# changelog

author: Jarod Wilson <jarod@redhat.com> [3.10.0-111.el7]
changelog:
  - [net] inet: fix for a race condition in the inet frag code (Nikolay Aleksandrov) [1070711] {CVE-2014-0100}
  - [scsi] aacraid: Print warning message if unsupported card is being used (Rich Bono) [1019091]
  - [drm] ttm: don't oops if no invalidate_caches() (Rob Clark) [1073470 1075068]
  - [security] selinux: bigendian problems with filename trans rules (Paul Moore) [1029837]
  - [security] selinux: Fix memory leak upon loading policy (Paul Moore) [1051042]
  - [x86] apic: Plug racy xAPIC access of CPU hotplug code (Igor Mammedov) [1073568]
  - [kernel] sched: Remove redundant update_runtime notifier (Igor Mammedov) [1074476]
  - [virt] kvm/svm: fix cr8 intercept window (Radim Krcmar) [1056982]
  - [video] fb: reorder the lock sequence to fix potential dead lock (Jason Wang) [1040781]
  - [virt] hv/vmbus: Don't timeout during the initial connection with host (Jason Wang) [1037957]
  - [virt] hv/vmbus: Specify the target CPU that should receive notification (Jason Wang) [1037957]
  - [mm] percpu scalability fixes (Alexander Viro) [1072446]
  - [x86] fix compile error due to X86_TRAP_NMI use in asm files (Don Zickus) [1051428]
  - [x86] Ignore NMIs that come in during early boot (Don Zickus) [1051428]
  - [fs] cifs: Add support for follow_link on dfs shares under posix extensions (Sachin Prabhu) [1020715]
  - [fs] cifs: move unix extension call to cifs_query_symlink() (Sachin Prabhu) [1020715]
  - [kernel] audit: include subject in login records (Richard Guy Briggs) [1075155]
  - [kernel] audit: remove superfluous new- prefix in AUDIT_LOGIN messages (Richard Guy Briggs) [1075155]
  - [ethernet] tg3: Don't check undefined error bits in RXBD (Ivan Vecera) [1071483]
  - [fs] gfs2: Move recovery variables to journal structure in memory (Robert S Peterson) [1059439]
  - [security] keys: Make the keyring cycle detector ignore other keyrings of the same name (David Howells) [1071346] {CVE-2014-0102}
  - [x86] fix x86 fixup_irqs() error handling (Prarit Bhargava) [1074644]
  - [fs] gfs2: Re-add a call to log_flush_wait when flushing the journal (Robert S Peterson) [1074556]
  - [fs] gfs2: Ensure workqueue is scheduled after noexp request (Robert S Peterson) [1074556]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-112.el7]
changelog:
  - [net] bridge: multicast: enable snooping on general queries only (Florian Westphal) [1074491]
  - [net] bridge: multicast: add sanity check for general query destination (Florian Westphal) [1074491]
  - [net] bridge: multicast: add sanity check for query source addresses (Florian Westphal) [1074491]
  - [net] inet: frag: fix oops when unloading inetfrag modules (Florian Westphal) [1073962]
  - [virt] vhost/net: fix ref cnt checking deadlock ("Michael S. Tsirkin") [1065878]
  - [virt] vhost_net: correctly limit the max pending buffers ("Michael S. Tsirkin") [1065878]
  - [virt] vhost/net: fix a theoretical race in device cleanup ("Michael S. Tsirkin") [1065878]
  - [powerpc] pseries: Expose in kernel device tree update to drmgr (Steve Best) [1064745]
  - [powerpc] pseries: Update dynamic cache nodes for suspend/resume operation (Steve Best) [1064745]
  - [powerpc] pseries: Device tree should only be updated once after suspend/migrate (Steve Best) [1064745]
  - [powerpc] pseries: Child nodes are not detached by dlpar_detach_node (Steve Best) [1064745]
  - [powerpc] pseries: Add mising of_node_put in delete_dt_node (Steve Best) [1064745]
  - [powerpc] pseries: Make dlpar_configure_connector parent node aware (Steve Best) [1064745]
  - [powerpc] pseries: Do all node initialization in dlpar_parse_cc_node (Steve Best) [1064745]
  - [powerpc] pseries: Fix parsing of initial node path in update_dt_node (Steve Best) [1064745]
  - [powerpc] pseries: Pack update_props_workarea to map correctly to rtas buffer header (Steve Best) [1064745]
  - [powerpc] pseries: Fix over writing of rtas return code in update_dt_node (Steve Best) [1064745]
  - [powerpc] pseries: Fix creation of loop in device node property list (Steve Best) [1064745]
  - [infiniband] mlx4: Don't allocate range of steerable UD QPs for Ethernet-only device (Doug Ledford) [1061795]
  - [ethernet] e1000: fix lockdep warning in e1000_reset_task (John Green) [1056355]
  - [ethernet] mlx4: mlx4_init_slave() shouldn't access comm channel before PF is ready (Amir Vadai) [1058413]
  - [ethernet] mlx4: Fix memory access error in mlx4_QUERY_DEV_CAP_wrapper() (Amir Vadai) [1058413]
  - [mm] numa: recheck for transhuge pages under lock during protection changes (Rik van Riel) [1073674]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-113.el7]
changelog:
  - [security] selinux: fix broken peer recv check (Paul Moore) [1043165]
  - [md] dm-raid: Fix possibility of skipping device recovery (Jonathan E Brassow) [1069927]
  - [fs] xfs: avoid AGI/AGF deadlock scenario for inode chunk allocation (Brian Foster) [1052789]
  - [md] dm-cache: fix access beyond end of origin device (Mike Snitzer) [1074606]
  - [md] dm-cache: fix truncation bug when copying a block to/from >2TB fast device (Mike Snitzer) [1075709]
  - [ethernet] bna: don't disable VLAN tag stripping in promisc mode (Ivan Vecera) [1057842]
  - [kernel] posix-timers: Spare workqueue if there is no full dynticks CPU to kick (Frederic Weisbecker) [1074168]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-114.el7]
changelog:
  - [net] netfilter: nf_conntrack_dccp: fix skb_header_pointer API usages (Jiri Pirko) [1077351] {CVE-2014-2523}
  - [net] ipv6: don't set DST_NOCOUNT for remotely added routes (Jiri Pirko) [1075060] {CVE-2014-2309}
  - [net] skbuff: skb_segment: orphan frags before copying ("Michael S. Tsirkin") [1056934] {CVE-2014-0131}
  - [net] skbuff: skb_segment: s/fskb/list_skb/ ("Michael S. Tsirkin") [1056934] {CVE-2014-0131}
  - [net] skbuff: skb_segment: s/skb/head_skb/ ("Michael S. Tsirkin") [1056934] {CVE-2014-0131}
  - [net] skbuff: skb_segment: s/skb_frag/frag/ ("Michael S. Tsirkin") [1056934] {CVE-2014-0131}
  - [net] skbuff: skb_segment: s/frag/nskb_frag/ ("Michael S. Tsirkin") [1056934] {CVE-2014-0131}
  - [net] use kfree_skb_list() helper ("Michael S. Tsirkin") [1056934] {CVE-2014-0131}
  - [net] veth: fix veth vlan features (Flavio Leitner) [1076077]
  - [net] sunrpc/xprtrdma: add separate Kconfig options for NFSoRDMA client and server support (Jeff Layton) [1077957]
  - [virt] kvm/x86: emulate MOVAPD (Igor Mammedov) [1052090]
  - [virt] kvm/x86: emulate MOVAPS (Igor Mammedov) [1052090]
  - [mm] x86: Wrong page freed on preallocate_pmds() failure exit (Larry Woodman) [1073641]
  - [mm] x86: do not leak page->ptl for pmd page tables (Larry Woodman) [1073641]
  - [virt] kvm/x86: fix emulator buffer overflow (Andrew Jones) [1071836] {CVE-2014-0049}
  - [virt] hyperv: Change the receive buffer size for legacy hosts (Jason Wang) [1075279]
  - [x86] quirks: Update DH8900CC Unsupported Device ID (Prarit Bhargava) [1076137]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-115.el7]
changelog:
  - [block] free q->flush_rq in blk_init_allocated_queue error paths (Mike Snitzer) [1078522]
  - [x86] fpu: Clear exceptions in AMD FXSAVE workaround (Phillip Lougher) [1053596] {CVE-2014-1438}
  - [mm] page_alloc: spill to remote nodes before waking kswapd (Johannes Weiner) [1076546]
  - [mm] vmscan: do not swap anon pages just because free+file is low (Johannes Weiner) [1076546]
  - [fs] sunrpc: Ensure call_connect_status() deals correctly with SOFTCONN tasks (Steve Dickson) [1071532]
  - [fs] nfs: Ensure we respect soft mount timeouts during trunking discovery (Steve Dickson) [1071532]
  - [fs] nfs: Schedule recovery if nfs40_walk_client_list() is interrupted (Steve Dickson) [1071532]
  - [fs] sunrpc: Ensure that call_bind times out correctly (Steve Dickson) [1071532]
  - [fs] sunrpc: Ensure that call_connect times out correctly (Steve Dickson) [1071532]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-116.el7]
changelog:
  - [s390] qeth: postpone freeing of qdio memory (Hendrik Brueckner) [1077650]
  - [kernel] rh_taint: Remove taint and update unsupported hardware message (Prarit Bhargava) [1076974]
  - [fs] proc/vmcore: continue vmcore initialization if PT_NOTE is found empty (Chao WANG) [1077535]
  - [net] ipv6: ip6_append_data_mtu do not handle the mtu of the second fragment properly (Jiri Pirko) [1079873]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-117.el7]
changelog:
  - [md] dm-thin: fix dangling bio in process_deferred_bios error path (Mike Snitzer) [1081781]
  - [md] dm: take care to copy the space map roots before locking the superblock (Mike Snitzer) [1081781]
  - [md] dm-transaction-manager: fix corruption due to non-atomic transaction commit (Mike Snitzer) [1081781]
  - [md] dm-era: fixes for issues identified upstream (Mike Snitzer) [1081781]
  - [md] dm-cache: remove remainder of distinct discard block size (Mike Snitzer) [1062679]
  - [md] dm-cache: prevent corruption caused by discard_block_size > cache_block_size (Mike Snitzer) [1062679]
  - [ipc] change kern_ipc_perm.deleted type to bool (Phillip Lougher) [1043807] {CVE-2013-7026}
  - [ipc] introduce ipc_valid_object() helper to sort out IPC_RMID races (Phillip Lougher) [1043807] {CVE-2013-7026}
  - [ipc] shm: fix shm_file deletion races (Phillip Lougher) [1043807] {CVE-2013-7026}
  - [drm] udl: take reference to device struct for dma-bufs (Dave Airlie) [1077774]
  - [security] keys: Allow special keys (eg. DNS results) to be invalidated by CAP_SYS_ADMIN (David Howells) [1074240]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-118.el7]
changelog:
  - [wireless] ath9k: Fix LNA gpio for AR9485 (John Green) [1082017]
  - [infiniband] core: Don't resolve passive side RoCE L2 address in cma req handler (Amir Vadai) [1075852]
  - [fs] xfs: fix buffer use after free on IO error (Eric Sandeen) [924301]
  - [scsi] be2iscsi: Bump the driver version (Rob Evers) [1052416]
  - [scsi] be2iscsi: Fix DMA Out of SW-IOMMU space error (Rob Evers) [1052416]
  - [scsi] be2iscsi: Fix scsi_cmnd leakage in driver (Rob Evers) [1052416]
  - [scsi] be2iscsi: Fix the session cleanup when reboot/shutdown happens (Rob Evers) [1052416]
  - [scsi] be2iscsi: Fix doorbell format for EQ/CQ/RQ s per SLI spec (Rob Evers) [1052416]
  - [scsi] be2iscsi: Fix port speed typo in driver (Rob Evers) [1052416]
  - [scsi] be2iscsi: Fix handling timed out MBX completion from FW (Rob Evers) [1052416]
  - [fs] nfs: Fix a use-after-free problem in open() (Steve Dickson) [1062809]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-119.el7]
changelog:
  - [net] bonding: remove bond_resend_igmp_join_requests read_unlock leftover (Veaceslav Falico) [1080924]
  - [ethernet] mlx4: Support shutdown() interface (Amir Vadai) [1046216]
  - [zram] fix invalid memory access (Jerome Marchand) [1081936]
  - [zram] protect zram_reset_device() call (Jerome Marchand) [1081936]
  - [zram] remove zram_sysfs file (Jerome Marchand) [1081936]
  - [zram] use atomic64_xxx() to replace zram_stat64_xxx() (Jerome Marchand) [1081936]
  - [zram] optimize memory operations with clear_page()/copy_page() (Jerome Marchand) [1081936]
  - [zram] kill unused zram_get_num_devices() (Jerome Marchand) [1081936]
  - [zram] simplify and optimize dev_to_zram() (Jerome Marchand) [1081936]
  - [kernel] futex: revert back to the explicit waiter counting code (Larry Woodman) [1081100]
  - [kernel] audit: Allow login in non-init namespaces (Richard Guy Briggs) [1082597]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-120.el7]
changelog:
  - [net] netfilter: fix panic when oom during rule replacement (Florian Westphal) [985657]
  - [net] netfilter: x_tables: fix ordering of jumpstack allocation and table update (Florian Westphal) [985657]
  - [virt] kvm/ioapic: try to recover if pending_eoi goes out of range (Paolo Bonzini) [1036478]
  - [virt] kvm/ioapic: fix assignment of ioapic->rtc_status.pending_eoi (Paolo Bonzini) [1036478 1081590] {CVE-2014-0155}
  - [virt] kvm/ioapic: reinject pending interrupts on KVM_SET_IRQCHIP (Paolo Bonzini) [1036478]
  - [virt] kvm/ioapic: extract body of kvm_ioapic_set_irq (Paolo Bonzini) [1036478]
  - [virt] kvm/ioapic: clear IRR for edge-triggered interrupts at delivery (Paolo Bonzini) [1036478]
  - [virt] kvm/ioapic: merge ioapic_deliver into ioapic_service (Paolo Bonzini) [1036478]
  - [virt] kvm: ignore ioapic polarity (Paolo Bonzini) [1036478]
  - [core] device: Create 'device_driver_rh' KABI shadowing structure (Myron Stowe) [1083692]
  - [core] device: Create 'device_rh' KABI shadowing structure (Myron Stowe) [1083692]
  - [scsi] Reserve space in structures for future XCOPY support (Ewan Milne) [1080430]
  - [fs] xfs: fix bad hash ordering (Brian Foster) [1083206]
  - [fs] xfs: always do log forces via the workqueue (Brian Foster) [1052004]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-121.el7]
changelog:
  - [virt] vhost/net: fix total length when packets are too short ("Michael S. Tsirkin") [1064446] {CVE-2014-0077}
  - [virt] vhost/net: validate vhost_get_vq_desc return value ("Michael S. Tsirkin") [1070940] {CVE-2014-0055}


author: Jarod Wilson <jarod@redhat.com> [3.10.0-122.el7]
changelog:
  - [security] device_cgroup: check if exception removal is allowed (Aristeu Rozanski) [1086057]
  - [security] device_cgroup: rework device access check and rule checking (Aristeu Rozanski) [1086057]
  - [fs] autofs: fix lockref lookup (Ian Kent) [1083815]
  - [mei] me: do not load the driver if the FW doesn't support MEI interface (Prarit Bhargava) [1082789]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-123.el7]
changelog:
  - [mm] rmap: try_to_unmap_cluster() should lock_page() before mlocking (Larry Woodman) [1078349] {CVE-2014-3122}
  - [mm] huge_memory: Fix cpuset cgroups so all pages for a task remain on correct node (Larry Woodman) [1076613]
  - [mm] mprotect: fix oops in change_pmd_range called from task_numa_work (Rik van Riel) [1085050]


author: Phillip Lougher <plougher@redhat.com> [3.10.0-123.1.2.el7]
changelog:
  - [tty] n_tty: Fix n_tty_write crash when echoing in raw mode (Aristeu Rozanski) [1094241 1094242] {CVE-2014-0196}


author: Karanbir Singh <kbsingh@centos.org> [3.10.0-123.1.2.el7.centos]
changelog:
  - Patch in CentOS SecureBoot certs
  - Add in debranding patches
  - Add in CentOS driver update and kpatch certs


author: Phillip Lougher <plougher@redhat.com> [3.10.0-123.2.1.el7]
changelog:
  - [net] filter: prevent nla extensions to peek beyond the end of the message (Jiri Benc) [1096780 1096781] {CVE-2014-3144 CVE-2014-3145}
  - [block] floppy: don't write kernel-only members to FDRAWCMD ioctl output (Denys Vlasenko) [1094316 1094318] {CVE-2014-1737 CVE-2014-1738}
  - [block] floppy: ignore kernel-only members in FDRAWCMD ioctl input (Denys Vlasenko) [1094316 1094318] {CVE-2014-1737 CVE-2014-1738}
  - [net] core, nfqueue, openvswitch: Orphan frags in skb_zerocopy and handle errors (Jiri Pirko) [1091345 1079014] {CVE-2014-2568}
  - [net] ipv4: current group_info should be put after using (Jiri Benc) [1087415 1087416] {CVE-2014-2851}
  - [fs] dcache: make prepend_name() work correctly when called with negative *buflen (Mikulas Patocka) [1099048 1092746]
  - [fs] dcache: __dentry_path() fixes (Mikulas Patocka) [1099048 1092746]
  - [fs] dcache: prepend_path() needs to reinitialize dentry/vfsmount/mnt on restarts (Mikulas Patocka) [1099048 1092746]
  - [target] tcm_fc: Fix use-after-free of ft_tpg (Andy Grover) [1088110 1071340]
  - [s390] af_iucv: wrong mapping of sent and confirmed skbs (Hendrik Brueckner) [1103064 1098513]
  - [s390] kernel: avoid page table walk on user space access (Hendrik Brueckner) [1103062 1097687]
  - [s390] crypto: fix aes, des ctr mode concurrency finding (Hendrik Brueckner) [1103060 1097686]
  - [net] openvswitch: fix a possible deadlock and lockdep warning (Flavio Leitner) [1103318 1094867]
  - [mm] filemap: update find_get_pages_tag() to deal with shadow entries (Johannes Weiner) [1103065 1091795]
  - [mm] page-writeback: fix divide by zero in pos_ratio_polynom (Rik van Riel) [1103067 1091784]
  - [mm] page-writeback: add strictlimit feature (Rik van Riel) [1103067 1091784]
  - [fs] xfs: log vector rounding leaks log space (Brian Foster) [1103059 1091136]
  - [fs] xfs: truncate_setsize should be outside transactions (Brian Foster) [1103059 1091136]
  - [fs] gfs2: Fix uninitialized VFS inode in gfs2_create_inode (Abhijith Das) [1097407 1087995]
  - [kernel] futex: Fix pthread_cond_broadcast() to wake up all threads (Larry Woodman) [1103066 1084757]
  - [net] ip: generate unique IP identificator if local fragmentation is allowed (Jiri Pirko) [1090490 1076106]
  - [kernel] cputime: Fix jiffies based cputime assumption on steal accounting (Frederic Weisbecker) [1090974 1047732]
  - [kernel] cputime: Bring cputime -> nsecs conversion (Frederic Weisbecker) [1090974 1047732]
  - [kernel] cputime: Default implementation of nsecs -> cputime conversion (Frederic Weisbecker) [1090974 1047732]
  - [x86] irq, pic: Probe for legacy PIC and set legacy_pic appropriately (Vivek Goyal) [1094973 1037957]
  - [virt] hyperv/vmbus: Negotiate version 3.0 when running on ws2012r2 hosts (Vivek Goyal) [1094973 1037957]


author: Phillip Lougher <plougher@redhat.com> [3.10.0-123.3.1.el7]
changelog:
  - [kernel] mutexes: Give more informative mutex warning in the !lock->owner case (Larry Woodman) [1103629 1087655] [1103630 1087919] [1103631 1087922]
  - [kernel] mutex: replace CONFIG_HAVE_ARCH_MUTEX_CPU_RELAX with simple ifdef (Larry Woodman) [1103629 1087655] [1103630 1087919] [1103631 1087922]
  - [kernel] locking/mutexes: Introduce cancelable MCS lock for adaptive spinning (Larry Woodman) [1103629 1087655] [1103630 1087919] [1103631 1087922]
  - [kernel] locking/mutexes: Modify the way optimistic spinners are queued (Larry Woodman) [1103629 1087655] [1103630 1087919] [1103631 1087922]
  - [kernel] locking/mutexes: Return false if task need_resched() in mutex_can_spin_on_owner() (Larry Woodman) [1103629 1087655] [1103630 1087919] [1103631 1087922]
  - [kernel] Restructure the MCS lock defines and locking & Move mcs_spinlock.h into kernel/locking/ (Larry Woodman) [1103629 1087655] [1103630 1087919] [1103631 1087922]
  - [misc] arch: Introduce smp_load_acquire(), smp_store_release() (Larry Woodman) [1103629 1087655] [1103630 1087919] [1103631 1087922]
  - [kernel] locking/mutex: Fix debug_mutexes (Larry Woodman) [1103629 1087655] [1103630 1087919] [1103631 1087922]
  - [kernel] locking/mutex: Fix debug checks (Larry Woodman) [1103629 1087655] [1103630 1087919] [1103631 1087922]
  - [kernel] locking/mutexes: Unlock the mutex without the wait_lock (Larry Woodman) [1103629 1087655] [1103630 1087919] [1103631 1087922]


author: Phillip Lougher <plougher@redhat.com> [3.10.0-123.4.1.el7]
changelog:
  - [kernel] futex: Make lookup_pi_state more robust (Larry Woodman) [1104519 1104520] {CVE-2014-3153}
  - [kernel] futex: Always cleanup owner tid in unlock_pi (Larry Woodman) [1104519 1104520] {CVE-2014-3153}
  - [kernel] futex: Validate atomic acquisition in futex_lock_pi_atomic() (Larry Woodman) [1104519 1104520] {CVE-2014-3153}
  - [kernel] futex: prevent requeue pi on same futex (Larry Woodman) [1104519 1104520] {CVE-2014-3153}
  - [ethernet] qlcnic: Fix ethtool statistics length calculation (Michal Schmidt) [1104972 1099634]
  - Revert: [kernel] cputime: Default implementation of nsecs -> cputime conversion (Frederic Weisbecker) [1090974 1047732]
  - Revert: [kernel] cputime: Bring cputime -> nsecs conversion (Frederic Weisbecker) [1090974 1047732]
  - Revert: [kernel] cputime: Fix jiffies based cputime assumption on steal accounting (Frederic Weisbecker) [1090974 1047732]


author: Phillip Lougher <plougher@redhat.com> [3.10.0-123.4.2.el7]
changelog:
  - [fs] aio: fix plug memory disclosure and fix reqs_active accounting backport (Jeff Moyer) [1094604 1094605] {CVE-2014-0206}
  - [fs] aio: plug memory disclosure and fix reqs_active accounting (Mateusz Guzik) [1094604 1094605] {CVE-2014-0206}


author: Karanbir Singh <kbsingh@centos.org> [3.10.0-123.4.2.el7.centos]
changelog:
  - Patch in CentOS SecureBoot certs
  - Add in debranding changes
  - Add in CentOS kdump and driver update certs
  - Modifications to remove Red Hat from spec file


author: Phillip Lougher <plougher@redhat.com> [3.10.0-123.4.3.el7]
changelog:
  - [x86] ptrace: force IRET path after a ptrace_stop() (Oleg Nesterov) [1115934 1115935] {CVE-2014-4699}


author: Phillip Lougher <plougher@redhat.com> [3.10.0-123.4.4.el7]
changelog:
  - [net] l2tp_ppp: fail when socket option level is not SOL_PPPOL2TP (Petr  Matousek) [1119465 1119466] {CVE-2014-4943}


author: Johnny Hughes <johnny@centos.org> [3.10.0-123.4.4.el7]
changelog:
  - Add in CentOS SecureBoot certs
  - Add in debranding changes
  - Add in CentOS kdump and driver update certs
  - Modifications to remove Red Hat branding from spec file


author: Phillip Lougher <plougher@redhat.com> [3.10.0-123.5.1.el7]
changelog:
  - [net] ipv4/tunnels: fix an oops when using ipip/sit with IPsec (Jiri Pirko) [1114957 1108857]
  - [scsi] Add timeout to avoid infinite command retry (Ewan Milne) [1114468 1061871]
  - [net] filter: let bpf_tell_extensions return SKF_AD_MAX (Jiri Benc) [1114404 1079524]
  - [net] filter: introduce SO_BPF_EXTENSIONS (Jiri Benc) [1114404 1079524]
  - [net] sctp: Fix sk_ack_backlog wrap-around problem (Daniel Borkmann) [1113971 1112726] {CVE-2014-4667}
  - [tty] Set correct tty name in 'active' sysfs attribute (Denys Vlasenko) [1113467 1066403]
  - [powerpc] tm: Disable IRQ in tm_recheckpoint (Larry Woodman) [1113150 1088224]
  - [scsi] qla2xxx: Update version number to 8.06.00.08.07.0-k3 (Chad Dupuis) [1112389 1090378]
  - [scsi] qla2xxx: Reduce the time we wait for a command to complete during SCSI error handling (Chad Dupuis) [1112389 1090378]
  - [scsi] qla2xxx: Clear loop_id for ports that are marked lost during fabric scanning (Chad Dupuis) [1112389 1090378]
  - [scsi] qla2xxx: Avoid escalating the SCSI error handler if the command is not found in firmware (Chad Dupuis) [1112389 1090378]
  - [scsi] qla2xxx: Don't check for firmware hung during the reset context for ISP82XX (Chad Dupuis) [1112389 1090378]
  - [scsi] qla2xxx: Issue abort command for outstanding commands during cleanup when only firmware is alive (Chad Dupuis) [1112389 1090378]
  - [fs] nfs: Apply NFS_MOUNT_CMP_FLAGMASK to nfs_compare_remount_data() (Scott Mayhew) [1109407 1103805]
  - [ethernet] bnx2x: Fix kernel crash and data miscompare after EEH recovery (Michal Schmidt) [1107721 1101808]
  - [net] gro: restore frag0 optimization (and fix crash) (Michal Schmidt) [1099950 1069741]
  - [watchdog] hpwdt: display informative string (Nigel Croxon) [1096961 1074038]
  - [net] Use netlink_ns_capable to verify the permisions of netlink messages (Jiri Benc) [1094271 1094272] {CVE-2014-0181}
  - [net] netlink: Add variants of capable for use on netlink messages (Jiri Benc) [1094271 1094272] {CVE-2014-0181}
  - [net] diag: Move the permission check in sock_diag_put_filterinfo to packet_diag_dump (Jiri Benc) [1094271 1094272] {CVE-2014-0181}
  - [net] netlink: Rename netlink_capable netlink_allowed (Jiri Benc) [1094271 1094272] {CVE-2014-0181}
  - [net] diag: Fix ns_capable check in sock_diag_put_filterinfo (Jiri Benc) [1094271 1094272] {CVE-2014-0181}
  - [net] netlink: Fix permission check in netlink_connect() (Jiri Benc) [1094271 1094272] {CVE-2014-0181}
  - [kernel] cputime: Fix jiffies based cputime assumption on steal accounting (Frederic Weisbecker) [1090974 1047732]
  - [kernel] cputime: Bring cputime -> nsecs conversion (Frederic Weisbecker) [1090974 1047732]
  - [kernel] cputime: Default implementation of nsecs -> cputime conversion (Frederic Weisbecker) [1090974 1047732]
  - [net] mac80211: fix crash due to AP powersave TX vs. wakeup race (Jacob Tanenbaum) [1083533 1083534] {CVE-2014-2706}
  - [wireless] ath9k: tid->sched race in ath_tx_aggr_sleep() (Jacob Tanenbaum) [1083251 1083252] {CVE-2014-2672}
  - [powerpc] tm: Fix crash when forking inside a transaction (Radomir Vrbovsky) [1083214 1083215] {CVE-2014-2673}
  - [fs] aio: fix plug memory disclosure and fix reqs_active accounting backport (Jeff Moyer) [1094604 1094605] {CVE-2014-0206}
  - [fs] aio: plug memory disclosure and fix reqs_active accounting (Mateusz Guzik) [1094604 1094605] {CVE-2014-0206}


author: Phillip Lougher <plougher@redhat.com> [3.10.0-123.6.2.el7]
changelog:
  - [s390] ptrace: correct insufficient sanitization when setting psw mask (Hendrik Brueckner) [1114090 1113673]


author: Phillip Lougher <plougher@redhat.com> [3.10.0-123.6.3.el7]
changelog:
  - [net] l2tp_ppp: fail when socket option level is not SOL_PPPOL2TP (Petr Matousek) [1119465 1119466] {CVE-2014-4943}


author: Phillip Lougher <plougher@redhat.com> [3.10.0-123.7.1.el7]
changelog:
  - [scsi] set DID_TIME_OUT correctly (Ewan Milne) [1122575 1103881]
  - [scsi] fix invalid setting of host byte (Ewan Milne) [1122575 1103881]
  - [scsi] More USB deadlock fixes (Ewan Milne) [1122575 1103881]
  - [scsi] Fix USB deadlock caused by SCSI error handling (Ewan Milne) [1122575 1103881]
  - [scsi] Fix command result state propagation (Ewan Milne) [1122575 1103881]
  - [scsi] Fix spurious request sense in error handling (Ewan Milne) [1122575 1103881]
  - [input] synaptics: fix resolution for manually provided min/max (Benjamin Tissoires) [1122559 1093449]
  - [input] synaptics: change min/max quirk table to pnp-id matching (Benjamin Tissoires) [1122559 1093449]
  - [input] synaptics: add a matches_pnp_id helper function (Benjamin Tissoires) [1122559 1093449]
  - [input] synaptics: T540p - unify with other LEN0034 models (Benjamin Tissoires) [1122559 1093449]
  - [input] synaptics: add min/max quirk for the ThinkPad W540 (Benjamin Tissoires) [1122559 1093449]
  - [input] synaptics: add min/max quirk for ThinkPad Edge E431 (Benjamin Tissoires) [1122559 1093449]
  - [input] synaptics: add min/max quirk for ThinkPad T431s, L440, L540, S1 Yoga and X1 (Benjamin Tissoires) [1122559 1093449]
  - [input] synaptics: report INPUT_PROP_TOPBUTTONPAD property (Benjamin Tissoires) [1122559 1093449]
  - [input] Add INPUT_PROP_TOPBUTTONPAD device property (Benjamin Tissoires) [1122559 1093449]
  - [input] i8042: add firmware_id support (Benjamin Tissoires) [1122559 1093449]
  - [input] serio: add firmware_id sysfs attribute (Benjamin Tissoires) [1122559 1093449]
  - [input] synaptics: add manual min/max quirk for ThinkPad X240 (Benjamin Tissoires) [1122559 1093449]
  - [input] synaptics: add manual min/max quirk (Benjamin Tissoires) [1122559 1093449]
  - [input] synaptics: fix incorrect placement of __initconst (Benjamin Tissoires) [1122559 1093449]
  - [ethernet] be2net: Fix invocation of be_close() after be_clear() (Ivan Vecera) [1122558 1066644]
  - [ethernet] be2net: enable interrupts in EEH resume (Ivan Vecera) [1121712 1076682]
  - [ethernet] sfc: PIO:Restrict to 64bit arch and use 64-bit writes (Nikolay Aleksandrov) [1119725 1089024]
  - [kernel] ftrace: Hardcode ftrace_module_init() call into load_module() (Takahiro MUNEDA) [1119721 1061553]
  - [kernel] trace: Make register/unregister_ftrace_command __init (Takahiro MUNEDA) [1119721 1061553]
  - [block] nvme: Initialize device reference count earlier (David Milburn) [1119720 1081734]
  - [ata] ahci: accommodate tag ordered controller (David Milburn) [1117154 1083746]
  - [s390] af_iucv: recvmsg problem for SOCK_STREAM sockets (Hendrik Brueckner) [1115585 1109703]
  - [s390] af_iucv: correct cleanup if listen backlog is full (Hendrik Brueckner) [1115584 1109033]
  - [mm] Revert: vmscan: do not swap anon pages just because free+file is low (Johannes Weiner) [1114938 1102991]
  - [drm] nouveau/bios: fix a bit shift error introduced by recent commit (Ulrich Obergfell) [1114869 1089936]
  - [ethernet] bnx2x: Adapter not recovery from EEH error injection (Michal Schmidt) [1107722 1067154]
  - [kernel] auditsc: audit_krule mask accesses need bounds checking (Denys Vlasenko) [1102708 1102710] {CVE-2014-3917}
  - [block] mtip32xx: mtip_async_complete() bug fixes (Jeff Moyer) [1125776 1102281]
  - [block] mtip32xx: Unmap the DMA segments before completing the IO request (Jeff Moyer) [1125776 1102281]
  - [net] l2tp: don't fall back on UDP [get|set]sockopt (Petr  Matousek) [1119465 1119466] {CVE-2014-4943}
  - [s390] ptrace: correct insufficient sanitization when setting psw mask (Hendrik Brueckner) [1114090 1113673] {CVE-2014-3534}


author: Phillip Lougher <plougher@redhat.com> [3.10.0-123.8.1.el7]
changelog:
  - [scsi] fnic: fix broken FIP discovery by initializing multicast address (Chris Leech) [1119727 1100078]
  - [scsi] libfcoe: Make fcoe_sysfs optional / fix fnic NULL exception (Chris Leech) [1119727 1100078]
  - [fs] nfs: Don't mark the data cache as invalid if it has been flushed (Scott Mayhew) [1115817 1114054]
  - [fs] nfs: Clear NFS_INO_REVAL_PAGECACHE when we update the file size (Scott Mayhew) [1115817 1114054]
  - [fs] nfs: Fix cache_validity check in nfs_write_pageuptodate() (Scott Mayhew) [1115817 1114054]
  - [mm] hugetlb: ensure hugepage access is denied if hugepages are not supported (David Gibson) [1122115 1081671]
  - [kernel] hrtimer: Prevent all reprogramming if hang detected (Prarit Bhargava) [1113175 1094732]


author: Jeff Moyer <jmoyer@redhat.com> - 1.101-4
changelog:
  - Build for x86_64 as well.  Kdump support doesn't work there, but users
    should be able to use kexec.


author: Jeff Moyer <jmoyer@redhat.com> - 1.101-8
changelog:
  - Fix the service stop case.  It was previously unloading the wrong kernel.
  - Implement the "restart" function.
  - Add the "irqpoll" option as a default kdump kernel commandline parameter.
  - Create a default kernel command line in the sysconfig file upon rpm install.


author: Thomas Graf <tgraf@redhat.com> - 1.101-10
changelog:
  - kdump7.patch
     o Remove elf32 core headers support for x86_64
     o Fix x86 prepare elf core header routine
     o Fix ppc64 kexec -p failure for gcc 4.10
     o Fix few warnings for gcc 4.10
     o Add the missing --initrd option for ppc64
     o Fix ppc64 persistent root device bug
  - Remove --elf32-core-headers from default configuration, users
    may re-add it via KEXEC_ARGS.
  - Remove obsolete KEXEC_HEADERS


author: Thomas Graf <tgraf@redhat.com> - 1.101-15
changelog:
  - Don't add kdump service by default, let the user manually add it to
    avoid everyone seeing a warning.


author: Neil Horman <nhorman@redhat.com> - 1.101-45
changelog:
  - fixed typo in mkdumprd for bz 202983
  - fixed typo in mkdumprd for bz 203053
  - clarified docs in kdump.conf with examples per bz 203015


author: Jarod Wilson <jwilson@redhat.com> - 1.101-46
changelog:
  - ppc64 fixups:
    - actually build ppc64 binaries (bug 203407)
    - correct usage output
    - avoid segfault in command-line parsing
  - install kexec man page
  - use regulation Fedora BuildRoot


author: Neil Horman <nhorman@redhat.com> - 1.101-58
changelog:
  - Updating kdump.init and mkdumprd with most recent RHEL5 fixes
  - Fixing BuildReq to require elfutils-devel-static


author: Neil Horman <nhorman@redhat.com> - 1.102pre-1
changelog:
  - Bumping kexec version to latest horms tree (bz 257201)
  - Adding trigger to remove initrds when a kernel is removed


author: Neil Horman <nhorman@redhat.com> - 1.102pre-3
changelog:
  - Fix ARCH placement in kdump init script (bz 427201)
  - Fix BuildRequires
  - Fix Makedumpfile to build with new libelf


author: Neil Horman <nhorman@redhat.com> - 1.102pre-6
changelog:
  - Bringing rawhide up to date with bugfixes from RHEL5
  - Adding patch to prevent kexec buffer overflow on ppc (bz 428684)


author: Neil Horman <nhorman@redhat.com> 2.0.0-18
changelog:
  - Updated initscript to use mkdumprd2 if manifest is present
  - Updated spec to require dash
  - Updated sample manifest to point to correct initscript
  - Updated populate_std_files helper to fix sh symlink


author: CAI Qian <caiqian@redhat.com> - 2.0.0-34
changelog:
  - Massive forward-port from RHEL6
  - Update kexec-kdump-howto.txt
  - Update docs to reflect use of ext4
  - Update mkdumprd to pull in all modules needed
  - Fix mkdumprd typo
  - Removed universal add of ata_piix from mkdumprd
  - Fix infinite loop from modprobe changes
  - Fixed kexec-kdump-howto.doc for RHEL6
  - Update makedumpfile to 1.3.5
  - Improved mkdumprd run time
  - Cai's fix for broken regex
  - Fixing crashkernel syntax parsing
  - Fix initscript to return proper LSB return codes
  - Fixed bad call to resolve_dm_name
  - Added poweroff option to mkdumprd
  - Fixed readlink issue
  - Fixed x86_64 page_offset specifictaion
  - Fixed lvm setup loop to not hang
  - Added utsname support to makedumpfile for 2.6.32
  - Fix critical_disks list to exclude cciss/md
  - Add help info for -b option
  - Add ability to handle firmware hotplug events
  - Update mkdumprd to deal with changes in busybox fsck
  - Vitaly's fix to detect need for 64 bit elf
  - Fix major/minor numbers on /dev/rtc
  - Fix ssh id propogation w/ selinux
  - Add blacklist feature to kdump.conf
  - Removed rhpl code from firstboot
  - Fixed firstboot enable sense
  - Remove bogus debug comment from mkdumprd.
  - Handle SPARSEMEM properly
  - Fix scp monitoring script
  - Fix firstboot to find grub on EFI systems
  - Fixed mkdumprd to remove dup insmod
  - Fixed kdump fsck pause
  - Fixed kdump option handling
  - fixed raid5 module detection


author: Cong Wang <xiyou.wangcong@gmail.com> - 2.0.3-42
changelog:
  - get ip addr with getent
  - spec: depends on dracut-network
  - Handle net option for nfs in kdump.conf correctly


author: Dave Young <dyoung@redhat.com> - 2.0.3-44
changelog:
  - update ppc64 sysconfig, resolve bug 811449
  - deal with nic rename issue, resolve bug 810107
  - update x86_64 sysconfig, resolve bug 813711


author: Dave Young <ruyang@redhat.com> - 2.0.3-46
changelog:
  - mkdumprd: Start using --hostonly and --add kdumpbase while calling dracut
  - get_mp function cleanup
  - move kdump script order to the end of pre pivot
  - port raw dump from rhel6
  - remove multi dump


author: Dave Young <ruyang@redhat.com> - 2.0.3-48
changelog:
  - do_default_action cleanup, Resolves: bz805773
  - add rhcrashkernel-param for anaconda use, Resolves: bz707441
  - Basic iscsi target dump support (software initiator), Resolves bz822701
  - Static ip configuratio support, Resolves: bz822739
  - udev rules fix, Resolves: bz808817


author: Dave Young <ruyang@redhat.com> - 2.0.3-49
changelog:
  - cleanup DUMP_INSTRUCTION handling
  - final reboot behavior fix
  - dump_rootfs for default target fix
  - add vlan support
  - fix and refactor bond handling code
  - fix and refactor bridge handling code
  - core_collector doc basic fix
  - omit plymouth module, Resolves: bz821997
  - mkdumprd manpage cleanup manpage
  - mkdumprd: remove --debug
  - mkdumprd: remove noconf
  - makedumprd: remove -d
  - kdump.conf add sshkey
  - kdump.conf remove disk_timeout
  - kdump.conf make path uncommented
  - kdump.conf.5 add default poweroff
  - kdump.conf default shell fix
  - kdump.conf default default action fix
  - kdump.conf.5 remove module option
  - kdump.conf remove kdump_pre/kdump_post
  - kdump.conf: remove link_delay


author: Dave Young <ruyang@redhat.com> - 2.0.3-50
changelog:
  - add blacklist option, Resolves: bz805774
  - Add kdump_post and kdump_pre support, Resolves: bz805773
  - Port check_config from rhel6, Resolves: bz805778
  - raw core_collector fix
  - ssh core_collector fix
  - drcut-kdump.sh: cleanup kdump.conf check


author: Dave Young <ruyang@redhat.com> - 2.0.3-51
changelog:
  - add s390x netdev setup
  - Add s390x support
  - Cleanup temp file leaved at /tmp/
  - add check_size function for fs dump
  - add ssh check_size
  - blacklist patch apply fix
  - Respect bonding mode
  - Support dump over vlan tagged bonding


author: Dave Young <ruyang@redhat.com> - 2.0.3-53
changelog:
  - refactor net option
  - use fstab-sys to mount nfs
  - rename function dump_localfs
  - dump_localfs error path fix
  - update kexec-kdump-howto.txt about systemctl commands
  - ssh propagate alert message fix
  - remove useless dracut cmdline '-c /dev/null'
  - remove useless dracut cmdline for kernel-modules and kdumpbase
  - install core_collector in module-setup.sh
  - install extra_bins in module-setup.sh
  - remove busybox dependency
  - improve warning message of space checking
  - do not mount root twice
  - do not add fstab-sys module in dracut cmdline
  - omit dash module
  - network dns config fix
  - shell exit value fix


author: Dave Young <ruyang@redhat.com> - 2.0.3-54
changelog:
  - pass raw device as dracut argument
  - iscsi setup fix
  - firstboot: add automatic and manual memory reservation for rhel
  - firstboot: remove unnecessary underline shortkey
  - firstboot: fix gtk warning about non-zero page size
  - firstboot: update all kernels config in grubbyCmd
  - firstboot: add actual reserved memory widget
  - firstboot code cleanup
  - rhcrashkernel-param: echo crashkernel=auto for rhel7
  - Remove the kernel-kdump handling
  - s390x firstboot fix
  - remove elilo support
  - grub2 fix in firstboot
  - Take closing the reboot dialog as no
  - Handle new crashkernel= syntax in firstboot
  - Fix a localized string in firstboot
  - Configure kdump in firstboot
  - fix firstboot to ensure kdump svc is disabled properly
  - firstboot text domain fix
  - Update to use systemctl instead of sysv chkconfig
  - port force_rebuild kdump.conf option
  - Change return value to indicate the result of dump_raw() correctly.
  - call dracut function for default shell


author: Dave Young <ruyang@redhat.com> - 2.0.3-56
changelog:
  - Pull vmcore-dmesg patches from vivek
  - ppc/ppc64: compile purgatory with gcc option msoft-float
  - Update to support f18 grub2 efi config file
  - pass persistent name to dracut --device
  - pass persistent name to dracut --mount
  - use persistent name in kdump.conf of initramfs
  - mkdumprd: add function get_persistent_dev
  - remove useless uuid and label handling


author: Dave Young <ruyang@redhat.com> - 2.0.3-59
changelog:
  - Enable kdump service after installation
  - get MEM_RESERVED from sysfs attribute
  - get_ssh_size: use -n to redirect stdin from /dev/null
  - add random feeding code for ssh dump
  - kdump option space checking improvement
  - kdumpctl: multi dump target checking fix


author: Dave Young <ruyang@redhat.com> - 2.0.3-60
changelog:
  - makedumpfile 1.5.1
  - Update po tar.gz
  - Add a notes for zanata process
  - Add two xmls file for po zanata translation
  - Cleanup and recreate po files


author: Dave Young <ruyang@redhat.com> - 2.0.3-62
changelog:
  - Pull translated po files from zanata
  - Optimize redundent code fetching server of network dump
  - change the dump dir format to be more readable


author: Dave Young <ruyang@redhat.com> - 2.0.3-63
changelog:
  - revert explictly handling of PIPESTATUS
  - enable pipefail bash option
  - wrong ssh key fix
  - build fix: Update 3 po files: po/gu.po po/or.po po/zh_CN.po


author: Dave Young <ruyang@redhat.com> - 2.0.3-65
changelog:
  - Add support for team devices
  - Update translation file po/it.po
  - remove wait for net ok function
  - add bootdev cmdline param
  - kdumpnic cmdline file name cleanup


author: Dave Young <ruyang@redhat.com> - 2.0.3-66
changelog:
  - Spec: remove kdump image when a corresponding kernel is removed
  - Merge an upstream patch for fix a ppc64 makedumpfile bug


author: Baoquan He <bhe@redhat.com> - 2.0.3-67
changelog:
  - Remove comma which is redundant
  - Modify codes related to dump dir to make it clearer
  - Rectify the get_host_ip implementation
  - Revert: Merge an upstream patch for fix a ppc64 makedumpfile bug with with CONFIG_SPARSEMEM_EXTREME
  - pull makedumpfile 1.5.3


author: Baoquan He <bhe@redhat.com> - 2.0.3-68
changelog:
  - tune sysconfig to save memory usage
  - Remove useless codes related to LOGGER in kdumpctl
  - kdumpctl:print out the service status
  - Return to start() function when check_ssh_target failed
  - use findmnt instead of blkid in mkdumprd
  - check dump target mounting earlier
  - kdumpctl: rename function name check_config
  - add function to check kdump config file
  - dracut-module-setup.sh: remove UUID/LABEL quotes before using it
  - Change dump_to_rootfs to be a default option and reboot to be default action
  - Remove "-F" in CORE_COLLECTOR when dump_to_rootfs


author: Baoquan He <bhe@redhat.com> - 2.0.4-1
changelog:
  - Delete several patches which have been merged into kexec-tools-2.0.4
  - Revert: Release 2.0.3-72
  - Release 2.0.3-72
  - Pull kexec-tools-2.0.4
  - Check if block device as dump target is resettable
  - mkdumprd: add function perror_exit
  - Deprecate blacklist option


author: Baoquan He <bhe@redhat.com> - 2.0.4-2
changelog:
  - kdump: Save vmcore-dmesg.txt before saving vmcore
  - Remove "ip=" overwrite to 40ip.conf
  - Add support for bridge over bond/team/vlan.
  - Fix bonding options syntax and get all specified options from ifcfg file.
  - add dracut_args option to kdump.conf
  - kexec-tools.spec: Add ethtool to dependency.
  - error out if dump target is encrypted


author: Baoquan He <bhe@redhat.com> - 2.0.4-3
changelog:
  - mkdumprd: remove -M option for dracut
  - kdumpctl: add selinux relabel when service startup
  - depends on dracut selinux module
  - dracut-kdump.sh: umount rootfs after dump_to_rootfs
  - kdump.sysconfig: append "panic=10" to kdump cmdline
  - kexec-kdump-howto: grubby is suggested modifing kernel cmdline
  - kexec-tools.spec: removes kexec udev rules for s390
  - kdump.sysconfig: Add option action_on_fail and set its default as continue
  - Add tab key as delimiter for core_collector in kdump.conf
  - redirect stdout to stderr


author: Baoquan He <bhe@redhat.com> - 2.0.4-4
changelog:
  - dracut-module-setup.sh: improve the approach to get a bridged interface list
  - dracut-module-setup.sh: cleanup - use kdump_get_mac_addr() function
  - dracut-module-setup.sh: use kernel exported mac address in kdump_get_mac_addr()
  - dracut-module-setup.sh: use perm addr of slaves to setup bonding network
  - kdump: Do not output debug messages by default
  - dracut-module-setup.sh: kdump module depends on drm module
  - mkdumprd: return error if no write permission on save path of server for ssh


author: Baoquan He <bhe@redhat.com> - 2.0.4-5
changelog:
  - monitor-dd-progress fix
  - rawdump: only show dd progress bar when core_collector is not makedumpfile
  - kexec-tools.spec: replaces scriptlets with new systemd macros
  - dracut-kdump.sh: umount fs right before kdump exit
  - dracut-kdump.sh: recursively umount fs and its submounts
  - dracut-kdump.sh: cleanup - using local variable names instead of $1/$2 in functions
  - dracut-kdump.sh: name the invalid vmcore to vmcore-incomplete
  - dracut-kdump.sh: Output top level information about the kdump progress.
  - kexec-kdump-howto: Add a section for debugging tips


author: Baoquan He <bhe@redhat.com> - 2.0.4-6
changelog:
  - add lzo build
  - makedumpfile: Add vmap_area_list definition for ppc/ppc64.
  - pull makedumpfile-1.5.4
  - mkdumprd: check return value of subshell
  - mkdumprd: get_persistent_dev() return original dev if no persistent dev exists.
  - dracut-kdump.sh: Merge dump_to_rootfs() to dump_fs()
  - dracut-kdump.sh: explicitly sync after each dump
  - Correct wrong weekday of changelog
  - kexec-tools.spec: Remove incorrect description in changelog


author: Baoquan He <bhe@redhat.com> - 2.0.4-7
changelog:
  - dracut-kdump.sh: add do_dump() and error out if dump vmcore fails
  - dracut-module-setup.sh: setup correct system time and time zone in 2nd kernel.
  - kernel cmdline: Remove hugepage allocations
  - Use /lib/dracut/no-emergency-shell to control action on fail
  - Revert: kdump.sysconfig: Add option action_on_fail and set its default as continue
  - dracut-kdump.sh: Redirect kdump script stdout/stderr to /dev/console
  - add snappy build


author: Baoquan He <bhe@redhat.com> - 2.0.4-9
changelog:
  - Strip inline comments from the kdump config file before use
  - kdump-lib.sh: add common function strip_comments
  - Introduce kdump-lib.sh for kdump shared functions
  - kdump.service: Start kdump after network is online and remote fs is mounted
  - dracut-module-setup: _dev to be a local variable
  - kdumpctl: Run multiple kdumpctl instances one by one in serial order


author: WANG Chao <chaowang@redhat.com> - 2.0.4-12
changelog:
  - fix sadump format phys_base calculating error
  - kdump, x86: Process multiple Crash kernel in /proc/iomem
  - makedumpfile: wrong cyclic buffer size recalculation causes bitmap data corruption
  - Fix max_mapnr issue on system has over 44-bit addressing.


author: WANG Chao <chaowang@redhat.com> - 2.0.4-14
changelog:
  - Add rd.memdebug in kdump module
  - kdumpctl: Avoid leaking fd to subshell
  - makedumpfile: Understand >= v3.11-rc4 dmesg
  - makedumpfile, ppc: Support to filter dump for kernels that use CONFIG_SPARSEMEM_VMEMMAP.


author: WANG Chao <chaowang@redhat.com> - 2.0.4-15
changelog:
  - makedumpfile: default to lzo compression
  - makedumpfile: add makedumpfile.conf.sample and its manpage


author: WANG Chao <chaowang@redhat.com> - 2.0.4-20
changelog:
  - vmcore-dmesg: fix timestamp error in vmcore-dmesg.txt
  - makedumpfile: re-enable mmap() and introduce --non-mmap
  - kdump.conf uncomment default core_collector line
  - fix an issue when 'ssh' directive appearing in kdump.conf, the rest part of
    lines in this file are ignored


author: WANG Chao <chaowang@redhat.com> - 2.0.4-21
changelog:
  - makedumpfile: Improve progress information for huge memory system
  - s390: use nr_cpus=1 instead of maxcpus=1


author: WANG Chao <chaowang@redhat.com> - 2.0.4-24
changelog:
  - remove selinux flipping when propagating ssh key
  - add kdump-in-cluster-environment.txt to rpm pkg
  - Secure Boot status check warning
  - Some watchdog driver support


author: WANG Chao <chaowang@redhat.com> - 2.0.4-25
changelog:
  - kdumpctl: Pass disable_cpu_apicid to kexec of capture kernel
  - Relax restriction of dumping on encrypted target
  - ssh dump: create random-seed manually


author: WANG Chao <chaowang@redhat.com> - 2.0.4-27
changelog:
  - mkdumprd: call dracut with --hostonly-cmdline (dracut >= 033-145)
  - warning on secure boot enabled platform


author: WANG Chao <chaowang@redhat.com> - 2.0.4-28
changelog:
  - Document supported/unsupported/unknown list of dump targets
  - Warn user about save vmcore path mounted by another disk


author: Jindrich Novy <jnovy@redhat.com> 5.0.21-0.2
changelog:
  - remove C# documentation
  - disable/remove rpath
  - fix description
  - tighten dependencies
  - run ldconfig for cxx and sql subpackages


author: Jindrich Novy <jnovy@redhat.com> 5.1.19-1
changelog:
  - update to 5.1.19
  - rename -devel-static to -static subpackage (#617800)
  - build java on all arches


author: Jindrich Novy <jnovy@redhat.com> 5.2.36-1
changelog:
  - update to 5.2.36,
    http://download.oracle.com/otndocs/products/berkeleydb/html/changelog_5_2.html#id3647664


author: Richard Jones <rjones@redhat.com> - 1.0.25-4
changelog:
  - New upstream version 1.0.25.
  - Enable debugging when running the tests.
  - Disable tests - don't work correctly in Koji.


author: Richard Jones <rjones@redhat.com> - 1.0.26-6
changelog:
  - Experimentally try to reenable ppc and ppc64 builds.
  - Note BZ numbers which are causing tests to fail.


author: Richard Jones <rjones@redhat.com> - 1.0.28-1
changelog:
  - New upstream version 1.0.28.  Nothing has visibly changed, but
    the source has been gettextized and we want to check that doesn't
    break anything.


author: Richard Jones <rjones@redhat.com> - 1.0.29-3
changelog:
  - New upstream version 1.0.29 (fixes RHBZ#502007 RHBZ#502018).
  - This should allow us to enable tests for i386 and x86-64.
  - Added test-bootbootboot.sh script which was missed from 1.0.29 tarball.
  - Pass kernel noapic flag to workaround RHBZ#502058.


author: Richard W.M. Jones <rjones@redhat.com> - 1.0.33-1
changelog:
  - New upstream version 1.0.33.
  - --with-java-home option is no longer required.
  - Upstream contains potential fixes for:
      501878 built-in commands like 'alloc' and 'help' don't autocomplete
      501883 javadoc messed up in libguestfs java documentation
      501885 Doesn't detect missing Java, --with-java-home=no should not be needed
      502533 Polish translation of libguestfs
      n/a    Allow more ext filesystem kmods (Charles Duffy)


author: Richard W.M. Jones <rjones@redhat.com> - 1.0.37-1
changelog:
  - New upstream version 1.0.37.
  - Fixes:
    . "mkdir-p" should not throw errors on preexisting directories (RHBZ#503133)
    . cramfs and squashfs modules should be available in libguestfs appliances
        (RHBZ#503135)


author: Richard W.M. Jones <rjones@redhat.com> - 1.0.39-1
changelog:
  - New upstream version 1.0.39.
  - Fixes:
    . libguestfs /dev is too sparse for kernel installation/upgrade (RHBZ#503169)
    . OCaml bindings build failure (RHBZ#502309)


author: Richard W.M. Jones <rjones@redhat.com> - 1.0.44-1
changelog:
  - New upstream version 1.0.44.
  - Try enabling tests on ppc & ppc64 since it looks like the bug(s?)
    in qemu which might have caused them to fail have been fixed.


author: Richard W.M. Jones <rjones@redhat.com> - 1.0.47-2
changelog:
  - New upstream release 1.0.47.
  - Enable experimental supermin appliance build.
  - Fix path to appliance.


author: Richard W.M. Jones <rjones@redhat.com> - 1.0.48-1
changelog:
  - New upstream release 1.0.48.
  - Should fix all the brokenness from 1.0.47.
  - Requires febootstrap >= 2.3.


author: Richard W.M. Jones <rjones@redhat.com> - 1.0.49-5
changelog:
  - Remove workaround for RHBZ#507007, since bug is now fixed.
  - Pull in upstream patch to fix pclose checking
    (testing as possible fix for RHBZ#507066).
  - Pull in upstream patch to check waitpid return values
    (testing as possible fix for RHBZ#507066).


author: Richard W.M. Jones <rjones@redhat.com> - 1.0.57-1
changelog:
  - New upstream release 1.0.57.
  - New tool virt-df (obsoletes existing package with this name).
  - RHBZ#507066 may be fixed, so reenable tests.


author: Richard W.M. Jones <rjones@redhat.com> - 1.0.64-3
changelog:
  - RHBZ#513249 bug in qemu is now fixed, so try to rebuild and run tests.
  - However RHBZ#503236 still prevents us from testing on i386.


author: Richard W.M. Jones <rjones@redhat.com> - 1.0.65-1
changelog:
  - New upstream release 1.0.65.
  - Add Obsoletes for virt-df2 (RHBZ#514309).
  - Disable tests because of ongoing TCG problems with newest qemu in Rawhide.


author: Richard W.M. Jones <rjones@redhat.com> - 1.0.66-5
changelog:
  - Set network interface to ne2k_pci (workaround for RHBZ#516022).
  - Rerun autoconf because patch touches configure script.


author: Richard W.M. Jones <rjones@redhat.com> - 1.0.69-1
changelog:
  - New upstream release 1.0.69.
  - Reenable the tests (because RHBZ#516543 is supposed to be fixed).
  - New main loop code should fix RHBZ#501888, RHBZ#504418.
  - Add waitpid along guestfs_close path (fixes RHBZ#518747).


author: Richard W.M. Jones <rjones@redhat.com> - 1.0.72-1
changelog:
  - New upstream release 1.0.72.
  - New tools: virt-edit, virt-rescue.
  - Combine virt-cat, virt-df, virt-edit, virt-inspector and virt-rescue
    into a single package called libguestfs-tools.


author: Richard W.M. Jones <rjones@redhat.com> - 1.0.73-1
changelog:
  - New upstream release 1.0.73.
  - OCaml library now depends on xml-light.
  - Deal with installed documentation.


author: Richard W.M. Jones <rjones@redhat.com> - 1.0.75-2
changelog:
  - New upstream release 1.0.75.
  - New library: libhivex.
  - New tools: virt-win-reg, hivexml, hivexget.
  - Don't require chntpw.
  - Add BR libxml2-devel, accidentally omitted before.


author: Richard W.M. Jones <rjones@redhat.com> - 1.0.77-1
changelog:
  - New upstream release 1.0.77.
  - Support for mounting guest in host using FUSE (guestmount command).
  - hivex*(1) man pages should be in main package, not -devel, since
    they are user commands.
  - libguestfs-tools: Fix "self-obsoletion" issue raised by rpmlint.
  - perl: Remove bogus script Sys/bindtests.pl.


author: Richard W.M. Jones <rjones@redhat.com> - 1.0.78-2
changelog:
  - New upstream release 1.0.78.
  - Many more filesystem types supported by this release - add them
    as dependencies.


author: Richard W.M. Jones <rjones@redhat.com> - 1.0.79-2
changelog:
  - New upstream release 1.0.79.
  - Adds FUSE test script and multiple fixes for FUSE (RHBZ#538069).
  - Fix virt-df in Xen (RHBZ#538041).
  - Improve speed of supermin appliance.
  - Disable FUSE-related tests because Koji doesn't currently allow them.
    fuse: device not found, try 'modprobe fuse' first


author: Richard W.M. Jones <rjones@redhat.com> - 1.0.80-1
changelog:
  - New upstream release 1.0.80.
  - New Polish translations (RHBZ#502533).
  - Give a meaningful error if no usable kernels are found (RHBZ#539746).
  - New tool: virt-list-filesystems


author: Richard W.M. Jones <rjones@redhat.com> - 1.0.80-11
changelog:
  - Remove gfs-utils (deprecated and removed from Fedora 13 by the
    upstream Cluster Suite developers).
  - Include patch to fix regression in qemu -serial stdio option.


author: Richard W.M. Jones <rjones@redhat.com> - 1.0.81-1
changelog:
  - New upstream version 1.0.81.
  - Remove two upstream patches.
  - virt-inspector: Make RPM application data more specific (RHBZ#552718).


author: Richard W.M. Jones <rjones@redhat.com> - 1.0.81-8
changelog:
  - Backport special handling of libgcc_s.so.
  - Backport unreadable files patch from RHEL 6 / upstream.


author: Richard W.M. Jones <rjones@redhat.com> - 1.0.82-1
changelog:
  - New upstream version 1.0.82.  This includes the two patches
    we were carrying, so those are now removed.
  - This release fixes:
    RHBZ#559498 (Oriya translation).
    RHBZ#559480 (Punjabi translation).
    RHBZ#558593 (Should prevent corruption by multilib).
    RHBZ#559237 (Telugu translation).
    RHBZ#557655 (Use xstrtol/xstrtoll to parse integers in guestfish).
    RHBZ#557195 (Missing crc kernel modules for recent Linux).
  - In addition this contains numerous fixes to the hivex library
    for parsing Windows Registry files, making hivex* and virt-win-reg
    more robust.
  - New API call 'filesize'.


author: Richard W.M. Jones <rjones@redhat.com> - 1.0.82-6
changelog:
  - Backport a better fix for RHBZ557655 test from upstream.
  - Backport fix for unreadable yum.log from upstream.


author: Richard W.M. Jones <rjones@redhat.com> - 1.0.83-2
changelog:
  - New upstream release 1.0.83.
  - This release fixes:
    Add Marathi translations (RHBZ#561671).
    Polish translations (RHBZ#502533).
    Add Gujarti translations (Sweta Kothari) (RHBZ#560918).
    Update Oriya translations (thanks Manoj Kumar Giri) (RHBZ#559498).
    Set locale in C programs so l10n works (RHBZ#559962).
    Add Tamil translation (RHBZ#559877) (thanks to I.Felix)
    Update Punjabi translation (RHBZ#559480) (thanks Jaswinder Singh)
  - There are significant fixes to hive file handling.
  - Add hivexsh and manual page.
  - Remove two patches, now upstream.


author: Matthew Booth <mbooth@redhat.com> - 1.0.83-6
changelog:
  - Change buildnonet to buildnet
  - Allow buildnet, mirror, updates, virtio and runtests to be configured by user
    macros.


author: Richard W.M. Jones <rjones@redhat.com> - 1.0.83-7
changelog:
  - Disable tests.  These fail in Koji (on RHEL 5 kernel) because of a
    bug in preadv/pwritev emulation in glibc (RHBZ#563103).


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.0.84-4
changelog:
  - Don't include generator.ml in rpm.  It's 400K and almost no one will need it.
  - Add comments to spec file about how repo building works.
  - Whitespace changes in the spec file.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.0.84-6
changelog:
  - Fix quoting in supermin-split script (RHBZ#566511).
  - Don't include bogus './builddir' entries in supermin hostfiles
    (RHBZ#566512).


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.0.85-1
changelog:
  - New upstream version 1.0.85.
  - Remove hivex, now a separate upstream project and package.
  - Remove supermin quoting patch, now upstream.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.0.86-1
changelog:
  - New upstream version 1.0.86.
  - libguestfs-supermin-helper rewritten in C (from shell), reduces
    appliance boot time by 2-3 seconds.
  - Fix parsing of integers in guestfish on 32 bit platforms (RHBZ#569757
    and RHBZ#567567).
  - Enhance virt-inspector output for Windows guests.
  - Add product_name field to virt-inspector output for all guests.
  - Weaken dependencies on libntfs-3g.so, don't include SONAME in dep.
  - Remove false dependency on libply (plymouth libraries).
  - Spanish translation (RHBZ#570181).
  - Fix bash regexp quoting bug.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.0.87-1
changelog:
  - New upstream version 1.0.87.
  - New tools: virt-resize and virt-list-partitions.
  - New APIs: guestfs_copy_size; APIs for querying the relationship between
    LVM objects.
  - Add vim to the virt-rescue appliance.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.0.88-1
changelog:
  - New upstream version 1.0.88.
  - Mainly small bugfixes.
  - Update Spanish translation of libguestfs (RHBZ#576876).
  - Use ext4 dev tools on RHEL 5 (RHBZ#576688).
  - Add support for minix filesystem (RHBZ#576689).


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.0.88-7
changelog:
  - Backport of TERM=dumb patch from upstream.
  - Workaround failure caused by RHBZ#575734.
  - Workaround unknown failure of test_swapon_label_0.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.0.89-1
changelog:
  - New upstream version 1.0.89.
  - Improved version of virt-win-reg.
  - Many smaller bugfixes.
  - Requires hivex >= 1.2.1.
  - Remove TERM=dumb patch which is now upstream.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.3.1-1
changelog:
  - New upstream version 1.3.1.
  - For explanation of apparently large version jump, see:
    https://www.redhat.com/archives/libguestfs/2010-April/msg00057.html
  - New tool: virt-make-fs.
  - New API: guestfs_zero_device.
  - Fixes RHBZ#580246 (tar-in command hangs if uploading more than
    available space)
  - Fixes RHBZ#579664 (guestfish doesn't report error when there is not
    enough space for image allocation)
  - +BR perl-String-ShellQuote (for virt-make-fs).


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.3.2-1
changelog:
  - New upstream version 1.3.2.
  - New APIs: checksum-device, part-del, part-get-bootable, part-get-mbr-id,
    part-set-mbr-id, vgscan, ntfsresize, txz-in, txz-out.
  - Enhanced/fixed virt-resize tool.
  - Enhanced virt-list-partitions tool.
  - Fixes: 580016, 580650, 579155, 580556.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.3.3-1
changelog:
  - New upstream version 1.3.3.
  - New virt-resize option --LV-expand.
  - New API: lvresize-free.
  - Fixes RHBZ#581501.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.3.12-1
changelog:
  - New upstream version 1.3.12.
  - febootstrap >= 2.7 is required at compile time and at runtime (at runtime
    because of the new febootstrap-supermin-helper).
  - Bugs fixed: 591155 591250 576879 591142 588651 507810 521674 559963 516096.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.3.12-3
changelog:
  - Backport supermin build fix from upstream.
  - Further changes required for new layout of supermin appliance.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.3.13-1
changelog:
  - New upstream version 1.3.13.
  - Add BUGS to documentation.
  - Force update of hivex dependency to 1.2.2 since it contains
    important registry import fixes.
  - Remove patch1, now upstream.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.3.20-1
changelog:
  - New upstream version 1.3.20.
  - Since upstream commit a043b6854a0c4 we don't need to run make install
    twice.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.3.21-4
changelog:
  - Explicitly depend on e2fsprogs.
  - Add patch to add e2fsprogs to the appliance.
  - Add patch to fix GFS kernel module problem.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.5.0-4
changelog:
  - New development branch 1.5.0.
  - Remove two upstream patches.
  - Work around permanently broken test-getlogin_r Gnulib test.


author: Richard Jones <rjones@redhat.com> - 1:1.5.4-1
changelog:
  - New upstream development version 1.5.4.
  - Now requires febootstrap >= 2.8 and qemu >= 0.12.
  - Re-enable tests because RHBZ#624854 is supposed to be fixed.
  - Upstream Source URL has changed.


author: Richard Jones <rjones@redhat.com> - 1:1.5.8-1
changelog:
  - New upstream version 1.5.8.
  - Add BR po4a for translations of man pages.
  - Add PHP bindings.
  - Remove partially-translated Japanese webpages.


author: Richard Jones <rjones@redhat.com> - 1:1.5.13-1
changelog:
  - New upstream version 1.5.13.
  - Removed the patch workaround for RHBZ#630583.  The same workaround
    is now upstream (the bug is not fixed).


author: Richard Jones <rjones@redhat.com> - 1:1.5.18-1
changelog:
  - New upstream development version 1.5.18.
  - Note that guestfish '-a' and '-d' options were broken in 1.5.17, so
    upgrading to this version is highly recommended.


author: Richard Jones <rjones@redhat.com> - 1:1.5.23-1
changelog:
  - Fix for libguestfs: missing disk format specifier when adding a disk
    (RHBZ#642934, CVE-2010-3851).


author: Richard Jones <rjones@redhat.com> - 1:1.5.25-1
changelog:
  - New upstream development version 1.5.25.
  - Rewritten virt-inspector.
  - Requires febootstrap >= 2.10.
  - New virt-inspector requires db_dump program.


author: Richard Jones <rjones@redhat.com> - 1:1.7.4-2
changelog:
  - New upstream development version 1.7.4.
  - ocaml-xml-light is no longer required.
  - Remove guestfs-actions.h and guestfs-structs.h.  Libguestfs now
    only exports a single <guestfs.h> header file.
  - Add patch to fix broken Perl test.
  - Remove workaround for RHBZ#563103.


author: Richard Jones <rjones@redhat.com> - 1:1.7.5-2
changelog:
  - New upstream development version 1.7.5.
  - Remove hand-installation of Ruby bindings.
  - Remove upstream patch.


author: Richard Jones <rjones@redhat.com> - 1:1.7.7-1
changelog:
  - New upstream development version 1.7.7.
  - Rename perl-libguestfs as perl-Sys-Guestfs (RHBZ#652587).


author: Richard Jones <rjones@redhat.com> - 1:1.7.8-1
changelog:
  - New upstream development version 1.7.8.
  - Add Obsoletes so perl-Sys-Guestfs overrides perl-libguestfs (RHBZ#652587).


author: Richard Jones <rjones@redhat.com> - 1:1.7.11-1
changelog:
  - New upstream development version 1.7.11.
  - Fix Source0 URL which had pointed to the 1.5 directory.
  - virt-inspector is not a dependency of guestmount.


author: Richard Jones <rjones@redhat.com> - 1:1.7.12-1
changelog:
  - New upstream development version 1.7.12.
  - New tool: virt-filesystems.  virt-list-filesystems and virt-list-partitions
    are deprecated, but still included in the package.


author: Richard Jones <rjones@redhat.com> - 1:1.7.13-3
changelog:
  - New upstream development version 1.7.13.
  - New manual pages containing example code.
  - Ship examples for C, OCaml, Ruby, Python.
  - Don't ship HTML versions of man pages.
  - Rebase no-fuse-test patch to latest version.


author: Richard Jones <rjones@redhat.com> - 1:1.7.15-2
changelog:
  - New upstream development version 1.7.15.
  - Split out new libguestfs-tools-c package from libguestfs-tools.
    . This is so that the -tools-c package can be pulled in by people
      wanting to avoid a dependency on Perl, while -tools pulls in everything
      as before.
    . The C tools currently are: cat, df, filesystems, fish, inspector, ls,
      mount, rescue.
    . guestfish still requires pod2text which requires perl.  This will be
      rectified in the next release.
    . libguestfs-tools no longer pulls in guestfish.
  - guestfish also depends on: less, man, vi
  - Add BR db4-utils (although since RPM needs it, it not really necessary).
  - Runtime requires on db4-utils should be on core lib, not tools package.
  - Change all "Requires: perl-Foo" to "Requires: perl(Foo)".


author: Richard Jones <rjones@redhat.com> - 1:1.7.16-1
changelog:
  - New upstream development version 1.7.16.
  - guestfish no longer requires pod2text, hence no longer requires perl.
  - Require febootstrap >= 2.11.


author: Richard Jones <rjones@redhat.com> - 1:1.7.19-1
changelog:
  - New upstream development version 1.7.19.
  - Appliance building in this version has been substantially rewritten
    and this requires febootstrap >= 3.0 to build.
  - createrepo no longer required.
  - Supermin appliance is the default.


author: Richard Jones <rjones@redhat.com> - 1:1.7.22-1
changelog:
  - New upstream version 1.7.22.
  - Depend on febootstrap 3.3 which fixes the checksum stability problem.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.9.2-1
changelog:
  - New upstream version 1.9.2.
  - New tools: virt-copy-in, virt-copy-out, virt-tar-in, virt-tar-out.
    These are just shell script wrappers around guestfish so they are
    included in the guestfish package.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.9.7-6
changelog:
  - Add temporary non-upstream patch to fix /etc/mtab.
    See: https://www.redhat.com/archives/libguestfs/2011-February/msg00006.html
  - Add fix for regressions/rhbz557655.sh so it works when tracing is enabled.
  - Add guestfs-perl(3) man page.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.9.7-7
changelog:
  - Rebuild against rpm-4.9.0-0.beta1.6.fc15 to fix OCaml deps.  See discussion:
    http://lists.fedoraproject.org/pipermail/devel/2011-February/148398.html


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.9.14-1
changelog:
  - New upstream version 1.9.14.
  - Include 'acl' as BR so virt-rescue gets getfacl and setfacl programs.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.9.15-1
changelog:
  - New upstream version 1.9.15.
  - Add BR libconfig-devel.
  - Add /etc/libguestfs-tools.conf (config file for guestfish, guestmount,
    virt-rescue; in future for other tools as well).


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.9.18-2
changelog:
  - New upstream version 1.9.18.
  - Requires ocaml-pcre for new virt-resize.
  - Remove libguestfs-test-tool-helper program which is no longer used.
  - Include upstream fix for virt-resize build.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.11.0-1
changelog:
  - New upstream development branch 1.11.0.
  - New Source URL.
  - Remove patches which are now upstream.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.11.2-1
changelog:
  - New upstream version 1.11.2.
  - Fixes Python bindings when used in Python threads.
  - Remove upstream patch.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.11.5-1
changelog:
  - New upstream version 1.11.5.
  - virt-edit has been rewritten in C, therefore this tool has been moved
    into the libguestfs-tools-c package.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.11.7-3
changelog:
  - New upstream version 1.11.7.
  - Depends on hivex >= 1.2.7.
  - Remove upstream patch.
  - Skip test of "zero" command (RHBZ#705499).


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.11.9-7
changelog:
  - Build against new parted.
  - Disable tests on i686 because of RHBZ#710921.
  - Remove recipes/ doc directory.  This is no longer present because it
    was replaced by a guestfs-recipes(1) man page.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.11.10-1
changelog:
  - New upstream version 1.11.10.
  - Enable tests since fix for RHBZ#710921 is in Rawhide kernel package.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.11.10-3
changelog:
  - Temporarily stop setting CCFLAGS in perl subdirectory.
    See: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=628522


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.11.13-2
changelog:
  - Add libguestfs-live-service subpackage.  This can be installed in
    virtual machines in order to enable safe editing of files in running
    guests (eg. guestfish --live).


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.11.13-3
changelog:
  - Further updates to libguestfs-live-service after feedback from
    Dan Berrange and Lennart Poettering.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.11.18-1
changelog:
  - New upstream version 1.11.18.
  - Force febootstrap >= 3.7 which contains a fix for latest Rawhide.
  - Use --enable-install-daemon to install guestfsd.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.11.20-1
changelog:
  - New upstream version 1.11.20.
  - Replace standard README file with one suited for Fedora.
  - Add guestfs-java(3) manpage to libguestfs-java-devel package.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.12.0-1
changelog:
  - New stable version 1.12.0 for Fedora 16.
  - Remove upstream patch.
  - Disable tests on i686 (because of RHBZ#723555).


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.12.1-4
changelog:
  - New upstream stable branch version 1.12.1.
  - Remove 5 x upstream patches.
  - Add non-upstream patch to deal with broken qemu -machine option.
  - Add upstream patch to fix segfault in OCaml bindings.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.13.2-3
changelog:
  - Switch Rawhide to use the new development branch (1.13).
  - New upstream version 1.13.2.
  - Remove upstream patch.
  - Ensure config.log is printed, even in the error case.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.13.3-4
changelog:
  - New upstream version 1.13.3.
  - 'test-getlogin_r.c:55: assertion failed' test must now be fixed in
    gnulib/tests directory instead of daemon/tests (the latter directory
    no longer exists).
  - Only run testsuite on x86_64 because of qemu bug.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.13.7-1
changelog:
  - New upstream version 1.13.7.
  - configure --with-extra version string contains Fedora release.
  - Build with make V=1 to display full compile commands.
  - Remove /usr/sbin PATH setting, not used for a very long time.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.13.12-4
changelog:
  - Don't require grub.  See RHBZ#737261.
  - Note this (hopefully temporarily) breaks guestfs_grub_install API.
  - Include upstream patch to add guestfs_grub_install into an optional group.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.13.15-1
changelog:
  - New upstream version 1.13.15.
  - Add lzop program to the appliance (for compress-out API).
  - Remove upstream patch.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.13.15-2
changelog:
  - Rearrange description to make it clearer.
  - virt-resize was written in OCaml.  Move it to libguestfs-tools-c
    subpackage since it doesn't require Perl.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.13.19-1
changelog:
  - New upstream version 1.13.19.
  - New tool: virt-sysprep.
  - Remove the old guestfish and libguestfs-mount packages, and put these
    tools into libguestfs-tools.  This change is long overdue, but is also
    necessitated by the new virt-sysprep tool.  This new tool would pull
    in guestfish anyway, so having separate packages makes no sense.
  - Remove old obsoletes for virt-cat, virt-df, virt-df2 and virt-inspector,
    since those packages existed only in much older Fedora.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.13.21-2
changelog:
  - New upstream version 1.13.21.
  - Move virt-sysprep to libguestfs-tools, to avoid pulling in extra
    dependencies for RHEV-H.  This tool is not likely to be useful
    for RHEV-H in its current form anyway.
  - Change BR cryptsetup-luks -> cryptsetup since that package changed.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.13.21-4
changelog:
  - Add upstream patch to skip FUSE tests if there is no /dev/fuse.
    This allows us also to remove the Fedora-specific patch which
    disabled these tests before.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.13.22-2
changelog:
  - New upstream version 1.13.22.
  - Remove 3x upstream patches.
  - Renumber the two remaining non-upstream patches as patch0, patch1.
  - Rebase patch1.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.13.24-1
changelog:
  - New upstream version 1.13.24.
  - This version includes upstream workarounds for broken qemu, so both
    non-upstream patches have now been removed from Fedora.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.15.2-1
changelog:
  - New upstream version 1.15.2.
  - ocaml-pcre is no longer required for virt-resize.
  - xmlstarlet is no longer required for virt-sysprep.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.15.4-2
changelog:
  - New upstream version 1.15.4.
  - Remove patch which is now upstream.
  - libguestfs_jni.a is no longer built.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.15.9-2
changelog:
  - New upstream version 1.15.9.
  - Add upstream patch to fix Augeas library detection.
  - Appliance explicitly requires libxml2 (because Augeas >= 0.10 requires it),
    although it was implicitly included already.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.15.13-4
changelog:
  - New upstream version 1.15.13.
  - Fixes Security: Mitigate possible privilege escalation via SG_IO ioctl
    (CVE-2011-4127, RHBZ#757071).
  - Add three upstream patches to fix 'make check'.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.15.15-2
changelog:
  - New upstream version 1.15.15.
  - Updated gnulib fixes builds with gcc 4.7.
  - Rebuild for OCaml 3.12.1.
  - Add explicit BR perl-hivex, required for various Perl virt tools.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.15.19-1
changelog:
  - New upstream version 1.15.19.
  - +BR psmisc for the appliance.
  - Includes GObject bindings in libguestfs-gobject and
    libguestfs-gobject-devel subpackages.
  - Include upstream patches for PHP 5.4.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.16.0-1
changelog:
  - New upstream version 1.16.0.
  - Remove patches which are now upstream.
  - GObject: Move *.typelib file to base gobject package.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.17.2-2
changelog:
  - New upstream version 1.17.2.
  - Use libdb-utils instead of old db4-utils.
  - net-tools is no longer used; replaced by iproute (RHBZ#784647).
  - Try re-enabling tests on i686.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.17.3-2
changelog:
  - New upstream version 1.17.3.
  - Remove patch now upstream.
  - Add upstream patch to fix OCaml bytecode compilation.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.17.6-1
changelog:
  - +BR ruby-irb.
  - Make virtio unconditional.  It's been a very long time since disabling
    virtio was a good idea.
  - Disable some packages not available in RHEL 7.
  - New upstream version 1.17.6.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.17.11-2
changelog:
  - Require netpbm-progs, icoutils.  These are needed for icon generation
    during inspection, but were not being pulled in before.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.17.22-2
changelog:
  - Include all gobject header files.
  - Include gtk-doc, and depend on the gtk-doc package at runtime.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.17.38-3
changelog:
  - Remove explicit runtime deps for old virt-sysprep.
  - Add explicit runtime dep on fuse (RHBZ#767852, thanks Pádraig Brady).
  - Remove explicit versioned dep on glibc.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.19.2-3
changelog:
  - Remove obsolete list of bugs in make check rule.
  - Remove some obsolete test workarounds.
  - Disable i386 tests (because of RHBZ#825944).


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.19.6-1
changelog:
  - New upstream version 1.19.6.
  - This version defaults to using virtio-scsi.
  - Requires qemu >= 1.0.
  - Requires febootstrap >= 3.15.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.19.28-3
changelog:
  - New upstream version 1.19.28.
  - Update libguestfs-find-requires to generate ordinary lib dependencies.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.19.29-2
changelog:
  - New upstream version 1.19.29.
  - Remove RELEASE NOTES from doc section, and add equivalent man page.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.19.33-3
changelog:
  - Fix Perl examples directory so we only include the examples.
  - Add Java examples to java-devel RPM.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.19.36-1
changelog:
  - Switch to using libvirt as the backend for running the appliance.  See:
    https://www.redhat.com/archives/libguestfs/2012-August/msg00070.html
  - Use configure RPM macro instead of ./configure.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.19.40-3
changelog:
  - Add (non-upstream) patch to add the noapic flag on the kernel
    command line on i386 only.  This works around a bug in 32-bit qemu.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.19.44-2
changelog:
  - Enable sVirt (NB: requires libvirt >= 0.10.2-3, selinux-policy >= 3.11.1-23).
  - Add upstream patch to label the custom $TMPDIR used in test-launch-race.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.19.56-3
changelog:
  - Add upstream patch to disable virt-format test, and disable
    it because wipefs utility is broken.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.19.63-2
changelog:
  - Remove non-upstream patch designed to work around
    https://bugzilla.redhat.com/show_bug.cgi?id=857026
    to see if this has been fixed.
  - Re-enable tests on i686 to see if
    https://bugzilla.redhat.com/show_bug.cgi?id=870042
    has been fixed.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.19.63-3
changelog:
  - Re-add: Non-upstream patch to add the noapic flag on the kernel
    command line on i386 only.  This works around a bug in 32-bit qemu,
    https://bugzilla.redhat.com/show_bug.cgi?id=857026


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.20.0-1
changelog:
  - New upstream version 1.20.0.
  - New source URL for this branch.
  - Reconcile upstream packagelist, BRs and Requires lists.
  - Requires newest SELinux policy so that SVirt works.
  - Fix patch 2.  Actually, remove and replace with a small script.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.20.0-2
changelog:
  - Use 'make check -k' so we get to see all test failures at once.
  - For RHEL 7:
    * Do not depend on perl(Expect) (only needed to test virt-rescue).
    * Depend on /usr/bin/qemu-img instead of qemu-img package, since the
      package name (but not the binary) is different in RHEL 7.
    * Add workaround for libvirt/KVM bug RHBZ#878406.
    * Do not depend on libvirt-daemon-qemu.
    * Do not depend on libldm (not yet in RHEL 7: RHBZ#887894).


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.20.0-5
changelog:
  - Remove RHEL-conditionals, since I have branched spec file for RHEL 7.
  - Add BR gdisk.
  - Change to using git to manage patches.
  - Add copy-patches.sh script.
  - Disable libguestfs live (RHEL only).
  - "Fedora" -> "RHEL" in replacement README file.
  - "fedora" -> "rhel" in version extra field.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.20.1-4
changelog:
  - Go over all non-upstream patches from RHEL 6 and add appropriate ones
    to RHEL 7:
    * Emphasize libguestfs-winsupport.
    * Remove libguestfs-live ('unix' attach-method).
    * Exclude iptables.
    * Ignore /etc/release file if /etc/redhat-release file exists.
    resolves: rhbz#889536, rhbz#889537, rhbz#889538, rhbz#873219
  - Do not number patches.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.20.2-1
changelog:
  - New upstream version 1.20.2.
  - Synchronize list of tests to be skipped with local list.
  - Use openjdk instead of java (GCJ).
  - Add BRs: libcap.
  - Ship the gobject pkgconfig file.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.20.5-1
changelog:
  - New upstream version 1.20.5.
  - Remove ruby vendor patch.
  - Set INSTALLDIRS=vendor on both make and make install rules.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.20.5-2
changelog:
  - Remove deprecated programs virt-tar, virt-list-filesystems and
    virt-list-partitions from RHEL 7.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.20.5-4
changelog:
  - In RHEL 7, 'ruby(abi)' has been replaced by 'ruby(release)'
    and the version of the ruby ABI/release is now 2.0.0.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.21.33-1.el7
changelog:
  - New upstream version 1.21.33.
  - Rebuild for renamed Kerberos library.
    resolves: rhbz#957616
  - Skip gnulib tests which fail.
  - Skip NBD test since there is no NBD in RHEL.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.22.2-1
changelog:
  - New upstream version 1.22.2.
  - Do not need to remove guestfsd man page, since libguestfs no longer
    installs it.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.22.4-2
changelog:
  - New upstream stable version 1.22.4.
  - Move virt-sysprep to libguestfs-tools-c package
    resolves: rhbz#975573
  - Remove 9p APIs from RHEL
    resolves: rhbz#921710
  - Reenable swapon test
    resolves: rhbz#911674
  - Reenable file architecture test
    resolves: rhbz#911678
  - Fix mkfs blocksize option when using xfs
    resolves: rhbz#976250
  - Fix double-free when kernel link fails during launch
    resolves: rhbz#983691
  - Fix disk-format "JSON parse error" when target file does not exist
    resolves: rhbz#980338
  - Fix documentation for acl-set-file
    resolves: rhbz#985856
  - libguestfs-devel should depend on full ENVR of libguestfs-tools-c.
  - Require /usr/bin/vi instead of /bin/vi for UsrMove.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.22.5-2
changelog:
  - New upstream stable version 1.22.5.
  - Fix virt-sysprep --firstboot option
    resolves: rhbz#988862
  - Disable unsupported remote drives
    resolves: rhbz#962113
  - cap-get-file returns empty string instead of error if no capabilities
    resolves: rhbz#989356


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.22.6-4
changelog:
  - New upstream stable version 1.22.6.
    resolves: rhbz#995712, rhbz#998750, rhbz#998485
  - Backport set-UUID API and related
    resolves: rhbz#995176
  - Enable kvmclock
    resolves: rhbz#998109
  - Add upstream APIs guestfs_add_drive_scratch, guestfs_remount.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.22.6-5
changelog:
  - Various fixes to tar-out 'excludes'
    resolves: rhbz#1001875
  - Document use of glob + rsync-out
    resolves: rhbz#1001876
  - Document mke2fs blockscount
    resolves: rhbz#1002032
  - Fix virt-format MBR partition type byte, add --label option to
    virt-format and virt-make-fs, and allow labels to be set on DOS filesystems
    resolves: rhbz#1000428
  - Fix javadoc location to use _javadocdir macro.
  - Call ldconfig in java post and postun scripts.
  - Do not explicitly depend on perl-devel.
  - Compress the ChangeLog and *.xml files in devel package.
  - Create new subpackage gobject-doc for the huge HTML documentation.
  - Make javadoc, gobject-doc, bash-completion, man-pages-*, tools packages
    'noarch'.
  - Enable gzip-compressed appliance.
  - Note this requires supermin >= 4.1.4.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.22.6-8
changelog:
  - Backport 'cachemode' property of 'add_drive'
    resolves: rhbz#1003291
  - Improve error reporting from aug_init
    related: rhbz# 1003685


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.22.6-9
changelog:
  - Use 'host-passthrough' instead of 'host-model' (RHBZ#1011922)
  - Fix mount-loop failed to setup loop device: No such file or directory
    resolves: rhbz#1011907


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.22.6-10
changelog:
  - Fix CVE-2013-4419: insecure temporary directory handling for
    guestfish's network socket
    resolves: rhbz#1019503


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.22.6-11
changelog:
  - Further fixes for kvmclock
    resolves: rhbz#998109
  - Document that blockdev-setbsz is deprecated and should not be used
    resolves: rhbz#1016465


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.22.6-12
changelog:
  - Backport: "daemon: Fix xfs_info parser because of new format."
    which is required to fix libguestfs tests.
    related: rhbz#1019503


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.22.6-15
changelog:
  - Add libguestfs-tools.conf(5) man page
    resolves: rhbz#1019891
  - Drop PHP bindings
    resolves: rhbz#1020021
  - Disable Haskell & Erlang (in case someone has these dependencies
    installed and tries to rebuild the package).


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.22.6-19
changelog:
  - Fix placement of *.py[co] files
    resolves: rhbz#1061155
  - Remove bogus license file from daemon
    resolves: rhbz#1061160
  - Prevent virt-sparsify from overwriting block or char devices
    resolves: rhbz#1056556
  - mount-local should give a clearer error if root is not mounted
    resolves: rhbz#1057492


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.22.6-21
changelog:
  - Fix segfault in guestfs_list_filesystems when presented with a
    corrupt btrfs filesystem
    resolves: rhbz#1064008


author: Paul Wouters <pwouters@redhat.com> - 3.5-1
changelog:
  - Initial package for RHEL7
  - Added interop patch for (some?) Cisco VPN clients sending 16 zero
    bytes of extraneous IKE data
  - Removed fipscheck_version


author: Paul Wouters <pwouters@redhat.com> - 3.6-1
changelog:
  - Updated to version 3.6 (IKEv2, MODECFG, Cisco interop fixes)
  - Generate empty NSS db if none exists
  - FIPS update using /etc/system-fips
  - Provide: openswan-doc


author: Paul Wouters <pwouters@redhat.com> - 3.8-1
changelog:
  - Resolves: rhbz#CVE-2013-6467 
  - Resolves: rhbz#1043642 rebase to version 3.8
  - Resolves: rhbz#1029912 ipsec force-reload doesn't work
  - Resolves: rhbz#826261 Implement SHA384/512 support for Openswan
  - Resolves: rhbz#1039655 ipsec newhostkey generates false configuration


author: Paul Wouters <pwouters@redhat.com> - 3.8-3
changelog:
  - Resolves: rhbz#1069024  erroneous debug line with mixture [...]
  - Resolves: rhbz#1030939 update nss/x509 documents, don't load acerts
  - Resolves: rhbz#1058813 newhostkey returns zero value when it fails


author: Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de> 0:0.2.5-0.fdr.1
changelog:
  - updated to 0.2.5
  - changed license to LGPL
  - rearranged %check to reflect execution order
  - minor cosmetical changes


author: Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de> - 1.3-1
changelog:
  - updated to 1.3 (#426488, #431334)
  - use wrapper around libtasn1-config which should make it multilib
    safe (#342411); this implies an untagged 'Requires: pkgconfig' for
    -devel now
  - conditionalized BR of valgrind (#401041)


author: Tomas Mraz <tmraz@redhat.com> - 2.2-1
changelog:
  - updated to new upstream version
  - SMP build should work now
  - drop fix for spurious rpath - no longer necessary


author: Daniel Veillard <veillard@redhat.com> 0.0.6-1
changelog:
  - added error handling APIs
  - small bug fixes
  - improve python bindings
  - augment documentation and regression tests


author: Daniel Veillard <veillard@redhat.com> 0.1.0-1
changelog:
  - various fixes
  - new APIs: for Node information and Reboot
  - virsh improvements and extensions
  - documentation updates and man page
  - enhancement and fixes of the XML description format


author: Daniel Veillard <veillard@redhat.com> 0.1.1-1
changelog:
  - extend and cleanup the driver infrastructure and code
  - python examples
  - extend uuid support
  - bug fixes, buffer handling cleanups
  - support for new Xen hypervisor API
  - test driver for unit testing
  - virsh --conect argument


author: Daniel Veillard <veillard@redhat.com> 0.1.4-1
changelog:
  - vCPUs and affinity support
  - more complete XML, console and boot options
  - specific features support
  - enforced read-only connections
  - various improvements, bug fixes


author: Daniel Veillard <veillard@redhat.com> 0.1.5-1
changelog:
  - new release
  - bug fixes
  - support for new hypervisor calls
  - early code for config files and defined domains


author: Daniel Veillard <veillard@redhat.com> 0.1.6-1
changelog:
  - Support for localization
  - Support for new Xen-3.0.3 cdrom and disk configuration
  - Support for setting VNC port
  - Fix bug when running against xen-3.0.2 hypercalls
  - Fix reconnection problem when talking directly to http xend


author: Daniel Veillard <veillard@redhat.com> 0.1.7-1
changelog:
  - Fix bug when running against xen-3.0.3 hypercalls
  - Fix memory bug when getting vcpus info from xend


author: Daniel Veillard <veillard@redhat.com> 0.1.8-1
changelog:
  - fix missing page size detection code for ia64
  - fix mlock size when getting domain info list from hypervisor
  - vcpu number initialization
  - don't label crashed domains as shut off
  - fix virsh man page
  - blktapdd support for alternate drivers like blktap
  - memory leak fixes (xend interface and XML parsing)
  - compile fix
  - mlock/munlock size fixes


author: Daniel Veillard <veillard@redhat.com> 0.1.9-1
changelog:
  - better error reporting
  - python bindings fixes and extensions
  - add support for shareable drives
  - add support for non-bridge style networking
  - hot plug device support
  - added support for inactive domains
  - API to dump core of domains
  - various bug fixes, cleanups and improvements
  - updated the localization


author: Daniel Veillard <veillard@redhat.com> 0.1.10-1.fc7
changelog:
  - support for inactive Xen domains
  - improved support for Xen display and vnc
  - a few bug fixes
  - localization updates


author: Daniel P. Berrange <berrange@redhat.com> - 0.2.0-2.fc7
changelog:
  - Fixed path to qemu daemon for autostart
  - Fixed generation of <features> block in XML
  - Pre-create config directory at startup


author: Daniel P. Berrange <berrange@redhat.com> - 0.2.0-3.fc7
changelog:
  - Disable kqemu support since its not in Fedora qemu binary
  - Fix for -vnc arg syntax change in 0.9.0  QEMU


author: Daniel Veillard <veillard@redhat.com> - 0.2.1-1
changelog:
  - Release of 0.2.1
  - lot of bug and portability fixes
  - Add support for network autostart and init scripts
  - New API to detect the virtualization capabilities of a host
  - Documentation updates


author: Jeremy Katz <katzj@redhat.com> - 0.2.1-2.fc7
changelog:
  - don't require xen; we don't need the daemon and can control non-xen now
  - fix scriptlet error (need to own more directories)
  - update description text


author: Daniel Veillard <veillard@redhat.com> - 0.2.3-1
changelog:
  - Release of 0.2.3
  - lot of assorted bugfixes and cleanups
  - support for Xen-3.1
  - new scheduler API


author: Daniel Veillard <veillard@redhat.com> - 0.3.0-1
changelog:
  - Release of 0.3.0
  - Secure remote access support
  - unification of daemons
  - lots of assorted bugfixes and cleanups
  - documentation and localization improvements


author: Daniel Veillard <veillard@redhat.com> - 0.3.1-1
changelog:
  - Release of 0.3.1
  - localtime clock support
  - PS/2 and USB input devices
  - lots of assorted bugfixes and cleanups
  - documentation and localization improvements


author: Daniel Veillard <veillard@redhat.com> - 0.3.2-1
changelog:
  - Release of 0.3.2
  - API for domains migration
  - APIs for collecting statistics on disks and interfaces
  - lots of assorted bugfixes and cleanups
  - documentation and localization improvements


author: Daniel Veillard <veillard@redhat.com> - 0.3.3-1
changelog:
  - Release of 0.3.3
  - Avahi support
  - NUMA support
  - lots of assorted improvements, bugfixes and cleanups
  - documentation and localization improvements


author: Daniel Veillard <veillard@redhat.com> - 0.4.0-1
changelog:
  - Release of 0.4.0
  - SASL based authentication
  - PolicyKit authentication
  - improved NUMA and statistics support
  - lots of assorted improvements, bugfixes and cleanups
  - documentation and localization improvements


author: Daniel Veillard <veillard@redhat.com> - 0.4.1-1
changelog:
  - Release of 0.4.1
  - Storage APIs
  - xenner support
  - lots of assorted improvements, bugfixes and cleanups
  - documentation and localization improvements


author: Daniel Veillard <veillard@redhat.com> - 0.7.0-1
changelog:
  - ESX, VBox3, Power Hypervisor drivers
  - new net filesystem glusterfs
  - Storage cloning for LVM and Disk backends
  - interface implementation based on netcf
  - Support cgroups in QEMU driver
  - QEmu hotplug NIC support
  - a lot of fixes


author: Mark McLoughlin <markmc@redhat.com> - 0.7.0-2
changelog:
  - Make sure qemu can access kernel/initrd (bug #516034)
  - Set perms on /var/lib/libvirt/boot to 0711 (bug #516034)


author: Mark McLoughlin <markmc@redhat.com> - 0.7.0-5
changelog:
  - Add PCI host device hotplug support
  - Allow PCI bus reset to reset other devices (#499678)
  - Fix stupid PCI reset error message (bug #499678)
  - Allow PM reset on multi-function PCI devices (bug #515689)
  - Re-attach PCI host devices after guest shuts down (bug #499561)
  - Fix list corruption after disk hot-unplug
  - Fix minor 'virsh nodedev-list --tree' annoyance


author: Mark McLoughlin <markmc@redhat.com> - 0.7.1-0.2.gitfac3f4c
changelog:
  - Update to newer snapshot of 0.7.1
  - Stop libvirt using untrusted 'info vcpus' PID data (#520864)
  - Support relabelling of USB and PCI devices
  - Enable multipath storage support
  - Restart libvirtd upon RPM upgrade


author: Daniel Veillard <veillard@redhat.com> - 0.7.1-1
changelog:
  - Upstream release of 0.7.1
  - ESX, VBox driver updates
  - mutipath support
  - support for encrypted (qcow) volume
  - compressed save image format for Qemu/KVM
  - QEmu host PCI device hotplug support
  - configuration of huge pages in guests
  - a lot of fixes


author: Mark McLoughlin <markmc@redhat.com> - 0.7.1-8
changelog:
  - Disable sound backend, even when selinux is disabled (#524499)
  - Re-label qcow2 backing files (#497131)


author: Mark McLoughlin <markmc@redhat.com> - 0.7.1-10
changelog:
  - Create /var/log/libvirt/{lxc,uml} dirs for logrotate
  - Make libvirt-python dependon on libvirt-client
  - Sync misc minor changes from upstream spec


author: Mark McLoughlin <markmc@redhat.com> - 0.7.1-11
changelog:
  - Fix libvirtd memory leak during error reply sending (#528162)
  - Add several PCI hot-unplug typo fixes from upstream


author: Daniel Veillard <veillard@redhat.com> - 0.7.2-1
changelog:
  - Upstream release of 0.7.2
  - Allow to define ESX domains
  - Allows suspend and resulme of LXC domains
  - API for data streams
  - many bug fixes


author: Daniel Veillard <veillard@redhat.com> - 0.7.4-1
changelog:
  - upstream release of 0.7.4
  - udev node device backend
  - API to check object properties
  - better QEmu monitor processing
  - MAC address based port filtering for qemu
  - support IPv6 and multiple addresses per interfaces
  - a lot of fixes


author: Daniel Veillard <veillard@redhat.com> - 0.7.5-1
changelog:
  - Add new API virDomainMemoryStats
  - Public API and domain extension for CPU flags
  - vbox: Add support for version 3.1
  - Support QEMU's virtual FAT block device driver
  - a lot of fixes


author: Daniel Veillard <veillard@redhat.com> - 0.7.6-1
changelog:
  - upstream release of 0.7.6
  - Use QEmu new device adressing when possible
  - Implement CPU topology support for QEMU driver
  - Implement SCSI controller hotplug/unplug for QEMU
  - Implement support for multi IQN
  - a lot of fixes and improvements


author: Adam Jackson <ajax@redhat.com> 0.7.6-2
changelog:
  - libvirt-0.7.6-add-needed.patch: Fix FTBFS from --no-add-needed
  - Add BuildRequires: xmlrpc-c-client for libxmlrpc_client.so


author: Daniel Veillard <veillard@redhat.com> - 0.7.7-1
changelog:
  - macvtap support
  - async job handling
  - virtio channel
  - computing baseline CPU
  - virDomain{Attach,Detach}DeviceFlags
  - assorted bug fixes and lots of cleanups


author: Cole Robinson <crobinso@redhat.com> - 0.7.7-2.fc14
changelog:
  - Fix USB devices by product with security enabled (bz 574136)
  - Set kernel/initrd in security driver, fixes some URL installs (bz 566425)


author: Daniel Veillard <veillard@redhat.com> - 0.8.0-1
changelog:
  - Upstream release 0.8.0
  - Snapshotting support (QEmu/VBox/ESX)
  - Network filtering API
  - XenAPI driver
  - new APIs for domain events
  - Libvirt managed save API
  - timer subselection for domain clock
  - synchronous hooks
  - API to update guest CPU to host CPU
  - virDomainUpdateDeviceFlags new API
  - migrate max downtime API
  - volume wiping API
  - and many bug fixes


author: Daniel Veillard <veillard@redhat.com> - 0.8.1-1
changelog:
  - Upstream release 0.8.1
  - Starts dnsmasq from libvirtd with --dhcp-hostsfile
  - Add virDomainGetBlockInfo API to query disk sizing
  - a lot of bug fixes and cleanups


author: Daniel Veillard <veillard@redhat.com> - 0.8.2-1
changelog:
  - Upstream release 0.8.2
  - phyp: adding support for IVM
  - libvirt: introduce domainCreateWithFlags API
  - add 802.1Qbh and 802.1Qbg switches handling
  - Support for VirtualBox version 3.2
  - Init script for handling guests on shutdown/boot
  - qemu: live migration with non-shared storage for kvm


author: Daniel P. Berrange <berrange@redhat.com> - 0.8.2-2
changelog:
  - CVE-2010-2237 ignoring defined main disk format when looking up disk backing stores
  - CVE-2010-2238 ignoring defined disk backing store format when recursing into disk
    image backing stores
  - CVE-2010-2239 not setting user defined backing store format when creating new image
  - CVE-2010-2242 libvirt: improperly mapped source privileged ports may allow for
    obtaining privileged resources on the host


author: Daniel Veillard <veillard@redhat.com> - 0.8.5-1
changelog:
  - Enable JSON and netdev features in QEMU >= 0.13
  - framework for auditing integration
  - framework DTrace/SystemTap integration
  - Setting the number of vcpu at boot
  - Enable support for nested SVM
  - Virtio plan9fs filesystem QEMU
  - Memory parameter controls
  - various improvements and bug fixes


author: Daniel Veillard <veillard@redhat.com> - 0.8.7-1
changelog:
  - Preliminary support for VirtualBox 4.0
  - IPv6 support
  - Add VMware Workstation and Player driver driver
  - Add network disk support
  - Various improvements and bug fixes
  - from 0.8.6:
  - Add support for iSCSI target auto-discovery
  - QED: Basic support for QED images
  - remote console support
  - support for SPICE graphics
  - sysinfo and VMBIOS support
  - virsh qemu-monitor-command
  - various improvements and bug fixes


author: Daniel Veillard <veillard@redhat.com> - 0.8.8-1
changelog:
  - expose new API for sysinfo extraction
  - cgroup blkio weight support
  - smartcard device support
  - qemu: Support per-device boot ordering
  - Various improvements and bug fixes


author: Daniel Veillard <veillard@redhat.com> - 0.9.0-1
changelog:
  - Support cputune cpu usage tuning
  - Add public APIs for storage volume upload/download
  - Add public API for setting migration speed on the fly
  - Add libxenlight driver
  - qemu: support migration to fd
  - libvirt: add virDomain{Get,Set}BlkioParameters
  - setmem: introduce a new libvirt API (virDomainSetMemoryFlags)
  - Expose event loop implementation as a public API
  - Dump the debug buffer to libvirtd.log on fatal signal
  - Audit support
  - Various improvements and bug fixes


author: Daniel Veillard <veillard@redhat.com> - 0.9.1-1
changelog:
  - support various persistent domain updates
  - improvements on memory APIs
  - Add virDomainEventRebootNew
  - various improvements to libxl driver
  - Spice: support audio, images and stream compression
  - Various improvements and bug fixes


author: Richard W.M. Jones <rjones@redhat.com> - 0.9.1-3
changelog:
  - Add upstream patches:
      0001-json-Avoid-passing-large-positive-64-bit-integers-to.patch
      0001-qemudDomainMemoryPeek-change-ownership-selinux-label.patch
      0002-remote-remove-bogus-virDomainFree.patch
    so that users can try out virt-dmesg.
  - Change /var/cache mode to 0711.


author: Daniel Veillard <veillard@redhat.com> - 0.9.2-1
changelog:
  - Framework for lock manager plugins
  - API for network config change transactions
  - flags for setting memory parameters
  - virDomainGetState public API
  - qemu: allow blkstat/blkinfo calls during migration
  - Introduce migration v3 API
  - Defining the Screenshot public API
  - public API for NMI injection
  - Various improvements and bug fixes


author: Laine Stump <laine@redhat.com> - 0.9.2-2
changelog:
  - add rule to require netcf-0.1.8 during build so that new transactional
    network change APIs are included.
  - document that CVE-2011-2178 has been fixed (by virtue of rebase
    to 0.9.2 - see https://bugzilla.redhat.com/show_bug.cgi?id=709777)


author: Daniel Veillard <veillard@redhat.com> - 0.9.3-1
changelog:
  - new API virDomainGetVcpupinInfo
  - Add TXT record support for virtual DNS service
  - Support reboots with the QEMU driver
  - New API virDomainGetControlInfo API
  - New API virNodeGetMemoryStats
  - New API virNodeGetCPUTime
  - New API for send-key
  - New API virDomainPinVcpuFlags
  - support multifunction PCI device
  - lxc: various improvements
  - many improvements and bug fixes


author: Daniel Veillard <veillard@redhat.com> - 0.9.4-1
changelog:
  - network bandwidth QoS control
  - Add new API virDomainBlockPull*
  - save: new API to manipulate save file images
  - CPU bandwidth limits support
  - allow to send NMI and key event to guests
  - new API virDomainUndefineFlags
  - Implement code to attach to external QEMU instances
  - bios: Add support for SGA
  - various missing python binding
  - many improvements and bug fixes


author: Daniel Veillard <veillard@redhat.com> - 0.9.5-1
changelog:
  - many snapshot improvements (Eric Blake)
  - latency: Define new public API and structure (Osier Yang)
  - USB2 and various USB improvements (Marc-André Lureau)
  - storage: Add fs pool formatting (Osier Yang)
  - Add public API for getting migration speed (Jim Fehlig)
  - Add basic driver for Microsoft Hyper-V (Matthias Bolte)
  - many improvements and bug fixes


author: Laine Stump <laine@redhat.com> - 0.9.6-2
changelog:
  - Make PCI multifunction support more manual - Bug 742836
  - F15 build still uses cgconfig - Bug 738725


author: Daniel Veillard <veillard@redhat.com> - 0.9.8-1
changelog:
  - Add support for QEMU 1.0
  - Add preliminary PPC cpu driver
  - Add new API virDomain{Set, Get}BlockIoTune
  - block_resize: Define the new API
  - Add a public API to invoke suspend/resume on the host
  - various improvements for LXC containers
  - Define keepalive protocol and add virConnectIsAlive API
  - Add support for STP and VLAN filtering
  - many improvements and bug fixes


author: Daniel Veillard <veillard@redhat.com> - 0.9.9-1
changelog:
  - Add API virDomain{S,G}etInterfaceParameters
  - Add API virDomain{G, S}etNumaParameters
  - Add support for ppc64 qemu
  - Support Xen domctl v8
  - many improvements and bug fixes


author: Cole Robinson <crobinso@redhat.com> - 0.9.11.3-1
changelog:
  - Rebased to version 0.9.11.3
  - Abide URI username when connecting to hypervisor (bz 811397)
  - Fix managed USB mode (bz 814866)
  - Fix crash connecting to ESX host (bz 811891)


author: Daniel Veillard <veillard@redhat.com> - 0.9.12-1
changelog:
  - qemu: allow snapshotting of sheepdog and rbd disks
  - blockjob: add new APIs
  - a lot of bug fixes, improvements and portability work


author: Daniel Veillard <veillard@redhat.com> - 0.9.13-1
changelog:
  - S390: support for s390(x)
  - snapshot: implement new APIs for esx and vbox
  - snapshot: new query APIs and many improvements
  - virsh: Allow users to reedit rejected XML
  - nwfilter: add DHCP snooping
  - Enable driver modules in libvirt RPM
  - Default to enable driver modules for libvirtd
  - storage backend: Add RBD (RADOS Block Device) support
  - sVirt support for LXC domains inprovement
  - a lot of bug fixes, improvements and portability work


author: Daniel Veillard <veillard@redhat.com> - 0.10.0-1
changelog:
  - upstream release of 0.10.0
  - agent: add qemuAgentArbitraryCommand() for general qemu agent command
  - Introduce virDomainPinEmulator and virDomainGetEmulatorPinInfo functions
  - network: use firewalld instead of iptables, when available
  - network: make network driver vlan-aware
  - esx: Implement network driver
  - driver for parallels hypervisor
  - Various LXC improvements
  - Add virDomainGetHostname
  - a lot of bug fixes, improvements and portability work


author: Cole Robinson <crobinso@redhat.com> - 0.10.1-3
changelog:
  - Fix libvirtd segfault with old netcf-libs (bz 853381)
  - Drop unneeded dnsmasq --filterwin2k
  - Fix unwanted connection closing, needed for boxes


author: Daniel Veillard <veillard@redhat.com> - 0.10.2-1
changelog:
  - Upstream release 0.10.2
  - network: define new API virNetworkUpdate
  - add support for QEmu sandbox support
  - blockjob: add virDomainBlockCommit
  - New APIs to get/set Node memory parameters
  - new API virConnectListAllSecrets
  - new API virConnectListAllNWFilters
  - new API virConnectListAllNodeDevices
  - parallels: add support of containers to the driver
  - new API virConnectListAllInterfaces
  - new API virConnectListAllNetworks
  - new API virStoragePoolListAllVolumes
  - Add PMSUSPENDED life cycle event
  - new API virStorageListAllStoragePools
  - Add per-guest S3/S4 state configuration
  - qemu: Support for Block Device IO Limits
  - a lot of bug fixes, improvements and portability work


author: Richard W.M. Jones <rjones@redhat.com> - 0.10.2-3
changelog:
  - Re-add Use-qemu-system-i386-as-binary-instead-of-qemu.patch
    NB: This patch is Fedora-specific and not upstream.
  - Add upstream patches: don't duplicate environment variables (RHBZ#859596).


author: Cole Robinson <crobinso@redhat.com> - 0.10.2.1-1
changelog:
  - Rebased to version 0.10.2.1
  - Fix lvm volume creation when alloc=0 (bz #866481)
  - Clarify virsh send-keys man page example (bz #860004)
  - Fix occasional deadlock via virDomainDestroy (bz #859009)
  - Fix LXC deadlock from ctrl-c (bz #848119)
  - Fix occasional selinux denials with macvtap (bz #798605)
  - Fix multilib conflict with systemtap files (bz #831425)
  - Don't trigger keytab warning in system logs (bz #745203)
  - Fix qemu domxml-2-native NIC model out (bz #636832)
  - Fix error message if not enough space for lvm vol (bz #609104)


author: Jiri Denemark <jdenemar@redhat.com> - 1.0.5-2
changelog:
  - virInitctlRequest: Don't hardcode 384 bytes size
  - network: Fix network driver startup for qemu:///session
  - virInitctlRequest: Unbreak make syntax check
  - virInitctlRequest: Unbreak make syntax check
  - build: Always include sanitytest in tarball
  - qemu: Fix stupid typos in VFIO cgroup setup/teardown
  - build: Always include libvirt_lxc.syms in tarball
  - build: Clean up stray files found by 'make distcheck'
  - spec: Proper soft static allocation of qemu uid
  - Fix F_DUPFD_CLOEXEC operation args
  - build: Fix mingw build of virprocess.c
  - Fix potential use of undefined variable in remote dispatch code
  - build: Avoid non-portable cast of pthread_t
  - Fix release of resources with lockd plugin
  - Fixup rpcgen code on kFreeBSD too
  - Make detect_scsi_host_caps a function on all architectures
  - qemu: Allocate network connections sooner during domain startup
  - tests: Files named '.*-invalid.xml' should fail validation
  - conf: Don't crash on a tpm device with no backends
  - Don't mention disk controllers in generic controller errors
  - iscsi: Don't leak portal string when starting a pool
  - util: Fix virFileOpenAs return value and resulting error logs


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.0-2
changelog:
  - qemu: Fix double free in qemuMigrationPrepareDirect (rhbz#977961)
  - Fix crash when multiple event callbacks were registered (CVE-2013-2230)
  - Paused domain should remain paused after migration (rhbz#981139)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-2
changelog:
  - spec: Change --enable-werror handling to match upstream
  - Delete obsolete / unused python test files (rhbz#884103)
  - Remove reference to python/tests from RPM %doc (rhbz#884103)
  - spec: Explicitly claim ownership of channel subdir (rhbz#884103)
  - Add APIs for formatting systemd slice/scope names (rhbz#980929)
  - Add support for systemd cgroup mount (rhbz#980929)
  - Cope with races while killing processes (rhbz#980929)
  - Enable support for systemd-machined in cgroups creation (rhbz#980929)
  - Ensure LXC/QEMU APIs set the filename for errors (rhbz#991348)
  - Avoid crash if NULL is passed for filename/funcname in logging (rhbz#991348)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-3
changelog:
  - RPC: Don't accept client if it would overcommit max_clients (rhbz#981729)
  - Introduce max_queued_clients (rhbz#981729)
  - conf: Add default USB controller in qemu post-parse callback (rhbz#819968)
  - qemu: Rename some functions in qemu_command.c (rhbz#819968)
  - qemu: Eliminate almost-duplicate code in qemu_command.c (rhbz#819968)
  - qemu: Enable auto-allocate of all PCI addresses (rhbz#819968)
  - qemu: Add pcie-root controller (rhbz#819968)
  - qemu: Add dmi-to-pci-bridge controller (rhbz#819968)
  - qemu: Fix handling of default/implicit devices for q35 (rhbz#819968)
  - qemu: Properly set/use device alias for pci controllers (rhbz#819968)
  - qemu: Enable using implicit sata controller in q35 machines (rhbz#819968)
  - qemu: Improve error reporting during PCI address validation (rhbz#819968)
  - qemu: Refactor qemuDomainCheckDiskPresence for only disk presence check (rhbz#910171)
  - qemu: Add helper functions for diskchain checking (rhbz#910171)
  - qemu: Check presence of each disk and its backing file as well (rhbz#910171)
  - conf: Add startupPolicy attribute for harddisk (rhbz#910171)
  - qemu: Support to drop disk with 'optional' startupPolicy (rhbz#910171)
  - Split TLS test into two separate tests (rhbz#994158)
  - Avoid re-generating certs every time (rhbz#994158)
  - Change data passed into TLS test cases (rhbz#994158)
  - Fix validation of CA certificate chains (rhbz#994158)
  - Fix parallel runs of TLS test suites (rhbz#994158)
  - tests: Fix parallel runs of TLS test suites (rhbz#994158)
  - Add a man page for virtlockd daemon (rhbz#991494)
  - Add an example config file for virtlockd (rhbz#991494)
  - Properly handle -h / -V for --help/--version aliases in virtlockd/libvirtd (rhbz#991494)
  - Make check for /dev/loop device names stricter to avoid /dev/loop-control (rhbz#924815)
  - Ensure securityfs is mounted readonly in container (rhbz#872642)
  - Add info about access control checks into API reference (rhbz#700443)
  - Record the where the auto-generated data comes from (rhbz#700443)
  - Add documentation for access control system (rhbz#700443)
  - virsh-domain: Flip logic in cmdSetvcpus (rhbz#996552)
  - Honour root prefix in lxcContainerMountFSBlockAuto (rhbz#924815)
  - util: Add virGetUserDirectoryByUID (rhbz#988491)
  - Introduce a virt-login-shell binary (rhbz#988491)
  - build: Fix compilation of virt-login-shell.c (rhbz#988491)
  - Fix double-free and broken logic in virt-login-shell (rhbz#988491)
  - Address missed feedback from review of virt-login-shell (rhbz#988491)
  - Ensure that /dev exists in the container root filesystem (rhbz#924815)
  - remote: Fix a segfault in remoteDomainCreateWithFlags (rhbz#994855)
  - build: Avoid -lgcrypt with newer gnutls (rhbz#951637)
  - virnettlscontext: Resolve Coverity warnings (UNINIT) (rhbz#994158)
  - build: Fix missing max_queued_clients in augeas test file for libvirtd.conf (rhbz#981729)
  - virsh-domain: Fix memleak in cmdCPUBaseline (rhbz#997798)
  - Fix typo in domain name in polkit acl example (rhbz#700443)
  - Update polkit examples to use 'lookup' method (rhbz#700443)
  - Add bounds checking on virDomainMigrate*Params RPC calls (CVE-2013-4292) (rhbz#1002667)
  - Add bounds checking on virDomainGetJobStats RPC call (rhbz#1002667)
  - Add bounds checking on virDomain{SnapshotListAllChildren, ListAllSnapshots} RPC calls (rhbz#1002667)
  - Add bounds checking on virConnectListAllDomains RPC call (rhbz#1002667)
  - Add bounds checking on virConnectListAllStoragePools RPC call (rhbz#1002667)
  - Add bounds checking on virStoragePoolListAllVolumes RPC call (rhbz#1002667)
  - Add bounds checking on virConnectListAllNetworks RPC call (rhbz#1002667)
  - Add bounds checking on virConnectListAllInterfaces RPC call (rhbz#1002667)
  - Add bounds checking on virConnectListAllNodeDevices RPC call (rhbz#1002667)
  - Add bounds checking on virConnectListAllNWFilters RPC call (rhbz#1002667)
  - Add bounds checking on virConnectListAllSecrets RPC call (rhbz#1002667)
  - Prohibit unbounded arrays in XDR protocols (rhbz#1002667)
  - virbitmap: Refactor virBitmapParse to avoid access beyond bounds of array (rhbz#997906)
  - virbitmaptest: Fix function header formatting (rhbz#997906)
  - virbitmaptest: Add test for out of bounds condition (rhbz#997906)
  - virsh-domain: Fix memleak in cmdUndefine with storage (rhbz#999057)
  - virsh: Modify vshStringToArray to duplicate the elements too (rhbz#999057)
  - virsh: Don't leak list of volumes when undefining domain with storage (rhbz#999057)
  - Fix URI connect precedence (rhbz#999323)
  - tests: Add URI precedence checking (rhbz#999323)
  - Don't free NULL network in cmdNetworkUpdate (rhbz#1001094)
  - virsh: Fix debugging (rhbz#1001628)
  - qemu: Remove hostdev entry when freeing the depending network entry (rhbz#1002669)
  - Set security label on FD for virDomainOpenGraphics (rhbz#999925)
  - virsh: Free the caps list properly if one of them is invalid (rhbz#1001957)
  - virsh: Free the formatting string when listing pool details (rhbz#1001957)
  - virsh-pool.c: Don't jump over variable declaration (rhbz#1001957)
  - virsh: Free the list from ListAll APIs even for 0 items (rhbz#1001957)
  - virsh: Free messages after logging them to a file (rhbz#1001957)
  - Reverse logic allowing partial DHCP host XML (rhbz#1001078)
  - virsh: Print cephx and iscsi usage (rhbz#1000155)
  - qemu_conf: Fix broken logic for adding passthrough iscsi lun (rhbz#1000159)
  - Report secret usage error message similarly (rhbz#1000168)
  - docs: Update the formatdomain disk examples (rhbz#1000169)
  - docs: Update formatsecrets to include more examples of each type (rhbz#1000169)
  - docs: Update iSCSI storage pool example (rhbz#1000169)
  - docs: Reformat <disk> attribute description in formatdomain (rhbz#1000169)
  - qemuBuildNicDevStr: Add mq=on for multiqueue networking (rhbz#651941)
  - migration: Do not restore labels on failed migration (rhbz#822052)
  - qemu: Drop qemuDomainMemoryLimit (rhbz#1001143)
  - docs: Discourage users to set hard_limit (rhbz#1001143)
  - docs: Clean 09adfdc62de2b up (rhbz#1001143)
  - qemuSetupMemoryCgroup: Handle hard_limit properly (rhbz#1001143)
  - qemuBuildCommandLine: Fall back to mem balloon if there's no hard_limit (rhbz#1001143)
  - qemuDomainAttachHostPciDevice: Fall back to mem balloon if there's no hard_limit (rhbz#1001143)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-4
changelog:
  - Don't crash in qemuBuildDeviceAddressStr (rhbz#1003526)
  - Fix leaks in python bindings (rhbz#1003828)
  - Process virtlockd.conf instead of libvirtd.conf (rhbz#1003685)
  - test_virtlockd.aug.in: Use the correct file (rhbz#1003685)
  - qemu: Make domain renaming work during migration (rhbz#999352)
  - qemu: Handle huge number of queues correctly (rhbz#651941)
  - conf: Remove the actual hostdev when removing a network (rhbz#1003537)
  - conf: Don't deref NULL actual network in virDomainNetGetActualHostdev() (rhbz#1003537)
  - python: Fix a PyList usage mistake (rhbz#1002558)
  - Add '<nat>' element to '<forward>' network schemas (rhbz#1004364)
  - Always specify qcow2 compat level on qemu-img command line (rhbz#997977)
  - selinux: Distinguish failure to label from request to avoid label (rhbz#924153)
  - selinux: Enhance test to cover nfs label failure (rhbz#924153)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-5
changelog:
  - Pass AM_LDFLAGS to driver modules too (rhbz#1006299)
  - virsh domjobinfo: Do not return 1 if job is NONE (rhbz#1006864)
  - Fix polkit permission names for storage pools, vols & node devices (rhbz#700443)
  - Fix naming of permission for detecting storage pools (rhbz#700443)
  - security: Provide supplemental groups even when parsing label (CVE-2013-4291) (rhbz#1006513)
  - virFileNBDDeviceAssociate: Avoid use of uninitialized variable (CVE-2013-4297)
  - Rename "struct interface_driver" to virNetcfDriverState (rhbz#983026)
  - netcf driver: Use a single netcf handle for all connections (rhbz#983026)
  - virDomainDefParseXML: Set the argument of virBitmapFree to NULL after calling virBitmapFree (rhbz#1006722)
  - Add test for the nodemask double free crash (rhbz#1006722)
  - qemu: Fix checking of guest ABI compatibility when reverting snapshots (rhbz#1006886)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-6
changelog:
  - Also store user & group ID values in virIdentity (rhbz#1006272)
  - Ensure system identity includes process start time (rhbz#1006272)
  - Add support for using 3-arg pkcheck syntax for process (CVE-2013-4311)
  - Free slicename in virSystemdCreateMachine (rhbz#1008619)
  - qemu: Fix checking of ABI stability when restoring external checkpoints (rhbz#1008340)
  - qemu: Use "migratable" XML definition when doing external checkpoints (rhbz#1008340)
  - qemu: Fix memleak after commit 59898a88ce8431bd3ea249b8789edc2ef9985827 (rhbz#1008340)
  - qemu: Avoid dangling job in qemuDomainSetBlockIoTune (rhbz#700443)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-7
changelog:
  - Fix crash in remoteDispatchDomainMemoryStats (CVE-2013-4296)
  - LXC: Don't mount securityfs when user namespace enabled (rhbz#872648)
  - Move array of mounts out of lxcContainerMountBasicFS (rhbz#872648)
  - Ensure root filesystem is recursively mounted readonly (rhbz#872648)
  - qemu: Fix seamless SPICE migration (rhbz#1010861)
  - qemu: Use "ide" as device name for implicit SATA controller on Q35 (rhbz#1008903)
  - qemu: Only parse basename when determining emulator properties (rhbz#1010617)
  - qemu: Recognize -machine accel=kvm when parsing native (rhbz#1010617)
  - qemu: Don't leave shutdown inhibited on attach failure (rhbz#1010617)
  - qemu: Don't leak vm on failure (rhbz#1010617)
  - Fix typo in identity code which is pre-requisite for CVE-2013-4311 (rhbz#1006272)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-8
changelog:
  - conf: Don't crash on invalid chardev source definition of RNGs and other (rhbz#1012196)
  - rpc: Increase bound limit for virDomainGetJobStats (rhbz#1012818)
  - qemu: Free all driver data in qemuStateCleanup (rhbz#1011330)
  - qemu: Don't leak reference to virQEMUDriverConfigPtr (rhbz#1011330)
  - qemu: Eliminate redundant if clauses in qemuCollectPCIAddress (rhbz#1003983)
  - qemu: Allow some PCI devices to be attached to PCIe slots (rhbz#1003983)
  - qemu: Replace multiple strcmps with a switch on an enum (rhbz#1003983)
  - qemu: Support ich9-intel-hda audio device (rhbz#1003983)
  - qemu: Turn if into switch in qemuDomainValidateDevicePCISlotsQ35 (rhbz#1003983)
  - qemu: Prefer to put a Q35 machine's dmi-to-pci-bridge at 00:1E.0 (rhbz#1003983)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-9
changelog:
  - virNetDevBandwidthEqual: Make it more robust (rhbz#1014503)
  - qemu_hotplug: Allow QoS update in qemuDomainChangeNet (rhbz#1014503)
  - qemu: Check actual netdev type rather than config netdev type during init (rhbz#1012824)
  - Fix crash in libvirtd when events are registered & ACLs active (CVE-2013-4399) (rhbz#1011429)
  - Remove virConnectPtr arg from virNWFilterDefParse* (rhbz#1015108)
  - Don't pass virConnectPtr in nwfilter 'struct domUpdateCBStruct' (rhbz#1015108)
  - Remove use of virConnectPtr from all remaining nwfilter code (rhbz#1015108)
  - Don't set netdev offline in container cleanup (rhbz#1014604)
  - Avoid reporting an error if veth device is already deleted (rhbz#1014604)
  - Avoid deleting NULL veth device name (rhbz#1014604)
  - Retry veth device creation on failure (rhbz#1014604)
  - Use 'vnet' as prefix for veth devices (rhbz#1014604)
  - Free cmd in virNetDevVethDelete (rhbz#1014604)
  - Free cmd in virNetDevVethCreate (rhbz#1014604)
  - LXC: Fix handling of RAM filesystem size units (rhbz#1015689)
  - build: Add lxc testcase to dist list (rhbz#1015689)
  - tests: Work with older dbus (rhbz#1018730)
  - virdbus: Add virDBusHasSystemBus() (rhbz#1018730)
  - virsystemd: Don't fail to start VM if DBus isn't available or compiled in (rhbz#1018730)
  - DBus: Introduce virDBusIsServiceEnabled (rhbz#1018730)
  - Change way we fake dbus method calls (rhbz#1018730)
  - Fix virsystemdtest for previous commit (rhbz#1018730)
  - LXC: Workaround machined uncleaned data with containers running systemd. (rhbz#1018730)
  - Allow use of a private dbus bus connection (rhbz#998365)
  - Add a method for closing the dbus system bus connection (rhbz#998365)
  - Make LXC controller use a private dbus connection & close it (rhbz#998365)
  - Fix flaw in detecting log format (rhbz#927072)
  - Fix exit status of lxc controller (rhbz#927072)
  - Improve error reporting with LXC controller (rhbz#927072)
  - nwfilter: Don't fail to start if DBus isn't available (rhbz#927072)
  - Don't ignore all dbus connection errors (rhbz#927072)
  - LXC: Check the existence of dir before resolving symlinks (rhbz#927072)
  - Ensure lxcContainerMain reports errors on stderr (rhbz#927072)
  - Ensure lxcContainerResolveSymlinks reports errors (rhbz#927072)
  - Improve log filtering in virLXCProcessReadLogOutputData (rhbz#927072)
  - Initialize threading & error layer in LXC controller (rhbz#1018725)
  - qemu_migration: Avoid crashing if domain dies too quickly (rhbz#1018267)
  - Convert uuid to a string before printing it (rhbz#1019023)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-10
changelog:
  - qemu_process: Make qemuProcessReadLog() more versatile and reusable (rhbz#1001738)
  - qemu: monitor: Add infrastructure to access VM logs for better err msgs (rhbz#1001738)
  - qemu: monitor: Produce better errors on monitor hangup (rhbz#1001738)
  - qemu: Wire up better early error reporting (rhbz#1001738)
  - qemu: process: Silence coverity warning when rewinding log file (rhbz#1001738)
  - qemu: hostdev: Refactor PCI passhrough handling (rhbz#1001738)
  - qemu: hostdev: Fix function spacing and header formatting (rhbz#1001738)
  - qemu: hostdev: Add checks if PCI passthrough is available in the host (rhbz#1001738)
  - qemu: Prefer VFIO for PCI device passthrough (rhbz#1001738)
  - qemu: Init @pcidevs in qemuPrepareHostdevPCIDevices (rhbz#1001738)
  - Fix max stream packet size for old clients (rhbz#950416)
  - Adjust legacy max payload size to account for header information (rhbz#950416)
  - rpc: Correct the wrong payload size checking (rhbz#950416)
  - qemu: Simplify calling qemuDomainHostdevNetConfigRestore (rhbz#1005682)
  - qemu: Move qemuDomainRemoveNetDevice to avoid forward reference (rhbz#1005682)
  - qemu: Fix removal of <interface type='hostdev'> (rhbz#1005682)
  - remote: Fix regression in event deregistration (rhbz#1020376)
  - qemu: managedsave: Add support for compressing managed save images (rhbz#1017227)
  - qemu: snapshot: Add support for compressing external snapshot memory (rhbz#1017227)
  - Migration: Introduce VIR_MIGRATE_PARAM_LISTEN_ADDRESS (rhbz#1015215)
  - virsocket: Introduce virSocketAddrIsWildcard (rhbz#1015215)
  - qemu: Implement support for VIR_MIGRATE_PARAM_LISTEN_ADDRESS (rhbz#1015215)
  - qemu_conf: Introduce "migration_address" (rhbz#1015215)
  - qemu: Include listenAddress in debug prints (rhbz#1015215)
  - docs: Expand description of host-model CPU mode (rhbz#1014682)
  - qemu: Avoid assigning unavailable migration ports (rhbz#1019237)
  - qemu: Make migration port range configurable (rhbz#1019237)
  - qemu: Fix augeas support for migration ports (rhbz#1019237)
  - Fix perms for virConnectDomainXML{To, From}Native (CVE-2013-4401)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-11
changelog:
  - Add helpers for getting env vars in a setuid environment (rhbz#1015247)
  - Only allow 'stderr' log output when running setuid (CVE-2013-4400)
  - Close all non-stdio FDs in virt-login-shell (CVE-2013-4400)
  - Don't link virt-login-shell against libvirt.so (CVE-2013-4400)
  - build: Fix linking virt-login-shell (rhbz#1015247)
  - build: Fix build of virt-login-shell on systems with older gnutls (rhbz#1015247)
  - Set a sane $PATH for virt-login-shell (rhbz#1015247)
  - spec: Fix rpm build when lxc disabled (rhbz#1015247)
  - Move virt-login-shell into libvirt-login-shell sub-RPM (rhbz#1015247)
  - Make virCommand env handling robust in setuid env (rhbz#1015247)
  - Remove all direct use of getenv (rhbz#1015247)
  - Block all use of getenv with syntax-check (rhbz#1015247)
  - Only allow the UNIX transport in remote driver when setuid (rhbz#1015247)
  - Don't allow remote driver daemon autostart when running setuid (rhbz#1015247)
  - Add stub getegid impl for platforms lacking it (rhbz#1015247)
  - Remove (nearly) all use of getuid()/getgid() (rhbz#1015247)
  - Block all use of libvirt.so in setuid programs (rhbz#1015247)
  - spec: Clean up distribution of ChangeLog (and others) (rhbz#1024393)
  - Push RPM deps down into libvirt-daemon-driver-XXXX sub-RPMs (rhbz#1024393)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-12
changelog:
  - virpci: Don't error on unbinded devices (rhbz#1019387)
  - network: Fix connections count in case of allocate failure (rhbz#1020135)
  - qemu: Clean up migration ports when migration cancelled (rhbz#1019237)
  - qemuMigrationBeginPhase: Check for 'drive-mirror' for NBD (rhbz#1022393)
  - Allow root directory in filesystem source dir schema (rhbz#1028107)
  - Use a port from the migration range for NBD as well (rhbz#1025699)
  - qemu: Avoid double free of VM (rhbz#1018267)
  - util: Use size_t instead of unsigned int for num_virtual_functions (rhbz#1025397)
  - pci: Properly handle out-of-order SRIOV virtual functions (rhbz#1025397)
  - conf: Do better job when comparing features ABI compatibility (rhbz#1008989)
  - schema: Rename option 'hypervtristate' to 'featurestate' (rhbz#1008989)
  - conf: Mark user provided strings in error messages when parsing XML (rhbz#1008989)
  - cpu: Add support for loading and storing CPU data (rhbz#1008989)
  - cpu: x86: Rename struct cpuX86cpuid as virCPUx86CPUID (rhbz#1008989)
  - cpu: x86: Rename struct cpuX86Data as virCPUx86Data (rhbz#1008989)
  - cpu: x86: Rename x86DataFree() as virCPUx86DataFree() (rhbz#1008989)
  - Ensure 'arch' is always set in cpuArchNodeData (rhbz#1008989)
  - cpu: x86: Rename x86MakeCPUData as virCPUx86MakeData (rhbz#1008989)
  - cpu: x86: Rename x86DataAddCpuid as virCPUx86DataAddCPUID (rhbz#1008989)
  - cpu: x86: Rename data_iterator and DATA_ITERATOR_INIT (rhbz#1008989)
  - cpu: x86: Fix return types of x86cpuidMatch and x86cpuidMatchMasked (rhbz#1008989)
  - cpu: x86: Use whitespace to clarify context and use consistent labels (rhbz#1008989)
  - cpu: x86: Clean up error messages in x86VendorLoad() (rhbz#1008989)
  - cpu: Export few x86-specific APIs (rhbz#1008989)
  - cpu: x86: Parse the CPU feature map only once (rhbz#1008989)
  - cpu_x86: Refactor storage of CPUID data to add support for KVM features (rhbz#1008989)
  - qemu: Add monitor APIs to fetch CPUID data from QEMU (rhbz#1008989)
  - cpu: x86: Add internal CPUID features support and KVM feature bits (rhbz#1008989)
  - conf: Refactor storing and usage of feature flags (rhbz#1008989)
  - qemu: Add support for paravirtual spinlocks in the guest (rhbz#1008989)
  - qemu: process: Validate specific CPUID flags of a guest (rhbz#1008989)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-13
changelog:
  - virsh-domain: Mark --live and --config mutually exclusive in vcpucount (rhbz#1024245)
  - virSecurityLabelDefParseXML: Don't parse label on model='none' (rhbz#1028962)
  - qemuMonitorIO: Don't use @mon after it's unrefed (rhbz#1018267)
  - qemu: Allow hotplug of multiple SCSI devices (rhbz#1031062)
  - qemu: Call qemuSetupHostdevCGroup later during hotplug (rhbz#1025108)
  - virscsi: Hostdev SCSI AdapterId retrieval fix (rhbz#1031079)
  - storage: Returns earlier if source adapter of the scsi pool is a HBA (rhbz#1027680)
  - spec: Restrict virt-login-shell usage (rhbz#1033614)
  - spec: Don't save/restore running VMs on libvirt-client update (rhbz#1033626)
  - Don't start a nested job in qemuMigrationPrepareAny (rhbz#1018267)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-14
changelog:
  - nodedev: Resolve Relax-NG validity error (rhbz#1035792)
  - test-lib: Make case skipping possible (rhbz#1034380)
  - tests: Don't test user config file if ran as root (rhbz#1034380)
  - Improve cgroups docs to cover systemd integration (rhbz#1004340)
  - Fix busy wait loop in LXC container I/O handling (rhbz#1032705)
  - tests: Guarantee abs_srcdir in all C tests (rhbz#1035403)
  - Introduce standard methods for sorting strings with qsort (rhbz#1035403)
  - Add virFileIsMountPoint function (rhbz#1035403)
  - Pull lxcContainerGetSubtree out into shared virfile module (rhbz#1035403)
  - Fix bug in identifying sub-mounts (rhbz#1035403)
  - LXC: Ensure security context is set when mounting images (rhbz#923903)
  - Ensure to zero out the virDomainBlockJobInfo arg (rhbz#1028846)
  - qemu: Default to vfio for nodedev-detach (rhbz#1035188)
  - daemon: Run virStateCleanup conditionally (rhbz#1033061)
  - qemu: Add "-boot strict" to commandline whenever possible (rhbz#1037593)
  - tests: Add forgotten boot-strict test files (rhbz#1037593)
  - conf: Fix XML formatting of RNG device info (rhbz#1035118)
  - qemu: Improve error when setting invalid count of vcpus via agent (rhbz#1035108)
  - Add qxl ram size to ABI stability check (rhbz#1035123)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-15
changelog:
  - spec: Don't save/restore running VMs on libvirt-client update (rhbz#1033626)
  - qemu: hotplug: Only label hostdev after checking device conflicts (rhbz#1025108)
  - qemu: hotplug: Fix double free on USB collision (rhbz#1025108)
  - qemu: hotplug: Fix adding USB devices to the driver list (rhbz#1025108)
  - docs: Enhance memoryBacking/locked documentation (rhbz#1035954)
  - util: Fix two virCompareLimitUlong bugs (rhbz#1024272)
  - cgroups: Redefine what "unlimited" means wrt memory limits (rhbz#1024272)
  - qemu: Report VIR_DOMAIN_MEMORY_PARAM_UNLIMITED properly (rhbz#1024272)
  - qemu: Fix minor inconsistency in error message (rhbz#1024272)
  - conf: Don't format memtune with unlimited values (rhbz#1024272)
  - qemu_process: Read errors from child (rhbz#1035955)
  - network: Properly update iptables rules during net-update (rhbz#1035336)
  - Tie SASL callbacks lifecycle to virNetSessionSASLContext (rhbz#1039991)
  - screenshot: Implement multiple screen support (rhbz#1026966)
  - Switch to private redhat namespace for QMP I/O error reason (rhbz#1026966)
  - Support virtio disk hotplug in JSON mode (rhbz#1026966)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-16
changelog:
  - qemu: Check for reboot-timeout on monitor (rhbz#1042690)
  - virsh: Fix return value error of cpu-stats (rhbz#1043388)
  - tools: Fix virsh connect man page (rhbz#1043260)
  - conf: Introduce generic ISA address (rhbz#996520)
  - conf: Add support for panic device (rhbz#996520)
  - qemu: Add support for -device pvpanic (rhbz#996520)
  - Fix invalid read in virNetSASLSessionClientStep debug log (rhbz#1043864)
  - virsh: man: Mention that volumes need to be in storage pool for undefine (rhbz#1044445)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-18
changelog:
  - qemu: Ask for -enable-fips when FIPS is required (rhbz#1035474)
  - qemu: Properly set MaxMemLock when hotplugging with VFIO (rhbz#1035490)
  - qemu: Avoid duplicate security label restore on hostdev attach failure (rhbz#1035490)
  - qemu: Re-add hostdev interfaces to hostdev array on libvirtd restart (rhbz#1045002)
  - domain: Don't try to interpret <driver> as virtio config for hostdev interfaces (rhbz#1046337)
  - virBitmapParse: Fix behavior in case of error and fix up callers (rhbz#1047234)
  - qemu: Fix live pinning to memory node on NUMA system (rhbz#1047234)
  - qemu: Clean up qemuDomainSetNumaParameters (rhbz#1047234)
  - qemu: Range check numa memory placement mode (rhbz#1047234)
  - virkeycode: Allow ANSI_A (rhbz#1044806)
  - Fix argument order of qemuMigrationPerformJob(). (rhbz#1049338)
  - qemu: Do not access stale data in virDomainBlockStats (CVE-2013-6458)
  - qemu: Avoid using stale data in virDomainGetBlockInfo (CVE-2013-6458)
  - qemu: Fix job usage in qemuDomainBlockJobImpl (CVE-2013-6458)
  - qemu: Fix job usage in qemuDomainBlockCopy (rhbz#1048643)
  - qemu: Fix job usage in virDomainGetBlockIoTune (CVE-2013-6458)
  - PanicCheckABIStability: Need to check for existence (rhbz#996520)
  - virsh: Improve usability of '--print-xml' flag for attach-disk command (rhbz#1049529)
  - virsh: Don't use legacy API if --current is used on device hot(un)plug (rhbz#1049529)
  - virsh: Use inactive definition when removing disk from config (rhbz#1049529)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-19
changelog:
  - CVE-2013-6436: Fix crash in lxcDomainGetMemoryParameters (rhbz#1049137)
  - Fix crash in lxcDomainSetMemoryParameters (rhbz#1052062)
  - Don't crash if a connection closes early (CVE-2014-1447)
  - Really don't crash if a connection closes early (CVE-2014-1447)
  - qemu: Change the default unix monitor timeout (rhbz#892273)
  - virSecuritySELinuxSetFileconHelper: Don't fail on read-only NFS (rhbz#996543)
  - qemu: Avoid operations on NULL monitor if VM fails early (rhbz#1054785)
  - virt-login-shell: Fix regressions in behavior (rhbz#1015247)
  - pci: Make reattach work for unbound devices (rhbz#1046919)
  - pci: Fix failure paths in detach (rhbz#1046919)
  - qemu: Don't detach devices if passthrough doesn't work (rhbz#1046919)
  - Fix migration with QEMU 1.6 (rhbz#1053405)
  - build: More workarounds for if_bridge.h (rhbz#1042937)
  - build: Fix build with latest rawhide kernel headers (rhbz#1042937)
  - aarch64: Disable -fstack-protector. (rhbz#1042937)
  - AArch64: Parse cputopology from /proc/cpuinfo. (rhbz#1042937)
  - virDomainEventCallbackListFree: Don't leak @list->callbacks (rhbz#1047964)
  - Fix memory leak in virObjectEventCallbackListRemoveID() (rhbz#1047964)
  - event: Filter global events by domain:getattr ACL (CVE-2014-0028)
  - Doc: Improve the document for nodesuspend (rhbz#1045089)
  - Doc: Add "note" for node-memory-tune (rhbz#1045089)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-21
changelog:
  - util: Correct the NUMA node range checking (rhbz#1045958)
  - storage: Add document for possible problem on volume detection (rhbz#726797)
  - storage: Fix autostart of pool with "fc_host" type adapter (rhbz#726797)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-22
changelog:
  - Add a read/write lock implementation (rhbz#1034807)
  - Push nwfilter update locking up to top level (rhbz#1034807)
  - utils: Introduce functions for kernel module manipulation (rhbz#1045124)
  - virCommand: Introduce virCommandSetDryRun (rhbz#1045124)
  - tests: Add test for new virkmod functions (rhbz#1045124)
  - Honor blacklist for modprobe command (rhbz#1045124)
  - qemu: Be sure we're using the updated value of backend during hotplug (rhbz#1056360)
  - network: Permit upstream forwarding of unqualified DNS names (rhbz#1061099)
  - network: Only prevent forwarding of DNS requests for unqualified names (rhbz#1061099)
  - network: Change default of forwardPlainNames to 'yes' (rhbz#1061099)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-23
changelog:
  - Generate a valid imagelabel even for type 'none' (rhbz#1061657)
  - qemu: keep pre-migration domain state after failed migration (rhbz#1057407)
  - schema: Fix guest timer specification schema according to the docs (rhbz#1056205)
  - conf: Enforce supported options for certain timers (rhbz#1056205)
  - qemu: hyperv: Add support for timer enlightenments (rhbz#1056205)
  - build: correctly check for SOICGIFVLAN GET_VLAN_VID_CMD command (rhbz#1062665)
  - util: Add "shareable" field for virSCSIDevice struct (rhbz#957292)
  - util: Fix the indention (rhbz#957292)
  - qemu: Don't fail if the SCSI host device is shareable between domains (rhbz#957292)
  - util: Add one argument for several scsi utils (rhbz#957292)
  - tests: Add tests for scsi utils (rhbz#957292)
  - qemu: Fix the error message for scsi host device's shareable checking (rhbz#957292)
  - util: Accept test data path for scsi device's sg_path (rhbz#957292)
  - tests: Modify the scsi util tests (rhbz#957292)
  - event: move event filtering to daemon (regression fix) (rhbz#1047964)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-24
changelog:
  - Block info query: Add check for transient domain (rhbz#1065531)
  - Fix minor typos in messages and docs (rhbz#1045643)
  - LXC: Free variable vroot in lxcDomainDetachDeviceHostdevUSBLive() (rhbz#1045643)
  - LXC: free dst before lxcDomainAttachDeviceDiskLive returns (rhbz#1045643)
  - maint: fix comment typos (rhbz#1045643)
  - storage: avoid short reads while chasing backing chain (rhbz#1045643)
  - Don't block use of USB with containers (rhbz#1045643)
  - Fix path used for USB device attach with LXC (rhbz#1045643)
  - Record hotplugged USB device in LXC live guest config (rhbz#1045643)
  - Fix reset of cgroup when detaching USB device from LXC guests (rhbz#1045643)
  - Disks are always block devices, never character devices (rhbz#1045643)
  - Move check for cgroup devices ACL upfront in LXC hotplug (rhbz#1045643)
  - Add virFileMakeParentPath helper function (rhbz#1045643)
  - Add helper for running code in separate namespaces (rhbz#1045643)
  - CVE-2013-6456: Avoid unsafe use of /proc/$PID/root in LXC shutdown/reboot code (CVE-2013-6456)
  - CVE-2013-6456: Avoid unsafe use of /proc/$PID/root in LXC disk hotplug (CVE-2013-6456)
  - CVE-2013-6456: Avoid unsafe use of /proc/$PID/root in LXC USB hotplug (CVE-2013-6456)
  - CVE-2013-6456: Avoid unsafe use of /proc/$PID/root in LXC block hostdev hotplug (CVE-2013-6456)
  - CVE-2013-6456: Avoid unsafe use of /proc/$PID/root in LXC chardev hostdev hotplug (CVE-2013-6456)
  - CVE-2013-6456: Avoid unsafe use of /proc/$PID/root in LXC hotunplug code (CVE-2013-6456)
  - Ignore additional fields in iscsiadm output (rhbz#1067173)
  - qemuBuildNicDevStr: Set vectors= on Multiqueue (rhbz#1066209)
  - Don't depend on syslog.service (rhbz#1032695)
  - libvirt-guests: Run only after libvirtd (rhbz#1032695)
  - virSystemdCreateMachine: Set dependencies for slices (rhbz#1032695)
  - libvirt-guests: Wait for libvirtd to initialize (rhbz#1032695)
  - virNetServerRun: Notify systemd that we're accepting clients (rhbz#1032695)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-25
changelog:
  - maint: fix comma style issues: conf (rhbz#1032370)
  - Allow <source> for type=block to have no dev (rhbz#1032370)
  - Allow LUN type disks to have no source (rhbz#1032370)
  - virsh-volume: Unify strigification of volume type (rhbz#1032370)
  - conf: Refactor virDomainDiskSourcePoolDefParse (rhbz#1032370)
  - conf: Split out code to parse the source of a disk definition (rhbz#1032370)
  - conf: Rename virDomainDiskHostDefFree to virDomainDiskHostDefClear (rhbz#1032370)
  - conf: Refactor virDomainDiskSourceDefParse (rhbz#1032370)
  - storage: fix RNG validation of gluster via netfs (rhbz#1032370)
  - maint: fix comment typos. (rhbz#1032370)
  - storage: use valid XML for awkward volume names (rhbz#1032370)
  - build: Don't fail on '&lt; ' or '&gt; ' with old xmllint (rhbz#1032370)
  - storage: allow interleave in volume XML (rhbz#1032370)
  - storage: expose volume meta-type in XML (rhbz#1032370)
  - storage: initial support for linking with libgfapi (rhbz#1032370)
  - storage: document existing pools (rhbz#1032370)
  - storage: document gluster pool (rhbz#1032370)
  - storage: implement rudimentary glusterfs pool refresh (rhbz#1032370)
  - storage: add network-dir as new storage volume type (rhbz#1032370)
  - storage: improve directory support in gluster pool (rhbz#1032370)
  - storage: improve allocation stats reported on gluster files (rhbz#1032370)
  - storage: improve handling of symlinks in gluster (rhbz#1032370)
  - storage: probe qcow2 volumes in gluster pool (rhbz#1032370)
  - storage: fix typo in previous patch (rhbz#1032370)
  - conf: Export virStorageVolType enum helper functions (rhbz#1032370)
  - test: Implement fake storage pool driver in qemuxml2argv test (rhbz#1032370)
  - storage: reduce number of stat calls (rhbz#1032370)
  - storage: use simpler 'char *' (rhbz#1032370)
  - storage: refactor backing chain division of labor (rhbz#1032370)
  - storage: always probe type with buffer (rhbz#1032370)
  - storage: don't read storage volumes in nonblock mode (rhbz#1032370)
  - storage: skip selinux cleanup when fd not available (rhbz#1032370)
  - storage: use correct type for array count (rhbz#1032370)
  - storage: allow interleave in pool XML (rhbz#1032370)
  - qemuxml2argv: Add test to verify correct usage of disk type="volume" (rhbz#1032370)
  - qemuxml2argv: Add test for disk type='volume' with iSCSI pools (rhbz#1032370)
  - tests: Fix comment for fake storage pool driver (rhbz#1032370)
  - conf: Support disk source formatting without needing a virDomainDiskDefPtr (rhbz#1032370)
  - conf: Clean up virDomainDiskSourceDefFormatInternal (rhbz#1032370)
  - conf: Split out seclabel formating code for disk source (rhbz#1032370)
  - conf: Export disk source formatter and parser (rhbz#1032370)
  - snapshot: conf: Use common parsing and formatting functions for source (rhbz#1032370)
  - snapshot: conf: Fix NULL dereference when <driver> element is empty (rhbz#1032370)
  - conf: Add functions to copy and free network disk source definitions (rhbz#1032370)
  - qemu: snapshot: Detect internal snapshots also for sheepdog and RBD (rhbz#1032370)
  - conf: Add helper do clear disk source authentication struct (rhbz#1032370)
  - qemu: snapshot: Touch up error message (rhbz#1032370)
  - qemu: snapshot: Add functions similar to disk source pool translation (rhbz#1032370)
  - qemu: Refactor qemuTranslateDiskSourcePool (rhbz#1032370)
  - qemu: Split out formatting of network disk source URI (rhbz#1032370)
  - qemu: Simplify call pattern of qemuBuildDriveURIString (rhbz#1032370)
  - qemu: Use qemuBuildNetworkDriveURI to handle http/ftp and friends (rhbz#1032370)
  - qemu: Migrate sheepdog source generation into common function (rhbz#1032370)
  - qemu: Split out NBD command generation (rhbz#1032370)
  - qemu: Unify formatting of RBD sources (rhbz#1032370)
  - qemu: Refactor disk source string formatting (rhbz#1032370)
  - qemu: Clear old translated pool source (rhbz#1032370)
  - qemu: snapshots: Declare supported and unsupported snapshot configs (rhbz#1032370)
  - domainsnapshotxml2xmltest: Clean up labels and use bool instead of int (rhbz#1032370)
  - domainsnapshotxml2xmltest: Allow for better testing of snapshots (rhbz#1032370)
  - domainsnapshotxml2xml: Move files with conflicting names (rhbz#1032370)
  - domainsnapshotxml2xmltest: Add existing files as new tests (rhbz#1032370)
  - domainsnapshotxml2xmltest: Add test case for empty driver element (rhbz#1032370)
  - qemu: Fix indentation in qemuTranslateDiskSourcePool (rhbz#1032370)
  - qemu: snapshot: Fix incorrect disk type for auto-generated disks (rhbz#1032370)
  - storage: fix omitted slash in gluster volume URI (rhbz#1032370)
  - virsh: domain: Fix undefine with storage of 'volume' disks (rhbz#1032370)
  - snapshot: schema: Split out snapshot disk driver definition (rhbz#1032370)
  - storage: Add gluster pool filter and fix virsh pool listing (rhbz#1032370)
  - storage: fix bogus target in gluster volume xml (rhbz#1032370)
  - storage: Improve error message when a storage backend is missing (rhbz#1032370)
  - storage: Break long lines and clean up spaces in storage backend header (rhbz#1032370)
  - storage: Support deletion of volumes on gluster pools (rhbz#1032370)
  - qemu: snapshot: Avoid libvirtd crash when qemu crashes while snapshotting (rhbz#1032370)
  - qemu: snapshot: Forbid snapshots when backing is a scsi passthrough disk (rhbz#1034993)
  - qemu: Avoid crash in qemuDiskGetActualType (rhbz#1032370)
  - snapshot: Add support for specifying snapshot disk backing type (rhbz#1032370)
  - conf: Move qemuDiskGetActualType to virDomainDiskGetActualType (rhbz#1032370)
  - conf: Move qemuSnapshotDiskGetActualType to virDomainSnapshotDiskGetActualType (rhbz#1032370)
  - storage: Add file storage APIs in the default storage driver (rhbz#1032370)
  - storage: add file functions for local and block files (rhbz#1032370)
  - storage: Add storage file backends for gluster (rhbz#1032370)
  - qemu: Switch snapshot deletion to the new API functions (rhbz#1032370)
  - qemu: snapshot: Use new APIs to detect presence of existing storage files (rhbz#1032370)
  - qemu: snapshot: Add support for external active snapshots on gluster (rhbz#1032370)
  - storage: Fix build with older compilers afeter gluster snapshot series (rhbz#1032370)
  - storage: gluster: Don't leak private data when storage file init fails (rhbz#1032370)
  - spec: Use correct versions of libgfapi in RHEL builds (rhbz#1032370)
  - spec: Fix braces around macros (rhbz#1032370)
  - build: use --with-systemd-daemon as configure option (rhbz#1032695)
  - spec: require device-mapper-devel for storage-disk (rhbz#1032695)
  - spec: make systemd_daemon usage configurable (rhbz#1032695)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-26
changelog:
  - virNetDevVethCreate: Serialize callers (rhbz#1014604)
  - qemuBuildNicDevStr: Adapt to new advisory on multiqueue (rhbz#1071888)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-27
changelog:
  - spec: Let translations be properly updated (rhbz#1030368)
  - Update translation to supported languages (rhbz#1030368)
  - Add a mutex to serialize updates to firewall (rhbz#1074003)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-28
changelog:
  - qemu: Forbid "sgio" support for SCSI generic host device (rhbz#957292)
  - qemu: monitor: Fix invalid parentheses (rhbz#1075973)
  - qemu: Introduce qemuDomainDefCheckABIStability (rhbz#1076503)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-29
changelog:
  - nwfilter: Increase buffer size for libpcap (rhbz#1078347)
  - nwfilter: Display pcap's error message when pcap setup fails (rhbz#1078347)
  - nwfilter: Fix double free of pointer (rhbz#1071181)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-29.el7_0.1
changelog:
  - LSN-2014-0003: Don't expand entities when parsing XML (CVE-2014-0179)
  - virNetClientSetTLSSession: Restore original signal mask (rhbz#1112689)
  - Don't use AI_ADDRCONFIG when binding to wildcard addresses (rhbz#1112692)
  - qemu: Unlock the NWFilter update lock by leaving via the cleanup label (rhbz#1112690)


author: Jiri Denemark <jdenemar@redhat.com> - 1.1.1-29.el7_0.2
changelog:
  - qemu: split out cpuset.mems setting (rhbz#1135871)
  - qemu: leave restricting cpuset.mems after initialization (rhbz#1135871)
  - qemu: blkiotune: Use correct definition when looking up disk (CVE-2014-3633)


author: Tom "spot" Callaway <tcallawa@redhat.com> 0.9.0-2
changelog:
  - fix permissions on binaries
  - rename generic binaries to v8_*
  - link shared library to -lm, -lpthread to resolve missing weak symbols


author: Tom "spot" Callaway <tcallawa@redhat.com> 0.9.0-7
changelog:
  - update to git revision 8389f1967c5f8b3819cca80705b1b4ba04132b93
  - upstream fix for bz 599147
  - proper shared library support


author: Ben Skeggs <bskeggs@redhat.com> 20090106-2
changelog:
  - Add firmware needed for nouveau to operate correctly (this is Fedora
    only - do not upstream yet - we just moved it here from Fedora kernel)


author: Josh Boyer <jwboyer@redhat.com> 20120510-0.3.git375e954
changelog:
  - Fix location of BuildRequires so git is inclued in the buildroot
  - Create iwlXXXX-firmware subpackages (rhbz 828050)


author: Josh Boyer <jwboyer@redhat.com>
changelog:
  - Consolidate rt61pci-firmware and rt73usb-firmware packages (rhbz 864959)
  - Consolidate netxen-firmware and ql2[123]xx-firmware packages (rhbz 864959)


author: Jarod Wilson <jarod@redhat.com> - 20130820-0.3.git600caef
changelog:
  - Put in proper URL and URL-less Source0 location, and a note about how
    we generate the tarball by hand from a git tree


author: Jarod Wilson <jarod@redhat.com> - 20131106-0.1.git7d0c7a8
changelog:
  - Update to latest upstream linux-firmware to pick up bfa firmware (rhbz 1013426)
  - Fix up Obsoletes to all use <= comparisons


author: Chris Leech <christopher.leech@intel.com> - 0.9.7-1
changelog:
  - Updated to 0.9.7
  - Added a private copy of dcbnl.h until kernel-headers includes it.
    Export patch is making it's way to the upstream kernel via net-2.6,
    expected in 2.6.29-rc7


author: Jan Zeleny <jzeleny@redhat.com> - 0.9.7-3
changelog:
  - added devel files again to support fcoe-utils package
  - added kernel >= 2.6.29 to Requires, deleted dcbnl.h, since it is
    aviable in kernel 2.6.29-rc7
  - changed config dir from /etc/sysconfig/dcbd to /etc/dcbd
  - updated init script: added mandatory Short description tag,
    deleted default runlevels, which should start the script


author: Karsten Hopp <karsten@redhat.com> 0.9.15-4
changelog:
  - buildrequire libconfig-devel >= 1.3.2, it doesn't build with 1.3.1 due to
    the different config_lookup_string api


author: Jan Zeleny <jzeleny@redhat.com> - 0.9.26-1
changelog:
  - rebased to 0.9.26
  - package renamed to lldpad
  - enahanced functionality (LLDP supported as well as DCBX)


author: Jan Zeleny <jzeleny@redhat.com> - 0.9.32-1
changelog:
  - rebased to 0.9.32 (various enhancements and bugfixes, see 
    lldpad-0.9.32-relnotes.txt on http://e1000.sf.net for complete list)


author: Jan Zeleny <jzeleny@redhat.com> - 0.9.38-1
changelog:
  - rebased to 0.9.38 (various enhancements and bugfixes, see 
    lldpad-0.9.38-relnotes.txt on http://e1000.sf.net for complete list)


author: Petr Sabata <psabata@redhat.com> - 0.9.41-1
changelog:
  - 0.9.41 bump
  - New BR: autotools, flex
  - Buildroot garbage removed
  - Devel post and preun scriptlets sanitized


author: Petr Sabata <contyk@redhat.com> - 0.9.42-1
changelog:
  - 0.9.42 bump (massive patches cleanup)
  - Remove obsolete defattr
  - Remove COPYING and README from devel subpackage


author: Petr Sabata <contyk@redhat.com> - 0.9.42-2
changelog:
  - Introduce systemd unit file, drop SysV support
  - Call systemctl instead of service and chkconfig
  - Enable the service only on new installation (post)
  - Clean exit patch


author: Petr Sabata <contyk@redhat.com> - 0.9.43-2
changelog:
  - Apply various upstream 0.9.43 bugfixes
  - Include not yet accepted Jens Osterkamp's patch to fix bug #720080
  - Whitespace cleanup, phew


author: Petr Šabata <contyk@redhat.com> - 0.9.46-1
changelog:
  - 0.9.46 bump
  - 802.1Qaz fixes to enable support on not CEE DCBX-enabled hardware
  - 802.1Qbg EVB module support
  - lldpad now supports bonded interfaces


author: Martin Gracik <mgracik@redhat.com> 0.2-2
changelog:
  - Fix the gnome themes
  - Add biosdevname package
  - Edit .bash_history file
  - Add the initrd and kernel lines to .treeinfo
  - Don't remove the gamin package from installtree


author: Martin Gracik <mgracik@redhat.com> 0.3-1
changelog:
  - Don't remove libmount package
  - Don't create mtab symlink, already exists
  - Exit with error if we have no lang-table
  - Fix file logging
  - Overwrite the /etc/shadow file
  - Use [images-xen] section for PAE and xen kernels


author: Martin Gracik <mgracik@redhat.com> 0.4-1
changelog:
  - Add the images-xen section to treeinfo on x86_64
  - Print a message when no arguments given (#684463)
  - Mako template returns unicode strings (#681003)
  - The check option in options causes ValueError
  - Disable all ctrl-alt-arrow metacity shortcuts
  - Remove the locale-archive explicitly
  - Use xz when compressing the initrd
  - Keep the source files for locales and get rid of the binary form
  - Add /sbin to $PATH (for the tty2 terminal)
  - Create /var/run/dbus directory in installtree
  - Add mkdir support to template
  - gpart is present only on i386 arch (#672611)
  - util-linux-ng changed to util-linux


author: Martin Gracik <mgracik@redhat.com> 0.5-1
changelog:
  - Remove pungi patch
  - Remove pseudo code
  - Add a /bin/login shim for use only in the installation environment.
  - Set the hostname from a config file, not programmatically.
  - Add systemd and agetty to the installation environment.
  - Specify "cpio -H newc" instead of "cpio -c".
  - Provide shutdown on s390x (#694518)
  - Fix arch specific requires in spec file
  - Add s390 modules and do some cleanup of the template
  - Generate ssh keys on s390
  - Don't remove tr, needed for s390
  - Do not check if we have all commands
  - Change location of addrsize and mk-s390-cdboot
  - Shutdown is in another location
  - Do not skip broken packages
  - Don't install network-manager-netbook
  - Wait for subprocess to finish
  - Have to call os.makedirs
  - images dir already exists, we just need to set it
  - Do not remove libassuan.
  - The biarch is a function not an attribute
  - Create images directory in outputtree
  - Use gzip on ppc initrd
  - Create efibootdir if doing efi images
  - Get rid of create_gconf().
  - gconf/metacity: have only one workspace.
  - Add yum-langpacks yum plugin to anaconda environment (notting)
  - Replace variables in yaboot.conf
  - Add sparc specific packages
  - Skip keymap creation on s390
  - Copy shutdown and linuxrc.s390 on s390
  - Add packages for s390
  - Add support for sparc
  - Use factory to get the image classes
  - treeinfo has to be addressed as self.treeinfo
  - Add support for s390
  - Add the xen section to treeinfo on x86_64
  - Fix magic and mapping paths
  - Fix passing of prepboot and macboot arguments
  - Small ppc fixes
  - Check if the file we want to remove exists
  - Install x86 specific packages only on x86
  - Change the location of zImage.lds
  - Added ppc specific packages
  - memtest and efika.forth are in /boot
  - Add support for ppc
  - Minor sparc pseudo code changes
  - Added sparc pseudo code (dgilmore)
  - Added s390 and x86 pseudo code
  - Added ppc pseudo code


author: Will Woods <wwoods@redhat.com> 17.0-1
changelog:
  - Merges the 'treebuilder' branch of lorax
  - images are split into two parts again (initrd.img, LiveOS/squashfs.img)
  - base memory use reduced to ~200M (was ~550M in F15, ~320MB in F16)
  - initrd.img is now built by dracut
  - booting now requires correct "root=live:..." argument
  - boot.iso is EFI hybrid capable (copy iso to USB stick, boot from EFI)
  - Better support for Apple EFI (now with custom boot icon!)
  - new syslinux config (#734170)
  - add fpaste to installer environment (#727842)
  - rsyslog.conf: hardcode hostname for virtio forwarding (#744544)
  - Use a predictable ISO Volume Label (#732298)
  - syslinux-vesa-splash changed filename (#739345)
  - don't create /etc/sysconfig/network (#733425)
  - xauth and libXmu are needed for ssh -X (#731046)
  - add libreport plugins (#729537), clean up libreport
  - keep nss certs for libreport (#730438)
  - keep ModemManager (#727946)
  - keep vmmouse binaries (#723831)
  - change isbeta to isfinal, default to isFinal=False (#723901)
  - use pungi's installroot rather than making our own (#722481)
  - keep ntfsresize around (#722711)
  - replace cjkuni-uming-fonts with wqy-microhei-fonts (#709962)
  - install all firmware packages (#703291, #705392)
  - keep libmodman and libproxy (#701622)
  - write the lorax verion in the .buildstamp (#689697)
  - disable rsyslogd rate limiting on imuxsock (#696943)
  - disable debuginfo package


author: Brian C. Lane <bcl@redhat.com> 17.1-1
changelog:
  - lorax: check for output directory early and quit (bcl)
  - lorax: Add --proxy command (bcl)
  - lorax: add --config option (bcl)
  - Modify spec file for livemedia-creator (bcl)
  - Add no-virt mode to livemedia-creator (bcl)
  - Add livemedia-creator README and example ks (bcl)
  - Add config files for live media (bcl)
  - Add livemedia-creator (bcl)
  - Allow a None to be passed as size to create_runtime (bcl)
  - Add execWith utils from anaconda (bcl)
  - Changes needed for livecd creation (bcl)
  - dracut has moved to /usr/bin (bcl)


author: Martin Gracik <mgracik@redhat.com> 17.2-1
changelog:
  - Allow specifying buildarch on the command line (#771382) (mgracik)
  - lorax: Don't touch /etc/mtab in cleanup (bcl)
  - Update TODO and POLICY to reflect the current state of things (wwoods)
  - consider %ghost files part of the filelists in templates (wwoods)
  - lorax: Add option to exclude packages (bcl)
  - dracut needs kbd directories (#769932) (bcl)
  - better debug, handle relative output paths (bcl)


author: Brian C. Lane <bcl@redhat.com> 17.3-1
changelog:
  - keep convertfs.sh script in image (#787893) (bcl)
  - Add dracut convertfs module (#787893) (bcl)
  - fix templates to work with F17 usrmove (tflink)
  - changing hfs to hfsplus so that the correct mkfs binary is called (tflink)
  - Add luks, md and dm dracut args to bootloaders (bcl)
  - update lorax and livemedia_creator to use isfinal (bcl)
  - lorax: copy kickstarts into sysroot (#743135) (bcl)
  - livemedia-creator: Mount iso if rootfs is LiveOS (bcl)
  - Log output of failed command (mgracik)
  - Add packages required for gtk3 and the new anaconda UI. (clumens)


author: Brian C. Lane <bcl@redhat.com> 18.0-1
changelog:
  - use --prefix=/run/initramfs when building initramfs (wwoods)
  - dhclient-script needs cut and arping (bcl)
  - Fix missing CalledProcessError import (bcl)
  - metacity now depends on gsettings-desktop-schemas (bcl)
  - Add findiso to grub config (mjg)
  - add memtest to the boot.iso for x86 (#787234) (bcl)
  - Don't use mk-s390-cdboot (dhorak) (mgracik)
  - Add dracut args to grub.conf (bcl)
  - Change the squashfs image section in .treeinfo (mgracik)
  - Add path to squashfs image to the treeinfo (mgracik)
  - Add runtime basename variable to the template (mgracik)
  - use internal implementation of the addrsize utility (dan)
  - Make sure var/run is not a symlink on s390x (#787217) (mgracik)
  - Create var/run/dbus directory on s390x (#787217) (mgracik)


author: Brian C. Lane <bcl@redhat.com> 18.1-1
changelog:
  - livemedia-creator: update README (bcl)
  - example livemedia kickstart for ec2 (bcl)
  - livemedia-creator: console=ttyS0 not /dev/ttyS0 (bcl)
  - livemedia-creator: Add support for making ami images (bcl)
  - Don't remove btrfs utils (#796511) (mgracik)
  - Remove root and ip parameters from generic.prm (#796572) (mgracik)
  - Check if the volume id is not longer than 32 chars (#786832) (mgracik)
  - Add option to specify volume id on command line (#786834) (mgracik)
  - Install nhn-nanum-gothic-fonts (#790266) (mgracik)
  - Change the locale to C (#786833) (mgracik)
  - iputils is small and required by dhclient-script (bcl)
  - util-linux-ng is now util-linux (bcl)


author: Brian C. Lane <bcl@redhat.com> 18.2-1
changelog:
  - Merge noloader commits from f17-branch (bcl)
  - mkefiboot: Make Apple boot images appear in the startup preferences (mjg)
  - add symlink from /mnt/install -> /run/install (wwoods)
  - Don't trash all the initscripts 'fedora*' services (wwoods)
  - remove anaconda-copy-ks.sh (wwoods)
  - add anaconda dracut module (wwoods)
  - runtime-postinstall: remove references to loader (wwoods)
  - runtime-postinstall: remove keymap stuff (wwoods)
  - Add the icfg package (#771733) (mgracik)
  - Log the output of mkfs (#769928) (mgracik)
  - Fix product name replacing in templates (#799919) (mgracik)
  - Fix requires (mgracik)
  - use cache outside the installtree (bcl)
  - add iscsi-initiator-utils (#804522) (bcl)
  - livemedia-creator: update TreeBuilder use for isolabel (bcl)


author: Brian C. Lane <bcl@redhat.com> 18.3-1
changelog:
  - Added BCM4331 firmware (#817151) (mgracik)
  - mkefiboot: Add support for disk label files (mjg)
  - Add 'tmux' to runtime image (wwoods)
  - Add /etc/sysctl.d/anaconda.conf, set kernel.printk=1 (#816022) (wwoods)
  - reduce image size from 2GB to 1GB (wwoods)
  - keep all filesystem tools (wwoods)
  - Leave some of the grub2 utilities in the install image (#749323) (mgracik)
  - add media check menu option (bcl)
  - remove unneeded dracut bootargs (bcl)
  - mkefiboot: Copy Mac bootloader, rather than linking it (mjg)
  - Remove workdir if it was created by lorax (#807964) (mgracik)
  - add gdisk to install image (#811083) (bcl)
  - Don't use --allbut for xfsprogs cleanup (#804779) (mgracik)
  - Log all removed files (mgracik)
  - Add spice-vdagent to initrd (#804739) (mgracik)
  - Add ntfs-3g to initrd (#804302) (mgracik)
  - ntfs-3g now uses /usr/lib (#810039) (bcl)


author: Martin Gracik <mgracik@redhat.com> 18.4-1
changelog:
  - Initialized to use tito.
  - Use gz not bz2 for source
  - remove 'loadkeys' stub (#804306)
  - add name field to .treeinfo its a concatination of family and version
  - Fix typo in help (#819476)
  - include the new cmsfs-fuse interface
  - linuxrc.s390 is dead in anaconda
  - Add the ppc magic file
  - Install proper branding packages from repo (#813969)
  - Use --mac for isohybrid only if doing macboot images
  - Add --nomacboot option
  - Add packages needed for NTP functionality in the installer
  - livemedia-creator: check kickstart for display modes (#819660)
  - livemedia-creator: Removed unused ImageMount class
  - livemedia-creator: cleanup after a crash
  - livemedia-creator: start using /var/tmp instead of /tmp
  - livemedia-creator: make libvirt module optional
  - stop moving /run (#818918)


author: Martin Gracik <mgracik@redhat.com> 18.5-1
changelog:
  - Don't remove sha256sum from the install image (mgracik@redhat.com)
  - Check if selinux is not in Enforcing mode (#824835) (mgracik@redhat.com)
  - Install rpcbind (#824835) (mgracik@redhat.com)
  - Remove hfsplus-tools dependency (#818913) (mgracik@redhat.com)
  - Copy mapping and magic to BOOTDIR on ppc (#815550) (mgracik@redhat.com)
  - Automatic commit of package [lorax] release [18.4-1]. (mgracik@redhat.com)


author: Martin Gracik <mgracik@redhat.com> 18.6-1
changelog:
  - Fix the rpm call (mgracik@redhat.com)
  - Use selinux python module to get enforcing mode (mgracik@redhat.com)


author: Martin Gracik <mgracik@redhat.com> 18.7-1
changelog:
  - Comment on why selinux needs to be in permissive or disabled
    (mgracik@redhat.com)
  - Verify the yum transaction (mgracik@redhat.com)
  - Do not remove shared-mime-info (#825960) (mgracik@redhat.com)
  - Add a --required switch to installpkg (mgracik@redhat.com)
  - livemedia-creator: Hook up arch option (bcl@redhat.com)
  - livemedia-creator: Add appliance creation (bcl@redhat.com)
  - livemedia-creator: handle failed mount for ami (bcl@redhat.com)


author: Martin Gracik <mgracik@redhat.com> 18.8-1
changelog:
  - Check if selinux is enabled before getting the mode (mgracik@redhat.com)
  - Add grub2 so that rescue is more useful (bcl@redhat.com)


author: Martin Gracik <mgracik@redhat.com> 18.9-1
changelog:
  - Add initial support for ARM based systems (dmarlin) (mgracik@redhat.com)
  - Add plymouth to the installer runtime (wwoods@redhat.com)
  - add 'systemctl' command and use it in postinstall (wwoods@redhat.com)
  - add dracut-shutdown.service (and its dependencies) (wwoods@redhat.com)
  - leave pregenerated locale files (save RAM) (wwoods@redhat.com)
  - runtime-cleanup: log broken symlinks being removed (wwoods@redhat.com)
  - Add some documentation to LoraxTemplateRunner (wwoods@redhat.com)
  - fix '-runcmd' and improve logging (wwoods@redhat.com)
  - mkefiboot: add --debug (wwoods@redhat.com)
  - pylorax.imgutils: add retry loop and "lazy" to umount() (wwoods@redhat.com)
  - pylorax.imgutils: add debug logging (wwoods@redhat.com)
  - pylorax: set up logging as recommended by logging module (wwoods@redhat.com)
  - remove dmidecode (wwoods@redhat.com)
  - clean up net-tools properly (wwoods@redhat.com)
  - runtime-cleanup: correctly clean up kbd (wwoods@redhat.com)
  - runtime-cleanup: correctly clean up iproute (wwoods@redhat.com)
  - runtime-cleanup: drop a bunch of do-nothing removals (wwoods@redhat.com)
  - Create missing /etc/fstab (wwoods@redhat.com)
  - Fix systemd unit cleanup in runtime-postinstall (wwoods@redhat.com)
  - Disable Alt+Tab in metacity (mgracik@redhat.com)
  - Add pollcdrom module to dracut (bcl@redhat.com)


author: Martin Gracik <mgracik@redhat.com> 18.10-1
changelog:
  - Don't set a root= argument (wwoods@redhat.com)
    Resolves: rhbz#837208
  - Don't remove the id tool (mgracik@redhat.com)
    Resolves: rhbz#836493
  - Xauth is in bin (mgracik@redhat.com)
    Resolves: rhbz#837317
  - Actually add plymouth to the initramfs (wwoods@redhat.com)
  - don't use --prefix with dracut anymore (wwoods@redhat.com)
  - newui requires checkisomd5 to run media check. (clumens@redhat.com)


author: Martin Gracik <mgracik@redhat.com> 18.12-1
changelog:
  - Add 'mvebu' to list of recognized ARM kernels. (dmarlin@redhat.com)
  - Cleanup boot menus (#809663) (mgracik@redhat.com)
  - Don't remove chvt from the install image (#838554) (mgracik@redhat.com)
  - Add llvm-libs (#826351) (mgracik@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 18.13-1
changelog:
  - Add a command line option to override the ARM platform. (dmarlin@redhat.com)
  - Don't remove krb5-libs (#848227) (mgracik@redhat.com)
  - Add grub2-efi support and Secure Boot shim support. (pjones@redhat.com)
  - Fix GPT code to allocate space for /2/ tables. (pjones@redhat.com)
  - Add platforms to the treeinfo for Beaker support. (dmarlin@redhat.com)
  - add logging to lorax (bcl@redhat.com)
  - move live templates into their own subdir of share (bcl@redhat.com)
  - clean up command execution (bcl@redhat.com)
  - livemedia-creator: cleanup logging a bit (bcl@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 18.14-1
changelog:
  - remove cleanup of some essential libraries (bcl@redhat.com)
  - Mask the tmp.mount service to avoid tmpfs (jkeating@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 18.15-1
changelog:
  - change grub-cd.efi to gcdx64.efi (#851326) (bcl@redhat.com)
  - use wildcard for product path to efi binaries (#851196) (bcl@redhat.com)
  - Add yum-plugin-fastestmirror (#849797) (bcl@redhat.com)
  - livemedia-creator: update templates for grub2-efi support (bcl@redhat.com)
  - imgutils: fix umount retry handling (bcl@redhat.com)
  - livemedia-creator: use stage2 instead of root (bcl@redhat.com)
  - livemedia-creator: add location option (bcl@redhat.com)
  - nm-connection-editor was moved to separate package (#849056)
    (rvykydal@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 18.17-1
changelog:
  - use inst.stage2=hd:LABEL (#848641) (bcl@redhat.com)
  - Disable the maximize/unmaximize key bindings (#853410). (clumens@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 18.18-1
changelog:
  - Keep the dracut-lib.sh around for runtime (#851362) (jkeating@redhat.com)
  - X needs the DRI drivers (#855289) (bcl@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 18.19-1
changelog:
  - There's no lang-table in anaconda anymore (#857925) (mgracik@redhat.com)
  - add convienience functions for running commands (bcl@redhat.com)
  - restore CalledProcessError handling (bcl@redhat.com)
  - add CalledProcessError to execWith* functions (bcl@redhat.com)
  - live uses root not inst.stage2 (bcl@redhat.com)
  - Revert "X needs the DRI drivers" (#855289) (bcl@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 18.20-1
changelog:
  - Remove grub 0.97 splash (bcl@redhat.com)
  - livemedia-creator: use rd.live.image instead of liveimg (bcl@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 18.21-1
changelog:
  - Change the install user's shell for tmux (jkeating@redhat.com)
  - Set permissions on the initrd (#863018) (mgracik@redhat.com)
  - Remove the default word from boot menu (#848676) (mgracik@redhat.com)
  - Disable a whole bunch more keyboard shortcuts (#863823). (clumens@redhat.com)
  - use /var/tmp instead of /tmp (bcl@redhat.com)
  - remove rv from unmount error log (bcl@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 18.22-1
changelog:
  - Install the yum-langpacks plugin (#868869) (jkeating@redhat.com)
  - perl is required by some low-level tools on s390x (#868824) (dan@danny.cz)


author: Brian C. Lane <bcl@redhat.com> 18.23-1
changelog:
  - remove multipath rules (#880263) (bcl@redhat.com)
  - add installupgradeinitrd function and use it to install the upgrade initrds
    (dennis@ausil.us)
  - use installinitrd to install the upgrade.img initramfs so that we get correct
    permissions (dennis@ausil.us)
  - ppc and arm need to use kernel.upgrade not kernel.upgrader (dennis@ausil.us)
  - remove upgrade from the sparc and sysylinux config templates
    (dennis@ausil.us)
  - Add the 'fedup' plymouth theme if available (wwoods@redhat.com)
  - make templates install upgrade.img (wwoods@redhat.com)
  - build fedup upgrade.img (wwoods@redhat.com)
  - treebuilder: improve findkernels() initrd search (wwoods@redhat.com)
  - treebuilder: add 'prefix' to rebuild_initrds() (wwoods@redhat.com)
  - Add thai-scalable-waree-fonts (#872468) (mgracik@redhat.com)
  - Do not remove the fipscheck package (#882153) (mgracik@redhat.com)
  - Add MokManager.efi to EFI/BOOT (#882101) (mgracik@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 18.24-1
changelog:
  - imgutils: use -s for kpartx, wait for device creation (bcl@redhat.com)
  - livemedia-creator: Use SELinux Permissive mode (bcl@redhat.com)
  - livemedia-creator: use cmdline mode (bcl@redhat.com)
  - use correct variable for upgrade image on s390 (dan@danny.cz)
  - only ix86/x86_64 and ppc/ppc64 need grub2 (dan@danny.cz)
  - no mount (sub-)package since RHEL-2 (dan@danny.cz)
  - Correct argument to installupgradeinitrd. (dmarlin@redhat.com)
  - Added fedup requires to spec (bcl@redhat.com)


author: Martin Gracik <mgracik@redhat.com> 18.25-1
changelog:
  - Add --noupgrade option (mgracik@redhat.com)
  - Require fedup-dracut* only on Fedora. (dmach@redhat.com)


author: Martin Gracik <mgracik@redhat.com> 18.28-1
changelog:
  - Fix rexists (mgracik@redhat.com)
  - Several 'doupgrade' fixes in the x86 template. (dmach@redhat.com)
  - Missing semicolon (mgracik@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 18.30-1
changelog:
  - yum changed the callback info (bcl@redhat.com)
  - tigervnc-server-module depends on Xorg, which doesn't exist on s390x
    (dan@danny.cz)
  - tools not existing on s390x (dan@danny.cz)
  - specspo is dead for a long time (dan@danny.cz)
  - no Xorg on s390x (dan@danny.cz)
  - Make boot configs consistent. (dmach@redhat.com)
  - Dynamically generate the list of installed platforms for .treeinfo
    (dmarlin@redhat.com)
  - Add a U-Boot wrapped image of 'upgrade.img'. (dmarlin@redhat.com)
  - Add trigger for Anaconda's exception handling to bash_history
    (vpodzime@redhat.com)
  - livemedia-creator: update example kickstarts (bcl@redhat.com)
  - livemedia-creator: don't pass console=ttyS0 (bcl@redhat.com)
  - Fix gcdx64.efi path to work for other distros than Fedora. (dmach@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 19.0-1
changelog:
  - New Version 19.0
  - Remove some env variables (#907692) (bcl@redhat.com)
  - Make sure tmpfs is enabled (#908253) (bcl@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 19.1-1
changelog:
  - Print & log messages on scriptlet/transaction errors (wwoods@redhat.com)
  - sysutils: add -x to cp in linktree (wwoods@redhat.com)
  - treebuilder: fix "Can't stat exclude path "/selinux"..." message
    (wwoods@redhat.com)
  - runtime: install dracut-{nohostonly,norescue} (wwoods@redhat.com)
  - runtime-install: install shim-unsigned (wwoods@redhat.com)
  - Add explicit install of net-tools (#921619) (bcl@redhat.com)
  - Don't remove hmac files for ssh and sshd (#882153) (bcl@redhat.com)
  - Raise an error when there are no initrds (bcl@redhat.com)
  - Add yum logging to yum.log (bcl@redhat.com)
  - remove sparc support (dennis@ausil.us)
  - Change Makefile to produce .tgz (bcl@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 19.2-1
changelog:
  - Let devices get detected and started automatically. (dlehman@redhat.com)
  - Fix import of version (bcl@redhat.com)
  - fix version query and add one to the log file (hamzy@us.ibm.com)
  - Do not remove files required by tools from the s390utils-base package.
    (jstodola@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 19.3-1
changelog:
  - Remove /var/log/journal so journald won't write to overlay
    (wwoods@redhat.com)
  - Leave /etc/os-release in the initrd (#956241) (bcl@redhat.com)
  - no standalone modutils package (dan@danny.cz)
  - remove no longer supported arm kernel variants add the new lpae one
    (dennis@ausil.us)
  - livemedia-creator: Update example kickstarts (bcl@redhat.com)
  - livemedia-creator: Ignore rescue kernels (bcl@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 19.4-1
changelog:
  - Add command for opening anaconda log file to history (mkolman@gmail.com)
  - Do not install chrony and rdate explicitly (vpodzime@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 19.5-1
changelog:
  - Let sshd decide which keys to create (#971856) (bcl@redhat.com)
  - Don't remove thbrk.tri (#886250) (bcl@redhat.com)
  - Switch from xorg-x11-fonts-ethiopic to sil-abyssinica-fonts (#875664)
    (bcl@redhat.com)
  - Make ignoring yum_lock messages in anaconda easier. (clumens@redhat.com)
  - Bump image size up to 2G (#967556) (bcl@redhat.com)
  - livemedia-creator: Fix logic for anaconda test (#958036) (bcl@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 19.6-1
changelog:
  - Add manpage for lorax (bcl@redhat.com)
  - Add manpage for livemedia-creator (bcl@redhat.com)
  - livemedia-creator: pass inst.cmdline for headless installs (#985487)
    (bcl@redhat.com)
  - Stop using /usr/bin/env (#987028) (bcl@redhat.com)
  - livemedia-creator: clarify required package errors (#985340) (bcl@redhat.com)
  - Include device-mapper-persistent-data in images for thinp support.
    (dlehman@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 19.6.2-1
changelog:
  - dracut-nohostonly and dracut-norescue got renamed for dracut >= 030 (#990305)
    (harald@redhat.com)
  - Don't remove xkeyboard-config message files (#989757) (dshea@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 19.6.4-1
changelog:
  - livemedia-creator: Fix gcdx64.efi path to work for other distros than Fedora
    (#1003078) (bcl@redhat.com)
  - livemedia-creator: Update example kickstart for rhel7 (#922064)
    (bcl@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 19.6.6-1
changelog:
  - livemedia-creator: Update minimal packages in README (#1003078) (bcl@redhat.com)
  - macboot defaults to no on rhel7 (#1012529) (bcl@redhat.com)
  - Add macboot option (#1012529) (bcl@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 19.6.8-1
changelog:
  - Set UEFI defaults to match BIOS (#1021451,#1021446) (bcl@redhat.com)
    Resolves: rhbz#1021451
    Resolves: rhbz#1021446
  - livemedia-creator: Set default name to Red Hat Enterprise Linux 7 (#1002027)
    (bcl@redhat.com)
    Resolves: rhbz#1002027
  - livemedia-creator: Add minimal disk example kickstart (#1019728)
    (bcl@redhat.com)
    Resolves: rhbz#1019728


author: Brian C. Lane <bcl@redhat.com> 19.6.16-1
changelog:
  - Activate anaconda-shell@.service on switch to empty VT (#980062)
    (wwoods@redhat.com)
  - flush data to disk after mkfsimage (#1052175) (bcl@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 19.6.17-1
changelog:
  - Don't activate default auto connections after switchroot (#1012511)
    (rvykydal@redhat.com)
    Related: rhbz#1012511


author: Brian C. Lane <bcl@redhat.com> 19.6.19-1
changelog:
  - livemedia-creator: virt-image needs ram in MiB not KiB (#1061773)
    (bcl@redhat.com)
  - Include all the example kickstarts (#1019728) (bcl@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 19.6.21-1
changelog:
  - Check initrd size on ppc64 and warn (#1060691) (bcl@redhat.com)
  - Remove drivers and modules on ppc64 (#1060691) (bcl@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 19.6.22-1
changelog:
  - fedora- services are named rhel- (#1066118) (bcl@redhat.com)
  - Remove unneeded packages from runtime-install (#1065557) (bcl@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 19.6.23-1
changelog:
  - livemedia-creator: Set the product and release version env variables (bcl@redhat.com)
    Resolves: rhbz#1067746
  - Remove unneeded images from the product -logos (bcl@redhat.com)
    Resolves: rhbz#1068721


author: Brian C. Lane <bcl@redhat.com> 19.6.26-1
changelog:
  - Use string for releasever not int (bcl@redhat.com)
    Related: rhbz#1067746
  - Make lorax's installation of lockdown.efi conditional on its existence. (pjones@redhat.com)
    Resolves: rhbz#1071380


author: Hans de Goede <j.w.r.degoede@hhs.nl> 1.08-7
changelog:
  - Taking over as maintainer since Anvil has other priorities
  - Add a patch to fix asm detection on i386 (bug 145882, 145893). Thanks to
    Carlo Marcelo Arenas Belon <carenas@sajinet.com.pe> for the initial patch.
  - Removed unused build dependency on nasm
  - Remove static lib
  - Cleanup %doc a bit


author: Hans de Goede <j.w.r.degoede@hhs.nl> 2.02-5
changelog:
  - Fix configure failure with -Werror-implicit-function-declaration in CFLAGS
  - Add a minilzo subpackage which contains a shared version of minilzo, to be
    used by all applications which ship with their own copy of it (bz 439979)


author: Honza Horak <hhorak@redhat.com> 5.5.28a-5
changelog:
  - Added licenses LGPLv2 and BSD
  - Removed wrong usage of %{epoch}
  - Test-suite is run in %check
  - Removed perl dependency checking adjustment, rpm seems to be smart enough
  - Other minor spec file fixes


author: Honza Horak <hhorak@redhat.com> 5.5.28a-6
changelog:
  - Removed %{_isa} from provides/obsoletes, which doesn't allow
    proper obsoleting
  - Do not obsolete mysql at the time of testing


author: Honza Horak <hhorak@redhat.com> 5.5.28a-7
changelog:
  - Adding necessary hacks for perl dependency checking, rpm is still
    not wise enough
  - Namespace sanity re-added for symbol default_charset_info


author: Honza Horak <hhorak@redhat.com> 5.5.29-1
changelog:
  - Rebase to 5.5.29
    https://kb.askmonty.org/en/mariadb-5529-changelog/
  - Fix inaccurate default for socket location in mysqld-wait-ready
    Resolves: #890535


author: Honza Horak <hhorak@redhat.com> 5.5.29-3
changelog:
  - Packages need to provide also %_isa version of mysql package
  - Provide own symbols with real- prefix to distinguish from mysql
    unambiguously
  - Fix format for buffer size in error messages (MDEV-4156)
  - Disable some tests that fail on ppc and s390
  - Conflict only with real-mysql, otherwise mariadb conflicts with ourself


author: Honza Horak <hhorak@redhat.com> 5.5.29-7
changelog:
  - Use configured prefix value instead of guessing basedir
    in mysql_config
  Resolves: #916189
  - Export dynamic columns and non-blocking API functions documented
    by upstream


author: Honza Horak <hhorak@redhat.com> 5.5.29-9
changelog:
  - Let mariadb-embedded-devel conflict with MySQL-embedded-devel
  - Adjust mariadb-sortbuffer.patch to correspond with upstream patch


author: Honza Horak <hhorak@redhat.com> 1:5.5.29-10
changelog:
  - Adding epoch to have higher priority than other mysql implementations
    when comes to provider comparison


author: Honza Horak <hhorak@redhat.com> 5.5.30-2
changelog:
  - Remove mytop utility, which is packaged separately
  - Resolve multilib conflicts in mysql/private/config.h


author: Honza Horak <hhorak@redhat.com> 5.5.31-1
changelog:
  - Rebase to 5.5.31
    https://kb.askmonty.org/en/mariadb-5531-changelog/
  - Preserve time-stamps in case of installed files
  - Use /var/tmp instead of /tmp, since the later is using tmpfs,
    which can cause problems
    Resolves: #962087
  - Fix test suite requirements


author: Honza Horak <hhorak@redhat.com> 5.5.31-6
changelog:
  - Test suite params enhanced to decrease server condition influence
  - Fix misleading error message when uninstalling built-in plugins
    Related: #966873


author: Honza Horak <hhorak@redhat.com> 5.5.32-1
changelog:
  - Rebase to 5.5.32
    https://kb.askmonty.org/en/mariadb-5532-changelog/
  - Clean-up un-necessary systemd snippets


author: Dennis Gilmore <dennis@ausil.us> - 5.5.32-5
changelog:
  - remove "Requires(pretrans): systemd" since its not possible
  - when installing mariadb and systemd at the same time. as in a new install


author: Honza Horak <hhorak@redhat.com> 5.5.32-6
changelog:
  - Remove unneeded systemd-sysv requires
  - Provide mysql-compat-server symbol
  - Create mariadb.service symlink
  - Fix multilib header location for arm
  - Enhance documentation in the unit file
  - Use scriptstub instead of links to avoid multilib conflicts
  - Revert docs in unversioned dir
  - Remove mysql provides from server-side and obsoleting mysql
  - Revert explicit enabling mysqld in the beggining of the transaction


author: Honza Horak <hhorak@redhat.com> - 1:5.5.32-9
changelog:
  - Move log file into /var/log/mariadb/mariadb.log
  - Rename logrotate script to mariadb
  - Resolves: #999589


author: Honza Horak <hhorak@redhat.com> 1:5.5.34-1
changelog:
  - Rebase to 5.5.34
  - Obsolete mysql packages
    Resolves: #1043971
  - Don't test EDH-RSA-DES-CBC-SHA cipher, it seems to be removed from openssl
    which now makes mariadb/mysql FTBFS because openssl_1 test fails
    Resolves: #1048881
  - Check if socket file is not being used by another process at a time
    of starting the service
    Resolves: #1045435


author: Honza Horak <hhorak@redhat.com> 1:5.5.34-3
changelog:
  - Clean all non-needed doc files properly
    Related: #1044532
  - Disable main.gis-precise test also for AArch64
    Disable perfschema.func_file_io and perfschema.func_mutex for AArch64
    (like it is done for 32-bit ARM)
    Resolves: #1050988
  - Build with -O3 on ppc64 (disabling innodb_prefix_index_restart_server)
    Related: #1051069
  - Move mysql_config to -devel sub-package and remove Require: mariadb
    Resolves: #1050920


author: Honza Horak <hhorak@redhat.com> 5.5.35-1
changelog:
  - Rebase to 5.5.35
    https://kb.askmonty.org/en/mariadb-5535-changelog/
    Also fixes: CVE-2014-0001, CVE-2014-0412, CVE-2014-0437, CVE-2013-5908,
    CVE-2014-0420, CVE-2014-0393, CVE-2013-5891, CVE-2014-0386, CVE-2014-0401,
    CVE-2014-0402
    Resolves: #1054041


author: Honza Horak <hhorak@redhat.com> - 1:5.5.37-1
changelog:
  - Rebase to 5.5.37
    https://kb.askmonty.org/en/mariadb-5537-changelog/
    Also fixes: CVE-2014-2440 CVE-2014-0384 CVE-2014-2432 CVE-2014-2431
    CVE-2014-2430 CVE-2014-2436 CVE-2014-2438 CVE-2014-2419
    Resolves: #1101062


author: Karsten Hopp <karsten@redhat.com> 8.1-0.2
changelog:
  - move drirc into with_hardware section (Dave Airlie)
  - libdricore.so and libglsl.so get built and installed on
    non-hardware archs, include them in the file list


author: Ville Skyttä <ville.skytta@iki.fi> - 8.1-0.9
changelog:
  - Call ldconfig at -libglapi and -libxatracker post(un)install time.
  - Drop redundant ldconfig dependencies, let rpm auto-add them.


author: Dave Airlie <airlied@redhat.com> 9.0-0.1
changelog:
  - rebase to latest upstream 9.0 pre-release branch
  - add back glu from new upstream (split for f18 later)


author: Adam Jackson <ajax@redhat.com> 9.0-0.2
changelog:
  - Switch to swrast classic instead of softpipe for non-llvm arches
  - Re-disable llvm on ppc until it can draw pixels


author: Dan Horák <dan[at]danny.cz> 9.0-0.3
changelog:
  - explicit BR: libGL-devel is required on s390(x), it's probbaly brought in indirectly on x86
  - gallium drivers must be set explicitely for s390(x) otherwise also r300, r600 and vmwgfx are built


author: Dan Horák <dan[at]danny.cz> 9.0-3
changelog:
  - gallium drivers must be set explicitely for s390(x) otherwise also r300, r600 and vmwgfx are built


author: Adam Jackson <ajax@redhat.com> 9.0-4
changelog:
  - mesa-9.0-18-g5fe5aa8: sync with 9.0 branch in git
  - Portability fixes for F17: old wayland, old llvm.


author: Adam Jackson <ajax@redhat.com> 9.0.1-3
changelog:
  - mesa-9.0.1-22-gd0a9ab2.patch: Sync with git
  - Build with -fno-rtti -fno-exceptions, modest size and speed win
  - mesa-9.0.1-less-cxx-please.patch: Remove the only use of typeid() so the
    above works.


author: Adam Jackson <ajax@redhat.com> 9.2-0.1.20130508
changelog:
  - Switch to Mesa master (pre 9.2)
  - Fix llvmpipe on big-endian and enable llvmpipe everywhere
  - Build vdpau drivers for r600/radeonsi/nouveau
  - Enable hardware floating-point texture support
  - Drop GLESv1, nothing's using it, let's not start


author: Adam Jackson <ajax@redhat.com> 9.2-0.1.20130514
changelog:
  - Today's git snap
  - Revert to swrast on ppc32 and s390 since llvm doesn't actually work
  - Build freedreno on arm
  - Drop snb hang workaround (upstream 1dfea559)
  - Rename filesystem package


author: Dave Jones <davej@redhat.com>
changelog:
  - Only enable microcode_ctl service if the CPU is capable.
  - Prevent microcode_ctl getting restarted multiple times on initlevel change (#141581)
  - Make restart/reload work properly
  - Do nothing if not started by root.


author: Dave Jones <davej@redhat.com>
changelog:
  - Create/remove the /dev/cpu/microcode dev node as needed.
  - Use correct path again for the microcode.dat.
  - Remove some no longer needed tests in the init script.


author: Dave Jones <davej@redhat.com>
changelog:
  - Drop the node creation/deletion change from previous release.
    It'll cause grief with selinux, and was a hack to get around
    a udev shortcoming that should be fixed properly.


author: Jarod Wilson <jwilson@redhat.com>
changelog:
  - Spec cleanup and macro standardization.
  - Update license
  - Update microcode data file to 20080131 revision.


author: Dave Jones <davej@redhat.com>
changelog:
  - Shorten sleep time during init.
    This really needs to be replaced with proper udev hooks, but this is
    a quick interim fix.


author: Kyle McMartin <kyle@redhat.com> 1.17-1.56
changelog:
  - Add AMD x86/x86-64 microcode. (Dated: 2009-10-09)
    Doesn't need microcode_ctl modifications as it's loaded by
    request_firmware() like any other sensible driver.
  - Eventually, this AMD firmware can probably live inside
    kernel-firmware once it is split out.


author: Anton Arapov <anton@redhat.com> 1.17-18
changelog:
  - Ship splitted microcode for Intel CPUs [#690930]
  - Include tool for splitting microcode for Intl CPUs (Kay Sievers )


author: Joe Orton <jorton@redhat.com> - 3.4-3
changelog:
  - use a NULL c->sbh pointer with httpd 2.4 (possible fix for #867276)
  - add logging for unexpected daemon process loss


author: Jan Kaluza <jkaluza@redhat.com> - 3.4-7
changelog:
  - compile with -fno-strict-aliasing to workaround Python
    bug http://www.python.org/dev/peps/pep-3123/


author: Christopher Aillon <caillon@redhat.com> 4.6-4
changelog:
  - Use the NSPR version numbering scheme reported by NSPR,
    which unfortunately is not exactly the same as the real
    version (4.6 != 4.6.0 according to RPM and pkgconfig).


author: Christopher Aillon <caillon@redhat.com>
changelog:
  - Stop shipping static libraries; NSS and dependencies no longer
    require static libraries to build.


author: Kai Engert <kengert@redhat.com> 4.6.1-2
changelog:
  - Do not use -ansi when compiling, because of a compilation
    problem with latest glibc and anonymous unions.
    See also bugzilla.mozilla.org # 322427.


author: Kai Engert <kengert@redhat.com> - 4.6.5-2
changelog:
  - Update to latest ipv6 upstream patch
  - Add upstream patch to fix a thread cleanup issue
  - Now requires pkgconfig


author: Kai Engert <kengert@redhat.com> - 4.6.6-2
changelog:
  - Update thread-cleanup patch to latest upstream version
  - Add upstream patch to support PR_STATIC_ASSERT


author: Elio Maldonado <emaldona@redhat.com> - 4.10.2-1
changelog:
  - Update to NSPR_4_10_2_RTM
  - Avoid unsigned integer wrapping in PL_ArenaAllocate
  - Resolves: rhbz#1031465 - CVE-2013-5607


author: Elio Maldonado <emaldona@redhat.com> - 4.10.2-2
changelog:
  - Restore previously used s390x patch as it isn't upstream yet
  - Related: rhbz#1031465 - CVE-2013-5607


author: Christopher Aillon <caillon@redhat.com> 3.11-0.cvs
changelog:
  - Initial import into Fedora Core, based on a CVS snapshot of
    the NSS_3_11_RTM tag
  - Fix up the pkcs11-devel subpackage to contain the proper headers
  - Build with RPM_OPT_FLAGS
  - No need to have rpath of /usr/lib in the pc file


author: Kai Engert <kengert@redhat.com> - 3.11.3-2
changelog:
  - Revert the attempt to require latest NSPR, as it is not yet available
    in the build infrastructure.


author: Kai Engert <kengert@redhat.com> - 3.11.5-1
changelog:
  - Update to 3.11.5
  - This update fixes two security vulnerabilities with SSL 2
  - Do not use -rpath link option
  - Added several unsupported tools to tools package


author: Kai Engert <kengert@redhat.com> - 3.11.5-2
changelog:
  - Fix rhbz#230545, failure to enable FIPS mode
  - Fix rhbz#220542, make NSS more tolerant of resets when in the 
    middle of prompting for a user password.


author: Kai Engert <kengert@redhat.com> - 3.11.7-2
changelog:
  - Update to 3.11.7, but freebl/softokn remain at 3.11.5.
  - Use a workaround to avoid mozilla bug 51429.


author: Kai Engert <kengert@redhat.com> - 3.11.7-10
changelog:
  - Add /etc/prelink.conf.d/nss-prelink.conf in order to blacklist
    our signed libraries and protect them from modification.


author: Kai Engert <kengert@redhat.com> - 3.11.99.3-2
changelog:
  - Build against gcc 4.3.0, use workaround for bug 432146
  - Run the test suite after the build and abort on failures.


author: Kai Engert <kengert@redhat.com> - 3.12.0.3-3
changelog:
  - nss package should own /etc/prelink.conf.d folder, rhbz#452062
  - use upstream patch to fix test suite abort


author: Kai Engert <kaie@redhat.com> - 3.12.3-3
changelog:
  - ship .chk files instead of running shlibsign at install time
  - include .chk file in softokn-freebl subpackage
  - add patch for upstream nss bug 488350


author: Kai Engert <kaie@redhat.com> - 3.12.3-7
changelog:
  - re-enable test suite
  - add patch for upstream bug 488646 and add newer paypal
    certs in order to make the test suite pass


author: Elio Maldonado <emaldona@redhat.com> - 3.12.3.99.3-5
changelog:
  - updated pem module incorporates various patches
  - fix off-by-one error when computing size to reduce memory leak. (483855)
  - fix data type to work on x86_64 systems. (429175)
  - fix various memory leaks and free internal objects on module unload. (501080)
  - fix to not clone internal objects in collect_objects().  (501118)
  - fix to not bypass initialization if module arguments are omitted. (501058)
  - fix numerous gcc warnings. (500815)
  - fix to support arbitrarily long password while loading a private key. (500180) 
  - fix memory leak in make_key and memory leaks and return values in pem_mdSession_Login (501191)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.3.99.3-10
changelog:
  - must install libnssutil3.since nss-util is untagged at the moment
  - preserve time stamps when installing various files


author: Elio Maldonado+emaldona@redhat.com - 3.12.3.99.3-11
changelog:
  - split off nss-softokn and nss-util as subpackages with their own rpms
  - first phase of splitting nss-softokn and nss-util as their own packages


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-19
changelog:
  - remove patches that are now in nss-softokn and
  - remove spurious exec-permissions for nss.pc per rpmlint
  - single requires line in nss.pc.in


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-22
changelog:
  - Fix nss-config not to include nssutil
  - Add BuildRequires on nss-softokn and nss-util since build also runs the test suite


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-25
changelog:
  - Remove nss-prelink.conf as signed all shared libraries moved to nss-softokn
  - Add a temprary hack to nss.pc.in to unblock builds


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-29
changelog:
  - Restoring patches 2 and 7 as we still compile all sources
  - Applying the nss-nolocalsql.patch solves nss-tools sqlite dependency problems


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-30
changelog:
  - Fix FORTIFY_SOURCE buffer overflows in test suite on ppc and ppc64 - bug 519766
  - Fixed requires and buildrequires as per recommendations in spec file review


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-2
changelog:
  - Remove symbolic links to shared libraries from devel - 521155
  - No rpath-link in nss-softokn-config


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-3
changelog:
  - PEM module implements memory management for internal objects - 509705
  - PEM module doesn't crash when processing malformed key files - 512019


author: Elio Maldonado<emaldona@redhat.com - 3.12.4-9
changelog:
  - Install blank databases and configuration file for system shared database
  - nsssysinit queries system for fips mode before relying on environment variable


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-13
changelog:
  - User no longer prompted for a password when listing keys an empty system db (#527048)
  - Fix setup-nsssysinit to handle more general formats (#527051)


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-13.1
changelog:
  - Require nss-softoken of same architecture as nss (#527867)
  - Merge setup-nsssysinit.sh improvements from F-12 (#527051)


author: Elio Maldonado<emaldona@redhat.com> - 3.12.5-1
changelog:
  - Update to 3.12.5
  - Patch to allow ssl/tls clients to interoperate with servers that require renogiation


author: Elio Maldonado<emaldona@redhat.com> - 3.12.5-1.5
changelog:
  - Fix nsssysinit to set the default flags on the crypto module (#545779)
  - Remove redundant header from the pem module


author: Elio Maldonado<emaldona@redhat.com> - 3.12.5-1.6
changelog:
  - Fix nsssysinit to enable apps to use system cert store, patch contributed by David Woodhouse (#546221)
  - Fix spec so sysinit requires coreutils for post install scriplet (#547067)
  - Fix segmentation fault when listing keys or certs in the database, patch contributed by Kamil Dudka (#540387)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.6-1.1
changelog:
  - Using SSL_RENEGOTIATE_TRANSITIONAL as default while on transition period
  - Disabling ssl tests suites until bug 539183 is resolved


author: Elio Maldonado <emaldona@redhat.com> - 3.12.6-3
changelog:
  - Add sed to sysinit requires as setup-nsssysinit.sh requires it (#576071)
  - Update PayPalEE test cert with unexpired one (#580207)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.6-5
changelog:
  - Update pem source tar to pick up the following bug fixes:
  - PEM - Allow collect objects to search through all objects
  - PEM - Make CopyObject return a new shallow copy
  - PEM - Fix memory leak in pem_mdCryptoOperationRSAPriv


author: Elio Maldonado <emaldona@redhat.com> - 3.12.7-2
changelog:
  - Define NSS_USE_SYSTEM_SQLITE and remove unneeded patch
  - Add comments regarding an unversioned provides which triggers rpmlint warning
  - Build requires nss-softokn-devel >= 3.12.7


author: Elio Maldonado <emaldona@redhat.com> - 3.12.8-1
changelog:
  - Update to 3.12.8
  - Prevent disabling of nss-sysinit on package upgrade (#636787)
  - Create pkcs11.txt with correct permissions regardless of umask (#636792) 
  - Setup-nsssysinit.sh reports whether nss-sysinit is turned on or off (#636801)
  - Added provides pkcs11-devel-static to comply with packaging guidelines (#609612)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.8-3
changelog:
  - Replace posttrans sysinit scriptlet with a triggerpostun one (#636787)
  - Fix and cleanup the setup-nsssysinit.sh script (#636792, #636801)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.8.99.2-1
changelog:
  - Update to NSS_3_12_9_BETA2
  - Fix libpnsspem crash when cacert dir contains other directories (#642433)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-5
changelog:
  - Fix the earlier infinite recursion patch (#499444)
  - Remove a header that now nss-softokn-freebl-devel ships


author: Christopher Aillon <caillon@redhat.com> - 3.12.9-6
changelog:
  - Revert patches for 499444 as they use a C++ reserved word and
    cause compilation of Firefox to fail


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-10
changelog:
  - Fix cms headers to not use c++ reserved words (#676036)
  - Reenabling Bug 499444 patches
  - Fix to swap internal key slot on fips mode switches


author: Elio Maldonado <emaldona@redhat.com> - 3.12.10-4
changelog:
  - Enable pluggable ecc support (#712556)
  - Disable the nssdb write-access-on-read-only-dir tests when user is root (#646045)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.11-3
changelog:
  - Fix attempt to free initilized pointer (#717338)
  - Fix leak on pem_CreateObject when given non-existing file name (#734760)
  - Fix pem_Initialize to return CKR_CANT_LOCK on multi-treaded calls (#736410)


author: Elio Maldonado Batiz <emaldona@redhat.com> - 3.13.1-4
changelog:
  - Rebuild with nss-softokn from 3.12 in the buildroot
  - Allows the pem module to statically link against 3.12.x freebl
  - Required for using nss-3.13.x with nss-softokn-3.12.y for a merge inrto rhel git repo
  - Build will be temprarily placed on buildroot override but not pushed in bodhi


author: Elio Maldonado <emaldona@redhat.com> - 3.13.1-5
changelog:
  - Statically link the pem module against system freebl found in buildroot
  - Disabling sha224-related powerup selftest until we update softokn
  - Disable sha224 and pss tests which nss-softokn 3.12.x doesn't support


author: Elio Maldonado <emaldona@redhat.com> - 3.13.1-6
changelog:
  - Removed unwanted /usr/include/nss3 in front of the normal cflags include path
  - Removed unnecessary patch dealing with CERTDB_TERMINAL_RECORD, it's visible


author: Elio Maldonado <emaldona@redhat.com> - 3.13.1-7
changelog:
  - Resolves: Bug 750376 - nss 3.13 breaks sssd TLS
  - Fix how pem is built so that nss-3.13.x works with nss-softokn-3.12.y
  - Only patch blapitest for the lack of sha224 on system freebl
  - Completed the patch to make pem link against system freebl


author: elio maldonado <emaldona@redhat.com> - 3.13.1-9
changelog:
  - Revert to using current nss_softokn_version
  - Patch to deal with lack of sha224 is no longer needed


author: Elio Maldonado <emaldona@redhat.com> - 3.13.1-10
changelog:
  - Resolves: Bug 770682 - nss update breaks pidgin-sipe connectivity
  - NSS_SSL_CBC_RANDOM_IV set to 0 by default and changed to 1 on user request


author: Elio Maldonado <emaldona@redhat.com> - 3.13.3-2
changelog:
  - Pick up fixes from RHEL
  - Resolves: rhbz#800674 - Unable to contact LDAP Server during winsync
  - Resolves: rhbz#800682 - Qpid AMQP daemon fails to load after nss update
  - Resolves: rhbz#800676 - NSS workaround for freebl bug that causes openswan to drop connections


author: Elio Maldonado <emaldona@redhat.com> - 3.13.4-1
changelog:
  - Update to NSS_3_13_4_RTM
  - Update the nss-pem source archive to the latest version
  - Remove no longer needed patches
  - Resolves: Bug 806043 - use pem files interchangeably in a single process
  - Resolves: Bug 806051 - PEM various flaws detected by Coverity
  - Resolves: Bug 806058 - PEM pem_CreateObject leaks memory given a non-existing file name


author: Elio Maldonado <emaldona@redhat.com> - 3.13.4-2
changelog:
  - Resolves: Bug 805723 - Library needs partial RELRO support added
  - Patch coreconf/Linux.mk as done on RHEL 6.2


author: Elio Maldonado <emaldona@redhat.com> - 3.13.5-4
changelog:
  - Resolves: Bug 830410 - Missing Requires %{?_isa}
  - Use Requires: %{name}%{?_isa} = %{version}-%{release} on tools
  - Drop zlib requires which rpmlint reports as error E: explicit-lib-dependency zlib
  - Enable sha224 portion of powerup selftest when running test suites
  - Require nspr 4.9.1


author: Elio Maldonado <emaldona@redhat.com> - 3.13.5-8
changelog:
  - Rebase pem sources to fedora-hosted upstream to pick up two fixes from rhel-6.3
  - Resolves: rhbz#847460 - Fix invalid read and free on invalid cert load
  - Resolves: rhbz#847462 - PEM module may attempt to free uninitialized pointer 
  - Remove unneeded fix gcc 4.7 c++ issue in secmodt.h that actually undoes the upstream fix


author: Elio Maldonado <emaldona@redhat.com> - 3.14-0.1.rc.1
changelog:
  - Update to NSS_3_14_RC1
  - update nss-589636.patch to apply to httpdserv
  - turn off ocsp tests for now
  - remove no longer needed patches
  - remove headers shipped by nss-util


author: Elio Maldonado <emaldona@redhat.com> - 3.14-2
changelog:
  - Add secmodt.h to the headers installed by nss-devel
  - nss-devel must install secmodt.h which moved from softoken to pk11wrap with nss-3.14


author: Elio Maldonado <emaldona@redhat.com> - 3.14-5
changelog:
  - Fix the spec file so sechash.h gets installed
  - Resolves: rhbz#871882 - missing header: sechash.h in nss 3.14


author: Elio Maldonado <emaldona@redhat.com> - 3.14-6
changelog:
  - Fix a previous unwanted merge from f18
  - Update the SS_SSL_CBC_RANDOM_IV patch to match new sources while
  - Keeping the patch disabled while we are still in rawhide and
  - State in comment that patch is needed for both stable and beta branches
  - Update .gitignore to download only the new sources


author: Elio Maldonado <emaldona@redhat.com> - 3.14-7
changelog:
  - Add a dummy source file for testing /preventing fedpkg breakage
  - Helps test the fedpkg new-sources and upload commands for breakage by nss updates
  - Related to Bug 872124 - nss 3.14 breaks fedpkg new-sources


author: Elio Maldonado <emaldona@redhat.com> - 3.14-8
changelog:
  - Fix pk11wrap locking which fixes 'fedpkg new-sources' and 'fedpkg update' hangs
  - Bug 872124 - nss-3.14 breaks fedpkg new-sources
  - Fix should be considered preliminary since the patch may change upon upstream approval


author: Elio Maldonado <emaldona@redhat.com> - 3.14-9
changelog:
  - Disable bypass code at build time and return failure on attempts to enable at runtime
  - Bug 806588 - Disable SSL PKCS #11 bypass at build time


author: Elio Maldonado <emaldona@redhat.com> - 3.14-11
changelog:
  - Bug 879978 - Install the nssck.api header template in a place where mod_revocator can access it
  - Install nssck.api in /usr/includes/nss3


author: Elio Maldonado <emaldona@redhat.com> - 3.14-12
changelog:
  - Bug 879978 - Install the nssck.api header template where mod_revocator can access it
  - Install nssck.api in /usr/includes/nss3/templates


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-1
changelog:
  - Update to NSS_3_14_3_RTM
  - sync up pem rsawrapr.c with softoken upstream changes for nss-3.14.3
  - Resolves: rhbz#908257 - CVE-2013-1620 nss: TLS CBC padding timing attack
  - Resolves: rhbz#896651 - PEM module trashes private keys if login fails
  - Resolves: rhbz#909775 - specfile support for AArch64
  - Resolves: rhbz#910584 - certutil -a does not produce ASCII output


author: Kai Engert <kaie@redhat.com> - 3.14.3-9
changelog:
  - Configure libnssckbi.so to use the alternatives system
    in order to prepare for a drop in replacement.


author: Elio Maldonado <emaldona@redhat.com> - 3.15-5
changelog:
  - Install man pages for nss-tools and the nss-config and setup-nsssysinit scripts
  - Resolves: rhbz#606020 - nss security tools lack man pages


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-2
changelog:
  - Update to NSS_3_15_1_RTM
  - Apply various fixes to the man pages and add new ones
  - Enable the iquote.patch to access newly introduced types
  - Add man page for pkcs11.txt configuration file and cert and key databases
  - Add missing option descriptions for {cert|cms|crl}util
  - Resolves: rhbz#948495 - Man page scan results for nss
  - Resolves: rhbz#982723 - Fix path to script in man page for nss-sysinit


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-4
changelog:
  - Install symlink to nss-sysinit.sh without the .sh suffix
  - Resolves: rhbz#982723 - nss-sysinit man page has wrong path for the script


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-1
changelog:
  - Rebase to nss-3.15.2
  - Resolves: rhbz#1012656 - pick up NSS 3.15.2 to fix CVE-2013-1739 and disable MD5 in OCSP/CRL


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-2
changelog:
  - Add description of the certutil's --email option to it's manpage
  - Resolves: rhbz#Bug 948495 - Man page scan results for nss


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-4
changelog:
  - Enable fips when system is in fips mode
  - Resolves: rhbz#852023 - FIPS mode detection does not work


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-6
changelog:
  - Fix errors in ssl disabling patches for both library and tests
  - Add s390x to the multilib_arches definition used for alt_ckbi
  - Resolves: rhbz#1001841 - Disable SSL2 and the export cipher suites


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-7
changelog:
  - Fix bash syntax error in patch for disabling ssl2 tests
  - Resolves: rhbz#1001841 - Disable SSL2 and the export cipher suites


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-8
changelog:
  - Fix patch for disabling ssl2 in ssl to correctly set error code
  - Fix syntax error reported in the build.log even tough it succeeds
  - Add patch top ignore setpolicy result 
  - Resolves: rhbz#1001841 - Disable SSL2 and the export cipher suites
  - Resolves: rhbz#1026677 - Attempt to run ipa-client-install fails


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-9
changelog:
  - Fix certutil man page options names to be consistent with help
  - Resolves: rhbz#948495 - man page scan results for nss
  - Remove incorrect count argument in status description in nss-sysinit man page
  - Resolves: rhbz#982723 - man page of nss-sysinit incorrect option descriptions


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-10
changelog:
  - Fix path to script and remove -- from some options in nss-sysinit man page
  - Resolves: rhbz#982723 - man page of nss-sysinit worong path and other flaws


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-2
changelog:
  - Revoke trust in one mis-issued anssi certificate
  - Resolves: Bug 1040284 - nss: Mis-issued ANSSI/DCSSI certificate (MFSA 2013-117) [rhel-7.0]


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-4
changelog:
  - Improve pluggable ECC support for ECDSA
  - Resolves: Bug 752980 - [7.0 FEAT] Support ECDSA algorithm in the nss package


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-6
changelog:
  - Fix a coverity scan compile time warning for the pem module
  - Resolves: Bug 1002271 - NSS pem module should not require unique base file names


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-7
changelog:
  - Move several nss-sysinit manpages tar archives to the %files
  - Resolves: Bug 1050163 - Same files in two packages create rpm conflict


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-8
changelog:
  - Fix the spec file to apply the nss ecc list patch for bug 752980
  - Resolves: Bug 752980 - Support ECDSA algorithm in the nss package via puggable ecc


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-9
changelog:
  - Rebase to nss-3.15.4
  - Resolves: Bug 1054457 - CVE-2013-1740 nss: false start PR_Recv information disclosure security issue
  - Remove no longer needed patches for manpages that were applied upstream
  - Remove no longer needed patch to disable ocsp stapling tests
  - Update iquote.patch on account of upstream changes
  - Update and rename patch to pem/rsawrapr.c on account of upstream changes
  - Use the pristine upstream sources for nss without repackaging
  - Avoid unneeded manual step which may introduce errors


author: Elio Maldonado <emaldona@redhat.com> - 3.15.4-3
changelog:
  - Remove spurious man5 wildcard entry as all manpages are listed by name
  - Resolves: Bug 1050163 - Same files in two packages create rpm conflict


author: Elio Maldonado <emaldona@redhat.com> - 3.15.4-4
changelog:
  - Update pem sources to latest from nss-pem upstream
  - Pick up pem module fixes verified on RHEL and applied upstream
  - Remove no loger needed pem patches on acccount on this update
  - Add comments documenting the iquote.patch 
  - Resolves: Bug 1054457 - CVE-2013-1740


author: Elio Maldonado <emaldona@redhat.com> - 3.15.4-5
changelog:
  - Pick up a fix from rhel-6 and fix an rpm conflict
  - Don't hold issuer cert handles in crl cache
  - Resolves: Bug 1034409 - deadlock in trust domain and object lock
  - Move nss shared db files to the main package
  - Resolves: Bug 1050163 - Same files in two packages create rpm conflict


author: Elio Maldonado <emaldona@redhat.com> - 3.15.4-6
changelog:
  - Disallow disabling the internal module
  - Resolves: Bug 1056036 - nss segfaults with opencryptoki module


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2-1
changelog:
  - Rebase to nss-3.16.2
  - Resolves: Bug 1124659 - Rebase RHEL 7 to at least NSS 3.16.1 (FF 31)
  - Fix test failure detection in the %check section
  - Move removal of unwanted source directories to the end of the %prep section
  - Update various patches on account of the rebase
  - Remove unused patches rendered obsolete by the rebase
  - Fix libssl and test patches that disable ssl2 support
  - Replace expired PayPal test certificate that breaks the build


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2-2
changelog:
  - Restore missing options descriptions fix for certutil manpage
  - Document certutil options --dump-ext-val, --extGeneric, and --extSAN
  - Related: Bug 1124659 - Rebase RHEL 7 to at least NSS 3.16.1


author: Elio Maldonado@<emaldona@redhat.com> - 3.12.3.99.3-19
changelog:
  - Determine NSSUTIL_INCLUDE_DIR and NSSUTIL_LIB_DIR with a pkg-config query on nss-util
  - Remove the release 17 hack


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-3
changelog:
  - Remove symblic links to shared libraries from devel, rhbz#521155
  - Apply the nss-nolocalsql patch
  - No rpath-link in nss-softokn-config


author: Elio Maldonado <emaldona@redhat.com> - 3.12.4-16
changelog:
  - allow prelink of softoken and freebl. Change the verify code to use
    prelink -u if prelink is installed. Fix by Robert Relyea rhbz#504949


author: Elio Maldonado <emaldona@redhat.com> - 3.12.4-19
changelog:
  - Consider the system as not fips enabled when /proc/sys/crypto/fips_enabled isn't present (rhbz#590199)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.4-20
changelog:
  - Add %{?_isa} to the requires in the devel packages (#596840)
  - Fix typo in the package description (#598295)
  - Update nspr version to 4.8.4


author: Elio Maldonado <emaldona@redhat.com> - 3.12.7-2
changelog:
  - Define NSS_USE_SYSTEM_SQLITE and remove nss-nolocalsql patch
  - Fix rpmlint warnings about macros in comments and changelog


author: Elio Maldonado <emaldona@redhat.com> - 3.12.8-1
changelog:
  - Update to 3.12.8
  - Adhere to static library packaging guidelines (#609613)
  - Fix nss-util-devel version dependency line
  - Shorten freebl and freebl subpackages descriptions


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-4
changelog:
  - Add blapit.h to headers provided by nss-softokn-freebl-devel (#675196)
  - Expand the freebl-devel package description


author: Elio Maldonado <emaldona@redhat.com> - 3.12.10-2
changelog:
  - Fix intel optimized aes code to deal with case where input and ouput are in the same buffer (#709517)


author: Elio Maldonado <emaldona@redhat.com> - 3.13-0.1.rc0.3
changelog:
  - Update to NSS_3_13_RC0 post bootstrapping
  - Don't incude util in sources for the lookaside cache
  - Reenable building the fipstest tool
  - Restore full cli argument parsing in the sectool library


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-11
changelog:
  - Downgrading to 3.12.9 for a merge into new RHEL git repo
  - This build is for the buildroot for a limited time only
  - Do not not push it to update-testing


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-13
changelog:
  - Bug 757005 Build nss-softokn for rhel 7
  - Make it almost like nss-softokn-3.12.9 in rhel 6.2
  - Added a patch to build with Linux 3 and higher
  - Meant to work with nss and nss-utul 3.1.3.1
  - Download only the 3.12.9 sources from the lookaside cache


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-14
changelog:
  - Restore the update to 3.13.1
  - Update the patch for freebl to deal with prelinked shared libraries
  - Add additional dbrg power-up self-tests as required by fips
  - Reactivate the tests


author: Elio Maldonado <emaldona@redhat.com> - 3.13.1-15
changelog:
  - Bug 770999 - Fix segmentation violation when turning on fips mode
  - Reintroduce the iquote patch but don't apply it unless needed


author: Tom Callaway <spot@fedoraproject.org> 3.13.1-19.1
changelog:
  - fix issue with gcc 4.7 in secmodt.h and C++11 user-defined literals
  - temporarily revert /usrmove changes. they will be restored in -20 for the f17-usrmove tag.


author: Elio Maldonado <emaldona@redhat.com> - 3.13.5-1
changelog:
  - Update to NSS_3_13_5_RTM
  - Remove unneeded fix for gcc 4.7 c++ issue in secmodt.h which undoes the upstream fix
  - Fix Libs: line on nss-softokn.pc.in


author: Elio Maldonado <emaldona@redhat.com> - 3.14-0.1.rc.1
changelog:
  - Update to NSS_3_14_RC1
  - Remove patches rendered obsolete by this update and update others
  - Temporarily modifiy the spec file while bootstrapping the buildroot a follows:
  - Remove unwanted headers that we lo loger ship
  - Modified the post install scriplet to ensure the in-tree freebl library is loaded


author: Elio Maldonado <emaldona@redhat.com> - 3.14-4
changelog:
  - Apply the bug 829088 patch in question
  - Adjust the patch to account for code changes in nss-3.14
  - Resolves: rhbz#829088 - Fix failure in sha244 self-test


author: Elio Maldonado <emaldona@redhat.com> - 3.14-5
changelog:
  - Truly apply the bug 829088 patch this time
  - Resolves: rhbz#829088 - Fix failure in sha244 self-test


author: Elio Maldonado <emaldona@redhat.com> - 3.14.2-2
changelog:
  - Update to NSS_3_14_2_RTM
  - Restore comments on how to transition when signing algorithm changes
  - Remove unused patches


author: Elio Maldonado <emaldona@redhat.com> - 3.15-0.1.beta.1
changelog:
  - Update to NSS_3_15_BETA1
  - Update spec file, patches, and helper scrips on account of a shallwer source tree


author: Elio Maldonado <emaldona@redhat.com> - 3.15-0.1.beta.2
changelog:
  - Add lowhashtest and pk11gcmtest as unsupported tools
  - Modify nss-softoken-split script to include them in the split


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-3
changelog:
  - Add export NSS_ENABLE_ECC=1 rto the %build and %check sections
  - Resolves: rhbz#752980 - [7.0 FEAT] Support ECDSA algorithm in the nss packag


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-1
changelog:
  - Rebase to nss-softoken from nss-3.15.2
  - Resolves: rhbz#1012679 - pick up NSS-SOFTOKN 3.15.2 (required for bug 1012656)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-3
changelog:
  - Fix to allow level 1 fips mode if the db has no password
  - Resolves: Bug 852023 - FIPS mode detection does not work


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-4
changelog:
  - Rebase to nss-3.15.4
  - Resolves: Bug 1054457 - CVE-2013-1740
  - Update softokn splitting script to oparate on the upstream pristine source
  - Using the .gz archives directly, not repackaging as .bz2 ones
  - Avoid unneeded manual steps that could introduce errors
  - Update the iquote and build softoken only patches on account of the rebase


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2-1
changelog:
  - Update to nss-3.16.2
  - Resolves: Bug 1124659 - Rebase RHEL 7.1 to at least NSS-SOFTOKN 3.16.1 (FF 31)


author: Dennis Gilmore <dennis@ausil.us> 3.12.3.99.3-10
changelog:
  - dont include the headers in nss-util only in the -devel package
  - nss-util-devel Requires nss-devel since its only providing a subset of the headers.


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-11
changelog:
  - Remove spurious executable permissions from nss-util-config
  - Shorten some descriptions to keep rpmlint happy


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-3
changelog:
  - Remove symbolic links to shared libraries from devel - 521155
  - Apply nss-nolocalsql patch subset for nss-util
  - No rpath-link in nss-util-config


author: Elio Maldonado <emaldona@redhat.com> - 3.13.4-0.1.beta.1
changelog:
  - Update to NSS_3_13_4_BETA1
  - Improve steps to splitting off util from the nss
  - Add executable attribute to the splitting script


author: Elio Maldonado <emaldona@redhat.com> - 3.13.4-2
changelog:
  - Resolves: Bug 805716 - Library needs partial RELRO support added
  - Patch coreconf/Linux.mk as done on RHEL 6.2


author: Elio Maldonado <emaldona@redhat.com> - 3.15.beta1-0.1.beta.1
changelog:
  - Update to NSS_3_15_BETA1
  - Update spec file, patches, and helper scripts on account of a shallower source tree


author: Elio Maldonado <emaldona@redhat.com> - 3.15-0.1.beta1.2
changelog:
  - Don't include prtypes.h from hasht.t
  - Resolves: rhbz#953277 - rawhide build of glibc fails due to fatal error from nss3/hasht.h


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-3
changelog:
  - Add the nss-util portion of a fix for a bug in nss and nss-util
  - Resolves: Bug 752980 - Support ECDSA via pluggable ECC in the nss package


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-4
changelog:
  - Update to nss-3.15.4
  - Modified the nss-split-util script to use the nss upstream pristine sources
  - Resolves: Bug 1054457 - CVE-2013-1740 nss: false start PR_Recv information disclosure security issue [rhel-7.0]


author: Bernhard Rosenkrdnzer <bero@redhat.de>
changelog:
  - inital packaging
  - changes from base:
    - Move /usr/local/ssl to /usr/share/ssl for FHS compliance
    - handle RPM_OPT_FLAGS


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 0.9.5a, modified for U.S.
  - add perl as a build-time requirement
  - move certificate makefile to another package
  - disable RC5, IDEA, RSA support
  - remove optimizations for now


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - byte-compile python extensions without the build-root
  - adjust the makefile to not remove temporary files (like .key files when
    building .csr files) by marking them as .PRECIOUS


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - remove -Wa,* and -m* compiler flags from the default Configure file (#20656)
  - add the CA.pl man page to the perl subpackage


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - disable some inline assembly, which on x86 is Pentium-specific
  - re-enable MD2 (see http://www.ietf.org/ietf/IPR/RSA-MD-all)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - re-disable MD2 -- the EVP_MD_CTX structure would grow from 100 to 152
    bytes or so, causing EVP_DigestInit() to zero out stack variables in
    apps built against a version of the library without it


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 0.9.6
  - enable MD2
  - use the libcrypto.so and libssl.so targets to build shared libs with
  - bump the soversion to 1 because we're no longer compatible with any of
    the various 0.9.5a packages circulating around, which provide lib*.so.0


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 0.9.6a
  - use the build-shared target to build shared libraries
  - bump the soversion to 2 because we're no longer compatible with
    our 0.9.5a packages or our 0.9.6 packages
  - drop the patch for making rsatest a no-op when rsa null support is used
  - put all man pages into <section>ssl instead of <section>
  - break the m2crypto modules into a separate package


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add a script for creating dummy certificates
  - move man pages from %{_mandir}/man?/foo.?ssl to %{_mandir}/man?ssl/foo.?


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-3
changelog:
  - add patches for AEP hardware support
  - add patch to keep trying when we fail to load a cert from a file and
    there are more in the file
  - add missing prototype for ENGINE_ubsec() in engine_int.h


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-4
changelog:
  - move man pages back to %{_mandir}/man?/foo.?ssl from
    %{_mandir}/man?ssl/foo.?
  - add an [ engine ] section to the default configuration file


author: Gary Benson <gbenson@redhat.com> stronghold-0.9.6c-1
changelog:
  - upgrade to 0.9.6c
  - bump BuildArch to i686 and enable assembler on all platforms
  - synchronise with shrimpy and rawhide
  - bump soversion to 3


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-30
changelog:
  - add configuration stanza for x86_64 and use it on x86_64
  - build for linux-ppc on ppc
  - start running the self-tests again


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.7-6
changelog:
  - EVP_DecryptInit should call EVP_CipherInit() instead of EVP_CipherInit_ex(),
    to get the right behavior when passed uninitialized context structures
    (#83766)
  - build with -mcpu=ev5 on alpha family (#83828)


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.7-8
changelog:
  - add fix to guard against attempts to allocate negative amounts of memory
  - add patch for CAN-2003-0078, fixing a timing attack


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-5
changelog:
  - add patch to harden against Klima-Pokorny-Rosa extension of Bleichenbacher's
    attack (CAN-2003-0131)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - backport fix for engine-used-for-everything from 0.9.7b
  - backport fix for prng not being seeded causing problems, also from 0.9.7b
  - add a check at build-time to ensure that RSA is thread-safe
  - keep perlpath from stomping on the libica configure scripts


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add security fixes for protocol parsing bugs (CAN-2003-0543, CAN-2003-0544)
    and heap corruption (CAN-2003-0545)
  - update RHNS-CA-CERT files
  - ease back on the number of threads used in the threading test


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-22
changelog:
  - add -Wa,--noexecstack to RPM_OPT_FLAGS so that assembled modules get tagged
    as not needing executable stacks


author: Phil Knirsch <pknirsch@redhat.com> 0.9.7a-24
changelog:
  - Use /dev/urandom instead of PRNG for libica.
  - Apply libica-1.3.5 fix for /dev/urandom in icalinux.c
  - Use latest ICA engine patch from IBM.


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-25
changelog:
  - add dependency on zlib-devel for the -devel package, which depends on zlib
    symbols because we enable zlib for libssl (#102962)


author: Joe Orton <jorton@redhat.com> 0.9.7a-27
changelog:
  - updated ca-bundle.crt: removed expired GeoTrust roots, added
    freessl.com root, removed trustcenter.de Class 0 root


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-33
changelog:
  - add an intermediate <openssl/opensslconf.h> which points to the right
    arch-specific opensslconf.h on multilib arches


author: Tomas Mraz <tmraz@redhat.com> 0.9.7e-1
changelog:
  - new upstream source, updated patches
  - added patch so we are hopefully ABI compatible with upcoming
    0.9.7f


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-1
changelog:
  - reenable optimizations on ppc64 and assembly code on ia64
  - upgrade to new upstream version (no soname bump needed)
  - disable thread test - it was testing the backport of the
    RSA blinding - no longer needed
  - added support for changing serial number to
    Makefile.certificate (#151188)
  - make ca-bundle.crt a config file (#118903)


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-2
changelog:
  - add back RC4_CHAR on ia64 and x86_64 so the ABI isn't broken
  - disable broken bignum assembly on x86_64


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-3
changelog:
  - uninitialized variable mustn't be used as input in inline
    assembly
  - reenable the x86_64 assembly again


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-4
changelog:
  - move certificates to _sysconfdir/pki/tls (#143392)
  - move CA directories to _sysconfdir/pki/CA
  - patch the CA script and the default config so it points to the
    CA directories


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-6
changelog:
  - use poll instead of select in rand (#128285)
  - fix Makefile.certificate to point to /etc/pki/tls
  - change the default string mask in ASN1 to PrintableString+UTF8String


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-7
changelog:
  - fix CAN-2005-0109 - use constant time/memory access mod_exp
    so bits of private key aren't leaked by cache eviction (#157631)
  - a few more fixes from upstream 0.9.7g


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-9
changelog:
  - add *.so.soversion as symlinks in /lib (#165264)
  - remove unpackaged symlinks (#159595)
  - fixes from upstream (constant time fixes for DSA,
    bn assembler div on ppc arch, initialize memory on realloc)


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-10
changelog:
  - fix CAN-2005-2969 - remove SSL_OP_MSIE_SSLV2_RSA_PADDING which
    disables the countermeasure against man in the middle attack in SSLv2
    (#169863)
  - use sha1 as default for CA and cert requests - CAN-2005-2946 (#169803)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8a-4
changelog:
  - fix build (-lcrypto was erroneusly dropped) of the updated libica
  - updated ICA engine to 1.3.6-rc3


author: Tomas Mraz <tmraz@redhat.com> - 0.9.8a-6
changelog:
  - fix stale open handles in libica (#177155)
  - fix build if 'rand' or 'passwd' in buildroot path (#178782)
  - initialize VIA Padlock engine (#186857)


author: Tomas Mraz <tmraz@redhat.com> - 0.9.8b-1
changelog:
  - upgrade to new version, stays ABI compatible
  - there is no more linux/config.h (it was empty anyway)


author: Tomas Mraz <tmraz@redhat.com>
changelog:
  - add ipv6 support to s_client and s_server (by Jan Pazdziora) (#198737)
  - add patches for BN threadsafety, AES cache collision attack hazard fix and
    pkcs7 code memleak fix from upstream CVS


author: Tomas Mraz <tmraz@redhat.com> 0.9.8b-7
changelog:
  - fix CVE-2006-2937 - mishandled error on ASN.1 parsing (#207276)
  - fix CVE-2006-2940 - parasitic public keys DoS (#207274)
  - fix CVE-2006-3738 - buffer overflow in SSL_get_shared_ciphers (#206940)
  - fix CVE-2006-4343 - sslv2 client DoS (#206940)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8b-13
changelog:
  - allow building on ARM architectures (#245417)
  - use reference timestamps to prevent multilib conflicts (#218064)
  - -devel package must require pkgconfig (#241031)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8b-14
changelog:
  - use localhost in testsuite, hopefully fixes slow build in koji
  - CVE-2007-3108 - fix side channel attack on private keys (#250577)
  - make ssl session cache id matching strict (#233599)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8b-16
changelog:
  - fix CVE-2007-5135 - off-by-one in SSL_get_shared_ciphers (#309801)
  - fix CVE-2007-4995 - out of order DTLS fragments buffer overflow (#321191)
  - add alpha sub-archs (#296031)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8g-2
changelog:
  - enable some new crypto algorithms and features
  - add some more important bug fixes from openssl CVS


author: Tomas Mraz <tmraz@redhat.com> 0.9.8g-3
changelog:
  - set default paths when no explicit paths are set (#418771)
  - do not add tls extensions to client hello for SSLv3 (#422081)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8g-9
changelog:
  - fix CVE-2008-0891 - server name extension crash (#448492)
  - fix CVE-2008-1672 - server key exchange message omit crash (#448495)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8j-1
changelog:
  - new upstream version with necessary soname bump (#455753)
  - temporarily provide symlink to old soname to make it possible to rebuild
    the dependent packages in rawhide
  - add eap-fast support (#428181)
  - add possibility to disable zlib by setting
  - add fips mode support for testing purposes
  - do not null dereference on some invalid smime files
  - add buildrequires pkgconfig (#479493)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8j-6
changelog:
  - drop the temporary triggerpostun and symlinking in post
  - fix the pkgconfig files and drop the unnecessary buildrequires
    on pkgconfig as it is a rpmbuild dependency (#481419)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8j-7
changelog:
  - must also verify checksum of libssl.so in the FIPS mode
  - obtain the seed for FIPS rng directly from the kernel device
  - drop the temporary symlinks


author: Tomas Mraz <tmraz@redhat.com> 0.9.8k-1
changelog:
  - update to new upstream release (minor bug fixes, security
    fixes and machine code optimizations only)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8k-6
changelog:
  - abort if selftests failed and random number generator is polled
  - mention EVP_aes and EVP_sha2xx routines in the manpages
  - add README.FIPS
  - make CA dir absolute path (#445344)
  - change default length for RSA key generation to 2048 (#484101)


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-0.11.beta4
changelog:
  - update to new upstream version, no soname bump needed
  - fix CVE-2009-3555 - note that the fix is bypassed if SSL_OP_ALL is used
    so the compatibility with unfixed clients is not broken. The
    protocol extension is also not final.


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-0.12.beta4
changelog:
  - keep the beta status in version number at 3 so we do not have to rebuild
    openssh and possibly other dependencies with too strict version check


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-0.13.beta4
changelog:
  - disable enforcement of the renegotiation extension on the client (#537962)
  - add fixes from the current upstream snapshot


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-0.17.beta4
changelog:
  - upstream fix compression handling on session resumption
  - various null checks and other small fixes from upstream
  - upstream changes for the renegotiation info according to the latest draft


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-0.19.beta4
changelog:
  - fix CVE-2009-4355 - leak in applications incorrectly calling
    CRYPTO_free_all_ex_data() before application exit (#546707)
  - upstream fix for future TLS protocol version handling


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-0.21.beta5
changelog:
  - gracefully handle zero length in assembler implementations of
    OPENSSL_cleanse (#564029)
  - do not fail in s_server if client hostname not resolvable (#561260)


author: Tomas Mraz <tmraz@redhat.com> 1.0.0c-2
changelog:
  - listen on ipv6 wildcard in s_server so we accept connections
    from both ipv4 and ipv6 (#601612)
  - fix openssl speed command so it can be used in the FIPS mode
    with FIPS allowed ciphers


author: Tomas Mraz <tmraz@redhat.com> 1.0.0c-3
changelog:
  - add -x931 parameter to openssl genrsa command to use the ANSI X9.31
    key generation method
  - use FIPS-186-3 method for DSA parameter generation
  - add OPENSSL_FIPS_NON_APPROVED_MD5_ALLOW environment variable
    to allow using MD5 when the system is in the maintenance state
    even if the /proc fips flag is on
  - make openssl pkcs12 command work by default in the FIPS mode


author: Tomas Mraz <tmraz@redhat.com> 1.0.0d-3
changelog:
  - add support for VIA Padlock on 64bit arch from upstream (#617539)
  - do not return bogus values from load_certs (#652286)


author: Tomas Mraz <tmraz@redhat.com> 1.0.0d-6
changelog:
  - add support for newest Intel acceleration improvements backported
    from upstream by Intel in form of a separate engine


author: Tomas Mraz <tmraz@redhat.com> 1.0.0d-7
changelog:
  - correct openssl cms help output (#636266)
  - more tolerant starttls detection in XMPP protocol (#608239)


author: Tomas Mraz <tmraz@redhat.com> 1.0.0d-8
changelog:
  - drop the separate engine for Intel acceleration improvements
    and merge in the AES-NI, SHA1, and RC4 optimizations
  - add support for OPENSSL_DISABLE_AES_NI environment variable
    that disables the AES-NI support


author: Tomas Mraz <tmraz@redhat.com> 1.0.0e-3
changelog:
  - do not use AVX instructions when osxsave bit not set
  - add direct known answer tests for SHA2 algorithms


author: Tomas Mraz <tmraz@redhat.com> 1.0.0g-1
changelog:
  - new upstream release fixing CVE-2012-0050 - DoS regression in
    DTLS support introduced by the previous release (#782795)


author: Tomas Mraz <tmraz@redhat.com> 1.0.1-0.1.beta2
changelog:
  - new upstream release from the 1.0.1 branch, ABI compatible
  - add documentation for the -no_ign_eof option


author: Tomas Mraz <tmraz@redhat.com> 1.0.1-0.2.beta3
changelog:
  - epoch bumped to 1 due to revert to 1.0.0g on Fedora 17
  - new upstream release from the 1.0.1 branch
  - fix s390x build (#798411)
  - versioning for the SSLeay symbol (#794950)
  - add -DPURIFY to build flags (#797323)
  - filter engine provides
  - split the libraries to a separate -libs package
  - add make to requires on the base package (#783446)


author: Tomas Mraz <tmraz@redhat.com> 1.0.1c-3
changelog:
  - fix DSA key generation in FIPS mode (#833866)
  - allow duplicate FIPS_mode_set(1)
  - enable build on ppc64 subarch (#834652)


author: Tomas Mraz <tmraz@redhat.com> 1.0.1c-4
changelog:
  - do not move libcrypto to /lib
  - do not use environment variables if __libc_enable_secure is on
  - fix strict aliasing problems in modes


author: Tomas Mraz <tmraz@redhat.com> 1.0.1c-7
changelog:
  - add missing initialization of str in aes_ccm_init_key (#853963)
  - add important patches from upstream CVS
  - use the secure_getenv() with new glibc


author: Tomas Mraz <tmraz@redhat.com> 1.0.1c-8
changelog:
  - use 1024 bit DH parameters in s_server as 512 bit is not allowed
    in FIPS mode and it is quite weak anyway


author: Tomas Mraz <tmraz@redhat.com> 1.0.1c-11
changelog:
  - add script for renewal of a self-signed cert by Philip Prindeville (#871566)
  - allow X509_issuer_and_serial_hash() produce correct result in
    the FIPS mode (#881336)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-20
changelog:
  - document the nextprotoneg option in manual pages
    original patch by Hubert Kario
  - try to avoid some races when updating the -fips subpackage


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-21
changelog:
  - make DTLS1 work in FIPS mode
  - avoid RSA and DSA 512 bits and Whirlpool in 'openssl speed' in FIPS mode
  - drop the -fips subpackage, installation of dracut-fips marks that the FIPS
    module is installed
  - avoid dlopening libssl.so from libcrypto
  - fix small memory leak in FIPS aes selftest
  - fix segfault in openssl speed hmac in the FIPS mode


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-24
changelog:
  - additional changes required for FIPS validation
  - disable verification of certificate, CRL, and OCSP signatures
    using MD5 if OPENSSL_ENABLE_MD5_VERIFY environment variable
    is not set


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-26
changelog:
  - fix CVE-2013-6449 - crash when version in SSL structure is incorrect
  - drop weak ciphers from the default TLS ciphersuite list
  - add back some symbols that were dropped with update to 1.0.1 branch
  - more FIPS validation requirement changes


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-28
changelog:
  - fix CVE-2013-4353 - Invalid TLS handshake crash
  - fix CVE-2013-6450 - possible MiTM attack on DTLS1


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-31
changelog:
  - print ephemeral key size negotiated in TLS handshake (#1057715)
  - add DH_compute_key_padded needed for FIPS CAVS testing
  - make expiration and key length changeable by DAYS and KEYLEN
    variables in the certificate Makefile (#1058108)
  - change default hash to sha256 (#1062325)
  - lower the actual 3des strength so it is sorted behind aes128 (#1056616)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-34.3
changelog:
  - fix CVE-2010-5298 - possible use of memory after free
  - fix CVE-2014-0195 - buffer overflow via invalid DTLS fragment
  - fix CVE-2014-0198 - possible NULL pointer dereference
  - fix CVE-2014-0221 - DoS from invalid DTLS handshake packet
  - fix CVE-2014-0224 - SSL/TLS MITM vulnerability
  - fix CVE-2014-3470 - client-side DoS when using anonymous ECDH


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-34.4
changelog:
  - fix CVE-2014-3505 - doublefree in DTLS packet processing
  - fix CVE-2014-3506 - avoid memory exhaustion in DTLS
  - fix CVE-2014-3507 - avoid memory leak in DTLS
  - fix CVE-2014-3508 - fix OID handling to avoid information leak
  - fix CVE-2014-3509 - fix race condition when parsing server hello
  - fix CVE-2014-3510 - fix DoS in anonymous (EC)DH handling in DTLS
  - fix CVE-2014-3511 - disallow protocol downgrade via fragmentation


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-1
changelog:
  - reenable optimizations on ppc64 and assembly code on ia64
  - upgrade to new upstream version (no soname bump needed)
  - disable thread test - it was testing the backport of the
    RSA blinding - no longer needed
  - added support for changing serial number to 
    Makefile.certificate (#151188)
  - make ca-bundle.crt a config file (#118903)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8b-9
changelog:
  - fix CVE-2007-3108 - side channel attack on private keys (#250581)
  - fix CVE-2007-5135 - off-by-one in SSL_get_shared_ciphers (#309881)
  - fix CVE-2007-4995 - out of order DTLS fragments buffer overflow (#321221)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8b-10
changelog:
  - compile with -march=z900 on s390 for performance improvements (#250818)
  - make ssl session ID matching strict (#233599)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-2
changelog:
  - more changes for FIPS validation (#444800)
  - correctly initialize default CA paths (#450987)
  - allow disabling zlib support through environment (#442624)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-5
changelog:
  - implement the integrity checking inside libcrypto so OpenSSL
    can be used in FIPS mode by the fipscheck library


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-8
changelog:
  - support multiple CRLs with same subject in a store (#457134)
  - fix CVE-2009-0590 - reject incorrectly encoded ASN.1 strings (#492304)
  - seed FIPS rng directly from kernel random device
  - do not require fipscheck to build the package (#475798)
  - call pairwise key tests in FIPS mode only (#479817)
  - do not crash when parsing bad mime data (#472440)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-12
changelog:
  - abort if selftests failed and random number generator is polled
  - mention EVP_aes and EVP_sha2xx routines in the manpages
  - add README.FIPS


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-13
changelog:
  - fix CVE-2009-2409 - drop MD2 algorithm from EVP tables (#510197)
  - fix CVE-2009-4355 - do not leak memory when CRYPTO_cleanup_all_ex_data()
    is called prematurely by application (#546707)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-14
changelog:
  - fix CVE-2009-3555 - support the safe renegotiation extension and
    do not allow legacy renegotiation on the server by default (#533125)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-15
changelog:
  - fix CVE-2010-0433 - do not pass NULL princ to krb5_kt_get_entry which
    in the RHEL-5 and newer versions will crash in such case (#569774)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-27
changelog:
  - fix for CVE-2013-0169 - SSL/TLS CBC timing attack (#907589)
  - fix for CVE-2013-0166 - DoS in OCSP signatures checking (#908052)
  - enable compression only if explicitly asked for or OPENSSL_DEFAULT_ZLIB
    environment variable is set (fixes CVE-2012-4929 #857051)
  - use secure_getenv() everywhere instead of getenv() (#839735)


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.4-2
changelog:
  - Reference authors from the project AUTHORS file instead of listing in description
  - Change Source0 to reference the project's Mercurial repo
  - Cleaned up the summaries and descriptions
  - Incorporate the results of Fedora package self-review


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.4-3
changelog:
  - Include an AUTHORS and license file in each package
  - Change the library package name to pacemaker-libs to be more
    Fedora compliant
  - Remove execute permissions from xml related files
  - Reference the new cluster-glue devel package name
  - Update the tarball from upstream to version c9120a53a6ae
    + High: PE: Only prevent migration if the clone dependancy is stopping/starting on the target node
    + High: PE: Bug 2160 - Dont shuffle clones due to colocation
    + High: PE: New implementation of the resource migration (not stop/start) logic
    + Medium: Tools: crm_resource - Prevent use-of-NULL by requiring a resource name for the -A and -a options
    + Medium: PE: Prevent use-of-NULL in find_first_action()
    + Low: Build: Include licensing files


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.5-0.4.c9120a53a6ae.hg
changelog:
  - Incorporate the feedback from the cluster-glue review
  - Realistically, the version is a 1.0.5 pre-release
  - Use the global directive instead of define for variables
  - Use the haclient/hacluster group/user instead of daemon
  - Use the _configure macro
  - Fix install dependancies


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.5-1
changelog:
  - Add dependancy on resource-agents
  - Use the version of the configure macro that supplies --prefix, --libdir, etc
  - Update the tarball from upstream to version 462f1569a437 (Pacemaker 1.0.5 final)
    + High: Tools: crm_resource - Advertise --move instead of --migrate
    + Medium: Extra: New node connectivity RA that uses system ping and attrd_updater
    + Medium: crmd: Note that dc-deadtime can be used to mask the brokeness of some switches


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.5-2
changelog:
  - Add versioned perl dependancy as specified by
      https://fedoraproject.org/wiki/Packaging/Perl#Packages_that_link_to_libperl
  - No longer remove RPATH data, it prevents us finding libperl.so and no other
    libraries were being hardcoded
  - Compile in support for heartbeat
  - Conditionally add heartbeat-devel and corosynclib-devel to the -devel requirements
    depending on which stacks are supported


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.5-4
changelog:
  - Include the fixes from CoroSync integration testing
  - Move the resource templates - they are not documentation
  - Ensure documentation is placed in a standard location
  - Exclude documentation that is included elsewhere in the package

  - Update the tarball from upstream to version ee19d8e83c2a
    + High: cib: Correctly clean up when both plaintext and tls remote ports are requested
    + High: PE: Bug bnc#515172 - Provide better defaults for lt(e) and gt(e) comparisions
    + High: PE: Bug lf#2197 - Allow master instances placemaker to be influenced by colocation constraints
    + High: PE: Make sure promote/demote pseudo actions are created correctly
    + High: PE: Prevent target-role from promoting more than master-max instances
    + High: ais: Bug lf#2199 - Prevent expected-quorum-votes from being populated with garbage
    + High: ais: Prevent deadlock - dont try to release IPC message if the connection failed
    + High: cib: For validation errors, send back the full CIB so the client can display the errors
    + High: cib: Prevent use-after-free for remote plaintext connections
    + High: crmd: Bug lf#2201 - Prevent use-of-NULL when running heartbeat
    + High: Core: Bug lf#2169 - Allow dtd/schema validation to be disabled
    + High: PE: Bug lf#2106 - Not all anonymous clone children are restarted after configuration change
    + High: PE: Bug lf#2170 - stop-all-resources option had no effect
    + High: PE: Bug lf#2171 - Prevent groups from starting if they depend on a complex resource which cannot
    + High: PE: Disable resource management if stonith-enabled=true and no stonith resources are defined
    + High: PE: Do not include master score if it would prevent allocation
    + High: ais: Avoid excessive load by checking for dead children every 1s (instead of 100ms)
    + High: ais: Bug rh#525589 - Prevent shutdown deadlocks when running on CoroSync
    + High: ais: Gracefully handle changes to the AIS nodeid
    + High: crmd: Bug bnc#527530 - Wait for the transition to complete before leaving S_TRANSITION_ENGINE
    + High: crmd: Prevent use-after-free with LOG_DEBUG_3
    + Medium: xml: Mask the "symmetrical" attribute on rsc_colocation constraints (bnc#540672)
    + Medium (bnc#520707): Tools: crm: new templates ocfs2 and clvm
    + Medium: Build: Invert the disable ais/heartbeat logic so that --without (ais|heartbeat) is available to rpmbuild
    + Medium: PE: Bug lf#2178 - Indicate unmanaged clones
    + Medium: PE: Bug lf#2180 - Include node information for all failed ops
    + Medium: PE: Bug lf#2189 - Incorrect error message when unpacking simple ordering constraint
    + Medium: PE: Correctly log resources that would like to start but cannot
    + Medium: PE: Stop ptest from logging to syslog
    + Medium: ais: Include version details in plugin name
    + Medium: crmd: Requery the resource metadata after every start operation


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.5-5
changelog:
  - Include patch of changeset 66b7bfd467f3:
    Some clients such as gfs_controld want a cluster name, allow one to be specified in corosync.conf


author: Andrew Beekhof <andrew@beekhof.net> - 1.1.1-0.1-60b7753f7310.hg
changelog:
  - Update the tarball from upstream to version 60b7753f7310
    + First public release of the 1.1 series


author: Andrew Beekhof <andrew@beekhof.net> - 1.1.2-1
changelog:
  - Update the tarball from the upstream 1.1.2 release
    + High: ais: Bug lf#2340 - Force rogue child processes to terminate after waiting 2.5 minutes
    + High: ais: Bug lf#2359 - Default expected votes to 2 inside Corosync/OpenAIS plugin
    + High: ais: Bug lf#2359 - expected-quorum-votes not correctly updated after membership change
    + High: ais: Bug rhbz#525552 - Move non-threadsafe calls to setenv() to after the fork()
    + High: ais: Do not count votes from offline nodes and calculate current votes before sending quorum data
    + High: ais: Ensure the list of active processes sent to clients is always up-to-date
    + High: ais: Fix previous commit, actually return a result in get_process_list()
    + High: ais: Fix two more uses of getpwnam() in non-thread-safe locations
    + High: ais: Look for the correct conf variable for turning on file logging
    + High: ais: Need to find a better and thread-safe way to set core_uses_pid. Disable for now.
    + High: ais: Use the threadsafe version of getpwnam
    + High: Core: Bug lf#2414 - Prevent use-after-free reported by valgrind when doing xpath based deletions
    + High: Core: Bump the feature set due to the new failcount expiry feature
    + High: Core: Fix memory leak in replace_xml_child() reported by valgrind
    + High: Core: fix memory leaks exposed by valgrind
    + High: crmd: Bug 2401 - Improved detection of partially active peers
    + High: crmd: Bug bnc#578644 - Improve handling of cancelled operations caused by resource cleanup
    + High: crmd: Bug lf#2379 - Ensure the cluster terminates when the PE is not available
    + High: crmd: Bug lf#2414 - Prevent use-after-free of the PE connection after it dies
    + High: crmd: Bug lf#2414 - Prevent use-after-free of the stonith-ng connection
    + High: crmd: Do not allow the target_rc to be misused by resource agents
    + High: crmd: Do not ignore action timeouts based on FSA state
    + High: crmd: Ensure we dont get stuck in S_PENDING if we loose an election to someone that never talks to us again
    + High: crmd: Fix memory leaks exposed by valgrind
    + High: crmd: Remove race condition that could lead to multiple instances of a clone being active on a machine
    + High: crmd: Send erase_status_tag() calls to the local CIB when the DC is fenced, since there is no DC to accept them
    + High: crmd: Use global fencing notifications to prevent secondary fencing operations of the DC
    + High: fencing: Account for stonith_get_info() always returning a pointer to the same static buffer
    + High: PE: Allow startup probes to be disabled - their calculation is a major bottleneck for very large clusters
    + High: PE: Bug lf#2317 - Avoid needless restart of primitive depending on a clone
    + High: PE: Bug lf#2358 - Fix master-master anti-colocation
    + High: PE: Bug lf#2361 - Ensure clones observe mandatory ordering constraints if the LHS is unrunnable
    + High: PE: Bug lf#2383 - Combine failcounts for all instances of an anonymous clone on a host
    + High: PE: Bug lf#2384 - Fix intra-set colocation and ordering
    + High: PE: Bug lf#2403 - Enforce mandatory promotion (colocation) constraints
    + High: PE: Bug lf#2412 - Correctly locate clone instances by their prefix
    + High: PE: Correctly implement optional colocation between primitives and clone resources
    + High: PE: Do not be so quick to pull the trigger on nodes that are coming up
    + High: PE: Fix memory leaks exposed by valgrind
    + High: PE: Fix memory leaks reported by valgrind
    + High: PE: Repair handling of unordered groups in RHS ordering constraints
    + High: PE: Rewrite native_merge_weights() to avoid Fix use-after-free
    + High: PE: Suppress duplicate ordering constraints to achieve orders of magnitude speed increases for large clusters
    + High: Shell: add support for xml in cli
    + High: Shell: always reload status if working with the cluster (bnc#590035)
    + High: Shell: check timeouts also against the default-action-timeout property
    + High: Shell: Default to using the status section from the live CIB (bnc#592762)
    + High: Shell: edit multiple meta_attributes sets in resource management (lf#2315)
    + High: Shell: enable comments (lf#2221)
    + High: Shell: implement new cibstatus interface and commands (bnc#580492)
    + High: Shell: improve configure commit (lf#2336)
    + High: Shell: new cibstatus import command (bnc#585471)
    + High: Shell: new configure filter command
    + High: Shell: restore error reporting in options
    + High: Shell: split shell into modules
    + High: Shell: support for the utilization element (old patch for the new structure)
    + High: Shell: update previous node lookup procedure to include the id where necessary
    + High: Tools: crm_mon - fix memory leaks exposed by valgrind


author: Andrew Beekhof <andrew@beekhof.net> - 1.1.2-2
changelog:
  - Resolves rhbz#602239 - Added patch to documentation so that it passes validation
  - High: Core: Bug lf#2401 - Backed out changeset 6e6980376f01


author: Andrew Beekhof <andrew@beekhof.net> - 1.1.3-0.1-b3cb4f4a30ae.hg
changelog:
  - Pre-release version of 1.1.3
    + High: ais: Bug lf2401 - Improved processing when the peer crmd processes join/leave
    + High: ais: fix list of active processes sent to clients (bnc#603685)
    + High: ais: Move the code for finding uid before the fork so that the child does no logging
    + High: ais: Resolve coverity CONSTANT_EXPRESSION_RESULT defects
    + High: cib: Also free query result for xpath operations that return more than one hit
    + High: cib: Attempt to resolve memory corruption when forking a child to write the cib to disk
    + High: cib: Correctly free memory when writing out the cib to disk
    + High: cib: Fix the application of unversioned diffs
    + High: cib: Remove old developmental error logging
    + High: cib: Restructure the 'valid peer' check for deciding which instructions to ignore
    + High: Core: Bug lf#2401 - Backed out changeset 6e6980376f01
    + High: Core: Correctly unpack HA_Messages containing multiple entries with the same name
    + High: Core: crm_count_member() should only track nodes that have the full stack up
    + High: Core: New developmental logging system inspired by the kernel and a PoC from Lars Ellenberg
    + High: crmd: All nodes should see status updates, not just he DC
    + High: crmd: Allow non-DC nodes to clear failcounts too
    + High: crmd: Base DC election on process relative uptime
    + High: crmd: Bug lf#2439 - cancel_op() can also return HA_RSCBUSY
    + High: crmd: Bug lf#2439 - Handle asynchronous notification of resource deletion events
    + High: crmd: Fix assertion failure when performing async resource failures
    + High: crmd: Fix handling of async resource deletion results
    + High: crmd: Include the action for crm graph operations
    + High: crmd: Make sure the membership cache is accurate after a sucessful fencing operation
    + High: crmd: Make sure we always poke the FSA after a transition to clear any TE_HALT actions
    + High: crmd: Offer crm-level membership once the peer starts the crmd process
    + High: crmd: Only need to request quorum update for plugin based clusters
    + High: crmd: Prevent everyone from loosing DC elections by correctly initializing all relevant variables
    + High: crmd: Prevent segmentation fault
    + High: crmd: several fixes for async resource delete
    + High: mcp: Add missing headers when built without heartbeat support
    + High: mcp: New master control process for (re)spawning pacemaker daemons
    + High: PE: Avoid creating invalid ordering constraints for probes that are not needed
    + High: PE: Bug lf#1959 - Fail unmanaged resources should not prevent other services from shutting down
    + High: PE: Bug lf#2422 - Ordering dependencies on partially active groups not observed properly
    + High: PE: Bug lf#2424 - Use notify oepration definition if it exists in the configuration
    + High: PE: Bug lf#2433 - No services should be stopped until probes finish
    + High: PE: Bug lf#2453 - Enforce clone ordering in the absense of colocation constraints
    + High: PE: Correctly detect when there is a real failcount that expired and needs to be cleared
    + High: PE: Correctly handle pseudo action creation
    + High: PE: Correctly order clone startup after group/clone start
    + High: PE: Fix colocation for interleaved clones
    + High: PE: Fix colocation with partially active groups
    + High: PE: Fix potential use-after-free defect from coverity
    + High: PE: Fix previous merge
    + High: PE: Fix use-after-free in order_actions() reported by valgrind
    + High: PE: Prevent endless loop when looking for operation definitions in the configuration
    + High: Resolve coverity RESOURCE_LEAK defects
    + High: Shell: Complete the transition to using crm_attribute instead of crm_failcount and crm_standby
    + High: stonith: Advertise stonith-ng options in the metadata
    + High: stonith: Correctly parse pcmk_host_list parameters that appear on a single line
    + High: stonith: Map poweron/poweroff back to on/off expected by the stonith tool from cluster-glue
    + High: stonith: pass the configuration to the stonith program via environment variables (bnc#620781)
    + High: Support starting plugin-based Pacemaker clusters with the MCP as well
    + High: tools: crm_report - corosync.conf wont necessarily contain the text 'pacemaker' anymore
    + High: tools: crm_simulate - Resolve coverity USE_AFTER_FREE defect
    + High: Tools: Drop the 'pingd' daemon and resource agent in favor of ocf:pacemaker:ping
    + High: Tools: Fix recently introduced use-of-NULL
    + High: Tools: Fix use-after-free defect from coverity


author: Andrew Beekhof <andrew@beekhof.net> - 1.1.3-1
changelog:
  - Upstream release of 1.1.3
    + High: crmd: Use the correct define/size for lrm resource IDs
    + High: crmd: Bug lf#2458 - Ensure stop actions always have the relevant resource attributes
    + High: crmd: Ensure we activate the DC timer if we detect an alternate DC
    + High: mcp: Correctly initialize the string containing the list of active daemons
    + High: mcp: Fix the expansion of the pid file in the init script
    + High: mcp: Tell chkconfig we need to shut down early on
    + High: PE: Bug lf#2476 - Repair on-fail=block for groups and primitive resources
    + High: PE: Do not demote resources because something that requires it can't run
    + High: PE: Rewrite the ordering constraint logic to be simplicity, clarity and maintainability
    + High: PE: Wait until stonith is available, don't fall back to shutdown for nodes requesting termination
    + High: PE: Prevent segfault by ensuring the arguments to do_calculations() are initialized
    + High: stonith: Bug lf#2461 - Prevent segfault by not looking up operations if the hashtable hasn't been initialized yet
    + High: Stonith: Bug lf#2473 - Ensure stonith operations complete within the timeout and are terminated if they run too long
    + High: stonith: Bug lf#2473 - Gracefully handle remote operations that arrive late (after we've done notifications)
    + High: stonith: Bug lf#2473 - Add the timeout at the top level where the daemon is looking for it
    + High: stonith: Bug lf#2473 - Ensure timeouts are included for fencing operations
    + High: Stonith: Use the timeout specified by the user
    + High: Tools: Bug lf#2456 - Fix assertion failure in crm_resource


author: Andrew Beekhof <andrew@beekhof.net> 1.1.4-1
changelog:
  - Upstream release of 1.1.4
  - See included ChangeLog file or http://hg.clusterlabs.org/pacemaker/1.1/file/tip/ChangeLog for details


author: Andrew Beekhof <andrew@beekhof.net> 1.1.6-1
changelog:
  - Upstream release of 1.1.6
  - See included ChangeLog file or http://hg.clusterlabs.org/pacemaker/1.1/file/tip/ChangeLog for details

  - Disabled eSMTP and SNMP support.  Painful to configure and rarely used.
  - Created cli sub-package for non-cluster usage


author: Andrew Beekhof <andrew@beekhof.net> 1.1.6-2
changelog:
  - Do not build in support for heartbeat, snmp, esmtp by default
  - Create a package for cluster unaware libraries to minimze our
    footprint on non-cluster nodes
  - Better package descriptions


author: Andrew Beekhof <andrew@beekhof.net> 1.1.7-0.1-bc7c125.git
changelog:
  - New upstream tarball: bc7c125
  - Pre-release 1.1.7 build to deal with the removal of cman and support for corosync plugins
  - Add libqb as a dependancy


author: Andrew Beekhof <andrew@beekhof.net> 1.1.7-0.3-7742926.git
changelog:
  - New upstream tarball: 7742926
  - Additional Provides and Obsoletes directives to enable upgrading from heartbeat
  - Rebuild now that the Corosync CFG API has been removed


author: Andrew Beekhof <andrew@beekhof.net> Pacemaker-1.1.7-1
changelog:
  - Update source tarball to upstream release: Pacemaker-1.1.7
  - See included ChangeLog file or https://raw.github.com/ClusterLabs/pacemaker/master/ChangeLog for details


author: Andrew Beekhof <andrew@beekhof.net> 1.1.8-1
changelog:
  - Rebuild for upstream 1.1.8 release
  - Documentation disabled pending a functional publican/ImageMagick combination

  - Statistics:
    Changesets: 1019
    Diff:       2107 files changed, 117258 insertions(+), 73606 deletions(-)

  - See included ChangeLog file or https://raw.github.com/ClusterLabs/pacemaker/master/ChangeLog for full details

    + New IPC implementation from libqb
    + New logging implementation from libqb
    + Quieter - info, debug and trace logs are no longer sent to syslog
    + Dropped dependancy on cluster-glue
    + Config and core directories no longer located in heartbeat directories
    + Support for managing systemd services
    + Rewritten local resource management daemon
    + Version bumps for every shared library due to API cleanups
    + Removes crm shell, install/use pcs shell and GUI instead


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.8-4
changelog:
  - Update for new upstream tarball: 5db5f53

    + High: mcp: Re-attach to existing pacemaker components when pacemakerd fails
    + High: pengine: cl#5111 - When clone/master child rsc has on-fail=stop, insure all children stop on failure.
    + High: Replace the use of the insecure mktemp(3) with mkstemp(3)
    + High: Core: Correctly process XML diff's involving element removal
    + High: PE: Correctly unpack active anonymous clones
    + High: PE: Fix clone_zero() and clone_strip() for single character resource names
    + High: IPC: Bug cl#5110 - Prevent 100% CPU usage when looking for synchronous replies
    + High: PE: Bug cl#5101 - Ensure stop order is preserved for partially active groups
    + High: fencing: On failure, only try a topology device once from the remote level.
    + High: fencing: Retry stonith device for duration of action's timeout period.
    + High: PE: Fix memory leak on processing message (bnc#780224)
    + High: fencing: Support 'on_target' option in fencing device metadata for forcing unfence on target node
    + High: PE: Support resources that require unfencing before start
    + High: PE: Support a 'requires' resource meta-attribute for controlling whether it needs quorum, fencing or nothing
    + High: mcp: Only define HA_DEBUGLOG to avoid agent calls to ocf_log printing everything twice
    + High: fencing: Do not start fencing until entire device topology is found or query results timeout.
    + High: Cluster: Allow cman and corosync 2.0 nodes to use a name other than uname()


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-1
changelog:
  - Update for new upstream tarball: Pacemaker-1.1.10-rc1
  - Features added since Pacemaker-1.1.8
    + Performance enhancements for supporting 16 node clusters
    + corosync: Use queues to avoid blocking when sending CPG messages
    + ipc: Compress messages that exceed the configured IPC message limit
    + ipc: Use queues to prevent slow clients from blocking the server
    + ipc: Use shared memory by default
    + lrmd: Support nagios remote monitoring
    + lrmd: Pacemaker Remote Daemon for extending pacemaker functionality outside corosync cluster.
    + pengine: Check for master/slave resources that are not OCF agents
    + pengine: Support a 'requires' resource meta-attribute for controlling whether it needs quorum, fencing or nothing
    + pengine: Support for resource containers
    + pengine: Support resources that require unfencing before start

  - Changes since Pacemaker-1.1.8
    + attrd: Correctly handle deletion of non-existant attributes
    + Bug cl#5135 - Improved detection of the active cluster type
    + Bug rhbz#913093 - Use crm_node instead of uname
    + cib: Prevent ordering changes when applying xml diffs
    + cib: Remove text nodes from cib replace operations
    + crmd: Prevent election storms caused by getrusage() values being too close
    + date/time: Bug cl#5118 - Correctly convert seconds-since-epoch to the current time
    + fencing: Attempt to provide more information that just 'generic error' for failed actions
    + fencing: Correctly record completed but previously unknown fencing operations
    + fencing: Correctly terminate when all device options have been exhausted
    + fencing: cov#739453 - String not null terminated
    + fencing: Do not merge new fencing requests with stale ones from dead nodes
    + fencing: Do not start fencing until entire device topology is found or query results timeout.
    + fencing: Do not wait for the query timeout if all replies have arrived
    + fencing: Fix passing of parameters from CMAN containing '='
    + fencing: Fix non-comparison when sorting devices by priority
    + fencing: On failure, only try a topology device once from the remote level.
    + fencing: Only try peers for non-topology based operations once
    + fencing: Retry stonith device for duration of action's timeout period.
    + ipc: Bug cl#5110 - Prevent 100% CPU usage when looking for synchronous replies
    + mcp: Re-attach to existing pacemaker components when mcp fails
    + pengine: Any location constraint for the slave role applies to all roles
    + pengine: Bug cl#5101 - Ensure stop order is preserved for partially active groups
    + pengine: Bug cl#5140 - Allow set members to be stopped when the subseqent set has require-all=false
    + pengine: Bug cl#5143 - Prevent shuffling of anonymous master/slave instances
    + pengine: Bug rhbz#880249 - Ensure orphan masters are demoted before being stopped
    + pengine: Bug rhbz#880249 - Teach the PE how to recover masters into primitives
    + pengine: cl#5025 - Automatically clear failcount for start/monitor failures after resource parameters change
    + pengine: cl#5099 - Probe operation uses the timeout value from the minimum interval monitor by default (#bnc776386)
    + pengine: cl#5111 - When clone/master child rsc has on-fail=stop, insure all children stop on failure.
    + pengine: cl#5142 - Do not delete orphaned children of an anonymous clone
    + pengine: Correctly unpack active anonymous clones
    + pengine: Ensure previous migrations are closed out before attempting another one
    + pengine: rhbz#902459 - Remove rsc node status for orphan resources
    + Replace the use of the insecure mktemp(3) with mkstemp(3)


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-2
changelog:
  - Update for new upstream tarball: Pacemaker-1.1.10-rc4

  - Features in Pacemaker-1.1.10-rc4:
    + PE: Display a list of nodes on which stopped anonymous clones are not active instead of meaningless clone IDs
    + crm_error: Add the ability to list and print error symbols
    + crm_resource: Implement --ban for moving resources away from nodes and --clear (replaces --unmove)
    + crm_resource: Support OCF tracing when using --force-(check|start|stop)

  - Changes since Pacemaker-1.1.10-rc1

    + Bug cl#5133 - pengine: Correctly observe on-fail=block for failed demote operation
    + Bug cl#5152 - Correctly clean up fenced nodes during membership changes
    + Bug cl#5153 - Correctly display clone failcounts in crm_mon
    + Bug cl#5154 - Do not expire failures when on-fail=block is present
    + Bug pengine: cl#5155 - Block the stop of resources if any depending resource is unmanaged
    + crm_report: Correctly collect logs when 'uname -n' reports fully qualified names
    + Check for and replace non-printing characters with their octal equivalent while exporting xml text
    + Convert all exit codes to positive errno values
    + Core: Ensure the blackbox is saved on abnormal program termination
    + corosync: Detect the loss of members for which we only know the nodeid
    + corosync: Nodes that can persist in sending CPG messages must be alive afterall
    + crmd: Do not get stuck in S_POLICY_ENGINE if a node we couldn't fence returns
    + crmd: Ensure all membership operations can complete while trying to cancel a transition
    + crmd: Everyone who gets a fencing notification should mark the node as down
    + crmd: Initiate node shutdown if another node claims to have successfully fenced us
    + crm_resource: Gracefully fail when --force-* is attempted for stonith resources
    + fencing: Restore the ability to manually confirm that fencing completed
    + pengine: Correctly handle resources that recover before we operate on them
    + pengine: Ensure per-node resource parameters are used during probes
    + pengine: Implement the rest of get_timet_now() and rename to get_effective_time
    + pengine: Mark unrunnable stop actions as "blocked"
    + pengine: Re-initiate active recurring monitors that previously failed but have timed out
    + xml: Restore the ability to embed comments in the cib


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-3
changelog:
  - Update to upstream 838e41e

    + Feature: pengine: Allow active nodes in our current membership to be fenced without quorum
    + Fix: attrd: Fixes deleted attributes during dc election
    + Fix: corosync: Fall back to uname for local nodes
    + Fix: crm_report: Find logs in compressed files
    + Fix: pengine: If fencing is unavailable or disabled, block further recovery for resources that fail to stop
    + Fix: systemd: Ensure we get shut down correctly by systemd


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-5
changelog:
  - Streamline spec file

  - Upstream patch for:
    + cman: Only build migration tools for targets that may use them
    + cib: Ensure we set up hacluster's groups in stand-alone mode

  - Update for new upstream tarball: Pacemaker-1.1.10-rc7

    + Bug cl#5157 - Allow migration in the absence of some colocation constraints
    + Bug cl#5168 - Prevent clones from being bounced around the cluster due to location constraints
    + Bug cl#5170 - Correctly support on-fail=block for clones
    + crmd: CID#1036761 Dereference null return value
    + crmd: cl#5164 - Fixes crmd crash when using pacemaker-remote
    + crmd: Ensure operations for cleaned up resources don't block recovery
    + crmd: Prevent messages for remote crmd clients from being relayed to wrong daemons
    + crmd: Properly handle recurring monitor operations for remote-node agent
    + fencing: Correctly detect existing device entries when registering a new one
    + logging: If SIGTRAP is sent before tracing is turned on, turn it on
    + lrmd: Prevent use-of-NULL in client library
    + pengine: cl#5128 - Support maintenance mode for a single node
    + pengine: cl#5164 - Pengine segfault when calculating transition with remote-nodes.
    + pengine: Do the right thing when admins specify the internal resource instead of the clone
    + systemd: Turn off auto-respawning of systemd services when the cluster starts them


author: Andrew Beekhof <andrew@beekhof.net> Pacemaker-1.1.10-6
changelog:
  - Update source tarball to revision: 368c726
  - Changesets: 18
  - Diff:       9 files changed, 245 insertions(+), 170 deletions(-)

  - Features added since Pacemaker-1.1.10-rc7
    + crm_resource: Allow options to be set recursively

  - Changes since Pacemaker-1.1.10-rc7
    + Bug cl#5161 - crmd: Prevent memory leak in operation cache
    + cib: Correctly read back archived configurations if the primary is corrupted


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-10
changelog:
  + Fix: pengine: Do not re-allocate clone instances that are blocked in the Stopped state
    + Fix: pengine: Do not allow colocation with blocked clone instances


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-11
changelog:
  + Fix: systemd: Prevent glib assertion - only call g_error_free() with non-NULL arguments
    + Fix: systemd: Prevent additional assertions in g_error_free
    + Fix: logging: glib CRIT messages should not produce core files by default
    + Doc: controld: Update the description
    + Fix: pengine: Correctly account for the location preferences of things colocated with a group
    + Fix: cib: Correctly log short-form xml diffs
    + Fix: crmd: Correcty update the history cache when recurring ops change their return code
    + Log: pengine: Better indicate when a resource has failed
    + Log: crm_mon: Unmunge the output for failed operations


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-13
changelog:
  + Fencing: Support agents that need the host to be unfenced at startup
      Resolves: rhbz#996576
    + crm_report: Collect corosync quorum data
      Resolves: rhbz#839342


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-14
changelog:
  + Fix: xml: Location constraints are allowed to specify a role
    + Bug rhbz#902407 - crm_resource: Handle --ban for master/slave resources as advertised
      Resolves: rhbz#902407


author: David Vossel <dvossel@redhat.com> - 1.1.10-15
changelog:
  + Fix: crmd: Allow transient attributes to be set on remote-nodes.
    + Fix: pengine: Handle orphaned remote-nodes properly
    + Low: cts: Add RemoteLXC regression test.

    Resolves: rhbz#1006465
    Resolves: rhbz#1006471


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-16
changelog:
  - Remove unsupported resource agent
  - Log: crmd: Supply arguments in the correct order
  - Fix: crm_report: Correctly redirect error message to /dev/null
  - Fix: Bug rhbz#1011618 - Consistently use 'Slave' as the role for unpromoted master/slave resources
  - Fix: pengine: Location constraints with role=Started should prevent masters from running at all
  - Fix: crm_resource: Observe --master modifier for --move
  - Provide a meaningful error if --master is used for primitives and groups
  - Fix: Fencing: Observe pcmk_host_list during automatic unfencing
      Resolves: rhbz#996576


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-17
changelog:
  Resolves: rhbz#720543

  - Fix: core: Do not enabled blackbox for cli tools
  - Fix: Command-line tools should stop after an assertion failure
  - Fix: crmd: Dont add node_state to cib, if we have not seen or fenced this node yet
  - Fix: crmd: Correctly update expected state when the previous DC shuts down
  - Fix: crmd: Cache rsc_info retrieved from lrmd and pacemaker_remoted
  - Fix: crmd: Pad internal lrmd rsc_info and metadata retrieval timeout
  - Fix: crm_attribute: Detect orphaned remote-nodes when setting attributes
  - Fix: crm_mon: Prevent use-of-NULL when ping resources do not define a host list
  - Fix: crm_report: Record the output of the collector
  - Fix: crm_report: Do not print garbage when collecting from the local node
  - Fix: crm_resource: Wait for all replies when cleaning up resources
  - Fix: fencing: Do not broadcast suicide if the on action is being executed
  - Fix: fencing: Allow fencing for node after topology entries are deleted
  - Fix: fencing: Deep copy current topology level list on remote op
  - Fix: lrmd: Correctly cancel monitor actions for lsb/systemd/service resources on cleaning up
  - Fix: pengine: Dont prevent clones from running due to dependant resources
  - Fix: pengine: Probe containers not expected to be up
  - Fix: ipc: Raise the default buffer size to 128k
  - Fix: ipc: Use the higher of the configured buffer size or the default
  - Fix: iso8601: Prevent dates from jumping backwards a day in some timezones
  - Fix: remote: Properly version the remote connection protocol
  - Fix: remote: Handle endian changes between client and server and improve forward compatibility
      Resolves: rhbz#720543


author: David Vossel <dvossel@redhat.com> - 1.1.10-19
changelog:
  - Fix: controld: Use the correct variant of dlm_controld for
    corosync-2 clusters

      Resolves: rhbz#1028627


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-20
changelog:
  - Fix: tools: Fixes formatting of remote-nodes in crm_mon and crm_simulate
  - Fix: Corosync: Attempt to retrieve a peers node name if it is not already known
      Resolves: rhbz#720543


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-23
changelog:
  - mcp: Tell systemd not to respawn us if we return 100
  - services: Detect missing agents and permission errors before forking
  - Use native DBus library for systemd support to avoid problematic use of threads
      Resolves: rhbz#720543 (aka. 1057697)


author: David Vossel <dvossel@redhat.com> - 1.1.10-24
changelog:
  - controld: handling startup fencing within the controld agent, not the dlm
      Resolves: rhbz#1064519
  - controld: Do not consider the dlm up until the address list is present
      Resolves: rhbz#1067536


author: David Vossel <dvossel@redhat.com> - 1.1.10-25
changelog:
  - pengine: cl#5187 - Prevent resources in an anti-colocation from even temporarily running on a same node
      Resolves: rhbz#1069284


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-26
changelog:
  - Run automated regression tests after every build
  - Fencing: Send details of stonith_api_time() and stonith_api_kick() to syslog
  - Fencing: Pass the correct options when looking up the history by node name
  - Fencing: stonith_api_time_helper now returns when the most recent fencing operation completed
  - crm_report: Additional dlm detail if dlm_controld is running
  - crmd: Gracefully handle actions that cannot be initiated
  - pengine: Gracefully handle bad values for XML_ATTR_TRANSITION_MAGIC
      Resolves: rhbz#1070916


author: Andrew Beekhof <beekhof@redhat.com> - 1.1.10-27
changelog:
  - crm_resource: Prevent use-of-NULL
  - systemd: Prevent use-of-NULL when determining if an agent exists
  - Fencing: Remove shadow definition and use of variable 'progress'
      Resolves: rhbz#1070916


author: David Vossel <dvossel@redhat.com> - 1.1.10-28
changelog:
  - pengine: fixes invalid transition caused by clones with more than 10 instances
      Resolves: rhbz#1078504


author: Andrew Beekhof <abeekhof@redhat.com> 1.1.10-30
changelog:
  - crmd: Do not erase the status section for unfenced nodes
  - crmd: Correctly react to successful unfencing operations
  - crmd: Report unsuccessful unfencing operations
  - crmd: Do not overwrite existing node state when fencing completes
  - fencing: Correctly record which peer performed the fencing operation
  - fencing: Automatically switch from 'list' to 'status' to 'static-list' if those actions are not advertised in the metadata
  - fencing: Filter self-fencing at the peers to allow unfencing to work correctly
  - pengine: Automatically re-unfence a node if the fencing device definition changes
  - pengine: Fencing devices default to only requiring quorum in order to start
  - pengine: Delay unfencing until after we know the state of all resources that require unfencing
  - pengine: Ensure unfencing occurs before fencing devices are (re-)probed
  - pengine: Ensure unfencing only happens once, even if the transition is interrupted
  - pengine: Do not unfence nodes that are offline, unclean or shutting down
  - pengine: Unfencing is based on device probes, there is no need to unfence when normal resources are found active
  - logging: daemons always get a log file, unless explicitly set to configured 'none'
  - lrmd: Expose logging variables expected by OCF agents
  - crm_report: Suppress logging errors after the target directory has been compressed
  - crm_resource: Wait for the correct number of replies when cleaning up resources
      Resolves: rhbz#1078078


author: David Vossel <dvossel@redhat.com> - 1.1.10-31
changelog:
  - fencing: Fence using all required devices
  - fencing: Execute all required fencing devices regardless of what topology level they are at
  - fencing: default to 'off' when agent does not advertise 'reboot' in metadata
      Resolves: rhbz#1078078


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-32
changelog:
  - Fix: lrmd: Handle systemd reporting 'done' before a resource is actually stopped
      Resolves: rhbz#1115024


author: Andrew Beekhof <beekhof@redhat.com> - 1.1.10-32.el7_0.1
changelog:
  - Fix: Bug rhbz#1139701 - Unref dbus reply to prevent systemd action timeouts
      Resolves: rhbz#1145740


author: Tom Callaway <tcallawa@redhat.com>
changelog:
  - bump to 5.0.0
  - add patch to prevent clobbering struct re_registers from regex.h
  - remove domxml references, replaced with dom now built-in
  - fix php.ini to refer to php5 not php4


author: Joe Orton <jorton@redhat.com> 5.0.1-1
changelog:
  - update to 5.0.1
  - only build shared modules once
  - put dom extension in php-dom subpackage again
  - move extension modules into %{_libdir}/php/modules
  - don't use --with-regex=system, it's ignored for the apache* SAPIs


author: Joe Orton <jorton@redhat.com> 5.0.2-4
changelog:
  - update to 5.0.2 (#127980)
  - build against mysqlclient10-devel
  - use new RTLD_DEEPBIND to load extension modules
  - drop explicit requirement for elfutils-devel
  - use AddHandler in default conf.d/php.conf (#135664)
  - "fix" round() fudging for recent gcc on x86
  - disable sqlite pending audit of warnings and subpackage split


author: Joe Orton <jorton@redhat.com> 5.0.2-5
changelog:
  - fix phpize installation for lib64 platforms
  - add fix for segfault in variable parsing introduced in 5.0.2


author: Joe Orton <jorton@redhat.com> 5.0.2-7
changelog:
  - truncate changelog at 4.3.1-1
  - merge from 4.3.x package:
   - enable mime_magic extension and Require: file (#130276)


author: Joe Orton <jorton@redhat.com> 5.0.3-1
changelog:
  - update to 5.0.3 (thanks to Robert Scheck et al, #143101)
  - enable xsl extension (#142174)
  - package both the xsl and dom extensions in php-xml
  - enable soap extension, shared (php-soap package) (#142901)
  - add patches from upstream 5.0 branch:
   * Zend_strtod.c compile fixes
   * correct php_sprintf return value usage


author: Joe Orton <jorton@redhat.com> 5.0.3-2
changelog:
  - install the ext/gd headers (#145891)
  - enable pcntl extension in /usr/bin/php (#142903)
  - add libmbfl array arithmetic fix (dcb314@hotmail.com, #143795)
  - add BuildRequire for recent pcre-devel (#147448)


author: Joe Orton <jorton@redhat.com> 5.0.3-4
changelog:
  - package mysqli extension in php-mysql
  - really enable pcntl (#142903)
  - don't build with --enable-safe-mode (#148969)
  - use "Instant Client" libraries for oci8 module (Kai Bolay, #149873)


author: Joe Orton <jorton@redhat.com> 5.0.3-5
changelog:
  - BuildRequire mysql-devel >= 4.1
  - don't mark php.ini as noreplace to make upgrades work (#152171)
  - fix subpackage descriptions (#152628)
  - fix memset(,,0) in Zend (thanks to Dave Jones)
  - fix various compiler warnings in Zend


author: Joe Orton <jorton@redhat.com> 5.0.4-1
changelog:
  - update to 5.0.4 (#153068)
  - add .phps AddType to php.conf (#152973)
  - better gcc4 fix for libxmlrpc


author: Joe Orton <jorton@redhat.com> 5.0.4-4
changelog:
  - bundle from PEAR: HTTP, Mail, XML_Parser, Net_Socket, Net_SMTP
  - snmp: disable MSHUTDOWN function to prevent error_log noise (#153988)
  - mysqli: add fix for crash on x86_64 (Georg Richter, upstream #32282)


author: Joe Orton <jorton@redhat.com> 5.0.4-6
changelog:
  - build /usr/bin/php with the CLI SAPI, and add /usr/bin/php-cgi,
    built with the CGI SAPI (thanks to Edward Rudd, #137704)
  - add php(1) man page for CLI
  - fix more test cases to use -n when invoking php


author: Joe Orton <jorton@redhat.com> 5.0.4-7
changelog:
  - split out dba and bcmath extensions into subpackages
  - BuildRequire gcc-c++ to avoid AC_PROG_CXX{,CPP} failure (#155221)
  - pear: update to DB-1.7.6
  - enable FastCGI support in /usr/bin/php-cgi (#149596)


author: Joe Orton <jorton@redhat.com> 5.0.4-9
changelog:
  - build simplexml_import_dom even with shared dom (#156434)
  - prevent truncation of copied files to ~2Mb (#155916)
  - install /usr/bin/php from CLI build alongside CGI
  - enable sysvmsg extension (#142988)


author: Joe Orton <jorton@redhat.com> 5.0.5-3
changelog:
  - update to 5.0.5
  - add fix for upstream #34435
  - devel: require autoconf, automake (#159283)
  - pear: update to HTTP-1.3.6, Mail-1.1.8, Net_SMTP-1.2.7, XML_RPC-1.4.1
  - fix imagettftext et al (upstream, #161001)


author: Joe Orton <jorton@redhat.com> 5.1.1-2
changelog:
  - update to 5.1.1
  - remove pear subpackage
  - enable pdo extensions (php-pdo subpackage)
  - remove non-standard conditional module builds
  - enable xmlreader extension


author: Joe Orton <jorton@redhat.com> 5.1.2-5
changelog:
  - provide php-api (#183227)
  - add provides for all builtin modules (Tim Jackson, #173804)
  - own %{_libdir}/php/pear for PEAR packages (per #176733)
  - add obsoletes to allow upgrade from FE4 PDO packages (#181863)


author: Joe Orton <jorton@redhat.com> 5.1.4-5
changelog:
  - provide mod_php (#187891)
  - provide php-cli (#192196)
  - use correct LDAP fix (#181518)
  - define _GNU_SOURCE in php_config.h and leave it defined
  - drop (circular) dependency on php-pear


author: Joe Orton <jorton@redhat.com> 5.1.4-8
changelog:
  - Provide php-posix (#194583)
  - only provide php-pcntl from -cli subpackage
  - add missing defattr's (thanks to Matthias Saou)


author: Joe Orton <jorton@redhat.com> 5.2.0-3
changelog:
  - update to 5.2.0 (#213837)
  - php-xml provides php-domxml (#215656)
  - fix php-pdo-abi provide (#214281)


author: Joe Orton <jorton@redhat.com> 5.2.0-4
changelog:
  - provide php-zend-abi (#212804)
  - add /etc/rpm/macros.php exporting interface versions
  - synch with upstream recommended php.ini


author: Joe Orton <jorton@redhat.com> 5.2.0-5
changelog:
  - build json and zip shared, in -common (Remi Collet, #215966)
  - obsolete php-json and php-pecl-zip
  - build readline extension into /usr/bin/php* (#210585)
  - change module subpackages to require php-common not php (#177821)


author: Joe Orton <jorton@redhat.com> 5.2.0-9
changelog:
  - add php(api), php(zend-abi) provides (#221302)
  - package /usr/share/php and append to default include_path (#225434)


author: Joe Orton <jorton@redhat.com> 5.2.0-10
changelog:
  - bump default memory_limit to 32M (#220821)
  - mark config files noreplace again (#174251)
  - drop trailing dots from Summary fields
  - use standard BuildRoot
  - drop libtool15 patch (#226294)


author: Joe Orton <jorton@redhat.com> 5.2.3-3
changelog:
  - add mcrypt, mhash, tidy, mssql subpackages (Dmitry Butskoy)
  - enable dbase extension and package in -common


author: Joe Orton <jorton@redhat.com> 5.2.6-3
changelog:
  - update to 5.2.6
  - sync default php.ini with upstream
  - drop extension_dir from default php.ini, rely on hard-coded
    default, to make php-common multilib-safe (#455091)
  - update to r3 of systzdata patch


author: Joe Orton <jorton@redhat.com> 5.2.6-6
changelog:
  - move gd_README to php-gd
  - update to r4 of systzdata patch; introduces a default timezone
    name of "System/Localtime", which uses /etc/localtime (#469532)


author: Joe Orton <jorton@redhat.com> 5.2.8-4
changelog:
  - move wddx to php-xml, build curl shared in -common
  - remove BR for expat-devel, bogus configure option


author: Joe Orton <jorton@redhat.com> 5.2.8-9
changelog:
  - add recode support, -recode subpackage (#106755)
  - add -zts subpackage with ZTS-enabled build of httpd SAPI
  - adjust php.conf to use -zts SAPI build for worker MPM


author: Remi Collet <Fedora@famillecollet.com> 5.3.0-1
changelog:
  - update to 5.3.0
  - remove ncurses, dbase, mhash extensions
  - add enchant, sqlite3, intl, phar, fileinfo extensions
  - raise sqlite version to 3.6.0 (for sqlite3, build with --enable-load-extension)
  - sync with upstream "production" php.ini


author: Joe Orton <jorton@redhat.com> 5.3.0-2
changelog:
  - update to v5 of systzdata patch; parses zone.tab and extracts
    timezone->{country-code,long/lat,comment} mapping table


author: Remi Collet <Fedora@famillecollet.com> 5.3.1-1
changelog:
  - update to 5.3.1
  - remove openssl patch (merged upstream)
  - add provides for php-pecl-json
  - add prod/devel php.ini in doc


author: Remi Collet <Fedora@famillecollet.com> 5.3.2-1
changelog:
  - PHP 5.3.2 Released!
  - remove mime_magic option (now provided by fileinfo, by emu)
  - add patch for http://bugs.php.net/50578
  - remove patch for libedit (upstream)
  - add runselftest option to allow build without test suite


author: Remi Collet <remi@fedoraproject.org> 5.3.8-2
changelog:
  - add mysqlnd sub-package
  - drop patch4, use --libdir to use /usr/lib*/php/build
  - add patch to redirect mysql.sock (in mysqlnd)


author: Remi Collet <remi@fedoraproject.org> 5.3.8-3
changelog:
  - revert is_a() to php <= 5.3.6 behavior (from upstream)
    with new option (allow_string) for new behavior


author: Remi Collet <remi@fedoraproject.org> 5.4.0-0.3.RC7
changelog:
  - update to PHP 5.4.0RC7
  - provides env file for php-fpm (#784770)
  - add patch to use system libzip (thanks to spot)
  - don't provide INSTALL file


author: Remi Collet <remi@fedoraproject.org> 5.4.0-5
changelog:
  - fix Loadmodule with MPM event (use ZTS if not MPM worker)
  - split conf.d/php.conf + conf.modules.d/10-php.conf with httpd 2.4


author: Remi Collet <remi@fedoraproject.org> 5.4.4-1
changelog:
  - update to 5.4.4 (CVE-2012-2143, CVE-2012-2386)
  - use /usr/lib/tmpfiles.d instead of /etc/tmpfiles.d
  - use /run/php-fpm instead of /var/run/php-fpm


author: Remi Collet <rcollet@redhat.com> 5.4.7-8
changelog:
  - systemd integration, https://bugs.php.net/63085
  - no odbc call during timeout, https://bugs.php.net/63171
  - check sqlite3_column_table_name, https://bugs.php.net/63149


author: Remi Collet <remi@fedoraproject.org> 5.4.7-9
changelog:
  - php-fpm: enable PrivateTmp
  - php-fpm: new systemd macros (#850268)
  - php-fpm: add upstream patch for startup issue (#846858)


author: Remi Collet <remi@fedoraproject.org> 5.4.8-1
changelog:
  - update to 5.4.8
  - define both session.save_handler and session.save_path
  - fix possible segfault in libxml (#828526)
  - php-fpm: create apache user if needed
  - use SKIP_ONLINE_TEST during make test
  - php-devel requires pcre-devel and php-cli (instead of php)


author: Remi Collet <rcollet@redhat.com> 5.4.8-6
changelog:
  - clarify Licenses
  - missing provides xmlreader and xmlwriter
  - modernize spec
  - change php embedded library soname version to 5.4


author: Remi Collet <rcollet@redhat.com> 5.4.9-0.1.RC1
changelog:
  - update to 5.4.9RC1
  - improves php.conf (use FilesMatch + SetHandler)
  - improves filter (httpd module)
  - apply ldap_r patch on fedora >= 18 only


author: Remi Collet <remi@fedoraproject.org> 5.4.12-1
changelog:
  - update to 5.4.12
  - security fix for CVE-2013-1635
  - enable tokyocabinet dba handler
  - upstream patch (5.4.13) to fix dval to lval conversion
    https://bugs.php.net/64142
  - upstream patch (5.4.13) for 2 failed tests
  - fix buit-in web server on ppc64 (fdset usage)
    https://bugs.php.net/64128


author: Remi Collet <rcollet@redhat.com> 5.4.13-1
changelog:
  - update to 5.4.13
  - security fix for CVE-2013-1643
  - Hardened build (links with -z now option)
  - Remove %config from /etc/rpm/macros.php


author: Remi Collet <rcollet@redhat.com> 5.4.16-1
changelog:
  - update to 5.4.16
  - switch systemd unit to Type=notify
  - patch for upstream Bug #64915 error_log ignored when daemonize=0
  - patch for upstream Bug #64949 Buffer overflow in _pdo_pgsql_error
  - patch for upstream bug #64960 Segfault in gc_zval_possible_root
  - add version to "Obsoletes"
  - own /usr/share/fpm


author: Remi Collet <rcollet@redhat.com> - 5.4.16-4
changelog:
  - improve mod_php, pgsql and ldap description
  - add provides php(pdo-abi) for consistency with php(api) and php(zend-abi)
  - use %__isa_bits instead of %__isa in ABI suffix


author: Remi Collet <rcollet@redhat.com> - 5.4.16-19
changelog:
  - fix memory leak introduce in patch for CVE-2014-1943
  - fix heap-based buffer over-read in DateInterval CVE-2013-6712


author: Remi Collet <rcollet@redhat.com> - 5.4.16-23
changelog:
  - fileinfo: cdf_unpack_summary_info() excessive looping
    DoS. CVE-2014-0237
  - fileinfo: CDF property info parsing nelements infinite
    loop. CVE-2014-0238
  - fileinfo: cdf_check_stream_offset insufficient boundary
    check. CVE-2014-3479
  - fileinfo: cdf_count_chain insufficient boundary check
    CVE-2014-3480
  - fileinfo: cdf_read_short_sector insufficient boundary
    check. CVE-2014-0207
  - fileinfo: cdf_read_property_info insufficient boundary
    check. CVE-2014-3487
  - fileinfo: fix extensive backtracking CVE-2013-7345
  - core: type confusion issue in phpinfo(). CVE-2014-4721
  - core: fix heap-based buffer overflow in DNS TXT record
    parsing. CVE-2014-4049
  - core: unserialize() SPL ArrayObject / SPLObjectStorage
    type confusion flaw. CVE-2014-3515


author: Remi Collet <rcollet@redhat.com> - 5.4.16-23.1
changelog:
  - gd: fix NULL pointer dereference in gdImageCreateFromXpm().
    CVE-2014-2497
  - gd: fix NUL byte injection in file names. CVE-2014-5120
  - fileinfo: fix extensive backtracking in regular expression
    (incomplete fix for CVE-2013-7345). CVE-2014-3538
  - fileinfo: fix mconvert incorrect handling of truncated
    pascal string size. CVE-2014-3478
  - fileinfo: fix cdf_read_property_info
    (incomplete fix for CVE-2012-1571). CVE-2014-3587
  - spl: fix use-after-free in ArrayIterator due to object
    change during sorting. CVE-2014-4698
  - spl: fix use-after-free in SPL Iterators. CVE-2014-4670
  - network: fix segfault in dns_get_record
    (incomplete fix for CVE-2014-4049). CVE-2014-3597


author: Dan Walsh <dwalsh@redhat.com> 1.9-9
changelog:
  - Change restorecon to not follow symlinks.  It is too difficult and confusing
  - to figure out the file context for the file pointed to by a symlink.


author: Colin Walters <walters@redhat.com> 1.10-3
changelog:
  - Add patch to fall back to authenticating via uid if
    the current user's SELinux user identity is the default
    identity
  - Add BuildRequires pam-devel


author: Dan Walsh <dwalsh@redhat.com> 1.13.3-1
changelog:
  - Update latest from NSA
  - Add -o option to setfiles to save output of any files with incorrect context.


author: Dan Walsh <dwalsh@redhat.com> 1.14.1-2
changelog:
  - Fix fixfiles.cron to not run on non SELinux boxes
  - Fix several problems in fixfiles and fixfiles.cron


author: Dan Walsh <dwalsh@redhat.com> 1.17.6-1
changelog:
  - Update with NSA
  	* Added -l option to setfiles to log changes via syslog.
  	* Merged -e option to setfiles to exclude directories.
  	* Merged -R option to restorecon for recursive descent.


author: Dan Walsh <dwalsh@redhat.com> 1.19.2-1
changelog:
  - Update to latest from NSA
  	* Changed restorecon to ignore ENOENT errors from matchpathcon.
  	* Merged nonls patch from Chris PeBenito.


author: Dan Walsh <dwalsh@redhat.com> 1.19.2-4
changelog:
  - Fix fixfiles handling of rpm
  - Fix restorecon to not warn on symlinks unless -v -v
  - Fix output of verbose to show old context as well as new context


author: Dan Walsh <dwalsh@redhat.com> 1.19.3-1
changelog:
  - Update to latest from NSA
  	* Merged fixfiles and restorecon patches from Dan Walsh.
  	* Don't display change if only user part changed.


author: Dan Walsh <dwalsh@redhat.com> 1.20.1-1
changelog:
  - Update to latest from NSA
  	* Merged fixfiles rewrite from Dan Walsh.
  	* Merged restorecon patch from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 1.21.1-3
changelog:
  - Don't change user componant if it is all that changed unless forced.
  - Change fixfiles to concatinate file_context.local for setfiles


author: Dan Walsh <dwalsh@redhat.com> 1.21.3-1
changelog:
  - Upgrade to latest from NSA
  	* Fixed restorecon to not treat errors from is_context_customizable()
  	  as a customizable context.
  	* Merged setfiles/restorecon patch to not reset user field unless
  	  -F option is specified from Dan Walsh.
  	* Merged open_init_pty helper for run_init from Manoj Srivastava.
  	* Merged audit2allow and genhomedircon man pages from Manoj Srivastava.


author: Dan Walsh <dwalsh@redhat.com> 1.21.5-1
changelog:
  - Upgrade to latest from NSA
  	* Merged newrole -l support from Darrel Goeddel (TCS).
  - Fix genhomedircon STARTING_UID


author: Dan Walsh <dwalsh@redhat.com> 1.21.7-3
changelog:
  - Fix fixfiles patch
  - Upgrade to latest from NSA
  	* Prevent overflow of spec array in setfiles.
  - Add diff comparason between file_contexts to fixfiles
  - Allow restorecon to give an warning on file not found instead of exiting


author: Dan Walsh <dwalsh@redhat.com> 1.21.9-1
changelog:
  - More cleanup of sed patch
  - Upgrade to latest from NSA
  	* Merged updated fixfiles script from Dan Walsh.
  	* Merged updated man page for fixfiles from Dan Walsh and re-added unzipped.
  	* Reverted fixfiles patch for file_contexts.local;
  	  obsoleted by setfiles rewrite.
  	* Merged error handling patch for restorecon from Dan Walsh.
  	* Merged semi raw mode for open_init_pty helper from Manoj Srivastava.
  	* Rewrote setfiles to use matchpathcon and the new interfaces
  	  exported by libselinux (>= 1.21.5).


author: Dan Walsh <dwalsh@redhat.com> 1.21.10-1
changelog:
  - More cleanup of fixfiles sed patch
  - Upgrade to latest from NSA
  	* Merged patch for open_init_pty from Manoj Srivastava.


author: Dan Walsh <dwalsh@redhat.com> 1.21.12-1
changelog:
  - More cleanup of fixfiles sed patch
  	* Merged further patches for restorecon/setfiles -e and fixfiles -C.


author: Dan Walsh <dwalsh@redhat.com> 1.21.13-1
changelog:
  - Update from NSA
  	* Merged further change to fixfiles -C from Dan Walsh.
  	* Merged updated fixfiles script from Dan Walsh.
  - Fix error handling of restorecon


author: Dan Walsh <dwalsh@redhat.com> 1.21.17-1
changelog:
  - Update to latest from NSA
  	* Merged new genhomedircon script from Dan Walsh.
  	* Changed load_policy to call sepol_genusers().


author: Dan Walsh <dwalsh@redhat.com> 1.21.18-1
changelog:
  - Update to latest from NSA
  	* Changed load_policy to fall back to the original policy upon
  	  an error from sepol_genusers().


author: Dan Walsh <dwalsh@redhat.com> 1.21.18-2
changelog:
  - Apply Uli patch
  	* The Makefiles should use the -Wall option even if compiled in beehive
  	* Add -W, too
  	* use -Werror when used outside of beehive.  This could also be used unconditionally
  	* setfiles/setfiles.c: fix resulting warning
  	* restorecon/restorecon.c: Likewise
  	* run_init/open_init_pty.c: argc hasn't been checked, the program would crash if
  called without parameters.  ignore the return value of nice properly.
  	* run_init: don't link with -ldl lutil
  	* load_policy: that's the bad bug.  pointer to unsigned int is passed, size_t is
  written to.  fails on 64-bit archs
  	* sestatus: signed vs unsigned problem
  	* newrole: don't link with -ldl


author: Dan Walsh <dwalsh@redhat.com> 1.23.1-1
changelog:
  - Update to released version from NSA
  	* Merged rewrite of genhomedircon by Eric Paris.
  	* Changed fixfiles to relabel jfs since it now supports security xattrs
  	  (as of 2.6.11).  Removed reiserfs until 2.6.12 is released with
  	  fixed support for reiserfs and selinux.


author: Dan Walsh <dwalsh@redhat.com> 1.23.2-1
changelog:
  - Update to version from NSA
  	* Changed setfiles -c to call set_matchpathcon_flags(3) to
  	  turn off processing of .homedirs and .local.


author: Dan Walsh <dwalsh@redhat.com> 1.23.3-1
changelog:
  - Update to version from NSA
  	* Merged context validation patch for genhomedircon from Eric Paris.
  - Fix verbose output of restorecon


author: Dan Walsh <dwalsh@redhat.com> 1.23.4-1
changelog:
  - Update to version from NSA
  	* Merged load_policy is_selinux_enabled patch from Dan Walsh.
  	* Merged restorecon verbose output patch from Dan Walsh.
  	* Merged setfiles altroot patch from Chris PeBenito.


author: Dan Walsh <dwalsh@redhat.com> 1.23.5-1
changelog:
  - Update to match NSA
  	* Reverted load_policy is_selinux_enabled patch from Dan Walsh.
  	  Otherwise, an initial policy load cannot be performed using
  	  load_policy, e.g. for anaconda.


author: Dan Walsh <dwalsh@redhat.com> 1.23.6-1
changelog:
  - Update to match NSA
  	* Fixed signed/unsigned pointer bug in load_policy.
  	* Reverted context validation patch for genhomedircon.


author: Dan Walsh <dwalsh@redhat.com> 1.23.7-1
changelog:
  - Change -f flag in fixfiles to remove stuff from /tmp
  - Change -F flag to pass -F flag  to restorecon/fixfiles.  (IE Force relabel).


author: Dan Walsh <dwalsh@redhat.com> 1.23.9-1
changelog:
  - Update to match NSA
  	* Updated audit2why for sepol_ prefixes on Flask types to
  	  avoid namespace collision with libselinux, and to
  	  include <selinux/selinux.h> now.


author: Dan Walsh <dwalsh@redhat.com> 1.23.10-1
changelog:
  - Update to match NSA
  	* Extended audit2why to incorporate booleans and local user
  	  settings when analyzing audit messages.


author: Dan Walsh <dwalsh@redhat.com> 1.23.11-1
changelog:
  - Update to match NSA
  	* Merged fixfiles and newrole patch from Dan Walsh.
  	* Merged audit2why man page from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 1.25.5-1
changelog:
  - Update to match NSA
  	* Merged patch to move module read/write code from libsemanage
  	  to libsepol from Jason Tang (Tresys).


author: Dan Walsh <dwalsh@redhat.com> 1.25.6-1
changelog:
  - Update to match NSA
  	* Merged fixes for semodule_link and sestatus from Serge Hallyn (IBM).
  	  Bugs found by Coverity.


author: Dan Walsh <dwalsh@redhat.com> 1.25.9-1
changelog:
  - Update to match NSA
  	* Changed setfiles -c to translate the context to raw format
  	prior to calling libsepol.


author: Dan Walsh <dwalsh@redhat.com> 1.27.1-1
changelog:
  - Update to match NSA
  	* Merged error shadowing bug fix for restorecon from Dan Walsh.
  	* Merged setfiles usage/man page update for -r option from Dan Walsh.
  	* Merged fixfiles -C patch to ignore :s0 addition on update
  	  to a MCS/MLS policy from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 1.27.2-1
changelog:
  - Update to match NSA
  	* Merged run_init open_init_pty bug fix from Manoj Srivastava
  	  (unblock SIGCHLD).  Bug reported by Erich Schubert.


author: Dan Walsh <dwalsh@redhat.com> 1.27.3-1
changelog:
  - Update to match NSA
  	* Merged patch to update semodule to the new libsemanage API
  	and improve the user interface from Karl MacMillan (Tresys).
  	* Modified semodule for the create/connect API split.


author: Dan Walsh <dwalsh@redhat.com> 1.27.5-1
changelog:
  - Update to match NSA
  	* Fixed warnings in load_policy.
  	* Rewrote load_policy to use the new selinux_mkload_policy()
  	interface provided by libselinux.


author: Dan Walsh <dwalsh@redhat.com> 1.27.6-1
changelog:
  - Update to match NSA
  	* Updated for changes to libsepol.
  	Changed semodule and semodule_package to use the shared libsepol.
  	Disabled build of semodule_link and semodule_expand for now.
  	Updated audit2why for relocated policydb internal headers,
  	still needs to be converted to a shared lib interface.


author: Dan Walsh <dwalsh@redhat.com> 1.27.7-1
changelog:
  - Update to match NSA
  	* Updated semodule_link and semodule_expand to use shared libsepol.
  	Fixed audit2why to call policydb_init prior to policydb_read (still
  	uses the static libsepol).


author: Dan Walsh <dwalsh@redhat.com> 1.27.11-1
changelog:
  - Update to match NSA
  	* Updated semodule_expand to use get interfaces for hidden sepol_module_package type.
  	* Merged newrole and run_init pam config patches from Dan Walsh (Red Hat).
  	* Merged fixfiles patch from Dan Walsh (Red Hat).
  	* Updated semodule for removal of semanage_strerror.


author: Dan Walsh <dwalsh@redhat.com> 1.27.12-1
changelog:
  - Update to match NSA
  	* Merged non-PAM Makefile support for newrole and run_init from Timothy Wood.


author: Dan Walsh <dwalsh@redhat.com> 1.27.18-1
changelog:
  - Update to match NSA
  	* Cleaned up usage and error messages and releasing of memory by
  	semodule utilities.
  	* Corrected error reporting by semodule.
  	* Updated semodule_expand for change to sepol interface.
  	* Merged fixes for make DESTDIR= builds from Joshua Brindle.


author: Dan Walsh <dwalsh@redhat.com> 1.27.19-1
changelog:
  - Update to match NSA
  	* Merged semodule support for reload, noreload, and store options
  	  from Joshua Brindle.
  	* Merged semodule_package rewrite from Joshua Brindle.


author: Dan Walsh <dwalsh@redhat.com> 1.27.20-1
changelog:
  - Update to match NSA
  	* Merged setsebool patch from Ivan Gyurdiev.
  	  This moves setsebool from libselinux/utils to policycoreutils,
  	  and rewrites it to use libsemanage for permanent boolean changes.


author: Dan Walsh <dwalsh@redhat.com> 1.27.23-1
changelog:
  - Update to match NSA
  	* Changed setfiles for the context canonicalization support.
  	* Changed setsebool to call semanage_is_managed() interface
  	  and fall back to security_set_boolean_list() if policy is
  	  not managed.
  	* Merged setsebool memory leak fix from Ivan Gyurdiev.
  	* Merged setsebool patch to call semanage_set_reload_bools()
  	  interface from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.27.26-1
changelog:
  * Added -B (--build) option to semodule to force a rebuild.
  	* Reverted setsebool patch to call semanage_set_reload_bools().
  	* Changed setsebool to disable policy reload and to call
  	  security_set_boolean_list to update the runtime booleans.
  	* Changed setfiles -c to use new flag to set_matchpathcon_flags()
  	  to disable context translation by matchpathcon_init().


author: Dan Walsh <dwalsh@redhat.com> 1.27.28-2
changelog:
  - Update to match NSA
  	* Merged genhomedircon rewrite from Dan Walsh.
  - Rewrite audit2allow to python


author: Dan Walsh <dwalsh@redhat.com> 1.27.29-1
changelog:
  - Update to match NSA
  	* Merged audit2allow python script from Dan Walsh.
  	  (old script moved to audit2allow.perl, will be removed later).
  	* Merged genhomedircon fixes from Dan Walsh.
  	* Merged semodule quieting patch from Dan Walsh
  	  (inverts default, use -v to restore original behavior).


author: Dan Walsh <dwalsh@redhat.com> 1.27.30-1
changelog:
  - Update to match NSA
  	* Merged sestatus, audit2allow, and semanage patch from Dan Walsh.
  	* Fixed semodule -v option.


author: Dan Walsh <dwalsh@redhat.com> 1.27.31-1
changelog:
  - Update to match NSA
  	* Changed genhomedircon to always use user_r for the role in the
  	  managed case since user_get_defrole is broken.
  - Add te file capabilities to audit2allow
  - Add man pages for semodule


author: Dan Walsh <dwalsh@redhat.com> 1.27.33-1
changelog:
  - Update to match NSA
  	* Merged audit2allow --tefile and --fcfile support from Dan Walsh.
  	* Merged genhomedircon fix from Dan Walsh.
  	* Merged semodule* man pages from Dan Walsh, and edited them.
  	* Changed setfiles to set the MATCHPATHCON_VALIDATE flag to
  	  retain validation/canonicalization of contexts during init.


author: Dan Walsh <dwalsh@redhat.com> 1.27.35-1
changelog:
  - Update to match NSA
  	* Merged genhomedircon bug fix from Dan Walsh.
  	* Revised semodule* man pages to refer to checkmodule and
  	  to include example sections.


author: Dan Walsh <dwalsh@redhat.com> 1.27.36-1
changelog:
  - Update to match NSA
  	* Changed genhomedircon to warn on use of ROLE in homedir_template
  	  if using managed policy, as libsemanage does not yet support it.


author: Dan Walsh <dwalsh@redhat.com> 1.29.1-1
changelog:
  - Update to match NSA
  	* Merged fix for audit2allow long option list from Dan Walsh.
  	* Merged -r option for restorecon (alias for -R) from Dan Walsh.
  	* Merged chcat script and man page from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 1.29.2-1
changelog:
  - Fix genhomedircon to work in installer
  - Update to match NSA
  	* Merged patch for chcat script from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 1.29.3-1
changelog:
  - Update to match NSA
  	* Merged semanage getpwnam bug fix from Serge Hallyn (IBM).
  	* Merged patch series from Ivan Gyurdiev.
  	  This includes patches to:
  	  - cleanup setsebool
  	  - update setsebool to apply active booleans through libsemanage
  	  - update semodule to use the new semanage_set_rebuild() interface
  	  - fix various bugs in semanage
  	* Merged patch from Dan Walsh (Red Hat).
  	  This includes fixes for restorecon, chcat, fixfiles, genhomedircon,
  	  and semanage.


author: Dan Walsh <dwalsh@redhat.com> 1.29.4-1
changelog:
  - Update to match NSA
  	* Merged genhomedircon and semanage patch from Dan Walsh.
  	* Changed semodule error reporting to include argv[0].


author: Dan Walsh <dwalsh@redhat.com> 1.29.7-1
changelog:
  - Update to match NSA
  	* Merged newrole cleanup patch from Steve Grubb.
  	* Merged setfiles/restorecon performance patch from Russell Coker.
  	* Merged genhomedircon and semanage patches from Dan Walsh.
  	* Merged remove add_local/set_local patch from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.29.8-1
changelog:
  - Update to match NSA
  	* Merged semanage fixes from Ivan Gyurdiev.
  	* Merged semanage fixes from Russell Coker.
  	* Merged chcat, genhomedircon, and semanage diffs from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 1.29.11-1
changelog:
  - Added translation support to semanage
  - Update from upstream
  	* Modified newrole and run_init to use the loginuid when
  	  supported to obtain the Linux user identity to re-authenticate,
  	  and to fall back to real uid.  Dropped the use of the SELinux
  	  user identity, as Linux users are now mapped to SELinux users
  	  via seusers and the SELinux user identity space is separate.
  	* Merged semanage bug fixes from Ivan Gyurdiev.
  	* Merged semanage fixes from Russell Coker.
  	* Merged chcat.8 and genhomedircon patches from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 1.29.15-1
changelog:
  - Update from upstream
  	* Merged newrole audit patch from Steve Grubb.
  	* Merged seuser -> seuser local rename patch from Ivan Gyurdiev.
  	* Merged semanage and semodule access check patches from Joshua Brindle.


author: Dan Walsh <dwalsh@redhat.com> 1.29.17-1
changelog:
  - Update from upstream
  	* Merged genhomedircon fix from Dan Walsh.
  	* Merged seusers.system patch from Ivan Gyurdiev.
  	* Merged improve port/fcontext API patch from Ivan Gyurdiev.
  	* Merged genhomedircon patch from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 1.29.20-1
changelog:
  - Update from upstream
  	* Merged seuser/user_extra support patch to semodule_package
  	  from Joshua Brindle.
  	* Merged getopt type fix for semodule_link/expand and sestatus
  	  from Chris PeBenito.
  - Fix genhomedircon output


author: Dan Walsh <dwalsh@redhat.com> 1.29.23-1
changelog:
  - Update from upstream
  	* Merged newrole -V/--version support from Glauber de Oliveira Costa.
  	* Merged genhomedircon prefix patch from Dan Walsh.
  	* Merged optionals in base patch from Joshua Brindle.


author: Dan Walsh <dwalsh@redhat.com> 1.29.26-1
changelog:
  - Update from upstream
  	* Merged semanage bug fix patch from Ivan Gyurdiev.
  	* Merged improve bindings patch from Ivan Gyurdiev.
  	* Merged semanage usage patch from Ivan Gyurdiev.
  	* Merged use PyList patch from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.30.1-1
changelog:
  - Make audit2allow translate dontaudit as well as allow rules
  - Update from upstream
  	* Merged semanage labeling prefix patch from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.30.4-1
changelog:
  - Update from upstream
  	* Merged audit2allow fixes for refpolicy from Dan Walsh.
  	* Merged fixfiles patch from Dan Walsh.
  	* Merged restorecond daemon from Dan Walsh.
  	* Merged semanage non-MLS fixes from Chris PeBenito.
  	* Merged semanage and semodule man page examples from Thomas Bleher.


author: Dan Walsh <dwalsh@redhat.com> 1.30.6-1
changelog:
  - Add /etc/samba/secrets.tdb to restorecond.conf
  - Update from upstream
  	* Merged semanage prefix support from Russell Coker.
  	* Added a test to setfiles to check that the spec file is
  	  a regular file.


author: Dan Walsh <dwalsh@redhat.com> 1.30.8-1
changelog:
  - Update to upstream
  	* Merged fix warnings patch from Karl MacMillan.
  	* Merged patch from Dan Walsh.
  	  This includes audit2allow changes for analysis plugins,
  	  internationalization support for several additional programs
  	  and added po files, some fixes for semanage, and several cleanups.
  	  It also adds a new secon utility.


author: Dan Walsh <dwalsh@redhat.com> 1.30.9-1
changelog:
  - Update to upstream
  	* Fixed audit2allow and po Makefiles for DESTDIR= builds.
  	* Merged .po file patch from Dan Walsh.
  	* Merged bug fix for genhomedircon.


author: Dan Walsh <dwalsh@redhat.com> 1.30.10-1
changelog:
  - Update to upstream
  	* Merged patch with updates to audit2allow, secon, genhomedircon,
  	  and semanage from Dan Walsh.


author: James Antill <jantill@redhat.com> 1.30.10-2
changelog:
  - secon fixes for --self-exec etc.
  - secon change from level => sensitivity, add clearance.
  - Add mass relabel AUDIT patch, but disable it until kernel problem solved.


author: Dan Walsh <dwalsh@redhat.com> 1.30.11-1
changelog:
  - Update to upstream
  	* Merged more translations from Dan Walsh.
  	* Merged patch to relocate setfiles to /sbin for early relabel
  	  when /usr might not be mounted from Dan Walsh.
  	* Merged semanage/seobject patch to preserve fcontext ordering in list.
  	* Merged secon patch from James Antill.


author: Dan Walsh <dwalsh@redhat.com> 1.30.14-1
changelog:
  - Update to upstream
  	* Merged fix for setsebool error path from Serge Hallyn.
  	* Merged patch from Dan Walsh with:
  	*    Updated po files.
  	*    Fixes for genhomedircon and seobject.
  	*    Audit message for mass relabel by setfiles.


author: Dan Walsh <dwalsh@redhat.com> 1.30.17-1
changelog:
  - Update to upstream
  	* Lindent.
  	* Merged patch from Dan Walsh with:
  	  * -p option (progress) for setfiles and restorecon.
  	  * disable context translation for setfiles and restorecon.
  	  * on/off values for setsebool.
  	* Merged setfiles and semodule_link fixes from Joshua Brindle.


author: Dan Walsh <dwalsh@redhat.com> 1.30.22-1
changelog:
  - Update to upstream
  	* Merged restorecond size_t fix from Joshua Brindle.
  	* Merged secon keycreate patch from Michael LeMay.
  	* Merged restorecond fixes from Dan Walsh.
  	  Merged updated po files from Dan Walsh.
  	* Merged python gettext patch from Stephen Bennett.
  	* Merged semodule_deps from Karl MacMillan.


author: Dan Walsh <dwalsh@redhat.com> 1.30.25-1
changelog:
  - Update to upstream
  	* Merged patch from Dan Walsh with:
  		* audit2allow: process MAC_POLICY_LOAD events
  		* newrole: run shell with - prefix to start a login shell
  		* po: po file updates
  		* restorecond: bail if SELinux not enabled
  		* fixfiles: omit -q
  		* genhomedircon:  fix exit code if non-root
  		* semodule_deps:  install man page
  	* Merged secon Makefile fix from Joshua Brindle.
  	* Merged netfilter contexts support patch from Chris PeBenito.


author: Dan Walsh <dwalsh@redhat.com> 1.30.26-1
changelog:
  - Update to upstream
  	* Merged semanage local file contexts patch from Chris PeBenito.
  - Fix fixfiles log creation
  - More translations


author: Dan Walsh <dwalsh@redhat.com> 1.30.27-4
changelog:
  - Add -i qualified to restorecon to tell it to ignore files that do not exist
  - Fixfiles also modified for this change


author: Dan Walsh <dwalsh@redhat.com> 1.30.28-1
changelog:
  - Security fixes to run python in a more locked down manner
  - More Translations
  - Update to upstream
  	* Merged fix for restorecon // handling from Erich Schubert.
  	* Merged translations update and fixfiles fix from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 1.30.28-6
changelog:
  - Change setfiles and restorecon to use stderr except for -o flag
  - Also -o flag will now output files


author: Dan Walsh <dwalsh@redhat.com> 1.30.30-1
changelog:
  - Update to upstream
  	* Merged newrole auditing of failures due to user actions from
  	  Michael Thompson.


author: Dan Walsh <dwalsh@redhat.com> 1.32-1
changelog:
  - Add newrole audit patch from sgrubb
  - Update to upstream
  	* Merged audit2allow -l fix from Yuichi Nakamura.
  	* Merged restorecon -i and -o - support from Karl MacMillan.
  	* Merged semanage/seobject fix from Dan Walsh.
  	* Merged fixfiles -R and verify changes from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 1.33.4-1
changelog:
  - Upstream accepted my patches
  	* Merged setsebool patch from Karl MacMillan.
  	  This fixes a bug reported by Yuichi Nakamura with
  	  always setting booleans persistently on an unmanaged system.


author: Dan Walsh <dwalsh@redhat.com> 1.33.6-1
changelog:
  - Update to upstream
  	* Patch from Dan Walsh to add an pam_acct_msg call to run_init
  	* Patch from Dan Walsh to fix error code returns in newrole
  	* Patch from Dan Walsh to remove verbose flag from semanage man page
  	* Patch from Dan Walsh to make audit2allow use refpolicy Makefile
  	  in /usr/share/selinux/<SELINUXTYPE>


author: Dan Walsh <dwalsh@redhat.com> 1.33.6-5
changelog:
  - Update po files
  - Fix newrole to open stdout and stderr rdrw so more will work on MLS machines
  Resolves: #216920


author: Dan Walsh <dwalsh@redhat.com> 1.33.6-6
changelog:
  - Fix audit2allow generating reference policy
  - Fix semanage to manage user roles properly
  Resolves: #220071


author: Dan Walsh <dwalsh@redhat.com> 1.33.6-7
changelog:
  - add exists switch to semanage to tell it not to check for existance of Linux user
  Resolves: #219421


author: Dan Walsh <dwalsh@redhat.com> 1.33.6-9
changelog:
  - Fix fixfiles script to use tty command correctly.  If this command fails, it
  should set the LOGFILE to /dev/null
  Resolves: #220879


author: Dan Walsh <dwalsh@redhat.com> 1.33.8-1
changelog:
  - Update to upstream
  	* Merged patches from Dan Walsh to:
  	  - omit the optional name from audit2allow
  	  - use the installed python version in the Makefiles
  	  - re-open the tty with O_RDWR in newrole


author: Dan Walsh <dwalsh@redhat.com> 1.33.10-1
changelog:
  - Update to upstream
  	* Merged patch to correctly handle a failure during semanage handle
  	  creation from Karl MacMillan.
  	* Merged patch to fix seobject role modification from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 1.33.11-1
changelog:
  - Update to upstream
  	* Merged fixfiles and seobject fixes from Dan Walsh.
  	* Merged semodule support for list of modules after -i from Karl MacMillan.


author: Dan Walsh <dwalsh@redhat.com> 1.33.12-1
changelog:
  - Want to update to match api
  - Update to upstream
  	* Merged newrole securetty check from Dan Walsh.
  	* Merged semodule patch to generalize list support from Karl MacMillan.
  Resolves: #200110


author: Dan Walsh <dwalsh@redhat.com> 1.33.14-1
changelog:
  * Merged newrole man page patch from Michael Thompson.
  	* Merged patch to fix python unicode problem from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 1.33.15-1
changelog:
  - Update to upstream
  	* Merged unicode-to-string fix for seobject audit from Dan Walsh.
  	* Merged man page updates to make "apropos selinux" work from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 1.34.1-1
changelog:
  - Fix system-config-selinux ports view
  - Update to upstream
  	* Fixed newrole non-pam build.
  	* Updated version for stable branch.


author: Dan Walsh <dwalsh@redhat.com> 2.0.0-1
changelog:
  - Update to upstream
  	* Merged new audit2allow from Karl MacMillan.
  	  This audit2allow depends on the new sepolgen python module.
  	  Note that you must run the sepolgen-ifgen tool to generate
  	  the data needed by audit2allow to generate refpolicy.
  	* Fixed newrole non-pam build.
  - Fix Changelog and spelling error in man page


author: Dan Walsh <dwalsh@redhat.com> 2.0.1-1
changelog:
  - Update to upstream
  	* Merged small fix to correct include of errcodes.h in semodule_deps from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 2.0.2-1
changelog:
  - Update to upstream
  	* Merged seobject exception handler fix from Caleb Case.
  	* Merged setfiles memory leak patch from Todd Miller.


author: Dan Walsh <dwalsh@redhat.com> 2.0.3-1
changelog:
  - Update to upstream
  	* Merged translations update from Dan Walsh.
  	* Merged chcat fixes from Dan Walsh.
  	* Merged man page fixes from Dan Walsh.
  	* Merged seobject prefix validity checking from Dan Walsh.
  	* Merged Makefile and refparser.py patch from Dan Walsh.
  	  Fixes PYTHONLIBDIR definition and error handling on interface files.


author: Dan Walsh <dwalsh@redhat.com> 2.0.6-1
changelog:
  - Update to upstream
    - policycoreutils
  	* Merged newrole O_NONBLOCK fix from Linda Knippers.
  	* Merged sepolgen and audit2allow patches to leave generated files
  	  in the current directory from Karl MacMillan.
  	* Merged restorecond memory leak fix from Steve Grubb.
    -sepolgen
  	* Merged patch to leave generated files (e.g. local.te) in current directory from Karl MacMillan.
  	* Merged patch to make run-tests.py use unittest.main from Karl MacMillan.
  	* Merged patch to update PLY from Karl MacMillan.
  	* Merged patch to update the sepolgen parser to handle the latest reference policy from Karl MacMillan.


author: Dan Walsh <dwalsh@redhat.com> 2.0.6-3
changelog:
  - Update to upstream
    -sepolgen
  	* Merged support for enabling parser debugging from Karl MacMillan.
  - Add sgrupp cleanup of restorcon init script


author: Dan Walsh <dwalsh@redhat.com> 2.0.7-1
changelog:
  - Update to upstream
  	* Merged restorecond init script LSB compliance patch from Steve Grubb.
    -sepolgen
  	* Merged better matching for refpolicy style from Karl MacMillan
  	* Merged support for extracting interface paramaters from interface calls from Karl MacMillan
  	* Merged support for parsing USER_AVC audit messages from Karl MacMillan.


author: Dan Walsh <dwalsh@redhat.com> 2.0.7-5
changelog:
  - Change location of audit2allow and sepol-ifgen to sbin
  - Updated version of sepolgen
  	* Merged patch to move the sepolgen runtime data from /usr/share to /var/lib to facilitate a read-only /usr from Karl MacMillan.


author: Dan Walsh <dwalsh@redhat.com> 2.0.7-6
changelog:
  - Updated version of sepolgen
  	* Merged patch to discard self from types when generating requires from Karl MacMillan.


author: Dan Walsh <dwalsh@redhat.com> 2.0.7-8
changelog:
  - system-config-selinux should be able to run on a disabled system,
  - at least enough to get it enabled.


author: Dan Walsh <dwalsh@redhat.com> 2.0.8-1
changelog:
  - Updated version of sepolgen
  	* Merged updates to sepolgen-ifgen from Karl MacMillan.
  	* Merged updates to sepolgen parser and tools from Karl MacMillan.
  	  This includes improved debugging support, handling of interface
  	  calls with list parameters, support for role transition rules,
  	  updated range transition rule support, and looser matching.


author: Dan Walsh <dwalsh@redhat.com> 2.0.9-1
changelog:
  - Updated version of sepolgen
  	* Merged seobject setransRecords patch to return the first alias from Xavier Toth.


author: Dan Walsh <dwalsh@redhat.com> 2.0.10-1
changelog:
  - Updated version of policycoreutils
  	* Merged chcat, fixfiles, genhomedircon, restorecond, and restorecon patches from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 2.0.13-1
changelog:
  - Updated version of policycoreutils
  	* Merged setsebool patch to only use libsemanage for persistent boolean changes from Stephen Smalley.
  	* Merged genhomedircon patch to use the __default__ setting from Dan Walsh.
  	* Dropped -b option from load_policy in preparation for always preserving booleans across reloads in the kernel.


author: Dan Walsh <dwalsh@redhat.com> 2.0.15-1
changelog:
  - Updated version of policycoreutils
  	* Merged po file updates from Dan Walsh.
  - Fix semanage to be able to modify prefix in user record


author: Dan Walsh <dwalsh@redhat.com> 2.0.16-1
changelog:
  - Updated version of policycoreutils
  	* Merged support for modifying the prefix via semanage from Dan Walsh.
  - Fixed genhomedircon to find homedirs correctly.


author: Dan Walsh <dwalsh@redhat.com> 2.0.20-1
changelog:
  - Update to match NSA
  	* Merged genhomedircon fixes from Dan Walsh.
  	* Merged setfiles -c usage fix from Dan Walsh.
  	* Merged restorecon fix from Yuichi Nakamura.
  	* Dropped -lsepol where no longer needed.


author: Dan Walsh <dwalsh@redhat.com> 2.0.22-13
changelog:
  - Speed up genhomedircon by an order of magnitude by compiling regex
  - Allow semanage fcontext -a -t <<none>> /path to work


author: Dan Walsh <dwalsh@redhat.com> 2.0.25-1
changelog:
  - Update semodule man page
  	* Fix genhomedircon searching for USER from Todd Miller
  	* Install run_init with mode 0755 from Dan Walsh.
  	* Fix chcat from Dan Walsh.
  	* Fix fixfiles pattern expansion and error reporting from Dan Walsh.
  	* Optimize genhomedircon to compile regexes once from Dan Walsh.
  	* Fix semanage gettext call from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 2.0.25-13
changelog:
  - Upgrade version of sepolgen from NSA
  	* Expand the sepolgen parser to parse all current refpolicy modules from Karl MacMillan.
  	* Suppress generation of rules for non-denials from Karl MacMillan (take 3).


author: Dan Walsh <dwalsh@redhat.com> 2.0.28-1
changelog:
  - Update to upstream
  	* Update semodule man page for -D from Dan Walsh.
  	* Add boolean, locallist, deleteall, and store support to semanage from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 2.0.29-1
changelog:
  - Update to upstream
  	* Add genhomedircon script to invoke semodule -Bn from Dan Walsh.
  - Add deleteall for ports and fcontext


author: Dan Walsh <dwalsh@redhat.com> 2.0.31-1
changelog:
  - Remove no.po
  - Update to upstream
  	* Fix semodule option handling from Dan Walsh.
  	* Add deleteall support for ports and fcontexts in semanage from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 2.0.33-1
changelog:
  - Upgrade from NSA
  	* Drop verbose output on fixfiles -C from Dan Walsh.
  	* Fix argument handling in fixfiles from Dan Walsh.
  	* Enhance boolean support in semanage, including using the .xml description when available, from Dan Walsh.
  - Fix handling of final screen in polgengui


author: Dan Walsh <dwalsh@redhat.com> 2.0.33-4
changelog:
  - Fix sepolgen to be able to parse Fedora 9 policy
        Handle ifelse statements
        Handle refpolicywarn inside of define
        Add init.if and inetd.if into parse
        Add parse_file to syntax error message


author: Dan Walsh <dwalsh@redhat.com> 2.0.34-1
changelog:
  - Update to upstream
  	* Update Makefile to not build restorecond if
  	  /usr/include/sys/inotify.h is not present


author: Dan Walsh <dwalsh@redhat.com> 2.0.34-2
changelog:
  - Make sepolgen set error exit code when partial failure
  - audit2why now checks booleans for avc diagnosis


author: Dan Walsh <dwalsh@redhat.com> 2.0.35-1
changelog:
  - Update to upstream
  	* Merged support for non-interactive newrole command invocation from Tim Reed.


author: Dan Walsh <dwalsh@redhat.com> 2.0.36-1
changelog:
  - Update to upstream
  	* Merged update to chcat, fixfiles, and semanage scripts from Dan Walsh.
  	* Merged sepolgen fixes from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 2.0.38-1
changelog:
  - Update to upstream
    * Merged audit2allow cleanups and boolean descriptions from Dan Walsh.
    * Merged setfiles -0 support by Benny Amorsen via Dan Walsh.
    * Merged fixfiles fixes and support for ext4 and gfs2 from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 2.0.39-1
changelog:
  - Don't initialize audit2allow for audit2why call.  Use default
  - Update to upstream
  	* Merged fixfiles -C fix from Marshall Miller.


author: Dan Walsh <dwalsh@redhat.com> 2.0.41-1
changelog:
  - Update to upstream
  	* Merged audit2why fix and semanage boolean --on/--off/-1/-0 support from Dan Walsh.
  	* Merged a second fixfiles -C fix from Marshall Miller.


author: Dan Walsh <dwalsh@redhat.com> 2.0.42-1
changelog:
  - Update to upstream
  	* Make semodule_expand use sepol_set_expand_consume_base to reduce
  	  peak memory usage.


author: Dan Walsh <dwalsh@redhat.com> 2.0.43-1
changelog:
  - Update to upstream
  	* Merged fix fixfiles option processing from Vaclav Ovsik.
  - Added existing users, staff and user_t users to polgengui


author: Dan Walsh <dwalsh@redhat.com> 2.0.46-1
changelog:
  - Update to upstream
  	* Update audit2allow to report dontaudit cases from Dan Walsh.
  	* Fix semanage port to use --proto from Caleb Case.


author: Dan Walsh <dwalsh@redhat.com> 2.0.47-1
changelog:
  - Make restorecond not start by default
  - Fix polgengui to allow defining of confined roles.
  - Add patches from Lubomir Rintel <lkundrak@v3.sk>
    * Add necessary runtime dependencies on setools-console for -gui
    * separate stderr when run seinfo commands
  - Update to upstream
    * Update semanage man page for booleans from Dan Walsh.
    * Add further error checking to seobject.py for setting booleans.


author: Dan Walsh <dwalsh@redhat.com> 2.0.47-2
changelog:
  - Add rm -rf /tmp/gconfd-* /tmp/pulse-* /tmp/orbit-* to fixfiles restore
  - So that mislabeled files will get removed on full relabel


author: Dan Walsh <dwalsh@redhat.com> 2.0.49-1
changelog:
  - Update to upstream
  	* Remove security_check_context calls for prefix validation from semanage.
  	* Change setfiles and restorecon to not relabel if the file already has the correct context value even if -F/force is specified.


author: Dan Walsh <dwalsh@redhat.com> 2.0.52-2
changelog:
  - Add lockdown wizard
  - Allow semanage booleans to take an input file an process lots of booleans at once.


author: Dan Walsh <dwalsh@redhat.com> 2.0.53-1
changelog:
  - Update to upstream
  	* Change setfiles to validate all file_contexts files when using -c from Stephen Smalley.


author: Dan Walsh <dwalsh@redhat.com> 2.0.54-1
changelog:
  - Update to upstream
  	* Add support for boolean files and group support for seusers from Dan Walsh.
  	* Ensure that setfiles -p output is newline terminated from Russell Coker.


author: Dan Walsh <dwalsh@redhat.com> 2.0.56-1
changelog:
  - Fix semanage help display
  - Update to upstream
  	* fixfiles will now remove all files in /tmp and will check for
  	  unlabeled_t in /tmp and /var/tmp from Dan Walsh.
  	* add glob support to restorecond from Dan Walsh.
  	* allow semanage to handle multi-line commands in a single transaction
  	  from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 2.0.58-1
changelog:
  - Update to upstream
  	* Allow local file context entries to override policy entries in
  	semanage from Dan Walsh.
  	* Newrole error message corrections from Dan Walsh.
  	* Add exception to audit2why call in audit2allow from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 2.0.61-1
changelog:
  - Update to upstream
  	* chcat: cut categories at arbitrary point (25) from Dan Walsh
  	* semodule: use new interfaces in libsemanage for compressed files
  	  from Dan Walsh
  	* audit2allow: string changes for usage


author: Dan Walsh <dwalsh@redhat.com> 2.0.61-3
changelog:
  - Add Domains Page to system-config-selinux
  - Add ability to create dbus confined applications to polgen


author: Dan Walsh <dwalsh@redhat.com> 2.0.62-1
changelog:
  - Update to upstream
  	* Add btrfs to fixfiles from Dan Walsh.
  	* Remove restorecond error for matching globs with multiple hard links
  	and fix some error messages from Dan Walsh.
  	* Make removing a non-existant module a warning rather than an error
  	  from Dan Walsh.
  	* Man page fixes from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 2.0.63-1
changelog:
  - Update to upstream
  	* Fix transaction checking from Dan Walsh.
  	* Make fixfiles -R (for rpm) recursive.
  	* Make semanage permissive clean up after itself from Dan Walsh.
  	* add /root/.ssh/* to restorecond.conf


author: Dan Walsh <dwalsh@redhat.com> 2.0.64-1
changelog:
  - Update to upstream
  	* Keep setfiles from spamming console from Dan Walsh.
  	* Fix chcat's category expansion for users from Dan Walsh.
  - Update po files
  - Fix sepolgen


author: Dan Walsh <dwalsh@redhat.com> 2.0.68-1
changelog:
  - Fix location of man pages
  - Update to upstream
  	* Modify setfiles to exclude mounts without seclabel option in
  	/proc/mounts on kernels >= 2.6.30 from Thomas Liu.
  	* Re-enable disable_dontaudit rules upon semodule -B from Christopher
  	Pardy and Dan Walsh.
  	* setfiles converted to fts from Thomas Liu.


author: Dan Walsh <dwalsh@redhat.com> 2.0.70-1
changelog:
  - Update to upstream
  	* Modify restorecon to only call realpath() on user-supplied pathnames
  	from Stephen Smalley.
  	* Fix typo in fixfiles that prevented it from relabeling btrfs
  	  filesystems from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 2.0.71-1
changelog:
  - Fix chcat to report error on non existing file
  - Update to upstream
  	* Modify setfiles/restorecon checking of exclude paths.  Only check
  	user-supplied exclude paths (not automatically generated ones based on
  	lack of seclabel support), don't require them to be directories, and
  	ignore permission denied errors on them (it is ok to exclude a path to
  	which the caller lacks permission).


author: Ville Skyttä <ville.skytta@iki.fi> - 2.0.71-9
changelog:
  - Don't try to remove restorecond after last erase (done already in %preun).
  - Ensure scriptlets exit with status 0.
  - Fix %post and %pr


author: Dan Walsh <dwalsh@redhat.com> 2.0.73-1
changelog:
  - Update to upstream
  	* Add semanage dontaudit to turn off dontaudits from Dan Walsh.
  	* Fix semanage to set correct mode for setrans file from Dan Walsh.
  	* Fix malformed dictionary in portRecord from Dan Walsh.
  	* Restore symlink handling support to restorecon based on a patch by
  	Martin Orr.  This fixes the restorecon /dev/stdin performed by Debian
  	udev scripts that was broken by policycoreutils 2.0.70.


author: Dan Walsh <dwalsh@redhat.com> 2.0.74-1
changelog:
  - Update to upstream
  	* Change semodule upgrade behavior to install even if the module
  	  is not present from Dan Walsh.
  	* Make setfiles label if selinux is disabled and a seclabel aware
  	  kernel is running from Caleb Case.
  	* Clarify forkpty() error message in run_init from Manoj Srivastava.


author: Dan Walsh <dwalsh@redhat.com> 2.0.74-8
changelog:
  - Add check to sandbox to verify save changes - Chris Pardy
  - Fix memory leak in restorecond - Steve Grubb


author: Dan Walsh <dwalsh@redhat.com> 2.0.74-14
changelog:
  - Allow semanage -i and semanage -o to generate customization files.
  - semanage -o will generate a customization file that semanage -i can read and set a machines to the same selinux configuration


author: Dan Walsh <dwalsh@redhat.com> 2.0.76-1
changelog:
  - Update to upstream
  	* Remove setrans management from semanage, as it does not work
  	  from Dan Walsh.
  	* Move load_policy from /usr/sbin to /sbin from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 2.0.77-1
changelog:
  - Update to upstream
  	* Fixed bug preventing semanage node -a from working
  	  from Chad Sellers
  	* Fixed bug preventing semanage fcontext -l from working
  	  from Chad Sellers
  - Change semanage to use unicode


author: Dan Walsh <dwalsh@redhat.com> 2.0.78-1
changelog:
  - Update to upstream
  	* Remove non-working OUTFILE from fixfiles from Dan Walsh.
  	* Additional exception handling in chcat from Dan Walsh.

  	* fix sepolgen to read a "type 1403" msg as a policy load by Stephen
  	  Smalley <sds@tycho.nsa.gov>
  	* Add support for Xen ocontexts from Paul Nuzzi.


author: Dan Walsh <dwalsh@redhat.com> 2.0.78-14
changelog:
  - Add session capability to sandbox
  - sandbox -SX -H ~/.homedir -t unconfined_t -l s0:c15 /etc/gdm/Xsession


author: Dan Walsh <dwalsh@redhat.com> 2.0.81-4
changelog:
  - Update to upstream - sepolgen
  	* Add since-last-boot option to audit2allow from Dan Walsh.
  	* Fix sepolgen output to match what Chris expects for upstream
  	  refpolicy from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 2.0.82-7
changelog:
  - Fix crash when args are empty
  Resolves: #582542
  - Fix semange to exit on bad options
  - Fix semanage dontaudit man page section
  Resolves: #582533


author: Dan Walsh <dwalsh@redhat.com> 2.0.82-13
changelog:
  - Make semanage boolean work on disabled machines and during livecd xguest
  - Fix homedir and tmpdir handling in sandbox
  Resolves: #587263


author: Dan Walsh <dwalsh@redhat.com> 2.0.82-17
changelog:
  - Fix policy tool to have correct name in menus
  - Fix seunshare to handle /tmp being in ~/home
  - Fix saving of altered files
  - Update translations


author: Dan Walsh <dwalsh@redhat.com> 2.0.82-23
changelog:
  - Fix seunshare translations
  - Fix seunshare to work on all arches
  - Fix icon for system-config-selinux
  Resolves: #595276


author: Dan Walsh <dwalsh@redhat.com> 2.0.82-27
changelog:
  - Move genhomedircon.8 to same package as genhomedircon
  - Fix sandbox to pass unit test
  Resolves: #595796


author: Dan Walsh <dwalsh@redhat.com> 2.0.83-17
changelog:
  - Apply patch to restorecond from Chris Adams, which will cause restorecond
  - to watch first user that logs in.


author: Dan Walsh <dwalsh@redhat.com> 2.0.83-20
changelog:
  - Tighten down seunshare to create /tmp dir with sticky bit and MS_NODEV | MS_NOSUID | MS_NOEXEC;
  - Remove setsid on seunshare so ^c on sandbox will cause apps to exit
  - Add dbus-launch --exit-with-session so all processes launched within the sandbox exit with the sandbox
  - Clean up error handling so error will get sent back to sandbox tool


author: Dan Walsh <dwalsh@redhat.com> 2.0.83-32
changelog:
  - Remove setuid flag and replace with file capabilities
  - Fix sandbox handling of files with spaces in them


author: Dan Walsh <dwalsh@redhat.com> 2.0.83-33
changelog:
  - Move /etc/pam.d/newrole in to polcicycoreutils-newrole
  - Additional capability checking in sepolgen


author: Dan Walsh <dwalsh@redhat.com> 2.0.85-3
changelog:
  - Polgengui raises the wrong type of exception.  #471078
  - Change semanage to not allow it to semanage module -D
  - Change setsebool to suggest run as root on failure


author: Dan Walsh <dwalsh@redhat.com> 2.0.85-10
changelog:
  - Cleaup selinux-polgengui to be a little more modern, fix comments and use selected name
  - Cleanup chcat man page


author: Dan Walsh <dwalsh@redhat.com> 2.0.85-13
changelog:
  - Rewrite seunshare to make sure /tmp is mounted stickybit owned by root
  - Only allow names in polgengui that contain letters and numbers
  - Fix up node handling in semanage command
  - Update translations


author: Dan Walsh <dwalsh@redhat.com> 2.0.85-16
changelog:
  - Require python-IPy for policycoreutils-python package
  - Fixes for sepologen
    - Usage statement needs -n name
    - Names with _ are being prevented
    - dbus apps should get _chat interface


author: Dan Walsh <dwalsh@redhat.com> 2.0.85-18
changelog:
  - put back in old handling of -T in sandbox command
  - Put back setsid in seunshare
  - Fix rsync to maintain times


author: Dan Walsh <dwalsh@redhat.com> 2.0.85-20
changelog:
  - Change sepolgen-ifgen to search all available policy files
  - Exit in restorecond if it can not find a UID in the passwd database


author: Dan Walsh <dwalsh@redhat.com> 2.0.85-21
changelog:
  - change default location of HOMEDIR in sandbox to /tmp/.sandbox_home_*
  - This will allow default sandboxes to work on NFS homedirs without allowing
    access to homedir data


author: Dan Walsh <dwalsh@redhat.com> 2.0.85-23
changelog:
  - Fix sepolgen to generate network polcy using generic_if and genric_node versus all_if and all_node


author: Dan Walsh <dwalsh@redhat.com> 2.0.86-6
changelog:
  - Apply patches from Christoph A.
    * fix sandbox title
    * stop xephyr from li
  - Also ignore errors on sandbox include of directory missing files


author: Dan Walsh <dwalsh@redhat.com> 2.0.86-10
changelog:
  - Allow semodule to pick alternate root for selinux files
  - Add ~/.config/* to restorcond_user.conf, so restorecond will watch for mislabeled files in this directory.


author: Dan Walsh <dwalsh@redhat.com> 2.0.86-16
changelog:
  - Add -C option to sandbox and seunshare to maintain capabilities, otherwise
  the bounding set will be dropped.
  - Change --cgroups short name -c rather then -C for consistancy
  - Fix memory and fd leaks in seunshare


author: Dan Walsh <dwalsh@redhat.com> 2.0.86-17
changelog:
  - Add -k qualifier to seunshare to have it attempt to kill all processes with
  the matching MCS label.


author: Dan Walsh <dwalsh@redhat.com> 2.0.86-18
changelog:
  - Change seunshare to send kill signals to the childs session.
  - Also add signal handler to catch sigint, so if user enters ctrl-C sandbox will shutdown.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.4-1
changelog:
  -Update to upstream
  2.1.4 2011-08-17
  	* run_init: clarification of the usage in the
  	* semanage: fix usage header around booleans
  	* semanage: remove useless empty lines
  	* semanage: update man page with new examples
  	* semanage: update usage text
  	* semanage: introduce file context equivalencies
  	* semanage: enable and disable modules
  	* semanage: output all local modifications
  	* semanage: introduce extraction of local configuration
  	* semanage: cleanup error on invalid operation
  	* semanage: handle being called with no arguments
  	* semanage: return sooner to save CPU time
  	* semanage: surround getopt with try/except
  	* semanage: use define/raise instead of lots of
  	* semanage: some options are only valid for
  	* semanage: introduce better deleteall support
  	* semanage: do not allow spaces in file
  	* semanage: distinguish between builtin and local permissive
  	* semanage: centralized ip node handling
  	* setfiles: make the restore function exclude() non-static
  	* setfiles: use glob to handle ~ and
  	* fixfiles: do not hard code types
  	* fixfiles: stop trying to be smart about
  	* fixfiles: use new kernel seclabel option
  	* fixfiles: pipe everything to cat before sending
  	* fixfiles: introduce /etc/selinux/fixfiles_exclude_dirs
  	* semodule: support for alternative root paths

  2.1.3 2011-08-03
  	* semanage: fix indention
  	* semodule_package: fix man page typo
  	* semodule_expand: update man page with -a
  	* semanage: handle os errors
  	* semanage: fix traceback with bad options
  	* semanage: show usage on -h or --help
  	* semanage: introduce more deleteall options
  	* semanage: verify ports < 65536
  	* transaction into semanageRecords
  	* make get_handle a method of semanageRecords
  	* remove a needless blank line
  	* make process_one error if not initialized correctly
  	* fixfiles: correct usage for r_opts.rootpath
  	* put -p in help for restorecon and
  	* fixfiles: do not try to only label
  	* fixfiles clean up /var/run and /var/lib/debug
  	* fixfiles delete tmp sockets and pipes rather
  	* fixfile use find -delete instead of pipe
  	* chcat man page typo
  	* add man page for genhomedircon
  	* setfiles fix typo
  	* setsebool should inform users they need to
  	* setsebool typos
  	* open_init_tty man page typos
  	* Don't add user site directory to sys.path
  	* newrole retain CAP_SETPCAP

  2.1.2 2011-08-02
  	* seunshare: define _GNU_SOURCE earlier
  	* make ignore_enoent do something
  	* restorecond: first user logged in is not noticed
  	* Repo: update .gitignore

  2.1.1 2011-08-01
  	* Man page updates
  	* restorecon fix for bad inotify assumptions

  2.1.0 2011-07-27
  	* Release, minor version bump


author: Dan Walsh <dwalsh@redhat.com> - 2.1.5-1
changelog:
  -Update to upstream
     * policycoreutils
  	* setfiles: Fix process_glob to handle error situations
  	* sandbox: Allow seunshare to run as root
  	* sandbox: trap sigterm to make sure sandbox
  	* sandbox: pass DPI from the desktop
  	* sandbox: seunshare: introduce helper spawn_command
  	* sandbox: seunshare: introduce new filesystem helpers
  	* sandbox: add -C option to not drop
  	* sandbox: split seunshare caps dropping
  	* sandbox: use dbus-launch
  	* sandbox: numerous simple updates to sandbox
  	* sandbox: do not require selinux context
  	* sandbox: Makefile: new man pages
  	* sandbox: rename dir to srcdir
  	* sandbox: allow users specify sandbox window size
  	* sandbox: check for paths up front
  	* sandbox: use defined values for paths rather
  	* sandbox: move seunshare globals to the top
  	* sandbox: whitespace fix
  	* semodule_package: Add semodule_unpackage executable
  	* setfiles: get rid of some stupid globals
  	* setfiles: move exclude_non_seclabel_mounts to a generic location
     * sepolgen
  	* refparser: include open among valid permissions
  	* refparser: add support for filename_trans rules


author: Dan Walsh <dwalsh@redhat.com> - 2.1.5-4
changelog:
  - Maintain the LANG environment Variable into the sandbox
  - Change restorecon/setfiles to only change type part of the context unless
    -f qualifier is given


author: Dan Walsh <dwalsh@redhat.com> - 2.1.6-1
changelog:
  -Update to upstream
      policycoreutils-2.1.6
  	* sepolgen-ifgen: new attr-helper does something
  	* audit2allow: use alternate policy file
  	* audit2allow: sepolgen-ifgen use the attr helper
  	* setfiles: switch from stat to stat64
  	* setfiles: Fix potential crash using dereferenced ftsent
  	* setfiles: do not wrap * output at 80 characters
  	* sandbox: add -Wall and -Werror to makefile
  	* sandbox: add sandbox cgroup support
  	* sandbox: rewrite /tmp handling
  	* sandbox: do not bind mount so much
  	* sandbox: add level based kill option
  	* sandbox: cntrl-c should kill entire process control group
  	* Create a new preserve_tunables flag in sepol_handle_t.
  	* semanage: show running and disk setting for booleans
  	* semanage: Dont print heading if no items selected
  	* sepolgen: audit2allow is mistakakenly not allowing valid module names
  	* semanage: Catch RuntimeErrors, that can be generated when SELinux is disabled
  	* More files to ignore
  	* tree: default make target to all not install
  	* sandbox: do not load unused generic init functions
      sepolgen-1.1.2
  	* src: sepolgen: add attribute storing infrastructure
  	* Change perm-map and add open to try to get better results on
  	* look for booleans that might solve problems
  	* sepolgen: audit2allow is mistakakenly not allowing valid module names
  	* tree: default make target to all not install


author: Dan Walsh <dwalsh@redhat.com> - 2.1.7-5
changelog:
  - A couple of minor coverity fixes for a potential leaked file descriptor
  - An an unchecked return code.
  - Add ~/.local/share/* to restorecond_user watches


author: Dan Walsh <dwalsh@redhat.com> - 2.1.8-1
changelog:
  - Upgrade to policycoreutils upstream
  	* sandbox: Maintain the LANG environment into the sandbox
  	* audit2allow: use audit2why internally
  	* fixfiles: label /root but not /var/lib/BackupPC
  	* semanage: update local boolean settings is dealing with localstore
  	* semanage: missing modify=True
  	* semanage: set modified correctly
  	* restorecond: make restorecond dbuss-able
  	* restorecon: Always check return code on asprintf
  	* restorecond: make restorecond -u exit when terminal closes
  	* sandbox: introduce package name and language stuff
  	* semodule_package: remove semodule_unpackage on clean
  	* fix sandbox Makefile to support DESTDIR
  	* semanage: Add -o description to the semanage man page
  	* make use of the new realpath_not_final function
  	* setfiles: close /proc/mounts file when finished
  	* semodule: Document semodule -p in man page
  	* setfiles: fix use before initialized
  	* restorecond: Add .local/share as a directory to watch
  - Upgrade to sepolgen upstream
  	* Ignore permissive qualifier if found in an interface
  	* Return name field in avc data


author: Dan Walsh <dwalsh@redhat.com> - 2.1.8-4
changelog:
  - sandbox init script should always return 0
  - sandbox command needs to check range of categories and report error if not big enough


author: Dan Walsh <dwalsh@redhat.com> - 2.1.8-6
changelog:
  - Add listing of distribution equivalence class from semanage fcontext -l
  - Add checking to semanage fcontext -a to guarantee a file specification will not be masked by an equivalence


author: Dan Walsh <dwalsh@redhat.com> - 2.1.8-7
changelog:
  - Fix dpi handling in sandbox
  - Make sure semanage fcontext -l -C prints if only local equiv have changed


author: Dan Walsh <dwalsh@redhat.com> - 2.1.9-1
changelog:
  - Upgrade to upstream
  	* sandbox: move sandbox.conf.5 to just sandbox.5
  	* po: Makefile use -p to preserve times to allow multilib simultatious installs
  	* of po files
  	* sandbox: Allow user to specify the DPI value for X in a sandbox
  	* sandbox: make sure the domain launching sandbox has at least 100 categories
  	* sandbox: do not try forever to find available category set
  	* sandbox: only complain if sandbox unable to launch
  	* sandbox: init script run twice is still successful
  	* semanage: print local and dristo equiv rules
  	* semanage: check file equivalence rules for conflict
  	* semanage: Make sure semanage fcontext -l -C prints even if local keys
  	* are not defined
  	* semanage: change src,dst to target,substitute for equivalency
  	* sestatus: Updated sestatus and man pages.
  	* Added SELinux config file man page.
  	* add clean target to man Makefile


author: Dan Walsh <dwalsh@redhat.com> - 2.1.10-1
changelog:
  -Update to upstream
  - sepolgen
  	* better analysis of why things broke
  - policycoreutils
  	* Remove excess whitespace
  	* sandbox: Add back in . functions to sandbox.init script
  	* Fix Makefile to match other policycoreutils Makefiles
  	* semanage: drop unused translation getopt


author: Dan Walsh <dwalsh@redhat.com> - 2.1.10-4
changelog:
  - Fix the handling of namespaces in seunshare/sandbox.
  - Currently mounting of directories within sandbox is propogating to the
  - parent namesspace.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.10-11
changelog:
  - restorecond fixes:
    Stop using depracated g_io interfaces
    Exit with non zero exit code if wrong options given
    Add -h option


author: Dan Walsh <dwalsh@redhat.com> - 2.1.10-17
changelog:
  - Change semanage to produce proper audit records for Common Criteria
  - Cleanup packaging for usrmove


author: Dan Walsh <dwalsh@redhat.com> - 2.1.10-22
changelog:
  - Change to use new selinux_binary_policy_path()
  - Add systemd_passwd_agent_exec($1), and systemd_read_fifo_file_passwd_run($1) to templates for _admin interface


author: Dan Walsh <dwalsh@redhat.com> - 2.1.11-1
changelog:
  - Update to upstream
    - policycoreutils
  	* sandbox: do not propogate inside mounts outside
  	* sandbox: Removing sandbox init script, should no longer be necessary
  	* restorecond: Stop using deprecated interfaces for g_io
  	* semanage: proper auditting of user changes for LSPP
  	* semanage: audit message to show what record(s) and item(s) have chaged
  	* scripts: Update Makefiles to handle /usrmove
  	* mcstrans: Version should have been bumped on last check in
  	* seunshare: Only drop caps not the Bounding Set from seunshare
  	* Add bash-completion scripts for setsebool and semanage
  	* newrole: Use correct capng calls in newrole
  	* Fix infinite loop with inotify on 2.6.31 kernels
  	* fix ftbfs with hardening flags
  	* Only run setfiles if we found read-write filesystems to run it on
  	* update .po files
  	* remove empty po files
  	* do not fail to install if unable to make load_policy lnk file

     - sepolgen
  	* Fix dead links to www.nsa.gov/selinux
  	* audit.py Dont crash if empty data is passed to sepolgen
  	* do not use md5 when calculating hash signatures
  	* fix detection of policy loads


author: Dan Walsh <dwalsh@redhat.com> - 2.1.11-6
changelog:
  - Rebuild to get latest libsepol which fixes the file_name transition problems
  - Update translations
  - Fix calls to close fd for restorecond


author: Dan Walsh <dwalsh@redhat.com> - 2.1.11-12
changelog:
  - Add -N qualifier to semanage, setsebool and semodule to allow you to update
  - policy without reloading it into the kernel.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.11-15
changelog:
  - Allow stream sock_files to be stored in /tmp and etc_rw_t directories by sepolgen
  - Trigger on selinux-policy needs to change to selinux-policy-devel
  - Update translations
  - Fix semanage dontaudit off/on exception


author: Dan Walsh <dwalsh@redhat.com> - 2.1.11-1
changelog:
  - Update to upstream
    - policycoreutils
  	* restorecond: wrong options should exit with non-zero error code
  	* restorecond: Add -h option to get usage command
  	* resorecond: user: fix fd leak
  	* mcstrans: add -f to run in foreground
  	* semanage: fix man page range and level defaults
  	* semanage: bash completion for modules should include -a,-m, -d
  	* semanage: manpage update for -e
  	* semanage: dontaudit off should work
  	* semanage: locallist option does not take an argument
  	* sepolgen: Make use of setools optional within sepolgen
     - sepolgen
  	* Make use of setools optional within sepolgen
  	* We need to support files that have a + in them


author: Dan Walsh <dwalsh@redhat.com> - 2.1.11-4
changelog:
  - Fix restorecon to generate a better percentage of completion on restorecon -R /.
  - Have audit2allow look at the constaint violation and tell the user whether it
  - is because of user,role or level


author: Dan Walsh <dwalsh@redhat.com> - 2.1.11-6
changelog:
  - Change polgen to generate dbus apps as optional so they can compile on minimal policy system, patch from Miroslav Grepl


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-1
changelog:
  - Update to upstream
  	* genhomedircon: manual page improvements
  	* setfiles/restorecon minor improvements
  	* run_init: If open_init_pty is not available then just use exec
  	* newrole: do not drop capabilities when newrole is run as
  	* restorecon: only update type by default
  	* scripts: Don't syslog setfiles changes on a fixfiles restore
  	* setfiles: do not syslog if no changes
  	* Disable user restorecond by default
  	* Make restorecon return 0 when a file has changed context
  	* setfiles: Fix process_glob error handling
  	* semanage: allow enable/disable under -m
  	* add .tx to gitignore
  	* translations: commit translations from Fedora community
  	* po: silence build process
  	* gui: Checking in policy to support polgengui and sepolgen.
  	* gui: polgen: search for systemd subpackage when generating policy
  	* gui: for exploring booleans
  	* gui: system-config-selinux gui
  	* Add Makefiles to support new gui code
  	* gui: remove lockdown wizard
  	* return equivalency records in fcontext customized
  	* semanage: option to not load new policy into kernel after
  	* sandbox: manpage update to describe standard types
  	* setsebool: -N should not reload policy on changes
  	* semodule: Add -N qualifier to no reload kernel policy
  	* gui: polgen: sort selinux types of user controls
  	* gui: polgen: follow symlinks and get the real path to
  	* gui: Fix missing error function
  	* setfiles: return errors when bad paths are given
  	* fixfiles: tell restorecon to ignore missing paths
  	* setsebool: error when setting multiple options
  	* semanage: use boolean subs.
  	* sandbox: Make sure Xephyr never listens on tcp ports
  	* sepolgen: return and output constraint violation information
  	* semanage: skip comments while reading external configuration files
  	* restorecond: relabel all mount runtime files in the restorecond example
  	* genhomedircon: dynamically create genhomedircon
  	* Allow returning of bastard matches
  	* sepolgen: return and output constraint violation information
  	* audit2allow: one role/type pair per line


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-3
changelog:
  - Allow fixfiles to specify -v, so they can get verbosity rather then progress.
  - Fix load_file Makefile to use SBINDIR rather then real OS.
  - Fix man pages in setfiles and restorecon to reflect what happens when you relabel the entire OS.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-7
changelog:
  - Fix manpage generation, missing import
  - Add equiv_dict to get samba booleans into smbd_selinux
  - Add proper translations for booleans and remove selinux.tbl


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-8
changelog:
  - Fix typo in preunstall line for restorecond
  - Add mgrepl patch to consolidate file context generated by sepolicy generate


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-9
changelog:
  - Fix semanage to verify that types are appropriate for commands.
    * Patch initiated by mgrepl
    * Fixes problem of specifying non file_types for fcontext, or not port_types for semanage port


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-10
changelog:
  - Update sepolicy generate with patch to create spec file and man page.
  - Patch initiated by Miroslav Grepl


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-12
changelog:
  - Add missing spec.py from templates directory needed for sepolicy generate
  - Add /var/tmp as collection point for sandbox apps.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-14
changelog:
  - Add role_allow to sepolicy.search python bindings, this allows us to remove last requirement for setools-cmdline in gui tools.
  - Fix man page generator.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-16
changelog:
  - Add Miroslav Grepl patch to generate html man pages
  - Update Translations
  - Add option to sandbox to shred files before deleting


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-19
changelog:
  - Change sepolicy python bindings to have python pick policy file, fixes weird memory problems in sepolicy network


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-24
changelog:
  - Fix manpage to generate proper man pages for alternate policy,
  basically allow me to build RHEL6 man pages on a Fedora 18 box, as long as
  I pull the policy, policy.xml and file_contexts and file_contexts.homedir


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-25
changelog:
  - Remove run_init, no longer needed with systemd.
  - Fix sepolicy generate to not include subdirs in generated fcontext file.  (mgrepl patch)


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-26
changelog:
  - Fix semanage booleans -l, move more boolean_dict handling into sepolicy
  - Update translations
  - Fixup sepolicy generate to discover /var/log, /var/run and /var/lib directories if they match the name
  - Fix kill function call should indicate signal_perms not kill capability
  - Error out cleanly in system-config-selinux, if it can not contact XServer


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-27
changelog:
  - Only report restorecon warning for missing default label, if not running
  recusively
  - Update translations


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-37
changelog:
  - Move sepogen python bindings back into policycoreutils-python out of -devel, since sepolicy is using the


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-41
changelog:
  - Add --path as a parameter to sepolicy generate
  - Print warning message if program does not exists when generating policy, and do not attempt to run nm command
  - Fix sepolicy generate -T to not take an argument, and supress the help message
  - Since this is really just a testing tool


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-44
changelog:
  - Additional fixes for disabled SELinux Box
  - system-config-selinux no longer relies on lokkit for /etc/selinux/config


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-45
changelog:
  - Apply patch from Miroslav to display proper range description in man pages g
  - Should print warning on missing default label when run in recusive mode iff
  - Remove extra -R description, and fix recursive description


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-46
changelog:
  - sepolicy transition was blowing up. Also cleanup output when only source is specified.
  - sepolicy generate should allow policy modules names that include - or _


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-50
changelog:
  - Update translations
  - update sepolicy manpage to generate fcontext equivalence data and to list
  default file context paths.
  - Add ability to generate policy for confined admins and domains like puppet.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-51
changelog:
  - Update translations
  - Fix sepolicy booleans to handle autogenerated booleans descriptions
  - Cleanups of sepolicy manpage
  - Fix crash on git_shell man page generation


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-52
changelog:
  - Update to latest patches from eparis/Upstream
  -    secon: add support for setrans color information in prompt output
  - Update translations


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-53
changelog:
  - Update with Miroslav patch to handle role attributes
  - Update Translations
  - import sepolicy will only throw exception on missing policy iff selinux is enabled


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-55
changelog:
  - Update Translations
  - Fix handling of semanage generate --cgi -n MODULE PATHTO/CGI
  -   This fixes the spec file and script file getting wrong names for modules and types.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-56
changelog:
  -  Additional changes for bash completsion and generate man page to match the w
  -  Add newtype as a new qualifier to sepolicy generate.  This new mechanism wil
  -  a policy write to generate types after the initial policy has been written a
  -  will autogenerate all of the interfaces.
  -  I also added a -w options to allow policy writers from the command line to s
  -  the writable directories of files.
  -
  -  Modify network.py to include interface definitions for newly created port type
  -  Standardize of te_types just like all of the other templates.

  -  Change permissive domains creation to raise exception if sepolgen is not ins
  -  get_te_results no longer needs or uses the opts parameter.
  -  The compliler was complaining so I just removed the option.
  -  Start returning analysis data for audit2allow


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-57
changelog:
  - Update to latest patches from eparis/Upstream
  - fixfiles onboot will write any flags handed to it to /.autorelabel.
  -   * Patch sent to initscripts to have fedora-autorelabel pass flags back to fixfiles restore
  -   * This should allow fixfiles -F onboot, to force a hard relabel.
  - Add -p to show progress on full relabel.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.12-58
changelog:
  - Reorginize sepolicy so all get_all functions are in main module
  - Add -B capability to fixfiles onboot and fixfiles restore, basically searches for all files created since the last boot.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-1
changelog:
  - Update to upstream
  	* setfiles: estimate percent progress
  	* load_policy: make link at the destination directory
  	* Rebuild polgen.glade with glade-3
  	* sepolicy: new command to unite small utilities
  	* sepolicy: Update Makefiles and po files
  	* sandbox: use sepolicy to look for sandbox_t
  	* gui: switch to use sepolicy
  	* gui: sepolgen: use sepolicy to generate
  	* semanage: use sepolicy for boolean dictionary
  	* add po file configuration information
  	* po: stop running update-po on all
  	* semanage: seobject verify policy types before allowing you to assign them.
  	* gui: Start using Popen, instead of os.spawnl
  	* sandbox: Copy /var/tmp to /tmp as they are the same inside
  	* qualifier to shred content
  	* semanage: Fix handling of boolean_sub names when using the -F flag
  	* semanage: man: roles instead of role
  	* gui: system-config-selinux: Catch no DISPLAY= error
  	* setfiles: print error if no default label found
  	* semanage: list logins file entries in semanage login -l
  	* semanage: good error message is sepolgen python module missing
  	* gui: system-config-selinux: do not use lokkit
  	* secon: add support for setrans color information in prompt output
  	* restorecond: remove /etc/mtab from default list
  	* gui: If you are not able to read enforcemode set it to False
  	* genhomedircon: regenerate genhomedircon more often
  	* restorecond: Add /etc/udpatedb.conf to restorecond.conf
  	* genhomedircon generation to allow spec file to pass in SEMODULE_PATH
  	* fixfiles: relabel only after specific date
  	* po: update translations
  	* sandbox: seunshare: do not reassign realloc value
  	* seunshare: do checking on setfsuid
  	* sestatus: rewrite to shut up coverity


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-4
changelog:
  - Revert some changes which are causing the wrong policy version file to be created
  - Switch sandbox to start using openbox rather then matchbox
  - Make sepolgen a symlink to sepolicy
  - update translations


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-6
changelog:
  - Fix newrole to retain cap_audit_write when compiled with namespace, also
  do not drop capabilities when run as root.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-7
changelog:
  - Add --root/-r flag to sepolicy manpage,
  - This allows us to generate man pages on the fly in the selinux-policy build


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-8
changelog:
  - Sepolixy should not throw an exception on an SELinux disabled machine
  - Switch from using console app to using pkexec, so we will work better
  with policykit.
  - Add missing import to fix system-config-selinux startup
  - Add comment to pamd files about pam_rootok.so
  - Fix sepolicy generate to not comment out the first line


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-10
changelog:
  - Fix sepolicy to be able to work on an SELinux disabled system.
  - Needed to be able to build man pages in selinux-policy package


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-12
changelog:
  - Do not load interface file by default when sepolicy is called, mov get_all_methods to the sepolicy package


author: Rahul Sundaram <sundaram@fedoraproject.org> - 2.1.14-13
changelog:
  - remove vendor tag from desktop file. https://fedorahosted.org/fpc/ticket/247
  - clean up spec to follow current guidelines


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-14
changelog:
  - Allow users with symlinked homedirs to work. call realpath on homedir
  - Fix sepolicy reorganization of helper functions.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-20
changelog:
  - Mention creation of permissive domains in sepolicy generate man page
  - Change sepolicy manpage to use shortname with an "_" to stop accidently grabbing unrelated types for a domain.
  - Fix audit2allow to show better information on constraint violations.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-21
changelog:
  - sepolicy generate should look for booleans that effect equivalence names, and add them to the man page


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-22
changelog:
  - Fix newrole to not drop capabilities from the bounding set.
  - Stop dropping capabilities from its children.
  - Add better error messages.
  - Change location of bash_completion files to /usr/share/bash-completion/compl


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-23
changelog:
  - sepolicy manpage:
  -   use nroff instead of man2html
  -   Remove checking for name of person who created the man page
  - audit2allow
  -   Fix output to show the level that is different.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-26
changelog:
  - Can not unshare IPC in sandbox, since it blows up Xephyr
  - Remove bogus error message sandbox about reseting setfsuid


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-28
changelog:
  - Fix audit2allow output to better align analysys with the allow rules
  - Apply Miroslav Grepl patch to clean up sepolicy generate usage
  - Apply Miroslav Grepl patch to fixupt handing of admin_user generation
  - Update Tranlslations


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-30
changelog:
  - Add buildrequires for OpenBox to prevent me from accidently building into RHEL7
  - Add support for returning alias data to sepolicy.info python bindings


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-31
changelog:
  - Add post install scripts for gui to make sure Icon Cache is refreshed.
  - Fix grammar issue in secon man page
  - Update Translations


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-32
changelog:
  - Move sepolicy to policycoreutils-devel pacage, since most of it is used for devel
  - Apply Miroslav Grepl Patches for sepolicy
  -- Fix generate mutually groups option handling
  -- EUSER is used for existing policy
  -- customize options can be used together with admin_domain option
  -- Fix manpage.py to generate correct man pages for SELinux users
  -- Fix policy *.te file generated by customize+writepaths options
  -- Fix install script for confined_admin option


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-34
changelog:
  - Update translations
  - Add patch inspired by Miroslav Grepl to add extended information for sepolicy interface command.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-35
changelog:
  - Update translations
  - Add patch by Miroslav Grepl to add compile test for sepolicy interface command.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-37
changelog:
  - Fix exceptionion hanling in audit2allow -o
  - Generate Man pages for everydomain, not just ones with exec_t entrypoints
  - sepolicy comunicate should return ValueError not TypeError
  - Trim header line in sepolicy manpage to use less space
  - Add missing options to restorecon man page


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-38
changelog:
  - No longer run sepolgen-ifgen at install time.
  - Run sepolgen-ifgen in audit2allow and sepolicy generate, if needed.
  - Update Translations


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-39
changelog:
  - Run sepolgen-ifgen in audit2allow and sepolicy generate, if needed, first time
  - Add  Sven Vermeulen  patches to cleanup man pages


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-40
changelog:
  - Only require selinux-policy-devel for policycoreutils-devel, this will shrink the size of the livecd.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-42
changelog:
  - Add support for Xephyr -resizable, so sandbox can now resize window
  - Add support for compressed policy.xml
  - Miroslav Grepl patch to allow sepolicy interface on individual interface fil
  - Also add capability to test interfaces for correctness.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-44
changelog:
  - Fix sepolicy-generate man page to clear up options/policy type
  - Add Miroslav Grepl to not generate man page when doing
    sepolicy generate --customize
  - Add support for executing semanage user within spec file
  - Fix generation of confined admin domains, to handle booleans properly.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-46
changelog:
  - Fix the name of the spec file generated in the build script
  - Add mgrepl patch to support argparse for semanage command parsing


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-48
changelog:
  - Fix audit2allow -o to open file for append
  - Fix the name of the spec file generated in the build script


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-50
changelog:
  - Fix sepolicy generate --confined_admin to generate tunables
  - Add new interface to generate entrypoints for use with new gui


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-56
changelog:
  - Fix semanage export/import commands
  - Fix semange module command
  - Remove --version option from sandbox


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-57
changelog:
  - Remove requires for systemd-sysv
  - Move systemd-units require to restorecond section
  - Update Tranlasions
  - More sepolicy interfaces for gui
  - Cleanup man pages for sepolicy generate


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-63
changelog:
  - Update sepolicy gui.
  - Error out of you call sepolicy gui without policycoreutils-gui package installed
  - Fix semanage login -d command
  - Update Translations


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-65
changelog:
  - Do not generate shell script or spec file for sepolicy generate --newtype
  - Update translations
  - Fix sepolicy generate --admin_user man page again
  - Fix setsebool to print less verbose error messages by default, add -V for ve


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-68
changelog:
  - Fix bugs introduced by previous patch.  semanage port
  - Update Translations
  - Add test suite for sepolicy command lines


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-75
changelog:
  - Update sepolicy gui code, cleanups and add file transition tab
  - Fix semanage fcontext -a --ftype code to work.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-79
changelog:
  - Add Miroslav Grepl setsebool patch to give better error message on bad boolean names
  - Additional help screens for sepolicy gui


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-80
changelog:
  - Random fixes for sepolicy gui
    * Do not prompt for password until you make a change
    * Add user mappings and selinux users page
    * lots of code cleanup

  - Verify homedir is owned by user before mounting over it with seunshare
  - Fix fixfiles to handle Relabel properly
  - Fix semanage fcontext -e / command to allow "/"


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-82
changelog:
  - Improvements to sepolicy gui
    - Add more help information
    - Cleanup code
    - Add deny_ptrace on lockdown screen
    - Make unconfined/permissivedomains lockdown work
    - Add more support for file equivalency


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-85
changelog:
  - Fixes for fixfiles
    * exclude_from_dirs should apply to all types of restorecon calls
    * fixfiles check now works
    * exit with the correct status

  - semanage no longer import selinux


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-86
changelog:
  - sepolicy gui
    - mgrepl added delete screens for users and login
    - Fix lots of bugs.
  - Update Translations.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-88
changelog:
  - Cleanup errors found by pychecker
  - Apply patch from Michal Trunecka to allow restorecon to handle {} in globs
  Resolves: #1018913


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-89
changelog:
  - Update to latest sepolicy tool chain.
  - Document semodule -P
  - Verify input to semanage permissive -a is a valid domain.
  - Assigning login user with semanage login, range should default to user record


author: Dan Walsh <dwalsh@redhat.com> - 2.2-1
changelog:
  - Update to upstream 
  	* Properly build the swig exception file from Laurent Bigonville.
  	* Fix man pages from Laurent Bigonville.
  	* Support overriding PATH and INITDIR in Makefile from Laurent Bigonville.
  	* Fix LDFLAGS usage from Laurent Bigonville.
  	* Fix init_policy warning from Laurent Bigonville.
  	* Fix semanage logging from Laurent Bigonville.
  	* Open newrole stdin as read/write from Sven Vermeulen.
  	* Fix sepolicy transition from Sven Vermeulen.
  	* Support overriding CFLAGS from Simon Ruderich.
  	* Create correct man directory for run_init from Russell Coker.
  	* restorecon GLOB_BRACE change from Michal Trunecka.
  	* Extend audit2why to report additional constraint information.
  	* Catch IOError errors within audit2allow from Dan Walsh.
  	* semanage export/import fixes from Dan Walsh.
  	* Improve setfiles progress reporting from Dan Walsh.
  	* Document setfiles -o option in usage from Dan Walsh.
  	* Change setfiles to always return -1 on failure from Dan Walsh.
  	* Improve setsebool error r eporting from Dan Walsh.
  	* Major overhaul of gui from Dan Walsh.
  	* Fix sepolicy handling of non-MLS policy from Dan Walsh.
  	* Support returning type aliases from Dan Walsh.
  	* Add sepolicy tests from Dan Walsh.
  	* Add org.selinux.config.policy from Dan Walsh.
  	* Improve range and user input checking by semanage from Dan Walsh.
  	* Prevent source or target arguments that end with / for substitutions from Dan Walsh.
  	* Allow use of <<none>> for semanage fcontext from Dan Walsh.
          * Report customized user levels from Dan Walsh.
  	* Support deleteall for restoring disabled modules from Dan Walsh.
  	* Improve semanage error reporting from Dan Walsh.
  	* Only list disabled modules for module locallist from Dan Walsh.
  	* Fix logging from Dan Walsh.
  	* Define new constants for file type character codes from Dan Walsh.
  	* Improve bash completions from Dan Walsh.
  	* Convert semanage to argparse from Dan Walsh (originally by Dave Quigley).
  	* Add semanage tests from Dan Walsh.
  	* Split semanage man pages from Dan Walsh.
  	* Move bash completion scripts from Dan Walsh.
  	* Replace genhomedircon script with a link to semodule from Dan Walsh.
  	* Fix fixfiles from Dan Walsh.
  	* Add support for systemd service for restorecon from Dan Walsh.
  	* Spelling corrections from Dan Walsh.
  	* Improve sandbox support for home dir symlinks and file caps from Dan Walsh.
  	* Switch sandbox to openbox window manager from Dan Walsh.
  	* Coalesce audit2why and audit2allow from Dan Walsh.
  	* Change audit2allow to append to output file from Dan Walsh.
  	* Update translations from Dan Walsh.
  	* Change audit2why to use selinux_current_policy_path from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> - 2.2-2
changelog:
  - Shift around some of the files to more appropriate packages.
          * semodule_* packages are required for devel.


author: Dan Walsh <dwalsh@redhat.com> - 2.2.2-1
changelog:
  Resolves: #1002529
  Resolves: #924105
  Resolves: #918140
  Resolves: #1028096

  - Speed up startup time of sepolicy gui
  - Clean up ports screen to only show enabled ports.
  - Update to upstream 
  	* Remove import policycoreutils.default_encoding_utf8 from semanage from Dan Walsh.
  	* Make yum/extract_rpms optional for sepolicy generate from Dan Walsh.
  	* Add test suite for audit2allow and sepolgen-ifgen from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> - 2.2.3-1
changelog:
  - Update to upstream 
  	* Apply polkit check on all dbus interfaces and restrict to active user from Dan Walsh.
  	* Fix typo in sepolicy gui dbus.relabel_on_boot call from Dan Walsh.
  - Apply Miroslav Grepl patch to fix TEMPLATETYPE_domtrans description in sepolicy generate


author: Dan Walsh <dwalsh@redhat.com> - 2.2.4-1
changelog:
  - Update to upstream 
  	* Revert automatic setting of serange and seuser in seobject; was breaking non-MLS systems.
  - Add patches for sepolicy gui from mgrepl to
    Fix advanced_item_button_push() to allow to select an application in advanced search menu
    Fix previously_modified_initialize() to show modified changes properly for all selections


author: Dan Walsh <dwalsh@redhat.com> - 2.2.4-5
changelog:
  - Fix semanage man page description of import command
  - Fix policy kit file to allow changing to permissive mode


author: Dan Walsh <dwalsh@redhat.com> - 2.2.4-6
changelog:
  - Fix sepolicy gui selection for advanced screen
  - Update Translations
  - Move requires checkpolicy requirement into policycoreutils-python
  Resolves: #1043489


author: Dan Walsh <dwalsh@redhat.com> - 2.2.5-1
changelog:
  - Fix Mass Rebuild problems
  - Update to upstream 
  	* Ignore selevel/serange if MLS is disabled from Sven Vermeulen.
  Resolves: #1043489


author: Dan Walsh <dwalsh@redhat.com> - 2.2.5-3
changelog:
  - Add Miroslav patch to
  - Fix previously_modified_initialize() to show modified changes properly for all selections
  Resolves: #1049977


author: Miroslav Grepl <mgrepl@redhat.com> - 2.2.5-5
changelog:
  - Remove default s0 range from semanage-login command. It is handled in seobject.py.
  Resolves:#1028106


author: Miroslav Grepl <mgrepl@redhat.com> - 2.2.5-11.el7_0.1
changelog:
  - Make selinux-policy build working also on another architectures related to sepolicy-manpage generate
  Resolves:#1135434


author: Radek Novacek <rnovacek@redhat.com> 0.96.1-2
changelog:
  - Fixed deprecation warning with polkit-0.98
  - Fixed typo in url
  - Null checking patch (might be fix for #637064)


author: Rex Dieter <rdieter@fedoraproject.org> 0.99.0-3
changelog:
  - upstream crash patch (kde#258916,#684625)
  - pull a couple more upstream patches
  - -devel: drop Req: polkit-devel


author: Trond Eivind Glomsrød <teg@redhat.com>
changelog:
  - Change to "License: GPL or artistic" from "Copyright: distributable"
  - Fix man page (#35825)
  - 3.15.1
  - redo config patch


author: Trond Eivind Glomsrød <teg@redhat.com> 3.22-4
changelog:
  - Add Telsa Gwynne's procmailrc as a doc file - it's
    excellently commented, and is a great example


author: Peter Vrabec <pvrabec@redhat.com> 3.22-17
changelog:
  - fix truncation of mailbox when running into a disk quota or a
    full partition. Patch from Solar Designer.


author: Miroslav Lichvar <mlichvar@redhat.com> 3.22-18
changelog:
  - add IPv6 support to comsat notification (#198403)
  - package man page for mailstat
  - change mail spool directory to /var/spool/mail


author: Miroslav Lichvar <mlichvar@redhat.com> 3.22-24
changelog:
  - rename getline to avoid conflict with glibc (#505977)
  - add -Wno-comments to CFLAGS
  - remove package name from summary


author: David Woodhouse <dwmw2@infradead.org> 0.7.0-2
changelog:
  - Proper fix for GCC 4 putting 'blr' or 'ret' in the middle of the function,
    for i386, x86_64 and PPC.


author: David Woodhouse <dwmw2@infradead.org> 0.8.0-3
changelog:
  - Use -mcpu= instead of -mtune= on x86_64 too
  - Disable SPARC targets on x86_64, because dyngen doesn't like fnegs


author: Matthias Saou <http://freshrpms.net/> 0.8.2-1
changelog:
  - Update to 0.8.2 (#200065).
  - Drop upstreamed syscall-macros patch2.
  - Put correct scriplet dependencies.
  - Force install mode for the init script to avoid umask problems.
  - Add %postun condrestart for changes to the init script to be applied if any.
  - Update description with the latest "about" from the web page (more current).
  - Update URL to qemu.org one like the Source.
  - Add which build requirement.
  - Don't include texi files in %doc since we ship them in html.
  - Switch to using gcc34 on devel, FC5 still has gcc32.
  - Add kernheaders patch to fix linux/compiler.h inclusion.
  - Add target-sparc patch to fix compiling on ppc (some int32 to float).


author: Matthias Saou <http://freshrpms.net/> 0.8.2-2
changelog:
  - Remove the target-list iteration for x86_64 since they all build again.
  - Make gcc32 vs. gcc34 conditional on %{fedora} to share the same spec for
    FC5 and FC6.


author: Hans de Goede <j.w.r.degoede@hhs.nl> 0.9.0-2
changelog:
  - Fix direct loading of a linux kernel with -kernel & -initrd (bz 234681)
  - Remove spurious execute bits from manpages (bz 222573)


author: Daniel P. Berrange <berrange@redhat.com> - 0.9.0-3.fc8
changelog:
  - Added backport of VNC password auth, and TLS+x509 cert auth
  - Switch to rtl8139 NIC by default for linkstate reporting
  - Fix rtl8139 mmio region mappings with multiple NICs


author: Glauber Costa <glommer@redhat.com> - 1.0-0.1.svn6666
changelog:
  - Updated to tip svn (release 6666). Featuring split packages for qemu.
    Unfortunately, still using binary blobs for the bioses.


author: Glauber Costa <glommer@redhat.com> - 0.10-0.1.kvm20090303git
changelog:
  - Set Epoch to 1
  - Build KVM (basic build, no tools yet)
  - Set ppc in ExcludeArch. This is temporary, just to fix one issue at a time.
    ppc users (IBM ? ;-)) please wait a little bit.


author: Glauber Costa <glommer@redhat.com> - 0.92-0.1.kvm20090303git
changelog:
  - Set Epoch to 2
  - Set version to 0.92. It seems upstream keep changing minds here, so pick the lowest
  - Provides KVM, Obsoletes KVM
  - Only install qemu-kvm in ix86 and x86_64
  - Remove pkgdesc macros, as they were generating bogus output for rpm -qi.
  - fix ppc and ppc64 builds


author: Glauber Costa <glommer@redhat.com> - 2:0.10-0.5.kvm20090303git
changelog:
  - kvm.modules were being wrongly mentioned at %install.
  - update description for the x86 system package to include kvm support
  - build kvm's own bios. It is still necessary while kvm uses a slightly different
    irq routing mechanism


author: Glauber Costa <glommer@redhat.com> - 2:0.10-0.8.kvm20090310git
changelog:
  - fix Obsolete/Provides pair
  - Use kvm bios from bochs-bios package.
  - Using RPM_OPT_FLAGS in configure
  - Picked back audio-drv-list from kvm package


author: Glauber Costa <glommer@redhat.com> - 2:0.10-0.11.kvm20090323git
changelog:
  - Update to snapshot kvm20090323.
  - Removed patch2 (upstream).
  - use upstream's new split package.
  - --with-patched-kernel flag not needed anymore
  - Tell how to get the sources.


author: Glauber Costa <glommer@redhat.com> - 2:0.10-1
changelog:
  - Include debuginfo for qemu-img
  - Do not require qemu-common for qemu-img
  - Explicitly own each of the firmware files
  - remove firmwares for ppc and sparc. They should be provided by an external package.
    Not that the packages exists for sparc in the secondary arch repo as noarch, but they
    don't automatically get into main repos. Unfortunately it's the best we can do right
    now.
  - rollback a bit in time. Snapshot from avi's maint/2.6.30
    - this requires the sasl patches to come back.
    - with-patched-kernel comes back.


author: Mark McLoughlin <markmc@redhat.com> - 2:0.10-5
changelog:
  - Fix vga segfault under kvm-autotest (#494002)
  - Kill kernelrelease hack; it's not needed
  - Build with "make V=1" for more verbose logs


author: Mark McLoughlin <markmc@redhat.com> - 2:0.10.50-1.kvm85
changelog:
  - Update to qemu-kvm-devel-85
  - kvm-85 is based on qemu development branch, currently version 0.10.50
  - Include new qemu-io utility in qemu-img package
  - Re-instate -help string for boot=on to fix virtio booting with libvirt
  - Drop upstreamed patches
  - Fix missing kernel/include/asm symlink in upstream tarball
  - Fix target-arm build
  - Fix build on ppc
  - Disable preadv()/pwritev() until bug #497429 is fixed
  - Kill more .kernelrelease uselessness
  - Make non-kvm qemu build verbose


author: Mark McLoughlin <markmc@redhat.com> - 2:0.10.50-5.kvm86
changelog:
  - Prevent locked cdrom eject - fixes hang at end of anaconda installs (#501412)
  - Avoid harmless 'unhandled wrmsr' warnings (#499712)


author: Mark McLoughlin <markmc@redhat.com> - 2:0.10.50-6.kvm86
changelog:
  - Fix 'kernel requires an x86-64 CPU' error
  - BuildRequires ncurses-devel to enable '-curses' option (#504226)


author: Mark McLoughlin <markmc@redhat.com> - 2:0.10.50-7.kvm87
changelog:
  - Update to kvm-87
  - Drop upstreamed patches
  - Cherry-pick new ppc build fix from upstream
  - Work around broken linux-user build on ppc
  - Fix hw/pcspk.c build with --disable-kvm
  - Re-enable preadv()/pwritev() since #497429 is long since fixed
  - Kill petalogix-s3adsp1800.dtb, since we don't ship the microblaze target


author: Daniel Berrange <berrange@lettuce.camlab.fab.redhat.com> - 2:0.10.50-10.kvm87
changelog:
  - Add udev rules to make /dev/kvm world accessible & group=kvm (rhbz #497341)
  - Create a kvm group if it doesn't exist (rhbz #346151)


author: Mark McLoughlin <markmc@redhat.com> - 2:0.10.50-11.kvm88
changelog:
  - Update to kvm-88, see http://www.linux-kvm.org/page/ChangeLog
  - Package mutiboot.bin
  - Update for how extboot is built
  - Fix sf.net source URL
  - Drop qemu-fix-ppc-softmmu-kvm-disabled-build.patch
  - Drop qemu-fix-pcspk-build-with-kvm-disabled.patch
  - Cherry-pick fix for esound support build failure


author: Mark McLoughlin <markmc@redhat.com> - 2:0.10.91-0.1.rc1.rc0
changelog:
  - Update to qemu-kvm-0.11.0-rc1-rc0
  - This is a pre-release of the official -rc1
  - A vista installer regression is blocking the official -rc1 release
  - Drop qemu-prefer-sysfs-for-usb-host-devices.patch
  - Drop qemu-fix-build-for-esd-audio.patch
  - Drop qemu-slirp-Fix-guestfwd-for-incoming-data.patch
  - Add patch to ensure extboot.bin is installed


author: Mark McLoughlin <markmc@redhat.com> - 2:0.10.92-1
changelog:
  - Update to qemu-kvm-0.11.0-rc2
  - Drop upstreamed patches
  - extboot install now fixed upstream
  - Re-place TCG init fix (#516543) with the one gone upstream


author: Mark McLoughlin <markmc@redhat.com> - 2:0.11.0-4
changelog:
  - Use rtl8029 PXE rom for ne2k_pci, not ne (#526777)
  - Also, replace the gpxe-roms-qemu pkg requires with file-based requires


author: Mark McLoughlin <markmc@redhat.com> - 2:0.11.0-6
changelog:
  - Fix fs errors with virtio and qcow2 backing file (#524734)
  - Fix ksm initscript errors on kernel missing ksm (#527653)
  - Add missing Requires(post): getent, useradd, groupadd (#527087)


author: Mark McLoughlin <markmc@redhat.com> - 2:0.11.0-12
changelog:
  - Fix a use-after-free crasher in the slirp code (#539583)
  - Fix overflow in the parallels image format support (#533573)


author: Justin M. Forbes <jforbes@redhat.com> - 2:0.12.2-5
changelog:
  - Avoid creating too large iovecs in multiwrite merge (#559717)
  - Don't try to set max_kernel_pages during ksm init on newer kernels (#558281)
  - Add logfile options for ksmtuned debug.


author: Justin M. Forbes <jforbes@redhat.com> - 2:0.12.3-1
changelog:
  - Update to 0.12.3 upstream
  - vhost-net migration/restart fixes
  - Add F-13 machine type
  - virtio-serial fixes


author: Justin M. Forbes <jforbes@redhat.com> - 2:0.12.3-6
changelog:
  - Change requires to the noarch seabios-bin
  - Add ownership of docdir to qemu-common (#572110)
  - Fix "Cannot boot from non-existent NIC" error when using virt-install (#577851)


author: Dan Horák <dan[at]danny.cz> - 2:0.12.3-8
changelog:
  - Add avoid-llseek patch from upstream needed for building on s390(x)
  - Don't use parallel make on s390(x)


author: Justin M. Forbes <jforbes@redhat.com> - 2:0.13.0-0.3.20100809git25fdf4a
changelog:
  - Updates from upstream towards 0.13 stable
  - Fix requires on gpxe
  - enable spice now that buildreqs are in the repository.
  - ksmtrace has moved to a separate upstream package


author: Justin M. Forbes <jforbes@redhat.com> - 2:0.13.0-1
changelog:
  - Update to 0.13.0 upstream release
  - Fixes for vhost
  - Fix mouse in certain guests (#636887)
  - Fix issues with WinXP guest install (#579348)
  - Resolve build issues with S390 (#639471)
  - Fix Windows XP on Raw Devices (#631591)


author: Daniel P. Berrange <berrange@redhat.com> - 2:0.13.0-2
changelog:
  - Revert previous change
  - Make qemu-common own the /etc/qemu directory
  - Add /etc/qemu/target-x86_64.conf to qemu-system-x86 regardless
    of host architecture.


author: Justin M. Forbes <jforbes@redhat.com> - 2:0.14.0-0.1.20110210git7aa8c46
changelog:
  - Update git snapshot
  - Temporarily disable qemu-cris and qemu-sparc due to build errors (to be resolved shorly)


author: Richard W.M. Jones <rjones@redhat.com> - 2:0.14.0-9
changelog:
  - Add BR libattr-devel.  This caused the -fstype option to be disabled.
    https://www.redhat.com/archives/libvir-list/2011-June/thread.html#01017


author: Hans de Goede <hdegoede@redhat.com> - 2:0.15.0-0.2.20110718525e3df
changelog:
  - Add support usb redirection over the network, see:
    http://fedoraproject.org/wiki/Features/UsbNetworkRedirection
  - Restore chardev flow control patches


author: Richard W.M. Jones <rjones@redhat.com> - 2:0.15.0-2
changelog:
  - Add upstream qemu patch 'Allow to leave type on default in -machine'
    (2645c6dcaf6ea2a51a3b6dfa407dd203004e4d11).


author: Daniel P. Berrange <berrange@redhat.com> - 2:0.15.0-4
changelog:
  - Enable DTrace tracing backend for SystemTAP (rhbz #737763)
  - Enable build with curl (rhbz #737006)


author: Justin M. Forbes <jforbes@redhat.com> - 2:0.15.1-1
changelog:
  - Require seabios-bin >= 0.6.0-2 (#741992)
  - Replace init scripts with systemd units (#741920)
  - Update to 0.15.1 stable upstream


author: Richard W.M. Jones <rjones@redhat.com> - 2:1.1.0-4
changelog:
  - Disable tests since they hang intermittently.
  - Add kvmvapic.bin (replaces vapic.bin).
  - Add cpus-x86_64.conf.  qemu now creates /etc/qemu/target-x86_64.conf
    as an empty file.
  - Add qemu-icon.bmp.
  - Add qemu-bridge-helper.
  - Build and include virtfs-proxy-helper + man page (thanks Hans de Goede).


author: Richard W.M. Jones <rjones@redhat.com> - 2:1.1.0-7
changelog:
  - Add patch to fix default machine options.  This fixes libvirt
    detection of qemu.
  - Back out patch 1 which conflicts.


author: Cole Robinson <crobinso@redhat.com> - 1.1.1-1
changelog:
  - Upstream stable release 1.1.1
  - Fix systemtap tapsets (bz 831763)
  - Fix VNC audio tunnelling (bz 840653)
  - Don't renable ksm on update (bz 815156)
  - Bump usbredir dep (bz 812097)
  - Fix RPM install error on non-virt machines (bz 660629)
  - Obsolete openbios to fix upgrade dependency issues (bz 694802)


author: Adam Jackson <ajax@redhat.com> 1.2.0-0.5.rc1
changelog:
  - Flip Requires: ceph >= foo to Conflicts: ceph < foo, so we pull in only the
    libraries which we need and not the rest of ceph which we don't.


author: Hans de Goede <hdegoede@redhat.com> - 2:1.2.0-1
changelog:
  - New upstream release 1.2.0 final
  - Add support for Spice seamless migration
  - Add support for Spice dynamic monitors
  - Add support for usb-redir live migration


author: Richard W.M. Jones <rjones@redhat.com> - 2:1.2.0-8
changelog:
  - Use 'global' instead of 'define', and underscore in definition name,
    n-v-r, and 'dist' tag of SLOF, all to fix RHBZ#855252.


author: Hans de Goede <hdegoede@redhat.com> - 2:1.2.0-11
changelog:
  - Rebuild against latest spice-server and spice-protocol
  - Fix non-seamless migration failing with vms with usb-redir devices,
    to allow boxes to load such vms from disk


author: Paolo Bonzini <pbonzini@redhat.com> - 2:1.2.0-13
changelog:
  - Add ppc support to kvm.modules (original patch by David Gibson)
  - Replace x86only build with kvmonly build: add separate defines and
    conditionals for all packages, so that they can be chosen and
    renamed in kvmonly builds and so that qemu has the appropriate requires
  - Automatically pick libfdt dependancy
  - Add knob to disable spice+seccomp


author: Paolo Bonzini <pbonzini@redhat.com> - 2:1.2.0-16
changelog:
  - add s390x KVM support
  - distribute pre-built firmware or device trees for Alpha, Microblaze, S390
  - add missing system targets
  - add missing linux-user targets
  - fix previous commit


author: Cole Robinson <crobinso@redhat.com> - 2:1.2.0-18
changelog:
  - Fix loading arm initrd if kernel is very large (bz #862766)
  - Don't use reserved word 'function' in systemtap files (bz #870972)
  - Drop assertion that was triggering when pausing guests w/ qxl (bz


author: Hans de Goede <hdegoede@redhat.com> - 2:1.2.0-19
changelog:
  - Sync spice patches with upstream, minor bugfixes and set the qxl pci
    device revision to 4 by default, so that guests know they can use
    the new features


author: Cole Robinson <crobinso@redhat.com> - 2:1.3.0-1
changelog:
  - Switch base tarball from qemu-kvm to qemu
  - qemu 1.3 release
  - Option to use linux VFIO driver to assign PCI devices
  - Many USB3 improvements
  - New paravirtualized hardware random number generator device.
  - Support for Glusterfs volumes with "gluster://" -drive URI
  - Block job commands for live block commit and storage migration


author: Michal Novotny <minovotn@redhat.com> - 2:1.3.0-3
changelog:
  - Remove dependency on bogus qemu-kvm-kvm package [bz#870343]
  - Resolves: bz#870343
    (qemu-kvm-1.2.0-16.el7 cant be installed)


author: Michal Novotny <minovotn@redhat.com> - 2:1.3.0-5
changelog:
  - Fix patch contents for usb-redir (bz#895491)
  - Resolves: bz#895491
    (PATCH: 0110-usb-redir-Add-flow-control-support.patch has been mangled on rebase !!)


author: Alon Levy <alevy@redhat.com> - 3:1.3.0-6
changelog:
  - Bump epoch back to 3 since there has already been a 3 package release:
    3:1.2.0-20.el7 https://brewweb.devel.redhat.com/buildinfo?buildID=244866
  - Mark explicit libcacard dependency on new enough qemu-img to avoid conflict
    since /usr/bin/vscclient was moved from qemu-img to libcacard subpackage.


author: Michal Novotny <minovotn@redhat.com> - 3:1.3.0-8
changelog:
  - Missing package qemu-system-x86 in hardware certification kvm testing (bz#912433)
  - Resolves: bz#912433
    (Missing package qemu-system-x86 in hardware certification kvm testing)


author: Miroslav Rezanina <mrezanin@redhat.com> - 3:1.4.0-4
changelog:
  - Enable build of libcacard subpackage for non-x86_64 archs (bz #873174)
  - Enable build of qemu-img subpackage for non-x86_64 archs (bz #873174)
  - Enable build of qemu-guest-agent subpackage for non-x86_64 archs (bz #873174)


author: Miroslav Rezanina <mrezanin@redhat.com> - 3:1.5.0-2
changelog:
  - Enable werror (bz #948290)
  - Enable nbd driver (bz #875871)
  - Fix udev rules file location (bz #958860)
  - Remove +x bit from systemd unit files (bz #965000)
  - Drop unneeded kvm.modules on x86 (bz #963642)
  - Fix build flags
  - Enable libusb


author: Miroslav Rezanina <mrezanin@redhat.com> - 10:1.5.1-2
changelog:
  - Fix package package version info (bz #952996)
  - pc: Replace upstream machine types by RHEL-7 types (bz #977864)
  - target-i386: Update model values on Conroe/Penryn/Nehalem CPU model (bz #861210)
  - target-i386: Set level=4 on Conroe/Penryn/Nehalem (bz #861210)


author: Miroslav Rezanina <mrezanin@redhat.com> - 10:1.5.2-2
changelog:
  - SPEC file prepared for RHEL/RHEV split (rhbz #987165)
  - RHEL guest( sata disk ) can not boot up (rhbz #981723)
  - Kill the "use flash device for BIOS unless KVM" misfeature (rhbz #963280)
  - Provide RHEL-6 machine types (rhbz #983991)
  - Change s3/s4 default to "disable". (rhbz #980840)  
  - Support Virtual Memory Disk Format in qemu (rhbz #836675)
  - Glusterfs backend for QEMU (rhbz #805139)


author: Miroslav Rezanina <mrezanin@redhat.com> - 10:1.5.2-3
changelog:
  - query mem info from monitor would cause qemu-kvm hang [RHEL-7] (rhbz #970047)
  - Throttle-down guest to help with live migration convergence (backport to RHEL7.0) (rhbz #985958)
  - disable (for now) EFI-enabled roms (rhbz #962563)
  - qemu-kvm "vPMU passthrough" mode breaks migration, shouldn't be enabled by default (rhbz #853101)
  - Remove pending watches after virtserialport unplug (rhbz #992900)
  - Containment of error when an SR-IOV device encounters an error... (rhbz #984604)


author: Miroslav Rezanina <mrezanin@redhat.com> - 10:1.5.2-4
changelog:
  - qemu: guest agent creates files with insecure permissions in deamon mode [rhel-7.0] (rhbz 974444)
  - update qemu-ga config & init script in RHEL7 wrt. fsfreeze hook (rhbz 969942)
  - RHEL7 does not have equivalent functionality for __com.redhat_qxl_screendump (rhbz 903910)
  - SEP flag behavior for CPU models of RHEL6 machine types should be compatible (rhbz 960216)
  - crash command can not read the dump-guest-memory file when paging=false [RHEL-7] (rhbz 981582)
  - RHEL 7 qemu-kvm fails to build on F19 host due to libusb deprecated API (rhbz 996469)
  - Live migration support in virtio-blk-data-plane (rhbz 995030)
  - qemu-img resize can execute successfully even input invalid syntax (rhbz 992935)


