygems built with RELRO
  - Resolves: rhbz#1260021 rhbz#1242158


author: Tomas Jelinek <tojeline@redhat.com> - 0.9.148-1
changelog:
  - Rebased to latest upstream packages
  - Fixed crashes on one-node clusters
  - Resolves: rhbz#1260021 rhbz#1283627


author: Ivan Devat <idevat@redhat.com> - 0.9.148-2
changelog:
  - Moved DISABLED_GUI option to /etc/sysconfig/pcsd
  - Added backend support for new cluster properties form in web UI
  - Fixed multilib .pyc/.pyo issue
  - Resolves: rhbz#1297782 rhbz#1298163


author: Ivan Devat <idevat@redhat.com> - 0.9.148-3
changelog:
  - Fixed updating cluster properties from older version of web UI
  - Fixed syntax error in utilization attributes functions
  - Resolves: rhbz#1298163
  - Related: rhbz#1260021


author: Robin Norwood <rnorwood@redhat.com> - 1.12-1
changelog:
  - Update to latest upstream version: 1.12
  - Fix license tag
  - Add BuildRequires for ExtUtils::MakeMaker and Test::Simple
  - Fix package review issues:
  - Source URL
  - Resolves: bz#226264


author: Paul Howarth <paul@city-fan.org> - 1.15-1
changelog:
  - Update to latest upstream version: 1.15
  - Add buildreq and req for perl(Net::LibIDN) to avoid croaking when trying to
    verify an international name against a certificate


author: Paul Howarth <paul@city-fan.org> - 1.26-1
changelog:
  - Update to 1.26 (verify_hostname_of_cert matched only the prefix for the
    hostname when no wildcard was given, e.g. www.example.org matched against a
    certificate with name www.exam in it [#509819])


author: Paul Howarth <paul@city-fan.org> - 1.27-1
changelog:
  - Update to 1.27
    - various regex fixes for i18n and service names
    - fix warnings from perl -w (CPAN RT#48131)
    - improve handling of errors from Net::ssl_write_all


author: Paul Howarth <paul@city-fan.org> - 1.30-1
changelog:
  - Update to 1.30 (fix memleak when SSL handshake failed)
  - Add buildreq procps needed for memleak test


author: Ville Skyttä <ville.skytta at iki.fi> - 0:1.25-0.fdr.4
changelog:
  - Rename to perl-Net-SSLeay, provide perl-Net_SSLeay for compatibility
    with the rest of the world.


author: Ville Skyttä <ville.skytta at iki.fi> - 0:1.26-0.fdr.1
changelog:
  - Update to unofficial 1.26 from Peter Behroozi, adds get1_session(),
    enables session caching with IO::Socket::SSL (bug 1859, bug 1860).
  - Bring outdated test14 up to date (bug 1859, test suite still not enabled).


author: Jose Pedro Oliveira <jpo at di.uminho.pt> - 1.30-2
changelog:
  - CVE-2005-0106: patch from Mandriva
    http://wwwnew.mandriva.com/security/advisories?name=MDKSA-2006:023


author: Paul Howarth <paul@city-fan.org> - 1.32-1
changelog:
  - update to 1.32, incorporate new upstream URLs
  - cosmetic spec changes suiting new maintainer's preferences
  - fix argument order for find with -depth
  - remove patch for CVE-2005-0106, fixed upstream in 1.30 (#191351)
    (http://rt.cpan.org/Public/Bug/Display.html?id=19218)
  - remove test patch, no longer needed
  - re-encode Credits as UTF-8
  - include TODO as %doc
  - add buildreqs perl(Array::Compare), perl(MIME::Base64), perl(Sub::Uplevel),
    perl(Test::Exception), perl(Test::NoWarnings), perl(Test::Pod),
    perl(Test::Warn), perl(Tree::DAG_Node)
  - add patch needed to disable testsuite non-interactively
  - run test suite but disable external tests by default; external tests can be
    enabled by using rpmbuild --with externaltests
  - add patch to change hosts connected to in external tests


author: Paul Howarth <paul@city-fan.org> - 1.35-1
changelog:
  - update to 1.35
  - drop flag and patch for enabling/disabling external tests - patch now upstream
  - external hosts patch no longer needed as we don't do external tests
  - filter out unversioned provide for perl(Net::SSLeay)
  - use the distro openssl flags rather than guessing them


author: Paul Howarth <paul@city-fan.org> - 1.35-7
changelog:
  - update to svn trunk (rev 252), needed due to omission of MD2 functionality
    from OpenSSL 1.0.0 (CPAN RT#48916)


author: Tom Callaway <tcallawa@redhat.com>
changelog:
  - bump to 5.0.0
  - add patch to prevent clobbering struct re_registers from regex.h
  - remove domxml references, replaced with dom now built-in
  - fix php.ini to refer to php5 not php4


author: Joe Orton <jorton@redhat.com> 5.0.1-1
changelog:
  - update to 5.0.1
  - only build shared modules once
  - put dom extension in php-dom subpackage again
  - move extension modules into %{_libdir}/php/modules
  - don't use --with-regex=system, it's ignored for the apache* SAPIs


author: Joe Orton <jorton@redhat.com> 5.0.2-4
changelog:
  - update to 5.0.2 (#127980)
  - build against mysqlclient10-devel
  - use new RTLD_DEEPBIND to load extension modules
  - drop explicit requirement for elfutils-devel
  - use AddHandler in default conf.d/php.conf (#135664)
  - "fix" round() fudging for recent gcc on x86
  - disable sqlite pending audit of warnings and subpackage split


author: Joe Orton <jorton@redhat.com> 5.0.2-5
changelog:
  - fix phpize installation for lib64 platforms
  - add fix for segfault in variable parsing introduced in 5.0.2


author: Joe Orton <jorton@redhat.com> 5.0.2-7
changelog:
  - truncate changelog at 4.3.1-1
  - merge from 4.3.x package:
   - enable mime_magic extension and Require: file (#130276)


author: Joe Orton <jorton@redhat.com> 5.0.3-1
changelog:
  - update to 5.0.3 (thanks to Robert Scheck et al, #143101)
  - enable xsl extension (#142174)
  - package both the xsl and dom extensions in php-xml
  - enable soap extension, shared (php-soap package) (#142901)
  - add patches from upstream 5.0 branch:
   * Zend_strtod.c compile fixes
   * correct php_sprintf return value usage


author: Joe Orton <jorton@redhat.com> 5.0.3-2
changelog:
  - install the ext/gd headers (#145891)
  - enable pcntl extension in /usr/bin/php (#142903)
  - add libmbfl array arithmetic fix (dcb314@hotmail.com, #143795)
  - add BuildRequire for recent pcre-devel (#147448)


author: Joe Orton <jorton@redhat.com> 5.0.3-4
changelog:
  - package mysqli extension in php-mysql
  - really enable pcntl (#142903)
  - don't build with --enable-safe-mode (#148969)
  - use "Instant Client" libraries for oci8 module (Kai Bolay, #149873)


author: Joe Orton <jorton@redhat.com> 5.0.3-5
changelog:
  - BuildRequire mysql-devel >= 4.1
  - don't mark php.ini as noreplace to make upgrades work (#152171)
  - fix subpackage descriptions (#152628)
  - fix memset(,,0) in Zend (thanks to Dave Jones)
  - fix various compiler warnings in Zend


author: Joe Orton <jorton@redhat.com> 5.0.4-1
changelog:
  - update to 5.0.4 (#153068)
  - add .phps AddType to php.conf (#152973)
  - better gcc4 fix for libxmlrpc


author: Joe Orton <jorton@redhat.com> 5.0.4-4
changelog:
  - bundle from PEAR: HTTP, Mail, XML_Parser, Net_Socket, Net_SMTP
  - snmp: disable MSHUTDOWN function to prevent error_log noise (#153988)
  - mysqli: add fix for crash on x86_64 (Georg Richter, upstream #32282)


author: Joe Orton <jorton@redhat.com> 5.0.4-6
changelog:
  - build /usr/bin/php with the CLI SAPI, and add /usr/bin/php-cgi,
    built with the CGI SAPI (thanks to Edward Rudd, #137704)
  - add php(1) man page for CLI
  - fix more test cases to use -n when invoking php


author: Joe Orton <jorton@redhat.com> 5.0.4-7
changelog:
  - split out dba and bcmath extensions into subpackages
  - BuildRequire gcc-c++ to avoid AC_PROG_CXX{,CPP} failure (#155221)
  - pear: update to DB-1.7.6
  - enable FastCGI support in /usr/bin/php-cgi (#149596)


author: Joe Orton <jorton@redhat.com> 5.0.4-9
changelog:
  - build simplexml_import_dom even with shared dom (#156434)
  - prevent truncation of copied files to ~2Mb (#155916)
  - install /usr/bin/php from CLI build alongside CGI
  - enable sysvmsg extension (#142988)


author: Joe Orton <jorton@redhat.com> 5.0.5-3
changelog:
  - update to 5.0.5
  - add fix for upstream #34435
  - devel: require autoconf, automake (#159283)
  - pear: update to HTTP-1.3.6, Mail-1.1.8, Net_SMTP-1.2.7, XML_RPC-1.4.1
  - fix imagettftext et al (upstream, #161001)


author: Joe Orton <jorton@redhat.com> 5.1.1-2
changelog:
  - update to 5.1.1
  - remove pear subpackage
  - enable pdo extensions (php-pdo subpackage)
  - remove non-standard conditional module builds
  - enable xmlreader extension


author: Joe Orton <jorton@redhat.com> 5.1.2-5
changelog:
  - provide php-api (#183227)
  - add provides for all builtin modules (Tim Jackson, #173804)
  - own %{_libdir}/php/pear for PEAR packages (per #176733)
  - add obsoletes to allow upgrade from FE4 PDO packages (#181863)


author: Joe Orton <jorton@redhat.com> 5.1.4-5
changelog:
  - provide mod_php (#187891)
  - provide php-cli (#192196)
  - use correct LDAP fix (#181518)
  - define _GNU_SOURCE in php_config.h and leave it defined
  - drop (circular) dependency on php-pear


author: Joe Orton <jorton@redhat.com> 5.1.4-8
changelog:
  - Provide php-posix (#194583)
  - only provide php-pcntl from -cli subpackage
  - add missing defattr's (thanks to Matthias Saou)


author: Joe Orton <jorton@redhat.com> 5.2.0-3
changelog:
  - update to 5.2.0 (#213837)
  - php-xml provides php-domxml (#215656)
  - fix php-pdo-abi provide (#214281)


author: Joe Orton <jorton@redhat.com> 5.2.0-4
changelog:
  - provide php-zend-abi (#212804)
  - add /etc/rpm/macros.php exporting interface versions
  - synch with upstream recommended php.ini


author: Joe Orton <jorton@redhat.com> 5.2.0-5
changelog:
  - build json and zip shared, in -common (Remi Collet, #215966)
  - obsolete php-json and php-pecl-zip
  - build readline extension into /usr/bin/php* (#210585)
  - change module subpackages to require php-common not php (#177821)


author: Joe Orton <jorton@redhat.com> 5.2.0-9
changelog:
  - add php(api), php(zend-abi) provides (#221302)
  - package /usr/share/php and append to default include_path (#225434)


author: Joe Orton <jorton@redhat.com> 5.2.0-10
changelog:
  - bump default memory_limit to 32M (#220821)
  - mark config files noreplace again (#174251)
  - drop trailing dots from Summary fields
  - use standard BuildRoot
  - drop libtool15 patch (#226294)


author: Joe Orton <jorton@redhat.com> 5.2.3-3
changelog:
  - add mcrypt, mhash, tidy, mssql subpackages (Dmitry Butskoy)
  - enable dbase extension and package in -common


author: Joe Orton <jorton@redhat.com> 5.2.6-3
changelog:
  - update to 5.2.6
  - sync default php.ini with upstream
  - drop extension_dir from default php.ini, rely on hard-coded
    default, to make php-common multilib-safe (#455091)
  - update to r3 of systzdata patch


author: Joe Orton <jorton@redhat.com> 5.2.6-6
changelog:
  - move gd_README to php-gd
  - update to r4 of systzdata patch; introduces a default timezone
    name of "System/Localtime", which uses /etc/localtime (#469532)


author: Joe Orton <jorton@redhat.com> 5.2.8-4
changelog:
  - move wddx to php-xml, build curl shared in -common
  - remove BR for expat-devel, bogus configure option


author: Joe Orton <jorton@redhat.com> 5.2.8-9
changelog:
  - add recode support, -recode subpackage (#106755)
  - add -zts subpackage with ZTS-enabled build of httpd SAPI
  - adjust php.conf to use -zts SAPI build for worker MPM


author: Remi Collet <Fedora@famillecollet.com> 5.3.0-1
changelog:
  - update to 5.3.0
  - remove ncurses, dbase, mhash extensions
  - add enchant, sqlite3, intl, phar, fileinfo extensions
  - raise sqlite version to 3.6.0 (for sqlite3, build with --enable-load-extension)
  - sync with upstream "production" php.ini


author: Joe Orton <jorton@redhat.com> 5.3.0-2
changelog:
  - update to v5 of systzdata patch; parses zone.tab and extracts
    timezone->{country-code,long/lat,comment} mapping table


author: Remi Collet <Fedora@famillecollet.com> 5.3.1-1
changelog:
  - update to 5.3.1
  - remove openssl patch (merged upstream)
  - add provides for php-pecl-json
  - add prod/devel php.ini in doc


author: Remi Collet <Fedora@famillecollet.com>
changelog:
  - PHP 5.3.2 Released!
  - remove mime_magic option (now provided by fileinfo, by emu)
  - add patch for http://bugs.php.net/50578
  - remove patch for libedit (upstream)


author: Joe Orton <jorton@redhat.com> - 5.3.2-6
changelog:
  - add security fixes for CVE-2010-1866, CVE-2010-2094, CVE-2010-1917,
    CVE-2010-2531, MOPS-2010-060 (#624469)


author: Joe Orton <jorton@redhat.com> - 5.3.3-1
changelog:
  - update to 5.3.3 (#645591)
  - add security fixes for CVE-2010-3709, CVE-2010-3710,
    CVE-2010-3870, CVE-2009-5016 (#651953)
  - prevent extract() cloberring $GLOBALS (#655118)
  - ensure correct mysql_config is used in biarch builds


author: Vojtech Vitek (V-Teq) <vvitek@redhat.com> - 5.3.3-6
changelog:
  - merge Joe's changes:
  - improve CVE-2011-1466 fix to cover CAL_GREGORIAN, CAL_JEWISH
  - add security fixes for CVE-2011-2483, CVE-2011-0708, CVE-2011-1148,
    CVE-2011-1466, CVE-2011-1468, CVE-2011-1469, CVE-2011-1470,
    CVE-2011-1471, CVE-2011-1938, and CVE-2011-2202 (#740732)


author: Joe Orton <jorton@redhat.com> - 5.3.3-11
changelog:
  - add security fixes for CVE-2012-0781, CVE-2011-4153, CVE-2012-0057,
    CVE-2012-0789, CVE-2012-1172, CVE-2012-2143, CVE-2012-2386


author: Remi Collet <rcollet@redhat.com> - 5.3.3-15
changelog:
  - fix permission on source files (#676364)
  - fix negative keys with var_export (#771738)
  - fix setDate when DateTime created from timestamp (#812819)
  - add php(language) and missing provides (#837042)
  - use arch-specific requires (#833545)
  - fix possible buffer overflow in pdo_odbc (#836264)
  - fix possible segfault in pdo_mysql (#824199)


author: Remi Collet <rcollet@redhat.com> - 5.3.3-16
changelog:
  - fix stream support in fileinfo (#858653)
  - fix imap_open DISABLE_AUTHENTICATOR param ignores array (#859371)


author: Remi Collet <rcollet@redhat.com> - 5.3.3-22
changelog:
  - php-xml provides php-xmlreader and php-xmlwriter (#874987)
  - fix possible NULL derefence and buffer overflow (#879179)
  - fix zend garbage collector (#848186, #868375)


author: Remi Collet <rcollet@redhat.com> - 5.3.3-24
changelog:
  - fix buffer overflow in _pdo_pgsql_error (#969110)
  - fix double free when destroy_zend_class fails (#910466)
  - fix segfault in error_handler with
    allow_call_time_pass_reference = Off (#892158)
  - fix copy doesn't report failure on partial copy (#947428)
  - add rpm macros for packagers: %php_inidir,
    %php_incldir and %__php (#953814)


author: Remi Collet <rcollet@redhat.com> - 5.3.3-29
changelog:
  - drop unneeded part of CVE-2006-724.patch and fileinfo.patch
    extension not provided or git binary patches (#1064027)
  - odbc: fix incompatible pointer type (#1053982)
  - mysqli: fix possible segfault in mysqli_stmt::bind_result
    php bug 66762 (#1069167)
  - mysql: fix php_mysql_fetch_hash writes long value into int
    php bug 52636 (#1054953)


author: Remi Collet <rcollet@redhat.com> - 5.3.3-31
changelog:
  - soap: fixRFC2616 transgression (#1045019)
  - fix static calling in non-static method (#953786)
  - fix autoload called from closing session (#954027)


author: Remi Collet <rcollet@redhat.com> - 5.3.3-34
changelog:
  - fileinfo: cdf_unpack_summary_info() excessive looping
    DoS. CVE-2014-0237
  - fileinfo: CDF property info parsing nelements infinite
    loop. CVE-2014-0238


author: Jan Kaluza <jkaluza@redhat.com> - 5.3.3-35
changelog:
  - fileinfo: out-of-bounds memory access in fileinfo. CVE-2014-2270
  - fileinfo: unrestricted recursion in handling of indirect type
    rules. CVE-2014-1943
  - fileinfo: out of bounds read in CDF parser. CVE-2012-1571
  - fileinfo: cdf_check_stream_offset boundary check. CVE-2014-3479
  - fileinfo: cdf_count_chain insufficient boundary check. CVE-2014-3480


author: Remi Collet <rcollet@redhat.com> - 5.3.3-36
changelog:
  - core: type confusion issue in phpinfo(). CVE-2014-4721
  - date: fix heap-based buffer over-read in DateInterval. CVE-2013-6712
  - core: fix heap-based buffer overflow in DNS TXT record parsing.
    CVE-2014-4049
  - core: unserialize() SPL ArrayObject / SPLObjectStorage type
    confusion flaw. CVE-2014-3515


author: Remi Collet <rcollet@redhat.com> - 5.3.3-37
changelog:
  - gd: fix NULL pointer dereference in gdImageCreateFromXpm.
    CVE-2014-2497
  - fileinfo: fix incomplete fix for CVE-2012-1571 in
    cdf_read_property_info. CVE-2014-3587
  - core: fix incomplete fix for CVE-2014-4049 DNS TXT
    record parsing. CVE-2014-3597


author: Remi Collet <rcollet@redhat.com> - 5.3.3-38
changelog:
  - spl: fix use-after-free in ArrayIterator due to object
    change during sorting. CVE-2014-4698
  - spl: fix use-after-free in SPL Iterators. CVE-2014-4670


author: Remi Collet <rcollet@redhat.com> - 5.3.3-39
changelog:
  - xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
  - core: fix integer overflow in unserialize() CVE-2014-3669
  - exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670


author: Remi Collet <rcollet@redhat.com> - 5.3.3-41
changelog:
  - core: fix double in zend_ts_hash_graceful_destroy CVE-2014-9425
  - core: fix use-after-free in unserialize CVE-2015-2787
  - exif: fix free on unitialized pointer CVE-2015-0232
  - gd: fix buffer read overflow in gd_gif.c CVE-2014-9709
  - date: fix use after free vulnerability in unserialize CVE-2015-0273
  - enchant: fix heap buffer overflow in enchant_broker_request_dict
    CVE-2014-9705
  - phar: use after free in phar_object.c CVE-2015-2301
  - soap: fix type confusion through unserialize


author: Remi Collet <rcollet@redhat.com> - 5.3.3-43
changelog:
  - core: fix multipart/form-data request can use excessive
    amount of CPU usage CVE-2015-4024
  - fix various functions accept paths with NUL character
    CVE-2015-4026, #1213407
  - ftp: fix integer overflow leading to heap overflow when
    reading FTP file listing CVE-2015-4022
  - phar: fix buffer over-read in metadata parsing CVE-2015-2783
  - phar: invalid pointer free() in phar_tar_process_metadata()
    CVE-2015-3307
  - phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
  - phar: fix memory corruption in phar_parse_tarfile caused by
    empty entry file name CVE-2015-4021
  - soap: more fix type confusion through unserialize #1222538


author: Remi Collet <rcollet@redhat.com> - 5.3.3-47
changelog:
  - fix wrong warning in openssl_encrypt() for missing IV
    when IV is not required #1260315
  - fix segfault's when you try and allocate an SplFixedArray
    with size >= 9999 #1071344
  - segfault in php_pgsql_meta_data CVE-2015-4644  #1234434
  - add options to enable TLS in curl #1255920
  - fix segfault in gc_collect_cycles #1122681


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.0-2
changelog:
  - Bugzilla Bug #668839 - Review Request: pki-core
  -   Added component versioning comments
  -   Updated JSS from "4.2.6-10" to "4.2.6-12"
  -   Modified installation section to preserve timestamps
  -   Removed sectional comments


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.0-3
changelog:
  - Bugzilla Bug #668839 - Review Request: pki-core
  -   Removed empty "pre" from "pki-ca"
  -   Consolidated directory ownership
  -   Corrected file ownership within subpackages
  -   Removed all versioning from NSS and NSPR packages


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.1-1
changelog:
  - Allow 'pki-native-tools' to be installed independently of 'pki-setup'
  - Removed explicit 'pki-setup' requirement from 'pki-ca'
    (since it already requires 'pki-common')
  - 'pki-setup'
  -     Bugzilla Bug #223343 - pkicreate: should add 'pkiuser' to nfast group
  -     Bugzilla Bug #629377 - Selinux errors during pkicreate CA, KRA, OCSP
        and TKS.
  -     Bugzilla Bug #555927 - rhcs80 - AgentRequestFilter servlet and port
        fowarding for agent services
  -     Bugzilla Bug #632425 - Port to tomcat6
  -     Bugzilla Bug #606946 - Convert Native Tools to use ldapAPI from
        OpenLDAP instead of the Mozldap
  -     Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI
        interface
  -     Bugzilla Bug #643206 - New CMake based build system for Dogtag
  -     Bugzilla Bug #658926 - org.apache.commons.lang class not found on F13
  -     Bugzilla Bug #661514 - CMAKE build system requires rules to make
        javadocs
  -     Bugzilla Bug #665388 - jakarta-* jars have been renamed to apache-*,
        pkicreate fails Fedora 14 and above
  -     Bugzilla Bug #23346 - Two conflicting ACL list definitions in source
        repository
  -     Bugzilla Bug #656733 - Standardize jar install location and jar names
  - 'pki-symkey'
  -     Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI
        interface
  -     Bugzilla Bug #643206 - New CMake based build system for Dogtag
  -     Bugzilla Bug #644056 - CS build contains warnings
  - 'pki-native-tools'
  -     template change
  -     Bugzilla Bug #606946 - Convert Native Tools to use ldapAPI from
        OpenLDAP instead of the Mozldap
  -     Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI
        interface
  -     Bugzilla Bug #643206 - New CMake based build system for Dogtag
  -     Bugzilla Bug #644056 - CS build contains warnings
  - 'pki-util'
  -     Bugzilla Bug #615814 - rhcs80 - profile policyConstraintsCritical
        cannot be set to true
  -     Bugzilla Bug #224945 - javadocs has missing descriptions, contains
        empty packages
  -     Bugzilla Bug #621337 - Limit the received senderNonce value to 16 bytes.
  -     Bugzilla Bug #621338 - Include a server randomly-generated 16 byte
        senderNonce in all signed SCEP responses.
  -     Bugzilla Bug #621327 - Provide switch disabling algorithm downgrade
        attack in SCEP
  -     Bugzilla Bug #621334 - Provide an option to set default hash algorithm
        for signing SCEP response messages.
  -     Bugzilla Bug #635033 - At installation wizard selecting key types other
        than CA's signing cert will fail
  -     Bugzilla Bug #645874 - rfe ecc - add ecc curve name support in JSS and
        CS interface
  -     Bugzilla Bug #488253 - com.netscape.cmsutil.ocsp.BasicOCSPResponse
        ASN.1 encoding/decoding is broken
  -     Bugzilla Bug #551410 - com.netscape.cmsutil.ocsp.TBSRequest ASN.1
        encoding/decoding is incomplete
  -     Bugzilla Bug #550331 - com.netscape.cmsutil.ocsp.ResponseData ASN.1
        encoding/decoding is incomplete
  -     Bugzilla Bug #623452 - rhcs80 pkiconsole profile policy editor limit
        policy extension to 5 only
  -     Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI
        interface
  -     Bugzilla Bug #651977 - turn off ssl2 for java servers (server.xml)
  -     Bugzilla Bug #643206 - New CMake based build system for Dogtag
  -     Bugzilla Bug #661514 - CMAKE build system requires rules to make
        javadocs
  -     Bugzilla Bug #658188 - remove remaining references to tomcat5
  -     Bugzilla Bug #656733 - Standardize jar install location and jar names
  -     Bugzilla Bug #223319 - Certificate Status inconsistency between token
        db and CA
  -     Bugzilla Bug #531137 - RHCS 7.1 - Running out of Java Heap Memory
        During CRL Generation
  - 'pki-java-tools'
  -     Bugzilla Bug #224945 - javadocs has missing descriptions, contains
        empty packages
  -     Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI
        interface
  -     Bugzilla Bug #659004 - CC: AuditVerify hardcoded with SHA-1
  -     Bugzilla Bug #643206 - New CMake based build system for Dogtag
  -     Bugzilla Bug #661514 - CMAKE build system requires rules to make
        javadocs
  -     Bugzilla Bug #662156 - HttpClient is hard-coded to handle only up to
        5000 bytes
  -     Bugzilla Bug #656733 - Standardize jar install location and jar names
  - 'pki-common'
  -     Bugzilla Bug #583822 - CC: ACL issues from CA interface CC doc review
  -     Bugzilla Bug #623745 - SessionTimer with LDAPSecurityDomainSessionTable
        started before configuration completed
  -     Bugzilla Bug #620925 - CC: auditor needs to be able to download audit
        logs in the java subsystems
  -     Bugzilla Bug #615827 - rhcs80 - profile policies need more than 5
        policy mappings (seem hardcoded)
  -     Bugzilla Bug #224945 - javadocs has missing descriptions, contains
        empty packages
  -     Bugzilla Bug #548699 - subCA's admin certificate should be generated by
        itself
  -     Bugzilla Bug #621322 - Provide switch disabling SCEP support in CA
  -     Bugzilla Bug #563386 - rhcs80 ca crash on invalid inputs to profile
        caAgentServerCert (null cert_request)
  -     Bugzilla Bug #621339 - SCEP one-time PIN can be used an unlimited
        number of times
  -     Bugzilla Bug #583825 - CC: Obsolete servlets to be removed from web.xml
        as part of CC interface review
  -     Bugzilla Bug #629677 - TPS: token enrollment fails.
  -     Bugzilla Bug #621350 - Unauthenticated user can decrypt a one-time PIN
        in a SCEP request
  -     Bugzilla Bug #503838 - rhcs71-80 external publishing ldap connection
        pools not reliable - improve connections or discovery
  -     Bugzilla Bug #629769 - password decryption logs plain text password
  -     Bugzilla Bug #583823 - CC: Auditing issues found as result of
        CC - interface review
  -     Bugzilla Bug #632425 - Port to tomcat6
  -     Bugzilla Bug #586700 - OCSP Server throws fatal error while using
        OCSP console for renewing SSL Server certificate.
  -     Bugzilla Bug #621337 - Limit the received senderNonce value to 16 bytes.
  -     Bugzilla Bug #621338 - Include a server randomly-generated 16 byte
        senderNonce in all signed SCEP responses.
  -     Bugzilla Bug #607380 - CC: Make sure Java Console can configure all
        security relevant config items
  -     Bugzilla Bug #558100 - host challenge of the Secure Channel needs to be
        generated on TKS instead of TPS.
  -     Bugzilla Bug #489342 -
        com.netscape.cms.servlet.common.CMCOutputTemplate.java
        doesn't support EC
  -     Bugzilla Bug #630121 - OCSP responder lacking option to delete or
        disable a CA that it serves
  -     Bugzilla Bug #634663 - CA CMC response default hard-coded to SHA1
  -     Bugzilla Bug #621327 - Provide switch disabling algorithm downgrade
        attack in SCEP
  -     Bugzilla Bug #621334 - Provide an option to set default hash algorithm
        for signing SCEP response messages.
  -     Bugzilla Bug #635033 - At installation wizard selecting key types other
        than CA's signing cert will fail
  -     Bugzilla Bug #621341 - Add CA support for new SCEP key pair dedicated
        for SCEP signing and encryption.
  -     Bugzilla Bug #223336 - ECC: unable to clone a ECC CA
  -     Bugzilla Bug #539781 - rhcs 71 - CRLs Partitioned
        by Reason Code - onlySomeReasons ?
  -     Bugzilla Bug #637330 - CC feature: Key Management - provide signature
        verification functions (JAVA subsystems)
  -     Bugzilla Bug #223313 - should do random generated IV param
        for symmetric keys
  -     Bugzilla Bug #555927 - rhcs80 - AgentRequestFilter servlet and port
        fowarding for agent services
  -     Bugzilla Bug #630176 - Improve reliability of the LdapAnonConnFactory
  -     Bugzilla Bug #524916 - ECC key constraints plug-ins should be based on
        ECC curve names (not on key sizes).
  -     Bugzilla Bug #516632 - RHCS 7.1 - CS Incorrectly Issuing Multiple
        Certificates from the Same Request
  -     Bugzilla Bug #648757 - expose and use updated cert verification
        function in JSS
  -     Bugzilla Bug #638242 - Installation Wizard: at SizePanel, fix selection
        of signature algorithm; and for ECC curves
  -     Bugzilla Bug #451874 - RFE - Java console - Certificate Wizard missing
        e.c. support
  -     Bugzilla Bug #651040 - cloning shoud not include sslserver
  -     Bugzilla Bug #542863 - RHCS8: Default cert audit nickname written to
        CS.cfg files imcomplete when the cert is stored on a hsm
  -     Bugzilla Bug #360721 - New Feature: Profile Integrity Check . . .
  -     Bugzilla Bug #651916 - kra and ocsp are using incorrect ports
        to talk to CA and complete configuration in DonePanel
  -     Bugzilla Bug #642359 - CC Feature - need to verify certificate when it
        is added
  -     Bugzilla Bug #653713 - CC: setting trust on a CIMC cert requires
        auditing
  -     Bugzilla Bug #489385 - references to rhpki
  -     Bugzilla Bug #499494 - change CA defaults to SHA2
  -     Bugzilla Bug #623452 - rhcs80 pkiconsole profile policy editor limit
        policy extension to 5 only
  -     Bugzilla Bug #649910 - Console: an auditor or agent can be added to
        an administrator group.
  -     Bugzilla Bug #632425 - Port to tomcat6
  -     Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI
        interface
  -     Bugzilla Bug #651977 - turn off ssl2 for java servers (server.xml)
  -     Bugzilla Bug #653576 - tomcat5 does not always run filters on servlets
        as expected
  -     Bugzilla Bug #642357 - CC Feature- Self-Test plugins only check for
        validity
  -     Bugzilla Bug #643206 - New CMake based build system for Dogtag
  -     Bugzilla Bug #659004 - CC: AuditVerify hardcoded with SHA-1
  -     Bugzilla Bug #661196 - ECC(with nethsm) subca configuration fails with
        Key Type RSA Not Matched despite using ECC key pairs for rootCA & subCA.
  -     Bugzilla Bug #661889 - The Servlet TPSRevokeCert of the CA returns an
        error to TPS even if certificate in question is already revoked.
  -     Bugzilla Bug #663546 - Disable the functionalities that are not exposed
        in the console
  -     Bugzilla Bug #661514 - CMAKE build system requires rules to make
        javadocs
  -     Bugzilla Bug #658188 - remove remaining references to tomcat5
  -     Bugzilla Bug #649343 - Publishing queue should recover from CA crash.
  -     Bugzilla Bug #491183 - rhcs rfe - add rfc 4523 support for pkiUser and
        pkiCA, obsolete 2252 and 2256
  -     Bugzilla Bug #640710 - Current SCEP implementation does not support HSMs
  -     Bugzilla Bug #656733 - Standardize jar install location and jar names
  -     Bugzilla Bug #661142 - Verification should fail when
        a revoked certificate is added
  -     Bugzilla Bug #642741 - CS build uses deprecated functions
  -     Bugzilla Bug #670337 - CA Clone configuration throws TCP connection error
  -     Bugzilla Bug #662127 - CC doc Error: SignedAuditLog expiration time
        interface is no longer available through console
  - 'pki-selinux'
  -     Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI
        interface
  -     Bugzilla Bug #643206 - New CMake based build system for Dogtag
  -     Bugzilla Bug #667153 - store nuxwdog passwords in kernel ring buffer -
        selinux changes
  - 'pki-ca'
  -     Bugzilla Bug #583822 - CC: ACL issues from CA interface CC doc review
  -     Bugzilla Bug #620925 - CC: auditor needs to be able to download audit
        logs in the java subsystems
  -     Bugzilla Bug #621322 - Provide switch disabling SCEP support in CA
  -     Bugzilla Bug #583824 - CC: Duplicate servlet mappings found as part of
        CC interface doc review
  -     Bugzilla Bug #621602 - pkiconsole: Click on 'Publishing' option with
        admin privilege throws error "You are not authorized to perform this
        operation".
  -     Bugzilla Bug #583825 - CC: Obsolete servlets to be removed from web.xml
        as part of CC interface review
  -     Bugzilla Bug #583823 - CC: Auditing issues found as result of
        CC - interface review
  -     Bugzilla Bug #519291 - Deleting a CRL Issuing Point after edits throws
        'Internal Server Error'.
  -     Bugzilla Bug #586700 - OCSP Server throws fatal error while using
        OCSP console for renewing SSL Server certificate.
  -     Bugzilla Bug #621337 - Limit the received senderNonce value to 16 bytes.
  -     Bugzilla Bug #621338 - Include a server randomly-generated 16 byte
        senderNonce in all signed SCEP responses.
  -     Bugzilla Bug #558100 - host challenge of the Secure Channel needs to be
        generated on TKS instead of TPS.
  -     Bugzilla Bug #630121 - OCSP responder lacking option to delete or
        disable a CA that it serves
  -     Bugzilla Bug #634663 - CA CMC response default hard-coded to SHA1
  -     Bugzilla Bug #621327 - Provide switch disabling algorithm downgrade
        attack in SCEP
  -     Bugzilla Bug #621334 - Provide an option to set default hash algorithm
        for signing SCEP response messages.
  -     Bugzilla Bug #539781 - rhcs 71 - CRLs Partitioned
        by Reason Code - onlySomeReasons ?
  -     Bugzilla Bug #637330 - CC feature: Key Management - provide signature
        verification functions (JAVA subsystems)
  -     Bugzilla Bug #555927 - rhcs80 - AgentRequestFilter servlet and port
        fowarding for agent services
  -     Bugzilla Bug #524916 - ECC key constraints plug-ins should be based on
        ECC curve names (not on key sizes).
  -     Bugzilla Bug #516632 - RHCS 7.1 - CS Incorrectly Issuing Multiple
        Certificates from the Same Request
  -     Bugzilla Bug #638242 - Installation Wizard: at SizePanel, fix selection
        of signature algorithm; and for ECC curves
  -     Bugzilla Bug #529945 - (Instructions and sample only) CS 8.0 GA
        release -- DRM and TKS do not seem to have CRL checking enabled
  -     Bugzilla Bug #609641 - CC: need procedure (and possibly tools) to help
        correctly set up CC environment
  -     Bugzilla Bug #509481 - RFE: support sMIMECapabilities extensions in
        certificates (RFC 4262)
  -     Bugzilla Bug #651916 - kra and ocsp are using incorrect ports
        to talk to CA and complete configuration in DonePanel
  -     Bugzilla Bug #511990 - rhcs 7.3, 8.0 - re-activate missing object
        signing support in RHCS
  -     Bugzilla Bug #651977 - turn off ssl2 for java servers (server.xml)
  -     Bugzilla Bug #489385 - references to rhpki
  -     Bugzilla Bug #499494 - change CA defaults to SHA2
  -     Bugzilla Bug #623452 - rhcs80 pkiconsole profile policy editor limit
        policy extension to 5 only
  -     Bugzilla Bug #649910 - Console: an auditor or agent can be added to
        an administrator group.
  -     Bugzilla Bug #632425 - Port to tomcat6
  -     Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI
        interface
  -     Bugzilla Bug #653576 - tomcat5 does not always run filters on servlets
        as expected
  -     Bugzilla Bug #642357 - CC Feature- Self-Test plugins only check for
        validity
  -     Bugzilla Bug #643206 - New CMake based build system for Dogtag
  -     Bugzilla Bug #661128 - incorrect CA ports used for revoke, unrevoke
        certs in TPS
  -     Bugzilla Bug #512496 - RFE rhcs80 - crl updates and scheduling feature 
  -     Bugzilla Bug #661196 - ECC(with nethsm) subca configuration fails with
        Key Type RSA Not Matched despite using ECC key pairs for rootCA & subCA.
  -     Bugzilla Bug #649343 - Publishing queue should recover from CA crash.
  -     Bugzilla Bug #491183 - rhcs rfe - add rfc 4523 support for pkiUser and
        pkiCA, obsolete 2252 and 2256
  -     Bugzilla Bug #223346 - Two conflicting ACL list definitions in source
        repository
  -     Bugzilla Bug #640710 - Current SCEP implementation does not support HSMs
  -     Bugzilla Bug #656733 - Standardize jar install location and jar names
  -     Bugzilla Bug #661142 - Verification should fail when
        a revoked certificate is added
  -     Bugzilla Bug #668100 - DRM storage cert has OCSP signing extended key
        usage
  -     Bugzilla Bug #662127 - CC doc Error: SignedAuditLog expiration time
        interface is no longer available through console
  -     Bugzilla Bug #531137 - RHCS 7.1 - Running out of Java Heap Memory
        During CRL Generation
  - 'pki-silent'
  -     Bugzilla Bug #627309 - pkisilent subca configuration fails.
  -     Bugzilla Bug #640091 - pkisilent panels need to match with changed java
        subsystems
  -     Bugzilla Bug #527322 - pkisilent ConfigureDRM should configure DRM
        Clone.
  -     Bugzilla Bug #643053 - pkisilent DRM configuration fails
  -     Bugzilla Bug #583754 - pki-silent needs an option to configure signing
        algorithm for CA certificates
  -     Bugzilla Bug #489385 - references to rhpki
  -     Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI
        interface
  -     Bugzilla Bug #651977 - turn off ssl2 for java servers (server.xml)
  -     Bugzilla Bug #640042 - TPS Installlation Wizard: need to move Module
        Panel up to before Security Domain Panel
  -     Bugzilla Bug #643206 - New CMake based build system for Dogtag
  -     Bugzilla Bug #588323 - Failed to enable cipher 0xc001
  -     Bugzilla Bug #656733 - Standardize jar install location and jar names
  -     Bugzilla Bug #645895 - pkisilent: add ability to select ECC curves,
        signing algorithm
  -     Bugzilla Bug #658641 - pkisilent doesn't not properly handle passwords
        with special characters
  -     Bugzilla Bug #642741 - CS build uses deprecated functions


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.1-2
changelog:
  - 'pki-symkey'
  -     Bugzilla Bug #671265 - pki-symkey jar version incorrect
  - 'pki-common'
  -     Bugzilla Bug #564207 - Searches for completed requests in the agent
        interface returns zero entries


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.1-3
changelog:
  - Bugzilla Bug #656661 - Please Update Spec File to use 'ghost' on files
    in /var/run and /var/lock


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.2-1
changelog:
  - Bugzilla Bug #673233 - Rebase pki-core to pick the latest features and fixes
  - 'pki-setup'
  -     Bugzilla Bug #673638 - Installation within IPA hangs
  - 'pki-symkey'
  - 'pki-native-tools'
  - 'pki-util'
  - 'pki-java-tools'
  -     Bugzilla Bug #673614 - CC: Review of cryptographic algorithms provided
        by 'netscape.security.provider' package
  - 'pki-common'
  -     Bugzilla Bug #672291 - CA is not publishing certificates issued using
        "Manual User Dual-Use Certificate Enrollment"
  -     Bugzilla Bug #670337 - CA Clone configuration throws TCP connection
        error.
  -     Bugzilla Bug #504056 - Completed SCEP requests are assigned to the
        "begin" state instead of "complete".
  -     Bugzilla Bug #504055 - SCEP requests are not properly populated
  -     Bugzilla Bug #564207 - Searches for completed requests in the agent
        interface returns zero entries
  -     Bugzilla Bug #672291 - CA is not publishing certificates issued using
        "Manual User Dual-Use Certificate Enrollment" -
  -     Bugzilla Bug #673614 - CC: Review of cryptographic algorithms provided
        by 'netscape.security.provider' package
  -     Bugzilla Bug #672920 - CA console: adding policy to a profile throws
        'Duplicate policy' error in some cases.
  -     Bugzilla Bug #673199 - init script returns control before web apps have
        started
  -     Bugzilla Bug #674917 - Restore identification of Tomcat-based PKI
        subsystem instances
  - 'pki-selinux'
  - 'pki-ca'
  -     Bugzilla Bug #504013 - sscep request is rejected due to authentication
        error if submitted through one time pin router certificate enrollment.
  -     Bugzilla Bug #672111 - CC doc: certServer.usrgrp.administration missing
        information
  -     Bugzilla Bug #583825 - CC: Obsolete servlets to be removed from web.xml
        as part of CC interface review
  -     Bugzilla Bug #672333 - Creation of RA agent fails in IPA installation
  -     Bugzilla Bug #674917 - Restore identification of Tomcat-based PKI
        subsystem instances
  - 'pki-silent'
  -     Bugzilla Bug #673614 - CC: Review of cryptographic algorithms provided
        by 'netscape.security.provider' package


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.3-1
changelog:
  - 'pki-common'
  -     Bugzilla Bug #674894 - ipactl restart : an annoy output line
  -     Bugzilla Bug #675179 - ipactl restart : an annoy output line


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.3-2
changelog:
  - 'pki-common'
  -     Bugzilla Bug #676051 - IPA installation failing - Fails to create CA
        instance
  -     Bugzilla Bug #676182 - IPA installation failing - Fails to create CA
        instance


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.3-3
changelog:
  - Resolves #676873 - Rebase pki-core again to pick the latest features and fixes
  -     Resolves #676048 - Installation within IPA hangs, r1846
  -     Resolves #679173 - uninitialized variable warnings from Perl, r1860
  -     Resolves #679174 - netstat loop fixes needed, r1862
  -     Resolves #679580 - Velocity fails to load all dependent classes, r1864


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.3-8
changelog:
  - Resolves 645097 
  - Resolves #683172 - pkisilent needs to provide option to set
    nsDS5ReplicaTransportInfo to TLS in replication agreements
    when creating a clone, r1886


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.3-10
changelog:
  - Resolves #688251 - Dogtag installation under IPA takes too much
    time - SELinux policy compilation, r1908


author: Ade Lee <alee@redhat.com> 9.0.3-12
changelog:
  - Resolves #689909 - Dogtag installation under IPA takes too much
    time - remove the inefficient sleeps, r2097


author: Ade Lee <alee@redhat.com> 9.0.3-13
changelog:
  - Resolves #698796: Race conditions during IPA installation, r2103 (alee)
  - Resolves #708075 - Clone installation does not work over NAT, r2104 (alee)
  - Resolves #726785 - If replication fails while setting up a clone it 
    will wait forever, r2106 (alee)
  - Resolves #691076 - pkiremove removes the registry entry for all instances
    on a machine, r2112 (mharmsen)
  - Resolves #693835 - /var/log/tomcat6/catalina.out owned by pkiuser, r2118
    (mharmsen)
  - Resolves #729126 - Increase default validity from 6mo to 2yrs in IPA
    profile, r2125 (awnuk)
  - Resolves #728651 - CS8 64 bit pkicreate script uses wrong library name
    for, r2126 (mharmsen)
  - Resolves #700522 - pki tomcat6 instances currently running unconfined,
    r2128 (alee)


author: Ade Lee <alee@redhat.com> 9.0.3-14
changelog:
  - Resolves #700522 - pki tomcat6 instances currently running unconfined, 
    allow server to come up when selinux disabled, r2149


author: Ade Lee <alee@redhat.com> 9.0.3-21
changelog:
  - Resolves #771790 - sslget does not work after FEDORA-2011-17400 update,
    breaking FreeIPA install (fixed in Git repo)


author: Ade Lee <alee@redhat.com> 9.0.3-23
changelog:
  - Resolves #769388 - pki-silent does not properly escape command-line arguments
    (fixed in Git repo)


author: Ade Lee <alee@redhat.com> 9.0.3-26
changelog:
  - Resolves #844459 - Increase audit cert renewal range to 2 years (mharmsen)
  - Resolves #841663 - serial number incorrectly cast from BigInt to integer in
    installation wizard (mharmsen)
  - Resolves #858864 - create/ identify a mechanism for clients to determine that
    the pki subsystem is up (alee)


author: Ade Lee <alee@redhat.com> 9.0.3-27
changelog:
  - Resolves #867640 - ipa-replica-install Configuration of CA failed
    by REVERTING #819111 - Non-existent container breaks replication


author: Ade Lee <alee@redhat.com> 9.0.3-31
changelog:
  - Resolves #887305 - /var/run/pki/ca has wrong selinux context
  - Resolves #895702 - pki-cad restart avc denial


author: Ade Lee <alee@redhat.com> 9.0.3-32
changelog:
  - Resolves #999055 - AVC denials during ipa server and replica installs
  - Resolves #998715 - Package Sanity Test Failures


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.3-33
changelog:
  - Resolves #1051382 - IPA Replica installation fails when using an external CA
  - Test patch to filter out invalid XML and provide additional debugging
    information
  - Resolves #1083170 - Prevent LDAP Attributes from being affected by Locale
  - Resolves #1096142 - IPA replica setup fails during CA setup with
                        "unable to parse xml"
  - Resolves #1061442 - RFE - ipa-server should keep backup of CS.cfg
  - Resolves #1055080 - Giant /var/log/pki-ca/debug


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.3-39
changelog:
  - Resolves #1144608 - pki-core failed to build with cmake-2.8.12.2-4.el6
  - Resolves #1037248 - pki-core FTBFS if "-Werror=format-security" flag is used
  - Resolves #1243 - Outdated selinux-policy dependency in Dogtag 9


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.3-40
changelog:
  - Resolves #1171848 - IPA - port 9443 (pki-core) is vulnerable to SSLv3 POODLE
    (based upon upstream changes provided by cfu and alee)


author: Jack Magne <jmagne@redhat.com> 9.0.3-42
changelog:
  - Resolves #1221900 - pki-core: cross-site scripting flaw in the dogtag administration page (port 9180, port 9444) [rhel-6.7]


author: Endi S. Dewata <edewata@redhat.com> 9.0.3-43
changelog:
  - Resolves #1225589 - unable to create rhel 7.1 replica from rhel 6 replica CA because subsystem user does not exist


author: Endi S. Dewata <edewata@redhat.com> 9.0.3-44
changelog:
  - Resolves #1256039 - Fixed missing subsystem user on external CA case.
  - Removed unused backup files (.p*) generated by the patches.


author: Ade Lee <alee@redhat.com> 9.0.3-48
changelog:
  - Resolves #1306989 - Crash seen with pki-common pkg during IPA server install
  - Resolves #1290535 - Check for incompatible Java at startup
  - Resolves #1313207 - ca.subsystem.certreq missing from CS.cfg


author: Dan Walsh <dwalsh@redhat.com> 1.9-9
changelog:
  - Change restorecon to not follow symlinks.  It is too difficult and confusing
  - to figure out the file context for the file pointed to by a symlink.


author: Colin Walters <walters@redhat.com> 1.10-3
changelog:
  - Add patch to fall back to authenticating via uid if
    the current user's SELinux user identity is the default
    identity
  - Add BuildRequires pam-devel


author: Dan Walsh <dwalsh@redhat.com> 1.13.3-1
changelog:
  - Update latest from NSA
  - Add -o option to setfiles to save output of any files with incorrect context.


author: Dan Walsh <dwalsh@redhat.com> 1.14.1-2
changelog:
  - Fix fixfiles.cron to not run on non SELinux boxes
  - Fix several problems in fixfiles and fixfiles.cron


author: Dan Walsh <dwalsh@redhat.com> 1.17.6-1
changelog:
  - Update with NSA
  	* Added -l option to setfiles to log changes via syslog.
  	* Merged -e option to setfiles to exclude directories.
  	* Merged -R option to restorecon for recursive descent.


author: Dan Walsh <dwalsh@redhat.com> 1.19.2-1
changelog:
  - Update to latest from NSA
  	* Changed restorecon to ignore ENOENT errors from matchpathcon.
  	* Merged nonls patch from Chris PeBenito.


author: Dan Walsh <dwalsh@redhat.com> 1.19.2-4
changelog:
  - Fix fixfiles handling of rpm
  - Fix restorecon to not warn on symlinks unless -v -v 
  - Fix output of verbose to show old context as well as new context


author: Dan Walsh <dwalsh@redhat.com> 1.19.3-1
changelog:
  - Update to latest from NSA
  	* Merged fixfiles and restorecon patches from Dan Walsh.
  	* Don't display change if only user part changed.


author: Dan Walsh <dwalsh@redhat.com> 1.20.1-1
changelog:
  - Update to latest from NSA
  	* Merged fixfiles rewrite from Dan Walsh.
  	* Merged restorecon patch from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 1.21.1-3
changelog:
  - Don't change user componant if it is all that changed unless forced.
  - Change fixfiles to concatinate file_context.local for setfiles


author: Dan Walsh <dwalsh@redhat.com> 1.21.3-1
changelog:
  - Upgrade to latest from NSA
  	* Fixed restorecon to not treat errors from is_context_customizable()
  	  as a customizable context.
  	* Merged setfiles/restorecon patch to not reset user field unless
  	  -F option is specified from Dan Walsh.
  	* Merged open_init_pty helper for run_init from Manoj Srivastava.
  	* Merged audit2allow and genhomedircon man pages from Manoj Srivastava.


author: Dan Walsh <dwalsh@redhat.com> 1.21.5-1
changelog:
  - Upgrade to latest from NSA
  	* Merged newrole -l support from Darrel Goeddel (TCS).
  - Fix genhomedircon STARTING_UID


author: Dan Walsh <dwalsh@redhat.com> 1.21.7-3
changelog:
  - Fix fixfiles patch
  - Upgrade to latest from NSA
  	* Prevent overflow of spec array in setfiles.
  - Add diff comparason between file_contexts to fixfiles
  - Allow restorecon to give an warning on file not found instead of exiting


author: Dan Walsh <dwalsh@redhat.com> 1.21.9-1
changelog:
  - More cleanup of sed patch
  - Upgrade to latest from NSA
  	* Merged updated fixfiles script from Dan Walsh.
  	* Merged updated man page for fixfiles from Dan Walsh and re-added unzipped.
  	* Reverted fixfiles patch for file_contexts.local; 
  	  obsoleted by setfiles rewrite.
  	* Merged error handling patch for restorecon from Dan Walsh.
  	* Merged semi raw mode for open_init_pty helper from Manoj Srivastava.
  	* Rewrote setfiles to use matchpathcon and the new interfaces
  	  exported by libselinux (>= 1.21.5).


author: Dan Walsh <dwalsh@redhat.com> 1.21.10-1
changelog:
  - More cleanup of fixfiles sed patch
  - Upgrade to latest from NSA
  	* Merged patch for open_init_pty from Manoj Srivastava.


author: Dan Walsh <dwalsh@redhat.com> 1.21.12-1
changelog:
  - More cleanup of fixfiles sed patch
  	* Merged further patches for restorecon/setfiles -e and fixfiles -C.


author: Dan Walsh <dwalsh@redhat.com> 1.21.13-1
changelog:
  - Update from NSA
  	* Merged further change to fixfiles -C from Dan Walsh.
  	* Merged updated fixfiles script from Dan Walsh.
  - Fix error handling of restorecon


author: Dan Walsh <dwalsh@redhat.com> 1.21.17-1
changelog:
  - Update to latest from NSA
  	* Merged new genhomedircon script from Dan Walsh.
  	* Changed load_policy to call sepol_genusers().


author: Dan Walsh <dwalsh@redhat.com> 1.21.18-1
changelog:
  - Update to latest from NSA
  	* Changed load_policy to fall back to the original policy upon
  	  an error from sepol_genusers().


author: Dan Walsh <dwalsh@redhat.com> 1.21.18-2
changelog:
  - Apply Uli patch
  	* The Makefiles should use the -Wall option even if compiled in beehive
  	* Add -W, too
  	* use -Werror when used outside of beehive.  This could also be used unconditionally
  	* setfiles/setfiles.c: fix resulting warning
  	* restorecon/restorecon.c: Likewise
  	* run_init/open_init_pty.c: argc hasn't been checked, the program would crash if
  called without parameters.  ignore the return value of nice properly.
  	* run_init: don't link with -ldl lutil
  	* load_policy: that's the bad bug.  pointer to unsigned int is passed, size_t is
  written to.  fails on 64-bit archs
  	* sestatus: signed vs unsigned problem
  	* newrole: don't link with -ldl


author: Dan Walsh <dwalsh@redhat.com> 1.23.1-1
changelog:
  - Update to released version from NSA
  	* Merged rewrite of genhomedircon by Eric Paris.
  	* Changed fixfiles to relabel jfs since it now supports security xattrs
  	  (as of 2.6.11).  Removed reiserfs until 2.6.12 is released with 
  	  fixed support for reiserfs and selinux.


author: Dan Walsh <dwalsh@redhat.com> 1.23.2-1
changelog:
  - Update to version from NSA
  	* Changed setfiles -c to call set_matchpathcon_flags(3) to
  	  turn off processing of .homedirs and .local.


author: Dan Walsh <dwalsh@redhat.com> 1.23.3-1
changelog:
  - Update to version from NSA
          * Merged context validation patch for genhomedircon from Eric Paris.
  - Fix verbose output of restorecon


author: Dan Walsh <dwalsh@redhat.com> 1.23.4-1
changelog:
  - Update to version from NSA
  	* Merged load_policy is_selinux_enabled patch from Dan Walsh.
  	* Merged restorecon verbose output patch from Dan Walsh.
  	* Merged setfiles altroot patch from Chris PeBenito.


author: Dan Walsh <dwalsh@redhat.com> 1.23.5-1
changelog:
  - Update to match NSA
  	* Reverted load_policy is_selinux_enabled patch from Dan Walsh.
  	  Otherwise, an initial policy load cannot be performed using
  	  load_policy, e.g. for anaconda.


author: Dan Walsh <dwalsh@redhat.com> 1.23.6-1
changelog:
  - Update to match NSA
  	* Fixed signed/unsigned pointer bug in load_policy.
  	* Reverted context validation patch for genhomedircon.


author: Dan Walsh <dwalsh@redhat.com> 1.23.7-1
changelog:
  - Change -f flag in fixfiles to remove stuff from /tmp
  - Change -F flag to pass -F flag  to restorecon/fixfiles.  (IE Force relabel).


author: Dan Walsh <dwalsh@redhat.com> 1.23.9-1
changelog:
  - Update to match NSA
  	* Updated audit2why for sepol_ prefixes on Flask types to
  	  avoid namespace collision with libselinux, and to 
  	  include <selinux/selinux.h> now.


author: Dan Walsh <dwalsh@redhat.com> 1.23.10-1
changelog:
  - Update to match NSA
  	* Extended audit2why to incorporate booleans and local user 
  	  settings when analyzing audit messages.


author: Dan Walsh <dwalsh@redhat.com> 1.23.11-1
changelog:
  - Update to match NSA
  	* Merged fixfiles and newrole patch from Dan Walsh.
  	* Merged audit2why man page from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 1.25.5-1
changelog:
  - Update to match NSA
  	* Merged patch to move module read/write code from libsemanage
  	  to libsepol from Jason Tang (Tresys).


author: Dan Walsh <dwalsh@redhat.com> 1.25.6-1
changelog:
  - Update to match NSA
  	* Merged fixes for semodule_link and sestatus from Serge Hallyn (IBM).
  	  Bugs found by Coverity.


author: Dan Walsh <dwalsh@redhat.com> 1.25.9-1
changelog:
  - Update to match NSA
  	* Changed setfiles -c to translate the context to raw format
  	prior to calling libsepol.


author: Dan Walsh <dwalsh@redhat.com> 1.27.1-1
changelog:
  - Update to match NSA
  	* Merged error shadowing bug fix for restorecon from Dan Walsh.
  	* Merged setfiles usage/man page update for -r option from Dan Walsh.
  	* Merged fixfiles -C patch to ignore :s0 addition on update
  	  to a MCS/MLS policy from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 1.27.2-1
changelog:
  - Update to match NSA
  	* Merged run_init open_init_pty bug fix from Manoj Srivastava
  	  (unblock SIGCHLD).  Bug reported by Erich Schubert.


author: Dan Walsh <dwalsh@redhat.com> 1.27.3-1
changelog:
  - Update to match NSA
  	* Merged patch to update semodule to the new libsemanage API
  	and improve the user interface from Karl MacMillan (Tresys).
  	* Modified semodule for the create/connect API split.


author: Dan Walsh <dwalsh@redhat.com> 1.27.5-1
changelog:
  - Update to match NSA
  	* Fixed warnings in load_policy.
  	* Rewrote load_policy to use the new selinux_mkload_policy()
  	interface provided by libselinux.


author: Dan Walsh <dwalsh@redhat.com> 1.27.6-1
changelog:
  - Update to match NSA
  	* Updated for changes to libsepol. 
  	Changed semodule and semodule_package to use the shared libsepol.
  	Disabled build of semodule_link and semodule_expand for now.
  	Updated audit2why for relocated policydb internal headers,
  	still needs to be converted to a shared lib interface.


author: Dan Walsh <dwalsh@redhat.com> 1.27.7-1
changelog:
  - Update to match NSA
  	* Updated semodule_link and semodule_expand to use shared libsepol.
  	Fixed audit2why to call policydb_init prior to policydb_read (still
  	uses the static libsepol).


author: Dan Walsh <dwalsh@redhat.com> 1.27.11-1
changelog:
  - Update to match NSA
  	* Updated semodule_expand to use get interfaces for hidden sepol_module_package type.
  	* Merged newrole and run_init pam config patches from Dan Walsh (Red Hat).
  	* Merged fixfiles patch from Dan Walsh (Red Hat).
  	* Updated semodule for removal of semanage_strerror.


author: Dan Walsh <dwalsh@redhat.com> 1.27.12-1
changelog:
  - Update to match NSA
  	* Merged non-PAM Makefile support for newrole and run_init from Timothy Wood.


author: Dan Walsh <dwalsh@redhat.com> 1.27.18-1
changelog:
  - Update to match NSA
  	* Cleaned up usage and error messages and releasing of memory by
     	  semodule_* utilities.
  	* Corrected error reporting by semodule.
  	* Updated semodule_expand for change to sepol interface.
  	* Merged fixes for make DESTDIR= builds from Joshua Brindle.


author: Dan Walsh <dwalsh@redhat.com> 1.27.19-1
changelog:
  - Update to match NSA
  	* Merged semodule support for reload, noreload, and store options
  	  from Joshua Brindle.
  	* Merged semodule_package rewrite from Joshua Brindle.


author: Dan Walsh <dwalsh@redhat.com> 1.27.20-1
changelog:
  - Update to match NSA
  	* Merged setsebool patch from Ivan Gyurdiev.
  	  This moves setsebool from libselinux/utils to policycoreutils,
  	  and rewrites it to use libsemanage for permanent boolean changes.


author: Dan Walsh <dwalsh@redhat.com> 1.27.23-1
changelog:
  - Update to match NSA
  	* Changed setfiles for the context canonicalization support.
  	* Changed setsebool to call semanage_is_managed() interface
  	  and fall back to security_set_boolean_list() if policy is
  	  not managed.
  	* Merged setsebool memory leak fix from Ivan Gyurdiev.
  	* Merged setsebool patch to call semanage_set_reload_bools()
  	  interface from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.27.26-1
changelog:
  * Added -B (--build) option to semodule to force a rebuild.
  	* Reverted setsebool patch to call semanage_set_reload_bools().
  	* Changed setsebool to disable policy reload and to call
  	  security_set_boolean_list to update the runtime booleans.
  	* Changed setfiles -c to use new flag to set_matchpathcon_flags()
  	  to disable context translation by matchpathcon_init().


author: Dan Walsh <dwalsh@redhat.com> 1.27.28-2
changelog:
  - Update to match NSA
  	* Merged genhomedircon rewrite from Dan Walsh.
  - Rewrite audit2allow to python


author: Dan Walsh <dwalsh@redhat.com> 1.27.29-1
changelog:
  - Update to match NSA
  	* Merged audit2allow python script from Dan Walsh.
  	  (old script moved to audit2allow.perl, will be removed later).
  	* Merged genhomedircon fixes from Dan Walsh.
  	* Merged semodule quieting patch from Dan Walsh
  	  (inverts default, use -v to restore original behavior).


author: Dan Walsh <dwalsh@redhat.com> 1.27.30-1
changelog:
  - Update to match NSA
  	* Merged sestatus, audit2allow, and semanage patch from Dan Walsh.
  	* Fixed semodule -v option.


author: Dan Walsh <dwalsh@redhat.com> 1.27.31-1
changelog:
  - Update to match NSA
  	* Changed genhomedircon to always use user_r for the role in the
  	  managed case since user_get_defrole is broken.
  - Add te file capabilities to audit2allow
  - Add man pages for semodule


author: Dan Walsh <dwalsh@redhat.com> 1.27.33-1
changelog:
  - Update to match NSA
  	* Merged audit2allow --tefile and --fcfile support from Dan Walsh.
  	* Merged genhomedircon fix from Dan Walsh.
  	* Merged semodule* man pages from Dan Walsh, and edited them.
  	* Changed setfiles to set the MATCHPATHCON_VALIDATE flag to
  	  retain validation/canonicalization of contexts during init.


author: Dan Walsh <dwalsh@redhat.com> 1.27.35-1
changelog:
  - Update to match NSA
  	* Merged genhomedircon bug fix from Dan Walsh.
  	* Revised semodule* man pages to refer to checkmodule and
  	  to include example sections.


author: Dan Walsh <dwalsh@redhat.com> 1.27.36-1
changelog:
  - Update to match NSA
  	* Changed genhomedircon to warn on use of ROLE in homedir_template
  	  if using managed policy, as libsemanage does not yet support it.


author: Dan Walsh <dwalsh@redhat.com> 1.29.1-1
changelog:
  - Update to match NSA
  	* Merged fix for audit2allow long option list from Dan Walsh.
  	* Merged -r option for restorecon (alias for -R) from Dan Walsh.
  	* Merged chcat script and man page from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 1.29.2-1
changelog:
  - Fix genhomedircon to work in installer
  - Update to match NSA
  	* Merged patch for chcat script from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 1.29.3-1
changelog:
  - Update to match NSA
  	* Merged semanage getpwnam bug fix from Serge Hallyn (IBM).
  	* Merged patch series from Ivan Gyurdiev.
  	  This includes patches to:
  	  - cleanup setsebool
  	  - update setsebool to apply active booleans through libsemanage
  	  - update semodule to use the new semanage_set_rebuild() interface
  	  - fix various bugs in semanage
  	* Merged patch from Dan Walsh (Red Hat).
  	  This includes fixes for restorecon, chcat, fixfiles, genhomedircon,
  	  and semanage.


author: Dan Walsh <dwalsh@redhat.com> 1.29.4-1
changelog:
  - Update to match NSA
  	* Merged genhomedircon and semanage patch from Dan Walsh.
  	* Changed semodule error reporting to include argv[0].


author: Dan Walsh <dwalsh@redhat.com> 1.29.7-1
changelog:
  - Update to match NSA
  	* Merged newrole cleanup patch from Steve Grubb.
  	* Merged setfiles/restorecon performance patch from Russell Coker.
  	* Merged genhomedircon and semanage patches from Dan Walsh.
  	* Merged remove add_local/set_local patch from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.29.8-1
changelog:
  - Update to match NSA
  	* Merged semanage fixes from Ivan Gyurdiev.
  	* Merged semanage fixes from Russell Coker.
  	* Merged chcat, genhomedircon, and semanage diffs from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 1.29.11-1
changelog:
  - Added translation support to semanage
  - Update from upstream
  	* Modified newrole and run_init to use the loginuid when
  	  supported to obtain the Linux user identity to re-authenticate,
  	  and to fall back to real uid.  Dropped the use of the SELinux
  	  user identity, as Linux users are now mapped to SELinux users
  	  via seusers and the SELinux user identity space is separate.
  	* Merged semanage bug fixes from Ivan Gyurdiev.
  	* Merged semanage fixes from Russell Coker.
  	* Merged chcat.8 and genhomedircon patches from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 1.29.15-1
changelog:
  - Update from upstream
  	* Merged newrole audit patch from Steve Grubb.
  	* Merged seuser -> seuser local rename patch from Ivan Gyurdiev.
  	* Merged semanage and semodule access check patches from Joshua Brindle.


author: Dan Walsh <dwalsh@redhat.com> 1.29.17-1
changelog:
  - Update from upstream
  	* Merged genhomedircon fix from Dan Walsh.
  	* Merged seusers.system patch from Ivan Gyurdiev.
  	* Merged improve port/fcontext API patch from Ivan Gyurdiev.
  	* Merged genhomedircon patch from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 1.29.20-1
changelog:
  - Update from upstream
  	* Merged seuser/user_extra support patch to semodule_package 
  	  from Joshua Brindle.
  	* Merged getopt type fix for semodule_link/expand and sestatus
  	  from Chris PeBenito.
  - Fix genhomedircon output


author: Dan Walsh <dwalsh@redhat.com> 1.29.23-1
changelog:
  - Update from upstream
  	* Merged newrole -V/--version support from Glauber de Oliveira Costa.
  	* Merged genhomedircon prefix patch from Dan Walsh.
  	* Merged optionals in base patch from Joshua Brindle.


author: Dan Walsh <dwalsh@redhat.com> 1.29.26-1
changelog:
  - Update from upstream
  	* Merged semanage bug fix patch from Ivan Gyurdiev.
  	* Merged improve bindings patch from Ivan Gyurdiev.
  	* Merged semanage usage patch from Ivan Gyurdiev.
  	* Merged use PyList patch from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.30.1-1
changelog:
  - Make audit2allow translate dontaudit as well as allow rules
  - Update from upstream
  	* Merged semanage labeling prefix patch from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.30.4-1
changelog:
  - Update from upstream
  	* Merged audit2allow fixes for refpolicy from Dan Walsh.
  	* Merged fixfiles patch from Dan Walsh.
  	* Merged restorecond daemon from Dan Walsh.
  	* Merged semanage non-MLS fixes from Chris PeBenito.
  	* Merged semanage and semodule man page examples from Thomas Bleher.


author: Dan Walsh <dwalsh@redhat.com> 1.30.6-1
changelog:
  - Add /etc/samba/secrets.tdb to restorecond.conf
  - Update from upstream
  	* Merged semanage prefix support from Russell Coker.
  	* Added a test to setfiles to check that the spec file is
  	  a regular file.


author: Dan Walsh <dwalsh@redhat.com> 1.30.8-1
changelog:
  - Update to upstream
  	* Merged fix warnings patch from Karl MacMillan.
  	* Merged patch from Dan Walsh.
  	  This includes audit2allow changes for analysis plugins,
  	  internationalization support for several additional programs 
  	  and added po files, some fixes for semanage, and several cleanups.
  	  It also adds a new secon utility.


author: Dan Walsh <dwalsh@redhat.com> 1.30.9-1
changelog:
  - Update to upstream
  	* Fixed audit2allow and po Makefiles for DESTDIR= builds.
  	* Merged .po file patch from Dan Walsh.
  	* Merged bug fix for genhomedircon.


author: Dan Walsh <dwalsh@redhat.com> 1.30.10-1
changelog:
  - Update to upstream
  	* Merged patch with updates to audit2allow, secon, genhomedircon,
  	  and semanage from Dan Walsh.


author: James Antill <jantill@redhat.com> 1.30.10-2
changelog:
  - secon fixes for --self-exec etc.
  - secon change from level => sensitivity, add clearance.
  - Add mass relabel AUDIT patch, but disable it until kernel problem solved.


author: Dan Walsh <dwalsh@redhat.com> 1.30.11-1
changelog:
  - Update to upstream
  	* Merged more translations from Dan Walsh.
  	* Merged patch to relocate setfiles to /sbin for early relabel
  	  when /usr might not be mounted from Dan Walsh.
  	* Merged semanage/seobject patch to preserve fcontext ordering in list.
  	* Merged secon patch from James Antill.


author: Dan Walsh <dwalsh@redhat.com> 1.30.14-1
changelog:
  - Update to upstream
  	* Merged fix for setsebool error path from Serge Hallyn.
  	* Merged patch from Dan Walsh with:
  	*    Updated po files.
  	*    Fixes for genhomedircon and seobject.
  	*    Audit message for mass relabel by setfiles.


author: Dan Walsh <dwalsh@redhat.com> 1.30.17-1
changelog:
  - Update to upstream
  	* Lindent.
  	* Merged patch from Dan Walsh with:
  	  * -p option (progress) for setfiles and restorecon.
  	  * disable context translation for setfiles and restorecon.
  	  * on/off values for setsebool.
  	* Merged setfiles and semodule_link fixes from Joshua Brindle.


author: Dan Walsh <dwalsh@redhat.com> 1.30.22-1
changelog:
  - Update to upstream
  	* Merged restorecond size_t fix from Joshua Brindle.
  	* Merged secon keycreate patch from Michael LeMay.
  	* Merged restorecond fixes from Dan Walsh.
  	  Merged updated po files from Dan Walsh.
  	* Merged python gettext patch from Stephen Bennett.
  	* Merged semodule_deps from Karl MacMillan.


author: Dan Walsh <dwalsh@redhat.com> 1.30.25-1
changelog:
  - Update to upstream
  	* Merged patch from Dan Walsh with:
  	  * audit2allow: process MAC_POLICY_LOAD events
  	  * newrole:  run shell with - prefix to start a login shell
  	  * po:  po file updates
  	  * restorecond:  bail if SELinux not enabled
  	  * fixfiles: omit -q 
  	  * genhomedircon:  fix exit code if non-root
  	  * semodule_deps:  install man page
  	* Merged secon Makefile fix from Joshua Brindle.
  	* Merged netfilter contexts support patch from Chris PeBenito.


author: Dan Walsh <dwalsh@redhat.com> 1.30.26-1
changelog:
  - Update to upstream
  	* Merged semanage local file contexts patch from Chris PeBenito.
  - Fix fixfiles log creation
  - More translations


author: Dan Walsh <dwalsh@redhat.com> 1.30.27-4
changelog:
  - Add -i qualified to restorecon to tell it to ignore files that do not exist
  - Fixfiles also modified for this change


author: Dan Walsh <dwalsh@redhat.com> 1.30.28-1
changelog:
  - Security fixes to run python in a more locked down manner
  - More Translations
  - Update to upstream
  	* Merged fix for restorecon // handling from Erich Schubert.
  	* Merged translations update and fixfiles fix from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 1.30.28-6
changelog:
  - Change setfiles and restorecon to use stderr except for -o flag
  - Also -o flag will now output files


author: Dan Walsh <dwalsh@redhat.com> 1.30.30-1
changelog:
  - Update to upstream
  	* Merged newrole auditing of failures due to user actions from
  	  Michael Thompson.


author: Dan Walsh <dwalsh@redhat.com> 1.32-1
changelog:
  - Add newrole audit patch from sgrubb
  - Update to upstream
  	* Merged audit2allow -l fix from Yuichi Nakamura.
  	* Merged restorecon -i and -o - support from Karl MacMillan.
  	* Merged semanage/seobject fix from Dan Walsh.
  	* Merged fixfiles -R and verify changes from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 1.33.4-1
changelog:
  - Upstream accepted my patches
  	* Merged setsebool patch from Karl MacMillan. 
  	  This fixes a bug reported by Yuichi Nakamura with
  	  always setting booleans persistently on an unmanaged system.


author: Dan Walsh <dwalsh@redhat.com> 1.33.6-1
changelog:
  - Update to upstream
  	* Patch from Dan Walsh to add an pam_acct_msg call to run_init
  	* Patch from Dan Walsh to fix error code returns in newrole
  	* Patch from Dan Walsh to remove verbose flag from semanage man page
  	* Patch from Dan Walsh to make audit2allow use refpolicy Makefile
  	  in /usr/share/selinux/<SELINUXTYPE>


author: Dan Walsh <dwalsh@redhat.com> 1.33.6-5
changelog:
  - Update po files
  - Fix newrole to open stdout and stderr rdrw so more will work on MLS machines
  Resolves: #216920


author: Dan Walsh <dwalsh@redhat.com> 1.33.6-6
changelog:
  - Fix audit2allow generating reference policy
  - Fix semanage to manage user roles properly 
  Resolves: #220071


author: Dan Walsh <dwalsh@redhat.com> 1.33.6-7
changelog:
  - add exists switch to semanage to tell it not to check for existance of Linux user
  Resolves: #219421


author: Dan Walsh <dwalsh@redhat.com> 1.33.6-9
changelog:
  - Fix fixfiles script to use tty command correctly.  If this command fails, it 
  should set the LOGFILE to /dev/null
  Resolves: #220879


author: Dan Walsh <dwalsh@redhat.com> 1.33.8-1
changelog:
  - Update to upstream
  	* Merged patches from Dan Walsh to:
  	  - omit the optional name from audit2allow
  	  - use the installed python version in the Makefiles
  	  - re-open the tty with O_RDWR in newrole


author: Dan Walsh <dwalsh@redhat.com> 1.33.10-1
changelog:
  - Update to upstream
  	* Merged patch to correctly handle a failure during semanage handle
  	  creation from Karl MacMillan.
  	* Merged patch to fix seobject role modification from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 1.33.11-1
changelog:
  - Update to upstream
  	* Merged fixfiles and seobject fixes from Dan Walsh.
  	* Merged semodule support for list of modules after -i from Karl MacMillan.


author: Dan Walsh <dwalsh@redhat.com> 1.33.12-1
changelog:
  - Want to update to match api
  - Update to upstream
  	* Merged newrole securetty check from Dan Walsh.
  	* Merged semodule patch to generalize list support from Karl MacMillan.
  Resolves: #200110


author: Dan Walsh <dwalsh@redhat.com> 1.33.14-1
changelog:
  * Merged newrole man page patch from Michael Thompson.
  	* Merged patch to fix python unicode problem from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 1.33.15-1
changelog:
  - Update to upstream
  	* Merged unicode-to-string fix for seobject audit from Dan Walsh.
  	* Merged man page updates to make "apropos selinux" work from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 1.34.1-1
changelog:
  - Fix system-config-selinux ports view
  - Update to upstream
  	* Fixed newrole non-pam build.
  	* Updated version for stable branch.


author: Dan Walsh <dwalsh@redhat.com> 2.0.0-1
changelog:
  - Update to upstream
  	* Merged new audit2allow from Karl MacMillan.
  	  This audit2allow depends on the new sepolgen python module.
  	  Note that you must run the sepolgen-ifgen tool to generate
  	  the data needed by audit2allow to generate refpolicy. 
  	* Fixed newrole non-pam build.
  - Fix Changelog and spelling error in man page


author: Dan Walsh <dwalsh@redhat.com> 2.0.1-1
changelog:
  - Update to upstream
  	* Merged small fix to correct include of errcodes.h in semodule_deps from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 2.0.2-1
changelog:
  - Update to upstream
  	* Merged seobject exception handler fix from Caleb Case.
  	* Merged setfiles memory leak patch from Todd Miller.


author: Dan Walsh <dwalsh@redhat.com> 2.0.3-1
changelog:
  - Update to upstream
  	* Merged translations update from Dan Walsh.
  	* Merged chcat fixes from Dan Walsh.
  	* Merged man page fixes from Dan Walsh.
  	* Merged seobject prefix validity checking from Dan Walsh.
  	* Merged Makefile and refparser.py patch from Dan Walsh.
  	  Fixes PYTHONLIBDIR definition and error handling on interface files.


author: Dan Walsh <dwalsh@redhat.com> 2.0.6-1
changelog:
  - Update to upstream
    - policycoreutils
  	* Merged newrole O_NONBLOCK fix from Linda Knippers.
  	* Merged sepolgen and audit2allow patches to leave generated files 
  	  in the current directory from Karl MacMillan.
  	* Merged restorecond memory leak fix from Steve Grubb.
    -sepolgen
  	* Merged patch to leave generated files (e.g. local.te) in current directory from Karl MacMillan.
  	* Merged patch to make run-tests.py use unittest.main from Karl MacMillan.
  	* Merged patch to update PLY from Karl MacMillan.
  	* Merged patch to update the sepolgen parser to handle the latest reference policy from Karl MacMillan.


author: Dan Walsh <dwalsh@redhat.com> 2.0.6-3
changelog:
  - Update to upstream
    -sepolgen
  	* Merged support for enabling parser debugging from Karl MacMillan.
  - Add sgrupp cleanup of restorcon init script


author: Dan Walsh <dwalsh@redhat.com> 2.0.7-1
changelog:
  - Update to upstream
  	* Merged restorecond init script LSB compliance patch from Steve Grubb.
    -sepolgen
  	* Merged better matching for refpolicy style from Karl MacMillan
  	* Merged support for extracting interface paramaters from interface calls from Karl MacMillan
  	* Merged support for parsing USER_AVC audit messages from Karl MacMillan.


author: Dan Walsh <dwalsh@redhat.com> 2.0.7-5
changelog:
  - Change location of audit2allow and sepol-ifgen to sbin
  - Updated version of sepolgen
  	* Merged patch to move the sepolgen runtime data from /usr/share to /var/lib to facilitate a read-only /usr from Karl MacMillan.


author: Dan Walsh <dwalsh@redhat.com> 2.0.7-6
changelog:
  - Updated version of sepolgen
  	* Merged patch to discard self from types when generating requires from Karl MacMillan.


author: Dan Walsh <dwalsh@redhat.com> 2.0.7-8
changelog:
  - system-config-selinux should be able to run on a disabled system,
  - at least enough to get it enabled.


author: Dan Walsh <dwalsh@redhat.com> 2.0.8-1
changelog:
  - Updated version of sepolgen
  	* Merged updates to sepolgen-ifgen from Karl MacMillan.
  	* Merged updates to sepolgen parser and tools from Karl MacMillan.
  	  This includes improved debugging support, handling of interface 
  	  calls with list parameters, support for role transition rules,
  	  updated range transition rule support, and looser matching.


author: Dan Walsh <dwalsh@redhat.com> 2.0.9-1
changelog:
  - Updated version of sepolgen
  	* Merged seobject setransRecords patch to return the first alias from Xavier Toth.


author: Dan Walsh <dwalsh@redhat.com> 2.0.10-1
changelog:
  - Updated version of policycoreutils
  	* Merged chcat, fixfiles, genhomedircon, restorecond, and restorecon patches from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 2.0.13-1
changelog:
  - Updated version of policycoreutils
  	* Merged setsebool patch to only use libsemanage for persistent boolean changes from Stephen Smalley.
  	* Merged genhomedircon patch to use the __default__ setting from Dan Walsh.
  	* Dropped -b option from load_policy in preparation for always preserving booleans across reloads in the kernel.


author: Dan Walsh <dwalsh@redhat.com> 2.0.15-1
changelog:
  - Updated version of policycoreutils
  	* Merged po file updates from Dan Walsh.
  - Fix semanage to be able to modify prefix in user record


author: Dan Walsh <dwalsh@redhat.com> 2.0.16-1
changelog:
  - Updated version of policycoreutils
  	* Merged support for modifying the prefix via semanage from Dan Walsh.
  - Fixed genhomedircon to find homedirs correctly.


author: Dan Walsh <dwalsh@redhat.com> 2.0.20-1
changelog:
  - Update to match NSA
  	* Merged genhomedircon fixes from Dan Walsh.
  	* Merged setfiles -c usage fix from Dan Walsh.
  	* Merged restorecon fix from Yuichi Nakamura.
  	* Dropped -lsepol where no longer needed.


author: Dan Walsh <dwalsh@redhat.com> 2.0.22-13
changelog:
  - Speed up genhomedircon by an order of magnitude by compiling regex
  - Allow semanage fcontext -a -t <<none>> /path to work


author: Dan Walsh <dwalsh@redhat.com> 2.0.25-1
changelog:
  - Update semodule man page
  	* Fix genhomedircon searching for USER from Todd Miller
  	* Install run_init with mode 0755 from Dan Walsh.
  	* Fix chcat from Dan Walsh.
  	* Fix fixfiles pattern expansion and error reporting from Dan Walsh.	
  	* Optimize genhomedircon to compile regexes once from Dan Walsh.
  	* Fix semanage gettext call from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 2.0.25-13
changelog:
  - Upgrade version of sepolgen from NSA
  	* Expand the sepolgen parser to parse all current refpolicy modules from Karl MacMillan.
  	* Suppress generation of rules for non-denials from Karl MacMillan (take 3).


author: Dan Walsh <dwalsh@redhat.com> 2.0.28-1
changelog:
  - Update to upstream
  	* Update semodule man page for -D from Dan Walsh.
  	* Add boolean, locallist, deleteall, and store support to semanage from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 2.0.29-1
changelog:
  - Update to upstream
  	* Add genhomedircon script to invoke semodule -Bn from Dan Walsh.
  - Add deleteall for ports and fcontext


author: Dan Walsh <dwalsh@redhat.com> 2.0.31-1
changelog:
  - Remove no.po
  - Update to upstream
  	* Fix semodule option handling from Dan Walsh.
  	* Add deleteall support for ports and fcontexts in semanage from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 2.0.33-1
changelog:
  - Upgrade from NSA
  	* Drop verbose output on fixfiles -C from Dan Walsh.
  	* Fix argument handling in fixfiles from Dan Walsh.
  	* Enhance boolean support in semanage, including using the .xml description when available, from Dan Walsh.
  - Fix handling of final screen in polgengui


author: Dan Walsh <dwalsh@redhat.com> 2.0.33-4
changelog:
  - Fix sepolgen to be able to parse Fedora 9 policy
        Handle ifelse statements
        Handle refpolicywarn inside of define
        Add init.if and inetd.if into parse
        Add parse_file to syntax error message


author: Dan Walsh <dwalsh@redhat.com> 2.0.34-1
changelog:
  - Update to upstream
  	* Update Makefile to not build restorecond if
  	  /usr/include/sys/inotify.h is not present


author: Dan Walsh <dwalsh@redhat.com> 2.0.34-2
changelog:
  - Make sepolgen set error exit code when partial failure
  - audit2why now checks booleans for avc diagnosis


author: Dan Walsh <dwalsh@redhat.com> 2.0.35-1
changelog:
  - Update to upstream
  	* Merged support for non-interactive newrole command invocation from Tim Reed.


author: Dan Walsh <dwalsh@redhat.com> 2.0.36-1
changelog:
  - Update to upstream
  	* Merged update to chcat, fixfiles, and semanage scripts from Dan Walsh.
  	* Merged sepolgen fixes from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 2.0.38-1
changelog:
  - Update to upstream
    * Merged audit2allow cleanups and boolean descriptions from Dan Walsh.
    * Merged setfiles -0 support by Benny Amorsen via Dan Walsh.
    * Merged fixfiles fixes and support for ext4 and gfs2 from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 2.0.39-1
changelog:
  - Don't initialize audit2allow for audit2why call.  Use default
  - Update to upstream
  	* Merged fixfiles -C fix from Marshall Miller.


author: Dan Walsh <dwalsh@redhat.com> 2.0.41-1
changelog:
  - Update to upstream
  	* Merged audit2why fix and semanage boolean --on/--off/-1/-0 support from Dan Walsh.
  	* Merged a second fixfiles -C fix from Marshall Miller.


author: Dan Walsh <dwalsh@redhat.com> 2.0.42-1
changelog:
  - Update to upstream
  	* Make semodule_expand use sepol_set_expand_consume_base to reduce
  	  peak memory usage.


author: Dan Walsh <dwalsh@redhat.com> 2.0.43-1
changelog:
  - Update to upstream
  	* Merged fix fixfiles option processing from Vaclav Ovsik.
  - Added existing users, staff and user_t users to polgengui


author: Dan Walsh <dwalsh@redhat.com> 2.0.46-1
changelog:
  - Update to upstream
  	* Update audit2allow to report dontaudit cases from Dan Walsh.
  	* Fix semanage port to use --proto from Caleb Case.


author: Dan Walsh <dwalsh@redhat.com> 2.0.47-1
changelog:
  - Make restorecond not start by default
  - Fix polgengui to allow defining of confined roles.
  - Add patches from Lubomir Rintel <lkundrak@v3.sk> 
    * Add necessary runtime dependencies on setools-console for -gui
    * separate stderr when run seinfo commands
  - Update to upstream
    * Update semanage man page for booleans from Dan Walsh.
    * Add further error checking to seobject.py for setting booleans.


author: Dan Walsh <dwalsh@redhat.com> 2.0.47-2
changelog:
  - Add 	rm -rf /tmp/gconfd-* /tmp/pulse-* /tmp/orbit-* to fixfiles restore
  - So that mislabeled files will get removed on full relabel


author: Dan Walsh <dwalsh@redhat.com> 2.0.49-1
changelog:
  - Update to upstream
  	* Remove security_check_context calls for prefix validation from semanage.
  	* Change setfiles and restorecon to not relabel if the file already has the correct context value even if -F/force is specified.


author: Dan Walsh <dwalsh@redhat.com> 2.0.52-2
changelog:
  - Add lockdown wizard
  - Allow semanage booleans to take an input file an process lots of booleans at once.


author: Dan Walsh <dwalsh@redhat.com> 2.0.53-1
changelog:
  - Update to upstream
  	* Change setfiles to validate all file_contexts files when using -c from Stephen Smalley.


author: Dan Walsh <dwalsh@redhat.com> 2.0.54-1
changelog:
  - Update to upstream
  	* Add support for boolean files and group support for seusers from Dan Walsh.
  	* Ensure that setfiles -p output is newline terminated from Russell Coker.


author: Dan Walsh <dwalsh@redhat.com> 2.0.56-1
changelog:
  - Fix semanage help display
  - Update to upstream
  	* fixfiles will now remove all files in /tmp and will check for
  	  unlabeled_t in /tmp and /var/tmp from Dan Walsh.
  	* add glob support to restorecond from Dan Walsh.
  	* allow semanage to handle multi-line commands in a single transaction
  	  from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 2.0.58-1
changelog:
  - Update to upstream
  	* Allow local file context entries to override policy entries in
  	semanage from Dan Walsh.
  	* Newrole error message corrections from Dan Walsh.
  	* Add exception to audit2why call in audit2allow from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 2.0.61-1
changelog:
  - Update to upstream
  	* chcat: cut categories at arbitrary point (25) from Dan Walsh
  	* semodule: use new interfaces in libsemanage for compressed files
  	  from Dan Walsh
  	* audit2allow: string changes for usage


author: Dan Walsh <dwalsh@redhat.com> 2.0.61-3
changelog:
  - Add Domains Page to system-config-selinux
  - Add ability to create dbus confined applications to polgen


author: Dan Walsh <dwalsh@redhat.com> 2.0.62-1
changelog:
  - Update to upstream
  	* Add btrfs to fixfiles from Dan Walsh.
  	* Remove restorecond error for matching globs with multiple hard links
   	  and fix some error messages from Dan Walsh.
  	* Make removing a non-existant module a warning rather than an error
  	  from Dan Walsh.
  	* Man page fixes from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 2.0.63-1
changelog:
  - Update to upstream
  	* Fix transaction checking from Dan Walsh.
  	* Make fixfiles -R (for rpm) recursive.
  	* Make semanage permissive clean up after itself from Dan Walsh.
  	* add /root/.ssh/* to restorecond.conf


author: Dan Walsh <dwalsh@redhat.com> 2.0.64-1
changelog:
  - Update to upstream
  	* Keep setfiles from spamming console from Dan Walsh.
  	* Fix chcat's category expansion for users from Dan Walsh.
  - Update po files
  - Fix sepolgen


author: Dan Walsh <dwalsh@redhat.com> 2.0.68-1
changelog:
  - Fix location of man pages
  - Update to upstream
  	* Modify setfiles to exclude mounts without seclabel option in
  	/proc/mounts on kernels >= 2.6.30 from Thomas Liu.
  	* Re-enable disable_dontaudit rules upon semodule -B from Christopher
  	Pardy and Dan Walsh.
  	* setfiles converted to fts from Thomas Liu.


author: Dan Walsh <dwalsh@redhat.com> 2.0.70-1
changelog:
  - Update to upstream
  	* Modify restorecon to only call realpath() on user-supplied pathnames
  	from Stephen Smalley.
  	* Fix typo in fixfiles that prevented it from relabeling btrfs 
  	  filesystems from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 2.0.71-1
changelog:
  - Fix chcat to report error on non existing file
  - Update to upstream
  	* Modify setfiles/restorecon checking of exclude paths.  Only check
  	user-supplied exclude paths (not automatically generated ones based on
  	lack of seclabel support), don't require them to be directories, and
  	ignore permission denied errors on them (it is ok to exclude a path to
  	which the caller lacks permission).


author: Ville Skyttä <ville.skytta@iki.fi> - 2.0.71-9
changelog:
  - Don't try to remove restorecond after last erase (done already in %preun).
  - Ensure scriptlets exit with status 0.
  - Fix %post and %pr


author: Dan Walsh <dwalsh@redhat.com> 2.0.73-1
changelog:
  - Update to upstream
          * Add semanage dontaudit to turn off dontaudits from Dan Walsh.
          * Fix semanage to set correct mode for setrans file from Dan Walsh.
          * Fix malformed dictionary in portRecord from Dan Walsh.
  	* Restore symlink handling support to restorecon based on a patch by
  	Martin Orr.  This fixes the restorecon /dev/stdin performed by Debian
  	udev scripts that was broken by policycoreutils 2.0.70.


author: Dan Walsh <dwalsh@redhat.com> 2.0.74-1
changelog:
  - Update to upstream
  	* Change semodule upgrade behavior to install even if the module
  	  is not present from Dan Walsh.
  	* Make setfiles label if selinux is disabled and a seclabel aware
  	  kernel is running from Caleb Case.
  	* Clarify forkpty() error message in run_init from Manoj Srivastava.


author: Dan Walsh <dwalsh@redhat.com> 2.0.74-8
changelog:
  - Add check to sandbox to verify save changes - Chris Pardy
  - Fix memory leak in restorecond - Steve Grubb


author: Dan Walsh <dwalsh@redhat.com> 2.0.74-14
changelog:
  - Allow semanage -i and semanage -o to generate customization files.
  - semanage -o will generate a customization file that semanage -i can read and set a machines to the same selinux configuration


author: Dan Walsh <dwalsh@redhat.com> 2.0.76-1
changelog:
  - Update to upstream
  	* Remove setrans management from semanage, as it does not work
  	  from Dan Walsh.
  	* Move load_policy from /usr/sbin to /sbin from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 2.0.77-1
changelog:
  - Update to upstream
  	* Fixed bug preventing semanage node -a from working
  	  from Chad Sellers
  	* Fixed bug preventing semanage fcontext -l from working
  	  from Chad Sellers
  - Change semanage to use unicode


author: Dan Walsh <dwalsh@redhat.com> 2.0.78-1
changelog:
  - Update to upstream
  	* Remove non-working OUTFILE from fixfiles from Dan Walsh.
  	* Additional exception handling in chcat from Dan Walsh.

  	* fix sepolgen to read a "type 1403" msg as a policy load by Stephen
  	  Smalley <sds@tycho.nsa.gov>
  	* Add support for Xen ocontexts from Paul Nuzzi.


author: Dan Walsh <dwalsh@redhat.com> 2.0.78-14
changelog:
  - Add session capability to sandbox 
  - sandbox -SX -H ~/.homedir -t unconfined_t -l s0:c15 /etc/gdm/Xsession


author: Dan Walsh <dwalsh@redhat.com> 2.0.81-4
changelog:
  - Update to upstream - sepolgen
  	* Add since-last-boot option to audit2allow from Dan Walsh.
  	* Fix sepolgen output to match what Chris expects for upstream
  	  refpolicy from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 2.0.82-7
changelog:
  - Fix crash when args are empty
  Resolves: #582542
  - Fix semange to exit on bad options
  - Fix semanage dontaudit man page section
  Resolves: #582533


author: Dan Walsh <dwalsh@redhat.com> 2.0.82-13
changelog:
  - Make semanage boolean work on disabled machines and during livecd xguest
  - Fix homedir and tmpdir handling in sandbox
  Resolves: #587263


author: Dan Walsh <dwalsh@redhat.com> 2.0.82-17
changelog:
  - Fix policy tool to have correct name in menus
  - Fix seunshare to handle /tmp being in ~/home
  - Fix saving of altered files
  - Update translations


author: Dan Walsh <dwalsh@redhat.com> 2.0.82-23
changelog:
  - Fix seunshare translations
  - Fix seunshare to work on all arches
  - Fix icon for system-config-selinux
  Resolves: #595276


author: Dan Walsh <dwalsh@redhat.com> 2.0.82-27
changelog:
  - Move genhomedircon.8 to same package as genhomedircon
  - Fix sandbox to pass unit test
  Resolves: #595796


author: Dan Walsh <dwalsh@redhat.com> 2.0.83-17
changelog:
  - Apply patch to restorecond from Chris Adams, which will cause restorecond 
  - to watch first user that logs in.


author: Dan Walsh <dwalsh@redhat.com> 2.0.83-19
changelog:
  - Fix sandbox -H and -T regression
  Resolves: #626404
  - Fix fcontext translation handling in system-config-selinux


author: Dan Walsh <dwalsh@redhat.com> 2.0.83-19.9
changelog:
  - selinux-polgengui should not blow up on disabled SELinux system
  Resolves: #695288
  CVE-2011-1011 policycoreutils: insecure temporary directory handling in seunshare
  Resolves: #679690
  check return value of getpwuid()
  Fix semanage module -D' traceback
  Resolves: #666861 
  sandbox -- AttributeError: 'module' object has no attribute 'chcon' 	
  Resolves: #690502 	
  system-config-selinux could not open interface info 	
  Resolves: #696809
  Mv sandbox.conf.5.gz to sandbox.5.gz and put in base package
  Resolves: #690744 
  sestatus usage message not complete (missing -b option) 	
  Resolves: #705027
  correct package name in the -sandbox subpackage description 	
  Resolves: #679798
  dracut attempts to load_policy with SELinux=disabled 	
  Resolves: #659076
  Resolves: #658532
  8 options are not described in semanage man page 	
  Resolves: #677541
  Mention "semanage module" in semanage man page 	 
  Resolves: #677542
  Update translations
  Allow polcycoreutils-gui and tools to run on disabled SELinux systems
  Resolves: #695288 
  Resolves: #689153


author: Dan Walsh <dwalsh@redhat.com> 2.0.83-19.10
changelog:
  - Fix policycoreutils-sandbox description
  - Change sepolgen-ifgen to search all available policy files
  - Fix portspage in system-config-selinux to not crash
  - fix to sandbox 
    - Fix seunshare to use more secure handling of /tmp
      - Rewrite seunshare to make sure /tmp is mounted stickybit owned by root
     - Change to allow sandbox to run on nfs homedirs, add start python script
     - change default location of HOMEDIR in sandbox to /tmp/.sandbox_home_*
     - Move seunshare to sandbox package
     - Fix sandbox to show correct types in  usage statement
  Resolves: #679690
  Resolves: #679689
  Resolves: #677541
  Resolves: #679798
  - Fixes for sepologen 
    - Usage statement needs -n name
    - Names with _ are being prevented
    - dbus apps should get _chat interface
    - Cleaup selinux-polgengui to be a little more modern, fix comments and use selected name
    - Add sandbox to sepolgen
    - Polgengui raises the wrong type of exception.  #471078
  - Cleanup chcat man page
  - Update translations
  - restorecond fixes
    - Have restorecond watch more directories in homedir
    - Fix restorecond watching utmp file for people logging in our out
    - Exit in restorecond if it can not find a UID in the passwd database

  - Stop fixfiles from complaining about missing dirs

  - Semanage fixes
    - Fix up node handling in semanage command
    - Fix proper handling of getopt errors
    - Do not allow modules names to contain spaces
    - Change semanage to not allow it to semanage module -D
  Resolves: #677542
  - Change setsebool to suggest run as root on failure
  - Don't report error on load_policy when system is disabled.
  - Fix unchecked return value of getpwuid()


author: Dan Walsh <dwalsh@redhat.com> 2.0.83-19.11
changelog:
  - Remove sandbox calling -k, only should be used by seunshare, should not be
  called all the time.
  Resolves: #679690
  Resolves: #679689
  Resolves: #677541
  Resolves: #679798


author: Dan Walsh <dwalsh@redhat.com> 2.0.83-19.12
changelog:
  - Back port option handling in semanage to handle semodule module -D correctly
  - Back port manpage from Fedora
  Resolves: #666861


author: Dan Walsh <dwalsh@redhat.com> 2.0.83-19.13
changelog:
  - Fix spec file to require rsync for sandbox
  Resolves: #734467
  - Fix spec file to require gtkhtml2 for lockdown booleans program
  Resolves: #702860
  - Fix bugs found by Coverity
  Resolves: #717640
  Resolves: #728833


author: Miroslav Grepl <mgrepl@redhat.com> 2.0.83-19.15
changelog:
  - Needs require gnome-python2-gtkhtml2 to make system-config-selinux working
  - Not use open_init_pty by default


author: Dan Walsh <dwalsh@redhat.com> 2.0.83-19.16
changelog:
  - Restorecon should not be exiting with a 1 when it is successful in relabeling a file
  Resolves: #740699
  Resolves: #739587


author: Miroslav Grepl <mgrepl@redhat.com> 2.0.83-19.18
changelog:
  - Other fix for semanage man page
  Resolves: #677541
  - Don't report error on load_policy when system is disabled.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.83-19.19
changelog:
  - Change semanage to produce proper audit records for Common Criteria
  - Fix the handling of namespaces in seunshare/sandbox.
  - Currently mounting of directories within sandbox is propogating to the 
  - parent namesspace.
  - restorecond -u needs to watch terminal for exit if run outside of dbus.
  - Fix unchecked return codes
  Related: #785678


author: Dan Walsh <dwalsh@redhat.com> - 2.0.83-19.22
changelog:
  - Make sure installing po files use -p
  - Fix unchecked return codes
  Resolves: #684015
  - Fix semanage is sending the wrong kind of audit events 
  - Fix Polyinstantiated namespace mount leaking to excluded users 
  Related: #786664 
  - Fix selinux-policy update shows error parsing file obj_perm_s... 
  Related: #786191


author: Miroslav Grepl <mgrepl@redhat.com> - 2.0.83-19.25
changelog:
  - Make restorecon to return proper exit codes on failure
  Resolves:#824779
  - Fix generated role_types for *.te
  Resolves:#843727


author: Miroslav Grepl <mgrepl@redhat.com> - 2.0.83-19.27
changelog:
  - Fix restorecond usage
  - Add missing te_stream_rules and if_stream_rules templates
  Resolves:#816460
  - Print a message if no default labels are assigned
  Resolves:#851479


author: Miroslav Grepl <mgrepl@redhat.com> - 2.0.83-19.28
changelog:
  - Allow to define sock file in /etc directory 
  Resolves:#816460
  - Make output of audit2allow when AVC can be allowed by boolean more readable


author: Miroslav Grepl <mgrepl@redhat.com> - 2.0.83-19.30
changelog:
  - Fix restorecond init script
  - Make setools.seinfo working only on SELinux enabled systems in seobjet.py
  Resolves:#893065


author: Miroslav Grepl <mgrepl@redhat.com> - 2.0.83-19.31
changelog:
  - Make setsebool less verbose on errors
  Resolves:#984484
  - Make <<none>> spec working for semanage fcontext
  - Make audit2allow witn o option to append output instead of write


author: Miroslav Grepl <mgrepl@redhat.com> - 2.0.83-19.33
changelog:
  - Fix semanage
  Resolves:#860506
  - Make semanage man page and help consistent
  - Fix setsebool to give better error message on bad boolean names
  - Add support for exclude dirs in fixfiles
  - Fix semanage boolean to require a value


author: Miroslav Grepl <mgrepl@redhat.com> - 2.0.83-19.37
changelog:
  - Add workaround to make allow_polyinstantiation=1 directive working for xguest with semanage-booleans
  Resolves:#1008790


author: Miroslav Grepl <mgrepl@redhat.com> - 2.0.83-19.41
changelog:
  - Allow use sandbox to follow homedirs symlinks
  Resolves:#913175
  - Make sure file equivalance target and source do not end
   with a /
  - Allow make only valid domains as permissive domains
  - Fix polgen.py to allow "_" in a policy file.
  - Implement --noreload option to semanage
  - Add missing long options in sandbox man page


author: Miroslav Grepl <mgrepl@redhat.com> - 2.0.83-19.42
changelog:
  - Fail properly on invalid options for restorecon/setfiles when using -R or -r
  - Check if all files exist for setfiles and restorecon
  - Remove handling of cgroups from sandbox. 
  Resolves:#1091139
  - Make -q and -d options mutually exclusive


author: Miroslav Grepl <mgrepl@redhat.com> - 2.0.83-19.43
changelog:
  - Fix semanage man page to contain also noreload option
  Resolves:#1032828
  - Fix sandbox man page
  - Make setfiles more informative if bad option is given


author: Miroslav Grepl <mgrepl@redhat.com> - 2.0.83-19.46
changelog:
  - Make semanage -i working on empty file
  - Fix setfiles man page
  - Fix setfiles -r option to be working correctly
  Resolves:#1086456


author: Miroslav Grepl <mgrepl@redhat.com> - 2.0.83-19.47
changelog:
  - Fix setfiles man page
  Resolves:#1086456
  - Fix  semanage fcontext  error message when non-existing context given
  Resolves:#1122023


author: Petr Lautrbach <plautrba@redhat.com> 2.0.83-20
changelog:
  - chcat: Change the isSensitivity() detection
  Resolves: rhbz#965397
  - Move sepolgen utility from policycoreutils-gui to policycoreutils-python
  Resolves: rhbz#995778
  - audit2allow: use date time format compatible with ausearch
  Resolves: rhbz#1111999


author: Petr Lautrbach <plautrba@redhat.com> 2.0.83-21
changelog:
  - fixfiles verify: do not relabel /tmp and /var/tmp dirs
  Resolves: rhbz#1113083
  - Fix semanage -S <store> -o <output>
  Resolves: rhbz#1122850


author: Petr Lautrbach <plautrba@redhat.com> 2.0.83-23
changelog:
  - Move python scripts in /usr/share/system-config-selinux to policycoreutils-python
  Resolves: rhbz#995778


author: Petr Lautrbach <plautrba@redhat.com> 2.0.83-26
changelog:
  - restorecond: treat root as a regular user
  Resolves: rhbz#1281877
  - semanage: don't skip reserver_port_t
  Resolves: rhbz#1225806
  - semanage: check if a store exists
  Resolves: rhbz#1208801
  - fixfiles: check the SELinux status
  Resolves: rhbz#1240788


author: Petr Lautrbach <plautrba@redhat.com> 2.0.83-27
changelog:
  - sandbox: Improve comments in sysconfig file
  Resolves: rhbz#1159336
  - secon, newrole: fix inconsistence between --help and man page
  Resolves: rhbz#1278811, rhbz#1278913


author: Jeremy Hylton <jeremy@beopen.com>
changelog:
  - Version 2 of 2.0b1
  - Make the package relocatable.  Thanks to Suchandra Thapa.
  - Exclude Tkinter from main RPM.  If it is in a separate RPM, it is
    easier to track Tk releases.


author: Jeremy Hylton <jeremy@beopen.com>
changelog:
  - updated for 2.0c1
  - build audioop, imageop, and rgbimg extension modules
  - include xml.parsers subpackage
  - add test.xml.out to files list


author: Matt Wilson <msw@redhat.com>
changelog:
  - modify all files to use "python2.0" as the intrepter
  - don't build the Expat bindings
  - build against db1


author: Trond Eivind Glomsrød <teg@redhat.com>
changelog:
  - fix the "requires" clause, it lacked a space causing problems
  - use %{_tmppath}
  - don't define name, version etc
  - add the available patches from the Python home page


author: Trond Eivind Glomsrød <teg@redhat.com> 2.2-0.4a4
changelog:
  - 2.2a4
  - Enable UCS4 support
  - Enable IPv6
  - Provide distutils
  - Include msgfmt.py and pygettext.py


author: Matt Wilson <msw@redhat.com> 2.2-0.9b2
changelog:
  - changed DESTDIR to point to / so that distutils will install dynload
    modules properly in the installroot


author: Trond Eivind Glomsrød <teg@redhat.com> 2.2-0.11c1
changelog:
  - 2.2 RC 1
  - Don't include the _tkinter module in the main package - it's 
    already in the tkiter packace
  - Turn off the mpzmodule, something broke in the buildroot


author: Nalin Dahyabhai <nalin@redhat.com> 2.2-5
changelog:
  - disable ndbm support, which is db2 in disguise (really interesting things
    can happen when you mix db2 and db4 in a single application)


author: Trond Eivind Glomsrød <teg@redhat.com> 2.2-8
changelog:
  - Make files in /usr/bin install side by side with python 1.5 when
  - Drop explicit requirement of db4
    built as python2


author: Trond Eivind Glomsrød <teg@redhat.com> 2.2-16
changelog:
  - the same, but in builddirs - this will remove them from the 
    docs package, which doesn't look in the buildroot for files.


author: Mihai Ibanescu <misa@redhat.com>
changelog:
  - builds as python2 require a different libdb
  - changed the buildroot name of python to match python2 builds


author: Mihai Ibanescu <misa@redhat.com>
changelog:
  2.2.2-2
  - Fix #76912 (python-tools contains idle, which uses tkinter, but there is no
    requirement of tkinter from python-tools).
  - Fix #74013 (rpm is missing the /usr/lib/python2.2/test directory)


author: Mihai Ibanescu <misa@redhat.com>
changelog:
  2.2.2-3.*
  - Merged patch from Karsten Hopp <karsten@redhat.de> from 2.2.1-17hammer to
    use %{_libdir}
  - Added XFree86-libs as BuildRequires (because of tkinter)
  - Fixed duplicate listing of plat-linux2
  - Fixed exclusion of lib-dynload/japanese
  - Added lib64 patch for the japanese codecs
  - Use setup magic instead of using tar directly on JapaneseCodecs


author: Mihai Ibanescu <misa@redhat.com>
changelog:
  2.2.2-5
  - Fixed configuration patch to add -lcrypt when compiling cryptmodule.c

  2.2.2-4
  - Spec file change from Matt Wilson <msw@redhat.com> to disable linking 
    with the C++ compiler.


author: Mihai Ibanescu <misa@redhat.com>
changelog:
  2.2.2-3.7.3
  - Recompiled for 7.3 (to fix the -lcrypt bug)
  - Fix for the spurious error message at the end of the build (build-requires
    gets confused by executable files starting with """"): make the tests
    non-executable.


author: Mihai Ibanescu <misa@redhat.com> 2.2.2-7
changelog:
  - Fix bug #79647 (Rebuild of SRPM fails if python isn't installed)
  - Added a bunch of missing BuildRequires found while fixing the
    above-mentioned bug


author: Jeremy Katz <katzj@redhat.com> 2.2.2-8
changelog:
  - urllib2 didn't support non-anonymous ftp.  add support based on how 
    urllib did it (#80676, #78168)


author: Mihai Ibanescu <misa@redhat.com> 2.2.2-11.7.3
changelog:
  - Fixed bug #82544: Errata removes most tools
  - Fixed bug #82435: Python 2.2.2 errata breaks redhat-config-users
  - Removed .lib64 and - files that get installed after we fix the multilib
    .py files.


author: Mihai Ibanescu <misa@redhat.com> 2.2.2-13
changelog:
  - Attempt to look both in /usr/lib64 and /usr/lib/python2.2/site-packages/:
    some work on python-2.2.2-lib64.patch


author: Mihai Ibanescu <misa@redhat.com> 2.2.2-22
changelog:
  - Using newer Japanese codecs (1.4.9). Thanks to 
    Peter Bowen <pzb@datastacks.com> for pointing this out.


author: Jeremy Katz <katzj@redhat.com> 2.2.2-23
changelog:
  - ftp uri's should be able to specify being rooted at the root instead of 
    where you login via ftp (#84692)


author: Mihai Ibanescu <misa@redhat.com> 2.2.2-25
changelog:
  - Fixed bug #84886: pydoc dies when run w/o arguments
  - Fixed bug #84205: add python shm module back (used to be shipped with 1.5.2)
  - Fixed bug #84966: path in byte-compiled code still wrong


author: Mihai Ibanescu <misa@redhat.com> 2.3-0.2
changelog:
  - Building python 2.3
  - Added more BuildRequires
  - Updated the startup files for modulator and pynche; idle installs its own
    now.


author: Mihai Ibanescu <misa@redhat.com> 2.3.3-4
changelog:
  - Fix for bug #122304 : splitting the domain name fails on 64-bit arches
  - Fix for bug #120879 : including Makefile into the main package

  - Requires XFree86-devel instead of -libs (see bug #118442)


author: Mihai Ibanescu <misa@redhat.com> 2.3.3-6
changelog:
  - Correct fix for #122304 from upstream:
    http://sourceforge.net/tracker/?func=detail&atid=105470&aid=931848&group_id=5470


author: Mihai Ibanescu <misa@redhat.com> 2.3.4-1
changelog:
  - Updated to 2.3.4-1 with Robert Scheck's help (bug #124764)
  - Added BuildRequires: tix-devel (bug #124918)


author: Mihai Ibanescu <misa@redhat.com> 2.3.4-3
changelog:
  - Added an optik.py that provides the same interface from optparse for
    backward compatibility; obsoleting python-optik


author: Mihai Ibanescu <misa@redhat.com> 2.3.4-6
changelog:
  - Fixed #128030 (help() not printing anything)
  - Fixed #125472 (distutils.sysconfig.get_python_lib() not returning the right
    path on 64-bit systems)
  - Fixed #127357 (building python as a shared library)
  - Fixed  #19347 (including the contents of Tools/scripts/ in python-tools)


author: Mihai Ibanescu <misa@redhat.com> 2.3.4-7
changelog:
  - Including html documentation for non-i386 arches
  - Fixed #125362 (python-doc html files have japanese character encoding)
  - Fixed #128923 (missing dependency between python and python-devel)


author: Mihai Ibanescu <misa@redhat.com> 2.3.4-8
changelog:
  - Fixed bug #129769: Makefile in new python conflicts with older version found
    in old python-devel
  - Reorganized the spec file to get rid of the aspython2 define; __python_ver
    is more powerful.


author: Mihai Ibanescu <misa@redhat.com> 2.3.4-10
changelog:
  - Fixed bug #77418 (Demo dir not packaged)
  - More tweaking on #19347 (Moved Tools/ under /usr/lib/python2.3/Tools)


author: Jeff Johnson <jbj@jbj.org> 2.4-2
changelog:
  - db-4.3.21 returns DB_BUFFER_SMALL rather than ENOMEM (#141994).
  - add Provide: python(abi) = 2.4
  - include msgfmt/pygettext *.pyc and *.pyo from brp-python-bytecompile.


author: Mihai Ibanescu <misa@redhat.com> 2.4-6
changelog:
  - building the docs from a different source rpm, to decouple bootstrapping
    python from having tetex installed


author: Mihai Ibanescu <misa@redhat.com> 2.4.1-2
changelog:
  - Fixed bug #143667 (python should own /usr/lib/python* on 64-bit systems, for
    noarch packages)
  - Fixed bug #143419 (BuildRequires db4 is not versioned)


author: Mihai Ibanescu <misa@redhat.com> 2.4.1-7
changelog:
  - Fixed bug #169046 (realpath is unsafe); thanks to 
    Peter Jones <pjones@redhat.com> and Arjan van de Ven <arjanv@redhat.com> for
    diagnosing and the patch.


author: Mihai Ibanescu <misa@redhat.com> 2.4.1-10
changelog:
  - Fixed bug #169159 (don't let python core dump if no arguments are passed in)
    Reworked the patch from -8 a bit more.


author: Peter Jones <pjones@redhat.com> 2.4.1-12
changelog:
  - Fixed bug #169159 (check for argc>0 and argv[0] == NULL, not just
      argv[0][0]='\0')
    Reworked the patch from -8 a bit more.


author: Mihai Ibanescu <misa@redhat.com> - 2.4.3-6
changelog:
  - Fixed bug #192592 (too aggressive assertion fails) - SF#1257960
  - Fixed bug #167468 (Doc/tools not included) - added in the python-tools package


author: Mihai Ibanescu <misa@redhat.com> - 2.4.99.c1
changelog:
  - Updated to 2.5c1. Merged fixes from FC6 too:
  - Fixed bug #199373 (on some platforms CFLAGS is needed when linking)
  - Fixed bug #198971 (case conversion not locale safe in logging library)
  - Verified bug #201434 (distutils.sysconfig is confused by the change to make
    python-devel multilib friendly) is fixed upstream


author: Jeremy Katz <katzj@redhat.com>
changelog:
  - fix _md5 and _sha modules (Robert Sheck)
  - no longer provide optik compat; it's been a couple of years now
  - no longer provide the old shm module; if this is still needed, let's 
    build it separately
  - no longer provide japanese codecs; should be a separate package


author: Jeremy Katz <katzj@redhat.com>
changelog:
  - support db 4.5
  - obsolete python-elementtree; since it requires some code tweaks, don't 
    provide it
  - obsolete old python-sqlite; provide the version that's actually included


author: Jeremy Katz <katzj@redhat.com> - 2.5.3-3
changelog:
  - fix atexit traceback with failed syslog logger (#218214)
  - split libpython into python-libs subpackage for multilib apps 
    embedding python interpreters


author: Jeremy Katz <katzj@redhat.com> - 2.5.3-8
changelog:
  - fix extensions to use shared libpython (#219564)
  - all 64bit platforms need the regex fix (#122304)


author: Jeremy Katz <katzj@redhat.com> - 2.5.1-4
changelog:
  - fix _elementtree.so build (#245703)
  - ensure that extension modules we expect are actually built rather than 
    having them silently fall out of the package


author: James Antill <jantill@redhat.com> - 2.5.1-13
changelog:
  - Add tix buildprereq
  - Add tkinter patch
  - Resolves: #281751
  - Fix ctypes loading of libraries, add requires on binutils
  - Resolves: #307221
  - Possible fix for CVE-2007-4965 possible exploitable integer overflow
  - Resolves: #295971


author: James Antill <jantill@redhat.com> - 2.5.1-15
changelog:
  - Do codec lowercase in C Locale.
  - Resolves: 207134 191096
  - Fix stupid namespacing in pysqlite, minimal upgrade to 2.3.3 pysqlite
  - Resolves: 263221


author: James Antill <jantill@redhat.com> - 2.5.1-16
changelog:
  - Fix pyconfig.h comment typo.
  - Add back test_support.py and the __init__.py file.
  - Resolves: rhbz#387401


author: James Antill <jantill@redhat.com> - 2.5.1-18
changelog:
  - Create a python-test sub-module, over 3MB of stuff noone wants.
  - Don't remove egginfo files, try this see what happens ... may revert.
  - Resolves: rhbz#414711


author: James Antill <jantill@redhat.com> - 2.5.1-20
changelog:
  - Add valgrind support files, as doc, to python-devel
  - Relates: rhbz#418621
  - Add new API from 2.6, set_wakeup_fd ... use at own risk, presumably won't
  - change but I have no control to guarantee that.
  - Resolves: rhbz#427794
  - Add gdbinit support file, as doc, to python-devel


author: David Malcolm <dmalcolm@redhat.com> - 2.6.2-3
changelog:
  - replace usage of %define with %global
  - introduce macros for 3 directories, replacing expanded references throughout:
  %{pylibdir}, %{dynload_dir}, %{site_packages}
  - split up the "configure" invocation flags onto individual lines
  - move lib2to3 from -tools subpackage to main package (bug 556667)
  - "Makefile" and the config-32/64.h file are needed by distutils/sysconfig.py
  _init_posix(), so we include them in the core package, along with their parent
  directories (bug 531901)
  - fixup the build when __python_ver is set (Zach Sadecki; bug 533989); use
  pybasever in the files section
  - automatically disable arena allocator when run under valgrind (upstream
  issue 2422; patch 52)
  - fix Lib/SocketServer.py to avoid trying to use non-existant keyword args
  for os.waitpid (patch 53, rhbz:552404, Adrian Reber)
  - use the %{_isa} macro to ensure that the python-devel dependency on python
  is for the correct multilib arch (#555943)
  - patch Makefile.pre.in to avoid building static library (patch111, bug 556092)
  - delete bundled copies of libffi and zlib to make sure we use the system ones
  - replace references to /usr with %{_prefix}; replace references to
  /usr/include with %{_includedir}
  - change python-2.6.2-config.patch to remove our downstream change to curses
  configuration in Modules/Setup.dist, so that the curses modules are built using
  setup.py with the downstream default (linking against libncursesw.so, rather
  than libncurses.so), rather than within the Makefile; add a test to %install
  to verify the dso files that the curses module is linked against the correct
  DSO (bug 539917; changes _cursesmodule.so -> _curses.so)
  - explicitly list all lib-dynload files, rather than dynamically gathering the
  payload into a temporary text file, so that we can be sure what we are
  shipping; remove now-redundant testing for presence of certain .so files


author: David Malcolm <dmalcolm@redhat.com> - 2.6.2-4
changelog:
  - introduce %{with_valgrind} macro, to only use the valgrind patch on archs
  where valgrind-devel is available


author: David Malcolm <dmalcolm@redhat.com> - 2.6.2-5
changelog:
  - update python-2.6.2-config.patch to remove downstream customization of build
  of pyexpat and elementtree modules
  - add patch adapted from upstream (patch 3) to add support for building against
  system expat; add --with-system-expat to "configure" invocation (patch 3)
  - remove embedded copy of expat from source tree during "prep"


author: David Malcolm <dmalcolm@redhat.com> - 2.6.2-6
changelog:
  - add gdb hooks for easier debugging (rhbz:569696)
  - supply fourth parameter (default permissions) in all usage of "defattr" in
  subpackage manifests
  - remove trailing periods from package "Summary" fields
  - fix typo in the description of the "test" subpackage


author: David Malcolm <dmalcolm@redhat.com> - 2.6.2-8
changelog:
  - ensure that the compiler is invoked with "-fwrapv" (rhbz#594819)
  - CVE-2010-1634: fix various integer overflow checks in the audioop
  module (patch 113)
  - CVE-2010-2089: further checks within the audioop module (patch 114)
  - CVE-2008-5983: the new PySys_SetArgvEx entry point from r81399 (patch 115)


author: David Malcolm <dmalcolm@redhat.com> - 2.6.2-9
changelog:
  - cherrypick upstream fix for fatal error creating threads when memory is
  low (patch 116)
  Resolves: rhbz#598564


author: David Malcolm <dmalcolm@redhat.com> - 2.6.2-10
changelog:
  - Fix an incompatibility between pyexpat and the system expat-2.0.1 that led to
  a segfault running test_pyexpat.py (patch 117)
  Resolves: rhbz#583931


author: David Malcolm <dmalcolm@redhat.com> - 2.6.2-11
changelog:
  - Stop python bailing out with an assertion failure when UnicodeDecodeErrors
  occur on very large buffers (patch 118, upstream issue 9058)
  Resolves: rhbz#540518


author: David Malcolm <dmalcolm@redhat.com> - 2.6.5-1
changelog:
  - 2.6.5
  - remove upstream patch 53
  - fixup selinux patch to apply cleanly against 2.6.5 (patch 110)
  Resolves: rhbz#611607
  - remove commented-out, out-of-date patches


author: David Malcolm <dmalcolm@redhat.com> - 2.6.5-2
changelog:
  - support OpenSSL FIPS mode in _hashlib and hashlib
  Resolves: rhbz#563986
  - don't build the _md5 and _sha* modules: rely on _hashlib in hashlib


author: David Malcolm <dmalcolm@redhat.com> - 2.6.6-1
changelog:
  - rebase to 2.6.6: (which contains the big whitespace cleanup of r81031)
    http://www.python.org/download/releases/2.6.6/
    - fixup patch 102, patch 11, patch 52, patch 110
    - drop upstreamed patches: patch 113 (CVE-2010-1634), patch 114
    (CVE-2010-2089), patch 115 (CVE-2008-5983), patch 116 (rhbz598564),
    patch 118 (rhbz540518)
    - add fix for upstream bug in test_posix.py introduced in 2.6.6 (patch 120)
  Resolves: rhbz#627301


author: David Malcolm <dmalcolm@redhat.com> - 2.6.6-2
changelog:
  - fix dbm.release on ppc64/s390x
  Resolves: rhbz#626756
  - fix missing lib2to3 test files
  Resolves: rhbz#625395
  - fix test.test_commands SELinux incompatibility
  Resolves: rhbz#625393
  - make "pydoc -k" more robust in the face of broken modules
  Resolves: rhbz#603073


author: David Malcolm <dmalcolm@redhat.com> - 2.6.6-3
changelog:
  - use an ephemeral port for IDLE, enabling multiple instances to be run
  Resolves: rhbz#639222
  - add systemtap static markers, tapsets, and example scripts
  Resolves: rhbz#569695


author: David Malcolm <dmalcolm@redhat.com> - 2.6.6-4
changelog:
  - backport subprocess fixes to use the "poll" system call, rather than "select"
  Resolves: rhbz#650588


author: David Malcolm <dmalcolm@redhat.com> - 2.6.6-5
changelog:
  - allow the "no_proxy" environment variable to override "ftp_proxy" in
  urllib2 (patch 128)
  Resolves: rhbz#637895
  - make garbage-collection assertion failures more informative (patch 129)
  Resolves: rhbz#614680


author: David Malcolm <dmalcolm@redhat.com> - 2.6.6-6
changelog:
  - prevent _sqlite3.so being built with a redundant RPATH of _libdir (patch 130)
  - remove DOS batch file "idle.bat"
  - remove shebang lines from .py files that aren't executable, and remove
  executability from .py files that don't have a shebang line
  Related: rhbz#634944
  - add "Obsoletes: python-ssl" to core package, as 2.6 contains the ssl module
  Resolves: rhbz#529274


author: David Malcolm <dmalcolm@redhat.com> - 2.6.6-11
changelog:
  - fix incompatibility between 2.6.6 and our non-standard M2Crypto.SSL.SSLTimeoutError
  Resolves: rhbz#681811


author: David Malcolm <dmalcolm@redhat.com> - 2.6.6-21
changelog:
  - backport fix for occasional failures in multiprocessing's Process.start()
  Resolves: rhbz#685234
  - port multiprocessing to use the "poll" syscall, rather than "select"
  Resolves: rhbz#713082
  - backport fix allowing getpass.getpass() to be interrupted with Ctrl-C
  or Ctrl-Z
  Resolves: rhbz#689794
  - backport memory leak fixes for the readline module
  Resolves: rhbz#699740


author: David Malcolm <dmalcolm@redhat.com> - 2.6.6-22
changelog:
  - backport fix for failures seen with subprocess module when supplying stdin
  to short-lived subprocesses
  Resolves: rhbz#667431


author: David Malcolm <dmalcolm@redhat.com> - 2.6.6-23
changelog:
  - update gdb debug hooks, showing when a thread is waiting on the GIL, calls
  to C functions and methods, and garbage collections.  Also, better handle the
  case when "f" is optimized out within PyEval_EvalFrameEx, to at least give
  file and function name, even if the line number and locals won't be available
  Resolves: rhbz#711818


author: David Malcolm <dmalcolm@redhat.com> - 2.6.6-24
changelog:
  - update uid/gid handling to avoid int overflows seen with uid/gid
  values >= 2^31 on 32-bit architectures
  Resolves: rhbz#697470


author: David Malcolm <dmalcolm@redhat.com> - 2.6.6-27
changelog:
  - update "py-bt" in gdb debug hooks to avoiding printing stray <function>
  frames on non-C functions
  Related: rhbz#711818


author: David Malcolm <dmalcolm@redhat.com> - 2.6.6-28
changelog:
  - avoid truncating the compilation flags of extension modules that have CFLAGS
  set in their environment
  Resolves: rhbz#727364


author: David Malcolm <dmalcolm@redhat.com> - 2.6.6-29
changelog:
  - protect GIL detection within gdb debug hooks against C stack frames that
  lack a name (source 1)
  Related: rhbz#711818
  Resolves: rhbz#736085


author: David Malcolm <dmalcolm@redhat.com> - 2.6.6-30
changelog:
  - oCERT-2011-003: add -R command-line option and PYTHONHASHSEED environment
  variable, to provide an opt-in way to protect against denial of service
  attacks due to hash collisions within the dict and set types
  Resolves: CVE-2012-1150


author: David Malcolm <dmalcolm@redhat.com> - 2.6.6-31
changelog:
  - fix endless loop in SimpleXMLRPCServer upon malformed POST request
  Resolves: CVE-2012-0845
  - send encoding in SimpleHTTPServer.list_directory to protect IE7 against
  potential XSS attacks
  Resolves: CVE-2011-4940


author: David Malcolm <dmalcolm@redhat.com> - 2.6.6-34
changelog:
  - add an RPATH to pyexpat.so to avoid ImportError on XML_SetHashSalt when a
  vanilla build of expat is present in LD_LIBRARY_PATH
  Resolves: rhbz#833271


author: David Malcolm <dmalcolm@redhat.com> - 2.6.6-35
changelog:
  - add -DNDEBUG to OPT during the build, disabling C-level assertions
  Resolves: rhbz#810847
  Resolves: rhbz#841748
  - avoid allocating thunks in ctypes unless absolutely necessary, to avoid
  generating SELinux denials on "import ctypes" and "import uuid" when
  embedding Python within httpd
  Resolves: rhbz#814391
  - avoid infinite loop in logging.handlers.SysLogHandler with eventlet when
  the syslog daemon is stopped
  Resolves: rhbz#835460


author: David Malcolm <dmalcolm@redhat.com> - 2.6.6-36
changelog:
  - disable patch 110 (python-2.6.5-ctypes-noexecmem.patch)
  Related: rhbz#707944
  - disable patch 129 (python-2.6.6-gc-assertions.patch) now that we're
  building with -DNDEBUG
  Related: rhbz#810847
  Related: rhbz#841748
  Related: rhbz#614680


author: David Malcolm <dmalcolm@redhat.com> - 2.6.6-38
changelog:
  - move most of the payload of the core package to the libs subpackage, given
  that the libs aren't meaningfully usable without the standard libraries
  - preserve timestamps when fixing shebangs (patch 158) and when installing,
  to minimize .pyc/.pyo differences across architectures (due to the embedded
  mtime in .pyc/.pyo headers)
  - fix multilib issue in /usr/bin/modulator and /usr/bin/pynche
  Related: rhbz#958256


author: Matej Stuchlik <mstuchli@redhat.com> - 2.6.6-39
changelog:
  - Remove BOM insertion code from SysLogHandler that causes messages to be
  treated as EMERG level
  Resolves: rhbz#845802


author: Matej Stuchlik <mstuchli@redhat.com> - 2.6.6-42
changelog:
  - Add an explicit RPATH to _elementtree.so pointing at the directory
  containing system expat
  Resolves: rhbz#962779


author: Slavek Kabrda <bkabrda@redhat.com> - 2.6.6-54
changelog:
  - Fix subprocess.Popen.communicate() being broken by SIGCHLD handler.
  Resolves: rhbz#1065537
  - Rebuild against latest valgrind-devel.
  Resolves: rhbz#1142170


author: Robert Kuska <rkuska@redhat.com> - 2.6.6-59
changelog:
  - Let ConfigParse handle options without values
  - Add check phase to specfile, fix and skip relevant failing tests
  Resolves: rhbz#1031709


author: Matej Stuchlik <mstuchli@redhat.com> - 2.6.6-63
changelog:
  - Since -libs now provide python-ordered dict, added ordereddict
    dist-info to site-packages
  Resolves: rhbz#1199997


author: Tomas Orsava <torsava@redhat.com> - 2.6.6-65
changelog:
  - Fix for CVE-2016-0772 python: smtplib StartTLS stripping attack (rhbz#1303647)
    Raise an error when STARTTLS fails (upstream patch)
  - Fix for CVE-2016-5699 python: http protocol steam injection attack (rhbz#1303699)
    Disabled HTTP header injections in httplib (upstream patch)
  Resolves: rhbz#1346354


author: Jef Spaleta <jspaleta@gmail.com>
changelog:
  - 0.6.0-4
  - Docs and Url fixes as suggested in the review
  - Added BR for python-devel for python 2.5, merry Christmas!


author: Matthias Saou <http://freshrpms.net/> 8.1.0-2
changelog:
  - Update to 8.1.0.
  - Merge back changes from Paul Howarth.
  - Make sure the scriplets never return a non-zero exit status.


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.4.el6
changelog:
  - kvm-virtio-Remove-duplicate-macro-definition-for-max.-vi.patch [bz#543825]
  - kvm-virtio-console-qdev-conversion-new-virtio-serial-bus.patch [bz#543825]
  - kvm-virtio-serial-bus-Maintain-guest-and-host-port-open-.patch [bz#543825]
  - kvm-virtio-serial-bus-Add-a-port-name-property-for-port-.patch [bz#543825]
  - kvm-virtio-serial-bus-Add-support-for-buffering-guest-ou.patch [bz#543825]
  - kvm-virtio-serial-bus-Add-ability-to-hot-unplug-ports.patch [bz#543825]
  - kvm-virtio-serial-Add-a-virtserialport-device-for-generi.patch [bz#543825]
  - kvm-Move-virtio-serial-to-Makefile.hw.patch [bz#543825]
  - Resolves: bz#543825
    ([RFE] Backport virtio-serial device to qemu)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.5.el6
changelog:
  - Remove unneeded/unsupported features: [bz#555336]
    - make default options explicit
    - remove sdl support
    - remove sb16 emulation
    - remove oss support
    - remove curses support
    - disable curl support
    - disable bluez support
    - enable -Werror
    - limit block drivers support
    - add host_cdrom block device
  - Resolves: bz#555336
    (Remove unneeded features)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.9.el6
changelog:
  - Disable -Werror again, as there are still warnings on the build
  - Related: bz#555336
    (Remove unneeded features)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.11.el6
changelog:
  - kvm-block-Introduce-BDRV_O_NO_BACKING.patch [bz#556459]
  - kvm-block-Add-bdrv_change_backing_file.patch [bz#556459]
  - kvm-qemu-img-rebase.patch [bz#556459]
  - Resolves: bz#556459
    (RFE - In-place backing file format change)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.12.el6
changelog:
  - kvm-virtio-serial-bus-Remove-guest-buffer-caching-and-th.patch [bz#543825]
  - kvm-virtio-serial-Make-sure-we-don-t-crash-when-host-por.patch [bz#543825]
  - kvm-virtio-serial-Use-MSI-vectors-for-port-virtqueues.patch [bz#543825]
  - kvm-virtio-serial-bus-Match-upstream-whitespace.patch [bz#543825]
  - Resolves: bz#543825
    ([RFE] Backport virtio-serial device to qemu)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.13.el6
changelog:
  - kvm-reduce-number-of-reinjects-on-ACK.patch [bz#557435]
  - kvm-Add-missing-newline-at-the-end-of-options-list.patch [bz#558412]
  - kvm-vnc-Fix-artifacts-in-hextile-decoding.patch [bz#558414]
  - kvm-QMP-Drop-wrong-assert.patch [bz#558415]
  - kvm-vmware_vga-Check-cursor-dimensions-passed-from-guest.patch [bz#558435]
  - kvm-virtio-pci-thinko-fix.patch [bz#558438]
  - kvm-QMP-Don-t-free-async-event-s-data.patch [bz#558465]
  - kvm-vnc_refresh-return-if-vd-timer-is-NULL.patch [bz#558466]
  - kvm-osdep.c-Fix-accept4-fallback.patch [bz#558477]
  - kvm-QMP-Emit-asynchronous-events-on-all-QMP-monitors.patch [bz#558619]
  - kvm-vnc_refresh-calling-vnc_update_client-might-free-vs.patch [bz#558846]
  - Resolves: bz#557435
    (KVM: WIN7-32bit blue screen (IMAGE_NAME:  ntkrnlmp.exe).)
  - Resolves: bz#558412
    (-help output not terminated by newline)
  - Resolves: bz#558414
    (Artifacts in hextile decoding)
  - Resolves: bz#558415
    (Assert triggers on qmp commands returning lists)
  - Resolves: bz#558435
    (vmware-svga buffer overflow copying cursor data)
  - Resolves: bz#558438
    (virtio status bits corrupted if guest deasserts bus mastering bit)
  - Resolves: bz#558465
    (Double-free of qmp async messages)
  - Resolves: bz#558466
    (Possible segfault on vnc client disconnect)
  - Resolves: bz#558477
    (Incorrect handling of EINVAL from accept4())
  - Resolves: bz#558619
    (QMP: Emit asynchronous events on all QMP monitors)
  - Resolves: bz#558846
    (fix use-after-free in vnc code)


author: Glauber Costa <glommer@redhat.com> - qemu-kvm-0.12.1.2-2.14.el6
changelog:
  - kvm-MCE-Fix-bug-of-IA32_MCG_STATUS-after-system-reset.patch [bz#558416]
  - kvm-Fix-CPU-topology-initialization.patch [bz#558432]
  - kvm-loader-more-ignores-for-rom-intended-to-be-loaded-by.patch [bz#558467]
  - kvm-pc-add-machine-type-for-0.12.patch [bz#558470]
  - kvm-virtio-console-Rename-virtio-serial.c-back-to-virtio.patch [bz#559089]
  - kvm-virtio-serial-bus-Fix-bus-initialisation-and-allow-f.patch [bz#559503]
  - Resolves: bz#558416
    (Machine check exception injected into qemu reinjected after every reset)
  - Resolves: bz#558432
    (CPU topology not taking effect)
  - Resolves: bz#558467
    (roms potentially loaded twice)
  - Resolves: bz#558470
    (Incorrect machine types)
  - Resolves: bz#559089
    (Rename virtio-serial.c to virtio-console.c as is upstream.)
  - Resolves: bz#559503
    (virtio-serial: fix multiple devices intialisation)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.15.el6
changelog:
  - kvm-VNC-Use-enabled-key-instead-of-status.patch [bz#549759]
  - kvm-VNC-Make-auth-key-mandatory.patch [bz#549759]
  - kvm-VNC-Rename-client-s-username-key.patch [bz#549759]
  - kvm-VNC-Add-family-key.patch [bz#549759]
  - kvm-VNC-Cache-client-info-at-connection-time.patch [bz#549759]
  - kvm-QMP-Introduce-VNC_CONNECTED-event.patch [bz#549759]
  - kvm-QMP-Introduce-VNC_DISCONNECTED-event.patch [bz#549759]
  - kvm-QMP-Introduce-VNC_INITIALIZED-event.patch [bz#549759]
  - kvm-block-avoid-creating-too-large-iovecs-in-multiwrite_.patch [bz#558730]
  - Resolves: bz#549759
    (A QMP event notification on VNC client connect/disconnect events)
  - Resolves: bz#558730
    (qemu may create too large iovecs for the kernel)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.17.el6
changelog:
  - kvm-Fix-QEMU_WARN_UNUSED_RESULT.patch [bz#560623]
  - kvm-qcow2-Fix-error-handling-in-qcow2_grow_l1_table.patch [bz#560623]
  - kvm-qcow2-Fix-error-handling-in-qcow_save_vmstate.patch [bz#560623]
  - kvm-qcow2-Return-0-errno-in-get_cluster_table.patch [bz#560623]
  - kvm-qcow2-Return-0-errno-in-qcow2_alloc_cluster_offset.patch [bz#560623]
  - kvm-block-Return-original-error-codes-in-bdrv_pread-writ.patch [bz#560623]
  - kvm-qcow2-Fix-error-handling-in-grow_refcount_table.patch [bz#560623]
  - kvm-qcow2-Improve-error-handling-in-update_refcount.patch [bz#560623]
  - kvm-qcow2-Allow-updating-no-refcounts.patch [bz#560623]
  - kvm-qcow2-Don-t-ignore-update_refcount-return-value.patch [bz#560623]
  - kvm-qcow2-Don-t-ignore-qcow2_alloc_clusters-return-value.patch [bz#560623]
  - kvm-net-Make-inet_strfamily-public.patch [bz#562181]
  - kvm-net-inet_strfamily-Better-unknown-family-report.patch [bz#562181]
  - kvm-vnc-Use-inet_strfamily.patch [bz#562181]
  - Resolves: bz#560623
    (error codes aren't always propagated up through the block layer (e.g. -ENOSPC))
  - Resolves: bz#562181
    (Small VNC related cleanup)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.18.el6
changelog:
  - kvm-roms-minor-fixes-and-cleanups.patch [bz#558818]
  - kvm-fw_cfg-rom-loader-tweaks.patch [bz#558818]
  - kvm-roms-rework-rom-loading-via-fw.patch [bz#558818]
  - kvm-pci-allow-loading-roms-via-fw_cfg.patch [bz#558818]
  - kvm-pc-add-rombar-to-compat-properties-for-pc-0.10-and-p.patch [bz#558818]
  - Resolves: bz#558818
    (rom loading)


author: Glauber Costa <glommer@redhat.com> - qemu-kvm-0.12.1.2-2.19.el6
changelog:
  - kvm-virtio_blk-Factor-virtio_blk_handle_request-out.patch [bz#560942]
  - kvm-virtio-blk-Fix-restart-after-read-error.patch [bz#560942]
  - kvm-virtio-blk-Fix-error-cases-which-ignored-rerror-werr.patch [bz#560942]
  - Resolves: bz#560942
    (virtio-blk error handling doesn't work reliably)


author: Glauber Costa <glommer@redhat.com> - qemu-kvm-0.12.1.2-2.20.el6
changelog:
  - kvm-QMP-Add-QEMU-s-version-to-the-greeting-message.patch [bz#557930]
  - kvm-QMP-Introduce-the-qmp_capabilities-command.patch [bz#557930]
  - kvm-QMP-Enforce-capability-negotiation-rules.patch [bz#557930]
  - kvm-QMP-spec-Capability-negotiation-updates.patch [bz#557930]
  - kvm-json-escape-u0000-.-u001F-when-outputting-json.patch [bz#559667]
  - kvm-json-fix-PRId64-on-Win32.patch [bz#563878]
  - kvm-qjson-Improve-debugging.patch [bz#563875]
  - kvm-Monitor-remove-unneeded-checks.patch [bz#563876]
  - kvm-QError-Don-t-abort-on-multiple-faults.patch [bz#559635]
  - kvm-QMP-Don-t-leak-on-connection-close.patch [bz#559645]
  - kvm-QMP-Emit-Basic-events.patch [bz#558623]
  - Resolves: bz#557930
    (QMP: Feature Negotiation support)
  - Resolves: bz#558623
    (QMP: Basic async events are not emitted)
  - Resolves: bz#559635
    (QMP: assertion on multiple faults)
  - Resolves: bz#559645
    (QMP: leak when a QMP connection is closed)
  - Resolves: bz#559667
    (QMP: JSON parser doesn't escape some control chars)
  - Resolves: bz#563875
    (QJSON: Improve debugging)
  - Resolves: bz#563876
    (Monitor: remove unneeded checks)
  - Resolves: bz#563878
    (QJSON: Fix PRId64 handling)


author: Glauber Costa <glommer@redhat.com> - qemu-kvm-0.12.1.2-2.21.el6
changelog:
  - kvm-net-add-API-to-disable-enable-polling.patch [bz#562958]
  - kvm-virtio-rename-features-guest_features.patch [bz#562958]
  - kvm-qdev-add-bit-property-type.patch [bz#562958]
  - kvm-qdev-fix-thinko-leading-to-guest-crashes.patch [bz#562958]
  - kvm-virtio-add-features-as-qdev-properties-fixup.patch [bz#562958]
  - Resolves: bz#562958
    (RFE: Support vhost net mode)


author: Glauber Costa <glommer@redhat.com> - qemu-kvm-0.12.1.2-2.22.el6
changelog:
  - kvm-QMP-BLOCK_IO_ERROR-event-handling.patch [bz#547501]
  - kvm-block-BLOCK_IO_ERROR-QMP-event.patch [bz#547501]
  - kvm-ide-Generate-BLOCK_IO_ERROR-QMP-event.patch [bz#547501]
  - kvm-scsi-Generate-BLOCK_IO_ERROR-QMP-event.patch [bz#547501]
  - kvm-virtio-blk-Generate-BLOCK_IO_ERROR-QMP-event.patch [bz#547501]
  - kvm-add-rhel-machine-types.patch [bz#558838]
  - kvm-QMP-Fix-query-balloon-key-change.patch [bz#568739]
  - Resolves: bz#547501
    (RFE: a QMP event notification for disk  I/O errors with werror/rerror flags)
  - Resolves: bz#558838
    (add rhel machine types)
  - Resolves: bz#568739
    (QMP: Fix 'query-balloon' key)


author: Glauber Costa <glommer@redhat.com> - qemu-kvm-0.12.1.2-2.23.el6
changelog:
  - kvm-ide-device-version-property.patch [bz#558835]
  - kvm-pc-add-driver-version-compat-properties.patch [bz#558835]
  - kvm-qemu-img-Fix-segfault-during-rebase.patch [bz#567602]
  - Resolves: bz#558835
    (ide/scsi drive versions)
  - Resolves: bz#567602
    (qemu-img rebase subcommand got Segmentation fault)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.24.el6
changelog:
  - kvm-path.c-fix-warning-with-_FORTIFY_SOURCE.patch [bz#567099]
  - kvm-hw-pc.c-fix-warnings-with-_FORTIFY_SOURCE.patch [bz#567099]
  - kvm-slirp-misc.c-fix-warning-with-_FORTIFY_SOURCE.patch [bz#567099]
  - kvm-savevm.c-fix-warning-with-_FORTIFY_SOURCE.patch [bz#567099]
  - kvm-block-bochs.c-fix-warning-with-_FORTIFY_SOURCE.patch [bz#567099]
  - kvm-block.c-fix-warning-with-_FORTIFY_SOURCE.patch [bz#567099]
  - kvm-Introduce-qemu_write_full.patch [bz#567099]
  - kvm-force-to-test-result-for-qemu_write_full.patch [bz#567099]
  - kvm-block-cow.c-fix-warnings-with-_FORTIFY_SOURCE.patch [bz#567099]
  - kvm-block-qcow.c-fix-warnings-with-_FORTIFY_SOURCE.patch [bz#567099]
  - kvm-block-vmdk.o-fix-warnings-with-_FORTIFY_SOURCE.patch [bz#567099]
  - kvm-block-vvfat.c-fix-warnings-with-_FORTIFY_SOURCE.patch [bz#567099]
  - kvm-block-qcow2.c-fix-warnings-with-_FORTIFY_SOURCE.patch [bz#567099]
  - kvm-net-slirp.c-fix-warning-with-_FORTIFY_SOURCE.patch [bz#567099]
  - kvm-usb-linux.c-fix-warning-with-_FORTIFY_SOURCE.patch [bz#567099]
  - kvm-vl.c-fix-warning-with-_FORTIFY_SOURCE.patch [bz#567099]
  - kvm-monitor.c-fix-warnings-with-_FORTIFY_SOURCE.patch [bz#567099]
  - kvm-linux-user-mmap.c-fix-warnings-with-_FORTIFY_SOURCE.patch [bz#567099]
  - kvm-check-pipe-return-value.patch [bz#567099]
  - kvm-fix-qemu-kvm-_FORTIFY_SOURCE-compilation.patch [bz#567099]
  - kvm-Enable-_FORTIFY_SOURCE-2.patch [bz#567099]
  - kvm-qcow2-Fix-image-creation-regression.patch [bz#567099]
  - kvm-cow-return-errno-instead-of-1.patch [bz#567099]
  - kvm-slirp-check-system-success.patch [bz#567099]
  - kvm-qcow2-return-errno-instead-of-1.patch [bz#567099]
  - kvm-qcow-return-errno-instead-of-1.patch [bz#567099]
  - kvm-vmdk-return-errno-instead-of-1.patch [bz#567099]
  - kvm-vmdk-make-vmdk_snapshot_create-return-errno.patch [bz#567099]
  - kvm-vmdk-fix-double-free.patch [bz#567099]
  - kvm-vmdk-share-cleanup-code.patch [bz#567099]
  - kvm-block-print-errno-on-error.patch [bz#567099]
  - kvm-documentation-qemu_write_full-don-t-work-with-non-bl.patch [bz#567099]
  - kvm-virtio-serial-pci-Allow-MSI-to-be-disabled.patch [bz#567035]
  - kvm-pc-Add-backward-compatibility-options-for-virtio-ser.patch [bz#567035]
  - kvm-virtio-serial-don-t-set-MULTIPORT-for-1-port-dev.patch [bz#567035]
  - kvm-qdev-Add-a-DEV_NVECTORS_UNSPECIFIED-enum-for-unspeci.patch [bz#567035]
  - kvm-virtio-pci-Use-DEV_NVECTORS_UNSPECIFIED-instead-of-1.patch [bz#567035]
  - kvm-kbd-leds-infrastructure.patch [bz#569767]
  - kvm-kbd-leds-ps-2-kbd.patch [bz#569767]
  - kvm-kbd-leds-usb-kbd.patch [bz#569767]
  - kvm-kbd-keds-vnc.patch [bz#569767]
  - kvm-migration-Clear-fd-also-in-error-cases.patch [bz#570174]
  - Resolves: bz#567035
    (Backport changes for virtio-serial from upstream: disabling MSI, backward compat.)
  - Resolves: bz#567099
    (Allow _FORTIFY_SOURCE=2 & --enable-warning)
  - Resolves: bz#569767
    (Caps Lock the key's appearance  of guest is not synchronous as host's --view kvm with vnc)
  - Resolves: bz#570174
    (Restoring a qemu guest from a saved state file using -incoming sometimes fails and hangs)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.25.el6
changelog:
  - kvm-qemu-memory-notifiers.patch [bz#562958]
  - kvm-tap-add-interface-to-get-device-fd.patch [bz#562958]
  - kvm-add-API-to-set-ioeventfd.patch [bz#562958]
  - kvm-notifier-event-notifier-implementation.patch [bz#562958]
  - kvm-virtio-add-notifier-support.patch [bz#562958]
  - kvm-virtio-add-APIs-for-queue-fields.patch [bz#562958]
  - kvm-virtio-add-set_status-callback.patch [bz#562958]
  - kvm-virtio-move-typedef-to-qemu-common.patch [bz#562958]
  - kvm-virtio-pci-fill-in-notifier-support.patch [bz#562958]
  - kvm-vhost-vhost-net-support.patch [bz#562958]
  - kvm-tap-add-vhost-vhostfd-options.patch [bz#562958]
  - kvm-tap-add-API-to-retrieve-vhost-net-header.patch [bz#562958]
  - kvm-virtio-net-vhost-net-support.patch [bz#562958]
  - kvm-qemu-kvm-add-vhost.h-header.patch [bz#562958]
  - kvm-irqfd-support.patch [bz#562958]
  - kvm-msix-add-mask-unmask-notifiers.patch [bz#562958]
  - kvm-virtio-pci-irqfd-support.patch [bz#562958]
  - Resolves: bz#562958
    (RFE: Support vhost net mode)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.26.el6
changelog:
  - kvm-add-spice-into-the-configure-file.patch [bz#549757]
  - kvm-spice-core-bits.patch [bz#549757]
  - kvm-spice-add-keyboard.patch [bz#549757]
  - kvm-spice-add-mouse.patch [bz#549757]
  - kvm-spice-simple-display.patch [bz#549757]
  - kvm-move-x509-file-name-defines-to-qemu-x509.h.patch [bz#549757]
  - kvm-spice-tls-support.patch [bz#549757]
  - kvm-spice-configure-listening-addr.patch [bz#549757]
  - kvm-spice-add-qxl-device.patch [bz#549757]
  - Resolves: bz#549757
    (Provide SPICE support  / -spice command line argument)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.27.el6
changelog:
  - kvm-spice-add-tablet.patch [bz#574211]
  - kvm-spice-simple-display-wake-spice-server-only-when-idl.patch [bz#574212]
  - kvm-spice-qxl-switch-back-to-vga-mode-on-register-access.patch [bz#574214]
  - kvm-spice-qxl-ring-access-security-fix.patch [bz#568820]
  - kvm-vnc-support-password-expire.patch [bz#525935]
  - kvm-spice-vnc-add-__com.redhat_set_password-monitor-comm.patch [bz#525935]
  - kvm-spice-add-audio-support.patch [bz#574222]
  - kvm-spice-make-image-compression-configurable.patch [bz#574225]
  - kvm-spice-configure-channel-security.patch [bz#574225]
  - kvm-spice-configure-renderer.patch [bz#574225]
  - kvm-spice-send-connect-disconnect-monitor-events.patch [bz#558957]
  - kvm-spice-qxl-update-vga-help-text-indicating-qxl-is-the.patch [bz#574853]
  - kvm-spice-notifying-spice-when-migration-starts-and-ends.patch [bz#574849]
  - kvm-spice-add-__com.redhat_spice_migrate_info-monitor-co.patch [bz#574849]
  - Resolves: bz#525935
    (RFE: expire vnc password)
  - Resolves: bz#558957
    (A QMP event notification on SPICE client connect/disconnect events)
  - Resolves: bz#568820
    (EMBARGOED CVE-2010-0431 qemu: Insufficient guest provided pointers validation [rhel-6.0])
  - Resolves: bz#574211
    (spice: add tablet support)
  - Resolves: bz#574212
    (spice:wake spice server only when idle)
  - Resolves: bz#574214
    (qxl: switch qxl from native into vga mode on vga register access)
  - Resolves: bz#574222
    (spice: add audio support)
  - Resolves: bz#574225
    (spice: add config options)
  - Resolves: bz#574849
    (spice: client migration support)
  - Resolves: bz#574853
    (spice/qxl: add qxl to -vga help text)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.28.el6
changelog:
  - kvm-qcow2-Factor-next_refcount_table_size-out.patch [bz#567940]
  - kvm-qcow2-Rewrite-alloc_refcount_block-grow_refcount_tab.patch [bz#567940]
  - kvm-qcow2-More-checks-for-qemu-img-check.patch [bz#567940]
  - kvm-spice-virtual-machine-channel-replacement-for-remove.patch [bz#576488]
  - Resolves: bz#567940
    (qcow2 corruption with I/O error during refcount block allocation)
  - Resolves: bz#576488
    (Spice: virtio serial based device for guest-spice client communication)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.29.el6
changelog:
  - kvm-scsi-device-version-property.patch [bz#558835]
  - kvm-scsi-disk-fix-buffer-overflow.patch [bz#558835]
  - Resolves: bz#558835
    (ide/scsi drive versions)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.30.el6
changelog:
  - kvm-New-API-for-asynchronous-monitor-commands.patch [bz#574939]
  - kvm-Revert-QMP-Fix-query-balloon-key-change.patch [bz#574939]
  - kvm-virtio-Add-memory-statistics-reporting-to-the-balloo.patch [bz#574939]
  - Resolves: bz#574939
    (Memory statistics support)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.31.el6
changelog:
  - kvm-Transparent-Hugepage-Support-3.patch [bz#574525]
  - kvm-monitor-Don-t-check-for-mon_get_cpu-failure.patch [bz#574642]
  - kvm-QError-New-QERR_OPEN_FILE_FAILED.patch [bz#574642]
  - kvm-monitor-convert-do_memory_save-to-QError.patch [bz#574642]
  - kvm-monitor-convert-do_physical_memory_save-to-QError.patch [bz#574642]
  - kvm-QError-New-QERR_INVALID_CPU_INDEX.patch [bz#574642]
  - kvm-monitor-convert-do_cpu_set-to-QObject-QError.patch [bz#574642]
  - kvm-monitor-Use-QERR_INVALID_PARAMETER-instead-of-QERR_I.patch [bz#575800]
  - kvm-Revert-QError-New-QERR_INVALID_CPU_INDEX.patch [bz#575800]
  - kvm-json-parser-Fix-segfault-on-malformed-input.patch [bz#575800]
  - kvm-fix-i-format-handling-in-memory-dump.patch [bz#575800]
  - kvm-Don-t-set-default-monitor-when-there-is-a-mux-ed-one.patch [bz#575800]
  - kvm-monitor-Document-argument-type-M.patch [bz#575821]
  - kvm-QDict-New-qdict_get_double.patch [bz#575821]
  - kvm-monitor-New-argument-type-b.patch [bz#575821]
  - kvm-monitor-Use-argument-type-b-for-migrate_set_speed.patch [bz#575821]
  - kvm-monitor-convert-do_migrate_set_speed-to-QObject.patch [bz#575821]
  - kvm-monitor-New-argument-type-T.patch [bz#575821]
  - kvm-monitor-Use-argument-type-T-for-migrate_set_downtime.patch [bz#575821]
  - kvm-monitor-convert-do_migrate_set_downtime-to-QObject.patch [bz#575821]
  - kvm-block-Emit-BLOCK_IO_ERROR-before-vm_stop-call.patch [bz#575912]
  - kvm-QMP-Move-STOP-event-into-do_vm_stop.patch [bz#575912]
  - kvm-QMP-Move-RESET-event-into-qemu_system_reset.patch [bz#575912]
  - kvm-QMP-Sync-with-upstream-event-changes.patch [bz#575912]
  - kvm-QMP-Drop-DEBUG-event.patch [bz#575912]
  - kvm-QMP-Revamp-the-qmp-events.txt-file.patch [bz#575912]
  - kvm-QMP-Introduce-RTC_CHANGE-event.patch [bz#547534]
  - kvm-QMP-Introduce-WATCHDOG-event.patch [bz#557083]
  - kvm-spice-add-more-config-options.patch [bz#576561]
  - Resolves: bz#547534
    (RFE: a QMP event notification for RTC clock changes)
  - Resolves: bz#557083
    (QMP events for watchdog events)
  - Resolves: bz#574525
    (Align qemu-kvm guest memory for transparent hugepage support)
  - Resolves: bz#574642
    (QMP: Convert do_cpu_set() to QObject)
  - Resolves: bz#575800
    (Monitor: Backport a collection of fixes)
  - Resolves: bz#575821
    (QMP: Convert migrate_set_speed, migrate_set_downtime to QObject)
  - Resolves: bz#575912
    (QMP: Backport event related fixes)
  - Resolves: bz#576561
    (spice: add more config options)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.32.el6
changelog:
  - kvm-Revert-spice-add-more-config-options.patch [bz#576561]
    (need to wait for spice patches to be included on spice-server)
  - Related: bz#576561
    (spice: add more config options)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.33.el6
changelog:
  - kvm-Fix-kvm_load_mpstate-for-vcpu-hot-add.patch [bz#569613]
  - kvm-qemu-kvm-enable-get-set-vcpu-events-on-reset-and-mig.patch [bz#569613]
  - kvm-Synchronize-kvm-headers.patch [bz#569613]
  - kvm-Increase-VNC_MAX_WIDTH.patch [bz#569613]
  - kvm-device-assignment-default-requires-IOMMU.patch [bz#569613]
  - kvm-Do-not-allow-vcpu-stop-with-in-progress-PIO.patch [bz#569613]
  - kvm-fix-savevm-command-without-id-or-tag.patch [bz#569613]
  - kvm-Do-not-ignore-error-if-open-file-failed-serial-dev-t.patch [bz#569613]
  - kvm-segfault-due-to-buffer-overrun-in-usb-serial.patch [bz#569613]
  - kvm-fix-inet_parse-typo.patch [bz#569613]
  - kvm-virtio-net-fix-network-stall-under-load.patch [bz#569613]
  - kvm-don-t-dereference-NULL-after-failed-strdup.patch [bz#569613]
  - kvm-net-Remove-unused-net_client_uninit.patch [bz#569613]
  - kvm-net-net_check_clients-runs-too-early-to-see-device-f.patch [bz#569613]
  - kvm-net-Fix-bogus-Warning-vlan-0-with-no-nics-with-devic.patch [bz#569613]
  - kvm-net-net_check_clients-checks-only-VLAN-clients-fix.patch [bz#569613]
  - kvm-net-info-network-shows-only-VLAN-clients-fix.patch [bz#569613]
  - kvm-net-Monitor-command-set_link-finds-only-VLAN-clients.patch [bz#569613]
  - kvm-ide-save-restore-pio-atapi-cmd-transfer-fields-and-i.patch [bz#569613]
  - kvm-cirrus-Properly-re-register-cirrus_linear_io_addr-on.patch [bz#569613]
  - Related: bz#569613
    (backport qemu-kvm-0.12.3 fixes to RHEL6)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.34.el6
changelog:
  - kvm-Monitor-Introduce-cmd_new_ret.patch [bz#563491]
  - kvm-Monitor-Convert-simple-handlers-to-cmd_new_ret.patch [bz#563491]
  - kvm-Monitor-Convert-do_cont-to-cmd_new_ret.patch [bz#563491]
  - kvm-Monitor-Convert-do_eject-to-cmd_new_ret.patch [bz#563491]
  - kvm-Monitor-Convert-do_cpu_set-to-cmd_new_ret.patch [bz#563491]
  - kvm-Monitor-Convert-do_block_set_passwd-to-cmd_new_ret.patch [bz#563491]
  - kvm-Monitor-Convert-do_getfd-to-cmd_new_ret.patch [bz#563491]
  - kvm-Monitor-Convert-do_closefd-to-cmd_new_ret.patch [bz#563491]
  - kvm-Monitor-Convert-pci_device_hot_add-to-cmd_new_ret.patch [bz#563491]
  - kvm-Monitor-Convert-pci_device_hot_remove-to-cmd_new_ret.patch [bz#563491]
  - kvm-Monitor-Convert-do_migrate-to-cmd_new_ret.patch [bz#563491]
  - kvm-Monitor-Convert-do_memory_save-to-cmd_new_ret.patch [bz#563491]
  - kvm-Monitor-Convert-do_physical_memory_save-to-cmd_new_r.patch [bz#563491]
  - kvm-Monitor-Convert-do_info-to-cmd_new_ret.patch [bz#563491]
  - kvm-Monitor-Convert-do_change-to-cmd_new_ret.patch [bz#563491]
  - kvm-Monitor-Convert-to-mon_set_password-to-cmd_new_ret.patch [bz#563491]
  - kvm-Monitor-Convert-mon_spice_migrate-to-cmd_new_ret.patch [bz#563491]
  - kvm-Monitor-Rename-cmd_new_ret.patch [bz#563491]
  - kvm-Monitor-Debugging-support.patch [bz#563491]
  - kvm-Monitor-Drop-the-print-disabling-mechanism.patch [bz#563491]
  - kvm-Monitor-Audit-handler-return.patch [bz#563491]
  - kvm-Monitor-Debug-stray-prints-the-right-way.patch [bz#563491]
  - kvm-Monitor-Report-more-than-one-error-in-handlers.patch [bz#563491]
  - Resolves: bz#563491
    (QMP: New internal error handling mechanism)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.35.el6
changelog:
  - kvm-QError-New-QERR_DEVICE_NOT_ENCRYPTED.patch [bz#563641]
  - kvm-Wrong-error-message-in-block_passwd-command.patch [bz#563641]
  - kvm-Monitor-Introduce-RFQDN_REDHAT-and-use-it.patch [bz#578493]
  - kvm-QMP-Fix-Spice-event-names.patch [bz#578493]
  - Resolves: bz#563641
    (QMP: Wrong error message in block_passwd command)
  - Resolves: bz#578493
    (QMP: Fix spice event names)
  - ksm.init: touch max_kernel_pages only if it exists [bz#561907]
  - Resolves: bz#561907
  - ksmtuned: add debug information [bz#576789]
  - Resolves: bz#576789


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.36.el6
changelog:
  - kvm-char-Remove-redundant-qemu_chr_generic_open-call.patch [bz#558236]
  - kvm-add-close-callback-for-tty-based-char-device.patch [bz#558236]
  - kvm-Restore-terminal-attributes-for-tty-based-monitor.patch [bz#558236]
  - kvm-Restore-terminal-monitor-attributes-addition.patch [bz#558236]
  - Resolves: bz#558236
    (qemu-kvm monitor corrupts tty on exit)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.37.el6
changelog:
  - kvm-balloon-Fix-overflow-when-reporting-actual-memory-si.patch [bz#578912]
  - kvm-json-parser-Output-the-content-of-invalid-keyword.patch [bz#576544]
  - Resolves: bz#576544
    (Error message doesn't contain the content of invalid keyword)
  - Resolves: bz#578912
    (Monitor: Overflow in 'info balloon')


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.38.el6
changelog:
  - kvm-read-only-Make-CDROM-a-read-only-drive.patch [bz#537164]
  - kvm-read-only-BDRV_O_FLAGS-cleanup.patch [bz#537164]
  - kvm-read-only-Added-drives-readonly-option.patch [bz#537164]
  - kvm-read-only-Disable-fall-back-to-read-only.patch [bz#537164]
  - kvm-read-only-No-need-anymoe-for-bdrv_set_read_only.patch [bz#537164]
  - kvm-read_only-Ask-for-read-write-permissions-when-openin.patch [bz#537164]
  - kvm-read-only-Read-only-device-changed-to-opens-it-s-fil.patch [bz#537164]
  - kvm-read-only-qemu-img-Fix-qemu-img-can-t-create-qcow-im.patch [bz#537164]
  - kvm-block-clean-up-bdrv_open2-structure-a-bit.patch [bz#537164]
  - kvm-block-saner-flags-filtering-in-bdrv_open2.patch [bz#537164]
  - kvm-block-flush-backing_hd-in-the-right-place.patch [bz#537164]
  - kvm-block-fix-cache-flushing-in-bdrv_commit.patch [bz#537164]
  - kvm-block-more-read-only-changes-related-to-backing-file.patch [bz#537164]
  - kvm-read-only-minor-cleanup.patch [bz#537164]
  - kvm-read-only-Another-minor-cleanup.patch [bz#537164]
  - kvm-read-only-allow-read-only-CDROM-with-any-interface.patch [bz#537164]
  - kvm-qemu-img-rebase-Add-f-option.patch [bz#580028]
  - kvm-qemu-io-Fix-return-value-handling-of-bdrv_open.patch [bz#579974]
  - kvm-qemu-nbd-Fix-return-value-handling-of-bdrv_open.patch [bz#579974]
  - kvm-qemu-img-Fix-error-message.patch [bz#579974]
  - kvm-Replace-calls-of-old-bdrv_open.patch [bz#579974]
  - Resolves: bz#537164
    (-drive arg has no way to request a read only disk)
  - Resolves: bz#579974
    (Get segmentation fault when creating qcow2 format image on block device with "preallocation=metadata")
  - Resolves: bz#580028
    ('qemu-img re-base' broken on block devices)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.39.el6
changelog:
  - kvm-virtio-blk-revert-serial-number-support.patch [bz#564101]
  - kvm-block-add-topology-qdev-properties.patch [bz#564101]
  - kvm-virtio-blk-add-topology-support.patch [bz#564101]
  - kvm-scsi-add-topology-support.patch [bz#564101]
  - kvm-ide-add-topology-support.patch [bz#564101]
  - kvm-pcnet-make-subsystem-vendor-id-match-hardware.patch [bz#580140]
  - Resolves: bz#564101
    ([RFE] topology support in the virt block layer)
  - Resolves: bz#580140
    (emulated pcnet nic in qemu-kvm has wrong PCI subsystem ID for Windows XP driver)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.40.el6
changelog:
  - cpu-model-config-1.patch [bz#569661]
  - cpu-model-config-2.patch [bz#569661]
  - cpu-model-config-3.patch [bz#569661]
  - cpu-model-config-4.patch [bz#569661]
  - Resolves: bz#569661
    (RHEL6.0 requires backport of upstream cpu model support..)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.42.el6
changelog:
  - kvm-net-remove-NICInfo.bootable-field.patch [bz#561078]
  - kvm-net-remove-broken-net_set_boot_mask-boot-device-vali.patch [bz#561078]
  - kvm-boot-remove-unused-boot_devices_bitmap-variable.patch [bz#561078]
  - kvm-check-kvm-enabled.patch [bz#580109]
  - kvm-qemu-rename-notifier-event_notifier.patch [bz#580109]
  - kvm-virtio-API-name-cleanup.patch [bz#580109]
  - kvm-vhost-u_int64_t-uint64_t.patch [bz#580109]
  - kvm-virtio-pci-fix-coding-style.patch [bz#580109]
  - kvm-vhost-detect-lack-of-support-earlier-style.patch [bz#580109]
  - kvm-configure-vhost-related-fixes.patch [bz#580109]
  - kvm-vhost-fix-features-ack.patch [bz#580109]
  - kvm-vhost-net-disable-mergeable-buffers.patch [bz#580109]
  - Resolves: bz#561078
    ("Cannot boot from non-existent NIC" when using virt-install --pxe)
  - Resolves: bz#580109
    (vhost net lacks upstream fixes)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.43.el6
changelog:
  - kvm-qemu-option-Make-qemu_opts_foreach-accumulate-return.patch [bz#579470]
  - kvm-qdev-Fix-exit-code-for-device.patch [bz#579470]
  - kvm-qdev-Add-help-for-device-properties.patch [bz#579470]
  - kvm-qdev-update-help-on-device.patch [bz#579470]
  - kvm-qdev-Add-rudimentary-help-for-property-value.patch [bz#579470]
  - kvm-qdev-Free-opts-on-failed-do_device_add.patch [bz#579470]
  - kvm-qdev-Improve-diagnostics-for-bad-property-values.patch [bz#579470]
  - kvm-qdev-Catch-attempt-to-attach-more-than-one-device-to.patch [bz#579470]
  - kvm-usb-Remove-disabled-monitor_printf-in-usb_read_file.patch [bz#579470]
  - kvm-savevm-Fix-loadvm-to-report-errors-to-stderr-not-the.patch [bz#579470]
  - kvm-pc-Fix-error-reporting-for-boot-once.patch [bz#579470]
  - kvm-pc-Factor-common-code-out-of-pc_boot_set-and-cmos_in.patch [bz#579470]
  - kvm-tools-Remove-unused-cur_mon-from-qemu-tool.c.patch [bz#579470]
  - kvm-monitor-Separate-default-monitor-and-current-monitor.patch [bz#579470]
  - kvm-block-Simplify-usb_msd_initfn-test-for-can-read-bdrv.patch [bz#579470]
  - kvm-monitor-Factor-monitor_set_error-out-of-qemu_error_i.patch [bz#579470]
  - kvm-error-Move-qemu_error-friends-from-monitor.c-to-own-.patch [bz#579470]
  - kvm-error-Simplify-error-sink-setup.patch [bz#579470]
  - kvm-error-Move-qemu_error-friends-into-their-own-header.patch [bz#579470]
  - kvm-error-New-error_printf-and-error_vprintf.patch [bz#579470]
  - kvm-error-Don-t-abuse-qemu_error-for-non-error-in-qdev_d.patch [bz#579470]
  - kvm-error-Don-t-abuse-qemu_error-for-non-error-in-qbus_f.patch [bz#579470]
  - kvm-error-Don-t-abuse-qemu_error-for-non-error-in-scsi_h.patch [bz#579470]
  - kvm-error-Replace-qemu_error-by-error_report.patch [bz#579470]
  - kvm-error-Rename-qemu_error_new-to-qerror_report.patch [bz#579470]
  - kvm-error-Infrastructure-to-track-locations-for-error-re.patch [bz#579470]
  - kvm-error-Include-the-program-name-in-error-messages-to-.patch [bz#579470]
  - kvm-error-Track-locations-in-configuration-files.patch [bz#579470]
  - kvm-QemuOpts-Fix-qemu_config_parse-to-catch-file-read-er.patch [bz#579470]
  - kvm-error-Track-locations-on-command-line.patch [bz#579470]
  - kvm-qdev-Fix-device-and-device_add-to-handle-unsuitable-.patch [bz#579470]
  - kvm-qdev-Factor-qdev_create_from_info-out-of-qdev_create.patch [bz#579470]
  - kvm-qdev-Hide-no_user-devices-from-users.patch [bz#579470]
  - kvm-qdev-Hide-ptr-properties-from-users.patch [bz#579470]
  - kvm-monitor-New-monitor_cur_is_qmp.patch [bz#579470]
  - kvm-error-Let-converted-handlers-print-in-human-monitor.patch [bz#579470]
  - kvm-error-Polish-human-readable-error-descriptions.patch [bz#579470]
  - kvm-error-New-QERR_PROPERTY_NOT_FOUND.patch [bz#579470]
  - kvm-error-New-QERR_PROPERTY_VALUE_BAD.patch [bz#579470]
  - kvm-error-New-QERR_PROPERTY_VALUE_IN_USE.patch [bz#579470]
  - kvm-error-New-QERR_PROPERTY_VALUE_NOT_FOUND.patch [bz#579470]
  - kvm-qdev-convert-setting-device-properties-to-QError.patch [bz#579470]
  - kvm-qdev-Relax-parsing-of-bus-option.patch [bz#579470]
  - kvm-error-New-QERR_BUS_NOT_FOUND.patch [bz#579470]
  - kvm-error-New-QERR_DEVICE_MULTIPLE_BUSSES.patch [bz#579470]
  - kvm-error-New-QERR_DEVICE_NO_BUS.patch [bz#579470]
  - kvm-qdev-Convert-qbus_find-to-QError.patch [bz#579470]
  - kvm-error-New-error_printf_unless_qmp.patch [bz#579470]
  - kvm-error-New-QERR_BAD_BUS_FOR_DEVICE.patch [bz#579470]
  - kvm-error-New-QERR_BUS_NO_HOTPLUG.patch [bz#579470]
  - kvm-error-New-QERR_DEVICE_INIT_FAILED.patch [bz#579470]
  - kvm-error-New-QERR_NO_BUS_FOR_DEVICE.patch [bz#579470]
  - kvm-Revert-qdev-Use-QError-for-device-not-found-error.patch [bz#579470]
  - kvm-error-Convert-do_device_add-to-QError.patch [bz#579470]
  - kvm-qemu-option-Functions-to-convert-to-from-QDict.patch [bz#579470]
  - kvm-qemu-option-Move-the-implied-first-name-into-QemuOpt.patch [bz#579470]
  - kvm-qemu-option-Rename-find_list-to-qemu_find_opts-exter.patch [bz#579470]
  - kvm-monitor-New-argument-type-O.patch [bz#579470]
  - kvm-monitor-Use-argument-type-O-for-device_add.patch [bz#579470]
  - kvm-monitor-convert-do_device_add-to-QObject.patch [bz#579470]
  - kvm-error-Trim-includes-after-Move-qemu_error-friends.patch [bz#579470]
  - kvm-error-Trim-includes-in-qerror.c.patch [bz#579470]
  - kvm-error-Trim-includes-after-Infrastructure-to-track-lo.patch [bz#579470]
  - kvm-error-Make-use-of-error_set_progname-optional.patch [bz#579470]
  - kvm-error-Link-qemu-img-qemu-nbd-qemu-io-with-qemu-error.patch [bz#579470]
  - kvm-error-Move-qerror_report-from-qemu-error.-ch-to-qerr.patch [bz#579470]
  - Resolves: bz#579470
    (QMP: device_add support)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.44.el6
changelog:
  - kvm-spice-add-more-config-options-readd.patch [bz#576561]
  - BuildRequires spice-server-devel >= 0.4.2-10.el6 because of API changes
  - Resolves: bz#576561
    (spice: add more config options)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.45.el6
changelog:
  - kvm-Documentation-Add-monitor-commands-to-function-index.patch [bz#559670]
  - kvm-error-Put-error-definitions-back-in-alphabetical-ord.patch [bz#559670]
  - kvm-error-New-QERR_DUPLICATE_ID.patch [bz#559670]
  - kvm-error-Convert-qemu_opts_create-to-QError.patch [bz#559670]
  - kvm-error-New-QERR_INVALID_PARAMETER_VALUE.patch [bz#559670]
  - kvm-error-Convert-qemu_opts_set-to-QError.patch [bz#559670]
  - kvm-error-Drop-extra-messages-after-qemu_opts_set-and-qe.patch [bz#559670]
  - kvm-error-Use-QERR_INVALID_PARAMETER_VALUE-instead-of-QE.patch [bz#559670]
  - kvm-error-Convert-qemu_opts_validate-to-QError.patch [bz#559670]
  - kvm-error-Convert-net_client_init-to-QError.patch [bz#559670]
  - kvm-error-New-QERR_DEVICE_IN_USE.patch [bz#559670]
  - kvm-monitor-New-commands-netdev_add-netdev_del.patch [bz#559670]
  - kvm-qdev-Convert-qdev_unplug-to-QError.patch [bz#582325]
  - kvm-monitor-convert-do_device_del-to-QObject-QError.patch [bz#582325]
  - kvm-block-Fix-error-code-in-multiwrite-for-immediate-fai.patch [bz#582575]
  - kvm-block-Fix-multiwrite-memory-leak-in-error-case.patch [bz#582575]
  - Resolves: bz#559670
    (No 'netdev_add' command in monitor)
  - Resolves: bz#582325
    (QMP: device_del support)
  - Resolves: bz#582575
    (Backport bdrv_aio_multiwrite fixes)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.46.el6
changelog:
  - kvm-spice-add-auth-info-to-monitor-events.patch [bz#581540]
  - Resolves: bz#581540
    (SPICE graphics event does not include auth details)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.47.el6
changelog:
  - kvm-Request-setting-of-nmi_pending-and-sipi_vector.patch [bz#569613]
  - Resolves: bz#569613
    (backport qemu-kvm-0.12.3 fixes to RHEL6)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.48.el6
changelog:
  - kvm-virtio-serial-save-load-Ensure-target-has-enough-por.patch [bz#574296]
  - kvm-virtio-serial-save-load-Ensure-nr_ports-on-src-and-d.patch [bz#574296]
  - kvm-virtio-serial-save-load-Ensure-we-have-hot-plugged-p.patch [bz#574296]
  - kvm-virtio-serial-save-load-Send-target-host-connection-.patch [bz#574296]
  - kvm-virtio-serial-Use-control-messages-to-notify-guest-o.patch [bz#574296]
  - kvm-virtio-serial-whitespace-match-surrounding-code.patch [bz#574296]
  - kvm-virtio-serial-Remove-redundant-check-for-0-sized-wri.patch [bz#574296]
  - kvm-virtio-serial-Update-copyright-year-to-2010.patch [bz#574296]
  - kvm-virtio-serial-Propagate-errors-in-initialising-ports.patch [bz#574296]
  - kvm-virtio-serial-Send-out-guest-data-to-ports-only-if-p.patch [bz#574296]
  - kvm-iov-Introduce-a-new-file-for-helpers-around-iovs-add.patch [bz#574296]
  - kvm-iov-Add-iov_to_buf-and-iov_size-helpers.patch [bz#574296]
  - kvm-virtio-serial-Handle-scatter-gather-buffers-for-cont.patch [bz#574296]
  - kvm-virtio-serial-Handle-scatter-gather-input-from-the-g.patch [bz#574296]
  - kvm-virtio-serial-Apps-should-consume-all-data-that-gues.patch [bz#574296]
  - kvm-virtio-serial-Discard-data-that-guest-sends-us-when-.patch [bz#574296]
  - kvm-virtio-serial-Implement-flow-control-for-individual-.patch [bz#574296]
  - kvm-virtio-serial-Handle-output-from-guest-to-unintialis.patch [bz#574296]
  - kvm-virtio-serial-bus-wake-up-iothread-upon-guest-read-n.patch [bz#574296]
  - kvm-Bail-out-when-VCPU_CREATE-fails.patch [bz#587227]
  - Resolves: bz#574296
    (Fix migration for virtio-serial after port hot-plug/hot-unplug operations)
  - Resolves: bz#587227
    (Fix segfault when creating more vcpus than allowed.)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.49.el6
changelog:
  - kvm-block-Free-iovec-arrays-allocated-by-multiwrite_merg.patch [bz#586572]
  - Resolves: bz#586572
    (virtio-blk multiwrite merge memory leak)
  - Force spice to be enabled and fix BuildRequires to use spice-server-devel
  - Resolves: bz#588904
    (qemu-kvm builds without spice support)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.50.el6
changelog:
  - kvm-vl.c-fix-BZ-588828-endless-loop-caused-by-non-option.patch [bz#588828]
  - Resolves: bz#588828
    (endless loop when parsing of command line with bare image argument)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.51.el6
changelog:
  - kvm-fdc-fix-drive-property-handling.patch [bz#584902]
  - Resolves: bz#584902
    (Cannot associate drive with a floppy device using -global)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.52.el6
changelog:
  - kvm-qemu-img-use-the-heap-instead-of-the-huge-stack-arra.patch [bz#585837]
  - kvm-qemu-img-rebase-Fix-output-image-corruption.patch [bz#585837]
  - Resolves: bz#585837
    (After re-base snapshot, the file in the snapshot disappeared)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.53.el6
changelog:
  - kvm-virtio-blk-Fix-use-after-free-in-error-case.patch [bz#578448]
  - kvm-block-Fix-multiwrite-error-handling.patch [bz#578448]
  - kvm-Fix-boot-once-option.patch [bz#579692]
  - kvm-QError-New-QERR_QMP_BAD_INPUT_OBJECT_MEMBER.patch [bz#573578]
  - kvm-QMP-Use-QERR_QMP_BAD_INPUT_OBJECT_MEMBER.patch [bz#573578]
  - kvm-QError-Improve-QERR_QMP_BAD_INPUT_OBJECT-desc.patch [bz#573578]
  - kvm-QMP-Check-arguments-member-s-type.patch [bz#573578]
  - kvm-QMP-Introduce-RESUME-event.patch [bz#590102]
  - kvm-pci-irq_state-vmstate-breakage.patch [bz#588133]
  - Resolves: bz#573578
    (Segfault when migrating via QMP command interface)
  - Resolves: bz#578448
    (qemu-kvm segfault when nfs restart(without using werror&rerror))
  - Resolves: bz#579692
    (qemu-kvm "-boot once=drives" couldn't function properly)
  - Resolves: bz#588133
    (RHEL5.4 guest can lose virtio networking during migration)
  - Resolves: bz#590102
    (QMP: Backport RESUME event)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.54.el6
changelog:
  - kvm-qemu-config-qemu_read_config_file-reads-the-normal-c.patch [bz#588756]
  - kvm-qemu-config-Make-qemu_config_parse-more-generic.patch [bz#588756]
  - kvm-blkdebug-Basic-request-passthrough.patch [bz#588756]
  - kvm-blkdebug-Inject-errors.patch [bz#588756]
  - kvm-Make-qemu-config-available-for-tools.patch [bz#588756]
  - kvm-blkdebug-Add-events-and-rules.patch [bz#588756]
  - kvm-qcow2-Trigger-blkdebug-events.patch [bz#588756]
  - kvm-qcow2-Fix-access-after-end-of-array.patch [bz#588762]
  - kvm-qcow2-rename-two-QCowAIOCB-members.patch [bz#588762]
  - kvm-qcow2-Don-t-ignore-immediate-read-write-failures.patch [bz#588762]
  - kvm-qcow2-Remove-request-from-in-flight-list-after-error.patch [bz#588762]
  - kvm-qcow2-Return-0-errno-in-write_l2_entries.patch [bz#588762]
  - kvm-qcow2-Fix-error-return-code-in-qcow2_alloc_cluster_l.patch [bz#588762]
  - kvm-qcow2-Return-0-errno-in-write_l1_entry.patch [bz#588762]
  - kvm-qcow2-Return-0-errno-in-l2_allocate.patch [bz#588762]
  - kvm-qcow2-Remove-abort-on-free_clusters-failure.patch [bz#588762]
  - kvm-Add-qemu-error.o-only-once-to-target-list.patch [bz#591061]
  - kvm-block-Fix-bdrv_commit.patch [bz#589439]
  - kvm-fix-80000001.EDX-supported-bit-filtering.patch [bz#578106]
  - kvm-fix-CPUID-vendor-override.patch [bz#591604]
  - Resolves: bz#578106
    (call trace when boot guest with -cpu host)
  - Resolves: bz#588756
    (blkdebug is missing)
  - Resolves: bz#588762
    (Backport qcow2 fixes)
  - Resolves: bz#589439
    (Qcow2 snapshot got corruption after commit using block device)
  - Resolves: bz#591061
    (make fails to build after make clean)
  - Resolves: bz#591604
    (cannot override cpu vendor from the command line)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.55.el6
changelog:
  - kvm-turn-off-kvmclock-when-resetting-cpu.patch [bz#588884]
  - kvm-virtio-blk-Avoid-zeroing-every-request-structure.patch [bz#593369]
  - Resolves: bz#588884
    (Rebooting a kernel with kvmclock enabled, into a kernel with kvmclock disabled, causes random crashes)
  - Resolves: bz#593369
    (virtio-blk: Avoid zeroing every request structure)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.56.el6
changelog:
  - kvm-dmg-fix-open-failure.patch [bz#580363]
  - kvm-block-get-rid-of-the-BDRV_O_FILE-flag.patch [bz#580363]
  - kvm-block-Convert-first_drv-to-QLIST.patch [bz#580363]
  - kvm-block-separate-raw-images-from-the-file-protocol.patch [bz#580363]
  - kvm-block-Split-bdrv_open.patch [bz#580363]
  - kvm-block-Avoid-forward-declaration-of-bdrv_open_common.patch [bz#580363]
  - kvm-block-Open-the-underlying-image-file-in-generic-code.patch [bz#580363]
  - kvm-block-bdrv_has_zero_init.patch [bz#580363]
  - kvm-block-Do-not-export-bdrv_first.patch [bz#590998]
  - kvm-block-Convert-bdrv_first-to-QTAILQ.patch [bz#590998]
  - kvm-block-Add-wr_highest_sector-blockstat.patch [bz#590998]
  - Resolves: bz#580363
    (Error while creating raw image on block device)
  - Resolves: bz#590998
    (qcow2 high watermark)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.57.el6
changelog:
  - kvm-stash-away-SCM_RIGHTS-fd-until-a-getfd-command-arriv.patch [bz#582684]
  - Resolves: bz#582684
    (Monitor: getfd command is broken)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.58.el6
changelog:
  - kvm-Fix-segfault-after-device-assignment-hot-remove.patch [bz#582874]
  - Resolves: bz#582874
    (Guest hangs during restart after hot unplug then hot plug physical NIC card)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.59.el6
changelog:
  - kvm-pci-cleanly-backout-of-pci_qdev_init.patch [bz#590884]
  - kvm-ide-Fix-ide_dma_cancel.patch [bz#593287]
  - Resolves: bz#590884
    (bogus 'info pci' state when hot-added assigned device fails to initialize)
  - Resolves: bz#593287
    (Failed asserting during ide_dma_cancel)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.60.el6
changelog:
  - kvm-spice-vmc-add-copyright.patch [bz#576488]
  - kvm-spice-vmc-remove-debug-prints-and-defines.patch [bz#576488]
  - kvm-spice-vmc-add-braces-to-single-line-if-s.patch [bz#576488]
  - kvm-spice-vmc-s-SpiceVirtualChannel-SpiceVMChannel-g.patch [bz#576488]
  - kvm-spice-vmc-s-spice_virtual_channel-spice_vmc-g.patch [bz#576488]
  - kvm-spice-vmc-all-variables-of-type-SpiceVMChannel-renam.patch [bz#576488]
  - kvm-spice-vmc-remove-meaningless-cast-of-void.patch [bz#576488]
  - kvm-spice-vmc-add-spice_vmc_ring_t-fix-write-function.patch [bz#576488]
  - kvm-spice-vmc-don-t-touch-guest_out_ring-on-unplug.patch [bz#576488]
  - kvm-spice-vmc-VirtIOSerialPort-vars-renamed-to-vserport.patch [bz#576488]
  - kvm-spice-vmc-add-nr-property.patch [bz#576488]
  - kvm-spice-vmc-s-SPICE_VM_CHANNEL-SPICE_VMC-g.patch [bz#576488]
  - kvm-spice-vmc-add-vmstate.-saves-active_interface.patch [bz#576488]
  - kvm-spice-vmc-rename-guest-device-name-to-com.redhat.spi.patch [bz#576488]
  - kvm-spice-vmc-remove-unused-property-name.patch [bz#576488]
  - Resolves: bz#576488
    (Spice: virtio serial based device for guest-spice client communication)


