# changelog

author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-7
changelog:
  - conf: Resolve corner case on fc_host deletion (rhbz#1420740)
  - pci: fix link maximum speed detection (rhbz#1455017)
  - qemu: Use correct variable in qemuDomainSetBlockIoTune (rhbz#1455510)
  - virsh: Track when create pkttyagent (rhbz#1374126)
  - conf: add eim attribute to <iommu><driver> (rhbz#1451282, rhbz#1289153)
  - qemu: format eim on intel-iommu command line (rhbz#1451282, rhbz#1289153)
  - rpc: Double buffer size instead of quadrupling buffer size. (rhbz#1440683)
  - rpc: Allow up to 256K records to be returned per domain from virConnectGetAllDomainStats. (rhbz#1440683)
  - nodedev: Increase the netlink socket buffer size to the one used by udev (rhbz#1450960, rhbz#1442307)
  - util: hostcpu: Correctly report total number of vcpus in virHostCPUGetMap (rhbz#1456793)
  - qemu: Report shutdown event details (rhbz#1384007)
  - qemu: json: Fix daemon crash on handling domain shutdown event (rhbz#1384007)


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-8
changelog:
  - qemu: mkdir memory_backing_dir on startup (rhbz#1214369)
  - qemu: Don't error out if allocation info can't be queried (rhbz#1452045)
  - daemon: Don't initialize SASL context if not necessary (rhbz#1450095)
  - virDomainXMLOption: Introduce virDomainABIStabilityDomain (rhbz#1450349)
  - virQEMUDriverDomainABIStability: Check for memoryBacking (rhbz#1450349)
  - qemu: process: Save vcpu ordering information on reconnect (rhbz#1451251)
  - audit: Fix the output message for shmem (rhbz#1218603)
  - qemu: Set operation on completed migration job (rhbz#1457052)
  - qemu: Conditionally allow block-copy for persistent domains (rhbz#1459113)
  - virsh: Add support for VIR_DOMAIN_BLOCK_COPY_TRANSIENT_JOB (rhbz#1459113)
  - qemu: Fix serial stub console allocation (rhbz#1434278)
  - conf: Make error reporting in virCPUDefIsEqual optional (rhbz#1441662)
  - conf: Refactor virCPUDefParseXML (rhbz#1441662)
  - conf: Make virDomainSnapshotDefFormat easier to read (rhbz#1441662)
  - conf: Pass xmlopt to virDomainSnapshotDefFormat (rhbz#1441662)
  - qemu: Rename xml_len in virQEMUSaveHeader as data_len (rhbz#1441662)
  - qemu: Fix memory leaks in qemuDomainSaveImageOpen (rhbz#1441662)
  - qemu: Introduce virQEMUSaveData{New,Free} (rhbz#1441662)
  - qemu: Introduce virQEMUSaveDataFinish (rhbz#1441662)
  - qemu: Refactor qemuDomainSaveHeader (rhbz#1441662)
  - qemu: Introduce virQEMUSaveData structure (rhbz#1441662)
  - conf: Introduce virSaveCookie (rhbz#1441662)
  - conf: Add save cookie callbacks to xmlopt (rhbz#1441662)
  - qemu: Implement virSaveCookie object and callbacks (rhbz#1441662)
  - qemu: Store save cookie in save images and snapshots (rhbz#1441662)
  - qemu: Remember CPU def from domain start (rhbz#1441662)
  - qemu: Report the original CPU in migratable xml (rhbz#1441662)
  - qemu: Always send persistent XML during migration (rhbz#1441662)
  - qemu: Send updated CPU in migration cookie (rhbz#1441662)
  - qemu: Store updated CPU in save cookie (rhbz#1441662)
  - qemu: Use updated CPU when starting QEMU if possible (rhbz#1441662)
  - docs: correct improper information about domain states in virsh manpage (rhbz#1408778)


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-10
changelog:
  - qemu: Set iface MTU on hotplug (rhbz#1408701)
  - Use a separate buffer for <input> subelements (rhbz#1283251)
  - Use a separate buffer for <disk><driver> (rhbz#1283251)
  - Use a separate buffer for <controller><driver> (rhbz#1283251)
  - Use a separate buffer for <filesystem><driver> (rhbz#1283251)
  - conf: introduce virDomainControllerDriverFormat (rhbz#1283251)
  - conf: add iotlb attribute to iommu (rhbz#1283251)
  - qemu: format device-iotlb on intel-iommu command line (rhbz#1283251)
  - qemuxml2xmltest: add virtio-options test (rhbz#1283251)
  - conf: use a leading space in virDomainVirtioNetDriverFormat (rhbz#1283251)
  - Add virtio-related options to interfaces (rhbz#1283251)
  - add virtio-related options to memballoon (rhbz#1283251)
  - Add virtio-related options to disks (rhbz#1283251)
  - Add virtio-related options to controllers (rhbz#1283251)
  - Add virtio-related options to filesystems (rhbz#1283251)
  - Add virtio-related options to rng devices (rhbz#1283251)
  - Add virtio-related options to video (rhbz#1283251)
  - Add virtio-related options to input devices (rhbz#1283251)
  - qemuxml2argvtest: add virtio-options test case (rhbz#1283251)
  - qemu: format virtio-related options on the command line (rhbz#1283251)
  - qemu: Allow memAccess for hugepages again (rhbz#1214369, rhbz#1458638)
  - qemu: Prefer hugepages over mem source='file' (rhbz#1214369)
  - qemu: Don't try to use hugepages if not enabled (rhbz#1214369)
  - qemu: Introduce qemuDomainDefFromXML helper (rhbz#1460952)
  - qemu: Add qemuDomainMigratableDefCheckABIStability (rhbz#1460952)
  - qemu: Add qemuDomainCheckABIStability (rhbz#1460952)
  - qemu: Use qemuDomainCheckABIStability where needed (rhbz#1460952)


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-11
changelog:
  - util: storage: Output parsed network backing store string to debug log (rhbz#1461638)
  - util: storage: Add missing return to virStorageSourceParseBackingJSONGluster (rhbz#1461638)
  - util: storage: make virStorageSourceParseBackingJSONGlusterHost universal (rhbz#1461638)
  - util: storage: Add support for type 'inet' in virStorageSourceParseBackingJSONSocketAddress (rhbz#1461638)
  - util: storage: Split out parsing of TCP network host from JSON pseudoprotocol (rhbz#1461638)
  - util: storage: Report errors when source host data is missing (rhbz#1461638)
  - util: storage: Add JSON parser for new options in iSCSI protocol (rhbz#1461638)
  - util: storage: adapt to changes in JSON format for NBD (rhbz#1461638)
  - util: storage: adapt to changes in JSON format for ceph/rbd (rhbz#1461638)
  - util: storage: adapt to changes in JSON format for ssh (rhbz#1461638)
  - util: storage: adapt to changes in JSON format for sheepdog (rhbz#1461638)
  - qemu: Allow live-updates of coalesce settings (rhbz#1414627)
  - qemu: Pass the number of heads even with -vga qxl (rhbz#1283207)
  - util: storage: Export virStorageIsRelative (rhbz#1461303)
  - storage: Add helper to retrieve the backing store string of a storage volume (rhbz#1461303)
  - qemu: snapshot: Load data necessary for relative block commit to work (rhbz#1461303)


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-14.el7_4.1
changelog:
  - qemu: Don't update CPU when checking ABI stability (rhbz#1470582)
  - cpu_x86: Properly disable unknown CPU features (rhbz#1470582)
  - qemu: Add qemuProcessFetchGuestCPU (rhbz#1470582)
  - qemu: Add qemuProcessVerifyCPU (rhbz#1470582)
  - qemu: Rename qemuProcessUpdateLiveGuestCPU (rhbz#1470582)
  - qemu: Add qemuProcessUpdateLiveGuestCPU (rhbz#1470582)
  - qemu: Export virQEMUCapsGuestIsNative (rhbz#1470582)
  - qemu: Move qemuProcessReconnect to the end of qemu_process.c (rhbz#1470582)
  - qemu: Update host-model CPUs on reconnect (rhbz#1470582)


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-14.el7_4.2
changelog:
  - qemu: Fix qemuDomainGetBlockInfo allocation value setting (rhbz#1470127)
  - qemuDomainBuildNamespace: Handle special file mount points (rhbz#1471660)


author: Vivek Lakshmanan <vivekl@redhat.com> - 0:1.2.13-2jpp_1fc
changelog:
  - Merge spec and patches with latest from JPP.
  - Clean source tar ball off prebuilt jars and classes.
  - Use classpathx-jaf and jms for buildrequires for the time being.


author: Vivek Lakshmanan <vivekl@redhat.com> - 0:1.2.13-3jpp.1
changelog:
  - Re-sync with latest from JPP.
  - Update patch for BZ #157585 to apply cleanly.
  - Partially adopt new naming convention.


author: Vivek Lakshmanan <vivekl@redhat.com> 0:1.2.14-3jpp.1
changelog:
  - Upgrade to 1.2.14
  - Modify the categories for the .desktop files so they are only
    displayed under the development/programming menus
  - Resolves: bug 241447


author: Alexander Kurtakov <akurtako@redhat.com> 0:1.2.16-6
changelog:
  - Do not require jaxp_parser_impl. Maven build is not using it all and it's provided by every Java5 JVM.


author: Alexander Kurtakov <akurtako@redhat.com> 0:1.2.16-10
changelog:
  - Remove duplicate import-package declaration.
  - Adapt to current guidelines.
  - Remove no longer needed patches.


author: Stanislav Ochotnicky <sochotnicky@redhat.com> - 0:1.2.17-1
changelog:
  - Update to latest version
  - Change OSGI bundle symbolic name to org.apache.log4j
  - Resolves #826776


author: Java SIG <java-devel@lists.fedoraproject.org> - 0:1.2.17-7
changelog:
  - Update for https://fedoraproject.org/wiki/Fedora_19_Maven_Rebuild
  - Replace maven BuildRequires with maven-local


author: Jonathan Shapiro <shap@eros-os.com> - 0.9.4-2
changelog:
  - update to 0.9.4-2
  - install contrib directory
  - set up required path for hgk
  - install man5 man pages


author: Neal Becker <ndbecker2@gmail.com> - 1.0-5
changelog:
  - Move hgk-related py files to hgk
  - Put mergetools.hgrc in /etc/mercurial/hgrc.d
  - Add hgk.rc and put in /etc/mercurial/hgrc.d


author: Neal Becker <ndbecker2@gmail.com> - 1.1.2-5
changelog:
  - Own directories bash_completion.d and zsh/site-functions
    https://bugzilla.redhat.com/show_bug.cgi?id=487015


author: Rob Crittenden <rcritten@redhat.com> 1.0.6-2
changelog:
  - Patch to properly detect the Apache model and set up NSS appropriately
  - Patch to punt if a bad password is encountered
  - Patch to fix crash when password.conf is malformatted
  - Don't enable ECC support as NSS doesn't have it enabled (3.11.4-0.7)


author: Rob Crittenden <rcritten@redhat.com> 1.0.7-1
changelog:
  - Update to 1.0.7
  - Remove Requires for nss and nspr since those are handled automatically
    by versioned libraries
  - Updated URL and Source to reference directory.fedoraproject.org


author: Rob Crittenden <rcritten@redhat.com> - 1.0.7-4
changelog:
  - Apply patch so that mod_nss calls NSS_Init() after Apache forks a child
    and not before. This is in response to a change in the NSS softtokn code
    and should have always been done this way. (444348)
  - The location of libnssckbi moved from /usr/lib[64] to /lib[64]
  - The NSS database needs to be readable by apache since we need to use it
    after the root priviledges are dropped.


author: Rob Crittenden <rcritten@redhat.com> - 1.0.7-6
changelog:
  - Update the patch for FIPS to include fixes for nss_pcache, enforce
    the security policy and properly initialize the FIPS token.


author: Rob Crittenden <rcritten@redhat.com> - 1.0.7-7
changelog:
  - Don't inherit the MP cache in multi-threaded mode (454701)
  - Don't initialize NSS in each child if SSL isn't configured


author: Rob Crittenden <rcritten@redhat.com> - 1.0.8-4
changelog:
  - Patch to add configuration options for new NSS negotiation API (#574187)
  - Add (pre) for Requires on httpd so we can be sure the user and group are
    already available
  - Add file Requires on libnssckbi.so so symlink can't fail
  - Use _sysconfdir macro instead of /etc
  - Set minimum level of NSS to 3.12.6


author: Rob Crittenden <rcritten@redhat.com> - 1.0.8-9
changelog:
  - Revert mod_nss-wouldblock patch
  - Reset NSPR error before calling PR_Read(). This should fix looping
    in #620856


author: Rob Crittenden <rcritten@redhat.com> - 1.0.8-18
changelog:
  - Actually apply the patch to use memmove in place of memcpy since the
    buffers can overlap (#669118)


author: Matthew Harmsen <mharmsen@redhat.com> - 1.0.8-21
changelog:
  - Bugzilla Bug #884115 - Package mod_nss-1.0.8-18.1.el7 failed RHEL7 RPMdiff
    testing
  - Bugzilla Bug #906082 - mod_nss requires manpages for gencert and nss_pcache
  - Bugzilla Bug #906089 - Fix dangling symlinks in mod_nss
  - Bugzilla Bug #906097 - Correct RPM Parse Warning in mod_nss.spec
  - Bugzilla Bug #948601 - Man page scan results for mod_nss


author: Matthew Harmsen <mharmsen@redhat.com> - 1.0.8-21.1
changelog:
  - Add the following explanation to the 'Dangling symlinks' textbox in rpmdiff:
    Symlink 'etc/httpd/alias/libnssckbi.so' is deliberate.
    This test does not belong in rpmdiff. This test belongs in TPS.
    Since the symlink points to a file in another package, e.g. a
    dependency or a system file, rpmdiff cannot detect this. Remember,
    rpmdiff does not install or even know about package dependencies.
    That's TPS's job.
  - Add the following explanation to the 'Brewtap results' textbox in rpmdiff:
    The '/etc/httpd/conf.d/nss.conf' file does not require a man page
    because its parameters are sufficiently documented within the
    configuration file itself.
    The '/etc/httpd/conf.modules.d/10-nss.conf' file does not require
    a man page because the file merely contains the line
    'LoadModule nss_module modules/libmodnss.so' to support httpd
    loading of Dynamic Shared Objects ('/etc/httpd/conf/httpd.conf').


author: Matthew Harmsen <mharmsen@redhat.com> - 1.0.8-24
changelog:
  - Add '--enable-ecc' option to %configure line under %build section of
    this spec file (mharmsen)
  - Bumped version build/runtime requirements for NSPR and NSS (mharmsen)
  - [mod_nss-PK11_ListCerts_2.patch]
  - Bugzilla Bug #1022295 - PK11_ListCerts called to retrieve all user
    certificates for every server (rcritten)
  - [mod_nss-array_overrun.patch]
  - Bugzilla Bug #1022298 - overrunning array when executing nss_pcache
    (rcritten)
  - [mod_nss-clientauth.patch]
  - Bugzilla Bug #1022921 - mod_nss: FakeBasicAuth authentication bypass
    [rhel-7.0] (rcritten)
  - [mod_nss-no_shutdown_if_not_init_2.patch]
  - Bugzilla Bug #1022303 - File descriptor leak after "service httpd reload"
    or httpd doesn't reload (rrelyea)
  - [mod_nss-proxyvariables.patch]
  - Bugzilla Bug #1022309 - mod_nss insists on Required value NSSCipherSuite
    not set. (mharmsen)
  - [mod_nss-tlsv1_1.patch]
  - Bugzilla Bug #1022310 - current nss support TLS 1.1 so mod_nss should pick
    it up (mharmsen)
  - [mod_nss-sslmultiproxy_2.patch]
  - Fixes Bugzilla Bug #1021458 - [RFE] Support ability to share mod_proxy with
    other SSL providers (jorton, mharmsen, nkinder, & rcritten)


author: Joe Orton <jorton@redhat.com> - 1.0.8-26
changelog:
  - [mod_nss-SSLEngine-off.patch]
  - Bugzilla Bug #1029042 - Implicit SSLEngine for 443 port breaks mod_nss
    configuration (jorton)
  - [mod_nss-unused-filter_ctx.patch]
  - Bugzilla Bug #1029665 - Remove unused variable 'filter_ctx' (mharmsen)


author: Rob Crittenden <rcritten@redhat.com> - 1.0.8-27
changelog:
  - Resolves: CVE-2013-4566
  - Bugzilla Bug #1024536 - mod_nss: incorrect handling of NSSVerifyClient in
    directory context [rhel-7.0] (rcritten)
  - Bugzilla Bug #1030845 - mod_nss: do not use %configure in %changelog
    (mharmsen)


author: Matthew Harmsen <mharmsen@redhat.com> - 1.0.8-28
changelog:
  - Resolves: rhbz #1030276
  - [mod_nss-usecases.patch]
  - Bugzilla Bug #1030276 - mod_nss not working in FIPS mode


author: Matthew Harmsen <mharmsen@redhat.com> - 1.0.8-30
changelog:
  - Resolves: rhbz #1029360
  - Bugzilla Bug #1029360 - ambiguous/invalid ENVR in httpd-mmn Provides/Requires


author: Matthew Harmsen <mharmsen@redhat.com> - 1.0.8-31
changelog:
  - Resolves: rhbz #1029360
  - Bugzilla Bug #1029360 - ambiguous/invalid ENVR in httpd-mmn Provides/Requires
  - corrected typo on date


author: Rob Crittenden <rcritten@redhat.com> - 1.0.11-3
changelog:
  - Fix logical and support in cipher strings CVE-2015-3277
    (#1253570)
  - Add missing BuildRequires and small patch to use requests.urllib3
    to fix make check (#1253570)


author: Rob Crittenden <rcritten@redhat.com> - 1.0.11-5
changelog:
  - Don't enable NULL ciphers in DEFAULT macro (#1253570)
  - Add OpenSSL cipher macro EECDH (#1160745)
  - Disable the live server testing in make check because it
    may run as root and fail horribly (#1160745)


author: Rob Crittenden <rcritten@redhat.com> - 1.0.11-6
changelog:
  - Add the supported NSS SHA384 ciphers (#1253570)
  - Add kECDH, AECDH, ECDSA and aECDSA macros (#1253570)
  - Bump the NSS BR and Requires so the new ciphers are available
  - Bump the NSPR Requires to match NSS


author: Rob Crittenden <rcritten@redhat.com> - 1.0.14-1
changelog:
  - Rebase to 1.0.14 (#1299063)
  - Add support for Server Name Indication (SNI) (#1053327)
  - Use upstream method to not execute live tests as root (#1256887)
  - Always call SSL_ShutdownServerSessionIDCache() in ModuleKill
    (#1263301, #1296685)
  - Don't require NSSProxyNickname (#1280287)
  - Make link to libnssckbi.so an absolute link (#1288471)
  - Fail for colons in credentials with FakeBasicAuth (#1295970)
  - Don't ignore NSSProtocol when NSSFIPS is enabled (#1312491)
  - Check filesystem permissions on NSS database at startup (#1312583)
  - OpenSSL ciphers stopped parsing at +, CVE-2016-3099 (#1323913)
  - Patch to match available ciphers so tests pass (#1299063)
  - Patch to fix tests in brew (#1299063)


author: Rob Crittenden <rcritten@redhat.com> - 1.0.14-6
changelog:
  - Check the NSS certificate database directory for read permissions
    by the Apache user. (#1312583)


author: Rob Crittenden <rcritten@redhat.com> - 1.0.14-8
changelog:
  - Fail start start when there are invalid Protocols defined (#1389114)
  - Handle group membership when testing NSS database filesystem
    permissions (#1395300)
  - Add OCSP cache tuning directives (#1392582) 
  - Don't share mod_nss NSS database with nss_pcache (#1382102)


author: Rob Crittenden <rcritten@redhat.com> - 1.0.14-9
changelog:
  - Update nss_pcache.8 to drop directory and prefix options (#1382102)

  - Don't share mod_nss NSS database with nss_pcache (#1382102)


author: Cristian Gafton <gafton@redhat.com>
changelog:
  - new patch to get xterm-color and nxterm terminfo entries
  - aliased them to rxvt, as that seems to satisfy everybody


author: Cristian Gafton <gafton@redhat.com>
changelog:
  - added terminfo entry for the poor guys using lat1 and/or lat-2 on their
    consoles... Enjoy linux-lat ! Thanks, Erik !


author: Cristian Gafton <gafton@redhat.com>
changelog:
  - don't build the C++ demo code
  - update patch set to the current as of today (redid all the individual
    patches in a single one)


author: Bernhard Rosenkraenzer <bero@redhat.com>
changelog:
  - 5.0
  - some spec cleanups to make updating easier
  - add links *.so.5 to *.so.4 - they are fully binary compatible.
    (Why did they change the invocation number???)


author: Bernhard Rosenkraenzer <bero@redhat.com>
changelog:
  - Fix a typo in spec
  - Add the 19991006 patch, fixing some C++ STL compatibility problems.
  - get rid of profiling and debugging versions - we need to save space...


author: Cristian Gafton <gafton@redhat.com>
changelog:
  - revert to the old major number - because the ABI is not changed (and we
    should be handling the changes via symbol versioning anyway)


author: Bernhard Rosenkränzer <bero@redhat.com>
changelog:
  - Add xterm patch from Hans de Goede <hans@highrise.nl>
  - Patch 20000108, this fixes a problem with a header file.


author: Bernhard Rosenkraenzer <bero@redhat.com>
changelog:
  - 5.2
  - Fix typo in man page (Bug #20205)
  - update the "screen" terminfo entries to the version supplied with
    screen 3.9.8


author: Bernhard Rosenkraenzer <bero@redhat.com> 5.2-17
changelog:
  - Patchlevel 20020209
  - Fix zero-substitution of cf_cv_type_of_bool (#59450)
  - Fix rebuilding of configure script with autoconf 2.5x


author: Bernhard Rosenkraenzer <bero@redhat.com> 5.2-26
changelog:
  - Remove duplicated files (#62752)
  - Don't strip libraries (#60398)
  - Remove cbt capability from xterm description (#61077)


author: Adrian Havill <havill@redhat.com> 5.3-1
changelog:
  - upgrade to 5.3 for sake of utf-8, wide chars (#77585 ...)
  - spec file summary/desc grammar (#73583)
  - add Requires: for c++ devel subpkg (#74002)
  - terminfo.src patches no longer needed
  - adjust autoconf patch


author: Adrian Havill <havill@redhat.com> 5.3-3
changelog:
  - remunged xterm changes from 5.2 patch for 5.3
  - updated screen entry (#82951)
  - fixed ka3, kb2 and kf0 entries (#77506)


author: Adrian Havill <havill@redhat.com> 5.3-5
changelog:
  - added latest rollup patch with widec/UTF8 centric weekly (20030517)
  - added --enable-widec to configure (#86311)
    original work done by Mr. Sam <sam@email-scan.com>
  - require sharutils (#86605)
  - add gpm, xmc support
  - add debug syms back into package
  - updated autoconf/configure patch


author: Adrian Havill <havill@redhat.com> 5.3-7
changelog:
  - fixed the safe sprintf code that was enabled in the previous release
    by the configure parameter. (#101486)


author: Adrian Havill <havill@redhat.com> 5.3-9
changelog:
  - remove not-so safe-sprintf configure option because the code does
    not appear to be stable enough for some apps. (#103790)


author: Adrian Havill <havill@redhat.com> 5.4-3
changelog:
  - link "xterm" to "xterm-color" as temp fix for escape problem (#115448)
  - remove old zcat for PATCH1


author: Adrian Havill <havill@redhat.com> 5.4-5
changelog:
  - remove --with-gpm from configure, as it adds a pkg
    dependency (#122336) and causes too many problems vs its benefits


author: Adrian Havill <havill@redhat.com> 5.4-9
changelog:
  - remove terminfo try-to-please-all xterm hackery; it's now ptty
    and profile's job to point to the correct terminal. (#122815)


author: Adrian Havill <havill@redhat.com> 5.4-11
changelog:
  - add latest rollup patches and weekly patches
  - remove home/end patch, which is now included in latest
    terminfo.src and termcap.src
  - add term.sh to /etc/profile.d, reference in /etc/bashrc
  - modify term.sh to support rxvt (#122815 comment 93)


author: Petr Rockai <prockai@redhat.com> - 5.4-17
changelog:
  - apply patch from Hans de Goede, fixing BR142659 [The
    terminfo data for kbs changed from \177 to ^H]


author: 5.4-19 <praszyk@redhat.com> 5.4-19
changelog:
  - Clear window after: filter()+initscr()+endwin()+refresh()
    See bug #2966, patch ncurses-5.4-filter.patch


author: Petr Raszyk <praszyk@redhat.com> 5.4-21
changelog:
  - Clear window after: filter()+'terminal-resizing'+endwin()
    doupdate()+endwin()
    See bug #174498, patch ncurses-5.4-endwinfilter.patch


author: Petr Raszyk <praszyk@redhat.com> 5.5-11
changelog:
  - According Henrik Nordstrom (hno@squid-cache.org)
    Diff between the two versions of curses.h on x86_64
    Patch ncurses-5.5-chtypeaslong2.patch
    See #178824


author: Miroslav Lichvar <mlichvar@redhat.com> 5.5-20
changelog:
  - update to patch 20060701
  - don't strip libraries, chmod +x them
  - move .so links to devel package
  - add gpm-devel to buildrequires
  - spec cleanup


author: Miroslav Lichvar <mlichvar@redhat.com> 5.5-24.20060715
changelog:
  - modify tgetstr to make screen happy (#202480)
  - use CFLAGS when linking (#199369)
  - change BuildRoot tag to comply with Fedora packaging guidelines


author: Miroslav Lichvar <mlichvar@redhat.com> 5.5-25.20060715
changelog:
  - move libncurses and some terminfo entries out of /usr
  - drop console symlink and sparc terminfo entries


author: Miroslav Lichvar <mlichvar@redhat.com> 5.5-27.20061209
changelog:
  - update to patch 20061209
  - strip large tables from shared libraries, reduce number of relocations
  - package utils linked with libncurses instead of libncursesw
  - package only wide-character headers


author: Miroslav Lichvar <mlichvar@redhat.com> 5.6-2.20070120
changelog:
  - update to patch 20070120
  - don't depend on bash, drop resetall script
  - include rxvt-unicode description


author: Miroslav Lichvar <mlichvar@redhat.com> 5.6-4.20070210
changelog:
  - update to patch 20070210
  - generate separate terminfo library
  - move static libraries to -static subpackage
  - avoid unnecessary linking with libdl


author: Miroslav Lichvar <mlichvar@redhat.com> 5.6-6.20070303
changelog:
  - update to patch 20070303
  - use one libtinfo for both libncurses and libncursesw
  - shorten -devel description


author: Miroslav Lichvar <mlichvar@redhat.com> 5.6-10.20070812
changelog:
  - fix comp_hash string output
  - avoid comparing padding in cchar_t structure
  - remove gawk from buildrequires


author: Miroslav Lichvar <mlichvar@redhat.com> 5.6-13.20080112
changelog:
  - update to patch 20080112
  - make -libs, -base, -term subpackages
  - obsolete termcap and libtermcap
  - update urxvt entry


author: Miroslav Lichvar <mlichvar@redhat.com> 5.6-16.20080301
changelog:
  - update to patch 20080301
  - provide libtermcap.so (#428898)
  - move all headers to /usr/include
  - move libncursesw out of /usr
  - make examples in documentation compilable (#436355)


author: Miroslav Lichvar <mlichvar@redhat.com> 5.6-18.20080628
changelog:
  - update to patch 20080628
  - move mlterm and screen.* entries to -base
  - change kbs to ^? in rxvt and screen entries


author: Miroslav Lichvar <mlichvar@redhat.com> 5.7-5.20100116
changelog:
  - fix narrow/wide libtinfo compatibility
  - fix wattrset macro to not produce warning with current gcc (#556645)


author: Miroslav Lichvar <mlichvar@redhat.com> 5.9-8.20130126
changelog:
  - update to 20130126
  - clear scrollback buffer in clear (#815790)
  - make -base and -term subpackages noarch
  - make some dependencies arch-specific


author: Christopher Aillon <caillon@redhat.com> 3.11-0.cvs
changelog:
  - Initial import into Fedora Core, based on a CVS snapshot of
    the NSS_3_11_RTM tag
  - Fix up the pkcs11-devel subpackage to contain the proper headers
  - Build with RPM_OPT_FLAGS
  - No need to have rpath of /usr/lib in the pc file


author: Kai Engert <kengert@redhat.com> - 3.11.3-2
changelog:
  - Revert the attempt to require latest NSPR, as it is not yet available
    in the build infrastructure.


author: Kai Engert <kengert@redhat.com> - 3.11.5-1
changelog:
  - Update to 3.11.5
  - This update fixes two security vulnerabilities with SSL 2
  - Do not use -rpath link option
  - Added several unsupported tools to tools package


author: Kai Engert <kengert@redhat.com> - 3.11.5-2
changelog:
  - Fix rhbz#230545, failure to enable FIPS mode
  - Fix rhbz#220542, make NSS more tolerant of resets when in the 
    middle of prompting for a user password.


author: Kai Engert <kengert@redhat.com> - 3.11.7-2
changelog:
  - Update to 3.11.7, but freebl/softokn remain at 3.11.5.
  - Use a workaround to avoid mozilla bug 51429.


author: Kai Engert <kengert@redhat.com> - 3.11.7-10
changelog:
  - Add /etc/prelink.conf.d/nss-prelink.conf in order to blacklist
    our signed libraries and protect them from modification.


author: Kai Engert <kengert@redhat.com> - 3.11.99.3-2
changelog:
  - Build against gcc 4.3.0, use workaround for bug 432146
  - Run the test suite after the build and abort on failures.


author: Kai Engert <kengert@redhat.com> - 3.12.0.3-3
changelog:
  - nss package should own /etc/prelink.conf.d folder, rhbz#452062
  - use upstream patch to fix test suite abort


author: Kai Engert <kaie@redhat.com> - 3.12.3-3
changelog:
  - ship .chk files instead of running shlibsign at install time
  - include .chk file in softokn-freebl subpackage
  - add patch for upstream nss bug 488350


author: Kai Engert <kaie@redhat.com> - 3.12.3-7
changelog:
  - re-enable test suite
  - add patch for upstream bug 488646 and add newer paypal
    certs in order to make the test suite pass


author: Elio Maldonado <emaldona@redhat.com> - 3.12.3.99.3-5
changelog:
  - updated pem module incorporates various patches
  - fix off-by-one error when computing size to reduce memory leak. (483855)
  - fix data type to work on x86_64 systems. (429175)
  - fix various memory leaks and free internal objects on module unload. (501080)
  - fix to not clone internal objects in collect_objects().  (501118)
  - fix to not bypass initialization if module arguments are omitted. (501058)
  - fix numerous gcc warnings. (500815)
  - fix to support arbitrarily long password while loading a private key. (500180) 
  - fix memory leak in make_key and memory leaks and return values in pem_mdSession_Login (501191)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.3.99.3-10
changelog:
  - must install libnssutil3.since nss-util is untagged at the moment
  - preserve time stamps when installing various files


author: Elio Maldonado+emaldona@redhat.com - 3.12.3.99.3-11
changelog:
  - split off nss-softokn and nss-util as subpackages with their own rpms
  - first phase of splitting nss-softokn and nss-util as their own packages


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-19
changelog:
  - remove patches that are now in nss-softokn and
  - remove spurious exec-permissions for nss.pc per rpmlint
  - single requires line in nss.pc.in


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-22
changelog:
  - Fix nss-config not to include nssutil
  - Add BuildRequires on nss-softokn and nss-util since build also runs the test suite


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-25
changelog:
  - Remove nss-prelink.conf as signed all shared libraries moved to nss-softokn
  - Add a temprary hack to nss.pc.in to unblock builds


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-29
changelog:
  - Restoring patches 2 and 7 as we still compile all sources
  - Applying the nss-nolocalsql.patch solves nss-tools sqlite dependency problems


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-30
changelog:
  - Fix FORTIFY_SOURCE buffer overflows in test suite on ppc and ppc64 - bug 519766
  - Fixed requires and buildrequires as per recommendations in spec file review


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-2
changelog:
  - Remove symbolic links to shared libraries from devel - 521155
  - No rpath-link in nss-softokn-config


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-3
changelog:
  - PEM module implements memory management for internal objects - 509705
  - PEM module doesn't crash when processing malformed key files - 512019


author: Elio Maldonado<emaldona@redhat.com - 3.12.4-9
changelog:
  - Install blank databases and configuration file for system shared database
  - nsssysinit queries system for fips mode before relying on environment variable


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-13
changelog:
  - User no longer prompted for a password when listing keys an empty system db (#527048)
  - Fix setup-nsssysinit to handle more general formats (#527051)


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-13.1
changelog:
  - Require nss-softoken of same architecture as nss (#527867)
  - Merge setup-nsssysinit.sh improvements from F-12 (#527051)


author: Elio Maldonado<emaldona@redhat.com> - 3.12.5-1
changelog:
  - Update to 3.12.5
  - Patch to allow ssl/tls clients to interoperate with servers that require renogiation


author: Elio Maldonado<emaldona@redhat.com> - 3.12.5-1.5
changelog:
  - Fix nsssysinit to set the default flags on the crypto module (#545779)
  - Remove redundant header from the pem module


author: Elio Maldonado<emaldona@redhat.com> - 3.12.5-1.6
changelog:
  - Fix nsssysinit to enable apps to use system cert store, patch contributed by David Woodhouse (#546221)
  - Fix spec so sysinit requires coreutils for post install scriplet (#547067)
  - Fix segmentation fault when listing keys or certs in the database, patch contributed by Kamil Dudka (#540387)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.6-1.1
changelog:
  - Using SSL_RENEGOTIATE_TRANSITIONAL as default while on transition period
  - Disabling ssl tests suites until bug 539183 is resolved


author: Elio Maldonado <emaldona@redhat.com> - 3.12.6-3
changelog:
  - Add sed to sysinit requires as setup-nsssysinit.sh requires it (#576071)
  - Update PayPalEE test cert with unexpired one (#580207)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.6-5
changelog:
  - Update pem source tar to pick up the following bug fixes:
  - PEM - Allow collect objects to search through all objects
  - PEM - Make CopyObject return a new shallow copy
  - PEM - Fix memory leak in pem_mdCryptoOperationRSAPriv


author: Elio Maldonado <emaldona@redhat.com> - 3.12.7-2
changelog:
  - Define NSS_USE_SYSTEM_SQLITE and remove unneeded patch
  - Add comments regarding an unversioned provides which triggers rpmlint warning
  - Build requires nss-softokn-devel >= 3.12.7


author: Elio Maldonado <emaldona@redhat.com> - 3.12.8-1
changelog:
  - Update to 3.12.8
  - Prevent disabling of nss-sysinit on package upgrade (#636787)
  - Create pkcs11.txt with correct permissions regardless of umask (#636792) 
  - Setup-nsssysinit.sh reports whether nss-sysinit is turned on or off (#636801)
  - Added provides pkcs11-devel-static to comply with packaging guidelines (#609612)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.8-3
changelog:
  - Replace posttrans sysinit scriptlet with a triggerpostun one (#636787)
  - Fix and cleanup the setup-nsssysinit.sh script (#636792, #636801)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.8.99.2-1
changelog:
  - Update to NSS_3_12_9_BETA2
  - Fix libpnsspem crash when cacert dir contains other directories (#642433)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-5
changelog:
  - Fix the earlier infinite recursion patch (#499444)
  - Remove a header that now nss-softokn-freebl-devel ships


author: Christopher Aillon <caillon@redhat.com> - 3.12.9-6
changelog:
  - Revert patches for 499444 as they use a C++ reserved word and
    cause compilation of Firefox to fail


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-10
changelog:
  - Fix cms headers to not use c++ reserved words (#676036)
  - Reenabling Bug 499444 patches
  - Fix to swap internal key slot on fips mode switches


author: Elio Maldonado <emaldona@redhat.com> - 3.12.10-4
changelog:
  - Enable pluggable ecc support (#712556)
  - Disable the nssdb write-access-on-read-only-dir tests when user is root (#646045)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.11-3
changelog:
  - Fix attempt to free initilized pointer (#717338)
  - Fix leak on pem_CreateObject when given non-existing file name (#734760)
  - Fix pem_Initialize to return CKR_CANT_LOCK on multi-treaded calls (#736410)


author: Elio Maldonado Batiz <emaldona@redhat.com> - 3.13.1-4
changelog:
  - Rebuild with nss-softokn from 3.12 in the buildroot
  - Allows the pem module to statically link against 3.12.x freebl
  - Required for using nss-3.13.x with nss-softokn-3.12.y for a merge inrto rhel git repo
  - Build will be temprarily placed on buildroot override but not pushed in bodhi


author: Elio Maldonado <emaldona@redhat.com> - 3.13.1-5
changelog:
  - Statically link the pem module against system freebl found in buildroot
  - Disabling sha224-related powerup selftest until we update softokn
  - Disable sha224 and pss tests which nss-softokn 3.12.x doesn't support


author: Elio Maldonado <emaldona@redhat.com> - 3.13.1-6
changelog:
  - Removed unwanted /usr/include/nss3 in front of the normal cflags include path
  - Removed unnecessary patch dealing with CERTDB_TERMINAL_RECORD, it's visible


author: Elio Maldonado <emaldona@redhat.com> - 3.13.1-7
changelog:
  - Resolves: Bug 750376 - nss 3.13 breaks sssd TLS
  - Fix how pem is built so that nss-3.13.x works with nss-softokn-3.12.y
  - Only patch blapitest for the lack of sha224 on system freebl
  - Completed the patch to make pem link against system freebl


author: elio maldonado <emaldona@redhat.com> - 3.13.1-9
changelog:
  - Revert to using current nss_softokn_version
  - Patch to deal with lack of sha224 is no longer needed


author: Elio Maldonado <emaldona@redhat.com> - 3.13.1-10
changelog:
  - Resolves: Bug 770682 - nss update breaks pidgin-sipe connectivity
  - NSS_SSL_CBC_RANDOM_IV set to 0 by default and changed to 1 on user request


author: Elio Maldonado <emaldona@redhat.com> - 3.13.3-2
changelog:
  - Pick up fixes from RHEL
  - Resolves: rhbz#800674 - Unable to contact LDAP Server during winsync
  - Resolves: rhbz#800682 - Qpid AMQP daemon fails to load after nss update
  - Resolves: rhbz#800676 - NSS workaround for freebl bug that causes openswan to drop connections


author: Elio Maldonado <emaldona@redhat.com> - 3.13.4-1
changelog:
  - Update to NSS_3_13_4_RTM
  - Update the nss-pem source archive to the latest version
  - Remove no longer needed patches
  - Resolves: Bug 806043 - use pem files interchangeably in a single process
  - Resolves: Bug 806051 - PEM various flaws detected by Coverity
  - Resolves: Bug 806058 - PEM pem_CreateObject leaks memory given a non-existing file name


author: Elio Maldonado <emaldona@redhat.com> - 3.13.4-2
changelog:
  - Resolves: Bug 805723 - Library needs partial RELRO support added
  - Patch coreconf/Linux.mk as done on RHEL 6.2


author: Elio Maldonado <emaldona@redhat.com> - 3.13.5-4
changelog:
  - Resolves: Bug 830410 - Missing Requires %{?_isa}
  - Use Requires: %{name}%{?_isa} = %{version}-%{release} on tools
  - Drop zlib requires which rpmlint reports as error E: explicit-lib-dependency zlib
  - Enable sha224 portion of powerup selftest when running test suites
  - Require nspr 4.9.1


author: Elio Maldonado <emaldona@redhat.com> - 3.13.5-8
changelog:
  - Rebase pem sources to fedora-hosted upstream to pick up two fixes from rhel-6.3
  - Resolves: rhbz#847460 - Fix invalid read and free on invalid cert load
  - Resolves: rhbz#847462 - PEM module may attempt to free uninitialized pointer 
  - Remove unneeded fix gcc 4.7 c++ issue in secmodt.h that actually undoes the upstream fix


author: Elio Maldonado <emaldona@redhat.com> - 3.14-0.1.rc.1
changelog:
  - Update to NSS_3_14_RC1
  - update nss-589636.patch to apply to httpdserv
  - turn off ocsp tests for now
  - remove no longer needed patches
  - remove headers shipped by nss-util


author: Elio Maldonado <emaldona@redhat.com> - 3.14-2
changelog:
  - Add secmodt.h to the headers installed by nss-devel
  - nss-devel must install secmodt.h which moved from softoken to pk11wrap with nss-3.14


author: Elio Maldonado <emaldona@redhat.com> - 3.14-5
changelog:
  - Fix the spec file so sechash.h gets installed
  - Resolves: rhbz#871882 - missing header: sechash.h in nss 3.14


author: Elio Maldonado <emaldona@redhat.com> - 3.14-6
changelog:
  - Fix a previous unwanted merge from f18
  - Update the SS_SSL_CBC_RANDOM_IV patch to match new sources while
  - Keeping the patch disabled while we are still in rawhide and
  - State in comment that patch is needed for both stable and beta branches
  - Update .gitignore to download only the new sources


author: Elio Maldonado <emaldona@redhat.com> - 3.14-7
changelog:
  - Add a dummy source file for testing /preventing fedpkg breakage
  - Helps test the fedpkg new-sources and upload commands for breakage by nss updates
  - Related to Bug 872124 - nss 3.14 breaks fedpkg new-sources


author: Elio Maldonado <emaldona@redhat.com> - 3.14-8
changelog:
  - Fix pk11wrap locking which fixes 'fedpkg new-sources' and 'fedpkg update' hangs
  - Bug 872124 - nss-3.14 breaks fedpkg new-sources
  - Fix should be considered preliminary since the patch may change upon upstream approval


author: Elio Maldonado <emaldona@redhat.com> - 3.14-9
changelog:
  - Disable bypass code at build time and return failure on attempts to enable at runtime
  - Bug 806588 - Disable SSL PKCS #11 bypass at build time


author: Elio Maldonado <emaldona@redhat.com> - 3.14-11
changelog:
  - Bug 879978 - Install the nssck.api header template in a place where mod_revocator can access it
  - Install nssck.api in /usr/includes/nss3


author: Elio Maldonado <emaldona@redhat.com> - 3.14-12
changelog:
  - Bug 879978 - Install the nssck.api header template where mod_revocator can access it
  - Install nssck.api in /usr/includes/nss3/templates


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-1
changelog:
  - Update to NSS_3_14_3_RTM
  - sync up pem rsawrapr.c with softoken upstream changes for nss-3.14.3
  - Resolves: rhbz#908257 - CVE-2013-1620 nss: TLS CBC padding timing attack
  - Resolves: rhbz#896651 - PEM module trashes private keys if login fails
  - Resolves: rhbz#909775 - specfile support for AArch64
  - Resolves: rhbz#910584 - certutil -a does not produce ASCII output


author: Kai Engert <kaie@redhat.com> - 3.14.3-9
changelog:
  - Configure libnssckbi.so to use the alternatives system
    in order to prepare for a drop in replacement.


author: Elio Maldonado <emaldona@redhat.com> - 3.15-5
changelog:
  - Install man pages for nss-tools and the nss-config and setup-nsssysinit scripts
  - Resolves: rhbz#606020 - nss security tools lack man pages


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-2
changelog:
  - Update to NSS_3_15_1_RTM
  - Apply various fixes to the man pages and add new ones
  - Enable the iquote.patch to access newly introduced types
  - Add man page for pkcs11.txt configuration file and cert and key databases
  - Add missing option descriptions for {cert|cms|crl}util
  - Resolves: rhbz#948495 - Man page scan results for nss
  - Resolves: rhbz#982723 - Fix path to script in man page for nss-sysinit


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-4
changelog:
  - Install symlink to nss-sysinit.sh without the .sh suffix
  - Resolves: rhbz#982723 - nss-sysinit man page has wrong path for the script


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-1
changelog:
  - Rebase to nss-3.15.2
  - Resolves: rhbz#1012656 - pick up NSS 3.15.2 to fix CVE-2013-1739 and disable MD5 in OCSP/CRL


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-2
changelog:
  - Add description of the certutil's --email option to it's manpage
  - Resolves: rhbz#Bug 948495 - Man page scan results for nss


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-4
changelog:
  - Enable fips when system is in fips mode
  - Resolves: rhbz#852023 - FIPS mode detection does not work


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-6
changelog:
  - Fix errors in ssl disabling patches for both library and tests
  - Add s390x to the multilib_arches definition used for alt_ckbi
  - Resolves: rhbz#1001841 - Disable SSL2 and the export cipher suites


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-7
changelog:
  - Fix bash syntax error in patch for disabling ssl2 tests
  - Resolves: rhbz#1001841 - Disable SSL2 and the export cipher suites


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-8
changelog:
  - Fix patch for disabling ssl2 in ssl to correctly set error code
  - Fix syntax error reported in the build.log even tough it succeeds
  - Add patch top ignore setpolicy result 
  - Resolves: rhbz#1001841 - Disable SSL2 and the export cipher suites
  - Resolves: rhbz#1026677 - Attempt to run ipa-client-install fails


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-9
changelog:
  - Fix certutil man page options names to be consistent with help
  - Resolves: rhbz#948495 - man page scan results for nss
  - Remove incorrect count argument in status description in nss-sysinit man page
  - Resolves: rhbz#982723 - man page of nss-sysinit incorrect option descriptions


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-10
changelog:
  - Fix path to script and remove -- from some options in nss-sysinit man page
  - Resolves: rhbz#982723 - man page of nss-sysinit worong path and other flaws


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-2
changelog:
  - Revoke trust in one mis-issued anssi certificate
  - Resolves: Bug 1040284 - nss: Mis-issued ANSSI/DCSSI certificate (MFSA 2013-117) [rhel-7.0]


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-4
changelog:
  - Improve pluggable ECC support for ECDSA
  - Resolves: Bug 752980 - [7.0 FEAT] Support ECDSA algorithm in the nss package


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-6
changelog:
  - Fix a coverity scan compile time warning for the pem module
  - Resolves: Bug 1002271 - NSS pem module should not require unique base file names


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-7
changelog:
  - Move several nss-sysinit manpages tar archives to the %files
  - Resolves: Bug 1050163 - Same files in two packages create rpm conflict


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-8
changelog:
  - Fix the spec file to apply the nss ecc list patch for bug 752980
  - Resolves: Bug 752980 - Support ECDSA algorithm in the nss package via puggable ecc


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-9
changelog:
  - Rebase to nss-3.15.4
  - Resolves: Bug 1054457 - CVE-2013-1740 nss: false start PR_Recv information disclosure security issue
  - Remove no longer needed patches for manpages that were applied upstream
  - Remove no longer needed patch to disable ocsp stapling tests
  - Update iquote.patch on account of upstream changes
  - Update and rename patch to pem/rsawrapr.c on account of upstream changes
  - Use the pristine upstream sources for nss without repackaging
  - Avoid unneeded manual step which may introduce errors


author: Elio Maldonado <emaldona@redhat.com> - 3.15.4-3
changelog:
  - Remove spurious man5 wildcard entry as all manpages are listed by name
  - Resolves: Bug 1050163 - Same files in two packages create rpm conflict


author: Elio Maldonado <emaldona@redhat.com> - 3.15.4-4
changelog:
  - Update pem sources to latest from nss-pem upstream
  - Pick up pem module fixes verified on RHEL and applied upstream
  - Remove no loger needed pem patches on acccount on this update
  - Add comments documenting the iquote.patch 
  - Resolves: Bug 1054457 - CVE-2013-1740


author: Elio Maldonado <emaldona@redhat.com> - 3.15.4-5
changelog:
  - Pick up a fix from rhel-6 and fix an rpm conflict
  - Don't hold issuer cert handles in crl cache
  - Resolves: Bug 1034409 - deadlock in trust domain and object lock
  - Move nss shared db files to the main package
  - Resolves: Bug 1050163 - Same files in two packages create rpm conflict


author: Elio Maldonado <emaldona@redhat.com> - 3.15.4-6
changelog:
  - Disallow disabling the internal module
  - Resolves: Bug 1056036 - nss segfaults with opencryptoki module


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2-1
changelog:
  - Rebase to nss-3.16.2
  - Resolves: Bug 1103252 - Rebase RHEL 7.1 to at least NSS 3.16.1 (FF 31)
  - Fix test failure detection in the %check section
  - Move removal of unwanted source directories to the end of the %prep section
  - Update various patches on account of the rebase
  - Remove unused patches rendered obsolete by the rebase


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2-2
changelog:
  - Fix libssl and test patches that disable ssl2 support
  - Resolves: Bug 1123435
  - Replace expired PayPal test certificate with current one


author: Elio Maldonado <pbrobinson@redhat.com> 3.16.2-3
changelog:
  - Generic 32/64 bit platform detection (fix ppc64le build)
  - Resolves: Bug 1125619 - nss fails to build on arch: ppc64le (missing dependencies)
  - Fix contributed by Peter Robinson <pbrobinson@redhat.com>


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2-10
changelog:
  - Resolves: Bug 1158161 - Upgrade to NSS 3.16.2.3 for Firefox 31.3
  - Support TLS_FALLBACK_SCSV in tstclnt and ssltap


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-2
changelog:
  - Restore patch for certutil man page
  - supply missing options descriptions
  - Resolves: Bug 1158161 - Upgrade to NSS 3.16.2.3 for Firefox 31.3


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-4
changelog:
  - Fix race condition
  - Resolves: Bug 1094468 - 389-ds-base server reported crash in stan_GetCERTCertificate
  - under the replication replay failure condition


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-5
changelog:
  - Reverse the sense of a test in patch to fix pk12util segfault
  - Resolves: Bug 1174527 - Segfault in pk12util when using -l option with certain .p12 files


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-2
changelog:
  - Replace expired PayPal test certificate that breaks the build
  - Resolves: Bug 1200898 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL7.1]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-3
changelog:
  - Fix shell syntax error on nss/tests/all.sh
  - Resolves: Bug 1200898 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL7.1]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-4
changelog:
  - Update and reeneable nss-646045.patch on account of the rebase
  - Resolves: Bug 1200898 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL7.1]


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-4
changelog:
  - Add support for sha384 tls cipher suites
  - Add support for server-side hde key exchange
  - Add support for DSS+SHA256 ciphersuites


author: Kai Engert <kaie@redhat.com> - 3.19.1-5
changelog:
  - Incremental patches to fix SSL/TLS test suite execution,
    fix the earlier SHA384 patch, and inform clients to use SHA384 with
    certificate_verify if required by NSS.


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-9
changelog:
  - Fix checks to skip ssl2/export cipher suites tests to not skip needed tests
  - Fix libssl ssl2/export disabling patch to handle NULL cipher cases
  - Enable additional cipher suites by default


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-12
changelog:
  - Support TLS > 1.0 by support while still allowing to connect to SSL3 only servers
  - Enable ECDSA cipher suites by default, a subset of the ones requested


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-13
changelog:
  - Reorder the cipher suites and enable two more by default
  - Fix some of the ssauth sni and ocsp stapling tests


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-14
changelog:
  - Update the required_softokn_build_version to -14
  - Add references to bugs filed upstream for new patches
  - Merge ocsp stapling and sslauth sni tests patches into one


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-16
changelog:
  - Fix check for public key size of DSA certificates
  - Use size of prime P not the size of dsa.publicValue


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-17
changelog:
  - Change the required_softokn_build_version back to -13
  - Ensure we use nss-softokn-3.16.2.3-13.el7_1


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-19
changelog:
  - Prevent TLS 1.2 Transcript Collision attacks against MD5 in key exchange protocol
  - Fix a mockbuild reported bad %if condition when using the __isa_bits macro instead of list of 64-bit architectures
  - Change the test to %if 0%{__isa_bits} == 64 as required for building the srpm which is noarch
  - Resolves: Bug 1289884


author: Kai Engert <kaie@redhat.com> - 3.21.0-5
changelog:
  - Merge fixes from the rhel-7.2 branch
  - Fix the SigAlgs sent in certificate_request
  - Ensure all ssl.sh tests are executed
  - Update sslauth test patch to run additional tests


author: Elio Maldonado <emaldona@redhat.com> - 3.21.0-13
changelog:
  - Fix reuse of session cache entry
  - Resolves: Bug 1241172 - Certificate verification fails with multiple https urls


author: Kai Engert <kaie@redhat.com> - 3.21.0-14
changelog:
  - Support TLS 1.2 certificate_verify hashes other than PRF,
    backported fix from NSS 3.25 (upstream bug 1179338).


author: Kai Engert <kaie@redhat.com> - 3.21.0-16
changelog:
  - enable ssl_gtests (without extended master secret tests), Bug 1298692
  - call SECMOD_RestartModules in nss_Init, Bug 1317691


author: Daiki Ueno <dueno@redhat.com> - 3.28.2-1.0
changelog:
  - Rebase to NSS 3.28.2
  - Remove NSS_ENABLE_ECC and NSS_ECC_MORE_THAN_SUITE_B setting, which
    is no-op now
  - Enable gtests when requested
  - Remove nss-646045.patch and fix-nss-test-filtering.patch, which are
    not necessary
  - Remove sslauth-no-v2.patch and
    nss-sslstress-txt-ssl3-lower-value-in-range.patch, as SSLv2 is
    already disabled in upstream
  - Remove ssl-server-min-key-sizes.patch, as we decided to support DH
    key size greater than 1023 bits
  - Remove local patches for SHA384 cipher suites (now supported in
    upstream): dhe-sha384-dss-support.patch,
    client_auth_for_sha384_prf_support.patch,
    nss-fix-client-auth-init-hashes.patch, nss-map-oid-to-hashalg.patch,
    nss-enable-384-cipher-tests.patch, nss-fix-signature-and-hash.patch,
    fix-allowed-sig-alg.patch, tests-extra.patch
  - Remove upstreamed patches: rh1238290.patch,
    fix-reuse-of-session-cache-entry.patch, flexible-certverify.patch,
    call-restartmodules-in-nssinit.patch


author: Daiki Ueno <dueno@redhat.com> - 3.28.2-3
changelog:
  - Remove %nss_cycles setting, which was also mistakenly added
  - Re-enable BUILD_OPT, mistakenly disabled in the previous build
  - Prevent ABI incompatibilty of SECKEYECPublicKey
  - Disable TLS_ECDHE_{RSA,ECDSA}_WITH_AES_128_CBC_SHA256 by default
  - Enable 4 AES_256_GCM_SHA384 ciphersuites, enabled by the downstream
    patch in the previous release
  - Fix crash with tstclnt -W
  - Always enable gtests for supported features
  - Add patch to fix bash syntax error in tests/ssl.sh
  - Build with support for SSLKEYLOGFILE
  - Disable the use of RSA-PSS with SSL/TLS


author: Daiki Ueno <dueno@redhat.com> - 3.28.3-3
changelog:
  - Make sure 32bit nss-pem always be installed with 32bit nss in
    multlib environment, patch by Kamil Dudka
  - Enable new algorithms supported by the new nss-softokn


author: Daiki Ueno <dueno@redhat.com> - 3.28.3-4
changelog:
  - Utilize CKA_NSS_MOZILLA_CA_POLICY attribute, patch by Kai Engert
  - Backport changes adding SSL alert callbacks from upstream
  - Add nss-check-policy-file.patch from Fedora
  - Install policy config in /etc/pki/nss-legacy/nss-rhel7.config


author: Daiki Ueno <dueno@redhat.com> - 3.28.3-5
changelog:
  - Switch default hash algorithm used by tools from SHA-1 to SHA-256
  - Avoid race condition in nssSlot_IsTokenPresent()
  - Enable SHA-2 and AES in pk12util
  - Disable RSA-PSS for now


author: Daiki Ueno <dueno@redhat.com> - 3.28.4-3
changelog:
  - Reorder ChaCha20-Poly1305 cipher suites, as suggested in:
    https://bugzilla.redhat.com/show_bug.cgi?id=1373158#c9


author: Elio Maldonado@<emaldona@redhat.com> - 3.12.3.99.3-19
changelog:
  - Determine NSSUTIL_INCLUDE_DIR and NSSUTIL_LIB_DIR with a pkg-config query on nss-util
  - Remove the release 17 hack


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-3
changelog:
  - Remove symblic links to shared libraries from devel, rhbz#521155
  - Apply the nss-nolocalsql patch
  - No rpath-link in nss-softokn-config


author: Elio Maldonado <emaldona@redhat.com> - 3.12.4-16
changelog:
  - allow prelink of softoken and freebl. Change the verify code to use
    prelink -u if prelink is installed. Fix by Robert Relyea rhbz#504949


author: Elio Maldonado <emaldona@redhat.com> - 3.12.4-19
changelog:
  - Consider the system as not fips enabled when /proc/sys/crypto/fips_enabled isn't present (rhbz#590199)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.4-20
changelog:
  - Add %{?_isa} to the requires in the devel packages (#596840)
  - Fix typo in the package description (#598295)
  - Update nspr version to 4.8.4


author: Elio Maldonado <emaldona@redhat.com> - 3.12.7-2
changelog:
  - Define NSS_USE_SYSTEM_SQLITE and remove nss-nolocalsql patch
  - Fix rpmlint warnings about macros in comments and changelog


author: Elio Maldonado <emaldona@redhat.com> - 3.12.8-1
changelog:
  - Update to 3.12.8
  - Adhere to static library packaging guidelines (#609613)
  - Fix nss-util-devel version dependency line
  - Shorten freebl and freebl subpackages descriptions


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-4
changelog:
  - Add blapit.h to headers provided by nss-softokn-freebl-devel (#675196)
  - Expand the freebl-devel package description


author: Elio Maldonado <emaldona@redhat.com> - 3.12.10-2
changelog:
  - Fix intel optimized aes code to deal with case where input and ouput are in the same buffer (#709517)


author: Elio Maldonado <emaldona@redhat.com> - 3.13-0.1.rc0.3
changelog:
  - Update to NSS_3_13_RC0 post bootstrapping
  - Don't incude util in sources for the lookaside cache
  - Reenable building the fipstest tool
  - Restore full cli argument parsing in the sectool library


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-11
changelog:
  - Downgrading to 3.12.9 for a merge into new RHEL git repo
  - This build is for the buildroot for a limited time only
  - Do not not push it to update-testing


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-13
changelog:
  - Bug 757005 Build nss-softokn for rhel 7
  - Make it almost like nss-softokn-3.12.9 in rhel 6.2
  - Added a patch to build with Linux 3 and higher
  - Meant to work with nss and nss-utul 3.1.3.1
  - Download only the 3.12.9 sources from the lookaside cache


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-14
changelog:
  - Restore the update to 3.13.1
  - Update the patch for freebl to deal with prelinked shared libraries
  - Add additional dbrg power-up self-tests as required by fips
  - Reactivate the tests


author: Elio Maldonado <emaldona@redhat.com> - 3.13.1-15
changelog:
  - Bug 770999 - Fix segmentation violation when turning on fips mode
  - Reintroduce the iquote patch but don't apply it unless needed


author: Tom Callaway <spot@fedoraproject.org> 3.13.1-19.1
changelog:
  - fix issue with gcc 4.7 in secmodt.h and C++11 user-defined literals
  - temporarily revert /usrmove changes. they will be restored in -20 for the f17-usrmove tag.


author: Elio Maldonado <emaldona@redhat.com> - 3.13.5-1
changelog:
  - Update to NSS_3_13_5_RTM
  - Remove unneeded fix for gcc 4.7 c++ issue in secmodt.h which undoes the upstream fix
  - Fix Libs: line on nss-softokn.pc.in


author: Elio Maldonado <emaldona@redhat.com> - 3.14-0.1.rc.1
changelog:
  - Update to NSS_3_14_RC1
  - Remove patches rendered obsolete by this update and update others
  - Temporarily modifiy the spec file while bootstrapping the buildroot a follows:
  - Remove unwanted headers that we lo loger ship
  - Modified the post install scriplet to ensure the in-tree freebl library is loaded


author: Elio Maldonado <emaldona@redhat.com> - 3.14-4
changelog:
  - Apply the bug 829088 patch in question
  - Adjust the patch to account for code changes in nss-3.14
  - Resolves: rhbz#829088 - Fix failure in sha244 self-test


author: Elio Maldonado <emaldona@redhat.com> - 3.14-5
changelog:
  - Truly apply the bug 829088 patch this time
  - Resolves: rhbz#829088 - Fix failure in sha244 self-test


author: Elio Maldonado <emaldona@redhat.com> - 3.14.2-2
changelog:
  - Update to NSS_3_14_2_RTM
  - Restore comments on how to transition when signing algorithm changes
  - Remove unused patches


author: Elio Maldonado <emaldona@redhat.com> - 3.15-0.1.beta.1
changelog:
  - Update to NSS_3_15_BETA1
  - Update spec file, patches, and helper scrips on account of a shallwer source tree


author: Elio Maldonado <emaldona@redhat.com> - 3.15-0.1.beta.2
changelog:
  - Add lowhashtest and pk11gcmtest as unsupported tools
  - Modify nss-softoken-split script to include them in the split


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-3
changelog:
  - Add export NSS_ENABLE_ECC=1 rto the %build and %check sections
  - Resolves: rhbz#752980 - [7.0 FEAT] Support ECDSA algorithm in the nss packag


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-1
changelog:
  - Rebase to nss-softoken from nss-3.15.2
  - Resolves: rhbz#1012679 - pick up NSS-SOFTOKN 3.15.2 (required for bug 1012656)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-3
changelog:
  - Fix to allow level 1 fips mode if the db has no password
  - Resolves: Bug 852023 - FIPS mode detection does not work


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-4
changelog:
  - Rebase to nss-3.15.4
  - Resolves: Bug 1054457 - CVE-2013-1740
  - Update softokn splitting script to oparate on the upstream pristine source
  - Using the .gz archives directly, not repackaging as .bz2 ones
  - Avoid unneeded manual steps that could introduce errors
  - Update the iquote and build softoken only patches on account of the rebase


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2-1
changelog:
  - Update to nss-3.16.2
  - Resolves: Bug 1103925 - Rebase RHEL 7.1 to at least NSS-SOFTOKN 3.16.1 (FF 31)


author: Elio Maldonado <emaldona@redhat.com> 3.16.2-2
changelog:
  - Generic 32/64 bit platform detection (fix ppc64le build)
  - Resolves: Bug 1125620 - nss-softokn fails to build on arch: ppc64le (build failure)
  - Fix contributed by Peter Robinson <pbrobinson@redhat.com>


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2-5-
changelog:
  - Fix incorrect path in the %check section
  - Add way to skip test suite execution during development work
  - Resolves: Bug 1145434 - CVE-2014-1568


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2-6
changelog:
  - Add lowhash to the softoken tests to run as done on rhel-6.6
  - Adapt suboptimal shell code in nss.spec fix from bug 108750
  - Resolves: Bug 1145434 - CVE-2014-1568


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2-7
changelog:
  - Change RSA_PrivateKeyCheck to not require p > q
  - Resolves: Bug 1150645 - Importing an RSA private key fails if p < q


author: Robert Relyea <rrelyea@redhat.com> 3.16.2-12
changelog:
  - Add support for encrypt_derive.
  - Allow us to init database at level1 while already in FIPS mode.
  - Allow UserDBOpen'ed FIPS tokens to do all the mechanisms as well as
    the main fips token.
  - Silence SIGCHLD when prelink is used.


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-2
changelog:
  - Remove temporary workaround for brew build problems now resolved
  - Resolves: Bug 1158161 - Upgrade to NSS 3.16.2.3 for Firefox 31.3


author: Robert Relyea <rrelyea@redhat.com> - 3.16.2.3-3
changelog:
  - Resolves: Bug 1153602 - libfreebl3.so runs prelink during the initialization phase
  - Decouple libfreebl3.so from the actual library.
  - Blacklist the freebl libraries
  - Turn off calling prelink to unprelink the binary


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-5
changelog:
  - Skip the fips checks if the action is newslot or delslot.
  - Resolves: Bug 1156406 - NSS fails to access sql:/etc/pki/nssdb in system FIPS mode


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-6
changelog:
  - Update fix for flaws reported by coverity scan  
  - Resolves: Bug 1154764 - Defects found in nss-softokn


author: Robert Relyea <rrelyea@redhat.com> - 3.16.2.3-7
changelog:
  - Use RHEL-7 dracut semantics rather than RHEL-6
  - fix dependencies so nss-softokn pulls in nss-softokn-freebl
  - keep dummy libfreebl3.chk for dracut kernel.


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-8
changelog:
  - fix permissions on dracut install file.
  - Resolves: Bug 1169957 - curl unable to download url when url is https and environment is dracut


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-14
changelog:
  - Pick up upstream freebl patch for CVE-2015-2730
  - Check for P == Q or P ==-Q before adding P and Q


author: Daiki Ueno <dueno@redhat.com> - 3.28.3-2
changelog:
  - Update to NSS 3.28.3
  - Remove upstreamed patches for the previous FIPS validation
  - Package lowkeyi.h and lowkeyti.h in freebl-devel
  - Pick up a patch in the Fedora package to fix build issue


author: Bob Relyea <rrelyea@redhat.com> - 3.28.3-4
changelog:
  - include new PKCS12 NSS specific mechanisms.
  - alias CKM_TLS_KDF to CKM_TLS_MAC to preserve ABI
  - add RSA PSS oid to decrypting PKCS #5 key blobs.
  - move ec public key check from softokn to freebl so apps like Java can benefit.


author: Daiki Ueno <dueno@redhat.com> - 3.28.3-5
changelog:
  - fix login handling for FIPS slots, patch from rhbz#1390154
  - backport upstream fix for CVE-2017-5462 (DRBG leak)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Patch to build with neither RSA nor RSAref.
  - Miscellaneous FHS-compliance tweaks.
  - Fix for possibly-compressed man pages.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Move condrestart to server postun.
  - Move key generation to init script.
  - Actually use the right patch for moving the key generation to the init script.
  - Clean up the init script a bit.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update to 2.1.1p4, which includes fixes for config file parsing problems.
  - Move the init script back.
  - Add Damien's quick fix for wackiness.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update to 20000823 snapshot.
  - Change subpackage requirements from %{version} to %{version}-%{release}
  - Back out the pipe patch.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update x11-askpass to 1.0.2. (#17835)
  - Add BuildPreReqs for /bin/login and /usr/bin/rsh so that configure will
    always find them in the right place. (#17909)
  - Set the default path to be the same as the one supplied by /bin/login, but
    add /usr/X11R6/bin. (#17909)
  - Try to handle obsoletion of ssh-server more cleanly.  Package names
    are different, but init script name isn't. (#17865)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Add BuildPreReq on /usr/include/security/pam_appl.h to be sure we always
    build PAM authentication in.
  - Try setting SSH_ASKPASS if gnome-ssh-askpass is installed.
  - Clean out no-longer-used patches.
  - Patch ssh-add to try to add both identity and id_dsa, and to error only
    when neither exists.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update to OpenSSH 2.3.0p1.
  - Update to x11-askpass 1.1.0.
  - Enable keyboard-interactive authentication.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Resync with conditional options in Damien Miller's .spec file for an errata.
  - Change libexecdir from %{_libexecdir}/ssh to %{_libexecdir}/openssh.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Add the primes file from the latest snapshot to the main package (#20884).
  - Add the dev package to the prereq list (#19984).
  - Remove the default path and mimic login's behavior in the server itself.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Disable the built-in MD5 password support.  We're using PAM.
  - Take a crack at doing keyboard-interactive authentication with PAM, and
    enable use of it in the default client configuration so that the client
    will try it when the server disallows password authentication.
  - Build with debugging flags.  Build root policies strip all binaries anyway.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Merge multiple PAM text messages into subsequent prompts when possible when
    doing keyboard-interactive authentication.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update to x11-askpass 1.1.1. (#21301)
  - Don't second-guess fixpaths, which causes paths to get fixed twice. (#21290)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Don't treat pam_setcred() failure as fatal unless pam_authenticate() has
    succeeded, to allow public-key authentication after a failure with "none"
    authentication.  (#21268)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - More gettextizing.
  - Close all files after going into daemon mode (needs more testing).
  - Extract patch from CVS to handle auth banners (in the client).
  - Extract patch from CVS to handle compat weirdness.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Don't open a PAM session until we've forked and become the user (#25690).
  - Apply Andrew Bartlett's patch for letting pam_authenticate() know which
    host the user is attempting a login from.
  - Resync with parts of Damien Miller's openssh.spec from CVS.
  - Don't expose KbdInt responses in debug messages (from CVS).
  - Detect and handle errors in rsa_{public,private}_decrypt (from CVS).


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update for 2.5.0p1.
  - Use $RPM_OPT_FLAGS instead of -O when building gnome-ssh-askpass
  - Resync with parts of Damien Miller's openssh.spec from CVS, including
    update of x11 askpass to 1.2.0.
  - Only require openssl (don't prereq) because we generate keys in the init
    script now.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update for 2.5.1p1.
  - Add init script mods from Pekka Savola.
  - Tweak the init script to match the CVS contrib script more closely.
  - Redo patch to ssh-add to try to adding both identity and id_dsa to also try
    adding id_rsa.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Redo patch to move pam_open_session after the server setuid()s to the user.
  - Rework the nopam patch to use be picked up by autoconf.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Chuck the closing patch.
  - Add a trigger to add host keys for protocol 2 to the config file, now that
    configuration file syntax requires us to specify it with HostKey if we
    specify any other HostKey values, which we do.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Revert the patch to move pam_open_session.
  - Init script and spec file changes from Pekka Savola. (#28750)
  - Patch sftp to recognize '-o protocol' arguments. (#29540)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.5.2p1 (includes endianness fixes in the rijndael implementation)
  - don't enable challenge-response by default until we find a way to not
    have too many userauth requests (we may make up to six pubkey and up to
    three password attempts as it is)
  - remove build dependency on rsh to match openssh.com's packages more closely


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.5.2p2
  - call setcred() again after initgroups, because the "creds" could actually
    be group memberships


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - make do_pam_setcred() smart enough to know when to establish creds and
    when to reinitialize them
  - add in a couple of other fixes from Damien for inclusion in the errata


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - mention that challengereponse supports PAM, so disabling password doesn't
    limit users to pubkey and rsa auth (#34378)
  - bypass the daemon() function in the init script and call initlog directly,
    because daemon() won't start a daemon it detects is already running (like
    open connections)
  - require the version of openssl we had when we were built


author: Preston Brown <pbrown@redhat.com>
changelog:
  - remove explicit openssl requirement, fixes builddistro issue
  - make initscript stop() function wait until sshd really dead to avoid 
    races in condrestart


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - finish marking strings in the init script for translation
  - modify init script to source /etc/sysconfig/sshd and pass $OPTIONS to sshd
    at startup (change merged from openssh.com init script, originally by
    Pekka Savola)
  - refuse to do X11 forwarding if xauth isn't there, handy if you enable
    it by default on a system that doesn't have X installed


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add in Simon Wilkinson's GSSAPI patch to give it some testing in-house,
    to be removed before the next beta cycle because it's a big departure
    from the upstream version


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix an error parsing the new default sshd_config
  - add a fix from Markus Friedl (via openssh-unix-dev) for ssh-keygen not
    dealing with comments right


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - change Copyright: BSD to License: BSD
  - add Markus Friedl's unverified patch for the cookie file deletion problem
    so that we can verify it
  - drop patch to check if xauth is present (was folded into cookie patch)
  - don't apply gssapi patches for the errata candidate
  - clear supplemental groups list at startup


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pull cvs patch to add session initialization to no-pty sessions
  - pull cvs patch to not cut off challengeresponse auth needlessly
  - refuse to do X11 forwarding if xauth isn't there, handy if you enable
    it by default on a system that doesn't have X installed (#49263)


author: Nalin Dahyabhai <nalin@redhat.com> 2.9p2-7
changelog:
  - fix scp's server's reporting of file sizes, and build with the proper
    preprocessor define to get large-file capable open(), stat(), etc.
    (sftp has been doing this correctly all along) (#51827)
  - configure without --with-ipv4-default on RHL 7.x and newer (#45987,#52247)
  - pull cvs patch to fix support for /etc/nologin for non-PAM logins (#47298)
  - mark profile.d scriptlets as config files (#42337)
  - refer to Jason Stone's mail for zsh workaround for exit-hanging quasi-bug
  - change a couple of log() statements to debug() statements (#50751)
  - pull cvs patch to add -t flag to sshd (#28611)
  - clear fd_sets correctly (one bit per FD, not one byte per FD) (#43221)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 3.0p1
  - update to x11-ssh-askpass 1.2.4.1
  - change build dependency on a file from pam-devel to the pam-devel package
  - replace primes with moduli


author: Nalin Dahyabhai <nalin@redhat.com> 3.0p1-1
changelog:
  - merge some of Damien Miller <djm@mindrot.org> changes from the upstream
    3.0p1 spec file and init script


author: Nalin Dahyabhai <nalin@redhat.com> 3.0.2p1-3
changelog:
  - add patches from Simon Wilkinson and Nicolas Williams for GSSAPI key
    exchange, authentication, and named key support


author: Nalin Dahyabhai <nalin@redhat.com> SNAP-20020220
changelog:
  - update to SNAP-20020220 for testing purposes (you've been warned, if there's
    anything to be warned about, gss patches won't apply, I don't mind)


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-1
changelog:
  - require sharutils for building (mindrot #137)
  - require db1-devel only when building for 6.x (#55105), which probably won't
    work anyway (3.1 requires OpenSSL 0.9.6 to build), but what the heck
  - require pam-devel by file (not by package name) again
  - add Markus's patch to compile with OpenSSL 0.9.5a (from
    http://bugzilla.mindrot.org/show_bug.cgi?id=141) and apply it if we're
    building for 6.x


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-2gss
changelog:
  - reintroduce Simon's gssapi patches
  - add buildprereq for autoconf253, which is needed to regenerate configure
    after applying the gssapi patches
  - refresh to the latest version of Markus's patch to build properly with
    older versions of OpenSSL


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-3
changelog:
  - pull patch from CVS to avoid printing error messages when some of the
    default keys aren't available when running ssh-add
  - refresh to current revisions of Simon's patches


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-4
changelog:
  - drop buildreq on db1-devel
  - require pam-devel by package name
  - require autoconf instead of autoconf253 again


author: Nalin Dahyabhai <nalin@redhat.com> 3.3p1-1
changelog:
  - update to 3.3p1
  - merge in spec file changes from upstream (remove setuid from ssh, ssh-keysign)
  - disable gtk2 askpass
  - require pam-devel by filename rather than by package for erratum
  - include patch from Solar Designer to work around anonymous mmap failures


author: Nalin Dahyabhai <nalin@redhat.com> 3.3p1-2
changelog:
  - rework the close-on-exit docs
  - include configuration file man pages
  - make use of nologin as the privsep shell optional


author: Nalin Dahyabhai <nalin@redhat.com> 3.5p1-2
changelog:
  - patch PAM configuration to use relative path names for the modules, allowing
    us to not worry about which arch the modules are built for on multilib systems


author: Nalin Dahyabhai <nalin@redhat.com> 3.5p1-6
changelog:
  - move scp to the -clients subpackage, because it directly depends on ssh
    which is also in -clients (#84329)


author: Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-6
changelog:
  - modify patch which clears the supplemental group list at startup to only
    complain if setgroups() fails if sshd has euid == 0
  - handle krb5 installed in %{_prefix} or elsewhere by using krb5-config


author: Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-11
changelog:
  - apply patch to store the correct buffer size in allocated buffers
    (CAN-2003-0693)
  - skip the initial PAM authentication attempt with an empty password if
    empty passwords are not permitted in our configuration (#103998)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - additional fix for apparently-never-happens double-free in buffer_free()
  - extend fix for #103998 to cover SSH1


author: Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-34
changelog:
  * Wed Mar 03 2004 Phil Knirsch <pknirsch@redhat.com> 3.6.1p2-33.30.1
  - Built RHLE3 U2 update package.


author: Nalin Dahyabhai <nalin@redhat.com> 3.8.1p1-1
changelog:
  - request gssapi-with-mic by default but not delegation (flag day for anyone
    who used previous gssapi patches)
  - no longer request x11 forwarding by default


author: Nalin Dahyabhai <nalin@redhat.com> 3.9p1-8
changelog:
  - add a --enable-vendor-patchlevel option which allows a ShowPatchLevel option
    to enable display of a vendor patch level during version exchange (#120285)
  - configure with --disable-strip to build useful debuginfo subpackages


author: Tomas Mraz <tmraz@redhat.com>
changelog:
  - change permissions on pam.d/sshd to 0644 (#64697)
  - patch initscript so it doesn't kill opened sessions if
    the sshd daemon isn't running anymore (#67624)


author: Tomas Mraz <tmraz@redhat.com> 3.9p1-10
changelog:
  - enable trusted forwarding by default if X11 forwarding is 
    required by user (#137685 and duplicates)
  - disable protocol 1 support by default in sshd server config (#88329)
  - keep the gnome-askpass dialog above others (#69131)


author: Tomas Mraz <tmraz@redhat.com> 3.9p1-11
changelog:
  - don't call syslog in signal handler
  - allow password authentication when copying from remote
    to remote machine (#103364)


author: Tomas Mraz <tmraz@redhat.com> 4.0p1-2
changelog:
  - fixed Local/RemoteForward in ssh_config.5 manpage
  - fix fatal when Local/RemoteForward is used and scp run (#153258)
  - don't leak user validity when using krb5 authentication


author: Tomas Mraz <tmraz@redhat.com> 4.1p1-3
changelog:
  - fix small regression caused by the nologin patch (#161956)
  - fix race in getpeername error checking (mindrot #1054)


author: Tomas Mraz <tmraz@redhat.com> 4.1p1-4
changelog:
  - don't deadlock on exit with multiple X forwarded channels (#152432)
  - don't use X11 port which can't be bound on all IP families (#163732)


author: Tomas Mraz <tmraz@redhat.com> 4.1p1-5
changelog:
  - use x11-ssh-askpass if openssh-askpass-gnome is not installed (#165207)
  - install ssh-copy-id from contrib (#88707)


author: Tomas Mraz <tmraz@redhat.com> 4.2p1-2
changelog:
  - use include instead of pam_stack in pam config
  - use fork+exec instead of system in scp - CVE-2006-0225 (#168167)
  - upstream patch for displaying authentication errors


author: Warren Togami <wtogami@redhat.com> - 4.2p1-7
changelog:
  - xorg-x11-devel -> libXt-devel
  - rebuild for new xauth location so X forwarding works
  - buildreq audit-libs-devel
  - buildreq automake for aclocal
  - buildreq imake for xmkmf
  -  -D_GNU_SOURCE in flags in order to get it to build
     Ugly hack to workaround openssh defining __USE_GNU which is
     not allowed and causes problems according to Ulrich Drepper
     fix this the correct way after FC5test1


author: Nalin Dahyabhai <nalin@redhat.com> - 4.2p1-8
changelog:
  - work around missing gccmakedep by wrapping makedepend in a local script
  - remove now-obsolete build dependency on "xauth"


author: Tomas Mraz <tmraz@redhat.com> - 4.2p1-9
changelog:
  - drop x11-ssh-askpass from the package
  - drop old build_6x ifs from spec file
  - improve gnome-ssh-askpass so it doesn't reveal number of passphrase 
    characters to person looking at the display
  - less hackish fix for the __USE_GNU problem


author: Tomas Mraz <tmraz@redhat.com> - 4.3p1-2
changelog:
  - fixed another place where syslog was called in signal handler
  - pass locale environment variables to server, accept them there (#179851)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-3
changelog:
  - enable the subprocess in chroot to send messages to system log
  - sshd should prevent login if audit call fails


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-6
changelog:
  - improve selinux patch (by Jan Kiszka)
  - upstream patch for buffer append space error (#191940)
  - fixed typo in configure.ac (#198986)
  - added pam_keyinit to pam configuration (#198628)
  - improved error message when askpass dialog cannot grab
    keyboard input (#198332)
  - buildrequires xauth instead of xorg-x11-xauth
  - fixed a few rpmlint warnings


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-7
changelog:
  - dropped old ssh obsoletes
  - call the pam_session_open/close from the monitor when privsep is
    enabled so it is always called as root (patch by Darren Tucker)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-8
changelog:
  - drop the pam-session patch from the previous build (#201341)
  - don't set IPV6_V6ONLY sock opt when listening on wildcard addr (#201594)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-9
changelog:
  - don't report duplicate syslog messages, use correct local time (#189158)
  - don't allow spnego as gssapi mechanism (from upstream)
  - fixed memleaks found by Coverity (from upstream)
  - allow ip options except source routing (#202856) (patch by HP)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-10
changelog:
  - improve gssapi-no-spnego patch (#208102)
  - CVE-2006-4924 - prevent DoS on deattack detector (#207957)
  - CVE-2006-5051 - don't call cleanups from signal handler (#208459)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-11
changelog:
  - merge sshd initscript patches
  - kill all ssh sessions when stop is called in halt or reboot runlevel
  - remove -TERM option from killproc so we don't race on sshd restart


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-13
changelog:
  - improved pam_session patch so it doesn't regress, the patch is necessary
    for the pam_session_close to be called correctly as uid 0


author: Tomas Mraz <tmraz@redhat.com> - 4.5p1-2
changelog:
  - support mls on labeled networks (#220487)
  - support mls level selection on unlabeled networks
  - allow / in usernames in scp (only beginning /, ./, and ../ is special)


author: Tomas Mraz <tmraz@redhat.com> - 4.5p1-8
changelog:
  - fix sftp client problems on write error (#247802)
  - allow disabling autocreation of server keys (#235466)


author: Tomas Mraz <tmraz@redhat.com> - 4.7p1-1
changelog:
  - upgrade to latest upstream
  - use libedit in sftp (#203009)
  - fixed audit log injection problem (CVE-2007-3102)


author: Tomas Mraz <tmraz@redhat.com> - 4.7p1-4
changelog:
  - do not copy /etc/localtime into the chroot as it is not
    necessary anymore (#193184)
  - call setkeycreatecon when selinux context is established
  - test for NULL privk when freeing key (#391871) - patch by
    Pierre Ossman


author: Tomas Mraz <tmraz@redhat.com> - 4.7p1-9
changelog:
  - set FD_CLOEXEC on client socket
  - apply real fix for window size problem (#286181) from upstream
  - apply fix for the spurious failed bind from upstream
  - apply open handle leak in sftp fix from upstream


author: Tomas Mraz <tmraz@redhat.com> - 4.7p1-10
changelog:
  - fix race on control master and cleanup stale control socket (#436311)
    patches by David Woodhouse


author: Tomas Mraz <tmraz@redhat.com> - 5.0p1-1
changelog:
  - upgrade to new upstream (#441066)
  - prevent initscript from killing itself on halt with upstart (#438449)
  - initscript status should show that the daemon is running
    only when the main daemon is still alive (#430882)


author: Tomas Mraz <tmraz@redhat.com> - 5.0p1-2
changelog:
  - add LANGUAGE to accepted/sent environment variables (#443231)
  - use pam_selinux to obtain the user context instead of doing it itself
  - unbreak server keep alive settings (patch from upstream)
  - small addition to scp manpage


author: Tomas Mraz <tmraz@redhat.com> - 5.1p1-1
changelog:
  - upgrade to new upstream release
  - fixed a problem with public key authentication and explicitely
    specified SELinux role


author: Tomas Mraz <tmraz@redhat.com> - 5.1p1-4
changelog:
  - set FD_CLOEXEC on channel sockets (#475866)
  - adjust summary
  - adjust nss-keys patch so it is applicable without selinux patches (#470859)


author: Tomas Mraz <tmraz@redhat.com> - 5.1p1-5
changelog:
  - remove obsolete --with-rsh (#478298)
  - add pam_sepermit to allow blocking confined users in permissive mode
    (#471746)
  - move system-auth after pam_selinux in the session stack


author: Jan F. Chadima <jchadima@redhat.com> - 5.2p1-20
changelog:
  - merged xmodifiers to redhat patch
  - merged gssapi-role to selinux patch
  - merged cve-2007_3102 to audit patch
  - sesftp patch only with WITH_SELINUX flag
  - rearange sesftp patch according to upstream request


author: Jan F. Chadima <jchadima@redhat.com> - 5.2p1-28
changelog:
  - Repair initscript to be acord to guidelines (#521860)
  - Add bugzilla# to application of edns and xmodifiers patch


author: Jan F. Chadima <jchadima@redhat.com> - 5.5p1-10 + 0.9.2-26
changelog:
  - Repair the reference in man ssh-ldap-helper(8)
  - Repair the PubkeyAgent section in sshd_config(5)
  - Provide example ldap.conf


author: Jan F. Chadima <jchadima@redhat.com> - 5.6p1-20 + 0.9.2-29
changelog:
  - reapair clientloop crash (#627332)
  - properly restore euid in case connect to the ssh-agent socket fails


author: Jan F. Chadima <jchadima@redhat.com> - 5.8p1-18 + 0.9.2-30
changelog:
  - add periodical reseeding of random generator 
  - change selinux contex for internal sftp in do_usercontext
  - exit(0) after sigterm


author: Jan F. Chadima <jchadima@redhat.com> - 5.8p1-20 + 0.9.2-30
changelog:
  - use /dev/random or /dev/urandom for seeding prng
  - improve periodical reseeding of random generator


author: Jan F. Chadima <jchadima@redhat.com> - 5.8p2-12 + 0.9.2-31
changelog:
  - Systemd compatibility according to Mathieu Bridon <bochecha@fedoraproject.org>
  - Split out the host keygen into their own command, to ease future migration
    to systemd. Compatitbility with the init script was kept.
  - Migrate the package to full native systemd unit files, according to the Fedora
    packaging guidelines.
  - Prepate the unit files for running an ondemand server. (do not add it actually)


author: Tomas Mraz <tmraz@redhat.com> - 5.9p1-11 + 0.9.2-32
changelog:
  - remove unnecessary requires on initscripts
  - set VerifyHostKeyDNS to ask in the default configuration (#739856)


author: Tomas Mraz <tmraz@redhat.com> - 5.9p1-12 + 0.9.2-32
changelog:
  - still support /etc/sysconfig/sshd loading in sshd service (#754732)
  - fix incorrect key permissions generated by sshd-keygen script (#754779)


author: Tomas Mraz <tmraz@redhat.com> - 5.9p1-13 + 0.9.2-32
changelog:
  - add back the restorecon call to ssh-copy-id - it might be needed on older
    distributions (#739989)


author: Petr Lautrbach <plautrba@redhat.com> 5.9p1-18 + 0.9.2-32
changelog:
  - replace TwoFactorAuth with RequiredAuthentications[12]
    https://bugzilla.mindrot.org/show_bug.cgi?id=983


author: Tomas Mraz <tmraz@redhat.com> 5.9p1-23 + 0.9.3-1
changelog:
  - fix segfault in su when pam_ssh_agent_auth is used and the ssh-agent
    is not running, most probably not exploitable
  - update pam_ssh_agent_auth to 0.9.3 upstream version


author: Petr Lautrbach <plautrba@redhat.com> 6.1p1-1 + 0.9.3-3
changelog:
  - new upstream release (#852651)
  - use DIR: kerberos type cache (#848228)
  - don't use chroot_user_t for chrooted users (#830237)
  - replace scriptlets with systemd macros (#850249)
  - don't use /bin and /sbin paths (#856590)


author: Petr Lautrbach <plautrba@redhat.com> 6.1p1-2
changelog:
  - add SELinux comment to /etc/ssh/sshd_config about SELinux command to modify port (#861400)
  - drop required chkconfig (#865498)
  - drop openssh-5.9p1-sftp-chroot.patch (#830237)


author: Petr Lautrbach <plautrba@redhat.com> 6.1p1-3 + 0.9.3-3
changelog:
  - replace RequiredAuthentications2 with AuthenticationMethods based on upstream
  - obsolete RequiredAuthentications[12] options
  - fix openssh-6.1p1-privsep-selinux.patch


author: Petr Lautrbach <plautrba@redhat.com> 6.2p1-2 + 0.9.3-4
changelog:
  - keep track of which IndentityFile options were manually supplied and
    which were default options, and don't warn if the latter are missing.
    (mindrot#2084)


author: Petr Lautrbach <plautrba@redhat.com> 6.2p1-3 + 0.9.3-4
changelog:
  - sshd.service: use KillMode=process (#890376)
  - add latest config.{sub,guess} to support aarch64 (#926284)


author: Petr Lautrbach <plautrba@redhat.com> 6.2p2-4 + 0.9.3-5
changelog:
  - don't show Success for EAI_SYSTEM (#985964)
  - make sftp's libedit interface marginally multibyte aware (#841771)


author: Petr Lautrbach <plautrba@redhat.com> 6.2p2-7 + 0.9.3-5
changelog:
  - use hmac_suffix for ssh{,d} hmac checksums
  - bump the minimum value of SSH_USE_STRONG_RNG to 14 according to SP800-131A
  - automatically restart sshd.service on-failure after 42s interval


author: Petr Lautrbach <plautrba@redhat.com> 6.2p2-8 + 0.9.3-5
changelog:
  - sshd-keygen: generate only RSA keys by default (#1010361)
  - use dist tag in suffixes for hmac checksum files


author: Petr Lautrbach <plautrba@redhat.com> 6.2p2-9 + 0.9.3-5
changelog:
  - use dracut-fips package to determine if a FIPS module is installed (#1001566)
  - revert -fips subpackages and hmac files suffixes


author: Petr Lautrbach <plautrba@redhat.com> 6.3p1-2 + 0.9.3-6
changelog:
  - use default_ccache_name from /etc/krb5.conf for a kerberos cache (#991186)
  - increase the size of the Diffie-Hellman groups (#1010607)
  - sshd-keygen to generate ECDSA keys <i.grok@comcast.net> (#1019222)


author: Petr Lautrbach <plautrba@redhat.com> 6.3p1-4 + 0.9.3-7
changelog:
  - adjust gss kex mechanism to the upstream changes (#1024004)
  - don't use xfree in pam_ssh_agent_auth sources <geertj@gmail.com> (#1024965)


author: Petr Lautrbach <plautrba@redhat.com> 6.4p1-2 + 0.9.3-1
changelog:
  - fix fatal() cleanup in the audit patch (#1029074)
  - fix parsing logic of ldap.conf file (#1033662)


author: Petr Lautrbach <plautrba@redhat.com> 6.4p1-3 + 0.9.3-8
changelog:
  - sshd-keygen - use correct permissions on ecdsa host key (#1023945)
  - use only rsa and ecdsa host keys by default


author: Petr Lautrbach <plautrba@redhat.com> 6.4p1-5 + 0.9.3-8
changelog:
  - use tty allocation for a remote scp (#985650)
  - run ssh-copy-id in the legacy mode when SSH_COPY_ID_LEGACY variable is set (#969375)
  - FIPS mode - adjust the key echange DH groups and ssh-keygen according toSP800-131A (#1001748)


author: Petr Lautrbach <plautrba@redhat.com> 6.4p1-7 + 0.9.3-8
changelog:
  - log fipscheck verification message into syslog authpriv
  - ssh-keygen - relative-specified certificate expiry time should be relative
    to current time and not the validity start time (#1058234)
  - use the size of security of 3des for DH (#1053107)
  - ssh-copy-id.1 man page fix (#1058792)


author: Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-1 + 0.9.3-9
changelog:
  - new upstream release (#1059667)
  - prevent a server from skipping SSHFP lookup - CVE-2014-2653 (#1081338)
  - make /etc/ssh/moduli file public (#1134448)
  - test existence of /etc/ssh/ssh_host_ecdsa_key in sshd-keygen.service
  - don't clean up gssapi credentials by default (#1134447)
  - ssh-agent - try CLOCK_BOOTTIME with fallback (#1134449)
  - disable the curve25519 KEX when speaking to OpenSSH 6.5 or 6.6
  - add support for ED25519 keys to sshd-keygen and sshd.sysconfig
  - standardise on NI_MAXHOST for gethostname() string lengths (#1097665)
  - set a client's address right after a connection is set (mindrot#2257) (#912792)
  - apply RFC3454 stringprep to banners when possible (mindrot#2058) (#1104662)
  - don't consider a partial success as a failure (mindrot#2270) (#1112972)


author: Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-2 + 0.9.3-9
changelog:
  - slightly change systemd units logic - use sshd-keygen.service (#1066615)
  - log when a client requests an interactive session and only sftp is allowed (#1130198)
  - sshd-keygen - don't generate DSA and ED25519 host keys in FIPS mode (#1143867)


author: Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-4 + 0.9.3-9
changelog:
  - revert the default of KerberosUseKuserok back to yes
  - fix kuserok patch which checked for the existence of .k5login unconditionally
    and hence prevented other mechanisms to be used properly


author: Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-8 + 0.9.3-9
changelog:
  - increase size of AUDIT_LOG_SIZE to 256 (#1171163)
  - record pfs= field in CRYPTO_SESSION audit event (#1171248)


author: Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-10 + 0.9.3-9
changelog:
  - add new option GSSAPIEnablek5users and disable using ~/.k5users by default CVE-2014-9278
    (#1169843)


author: Jakub Jelen <jjelen@redhat.com> 6.6.1p1-13 + 0.9.3-9
changelog:
  - Increase limit of files for glob match in sftp (#1160377)
  - Add pam_reauthorize.so to /etc/pam.d/sshd (#1204233)
  - Show all config values in sshd test mode (#1187597)
  - Document required selinux boolean for working ssh-ldap-helper (#1178116)
  - Consistent usage of pam_namespace in sshd (#1125110)
  - Fix auditing when using combination of ForcedCommand and PTY (#1199112)
  - Add sftp option to force mode of created files (#1197989)
  - Ability to specify an arbitrary LDAP filter in ldap.conf for ssh-ldap-helper (#1201753)
  - Provide documentation line for systemd service and socket (#1181591)
  - Provide LDIF version of LPK schema (#1184938)
  - Document TERM environment variable (#1162683)
  - Fix ssh-copy-id on non-sh remote shells (#1201758)
  - Do not read RSA1 hostkeys for HostBased authentication in FIPS (#1197666)


author: Jakub Jelen <jjelen@redhat.com> 6.6.1p1-14 + 0.9.3-9
changelog:
  - Fix ldif schema to have correct spacing on newlines (#1184938)
  - Add missing values for sshd test mode (#1187597)
  - ssh-copy-id: tcsh doesnt work with multiline strings (#1201758)
  - Fix memory problems with newkeys and array transfers (#1223218)
  - Enhance AllowGroups documentation in man page (#1150007)


author: Jakub Jelen <jjelen@redhat.com> 6.6.1p1-15 + 0.9.3-9
changelog:
  - One more typo in manual page documenting TERM variable (#1162683)
  - Fix race condition with auditing messages answers (#1240613)


author: Jakub Jelen <jjelen@redhat.com> 6.6.1p1-17 + 0.9.3-9
changelog:
  - Security fixes released with openssh-6.9 (CVE-2015-5352) (#1247864)
   - XSECURITY restrictions bypass under certain conditions in ssh(1) (#1238231)
   - weakness of agent locking (ssh-add -x) to password guessing (#1238238)


author: Jakub Jelen <jjelen@redhat.com> 6.6.1p1-20 + 0.9.3-9
changelog:
  - Fix vulnerabilities published with openssh-7.0 (#1265807)
   - Privilege separation weakness related to PAM support
   - Use-after-free bug related to PAM support


author: Jakub Jelen <jjelen@redhat.com> 6.6.1p1-23 + 0.9.3-9
changelog:
  - Disable undocumented feauture Roaming for good (#1298218)
  - prevents CVE-2016-0777 and CVE-2016-0778


author: Jakub Jelen <jjelen@redhat.com> 6.6.1p1-26 + 0.9.3-9
changelog:
  - Drop glob patch for sftp client preventing listing many files (#1310303)
  - Fix race condition between audit messages from different processes (#1310684)
  - Make systemd service forking to properly report state (#1291172)
  - Get rid of rpm triggers for openssh-5.x (#1312013)
  - Generate the host keys when the key files are empty (#1266043)
  - pam_ssh_agent_auth: authorized_keys_command option (#1317858)
  - Don't use MD5 digest from pam_ssh_agent_auth in FIPS mode (#1317952)


author: Jakub Jelen <jjelen@redhat.com> - 6.6.1p1-27 + 0.9.3-9
changelog:
  - Coverity and RPMDiff build issues (#1334326)
  - CVE-2015-8325: privilege escalation via user's PAM environment and UseLogin=yes (#1329191)
  - Check for real location of .k5login file (#1328243)
  - close ControlPersist background process stderr (#1335540)


author: Jakub Jelen <jjelen@redhat.com> - 6.6.1p1-28 + 0.9.3-9
changelog:
  - SFTP force permission collision with umask (#1344614)
  - Make closefrom() ignore FD's to /dev/ devices on s390 (#1318760)
  - Create a default value for AuthenticationMethods any (#1237129)
  - Fix ssh-copy-id with LogLevel=quiet (#1349556)
  - Expose more information to PAM (#1312304)
  - Move MAX_DISPLAYS to a configuration option (#1341302)
  - Add a wildcard option to PermitOpen directive (host) (#1344106)


author: Jakub Jelen <jjelen@redhat.com> - 7.4p1-1 + 0.10.3-1
changelog:
  - Rebase to openssh 7.4 and pam_ssh_agent_auth 0.10.3 (#1341754)
  - detach -cavs subpackage
  - enable seccomp filter for sandboxed child


author: Jakub Jelen <jjelen@redhat.com> - 7.4p1-2 + 0.10.3-1
changelog:
  - Fix coverity scan results
  - Adjust FIPS algorithms list (#1420910)
  - Revert problematic feature for chroot(#1418062)
  - Fix CBC weakness in released OpenSSH 7.5


author: Jakub Jelen <jjelen@redhat.com> - 7.4p1-3 + 0.10.3-1
changelog:
  - Do not completely disable SHA-1 key exchange methods in FIPS (#1324493)
  - Remove wrong coverity patches


author: Jakub Jelen <jjelen@redhat.com> - 7.4p1-5 + 0.10.3-1
changelog:
  - Fix the default key exchange proposal in FIPS mode (#1438414)
  - Remove another wrong coverity chunk to unbreak gsskex (#1438414)


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.4-2
changelog:
  - Reference authors from the project AUTHORS file instead of listing in description
  - Change Source0 to reference the project's Mercurial repo
  - Cleaned up the summaries and descriptions
  - Incorporate the results of Fedora package self-review


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.4-3
changelog:
  - Include an AUTHORS and license file in each package
  - Change the library package name to pacemaker-libs to be more
    Fedora compliant
  - Remove execute permissions from xml related files
  - Reference the new cluster-glue devel package name
  - Update the tarball from upstream to version c9120a53a6ae
    + High: PE: Only prevent migration if the clone dependancy is stopping/starting on the target node
    + High: PE: Bug 2160 - Dont shuffle clones due to colocation
    + High: PE: New implementation of the resource migration (not stop/start) logic
    + Medium: Tools: crm_resource - Prevent use-of-NULL by requiring a resource name for the -A and -a options
    + Medium: PE: Prevent use-of-NULL in find_first_action()
    + Low: Build: Include licensing files


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.5-0.4.c9120a53a6ae.hg
changelog:
  - Incorporate the feedback from the cluster-glue review
  - Realistically, the version is a 1.0.5 pre-release
  - Use the global directive instead of define for variables
  - Use the haclient/hacluster group/user instead of daemon
  - Use the _configure macro
  - Fix install dependancies


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.5-1
changelog:
  - Add dependancy on resource-agents
  - Use the version of the configure macro that supplies --prefix, --libdir, etc
  - Update the tarball from upstream to version 462f1569a437 (Pacemaker 1.0.5 final)
    + High: Tools: crm_resource - Advertise --move instead of --migrate
    + Medium: Extra: New node connectivity RA that uses system ping and attrd_updater
    + Medium: crmd: Note that dc-deadtime can be used to mask the brokeness of some switches


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.5-2
changelog:
  - Add versioned perl dependancy as specified by
      https://fedoraproject.org/wiki/Packaging/Perl#Packages_that_link_to_libperl
  - No longer remove RPATH data, it prevents us finding libperl.so and no other
    libraries were being hardcoded
  - Compile in support for heartbeat
  - Conditionally add heartbeat-devel and corosynclib-devel to the -devel requirements
    depending on which stacks are supported


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.5-4
changelog:
  - Include the fixes from CoroSync integration testing
  - Move the resource templates - they are not documentation
  - Ensure documentation is placed in a standard location
  - Exclude documentation that is included elsewhere in the package

  - Update the tarball from upstream to version ee19d8e83c2a
    + High: cib: Correctly clean up when both plaintext and tls remote ports are requested
    + High: PE: Bug bnc#515172 - Provide better defaults for lt(e) and gt(e) comparisions
    + High: PE: Bug lf#2197 - Allow master instances placemaker to be influenced by colocation constraints
    + High: PE: Make sure promote/demote pseudo actions are created correctly
    + High: PE: Prevent target-role from promoting more than master-max instances
    + High: ais: Bug lf#2199 - Prevent expected-quorum-votes from being populated with garbage
    + High: ais: Prevent deadlock - dont try to release IPC message if the connection failed
    + High: cib: For validation errors, send back the full CIB so the client can display the errors
    + High: cib: Prevent use-after-free for remote plaintext connections
    + High: crmd: Bug lf#2201 - Prevent use-of-NULL when running heartbeat
    + High: Core: Bug lf#2169 - Allow dtd/schema validation to be disabled
    + High: PE: Bug lf#2106 - Not all anonymous clone children are restarted after configuration change
    + High: PE: Bug lf#2170 - stop-all-resources option had no effect
    + High: PE: Bug lf#2171 - Prevent groups from starting if they depend on a complex resource which cannot
    + High: PE: Disable resource management if stonith-enabled=true and no stonith resources are defined
    + High: PE: Do not include master score if it would prevent allocation
    + High: ais: Avoid excessive load by checking for dead children every 1s (instead of 100ms)
    + High: ais: Bug rh#525589 - Prevent shutdown deadlocks when running on CoroSync
    + High: ais: Gracefully handle changes to the AIS nodeid
    + High: crmd: Bug bnc#527530 - Wait for the transition to complete before leaving S_TRANSITION_ENGINE
    + High: crmd: Prevent use-after-free with LOG_DEBUG_3
    + Medium: xml: Mask the "symmetrical" attribute on rsc_colocation constraints (bnc#540672)
    + Medium (bnc#520707): Tools: crm: new templates ocfs2 and clvm
    + Medium: Build: Invert the disable ais/heartbeat logic so that --without (ais|heartbeat) is available to rpmbuild
    + Medium: PE: Bug lf#2178 - Indicate unmanaged clones
    + Medium: PE: Bug lf#2180 - Include node information for all failed ops
    + Medium: PE: Bug lf#2189 - Incorrect error message when unpacking simple ordering constraint
    + Medium: PE: Correctly log resources that would like to start but cannot
    + Medium: PE: Stop ptest from logging to syslog
    + Medium: ais: Include version details in plugin name
    + Medium: crmd: Requery the resource metadata after every start operation


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.5-5
changelog:
  - Include patch of changeset 66b7bfd467f3:
    Some clients such as gfs_controld want a cluster name, allow one to be specified in corosync.conf


author: Andrew Beekhof <andrew@beekhof.net> - 1.1.1-0.1-60b7753f7310.hg
changelog:
  - Update the tarball from upstream to version 60b7753f7310
    + First public release of the 1.1 series


author: Andrew Beekhof <andrew@beekhof.net> - 1.1.2-1
changelog:
  - Update the tarball from the upstream 1.1.2 release
    + High: ais: Bug lf#2340 - Force rogue child processes to terminate after waiting 2.5 minutes
    + High: ais: Bug lf#2359 - Default expected votes to 2 inside Corosync/OpenAIS plugin
    + High: ais: Bug lf#2359 - expected-quorum-votes not correctly updated after membership change
    + High: ais: Bug rhbz#525552 - Move non-threadsafe calls to setenv() to after the fork()
    + High: ais: Do not count votes from offline nodes and calculate current votes before sending quorum data
    + High: ais: Ensure the list of active processes sent to clients is always up-to-date
    + High: ais: Fix previous commit, actually return a result in get_process_list()
    + High: ais: Fix two more uses of getpwnam() in non-thread-safe locations
    + High: ais: Look for the correct conf variable for turning on file logging
    + High: ais: Need to find a better and thread-safe way to set core_uses_pid. Disable for now.
    + High: ais: Use the threadsafe version of getpwnam
    + High: Core: Bug lf#2414 - Prevent use-after-free reported by valgrind when doing xpath based deletions
    + High: Core: Bump the feature set due to the new failcount expiry feature
    + High: Core: Fix memory leak in replace_xml_child() reported by valgrind
    + High: Core: fix memory leaks exposed by valgrind
    + High: crmd: Bug 2401 - Improved detection of partially active peers
    + High: crmd: Bug bnc#578644 - Improve handling of cancelled operations caused by resource cleanup
    + High: crmd: Bug lf#2379 - Ensure the cluster terminates when the PE is not available
    + High: crmd: Bug lf#2414 - Prevent use-after-free of the PE connection after it dies
    + High: crmd: Bug lf#2414 - Prevent use-after-free of the stonith-ng connection
    + High: crmd: Do not allow the target_rc to be misused by resource agents
    + High: crmd: Do not ignore action timeouts based on FSA state
    + High: crmd: Ensure we dont get stuck in S_PENDING if we loose an election to someone that never talks to us again
    + High: crmd: Fix memory leaks exposed by valgrind
    + High: crmd: Remove race condition that could lead to multiple instances of a clone being active on a machine
    + High: crmd: Send erase_status_tag() calls to the local CIB when the DC is fenced, since there is no DC to accept them
    + High: crmd: Use global fencing notifications to prevent secondary fencing operations of the DC
    + High: fencing: Account for stonith_get_info() always returning a pointer to the same static buffer
    + High: PE: Allow startup probes to be disabled - their calculation is a major bottleneck for very large clusters
    + High: PE: Bug lf#2317 - Avoid needless restart of primitive depending on a clone
    + High: PE: Bug lf#2358 - Fix master-master anti-colocation
    + High: PE: Bug lf#2361 - Ensure clones observe mandatory ordering constraints if the LHS is unrunnable
    + High: PE: Bug lf#2383 - Combine failcounts for all instances of an anonymous clone on a host
    + High: PE: Bug lf#2384 - Fix intra-set colocation and ordering
    + High: PE: Bug lf#2403 - Enforce mandatory promotion (colocation) constraints
    + High: PE: Bug lf#2412 - Correctly locate clone instances by their prefix
    + High: PE: Correctly implement optional colocation between primitives and clone resources
    + High: PE: Do not be so quick to pull the trigger on nodes that are coming up
    + High: PE: Fix memory leaks exposed by valgrind
    + High: PE: Fix memory leaks reported by valgrind
    + High: PE: Repair handling of unordered groups in RHS ordering constraints
    + High: PE: Rewrite native_merge_weights() to avoid Fix use-after-free
    + High: PE: Suppress duplicate ordering constraints to achieve orders of magnitude speed increases for large clusters
    + High: Shell: add support for xml in cli
    + High: Shell: always reload status if working with the cluster (bnc#590035)
    + High: Shell: check timeouts also against the default-action-timeout property
    + High: Shell: Default to using the status section from the live CIB (bnc#592762)
    + High: Shell: edit multiple meta_attributes sets in resource management (lf#2315)
    + High: Shell: enable comments (lf#2221)
    + High: Shell: implement new cibstatus interface and commands (bnc#580492)
    + High: Shell: improve configure commit (lf#2336)
    + High: Shell: new cibstatus import command (bnc#585471)
    + High: Shell: new configure filter command
    + High: Shell: restore error reporting in options
    + High: Shell: split shell into modules
    + High: Shell: support for the utilization element (old patch for the new structure)
    + High: Shell: update previous node lookup procedure to include the id where necessary
    + High: Tools: crm_mon - fix memory leaks exposed by valgrind


author: Andrew Beekhof <andrew@beekhof.net> - 1.1.2-2
changelog:
  - Resolves rhbz#602239 - Added patch to documentation so that it passes validation
  - High: Core: Bug lf#2401 - Backed out changeset 6e6980376f01


author: Andrew Beekhof <andrew@beekhof.net> - 1.1.3-0.1-b3cb4f4a30ae.hg
changelog:
  - Pre-release version of 1.1.3
    + High: ais: Bug lf2401 - Improved processing when the peer crmd processes join/leave
    + High: ais: fix list of active processes sent to clients (bnc#603685)
    + High: ais: Move the code for finding uid before the fork so that the child does no logging
    + High: ais: Resolve coverity CONSTANT_EXPRESSION_RESULT defects
    + High: cib: Also free query result for xpath operations that return more than one hit
    + High: cib: Attempt to resolve memory corruption when forking a child to write the cib to disk
    + High: cib: Correctly free memory when writing out the cib to disk
    + High: cib: Fix the application of unversioned diffs
    + High: cib: Remove old developmental error logging
    + High: cib: Restructure the 'valid peer' check for deciding which instructions to ignore
    + High: Core: Bug lf#2401 - Backed out changeset 6e6980376f01
    + High: Core: Correctly unpack HA_Messages containing multiple entries with the same name
    + High: Core: crm_count_member() should only track nodes that have the full stack up
    + High: Core: New developmental logging system inspired by the kernel and a PoC from Lars Ellenberg
    + High: crmd: All nodes should see status updates, not just he DC
    + High: crmd: Allow non-DC nodes to clear failcounts too
    + High: crmd: Base DC election on process relative uptime
    + High: crmd: Bug lf#2439 - cancel_op() can also return HA_RSCBUSY
    + High: crmd: Bug lf#2439 - Handle asynchronous notification of resource deletion events
    + High: crmd: Fix assertion failure when performing async resource failures
    + High: crmd: Fix handling of async resource deletion results
    + High: crmd: Include the action for crm graph operations
    + High: crmd: Make sure the membership cache is accurate after a sucessful fencing operation
    + High: crmd: Make sure we always poke the FSA after a transition to clear any TE_HALT actions
    + High: crmd: Offer crm-level membership once the peer starts the crmd process
    + High: crmd: Only need to request quorum update for plugin based clusters
    + High: crmd: Prevent everyone from loosing DC elections by correctly initializing all relevant variables
    + High: crmd: Prevent segmentation fault
    + High: crmd: several fixes for async resource delete
    + High: mcp: Add missing headers when built without heartbeat support
    + High: mcp: New master control process for (re)spawning pacemaker daemons
    + High: PE: Avoid creating invalid ordering constraints for probes that are not needed
    + High: PE: Bug lf#1959 - Fail unmanaged resources should not prevent other services from shutting down
    + High: PE: Bug lf#2422 - Ordering dependencies on partially active groups not observed properly
    + High: PE: Bug lf#2424 - Use notify oepration definition if it exists in the configuration
    + High: PE: Bug lf#2433 - No services should be stopped until probes finish
    + High: PE: Bug lf#2453 - Enforce clone ordering in the absense of colocation constraints
    + High: PE: Correctly detect when there is a real failcount that expired and needs to be cleared
    + High: PE: Correctly handle pseudo action creation
    + High: PE: Correctly order clone startup after group/clone start
    + High: PE: Fix colocation for interleaved clones
    + High: PE: Fix colocation with partially active groups
    + High: PE: Fix potential use-after-free defect from coverity
    + High: PE: Fix previous merge
    + High: PE: Fix use-after-free in order_actions() reported by valgrind
    + High: PE: Prevent endless loop when looking for operation definitions in the configuration
    + High: Resolve coverity RESOURCE_LEAK defects
    + High: Shell: Complete the transition to using crm_attribute instead of crm_failcount and crm_standby
    + High: stonith: Advertise stonith-ng options in the metadata
    + High: stonith: Correctly parse pcmk_host_list parameters that appear on a single line
    + High: stonith: Map poweron/poweroff back to on/off expected by the stonith tool from cluster-glue
    + High: stonith: pass the configuration to the stonith program via environment variables (bnc#620781)
    + High: Support starting plugin-based Pacemaker clusters with the MCP as well
    + High: tools: crm_report - corosync.conf wont necessarily contain the text 'pacemaker' anymore
    + High: tools: crm_simulate - Resolve coverity USE_AFTER_FREE defect
    + High: Tools: Drop the 'pingd' daemon and resource agent in favor of ocf:pacemaker:ping
    + High: Tools: Fix recently introduced use-of-NULL
    + High: Tools: Fix use-after-free defect from coverity


author: Andrew Beekhof <andrew@beekhof.net> - 1.1.3-1
changelog:
  - Upstream release of 1.1.3
    + High: crmd: Use the correct define/size for lrm resource IDs
    + High: crmd: Bug lf#2458 - Ensure stop actions always have the relevant resource attributes
    + High: crmd: Ensure we activate the DC timer if we detect an alternate DC
    + High: mcp: Correctly initialize the string containing the list of active daemons
    + High: mcp: Fix the expansion of the pid file in the init script
    + High: mcp: Tell chkconfig we need to shut down early on
    + High: PE: Bug lf#2476 - Repair on-fail=block for groups and primitive resources
    + High: PE: Do not demote resources because something that requires it can't run
    + High: PE: Rewrite the ordering constraint logic to be simplicity, clarity and maintainability
    + High: PE: Wait until stonith is available, don't fall back to shutdown for nodes requesting termination
    + High: PE: Prevent segfault by ensuring the arguments to do_calculations() are initialized
    + High: stonith: Bug lf#2461 - Prevent segfault by not looking up operations if the hashtable hasn't been initialized yet
    + High: Stonith: Bug lf#2473 - Ensure stonith operations complete within the timeout and are terminated if they run too long
    + High: stonith: Bug lf#2473 - Gracefully handle remote operations that arrive late (after we've done notifications)
    + High: stonith: Bug lf#2473 - Add the timeout at the top level where the daemon is looking for it
    + High: stonith: Bug lf#2473 - Ensure timeouts are included for fencing operations
    + High: Stonith: Use the timeout specified by the user
    + High: Tools: Bug lf#2456 - Fix assertion failure in crm_resource


author: Andrew Beekhof <andrew@beekhof.net> 1.1.4-1
changelog:
  - Upstream release of 1.1.4
  - See included ChangeLog file or http://hg.clusterlabs.org/pacemaker/1.1/file/tip/ChangeLog for details


author: Andrew Beekhof <andrew@beekhof.net> 1.1.6-1
changelog:
  - Upstream release of 1.1.6
  - See included ChangeLog file or http://hg.clusterlabs.org/pacemaker/1.1/file/tip/ChangeLog for details

  - Disabled eSMTP and SNMP support.  Painful to configure and rarely used.
  - Created cli sub-package for non-cluster usage


author: Andrew Beekhof <andrew@beekhof.net> 1.1.6-2
changelog:
  - Do not build in support for heartbeat, snmp, esmtp by default
  - Create a package for cluster unaware libraries to minimze our
    footprint on non-cluster nodes
  - Better package descriptions


author: Andrew Beekhof <andrew@beekhof.net> 1.1.7-0.1-bc7c125.git
changelog:
  - New upstream tarball: bc7c125
  - Pre-release 1.1.7 build to deal with the removal of cman and support for corosync plugins
  - Add libqb as a dependancy


author: Andrew Beekhof <andrew@beekhof.net> 1.1.7-0.3-7742926.git
changelog:
  - New upstream tarball: 7742926
  - Additional Provides and Obsoletes directives to enable upgrading from heartbeat
  - Rebuild now that the Corosync CFG API has been removed


author: Andrew Beekhof <andrew@beekhof.net> Pacemaker-1.1.7-1
changelog:
  - Update source tarball to upstream release: Pacemaker-1.1.7
  - See included ChangeLog file or https://raw.github.com/ClusterLabs/pacemaker/master/ChangeLog for details


author: Andrew Beekhof <andrew@beekhof.net> 1.1.8-1
changelog:
  - Rebuild for upstream 1.1.8 release
  - Documentation disabled pending a functional publican/ImageMagick combination

  - Statistics:
    Changesets: 1019
    Diff:       2107 files changed, 117258 insertions(+), 73606 deletions(-)

  - See included ChangeLog file or https://raw.github.com/ClusterLabs/pacemaker/master/ChangeLog for full details

    + New IPC implementation from libqb
    + New logging implementation from libqb
    + Quieter - info, debug and trace logs are no longer sent to syslog
    + Dropped dependancy on cluster-glue
    + Config and core directories no longer located in heartbeat directories
    + Support for managing systemd services
    + Rewritten local resource management daemon
    + Version bumps for every shared library due to API cleanups
    + Removes crm shell, install/use pcs shell and GUI instead


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.8-4
changelog:
  - Update for new upstream tarball: 5db5f53

    + High: mcp: Re-attach to existing pacemaker components when pacemakerd fails
    + High: pengine: cl#5111 - When clone/master child rsc has on-fail=stop, insure all children stop on failure.
    + High: Replace the use of the insecure mktemp(3) with mkstemp(3)
    + High: Core: Correctly process XML diff's involving element removal
    + High: PE: Correctly unpack active anonymous clones
    + High: PE: Fix clone_zero() and clone_strip() for single character resource names
    + High: IPC: Bug cl#5110 - Prevent 100% CPU usage when looking for synchronous replies
    + High: PE: Bug cl#5101 - Ensure stop order is preserved for partially active groups
    + High: fencing: On failure, only try a topology device once from the remote level.
    + High: fencing: Retry stonith device for duration of action's timeout period.
    + High: PE: Fix memory leak on processing message (bnc#780224)
    + High: fencing: Support 'on_target' option in fencing device metadata for forcing unfence on target node
    + High: PE: Support resources that require unfencing before start
    + High: PE: Support a 'requires' resource meta-attribute for controlling whether it needs quorum, fencing or nothing
    + High: mcp: Only define HA_DEBUGLOG to avoid agent calls to ocf_log printing everything twice
    + High: fencing: Do not start fencing until entire device topology is found or query results timeout.
    + High: Cluster: Allow cman and corosync 2.0 nodes to use a name other than uname()


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-1
changelog:
  - Update for new upstream tarball: Pacemaker-1.1.10-rc1
  - Features added since Pacemaker-1.1.8
    + Performance enhancements for supporting 16 node clusters
    + corosync: Use queues to avoid blocking when sending CPG messages
    + ipc: Compress messages that exceed the configured IPC message limit
    + ipc: Use queues to prevent slow clients from blocking the server
    + ipc: Use shared memory by default
    + lrmd: Support nagios remote monitoring
    + lrmd: Pacemaker Remote Daemon for extending pacemaker functionality outside corosync cluster.
    + pengine: Check for master/slave resources that are not OCF agents
    + pengine: Support a 'requires' resource meta-attribute for controlling whether it needs quorum, fencing or nothing
    + pengine: Support for resource containers
    + pengine: Support resources that require unfencing before start

  - Changes since Pacemaker-1.1.8
    + attrd: Correctly handle deletion of non-existant attributes
    + Bug cl#5135 - Improved detection of the active cluster type
    + Bug rhbz#913093 - Use crm_node instead of uname
    + cib: Prevent ordering changes when applying xml diffs
    + cib: Remove text nodes from cib replace operations
    + crmd: Prevent election storms caused by getrusage() values being too close
    + date/time: Bug cl#5118 - Correctly convert seconds-since-epoch to the current time
    + fencing: Attempt to provide more information that just 'generic error' for failed actions
    + fencing: Correctly record completed but previously unknown fencing operations
    + fencing: Correctly terminate when all device options have been exhausted
    + fencing: cov#739453 - String not null terminated
    + fencing: Do not merge new fencing requests with stale ones from dead nodes
    + fencing: Do not start fencing until entire device topology is found or query results timeout.
    + fencing: Do not wait for the query timeout if all replies have arrived
    + fencing: Fix passing of parameters from CMAN containing '='
    + fencing: Fix non-comparison when sorting devices by priority
    + fencing: On failure, only try a topology device once from the remote level.
    + fencing: Only try peers for non-topology based operations once
    + fencing: Retry stonith device for duration of action's timeout period.
    + ipc: Bug cl#5110 - Prevent 100% CPU usage when looking for synchronous replies
    + mcp: Re-attach to existing pacemaker components when mcp fails
    + pengine: Any location constraint for the slave role applies to all roles
    + pengine: Bug cl#5101 - Ensure stop order is preserved for partially active groups
    + pengine: Bug cl#5140 - Allow set members to be stopped when the subseqent set has require-all=false
    + pengine: Bug cl#5143 - Prevent shuffling of anonymous master/slave instances
    + pengine: Bug rhbz#880249 - Ensure orphan masters are demoted before being stopped
    + pengine: Bug rhbz#880249 - Teach the PE how to recover masters into primitives
    + pengine: cl#5025 - Automatically clear failcount for start/monitor failures after resource parameters change
    + pengine: cl#5099 - Probe operation uses the timeout value from the minimum interval monitor by default (#bnc776386)
    + pengine: cl#5111 - When clone/master child rsc has on-fail=stop, insure all children stop on failure.
    + pengine: cl#5142 - Do not delete orphaned children of an anonymous clone
    + pengine: Correctly unpack active anonymous clones
    + pengine: Ensure previous migrations are closed out before attempting another one
    + pengine: rhbz#902459 - Remove rsc node status for orphan resources
    + Replace the use of the insecure mktemp(3) with mkstemp(3)


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-2
changelog:
  - Update for new upstream tarball: Pacemaker-1.1.10-rc4

  - Features in Pacemaker-1.1.10-rc4:
    + PE: Display a list of nodes on which stopped anonymous clones are not active instead of meaningless clone IDs
    + crm_error: Add the ability to list and print error symbols
    + crm_resource: Implement --ban for moving resources away from nodes and --clear (replaces --unmove)
    + crm_resource: Support OCF tracing when using --force-(check|start|stop)

  - Changes since Pacemaker-1.1.10-rc1

    + Bug cl#5133 - pengine: Correctly observe on-fail=block for failed demote operation
    + Bug cl#5152 - Correctly clean up fenced nodes during membership changes
    + Bug cl#5153 - Correctly display clone failcounts in crm_mon
    + Bug cl#5154 - Do not expire failures when on-fail=block is present
    + Bug pengine: cl#5155 - Block the stop of resources if any depending resource is unmanaged
    + crm_report: Correctly collect logs when 'uname -n' reports fully qualified names
    + Check for and replace non-printing characters with their octal equivalent while exporting xml text
    + Convert all exit codes to positive errno values
    + Core: Ensure the blackbox is saved on abnormal program termination
    + corosync: Detect the loss of members for which we only know the nodeid
    + corosync: Nodes that can persist in sending CPG messages must be alive afterall
    + crmd: Do not get stuck in S_POLICY_ENGINE if a node we couldn't fence returns
    + crmd: Ensure all membership operations can complete while trying to cancel a transition
    + crmd: Everyone who gets a fencing notification should mark the node as down
    + crmd: Initiate node shutdown if another node claims to have successfully fenced us
    + crm_resource: Gracefully fail when --force-* is attempted for stonith resources
    + fencing: Restore the ability to manually confirm that fencing completed
    + pengine: Correctly handle resources that recover before we operate on them
    + pengine: Ensure per-node resource parameters are used during probes
    + pengine: Implement the rest of get_timet_now() and rename to get_effective_time
    + pengine: Mark unrunnable stop actions as "blocked"
    + pengine: Re-initiate active recurring monitors that previously failed but have timed out
    + xml: Restore the ability to embed comments in the cib


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-3
changelog:
  - Update to upstream 838e41e

    + Feature: pengine: Allow active nodes in our current membership to be fenced without quorum
    + Fix: attrd: Fixes deleted attributes during dc election
    + Fix: corosync: Fall back to uname for local nodes
    + Fix: crm_report: Find logs in compressed files
    + Fix: pengine: If fencing is unavailable or disabled, block further recovery for resources that fail to stop
    + Fix: systemd: Ensure we get shut down correctly by systemd


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-5
changelog:
  - Streamline spec file

  - Upstream patch for:
    + cman: Only build migration tools for targets that may use them
    + cib: Ensure we set up hacluster's groups in stand-alone mode

  - Update for new upstream tarball: Pacemaker-1.1.10-rc7

    + Bug cl#5157 - Allow migration in the absence of some colocation constraints
    + Bug cl#5168 - Prevent clones from being bounced around the cluster due to location constraints
    + Bug cl#5170 - Correctly support on-fail=block for clones
    + crmd: CID#1036761 Dereference null return value
    + crmd: cl#5164 - Fixes crmd crash when using pacemaker-remote
    + crmd: Ensure operations for cleaned up resources don't block recovery
    + crmd: Prevent messages for remote crmd clients from being relayed to wrong daemons
    + crmd: Properly handle recurring monitor operations for remote-node agent
    + fencing: Correctly detect existing device entries when registering a new one
    + logging: If SIGTRAP is sent before tracing is turned on, turn it on
    + lrmd: Prevent use-of-NULL in client library
    + pengine: cl#5128 - Support maintenance mode for a single node
    + pengine: cl#5164 - Pengine segfault when calculating transition with remote-nodes.
    + pengine: Do the right thing when admins specify the internal resource instead of the clone
    + systemd: Turn off auto-respawning of systemd services when the cluster starts them


author: Andrew Beekhof <andrew@beekhof.net> Pacemaker-1.1.10-6
changelog:
  - Update source tarball to revision: 368c726 (Pacemaker-1.1.10-rc7)
  - Changesets: 18
  - Diff:       9 files changed, 245 insertions(+), 170 deletions(-)

  - Features added since Pacemaker-1.1.10-rc7
    + crm_resource: Allow options to be set recursively

  - Changes since Pacemaker-1.1.10-rc7
    + Bug cl#5161 - crmd: Prevent memory leak in operation cache
    + cib: Correctly read back archived configurations if the primary is corrupted


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-10
changelog:
  + Fix: pengine: Do not re-allocate clone instances that are blocked in the Stopped state
    + Fix: pengine: Do not allow colocation with blocked clone instances


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-11
changelog:
  + Fix: systemd: Prevent glib assertion - only call g_error_free() with non-NULL arguments
    + Fix: systemd: Prevent additional assertions in g_error_free
    + Fix: logging: glib CRIT messages should not produce core files by default
    + Doc: controld: Update the description
    + Fix: pengine: Correctly account for the location preferences of things colocated with a group
    + Fix: cib: Correctly log short-form xml diffs
    + Fix: crmd: Correcty update the history cache when recurring ops change their return code
    + Log: pengine: Better indicate when a resource has failed
    + Log: crm_mon: Unmunge the output for failed operations


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-13
changelog:
  + Fencing: Support agents that need the host to be unfenced at startup
      Resolves: rhbz#996576
    + crm_report: Collect corosync quorum data
      Resolves: rhbz#839342


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-14
changelog:
  + Fix: xml: Location constraints are allowed to specify a role
    + Bug rhbz#902407 - crm_resource: Handle --ban for master/slave resources as advertised
      Resolves: rhbz#902407


author: David Vossel <dvossel@redhat.com> - 1.1.10-15
changelog:
  + Fix: crmd: Allow transient attributes to be set on remote-nodes.
    + Fix: pengine: Handle orphaned remote-nodes properly
    + Low: cts: Add RemoteLXC regression test.

    Resolves: rhbz#1006465
    Resolves: rhbz#1006471


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-16
changelog:
  - Remove unsupported resource agent
  - Log: crmd: Supply arguments in the correct order
  - Fix: crm_report: Correctly redirect error message to /dev/null
  - Fix: Bug rhbz#1011618 - Consistently use 'Slave' as the role for unpromoted master/slave resources
  - Fix: pengine: Location constraints with role=Started should prevent masters from running at all
  - Fix: crm_resource: Observe --master modifier for --move
  - Provide a meaningful error if --master is used for primitives and groups
  - Fix: Fencing: Observe pcmk_host_list during automatic unfencing
      Resolves: rhbz#996576


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-17
changelog:
  Resolves: rhbz#720543

  - Fix: core: Do not enabled blackbox for cli tools
  - Fix: Command-line tools should stop after an assertion failure
  - Fix: crmd: Dont add node_state to cib, if we have not seen or fenced this node yet
  - Fix: crmd: Correctly update expected state when the previous DC shuts down
  - Fix: crmd: Cache rsc_info retrieved from lrmd and pacemaker_remoted
  - Fix: crmd: Pad internal lrmd rsc_info and metadata retrieval timeout
  - Fix: crm_attribute: Detect orphaned remote-nodes when setting attributes
  - Fix: crm_mon: Prevent use-of-NULL when ping resources do not define a host list
  - Fix: crm_report: Record the output of the collector
  - Fix: crm_report: Do not print garbage when collecting from the local node
  - Fix: crm_resource: Wait for all replies when cleaning up resources
  - Fix: fencing: Do not broadcast suicide if the on action is being executed
  - Fix: fencing: Allow fencing for node after topology entries are deleted
  - Fix: fencing: Deep copy current topology level list on remote op
  - Fix: lrmd: Correctly cancel monitor actions for lsb/systemd/service resources on cleaning up
  - Fix: pengine: Dont prevent clones from running due to dependant resources
  - Fix: pengine: Probe containers not expected to be up
  - Fix: ipc: Raise the default buffer size to 128k
  - Fix: ipc: Use the higher of the configured buffer size or the default
  - Fix: iso8601: Prevent dates from jumping backwards a day in some timezones
  - Fix: remote: Properly version the remote connection protocol
  - Fix: remote: Handle endian changes between client and server and improve forward compatibility
      Resolves: rhbz#720543


author: David Vossel <dvossel@redhat.com> - 1.1.10-19
changelog:
  - Fix: controld: Use the correct variant of dlm_controld for
    corosync-2 clusters

      Resolves: rhbz#1028627


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-20
changelog:
  - Fix: tools: Fixes formatting of remote-nodes in crm_mon and crm_simulate
  - Fix: Corosync: Attempt to retrieve a peers node name if it is not already known
      Resolves: rhbz#720543


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-23
changelog:
  - mcp: Tell systemd not to respawn us if we return 100
  - services: Detect missing agents and permission errors before forking
  - Use native DBus library for systemd support to avoid problematic use of threads
      Resolves: rhbz#720543 (aka. 1057697)


author: David Vossel <dvossel@redhat.com> - 1.1.10-24
changelog:
  - controld: handling startup fencing within the controld agent, not the dlm
      Resolves: rhbz#1064519
  - controld: Do not consider the dlm up until the address list is present
      Resolves: rhbz#1067536


author: David Vossel <dvossel@redhat.com> - 1.1.10-25
changelog:
  - pengine: cl#5187 - Prevent resources in an anti-colocation from even temporarily running on a same node
      Resolves: rhbz#1069284


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-26
changelog:
  - Run automated regression tests after every build
  - Fencing: Send details of stonith_api_time() and stonith_api_kick() to syslog
  - Fencing: Pass the correct options when looking up the history by node name
  - Fencing: stonith_api_time_helper now returns when the most recent fencing operation completed
  - crm_report: Additional dlm detail if dlm_controld is running
  - crmd: Gracefully handle actions that cannot be initiated
  - pengine: Gracefully handle bad values for XML_ATTR_TRANSITION_MAGIC
      Resolves: rhbz#1070916


author: Andrew Beekhof <beekhof@redhat.com> - 1.1.10-27
changelog:
  - crm_resource: Prevent use-of-NULL
  - systemd: Prevent use-of-NULL when determining if an agent exists
  - Fencing: Remove shadow definition and use of variable 'progress'
      Resolves: rhbz#1070916


author: David Vossel <dvossel@redhat.com> - 1.1.10-28
changelog:
  - pengine: fixes invalid transition caused by clones with more than 10 instances
      Resolves: rhbz#1078504


author: Andrew Beekhof <abeekhof@redhat.com> 1.1.10-30
changelog:
  - crmd: Do not erase the status section for unfenced nodes
  - crmd: Correctly react to successful unfencing operations
  - crmd: Report unsuccessful unfencing operations
  - crmd: Do not overwrite existing node state when fencing completes
  - fencing: Correctly record which peer performed the fencing operation
  - fencing: Automatically switch from 'list' to 'status' to 'static-list' if those actions are not advertised in the metadata
  - fencing: Filter self-fencing at the peers to allow unfencing to work correctly
  - pengine: Automatically re-unfence a node if the fencing device definition changes
  - pengine: Fencing devices default to only requiring quorum in order to start
  - pengine: Delay unfencing until after we know the state of all resources that require unfencing
  - pengine: Ensure unfencing occurs before fencing devices are (re-)probed
  - pengine: Ensure unfencing only happens once, even if the transition is interrupted
  - pengine: Do not unfence nodes that are offline, unclean or shutting down
  - pengine: Unfencing is based on device probes, there is no need to unfence when normal resources are found active
  - logging: daemons always get a log file, unless explicitly set to configured 'none'
  - lrmd: Expose logging variables expected by OCF agents
  - crm_report: Suppress logging errors after the target directory has been compressed
  - crm_resource: Wait for the correct number of replies when cleaning up resources
      Resolves: rhbz#1078078


author: David Vossel <dvossel@redhat.com> - 1.1.10-31
changelog:
  - fencing: Fence using all required devices
  - fencing: Execute all required fencing devices regardless of what topology level they are at
  - fencing: default to 'off' when agent does not advertise 'reboot' in metadata
      Resolves: rhbz#1078078


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-32
changelog:
  - Fix: lrmd: Handle systemd reporting 'done' before a resource is actually stopped
      Resolves: rhbz#1111747


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.12-5
changelog:
  - Update patch level to upstream 031e46c
    - Prevent glib assert triggered by timers being removed from mainloop more than once 
    - Allow rsc discovery to be disabled in certain situations
    - Allow remote-nodes to be placed in maintenance mode
    - Improved sbd integration


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.12-9
changelog:
  - Update patch level to upstream fb94901
  - Prevent blocking by performing systemd reloads asynchronously


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.12-10
changelog:
  - Update patch level to upstream 98b6688
  - Support an intelligent resource restart operation
  - Exclusive discovery implies running the resource is only possible on the listed nodes


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.12-11
changelog:
  - Update patch level to upstream 7dd9022
  - Ensure all internal caches are updated when nodes are removed from the cluster
    Resolves: rhbz#1162727


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.12-13
changelog:
  - Update patch level to upstream a433de6
  - Ensure we wait for long running systemd stop operations to complete
    Resolves: rhbz#1165423


author: David Vossel <dvossel@redhat.com> - 1.1.12-18
changelog:
  - clone order constraint require-all option.
  - fix memory leaks in crmd and pacemakerd

    Resolves: rhbz#1176210


author: David Vossel <dvossel@redhat.com> - 1.1.12-19
changelog:
  - Imply stop on actions within containers during host fencing
  - acl correctly implement the reference acl direct

    Resolves: rhbz#1117341


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.14-11
changelog:
  - Rebase to upstream 2cccd43d6b7f2525d406251e14ef37626e29c51f (1.1.14+)
  - Resolves: rhbz#1304771
    Resolves: rhbz#1207388
    Resolves: rhbz#1240330
    Resolves: rhbz#1281450
    Resolves: rhbz#1284069
    Resolves: rhbz#1286316
    Resolves: rhbz#1287315
    Resolves: rhbz#1287868
    Resolves: rhbz#1288929
    Resolves: rhbz#1303765
  - This also updates the packaging to follow upstream more closely,
    most importantly moving some files from the pacemaker package to
    pacemaker-cli (including XML schemas, SNMP MIB, attrd_updater command,
    most ocf:pacemaker resource agents, and related man pages),
    and deploying /etc/sysconfig/crm_mon.


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.15-1
changelog:
  - Rebase to upstream 2c148ac30dfcc2cfb91dc367ed469b6f227a8abc (1.1.15-rc3+)
  - Resolves: rhbz#1304771
    Resolves: rhbz#1040685
    Resolves: rhbz#1219188
    Resolves: rhbz#1235434
    Resolves: rhbz#1268313
    Resolves: rhbz#1284069
    Resolves: rhbz#1287868
    Resolves: rhbz#1288929
    Resolves: rhbz#1312094
    Resolves: rhbz#1314157
    Resolves: rhbz#1321711
    Resolves: rhbz#1338623


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.15-2
changelog:
  - Rebase to upstream 25920dbdbc7594fc944a963036996f724c63a8b8 (1.1.15-rc4)
  - Resolves: rhbz#1304771
    Resolves: rhbz#773656
    Resolves: rhbz#1240330
    Resolves: rhbz#1281450
    Resolves: rhbz#1286316
    Resolves: rhbz#1287315
    Resolves: rhbz#1323544


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.15-3
changelog:
  - Rebase to upstream e174ec84857e087210b9dacee3318f8203176129 (1.1.15)
  - Resolves: rhbz#1304771
    Resolves: rhbz#1303765
    Resolves: rhbz#1327469
    Resolves: rhbz#1337688
    Resolves: rhbz#1345876
    Resolves: rhbz#1346726


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.15-8
changelog:
  - Quote timestamp-format correctly in alert_snmp.sh.sample
  - Unregister CIB callbacks correctly
  - Print resources section heading consistently in crm_mon output
  - Resolves: rhbz#773656
  - Resolves: rhbz#1361533


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.15-10
changelog:
  - Only clear remote node operation history on startup
  - Resend a lost shutdown request
  - Correctly detect and report invalid configurations
  - Don't include manual page for resource agent that isn't included
  - Resolves: rhbz#1288929
  - Resolves: rhbz#1310486
  - Resolves: rhbz#1352039


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.15-11
changelog:
  - Sanitize readable CIB output collected by crm_report
  - Document crm_report --sos-mode option
  - Speed up crm_report on Pacemaker Remote nodes
  - Avoid sbd fencing when upgrading pacemaker_remote package
  - Resolves: rhbz#1219188
  - Resolves: rhbz#1235434
  - Resolves: rhbz#1323544
  - Resolves: rhbz#1372009


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.16-1
changelog:
  - Rebase to upstream 94ff4df51a55cc30d01843ea11b3292bac755432 (1.1.16)
  - Resolves: rhbz#1374777
  - Resolves: rhbz#1378817
  - Resolves: rhbz#1410886


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.16-2
changelog:
  - Avoid grep crashes in crm_report when looking for system logs
  - Properly ignore version with crm_diff --no-version
  - Process guest node fencing properly
  - Ensure filename is valid before using
  - Build for ppc64le
  - Resolves: rhbz#1288261
  - Resolves: rhbz#1289662
  - Resolves: rhbz#1383462
  - Resolves: rhbz#1405635
  - Resolves: rhbz#1412309


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.16-3
changelog:
  - Avoid hang when shutting down unmanaged remote node connections
  - Get correct node name when crm_node or crm_attribute is run on remote node
  - Ignore action when configured as a stonith device parameter
  - Include recent upstream bug fixes
  - Resolves: rhbz#1388489
  - Resolves: rhbz#1410886
  - Resolves: rhbz#1417936
  - Resolves: rhbz#1421700


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.16-4
changelog:
  - Add support for container bundles
  - Treat systemd reloading state as monitor success
  - Resolves: rhbz#1432722
  - Resolves: rhbz#1436696


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.16-5
changelog:
  - Keep man pages compressed
  - Bugfixes for container bundles
  - Resolves: rhbz#1410886
  - Resolves: rhbz#1432722


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.16-7
changelog:
  - Avoid fencing old DC if it is shutting down while another node is joining
  - Improve crmd's handling of repeated fencing failures
  - Correct behavior when guest created by bundle has a node attribute
  - Show Red Hat bugzilla URL rather than upstream when generating cluster report
  - Resolves: rhbz#1430112
  - Resolves: rhbz#1432722


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.16-9
changelog:
  - Allow cleanup of guest nodes when guest is unmanaged
  - Allow bundles to run on Pacemaker Remote nodes
  - Handle slow IPC clients better
  - Update crmd throttle information when CPUs are hot-plugged in
  - Order pacemaker systemd unit after resource-agents-deps target
  - Resolves: rhbz#1303742
  - Resolves: rhbz#1432722
  - Resolves: rhbz#1435067
  - Resolves: rhbz#1444728
  - Resolves: rhbz#1446669


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.16-10
changelog:
  - Fix issues when running bundles on Pacemaker Remote nodes
  - Reap orphaned processes when running Pacemaker Remote as pid 1
  - Order remote actions after remote connection recovery
    (fixes regression in RHEL 7.3)
  - Avoid local resource manager daemon (lrmd) crash when an
    in-flight systemd operation is cancelled
  - Resolves: rhbz#1432722
  - Resolves: rhbz#1441603
  - Resolves: rhbz#1448772
  - Resolves: rhbz#1451170


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.16-12.1
changelog:
  - Add cluster-ipc-limit option to avoid CIB eviction in large clusters
  - Implement ordering constraints involving bundles
  - Always re-check resource placement after quorum loss
  - Avoid stonithd crash when disabling fence device with queued actions
  - Allow re-enabled fence devices to be used
  - Resolves: rhbz#1478298
  - Resolves: rhbz#1481139
  - Resolves: rhbz#1481140
  - Resolves: rhbz#1481141
  - Resolves: rhbz#1481142


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.0-2
changelog:
  - Bugzilla Bug #668839 - Review Request: pki-core
  -   Added component versioning comments
  -   Updated JSS from "4.2.6-10" to "4.2.6-12"
  -   Modified installation section to preserve timestamps
  -   Removed sectional comments


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.0-3
changelog:
  - Bugzilla Bug #668839 - Review Request: pki-core
  -   Removed empty "pre" from "pki-ca"
  -   Consolidated directory ownership
  -   Corrected file ownership within subpackages
  -   Removed all versioning from NSS and NSPR packages


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.1-1
changelog:
  - Allow 'pki-native-tools' to be installed independently of 'pki-setup'
  - Removed explicit 'pki-setup' requirement from 'pki-ca'
    (since it already requires 'pki-common')
  - 'pki-setup'
  -     Bugzilla Bug #223343 - pkicreate: should add 'pkiuser' to nfast group
  -     Bugzilla Bug #629377 - Selinux errors during pkicreate CA, KRA, OCSP
        and TKS.
  -     Bugzilla Bug #555927 - rhcs80 - AgentRequestFilter servlet and port
        fowarding for agent services
  -     Bugzilla Bug #632425 - Port to tomcat6
  -     Bugzilla Bug #606946 - Convert Native Tools to use ldapAPI from
        OpenLDAP instead of the Mozldap
  -     Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI
        interface
  -     Bugzilla Bug #643206 - New CMake based build system for Dogtag
  -     Bugzilla Bug #658926 - org.apache.commons.lang class not found on F13
  -     Bugzilla Bug #661514 - CMAKE build system requires rules to make
        javadocs
  -     Bugzilla Bug #665388 - jakarta-* jars have been renamed to apache-*,
        pkicreate fails Fedora 14 and above
  -     Bugzilla Bug #23346 - Two conflicting ACL list definitions in source
        repository
  -     Bugzilla Bug #656733 - Standardize jar install location and jar names
  - 'pki-symkey'
  -     Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI
        interface
  -     Bugzilla Bug #643206 - New CMake based build system for Dogtag
  -     Bugzilla Bug #644056 - CS build contains warnings
  - 'pki-native-tools'
  -     template change
  -     Bugzilla Bug #606946 - Convert Native Tools to use ldapAPI from
        OpenLDAP instead of the Mozldap
  -     Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI
        interface
  -     Bugzilla Bug #643206 - New CMake based build system for Dogtag
  -     Bugzilla Bug #644056 - CS build contains warnings
  - 'pki-util'
  -     Bugzilla Bug #615814 - rhcs80 - profile policyConstraintsCritical
        cannot be set to true
  -     Bugzilla Bug #224945 - javadocs has missing descriptions, contains
        empty packages
  -     Bugzilla Bug #621337 - Limit the received senderNonce value to 16 bytes.
  -     Bugzilla Bug #621338 - Include a server randomly-generated 16 byte
        senderNonce in all signed SCEP responses.
  -     Bugzilla Bug #621327 - Provide switch disabling algorithm downgrade
        attack in SCEP
  -     Bugzilla Bug #621334 - Provide an option to set default hash algorithm
        for signing SCEP response messages.
  -     Bugzilla Bug #635033 - At installation wizard selecting key types other
        than CA's signing cert will fail
  -     Bugzilla Bug #645874 - rfe ecc - add ecc curve name support in JSS and
        CS interface
  -     Bugzilla Bug #488253 - com.netscape.cmsutil.ocsp.BasicOCSPResponse
        ASN.1 encoding/decoding is broken
  -     Bugzilla Bug #551410 - com.netscape.cmsutil.ocsp.TBSRequest ASN.1
        encoding/decoding is incomplete
  -     Bugzilla Bug #550331 - com.netscape.cmsutil.ocsp.ResponseData ASN.1
        encoding/decoding is incomplete
  -     Bugzilla Bug #623452 - rhcs80 pkiconsole profile policy editor limit
        policy extension to 5 only
  -     Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI
        interface
  -     Bugzilla Bug #651977 - turn off ssl2 for java servers (server.xml)
  -     Bugzilla Bug #643206 - New CMake based build system for Dogtag
  -     Bugzilla Bug #661514 - CMAKE build system requires rules to make
        javadocs
  -     Bugzilla Bug #658188 - remove remaining references to tomcat5
  -     Bugzilla Bug #656733 - Standardize jar install location and jar names
  -     Bugzilla Bug #223319 - Certificate Status inconsistency between token
        db and CA
  -     Bugzilla Bug #531137 - RHCS 7.1 - Running out of Java Heap Memory
        During CRL Generation
  - 'pki-java-tools'
  -     Bugzilla Bug #224945 - javadocs has missing descriptions, contains
        empty packages
  -     Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI
        interface
  -     Bugzilla Bug #659004 - CC: AuditVerify hardcoded with SHA-1
  -     Bugzilla Bug #643206 - New CMake based build system for Dogtag
  -     Bugzilla Bug #661514 - CMAKE build system requires rules to make
        javadocs
  -     Bugzilla Bug #662156 - HttpClient is hard-coded to handle only up to
        5000 bytes
  -     Bugzilla Bug #656733 - Standardize jar install location and jar names
  - 'pki-common'
  -     Bugzilla Bug #583822 - CC: ACL issues from CA interface CC doc review
  -     Bugzilla Bug #623745 - SessionTimer with LDAPSecurityDomainSessionTable
        started before configuration completed
  -     Bugzilla Bug #620925 - CC: auditor needs to be able to download audit
        logs in the java subsystems
  -     Bugzilla Bug #615827 - rhcs80 - profile policies need more than 5
        policy mappings (seem hardcoded)
  -     Bugzilla Bug #224945 - javadocs has missing descriptions, contains
        empty packages
  -     Bugzilla Bug #548699 - subCA's admin certificate should be generated by
        itself
  -     Bugzilla Bug #621322 - Provide switch disabling SCEP support in CA
  -     Bugzilla Bug #563386 - rhcs80 ca crash on invalid inputs to profile
        caAgentServerCert (null cert_request)
  -     Bugzilla Bug #621339 - SCEP one-time PIN can be used an unlimited
        number of times
  -     Bugzilla Bug #583825 - CC: Obsolete servlets to be removed from web.xml
        as part of CC interface review
  -     Bugzilla Bug #629677 - TPS: token enrollment fails.
  -     Bugzilla Bug #621350 - Unauthenticated user can decrypt a one-time PIN
        in a SCEP request
  -     Bugzilla Bug #503838 - rhcs71-80 external publishing ldap connection
        pools not reliable - improve connections or discovery
  -     Bugzilla Bug #629769 - password decryption logs plain text password
  -     Bugzilla Bug #583823 - CC: Auditing issues found as result of
        CC - interface review
  -     Bugzilla Bug #632425 - Port to tomcat6
  -     Bugzilla Bug #586700 - OCSP Server throws fatal error while using
        OCSP console for renewing SSL Server certificate.
  -     Bugzilla Bug #621337 - Limit the received senderNonce value to 16 bytes.
  -     Bugzilla Bug #621338 - Include a server randomly-generated 16 byte
        senderNonce in all signed SCEP responses.
  -     Bugzilla Bug #607380 - CC: Make sure Java Console can configure all
        security relevant config items
  -     Bugzilla Bug #558100 - host challenge of the Secure Channel needs to be
        generated on TKS instead of TPS.
  -     Bugzilla Bug #489342 -
        com.netscape.cms.servlet.common.CMCOutputTemplate.java
        doesn't support EC
  -     Bugzilla Bug #630121 - OCSP responder lacking option to delete or
        disable a CA that it serves
  -     Bugzilla Bug #634663 - CA CMC response default hard-coded to SHA1
  -     Bugzilla Bug #621327 - Provide switch disabling algorithm downgrade
        attack in SCEP
  -     Bugzilla Bug #621334 - Provide an option to set default hash algorithm
        for signing SCEP response messages.
  -     Bugzilla Bug #635033 - At installation wizard selecting key types other
        than CA's signing cert will fail
  -     Bugzilla Bug #621341 - Add CA support for new SCEP key pair dedicated
        for SCEP signing and encryption.
  -     Bugzilla Bug #223336 - ECC: unable to clone a ECC CA
  -     Bugzilla Bug #539781 - rhcs 71 - CRLs Partitioned
        by Reason Code - onlySomeReasons ?
  -     Bugzilla Bug #637330 - CC feature: Key Management - provide signature
        verification functions (JAVA subsystems)
  -     Bugzilla Bug #223313 - should do random generated IV param
        for symmetric keys
  -     Bugzilla Bug #555927 - rhcs80 - AgentRequestFilter servlet and port
        fowarding for agent services
  -     Bugzilla Bug #630176 - Improve reliability of the LdapAnonConnFactory
  -     Bugzilla Bug #524916 - ECC key constraints plug-ins should be based on
        ECC curve names (not on key sizes).
  -     Bugzilla Bug #516632 - RHCS 7.1 - CS Incorrectly Issuing Multiple
        Certificates from the Same Request
  -     Bugzilla Bug #648757 - expose and use updated cert verification
        function in JSS
  -     Bugzilla Bug #638242 - Installation Wizard: at SizePanel, fix selection
        of signature algorithm; and for ECC curves
  -     Bugzilla Bug #451874 - RFE - Java console - Certificate Wizard missing
        e.c. support
  -     Bugzilla Bug #651040 - cloning shoud not include sslserver
  -     Bugzilla Bug #542863 - RHCS8: Default cert audit nickname written to
        CS.cfg files imcomplete when the cert is stored on a hsm
  -     Bugzilla Bug #360721 - New Feature: Profile Integrity Check . . .
  -     Bugzilla Bug #651916 - kra and ocsp are using incorrect ports
        to talk to CA and complete configuration in DonePanel
  -     Bugzilla Bug #642359 - CC Feature - need to verify certificate when it
        is added
  -     Bugzilla Bug #653713 - CC: setting trust on a CIMC cert requires
        auditing
  -     Bugzilla Bug #489385 - references to rhpki
  -     Bugzilla Bug #499494 - change CA defaults to SHA2
  -     Bugzilla Bug #623452 - rhcs80 pkiconsole profile policy editor limit
        policy extension to 5 only
  -     Bugzilla Bug #649910 - Console: an auditor or agent can be added to
        an administrator group.
  -     Bugzilla Bug #632425 - Port to tomcat6
  -     Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI
        interface
  -     Bugzilla Bug #651977 - turn off ssl2 for java servers (server.xml)
  -     Bugzilla Bug #653576 - tomcat5 does not always run filters on servlets
        as expected
  -     Bugzilla Bug #642357 - CC Feature- Self-Test plugins only check for
        validity
  -     Bugzilla Bug #643206 - New CMake based build system for Dogtag
  -     Bugzilla Bug #659004 - CC: AuditVerify hardcoded with SHA-1
  -     Bugzilla Bug #661196 - ECC(with nethsm) subca configuration fails with
        Key Type RSA Not Matched despite using ECC key pairs for rootCA & subCA.
  -     Bugzilla Bug #661889 - The Servlet TPSRevokeCert of the CA returns an
        error to TPS even if certificate in question is already revoked.
  -     Bugzilla Bug #663546 - Disable the functionalities that are not exposed
        in the console
  -     Bugzilla Bug #661514 - CMAKE build system requires rules to make
        javadocs
  -     Bugzilla Bug #658188 - remove remaining references to tomcat5
  -     Bugzilla Bug #649343 - Publishing queue should recover from CA crash.
  -     Bugzilla Bug #491183 - rhcs rfe - add rfc 4523 support for pkiUser and
        pkiCA, obsolete 2252 and 2256
  -     Bugzilla Bug #640710 - Current SCEP implementation does not support HSMs
  -     Bugzilla Bug #656733 - Standardize jar install location and jar names
  -     Bugzilla Bug #661142 - Verification should fail when
        a revoked certificate is added
  -     Bugzilla Bug #642741 - CS build uses deprecated functions
  -     Bugzilla Bug #670337 - CA Clone configuration throws TCP connection error
  -     Bugzilla Bug #662127 - CC doc Error: SignedAuditLog expiration time
        interface is no longer available through console
  - 'pki-selinux'
  -     Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI
        interface
  -     Bugzilla Bug #643206 - New CMake based build system for Dogtag
  -     Bugzilla Bug #667153 - store nuxwdog passwords in kernel ring buffer -
        selinux changes
  - 'pki-ca'
  -     Bugzilla Bug #583822 - CC: ACL issues from CA interface CC doc review
  -     Bugzilla Bug #620925 - CC: auditor needs to be able to download audit
        logs in the java subsystems
  -     Bugzilla Bug #621322 - Provide switch disabling SCEP support in CA
  -     Bugzilla Bug #583824 - CC: Duplicate servlet mappings found as part of
        CC interface doc review
  -     Bugzilla Bug #621602 - pkiconsole: Click on 'Publishing' option with
        admin privilege throws error "You are not authorized to perform this
        operation".
  -     Bugzilla Bug #583825 - CC: Obsolete servlets to be removed from web.xml
        as part of CC interface review
  -     Bugzilla Bug #583823 - CC: Auditing issues found as result of
        CC - interface review
  -     Bugzilla Bug #519291 - Deleting a CRL Issuing Point after edits throws
        'Internal Server Error'.
  -     Bugzilla Bug #586700 - OCSP Server throws fatal error while using
        OCSP console for renewing SSL Server certificate.
  -     Bugzilla Bug #621337 - Limit the received senderNonce value to 16 bytes.
  -     Bugzilla Bug #621338 - Include a server randomly-generated 16 byte
        senderNonce in all signed SCEP responses.
  -     Bugzilla Bug #558100 - host challenge of the Secure Channel needs to be
        generated on TKS instead of TPS.
  -     Bugzilla Bug #630121 - OCSP responder lacking option to delete or
        disable a CA that it serves
  -     Bugzilla Bug #634663 - CA CMC response default hard-coded to SHA1
  -     Bugzilla Bug #621327 - Provide switch disabling algorithm downgrade
        attack in SCEP
  -     Bugzilla Bug #621334 - Provide an option to set default hash algorithm
        for signing SCEP response messages.
  -     Bugzilla Bug #539781 - rhcs 71 - CRLs Partitioned
        by Reason Code - onlySomeReasons ?
  -     Bugzilla Bug #637330 - CC feature: Key Management - provide signature
        verification functions (JAVA subsystems)
  -     Bugzilla Bug #555927 - rhcs80 - AgentRequestFilter servlet and port
        fowarding for agent services
  -     Bugzilla Bug #524916 - ECC key constraints plug-ins should be based on
        ECC curve names (not on key sizes).
  -     Bugzilla Bug #516632 - RHCS 7.1 - CS Incorrectly Issuing Multiple
        Certificates from the Same Request
  -     Bugzilla Bug #638242 - Installation Wizard: at SizePanel, fix selection
        of signature algorithm; and for ECC curves
  -     Bugzilla Bug #529945 - (Instructions and sample only) CS 8.0 GA
        release -- DRM and TKS do not seem to have CRL checking enabled
  -     Bugzilla Bug #609641 - CC: need procedure (and possibly tools) to help
        correctly set up CC environment
  -     Bugzilla Bug #509481 - RFE: support sMIMECapabilities extensions in
        certificates (RFC 4262)
  -     Bugzilla Bug #651916 - kra and ocsp are using incorrect ports
        to talk to CA and complete configuration in DonePanel
  -     Bugzilla Bug #511990 - rhcs 7.3, 8.0 - re-activate missing object
        signing support in RHCS
  -     Bugzilla Bug #651977 - turn off ssl2 for java servers (server.xml)
  -     Bugzilla Bug #489385 - references to rhpki
  -     Bugzilla Bug #499494 - change CA defaults to SHA2
  -     Bugzilla Bug #623452 - rhcs80 pkiconsole profile policy editor limit
        policy extension to 5 only
  -     Bugzilla Bug #649910 - Console: an auditor or agent can be added to
        an administrator group.
  -     Bugzilla Bug #632425 - Port to tomcat6
  -     Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI
        interface
  -     Bugzilla Bug #653576 - tomcat5 does not always run filters on servlets
        as expected
  -     Bugzilla Bug #642357 - CC Feature- Self-Test plugins only check for
        validity
  -     Bugzilla Bug #643206 - New CMake based build system for Dogtag
  -     Bugzilla Bug #661128 - incorrect CA ports used for revoke, unrevoke
        certs in TPS
  -     Bugzilla Bug #512496 - RFE rhcs80 - crl updates and scheduling feature 
  -     Bugzilla Bug #661196 - ECC(with nethsm) subca configuration fails with
        Key Type RSA Not Matched despite using ECC key pairs for rootCA & subCA.
  -     Bugzilla Bug #649343 - Publishing queue should recover from CA crash.
  -     Bugzilla Bug #491183 - rhcs rfe - add rfc 4523 support for pkiUser and
        pkiCA, obsolete 2252 and 2256
  -     Bugzilla Bug #223346 - Two conflicting ACL list definitions in source
        repository
  -     Bugzilla Bug #640710 - Current SCEP implementation does not support HSMs
  -     Bugzilla Bug #656733 - Standardize jar install location and jar names
  -     Bugzilla Bug #661142 - Verification should fail when
        a revoked certificate is added
  -     Bugzilla Bug #668100 - DRM storage cert has OCSP signing extended key
        usage
  -     Bugzilla Bug #662127 - CC doc Error: SignedAuditLog expiration time
        interface is no longer available through console
  -     Bugzilla Bug #531137 - RHCS 7.1 - Running out of Java Heap Memory
        During CRL Generation
  - 'pki-silent'
  -     Bugzilla Bug #627309 - pkisilent subca configuration fails.
  -     Bugzilla Bug #640091 - pkisilent panels need to match with changed java
        subsystems
  -     Bugzilla Bug #527322 - pkisilent ConfigureDRM should configure DRM
        Clone.
  -     Bugzilla Bug #643053 - pkisilent DRM configuration fails
  -     Bugzilla Bug #583754 - pki-silent needs an option to configure signing
        algorithm for CA certificates
  -     Bugzilla Bug #489385 - references to rhpki
  -     Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI
        interface
  -     Bugzilla Bug #651977 - turn off ssl2 for java servers (server.xml)
  -     Bugzilla Bug #640042 - TPS Installlation Wizard: need to move Module
        Panel up to before Security Domain Panel
  -     Bugzilla Bug #643206 - New CMake based build system for Dogtag
  -     Bugzilla Bug #588323 - Failed to enable cipher 0xc001
  -     Bugzilla Bug #656733 - Standardize jar install location and jar names
  -     Bugzilla Bug #645895 - pkisilent: add ability to select ECC curves,
        signing algorithm
  -     Bugzilla Bug #658641 - pkisilent doesn't not properly handle passwords
        with special characters
  -     Bugzilla Bug #642741 - CS build uses deprecated functions


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.1-2
changelog:
  - 'pki-symkey'
  -     Bugzilla Bug #671265 - pki-symkey jar version incorrect
  - 'pki-common'
  -     Bugzilla Bug #564207 - Searches for completed requests in the agent
        interface returns zero entries


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.1-3
changelog:
  - Bugzilla Bug #656661 - Please Update Spec File to use 'ghost' on files
    in /var/run and /var/lock


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.2-1
changelog:
  - Bugzilla Bug #673233 - Rebase pki-core to pick the latest features and fixes
  - 'pki-setup'
  -     Bugzilla Bug #673638 - Installation within IPA hangs
  - 'pki-symkey'
  - 'pki-native-tools'
  - 'pki-util'
  - 'pki-java-tools'
  -     Bugzilla Bug #673614 - CC: Review of cryptographic algorithms provided
        by 'netscape.security.provider' package
  - 'pki-common'
  -     Bugzilla Bug #672291 - CA is not publishing certificates issued using
        "Manual User Dual-Use Certificate Enrollment"
  -     Bugzilla Bug #670337 - CA Clone configuration throws TCP connection
        error.
  -     Bugzilla Bug #504056 - Completed SCEP requests are assigned to the
        "begin" state instead of "complete".
  -     Bugzilla Bug #504055 - SCEP requests are not properly populated
  -     Bugzilla Bug #564207 - Searches for completed requests in the agent
        interface returns zero entries
  -     Bugzilla Bug #672291 - CA is not publishing certificates issued using
        "Manual User Dual-Use Certificate Enrollment" -
  -     Bugzilla Bug #673614 - CC: Review of cryptographic algorithms provided
        by 'netscape.security.provider' package
  -     Bugzilla Bug #672920 - CA console: adding policy to a profile throws
        'Duplicate policy' error in some cases.
  -     Bugzilla Bug #673199 - init script returns control before web apps have
        started
  -     Bugzilla Bug #674917 - Restore identification of Tomcat-based PKI
        subsystem instances
  - 'pki-selinux'
  - 'pki-ca'
  -     Bugzilla Bug #504013 - sscep request is rejected due to authentication
        error if submitted through one time pin router certificate enrollment.
  -     Bugzilla Bug #672111 - CC doc: certServer.usrgrp.administration missing
        information
  -     Bugzilla Bug #583825 - CC: Obsolete servlets to be removed from web.xml
        as part of CC interface review
  -     Bugzilla Bug #672333 - Creation of RA agent fails in IPA installation
  -     Bugzilla Bug #674917 - Restore identification of Tomcat-based PKI
        subsystem instances
  - 'pki-silent'
  -     Bugzilla Bug #673614 - CC: Review of cryptographic algorithms provided
        by 'netscape.security.provider' package


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.3-1
changelog:
  - 'pki-common'
  -     Bugzilla Bug #674894 - ipactl restart : an annoy output line
  -     Bugzilla Bug #675179 - ipactl restart : an annoy output line


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.3-2
changelog:
  - 'pki-common'
  -     Bugzilla Bug #676051 - IPA installation failing - Fails to create CA
        instance
  -     Bugzilla Bug #676182 - IPA installation failing - Fails to create CA
        instance


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.4-1
changelog:
  - Bugzilla Bug #688763 - Rebase updated Dogtag Packages for Fedora 15 (alpha)
  - Bugzilla Bug #676182 - IPA installation failing - Fails to create CA
    instance
  - Bugzilla Bug #675742 - Profile caIPAserviceCert Not Found
  - 'pki-setup'
  -     Bugzilla Bug #678157 - uninitialized variable warnings from Perl
  -     Bugzilla Bug #679574 - Velocity fails to load all dependent classes
  -     Bugzilla Bug #680420 - xml-commons-apis.jar dependency
  -     Bugzilla Bug #682013 - pkisilent needs xml-commons-apis.jar in it's
        classpath
  -     Bugzilla Bug #673508 - CS8 64 bit pkicreate script uses wrong library
        name for SafeNet LunaSA
  - 'pki-common'
  -     Bugzilla Bug #673638 - Installation within IPA hangs
  -     Bugzilla Bug #678715 - netstat loop fixes needed
  -     Bugzilla Bug #673609 - CC: authorize() call needs to be added to
        getStats servlet
  - 'pki-selinux'
  -     Bugzilla Bug #674195: SELinux error message thrown during token
        enrollment
  - 'pki-ca'
  -     Bugzilla Bug #673638 - Installation within IPA hangs
  -     Bugzilla Bug #673609 - CC: authorize() call needs to be added to
        getStats servlet
  -     Bugzilla Bug #676330 - init script cannot start service
  - 'pki-silent'
  -     Bugzilla Bug #682013 - pkisilent needs xml-commons-apis.jar in it's
        classpath


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.5-1
changelog:
  - Bugzilla Bug #690950 - Update Dogtag Packages for Fedora 15 (beta)
  - Require "jss >= 4.2.6-15" as a build and runtime requirement
  - Require "tomcatjss >= 2.1.1" as a build and runtime requirement
    for Fedora 15 and later platforms
  - 'pki-setup'
  -     Bugzilla Bug #688287 - Add "deprecation" notice regarding using
        "shared ports" in pkicreate -help . . .
  -     Bugzilla Bug #688251 - Dogtag installation under IPA takes
        too much time - SELinux policy compilation
  - 'pki-symkey'
  - 'pki-native-tools'
  - 'pki-util'
  - 'pki-java-tools'
  -     Bugzilla Bug #689501 - ExtJoiner tool fails to join the multiple
        extensions
  - 'pki-common'
  -     Bugzilla Bug #683581 - CA configuration with ECC(Default
        EC curve-nistp521) CA fails with 'signing operation failed'
  -     Bugzilla Bug #689662 - ocsp publishing needs to be re-enabled
        on the EE port
  - 'pki-selinux'
  -     Bugzilla Bug #684871 - ldaps selinux link change
  - 'pki-ca'
  -     Bugzilla Bug #683581 - CA configuration with ECC(Default
        EC curve-nistp521) CA fails with 'signing operation failed'
  -     Bugzilla Bug #684381 - CS.cfg specifies incorrect type of comments
  -     Bugzilla Bug #689453 - CRMFPopClient request to CA's unsecure port
        throws file not found exception.(profile and CS.cfg only)
  - 'pki-silent'


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.6-1
changelog:
  - Bugzilla Bug #690950 - Update Dogtag Packages for Fedora 15 (beta)
  - Bugzilla Bug #693327 - Missing requires: tomcatjss
  - 'pki-setup'
  -     Bugzilla Bug #690626 - pkiremove removes the registry entry for
        all instances on a machine
  - 'pki-symkey'
  - 'pki-native-tools'
  - 'pki-util'
  - 'pki-java-tools'
  -     Bugzilla Bug #689453 - CRMFPopClient request to CA's unsecure port
        throws file not found exception.
  - 'pki-common'
  -     Bugzilla Bug #692990 - Audit log messages needed to match CC doc:
        DRM Recovery audit log messages
  - 'pki-selinux'
  - 'pki-ca'
  - 'pki-silent'


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.7-1
changelog:
  - 'pki-setup'
  -     Bugzilla Bug #693815 - /var/log/tomcat6/catalina.out owned by pkiuser
  -     Bugzilla Bug #694569 - parameter used by pkiremove not updated
  - 'pki-symkey'
  - 'pki-native-tools'
  - 'pki-util'
  - 'pki-java-tools'
  - 'pki-common'
  -     Bugzilla Bug #695403 - Editing signedaudit or transaction, system logs
        throws 'Invalid protocol' for OCSP subsystems
  -     Bugzilla Bug #694569 - parameter used by pkiremove not updated
  -     Bugzilla Bug #695015 - Serial No. of a revoked certificate is not
        populated in the CA signedAudit messages
  -     Bugzilla Bug #694143 - CA Agent not returning specified request
  -     Bugzilla Bug #695015 - Serial No. of a revoked certificate is not
        populated in the CA signedAudit messages
  -     Bugzilla Bug #698885 - Race conditions during IPA installation
  - 'pki-selinux'
  - 'pki-ca'
  -     Bugzilla Bug #693815 - /var/log/tomcat6/catalina.out owned by pkiuser
  -     Bugzilla Bug #699837 - service command is not fully backwards compatible
        with Dogtag pki subsystems
  - 'pki-silent'


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.8-1
changelog:
  - 'pki-setup'
  - 'pki-symkey'
  - 'pki-native-tools'
  - 'pki-util'
  - 'pki-java-tools'
  -     Bugzilla Bug #532548 - Tool to do DRM re-key
  - 'pki-common'
  - 'pki-selinux'
  - 'pki-ca'
  - 'pki-silent'


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.8-2
changelog:
  - 'pki-setup'
  - 'pki-symkey'
  - 'pki-native-tools'
  - 'pki-util'
  - 'pki-java-tools'
  -     Added 'DRMTool.cfg' configuration file to inventory
  - 'pki-common'
  - 'pki-selinux'
  - 'pki-ca'
  - 'pki-silent'


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.9-1
changelog:
  - Updated release of 'jss'
  - Updated release of 'tomcatjss' for Fedora 15
  - 'pki-setup'
  -      Bugzilla Bug #695157 - Auditverify on TPS audit log throws error.
         (mharmsen)
  -      Bugzilla Bug #693815 - /var/log/tomcat6/catalina.out owned by pkiuser
         (jdennis)
  -      Bugzilla Bug #694569 - parameter used by pkiremove not updated (alee)
  -      Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen)
  - 'pki-symkey'
  -      Bugzilla Bug #695157 - Auditverify on TPS audit log throws error.
         (mharmsen)
  -      Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen)
  - 'pki-native-tools'
  -      Bugzilla Bug #695157 - Auditverify on TPS audit log throws error.
         (mharmsen)
  -      Bugzilla Bug #717765 - TPS configuration: logging into security domain
         from tps does not work with clientauth=want. (alee)
  -      Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen)
  - 'pki-util'
  -      Bugzilla Bug #695157 - Auditverify on TPS audit log throws error.
         (mharmsen)
  -      Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen)
  - 'pki-java-tools'
  -      Bugzilla Bug #695157 - Auditverify on TPS audit log throws error.
         (mharmsen)
  -      Bugzilla Bug #532548 - Tool to do DRM re-key (mharmsen)
  -      Bugzilla Bug #532548 - Tool to do DRM re-key (config file and record
         processing) (mharmsen)
  -      Bugzilla Bug #532548 - Tool to do DRM re-key (tweaks) (mharmsen)
  -      Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen)
  - 'pki-common'
  -      Bugzilla Bug #695157 - Auditverify on TPS audit log throws error.
         (mharmsen)
  -      Bugzilla Bug #695403 - Editing signedaudit or transaction, system
         logs throws 'Invalid protocol' for OCSP subsystems (alee)
  -      Bugzilla Bug #694569 - parameter used by pkiremove not updated (alee)
  -      Bugzilla Bug #695015 - Serial No. of a revoked certificate is not
         populated in the CA signedAudit messages (alee)
  -      Bugzilla Bug #694143 - CA Agent not returning specified request (awnuk)
  -      Bugzilla Bug #695015 - Serial No. of a revoked certificate is not
         populated in the CA signedAudit messages (jmagne)
  -      Bugzilla Bug #698885 - Race conditions during IPA installation (alee)
  -      Bugzilla Bug #704792 - CC_LAB_EVAL: CA agent interface:
         SubjectID=$Unidentified$ fails audit evaluation (jmagne)
  -      Bugzilla Bug #705914 - SCEP mishandles nicknames when processing
         subsequent SCEP requests. (awnuk)
  -      Bugzilla Bug #661142 - Verification should fail when a revoked
         certificate is added. (jmagne)
  -      Bugzilla Bug #707416 - CC_LAB_EVAL: Security Domain: missing audit msgs
         for modify/add (alee)
  -      Bugzilla Bug #707416 - additional audit messages for GetCookie (alee)
  -      Bugzilla Bug #707607 - Published certificate summary has list of
         non-published certificates with succeeded status (jmagne)
  -      Bugzilla Bug #717813 - EV_AUDIT_LOG_SHUTDOWN audit log not generated
         for tps and ca on server shutdown (jmagne)
  -      Bugzilla Bug #697939 - DRM signed audit log message - operation should
         be read instead of modify (jmagne)
  -      Bugzilla Bug #718427 - When audit log is full, server continue to
         function. (alee)
  -      Bugzilla Bug #718607 - CC_LAB_EVAL: No AUTH message is generated in
         CA's signedaudit log when a directory based user enrollment is
         performed (jmagne)
  -      Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen)
  - 'pki-selinux'
  -      Bugzilla Bug #695157 - Auditverify on TPS audit log throws error.
         (mharmsen)
  -      Bugzilla Bug #720503 - RA and TPS require additional SELinux
         permissions to run in "Enforcing" mode (alee)
  -      Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen)
  - 'pki-ca'
  -      Bugzilla Bug #695157 - Auditverify on TPS audit log throws error.
         (mharmsen)
  -      Bugzilla Bug #693815 - /var/log/tomcat6/catalina.out owned by pkiuser
         (jdennis)
  -      Bugzilla Bug #699837 - service command is not fully backwards
         compatible with Dogtag pki subsystems (mharmsen)
  -      Bugzilla Bug #649910 - Console: an auditor or agent can be added to an
         administrator group. (jmagne)
  -      Bugzilla Bug #707416 - CC_LAB_EVAL: Security Domain: missing audit msgs
         for modify/add (alee)
  -      Bugzilla Bug #716269 - make ra authenticated profiles non-visible on ee
         pages (alee)
  -      Bugzilla Bug #718621 - CC_LAB_EVAL: PRIVATE_KEY_ARCHIVE_REQUEST occurs
         for a revocation invoked by EE user (awnuk)
  -      Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen)
  - 'pki-silent'
  -      Bugzilla Bug #695157 - Auditverify on TPS audit log throws error.
         (mharmsen)
  -      Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen)


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.10-1
changelog:
  - 'pki-setup'
  - 'pki-symkey'
  - 'pki-native-tools'
  - 'pki-util'
  -      Bugzilla Bug #719007 - Key Constraint keyParameter being ignored
         using an ECC CA to generate ECC certs from CRMF. (jmagne)
  -      Bugzilla Bug #716307 - rhcs80 - DER shall not include an encoding
         for any component value which is equal to its default value (alee)
  - 'pki-java-tools'
  - 'pki-common'
  -      Bugzilla Bug #720510 - Console: Adding a certificate into nethsm
         throws Token not found error. (jmagne)
  -      Bugzilla Bug #719007 - Key Constraint keyParameter being ignored
         using an ECC CA to generate ECC certs from CRMF. (jmagne)
  -      Bugzilla Bug #716307 - rhcs80 - DER shall not include an encoding
         for any component value which is equal to its default value (alee)
  -      Bugzilla Bug #722989 - Registering an agent when a subsystem is
         created - does not log AUTHZ_SUCCESS event. (alee)
  - 'pki-selinux'
  - 'pki-ca'
  -      Bugzilla Bug #719113 - Add client usage flag to caIPAserviceCert
         (awnuk)
  - 'pki-silent'


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.11-1
changelog:
  - 'pki-setup'
  -      Bugzilla Bug #689909 - Dogtag installation under IPA takes too much
         time - remove the inefficient sleeps (alee)
  - 'pki-symkey'
  - 'pki-native-tools'
  - 'pki-util'
  - 'pki-java-tools'
  -      Bugzilla Bug #724861 - DRMTool: fix duplicate "dn:" records by
         renumbering "cn=<value>" (mharmsen)
  - 'pki-common'
  -      Bugzilla Bug #717041 - Improve escaping of some enrollment inputs like
         (jmagne, awnuk)
  -      Bugzilla Bug #689909 - Dogtag installation under IPA takes too much
         time - remove the inefficient sleeps (alee)
  -      Bugzilla Bug #708075 - Clone installation does not work over NAT
         (alee)
  -      Bugzilla Bug #726785 - If replication fails while setting up a clone
         it will wait forever (alee)
  -      Bugzilla Bug #728332 - xml output has changed on cert requests (awnuk)
  -      Bugzilla Bug #700505 - pki tomcat6 instances currently running
         unconfined (alee)
  - 'pki-selinux'
  -      Bugzilla Bug #700505 - pki tomcat6 instances currently running
         unconfined (alee)
  - 'pki-ca'
  -      Bugzilla Bug #728605 - RFE: increase default validity from 6mo to 2yrs
         in IPA profile (awnuk)
  - 'pki-silent'
  -      Bugzilla Bug #689909 - Dogtag installation under IPA takes too much
         time - remove the inefficient sleeps (alee)


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.12-1
changelog:
  - 'pki-setup'
  -      Bugzilla Bug #712931 - CS requires too many ports
         to be open in the FW (alee)
  - 'pki-symkey'
  - 'pki-native-tools'
  -      Bugzilla Bug #717643 - Fopen without NULL check and other Coverity
         issues (awnuk)
  -      Bugzilla Bug #730801 - Coverity issues in native-tools area (awnuk)
  - 'pki-util'
  - 'pki-java-tools'
  - 'pki-common'
  -      Bugzilla Bug #700522 - pki tomcat6 instances currently running
         unconfined, allow server to come up when selinux disabled (alee)
  -      Bugzilla Bug #731741 - some CS.cfg nickname parameters not updated
         correctly when subsystem cloned (using hsm) (alee)
  -      Bugzilla Bug #712931 - CS requires too many ports
         to be open in the FW (alee)
  - 'pki-selinux'
  -      Bugzilla Bug #712931 - CS requires too many ports
         to be open in the FW (alee)
  - 'pki-ca'
  -      Bugzilla Bug #712931 - CS requires too many ports
         to be open in the FW (alee)
  - 'pki-silent'


author: Ade Lee <alee@redhat.com> 9.0.13-1
changelog:
  - 'pki-setup'
  -      Bugzilla Bug #699809 - Convert CS to use systemd (alee)
  - 'pki-ca'
  -      Bugzilla Bug #699809 - Convert CS to use systemd (alee)
  - 'pki-common'
  -      Bugzilla Bug #699809 - Convert CS to use systemd (alee)


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.14-1
changelog:
  - 'pki-setup'
  -      Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . .
  - 'pki-symkey'
  -      Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . .
  - 'pki-native-tools'
  - 'pki-util'
  -      Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . .
  - 'pki-java-tools'
  -      Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . .
  - 'pki-common'
  -      Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . .
  - 'pki-selinux'
  - 'pki-ca'
  -      Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . .
  -      Bugzilla Bug #699809 - Convert CS to use systemd (alee)
  - 'pki-silent'
  -      Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . .


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.15-1
changelog:
  - Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . . (mharmsen)
  - Bugzilla Bug #699809 - Convert CS to use systemd (alee)
  - 'pki-setup'
  -      Bugzilla Bug #730146 - SSL handshake picks non-FIPS ciphers in FIPS
         mode (cfu)
  -      Bugzilla Bug #737192 - Need script to upgrade proxy configuration (alee)
  - 'pki-symkey'
  -      Bugzilla Bug #730162 - TPS/TKS token enrollment failure in FIPS mode
         (hsm+NSS). (jmagne)
  - 'pki-native-tools'
  -      Bugzilla Bug #730801 - Coverity issues in native-tools area (awnuk)
  -      Bugzilla Bug #730146 - SSL handshake picks non-FIPS ciphers in FIPS
         mode (cfu)
  - 'pki-util'
  -      Bugzilla Bug #730146 - SSL handshake picks non-FIPS ciphers in FIPS
         mode (cfu)
  - 'pki-java-tools'
  - 'pki-common'
  -      Bugzilla Bug #730146 - SSL handshake picks non-FIPS ciphers in FIPS
         mode (cfu)
  -      Bugzilla Bug #737218 - Incorrect request attribute name matching
         ignores request attributes during request parsing. (awnuk)
  -      Bugzilla Bug #730162 - TPS/TKS token enrollment failure in FIPS mode
         (hsm+NSS). (jmagne)
  - 'pki-selinux'
  -      Bugzilla Bug #739708 - pki-selinux lacks rules in F16 (alee)
  - 'pki-ca'
  -      Bugzilla Bug #712931 - CS requires too many ports
         to be open in the FW (alee)
  -      Bugzilla Bug #730146 - SSL handshake picks non-FIPS ciphers in FIPS
         mode (cfu)
  - 'pki-silent'
  -      Bugzilla Bug #739201 - pkisilent does not take arch into account
         as Java packages migrated to arch-dependent directories (mharmsen)


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.16-1
changelog:
  - 'pki-setup'
  - 'pki-symkey'
  - 'pki-native-tools'
  - 'pki-util'
  -      Bugzilla Bug #737122 - DRM: during archiving and recovering,
         wrapping unwrapping keys should be done in the token (cfu)
  - 'pki-java-tools'
  - 'pki-common'
  -      Bugzilla Bug #744797 - KRA key recovery (retrieve pkcs#12) fails after
         the in-place upgrade( CS 8.0->8.1) (cfu)
  - 'pki-selinux'
  - 'pki-ca'
  -      Bugzilla Bug #746367 - Typo in the profile name. (jmagne)
  -      Bugzilla Bug #737122 - DRM: during archiving and recovering,
         wrapping unwrapping keys should be done in the token (cfu)
  -      Bugzilla Bug #749927 - Java class conflicts using Java 7 in Fedora 17
         (rawhide) . . . (mharmsen)
  -      Bugzilla Bug #749945 - Installation error reported during CA, DRM,
         OCSP, and TKS package installation . . . (mharmsen)
  - 'pki-silent'


author: Matthew Harmsen <mharmsen@redhat.com> 10.0.0-0.2.a1
changelog:
  - Integrated 'pki-kra' into 'pki-core'
  - Integrated 'pki-ocsp' into 'pki-core'
  - Integrated 'pki-tks' into 'pki-core'
  - Bugzilla Bug #788787 - added 'junit'/'junit4' build-time requirements


author: Matthew Harmsen <mharmsen@redhat.com> 10.0.0-0.3.a1
changelog:
  - Add '-DSYSTEMD_LIB_INSTALL_DIR' override flag to 'cmake' to address changes
    in fundamental path structure in Fedora 17
  - 'pki-setup'
  -      Hard-code Perl dependencies to protect against bugs such as
         Bugzilla Bug #772699 - Adapt perl and python fileattrs to
         changed file 5.10 magics
  - 'pki-selinux'
  -      Bugzilla Bug #795966 - pki-selinux policy is kind of a mess


author: Ade Lee <alee@redhat.com> 10.0.0-0.5.a1
changelog:
  - 'pki-selinux'
  -      Added platform-dependent patches for SELinux component
  -      Bugzilla Bug #739708 - Selinux fix for ephemeral ports (F16)
  -      Bugzilla Bug #795966 - pki-selinux policy is kind of a mess (F17)


author: Matthew Harmsen <mharmsen@redhat.com> 10.0.0-0.7.a1
changelog:
  - For 'mock' purposes, removed platform-specific logic from around
    the 'patch' files so that ALL 'patch' files will be included in
    the SRPM.


author: Matthew Harmsen <mharmsen@redhat.com> 10.0.0-0.9.a1
changelog:
  - Initial attempt at PKI deployment framework described in
    'http://pki.fedoraproject.org/wiki/PKI_Instance_Deployment'.


author: Ade Lee <alee@redhat.com> 10.0.0-0.11.a1
changelog:
  - BZ 802396 - Change location of TOMCAT_LOG to match tomcat6 changes
  - Corrected patch selected for selinux f17 rules


author: Matthew Harmsen <mharmsen@redhat.com> 10.0.0-0.16.a1
changelog:
  - Integration of Tomcat 7
  - Addition of centralized 'pki-tomcatd' systemd functionality to the
    PKI Deployment strategy
  - Removal of 'pki_flavor' attribute


author: Matthew Harmsen <mharmsen@redhat.com> 10.0.0-0.23.a1
changelog:
  - Updated release of 'tomcatjss' to rely on Tomcat 7 for Fedora 17
  - Changed Dogtag 10 build-time and runtime requirements for 'pki-deploy'
  - Altered PKI Package Dependency Chain (top-to-bottom):
    pki-ca, pki-kra, pki-ocsp, pki-tks --> pki-deploy --> pki-common


author: Endi S. Dewata <edewata@redhat.com> 10.0.0-0.24.a1
changelog:
  - Split pki-common into pki-base and pki-server.
  - Merged pki-util into pki-base.
  - Merged pki-deploy into pki-server.


author: Endi S. Dewata <edewata@redhat.com> 10.0.0-0.25.a1
changelog:
  - Merged pki-native-tools and pki-java-tools into pki-tools.
  - Modified pki-server to depend on pki-tools.


author: Matthew Harmsen <mharmsen@redhat.com> 10.0.0-0.32.a1
changelog:
  - TRAC Ticket #312 - Dogtag 10: Automatically restart any running instances
    upon RPM "update" . . .
  - TRAC Ticket #317 - Dogtag 10: Move "pkispawn"/"pkidestroy"
    from /usr/bin to /usr/sbin . . .


author: Ade Lee <alee@redhat.com> 10.0.0-0.53.b3
changelog:
  - Cleaned up spec file to provide only support rhel 7+, f17+
  - Added resteasy-base dependency for rhel 7
  - Update cmake version


author: Matthew Harmsen <mharmsen@redhat.com> 10.0.0-0.56.b3
changelog:
  - TRAC Ticket #315 - Man pages for pkispawn/pkidestroy.
  - Added place-holders for 'pki.1' and 'pki_default.cfg.5' man pages.


author: Matthew Harmsen <mharmsen@redhat.com> 10.0.0-4
changelog:
  - TRAC Ticket #469 - Dogtag 10: Fix tomcatjss issue in pki-core.spec and
    dogtag-pki.spec . . .
  - TRAC Ticket #468 - pkispawn throws exception


author: Ade Lee <alee@redhat.com> 10.0.1-1
changelog:
  - TRAC Ticket 214 - Missing error description for duplicate user
  - TRAC Ticket 213 - Add nonces for cert revocation
  - TRAC Ticket 367 - pkidestroy does not remove connector
  - TRAC Ticket #430 - License for 3rd party code
  - Bugzilla Bug 839426 - [RFE] ECC CRL support for OCSP
  - Fix spec file to allow f17 to work with latest tomcatjss
  - TRAC Ticket 466 - Increase root CA validity to 20 years
  - TRAC Ticket 469 - Fix tomcatjss issue in spec files
  - TRAC Ticket 468 - pkispawn throws exception
  - TRAC Ticket 191 - Mapping HTTP Exceptions to HTTP error codes
  - TRAC Ticket 271 - Dogtag 10: Fix 'status' command in 'pkidaemon' . . .
  - TRAC Ticket 437 - Make admin cert p12 file location configurable
  - TRAC Ticket 393 - pkispawn fails when selinux is disabled
  - Punctuation and formatting changes in man pages
  - Revert to using default config file for pkidestroy
  - Hardcode setting of resteasy-lib for instance
  - TRAC Ticket 436 - Interpolation for pki_subsystem
  - TRAC Ticket 433 - Interpolation for paths
  - TRAC Ticket 435 - Identical instance id and instance name
  - TRAC Ticket 406 - Replace file dependencies with package dependencies


author: Matthew Harmsen <mharmsen@redhat.com> 10.0.1-2
changelog:
  - Removed runtime dependency on 'pki-server-theme' to resolve
    Bugzilla Bug #916134 - unresolved dependency in pki-server: pki-server-theme


author: Matthew Harmsen <mharmsen@redhat.com> 10.0.1-3
changelog:
  - TRAC Ticket #517 - Clean up theme dependencies
  - TRAC Ticket #518 - Remove UI dependencies from pkispawn . . .


author: Endi S. Dewata <edewata@redhat.com> 10.0.1-9
changelog:
  - Renamed base/deploy to base/server.
  - Moved pki.conf into pki-base.
  - Removed redundant pki/server folder declaration.


author: Endi S. Dewata <edewata@redhat.com> 10.0.2-0.7
changelog:
  - Added pki-server-upgrade script and pki.server module.
  - Call upgrade scripts in %post for pki-base and pki-server.


author: Endi S. Dewata <edewata@redhat.com> 10.0.2-2
changelog:
  - Added default pki.conf in /usr/share/pki/etc
  - Create upgrade tracker on install and remove it on uninstall


author: Matthew Harmsen <mharmsen@redhat.com> 10.1.0-0.2
changelog:
  - TRAC Ticket 606 - add restart / start at boot info to pkispawn man page
  - TRAC Ticket 610 - Document limitation in using GUI install
  - TRAC Ticket 629 - Package ownership of '/usr/share/pki/etc/' directory


author: Abhishek Koneru <akoneru@redhat.com> 10.1.0.0.9
changelog:
  - Listed new packages required during build, due to issues reported
    by pylint.
  - Packages added: python-requests, python-ldap, libselinux-python,
                    policycoreutils-python


author: Ade Lee <alee@redhat.com> 10.1.0-1
changelog:
  - Trac Ticket 788 - Clean up spec files
  - Update release number for release build
  - Updated requirements for resteasy


author: Dogtag Team <pki-devel@redhat.com> 10.2.0-0.1
changelog:
  - Added option to build without server packages.
  - Replaced Jettison with Jackson.
  - Added python-nss build requirement
  - Bugzilla Bug #1057959 - pkispawn requires policycoreutils-python
  - TRAC Ticket #840 - pkispawn requires policycoreutils-python
  - Updated requirements for resteasy
  - Added template files for archive, retrieve and generate key
    requests to the client package.


author: Matthew Harmsen <mharmsen@redhat.com> - 10.2.0-0.6
changelog:
  - Bugzilla Bug #1120045 - pki-core: Switch to java-headless (build)requires --
    drop dependency on java-atk-wrapper
  - Removed 'java-atk-wrapper' dependency from 'pki-server'


author: Matthew Harmsen <mharmsen@redhat.com> - 10.2.0-0.9
changelog:
  - Merged jmagne@redhat.com's spec file changes from the stand-alone
    'pki-tps-client' package needed to build/run the native 'tpsclient'
    command line utility into this 'pki-core' spec file under the 'tps' package.
  - Original tps libararies must be built to support this native utility.
  - Modifies tps package from 'noarch' into 'architecture-specific' package


author: Ade Lee <alee@redhat.com> 10.2.0-3
changelog:
  - Disable pylint dependency for RHEL builds
  - Added jakarta-commons-httpclient requirements
  - Added tomcat version for RHEL build
  - Added resteasy-base-client for RHEL build


author: Dogtag Team <pki-devel@redhat.com> 10.2.1-0.1
changelog:
  - Updated version number to 10.2.1-0.1.
  - Added CLIs to simplify generating user certificates
  - Added enhancements to KRA Python API
  - Added a man page for pki ca-profile commands.
  - Added python api docs


author: Christina Fu <cfu@redhat.com> 10.2.1-0.2
changelog:
  - Ticket 1198 Bugzilla 1158410 add TLS range support to server.xml by
    default and upgrade (cfu)
  - PKI Trac Ticket #1211 - New release overwrites old source tarball (mharmsen)
  - up the release number to 0.2


author: Matthew Harmsen <mharmsen@redhat.com> - 10.2.1-0.4
changelog:
  - PKI TRAC Ticket #1187 - mod_perl should be removed from requirements for 10.2
  - PKI TRAC Ticket #1205 - Outdated selinux-policy dependency.
  - Removed perl(XML::LibXML), perl-Crypt-SSLeay, and perl-Mozilla-LDAP runtime
    dependencies


author: Dogtag Team <pki-devel@redhat.com> 10.2.2-0.1
changelog:
  - Updated version number to 10.2.2-0.1
  - Moved web application deployment locations.
  - Updated Resteasy and Jackson dependencies.
  - Added missing python-lxml build dependency.


author: Dogtag Team <pki-devel@redhat.com> 10.2.7-0.3
changelog:
  - Added dep on tomcat-servlet-3.1-api [Fedora 23 and later] or dep on
    tomcat-servlet-3.0-api [Fedora 22 and later] to pki-tools
  - Updated dep on tomcatjss [Fedora 23 and later]


author: Dogtag Team <pki-devel@redhat.com> 10.3.0.a1-2
changelog:
  - PKI TRAC Ticket #1625 - Allow multiple ACLs of same name
    (union of rules) [ftweedal]
  - PKI TRAC Ticket #2237 - Add CRL dist points extension to OIDMap
    unconditionally [edewata]
  - PKI TRAC Ticket #1803 - Removed unnecessary URL encoding for admin cert
    request. [edewata]
  - PKI TRAC Ticket #1742 - Added support for cloning 3rd-party CA
    certificates. [edewata]
  - PKI TRAC Ticket #1482 - Added TPS token filter dialog. [edewata]
  - PKI TRAC Ticket #1808 - Fixed illegal token state transition
    via TEMP_LOST. [edewata]


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-3
changelog:
  - PKI TRAC Ticket #691  - [MAN] pki-server man pages (mharmsen)
  - PKI TRAC Ticket #1114 - [MAN] Generting Symmetric key fails with
    key-generate when --usages verify is passed (jmagne)
  - PKI TRAC Ticket #1306 - [RFE] Add granularity to token termination in TPS
    (cfu)
  - PKI TRAC Ticket #1308 - [RFE] Provide ability to perform off-card key
    generation for non-encryption token keys (cfu)
  - PKI TRAC Ticket #1405 - [MAN] Add additional HSM details to
    'pki_default.cfg' & 'pkispawn' man pages (mharmsen)
  - PKI TRAC Ticket #1607 - [MAN] man pkispawn has inadequate description for
    shared vs non shared tomcat instance installation (mharmsen)
  - PKI TRAC Ticket #1664 - [BUG] Add ability to disallow TPS to enroll a single
    user on multiple tokens. (jmagne)
  - PKI TRAC Ticket #1711 - CLI :: pki-server ca-cert-request-find throws
    IOError (edewata, ftweedal)
  - PKI TRAC Ticket #2285 - freeipa fails to start correctly after pki-core
    update on upgraded system (ftweedal)
  - PKI TRAC Ticket #2311 - When pki_token_name=Internal, consider normalizing
    it to "internal" (mharmsen)
  - PKI TRAC Ticket #2349 - Separated TPS does not automatically receive shared
    secret from remote TKS (jmagne)
  - PKI TRAC Ticket #2364 - CLI :: pki-server ca-cert-request-show throws
    attribute error (ftweedal)
  - PKI TRAC Ticket #2368 - pki-server subsystem subcommands throws error with
    --help option (edewata)
  - PKI TRAC Ticket #2374 - KRA cloning overwrites CA signing certificate trust
    flags (edewata)
  - PKI TRAC Ticket #2380 - Pki-server instance commands throws exception while
    specifying invalid parameters. (edewata)
  - PKI TRAC Ticket #2384 - CA installation with HSM prompts for HSM password
    during silent installation (edewata)
  - PKI TRAC Ticket #2385 - Upgraded CA lacks ca.sslserver.certreq in CS.cfg
    (ftweedal)
  - PKI TRAC Ticket #2387 - Add config for default OCSP URI if none given
    (ftweedal)
  - PKI TRAC Ticket #2388 - CA creation responds 500 if certificate issuance
    fails (ftweedal)
  - PKI TRAC Ticket #2389 - Installation: subsystem certs could have notAfter
    beyond CA signing cert in case of external or existing CA (cfu)
  - PKI TRAC Ticket #2390 - Dogtag 10.3.4: Miscellaneous Enhancements
    (akasurde, edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-5
changelog:
  - PKI TRAC Ticket #978  - TPS connector man page: add revocation routing
    info (cfu)
  - PKI TRAC Ticket #1285 - [MAN] Apply 'generateCRMFRequest() removed from
    Firefox' workarounds to appropriate 'pki' man page (jmagne)
  - PKI TRAC Ticket #2246 - [MAN] Man Page: AuditVerify (cfu)
  - PKI TRAC Ticket #2381 - Throws exception while providing invalid module.
    (edewata)
  - PKI TRAC Ticket #2383 - CLI :: pki client-cert-request --extractable
    should accept only boolean value (edewata)
  - PKI TRAC Ticket #2389 - Installation: subsystem certs could have notAfter
    beyond CA signing cert in case of external or existing CA (cfu)
  - PKI TRAC Ticket #2399 - Dogtag 10.3.5: Miscellaneous Enhancements
    (akasurde, alee, cheimes, edewata, jmagne, mharmsen)
  - PKI TRAC Ticket #2401 - pkispawn calls dnsdomainname even if it does not
    rpm-require hostname (mharmsen)
  - PKI TRAC Ticket #2402 - Conflict in file ownership in pki-base and
    pki-server (cheimes)
  - PKI TRAC Ticket #2403 - Deployment problem with RESTEasy 3.0.17 (edewata)
  - PKI TRAC Ticket #2406 - Make starting CRL Number configurable (jmagne)
  - PKI TRAC Ticket #2412 - pki client-cert-import --trust option does not
    apply the specified trust bits (alee)
  - PKI TRAC Ticket #2418 - [TPS] Some template substitution didn't happen
    during installation (alee)
  - PKI TRAC Ticket #2420 - CA subsystem OSCP responder fails when LWCAs are
    not used (ftweedal)
  - PKI TRAC Ticket #2421 - Incorrect SELinux contexts
    Installation/Configuration (edewata)
  - PKI TRAC Ticket #2424 - ipa-ca-install fails on replica when IPA server
    is converted from CA-less to CA-full (edewata)
  - PKI TRAC Ticket #2428 - broken request links for CA's system certs in
    agent request viewing (cfu)
  - PKI TRAC Ticket #2430 - CA Agent certificate list is not sorted by serial
    number in migration case (jmagne)
  - PKI TRAC Ticket #2431 - Errors noticed during ipa server upgrade.
    (mharmsen)
  - PKI TRAC Ticket #2433 - Lightweight CA GET <id>/chain returns bogus PEM
    data (ftweedal)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-7
changelog:
  - PKI TRAC Ticket #690 - [MAN] pki-tools man pages (mharmsen)
    - CMCEnroll
  - PKI TRAC Ticket #833 - pki user-mod fullName="" gives an error message
    "PKIException: LDAP error (21): error result" (edewata)
  - PKI TRAC Ticket #2431 - Errors noticed during ipa server upgrade.
    (cheimes, edewata, mharmsen)
  - PKI TRAC Ticket #2432 - Kra-selftest behavior is not as expected (edewata)
  - PKI TRAC Ticket #2436 - Dogtag 10.3.6: Miscellaneous Enhancements
    (edewata, mharmsen)
  - PKI TRAC Ticket #2437 - TPS UI: while adding certs for users from TPSUI pem
    format with/without header works while pkcs7 with header is not allowed
    (edewata)
  - PKI TRAC Ticket #2440 - Optional CA signing CSR for migration (edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-8
changelog:
  - PKI TRAC Ticket #1578 - Authentication Instance Id PinDirEnrollment with authType value as SslclientAuth is not working (jmagne)
  - PKI TRAC TIcket #2414 - pki pkcs12-cert-del shows a successfully deleted message when a wrong nickname is provided (gkapoor)
  - PKI TRAC Ticket #2423 - pki_ca_signing_token when not specified does not fallback to pki_token_name value (edewata)
  - PKI TRAC Ticket #2436 - Dogtag 10.3.6: Miscellaneous Enhancements (akasurde) - ticket remains open
  - PKI TRAC Ticket #2439 - Outdated deployment descriptors in upgraded server(edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-9
changelog:
  - PKI TRAC Ticket #1638 - Lightweight CAs: revoke certificate on CA deletion
    (ftweedal)
  - PKI TRAC Ticket #2436 - Dogtag 10.3.6: Miscellaneous Enhancements
    (edewata)
  - PKI TRAC Ticket #2443 - Prevent deletion of host CA's keys if LWCA entry
    deleted (ftweedal)
  - PKI TRAC Ticket #2444 - Authority entry without entryUSN is skipped even if
    USN plugin enabled (ftweedal)
  - PKI TRAC Ticket #2446 - pkispawn: make subject_dn defaults unique per
    instance name (for shared HSM) (cfu)
  - PKI TRAC Ticket #2447 - CertRequestInfo has incorrect URLs (vakwetu)
  - PKI TRAC Ticket #2449 - Unable to create system certificates in different
    tokens (edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-10
changelog:
  - Revert Patch:  PKI TRAC Ticket #2449 - Unable to create system certificates
    in different tokens (edewata)
  - Resolves:  rhbz #1374054 - ipa-replica-install fails setting up certificate
  - Restores:  rhbz #1319557 - pkispawn KRA instance is failing server
  - Removes from Errata:  rhbz #1372041 - Unable to create system certificates
    in different tokens


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-11
changelog:
  - PKI TRAC Ticket #1527 - TPS Enrollment always goes to "ca1" (cfu)
  - PKI TRAC Ticket #1664 - [BUG] Add ability to disallow TPS to enroll a single
    user on multiple tokens. (jmagne)
  - PKI TRAC Ticket #2478 - pkispawn fails as it is not able to find openssl as a
    dependency package (mharmsen)
  - PKI TRAC Ticket #2483 - Unable to read an encrypted email using renewed
    tokens (jmagne)
  - PKI TRAC Ticket #2496 - Cert/Key recovery is successful when the cert serial
    number and key id on the ldap user mismatches (cfu)
  - PKI TRAC Ticket #2505 - Fix packaging duplicates of classes in multiple jar
    files (edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-12
changelog:
  - ## RHEL 7.3.z Batch Update 1
  - Bugzilla Bug #1390318 - CA EE: Submit caUserCert request without uid does
    not show proper error message (alee)
  - Bugzilla Bug #1390319 - Failed to start pki-tomcatd Service
    ("ipa-cacert-manage renew" failed?) (edewata)
  - Bugzilla Bug #1390320 - pkispawn fails as it is not able to find openssl as
    a dependency package (mharmsen)
  - Bugzilla Bug #1390321 - two-step externally-signed CA installation fails due
    to missing AuthorityID (ftweedal)
  - Bugzilla Bug #1390322 - Spurious host authority entries created (ftweedal)
  - Bugzilla Bug #1390324 - KRA installation failed against externally-signed CA
    with partial certificate chain (edewata)
  - Bugzilla Bug #1389757 - Problems with FIPS mode (edewata)
  - Bugzilla Bug #1390311 - Fix packaging duplicates of classes in multiple jar
    files (edewata)
  - Bugzilla Bug #1390325 - Typo in comment line of UserPwdDirAuthentication.java
    (edewata)
  - ## RHCS 9.1.z Batch Update 1
  - Bugzilla Bug #1248553 - TPS Enrollment always goes to "ca1" (cfu)
  - Bugzilla Bug #1274096 -  [BUG] Add ability to disallow TPS to enroll a
    single user on multiple tokens. (jmagne)
  - Bugzilla Bug #1379379 - Unable to read an encrypted email using renewed
    tokens (jmagne)
  - Bugzilla Bug #1379749 - Automatic recovery of encryption cert is not working
    when a token is physically damaged and a temporary token is issued (jmagne)
  - Bugzilla Bug #1381375 - Cert/Key recovery is successful when the cert serial
    number and key id on the ldap user mismatches
  - Bugzilla Bug #1381635 - Token format with external reg fails when
    op.format.externalRegAddToToken.revokeCert=true (cfu)
  - Bugzilla Bug #1382762 - PIN_RESET policy is not giving expected results when
    set on a token (jmagne)
  - Bugzilla Bug #1382862 - TPS token enrollment fails to setupSecureChannel
    when TPS and TKS security db is on fips mode. (jmagne)
  - Bugzilla Bug #1386257 - Changes to target.agent.approve.list parameter is
    not reflected in the TPS Web UI (edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-13
changelog:
  - ## RHEL 7.3.z Batch Update 1
  - Bugzilla Bug #1389757 - Problems with FIPS mode (edewata)
    (added KRA key recovery via CLI in FIPS mode)
  - ## RHCS 9.1.z Batch Update 1
  - Reverted patches associated with
    Bugzilla Bug #1386257 - Changes to target.agent.approve.list parameter is
    not reflected in the TPS Web UI (edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-14
changelog:
  - Marked the following RHCS 9.1.z bug:
    Bugzilla Bug #1382862 - TPS token enrollment fails to setupSecureChannel
    when TPS and TKS security db is on fips mode. (jmagne)
    as a duplicate of RHEL 7.3.z bug:
    Bugzilla Bug #1389757 - Problems with FIPS mode (edewata)
    and moved the patch from the RHCS 9.1.z bug to the RHEL 7.3.z bug.


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-15
changelog:
  - ## RHEL 7.3.z Batch Update 2
  - Bugzilla Bug #1404173 - user-cert-add --serial CLI request to secure port
    with remote CA shows authentication failure (edewata)
  - Bugzilla Bug #1404175 -  pki ca-cert-request-submit fails presumably because
    of missing authentication even if it should not require any (edewata)
  - Bugzilla Bug #1404178 - Changes to target.agent.approve.list parameter is
    not reflected in the TPS Web UI [pki-base] (edewata)
  - Bugzilla Bug #1404172 - Unable to install subordinate CA with HSM in FIPS
    mode (edewata)
  - Bugzilla Bug #1403689 - pkispawn does not change default ecc key size from
    nistp256 when nistp384 is specified in spawn config (jmagne)
  - Bugzilla Bug #1404176 - logging properties and man pages (edewata)
  - ## RHCS 9.1.z Batch Update 2
  - Bugzilla Bug #1386257 - Changes to target.agent.approve.list parameter is
    not reflected in the TPS Web UI [pki-tps] (edewata)
  - Bugzilla Bug #1391207 - Automatic recovery of encryption cert - CA and TPS
    tokendb shows different certificate status (cfu)
  - Bugzilla Bug #1395479 -  TPS throws "err=6" when attempting to format and
    enroll G&D Cards (jmagne)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-16
changelog:
  - Separate original patches into RHEL and RHCS portions
  - ## RHEL 7.3.z Batch Update 2
  - Bugzilla Bug #1404176 - logging properties and man pages (edewata)
  - Bugzilla Bug #1405328 - TPS throws "err=6" when attempting to format and
    enroll G&D Cards (jmagne)
  - ## RHCS 9.1.z Batch Update 2
  - Bugzilla Bug #1395479 - TPS throws "err=6" when attempting to format and
    enroll G&D Cards (jmagne)
  - Bugzilla Bug #1404900 - RHCS logging properties (edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-17
changelog:
  - ## RHCS 9.1.z Batch Update 3
  - Bugzilla Bug #1391207 - Automatic recovery of encryption cert - CA and TPS
    tokendb shows different certificate status (cfu)
  - ## RHEL 7.3.z Batch Update 3
  - Bugzilla Bug #1417063 - ECDSA Certificates Generated by Certificate System
    8.1 fail NIST validation test with parameter field. (cfu)
  - Bugzilla Bug #1417064 - Unable to search certificate requests using the
    latest request ID (edewata)
  - Bugzilla Bug #1417065 - CA Certificate Issuance Date displayed on CA website
    incorrect (alee)
  - Bugzilla Bug #1417066 - update to 7.3 IPA with otpd bugfixes, tomcat will
    not finish start, hangs (ftweedal)
  - Bugzilla Bug #1417067 - pki-tomcat for 10+ minutes before generating cert
    (edewata)
  - Bugzilla Bug #1417190 - Problem with default AJP hostname in IPv6
    environment. (edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-18
changelog:
  - ## RHEL 7.3.z Batch Update 4
  - Bugzilla Bug #1429492 - Add profile component that copies CN to SAN
    (ftweedal)


author: Dogtag Team <pki-devel@redhat.com> 10.4.0-1
changelog:
  - Require "jss >= 4.4.0-1" as a build and runtime requirement
  - Require "tomcatjss >= 7.2.1-1" as a build and runtime requirement
  - ############################################################################
  - Bugzilla Bug #1394309 - Rebase pki-core to 10.4.x in RHEL-7.4
  - Bugzilla Bug #1394315 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.4.x
  - ############################################################################
  - RHEL 7.4:
  - ############################################################################
  - Bugzilla Bug #1222557 - ECDSA Certificates Generated by Certificate System
    8.1 fail NIST validation test with parameter field. (cfu)
  - Bugzilla Bug #1238684 - Generting Symmetric key fails with key-generate
    when --usages verify (vakwetu)
  - Bugzilla Bug #1246635 - user-cert-add --serial CLI request to secure port
    with remote CA shows authentication failure (edewata)
  - Bugzilla Bug #1249400 - CA EE: Submit caUserCert request without uid does
    not show proper error message (vakwetu)
  - Bugzilla Bug #1305993 - Add profile component that copies CN to SAN
    (ftweedal)
  - Bugzilla Bug #1316653 - pki ca-cert-request-submit fails presumably because
    of missing authentication even if it should not require any (edewata)
  - Bugzilla Bug #1325071 - add options to enable/disable cert or crl
    publishing. (vakwetu)
  - Bugzilla Bug #1330800 - Failed to start pki-tomcatd Service
    ("ipa-cacert-manage renew" failed?) (edewata)
  - Bugzilla Bug #1368410 - Misleading Logging for HSM (edewata)
  - Bugzilla Bug #1372052 - Unable to search certificate requests using the
    latest request ID (edewata)
  - Bugzilla Bug #1375347 - Typo in comment line of
    UserPwdDirAuthentication.java (edewata)
  - Bugzilla Bug #1376226 - IPA replica-prepare failed with error
    "Profile caIPAserviceCert Not Found" (ftweedal)
  - Bugzilla Bug #1376488 - pkispawn fails as it is not able to find openssl as
    a dependency package (mharmsen)
  - Bugzilla Bug #1378275 - two-step externally-signed CA installation fails due
    to missing AuthorityID (ftweedal)
  - Bugzilla Bug #1378277 - Spurious host authority entries created (ftweedal)
  - Bugzilla Bug #1378527 - Miscellaneous Minor Changes (edewata)
  - Bugzilla Bug #1381084 - KRA installation failed against externally-signed CA
    with partial certificate chain (edewata)
  - Bugzilla Bug #1382066 - Problems with FIPS mode (edewata)
  - Bugzilla Bug #1386371 - Remove xenroll.dll from pki-core (mharmsen)
  - Bugzilla Bug #1386424 - Fix packaging duplicates of classes in multiple jar
    files (edewata)
  - Bugzilla Bug #1391737 - Changes to target.agent.approve.list parameter is
    not reflected in the TPS Web UI (RHEL 7) (edewata)
  - Bugzilla Bug #1392068 - [RFE] add express archivals and retrievals from KRA
    (vakwetu)
  - Bugzilla Bug #1395817 - Unable to install subordinate CA with HSM in FIPS
    mode (edewata)
  - Bugzilla Bug #1397200 - pkispawn does not change default ecc key size from
    nistp256 when nistp384 is specified in spawn config (jmagne)
  - Bugzilla Bug #1399862 - Dogtag 10.3.9 Man Pages (edewata)
  - Bugzilla Bug #1404881 - TPS throws "err=6" when attempting to format and
    enroll G&D Cards (jmagne)
  - Bugzilla Bug #1405654 - Token memory not wiped after key deletion (RHEL)
    (jmagne)
  - Bugzilla Bug #1409946 - Request ID undefined for CA signing certificate
    (vakwetu)
  - Bugzilla Bug #1409949 - CA Certificate Issuance Date displayed on CA website
    incorrect (vakwetu)
  - Bugzilla Bug #1410650 - [RFE] Add SCP03 support (RHEL) (jmagne)
  - Bugzilla Bug #1411428 - Unable to create a CA clone in FIPS (edewata)
  - Bugzilla Bug #1412211 - Unable to set up KRA in FIPS (edewata)
  - Bugzilla Bug #1412681 - update to 7.3 IPA with otpd bugfixes, tomcat will
    not finish start, hangs (ftweedal)
  - Bugzilla Bug #1413132 - pki-tomcat for 10+ minutes before generating cert
    (edewata)
  - Bugzilla Bug #1413136 - Problem with default AJP hostname in IPv6
    environment. (edewata)
  - ############################################################################
  - RHCS 9.2:
  - ############################################################################
  - Bugzilla Bug #1248553 - TPS Enrollment always goes to "ca1 (cfu)
  - Bugzilla Bug #1274086 - [RFE] Add SCP03 support (RHCS) (jmagne)
  - Bugzilla Bug #1274096 - [BUG] Add ability to disallow TPS to enroll a single
    user on multiple tokens. (jmagne)
  - Bugzilla Bug #1379379 - Unable to read an encrypted email using renewed
    tokens (jmagne)
  - Bugzilla Bug #1379749 - Automatic recovery of encryption cert is not working
    when a token is physically damaged and a temporary token is issued (jmagne)
  - Bugzilla Bug #1381375 - Cert/Key recovery is successful when the cert serial
    number and key id on the ldap user mismatches (cfu)
  - Bugzilla Bug #1381635 - Token format with external reg fails when
    op.format.externalRegAddToToken.revokeCert=true (cfu)
  - Bugzilla Bug #1382762 - PIN_RESET policy is not giving expected results when
    set on a token (jmagne)
  - Bugzilla Bug #1386257 - Changes to target.agent.approve.list parameter is
    not reflected in the TPS Web UI (RHCS 9) (edewata)
  - Bugzilla Bug #1391207 - Automatic recovery of encryption cert - CA and TPS
    tokendb shows different certificate status (cfu)
  - Bugzilla Bug #1395479 - TPS throws "err=6" when attempting to format and
    enroll G&D Cards (RHCS) (jmagne)
  - Bugzilla Bug #1404900 - Dogtag 10.3.9 logging properties (edewata)
  - Bugzilla Bug #1405655 - Token memory not wiped after key deletion (RHCS)
    (jmagne)
  - ############################################################################


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-1
changelog:
  - Require "nss >= 3.28.3" as a build and runtime requirement
  - Require "jss >= 4.4.0-4" as a build and runtime requirement
  - Require "tomcatjss >= 7.2.1-3" as a build and runtime requirement
  - dogtagpki Pagure Issue #2612 - Unable to clone due to pki pkcs12-cert-find
    failure (edewata)
  - ############################################################################
  - Bugzilla Bug #1394309 - Rebase pki-core to 10.4.x in RHEL-7.4
  - Bugzilla Bug #1394315 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.4.x
  - ############################################################################
  - RHEL 7.4:
  - ############################################################################
  - ############################################################################
  - RHCS 9.2:
  - ############################################################################
  - ############################################################################
  - Common Criteria
  - ############################################################################
  - Bugzilla Bug #1419734 - CC: CMC: id-cmc-identityProofV2 feature
    implementation (cfu)
  - Bugzilla Bug #1419742 - CC: CMC: provide Proof of Possession for encryption
    cert requests (cfu)
  - Bugzilla Bug #1404080 - CC: add audit event: various SSL/TLS failures
    (edewata)
  - Bugzilla Bug #1428020 - CC: CMC feature support: provided issuance
    protection cert mechanism (cfu)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-2
changelog:
  - ############################################################################
  - RHEL 7.4:
  - ############################################################################
  - Bugzilla Bug #1282504 - Installing pki-server in container reports
    scriptlet failed, exit status 1 (jpazdziora)
  - Bugzilla Bug #1400149 - pkispawn fails to create CA subsystem on FIPS
    enabled system (edewata)
  - Bugzilla Bug #1410650 - [RFE] Add SCP03 support
    for sc 7 g & d cards (RHEL) (jmagne)
  - Bugzilla Bug #1437591 - cli authentication using expired cert throws an
    exception (edewata)
  - Bugzilla Bug #1437602 - non-CA cli looks for CA in the instance during a
    request (edewata)
  - ############################################################################
  - RHCS 9.2:
  - ############################################################################
  - Bugzilla Bug #1274086 - [RFE] Add SCP03 support
    for sc 7 g & d cards (RHCS) (jmagne)
  - ############################################################################
  - Common Criteria
  - ############################################################################
  - Bugzilla Bug #1404080 - CC: add audit event: various SSL/TLS failures
    (edewata)
  - Bugzilla Bug #1417307 - CC: Audit Review /Searches (edewata)
  - Bugzilla Bug #1419737 - CC: CMC: id-cmc-popLinkWitnessV2 feature
    implementation (cfu)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-3
changelog:
  - ############################################################################
  - RHEL 7.4:
  - ############################################################################
  - Bugzilla Bug #1303683 - dogtag should support GSSAPI based auth in
    conjuction with FreeIPA (ftweedal)
  - Bugzilla Bug #1385208 - RHCS 9.1 RC5 CA in the certificate profiles the
    startTime parameter is not working as expected. (jmagne)
  - Bugzilla Bug #1419756 - CC: allow CA to process pre-signed CMC non-signing
    certificate requests (cfu)
  - Bugzilla Bug #1426754 - PKCS12: upgrade to at least AES and SHA2 (ftweedal)
  - Bugzilla Bug #1445088 - profile modification cannot remove existing config
    parameters (ftweedal)
  - Bugzilla Bug #1445535 - CC: Crypto Operation (AES Encryption/Decryption)
    (RHEL) (alee)
  - Bugzilla Bug #1446874 - Missing ClientIP and ServerIP in audit log when
    pki CLI terminates SSL connection (edewata)
  - Bugzilla Bug #1446875 - Session timeout for PKI console (RHEL) (edewata)
  - ############################################################################
  - RHCS 9.2:
  - ############################################################################
  - Bugzilla Bug #1404480 - CC: Crypto Operation (AES Encryption/Decryption)
    (RHCS) (alee)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-4
changelog:
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1386303 - cannot extract generated private key from KRA when
    HSM is used. (alee)
  - Bugzilla Bug #1446364 - pkispawn returns before tomcat is ready (cheimes)
  - Bugzilla Bug #1447145 - CMC: cmc.popLinkWitnessRequired=false would cause
    error (cfu)
  - Bugzilla Bug #1448203 - CAInfoService: retrieve KRA-related values from
    the KRA (ftweedal)
  - Bugzilla Bug #1448204 - pkispawn of clone install fails with
    InvalidBERException (ftweedal)
  - Bugzilla Bug #1448521 - kra unable to extract symmetric keys generated on
    thales hsm (alee)
  - Updated "jss" build and runtime requirements (mharmsen)
  - ##########################################################################
  - RHCS 9.2:
  - ##########################################################################
  - Bugzilla Bug #1274086 - [RFE] Add SCP03 support (RHCS) (jmagne)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-5
changelog:
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1419761 - CC: allow CA to process pre-signed CMC renewal
    non-signing cert requests (cfu)
  - Bugzilla Bug #1447080 - CC: CMC: allow enrollment key signed (self-signed)
    CMC with identity proof (cfu)
  - Bugzilla Bug #1447144 - CA brought down during separate KRA instance
    creation (mharmsen)
  - Bugzilla Bug #1448903 - exception Invalid module "--ignore-banner" when
    defined in ~/.dogtag/pki.conf and run pki pkcs12-import --help (edewata)
  - Bugzilla Bug #1450143 - CA installation with HSM in FIPS mode fails (jmagne)
  - Bugzilla Bug #1452123 - CA CS.cfg shows default port (mharmsen)
  - Bugzilla Bug #1452250 - Inconsistent CERT_REQUEST_PROCESSED event in
    ConnectorServlet. (edewata)
  - Bugzilla Bug #1452340 - Ensuring common audit log correctness (edewata)
  - Bugzilla Bug #1452344 - Adding serial number into CERT_REQUEST_PROCESSED
    audit event. (edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-7
changelog:
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1393633 - Creating symmetric key (sharedSecret)
    using tkstool is failing when RHEL 7.3 is in FIPS mode. (jmagne)
  - Bugzilla Bug #1445519 - CA Server installation with HSM fails
    (jmagne)
  - Bugzilla Bug #1452617 - Unable to create IPA Sub CA
    (ftweedal)
  - Bugzilla Bug #1454471 - Enabling all subsystems on startup
    (edewata)
  - Bugzilla Bug #1455617 - Key recovery on token fails because
    key record is not marked encrypted (alee)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-8
changelog:
  - Require "selinux-policy-targeted >= 3.13.1-159" as a runtime requirement
  - Require "tomcatjss >= 7.2.1-4" as a build and runtime requirement
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1400149 - pkispawn fails to create CA subsystem on FIPS
    enabled system (edewata)
  - Bugzilla Bug #1447144 - CA brought down during separate KRA instance
    creation (edewata)
  - Bugzilla Bug #1447762 - pkispawn fails occasionally with this failure
    ACCESS_SESSION_ESTABLISH_FAILURE (edewata)
  - Bugzilla Bug #1454450 - SubCA installation failure with 2 step
    installation in fips enabled mode (edewata)
  - Bugzilla Bug #1456597 - Certificate import using pki client-cert-import
    is asking for password when already provided (edewata)
  - Bugzilla Bug #1456940 - Build failure due to Pylint issues (cheimes)
  - Bugzilla Bug #1458043 - Key recovery using externalReg fails
    with java null pointer exception on KRA (alee)
  - Bugzilla Bug #1458379 - Upgrade script for keepAliveTimeout parameter
    (edewata)
  - Bugzilla Bug #1458429 - client-cert-import --ca-cert should
    import CA cert with trust bits "CT,C,C" (edewata)
  - ##########################################################################
  - RHCS 9.2:
  - ##########################################################################
  - Bugzilla Bug #1274086 - [RFE] Add SCP03 support (RHCS) (jmagne)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-9
changelog:
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1393633 - Creating symmetric key (sharedSecret)
    using tkstool is failing when RHEL 7.3 is in FIPS mode. (jmagne)
  - Bugzilla Bug #1419756 - CC: allow CA to process pre-signed CMC
    non-signing certificate requests (cfu)
  - Bugzilla Bug #1419777 - CC: allow CA to process pre-signed CMC
     revocation non-signing cert requests (cfu)
  - Bugzilla Bug #1458047 - change the way aes clients refer to
    aes keysets (alee)
  - Bugzilla Bug #1458055 - dont reuse IVs in the CMC code
    (alee)
  - Bugzilla Bug #1460028 - In keywrap mode, key recovery on
    KRA with HSM causes KRA to crash (ftweedal)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-10
changelog:
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1458043 - Key recovery on token fails with
    invalid public key error on KRA (alee)
  - Bugzilla Bug #1460764 - CC: CMC: check HTTPS client
    authentication cert against CMC signer (cfu)
  - Bugzilla Bug #1461533 - Unable to find keys in the p12 file after
    deleting the any of the subsystem certs from it (ftweedal)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-11
changelog:
  - Resolves: rhbz #1469432
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1469432 - CMC plugin default change
  - Resolves CVE-2017-7537
  - Fixes BZ #1470948


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-12
changelog:
  - Resolves: rhbz #1472615,1472617,1469447,1463350,1469449,1472619,1464970,1469437,1469439,1469446
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1472615 - CC: allow CA to process pre-signed CMC non-signing
    certificate requests (cfu)
    [PREVIOUS PATCH:  pki-core-beta.patch]
    [PREVIOUS PATCH:  pki-core-snapshot-4.patch]
  - Bugzilla Bug #1472617 - CMC: cmc.popLinkWitnessRequired=false would cause
    error (cfu)
    [PREVIOUS PATCH:  pki-core-post-beta.patch]
  - Bugzilla Bug #1469447 - CC: CMC: check HTTPS client authentication cert
    against CMC signer (cfu)
    [PREVIOUS PATCH:  pki-core-CMC-check-HTTPS-client-authentication-cert.patch]
  - Bugzilla Bug #1463350 - Access banner validation (edewata)
    [pki-core-server-access-banner-validation.patch]
  - Bugzilla Bug #1469449 - CC: allow CA to process pre-signed CMC renewal
    non-signing cert requests (cfu)
    [PREVIOUS PATCH:  pki-core-snapshot-1.patch]
    [pki-core-pre-signed-CMC-renewal-UniqueKeyConstraint.patch]
  - Bugzilla Bug #1472619 - Platform Dependent Python Import (mharmsen)
    [pki-core-platform-dependent-python-import.patch]
  - Bugzilla Bug #1464970 - CC: CMC: replace id-cmc-statusInfo with
    id-cmc-statusInfoV2 (cfu)
    [pki-core-CMC-id-cmc-statusInfoV2.patch]
  - Bugzilla Bug #1469437 - subsystem-cert-update command lacks --cert option
    (dmoluguw)
    [pki-core-subsystem-cert-update-CLI-cert-option.patch]
  - Bugzilla Bug #1469439 - Fix Key Changeover with HSM to support SCP03
    (jmagne)
    [pki-core-HSM-key-changeover-SCP03-support.patch]
  - Bugzilla Bug #1469446 - CC: need CMC enrollment profiles for system
    certificates (cfu)
    [pki-core-system-cert-CMC-enroll-profile.patch]


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-13
changelog:
  - Resolves: rhbz #1463350
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1463350 - Access banner validation (edewata)
    [pki-core-server-access-banner-retrieval-validation.patch]


author: Adam Jackson <ajax@redhat.com> 0.8.0-3
changelog:
  - poppler-0.8.0-ocg-crash.patch: Fix a crash when no optional content
    groups are defined.
  - Mangle configure to account for the new directory for qt3 libs.
  - Fix grammar in %description.


author: Marek Kasik <mkasik@redhat.com> - 0.12.3-3
changelog:
  - Correct permissions of goo/GooTimer.h
  - Convert pdftohtml.1 to utf8
  - Make the pdftohtml's Provides/Obsoletes versioned


author: Marek Kasik <mkasik@redhat.com> - 0.15.0-5
changelog:
  - Add poppler-0.15.0-CVE-2010-3702.patch
      (Properly initialize parser)
  - Add poppler-0.15.0-CVE-2010-3703.patch
      (Properly initialize stack)
  - Add poppler-0.15.0-CVE-2010-3704.patch
      (Fix crash in broken pdf (code < 0))
  - Resolves: #639861


author: Marek Kasik <mkasik@redhat.com> - 0.17.3-2
changelog:
  - Don't include pdfextract and pdfmerge in resulting packages for now
  - since they conflict with packages pdfmerge and mupdf (#740906)


author: Marek Kasik <mkasik@redhat.com> 0.18.4-3
changelog:
  - Backport of a patch which sets mask matrix before drawing an image with a mask
  - Resolves: #817378


author: Marek Kasik <mkasik@redhat.com> 0.20.2-6
changelog:
  - Backport most of the changes from poppler-0.20.3 - poppler-0.20.5
  -   (those which doesn't change API or ABI and are important)
  - See poppler-0.20.3-5.patch for detailed list of included commits


author: Marek Kasik <mkasik@redhat.com> 0.22.5-2
changelog:
  - Add poppler-0.22.5-CVE-2013-4473.patch
      (Limit length of output to pathName buffer)
  - Add poppler-0.22.5-CVE-2013-4474.patch
      (Check file pattern)
  - Resolves: #1025160


author: Marek Kasik <mkasik@redhat.com> - 0.26.5-1
changelog:
  - Update to 0.26.5
  - Remove unused patches
  - Rereview patches from fedora
  - Modify RHEL patches so that they apply
  - Disable Qt5 explicitly
  - Resolves: #1174537


author: Marek Kasik <mkasik@redhat.com> - 0.26.5-4
changelog:
  - Bump sonames of all frontends so that they loads symbols
  - from correct libpoppler.so.* when the compat-poppler022
  - package is installed.
  - Resolves: #1174537


author: Marek Kasik <mkasik@redhat.com> - 0.26.5-5
changelog:
  - Remove PFB headers from embedded Type1 fonts
  - before embedding them into a PostScript file.
  - Resolves: #1241488


author: Kaj J. Niemi <kajtzu@fi.basen.net> 7.4-0.1
changelog:
  - 7.4
  - Fixed Patch #1 (now rpm-pgsql-7.4.patch)
  - Fixed Patch #2 (now rpm-multilib-7.4.patch):
  - Patch #4 is unnecessary (upstream)
  - Fixed Patch #6 (now postgresql-7.4-src-tutorial.patch)
  - Added Patch #8 (postgresql-7.4-com_err.patch) as com_err()
    is provided by e2fsprogs and CPPFLAGS gets lost somewhere
    inside configure (bad macro?)
  - No 7.4 PDF docs available yet (Source #17)
  - PyGreSQL is separated from the upstream distribution but
    we include it as usual (Source #18)
  - Default to compiling libpq and ECPG as fully thread-safe

  - 7.4 Origin.  See previous spec files for previous history. Adapted
  - from Red Hat and PGDG's 7.3.4 RPM, directly descended from 
  - postgresql-7.3.4-2 as shipped in Fedora Core 1.


author: Lamar Owen <lowen@pari.edu> <lamar.owen@wgcr.org>
changelog:
  - 7.4-0.1PGDG
  - Development JDBC jars in addition to the 7.3 jars; will replace the
  - 7.3 jars once 7.4 official jars are released.
  - Changed to use the bzip2 source to save a little size.
  - Removed some commented out portions of the specfile.
  - Removed the 7.3.4 PDF docs.  Will replace with 7.4 PDF's once they
  - are ready.


author: David Jee <djee@redhat.com> 7.4-4
changelog:
  - Add PyGreSQL patch for deprecated column pg_type.typprtlen [Bug #111263]
  - Add headers patch which moves ecpg headers to /usr/include/ecpg
    [Bug #111195]


author: Lamar Owen <lowen@pari.edu>
changelog:
  - 7.4.1-1PGDG
  - Merge Sander Steffann's changes up to 7.4-0.5PGDG
  - Proper 7.4.1 JDBC jars this time.
  - Patch for no pl/python from Alvaro


author: Tom Lane <tgl@redhat.com> 7.4.2-1
changelog:
  - Update to PostgreSQL 7.4.2; sync with community SRPM as much as possible.
  - Support PGOPTS from /etc/sysconfig/pgsql, per bug 111504.
  - Fix permissions on /etc/sysconfig/pgsql, per bug 115278.
  - SELinux patch in init file: always su </dev/null, per bug 117901.
  - Rebuilt


author: Tom Lane <tgl@redhat.com> 7.4.3-1
changelog:
  - Update to PostgreSQL 7.4.3.
  - Uninstalling server RPM stops postmaster first, per bug 114846.
  - Fix su commands to not assume PG user's shell is sh-like, per bug 124024.
  - Fix permissions on postgresql-python doc files, per bug 124822.
  - Minor postgresql.init improvements.


author: Tom Lane <tgl@redhat.com> 7.4.3-3
changelog:
  - Undo ill-considered chkconfig change that causes server to start
    immediately upon install.  Mea culpa (bug 127552).


author: Tom Lane <tgl@redhat.com> 7.4.5-1
changelog:
  - Update to PostgreSQL 7.4.5.
  - Update JDBC jars to driver build 215.
  - Add Obsoletes: entries for rh-postgresql packages, per bug 129278.


author: Tom Lane <tgl@redhat.com> 7.4.5-3
changelog:
  - Solve the stale lockfile problem (bugs 71295, 96981, 134090)
  - Use runuser instead of su for SELinux (bug 134588)


author: Tom Lane <tgl@redhat.com> 7.4.5-4
changelog:
  - Remove contrib/oidjoins stuff from installed fileset; it's of no use
    to ordinary users and has a security issue (bugs 136300, 136301)
  - adjust chkconfig priority (bug 128852)


author: Tom Lane <tgl@redhat.com> 7.4.6-1
changelog:
  - Update to PostgreSQL 7.4.6 (bugs 136947, 136949)
  - Make init script more paranoid about mkdir step of initializing a new
    database (bugs 136947, 136949)


author: Tom Lane <tgl@redhat.com> 7.4.6-3
changelog:
  - Update to PyGreSQL 3.6 (to fix bug #142711)
  - Adjust a few file permissions (bug #142431)
  - Assign %{_libdir}/pgsql to base package instead of -server (bug #74003)


author: Tom Lane <tgl@redhat.com> 8.0.0-1
changelog:
  - Update to PostgreSQL 8.0.0, PyGreSQL 3.6.1, pgtcl 1.5.2,
    and jdbc driver build 309.
  - Extensive cleanout of obsolete cruft in patch set.
  - Regression tests are run during RPM build (NOTE: cannot build as root when
    this is enabled).
  - Postmaster stderr goes someplace useful, not /dev/null (bz#76503, #103767)
  - Make init script return a useful exit status (bz#80782)
  - Move docs' tutorial directory to %{_libdir}/pgsql/tutorial, since it
    includes .so files that surely do not belong under /usr/share.
  - Remove useless .sgml files from docs RPM (bz#134450)
  - Put regression tests under /usr/lib64 on 64-bit archs, since .so files
    are not architecture-independent.


author: Tom Lane <tgl@redhat.com> 8.0.1-2
changelog:
  - Repair improper error message in init script when PGVERSION doesn't match.
  - Arrange for auto update of version embedded in init script.


author: Tom Lane <tgl@redhat.com> 8.0.1-4
changelog:
  - Attach Obsoletes: declarations for rh-postgresql to subpackages (bz#144435)
  - Make Requires: and Prereq: package linkages specify release not only
    version, as per recent mailing list discussion.


author: Tom Lane <tgl@redhat.com> 8.0.3-1
changelog:
  - Update to PostgreSQL 8.0.3 (includes security and data-loss fixes; see
    bz#156727, CAN-2005-1409, CAN-2005-1410)
  - Update to jdbc driver build 311
  - Recreate postgres user after superseding an rh-postgresql install (bug #151911)
  - Ensure postgresql server is restarted if running during an upgrade


author: Tom Lane <tgl@redhat.com> 8.0.4-1
changelog:
  - Update to PostgreSQL 8.0.4, PyGreSQL 3.6.2, and jdbc driver build 312
  - Adjust pgtcl link command to ensure it binds to correct libpq (bug #166665)
  - Remove obsolete Conflicts: against other python versions (bug #166754)
  - Add /etc/pam.d/postgresql (bug #167040)
  - Include contrib/xml2 in build (bug #167492)


author: Tom Lane <tgl@redhat.com> 8.1.0-1
changelog:
  - Update to PostgreSQL 8.1.0, PyGreSQL 3.7, and jdbc driver build 404
  - Fix PAM config file (must have account not only auth) (bug #167040)
  - Add BuildPrereq: libxslt-devel (bug #170141)
  - Sync with PGDG SRPM as much as feasible


author: Tom Lane <tgl@redhat.com> 8.1.1-1
changelog:
  - Update to PostgreSQL 8.1.1
  - Make pg_config.h architecture-independent for multilib installs;
    put the original pg_config.h into pg_config_$ARCH.h


author: Tom Lane <tgl@redhat.com> 8.1.1-3
changelog:
  - fix pg_config.h for 64-bit and ppc platforms
  - update Makefile.regress (needs to --load-language=plpgsql)


author: Tom Lane <tgl@redhat.com> 8.1.2-1
changelog:
  - Update to PostgreSQL 8.1.2
  - Repair extraneous quote in pgtcl configure script ... odd that bash
    didn't use to spit up on this.


author: Tom Lane <tgl@redhat.com> 8.1.3-1
changelog:
  - Update to PostgreSQL 8.1.3 (fixes bug #180617, CVE-2006-0553)
  - Update to jdbc driver build 405
  - Modify multilib header hack to not break non-RH arches, per bug #177564


author: Tom Lane <tgl@redhat.com> 8.1.4-1
changelog:
  - Update to PostgreSQL 8.1.4 (includes fixes for CVE-2006-2313, CVE-2006-2314;
    see bug #192173)
  - Update to PyGreSQL 3.8
  - Suppress noise from chcon, per bug #187744


author: Tom Lane <tgl@redhat.com> 8.2.0-1
changelog:
  - Update to PostgreSQL 8.2.0
  - Update to PyGreSQL 3.8.1
  - Fix chcon arguments in test/regress/Makefile
  Related: #201035
  - Adjust init script to not fool /etc/rc.d/rc
  Resolves: #161470
  - Change init script to not do initdb automatically, but require
    manual "service postgresql initdb" for safety.  Per upstream discussions.


author: Tom Lane <tgl@redhat.com> 8.2.1-1
changelog:
  - Update to PostgreSQL 8.2.1
  - Update to pgtcl 1.5.3
  - Be sure we link to libncurses, not libtermcap which is disappearing in Fedora


author: Tom Lane <tgl@redhat.com> 8.2.1-2
changelog:
  - Split -pl subpackage into three new packages to reduce dependencies
    and track upstream project's packaging.


author: Tom Lane <tgl@redhat.com> 8.2.4-2
changelog:
  - Fix oversight in postgresql-test makefile: pg_regress isn't a shell script
    anymore.  Per upstream bug 3398.


author: Tom Lane <tgl@redhat.com> 8.2.4-4
changelog:
  - Use tzdata package's data files instead of private copy, so that
    postgresql-server need not be turned for routine timezone updates
  - Don't remove postgres user/group during RPM uninstall, per Fedora
    packaging guidelines
  - Seems we need an explicit BuildRequires on gawk now
  - Rebuild to fix Fedora toolchain issues


author: Tom Lane <tgl@redhat.com> 8.2.4-5
changelog:
  - Use nicer solution for tzdata file substitution: upstream discussion
    concluded that hardwiring the path was better than a symlink after all.


author: Tom Lane <tgl@redhat.com> 8.2.6-1
changelog:
  - Update to PostgreSQL 8.2.6 to fix CVE-2007-4769, CVE-2007-4772,
    CVE-2007-6067, CVE-2007-6600, CVE-2007-6601
  - Make initscript and pam config files be installed unconditionally;
    seems new buildroots don't necessarily have those directories in place


author: Tom Lane <tgl@redhat.com> 8.3RC2-1
changelog:
  - Update to PostgreSQL 8.3RC2 (not waiting for 8.3.0 because Fedora 9 alpha
    should be 8.3-based not 8.2-based).
  - Update to pgtcl 1.6.2


author: Tom Lane <tgl@redhat.com> 8.3.1-2
changelog:
  - Clean up cross-subpackage Requires: to ensure that updating any one
    subpackage brings in the matching versions of others.
  Resolves: #444271


author: Tom Lane <tgl@redhat.com> 8.3.1-4
changelog:
  - Enable LDAP support
  Resolves: #445315
  - Use -Wl,--as-needed to suppress bogus dependencies for libraries that
    are really only needed by some of the subpackages


author: Tom Lane <tgl@redhat.com> 8.3.3-1
changelog:
  - Update to PostgreSQL 8.3.3.
  - Remove postgresql-prefer-ncurses.patch, no longer needed in recent
    Fedora releases because libtermcap is gone.


author: Tom Lane <tgl@redhat.com> 8.3.3-2
changelog:
  - Install Pgtcl in /usr/lib/tcl$TCL_VERSION, not directly in /usr/lib.
    Needed because tcl 8.5 no longer puts /usr/lib into its package search path.
    NOTE: do not back-port this change into branches using pre-8.5 tcl, because
    /usr/lib/tcl8.4 had been a symlink to /usr/share/tcl8.4, and /usr/share
    is exactly where we must not put Pgtcl.
  Resolves: #228263


author: Tom Lane <tgl@redhat.com> 8.3.5-1
changelog:
  - Update to PostgreSQL 8.3.5.
  - Improve display from init script's initdb action, per Michael Schwendt


author: Tom Lane <tgl@redhat.com> 8.3.6-1
changelog:
  - Update to PostgreSQL 8.3.6, for various fixes described at
    http://www.postgresql.org/docs/8.3/static/release-8-3-6.html


author: Tom Lane <tgl@redhat.com> 8.3.6-4
changelog:
  - Prevent dependent packages from needing to include sys/sdt.h
    (unintended side effect of previous patch)
  - Use -O1 on alpha, per report from Oliver Falk; -O2 tickles gcc bugs


author: Tom Lane <tgl@redhat.com> 8.3.7-1
changelog:
  - Update to PostgreSQL 8.3.7, for various fixes described at
    http://www.postgresql.org/docs/8.3/static/release-8-3-7.html
    notably the fix for CVE-2009-0922


author: Tom Lane <tgl@redhat.com> 8.4.0-1
changelog:
  - Update to PostgreSQL 8.4.0.  See release notes at
    http://www.postgresql.org/docs/8.4/static/release-8-4.html


author: Tom "spot" Callaway <tcallawa@redhat.com> 8.4.0-2
changelog:
  - update License tag to MIT (PostgreSQL calls it "BSD", but it is MIT)
  - Note: This changes nothing from a license compatibility perspective.


author: Tom Lane <tgl@redhat.com> 8.4.1-1
changelog:
  - Update to PostgreSQL 8.4.1, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-1.html
    including two security issues
  Related: #522085
  Related: #522092


author: Tom Lane <tgl@redhat.com> 8.4.2-1
changelog:
  - Update to PostgreSQL 8.4.2, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-2.html
    including two security issues
  Related: #546321
  Related: #547662
  - Use -N not the obsolete -n in useradd call
  Resolves: #495727
  - Clean up specfile to eliminate rpmlint gripes, mainly by removing
    no-longer-needed provisions for superseding rh-postgresql


author: Tom Lane <tgl@redhat.com> 8.4.2-2
changelog:
  - Remove static libraries (.a files) from package, per packaging guidelines
  - Change %define to %global, per packaging guidelines


author: Tom Lane <tgl@redhat.com> 8.4.2-3
changelog:
  - Remove the postgresql-python and postgresql-tcl subpackages.  These files
    are now broken out as their own packages (PyGreSQL and tcl-pgtcl,
    respectively), to reflect the now longstanding split of upstream projects.
  Related: #452306, #452321


author: Tom Lane <tgl@redhat.com> 8.4.2-4
changelog:
  - Arrange for the postmaster, but not any of its child processes, to be run
    with oom_adj -17.  This compensates for the OOM killer not being smart about
    accounting for shared memory usage.


author: Tom Lane <tgl@redhat.com> 8.4.2-5
changelog:
  - Latest version of systemtap needs the probes.o file to be built again
  Resolves: #557266
  - Provide script and instructions for building the documentation PDF


author: Tom Lane <tgl@redhat.com> 8.4.3-1
changelog:
  - Update to PostgreSQL 8.4.3, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-3.html


author: Tom Lane <tgl@redhat.com> 8.4.4-1
changelog:
  - Update to PostgreSQL 8.4.4, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-4.html
    including fixes for CVE-2010-1169 and CVE-2010-1170
  Resolves: #593032


author: Orcan Ogetbil <oget[dot]fedora[at]gmail[dot]com> - 8.4.4-3
changelog:
  - Rebuilt for https://fedoraproject.org/wiki/Features/Python_2.7/MassRebuild
  - Duplicate COPYRIGHT in -libs subpackage, per revised packaging guidelines


author: Tom Lane <tgl@redhat.com> 8.4.5-1
changelog:
  - Update to PostgreSQL 8.4.5, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-5.html
    including the fix for CVE-2010-3433
  Related: #639371
  - Add -p "$pidfile" to initscript's status call to improve corner cases.
  Related: #561010


author: Tom Lane <tgl@redhat.com> 8.4.6-1
changelog:
  - Update to PostgreSQL 8.4.6, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-6.html
  - Ensure we don't package any .gitignore files from the source tarball
  Related: #642210


author: Tom Lane <tgl@redhat.com> 9.0.2-1
changelog:
  - Update to PostgreSQL 9.0.2 (major version bump)
  - Create infrastructure for in-place database upgrade using pg_upgrade
  Resolves: #398221


author: Tom Lane <tgl@redhat.com> 9.0.3-1
changelog:
  - Update to PostgreSQL 9.0.3, for various fixes described at
    http://www.postgresql.org/docs/9.0/static/release-9-0-3.html
    including the fix for CVE-2010-4015
  Resolves: #674296


author: Tom Lane <tgl@redhat.com> 9.0.3-2
changelog:
  - Remove filter-requires-perl-Pg.sh, which doesn't seem to be needed now that
    PyGreSQL has been split out; and our use of it isn't compatible with rpm 4.9
    anyway


author: Tom Lane <tgl@redhat.com> 9.0.4-1
changelog:
  - Update to PostgreSQL 9.0.4, for various fixes described at
    http://www.postgresql.org/docs/9.0/static/release-9-0-4.html
  - Add %{?_isa} to cross-subpackage Requires, per latest packaging guidelines


author: Tom Lane <tgl@redhat.com> 9.1.0-1
changelog:
  - Update to PostgreSQL 9.1.0 (major version bump);
    in-place upgrade support now works from 9.0.x as the previous version


author: Tom Lane <tgl@redhat.com> 9.1.1-1
changelog:
  - Update to PostgreSQL 9.1.1, for various fixes described at
    http://www.postgresql.org/docs/9.1/static/release-9-1-1.html
  - Enable build (but not test) of contrib/sepgsql
  - Clean up specfile build options so that turning options off works again


author: Honza Horak <hhorak@redhat.com> 9.1.1-2
changelog:
  - Create a symlink of pg_regress instead of full copy;
    Don't strip symbols from regress libs
  Related: #729012


author: Tom Lane <tgl@redhat.com> 9.1.2-1
changelog:
  - Update to PostgreSQL 9.1.2, for various fixes described at
    http://www.postgresql.org/docs/9.1/static/release-9-1-2.html


author: Tom Lane <tgl@redhat.com> 9.1.2-2
changelog:
  - Make systemd unit file more user-friendly by resurrecting the old init
    script's checks for data directory presence and version match
  Resolves: #771496


author: Tom Lane <tgl@redhat.com> 9.1.3-1
changelog:
  - Update to PostgreSQL 9.1.3, for various fixes described at
    http://www.postgresql.org/docs/9.1/static/release-9-1-3.html
    including the fixes for CVE-2012-0866, CVE-2012-0867, CVE-2012-0868
  Resolves: #797918


author: Tom Lane <tgl@redhat.com> 9.1.3-2
changelog:
  - Fix postgresql-setup to look for unit file in /usr/lib and to ignore
    comments therein
  Resolves: #802835
  - Resurrect a now-mostly-dummy postgresql init script, so that people can
    keep on using "service postgresql initdb" if they wish
  Resolves: #800416


author: Tom Lane <tgl@redhat.com> 9.1.3-3
changelog:
  - Fix postgresql-setup to rely on systemd to parse the unit file, instead
    of using ad-hoc code
  Resolves: #804290


author: Tom Lane <tgl@redhat.com> 9.1.4-1
changelog:
  - Update to PostgreSQL 9.1.4, for various fixes described at
    http://www.postgresql.org/docs/9.1/static/release-9-1-4.html
    including the fixes for CVE-2012-2143, CVE-2012-2655
  Resolves: #826606
  - Update previous version (embedded in postgresql-upgrade) to 9.0.8
    because fix in whole-row variable dumping could be needed for upgrades
  - Revert fix for bug #800416, per fedora-packaging discussion at
    http://lists.fedoraproject.org/pipermail/packaging/2012-April/008314.html
    "service postgresql initdb" is dead and will stay that way


author: Tom Lane <tgl@redhat.com> 9.1.4-3
changelog:
  - Update code to use oom_score_adj not oom_adj, thereby suppressing
    whining in the kernel log
  - Add "legacy action" scripts to support "service postgresql initdb" and
    "service postgresql upgrade" in a now-approved fashion (requires a
    recent version of initscripts to work)
  Resolves: #800416


author: Tom Lane <tgl@redhat.com> 9.1.4-5
changelog:
  - Back-port upstream support for postmaster listening on multiple Unix sockets
  - Configure postmaster to create sockets in both /var/run/postgresql and /tmp;
    the former is now the default place for libpq to contact the postmaster.
  Resolves: #825448
  - Annotate postgresql.conf about not setting port number there
  - Minor specfile cleanup per suggestions from Tom Callaway
  Related: #845110


author: Tom Lane <tgl@redhat.com> 9.1.5-1
changelog:
  - Update to PostgreSQL 9.1.5, for various fixes described at
    http://www.postgresql.org/docs/9.1/static/release-9-1-5.html
    including the fixes for CVE-2012-3488, CVE-2012-3489


author: Tom Lane <tgl@redhat.com> 9.2.0-1
changelog:
  - Update to PostgreSQL 9.2.0 (major version bump);
    in-place upgrade support now works from 9.1.x as the previous version
  - Add postgresql-plpython3 subpackage with PL/Python built against Python 3


author: Tom Lane <tgl@redhat.com> 9.2.1-1
changelog:
  - Update to PostgreSQL 9.2.1, for various fixes described at
    http://www.postgresql.org/docs/9.2/static/release-9-2-1.html
    including a nasty data-loss bug
  - Adopt new systemd macros for server package install/uninstall triggers
  Resolves: #850277


author: Tom Lane <tgl@redhat.com> 9.2.2-1
changelog:
  - Update to PostgreSQL 9.2.2, for various fixes described at
    http://www.postgresql.org/docs/9.2/static/release-9-2-2.html
  - Use new systemd install/uninstall trigger macros conditionally,
    so that package can still be installed on pre-F18 branches


author: Tom Lane <tgl@redhat.com> 9.2.2-3
changelog:
  - Prevent creation of TCP socket during pg_upgrade regression test, so that
    concurrent RPM builds on the same machine won't fail
  Resolves: #891531
  - Make sure $PGDATA/pg_log/ gets the right SELinux label in postgresql-setup
  Resolves: #891547


author: Tom Lane <tgl@redhat.com> 9.2.3-1
changelog:
  - Update to PostgreSQL 9.2.3, for various fixes described at
    http://www.postgresql.org/docs/9.2/static/release-9-2-3.html
    including the fix for CVE-2013-0255
  Resolves: #908722
  - Make the package build with selinux option disabled
  Resolves: #894367
  - Include old version of pg_controldata in postgresql-upgrade subpackage
  Related: #896161


author: Tom Lane <tgl@redhat.com> 9.2.4-1
changelog:
  - Update to PostgreSQL 9.2.4, for various fixes described at
    http://www.postgresql.org/docs/9.2/static/release-9-2-4.html
    including the fixes for CVE-2013-1899, CVE-2013-1900, CVE-2013-1901
  Resolves: #929223, #929255, #929328
  - fix build for aarch64 and ppc64p7


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.4-2
changelog:
  - postgresql-setup: don't create whole path to server's data to make sure that
    the parent directory has correct permissions (#972425)


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.4-3
changelog:
  - add atomic operations support for aarch64 to preupgrade version also (#970661)
  - apply the forgotten man-page-day patch (#948933)


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.4-5
changelog:
  - %beta implies debug everywhere (also in upgrade part of build)
  - allow `rpmbuild -bi --short-circuit`
  - upgrade: setup previous (RHEL6) version as 8.14.3
  - upgrade: start old postgres with socket file in /var/run/postgresql


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.4-6
changelog:
  - disable aggressive loop optimizations for old codebase (#993532)
  - upgrade: stop old server in case of permissions problem (#896161)


author: Jozef Mlich <jmlich@redhat.com> - 9.2.5-1
changelog:
  - rebase postgresql to 9.2.5 #1019762 
    http://www.postgresql.org/docs/9.2/static/release-9-2-5.html


author: Jozef Mlich <jmlich@redhat.com> - 9.2.5-2
changelog:
  - Resolves: #1019762 
  - additionally fixes rpmdiff filelist problem with
    /usr/share/doc/postgresql-9.2.5/html/bookindex.html.orig


author: Jozef Mlich <jmlich@redhat.com> - 9.2.6-1
changelog:
  - Resolves #1038688
  - rebase to 9.2.6 see changes at
    http://www.postgresql.org/docs/9.2/static/release-9-2-6.html


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.7-1
changelog:
  - update to 9.2.7 per release notes (#1065845)
    http://www.postgresql.org/docs/9.2/static/release-9-2-7.html


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.10-1
changelog:
  - update to 9.2.10 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-10.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-9.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-8.html
    (rhbz#1198672 rhbz#1198673)


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.11-1
changelog:
  - update to 9.2.11 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-11.html


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.12-1
changelog:
  - update to 9.2.12 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-12.html


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.13-1
changelog:
  - update to 9.2.13 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-13.html


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.14-1
changelog:
  - update to 9.2.14 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-14.html


author: Pavel Kajaba <pkajaba@redhat.com> - 9.2.15-1
changelog:
  - update to 9.2.15 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-15.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.18-1
changelog:
  - update to 9.2.18 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-18.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-17.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-16.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.21-1
changelog:
  - update to 9.2.21 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-21.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-20.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-19.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.22-1
changelog:
  - update to 9.2.22 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-22.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.23-1
changelog:
  - update to 9.2.23 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-23.html


author: David Woodhouse <dwmw2@infradead.org> 0.7.0-2
changelog:
  - Proper fix for GCC 4 putting 'blr' or 'ret' in the middle of the function,
    for i386, x86_64 and PPC.


author: David Woodhouse <dwmw2@infradead.org> 0.8.0-3
changelog:
  - Use -mcpu= instead of -mtune= on x86_64 too
  - Disable SPARC targets on x86_64, because dyngen doesn't like fnegs


author: Matthias Saou <http://freshrpms.net/> 0.8.2-1
changelog:
  - Update to 0.8.2 (#200065).
  - Drop upstreamed syscall-macros patch2.
  - Put correct scriplet dependencies.
  - Force install mode for the init script to avoid umask problems.
  - Add %postun condrestart for changes to the init script to be applied if any.
  - Update description with the latest "about" from the web page (more current).
  - Update URL to qemu.org one like the Source.
  - Add which build requirement.
  - Don't include texi files in %doc since we ship them in html.
  - Switch to using gcc34 on devel, FC5 still has gcc32.
  - Add kernheaders patch to fix linux/compiler.h inclusion.
  - Add target-sparc patch to fix compiling on ppc (some int32 to float).


author: Matthias Saou <http://freshrpms.net/> 0.8.2-2
changelog:
  - Remove the target-list iteration for x86_64 since they all build again.
  - Make gcc32 vs. gcc34 conditional on %{fedora} to share the same spec for
    FC5 and FC6.


author: Hans de Goede <j.w.r.degoede@hhs.nl> 0.9.0-2
changelog:
  - Fix direct loading of a linux kernel with -kernel & -initrd (bz 234681)
  - Remove spurious execute bits from manpages (bz 222573)


author: Daniel P. Berrange <berrange@redhat.com> - 0.9.0-3.fc8
changelog:
  - Added backport of VNC password auth, and TLS+x509 cert auth
  - Switch to rtl8139 NIC by default for linkstate reporting
  - Fix rtl8139 mmio region mappings with multiple NICs


author: Glauber Costa <glommer@redhat.com> - 1.0-0.1.svn6666
changelog:
  - Updated to tip svn (release 6666). Featuring split packages for qemu.
    Unfortunately, still using binary blobs for the bioses.


author: Glauber Costa <glommer@redhat.com> - 0.10-0.1.kvm20090303git
changelog:
  - Set Epoch to 1
  - Build KVM (basic build, no tools yet)
  - Set ppc in ExcludeArch. This is temporary, just to fix one issue at a time.
    ppc users (IBM ? ;-)) please wait a little bit.


author: Glauber Costa <glommer@redhat.com> - 0.92-0.1.kvm20090303git
changelog:
  - Set Epoch to 2
  - Set version to 0.92. It seems upstream keep changing minds here, so pick the lowest
  - Provides KVM, Obsoletes KVM
  - Only install qemu-kvm in ix86 and x86_64
  - Remove pkgdesc macros, as they were generating bogus output for rpm -qi.
  - fix ppc and ppc64 builds


author: Glauber Costa <glommer@redhat.com> - 2:0.10-0.5.kvm20090303git
changelog:
  - kvm.modules were being wrongly mentioned at %install.
  - update description for the x86 system package to include kvm support
  - build kvm's own bios. It is still necessary while kvm uses a slightly different
    irq routing mechanism


author: Glauber Costa <glommer@redhat.com> - 2:0.10-0.8.kvm20090310git
changelog:
  - fix Obsolete/Provides pair
  - Use kvm bios from bochs-bios package.
  - Using RPM_OPT_FLAGS in configure
  - Picked back audio-drv-list from kvm package


author: Glauber Costa <glommer@redhat.com> - 2:0.10-0.11.kvm20090323git
changelog:
  - Update to snapshot kvm20090323.
  - Removed patch2 (upstream).
  - use upstream's new split package.
  - --with-patched-kernel flag not needed anymore
  - Tell how to get the sources.


author: Glauber Costa <glommer@redhat.com> - 2:0.10-1
changelog:
  - Include debuginfo for qemu-img
  - Do not require qemu-common for qemu-img
  - Explicitly own each of the firmware files
  - remove firmwares for ppc and sparc. They should be provided by an external package.
    Not that the packages exists for sparc in the secondary arch repo as noarch, but they
    don't automatically get into main repos. Unfortunately it's the best we can do right
    now.
  - rollback a bit in time. Snapshot from avi's maint/2.6.30
    - this requires the sasl patches to come back.
    - with-patched-kernel comes back.


author: Mark McLoughlin <markmc@redhat.com> - 2:0.10-5
changelog:
  - Fix vga segfault under kvm-autotest (#494002)
  - Kill kernelrelease hack; it's not needed
  - Build with "make V=1" for more verbose logs


author: Mark McLoughlin <markmc@redhat.com> - 2:0.10.50-1.kvm85
changelog:
  - Update to qemu-kvm-devel-85
  - kvm-85 is based on qemu development branch, currently version 0.10.50
  - Include new qemu-io utility in qemu-img package
  - Re-instate -help string for boot=on to fix virtio booting with libvirt
  - Drop upstreamed patches
  - Fix missing kernel/include/asm symlink in upstream tarball
  - Fix target-arm build
  - Fix build on ppc
  - Disable preadv()/pwritev() until bug #497429 is fixed
  - Kill more .kernelrelease uselessness
  - Make non-kvm qemu build verbose


author: Mark McLoughlin <markmc@redhat.com> - 2:0.10.50-5.kvm86
changelog:
  - Prevent locked cdrom eject - fixes hang at end of anaconda installs (#501412)
  - Avoid harmless 'unhandled wrmsr' warnings (#499712)


author: Mark McLoughlin <markmc@redhat.com> - 2:0.10.50-6.kvm86
changelog:
  - Fix 'kernel requires an x86-64 CPU' error
  - BuildRequires ncurses-devel to enable '-curses' option (#504226)


author: Mark McLoughlin <markmc@redhat.com> - 2:0.10.50-7.kvm87
changelog:
  - Update to kvm-87
  - Drop upstreamed patches
  - Cherry-pick new ppc build fix from upstream
  - Work around broken linux-user build on ppc
  - Fix hw/pcspk.c build with --disable-kvm
  - Re-enable preadv()/pwritev() since #497429 is long since fixed
  - Kill petalogix-s3adsp1800.dtb, since we don't ship the microblaze target


author: Daniel Berrange <berrange@lettuce.camlab.fab.redhat.com> - 2:0.10.50-10.kvm87
changelog:
  - Add udev rules to make /dev/kvm world accessible & group=kvm (rhbz #497341)
  - Create a kvm group if it doesn't exist (rhbz #346151)


author: Mark McLoughlin <markmc@redhat.com> - 2:0.10.50-11.kvm88
changelog:
  - Update to kvm-88, see http://www.linux-kvm.org/page/ChangeLog
  - Package mutiboot.bin
  - Update for how extboot is built
  - Fix sf.net source URL
  - Drop qemu-fix-ppc-softmmu-kvm-disabled-build.patch
  - Drop qemu-fix-pcspk-build-with-kvm-disabled.patch
  - Cherry-pick fix for esound support build failure


author: Mark McLoughlin <markmc@redhat.com> - 2:0.10.91-0.1.rc1.rc0
changelog:
  - Update to qemu-kvm-0.11.0-rc1-rc0
  - This is a pre-release of the official -rc1
  - A vista installer regression is blocking the official -rc1 release
  - Drop qemu-prefer-sysfs-for-usb-host-devices.patch
  - Drop qemu-fix-build-for-esd-audio.patch
  - Drop qemu-slirp-Fix-guestfwd-for-incoming-data.patch
  - Add patch to ensure extboot.bin is installed


author: Mark McLoughlin <markmc@redhat.com> - 2:0.10.92-1
changelog:
  - Update to qemu-kvm-0.11.0-rc2
  - Drop upstreamed patches
  - extboot install now fixed upstream
  - Re-place TCG init fix (#516543) with the one gone upstream


author: Mark McLoughlin <markmc@redhat.com> - 2:0.11.0-4
changelog:
  - Use rtl8029 PXE rom for ne2k_pci, not ne (#526777)
  - Also, replace the gpxe-roms-qemu pkg requires with file-based requires


author: Mark McLoughlin <markmc@redhat.com> - 2:0.11.0-6
changelog:
  - Fix fs errors with virtio and qcow2 backing file (#524734)
  - Fix ksm initscript errors on kernel missing ksm (#527653)
  - Add missing Requires(post): getent, useradd, groupadd (#527087)


author: Mark McLoughlin <markmc@redhat.com> - 2:0.11.0-12
changelog:
  - Fix a use-after-free crasher in the slirp code (#539583)
  - Fix overflow in the parallels image format support (#533573)


author: Justin M. Forbes <jforbes@redhat.com> - 2:0.12.2-5
changelog:
  - Avoid creating too large iovecs in multiwrite merge (#559717)
  - Don't try to set max_kernel_pages during ksm init on newer kernels (#558281)
  - Add logfile options for ksmtuned debug.


author: Justin M. Forbes <jforbes@redhat.com> - 2:0.12.3-1
changelog:
  - Update to 0.12.3 upstream
  - vhost-net migration/restart fixes
  - Add F-13 machine type
  - virtio-serial fixes


author: Justin M. Forbes <jforbes@redhat.com> - 2:0.12.3-6
changelog:
  - Change requires to the noarch seabios-bin
  - Add ownership of docdir to qemu-common (#572110)
  - Fix "Cannot boot from non-existent NIC" error when using virt-install (#577851)


author: Dan Horák <dan[at]danny.cz> - 2:0.12.3-8
changelog:
  - Add avoid-llseek patch from upstream needed for building on s390(x)
  - Don't use parallel make on s390(x)


author: Justin M. Forbes <jforbes@redhat.com> - 2:0.13.0-0.3.20100809git25fdf4a
changelog:
  - Updates from upstream towards 0.13 stable
  - Fix requires on gpxe
  - enable spice now that buildreqs are in the repository.
  - ksmtrace has moved to a separate upstream package


author: Justin M. Forbes <jforbes@redhat.com> - 2:0.13.0-1
changelog:
  - Update to 0.13.0 upstream release
  - Fixes for vhost
  - Fix mouse in certain guests (#636887)
  - Fix issues with WinXP guest install (#579348)
  - Resolve build issues with S390 (#639471)
  - Fix Windows XP on Raw Devices (#631591)


author: Daniel P. Berrange <berrange@redhat.com> - 2:0.13.0-2
changelog:
  - Revert previous change
  - Make qemu-common own the /etc/qemu directory
  - Add /etc/qemu/target-x86_64.conf to qemu-system-x86 regardless
    of host architecture.


author: Justin M. Forbes <jforbes@redhat.com> - 2:0.14.0-0.1.20110210git7aa8c46
changelog:
  - Update git snapshot
  - Temporarily disable qemu-cris and qemu-sparc due to build errors (to be resolved shorly)


author: Richard W.M. Jones <rjones@redhat.com> - 2:0.14.0-9
changelog:
  - Add BR libattr-devel.  This caused the -fstype option to be disabled.
    https://www.redhat.com/archives/libvir-list/2011-June/thread.html#01017


author: Hans de Goede <hdegoede@redhat.com> - 2:0.15.0-0.2.20110718525e3df
changelog:
  - Add support usb redirection over the network, see:
    http://fedoraproject.org/wiki/Features/UsbNetworkRedirection
  - Restore chardev flow control patches


author: Richard W.M. Jones <rjones@redhat.com> - 2:0.15.0-2
changelog:
  - Add upstream qemu patch 'Allow to leave type on default in -machine'
    (2645c6dcaf6ea2a51a3b6dfa407dd203004e4d11).


author: Daniel P. Berrange <berrange@redhat.com> - 2:0.15.0-4
changelog:
  - Enable DTrace tracing backend for SystemTAP (rhbz #737763)
  - Enable build with curl (rhbz #737006)


author: Justin M. Forbes <jforbes@redhat.com> - 2:0.15.1-1
changelog:
  - Require seabios-bin >= 0.6.0-2 (#741992)
  - Replace init scripts with systemd units (#741920)
  - Update to 0.15.1 stable upstream


author: Richard W.M. Jones <rjones@redhat.com> - 2:1.1.0-4
changelog:
  - Disable tests since they hang intermittently.
  - Add kvmvapic.bin (replaces vapic.bin).
  - Add cpus-x86_64.conf.  qemu now creates /etc/qemu/target-x86_64.conf
    as an empty file.
  - Add qemu-icon.bmp.
  - Add qemu-bridge-helper.
  - Build and include virtfs-proxy-helper + man page (thanks Hans de Goede).


author: Richard W.M. Jones <rjones@redhat.com> - 2:1.1.0-7
changelog:
  - Add patch to fix default machine options.  This fixes libvirt
    detection of qemu.
  - Back out patch 1 which conflicts.


author: Cole Robinson <crobinso@redhat.com> - 1.1.1-1
changelog:
  - Upstream stable release 1.1.1
  - Fix systemtap tapsets (bz 831763)
  - Fix VNC audio tunnelling (bz 840653)
  - Don't renable ksm on update (bz 815156)
  - Bump usbredir dep (bz 812097)
  - Fix RPM install error on non-virt machines (bz 660629)
  - Obsolete openbios to fix upgrade dependency issues (bz 694802)


author: Adam Jackson <ajax@redhat.com> 1.2.0-0.5.rc1
changelog:
  - Flip Requires: ceph >= foo to Conflicts: ceph < foo, so we pull in only the
    libraries which we need and not the rest of ceph which we don't.


author: Hans de Goede <hdegoede@redhat.com> - 2:1.2.0-1
changelog:
  - New upstream release 1.2.0 final
  - Add support for Spice seamless migration
  - Add support for Spice dynamic monitors
  - Add support for usb-redir live migration


author: Richard W.M. Jones <rjones@redhat.com> - 2:1.2.0-8
changelog:
  - Use 'global' instead of 'define', and underscore in definition name,
    n-v-r, and 'dist' tag of SLOF, all to fix RHBZ#855252.


author: Hans de Goede <hdegoede@redhat.com> - 2:1.2.0-11
changelog:
  - Rebuild against latest spice-server and spice-protocol
  - Fix non-seamless migration failing with vms with usb-redir devices,
    to allow boxes to load such vms from disk


author: Paolo Bonzini <pbonzini@redhat.com> - 2:1.2.0-13
changelog:
  - Add ppc support to kvm.modules (original patch by David Gibson)
  - Replace x86only build with kvmonly build: add separate defines and
    conditionals for all packages, so that they can be chosen and
    renamed in kvmonly builds and so that qemu has the appropriate requires
  - Automatically pick libfdt dependancy
  - Add knob to disable spice+seccomp


author: Paolo Bonzini <pbonzini@redhat.com> - 2:1.2.0-16
changelog:
  - add s390x KVM support
  - distribute pre-built firmware or device trees for Alpha, Microblaze, S390
  - add missing system targets
  - add missing linux-user targets
  - fix previous commit


author: Cole Robinson <crobinso@redhat.com> - 2:1.2.0-18
changelog:
  - Fix loading arm initrd if kernel is very large (bz #862766)
  - Don't use reserved word 'function' in systemtap files (bz #870972)
  - Drop assertion that was triggering when pausing guests w/ qxl (bz


author: Hans de Goede <hdegoede@redhat.com> - 2:1.2.0-19
changelog:
  - Sync spice patches with upstream, minor bugfixes and set the qxl pci
    device revision to 4 by default, so that guests know they can use
    the new features


author: Cole Robinson <crobinso@redhat.com> - 2:1.3.0-1
changelog:
  - Switch base tarball from qemu-kvm to qemu
  - qemu 1.3 release
  - Option to use linux VFIO driver to assign PCI devices
  - Many USB3 improvements
  - New paravirtualized hardware random number generator device.
  - Support for Glusterfs volumes with "gluster://" -drive URI
  - Block job commands for live block commit and storage migration


author: Michal Novotny <minovotn@redhat.com> - 2:1.3.0-3
changelog:
  - Remove dependency on bogus qemu-kvm-kvm package [bz#870343]
  - Resolves: bz#870343
    (qemu-kvm-1.2.0-16.el7 cant be installed)


author: Michal Novotny <minovotn@redhat.com> - 2:1.3.0-5
changelog:
  - Fix patch contents for usb-redir (bz#895491)
  - Resolves: bz#895491
    (PATCH: 0110-usb-redir-Add-flow-control-support.patch has been mangled on rebase !!)


author: Alon Levy <alevy@redhat.com> - 3:1.3.0-6
changelog:
  - Bump epoch back to 3 since there has already been a 3 package release:
    3:1.2.0-20.el7 https://brewweb.devel.redhat.com/buildinfo?buildID=244866
  - Mark explicit libcacard dependency on new enough qemu-img to avoid conflict
    since /usr/bin/vscclient was moved from qemu-img to libcacard subpackage.


author: Michal Novotny <minovotn@redhat.com> - 3:1.3.0-8
changelog:
  - Missing package qemu-system-x86 in hardware certification kvm testing (bz#912433)
  - Resolves: bz#912433
    (Missing package qemu-system-x86 in hardware certification kvm testing)


author: Miroslav Rezanina <mrezanin@redhat.com> - 3:1.4.0-4
changelog:
  - Enable build of libcacard subpackage for non-x86_64 archs (bz #873174)
  - Enable build of qemu-img subpackage for non-x86_64 archs (bz #873174)
  - Enable build of qemu-guest-agent subpackage for non-x86_64 archs (bz #873174)


author: Miroslav Rezanina <mrezanin@redhat.com> - 3:1.5.0-2
changelog:
  - Enable werror (bz #948290)
  - Enable nbd driver (bz #875871)
  - Fix udev rules file location (bz #958860)
  - Remove +x bit from systemd unit files (bz #965000)
  - Drop unneeded kvm.modules on x86 (bz #963642)
  - Fix build flags
  - Enable libusb


author: Miroslav Rezanina <mrezanin@redhat.com> - 10:1.5.1-2
changelog:
  - Fix package package version info (bz #952996)
  - pc: Replace upstream machine types by RHEL-7 types (bz #977864)
  - target-i386: Update model values on Conroe/Penryn/Nehalem CPU model (bz #861210)
  - target-i386: Set level=4 on Conroe/Penryn/Nehalem (bz #861210)


author: Miroslav Rezanina <mrezanin@redhat.com> - 10:1.5.2-2
changelog:
  - SPEC file prepared for RHEL/RHEV split (rhbz #987165)
  - RHEL guest( sata disk ) can not boot up (rhbz #981723)
  - Kill the "use flash device for BIOS unless KVM" misfeature (rhbz #963280)
  - Provide RHEL-6 machine types (rhbz #983991)
  - Change s3/s4 default to "disable". (rhbz #980840)  
  - Support Virtual Memory Disk Format in qemu (rhbz #836675)
  - Glusterfs backend for QEMU (rhbz #805139)


author: Miroslav Rezanina <mrezanin@redhat.com> - 10:1.5.2-3
changelog:
  - query mem info from monitor would cause qemu-kvm hang [RHEL-7] (rhbz #970047)
  - Throttle-down guest to help with live migration convergence (backport to RHEL7.0) (rhbz #985958)
  - disable (for now) EFI-enabled roms (rhbz #962563)
  - qemu-kvm "vPMU passthrough" mode breaks migration, shouldn't be enabled by default (rhbz #853101)
  - Remove pending watches after virtserialport unplug (rhbz #992900)
  - Containment of error when an SR-IOV device encounters an error... (rhbz #984604)


author: Miroslav Rezanina <mrezanin@redhat.com> - 10:1.5.2-4
changelog:
  - qemu: guest agent creates files with insecure permissions in deamon mode [rhel-7.0] (rhbz 974444)
  - update qemu-ga config & init script in RHEL7 wrt. fsfreeze hook (rhbz 969942)
  - RHEL7 does not have equivalent functionality for __com.redhat_qxl_screendump (rhbz 903910)
  - SEP flag behavior for CPU models of RHEL6 machine types should be compatible (rhbz 960216)
  - crash command can not read the dump-guest-memory file when paging=false [RHEL-7] (rhbz 981582)
  - RHEL 7 qemu-kvm fails to build on F19 host due to libusb deprecated API (rhbz 996469)
  - Live migration support in virtio-blk-data-plane (rhbz 995030)
  - qemu-img resize can execute successfully even input invalid syntax (rhbz 992935)


author: Miroslav Rezanina <mrezanin@redhat.com> - qemu-kvm-1.5.3-2.el7
changelog:
  - kvm-osdep-add-qemu_get_local_state_pathname.patch [bz#964304]
  - kvm-qga-determine-default-state-dir-and-pidfile-dynamica.patch [bz#964304]
  - kvm-configure-don-t-save-any-fixed-local_statedir-for-wi.patch [bz#964304]
  - kvm-qga-create-state-directory-on-win32.patch [bz#964304]
  - kvm-qga-save-state-directory-in-ga_install_service-RHEL-.patch [bz#964304]
  - kvm-Makefile-create-.-var-run-when-installing-the-POSIX-.patch [bz#964304]
  - kvm-qemu-option-Fix-qemu_opts_find-for-null-id-arguments.patch [bz#980782]
  - kvm-qemu-option-Fix-qemu_opts_set_defaults-for-corner-ca.patch [bz#980782]
  - kvm-vl-New-qemu_get_machine_opts.patch [bz#980782]
  - kvm-Fix-machine-options-accel-kernel_irqchip-kvm_shadow_.patch [bz#980782]
  - kvm-microblaze-Fix-latent-bug-with-default-DTB-lookup.patch [bz#980782]
  - kvm-Simplify-machine-option-queries-with-qemu_get_machin.patch [bz#980782]
  - kvm-pci-add-VMSTATE_MSIX.patch [bz#838170]
  - kvm-xhci-add-XHCISlot-addressed.patch [bz#838170]
  - kvm-xhci-add-xhci_alloc_epctx.patch [bz#838170]
  - kvm-xhci-add-xhci_init_epctx.patch [bz#838170]
  - kvm-xhci-add-live-migration-support.patch [bz#838170]
  - kvm-pc-set-level-xlevel-correctly-on-486-qemu32-CPU-mode.patch [bz#918907]
  - kvm-pc-Remove-incorrect-rhel6.x-compat-model-value-for-C.patch [bz#918907]
  - kvm-pc-rhel6.x-has-x2apic-present-on-Conroe-Penryn-Nehal.patch [bz#918907]
  - kvm-pc-set-compat-CPUID-0x80000001-.EDX-bits-on-Westmere.patch [bz#918907]
  - kvm-pc-Remove-PCLMULQDQ-from-Westmere-on-rhel6.x-machine.patch [bz#918907]
  - kvm-pc-SandyBridge-rhel6.x-compat-fixes.patch [bz#918907]
  - kvm-pc-Haswell-doesn-t-have-rdtscp-on-rhel6.x.patch [bz#918907]
  - kvm-i386-fix-LAPIC-TSC-deadline-timer-save-restore.patch [bz#972433]
  - kvm-all.c-max_cpus-should-not-exceed-KVM-vcpu-limit.patch [bz#996258]
  - kvm-add-timestamp-to-error_report.patch [bz#906937]
  - kvm-Convert-stderr-message-calling-error_get_pretty-to-e.patch [bz#906937]
  - Resolves: bz#838170
    (Add live migration support for USB [xhci, usb-uas])
  - Resolves: bz#906937
    ([Hitachi 7.0 FEAT][QEMU]Add a time stamp to error message (*))
  - Resolves: bz#918907
    (provide backwards-compatible RHEL specific machine types in QEMU - CPU features)
  - Resolves: bz#964304
    (Windows guest agent service failed to be started)
  - Resolves: bz#972433
    ("INFO: rcu_sched detected stalls" after RHEL7 kvm vm migrated)
  - Resolves: bz#980782
    (kernel_irqchip defaults to off instead of on without -machine)
  - Resolves: bz#996258
    (boot guest with maxcpu=255 successfully but actually max number of vcpu is 160)


author: Michal Novotny <minovotn@redhat.com> - qemu-kvm-1.5.3-4.el7
changelog:
  - kvm-block-package-preparation-code-in-qmp_transaction.patch [bz#1005818]
  - kvm-block-move-input-parsing-code-in-qmp_transaction.patch [bz#1005818]
  - kvm-block-package-committing-code-in-qmp_transaction.patch [bz#1005818]
  - kvm-block-package-rollback-code-in-qmp_transaction.patch [bz#1005818]
  - kvm-block-make-all-steps-in-qmp_transaction-as-callback.patch [bz#1005818]
  - kvm-blockdev-drop-redundant-proto_drv-check.patch [bz#1005818]
  - kvm-block-Don-t-parse-protocol-from-file.filename.patch [bz#1005818]
  - kvm-Revert-block-Disable-driver-specific-options-for-1.5.patch [bz#1005818]
  - kvm-qcow2-Add-refcount-update-reason-to-all-callers.patch [bz#1005818]
  - kvm-qcow2-Options-to-enable-discard-for-freed-clusters.patch [bz#1005818]
  - kvm-qcow2-Batch-discards.patch [bz#1005818]
  - kvm-block-Always-enable-discard-on-the-protocol-level.patch [bz#1005818]
  - kvm-qapi.py-Avoid-code-duplication.patch [bz#1005818]
  - kvm-qapi.py-Allow-top-level-type-reference-for-command-d.patch [bz#1005818]
  - kvm-qapi-schema-Use-BlockdevSnapshot-type-for-blockdev-s.patch [bz#1005818]
  - kvm-qapi-types.py-Implement-base-for-unions.patch [bz#1005818]
  - kvm-qapi-visit.py-Split-off-generate_visit_struct_fields.patch [bz#1005818]
  - kvm-qapi-visit.py-Implement-base-for-unions.patch [bz#1005818]
  - kvm-docs-Document-QAPI-union-types.patch [bz#1005818]
  - kvm-qapi-Add-visitor-for-implicit-structs.patch [bz#1005818]
  - kvm-qapi-Flat-unions-with-arbitrary-discriminator.patch [bz#1005818]
  - kvm-qapi-Add-consume-argument-to-qmp_input_get_object.patch [bz#1005818]
  - kvm-qapi.py-Maintain-a-list-of-union-types.patch [bz#1005818]
  - kvm-qapi-qapi-types.py-native-list-support.patch [bz#1005818]
  - kvm-qapi-Anonymous-unions.patch [bz#1005818]
  - kvm-block-Allow-driver-option-on-the-top-level.patch [bz#1005818]
  - kvm-QemuOpts-Add-qemu_opt_unset.patch [bz#1005818]
  - kvm-blockdev-Rename-I-O-throttling-options-for-QMP.patch [bz#1005818]
  - kvm-qemu-iotests-Update-051-reference-output.patch [bz#1005818]
  - kvm-blockdev-Rename-readonly-option-to-read-only.patch [bz#1005818]
  - kvm-blockdev-Split-up-cache-option.patch [bz#1005818]
  - kvm-qcow2-Use-dashes-instead-of-underscores-in-options.patch [bz#1005818]
  - kvm-qemu-iotests-filter-QEMU-version-in-monitor-banner.patch [bz#1006959]
  - kvm-tests-set-MALLOC_PERTURB_-to-expose-memory-bugs.patch [bz#1006959]
  - kvm-qemu-iotests-Whitespace-cleanup.patch [bz#1006959]
  - kvm-qemu-iotests-Fixed-test-case-026.patch [bz#1006959]
  - kvm-qemu-iotests-Fix-test-038.patch [bz#1006959]
  - kvm-qemu-iotests-Remove-lsi53c895a-tests-from-051.patch [bz#1006959]
  - Resolves: bz#1005818
    (qcow2: Backport discard command line options)
  - Resolves: bz#1006959
    (qemu-iotests false positives)


author: Miroslav Rezanina <mrezanin@redhat.com> - qemu-kvm-1.5.3-7.el7
changelog:
  - kvm-spice-fix-display-initialization.patch [bz#974887]
  - kvm-Remove-i82550-network-card-emulation.patch [bz#921983]
  - kvm-Remove-usb-wacom-tablet.patch [bz#903914]
  - kvm-Disable-usb-uas.patch [bz#903914]
  - kvm-Disable-vhost-scsi.patch [bz#994642]
  - kvm-Remove-no-hpet-option.patch [bz#947441]
  - kvm-Disable-isa-parallel.patch [bz#1002286]
  - kvm-xhci-implement-warm-port-reset.patch [bz#949514]
  - kvm-usb-add-serial-bus-property.patch [bz#953304]
  - kvm-rhel6-compat-usb-serial-numbers.patch [bz#953304]
  - kvm-vmdk-fix-comment-for-vmdk_co_write_zeroes.patch [bz#995866]
  - kvm-gluster-Add-image-resize-support.patch [bz#1007226]
  - kvm-block-Introduce-bs-zero_beyond_eof.patch [bz#1007226]
  - kvm-block-Produce-zeros-when-protocols-reading-beyond-en.patch [bz#1007226]
  - kvm-gluster-Abort-on-AIO-completion-failure.patch [bz#1007226]
  - kvm-Preparation-for-usb-bt-dongle-conditional-build.patch [bz#1001131]
  - kvm-Remove-dev-bluetooth.c-dependency-from-vl.c.patch [bz#1001131]
  - kvm-exec-Fix-Xen-RAM-allocation-with-unusual-options.patch [bz#1009328]
  - kvm-exec-Clean-up-fall-back-when-mem-path-allocation-fai.patch [bz#1009328]
  - kvm-exec-Reduce-ifdeffery-around-mem-path.patch [bz#1009328]
  - kvm-exec-Simplify-the-guest-physical-memory-allocation-h.patch [bz#1009328]
  - kvm-exec-Drop-incorrect-dead-S390-code-in-qemu_ram_remap.patch [bz#1009328]
  - kvm-exec-Clean-up-unnecessary-S390-ifdeffery.patch [bz#1009328]
  - kvm-exec-Don-t-abort-when-we-can-t-allocate-guest-memory.patch [bz#1009328]
  - kvm-pc_sysfw-Fix-ISA-BIOS-init-for-ridiculously-big-flas.patch [bz#1009328]
  - kvm-virtio-scsi-Make-type-virtio-scsi-common-abstract.patch [bz#903918]
  - kvm-qga-move-logfiles-to-new-directory-for-easier-SELinu.patch [bz#1009491]
  - kvm-target-i386-add-cpu64-rhel6-CPU-model.patch [bz#918907]
  - kvm-fix-steal-time-MSR-vmsd-callback-to-proper-opaque-ty.patch [bz#903889]
  - Resolves: bz#1001131
    (Disable or remove device usb-bt-dongle)
  - Resolves: bz#1002286
    (Disable or remove device isa-parallel)
  - Resolves: bz#1007226
    (Introduce bs->zero_beyond_eof)
  - Resolves: bz#1009328
    ([RFE] Nicer error report when qemu-kvm can't allocate guest RAM)
  - Resolves: bz#1009491
    (move qga logfiles to new /var/log/qemu-ga/ directory [RHEL-7])
  - Resolves: bz#903889
    (The value of steal time in "top" command always is "0.0% st" after guest migration)
  - Resolves: bz#903914
    (Disable or remove usb related devices that we will not support)
  - Resolves: bz#903918
    (Disable or remove emulated SCSI devices we will not support)
  - Resolves: bz#918907
    (provide backwards-compatible RHEL specific machine types in QEMU - CPU features)
  - Resolves: bz#921983
    (Disable or remove emulated network devices that we will not support)
  - Resolves: bz#947441
    (HPET device must be disabled)
  - Resolves: bz#949514
    (fail to passthrough the USB3.0 stick to windows guest with xHCI controller under pc-i440fx-1.4)
  - Resolves: bz#953304
    (Serial number of some USB devices must be fixed for older RHEL machine types)
  - Resolves: bz#974887
    (the screen of guest fail to display correctly when use spice + qxl driver)
  - Resolves: bz#994642
    (should disable vhost-scsi)
  - Resolves: bz#995866
    (fix vmdk support to ESX images)


author: Miroslav Rezanina <mrezanin@redhat.com> - qemu-kvm-1.5.3-8.el7
changelog:
  - kvm-vmdk-Make-VMDK3Header-and-VmdkGrainMarker-QEMU_PACKE.patch [bz#995866]
  - kvm-vmdk-use-unsigned-values-for-on-disk-header-fields.patch [bz#995866]
  - kvm-qemu-iotests-add-poke_file-utility-function.patch [bz#995866]
  - kvm-qemu-iotests-add-empty-test-case-for-vmdk.patch [bz#995866]
  - kvm-vmdk-check-granularity-field-in-opening.patch [bz#995866]
  - kvm-vmdk-check-l2-table-size-when-opening.patch [bz#995866]
  - kvm-vmdk-check-l1-size-before-opening-image.patch [bz#995866]
  - kvm-vmdk-use-heap-allocation-for-whole_grain.patch [bz#995866]
  - kvm-vmdk-rename-num_gtes_per_gte-to-num_gtes_per_gt.patch [bz#995866]
  - kvm-vmdk-Move-l1_size-check-into-vmdk_add_extent.patch [bz#995866]
  - kvm-vmdk-fix-L1-and-L2-table-size-in-vmdk3-open.patch [bz#995866]
  - kvm-vmdk-support-vmfsSparse-files.patch [bz#995866]
  - kvm-vmdk-support-vmfs-files.patch [bz#995866]
  - Resolves: bz#995866
    (fix vmdk support to ESX images)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-9.el7
changelog:
  - kvm-qxl-fix-local-renderer.patch [bz#1005036]
  - kvm-spec-include-userspace-iSCSI-initiator-in-block-driv.patch [bz#923843]
  - kvm-linux-headers-update-to-kernel-3.10.0-26.el7.patch [bz#1008987]
  - kvm-target-i386-add-feature-kvm_pv_unhalt.patch [bz#1008987]
  - kvm-warn-if-num-cpus-is-greater-than-num-recommended.patch [bz#1010881]
  - kvm-char-move-backends-io-watch-tag-to-CharDriverState.patch [bz#1007222]
  - kvm-char-use-common-function-to-disable-callbacks-on-cha.patch [bz#1007222]
  - kvm-char-remove-watch-callback-on-chardev-detach-from-fr.patch [bz#1007222]
  - kvm-block-don-t-lose-data-from-last-incomplete-sector.patch [bz#1017049]
  - kvm-vmdk-fix-cluster-size-check-for-flat-extents.patch [bz#1017049]
  - kvm-qemu-iotests-add-monolithicFlat-creation-test-to-059.patch [bz#1017049]
  - Resolves: bz#1005036
    (When using “-vga qxl” together with “-display vnc=:5” or “-display  sdl” qemu displays  pixel garbage)
  - Resolves: bz#1007222
    (QEMU core dumped when do hot-unplug virtio serial port during transfer file between host to guest with virtio serial through TCP socket)
  - Resolves: bz#1008987
    (pvticketlocks: add kvm feature kvm_pv_unhalt)
  - Resolves: bz#1010881
    (backport vcpu soft limit warning)
  - Resolves: bz#1017049
    (qemu-img refuses to open the vmdk format image its created)
  - Resolves: bz#923843
    (include userspace iSCSI initiator in block driver whitelist)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-10.el7
changelog:
  - kvm-xhci-fix-endpoint-interval-calculation.patch [bz#1001604]
  - kvm-xhci-emulate-intr-endpoint-intervals-correctly.patch [bz#1001604]
  - kvm-xhci-reset-port-when-disabling-slot.patch [bz#1001604]
  - kvm-Revert-usb-hub-report-status-changes-only-once.patch [bz#1001604]
  - kvm-target-i386-Set-model-6-on-qemu64-qemu32-CPU-models.patch [bz#1004290]
  - kvm-pc-rhel6-doesn-t-have-APIC-on-pentium-CPU-models.patch [bz#918907]
  - kvm-pc-RHEL-6-had-x2apic-set-on-Opteron_G-123.patch [bz#918907]
  - kvm-pc-RHEL-6-don-t-have-RDTSCP.patch [bz#918907]
  - kvm-scsi-Fix-scsi_bus_legacy_add_drive-scsi-generic-with.patch [bz#1009285]
  - kvm-seccomp-fine-tuning-whitelist-by-adding-times.patch [bz#1004175]
  - kvm-block-add-bdrv_write_zeroes.patch [bz#921465]
  - kvm-block-raw-add-bdrv_co_write_zeroes.patch [bz#921465]
  - kvm-rdma-export-qemu_fflush.patch [bz#921465]
  - kvm-block-migration-efficiently-encode-zero-blocks.patch [bz#921465]
  - kvm-Fix-real-mode-guest-migration.patch [bz#921465]
  - kvm-Fix-real-mode-guest-segments-dpl-value-in-savevm.patch [bz#921465]
  - kvm-migration-add-autoconvergence-documentation.patch [bz#921465]
  - kvm-migration-send-total-time-in-QMP-at-completed-stage.patch [bz#921465]
  - kvm-migration-don-t-use-uninitialized-variables.patch [bz#921465]
  - kvm-pc-drop-external-DSDT-loading.patch [bz#921465]
  - kvm-hda-codec-refactor-common-definitions-into-a-header-.patch [bz#954195]
  - kvm-hda-codec-make-mixemu-selectable-at-runtime.patch [bz#954195]
  - kvm-audio-remove-CONFIG_MIXEMU-configure-option.patch [bz#954195]
  - kvm-pc_piix-disable-mixer-for-6.4.0-machine-types-and-be.patch [bz#954195]
  - kvm-spec-mixemu-config-option-is-no-longer-supported-and.patch [bz#954195]
  - Resolves: bz#1001604
    (usb hub doesn't work properly (win7 sees downstream port #1 only).)
  - Resolves: bz#1004175
    ('-sandbox on'  option  cause  qemu-kvm process hang)
  - Resolves: bz#1004290
    (Use model 6 for qemu64 and intel cpus)
  - Resolves: bz#1009285
    (-device usb-storage,serial=... crashes with SCSI generic drive)
  - Resolves: bz#918907
    (provide backwards-compatible RHEL specific machine types in QEMU - CPU features)
  - Resolves: bz#921465
    (Migration can not finished even the "remaining ram" is already 0 kb)
  - Resolves: bz#954195
    (RHEL machines <=6.4 should not use mixemu)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-11.el7
changelog:
  - kvm-chardev-fix-pty_chr_timer.patch [bz#994414]
  - kvm-qemu-socket-zero-initialize-SocketAddress.patch [bz#922010]
  - kvm-qemu-socket-drop-pointless-allocation.patch [bz#922010]
  - kvm-qemu-socket-catch-monitor_get_fd-failures.patch [bz#922010]
  - kvm-qemu-char-check-optional-fields-using-has_.patch [bz#922010]
  - kvm-error-add-error_setg_file_open-helper.patch [bz#922010]
  - kvm-qemu-char-use-more-specific-error_setg_-variants.patch [bz#922010]
  - kvm-qemu-char-print-notification-to-stderr.patch [bz#922010]
  - kvm-qemu-char-fix-documentation-for-telnet-wait-socket-f.patch [bz#922010]
  - kvm-qemu-char-don-t-leak-opts-on-error.patch [bz#922010]
  - kvm-qemu-char-use-ChardevBackendKind-in-CharDriver.patch [bz#922010]
  - kvm-qemu-char-minor-mux-chardev-fixes.patch [bz#922010]
  - kvm-qemu-char-add-chardev-mux-support.patch [bz#922010]
  - kvm-qemu-char-report-udp-backend-errors.patch [bz#922010]
  - kvm-qemu-socket-don-t-leak-opts-on-error.patch [bz#922010]
  - kvm-chardev-handle-qmp_chardev_add-KIND_MUX-failure.patch [bz#922010]
  - kvm-acpi-piix4-Enable-qemu-kvm-compatibility-mode.patch [bz#1019474]
  - kvm-target-i386-support-loading-of-cpu-xsave-subsection.patch [bz#1004743]
  - Resolves: bz#1004743
    (XSAVE migration format not compatible between RHEL6 and RHEL7)
  - Resolves: bz#1019474
    (RHEL-7 can't load piix4_pm migration section from RHEL-6.5)
  - Resolves: bz#922010
    (RFE: support hotplugging chardev & serial ports)
  - Resolves: bz#994414
    (hot-unplug chardev with pty backend caused qemu Segmentation fault)


author: Michal Novotny <minovotn@redhat.com> - 1.5.3-12.el7
changelog:
  - kvm-vl-Clean-up-parsing-of-boot-option-argument.patch [bz#997817]
  - kvm-qemu-option-check_params-is-now-unused-drop-it.patch [bz#997817]
  - kvm-vl-Fix-boot-order-and-once-regressions-and-related-b.patch [bz#997817]
  - kvm-vl-Rename-boot_devices-to-boot_order-for-consistency.patch [bz#997817]
  - kvm-pc-Make-no-fd-bootchk-stick-across-boot-order-change.patch [bz#997817]
  - kvm-doc-Drop-ref-to-Bochs-from-no-fd-bootchk-documentati.patch [bz#997817]
  - kvm-libqtest-Plug-fd-and-memory-leaks-in-qtest_quit.patch [bz#997817]
  - kvm-libqtest-New-qtest_end-to-go-with-qtest_start.patch [bz#997817]
  - kvm-qtest-Don-t-reset-on-qtest-chardev-connect.patch [bz#997817]
  - kvm-boot-order-test-New-covering-just-PC-for-now.patch [bz#997817]
  - kvm-qemu-ga-execute-fsfreeze-freeze-in-reverse-order-of-.patch [bz#1019352]
  - kvm-rbd-link-and-load-librbd-dynamically.patch [bz#989608]
  - kvm-rbd-Only-look-for-qemu-specific-copy-of-librbd.so.1.patch [bz#989608]
  - kvm-spec-Whitelist-rbd-block-driver.patch [bz#989608]
  - Resolves: bz#1019352
    (qemu-guest-agent: "guest-fsfreeze-freeze" deadlocks if the guest have mounted disk images)
  - Resolves: bz#989608
    ([7.0 FEAT] qemu runtime support for librbd backend (ceph))
  - Resolves: bz#997817
    (-boot order and -boot once regressed since RHEL-6)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-13.el7
changelog:
  - kvm-seabios-paravirt-allow-more-than-1TB-in-x86-guest.patch [bz#989677]
  - kvm-scsi-prefer-UUID-to-VM-name-for-the-initiator-name.patch [bz#1006468]
  - kvm-Fix-incorrect-rhel_rhev_conflicts-macro-usage.patch [bz#1017693]
  - Resolves: bz#1006468
    (libiscsi initiator name should use vm UUID)
  - Resolves: bz#1017693
    (incorrect use of rhel_rhev_conflicts)
  - Resolves: bz#989677
    ([HP 7.0 FEAT]: Increase KVM guest supported memory to 4TiB)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-14.el7
changelog:
  - kvm-target-i386-remove-tabs-from-target-i386-cpu.h.patch [bz#928867]
  - kvm-migrate-vPMU-state.patch [bz#928867]
  - kvm-blockdev-do-not-default-cache.no-flush-to-true.patch [bz#1009993]
  - kvm-virtio-blk-do-not-relay-a-previous-driver-s-WCE-conf.patch [bz#1009993]
  - kvm-rng-random-use-error_setg_file_open.patch [bz#907743]
  - kvm-block-mirror_complete-use-error_setg_file_open.patch [bz#907743]
  - kvm-blockdev-use-error_setg_file_open.patch [bz#907743]
  - kvm-cpus-use-error_setg_file_open.patch [bz#907743]
  - kvm-dump-qmp_dump_guest_memory-use-error_setg_file_open.patch [bz#907743]
  - kvm-savevm-qmp_xen_save_devices_state-use-error_setg_fil.patch [bz#907743]
  - kvm-block-bdrv_reopen_prepare-don-t-use-QERR_OPEN_FILE_F.patch [bz#907743]
  - kvm-qerror-drop-QERR_OPEN_FILE_FAILED-macro.patch [bz#907743]
  - kvm-rhel-Drop-ivshmem-device.patch [bz#787463]
  - kvm-usb-remove-old-usb-host-code.patch [bz#1001144]
  - kvm-Add-rhel6-pxe-roms-files.patch [bz#997702]
  - kvm-Add-rhel6-pxe-rom-to-redhat-rpm.patch [bz#997702]
  - kvm-Fix-migration-from-rhel6.5-to-rhel7-with-ipxe.patch [bz#997702]
  - kvm-pc-Don-t-prematurely-explode-QEMUMachineInitArgs.patch [bz#994490]
  - kvm-pc-Don-t-explode-QEMUMachineInitArgs-into-local-vari.patch [bz#994490]
  - kvm-smbios-Normalize-smbios_entry_add-s-error-handling-t.patch [bz#994490]
  - kvm-smbios-Convert-to-QemuOpts.patch [bz#994490]
  - kvm-smbios-Improve-diagnostics-for-conflicting-entries.patch [bz#994490]
  - kvm-smbios-Make-multiple-smbios-type-accumulate-sanely.patch [bz#994490]
  - kvm-smbios-Factor-out-smbios_maybe_add_str.patch [bz#994490]
  - kvm-hw-Pass-QEMUMachine-to-its-init-method.patch [bz#994490]
  - kvm-smbios-Set-system-manufacturer-product-version-by-de.patch [bz#994490]
  - kvm-smbios-Decouple-system-product-from-QEMUMachine.patch [bz#994490]
  - kvm-rhel-SMBIOS-type-1-branding.patch [bz#994490]
  - kvm-Add-disable-rhev-features-option-to-configure.patch []
  - Resolves: bz#1001144
    (Disable or remove device usb-host-linux)
  - Resolves: bz#1009993
    (RHEL7 guests do not issue fdatasyncs on virtio-blk)
  - Resolves: bz#787463
    (disable ivshmem (was: [Hitachi 7.0 FEAT] Support ivshmem (Inter-VM Shared Memory)))
  - Resolves: bz#907743
    (qemu-ga: empty reason string for OpenFileFailed error)
  - Resolves: bz#928867
    (Virtual PMU support during live migration - qemu-kvm)
  - Resolves: bz#994490
    (Set per-machine-type SMBIOS strings)
  - Resolves: bz#997702
    (Migration from RHEL6.5 host to RHEL7.0 host is failed with virtio-net device)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-15.el7
changelog:
  - kvm-cow-make-reads-go-at-a-decent-speed.patch [bz#989646]
  - kvm-cow-make-writes-go-at-a-less-indecent-speed.patch [bz#989646]
  - kvm-cow-do-not-call-bdrv_co_is_allocated.patch [bz#989646]
  - kvm-block-keep-bs-total_sectors-up-to-date-even-for-grow.patch [bz#989646]
  - kvm-block-make-bdrv_co_is_allocated-static.patch [bz#989646]
  - kvm-block-do-not-use-total_sectors-in-bdrv_co_is_allocat.patch [bz#989646]
  - kvm-block-remove-bdrv_is_allocated_above-bdrv_co_is_allo.patch [bz#989646]
  - kvm-block-expect-errors-from-bdrv_co_is_allocated.patch [bz#989646]
  - kvm-block-Fix-compiler-warning-Werror-uninitialized.patch [bz#989646]
  - kvm-qemu-img-always-probe-the-input-image-for-allocated-.patch [bz#989646]
  - kvm-block-make-bdrv_has_zero_init-return-false-for-copy-.patch [bz#989646]
  - kvm-block-introduce-bdrv_get_block_status-API.patch [bz#989646]
  - kvm-block-define-get_block_status-return-value.patch [bz#989646]
  - kvm-block-return-get_block_status-data-and-flags-for-for.patch [bz#989646]
  - kvm-block-use-bdrv_has_zero_init-to-return-BDRV_BLOCK_ZE.patch [bz#989646]
  - kvm-block-return-BDRV_BLOCK_ZERO-past-end-of-backing-fil.patch [bz#989646]
  - kvm-qemu-img-add-a-map-subcommand.patch [bz#989646]
  - kvm-docs-qapi-document-qemu-img-map.patch [bz#989646]
  - kvm-raw-posix-return-get_block_status-data-and-flags.patch [bz#989646]
  - kvm-raw-posix-report-unwritten-extents-as-zero.patch [bz#989646]
  - kvm-block-add-default-get_block_status-implementation-fo.patch [bz#989646]
  - kvm-block-look-for-zero-blocks-in-bs-file.patch [bz#989646]
  - kvm-qemu-img-fix-invalid-JSON.patch [bz#989646]
  - kvm-block-get_block_status-set-pnum-0-on-error.patch [bz#989646]
  - kvm-block-get_block_status-avoid-segfault-if-there-is-no.patch [bz#989646]
  - kvm-block-get_block_status-avoid-redundant-callouts-on-r.patch [bz#989646]
  - kvm-qcow2-Restore-total_sectors-value-in-save_vmstate.patch [bz#1025740]
  - kvm-qcow2-Unset-zero_beyond_eof-in-save_vmstate.patch [bz#1025740]
  - kvm-qemu-iotests-Test-for-loading-VM-state-from-qcow2.patch [bz#1025740]
  - kvm-apic-rename-apic-specific-bitopts.patch [bz#1001216]
  - kvm-hw-import-bitmap-operations-in-qdev-core-header.patch [bz#1001216]
  - kvm-qemu-help-Sort-devices-by-logical-functionality.patch [bz#1001216]
  - kvm-devices-Associate-devices-to-their-logical-category.patch [bz#1001216]
  - kvm-Mostly-revert-qemu-help-Sort-devices-by-logical-func.patch [bz#1001216]
  - kvm-qdev-monitor-Group-device_add-help-and-info-qdm-by-c.patch [bz#1001216]
  - kvm-qdev-Replace-no_user-by-cannot_instantiate_with_devi.patch [bz#1001216]
  - kvm-sysbus-Set-cannot_instantiate_with_device_add_yet.patch [bz#1001216]
  - kvm-cpu-Document-why-cannot_instantiate_with_device_add_.patch [bz#1001216]
  - kvm-apic-Document-why-cannot_instantiate_with_device_add.patch [bz#1001216]
  - kvm-pci-host-Consistently-set-cannot_instantiate_with_de.patch [bz#1001216]
  - kvm-ich9-Document-why-cannot_instantiate_with_device_add.patch [bz#1001216]
  - kvm-piix3-piix4-Clean-up-use-of-cannot_instantiate_with_.patch [bz#1001216]
  - kvm-vt82c686-Clean-up-use-of-cannot_instantiate_with_dev.patch [bz#1001216]
  - kvm-isa-Clean-up-use-of-cannot_instantiate_with_device_a.patch [bz#1001216]
  - kvm-qdev-Do-not-let-the-user-try-to-device_add-when-it-c.patch [bz#1001216]
  - kvm-rhel-Revert-unwanted-cannot_instantiate_with_device_.patch [bz#1001216]
  - kvm-rhel-Revert-downstream-changes-to-unused-default-con.patch [bz#1001076]
  - kvm-rhel-Drop-cfi.pflash01-and-isa-ide-device.patch [bz#1001076]
  - kvm-rhel-Drop-isa-vga-device.patch [bz#1001088]
  - kvm-rhel-Make-isa-cirrus-vga-device-unavailable.patch [bz#1001088]
  - kvm-rhel-Make-ccid-card-emulated-device-unavailable.patch [bz#1001123]
  - kvm-x86-fix-migration-from-pre-version-12.patch [bz#1005695]
  - kvm-x86-cpuid-reconstruct-leaf-0Dh-data.patch [bz#1005695]
  - kvm-kvmvapic-Catch-invalid-ROM-size.patch [bz#920021]
  - kvm-kvmvapic-Enter-inactive-state-on-hardware-reset.patch [bz#920021]
  - kvm-kvmvapic-Clear-also-physical-ROM-address-when-enteri.patch [bz#920021]
  - kvm-block-optionally-disable-live-block-jobs.patch [bz#987582]
  - kvm-rpm-spec-template-disable-live-block-ops-for-rhel-en.patch [bz#987582]
  - kvm-migration-disable-live-block-migration-b-i-for-rhel-.patch [bz#1022392]
  - kvm-Build-ceph-rbd-only-for-rhev.patch [bz#987583]
  - kvm-spec-Disable-host-cdrom-RHEL-only.patch [bz#760885]
  - kvm-rhel-Make-pci-serial-2x-and-pci-serial-4x-device-una.patch [bz#1001180]
  - kvm-usb-host-libusb-Fix-reset-handling.patch [bz#980415]
  - kvm-usb-host-libusb-Configuration-0-may-be-a-valid-confi.patch [bz#980383]
  - kvm-usb-host-libusb-Detach-kernel-drivers-earlier.patch [bz#980383]
  - kvm-monitor-Remove-pci_add-command-for-Red-Hat-Enterpris.patch [bz#1010858]
  - kvm-monitor-Remove-pci_del-command-for-Red-Hat-Enterpris.patch [bz#1010858]
  - kvm-monitor-Remove-usb_add-del-commands-for-Red-Hat-Ente.patch [bz#1010858]
  - kvm-monitor-Remove-host_net_add-remove-for-Red-Hat-Enter.patch [bz#1010858]
  - kvm-fw_cfg-add-API-to-find-FW-cfg-object.patch [bz#990601]
  - kvm-pvpanic-use-FWCfgState-explicitly.patch [bz#990601]
  - kvm-pvpanic-initialization-cleanup.patch [bz#990601]
  - kvm-pvpanic-fix-fwcfg-for-big-endian-hosts.patch [bz#990601]
  - kvm-hw-misc-make-pvpanic-known-to-user.patch [bz#990601]
  - kvm-gdbstub-do-not-restart-crashed-guest.patch [bz#990601]
  - kvm-gdbstub-fix-for-commit-87f25c12bfeaaa0c41fb857713bbc.patch [bz#990601]
  - kvm-vl-allow-cont-from-panicked-state.patch [bz#990601]
  - kvm-hw-misc-don-t-create-pvpanic-device-by-default.patch [bz#990601]
  - kvm-block-vhdx-add-migration-blocker.patch [bz#1007176]
  - kvm-qemu-kvm.spec-add-vhdx-to-the-read-only-block-driver.patch [bz#1007176]
  - kvm-qemu-kvm.spec-Add-VPC-VHD-driver-to-the-block-read-o.patch [bz#1007176]
  - Resolves: bz#1001076
    (Disable or remove other block devices we won't support)
  - Resolves: bz#1001088
    (Disable or remove display devices we won't support)
  - Resolves: bz#1001123
    (Disable or remove device ccid-card-emulated)
  - Resolves: bz#1001180
    (Disable or remove devices pci-serial-2x, pci-serial-4x)
  - Resolves: bz#1001216
    (Fix no_user or provide another way make devices unavailable with -device / device_add)
  - Resolves: bz#1005695
    (QEMU should hide CPUID.0Dh values that it does not support)
  - Resolves: bz#1007176
    (Add VPC and VHDX file formats as supported in qemu-kvm (read-only))
  - Resolves: bz#1010858
    (Disable unused human monitor commands)
  - Resolves: bz#1022392
    (Disable live-storage-migration in qemu-kvm (migrate -b/-i))
  - Resolves: bz#1025740
    (Saving VM state on qcow2 images results in VM state corruption)
  - Resolves: bz#760885
    (Disable host cdrom passthrough)
  - Resolves: bz#920021
    (qemu-kvm segment fault when reboot guest after hot unplug device with option ROM)
  - Resolves: bz#980383
    (The usb3.0 stick can't be returned back to host after shutdown guest with usb3.0 pass-through)
  - Resolves: bz#980415
    (libusbx: error [_open_sysfs_attr] open /sys/bus/usb/devices/4-1/bConfigurationValue failed ret=-1 errno=2)
  - Resolves: bz#987582
    (Initial Virtualization Differentiation for RHEL7 (Live snapshots))
  - Resolves: bz#987583
    (Initial Virtualization Differentiation for RHEL7 (Ceph enablement))
  - Resolves: bz#989646
    (Support backup vendors in qemu to access qcow disk readonly)
  - Resolves: bz#990601
    (pvpanic device triggers guest bugs when present by default)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-16.el7
changelog:
  - kvm-block-drop-bs_snapshots-global-variable.patch [bz#1026524]
  - kvm-block-move-snapshot-code-in-block.c-to-block-snapsho.patch [bz#1026524]
  - kvm-block-fix-vvfat-error-path-for-enable_write_target.patch [bz#1026524]
  - kvm-block-Bugfix-format-and-snapshot-used-in-drive-optio.patch [bz#1026524]
  - kvm-iscsi-use-bdrv_new-instead-of-stack-structure.patch [bz#1026524]
  - kvm-qcow2-Add-corrupt-bit.patch [bz#1004347]
  - kvm-qcow2-Metadata-overlap-checks.patch [bz#1004347]
  - kvm-qcow2-Employ-metadata-overlap-checks.patch [bz#1004347]
  - kvm-qcow2-refcount-Move-OFLAG_COPIED-checks.patch [bz#1004347]
  - kvm-qcow2-refcount-Repair-OFLAG_COPIED-errors.patch [bz#1004347]
  - kvm-qcow2-refcount-Repair-shared-refcount-blocks.patch [bz#1004347]
  - kvm-qcow2_check-Mark-image-consistent.patch [bz#1004347]
  - kvm-qemu-iotests-Overlapping-cluster-allocations.patch [bz#1004347]
  - kvm-w32-Fix-access-to-host-devices-regression.patch [bz#1026524]
  - kvm-add-qemu-img-convert-n-option-skip-target-volume-cre.patch [bz#1026524]
  - kvm-bdrv-Use-Error-for-opening-images.patch [bz#1026524]
  - kvm-bdrv-Use-Error-for-creating-images.patch [bz#1026524]
  - kvm-block-Error-parameter-for-open-functions.patch [bz#1026524]
  - kvm-block-Error-parameter-for-create-functions.patch [bz#1026524]
  - kvm-qemu-img-create-Emit-filename-on-error.patch [bz#1026524]
  - kvm-qcow2-Use-Error-parameter.patch [bz#1026524]
  - kvm-qemu-iotests-Adjustments-due-to-error-propagation.patch [bz#1026524]
  - kvm-block-raw-Employ-error-parameter.patch [bz#1026524]
  - kvm-block-raw-win32-Employ-error-parameter.patch [bz#1026524]
  - kvm-blkdebug-Employ-error-parameter.patch [bz#1026524]
  - kvm-blkverify-Employ-error-parameter.patch [bz#1026524]
  - kvm-block-raw-posix-Employ-error-parameter.patch [bz#1026524]
  - kvm-block-raw-win32-Always-use-errno-in-hdev_open.patch [bz#1026524]
  - kvm-qmp-Documentation-for-BLOCK_IMAGE_CORRUPTED.patch [bz#1004347]
  - kvm-qcow2-Correct-snapshots-size-for-overlap-check.patch [bz#1004347]
  - kvm-qcow2-CHECK_OFLAG_COPIED-is-obsolete.patch [bz#1004347]
  - kvm-qcow2-Correct-endianness-in-overlap-check.patch [bz#1004347]
  - kvm-qcow2-Switch-L1-table-in-a-single-sequence.patch [bz#1004347]
  - kvm-qcow2-Use-pread-for-inactive-L1-in-overlap-check.patch [bz#1004347]
  - kvm-qcow2-Remove-wrong-metadata-overlap-check.patch [bz#1004347]
  - kvm-qcow2-Use-negated-overflow-check-mask.patch [bz#1004347]
  - kvm-qcow2-Make-overlap-check-mask-variable.patch [bz#1004347]
  - kvm-qcow2-Add-overlap-check-options.patch [bz#1004347]
  - kvm-qcow2-Array-assigning-options-to-OL-check-bits.patch [bz#1004347]
  - kvm-qcow2-Add-more-overlap-check-bitmask-macros.patch [bz#1004347]
  - kvm-qcow2-Evaluate-overlap-check-options.patch [bz#1004347]
  - kvm-qapi-types.py-Split-off-generate_struct_fields.patch [bz#978402]
  - kvm-qapi-types.py-Fix-enum-struct-sizes-on-i686.patch [bz#978402]
  - kvm-qapi-types-visit.py-Pass-whole-expr-dict-for-structs.patch [bz#978402]
  - kvm-qapi-types-visit.py-Inheritance-for-structs.patch [bz#978402]
  - kvm-blockdev-Introduce-DriveInfo.enable_auto_del.patch [bz#978402]
  - kvm-Implement-qdict_flatten.patch [bz#978402]
  - kvm-blockdev-blockdev-add-QMP-command.patch [bz#978402]
  - kvm-blockdev-Separate-ID-generation-from-DriveInfo-creat.patch [bz#978402]
  - kvm-blockdev-Pass-QDict-to-blockdev_init.patch [bz#978402]
  - kvm-blockdev-Move-parsing-of-media-option-to-drive_init.patch [bz#978402]
  - kvm-blockdev-Move-parsing-of-if-option-to-drive_init.patch [bz#978402]
  - kvm-blockdev-Moving-parsing-of-geometry-options-to-drive.patch [bz#978402]
  - kvm-blockdev-Move-parsing-of-boot-option-to-drive_init.patch [bz#978402]
  - kvm-blockdev-Move-bus-unit-index-processing-to-drive_ini.patch [bz#978402]
  - kvm-blockdev-Move-virtio-blk-device-creation-to-drive_in.patch [bz#978402]
  - kvm-blockdev-Remove-IF_-check-for-read-only-blockdev_ini.patch [bz#978402]
  - kvm-qemu-iotests-Check-autodel-behaviour-for-device_del.patch [bz#978402]
  - kvm-blockdev-Remove-media-parameter-from-blockdev_init.patch [bz#978402]
  - kvm-blockdev-Don-t-disable-COR-automatically-with-blockd.patch [bz#978402]
  - kvm-blockdev-blockdev_init-error-conversion.patch [bz#978402]
  - kvm-sd-Avoid-access-to-NULL-BlockDriverState.patch [bz#978402]
  - kvm-blockdev-fix-cdrom-read_only-flag.patch [bz#978402]
  - kvm-block-fix-backing-file-overriding.patch [bz#978402]
  - kvm-block-Disable-BDRV_O_COPY_ON_READ-for-the-backing-fi.patch [bz#978402]
  - kvm-block-Don-t-copy-backing-file-name-on-error.patch [bz#978402]
  - kvm-qemu-iotests-Try-creating-huge-qcow2-image.patch [bz#980771]
  - kvm-block-move-qmp-and-info-dump-related-code-to-block-q.patch [bz#980771]
  - kvm-block-dump-snapshot-and-image-info-to-specified-outp.patch [bz#980771]
  - kvm-block-add-snapshot-info-query-function-bdrv_query_sn.patch [bz#980771]
  - kvm-block-add-image-info-query-function-bdrv_query_image.patch [bz#980771]
  - kvm-qmp-add-ImageInfo-in-BlockDeviceInfo-used-by-query-b.patch [bz#980771]
  - kvm-vmdk-Implement-.bdrv_has_zero_init.patch [bz#980771]
  - kvm-qemu-iotests-Add-basic-ability-to-use-binary-sample-.patch [bz#980771]
  - kvm-qemu-iotests-Quote-TEST_IMG-and-TEST_DIR-usage.patch [bz#980771]
  - kvm-qemu-iotests-fix-test-case-059.patch [bz#980771]
  - kvm-qapi-Add-ImageInfoSpecific-type.patch [bz#980771]
  - kvm-block-Add-bdrv_get_specific_info.patch [bz#980771]
  - kvm-block-qapi-Human-readable-ImageInfoSpecific-dump.patch [bz#980771]
  - kvm-qcow2-Add-support-for-ImageInfoSpecific.patch [bz#980771]
  - kvm-qemu-iotests-Discard-specific-info-in-_img_info.patch [bz#980771]
  - kvm-qemu-iotests-Additional-info-from-qemu-img-info.patch [bz#980771]
  - kvm-vmdk-convert-error-code-to-use-errp.patch [bz#980771]
  - kvm-vmdk-refuse-enabling-zeroed-grain-with-flat-images.patch [bz#980771]
  - kvm-qapi-Add-optional-field-compressed-to-ImageInfo.patch [bz#980771]
  - kvm-vmdk-Only-read-cid-from-image-file-when-opening.patch [bz#980771]
  - kvm-vmdk-Implment-bdrv_get_specific_info.patch [bz#980771]
  - Resolves: bz#1004347
    (Backport qcow2 corruption prevention patches)
  - Resolves: bz#1026524
    (Backport block layer error parameter patches)
  - Resolves: bz#978402
    ([RFE] Add discard support to qemu-kvm layer)
  - Resolves: bz#980771
    ([RFE]  qemu-img should be able to tell the compat version of a qcow2 image)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-17.el7
changelog:
  - kvm-pci-assign-Add-MSI-affinity-support.patch [bz#1025877]
  - kvm-Fix-potential-resource-leak-missing-fclose.patch [bz#1025877]
  - kvm-pci-assign-remove-the-duplicate-function-name-in-deb.patch [bz#1025877]
  - kvm-Remove-s390-ccw-img-loader.patch [bz#1017682]
  - kvm-Fix-vscclient-installation.patch [bz#1017681]
  - kvm-Change-qemu-bridge-helper-permissions-to-4755.patch [bz#1017689]
  - kvm-net-update-nic-info-during-device-reset.patch [bz#922589]
  - kvm-net-e1000-update-network-information-when-macaddr-is.patch [bz#922589]
  - kvm-net-rtl8139-update-network-information-when-macaddr-.patch [bz#922589]
  - kvm-virtio-net-fix-up-HMP-NIC-info-string-on-reset.patch [bz#1026689]
  - kvm-vfio-pci-VGA-quirk-update.patch [bz#1025477]
  - kvm-vfio-pci-Add-support-for-MSI-affinity.patch [bz#1025477]
  - kvm-vfio-pci-Test-device-reset-capabilities.patch [bz#1026550]
  - kvm-vfio-pci-Lazy-PCI-option-ROM-loading.patch [bz#1026550]
  - kvm-vfio-pci-Cleanup-error_reports.patch [bz#1026550]
  - kvm-vfio-pci-Add-dummy-PCI-ROM-write-accessor.patch [bz#1026550]
  - kvm-vfio-pci-Fix-endian-issues-in-vfio_pci_size_rom.patch [bz#1026550]
  - kvm-linux-headers-Update-to-include-vfio-pci-hot-reset-s.patch [bz#1025472]
  - kvm-vfio-pci-Implement-PCI-hot-reset.patch [bz#1025472]
  - kvm-linux-headers-Update-for-KVM-VFIO-device.patch [bz#1025474]
  - kvm-vfio-pci-Make-use-of-new-KVM-VFIO-device.patch [bz#1025474]
  - kvm-vmdk-Fix-vmdk_parse_extents.patch [bz#995866]
  - kvm-vmdk-fix-VMFS-extent-parsing.patch [bz#995866]
  - kvm-e1000-rtl8139-update-HMP-NIC-when-every-bit-is-writt.patch [bz#922589]
  - kvm-don-t-disable-ctrl_mac_addr-feature-for-6.5-machine-.patch [bz#1005039]
  - Resolves: bz#1005039
    (add compat property to disable ctrl_mac_addr feature)
  - Resolves: bz#1017681
    (rpmdiff test "Multilib regressions": vscclient is a libtool script on s390/s390x/ppc/ppc64)
  - Resolves: bz#1017682
    (/usr/share/qemu-kvm/s390-ccw.img need not be distributed)
  - Resolves: bz#1017689
    (/usr/libexec/qemu-bridge-helper permissions should be 4755)
  - Resolves: bz#1025472
    (Nvidia GPU device assignment - qemu-kvm - bus reset support)
  - Resolves: bz#1025474
    (Nvidia GPU device assignment - qemu-kvm - NoSnoop support)
  - Resolves: bz#1025477
    (VFIO MSI affinity)
  - Resolves: bz#1025877
    (pci-assign lacks MSI affinity support)
  - Resolves: bz#1026550
    (QEMU VFIO update ROM loading code)
  - Resolves: bz#1026689
    (virtio-net: macaddr is reset but network info of monitor isn't updated)
  - Resolves: bz#922589
    (e1000/rtl8139: qemu mac address can not be changed via set the hardware address in guest)
  - Resolves: bz#995866
    (fix vmdk support to ESX images)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-19.el7
changelog:
  - kvm-qapi-qapi-visit.py-fix-list-handling-for-union-types.patch [bz#848203]
  - kvm-qapi-qapi-visit.py-native-list-support.patch [bz#848203]
  - kvm-qapi-enable-generation-of-native-list-code.patch [bz#848203]
  - kvm-net-add-support-of-mac-programming-over-macvtap-in-Q.patch [bz#848203]
  - Resolves: bz#848203
    (MAC Programming for virtio over macvtap - qemu-kvm support)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-20.el7
changelog:
  - kvm-pc-drop-virtio-balloon-pci-event_idx-compat-property.patch [bz#1029539]
  - kvm-virtio-net-only-delete-bh-that-existed.patch [bz#922463]
  - kvm-virtio-net-broken-RX-filtering-logic-fixed.patch [bz#1029370]
  - kvm-block-Avoid-unecessary-drv-bdrv_getlength-calls.patch [bz#1025138]
  - kvm-block-Round-up-total_sectors.patch [bz#1025138]
  - kvm-doc-fix-hardcoded-helper-path.patch [bz#1016952]
  - kvm-introduce-RFQDN_REDHAT-RHEL-6-7-fwd.patch [bz#971933]
  - kvm-error-reason-in-BLOCK_IO_ERROR-BLOCK_JOB_ERROR-event.patch [bz#971938]
  - kvm-improve-debuggability-of-BLOCK_IO_ERROR-BLOCK_JOB_ER.patch [bz#895041]
  - kvm-vfio-pci-Fix-multifunction-on.patch [bz#1029275]
  - kvm-qcow2-Change-default-for-new-images-to-compat-1.1.patch [bz#1026739]
  - kvm-qcow2-change-default-for-new-images-to-compat-1.1-pa.patch [bz#1026739]
  - kvm-rng-egd-offset-the-point-when-repeatedly-read-from-t.patch [bz#1032862]
  - kvm-Fix-rhel-rhev-conflict-for-qemu-kvm-common.patch [bz#1033463]
  - Resolves: bz#1016952
    (qemu-kvm man page guide wrong path for qemu-bridge-helper)
  - Resolves: bz#1025138
    (Read/Randread/Randrw performance regression)
  - Resolves: bz#1026739
    (qcow2: Switch to compat=1.1 default for new images)
  - Resolves: bz#1029275
    (Guest only find one 82576 VF(function 0) while use multifunction)
  - Resolves: bz#1029370
    ([whql][netkvm][wlk] Virtio-net device handles RX multicast filtering improperly)
  - Resolves: bz#1029539
    (Machine type rhel6.1.0 and  balloon device cause migration fail from RHEL6.5 host to RHEL7.0 host)
  - Resolves: bz#1032862
    (virtio-rng-egd: repeatedly read same random data-block w/o considering the buffer offset)
  - Resolves: bz#1033463
    (can not upgrade qemu-kvm-common to qemu-kvm-common-rhev due to conflicts)
  - Resolves: bz#895041
    (QMP: forward port I/O error debug messages)
  - Resolves: bz#922463
    (qemu-kvm core dump when virtio-net multi queue guest hot-unpluging vNIC)
  - Resolves: bz#971933
    (QMP: add RHEL's vendor extension prefix)
  - Resolves: bz#971938
    (QMP: Add error reason to BLOCK_IO_ERROR event)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-21.el7
changelog:
  - kvm-scsi-Allocate-SCSITargetReq-r-buf-dynamically-CVE-20.patch [bz#1007334]
  - Resolves: bz#1007334
    (CVE-2013-4344 qemu-kvm: qemu: buffer overflow in scsi_target_emulate_report_luns [rhel-7.0])


author: Michal Novotny <minovotn@redhat.com> - 1.5.3-22.el7
changelog:
  - Fix ksmtuned with set_process_name=1 [bz#1027420]
  - Fix committed memory when no qemu-kvm running [bz#1027418]
  - kvm-virtio-net-fix-the-memory-leak-in-rxfilter_notify.patch [bz#1033810]
  - kvm-qom-Fix-memory-leak-in-object_property_set_link.patch [bz#1033810]
  - kvm-fix-intel-hda-live-migration.patch [bz#1036537]
  - kvm-vfio-pci-Release-all-MSI-X-vectors-when-disabled.patch [bz#1029743]
  - kvm-Query-KVM-for-available-memory-slots.patch [bz#921490]
  - kvm-block-Dont-ignore-previously-set-bdrv_flags.patch [bz#1039501]
  - kvm-cleanup-trace-events.pl-New.patch [bz#997832]
  - kvm-slavio_misc-Fix-slavio_led_mem_readw-_writew-tracepo.patch [bz#997832]
  - kvm-milkymist-minimac2-Fix-minimac2_read-_write-tracepoi.patch [bz#997832]
  - kvm-trace-events-Drop-unused-events.patch [bz#997832]
  - kvm-trace-events-Fix-up-source-file-comments.patch [bz#997832]
  - kvm-trace-events-Clean-up-with-scripts-cleanup-trace-eve.patch [bz#997832]
  - kvm-trace-events-Clean-up-after-removal-of-old-usb-host-.patch [bz#997832]
  - kvm-net-Update-netdev-peer-on-link-change.patch [bz#1027571]
  - Resolves: bz#1027418
    (ksmtuned committed_memory() still returns "", not 0, when no qemu running)
  - Resolves: bz#1027420
    (ksmtuned can’t handle libvirt WITH set_process_name=1)
  - Resolves: bz#1027571
    ([virtio-win]win8.1 guest network can not resume automatically after do "set_link tap1 on")
  - Resolves: bz#1029743
    (qemu-kvm core dump after hot plug/unplug 82576 PF about 100 times)
  - Resolves: bz#1033810
    (memory leak in using object_get_canonical_path())
  - Resolves: bz#1036537
    (Cross version migration from RHEL6.5 host to RHEL7.0 host with sound device failed.)
  - Resolves: bz#1039501
    ([provisioning] discard=on broken)
  - Resolves: bz#921490
    (qemu-kvm core dumped after hot plugging more than 11 VF through vfio-pci)
  - Resolves: bz#997832
    (Backport trace fixes proactively to avoid confusion and silly conflicts)


author: Michal Novotny <minovotn@redhat.com> - 1.5.3-23.el7
changelog:
  - kvm-qdev-monitor-Unref-device-when-device_add-fails.patch [bz#1003773]
  - kvm-qdev-Drop-misleading-qdev_free-function.patch [bz#1003773]
  - kvm-blockdev-fix-drive_init-opts-and-bs_opts-leaks.patch [bz#1003773]
  - kvm-libqtest-rename-qmp-to-qmp_discard_response.patch [bz#1003773]
  - kvm-libqtest-add-qmp-fmt-.-QDict-function.patch [bz#1003773]
  - kvm-blockdev-test-add-test-case-for-drive_add-duplicate-.patch [bz#1003773]
  - kvm-qdev-monitor-test-add-device_add-leak-test-cases.patch [bz#1003773]
  - kvm-qtest-Use-display-none-by-default.patch [bz#1003773]
  - Resolves: bz#1003773
    (When virtio-blk-pci device with dataplane is failed to be added, the drive cannot be released.)


author: Michal Novotny <minovotn@redhat.com> - 1.5.3-24.el7
changelog:
  - kvm-range-add-Range-structure.patch [bz#1034876]
  - kvm-range-add-Range-to-typedefs.patch [bz#1034876]
  - kvm-range-add-min-max-operations-on-ranges.patch [bz#1034876]
  - kvm-qdev-Add-SIZE-type-to-qdev-properties.patch [bz#1034876]
  - kvm-qapi-make-visit_type_size-fallback-to-type_int.patch [bz#1034876]
  - kvm-pc-move-IO_APIC_DEFAULT_ADDRESS-to-include-hw-i386-i.patch [bz#1034876]
  - kvm-pci-add-helper-to-retrieve-the-64-bit-range.patch [bz#1034876]
  - kvm-pci-fix-up-w64-size-calculation-helper.patch [bz#1034876]
  - kvm-refer-to-FWCfgState-explicitly.patch [bz#1034876]
  - kvm-fw_cfg-move-typedef-to-qemu-typedefs.h.patch [bz#1034876]
  - kvm-arch_init-align-MR-size-to-target-page-size.patch [bz#1034876]
  - kvm-loader-store-FW-CFG-ROM-files-in-RAM.patch [bz#1034876]
  - kvm-pci-store-PCI-hole-ranges-in-guestinfo-structure.patch [bz#1034876]
  - kvm-pc-pass-PCI-hole-ranges-to-Guests.patch [bz#1034876]
  - kvm-pc-replace-i440fx_common_init-with-i440fx_init.patch [bz#1034876]
  - kvm-pc-don-t-access-fw-cfg-if-NULL.patch [bz#1034876]
  - kvm-pc-add-I440FX-QOM-cast-macro.patch [bz#1034876]
  - kvm-pc-limit-64-bit-hole-to-2G-by-default.patch [bz#1034876]
  - kvm-q35-make-pci-window-address-size-match-guest-cfg.patch [bz#1034876]
  - kvm-q35-use-64-bit-window-programmed-by-guest.patch [bz#1034876]
  - kvm-piix-use-64-bit-window-programmed-by-guest.patch [bz#1034876]
  - kvm-pc-fix-regression-for-64-bit-PCI-memory.patch [bz#1034876]
  - kvm-cleanup-object.h-include-error.h-directly.patch [bz#1034876]
  - kvm-qom-cleanup-struct-Error-references.patch [bz#1034876]
  - kvm-qom-add-pointer-to-int-property-helpers.patch [bz#1034876]
  - kvm-fw_cfg-interface-to-trigger-callback-on-read.patch [bz#1034876]
  - kvm-loader-support-for-unmapped-ROM-blobs.patch [bz#1034876]
  - kvm-pcie_host-expose-UNMAPPED-macro.patch [bz#1034876]
  - kvm-pcie_host-expose-address-format.patch [bz#1034876]
  - kvm-q35-use-macro-for-MCFG-property-name.patch [bz#1034876]
  - kvm-q35-expose-mmcfg-size-as-a-property.patch [bz#1034876]
  - kvm-i386-add-ACPI-table-files-from-seabios.patch [bz#1034876]
  - kvm-acpi-add-rules-to-compile-ASL-source.patch [bz#1034876]
  - kvm-acpi-pre-compiled-ASL-files.patch [bz#1034876]
  - kvm-acpi-ssdt-pcihp-updat-generated-file.patch [bz#1034876]
  - kvm-loader-use-file-path-size-from-fw_cfg.h.patch [bz#1034876]
  - kvm-i386-add-bios-linker-loader.patch [bz#1034876]
  - kvm-loader-allow-adding-ROMs-in-done-callbacks.patch [bz#1034876]
  - kvm-i386-define-pc-guest-info.patch [bz#1034876]
  - kvm-acpi-piix-add-macros-for-acpi-property-names.patch [bz#1034876]
  - kvm-piix-APIs-for-pc-guest-info.patch [bz#1034876]
  - kvm-ich9-APIs-for-pc-guest-info.patch [bz#1034876]
  - kvm-pvpanic-add-API-to-access-io-port.patch [bz#1034876]
  - kvm-hpet-add-API-to-find-it.patch [bz#1034876]
  - kvm-hpet-fix-build-with-CONFIG_HPET-off.patch [bz#1034876]
  - kvm-acpi-add-interface-to-access-user-installed-tables.patch [bz#1034876]
  - kvm-pc-use-new-api-to-add-builtin-tables.patch [bz#1034876]
  - kvm-i386-ACPI-table-generation-code-from-seabios.patch [bz#1034876]
  - kvm-ssdt-fix-PBLK-length.patch [bz#1034876]
  - kvm-ssdt-proc-update-generated-file.patch [bz#1034876]
  - kvm-pc-disable-pci-info.patch [bz#1034876]
  - kvm-acpi-build-fix-build-on-glib-2.22.patch [bz#1034876]
  - kvm-acpi-build-fix-build-on-glib-2.14.patch [bz#1034876]
  - kvm-acpi-build-fix-support-for-glib-2.22.patch [bz#1034876]
  - kvm-acpi-build-Fix-compiler-warning-missing-gnu_printf-f.patch [bz#1034876]
  - kvm-exec-Fix-prototype-of-phys_mem_set_alloc-and-related.patch [bz#1034876]
  - Resolves: bz#1034876
    (export acpi tables to guests)


author: Michal Novotny <minovotn@redhat.com> - 1.5.3-25.el7
changelog:
  - kvm-Change-package-description.patch [bz#1017696]
  - kvm-seccomp-add-kill-to-the-syscall-whitelist.patch [bz#1026314]
  - kvm-json-parser-fix-handling-of-large-whole-number-value.patch [bz#997915]
  - kvm-qapi-add-QMP-input-test-for-large-integers.patch [bz#997915]
  - kvm-qapi-fix-visitor-serialization-tests-for-numbers-dou.patch [bz#997915]
  - kvm-qapi-add-native-list-coverage-for-visitor-serializat.patch [bz#997915]
  - kvm-qapi-add-native-list-coverage-for-QMP-output-visitor.patch [bz#997915]
  - kvm-qapi-add-native-list-coverage-for-QMP-input-visitor-.patch [bz#997915]
  - kvm-qapi-lack-of-two-commas-in-dict.patch [bz#997915]
  - kvm-tests-QAPI-schema-parser-tests.patch [bz#997915]
  - kvm-tests-Use-qapi-schema-test.json-as-schema-parser-tes.patch [bz#997915]
  - kvm-qapi.py-Restructure-lexer-and-parser.patch [bz#997915]
  - kvm-qapi.py-Decent-syntax-error-reporting.patch [bz#997915]
  - kvm-qapi.py-Reject-invalid-characters-in-schema-file.patch [bz#997915]
  - kvm-qapi.py-Fix-schema-parser-to-check-syntax-systematic.patch [bz#997915]
  - kvm-qapi.py-Fix-diagnosing-non-objects-at-a-schema-s-top.patch [bz#997915]
  - kvm-qapi.py-Rename-expr_eval-to-expr-in-parse_schema.patch [bz#997915]
  - kvm-qapi.py-Permit-comments-starting-anywhere-on-the-lin.patch [bz#997915]
  - kvm-scripts-qapi.py-Avoid-syntax-not-supported-by-Python.patch [bz#997915]
  - kvm-tests-Fix-schema-parser-test-for-in-tree-build.patch [bz#997915]
  - Resolves: bz#1017696
    ([branding] remove references to dynamic translation and user-mode emulation)
  - Resolves: bz#1026314
    (qemu-kvm hang when use '-sandbox on'+'vnc'+'hda')
  - Resolves: bz#997915
    (Backport new QAPI parser proactively to help developers and avoid silly conflicts)


author: Michal Novotny <minovotn@redhat.com> - 1.5.3-26.el7
changelog:
  - Add BuildRequires to libRDMAcm-devel for RDMA support [bz#1011720]
  - kvm-add-a-header-file-for-atomic-operations.patch [bz#1011720]
  - kvm-savevm-Fix-potential-memory-leak.patch [bz#1011720]
  - kvm-migration-Fail-migration-on-bdrv_flush_all-error.patch [bz#1011720]
  - kvm-rdma-add-documentation.patch [bz#1011720]
  - kvm-rdma-introduce-qemu_update_position.patch [bz#1011720]
  - kvm-rdma-export-yield_until_fd_readable.patch [bz#1011720]
  - kvm-rdma-export-throughput-w-MigrationStats-QMP.patch [bz#1011720]
  - kvm-rdma-introduce-qemu_file_mode_is_not_valid.patch [bz#1011720]
  - kvm-rdma-introduce-qemu_ram_foreach_block.patch [bz#1011720]
  - kvm-rdma-new-QEMUFileOps-hooks.patch [bz#1011720]
  - kvm-rdma-introduce-capability-x-rdma-pin-all.patch [bz#1011720]
  - kvm-rdma-update-documentation-to-reflect-new-unpin-suppo.patch [bz#1011720]- kvm-rdma-bugfix-ram_control_save_page.patch [bz#1011720]
  - kvm-rdma-introduce-ram_handle_compressed.patch [bz#1011720]
  - kvm-rdma-core-logic.patch [bz#1011720]
  - kvm-rdma-send-pc.ram.patch [bz#1011720]
  - kvm-rdma-allow-state-transitions-between-other-states-be.patch [bz#1011720]
  - kvm-rdma-introduce-MIG_STATE_NONE-and-change-MIG_STATE_S.patch [bz#1011720]
  - kvm-rdma-account-for-the-time-spent-in-MIG_STATE_SETUP-t.patch [bz#1011720]
  - kvm-rdma-bugfix-make-IPv6-support-work.patch [bz#1011720]
  - kvm-rdma-forgot-to-turn-off-the-debugging-flag.patch [bz#1011720]
  - kvm-rdma-correct-newlines-in-error-statements.patch [bz#1011720]
  - kvm-rdma-don-t-use-negative-index-to-array.patch [bz#1011720]
  - kvm-rdma-qemu_rdma_post_send_control-uses-wrongly-RDMA_W.patch [bz#1011720]
  - kvm-rdma-use-DRMA_WRID_READY.patch [bz#1011720]
  - kvm-rdma-memory-leak-RDMAContext-host.patch [bz#1011720]
  - kvm-rdma-use-resp.len-after-validation-in-qemu_rdma_regi.patch [bz#1011720]
  - kvm-rdma-validate-RDMAControlHeader-len.patch [bz#1011720]
  - kvm-rdma-check-if-RDMAControlHeader-len-match-transferre.patch [bz#1011720]
  - kvm-rdma-proper-getaddrinfo-handling.patch [bz#1011720]
  - kvm-rdma-IPv6-over-Ethernet-RoCE-is-broken-in-linux-work.patch [bz#1011720]
  - kvm-rdma-remaining-documentation-fixes.patch [bz#1011720]
  - kvm-rdma-silly-ipv6-bugfix.patch [bz#1011720]
  - kvm-savevm-fix-wrong-initialization-by-ram_control_load_.patch [bz#1011720]
  - kvm-arch_init-right-return-for-ram_save_iterate.patch [bz#1011720]
  - kvm-rdma-clean-up-of-qemu_rdma_cleanup.patch [bz#1011720]
  - kvm-rdma-constify-ram_chunk_-index-start-end.patch [bz#1011720]
  - kvm-migration-Fix-debug-print-type.patch [bz#1011720]
  - kvm-arch_init-make-is_zero_page-accept-size.patch [bz#1011720]
  - kvm-migration-ram_handle_compressed.patch [bz#1011720]
  - kvm-migration-fix-spice-migration.patch [bz#1011720]
  - kvm-pci-assign-cap-number-of-devices-that-can-be-assigne.patch [bz#678368]
  - kvm-vfio-cap-number-of-devices-that-can-be-assigned.patch [bz#678368]
  - kvm-Revert-usb-tablet-Don-t-claim-wakeup-capability-for-.patch [bz#1039513]
  - kvm-mempath-prefault-pages-manually-v4.patch [bz#1026554]
  - Resolves: bz#1011720
    ([HP 7.0 Feat]: Backport RDMA based live guest migration changes from upstream to RHEL7.0 KVM)
  - Resolves: bz#1026554
    (qemu: mempath: prefault pages manually)
  - Resolves: bz#1039513
    (backport remote wakeup for ehci)
  - Resolves: bz#678368
    (RFE: Support more than 8 assigned devices)


author: Michal Novotny <minovotn@redhat.com> - 1.5.3-27.el7
changelog:
  - Change systemd service location [bz#1025217]
  - kvm-vmdk-Allow-read-only-open-of-VMDK-version-3.patch [bz#1007710 bz#1029852]
  - Resolves: bz#1007710
    ([RFE] Enable qemu-img to support VMDK version 3)
  - Resolves: bz#1025217
    (systemd can't control ksm.service and ksmtuned.service)
  - Resolves: bz#1029852
    (qemu-img fails to convert vmdk image with "qemu-img: Could not open 'image.vmdk'")


author: Michal Novotny <minovotn@redhat.com> - 1.5.3-28.el7
changelog:
  - kvm-virtio_pci-fix-level-interrupts-with-irqfd.patch [bz#1035132]
  - Resolves: bz#1035132
    (fail to boot and call trace with x-data-plane=on specified for rhel6.5 guest)


author: Michal Novotny <minovotn@redhat.com> - 1.5.3-29.el7
changelog:
  - kvm-QMP-Forward-port-__com.redhat_drive_del-from-RHEL-6.patch [bz#889051]
  - kvm-QMP-Forward-port-__com.redhat_drive_add-from-RHEL-6.patch [bz#889051]
  - kvm-HMP-Forward-port-__com.redhat_drive_add-from-RHEL-6.patch [bz#889051]
  - kvm-QMP-Document-throttling-parameters-of-__com.redhat_d.patch [bz#889051]
  - kvm-HMP-Disable-drive_add-for-Red-Hat-Enterprise-Linux.patch [bz#889051]
  - Resolves: bz#889051
    (Commands "__com.redhat_drive_add/del" don' t exist in RHEL7.0)


author: Michal Novotny <minovotn@redhat.com> - 1.5.3-30.el7
changelog:
  - kvm-Revert-HMP-Disable-drive_add-for-Red-Hat-Enterprise-2.patch.patch [bz#889051]
  - Resolves: bz#889051
    (Commands "__com.redhat_drive_add/del" don' t exist in RHEL7.0)


author: Michal Novotny <minovotn@redhat.com> - 1.5.3-32.el7
changelog:
  - kvm-block-change-default-of-.has_zero_init-to-0.patch.patch [bz#1007815]
  - kvm-iscsi-factor-out-sector-conversions.patch.patch [bz#1007815]
  - kvm-iscsi-add-logical-block-provisioning-information-to-.patch.patch [bz#1007815]
  - kvm-iscsi-add-.bdrv_get_block_status.patch.patch.patch [bz#1007815]
  - kvm-iscsi-split-discard-requests-in-multiple-parts.patch.patch.patch [bz#1007815]
  - kvm-block-make-BdrvRequestFlags-public.patch.patch.patch [bz#1007815]
  - kvm-block-add-flags-to-bdrv_-_write_zeroes.patch.patch.patch [bz#1007815]
  - kvm-block-introduce-BDRV_REQ_MAY_UNMAP-request-flag.patch.patch.patch [bz#1007815]
  - kvm-block-add-logical-block-provisioning-info-to-BlockDr.patch.patch.patch [bz#1007815]
  - kvm-block-add-wrappers-for-logical-block-provisioning-in.patch.patch.patch [bz#1007815]
  - kvm-block-iscsi-add-.bdrv_get_info.patch.patch [bz#1007815]
  - kvm-block-add-BlockLimits-structure-to-BlockDriverState.patch.patch.patch [bz#1007815]
  - kvm-block-raw-copy-BlockLimits-on-raw_open.patch.patch.patch [bz#1007815]
  - kvm-block-honour-BlockLimits-in-bdrv_co_do_write_zeroes.patch.patch.patch [bz#1007815]
  - kvm-block-honour-BlockLimits-in-bdrv_co_discard.patch.patch.patch [bz#1007815]
  - kvm-iscsi-set-limits-in-BlockDriverState.patch.patch.patch [bz#1007815]
  - kvm-iscsi-simplify-iscsi_co_discard.patch.patch.patch [bz#1007815]
  - kvm-iscsi-add-bdrv_co_write_zeroes.patch.patch.patch [bz#1007815]
  - kvm-block-introduce-bdrv_make_zero.patch.patch.patch [bz#1007815]
  - kvm-block-get_block_status-fix-BDRV_BLOCK_ZERO-for-unall.patch.patch.patch [bz#1007815]
  - kvm-qemu-img-add-support-for-fully-allocated-images.patch.patch.patch [bz#1007815]
  - kvm-qemu-img-conditionally-zero-out-target-on-convert.patch.patch.patch [bz#1007815]
  - kvm-block-generalize-BlockLimits-handling-to-cover-bdrv_.patch.patch.patch [bz#1007815]
  - kvm-block-add-flags-to-BlockRequest.patch.patch.patch [bz#1007815]
  - kvm-block-add-flags-argument-to-bdrv_co_write_zeroes-tra.patch.patch.patch [bz#1007815]
  - kvm-block-add-bdrv_aio_write_zeroes.patch.patch.patch [bz#1007815]
  - kvm-block-handle-ENOTSUP-from-discard-in-generic-code.patch.patch.patch [bz#1007815]
  - kvm-block-make-bdrv_co_do_write_zeroes-stricter-in-produ.patch.patch.patch [bz#1007815]
  - kvm-vpc-vhdx-add-get_info.patch.patch.patch [bz#1007815]
  - kvm-block-drivers-add-discard-write_zeroes-properties-to.patch.patch.patch [bz#1007815]
  - kvm-block-drivers-expose-requirement-for-write-same-alig.patch.patch.patch [bz#1007815]
  - kvm-block-iscsi-remove-.bdrv_has_zero_init.patch.patch.patch [bz#1007815]
  - kvm-block-iscsi-updated-copyright.patch.patch.patch [bz#1007815]
  - kvm-block-iscsi-check-WRITE-SAME-support-differently-dep.patch.patch.patch [bz#1007815]
  - kvm-scsi-disk-catch-write-protection-errors-in-UNMAP.patch.patch.patch [bz#1007815]
  - kvm-scsi-disk-reject-ANCHOR-1-for-UNMAP-and-WRITE-SAME-c.patch.patch.patch [bz#1007815]
  - kvm-scsi-disk-correctly-implement-WRITE-SAME.patch.patch.patch [bz#1007815]
  - kvm-scsi-disk-fix-WRITE-SAME-with-large-non-zero-payload.patch.patch.patch [bz#1007815]
  - kvm-raw-posix-implement-write_zeroes-with-MAY_UNMAP-for-.patch.patch.patch.patch [bz#1007815]
  - kvm-raw-posix-implement-write_zeroes-with-MAY_UNMAP-for-.patch.patch.patch.patch.patch [bz#1007815]
  - kvm-raw-posix-add-support-for-write_zeroes-on-XFS-and-bl.patch.patch [bz#1007815]
  - kvm-qemu-iotests-033-is-fast.patch.patch [bz#1007815]
  - kvm-qemu-img-add-support-for-skipping-zeroes-in-input-du.patch.patch [bz#1007815]
  - kvm-qemu-img-fix-usage-instruction-for-qemu-img-convert.patch.patch [bz#1007815]
  - kvm-block-iscsi-set-bdi-cluster_size.patch.patch [bz#1007815]
  - kvm-block-add-opt_transfer_length-to-BlockLimits.patch.patch [bz#1039557]
  - kvm-block-iscsi-set-bs-bl.opt_transfer_length.patch.patch [bz#1039557]
  - kvm-qemu-img-dynamically-adjust-iobuffer-size-during-con.patch.patch [bz#1039557]
  - kvm-qemu-img-round-down-request-length-to-an-aligned-sec.patch.patch [bz#1039557]
  - kvm-qemu-img-decrease-progress-update-interval-on-conver.patch.patch [bz#1039557]
  - Resolves: bz#1007815
    (fix WRITE SAME support)
  - Resolves: bz#1039557
    (optimize qemu-img for thin provisioned images)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-33.el7
changelog:
  - kvm-block-qemu-iotests-for-vhdx-read-sample-dynamic-imag.patch [bz#879234]
  - kvm-block-qemu-iotests-add-quotes-to-TEST_IMG-usage-io-p.patch [bz#879234]
  - kvm-block-qemu-iotests-fix-_make_test_img-to-work-with-s.patch [bz#879234]
  - kvm-block-qemu-iotests-add-quotes-to-TEST_IMG.base-usage.patch [bz#879234]
  - kvm-block-qemu-iotests-add-quotes-to-TEST_IMG-usage-in-0.patch [bz#879234]
  - kvm-block-qemu-iotests-removes-duplicate-double-quotes-i.patch [bz#879234]
  - kvm-block-vhdx-minor-comments-and-typo-correction.patch [bz#879234]
  - kvm-block-vhdx-add-header-update-capability.patch [bz#879234]
  - kvm-block-vhdx-code-movement-VHDXMetadataEntries-and-BDR.patch [bz#879234]
  - kvm-block-vhdx-log-support-struct-and-defines.patch [bz#879234]
  - kvm-block-vhdx-break-endian-translation-functions-out.patch [bz#879234]
  - kvm-block-vhdx-update-log-guid-in-header-and-first-write.patch [bz#879234]
  - kvm-block-vhdx-code-movement-move-vhdx_close-above-vhdx_.patch [bz#879234]
  - kvm-block-vhdx-log-parsing-replay-and-flush-support.patch [bz#879234]
  - kvm-block-vhdx-add-region-overlap-detection-for-image-fi.patch [bz#879234]
  - kvm-block-vhdx-add-log-write-support.patch [bz#879234]
  - kvm-block-vhdx-write-support.patch [bz#879234]
  - kvm-block-vhdx-remove-BAT-file-offset-bit-shifting.patch [bz#879234]
  - kvm-block-vhdx-move-more-endian-translations-to-vhdx-end.patch [bz#879234]
  - kvm-block-vhdx-break-out-code-operations-to-functions.patch [bz#879234]
  - kvm-block-vhdx-fix-comment-typos-in-header-fix-incorrect.patch [bz#879234]
  - kvm-block-vhdx-add-.bdrv_create-support.patch [bz#879234]
  - kvm-block-vhdx-update-_make_test_img-to-filter-out-vhdx-.patch [bz#879234]
  - kvm-block-qemu-iotests-for-vhdx-add-write-test-support.patch [bz#879234]
  - kvm-block-vhdx-qemu-iotest-log-replay-of-data-sector.patch [bz#879234]
  - Resolves: bz#879234
    ([RFE] qemu-img: Add/improve support for VHDX format)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-34.el7
changelog:
  - kvm-block-stream-Don-t-stream-unbacked-devices.patch [bz#965636]
  - kvm-qemu-io-Let-open-pass-options-to-block-driver.patch [bz#1004347]
  - kvm-qcow2.py-Subcommand-for-changing-header-fields.patch [bz#1004347]
  - kvm-qemu-iotests-Remaining-error-propagation-adjustments.patch [bz#1004347]
  - kvm-qemu-iotests-Add-test-for-inactive-L2-overlap.patch [bz#1004347]
  - kvm-qemu-iotests-Adjust-test-result-039.patch [bz#1004347]
  - kvm-virtio-net-don-t-update-mac_table-in-error-state.patch [bz#1048671]
  - kvm-qcow2-Zero-initialise-first-cluster-for-new-images.patch [bz#1032904]
  - Resolves: bz#1004347
    (Backport qcow2 corruption prevention patches)
  - Resolves: bz#1032904
    (qemu-img can not create libiscsi qcow2_v3 image)
  - Resolves: bz#1048671
    (virtio-net: mac_table change isn't recovered in error state)
  - Resolves: bz#965636
    (streaming with no backing file should not do anything)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-35.el7
changelog:
  - kvm-option-Add-assigned-flag-to-QEMUOptionParameter.patch [bz#1033490]
  - kvm-qcow2-refcount-Snapshot-update-for-zero-clusters.patch [bz#1033490]
  - kvm-qemu-iotests-Snapshotting-zero-clusters.patch [bz#1033490]
  - kvm-block-Image-file-option-amendment.patch [bz#1033490]
  - kvm-qcow2-cache-Empty-cache.patch [bz#1033490]
  - kvm-qcow2-cluster-Expand-zero-clusters.patch [bz#1033490]
  - kvm-qcow2-Save-refcount-order-in-BDRVQcowState.patch [bz#1033490]
  - kvm-qcow2-Implement-bdrv_amend_options.patch [bz#1033490]
  - kvm-qcow2-Correct-bitmap-size-in-zero-expansion.patch [bz#1033490]
  - kvm-qcow2-Free-only-newly-allocated-clusters-on-error.patch [bz#1033490]
  - kvm-qcow2-Add-missing-space-in-error-message.patch [bz#1033490]
  - kvm-qemu-iotest-qcow2-image-option-amendment.patch [bz#1033490]
  - kvm-qemu-iotests-New-test-case-in-061.patch [bz#1033490]
  - kvm-qemu-iotests-Preallocated-zero-clusters-in-061.patch [bz#1033490]
  - Resolves: bz#1033490
    (Cannot upgrade/downgrade qcow2 images)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-36.el7
changelog:
  - kvm-Add-support-statement-to-help-output.patch [bz#972773]
  - kvm-__com.redhat_qxl_screendump-add-docs.patch [bz#903910]
  - kvm-vl-Round-memory-sizes-below-2MiB-up-to-2MiB.patch [bz#999836]
  - kvm-seccomp-exit-if-seccomp_init-fails.patch [bz#1044845]
  - kvm-redhat-qemu-kvm.spec-require-python-for-build.patch [bz#1034876]
  - kvm-redhat-qemu-kvm.spec-require-iasl.patch [bz#1034876]
  - kvm-configure-make-iasl-option-actually-work.patch [bz#1034876]
  - kvm-redhat-qemu-kvm.spec-add-cpp-as-build-dependency.patch [bz#1034876]
  - kvm-acpi-build-disable-with-no-acpi.patch [bz#1045386]
  - kvm-ehci-implement-port-wakeup.patch [bz#1039513]
  - kvm-qdev-monitor-Fix-crash-when-device_add-is-called-wit.patch [bz#1026712 bz#1046007]
  - kvm-block-vhdx-improve-error-message-and-.bdrv_check-imp.patch [bz#1035001]
  - kvm-docs-updated-qemu-img-man-page-and-qemu-doc-to-refle.patch [bz#1017650]
  - kvm-enable-pvticketlocks-by-default.patch [bz#1052340]
  - kvm-fix-boot-strict-regressed-in-commit-6ef4716.patch [bz#997817]
  - kvm-vl-make-boot_strict-variable-static-not-used-outside.patch [bz#997817]
  - Resolves: bz#1017650
    (need to update qemu-img man pages on "VHDX" format)
  - Resolves: bz#1026712
    (Qemu core dumpd when boot guest with driver name as "virtio-pci")
  - Resolves: bz#1034876
    (export acpi tables to guests)
  - Resolves: bz#1035001
    (VHDX: journal log should not be replayed by default, but rather via qemu-img check -r all)
  - Resolves: bz#1039513
    (backport remote wakeup for ehci)
  - Resolves: bz#1044845
    (QEMU seccomp sandbox - exit if seccomp_init() fails)
  - Resolves: bz#1045386
    (qemu-kvm: hw/i386/acpi-build.c:135: acpi_get_pm_info: Assertion `obj' failed.)
  - Resolves: bz#1046007
    (qemu-kvm aborted when hot plug PCI device to guest with romfile and rombar=0)
  - Resolves: bz#1052340
    (pvticketlocks: default on)
  - Resolves: bz#903910
    (RHEL7 does not have equivalent functionality for __com.redhat_qxl_screendump)
  - Resolves: bz#972773
    (RHEL7: Clarify support statement in KVM help)
  - Resolves: bz#997817
    (-boot order and -boot once regressed since RHEL-6)
  - Resolves: bz#999836
    (-m 1 crashes)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-37.el7
changelog:
  - kvm-bitmap-use-long-as-index.patch [bz#997559]
  - kvm-memory-cpu_physical_memory_set_dirty_flags-result-is.patch [bz#997559]
  - kvm-memory-cpu_physical_memory_set_dirty_range-return-vo.patch [bz#997559]
  - kvm-exec-use-accessor-function-to-know-if-memory-is-dirt.patch [bz#997559]
  - kvm-memory-create-function-to-set-a-single-dirty-bit.patch [bz#997559]
  - kvm-exec-drop-useless-if.patch [bz#997559]
  - kvm-exec-create-function-to-get-a-single-dirty-bit.patch [bz#997559]
  - kvm-memory-make-cpu_physical_memory_is_dirty-return-bool.patch [bz#997559]
  - kvm-memory-all-users-of-cpu_physical_memory_get_dirty-us.patch [bz#997559]
  - kvm-memory-set-single-dirty-flags-when-possible.patch [bz#997559]
  - kvm-memory-cpu_physical_memory_set_dirty_range-always-di.patch [bz#997559]
  - kvm-memory-cpu_physical_memory_mask_dirty_range-always-c.patch [bz#997559]
  - kvm-memory-use-bit-2-for-migration.patch [bz#997559]
  - kvm-memory-make-sure-that-client-is-always-inside-range.patch [bz#997559]
  - kvm-memory-only-resize-dirty-bitmap-when-memory-size-inc.patch [bz#997559]
  - kvm-memory-cpu_physical_memory_clear_dirty_flag-result-i.patch [bz#997559]
  - kvm-bitmap-Add-bitmap_zero_extend-operation.patch [bz#997559]
  - kvm-memory-split-dirty-bitmap-into-three.patch [bz#997559]
  - kvm-memory-unfold-cpu_physical_memory_clear_dirty_flag-i.patch [bz#997559]
  - kvm-memory-unfold-cpu_physical_memory_set_dirty-in-its-o.patch [bz#997559]
  - kvm-memory-unfold-cpu_physical_memory_set_dirty_flag.patch [bz#997559]
  - kvm-memory-make-cpu_physical_memory_get_dirty-the-main-f.patch [bz#997559]
  - kvm-memory-cpu_physical_memory_get_dirty-is-used-as-retu.patch [bz#997559]
  - kvm-memory-s-mask-clear-cpu_physical_memory_mask_dirty_r.patch [bz#997559]
  - kvm-memory-use-find_next_bit-to-find-dirty-bits.patch [bz#997559]
  - kvm-memory-cpu_physical_memory_set_dirty_range-now-uses-.patch [bz#997559]
  - kvm-memory-cpu_physical_memory_clear_dirty_range-now-use.patch [bz#997559]
  - kvm-memory-s-dirty-clean-in-cpu_physical_memory_is_dirty.patch [bz#997559]
  - kvm-memory-make-cpu_physical_memory_reset_dirty-take-a-l.patch [bz#997559]
  - kvm-exec-Remove-unused-global-variable-phys_ram_fd.patch [bz#997559]
  - kvm-memory-cpu_physical_memory_set_dirty_tracking-should.patch [bz#997559]
  - kvm-memory-move-private-types-to-exec.c.patch [bz#997559]
  - kvm-memory-split-cpu_physical_memory_-functions-to-its-o.patch [bz#997559]
  - kvm-memory-unfold-memory_region_test_and_clear.patch [bz#997559]
  - kvm-use-directly-cpu_physical_memory_-api-for-tracki.patch [bz#997559]
  - kvm-refactor-start-address-calculation.patch [bz#997559]
  - kvm-memory-move-bitmap-synchronization-to-its-own-functi.patch [bz#997559]
  - kvm-memory-syncronize-kvm-bitmap-using-bitmaps-operation.patch [bz#997559]
  - kvm-ram-split-function-that-synchronizes-a-range.patch [bz#997559]
  - kvm-migration-synchronize-memory-bitmap-64bits-at-a-time.patch [bz#997559]
  - Resolves: bz#997559
    (Improve live migration bitmap handling)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-38.el7
changelog:
  - kvm-intel-hda-fix-position-buffer.patch [bz#947785]
  - kvm-The-calculation-of-bytes_xfer-in-qemu_put_buffer-is-.patch [bz#1003467]
  - kvm-migration-Fix-rate-limit.patch [bz#1003467]
  - kvm-audio-honor-QEMU_AUDIO_TIMER_PERIOD-instead-of-wakin.patch [bz#1017636]
  - kvm-audio-Lower-default-wakeup-rate-to-100-times-second.patch [bz#1017636]
  - kvm-audio-adjust-pulse-to-100Hz-wakeup-rate.patch [bz#1017636]
  - kvm-pc-Fix-rhel6.-3dnow-3dnowext-compat-bits.patch [bz#918907]
  - kvm-add-firmware-to-machine-options.patch [bz#1038603]
  - kvm-switch-rhel7-machine-types-to-big-bios.patch [bz#1038603]
  - kvm-add-bios-256k.bin-from-seabios-bin-1.7.2.2-10.el7.no.patch [bz#1038603]
  - kvm-pci-fix-pci-bridge-fw-path.patch [bz#1034518]
  - kvm-hw-cannot_instantiate_with_device_add_yet-due-to-poi.patch [bz#1031098]
  - kvm-qdev-Document-that-pointer-properties-kill-device_ad.patch [bz#1031098]
  - kvm-Add-back-no-hpet-but-ignore-it.patch [bz#1044742]
  - Resolves: bz#1003467
    (Backport migration fixes from post qemu 1.6)
  - Resolves: bz#1017636
    (PATCH: fix qemu using 50% host cpu when audio is playing)
  - Resolves: bz#1031098
    (Disable device smbus-eeprom)
  - Resolves: bz#1034518
    (boot order wrong with q35)
  - Resolves: bz#1038603
    (make seabios 256k for rhel7 machine types)
  - Resolves: bz#1044742
    (Cannot create guest on remote RHEL7 host using F20 virt-manager, libvirt's qemu -no-hpet detection is broken)
  - Resolves: bz#918907
    (provide backwards-compatible RHEL specific machine types in QEMU - CPU features)
  - Resolves: bz#947785
    (In rhel6.4 guest  sound recorder doesn't work when  playing audio)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-39.el7
changelog:
  - kvm-Revert-qdev-monitor-Fix-crash-when-device_add-is-cal.patch [bz#669524]
  - kvm-Revert-qdev-Do-not-let-the-user-try-to-device_add-wh.patch [bz#669524]
  - kvm-qdev-monitor-Clean-up-qdev_device_add-variable-namin.patch [bz#669524]
  - kvm-qdev-monitor-Fix-crash-when-device_add-is-called.2.patch.patch [bz#669524]
  - kvm-qdev-monitor-Avoid-qdev-as-variable-name.patch [bz#669524]
  - kvm-qdev-monitor-Inline-qdev_init-for-device_add.patch [bz#669524]
  - kvm-qdev-Do-not-let-the-user-try-to-device_add-when-it.2.patch.patch [bz#669524]
  - kvm-qdev-monitor-Avoid-device_add-crashing-on-non-device.patch [bz#669524]
  - kvm-qdev-monitor-Improve-error-message-for-device-nonexi.patch [bz#669524]
  - kvm-exec-change-well-known-physical-sections-to-macros.patch [bz#1003535]
  - kvm-exec-separate-sections-and-nodes-per-address-space.patch [bz#1003535]
  - Resolves: bz#1003535
    (qemu-kvm core dump when boot vm with more than 32 virtio disks/nics)
  - Resolves: bz#669524
    (Confusing error message from -device <unknown dev>)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-40.el7
changelog:
  - kvm-avoid-a-bogus-COMPLETED-CANCELLED-transition.patch [bz#1053699]
  - kvm-introduce-MIG_STATE_CANCELLING-state.patch [bz#1053699]
  - kvm-vvfat-use-bdrv_new-to-allocate-BlockDriverState.patch [bz#1041301]
  - kvm-block-implement-reference-count-for-BlockDriverState.patch [bz#1041301]
  - kvm-block-make-bdrv_delete-static.patch [bz#1041301]
  - kvm-migration-omit-drive-ref-as-we-have-bdrv_ref-now.patch [bz#1041301]
  - kvm-xen_disk-simplify-blk_disconnect-with-refcnt.patch [bz#1041301]
  - kvm-nbd-use-BlockDriverState-refcnt.patch [bz#1041301]
  - kvm-block-use-BDS-ref-for-block-jobs.patch [bz#1041301]
  - kvm-block-Make-BlockJobTypes-const.patch [bz#1041301]
  - kvm-blockjob-rename-BlockJobType-to-BlockJobDriver.patch [bz#1041301]
  - kvm-qapi-Introduce-enum-BlockJobType.patch [bz#1041301]
  - kvm-qapi-make-use-of-new-BlockJobType.patch [bz#1041301]
  - kvm-mirror-Don-t-close-target.patch [bz#1041301]
  - kvm-mirror-Move-base-to-MirrorBlockJob.patch [bz#1041301]
  - kvm-block-Add-commit_active_start.patch [bz#1041301]
  - kvm-commit-Support-commit-active-layer.patch [bz#1041301]
  - kvm-qemu-iotests-prefill-some-data-to-test-image.patch [bz#1041301]
  - kvm-qemu-iotests-Update-test-cases-for-commit-active.patch [bz#1041301]
  - kvm-commit-Remove-unused-check.patch [bz#1041301]
  - kvm-blockdev-use-bdrv_getlength-in-qmp_drive_mirror.patch [bz#921890]
  - kvm-qemu-iotests-make-assert_no_active_block_jobs-common.patch [bz#921890]
  - kvm-block-drive-mirror-Check-for-NULL-backing_hd.patch [bz#921890]
  - kvm-qemu-iotests-Extend-041-for-unbacked-mirroring.patch [bz#921890]
  - kvm-qapi-schema-Update-description-for-NewImageMode.patch [bz#921890]
  - kvm-block-drive-mirror-Reuse-backing-HD-for-sync-none.patch [bz#921890]
  - kvm-qemu-iotests-Fix-test-041.patch [bz#921890]
  - kvm-scsi-bus-fix-transfer-length-and-direction-for-VERIF.patch [bz#1035644]
  - kvm-scsi-disk-fix-VERIFY-emulation.patch [bz#1035644]
  - kvm-block-ensure-bdrv_drain_all-works-during-bdrv_delete.patch [bz#1041301]
  - kvm-use-recommended-max-vcpu-count.patch [bz#998708]
  - kvm-pc-Create-pc_compat_rhel-functions.patch [bz#1049706]
  - kvm-pc-Enable-x2apic-by-default-on-more-recent-CPU-model.patch [bz#1049706]
  - kvm-Build-all-subpackages-for-RHEV.patch [bz#1007204]
  - Resolves: bz#1007204
    (qemu-img-rhev  qemu-kvm-rhev-tools are not built for qemu-kvm-1.5.3-3.el7)
  - Resolves: bz#1035644
    (rhel7.0host + windows guest + virtio-win + 'chkdsk' in the guest gives qemu assertion in scsi_dma_complete)
  - Resolves: bz#1041301
    (live snapshot merge (commit) of the active layer)
  - Resolves: bz#1049706
    (MIss CPUID_EXT_X2APIC in Westmere cpu model)
  - Resolves: bz#1053699
    (Backport Cancelled race condition fixes)
  - Resolves: bz#921890
    (Core dump when block mirror with "sync" is "none" and mode is "absolute-paths")
  - Resolves: bz#998708
    (qemu-kvm: maximum vcpu should be recommended maximum)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-41.el7
changelog:
  - kvm-help-add-id-suboption-to-iscsi.patch [bz#1019221]
  - kvm-scsi-disk-add-UNMAP-limits-to-block-limits-VPD-page.patch [bz#1037503]
  - kvm-qdev-Fix-32-bit-compilation-in-print_size.patch [bz#1034876]
  - kvm-qdev-Use-clz-in-print_size.patch [bz#1034876]
  - Resolves: bz#1019221
    (Iscsi miss id sub-option in help output)
  - Resolves: bz#1034876
    (export acpi tables to guests)
  - Resolves: bz#1037503
    (fix thin provisioning support for block device backends)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-43.el7
changelog:
  - kvm-piix-gigabyte-alignment-for-ram.patch [bz#1026548]
  - kvm-pc_piix-document-gigabyte_align.patch [bz#1026548]
  - kvm-q35-gigabyle-alignment-for-ram.patch [bz#1026548]
  - kvm-virtio-bus-remove-vdev-field.patch [bz#983344]
  - kvm-virtio-pci-remove-vdev-field.patch [bz#983344]
  - kvm-virtio-bus-cleanup-plug-unplug-interface.patch [bz#983344]
  - kvm-virtio-blk-switch-exit-callback-to-VirtioDeviceClass.patch [bz#983344]
  - kvm-virtio-serial-switch-exit-callback-to-VirtioDeviceCl.patch [bz#983344]
  - kvm-virtio-net-switch-exit-callback-to-VirtioDeviceClass.patch [bz#983344]
  - kvm-virtio-scsi-switch-exit-callback-to-VirtioDeviceClas.patch [bz#983344]
  - kvm-virtio-balloon-switch-exit-callback-to-VirtioDeviceC.patch [bz#983344]
  - kvm-virtio-rng-switch-exit-callback-to-VirtioDeviceClass.patch [bz#983344]
  - kvm-virtio-pci-add-device_unplugged-callback.patch [bz#983344]
  - kvm-block-use-correct-filename-for-error-report.patch [bz#1051438]
  - Resolves: bz#1026548
    (i386: pc: align gpa<->hpa on 1GB boundary)
  - Resolves: bz#1051438
    (Error message contains garbled characters when unable to open image due to bad permissions (permission denied).)
  - Resolves: bz#983344
    (QEMU core dump and host will reboot when do hot-unplug a virtio-blk disk which use  the switch behind switch)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-44.el7
changelog:
  - kvm-Partially-revert-rhel-Drop-cfi.pflash01-and-isa-ide-.patch [bz#1032346]
  - kvm-Revert-pc-Disable-the-use-flash-device-for-BIOS-unle.patch [bz#1032346]
  - kvm-memory-Replace-open-coded-memory_region_is_romd.patch [bz#1032346]
  - kvm-memory-Rename-readable-flag-to-romd_mode.patch [bz#1032346]
  - kvm-isapc-Fix-non-KVM-qemu-boot-read-write-memory-for-is.patch [bz#1032346]
  - kvm-add-kvm_readonly_mem_enabled.patch [bz#1032346]
  - kvm-support-using-KVM_MEM_READONLY-flag-for-regions.patch [bz#1032346]
  - kvm-pc_sysfw-allow-flash-pflash-memory-to-be-used-with-K.patch [bz#1032346]
  - kvm-fix-double-free-the-memslot-in-kvm_set_phys_mem.patch [bz#1032346]
  - kvm-sysfw-remove-read-only-pc_sysfw_flash_vs_rom_bug_com.patch [bz#1032346]
  - kvm-pc_sysfw-remove-the-rom_only-property.patch [bz#1032346]
  - kvm-pc_sysfw-do-not-make-it-a-device-anymore.patch [bz#1032346]
  - kvm-hw-i386-pc_sysfw-support-two-flash-drives.patch [bz#1032346]
  - kvm-i440fx-test-qtest_start-should-be-paired-with-qtest_.patch [bz#1032346]
  - kvm-i440fx-test-give-each-GTest-case-its-own-qtest.patch [bz#1032346]
  - kvm-i440fx-test-generate-temporary-firmware-blob.patch [bz#1032346]
  - kvm-i440fx-test-verify-firmware-under-4G-and-1M-both-bio.patch [bz#1032346]
  - kvm-piix-fix-32bit-pci-hole.patch [bz#1032346]
  - kvm-qapi-Add-backing-to-BlockStats.patch [bz#1041564]
  - kvm-pc-Disable-RDTSCP-unconditionally-on-rhel6.-machine-.patch [bz#918907]
  - kvm-pc-Disable-RDTSCP-on-AMD-CPU-models.patch [bz#1056428 bz#874400]
  - kvm-block-add-.bdrv_reopen_prepare-stub-for-iscsi.patch [bz#1030301]
  - Resolves: bz#1030301
    (qemu-img can not merge live snapshot to backing file(r/w backing file via libiscsi))
  - Resolves: bz#1032346
    (basic OVMF support (non-volatile UEFI variables in flash, and fixup for ACPI tables))
  - Resolves: bz#1041564
    ([NFR] qemu: Returning the watermark for all the images opened for writing)
  - Resolves: bz#1056428
    ("rdtscp" flag defined on Opteron_G5 model and cann't be exposed to guest)
  - Resolves: bz#874400
    ("rdtscp" flag defined on Opteron_G5 model and cann't be exposed to guest)
  - Resolves: bz#918907
    (provide backwards-compatible RHEL specific machine types in QEMU - CPU features)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-45.el7
changelog:
  - kvm-vfio-pci-Fail-initfn-on-DMA-mapping-errors.patch [bz#1044815]
  - kvm-vfio-Destroy-memory-regions.patch [bz#1052030]
  - kvm-docs-qcow2-compat-1.1-is-now-the-default.patch [bz#1048092]
  - kvm-hda-codec-disable-streams-on-reset.patch [bz#947812]
  - kvm-QEMUBH-make-AioContext-s-bh-re-entrant.patch [bz#1009297]
  - kvm-qxl-replace-pipe-signaling-with-bottom-half.patch [bz#1009297]
  - Resolves: bz#1009297
    (RHEL7.0 guest gui can not be used in dest host after migration)
  - Resolves: bz#1044815
    (vfio initfn succeeds even if IOMMU mappings fail)
  - Resolves: bz#1048092
    (manpage of qemu-img contains error statement about compat option)
  - Resolves: bz#1052030
    (src qemu-kvm core dump after hotplug/unhotplug GPU device and do local migration)
  - Resolves: bz#947812
    (There's a shot voice after  'system_reset'  during playing music inside rhel6 guest w/ intel-hda device)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-46.el7
changelog:
  - kvm-block-fix-backing-file-segfault.patch [bz#748906]
  - kvm-block-Move-initialisation-of-BlockLimits-to-bdrv_ref.patch [bz#748906]
  - kvm-raw-Fix-BlockLimits-passthrough.patch [bz#748906]
  - kvm-block-Inherit-opt_transfer_length.patch [bz#748906]
  - kvm-block-Update-BlockLimits-when-they-might-have-change.patch [bz#748906]
  - kvm-qemu_memalign-Allow-small-alignments.patch [bz#748906]
  - kvm-block-Detect-unaligned-length-in-bdrv_qiov_is_aligne.patch [bz#748906]
  - kvm-block-Don-t-use-guest-sector-size-for-qemu_blockalig.patch [bz#748906]
  - kvm-block-rename-buffer_alignment-to-guest_block_size.patch [bz#748906]
  - kvm-raw-Probe-required-direct-I-O-alignment.patch [bz#748906]
  - kvm-block-Introduce-bdrv_aligned_preadv.patch [bz#748906]
  - kvm-block-Introduce-bdrv_co_do_preadv.patch [bz#748906]
  - kvm-block-Introduce-bdrv_aligned_pwritev.patch [bz#748906]
  - kvm-block-write-Handle-COR-dependency-after-I-O-throttli.patch [bz#748906]
  - kvm-block-Introduce-bdrv_co_do_pwritev.patch [bz#748906]
  - kvm-block-Switch-BdrvTrackedRequest-to-byte-granularity.patch [bz#748906]
  - kvm-block-Allow-waiting-for-overlapping-requests-between.patch [bz#748906]
  - kvm-block-use-DIV_ROUND_UP-in-bdrv_co_do_readv.patch [bz#748906]
  - kvm-block-Make-zero-after-EOF-work-with-larger-alignment.patch [bz#748906]
  - kvm-block-Generalise-and-optimise-COR-serialisation.patch [bz#748906]
  - kvm-block-Make-overlap-range-for-serialisation-dynamic.patch [bz#748906]
  - kvm-block-Fix-32-bit-truncation-in-mark_request_serialis.patch [bz#748906]
  - kvm-block-Allow-wait_serialising_requests-at-any-point.patch [bz#748906]
  - kvm-block-Align-requests-in-bdrv_co_do_pwritev.patch [bz#748906]
  - kvm-lock-Fix-memory-leaks-in-bdrv_co_do_pwritev.patch [bz#748906]
  - kvm-block-Assert-serialisation-assumptions-in-pwritev.patch [bz#748906]
  - kvm-block-Change-coroutine-wrapper-to-byte-granularity.patch [bz#748906]
  - kvm-block-Make-bdrv_pread-a-bdrv_prwv_co-wrapper.patch [bz#748906]
  - kvm-block-Make-bdrv_pwrite-a-bdrv_prwv_co-wrapper.patch [bz#748906]
  - kvm-iscsi-Set-bs-request_alignment.patch [bz#748906]
  - kvm-blkdebug-Make-required-alignment-configurable.patch [bz#748906]
  - kvm-blkdebug-Don-t-leak-bs-file-on-failure.patch [bz#748906]
  - kvm-qemu-io-New-command-sleep.patch [bz#748906]
  - kvm-qemu-iotests-Filter-out-qemu-io-prompt.patch [bz#748906]
  - kvm-qemu-iotests-Test-pwritev-RMW-logic.patch [bz#748906]
  - kvm-block-bdrv_aligned_pwritev-Assert-overlap-range.patch [bz#748906]
  - kvm-block-Don-t-call-ROUND_UP-with-negative-values.patch [bz#748906]
  - Resolves: bz#748906
    (qemu fails on disk with 4k sectors and cache=off)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-47.el7
changelog:
  - kvm-seccomp-add-mkdir-and-fchmod-to-the-whitelist.patch [bz#1026314]
  - kvm-seccomp-add-some-basic-shared-memory-syscalls-to-the.patch [bz#1026314]
  - kvm-scsi-Support-TEST-UNIT-READY-in-the-dummy-LUN0.patch [bz#1004143]
  - kvm-usb-add-vendor-request-defines.patch [bz#1039530]
  - kvm-usb-move-usb_-hi-lo-helpers-to-header-file.patch [bz#1039530]
  - kvm-usb-add-support-for-microsoft-os-descriptors.patch [bz#1039530]
  - kvm-usb-add-microsoft-os-descriptors-compat-property.patch [bz#1039530]
  - kvm-usb-hid-add-microsoft-os-descriptor-support.patch [bz#1039530]
  - kvm-configure-add-option-to-disable-fstack-protect.patch [bz#1044182]
  - kvm-exec-always-use-MADV_DONTFORK.patch [bz#1004197]
  - kvm-pc-Save-size-of-RAM-below-4GB.patch [bz#1048080]
  - kvm-acpi-Fix-PCI-hole-handling-on-build_srat.patch [bz#1048080]
  - kvm-Add-check-for-cache-size-smaller-than-page-size.patch [bz#1017096]
  - kvm-XBZRLE-cache-size-should-not-be-larger-than-guest-me.patch [bz#1047448]
  - kvm-Don-t-abort-on-out-of-memory-when-creating-page-cach.patch [bz#1047448]
  - kvm-Don-t-abort-on-memory-allocation-error.patch [bz#1047448]
  - kvm-Set-xbzrle-buffers-to-NULL-after-freeing-them-to-avo.patch [bz#1038540]
  - kvm-migration-fix-free-XBZRLE-decoded_buf-wrong.patch [bz#1038540]
  - kvm-block-resize-backing-file-image-during-offline-commi.patch [bz#1047254]
  - kvm-block-resize-backing-image-during-active-layer-commi.patch [bz#1047254]
  - kvm-block-update-block-commit-documentation-regarding-im.patch [bz#1047254]
  - kvm-block-Fix-bdrv_commit-return-value.patch [bz#1047254]
  - kvm-block-remove-QED-.bdrv_make_empty-implementation.patch [bz#1047254]
  - kvm-block-remove-qcow2-.bdrv_make_empty-implementation.patch [bz#1047254]
  - kvm-qemu-progress-Drop-unused-include.patch [bz#997878]
  - kvm-qemu-progress-Fix-progress-printing-on-SIGUSR1.patch [bz#997878]
  - kvm-Documentation-qemu-img-Mention-SIGUSR1-progress-repo.patch [bz#997878]
  - Resolves: bz#1004143
    ("test unit ready failed" on LUN 0 delays boot when a virtio-scsi target does not have any disk on LUN 0)
  - Resolves: bz#1004197
    (Cannot hot-plug nic in windows VM when the vmem is larger)
  - Resolves: bz#1017096
    (Fail to migrate while the size of migrate-compcache less then 4096)
  - Resolves: bz#1026314
    (qemu-kvm hang when use '-sandbox on'+'vnc'+'hda')
  - Resolves: bz#1038540
    (qemu-kvm aborted while cancel migration then restart it (with page delta compression))
  - Resolves: bz#1039530
    (add support for microsoft os descriptors)
  - Resolves: bz#1044182
    (Relax qemu-kvm stack protection to -fstack-protector-strong)
  - Resolves: bz#1047254
    (qemu-img failed to commit image)
  - Resolves: bz#1047448
    (qemu-kvm core  dump in src host when do migration with "migrate_set_capability xbzrle on and migrate_set_cache_size 10000G")
  - Resolves: bz#1048080
    (Qemu-kvm NUMA emulation failed)
  - Resolves: bz#997878
    (Kill -SIGUSR1 `pidof qemu-img convert` can not get progress of qemu-img)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-48.el7
changelog:
  - kvm-spec-disable-qom-cast-debug.patch [bz#1063942]
  - kvm-fix-guest-physical-bits-to-match-host-to-go-beyond-1.patch [bz#989677]
  - kvm-monitor-Cleanup-mon-outbuf-on-write-error.patch [bz#1065225]
  - Resolves: bz#1063942
    (configure qemu-kvm with --disable-qom-cast-debug)
  - Resolves: bz#1065225
    (QMP socket breaks on unexpected close)
  - Resolves: bz#989677
    ([HP 7.0 FEAT]: Increase KVM guest supported memory to 4TiB)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-49.el7
changelog:
  - kvm-xhci-add-support-for-suspend-resume.patch [bz#1012365]
  - kvm-qcow2-remove-n_start-and-n_end-of-qcow2_alloc_cluste.patch [bz#1049176]
  - kvm-qcow2-fix-offset-overflow-in-qcow2_alloc_clusters_at.patch [bz#1049176]
  - kvm-qcow2-check-for-NULL-l2meta.patch [bz#1055848]
  - kvm-qemu-iotests-add-test-for-qcow2-preallocation-with-d.patch [bz#1055848]
  - Resolves: bz#1012365
    (xhci usb storage lost in guest after wakeup from S3)
  - Resolves: bz#1049176
    (qemu-img core dump when using "-o preallocation=metadata,cluster_size=2048k" to create image of libiscsi lun)
  - Resolves: bz#1055848
    (qemu-img core dumped when cluster size is larger than the default value with opreallocation=metadata specified)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-50.el7
changelog:
  - kvm-mempath-prefault-fix-off-by-one-error.patch [bz#1069039]
  - kvm-qemu-option-has_help_option-and-is_valid_option_list.patch [bz#1065873]
  - kvm-qemu-img-create-Support-multiple-o-options.patch [bz#1065873]
  - kvm-qemu-img-convert-Support-multiple-o-options.patch [bz#1065873]
  - kvm-qemu-img-amend-Support-multiple-o-options.patch [bz#1065873]
  - kvm-qemu-img-Allow-o-help-with-incomplete-argument-list.patch [bz#1065873]
  - kvm-qemu-iotests-Check-qemu-img-command-line-parsing.patch [bz#1065873]
  - Resolves: bz#1065873
    (qemu-img silently ignores options with multiple -o parameters)
  - Resolves: bz#1069039
    (-mem-prealloc option behaviour is opposite to expected)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-51.el7
changelog:
  - kvm-qmp-access-the-local-QemuOptsLists-for-drive-option.patch [bz#1026184]
  - kvm-qxl-add-sanity-check.patch [bz#751937]
  - kvm-Fix-two-XBZRLE-corruption-issues.patch [bz#1063417]
  - kvm-qdev-monitor-set-DeviceState-opts-before-calling-rea.patch [bz#1037956]
  - kvm-vfio-blacklist-loading-of-unstable-roms.patch [bz#1037956]
  - kvm-block-Set-block-filename-sizes-to-PATH_MAX-instead-o.patch [bz#1072339]
  - Resolves: bz#1026184
    (QMP: querying -drive option returns a NULL parameter list)
  - Resolves: bz#1037956
    (bnx2x: boot one guest to do vfio-pci with all PFs assigned in same group meet QEMU segmentation fault (Broadcom BCM57810 card))
  - Resolves: bz#1063417
    (google stressapptest vs Migration)
  - Resolves: bz#1072339
    (RHEV: Cannot start VMs that have more than 23 snapshots.)
  - Resolves: bz#751937
    (qxl triggers assert during iofuzz test)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-52.el7
changelog:
  - kvm-target-i386-Move-hyperv_-static-globals-to-X86CPU.patch [bz#1004773]
  - kvm-Fix-uninitialized-cpuid_data.patch [bz#1057173]
  - kvm-fix-coexistence-of-KVM-and-Hyper-V-leaves.patch [bz#1004773]
  - kvm-make-availability-of-Hyper-V-enlightenments-depe.patch [bz#1004773]
  - kvm-make-hyperv-hypercall-and-guest-os-id-MSRs-migra.patch [bz#1004773]
  - kvm-make-hyperv-vapic-assist-page-migratable.patch [bz#1004773]
  - kvm-target-i386-Convert-hv_relaxed-to-static-property.patch [bz#1057173]
  - kvm-target-i386-Convert-hv_vapic-to-static-property.patch [bz#1057173]
  - kvm-target-i386-Convert-hv_spinlocks-to-static-property.patch [bz#1057173]
  - kvm-target-i386-Convert-check-and-enforce-to-static-prop.patch [bz#1004773]
  - kvm-target-i386-Cleanup-foo-feature-handling.patch [bz#1057173]
  - kvm-add-support-for-hyper-v-timers.patch [bz#1057173]
  - Resolves: bz#1004773
    (Hyper-V guest OS id and hypercall MSRs not migrated)
  - Resolves: bz#1057173
    (KVM Hyper-V Enlightenment - New feature - hv-time (QEMU))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-53.el7
changelog:
  - kvm-dataplane-Fix-startup-race.patch [bz#1069541]
  - kvm-QMP-Relax-__com.redhat_drive_add-parameter-checking.patch [bz#1057471]
  - kvm-all-exit-in-case-max-vcpus-exceeded.patch [bz#993429]
  - kvm-block-gluster-code-movements-state-storage-changes.patch [bz#1031526]
  - kvm-block-gluster-add-reopen-support.patch [bz#1031526]
  - kvm-virtio-net-add-feature-bit-for-any-header-s-g.patch [bz#990989]
  - kvm-spec-Add-README.rhel6-gpxe-source.patch [bz#1073774]
  - kvm-pc-Add-RHEL6-e1000-gPXE-image.patch [bz#1073774]
  - kvm-loader-rename-in_ram-has_mr.patch [bz#1064018]
  - kvm-pc-avoid-duplicate-names-for-ROM-MRs.patch [bz#1064018]
  - kvm-qemu-img-convert-Fix-progress-output.patch [bz#1073728]
  - kvm-qemu-iotests-Test-progress-output-for-conversion.patch [bz#1073728]
  - kvm-iscsi-Use-bs-sg-for-everything-else-than-disks.patch [bz#1067784]
  - kvm-block-Fix-bs-request_alignment-assertion-for-bs-sg-1.patch [bz#1067784]
  - kvm-qemu_file-use-fwrite-correctly.patch [bz#1005103]
  - kvm-qemu_file-Fix-mismerge-of-use-fwrite-correctly.patch [bz#1005103]
  - Resolves: bz#1005103
    (Migration should fail when migrate guest offline to a file which is specified to a readonly directory.)
  - Resolves: bz#1031526
    (Can not commit snapshot when disk is using glusterfs:native backend)
  - Resolves: bz#1057471
    (fail to do hot-plug with "discard = on" with "Invalid parameter 'discard'" error)
  - Resolves: bz#1064018
    (abort from conflicting genroms)
  - Resolves: bz#1067784
    (qemu-kvm: block.c:850: bdrv_open_common: Assertion `bs->request_alignment != 0' failed. Aborted (core dumped))
  - Resolves: bz#1069541
    (Segmentation fault when boot guest with dataplane=on)
  - Resolves: bz#1073728
    (progress bar doesn't display when converting with -p)
  - Resolves: bz#1073774
    (e1000 ROM cause migrate fail  from RHEL6.5 host to RHEL7.0 host)
  - Resolves: bz#990989
    (backport inline header virtio-net optimization)
  - Resolves: bz#993429
    (kvm: test maximum number of vcpus supported (rhel7))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-54.el7
changelog:
  - kvm-qdev-monitor-Set-properties-after-parent-is-assigned.patch [bz#1046248]
  - kvm-block-Update-image-size-in-bdrv_invalidate_cache.patch [bz#1048575]
  - kvm-qcow2-Keep-option-in-qcow2_invalidate_cache.patch [bz#1048575]
  - kvm-qcow2-Check-bs-drv-in-copy_sectors.patch [bz#1048575]
  - kvm-block-bs-drv-may-be-NULL-in-bdrv_debug_resume.patch [bz#1048575]
  - kvm-iotests-Test-corruption-during-COW-request.patch [bz#1048575]
  - Resolves: bz#1046248
    (qemu-kvm crash when send "info qtree" after hot plug a device with invalid addr)
  - Resolves: bz#1048575
    (Segmentation fault occurs after migrate guest(use scsi disk and add stress) to des machine)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-55.el7
changelog:
  - kvm-scsi-Change-scsi-sense-buf-size-to-252.patch [bz#1058173]
  - kvm-scsi-Fix-migration-of-scsi-sense-data.patch [bz#1058173]
  - Resolves: bz#1058173
    (qemu-kvm core dump booting guest with scsi-generic disk attached when using built-in iscsi driver)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-56.el7
changelog:
  - kvm-configure-Fix-bugs-preventing-Ceph-inclusion.patch [bz#1078809]
  - Resolves: bz#1078809
    (can not boot qemu-kvm-rhev with rbd image)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-57.el7
changelog:
  - kvm-virtio-net-fix-guest-triggerable-buffer-overrun.patch [bz#1078308]
  - Resolves: bz#1078308
    (EMBARGOED CVE-2014-0150 qemu: virtio-net: fix guest-triggerable buffer overrun [rhel-7.0])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-58.el7
changelog:
  - kvm-pc-Use-cpu64-rhel6-CPU-model-by-default-on-rhel6-mac.patch [bz#1080170]
  - kvm-target-i386-Copy-cpu64-rhel6-definition-into-qemu64.patch [bz#1078607 bz#1080170]
  - Resolves: bz#1080170
    (intel 82576 VF not work in windows 2008 x86 - Code 12 [TestOnly])
  - Resolves: bz#1080170
    (Default CPU model for rhel6.* machine-types is different from RHEL-6)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-59.el7
changelog:
  - kvm-qemu-iotests-add-.-check-cloop-support.patch [bz#1066691]
  - kvm-qemu-iotests-add-cloop-input-validation-tests.patch [bz#1066691]
  - kvm-block-cloop-validate-block_size-header-field-CVE-201.patch [bz#1079455]
  - kvm-block-cloop-prevent-offsets_size-integer-overflow-CV.patch [bz#1079320]
  - kvm-block-cloop-refuse-images-with-huge-offsets-arrays-C.patch [bz#1079455]
  - kvm-block-cloop-refuse-images-with-bogus-offsets-CVE-201.patch [bz#1079455]
  - kvm-size-off-by-one.patch [bz#1066691]
  - kvm-qemu-iotests-Support-for-bochs-format.patch [bz#1066691]
  - kvm-bochs-Unify-header-structs-and-make-them-QEMU_PACKED.patch [bz#1066691]
  - kvm-bochs-Use-unsigned-variables-for-offsets-and-sizes-C.patch [bz#1079339]
  - kvm-bochs-Check-catalog_size-header-field-CVE-2014-0143.patch [bz#1079320]
  - kvm-bochs-Check-extent_size-header-field-CVE-2014-0142.patch [bz#1079315]
  - kvm-bochs-Fix-bitmap-offset-calculation.patch [bz#1066691]
  - kvm-vpc-vhd-add-bounds-check-for-max_table_entries-and-b.patch [bz#1079455]
  - kvm-vpc-Validate-block-size-CVE-2014-0142.patch [bz#1079315]
  - kvm-vdi-add-bounds-checks-for-blocks_in_image-and-disk_s.patch [bz#1079455]
  - kvm-vhdx-Bounds-checking-for-block_size-and-logical_sect.patch [bz#1079346]
  - kvm-curl-check-data-size-before-memcpy-to-local-buffer.-.patch [bz#1079455]
  - kvm-qcow2-Check-header_length-CVE-2014-0144.patch [bz#1079455]
  - kvm-qcow2-Check-backing_file_offset-CVE-2014-0144.patch [bz#1079455]
  - kvm-qcow2-Check-refcount-table-size-CVE-2014-0144.patch [bz#1079455]
  - kvm-qcow2-Validate-refcount-table-offset.patch [bz#1066691]
  - kvm-qcow2-Validate-snapshot-table-offset-size-CVE-2014-0.patch [bz#1079455]
  - kvm-qcow2-Validate-active-L1-table-offset-and-size-CVE-2.patch [bz#1079455]
  - kvm-qcow2-Fix-backing-file-name-length-check.patch [bz#1066691]
  - kvm-qcow2-Don-t-rely-on-free_cluster_index-in-alloc_refc.patch [bz#1079339]
  - kvm-qcow2-Avoid-integer-overflow-in-get_refcount-CVE-201.patch [bz#1079320]
  - kvm-qcow2-Check-new-refcount-table-size-on-growth.patch [bz#1066691]
  - kvm-qcow2-Fix-types-in-qcow2_alloc_clusters-and-alloc_cl.patch [bz#1066691]
  - kvm-qcow2-Protect-against-some-integer-overflows-in-bdrv.patch [bz#1066691]
  - kvm-qcow2-Fix-new-L1-table-size-check-CVE-2014-0143.patch [bz#1079320]
  - kvm-dmg-coding-style-and-indentation-cleanup.patch [bz#1066691]
  - kvm-dmg-prevent-out-of-bounds-array-access-on-terminator.patch [bz#1066691]
  - kvm-dmg-drop-broken-bdrv_pread-loop.patch [bz#1066691]
  - kvm-dmg-use-appropriate-types-when-reading-chunks.patch [bz#1066691]
  - kvm-dmg-sanitize-chunk-length-and-sectorcount-CVE-2014-0.patch [bz#1079325]
  - kvm-dmg-use-uint64_t-consistently-for-sectors-and-length.patch [bz#1066691]
  - kvm-dmg-prevent-chunk-buffer-overflow-CVE-2014-0145.patch [bz#1079325]
  - kvm-block-vdi-bounds-check-qemu-io-tests.patch [bz#1066691]
  - kvm-block-Limit-request-size-CVE-2014-0143.patch [bz#1079320]
  - kvm-qcow2-Fix-copy_sectors-with-VM-state.patch [bz#1066691]
  - kvm-qcow2-Fix-NULL-dereference-in-qcow2_open-error-path-.patch [bz#1079333]
  - kvm-qcow2-Fix-L1-allocation-size-in-qcow2_snapshot_load_.patch [bz#1079325]
  - kvm-qcow2-Check-maximum-L1-size-in-qcow2_snapshot_load_t.patch [bz#1079320]
  - kvm-qcow2-Limit-snapshot-table-size.patch [bz#1066691]
  - kvm-parallels-Fix-catalog-size-integer-overflow-CVE-2014.patch [bz#1079320]
  - kvm-parallels-Sanity-check-for-s-tracks-CVE-2014-0142.patch [bz#1079315]
  - kvm-fix-machine-check-propagation.patch [bz#740107]
  - Resolves: bz#1066691
    (qemu-kvm: include leftover patches from block layer security audit)
  - Resolves: bz#1079315
    (CVE-2014-0142 qemu-kvm: qemu: crash by possible division by zero [rhel-7.0])
  - Resolves: bz#1079320
    (CVE-2014-0143 qemu-kvm: Qemu: block: multiple integer overflow flaws [rhel-7.0])
  - Resolves: bz#1079325
    (CVE-2014-0145 qemu-kvm: Qemu: prevent possible buffer overflows [rhel-7.0])
  - Resolves: bz#1079333
    (CVE-2014-0146 qemu-kvm: Qemu: qcow2: NULL dereference in qcow2_open() error path [rhel-7.0])
  - Resolves: bz#1079339
    (CVE-2014-0147 qemu-kvm: Qemu: block: possible crash due signed types or logic error [rhel-7.0])
  - Resolves: bz#1079346
    (CVE-2014-0148 qemu-kvm: Qemu: vhdx: bounds checking for block_size and logical_sector_size [rhel-7.0])
  - Resolves: bz#1079455
    (CVE-2014-0144 qemu-kvm: Qemu: block: missing input validation [rhel-7.0])
  - Resolves: bz#740107
    ([Hitachi 7.0 FEAT]  KVM: MCA Recovery for KVM guest OS memory)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-60.el7
changelog:
  - kvm-qcow2-fix-dangling-refcount-table-entry.patch [bz#1081793]
  - kvm-qcow2-link-all-L2-meta-updates-in-preallocate.patch [bz#1081393]
  - Resolves: bz#1081393
    (qemu-img will prompt that 'leaked clusters were found' while creating images with '-o preallocation=metadata,cluster_size<=1024')
  - Resolves: bz#1081793
    (qemu-img core dumped when creating a qcow2 image base on block device(iscsi or libiscsi))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-61.el7
changelog:
  - kvm-iscsi-fix-indentation.patch [bz#1083413]
  - kvm-iscsi-correctly-propagate-errors-in-iscsi_open.patch [bz#1083413]
  - kvm-block-iscsi-query-for-supported-VPD-pages.patch [bz#1083413]
  - kvm-block-iscsi-fix-segfault-if-writesame-fails.patch [bz#1083413]
  - kvm-iscsi-recognize-invalid-field-ASCQ-from-WRITE-SAME-c.patch [bz#1083413]
  - kvm-iscsi-ignore-flushes-on-scsi-generic-devices.patch [bz#1083413]
  - kvm-iscsi-always-query-max-WRITE-SAME-length.patch [bz#1083413]
  - kvm-iscsi-Don-t-set-error-if-already-set-in-iscsi_do_inq.patch [bz#1083413]
  - kvm-iscsi-Remember-to-set-ret-for-iscsi_open-in-error-ca.patch [bz#1083413]
  - kvm-qemu_loadvm_state-shadow-SeaBIOS-for-VM-incoming-fro.patch [bz#1027565]
  - kvm-uhci-UNfix-irq-routing-for-RHEL-6-machtypes-RHEL-onl.patch [bz#1085701]
  - kvm-ide-Correct-improper-smart-self-test-counter-reset-i.patch [bz#1087980]
  - Resolves: bz#1027565
    (fail to reboot guest after migration from RHEL6.5 host to RHEL7.0 host)
  - Resolves: bz#1083413
    (qemu-kvm: iSCSI: Failure. SENSE KEY:ILLEGAL_REQUEST(5) ASCQ:INVALID_FIELD_IN_CDB(0x2400))
  - Resolves: bz#1085701
    (Guest hits call trace migrate from RHEL6.5 to RHEL7.0 host with -M 6.1 & balloon & uhci device)
  - Resolves: bz#1087980
    (CVE-2014-2894 qemu-kvm: QEMU: out of bounds buffer accesses, guest triggerable via IDE SMART [rhel-7.1])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-62.el7
changelog:
  - kvm-pc-add-hot_add_cpu-callback-to-all-machine-types.patch [bz#1094285]
  - Resolves: bz#1094285
    (Hot plug CPU not working with RHEL6  machine types running on RHEL7 host.)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-63.el7
changelog:
  - kvm-char-restore-read-callback-on-a-reattached-hotplug-c.patch [bz#1038914]
  - kvm-qcow2-Free-preallocated-zero-clusters.patch [bz#1052093]
  - kvm-qemu-iotests-Discard-preallocated-zero-clusters.patch [bz#1052093]
  - kvm-XBZRLE-Fix-qemu-crash-when-resize-the-xbzrle-cache.patch [bz#1066338]
  - kvm-Provide-init-function-for-ram-migration.patch [bz#1066338]
  - kvm-Init-the-XBZRLE.lock-in-ram_mig_init.patch [bz#1066338]
  - kvm-XBZRLE-Fix-one-XBZRLE-corruption-issues.patch [bz#1066338]
  - kvm-Count-used-RAMBlock-pages-for-migration_dirty_pages.patch [bz#1074913]
  - kvm-virtio-net-fix-buffer-overflow-on-invalid-state-load.patch [bz#1095678]
  - kvm-virtio-net-out-of-bounds-buffer-write-on-invalid-sta.patch [bz#1095690]
  - kvm-virtio-net-out-of-bounds-buffer-write-on-load.patch [bz#1095685]
  - kvm-virtio-out-of-bounds-buffer-write-on-invalid-state-l.patch [bz#1095695]
  - kvm-virtio-avoid-buffer-overrun-on-incoming-migration.patch [bz#1095738]
  - kvm-virtio-scsi-fix-buffer-overrun-on-invalid-state-load.patch [bz#1095742]
  - kvm-virtio-validate-config_len-on-load.patch [bz#1095783]
  - kvm-virtio-validate-num_sg-when-mapping.patch [bz#1095766]
  - kvm-virtio-allow-mapping-up-to-max-queue-size.patch [bz#1095766]
  - kvm-usb-sanity-check-setup_index-setup_len-in-post_load.patch [bz#1095747]
  - kvm-usb-sanity-check-setup_index-setup_len-in-post_l2.patch [bz#1095747]
  - kvm-vmstate-reduce-code-duplication.patch [bz#1095716]
  - kvm-vmstate-add-VMS_MUST_EXIST.patch [bz#1095716]
  - kvm-vmstate-add-VMSTATE_VALIDATE.patch [bz#1095716]
  - kvm-hpet-fix-buffer-overrun-on-invalid-state-load.patch [bz#1095707]
  - kvm-hw-pci-pcie_aer.c-fix-buffer-overruns-on-invalid-sta.patch [bz#1095716]
  - kvm-usb-fix-up-post-load-checks.patch [bz#1096829]
  - kvm-qcow-correctly-propagate-errors.patch [bz#1097230]
  - kvm-qcow1-Make-padding-in-the-header-explicit.patch [bz#1097230]
  - kvm-qcow1-Check-maximum-cluster-size.patch [bz#1097230]
  - kvm-qcow1-Validate-L2-table-size-CVE-2014-0222.patch [bz#1097230]
  - kvm-qcow1-Validate-image-size-CVE-2014-0223.patch [bz#1097237]
  - kvm-qcow1-Stricter-backing-file-length-check.patch [bz#1097237]
  - Resolves: bz#1038914
    (Guest can't receive any character transmitted from host after hot unplugging virtserialport then hot plugging again)
  - Resolves: bz#1052093
    (qcow2 corruptions (leaked clusters after installing a rhel7 guest using virtio_scsi))
  - Resolves: bz#1066338
    (Reduce the migrate cache size during migration causes qemu segment fault)
  - Resolves: bz#1074913
    (migration can not finish with 1024k 'remaining ram' left after hotunplug 4 nics)
  - Resolves: bz#1095678
    (CVE-2013-4148 qemu-kvm: qemu: virtio-net: buffer overflow on invalid state load [rhel-7.1])
  - Resolves: bz#1095685
    (CVE-2013-4149 qemu-kvm: qemu: virtio-net: out-of-bounds buffer write on load [rhel-7.1])
  - Resolves: bz#1095690
    (CVE-2013-4150 qemu-kvm: qemu: virtio-net: out-of-bounds buffer write on invalid state load [rhel-7.1])
  - Resolves: bz#1095695
    (CVE-2013-4151 qemu-kvm: qemu: virtio: out-of-bounds buffer write on invalid state load [rhel-7.1])
  - Resolves: bz#1095707
    (CVE-2013-4527 qemu-kvm: qemu: hpet: buffer overrun on invalid state load [rhel-7.1])
  - Resolves: bz#1095716
    (CVE-2013-4529 qemu-kvm: qemu: hw/pci/pcie_aer.c: buffer overrun on invalid state load [rhel-7.1])
  - Resolves: bz#1095738
    (CVE-2013-6399 qemu-kvm: qemu: virtio: buffer overrun on incoming migration [rhel-7.1])
  - Resolves: bz#1095742
    (CVE-2013-4542 qemu-kvm: qemu: virtio-scsi: buffer overrun on invalid state load [rhel-7.1])
  - Resolves: bz#1095747
    (CVE-2013-4541 qemu-kvm: qemu: usb: insufficient sanity checking of setup_index+setup_len in post_load [rhel-7.1])
  - Resolves: bz#1095766
    (CVE-2013-4535 CVE-2013-4536 qemu-kvm: qemu: virtio: insufficient validation of num_sg when mapping [rhel-7.1])
  - Resolves: bz#1095783
    (CVE-2014-0182 qemu-kvm: qemu: virtio: out-of-bounds buffer write on state load with invalid config_len [rhel-7.1])
  - Resolves: bz#1096829
    (CVE-2014-3461 qemu-kvm: Qemu: usb: fix up post load checks [rhel-7.1])
  - Resolves: bz#1097230
    (CVE-2014-0222 qemu-kvm: Qemu: qcow1: validate L2 table size to avoid integer overflows [rhel-7.1])
  - Resolves: bz#1097237
    (CVE-2014-0223 qemu-kvm: Qemu: qcow1: validate image size to avoid out-of-bounds memory access [rhel-7.1])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-64.el7
changelog:
  - kvm-zero-initialize-KVM_SET_GSI_ROUTING-input.patch [bz#1098976]
  - kvm-skip-system-call-when-msi-route-is-unchanged.patch [bz#1098976]
  - Resolves: bz#1098976
    (2x RHEL 5.10 VM running on RHEL 7 KVM have low TCP_STREAM throughput)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-65.el7
changelog:
  - kvm-Allow-mismatched-virtio-config-len.patch [bz#1113009]
  - Resolves: bz#1113009
    (Migration failed with virtio-blk from RHEL6.5.0 host to RHEL7.0 host)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-66.el7
changelog:
  - kvm-xhci-fix-overflow-in-usb_xhci_post_load.patch [bz#1074219]
  - kvm-migration-qmp_migrate-keep-working-after-syntax-erro.patch [bz#1086598]
  - kvm-seccomp-add-shmctl-mlock-and-munlock-to-the-syscall-.patch [bz#1026314]
  - kvm-exit-when-no-kvm-and-vcpu-count-160.patch [bz#1076326]
  - kvm-Disallow-outward-migration-while-awaiting-incoming-m.patch [bz#1086987]
  - kvm-block-Ignore-duplicate-or-NULL-format_name-in-bdrv_i.patch [bz#1088695 bz#1093983]
  - kvm-block-vhdx-account-for-identical-header-sections.patch [bz#1097020]
  - kvm-aio-Fix-use-after-free-in-cancellation-path.patch [bz#1095877]
  - kvm-scsi-disk-Improve-error-messager-if-can-t-get-versio.patch [bz#1021788]
  - kvm-scsi-Improve-error-messages-more.patch [bz#1021788]
  - kvm-memory-Don-t-call-memory_region_update_coalesced_ran.patch [bz#1096645]
  - kvm-kvmclock-Ensure-time-in-migration-never-goes-backwar.patch [bz#1098602]
  - kvm-kvmclock-Ensure-proper-env-tsc-value-for-kvmclock_cu.patch [bz#1098602]
  - Resolves: bz#1021788
    (the error message "scsi generic interface too old" is wrong more often than not)
  - Resolves: bz#1026314
    (qemu-kvm hang when use '-sandbox on'+'vnc'+'hda')
  - Resolves: bz#1074219
    (qemu core dump when install a RHEL.7 guest(xhci) with migration)
  - Resolves: bz#1076326
    (qemu-kvm does not quit when booting guest w/ 161 vcpus and "-no-kvm")
  - Resolves: bz#1086598
    (migrate_cancel wont take effect on previouly wrong migrate -d cmd)
  - Resolves: bz#1086987
    (src qemu crashed when starting migration in inmigrate mode)
  - Resolves: bz#1088695
    (there are four "gluster" in qemu-img supported format list)
  - Resolves: bz#1093983
    (there are three "nbd" in qemu-img supported format list)
  - Resolves: bz#1095877
    (segmentation fault in qemu-kvm due to use-after-free of a SCSIGenericReq (host device pass-through))
  - Resolves: bz#1096645
    ([FJ7.0 Bug] RHEL7.0 guest attaching 150 or more virtio-blk disks fails to start up)
  - Resolves: bz#1097020
    ([RFE] qemu-img: Add/improve Disk2VHD tools creating VHDX images)
  - Resolves: bz#1098602
    (kvmclock: Ensure time in migration never goes backward (backport))


author: Jeff E. Nelson <jen@redhat.com> - 1.5.3-67.el7
changelog:
  - kvm-vl.c-Output-error-on-invalid-machine-type.patch [bz#990724]
  - kvm-migration-dump-vmstate-info-as-a-json-file-for-stati.patch [bz#1118707]
  - kvm-vmstate-static-checker-script-to-validate-vmstate-ch.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-add-dump1-and-dump2-fil.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-incompat-machine-types.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-add-version-error-in-ma.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-version-mismatch-inside.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-minimum_version_id-chec.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-remove-a-section.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-remove-a-field.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-remove-last-field-in-a-.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-change-description-name.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-remove-Fields.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-remove-Description.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-remove-Description-insi.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-remove-a-subsection.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-remove-Subsections.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-add-substructure-for-us.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-add-size-mismatch-insid.patch [bz#1118707]
  - kvm-aio-fix-qemu_bh_schedule-bh-ctx-race-condition.patch [bz#1116728]
  - kvm-block-Improve-driver-whitelist-checks.patch [bz#999789]
  - kvm-vmdk-Fix-format-specific-information-create-type-for.patch [bz#1029271]
  - kvm-virtio-pci-Report-an-error-when-msix-vectors-init-fa.patch [bz#1095645]
  - kvm-scsi-Report-error-when-lun-number-is-in-use.patch [bz#1096576]
  - kvm-util-Split-out-exec_dir-from-os_find_datadir.patch [bz#1017685]
  - kvm-rules.mak-fix-obj-to-a-real-relative-path.patch [bz#1017685]
  - kvm-rules.mak-allow-per-object-cflags-and-libs.patch [bz#1017685]
  - kvm-block-use-per-object-cflags-and-libs.patch [bz#1017685]
  - kvm-vmdk-Fix-creating-big-description-file.patch [bz#1039791]
  - Resolves: bz#1017685
    (Gluster etc. should not be a dependency of vscclient and libcacard)
  - Resolves: bz#1029271
    (Format specific information (create type) was wrong when create it specified subformat='streamOptimized')
  - Resolves: bz#1039791
    (qemu-img creates truncated VMDK image with subformat=twoGbMaxExtentFlat)
  - Resolves: bz#1095645
    (vectors of virtio-scsi-pci will be 0 when set vectors>=129)
  - Resolves: bz#1096576
    (QEMU core dumped when boot up two scsi-hd disk on the same virtio-scsi-pci controller in Intel host)
  - Resolves: bz#1116728
    (Backport qemu_bh_schedule() race condition fix)
  - Resolves: bz#1118707
    (VMstate static checker: backport -dump-vmstate feature to export json-encoded vmstate info)
  - Resolves: bz#990724
    (qemu-kvm failing when invalid machine type is provided)
  - Resolves: bz#999789
    (qemu should give a more friendly prompt when didn't specify read-only for VMDK format disk)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-68.el7
changelog:
  - kvm-virtio-net-Do-not-filter-VLANs-without-F_CTRL_VLAN.patch [bz#1065724]
  - kvm-virtio-net-add-vlan-receive-state-to-RxFilterInfo.patch [bz#1065724]
  - kvm-virtio-rng-check-return-value-of-virtio_load.patch [bz#1116941]
  - kvm-qapi-treat-all-negative-return-of-strtosz_suffix-as-.patch [bz#1074403]
  - Resolves: bz#1065724
    (rx filter incorrect when guest disables VLAN filtering)
  - Resolves: bz#1074403
    (qemu-kvm can not give any warning hint when set sndbuf with negative value)
  - Resolves: bz#1116941
    (Return value of virtio_load not checked in virtio_rng_load)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-69.el7
changelog:
  - kvm-rdma-bug-fixes.patch [bz#1107821]
  - kvm-virtio-serial-report-frontend-connection-state-via-m.patch [bz#1122151]
  - kvm-char-report-frontend-open-closed-state-in-query-char.patch [bz#1122151]
  - kvm-acpi-fix-tables-for-no-hpet-configuration.patch [bz#1129552]
  - kvm-mirror-Fix-resource-leak-when-bdrv_getlength-fails.patch [bz#1130603]
  - kvm-blockjob-Add-block_job_yield.patch [bz#1130603]
  - kvm-mirror-Go-through-ready-complete-process-for-0-len-i.patch [bz#1130603]
  - kvm-qemu-iotests-Test-BLOCK_JOB_READY-event-for-0Kb-imag.patch [bz#1130603]
  - kvm-block-make-top-argument-to-block-commit-optional.patch [bz#1130603]
  - kvm-qemu-iotests-Test-0-length-image-for-mirror.patch [bz#1130603]
  - kvm-mirror-Fix-qiov-size-for-short-requests.patch [bz#1130603]
  - Resolves: bz#1107821
    (rdma migration: seg if destination isn't listening)
  - Resolves: bz#1122151
    (Pass close from qemu-ga)
  - Resolves: bz#1129552
    (backport "acpi: fix tables for no-hpet configuration")
  - Resolves: bz#1130603
    (advertise active commit to libvirt)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-70.el7
changelog:
  - kvm-Enforce-stack-protector-usage.patch [bz#1064260]
  - kvm-pc-increase-maximal-VCPU-count-to-240.patch [bz#1134408]
  - kvm-gluster-Add-discard-support-for-GlusterFS-block-driv.patch [bz#1136534]
  - kvm-gluster-default-scheme-to-gluster-and-host-to-localh.patch [bz#1088150]
  - kvm-qdev-properties-system.c-Allow-vlan-or-netdev-for-de.patch [bz#996011]
  - kvm-vl-process-object-after-other-backend-options.patch [bz#1128095]
  - Resolves: bz#1064260
    (Handle properly --enable-fstack-protector option)
  - Resolves: bz#1088150
    (qemu-img coredumpd when try to create a gluster format image)
  - Resolves: bz#1128095
    (chardev 'chr0' isn't initialized when we try to open rng backend)
  - Resolves: bz#1134408
    ([HP 7.1 FEAT] Increase qemu-kvm's VCPU limit to 240)
  - Resolves: bz#1136534
    (glusterfs backend does not support discard)
  - Resolves: bz#996011
    (vlan and queues options cause core dumped when qemu-kvm process quit(or ctrl+c))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-71.el7
changelog:
  - kvm-spice-move-qemu_spice_display_-from-spice-graphics-t.patch [bz#1054077]
  - kvm-spice-move-spice_server_vm_-start-stop-calls-into-qe.patch [bz#1054077]
  - kvm-spice-stop-server-for-qxl-hard-reset.patch [bz#1054077]
  - kvm-qemu-Adjust-qemu-wakeup.patch [bz#1064156]
  - kvm-vmstate_xhci_event-fix-unterminated-field-list.patch [bz#1122147]
  - kvm-vmstate_xhci_event-bug-compat-with-RHEL-7.0-RHEL-onl.patch [bz#1122147]
  - kvm-pflash_cfi01-write-flash-contents-to-bdrv-on-incomin.patch [bz#1139702]
  - kvm-ide-test-Add-enum-value-for-DEV.patch [bz#1123372]
  - kvm-ide-test-Add-FLUSH-CACHE-test-case.patch [bz#1123372]
  - kvm-ide-Fix-segfault-when-flushing-a-device-that-doesn-t.patch [bz#1123372]
  - kvm-IDE-Fill-the-IDENTIFY-request-consistently.patch [bz#852348]
  - kvm-ide-Add-resize-callback-to-ide-core.patch [bz#852348]
  - Resolves: bz#1054077
    (qemu crash when reboot win7 guest with spice display)
  - Resolves: bz#1064156
    ([qxl] The guest show black screen while resumed guest which managedsaved in pmsuspended status.)
  - Resolves: bz#1122147
    (CVE-2014-5263 vmstate_xhci_event: fix unterminated field list)
  - Resolves: bz#1123372
    (qemu-kvm crashed when doing iofuzz testing)
  - Resolves: bz#1139702
    (pflash (UEFI varstore) migration shortcut for libvirt [RHEL])
  - Resolves: bz#852348
    (fail to block_resize local data disk with IDE/AHCI disk_interface)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-72.el7
changelog:
  - kvm-vbe-make-bochs-dispi-interface-return-the-correct-me.patch [bz#1139118]
  - kvm-vbe-rework-sanity-checks.patch [bz#1139118]
  - kvm-spice-display-add-display-channel-id-to-the-debug-me.patch [bz#1139118]
  - kvm-spice-make-sure-we-don-t-overflow-ssd-buf.patch [bz#1139118]
  - Resolves: bz#1139118
    (CVE-2014-3615 qemu-kvm: Qemu: crash when guest sets high resolution [rhel-7.1])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-73.el7
changelog:
  - kvm-scsi-disk-fix-bug-in-scsi_block_new_request-introduc.patch [bz#1105880]
  - Resolves: bz#1105880
    (bug in scsi_block_new_request() function introduced by upstream commit 137745c5c60f083ec982fe9e861e8c16ebca1ba8)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-74.el7
changelog:
  - kvm-ide-Add-wwn-support-to-IDE-ATAPI-drive.patch [bz#1131316]
  - kvm-vmdk-Allow-vmdk_create-to-work-with-protocol.patch [bz#1098086]
  - kvm-block-make-vdi-bounds-check-match-upstream.patch [bz#1098086]
  - kvm-vdi-say-why-an-image-is-bad.patch [bz#1098086]
  - kvm-block-do-not-abuse-EMEDIUMTYPE.patch [bz#1098086]
  - kvm-cow-correctly-propagate-errors.patch [bz#1098086]
  - kvm-block-Use-correct-width-in-format-strings.patch [bz#1098086]
  - kvm-vdi-remove-double-conversion.patch [bz#1098086]
  - kvm-block-vdi-Error-out-immediately-in-vdi_create.patch [bz#1098086]
  - kvm-vpc-Implement-.bdrv_has_zero_init.patch [bz#1098086]
  - kvm-block-vpc-use-QEMU_PACKED-for-on-disk-structures.patch [bz#1098086]
  - kvm-block-allow-bdrv_unref-to-be-passed-NULL-pointers.patch [bz#1098086]
  - kvm-block-vdi-use-block-layer-ops-in-vdi_create-instead-.patch [bz#1098086]
  - kvm-block-use-the-standard-ret-instead-of-result.patch [bz#1098086]
  - kvm-block-vpc-use-block-layer-ops-in-vpc_create-instead-.patch [bz#1098086]
  - kvm-block-iotest-update-084-to-test-static-VDI-image-cre.patch [bz#1098086]
  - kvm-block-add-helper-function-to-determine-if-a-BDS-is-i.patch [bz#1122925]
  - kvm-block-extend-block-commit-to-accept-a-string-for-the.patch [bz#1122925]
  - kvm-block-add-backing-file-option-to-block-stream.patch [bz#1122925]
  - kvm-block-add-__com.redhat_change-backing-file-qmp-comma.patch [bz#1122925]
  - Resolves: bz#1098086
    (RFE: Supporting creating vmdk/vdi/vpc format disk with protocols (glusterfs))
  - Resolves: bz#1122925
    (Maintain relative path to backing file image during live merge (block-commit))
  - Resolves: bz#1131316
    (fail to specify wwn for virtual IDE CD-ROM)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-75.el7
changelog:
  - kvm-target-i386-Broadwell-CPU-model.patch [bz#1116117]
  - kvm-pc-Add-Broadwell-CPUID-compatibility-bits.patch [bz#1116117]
  - kvm-virtio-balloon-fix-integer-overflow-in-memory-stats-.patch [bz#1142290]
  - Resolves: bz#1116117
    ([Intel 7.1 FEAT] Broadwell new instructions support for KVM - qemu-kvm)
  - Resolves: bz#1142290
    (guest is stuck when setting balloon memory with large guest-stats-polling-interval)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-76.el7
changelog:
  - kvm-usb-hcd-xhci-QOM-Upcast-Sweep.patch [bz#980747]
  - kvm-usb-hcd-xhci-QOM-parent-field-cleanup.patch [bz#980747]
  - kvm-uhci-egsm-fix.patch [bz#1046873]
  - kvm-usb-redir-fix-use-after-free.patch [bz#1046574 bz#1088116]
  - kvm-xhci-remove-leftover-debug-printf.patch [bz#980833]
  - kvm-xhci-add-tracepoint-for-endpoint-state-changes.patch [bz#980833]
  - kvm-xhci-add-port-to-slot_address-tracepoint.patch [bz#980833]
  - kvm-usb-parallelize-usb3-streams.patch [bz#1075846]
  - kvm-xhci-Init-a-transfers-xhci-slotid-and-epid-member-on.patch [bz#1075846]
  - kvm-xhci-Add-xhci_epid_to_usbep-helper-function.patch [bz#980833]
  - kvm-xhci-Fix-memory-leak-on-xhci_disable_ep.patch [bz#980833]
  - kvm-usb-Also-reset-max_packet_size-on-ep_reset.patch [bz#1075846]
  - kvm-usb-Fix-iovec-memleak-on-combined-packet-free.patch [bz#1075846]
  - kvm-usb-hcd-xhci-Remove-unused-sstreamsm-member-from-XHC.patch [bz#980747]
  - kvm-usb-hcd-xhci-Remove-unused-cancelled-member-from-XHC.patch [bz#980747]
  - kvm-usb-hcd-xhci-Report-completion-of-active-transfer-wi.patch [bz#980747]
  - kvm-usb-hcd-xhci-Update-endpoint-context-dequeue-pointer.patch [bz#980747]
  - kvm-xhci-Add-a-few-missing-checks-for-disconnected-devic.patch [bz#980833]
  - kvm-usb-Add-max_streams-attribute-to-endpoint-info.patch [bz#1111450]
  - kvm-usb-Add-usb_device_alloc-free_streams.patch [bz#1111450]
  - kvm-xhci-Call-usb_device_alloc-free_streams.patch [bz#980833]
  - kvm-uhci-invalidate-queue-on-device-address-changes.patch [bz#1111450]
  - kvm-xhci-iso-fix-time-calculation.patch [bz#949385]
  - kvm-xhci-iso-allow-for-some-latency.patch [bz#949385]
  - kvm-xhci-switch-debug-printf-to-tracepoint.patch [bz#980747]
  - kvm-xhci-use-DPRINTF-instead-of-fprintf-stderr.patch [bz#980833]
  - kvm-xhci-child-detach-fix.patch [bz#980833]
  - kvm-usb-add-usb_pick_speed.patch [bz#1075846]
  - kvm-xhci-make-port-reset-trace-point-more-verbose.patch [bz#980833]
  - kvm-usb-initialize-libusb_device-to-avoid-crash.patch [bz#1111450]
  - kvm-target-i386-get-CPL-from-SS.DPL.patch [bz#1097363]
  - kvm-trace-use-unique-Red-Hat-version-number-in-simpletra.patch [bz#1088112]
  - kvm-trace-add-pid-field-to-simpletrace-record.patch [bz#1088112]
  - kvm-simpletrace-add-support-for-trace-record-pid-field.patch [bz#1088112]
  - kvm-simpletrace-add-simpletrace.py-no-header-option.patch [bz#1088112]
  - kvm-trace-extract-stap_escape-function-for-reuse.patch [bz#1088112]
  - kvm-trace-add-tracetool-simpletrace_stap-format.patch [bz#1088112]
  - kvm-trace-install-simpletrace-SystemTap-tapset.patch [bz#1088112]
  - kvm-trace-install-trace-events-file.patch [bz#1088112]
  - kvm-trace-add-SystemTap-init-scripts-for-simpletrace-bri.patch [bz#1088112]
  - kvm-simpletrace-install-simpletrace.py.patch [bz#1088112]
  - kvm-trace-add-systemtap-initscript-README-file-to-RPM.patch [bz#1088112]
  - kvm-rdma-Fix-block-during-rdma-migration.patch [bz#1152969]
  - Resolves: bz#1046574
    (fail to passthrough the USB speaker redirected from usb-redir with xhci controller)
  - Resolves: bz#1046873
    (fail to be recognized the hotpluging usb-storage device with xhci controller in win2012R2 guest)
  - Resolves: bz#1075846
    (qemu-kvm core dumped when hotplug/unhotplug USB3.0 device multi times)
  - Resolves: bz#1088112
    ([Fujitsu 7.1 FEAT]:QEMU: capturing trace data all the time using ftrace-based tracing)
  - Resolves: bz#1088116
    (qemu crash when device_del usb-redir)
  - Resolves: bz#1097363
    (qemu ' KVM internal error. Suberror: 1'  when  query cpu frequently during pxe boot in Intel "Q95xx" host)
  - Resolves: bz#1111450
    (Guest crash when hotplug usb while disable virt_use_usb)
  - Resolves: bz#1152969
    (Qemu-kvm got stuck when migrate to wrong RDMA ip)
  - Resolves: bz#949385
    (passthrough USB speaker to win2012 guest fail to work well)
  - Resolves: bz#980747
    (flood with 'xhci: wrote doorbell while xHC stopped or paused' when redirected USB Webcam from usb-host with xHCI controller)
  - Resolves: bz#980833
    (xhci: FIXME: endpoint stopped w/ xfers running, data might be lost)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-77.el7
changelog:
  - kvm-seccomp-add-semctl-to-the-syscall-whitelist.patch [bz#1026314]
  - kvm-Revert-kvmclock-Ensure-proper-env-tsc-value-for-kvmc.patch [bz#1098602 bz#1130428]
  - kvm-Revert-kvmclock-Ensure-time-in-migration-never-goes-.patch [bz#1098602 bz#1130428]
  - kvm-Introduce-cpu_clean_all_dirty.patch [bz#1098602 bz#1130428]
  - kvm-kvmclock-Ensure-proper-env-tsc-value-for-kvmclock.v2.patch [bz#1098602 bz#1130428]
  - kvm-kvmclock-Ensure-time-in-migration-never-goes-back.v2.patch [bz#1098602 bz#1130428]
  - Resolves: bz#1026314
    (BUG: qemu-kvm hang when use '-sandbox on'+'vnc'+'hda')
  - Resolves: bz#1098602
    (kvmclock: Ensure time in migration never goes backward (backport))
  - Resolves: bz#1130428
    (After migration of RHEL7.1 guest with "-vga qxl", GUI console is hang)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-78.el7
changelog:
  - kvm-slirp-udp-fix-NULL-pointer-dereference-because-of-un.patch [bz#1144820]
  - kvm-hw-pci-fix-error-flow-in-pci-multifunction-init.patch [bz#1049734]
  - kvm-rhel-Drop-machine-type-pc-q35-rhel7.0.0.patch [bz#1111107]
  - kvm-virtio-scsi-Plug-memory-leak-on-virtio_scsi_push_eve.patch [bz#1088822]
  - kvm-virtio-scsi-Report-error-if-num_queues-is-0-or-too-l.patch [bz#1089606]
  - kvm-virtio-scsi-Fix-memory-leak-when-realize-failed.patch [bz#1089606]
  - kvm-virtio-scsi-Fix-num_queue-input-validation.patch [bz#1089606]
  - kvm-Revert-linux-aio-use-event-notifiers.patch [bz#1104748]
  - kvm-specfile-Require-glusterfs-api-3.6.patch [bz#1155518]
  - Resolves: bz#1049734
    (PCI: QEMU crash on illegal operation: attaching a function to a non multi-function device)
  - Resolves: bz#1088822
    (hot-plug a virtio-scsi disk via 'blockdev-add' always cause QEMU quit)
  - Resolves: bz#1089606
    (QEMU will not reject invalid number of queues (num_queues = 0) specified for virtio-scsi)
  - Resolves: bz#1104748
    (48% reduction in IO performance for KVM guest, io=native)
  - Resolves: bz#1111107
    (Remove Q35 machine type from qemu-kvm)
  - Resolves: bz#1144820
    (CVE-2014-3640 qemu-kvm: qemu: slirp: NULL pointer deref in sosendto() [rhel-7.1])
  - Resolves: bz#1155518
    (qemu-kvm: undefined symbol: glfs_discard_async)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-79.el7
changelog:
  - kvm-libcacard-link-against-qemu-error.o-for-error_report.patch [bz#1088176]
  - kvm-error-Add-error_abort.patch [bz#1088176]
  - kvm-blockdev-Fail-blockdev-add-with-encrypted-images.patch [bz#1088176]
  - kvm-blockdev-Fix-NULL-pointer-dereference-in-blockdev-ad.patch [bz#1088176]
  - kvm-qemu-iotests-Test-a-few-blockdev-add-error-cases.patch [bz#1088176]
  - kvm-block-Add-errp-to-bdrv_new.patch [bz#1088176]
  - kvm-qemu-img-Avoid-duplicate-block-device-IDs.patch [bz#1088176]
  - kvm-block-Catch-duplicate-IDs-in-bdrv_new.patch [bz#1088176]
  - kvm-qemu-img-Allow-source-cache-mode-specification.patch [bz#1138691]
  - kvm-qemu-img-Allow-cache-mode-specification-for-amend.patch [bz#1138691]
  - kvm-qemu-img-clarify-src_cache-option-documentation.patch [bz#1138691]
  - kvm-qemu-img-fix-rebase-src_cache-option-documentation.patch [bz#1138691]
  - kvm-qemu-img-fix-img_compare-flags-error-path.patch [bz#1138691]
  - kvm-ac97-register-reset-via-qom.patch [bz#1141667]
  - kvm-virtio-blk-Factor-common-checks-out-of-virtio_blk_ha.patch [bz#1085232]
  - kvm-virtio-blk-Bypass-error-action-and-I-O-accounting-on.patch [bz#1085232]
  - kvm-virtio-blk-Treat-read-write-beyond-end-as-invalid.patch [bz#1085232]
  - kvm-ide-Treat-read-write-beyond-end-as-invalid.patch [bz#1085232]
  - kvm-ide-only-constrain-read-write-requests-to-drive-size.patch [bz#1085232]
  - Resolves: bz#1085232
    (Ilegal guest requests on block devices pause the VM)
  - Resolves: bz#1088176
    (QEMU fail to check whether duplicate ID for block device drive using 'blockdev-add' to hotplug)
  - Resolves: bz#1138691
    (Allow qemu-img to bypass the host cache (check, compare, convert, rebase, amend))
  - Resolves: bz#1141667
    (Qemu crashed if reboot guest after hot remove AC97 sound device)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-80.el7
changelog:
  - kvm-dump-RHEL-specific-fix-for-CPUState-bug-introduced-b.patch [bz#1161563]
  - kvm-dump-guest-memory-Check-for-the-correct-return-value.patch [bz#1157798]
  - kvm-dump-const-qualify-the-buf-of-WriteCoreDumpFunction.patch [bz#1157798]
  - kvm-dump-add-argument-to-write_elfxx_notes.patch [bz#1157798]
  - kvm-dump-add-API-to-write-header-of-flatten-format.patch [bz#1157798]
  - kvm-dump-add-API-to-write-vmcore.patch [bz#1157798]
  - kvm-dump-add-API-to-write-elf-notes-to-buffer.patch [bz#1157798]
  - kvm-dump-add-support-for-lzo-snappy.patch [bz#1157798]
  - kvm-RPM-spec-build-qemu-kvm-with-lzo-and-snappy-enabled-.patch [bz#1157798]
  - kvm-dump-add-members-to-DumpState-and-init-some-of-them.patch [bz#1157798]
  - kvm-dump-add-API-to-write-dump-header.patch [bz#1157798]
  - kvm-dump-add-API-to-write-dump_bitmap.patch [bz#1157798]
  - kvm-dump-add-APIs-to-operate-DataCache.patch [bz#1157798]
  - kvm-dump-add-API-to-write-dump-pages.patch [bz#1157798]
  - kvm-dump-Drop-qmp_dump_guest_memory-stub-and-build-for-a.patch [bz#1157798]
  - kvm-dump-make-kdump-compressed-format-available-for-dump.patch [bz#1157798]
  - kvm-Define-the-architecture-for-compressed-dump-format.patch [bz#1157798]
  - kvm-dump-add-query-dump-guest-memory-capability-command.patch [bz#1157798]
  - kvm-dump-Drop-pointless-error_is_set-DumpState-member-er.patch [bz#1157798]
  - kvm-dump-fill-in-the-flat-header-signature-more-pleasing.patch [bz#1157798]
  - kvm-dump-simplify-write_start_flat_header.patch [bz#1157798]
  - kvm-dump-eliminate-DumpState.page_shift-guest-s-page-shi.patch [bz#1157798]
  - kvm-dump-eliminate-DumpState.page_size-guest-s-page-size.patch [bz#1157798]
  - kvm-dump-select-header-bitness-based-on-ELF-class-not-EL.patch [bz#1157798]
  - kvm-dump-hoist-lzo_init-from-get_len_buf_out-to-dump_ini.patch [bz#1157798]
  - kvm-dump-simplify-get_len_buf_out.patch [bz#1157798]
  - kvm-rename-parse_enum_option-to-qapi_enum_parse-and-make.patch [bz#1087724]
  - kvm-qapi-introduce-PreallocMode-and-new-PreallocModes-fu.patch [bz#1087724]
  - kvm-raw-posix-Add-falloc-and-full-preallocation-option.patch [bz#1087724]
  - kvm-qcow2-Add-falloc-and-full-preallocation-option.patch [bz#1087724]
  - kvm-vga-fix-invalid-read-after-free.patch [bz#1161890]
  - kvm-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch [bz#1140618]
  - kvm-vnc-sanitize-bits_per_pixel-from-the-client.patch [bz#1157645]
  - kvm-spice-call-qemu_spice_set_passwd-during-init.patch [bz#1138639]
  - kvm-block-raw-posix-Try-both-FIEMAP-and-SEEK_HOLE.patch [bz#1160237]
  - kvm-block-raw-posix-Fix-disk-corruption-in-try_fiemap.patch [bz#1160237]
  - kvm-block-raw-posix-use-seek_hole-ahead-of-fiemap.patch [bz#1160237]
  - kvm-raw-posix-Fix-raw_co_get_block_status-after-EOF.patch [bz#1160237]
  - kvm-raw-posix-raw_co_get_block_status-return-value.patch [bz#1160237]
  - kvm-raw-posix-SEEK_HOLE-suffices-get-rid-of-FIEMAP.patch [bz#1160237]
  - kvm-raw-posix-The-SEEK_HOLE-code-is-flawed-rewrite-it.patch [bz#1160237]
  - Resolves: bz#1087724
    ([Fujitsu 7.1 FEAT]: qemu-img should use fallocate() system call for "preallocation=full" option)
  - Resolves: bz#1138639
    (fail to login spice session with password + expire time)
  - Resolves: bz#1140618
    (Should replace "qemu-system-i386" by "/usr/libexec/qemu-kvm" in manpage of qemu-kvm for our official qemu-kvm build)
  - Resolves: bz#1157645
    (CVE-2014-7815 qemu-kvm: qemu: vnc: insufficient bits_per_pixel from the client sanitization [rhel-7.1])
  - Resolves: bz#1157798
    ([FEAT RHEL7.1]: qemu: Support compression for dump-guest-memory command)
  - Resolves: bz#1160237
    (qemu-img convert intermittently corrupts output images)
  - Resolves: bz#1161563
    (invalid QEMU NOTEs in vmcore that is dumped for multi-VCPU guests)
  - Resolves: bz#1161890
    ([abrt] qemu-kvm: pixman_image_get_data(): qemu-kvm killed by SIGSEGV)


