# changelog

author: Dogtag Team <pki-devel@redhat.com> 10.4.1-3
changelog:
  - ############################################################################
  - RHEL 7.4:
  - ############################################################################
  - Bugzilla Bug #1303683 - dogtag should support GSSAPI based auth in
    conjuction with FreeIPA (ftweedal)
  - Bugzilla Bug #1385208 - RHCS 9.1 RC5 CA in the certificate profiles the
    startTime parameter is not working as expected. (jmagne)
  - Bugzilla Bug #1419756 - CC: allow CA to process pre-signed CMC non-signing
    certificate requests (cfu)
  - Bugzilla Bug #1426754 - PKCS12: upgrade to at least AES and SHA2 (ftweedal)
  - Bugzilla Bug #1445088 - profile modification cannot remove existing config
    parameters (ftweedal)
  - Bugzilla Bug #1445535 - CC: Crypto Operation (AES Encryption/Decryption)
    (RHEL) (alee)
  - Bugzilla Bug #1446874 - Missing ClientIP and ServerIP in audit log when
    pki CLI terminates SSL connection (edewata)
  - Bugzilla Bug #1446875 - Session timeout for PKI console (RHEL) (edewata)
  - ############################################################################
  - RHCS 9.2:
  - ############################################################################
  - Bugzilla Bug #1404480 - CC: Crypto Operation (AES Encryption/Decryption)
    (RHCS) (alee)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-4
changelog:
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1386303 - cannot extract generated private key from KRA when
    HSM is used. (alee)
  - Bugzilla Bug #1446364 - pkispawn returns before tomcat is ready (cheimes)
  - Bugzilla Bug #1447145 - CMC: cmc.popLinkWitnessRequired=false would cause
    error (cfu)
  - Bugzilla Bug #1448203 - CAInfoService: retrieve KRA-related values from
    the KRA (ftweedal)
  - Bugzilla Bug #1448204 - pkispawn of clone install fails with
    InvalidBERException (ftweedal)
  - Bugzilla Bug #1448521 - kra unable to extract symmetric keys generated on
    thales hsm (alee)
  - Updated "jss" build and runtime requirements (mharmsen)
  - ##########################################################################
  - RHCS 9.2:
  - ##########################################################################
  - Bugzilla Bug #1274086 - [RFE] Add SCP03 support (RHCS) (jmagne)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-5
changelog:
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1419761 - CC: allow CA to process pre-signed CMC renewal
    non-signing cert requests (cfu)
  - Bugzilla Bug #1447080 - CC: CMC: allow enrollment key signed (self-signed)
    CMC with identity proof (cfu)
  - Bugzilla Bug #1447144 - CA brought down during separate KRA instance
    creation (mharmsen)
  - Bugzilla Bug #1448903 - exception Invalid module "--ignore-banner" when
    defined in ~/.dogtag/pki.conf and run pki pkcs12-import --help (edewata)
  - Bugzilla Bug #1450143 - CA installation with HSM in FIPS mode fails (jmagne)
  - Bugzilla Bug #1452123 - CA CS.cfg shows default port (mharmsen)
  - Bugzilla Bug #1452250 - Inconsistent CERT_REQUEST_PROCESSED event in
    ConnectorServlet. (edewata)
  - Bugzilla Bug #1452340 - Ensuring common audit log correctness (edewata)
  - Bugzilla Bug #1452344 - Adding serial number into CERT_REQUEST_PROCESSED
    audit event. (edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-7
changelog:
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1393633 - Creating symmetric key (sharedSecret)
    using tkstool is failing when RHEL 7.3 is in FIPS mode. (jmagne)
  - Bugzilla Bug #1445519 - CA Server installation with HSM fails
    (jmagne)
  - Bugzilla Bug #1452617 - Unable to create IPA Sub CA
    (ftweedal)
  - Bugzilla Bug #1454471 - Enabling all subsystems on startup
    (edewata)
  - Bugzilla Bug #1455617 - Key recovery on token fails because
    key record is not marked encrypted (alee)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-8
changelog:
  - Require "selinux-policy-targeted >= 3.13.1-159" as a runtime requirement
  - Require "tomcatjss >= 7.2.1-4" as a build and runtime requirement
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1400149 - pkispawn fails to create CA subsystem on FIPS
    enabled system (edewata)
  - Bugzilla Bug #1447144 - CA brought down during separate KRA instance
    creation (edewata)
  - Bugzilla Bug #1447762 - pkispawn fails occasionally with this failure
    ACCESS_SESSION_ESTABLISH_FAILURE (edewata)
  - Bugzilla Bug #1454450 - SubCA installation failure with 2 step
    installation in fips enabled mode (edewata)
  - Bugzilla Bug #1456597 - Certificate import using pki client-cert-import
    is asking for password when already provided (edewata)
  - Bugzilla Bug #1456940 - Build failure due to Pylint issues (cheimes)
  - Bugzilla Bug #1458043 - Key recovery using externalReg fails
    with java null pointer exception on KRA (alee)
  - Bugzilla Bug #1458379 - Upgrade script for keepAliveTimeout parameter
    (edewata)
  - Bugzilla Bug #1458429 - client-cert-import --ca-cert should
    import CA cert with trust bits "CT,C,C" (edewata)
  - ##########################################################################
  - RHCS 9.2:
  - ##########################################################################
  - Bugzilla Bug #1274086 - [RFE] Add SCP03 support (RHCS) (jmagne)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-9
changelog:
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1393633 - Creating symmetric key (sharedSecret)
    using tkstool is failing when RHEL 7.3 is in FIPS mode. (jmagne)
  - Bugzilla Bug #1419756 - CC: allow CA to process pre-signed CMC
    non-signing certificate requests (cfu)
  - Bugzilla Bug #1419777 - CC: allow CA to process pre-signed CMC
     revocation non-signing cert requests (cfu)
  - Bugzilla Bug #1458047 - change the way aes clients refer to
    aes keysets (alee)
  - Bugzilla Bug #1458055 - dont reuse IVs in the CMC code
    (alee)
  - Bugzilla Bug #1460028 - In keywrap mode, key recovery on
    KRA with HSM causes KRA to crash (ftweedal)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-10
changelog:
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1458043 - Key recovery on token fails with
    invalid public key error on KRA (alee)
  - Bugzilla Bug #1460764 - CC: CMC: check HTTPS client
    authentication cert against CMC signer (cfu)
  - Bugzilla Bug #1461533 - Unable to find keys in the p12 file after
    deleting the any of the subsystem certs from it (ftweedal)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-11
changelog:
  - Resolves: rhbz #1469432
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1469432 - CMC plugin default change
  - Resolves CVE-2017-7537
  - Fixes BZ #1470948


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-12
changelog:
  - Resolves: rhbz #1472615,1472617,1469447,1463350,1469449,1472619,1464970,1469437,1469439,1469446
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1472615 - CC: allow CA to process pre-signed CMC non-signing
    certificate requests (cfu)
    [PREVIOUS PATCH:  pki-core-beta.patch]
    [PREVIOUS PATCH:  pki-core-snapshot-4.patch]
  - Bugzilla Bug #1472617 - CMC: cmc.popLinkWitnessRequired=false would cause
    error (cfu)
    [PREVIOUS PATCH:  pki-core-post-beta.patch]
  - Bugzilla Bug #1469447 - CC: CMC: check HTTPS client authentication cert
    against CMC signer (cfu)
    [PREVIOUS PATCH:  pki-core-CMC-check-HTTPS-client-authentication-cert.patch]
  - Bugzilla Bug #1463350 - Access banner validation (edewata)
    [pki-core-server-access-banner-validation.patch]
  - Bugzilla Bug #1469449 - CC: allow CA to process pre-signed CMC renewal
    non-signing cert requests (cfu)
    [PREVIOUS PATCH:  pki-core-snapshot-1.patch]
    [pki-core-pre-signed-CMC-renewal-UniqueKeyConstraint.patch]
  - Bugzilla Bug #1472619 - Platform Dependent Python Import (mharmsen)
    [pki-core-platform-dependent-python-import.patch]
  - Bugzilla Bug #1464970 - CC: CMC: replace id-cmc-statusInfo with
    id-cmc-statusInfoV2 (cfu)
    [pki-core-CMC-id-cmc-statusInfoV2.patch]
  - Bugzilla Bug #1469437 - subsystem-cert-update command lacks --cert option
    (dmoluguw)
    [pki-core-subsystem-cert-update-CLI-cert-option.patch]
  - Bugzilla Bug #1469439 - Fix Key Changeover with HSM to support SCP03
    (jmagne)
    [pki-core-HSM-key-changeover-SCP03-support.patch]
  - Bugzilla Bug #1469446 - CC: need CMC enrollment profiles for system
    certificates (cfu)
    [pki-core-system-cert-CMC-enroll-profile.patch]


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-13
changelog:
  - Resolves: rhbz #1463350
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1463350 - Access banner validation (edewata)
    [pki-core-server-access-banner-retrieval-validation.patch]


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-5
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release
    (RHEL)
  - Bugzilla Bug #1466066 - CC: Secure removal of secret data storage
    (jmagne)
  - Bugzilla Bug #1518096 - ExternalCA: Failures in ExternalCA when tried to
    setup with CMC signed certificates (cfu)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-6
changelog:
  - Updated jss, nuxwdog, and openssl dependencies
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release
    (RHEL)
  - Bugzilla Bug #1402280 - CA Cloning: Failed to update number range in
    few cases (ftweedal)
  - Bugzilla Bug #1428021 - CC: shared token storage and retrieval
    mechanism (cfu)
  - Bugzilla Bug #1447145 - CMC: cmc.popLinkWitnessRequired=false
    would cause error (cfu)
  - Bugzilla Bug #1498957 - pkidestroy does not work with nuxwdog
     (alee)
  - Bugzilla Bug #1520277 - PR_FILE_NOT_FOUND_ERROR during
    pkispawn (alee)
  - Bugzilla Bug #1520526 - p12 admin certificate is missing when
    certificate is signed Externally (edewata)
  - Bugzilla Bug #1523410 - Unable to have non "pkiuser" owned CA
     instance (alee)
  - Bugzilla Bug #1523443 - HAProxy rejects OCSP responses due to
    missing nextupdate field (ftweedal)
  - Bugzilla Bug #1526881 - Not able to setup CA with ECC (mharmsen)
  - Bugzilla Bug #1532759 - pkispawn seems to be leaving our passwords
    in several different files after installation completes (alee)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-7
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - # Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release
    - Bugzilla Bug #1445532 - CC: Audit Events: Update the default audit event
    set (RHEL) (edewata)
  - Bugzilla Bug #1522938 - CC: Missing faillure resumption detection and
    audit event logging at startup (jmagne)
  - Bugzilla Bug #1523410 -  Unable to have non "pkiuser" owned CA instance
    (alee)
  - Bugzilla Bug #1525306 - CC: missing CMC request and response record
    (cfu)
  - Bugzilla Bug #1532933 - Installing subsystems with external CMC
    certificates in HSM environment shows import error (edewata)
  - Bugzilla Bug #1535797 - ExternalCA: Failures when installed with hsm
    (edewata)
  - Bugzilla Bug #1539125 - restrict default cipher suite to those ciphers
    permitted in fips mode (mharmsen)
  - Bugzilla Bug #1539198 - Inconsistent CERT_REQUEST_PROCESSED
    outcomes. (edewata)
  - Bugzilla Bug #1540440 - CMC: Audit Events needed for failures in
    SharedToken scenario's (cfu)
  - Bugzilla Bug #1541526 - CMC: Revocation works with an unknown
    revRequest.issuer (cfu)
  - Bugzilla Bug #1541853 - ProfileService: config values with
    backslashes have backslashes removed (ftweedal)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,
    - # Bugzilla Bug #1404075 - CC: Audit Events: Update the default audit
    - # Bugzilla Bug #1501436 - TPS CS.cfg should be reflected with the


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-8
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - # Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release
    - Bugzilla Bug #1542210 - pki console configurations that involves ldap
    passwords leave the plain text password in debug logs (jmagne)
  - Bugzilla Bug #1543242 - Regression in lightweight CA key replication
    (ftweedal)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-9
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - # Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release
    - Bugzilla Bug #1445532 - CC: Audit Events: Update the default audit event
    set (RHEL) (edewata)
  - Bugzilla Bug #1532867 - Inconsistent key ID encoding (edewata)
  - Bugzilla Bug #1540687 - CC: External OCSP Installation failure with HSM
    and FIPS (edewata)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,
    - # Bugzilla Bug #1404075 - CC: Audit Events: Update the default audit event


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-10
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1550581 - CMCAuth throws
    org.mozilla.jss.crypto.TokenException: Unable to insert certificate into
    temporary database [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1551067 - [MAN] Add --skip-configuration
    and --skip-installation into pkispawn man page. [rhel-7.5.z] (edewata)
  - Bugzilla Bug #1552241 - Make sslget aware of TLSv1_2 ciphers
    [rhel-7.5.z] (cheimes, mharmsen)
  - Bugzilla Bug #1553068 - Using a Netmask produces an odd entry
    in a certifcate [rhel-7.5.z] (ftweedal)
  - Bugzilla Bug #1554726 - Need ECC-specific Enrollment Profiles for
    standard conformance [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1554727 - Permit additional FIPS ciphers to be enabled
    by default for RSA . . . [rhel-7.5.z] (mharmsen, cfu)
  - Bugzilla Bug #1557880 - [MAN] Missing Man pages for tools
    CMCRequest, CMCResponse, CMCSharedToken [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1557883 - Console: Adding ACL from pki-console gives
    StringIndexOutOfBoundsException [rhel-7.5.z] (ftweedal)
  - Bugzilla Bug #1558919 - Not able to generate certificate request
    with ECC using pki client-cert-request [rhel-7.5.z] (akahat)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1560233 - libtps does not directly depend on libz


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-11
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1554726 - Need ECC-specific Enrollment Profiles for
    standard conformance [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1557880 - [MAN] Missing Man pages for tools
    CMCRequest, CMCResponse, CMCSharedToken [rhel-7.5.z] (cfu)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1560233 - libtps does not directly depend on libz


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-12
changelog:
  - Updated "jss" build and runtime requirements (mharmsen)
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1571582 - [MAN] Missing Man pages for tools CMCRequest,
    CMCResponse, CMCSharedToken (typos) [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1572548 - IPA install with external-CA is failing when
    FIPS mode enabled. [rhel-7.5.z] (edewata)
  - Bugzilla Bug #1574848 - servlet profileSubmitCMCSimple throws NPE
    [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1575521 - subsystem -> subsystem SSL handshake issue
    with TLS_ECDHE_RSA_* on Thales HSM [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1581134 - ECC installation for non CA subsystems needs
    improvement [rhel-7.5.z] (jmagne)
  - Bugzilla Bug #1581135 - SAN in internal SSL server certificate in
    pkispawn configuration step [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1581167 - CC: CMC profiles: Some CMC profiles have wrong
    input class_id [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1581382 - ECDSA Certificates Generated by Certificate System
    9.3 fail NIST validation test with parameter field. [rhel-7.5.z] (cfu)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-13
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1553068 - Using a Netmask produces an odd
    entry in a certifcate [rhel-7.5.z] (ftweedal)
  - Bugzilla Bug #1585945 - CMC CRMF requests result in
    InvalidKeyFormatException when signing algorithm is ECC
    [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1587826 - ExternalCA: Installation failed during
    csr generation with ecc [rhel-7.5.z] (rrelyea, gkapoor)
  - Bugzilla Bug #1588944 - Cert validation for installation with
    external CA cert [rhel-7.5.z] (edewata)
  - Bugzilla Bug #1588945 - CRMFPopClient tool - should allow
    option to do no key archival (cfu)
  - Bugzilla Bug #1589307 - CVE-2018-1080 pki-core: Mishandled
    ACL configuration in AAclAuthz.java reverses rules that allow
    and deny access [rhel-7.5.z] (ftweedal, cfu)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-14
changelog:
  - Updated "jss" build and runtime requirements (mharmsen)
  - Updated "tomcatjss" build and runtime requirements (mharmsen)
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1574848 - servlet profileSubmitCMCSimple throws NPE
    [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1593585 - Need proper default subjectDN for CMC request
    authenticated through SharedToken [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1594128 - CMC: Audit Events needed for failures in
    SharedToken scenario's [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1595606 - AuditVerify failure due to line breaks
    [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1596525 - Address ECC profile overrides [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1596551 - X500Name.directoryStringEncodingOrder overridden
    by CSR encoding [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1553068 - Using a Netmask produces an odd entry in a
    certifcate [rhel-7.5.z] (ftweedal)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-15
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1600905 - pki console configurations that involves ldap
    passwords leave the plain text password in signed audit logs
    [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1611245 - Certificate generation happens with partial
    attributes in CMCRequest file [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1611250 - Better understanding of
    NSS_USE_DECODED_CKA_EC_POINT for ECC [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1612880 - CMC Revocations throws exception with
    same reqIssuer & certissuer [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1614837 - ipa-replica-install --setup-kra broken on
    DL0 with latest version [rhel-7.5.z] (abokovoy)
  - Bugzilla Bug #1614839 - CC: Enable all config audit events
    [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1615266 - ECC keys not supported for signing audit
    logs [rhel-7.5.z] (cfu)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1539933 - keyGen fails when only Identity


author: Dogtag Team <pki-devel@redhat.com> 10.5.0-1
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release
    (RHEL)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - #Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.9-7
changelog:
  - Require "tomcatjss >= 7.2.1-8" as a build and runtime requirement
  - ##########################################################################
  - # RHEL 7.6:
  - ##########################################################################
  - Bugzilla Bug #1632116 - CC: missing audit event for CS acting as
    TLS client [rhel-7.6.z] (cfu)
  - Bugzilla Bug #1632120 - Unsupported RSA_ ciphers should be
    removed from the default ciphers list [rhel-7.6.z] (cfu)
  - Bugzilla Bug #1632615 - Permit certain SHA384 FIPS ciphers to be
    enabled by default for RSA and ECC . . . [rhel-7.6.z] (cfu)
  - Bugzilla Bug #1632616 - X500Name.directoryStringEncodingOrder
    overridden by CSR encoding (coverity changes) [rhel-7.6.z] (mharmsen)
  - Bugzilla Bug #1633104 - CMC: add config to allow non-clientAuth
    [rhel-7.6.z] (cfu)
  - Bugzilla Bug #1636490 - Installation of CA using an existing CA fails
    [rhel-7.6.z] (edewata)
  - Bugzilla Bug #1643878 - pki cli command for RHCS doesn't prompt for
    a password [rhel-7.6.z] (edewata)
  - Bugzilla Bug #1643879 - CC: Identify version/release of pki-ca, pki-kra,
    pki-ocsp, pki-tks, and pki-tps remotely [RHEL] [rhel-7.6.z] (cfu, jmagne)
  - Bugzilla Bug #1643880 - PKI subsystem process is not shutdown when
    there is no space on the disk to write logs [rhel-7.6.z] (edewata)
  - ##########################################################################
  - # RHCS 9.4:
  - ##########################################################################
  - # Bugzilla Bug #1639836 - CC: Identify RHCS version of CA, KRA,


author: Dogtag Team <pki-devel@redhat.com> 10.5.9-8
changelog:
  - ##########################################################################
  - # RHEL 7.6:
  - ##########################################################################
  - Bugzilla Bug #1645262 - pkidestroy may not remove all files [rhel-7.6.z]
    (dmoluguw)
  - Bugzilla Bug #1645263 - Auth plugins leave passwords in the access
    log and audit log using REST [rhel-7.6.z] (dmoluguw)
  - Bugzilla Bug #1645429 - pkispawn fails due to name collision with
    /var/log/pki/<instance> [rhel-7.6.z] (dmoluguw)
  - Bugzilla Bug #1655951 - CC: tools supporting CMC requests output
    keyID needs to be captured in file [rhel-7.6.z] (cfu)
  - Bugzilla Bug #1656297 - Unable to install with admin-generated keys
    [rhel-7.6.z] (edewata)
  - ##########################################################################
  - # RHCS 9.4:
  - ##########################################################################
  - # Bugzilla Bug #1639836 - CC: Identify RHCS version of CA, KRA,


author: Dogtag Team <pki-devel@redhat.com> 10.5.9-9
changelog:
  - ##########################################################################
  - # RHEL 7.6:
  - ##########################################################################
  - Bugzilla Bug #1657922 - CC: CA/OCSP startup fail on SystemCertsVerification
    if enableOCSP is true [rhel-7.6.z] (jmagne)
  - ##########################################################################
  - # RHCS 9.4:
  - ##########################################################################
  - # Bugzilla Bug #1639836 - CC: Identify RHCS version of CA, KRA,


author: Dogtag Team <pki-devel@redhat.com> 10.5.9-10
changelog:
  - ##########################################################################
  - # RHEL 7.6:
  - ##########################################################################
  - Bugzilla Bug #1659939 - CC: Simplifying Web UI session timeout
    configuration [rhel-7.6.z] (edewata)
  - ##########################################################################
  - # RHCS 9.4:
  - ##########################################################################
  - # Bugzilla Bug #1639836 - CC: Identify RHCS version of CA, KRA,
    - # Added Batch Update Information to Product Version (mharmsen)


author: Dogtag Team <pki-devel@redhat.com> 10.5.9-11
changelog:
  - Updated jss dependencies
  - ##########################################################################
  - # RHEL 7.6:
  - ##########################################################################
  - Bugzilla Bug #1671245 - CC: unable to verify cert before import
    [rhel-7.6.z] (ascheel)
  - Bugzilla Bug #1671303 - CC: Upgrade scripts for audit event names (RHEL)
    [rhel-7.6.z] (edewata)
  - ##########################################################################
  - # RHCS 9.4:
  - ##########################################################################
  - # Bugzilla Bug #1671586 - CC: Upgrade scripts for audit event names (RHCS)


author: Dogtag Team <pki-devel@redhat.com> 10.5.9-13
changelog:
  - Updated jss dependencies
  - ##########################################################################
  - # RHEL 7.6:
  - ##########################################################################
  - Bugzilla Bug #1671245 - CC: unable to verify cert before import
    [rhel-7.6.z] [manpage] (ascheel)
  - Bugzilla Bug #1671303 - CC: Upgrade scripts for audit event names (RHEL)
    [rhel-7.6.z] (edewata)
  - ##########################################################################
  - # RHCS 9.4:
  - ##########################################################################
  - # Bugzilla Bug #1671586 - CC: Upgrade scripts for audit event names (RHCS)


author: Dogtag Team <pki-devel@redhat.com> 10.5.16-1
changelog:
  - Updated jss dependencies
  - ##########################################################################
  - # RHEL 7.7:
  - ##########################################################################
  - Bugzilla Bug #1633422 - Rebase pki-core from 10.5.1 to 10.5.16 (RHEL) 
  - ##########################################################################
  - # RHCS 9.5:
  - ##########################################################################
  - # Bugzilla Bug #1633423 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.16-2
changelog:
  - ##########################################################################
  - # RHEL 7.7:
  - ##########################################################################
  - Bugzilla Bug #1491453 - Need Method to Include SKI in CA Signing
    Certificate Request [ftweedal]
  - ##########################################################################
  - # RHCS 9.5:
  - ##########################################################################
  - # Bugzilla Bug #1633423 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.16-3
changelog:
  - ##########################################################################
  - # RHEL 7.7:
  - ##########################################################################
  - Bugzilla Bug #1638379 - PKI startup initialization process should not
    depend on LDAP operational attributes [ftweedal]
  - ##########################################################################
  - # RHCS 9.5:
  - ##########################################################################
  - Bugzilla Bug #1633423 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.16 in RHCS 9.5


author: Dogtag Team <pki-devel@redhat.com> 10.5.16-4
changelog:
  - ##########################################################################
  - # RHEL 7.7:
  - ##########################################################################
  - Bugzilla Bug #1743122 - RHCS-9 CA clone SSL server cert not issued with its
    custom SAN extension, RHEL-7.6 and HSM [rhel-7.7.z] (edewata)
  - ##########################################################################
  - # RHCS 9.5:
  - ##########################################################################
  - # Bugzilla Bug #1633423 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.16-5
changelog:
  - ##########################################################################
  - # RHEL 7.7:
  - ##########################################################################
  - Bugzilla Bug #1750277 - CC: missing audit event for CS acting as TLS client
    [rhel-7.7.z] (cfu)
  - ##########################################################################
  - # RHCS 9.5:
  - ##########################################################################
  - # Bugzilla Bug #1633423 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.16-6
changelog:
  - ##########################################################################
  - # RHEL 7.7:
  - ##########################################################################
  - Bugzilla Bug #1754845 - number range depletion when multiple clones
    created from same master (ftweedal)
  - ##########################################################################
  - # RHCS 9.5:
  - ##########################################################################
  - # Bugzilla Bug #1633423 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.16-3
changelog:
  - ##########################################################################
  - # RHEL 7.7:
  - ##########################################################################
  - Bugzilla Bug #1638379 - PKI startup initialization process should not
    depend on LDAP operational attributes [ftweedal]
  - ##########################################################################
  - # RHCS 9.5:
  - ##########################################################################
  - # Bugzilla Bug #1633423 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.17-1
changelog:
  - Updated jss, nuxwdog, and tomcatjss dependencies
  - ##########################################################################
  - # RHEL 7.8:
  - ##########################################################################
  - Bugzilla Bug #1733586 - Rebase pki-core from 10.5.16 to 10.5.17 (RHEL)
  - ##########################################################################
  - # RHCS 9.6:
  - ##########################################################################
  - # Bugzilla Bug #1718418 - Update RHCS version of CA, KRA, OCSP, and TKS so
    - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.17-2
changelog:
  - ##########################################################################
  - # RHEL 7.8:
  - ##########################################################################
  - Bugzilla Bug #1523330 - CC: missing audit event for CS acting as TLS
    client (cfu)
  - Bugzilla Bug #1597727 - CA - Unable to change a certificate’s revocation
    reason from superceded to key_compromised (rhcs-maint)
  - ##########################################################################
  - # RHCS 9.6:
  - ##########################################################################
  - # Bugzilla Bug #1470410 - TPS doesn't update revocation status when
    - # Bugzilla Bug #1470433 - Add supported transitions to TPS (rhcs-maint)
  - # Bugzilla Bug #1585722 - TMS - PKISocketFactory – Modify Logging to Allow
    - # Bugzilla Bug #1642577 - TPS – Revoked Encryption Certificates Marked as


author: Dogtag Team <pki-devel@redhat.com> 10.5.17-3
changelog:
  - ##########################################################################
  - # RHEL 7.8:
  - ##########################################################################
  - Bugzilla Bug #1445479 - KRATool does not support netkeyKeyRecovery
    attribute (dmoluguw)
  - Bugzilla Bug #1534013 - Attempting to add new keys using a PUT KEY APDU
    to a token that is loaded only with the default/factory keys (Key Version
    Number 0xFF) returns an APDU with error code 0x6A88. (jmagne)
  - Bugzilla Bug #1709585 - PKI (test support) for PKCS#11 standard
    AES KeyWrap for HSM support (cfu, ftweedal)
  - Bugzilla Bug #1748766 - number range depletion when multiple clones
    created from same master (ftweedal)
  - ##########################################################################
  - # RHCS 9.6:
  - ##########################################################################
  - # Bugzilla Bug #1520258 - TPS token search fails to find entries , LDAP filter
    - # Bugzilla Bug #1535671 - RFE to have the users be able to use the


author: Dogtag Team <pki-devel@redhat.com> 10.5.17-5
changelog:
  - ##########################################################################
  - # RHEL 7.8:
  - ##########################################################################
  - Bugzilla Bug #1523330 - CC: missing audit event for CS acting as TLS client
    (cfu)
  - ##########################################################################
  - # RHCS 9.6:
  - ##########################################################################
  - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.17-6
changelog:
  - ##########################################################################
  - # RHEL 7.8:
  - ##########################################################################
  - Bugzilla Bug #1723008 - ECC Key recovery failure with
    CKR_TEMPLATE_INCONSISTENT (cfu)
  - Bugzilla Bug #1774282 - pki-server-nuxwdog template has pid file name with
    non-breakable space char encoded instead of 0x20 space char (ascheel)
  - ##########################################################################
  - # RHCS 9.6:
  - ##########################################################################
  - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-3
changelog:
  - Updated jss dependencies
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug #1794213 - Server-Side keygen Enrollment for EE (cfu)
  - Bugzilla Bug #1809273 - CRL generation performs an unindexed search (jmagne)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - # Bugzilla Bug #1549307 - No default TPS Auditor group (ascheel)


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-4
changelog:
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug #1794213 - Server-Side keygen Enrollment for EE
    additional support and touch-up (cfu)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - # Bugzilla Bug #1710975 - TPS - Searching the certificate DB for a brand new


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-6
changelog:
  - Patch for CMC Credential Error, RSA PSS typo, and new profile
    for directory-authentication-based Server-Side keygen
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug #1710109 - add RSA PSS support (jmagne)
  - Bugzilla Bug #1794213 - Server-Side keygen Enrollment for EE (cfu)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-7
changelog:
  - Patch for CMCResponse tool
  - Bugzilla Bug #1710109 - add RSA PSS support - fix CMCResponse tool (jmagne)


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-8
changelog:
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug #1883639 - add profile caAuditSigningCert (cfu)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - # Bugzilla Bug #1710978 - TPS - Add logging to tdbAddCertificatesForCUID if
    - # Bugzilla Bug #1858860 - TPS - Update Error Codes returned to client
    - # Bugzilla Bug #1858861 - TPS - Server side key generation is not working
    - # Bugzilla Bug #1858867 - TPS does not check token cuid on the user


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-9
changelog:
  - Bugzilla Bug #1883639 - additional support on upgrade for audit
    cert profile and auditProfileUpgrade + auditProfileUpgrade part 2 (cfu)


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-11
changelog:
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug 1883639 - Add KRA Transport and Storage Certificates
    profiles, audit for IPA (edewata)
  - ##########################################################################
  - # Backported CVEs (ascheel):
  - ##########################################################################
  - Bugzilla Bug 1724697 - CVE-2019-10180 pki-core: unsanitized token
    parameters in TPS resulting in stored XSS [certificate_system_9-default]
    (edewata, ascheel)
  - Bugzilla Bug 1725128 - CVE-2019-10178 pki-core: stored Cross-site
    scripting (XSS) in the pki-tps web Activity tab
    [certificate_system_9-default] (edewata, ascheel)
  - Bugzilla Bug 1791100 - CVE-2020-1696 pki-core: Stored XSS in TPS profile
    creation [certificate_system_9-default] (edewata, ascheel)
  - Bugzilla Bug 1724688 - CVE-2019-10146 pki-core: Reflected Cross-Site
    Scripting in 'path length' constraint field in CA's Agent page
    [rhel-7.9.z] (dmoluguw, ascheel)
  - Bugzilla Bug 1789843 - CVE-2019-10221 pki-core: reflected cross site
    scripting in getcookies?url= endpoint in CA [rhel-7.9.z]
    (dmoluguw, ascheel)
  - Bugzilla Bug 1724713 - CVE-2019-10179 pki-core: pki-core/pki-kra:
    Reflected XSS in recoveryID search field at KRA's DRM agent page in
    authorize recovery tab [rhel-7.9.z] (ascheel)
  - Bugzilla Bug 1798011 - CVE-2020-1721 pki-core: KRA vulnerable to
    reflected XSS via the getPk12 page [rhel-7.9.z] (ascheel,jmagne)
  - ##########################################################################
  - Update to jquery v3.4.1 (ascheel)
  - Update to jquery-i18n-properties v1.2.7 (ascheel)
  - Update to backbone v1.4.0 (ascheel)
  - Upgrade to underscore v1.9.2 (ascheel)
  - Update to patternfly v3.59.3 (ascheel)
  - Update to jQuery v3.5.1 (ascheel)
  - Upgrade to bootstrap v3.4.1 (ascheel)
  - Link in new Bootstrap CSS file (ascheel)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-12
changelog:
  - Change variable 'TPS' to 'tps'
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug 1883639 - Add KRA Transport and Storage Certificates
    profiles, audit for IPA (edewata)
  - ##########################################################################
  - # Backported CVEs (ascheel):
  - ##########################################################################
  - Bugzilla Bug 1724697 - CVE-2019-10180 pki-core: unsanitized token
    parameters in TPS resulting in stored XSS [certificate_system_9-default]
    (edewata, ascheel)
  - Bugzilla Bug 1725128 - CVE-2019-10178 pki-core: stored Cross-site
    scripting (XSS) in the pki-tps web Activity tab
    [certificate_system_9-default] (edewata, ascheel)
  - Bugzilla Bug 1791100 - CVE-2020-1696 pki-core: Stored XSS in TPS profile
    creation [certificate_system_9-default] (edewata, ascheel)
  - Bugzilla Bug 1724688 - CVE-2019-10146 pki-core: Reflected Cross-Site
    Scripting in 'path length' constraint field in CA's Agent page
    [rhel-7.9.z] (dmoluguw, ascheel)
  - Bugzilla Bug 1789843 - CVE-2019-10221 pki-core: reflected cross site
    scripting in getcookies?url= endpoint in CA [rhel-7.9.z]
    (dmoluguw, ascheel)
  - Bugzilla Bug 1724713 - CVE-2019-10179 pki-core: pki-core/pki-kra:
    Reflected XSS in recoveryID search field at KRA's DRM agent page in
    authorize recovery tab [rhel-7.9.z] (ascheel)
  - Bugzilla Bug 1798011 - CVE-2020-1721 pki-core: KRA vulnerable to
    reflected XSS via the getPk12 page [rhel-7.9.z] (ascheel,jmagne)
  - ##########################################################################
  - Update to jquery v3.4.1 (ascheel)
  - Update to jquery-i18n-properties v1.2.7 (ascheel)
  - Update to backbone v1.4.0 (ascheel)
  - Upgrade to underscore v1.9.2 (ascheel)
  - Update to patternfly v3.59.3 (ascheel)
  - Update to jQuery v3.5.1 (ascheel)
  - Upgrade to bootstrap v3.4.1 (ascheel)
  - Link in new Bootstrap CSS file (ascheel)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-13
changelog:
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug 1949136 - PKI instance creation failed with new 389-ds-base
    build (jmagne)
  - Bugzilla Bug 1949656 - CRMF requests with extensions other than SKID cannot
    be processed (cfu)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 6)


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-14
changelog:
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug 1911472 - Revoke via REST API not working when Agent
    certificate not issued by CA [rhel-7.9.z] (cfu)
  - Bugzilla Bug 1914587 - RHEL IPA PKI - Failed to read product version
    String.java.io.FileNotFoundException (ckelley)
  - Bugzilla Bug 1942687 - TPS not populating Token Policy, or switching
    PIN_RESET=YES to NO [rhel-7.9.z] (jmagne)
  - Bugzilla Bug 1955633 - Recovery of Keys migrated to latest version of KRA
    fail to recover and result in Null Point Exception [rhel-7.9.z] (jmagne)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 6)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-15
changelog:
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug 1905374 - restrict EE profile list and enrollment submission
    per LDAP group without immediate issuance [rhel-7.9.z] (cfu)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-16
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 8):
  - ##########################################################################
  - Bugzilla Bug 1958277 - PKCS10Client EC Attribute Encoding [cfu]
  - Bugzilla Bug 1958788 - ipa: ERROR: Request failed with status 500:
    Non-2xx response from CA REST API: 500 [ftweedale, ckelley]
  - ##########################################################################
  - # RHCS 9.7 (Batch Update 8):
  - ##########################################################################
  - Bugzilla Bug 1959937 - TPS Allowing Token Transactions while
    the CA is Down [cfu]
  - Bugzilla Bug 1979710 - TPS Not properly enforcing Token Profile
    Separation [cfu]


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-17
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 8):
  - ##########################################################################
  - Bugzilla Bug 1958788 - ipa: ERROR: Request failed with status 500: Non-2xx
    response from CA REST API: 500 [ftweedal, ckelley]
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-17
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 9):
  - ##########################################################################
  - Bugzilla Bug 1958788 - ipa: ERROR: Request failed with status 500: Non-2xx
    response from CA REST API: 500 [ftweedal, ckelley]
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-18
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 10):
  - ##########################################################################
  - Bugzillla Bug 1978345 - End Entity's List Certificates Page Back/Forward
    Buttons are Broken (ckelley, jonahon.d.parrish@mail.mil, mharmsen)
  - Bugzilla Bug 2008707 - pkispawn bails out too easily for things that could
    have been worked around after installation [RHEL 7.9.z] (cfu)
  - Bugzilla Bug 2016773 - Directory authentication plugin requires directory
    admin password just for user authentication (rhel-7.9.z)
    (awnuk@purestorage.com, jmagne)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-19
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 11):
  - ##########################################################################
  - Bugzilla Bug 1998597 - TPS RA Separation Issues (cfu)
  - Bugzilla Bug 2008319 - PKISpawn with ECC Signing Algorithms fail
    in FIPS Mode (cfu)
  - Bugzilla Bug 2018608 - Invalid certificates with creation of subCA
    (pkispawn single step) [rhel-7.9.0.z] (cfu)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-20
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 14):
  - ##########################################################################
  - Bugzilla Bug #2074722 - user password and pkcs12 password exposure when
    debug level set to maximum [RHEL 7.9.z] (cfu)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-21
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 15):
  - ##########################################################################
  - Bugzilla Bug #2074722 - user password and pkcs12 password exposure when
    debug level set to maximum [RHEL 7.9.z] (cfu)
  - Bugzilla Bug #2082717 - SCEP manual approval failure (cfu)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-22
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 17):
  - ##########################################################################
  - Bugzilla Bug #2107329 - CVE-2022-2414 pki-core: access to external
    entities when parsing XML can lead to XXE [rhel-7.9.z] (ckelley, mharmsen)
  - Bugzilla Bug #2111514 - CVE-2022-2393 pki-core: When using the
    caServerKeygen_DirUserCert profile, user can get certificates for other
    UIDs by entering name in Subject field [rhel-7.9] (cfu, ckelley)
  - ##########################################################################
  - # RHCS 9.7 (Batch Update 17):
  - ##########################################################################
  - Bugzilla Bug #2107325 - CVE-2022-2414 pki-core: access to external
    entities when parsing XML can lead to XXE [certificate_system_9.7.z]
    (ckelley, mharmsen)
  - Bugzilla Bug #2111493 - CVE-2022-2393 pki-core: When using the
    caServerKeygen_DirUserCert profile, user can get certificates for other
    UIDs by entering name in Subject field [rhcs_9.7] (cfu, ckelley)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-23
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 18):
  - ##########################################################################
  - Bugzilla Bug #2107329 - CVE-2022-2414 pki-core: access to external
    entities when parsing XML can lead to XXE [rhel-7.9.z] (ckelley, mharmsen)
  - Bugzilla Bug #2111514 - CVE-2022-2393 pki-core: When using the
    caServerKeygen_DirUserCert profile, user can get certificates for other
    UIDs by entering name in Subject field [rhel-7.9] (cfu, ckelley)
  - ##########################################################################
  - # RHCS 9.7 (Batch Update 18):
  - ##########################################################################
  - Bugzilla Bug #2107325 - CVE-2022-2414 pki-core: access to external
    entities when parsing XML can lead to XXE [certificate_system_9.7.z]
    (ckelley, mharmsen)
  - Bugzilla Bug #2111493 - CVE-2022-2393 pki-core: When using the
    caServerKeygen_DirUserCert profile, user can get certificates for other
    UIDs by entering name in Subject field [rhcs_9.7] (cfu, ckelley)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-24
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 19):
  - ##########################################################################
  - Bugzilla Bug #2107329 - CVE-2022-2414 pki-core: access to external
    entities when parsing XML can lead to XXE [rhel-7.9.z] (ckelley, mharmsen)
  - ##########################################################################
  - # RHCS 9.7 (Batch Update 19):
  - ##########################################################################
  - Bugzilla Bug #2107325 - CVE-2022-2414 pki-core: access to external
    entities when parsing XML can lead to XXE [certificate_system_9.7.z]
    (ckelley, mharmsen)


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-1
changelog:
  - Updated jss dependencies
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug #1774174 - Rebase pki-core from 10.5.17 to 10.5.18 (RHEL)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - # Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    - # Bugzilla Bug #1774181 - Update RHCS version of CA, KRA, OCSP, and TKS so


author: Dogtag Team <pki-devel@redhat.com> 10.5.9-4
changelog:
  - ##########################################################################
  - # RHEL 7.6:
  - ##########################################################################
  - Bugzilla Bug #1548203 - pki console configurations that involves ldap
    passwords leave the plain text password in signed audit logs (cfu)
  - ##########################################################################
  - # RHCS 9.4:
  - ##########################################################################
  - # Bugzilla Bug #1494591 - keyGen fails when only Identity


author: Dogtag Team <pki-devel@redhat.com> 10.5.9-5
changelog:
  - ##########################################################################
  - # RHEL 7.6:
  - ##########################################################################
  - Bugzilla Bug #1596629 - ipa-replica-install --setup-kra broken on DL0
    with latest version (abokovoy)
  - ##########################################################################
  - # RHCS 9.4:
  - ##########################################################################
  - # Bugzilla Bug #1557570 - Re-base pki-core from 10.5.1 to


author: Dogtag Team <pki-devel@redhat.com> 10.5.9-6
changelog:
  - Updated nuxwdog dependencies
  - ##########################################################################
  - # RHEL 7.6:
  - ##########################################################################
  - Bugzilla Bug #673182 - ECC keys not supported for signing
    audit logs (cfu)
  - Bugzilla Bug #1593805 - Better understanding of
    NSS_USE_DECODED_CKA_EC_POINT for ECC (cfu)
  - Bugzilla Bug #1601071 - Certificate generation happens with
    partial attributes in CMCRequest file (cfu)
  - Bugzilla Bug #1601569 - CC: Enable all config audit events
    (cfu)
  - Bugzilla Bug #1608375 - CMC Revocations throws exception
    with same reqIssuer & certissuer (cfu)
  - ##########################################################################
  - # RHCS 9.4:
  - ##########################################################################
  - # Bugzilla Bug #1557570 - Re-base pki-core from 10.5.1 to


author: Dogtag Team <pki-devel@redhat.com> 10.5.9-1
changelog:
  - ##########################################################################
  - # RHEL 7.6:
  - ##########################################################################
  - Bugzilla Bug #1538311 - Using a Netmask produces an odd
    entry in a certifcate (ftweedal)
  - Bugzilla Bug #1544843 - ExternalCA: Installation failed during
    csr generation with ecc (rrelyea, gkapoor)
  - Bugzilla Bug #1557569 - Re-base pki-core from 10.5.1 to latest
    upstream 10.5.x (RHEL) (mharmsen)
  - Bugzilla Bug #1580394 - CMC CRMF requests result in
    InvalidKeyFormatException when signing algorithm is ECC (cfu)
  - Bugzilla Bug #1580527 - CVE-2018-1080 pki-core: Mishandled
    ACL configuration in AAclAuthz.java reverses rules that allow
    and deny access (ftweedal, cfu)
  - Bugzilla Bug #1585866 - CRMFPopClient tool - should allow
    option to do no key archival (cfu)
  - Bugzilla Bug #1588655 - Cert validation for installation with
    external CA cert (edewata)
  - ##########################################################################
  - # RHCS 9.4:
  - ##########################################################################
  - # Bugzilla Bug #1557570 - Re-base pki-core from 10.5.1 to


author: Dogtag Team <pki-devel@redhat.com> 10.5.9-2
changelog:
  - ##########################################################################
  - # RHEL 7.6:
  - ##########################################################################
  - Bugzilla Bug #1471935 - X500Name.directoryStringEncodingOrder overridden
    by CSR encoding (cfu)
  - Bugzilla Bug #1538311 - Using a Netmask produces an odd entry in a
    certificate (ftweedal)
  - Bugzilla Bug #1540440 - CMC: Audit Events needed for failures in
    SharedToken scenario's (cfu)
  - Bugzilla Bug #1550742 - Address ECC profile overrides (cfu)
  - Bugzilla Bug #1562841 - servlet profileSubmitCMCSimple throws NPE (cfu)
  - Bugzilla Bug #1572432 - AuditVerify failure due to line breaks (cfu)
  - Bugzilla Bug #1592961 - Need proper default subjectDN for CMC request
    authenticated through SharedToken (cfu)
  - ##########################################################################
  - # RHCS 9.4:
  - ##########################################################################
  - # Bugzilla Bug #1557570 - Re-base pki-core from 10.5.1 to


author: Ray Strode <rstrode@redhat.com> 0.8.9-0.3.20140113
changelog:
  - Read OS string from REDHAT_BUGZILLA_PRODUCT instead of PRETTY_NAME
    in /etc/os-release to work around a lorax bug.
    Resolves: #911553
  - Fix text splash when explicitly configured by user
    Related: #911553
    Related: #1026571


author: Ray Strode <rstrode@redhat.com> 0.8.9-0.9.20140113
changelog:
  - Ignore early fb devices
    Resolves: #1063758
    Resolves: #1064235
    Resolves: #1066641
  - Ignore udev if using lone serial console
    Resolves: #1058049
  - Fix password at start up race
    Resolves: #1070707
    Resolves: #1073145


author: Ray Strode <rstrode@redhat.com> - 0.8.9-0.25.20140113
changelog:
  - Read OS string from PRETTY_NAME instead of REDHAT_BUGZILLA_PRODUCT
    again, this time munging it to get rid of parts we want to hide.
    Related: #911553
    Resolves: #1306543


author: Ray Strode <rstrode@redhat.com> - 0.8.9-0.26.20140113
changelog:
  - Fix color of text progress bar
    Related: #1167735
  - Fix escape key during media check of live image
    Resolves: #1167735


author: Ray Strode <rstrode@redhat.com> - 0.8.9-0.28.20140113
changelog:
  - Don't change file mode of boot.log.  Instead, remember what mode
    the admin set it to.
    Related: #916704
  - Don't unlink boot.log before opening it.
    Related: #916704


author: Ray Strode <rstrode@redhat.com> - 0.8.9-0.29.20140113
changelog:
  - Fall back to text mode if /dev/dri/card0 can't modeset
    Resolves: #1431141
  - Remove unnecessary post scripts that rpm -V output
    Resolves: #1266085


author: Tim Waugh <twaugh@redhat.com> - 1:1.04-19
changelog:
  - Consistent use of macros.
  - Removed ancient obsoletes tag.
  - Clean buildroot in install section not prep section.
  - Make setup quiet.
  - Use noreplace for config files.


author: Lokesh Mandvekar <lsm5@redhat.com> - 0.11.1-1.gita4adfe5
changelog:
  - bump to v0.11.1
  - subpackage podman-docker
  - built libpod commit a4adfe5
  - built conmon from cri-o commit 464dba6


author: Lokesh Mandvekar <lsm5@redhat.com> - 0.4.1-2.gitb51d327
changelog:
  - add containernetworking-plugins v0.7.0 as a subpackage (podman dep)
  - release tag for the containernetworking-plugins is actually gotten from
  podman release tag.


author: Lokesh Mandvekar <lsm5@redhat.com> - 0.6.1-1.git3e0ff12
changelog:
  - Resolves: #1584429 - drop capabilities when running a container as non-root
  - bump to v0.6.1
  - built podman commit 3e0ff12
  - built conmon from cri-o commit 1c0c3b0
  - drop containernetworking-plugins subpackage, it's now split out into a standalone
  package


author: Lokesh Mandvekar <lsm5@redhat.com> - 1.1.2-2.git0ad9b6b
changelog:
  - system renumber when upgrading from version lower than 1.1
  - centos build envs don't have make by default


author: Jindrich Novy <jnovy@redhat.com> - 1.6.4-9
changelog:
  - fix "Podman support for FIPS Mode requires a bind mount inside the container"
  - Resolves: #1804189


author: Jindrich Novy <jnovy@redhat.com> - 1.6.4-12
changelog:
  - fix "Podman can't reuse a container name, even if the container that was using it is no longer around"
  - Resolves: #1807437


author: Jindrich Novy <jnovy@redhat.com> - 1.6.4-13
changelog:
  - fix "[FJ8.2 Bug]: [REG]The "--group-add" option of "podman create" doesn't function."
  - Resolves: #1808702


author: Jindrich Novy <jnovy@redhat.com> - 1.6.4-14
changelog:
  - fix "CVE-2020-1702 podman: containers/image: Container images read entire image manifest into memory"
  - Resolves: #1810614


author: Jindrich Novy <jnovy@redhat.com> - 1.6.4-15
changelog:
  - update fix for "podman (1.6.4) rhel 8.1 no route to host from inside container"
  - Resolves: #1806895


author: Jindrich Novy <jnovy@redhat.com> - 1.6.4-17
changelog:
  - fix "CVE-2020-10696 buildah: crafted input tar file may lead to local file overwriting during image build process"
  - Resolves: #1817743


author: Jindrich Novy <jnovy@redhat.com> - 1.6.4-18
changelog:
  - fix "CVE-2020-8945 proglottis/gpgme: Use-after-free in GPGME bindings during container image pull"
  - Resolves: #1806940


author: Jindrich Novy <jnovy@redhat.com> - 1.6.4-19
changelog:
  - fix "podman segfault upon doing buildah operations due to error handling message"
  - Resolves: #1853326


author: Jindrich Novy <jnovy@redhat.com> - 1.6.4-21
changelog:
  - fix "podman launches a container with systemd instance inside - bind mounts of systemd cgroup entries are being leaked in host mount namespace"
  - Resolves: #1860506


author: Jindrich Novy <jnovy@redhat.com> - 1.6.4-22
changelog:
  - revert regressions introduced by 0001-bump-github.com-containers-buildah-to-v1.11.5.patch
    regressed bugzilla list follows:
  - Related: #1817743, #1792243, #1784950


author: Jindrich Novy <jnovy@redhat.com> - 1.6.4-23
changelog:
  - fix "CVE-2020-14040 podman: golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash [rhel-7]"
  - Resolves: #1854715


author: Jindrich Novy <jnovy@redhat.com> - 1.6.4-25
changelog:
  - use proper patch to address "podman does not use $TMPDIR loading a tar file."
  - Resolves: #1877699


author: Jindrich Novy <jnovy@redhat.com> - 1.6.4-26
changelog:
  - fix "CVE-2020-14370 podman: environment variables leak between containers when started via Varlink or Docker-compatible REST API [rhel-7]"
  - Resolves: #1881062


author: Jindrich Novy <jnovy@redhat.com> - 1.6.4-28
changelog:
  - fix "CVE-2021-20188 podman: container users permissions are not respected in privileged containers [rhel-7.9.z]"
  - Resolves: #1918282


author: Jindrich Novy <jnovy@redhat.com> - 1.6.4-30
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v1.6.4-rhel
    (https://github.com/containers/podman/commit/c19e460)
  - Related: #2074089


author: Jindrich Novy <jnovy@redhat.com> - 1.6.4-32
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v1.6.4-rhel
    (https://github.com/containers/podman/commit/aba15dd)


author: Jindrich Novy <jnovy@redhat.com> - 1.6.4-33
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v1.6.4-rhel
    (https://github.com/containers/podman/commit/68af661)


author: Jindrich Novy <jnovy@redhat.com> - 1.6.4-35
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v1.6.4-rhel
    (https://github.com/containers/podman/commit/e330751)


author: Jindrich Novy <jnovy@redhat.com> - 1.6.4-36
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v1.6.4-rhel
    (https://github.com/containers/podman/commit/7667df8)


author: Dan Walsh <dwalsh@redhat.com> - 2.2.5-3
changelog:
  - Add Miroslav patch to
  - Fix previously_modified_initialize() to show modified changes properly for all selections
  Resolves: #1049977


author: Miroslav Grepl <mgrepl@redhat.com> - 2.2.5-5
changelog:
  - Remove default s0 range from semanage-login command. It is handled in seobject.py.
  Resolves:#1028106


author: Miroslav Grepl <mgrepl@redhat.com> - 2.2.5-11.el7_0.1
changelog:
  - Make selinux-policy build working also on another architectures related to sepolicy-manpage generate
  Resolves:#1135434


author: Miroslav Grepl <mgrepl@redhat.com> - 2.2.5-12
changelog:
  - Make selinux-policy build working also on another architectures related to sepolicy-manpage generate
  Resolves:#1103292


author: Miroslav Grepl <mgrepl@redhat.com> - 2.2.5-13
changelog:
  - If the user attempts to restorecon the label of a file that does not exist, do not report this as an error
  Resolves:#1082956
  - Make fixfiles_exclude_dirs working if there is a substituion for the given directory
  Resolves:#1082676
  - Add ability to list the actual active modules
  Resolves:#1075023
  - Update XDG_RUNTIME_DIR directory
  Resolves:#1112811
  - Fix semanage man page to talk about  semanage-* (8) man pages.
  Resolves:#1084390


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-2
changelog:
  - sepolgen: Add support for TYPEBOUNDS statement in INTERFACE policy
    files (#1319338)
  - Add documentation for MCS separated domains
  - Move svirt man page out of libvirt into its own


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-3
changelog:
  - Update sandbox types in sandbox manual
  - Fix typos in semanage manpages
  - Fix the documentation of -l,--list for semodule
  - Minor fix in a French translation
  - Fix the extract example in semodule.8
  - Update sandbox.8 man page
  - Remove typos from chcat --help
  - Fix multiple spelling errors
  - hll/pp: Warn if module name different than output filename


author: Petr Lautrbach <plautrba@redhat.com> 2.5-6.2
changelog:
  - open_init_pty: Do not error on EINTR
  - Fix [-s STORE] typos in semanage
  - Don't use subprocess.getstatusoutput() in Python 2 code


author: Petr Lautrbach <plautrba@redhat.com> 2.5-7
changelog:
  - fixfiles: Pass -n to restorecon for fixfiles check
  - sepolicy: Check get_rpm_nvr_list() return value
  - Don't use subprocess.getstatusoutput() in Python 2 code
  - semanage: Add auditing of changes in records
  - Remove unused 'q' from semodule getopt string


author: Petr Lautrbach <plautrba@redhat.com> 2.5-8
changelog:
  - audit2allow: tests should use local copy not system
  - audit2allow: remove audit2why so that it gets symlinked
  - semanage: fix man page and help message for import option
  - semanage: fix error message for fcontext -m
  - semanage: Fix semanage fcontext -D
  - semanage: Correct fcontext auditing
  - semanage: Default serange to "s0" for port modify
  - semanage: Use socket.getprotobyname for protocol
  - semanage: fix modify action in node and interface


author: Petr Lautrbach <plautrba@redhat.com> 2.5-9
changelog:
  - sandbox: create a new session for sandboxed processes - CVE-2016-7545
  - sandbox: do not try to setup directories without -X or -M


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-13
changelog:
  - hll/pp: Fix pp crash when processing base module (#1350806)
  - sepolicy: fix obtaining domain name in HTMLManPages (#1174744)


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-14
changelog:
  - Fix export of fcontext socket entries (#1435100)
  - Fix checks whether a module name is passed to semanage-module (#1420527)


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-15
changelog:
  - sepolicy: Do not fail when file_contexts.{homedirs,local} are not present (#1395778)
  - fixfiles - use quotes around "$FILEPATH" (#1241946)


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-16
changelog:
  - Strip non-printable characters when parsing audit messages (#1406328)
  - Install seobject python module into arch specific path (#1061049)
  - restorecond: Decrease loglevel of termination message (#1422121)
  - semodule_package: do not fail with an empty fc file (#1390535)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-18
changelog:
  - semanage: Enable listing file_contexts.homedirs
  - semanage: Fix manpage author for ibpkey and ibendport pages.
  - semanage: Update man pages for infiniband
  - semanage: Update semanage to allow runtime labeling of ibendports
  - semanage: Update semanage to allow runtime labeling of Infiniband Pkeys
  - semanage: Improve semanage-port man page
  - fixfiles: do not dereference link files in tmp


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-20
changelog:
  - setfiles: Mention customizable types in restorecon man page (#1260238)
  - sepolicy: do not fail when file_contexts.local or .subs do not exist (#1512590)
  - semanage: Fix export of ibendport entries (#1471809)


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-22
changelog:
  - semanage: Fix fcontext help message (#1499259)
  - semanage: Improve semanage-user.8 man page (#1079946)
  - semodule: Improve man page (#1337192)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-23
changelog:
  - Update translation files and remove empty ones (#1375915)
  - sepolicy: Fix sepolicy manpage (#1509383)
  - semanage/seobject: Fix moduleRecords.modify() (#1408331)
  - semodule: Improve man page and unify it with --help (#1320565)
  - setfiles: Improve description of -d switch (#1271327)
  - sepolgen: Try to translate SELinux contexts to raw (#1356149)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-24
changelog:
  - Stop rejecting SCTP and DCCP in sepolicy.info
  - semanage: Replace bare except with specific one (#1598444)
  - semanage: Fix logger class definition (#1598444)
  - semanage: Stop rejecting aliases in semanage commands (#1544793)
  - sepolicy: Stop rejecting aliases in sepolicy commands (#1600009)
  - semanage: Stop logging loginRecords changes (#1294663)
  - Use file_contexts.local in fixfiles restore (#1559808)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-30
changelog:
  - semanage/seobject: Fix listing boolean values (#1391605)
  - sepolicy: Make policy files sorting more robust
  - semanage: Fix setting alternative policy store (#1558033)
  - semanage: Load a store policy and set the store SELinux policy root
  - sepolicy: Add sepolicy.load_store_policy(store)
  - semanage: import sepolicy only when it's needed
  - semanage: move valid_types initialisations to class constructors
  - semanage/seobject: Fix indentation issues
  - scripts/fixfiles: Do not fail on file_contexts.local (#1647714)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-31
changelog:
  - semanage: Start exporting "ibendport" and "ibpkey" entries (#1657196)
  - semanage: Do not show "None" levels when using a non-MLS policy (#1400482)
  - semanage: Include MCS/MLS range when exporting local customizations (#1400482)


author: Miloslav Trmač <mitr@redhat.com> - 0.112-2
changelog:
  - Workaround pam_systemd setting broken XDG_RUNTIME_DIR
    Resolves: #1033774
  - Always use mozjs-17.0 even if js-devel is installed


author: Miloslav Trmač <mitr@redhat.com> - 0.112-12
changelog:
  - Fix a memory leak in PolkitPermission.
    Patch by Rui Matos <tiagomatos@gmail.com>
    Resolves: #1433915


author: Miloslav Trmač <mitr@redhat.com> - 0.110-4
changelog:
  - Make the JavaScript engine mandatory.  The polkit-js-engine package has been
    removed, main polkit package Provides:polkit-js-engine for compatibility.
  - Add Requires: polkit-pkla-compat
    Resolves: #908808


author: Miloslav Trmač <mitr@redhat.com> - 0.110-4
changelog:
  - Shut up rpmlint about Summary:
  - Build with V=1
  - Use %{_unitdir} instead of hard-coding the path
  - Use the new systemd macros, primarily to run (systemctl daemon-reload)
    Resolves: #857382


author: Miloslav Trmač <mitr@redhat.com> - 0.111-1
changelog:
  - Update to polkit-0.111
    Resolves: #917888
  - Use SpiderMonkey from mozjs17 instead of js
  - Ship the signature in the srpm
  - Try to preserve timestamps in (make install)


author: Rex Dieter <rdieter@fedoraproject.org> 0.99.0-3
changelog:
  - patch to bring polkit auth dialog to front
  - patch restart polkit-kde on crash 
  - patch to remove unimplimented 'remember authorization' checkbox


author: Miloslav Trmač <mitr@redhat.com> - 0.1-2
changelog:
  - Add a comment above License about SRPM-only licenses
  - Reword Summary: to avoid a rpmlint warning
  - Move INSTALL= to the %install section


author: Marek Kasik <mkasik@redhat.com> 0.22.5-2
changelog:
  - Add poppler-0.22.5-CVE-2013-4473.patch
      (Limit length of output to pathName buffer)
  - Add poppler-0.22.5-CVE-2013-4474.patch
      (Check file pattern)
  - Resolves: #1025160


author: Marek Kasik <mkasik@redhat.com> - 0.26.5-33
changelog:
  - Only embed mime data for gray/rgb/cmyk colorspaces
  - if image decode map is identity
  - Resolves: #1636103


author: Marek Kasik <mkasik@redhat.com> - 0.26.5-38
changelog:
  - Constrain number of cycles in rescale filter
  - Compute correct coverage values for box filter
  - Resolves: #1688417


author: Panu Matilainen <pmatilai@redhat.com> - 1.13-12
changelog:
  - Hack poptBadOption() to return something semi-meaningful on exec alias
    failures (#697435, #710267)
  - Run internal test-suite on build, minimal as it might be


author: Tim Waugh <twaugh@redhat.com> - 0.0.5-8
changelog:
  - Avoid a race during start-up if there are no configured ports (bug #1034139).
  - Moved tmpfiles configuration file to correct location.
  - Don't use %ghost in manifest for state directory, in order to make
    sure it is ready to use after installation.


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2:2.10.0-2
changelog:
  - Fixed systemd error message regarding chroot-update, patch provided
    by John Heidemann <johnh@isi.edu>
    Resolves: rhbz#917463


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2:2.10.1-7
changelog:
  - Fixed haproxy with TLS
    Resolves: rhbz#1370455
  - Fixed documentation about canonical maps
    Resolves: rhbz#1381871
  - Fixed build with kernel-4.*
    Resolves: rhbz#1575658


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2:2.10.1-9
changelog:
  - Compiled with USE_LDAP_SASL if both "ldap" and "sasl" options are enabled
    Resolves: rhbz#1733938


author: Jozef Mlich <jmlich@redhat.com> - 9.2.6-1
changelog:
  - Resolves #1038688
  - rebase to 9.2.6 see changes at
    http://www.postgresql.org/docs/9.2/static/release-9-2-6.html


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.7-1
changelog:
  - update to 9.2.7 per release notes (#1065845)
    http://www.postgresql.org/docs/9.2/static/release-9-2-7.html


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.10-1
changelog:
  - update to 9.2.10 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-10.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-9.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-8.html
    (rhbz#1198672 rhbz#1198673)


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.11-1
changelog:
  - update to 9.2.11 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-11.html


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.12-1
changelog:
  - update to 9.2.12 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-12.html


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.13-1
changelog:
  - update to 9.2.13 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-13.html


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.14-1
changelog:
  - update to 9.2.14 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-14.html


author: Pavel Kajaba <pkajaba@redhat.com> - 9.2.15-1
changelog:
  - update to 9.2.15 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-15.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.18-1
changelog:
  - update to 9.2.18 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-18.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-17.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-16.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.21-1
changelog:
  - update to 9.2.21 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-21.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-20.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-19.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.22-1
changelog:
  - update to 9.2.22 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-22.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.23-1
changelog:
  - update to 9.2.23 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-23.html


author: Jozef Mlich <jmlich@redhat.com> - 9.2.5-2
changelog:
  - Resolves: #1019762 
  - additionally fixes rpmdiff filelist problem with
    /usr/share/doc/postgresql-9.2.5/html/bookindex.html.orig


author: Tom Lane <tgl@redhat.com> 09.01.0200-1
changelog:
  - Update to version 09.01.0200
  - Minor specfile cleanup per suggestions from Tom Callaway
  Related: #845110


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.3-5
changelog:
  - Fixed some possible unregistered parameters errors
    (by reg-net-param patch)
    Resolves: rhbz#1014662
  - Unlimit FDs (by unlimit-fds patch)
    Printed friendly error message if the system is running out
    of FDs (by fd-limit-err patch)
    Resolves: rhbz#1017668


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.3-8
changelog:
  - Fixed buffer overflow in cpufreq tunables on systems with many CPUs
    (by tunable-overflow-fix patch)
    Resolves: rhbz#1080191


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.3-9
changelog:
  - MSR read errors are no more fatal (by msr-check patch)
    Resolves: rhbz#1102088
  - Backported --auto-tune feature and added one-shot systemd service
    (by auto-tune patch)
    Resolves: rhbz#1143014
  - Improved handling of reporting filenames (by improve-reporting patch)
    Resolves: rhbz#1039822


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.3-10
changelog:
  - Reintroduced -d, --dump option and added plain report mode,
    fixed parameters and manual page
    Resolves: rhbz#1333495


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.3-1
changelog:
  - New version
    Resolves: rhbz#923729
  - Dropped fix-crash-on-readonly-fs, reduce-syscalls,
    gpu-wiggle-fix patches (upstreamed)
  - Dropped version-fix patch (not needed)


author: Michal Sekletar <msekleta@redhat.com> - 2.4.5-29
changelog:
  - make radius plugin config parser less strict
  - add creation of dip system group
  - resolves : #906913, #918296


author: Michal Sekletar <msekleta@redhat.com> - 2.4.5-30
changelog:
  - don't ship /var/lock/ppp in rpm payload and create it in %post instead
  - fix installation of tmpfiles.d configuration
  - enable hardened build
  - fix bogus dates in changelog
  - compile all binaries with hardening flags
  - fix possible NULL pointer dereferencing


author: Miroslav Lichvar <mlichvar@redhat.com> 0-0.7.20120407git0deb9c
changelog:
  - update to 20120407git0deb9c
  - move timepps.h to sys (#852950)
  - include license files in devel subpackage
  - remove obsolete macros


author: Paul Howarth <paul@city-fan.org> 1.7.2-13.2
changelog:
  - Add patch to fix highly-parallel build (e.g. -j16)
  - Add additional compiler warning flags to highlight questionable code
  - Add patch to fix comparisons between signed and unsigned integers
  - Add patch to fix const usage
  - Add patch to fix missing field initializers
  - Add patch to suppress warnings about possibly unused variables
  - Add patch to fix declarations that are not prototypes
  - Add patch to fix warnings about nested externs
  - Add patch to fix dubious typecasts that violate strict-aliasing rules
  - Update the FSF address references and GPLv2 license text
  - Use default optimization level (-O2) again


author: Paul Howarth <paul@city-fan.org> 1.7.2-14
changelog:
  - Build with warning-fix patches to address occasional segfaults (#749455)
  - Patches have all now been merged upstream


author: Paul Howarth <paul@city-fan.org> 1.7.2-17
changelog:
  - Add note in options.pptp about MPPE not being available in FIPS mode
    (#845112)
  - Add note in options.pptp about PPTP with MSCHAP-V2 being insecure


author: Jan Rybar <jrybar@redhat.com> - 3.3.10-7
changelog:
  - Fixing sysinfo - devices with length exceeding 15 chars are not displayed in vmstat -d
  - Resolves: #1169349


author: Jan Rybar <jrybar@redhat.com> - 3.3.10-9
changelog:
  - Fixes showing same cgroups for threads under process by adding format option
  - Resolves: rhbz#1284087


author: Jan Rybar <jrybar@redhat.com> - 3.3.10-10
changelog:
  - Fixes sysinfo - devices with name longer than 20 chars are mistaken for partitions
  - Resolves: rhbz#1169349


author: Jan Rybar <jrybar@redhat.com> - 3.3.10-28
changelog:
  - pgrep: uid/gid conversion overflow
  - vmstat: manpage line about I/O blocked procs unclear
  - Resolves: rhbz#1624514, rhbz#1796043


author: Jaromir Capik <jcapik@redhat.com> - 3.3.9-5
changelog:
  - Support for timestamps & wide diskstat (#1053428, #1025833)
  - Fixing fd leak in watch
  - Fixing format-security build issues
  - Skipping trailing zeros in read_unvectored (#1057600)
  - Resolves: rhbz#1053428, Related: rhbz#1025833


author: Jaromir Capik <jcapik@redhat.com> - 3.3.10-1
changelog:
  - Upgrading to 3.3.10
  - top.1: physical memory - has used / is using (#1119263)
  - Include man pages for openproc, readproc and readproctab (#1119260)
  - ps -p cycles over all PIDs instead of just one (#1060715)
  - Remove explicit dependency on systemd-libs package (#1113206)
  - Allow longer usernames to display in ps output (#1112734)
  - w doesn't display FROM by default (#1078310)
  - Return value of pgrep is incorrect (#1116309)
  - Should shared memory be accounted in cached in free output? (#1070736)
  - Resolves: rhbz#1119263 rhbz#1119260 rhbz#1060715 rhbz#1113206
  - Resolves: rhbz#1112734 rhbz#1078310 rhbz#1116309 rhbz#1070736


author: Jaromir Capik <jcapik@redhat.com> - 3.3.10-2
changelog:
  - Replacing RC tarball with final 3.3.10 release
  - Related: rhbz#1119263 rhbz#1119260 rhbz#1060715 rhbz#1113206
  - Related: rhbz#1112734 rhbz#1078310 rhbz#1116309 rhbz#1070736


author: Jaromir Capik <jcapik@redhat.com> - 3.3.10-3
changelog:
  - Disabling translated man pages due to conflicts with man-pages-*
  - Removing /etc/sysctl.d (quietly stolen by systemd)
  - Related: rhbz#1119263 rhbz#1119260 rhbz#1060715 rhbz#1113206
  - Related: rhbz#1112734 rhbz#1078310 rhbz#1116309 rhbz#1070736


author: Jaromir Capik <jcapik@redhat.com> - 6.5.5-8
changelog:
  - #759321 - psacct logrotate script references init.d service
  - #735300 - Enabling psacct causes daily cron spam


author: Jaromir Capik <jcapik@redhat.com> - 22.20-6
changelog:
  - Fixing null pointer dereference introduced with namespaces
  - Fixing bogus dates in the changelog
  - Related: rhbz#980514


author: Jan Rybar <jrybar@redhat.com> 22.20-13
changelog:
  - fuser manpage: note about invisible other PIDs moved to RESTRICTIONS section
  - Resolves: rhbz#1400126


author: Richard W.M. Jones <rjones@redhat.com> 22.20-1
changelog:
  - Update to 22.20.
    Contains a fix for: http://sourceforge.net/p/psmisc/bugs/53/
  - Fix src/pstree.c when SELinux is available.


author: Jiri Popelka <jpopelka@redhat.com> - 1.17-40
changelog:
  - fix dist tag and URL
  - put psutils-copyright.patch among sources as it's used only in
    psutils-remove-copyrighted-files
  - no need to define BuildRoot and clean it in %clean and %install anymore
  - %defattr no longer needed in %files


author: Michael Schwendt <mschwendt@fedoraproject.org> - 2.0.7-19
changelog:
  - Build with -D_FILE_OFFSET_BITS=64 to get stat64 in pth_high.c
  - Guard the ARM CFLAGS sed substitution.


author: Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.10.2-4
changelog:
  * Sat Aug 25 2012 Peter Robinson <pbrobinson@fedoraproject.org> - 2.10.7-1
  - New 2.10.7 stable release


author: Wim Taymans <wtaymans@redhat.com> - 6.0-4
changelog:
  - Add more Requires to avoid testing multiple versions
  - enable hardened build
  - Fix missing %endif
  - Resolves: #1174548


author: Rex Dieter <rdieter@fedoraproject.org> - 6.0-7
changelog:
  - better autostart.patch, handle case were autospawn is disabled
    (or otherwise doesn't work, like for root user)
  - Resolves: #1269104


author: Wim Taymans <wtaymans@redhat.com> - 10.0-4
changelog:
  - Add support for usb audio in the Dell dock TB16
  - Add patches to improve default sinks
  - Resolves: #1457385


author: Wim Taymans <wtaymans@redhat.com> - 3.0-16
changelog:
  - Build SUID proximity-helper with full relro
  - don't mark .desktop and dbus configurations as %config
  - Related #884146


author: Wim Taymans <wtaymans@redhat.com> - 3.0-17
changelog:
  - Use the statically allocated UID and GID from /usr/share/doc/setup/uidgid (#1056656)
  - The pulse-rt group doesn't exist (#885020)
  - Related #884146


author: Wim Taymans <wtaymans@redhat.com> - 3.0-28
changelog:
  - core-util: Remove redundant check of directory permissions
  - core-util: Call fchown() only when necessary
  - core: Fix resource leak in core-util
  - Resolves: rhbz#1136330


author: Tomáš Mráz <tmraz@redhat.com> - 0.13-6
changelog:
  - Check for error returns which cause segfaults in FIPS mode
  - Fix missing error check and leak found by gcc-with-cpychecker (#800086)


author: Tomáš Mráz <tmraz@redhat.com> - 0.13.1-1
changelog:
  - new upstream release fixing a security issue with string
    formatting subjectAltName of a certificate


author: Tomáš Mráz <tmraz@redhat.com> - 0.13.1-4
changelog:
  - fix various testsuite failures
  - fix exception propagation from private key passphrase callback (#1227505)
  - add optional digest parameter to CRL.export method (#1523772)


author: John (J5) Palmieri <johnp@redhat.com> - 2.28.6-2
changelog:
  - disable introspection in anticipation of pygobject3
  - https://bugzilla.redhat.com/show_bug.cgi?id=731851
  - pygobject2 now becomes legacy for static binding support (e.g. PyGTK)


author: Colin Walters <walters@redhat.com> - 2.28.6-8
changelog:
  - Add various missing BuildRequires, switch to pkgconfig() syntax
  - Backport upstream patch which fixes a crasher in some applications


author: Toshio Kuratomi <toshio@fedoraproject.org> - 0.3-1
changelog:
  - New upstream release
  - Build a python3 subpackage
  - Run the test suite even though we ignore the output


author: Miloslav Trmač <mitr@redhat.com> - 0.3-5
changelog:
  - Disable -fstrict-aliasing (see http://www.python.org/dev/peps/pep-3123/ for
    rationale)
  - Don't ship .pyc files from the test suite in %doc, to avoid multilib
    conflicts


author: David Cantrell <dcantrell@redhat.com> - 1:3.9-9
changelog:
  - Disable python-coverage tests on s390x
    Related: rhbz#1057626
  - Fix python-coverage tests (some disabled that are not working)
    Resolves: rhbz#1057626


author: David Cantrell <dcantrell@redhat.com> - 1:3.9-14
changelog:
  - Update URLs to point to github.com since that's where upstream lives
    these days
    Resolves: rhbz#1502389


author: Toshio Kuratomi <toshio@fedoraproject.org> - 3.5.3-2
changelog:
  - Patch from upstream for traceback when people use this with python2 and
    python3 in the same directory


author: Paul Howarth <paul@city-fan.org> - 2.5-1
changelog:
  - Update to 2.5
    - Added PKCS#1 encryption schemes (v1.5 and OAEP); we now have a decent,
      easy-to-use non-textbook RSA implementation
    - Added PKCS#1 signature schemes (v1.5 and PSS); v1.5 required some
      extensive changes to Hash modules to contain the algorithm-specific ASN.1
      OID, and to that end we now always have a (thin) Python module to hide the
      one in pure C
    - Added 2 standard Key Derivation Functions (PBKDF1 and PBKDF2)
    - Added export/import of RSA keys in OpenSSH and PKCS#8 formats
    - Added password-protected export/import of RSA keys (one old method for
      PKCS#8 PEM only)
    - Added ability to generate RSA key pairs with configurable public
      exponent e
    - Added ability to construct an RSA key pair even if only the private
      exponent d is known, and not p and q
    - Added SHA-2 C source code (fully from Lorenz Quack)
    - Unit tests for all the above
    - Updates to documentation (both inline and in Doc/pycrypt.rst)
    - Minor bug fixes (setup.py and tests)
  - Upstream no longer ships python-3-changes.txt


author: Paul Howarth <paul@city-fan.org> - 2.5-2
changelog:
  - Add upstream fixes for issues found by Dave Malcolm's experimental static
    analysis tool (#790584)


author: Paul Howarth <paul@city-fan.org> - 2.6-1
changelog:
  - Update to 2.6
    - Fix insecure ElGamal key generation (launchpad bug #985164, CVE-2012-2417)
    - Huge documentation cleanup
    - Added more tests, including test vectors from NIST 800-38A
    - Remove broken MODE_PGP, which never actually worked properly
    - A new mode, MODE_OPENPGP, has been added for people wishing to write
      OpenPGP implementations (see also launchpad bug #996814)
    - Fix: getPrime with invalid input causes Python to abort with fatal error
      (launchpad bug #988431)
    - Fix: Segfaults within error-handling paths (launchpad bug #934294)
    - Fix: Block ciphers allow empty string as IV (launchpad bug #997464)
    - Fix DevURandomRNG to work with Python3's new I/O stack
    - Remove automagic dependencies on libgmp and libmpir; let the caller
      disable them using args
    - Many other minor bug fixes and improvements
  - Drop upstream patches


author: Paul Howarth <paul@city-fan.org> - 2.6.1-13
changelog:
  - AES.new with invalid parameter crashes python (CVE-2013-7459)
    (https://github.com/dlitz/pycrypto/issues/176)


author: Pavel Cahyna <pcahyna@redhat.com> - 2.6.1-15
changelog:
  - Add Provides and Obsoletes for the python-crypto package now
    when the package is named python2-crypto. On Fedora this is
    done automatically, but not on RHEL.


author: Christian Heimes <cheimes@redhat.com> - 1.7.2-1
changelog:
  - Update to 1.7.2
  - Disable pytest.deprecated_call() tests
  - Remove versioned pytest
  - Add build requirements pytz


author: Christian Heimes <cheimes@redhat.com> - 1.7.2-2
changelog:
  - Ignore errors on OpenSSL's error stack when initializing, fixes RHBZ#1402235
  - Add depenency on python-setuptools, fixes RHBZ#1459947
  - Fix parsing of long OIDs, fixes RHBZ#1455755


author: Robert Kuska <rkuska@redhat.com> - 2.7.5-32
changelog:
  - Backport SSLSocket.version function
  - Temporary disable test_gdb on ppc64le rhbz#1260558
  Resolves: rhbz#1259421


author: Tomas Orsava <torsava@redhat.com> - 2.7.5-36
changelog:
  - Fix for CVE-2016-0772 python: smtplib StartTLS stripping attack (rhbz#1303647)
    Raise an error when STARTTLS fails (upstream patch)
  - Fix for CVE-2016-5699 python: http protocol steam injection attack (rhbz#1303699)
    Disabled HTTP header injections in httplib (upstream patch)
  Resolves: rhbz#1346356


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-39
changelog:
  - Fix hashlib algorithms breaking by initializing OpenSSL_add_all_digests
  function in _hashlib library
  Resolves: rhbz#1371132


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-39
changelog:
  - Removal of the '$Date$' placeholder on the python(1) man page footer,
  which does not expand during build
  Resolves: rhbz#1268310


author: Tomas Orsava <torsava@redhat.com> - 2.7.5-45
changelog:
  - Fix for CVE-2016-0772 python: smtplib StartTLS stripping attack (rhbz#1303647)
    Raise an error when STARTTLS fails (upstream patch)
  - Fix for CVE-2016-5699 python: http protocol steam injection attack (rhbz#1303699)
    Disabled HTTP header injections in httplib (upstream patch)
  Resolves: rhbz#1346357


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-46
changelog:
  - Drop patch 221 that backported sslwrap function since it was introducing regressions
  - Refactor patch 227
  Resolves: rhbz#1331425


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-47
changelog:
  - Fix for CVE-2016-5636: possible integer overflow and heap corruption in zipimporter.get_data()
  Resolves: rhbz#1356364


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-49
changelog:
  - Fix ssl module's parsing of GEN_RID subject alternative name fields in X.509 certs
  Resolves: rhbz#1364444


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-52
changelog:
  - Workaround Python's threading library issue with non returning wait, for signals with timeout
  Resolves: rhbz#1368076


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-57
changelog:
  - Fix implicit declaration warnings of functions added by patches 147 and 265
  Resolves: rhbz#1441237


author: Petr Viktorin <pviktori@redhat.com> - 2.7.5-63
changelog:
  - Make it more likely for the system allocator to release free()d memory arenas
  Resolves: rhbz#1468410


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-65
changelog:
  - Fix hanging of all threads when trying to access an inaccessible NFS server.
  Resolves: rhbz#1520068


author: Tomas Orsava <torsava@redhat.com> - 2.7.5-68
changelog:
  - Add Conflicts tag with old virtualenv versions due to new behaviour of
    httplib (patch 295)
  Resolves: rhbz#1483438


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-71
changelog:
  - Limit the number of CPU cores when building the package on power architectures
  Resolves: rhbz#1568974


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-72
changelog:
  - Fix CVE-2018-1060 and CVE-2018-1061
  Resolves: rhbz#1563454 and rhbz#1549192
  - Provide python2-libs from the python-libs subpackage
  Resolves: rhbz#1557460


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-74
changelog:
  - Fix OSERROR 17 due to _multiprocessing/semaphore.c assuming
    a one-to-one Pid -> process mapping
  Resolves: rhbz#1579432


author: Tomas Orsava <torsava@redhat.com> - 2.7.5-79
changelog:
  - Moved the macros.python/2 files into their own packages python/2-rpm-macros
  Resolves: rhbz#1679221


author: Victor Stinner <vstinner@redhat.com> - 2.7.5-80
changelog:
  - Security fix for CVE-2019-5010: crash on parsing a specially crafted X509 certificate
    (resolves: rhbz#1666788)


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-84
changelog:
  - Disallow control chars in http URLs
  - Fixes CVE-2019-9740 and CVE-2019-9947
  Resolves: rhbz#1704362 and rhbz#1703530


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-90
changelog:
  - Avoid infinite loop when reading specially crafted TAR files (CVE-2019-20907)
  Resolves: rhbz#1856481


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-91
changelog:
  - Security fixes for CVE-2020-26116, CVE-2020-26137 and CVE-2022-0391
  - Test fixes for the latest expat security release
  - Update the certificates utilized in the test suite
  Resolves: rhbz#1883014, rhbz#1883632, rhbz#2047376, rhbz#1896494


author: David Sommerseth <davids@redhat.com> - 0.7-1
changelog:
  - Fixed several memory leaks (commit aa2c20e697af, abc7f912f66d)
  - Improved error checking towards NULL values(commit 4e928d62a8e3)
  - Fixed typo in pethtool --help (commit 710766dc722)
  - Only open a NETLINK connection when needed (commit 508ffffbb3c)
  - Added man page for pifconfig and pethtool (commit 9f0d17aa532, rhbz#638475)
  - Force NETLINK socket to close on fork() using FD_CLOEXEC (commit 1680cbeb40e)


author: Bohuslav Kabrda <bkabrda@redhat.com> - 0.8-2
changelog:
  - Fixed reporting of more IPv4 addresses per interface
  Resolves: rhbz#1027685
  - Make get_active_devices() return IPv6-only devices, too
  Resolves: rhbz#1027678


author: d.marlin <dmarlin@redhat.com>
changelog:
  - Add support for ppc64 in LE mode running ABIv2
    Signed-off-by: Ulrich Weigand <uweigand@de.ibm.com>
    Signed-off-by: Tony Breeds <tony@bakeyournoodle.com>
    rhbz#1252900
  - Remove s390x from skip check list.
  - Bump release and build of all archs.


author: Mike Bonnet <mikeb@redhat.com> - 1.0.90-1
changelog:
  - return the contents of the AP_REP message from rd_rep()
  - improved memory handling
  - removed use of KRB_PRIVATE


author: Matthew Barnes <mbarnes@redhat.com> - 0:2.4.15-2
changelog:
  - Add syncrepl_refreshdone() method to SyncreplConsumer class.
    Need by FreeIPA, subsequently accepted upstream.
  - Resolves: rhbz#1122495


author: Jeffrey Ollie <jeff@ocjtech.us> - 2.3.5-1
changelog:
  - Bugs fixed
  -
  -  * Crash when merging text nodes in element.remove().
  -  * Crash in sax/target parser when reporting empty doctype.


author: Jeffrey Ollie <jeff@ocjtech.us> - 3.0-1
changelog:
  - 3.0 (2012-10-08)
  - ================
  -
  - Features added
  - --------------
  -
  - Bugs fixed
  - ----------
  -
  - * End-of-file handling was incorrect in iterparse() when reading from
  -   a low-level C file stream and failed in libxml2 2.9.0 due to its
  -   improved consistency checks.
  -
  - Other changes
  - -------------
  -
  - * The build no longer uses Cython by default unless the generated C files
  -   are missing.  To use Cython, pass the option "--with-cython".  To ignore
  -   the fatal build error when Cython is required but not available (e.g. to
  -   run special setup.py commands that do not actually run a build), pass
  -   "--without-cython".
  -
  -
  - 3.0beta1 (2012-09-26)
  - =====================
  -
  - Features added
  - --------------
  -
  - * Python level access to (optional) libxml2 memory debugging features
  -   to simplify debugging of memory leaks etc.
  -
  - Bugs fixed
  - ----------
  -
  - * Fix a memory leak in XPath by switching to Cython 0.17.1.
  -
  - * Some tests were adapted to work with PyPy.
  -
  - Other changes
  - -------------
  -
  - * The code was adapted to work with the upcoming libxml2 2.9.0 release.
  -
  -
  - 3.0alpha2 (2012-08-23)
  - ======================
  -
  - Features added
  - --------------
  -
  - * The .iter() method of elements now accepts tag arguments like "{*}name"
  -   to search for elements with a given local name in any namespace.  With
  -   this addition, all combinations of wildcards now work as expected:
  -   "{ns}name", "{}name", "{*}name", "{ns}*", "{}*" and "{*}*".  Note that
  -   "name" is equivalent to "{}name", but "*" is "{*}*".  The same change
  -   applies to the .getiterator(), .itersiblings(), .iterancestors(),
  -   .iterdescendants(), .iterchildren() and .itertext() methods,  the
  -   strip_attributes(), strip_elements() and strip_tags() functions as well
  -   as the iterparse() function.
  -
  - * C14N allows specifying the inclusive prefixes to be promoted to
  -   top-level during exclusive serialisation.
  -
  - Bugs fixed
  - ----------
  -
  - * Passing long Unicode strings into the feed() parser interface failed to
  -   read the entire string.
  -
  - Other changes
  - -------------
  -
  -
  - 3.0alpha1 (2012-07-31)
  - ======================
  -
  - Features added
  - --------------
  -
  - * Initial support for building in PyPy (through cpyext).
  -
  - * DTD objects gained an API that allows read access to their
  -   declarations.
  -
  - * xpathgrep.py gained support for parsing line-by-line (e.g.
  -   from grep output) and for surrounding the output with a new root
  -   tag.
  -
  - * E-factory in lxml.builder accepts subtypes of known data
  -   types (such as string subtypes) when building elements around them.
  -
  - * Tree iteration and iterparse() with a selective tag
  -   argument supports passing a set of tags.  Tree nodes will be
  -   returned by the iterators if they match any of the tags.
  -
  - Bugs fixed
  - ----------
  -
  - * The .find*() methods in lxml.objectify no longer use XPath
  -   internally, which makes them faster in many cases (especially when
  -   short circuiting after a single or couple of elements) and fixes
  -   some behavioural differences compared to lxml.etree.  Note that
  -   this means that they no longer support arbitrary XPath expressions
  -   but only the subset that the ElementPath language supports.
  -   The previous implementation was also redundant with the normal
  -   XPath support, which can be used as a replacement.
  -
  - * el.find('*') could accidentally return a comment or processing
  -   instruction that happened to be in the wrong spot.  (Same for the
  -   other .find*() methods.)
  -
  - * The error logging is less intrusive and avoids a global setup where
  -   possible.
  -
  - * Fixed undefined names in html5lib parser.
  -
  - * xpathgrep.py did not work in Python 3.
  -
  - * Element.attrib.update() did not accept an attrib of
  -   another Element as parameter.
  -
  - * For subtypes of ElementBase that make the .text or .tail
  -   properties immutable (as in objectify, for example), inserting text
  -   when creating Elements through the E-Factory feature of the class
  -   constructor would fail with an exception, stating that the text
  -   cannot be modified.
  -
  - Other changes
  - --------------
  -
  - * The code base was overhauled to properly use 'const' where the API
  -   of libxml2 and libxslt requests it.  This also has an impact on the
  -   public C-API of lxml itself, as defined in etreepublic.pxd, as
  -   well as the provided declarations in the lxml/includes/ directory.
  -   Code that uses these declarations may have to be adapted.  On the
  -   plus side, this fixes several C compiler warnings, also for user
  -   code, thus making it easier to spot real problems again.
  -
  - * The functionality of "lxml.cssselect" was moved into a separate PyPI
  -   package called "cssselect".  To continue using it, you must install
  -   that package separately.  The "lxml.cssselect" module is still
  -   available and provides the same interface, provided the "cssselect"
  -   package can be imported at runtime.
  -
  - * Element attributes passed in as an attrib dict or as keyword
  -   arguments are now sorted by (namespaced) name before being created
  -   to make their order predictable for serialisation and iteration.
  -   Note that adding or deleting attributes afterwards does not take
  -   that order into account, i.e. setting a new attribute appends it
  -   after the existing ones.
  -
  - * Several classes that are for internal use only were removed
  -   from the lxml.etree module dict:
  -   _InputDocument, _ResolverRegistry, _ResolverContext, _BaseContext,
  -   _ExsltRegExp, _IterparseContext, _TempStore, _ExceptionContext,
  -   __ContentOnlyElement, _AttribIterator, _NamespaceRegistry,
  -   _ClassNamespaceRegistry, _FunctionNamespaceRegistry,
  -   _XPathFunctionNamespaceRegistry, _ParserDictionaryContext,
  -   _FileReaderContext, _ParserContext, _PythonSaxParserTarget,
  -   _TargetParserContext, _ReadOnlyProxy, _ReadOnlyPIProxy,
  -   _ReadOnlyEntityProxy, _ReadOnlyElementProxy, _OpaqueNodeWrapper,
  -   _OpaqueDocumentWrapper, _ModifyContentOnlyProxy,
  -   _ModifyContentOnlyPIProxy, _ModifyContentOnlyEntityProxy,
  -   _AppendOnlyElementProxy, _SaxParserContext, _FilelikeWriter,
  -   _ParserSchemaValidationContext, _XPathContext,
  -   _XSLTResolverContext, _XSLTContext, _XSLTQuotedStringParam
  -
  - * Several internal classes can no longer be inherited from:
  -   _InputDocument, _ResolverRegistry, _ExsltRegExp, _ElementUnicodeResult,
  -   _IterparseContext, _TempStore, _AttribIterator, _ClassNamespaceRegistry,
  -   _XPathFunctionNamespaceRegistry, _ParserDictionaryContext,
  -   _FileReaderContext, _PythonSaxParserTarget, _TargetParserContext,
  -   _ReadOnlyPIProxy, _ReadOnlyEntityProxy, _OpaqueDocumentWrapper,
  -   _ModifyContentOnlyPIProxy, _ModifyContentOnlyEntityProxy,
  -   _AppendOnlyElementProxy, _FilelikeWriter, _ParserSchemaValidationContext,
  -   _XPathContext, _XSLTResolverContext, _XSLTContext,
  -   _XSLTQuotedStringParam, _XSLTResultTree, _XSLTProcessingInstruction


author: Jeffrey Ollie <jeff@ocjtech.us> - 3.0.1-1
changelog:
  - 3.0.1 (2012-10-14)
  - Bugs fixed
  -
  -  * LP#1065924: Element proxies could disappear during garbage collection
  -    in PyPy without proper cleanup.
  -  * GH#71: Failure to work with libxml2 2.6.x.
  -  * LP#1065139: static MacOS-X build failed in Py3.


author: Jeffrey Ollie <jeff@ocjtech.us> - 3.1.0-1
changelog:
  - 3.1.0 (2013-02-10)
  - ==================
  -
  - Features added
  - --------------
  -
  - * GH#89: lxml.html.clean allows overriding the set of attributes that it
  -   considers 'safe'.  Patch by Francis Devereux.
  -
  - Bugs fixed
  - ----------
  -
  - * LP#1104370: ``copy.copy(el.attrib)`` raised an exception.  It now returns
  -   a copy of the attributes as a plain Python dict.
  -
  - * GH#95: When used with namespace prefixes, the  ``el.find*()`` methods
  -   always used the first namespace mapping that was provided for each
  -   path expression instead of using the one that was actually passed
  -   in for the current run.
  -
  - * LP#1092521, GH#91: Fix undefined C symbol in Python runtimes compiled
  -   without threading support.  Patch by Ulrich Seidl.
  -
  - Other changes
  - -------------
  -
  -
  - 3.1beta1 (2012-12-21)
  - =====================
  -
  - Features added
  - --------------
  -
  - * New build-time option ``--with-unicode-strings`` for Python 2 that
  -   makes the API always return Unicode strings for names and text
  -   instead of byte strings for plain ASCII content.
  -
  - * New incremental XML file writing API ``etree.xmlfile()``.
  -
  - * E factory in lxml.objectify is callable to simplify the creation of
  -   tags with non-identifier names without having to resort to getattr().
  -
  - Bugs fixed
  - ----------
  -
  - * When starting from a non-namespaced element in lxml.objectify, searching
  -   for a child without explicitly specifying a namespace incorrectly found
  -   namespaced elements with the requested local name, instead of restricting
  -   the search to non-namespaced children.
  -
  - * GH#85: Deprecation warnings were fixed for Python 3.x.
  -
  - * GH#33: lxml.html.fromstring() failed to accept bytes input in Py3.
  -
  - * LP#1080792: Static build of libxml2 2.9.0 failed due to missing file.
  -
  - Other changes
  - -------------
  -
  - * The externally useless class ``_ObjectifyElementMakerCaller`` was
  -   removed from the module API of lxml.objectify.
  -
  - * LP#1075622: lxml.builder is faster for adding text to elements with
  -   many children.  Patch by Anders Hammarquist.


author: Jeffrey Ollie <jeff@ocjtech.us> - 3.2.0-1
changelog:
  - 3.2.0 (2013-04-28)
  - ==================
  -
  - Features added
  - --------------
  -
  - Bugs fixed
  - ----------
  -
  - * LP#690319: Leading whitespace could change the behaviour of the string
  -   parsing functions in ``lxml.html``.
  -
  - * LP#599318: The string parsing functions in ``lxml.html`` are more robust
  -   in the face of uncommon HTML content like framesets or missing body tags.
  -   Patch by Stefan Seelmann.
  -
  - * LP#712941: I/O errors while trying to access files with paths that
  -   contain non-ASCII characters could raise ``UnicodeDecodeError`` instead
  -   of properly reporting the ``IOError``.
  -
  - * LP#673205: Parsing from in-memory strings disabled network access in the
  -   default parser and made subsequent attempts to parse from a URL fail.
  -
  - * LP#971754: lxml.html.clean appends 'nofollow' to 'rel' attributes instead
  -   of overwriting the current value.
  -
  - * LP#715687: lxml.html.clean no longer discards scripts that are explicitly
  -   allowed by the user provided whitelist.  Patch by Christine Koppelt.
  -
  - 3.1.2 (2013-04-12)
  - ==================
  -
  - Bugs fixed
  - ----------
  -
  - * LP#1136509: Passing attributes through the namespace-unaware API of
  -   the sax bridge (i.e. the ``handler.startElement()`` method) failed
  -   with a ``TypeError``.  Patch by Mike Bayer.
  -
  - * LP#1123074: Fix serialisation error in XSLT output when converting
  -   the result tree to a Unicode string.
  -
  - * GH#105: Replace illegal usage of ``xmlBufLength()`` in libxml2 2.9.0
  -   by properly exported API function ``xmlBufUse()``.
  -
  - 3.1.1 (2013-03-29)
  - ==================
  -
  - Features added
  - --------------
  -
  - Bugs fixed
  - ----------
  -
  - * LP#1160386: Write access to ``lxml.html.FormElement.fields`` raised
  -   an AttributeError in Py3.
  -
  - * Illegal memory access during cleanup in incremental xmlfile writer.
  -
  - Other changes
  - -------------
  -
  - * The externally useless class ``lxml.etree._BaseParser`` was removed
  -   from the module dict.


author: Jeffrey Ollie <jeff@ocjtech.us> - 3.2.1-1
changelog:
  - 3.2.1 (2013-05-11)
  - ==================
  -
  - Features added
  - --------------
  -
  - * The methods ``apply_templates()`` and ``process_children()`` of XSLT
  -   extension elements have gained two new boolean options ``elements_only``
  -   and ``remove_blank_text`` that discard either all strings or
  -   whitespace-only strings from the result list.
  -
  - Bugs fixed
  - ----------
  -
  - * When moving Elements to another tree, the namespace cleanup mechanism
  -   no longer drops namespace prefixes from attributes for which it finds
  -   a default namespace declaration, to prevent them from appearing as
  -   unnamespaced attributes after serialisation.
  -
  - * Returning non-type objects from a custom class lookup method could lead
  -   to a crash.
  -
  - * Instantiating and using subtypes of Comments and ProcessingInstructions
  -   crashed.


author: pcpa <paulo.cesar.pereira.de.andrade@gmail.com> - 1.2.0-8
changelog:
  - Update fontconfig patch to apply issue found by upstream
  - Update fontconfig patch to apply issue with missing afm fonts (#896182)


author: pcpa <paulo.cesar.pereira.de.andrade@gmail.com> - 1.2.0-10
changelog:
  - Use stix fonts avoid problems with missing cm fonts (#908717)
  - Correct type mismatch in python3 font_manager (#912843, #928326)


author: John Dennis <jdennis@redhat.com> - 0.12-2
changelog:
  - add patch python-nss-0.12-rsapssparams.patch to fix build problem
    which appears only with nss 3.13 and later.


author: John Dennis <jdennis@redhat.com> - 0.13-0
changelog:
  - Update to version 0.13
    Introduced in 0.13:

    * Fix NSS SECITEM_CompareItem bug via workaround.

    * Fix incorrect format strings in PyArg_ParseTuple* for:
      - GeneralName
      - BasicConstraints
      - cert_x509_key_usage

    * Fix bug when decoding certificate BasicConstraints extension

    * Fix hang in setup_certs.

    * For NSS >= 3.13 support CERTDB_TERMINAL_RECORD

    * You can now query for a specific certificate extension
      Certficate.get_extension()

    * The following classes were added:
      - RSAGenParams

    * The following class methods were added:
      - nss.nss.Certificate.get_extension
      - nss.nss.PK11Slot.generate_key_pair
      - nss.nss.DSAPublicKey.format
      - nss.nss.DSAPublicKey.format_lines

    * The following module functions were added:
      - nss.nss.pub_wrap_sym_key

    * The following internal utilities were added:
      - PyString_UTF8
      - SecItem_new_alloc()

    * The following class constructors were modified to accept
      intialization parameters

      - KEYPQGParams (DSA generation parameters)

    * The PublicKey formatting (i.e. format_lines) was augmented
      to format DSA keys (formerly it only recognized RSA keys).

    * Allow lables and values to be justified when printing objects

    * The following were deprecated:
      - nss.nss.make_line_pairs (replaced by nss.nss.make_line_fmt_tuples)

      Deprecated Functionality:
      -------------------------
      - make_line_pairs() has been replaced by make_line_fmt_tuples()
        because 2-valued tuples were not sufficently general. It is
        expected very few programs will have used this function, it's mostly
        used internally but provided as a support utility.


author: John Dennis <jdennis@redhat.com> - 0.14-1
changelog:
  External Changes:
    -----------------

    The primary enhancements in this version is support of certifcate
    validation, OCSP support, and support for the certificate "Authority
    Information Access" extension.

    Enhanced certifcate validation including CA certs can be done via
    Certificate.verify() or Certificate.is_ca_cert(). When cert
    validation fails you can now obtain diagnostic information as to why
    the cert failed to validate. This is encapsulated in the
    CertVerifyLog class which is a iterable collection of
    CertVerifyLogNode objects. Most people will probablby just print the
    string representation of the returned CertVerifyLog object. Cert
    validation logging is handled by the Certificate.verify() method.
    Support has also been added for the various key usage and cert type
    entities which feature prominently during cert validation.


    * Certificate() constructor signature changed from

      Certificate(data=None, der_is_signed=True)

      to

      Certificate(data, certdb=cert_get_default_certdb(), perm=False, nickname=None)

      This change was necessary because all certs should be added to the
      NSS temporary database when they are loaded, but earlier code
      failed to to that. It's is not likely that an previous code was
      failing to pass initialization data or the der_is_signed flag so
      this change should be backwards compatible.

    * Fix bug #922247, PKCS12Decoder.database_import() method. Importing into
      a NSS database would sometimes fail or segfault.

    * Error codes and descriptions were updated from upstream NSPR & NSS.

    * The password callback did not allow for breaking out of a password
      prompting loop, now if None is returned from the password callback
      the password prompting is terminated.

    * nss.nss_shutdown_context now called from InitContext destructor,
      this assures the context is shutdown even if the programmer forgot
      to. It's still best to explicitly shut it down, this is just
      failsafe.

    * Support was added for shutdown callbacks.

    * The following classes were added:
      - nss.CertVerifyLogNode
      - nss.CertVerifyLog
      - error.CertVerifyError (exception)
      - nss.AuthorityInfoAccess
      - nss.AuthorityInfoAccesses


    * The following class methods were added:
      - nss.Certificate.is_ca_cert
      - nss.Certificate.verify
      - nss.Certificate.verify_with_log
      - nss.Certificate.get_cert_chain
      - nss.Certificate.check_ocsp_status
      - nss.PK11Slot.list_certs
      - nss.CertVerifyLogNode.format_lines
      - nss.CertVerifyLog.format_lines
      - nss.CRLDistributionPts.format_lines

    * The following class properties were added:
      - nss.CertVerifyLogNode.certificate
      - nss.CertVerifyLogNode.error
      - nss.CertVerifyLogNode.depth
      - nss.CertVerifyLog.count

    * The following module functions were added:
      - nss.x509_cert_type
      - nss.key_usage_flags
      - nss.list_certs
      - nss.find_certs_from_email_addr
      - nss.find_certs_from_nickname
      - nss.nss_get_version
      - nss.nss_version_check
      - nss.set_shutdown_callback
      - nss.get_use_pkix_for_validation
      - nss.set_use_pkix_for_validation
      - nss.enable_ocsp_checking
      - nss.disable_ocsp_checking
      - nss.set_ocsp_cache_settings
      - nss.set_ocsp_failure_mode
      - nss.set_ocsp_timeout
      - nss.clear_ocsp_cache
      - nss.set_ocsp_default_responder
      - nss.enable_ocsp_default_responder
      - nss.disable_ocsp_default_responder

    * The following files were added:
        src/py_traceback.h
        doc/examples/verify_cert.py
        test/test_misc.py

    * The following constants were added:
      - nss.KU_DIGITAL_SIGNATURE
      - nss.KU_NON_REPUDIATION
      - nss.KU_KEY_ENCIPHERMENT
      - nss.KU_DATA_ENCIPHERMENT
      - nss.KU_KEY_AGREEMENT
      - nss.KU_KEY_CERT_SIGN
      - nss.KU_CRL_SIGN
      - nss.KU_ENCIPHER_ONLY
      - nss.KU_ALL
      - nss.KU_DIGITAL_SIGNATURE_OR_NON_REPUDIATION
      - nss.KU_KEY_AGREEMENT_OR_ENCIPHERMENT
      - nss.KU_NS_GOVT_APPROVED
      - nss.PK11CertListUnique
      - nss.PK11CertListUser
      - nss.PK11CertListRootUnique
      - nss.PK11CertListCA
      - nss.PK11CertListCAUnique
      - nss.PK11CertListUserUnique
      - nss.PK11CertListAll
      - nss.certUsageSSLClient
      - nss.certUsageSSLServer
      - nss.certUsageSSLServerWithStepUp
      - nss.certUsageSSLCA
      - nss.certUsageEmailSigner
      - nss.certUsageEmailRecipient
      - nss.certUsageObjectSigner
      - nss.certUsageUserCertImport
      - nss.certUsageVerifyCA
      - nss.certUsageProtectedObjectSigner
      - nss.certUsageStatusResponder
      - nss.certUsageAnyCA
      - nss.ocspMode_FailureIsVerificationFailure
      - nss.ocspMode_FailureIsNotAVerificationFailure

    * cert_dump.py extended to print NS_CERT_TYPE_EXTENSION

    * cert_usage_flags, nss_init_flags now support optional repr_kind parameter

    Internal Changes:
    -----------------

    * Reimplement exception handling
      - NSPRError is now derived from StandardException instead of
        EnvironmentError. It was never correct to derive from
        EnvironmentError but was difficult to implement a new subclassed
        exception with it's own attributes, using EnvironmentError had
        been expedient.

      - NSPRError now derived from StandardException, provides:
        * errno (numeric error code)
        * strerror (error description associated with error code)
        * error_message (optional detailed message)
        * error_code (alias for errno)
        * error_desc (alias for strerror)

      - CertVerifyError derived from NSPRError, extends with:
        * usages (bitmask of returned usages)
        * log (CertVerifyLog object)

    * Expose error lookup to sibling modules

    * Use macros for bitmask_to_list functions to reduce code
      duplication and centralize logic.

    * Add repr_kind parameter to cert_trust_flags_str()

    * Add support for repr_kind AsEnumName to bitstring table lookup.

    * Add cert_type_bitstr_to_tuple() lookup function

    * Add PRTimeConvert(), used to convert Python time values
      to PRTime, centralizes conversion logic, reduces duplication

    * Add UTF8OrNoneConvert to better handle unicode parameters which
      are optional.

    * Add Certificate_summary_format_lines() utility to generate
      concise certificate identification info for output.

    * Certificate_new_from_CERTCertificate now takes add_reference parameter
      to properly reference count certs, should fix shutdown busy problems.

    * Add print_traceback(), print_cert() debugging support.


author: John Dennis <jdennis@redhat.com> - 0.14.0-2
changelog:
  - resolves: bug#1002589
  - resolves: bug#1003979

  - Rewrite setup_certs.py. No longer behaves like an expect script
    which was fragile. By default now creates a sql style database.
  - By default all examples & tests use new sql format for NSS database
  - db-name is now used instead of dbdir to provide distinction between
    the database directory and it's scheme (e.g. 'sql:')
  - all examples and tests now default db-name to 'sql:pki'
  - replaced legacy getopt & optparse command line argument handling
    with modern argparse.


author: John Dennis <jdennis@redhat.com> - 0.14.0-3
changelog:
  - resolves: bug#1003979
  - In coordination with QE with regards to bz 1019934 it was requested
    the unittest patches be enhanced with a more robust version of
    test_pkcs12, no actual bug, just better testing.


author: John Dennis <jdennis@redhat.com> - 0.15.0-1
changelog:
  - resolves: bug#1109769 rebase to 0.15.0
  - includes fixes for 1087031 and 1060314
    See doc/Changelog for details


author: John Dennis <jdennis@redhat.com> - 0.16.0-1
changelog:
  - resolves: bug#1155703 - Add API call for SSL_VersionRangeSet (rebase)
    rebased to 0.16.0
  - The primary enhancements in this version is adding support for the
    setting trust attributes on a Certificate, the SSL version range API,
    information on the SSL cipher suites and information on the SSL connection.

    * The following module functions were added:

      - ssl.get_ssl_version_from_major_minor
      - ssl.get_default_ssl_version_range
      - ssl.get_supported_ssl_version_range
      - ssl.set_default_ssl_version_range
      - ssl.ssl_library_version_from_name
      - ssl.ssl_library_version_name
      - ssl.get_cipher_suite_info
      - ssl.ssl_cipher_suite_name
      - ssl.ssl_cipher_suite_from_name

    * The following deprecated module functions were removed:

      - ssl.nssinit
      - ssl.nss_ini
      - ssl.nss_shutdown

    * The following classes were added:

      - SSLCipherSuiteInfo
      - SSLChannelInfo

    * The following class methods were added:

      - Certificate.trust_flags
      - Certificate.set_trust_attributes

      - SSLSocket.set_ssl_version_range
      - SSLSocket.get_ssl_version_range
      - SSLSocket.get_ssl_channel_info
      - SSLSocket.get_negotiated_host
      - SSLSocket.connection_info_format_lines
      - SSLSocket.connection_info_format
      - SSLSocket.connection_info_str
  	
      - SSLCipherSuiteInfo.format_lines
      - SSLCipherSuiteInfo.format

      - SSLChannelInfo.format_lines
      - SSLChannelInfo.format

    * The following class properties were added:

      - Certificate.ssl_trust_flags
      - Certificate.email_trust_flags
      - Certificate.signing_trust_flags

      - SSLCipherSuiteInfo.cipher_suite
      - SSLCipherSuiteInfo.cipher_suite_name
      - SSLCipherSuiteInfo.auth_algorithm
      - SSLCipherSuiteInfo.auth_algorithm_name
      - SSLCipherSuiteInfo.kea_type
      - SSLCipherSuiteInfo.kea_type_name
      - SSLCipherSuiteInfo.symmetric_cipher
      - SSLCipherSuiteInfo.symmetric_cipher_name
      - SSLCipherSuiteInfo.symmetric_key_bits
      - SSLCipherSuiteInfo.symmetric_key_space
      - SSLCipherSuiteInfo.effective_key_bits
      - SSLCipherSuiteInfo.mac_algorithm
      - SSLCipherSuiteInfo.mac_algorithm_name
      - SSLCipherSuiteInfo.mac_bits
      - SSLCipherSuiteInfo.is_fips
      - SSLCipherSuiteInfo.is_exportable
      - SSLCipherSuiteInfo.is_nonstandard

      - SSLChannelInfo.protocol_version
      - SSLChannelInfo.protocol_version_str
      - SSLChannelInfo.protocol_version_enum
      - SSLChannelInfo.major_protocol_version
      - SSLChannelInfo.minor_protocol_version
      - SSLChannelInfo.cipher_suite
      - SSLChannelInfo.auth_key_bits
      - SSLChannelInfo.kea_key_bits
      - SSLChannelInfo.creation_time
      - SSLChannelInfo.creation_time_utc
      - SSLChannelInfo.last_access_time
      - SSLChannelInfo.last_access_time_utc
      - SSLChannelInfo.expiration_time
      - SSLChannelInfo.expiration_time_utc
      - SSLChannelInfo.compression_method
      - SSLChannelInfo.compression_method_name
      - SSLChannelInfo.session_id

    * The following files were added:

      - doc/examples/cert_trust.py
      - doc/examples/ssl_version_range.py

    * The following constants were added:
      - nss.CERTDB_TERMINAL_RECORD
      - nss.CERTDB_VALID_PEER
      - nss.CERTDB_TRUSTED
      - nss.CERTDB_SEND_WARN
      - nss.CERTDB_VALID_CA
      - nss.CERTDB_TRUSTED_CA
      - nss.CERTDB_NS_TRUSTED_CA
      - nss.CERTDB_USER
      - nss.CERTDB_TRUSTED_CLIENT_CA
      - nss.CERTDB_GOVT_APPROVED_CA
      - ssl.SRTP_AES128_CM_HMAC_SHA1_32
      - ssl.SRTP_AES128_CM_HMAC_SHA1_80
      - ssl.SRTP_NULL_HMAC_SHA1_32
      - ssl.SRTP_NULL_HMAC_SHA1_80
      - ssl.SSL_CK_DES_192_EDE3_CBC_WITH_MD5
      - ssl.SSL_CK_DES_64_CBC_WITH_MD5
      - ssl.SSL_CK_IDEA_128_CBC_WITH_MD5
      - ssl.SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
      - ssl.SSL_CK_RC2_128_CBC_WITH_MD5
      - ssl.SSL_CK_RC4_128_EXPORT40_WITH_MD5
      - ssl.SSL_CK_RC4_128_WITH_MD5
      - ssl.SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA
      - ssl.SSL_FORTEZZA_DMS_WITH_NULL_SHA
      - ssl.SSL_FORTEZZA_DMS_WITH_RC4_128_SHA
      - ssl.SSL_RSA_OLDFIPS_WITH_3DES_EDE_CBC_SHA
      - ssl.SSL_RSA_OLDFIPS_WITH_DES_CBC_SHA
      - ssl.TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA
      - ssl.TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA
      - ssl.TLS_DHE_DSS_WITH_AES_128_GCM_SHA256
      - ssl.TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA
      - ssl.TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA
      - ssl.TLS_DHE_DSS_WITH_DES_CBC_SHA
      - ssl.TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA
      - ssl.TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
      - ssl.TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
      - ssl.TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
      - ssl.TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
      - ssl.TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA
      - ssl.TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA
      - ssl.TLS_DHE_RSA_WITH_DES_CBC_SHA
      - ssl.TLS_DH_ANON_WITH_CAMELLIA_128_CBC_SHA
      - ssl.TLS_DH_ANON_WITH_CAMELLIA_256_CBC_SHA
      - ssl.TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA
      - ssl.TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA
      - ssl.TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA
      - ssl.TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA
      - ssl.TLS_DH_DSS_WITH_DES_CBC_SHA
      - ssl.TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA
      - ssl.TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA
      - ssl.TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA
      - ssl.TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA
      - ssl.TLS_DH_RSA_WITH_DES_CBC_SHA
      - ssl.TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA
      - ssl.TLS_DH_anon_EXPORT_WITH_RC4_40_MD5
      - ssl.TLS_DH_anon_WITH_3DES_EDE_CBC_SHA
      - ssl.TLS_DH_anon_WITH_AES_128_CBC_SHA
      - ssl.TLS_DH_anon_WITH_AES_256_CBC_SHA
      - ssl.TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA
      - ssl.TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA
      - ssl.TLS_DH_anon_WITH_DES_CBC_SHA
      - ssl.TLS_DH_anon_WITH_RC4_128_MD5
      - ssl.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
      - ssl.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
      - ssl.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
      - ssl.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
      - ssl.TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256
      - ssl.TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256
      - ssl.TLS_EMPTY_RENEGOTIATION_INFO_SCSV
      - ssl.TLS_FALLBACK_SCSV
      - ssl.TLS_NULL_WITH_NULL_NULL
      - ssl.TLS_RSA_EXPORT_WITH_DES40_CBC_SHA
      - ssl.TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5
      - ssl.TLS_RSA_EXPORT_WITH_RC4_40_MD5
      - ssl.TLS_RSA_WITH_3DES_EDE_CBC_SHA
      - ssl.TLS_RSA_WITH_AES_128_CBC_SHA256
      - ssl.TLS_RSA_WITH_AES_128_GCM_SHA256
      - ssl.TLS_RSA_WITH_AES_256_CBC_SHA256
      - ssl.TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
      - ssl.TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
      - ssl.TLS_RSA_WITH_DES_CBC_SHA
      - ssl.TLS_RSA_WITH_IDEA_CBC_SHA
      - ssl.TLS_RSA_WITH_NULL_MD5
      - ssl.TLS_RSA_WITH_NULL_SHA
      - ssl.TLS_RSA_WITH_NULL_SHA256
      - ssl.TLS_RSA_WITH_RC4_128_MD5
      - ssl.TLS_RSA_WITH_RC4_128_SHA
      - ssl.TLS_RSA_WITH_SEED_CBC_SHA
      - ssl.SSL_VARIANT_DATAGRAM
      - ssl.SSL_VARIANT_STREAM
      - ssl.SSL_LIBRARY_VERSION_2
      - ssl.SSL_LIBRARY_VERSION_3_0
      - ssl.SSL_LIBRARY_VERSION_TLS_1_0
      - ssl.SSL_LIBRARY_VERSION_TLS_1_1
      - ssl.SSL_LIBRARY_VERSION_TLS_1_2
      - ssl.SSL_LIBRARY_VERSION_TLS_1_3
      - ssl.ssl2
      - ssl.ssl3
      - ssl.tls1.0
      - ssl.tls1.1
      - ssl.tls1.2
      - ssl.tls1.3

     * The following methods were missing thread locks, this has been fixed.

       - nss.nss_initialize
       - nss.nss_init_context
       - nss.nss_shutdown_context


author: Toshio Kuratomi <toshio@fedoraproject.org> - 2.0.0-7.gitd1c6db8
changelog:
  - Remove Obsoletes in the python-pillow-qt subpackage. Obsoletes isn't
    appropriate since qt support didn't exist in the previous python-pillow
    package so there's no reason to drag in python-pillow-qt when updating
    python-pillow.


author: Roman Rakus <rrakus@redhat.com> - 2.0.0-12
changelog:
  - Mark doc subpackage arch dependent. Docs are built depending on supported
    features, which are different across archs.
    Resolves: rhbz#987839


author: Charalampos Stratakis <cstratak@redhat.com> - 2.0.0-23gitd1c6db8
changelog:
  - Fixup for CVE-2022-22817
  - Security fixes for CVE-2022-22815, CVE-2022-22816
  Resolves: rhbz#2042522


author: Devrim Gündüz <devrim@gunduz.org> 2.5-1
changelog:
  - Update to 2.5, per changes described at:
    http://www.psycopg.org/psycopg/articles/2013/04/07/psycopg-25-released/


author: Kamil Dudka <kdudka@redhat.com> - 7.19.0-15
changelog:
  - allow to return -1 from the write callback (#857875) 
  - remove the patch for curl-config --static-libs no longer needed
  - run the tests against the just built pycurl, not the system one


author: ckozak <ckozak@redhat.com>
changelog:
  - 1006748: replace simplejson with 'ourjson' (alikins@redhat.com)
  - Log the new requestUuid from candlepin if it is present in the response.
    (dgoodwin@redhat.com)


author: ckozak <ckozak@redhat.com> 1.10.6-1
changelog:
  - Fix a crash that occurs when rhsm.conf is missing (ckozak@redhat.com)
  - Correct implementation of __eq__ for Content objects. (awood@redhat.com)
  - Log ca_dir and loaded ca pems on one line. (alikins@redhat.com)
  - Add default full_refresh_on_yum option. (awood@redhat.com)
  - Send empty JSON list when deleting all overrides. (awood@redhat.com)
  - Add __hash__ method to Content classes. (awood@redhat.com)
  - Add method to get all content overrides for a consumer (mstead@redhat.com)
  - Add methods to set and delete content overrides. (awood@redhat.com)
  - 1008808: json ValueErrors have no .msg attribute (alikins@redhat.com)


author: ckozak <ckozak@redhat.com> 1.10.9-1
changelog:
  - Removing entitlement cert and key from getEntitlementList (ckozak@redhat.com)
  - respect http(s)_proxy env variable for proxy information (jesusr@redhat.com)


author: ckozak <ckozak@redhat.com> 1.10.12-2
changelog:
  - Add attributes for brand_name (alikins@redhat.com)
  - updated tito.props (ckozak@redhat.com)
  - removed other releasers (ckozak@redhat.com)


author: Alex Wood <awood@redhat.com> 1.13.6-1
changelog:
  - 1153375: Support TLSv1.2 and v1.1 by default. (alikins@redhat.com)
  - Set CA PEM files permissions to 644. (awood@redhat.com)


author: William Poteat <wpoteat@redhat.com> 1.13.10-1
changelog:
  - Add custom JSON encoding for set objects. (awood@redhat.com)
  - Update SSL context options to follow the M2Crypto standard idiom.
    (awood@redhat.com)


author: Vritant Jain <vrjain@redhat.com> 1.17.2-1
changelog:
  - Added 7.3 releaser (vrjain@redhat.com)
  - Updated UEPConnection.getProduct to explicitly reference product UUID
    (crog@redhat.com)


author: Vritant Jain <vrjain@redhat.com> 1.17.4-1
changelog:
  - 1346417: Allow users to set socket timeout. (awood@redhat.com)
  - Fix Flake8 Errors (bcourt@redhat.com)
  - Add Fedora 24 to the branch list. (awood@redhat.com)
  - Added basic SLES compatibilty. Tested against SLES 11 SP3
    (darinlively@gmail.com)


author: Vritant Jain <vrjain@redhat.com> 1.17.6-1
changelog:
  - 1315901: Exception handling for PEM cert read (wpoteat@redhat.com)
  - 1334916: Add rhsm.conf logging section defaults (csnyder@redhat.com)
  - 1360909: Added functionality for regenerating entitlement certificates
    (crog@redhat.com)


author: Vritant Jain <vrjain@redhat.com> 1.17.7-1
changelog:
  - 1366301: Entitlement regeneration no longer propagates server errors
    (crog@redhat.com)
  - 1365280: Update default_log_level to INFO (csnyder@redhat.com)


author: Alex Wood <awood@redhat.com> 1.19.0-1
changelog:
  - Bump version to 1.19 (adarshvritant@gmail.com)
  - Adds new super class BaseRhsmLib that exposes request results.
    (awood@redhat.com)


author: Alex Wood <awood@redhat.com> 1.19.1-1
changelog:
  - Adjust our C bindings for OpenSSL v1.1 API. (awood@redhat.com)
  - Make python-rhsm Python-3 compatible (khowell@redhat.com)


author: Kevin Howell <khowell@redhat.com> 1.19.2-1
changelog:
  - 1423443: Handle IndexError during m2crypto request (khowell@redhat.com)
  - Move python-rhsm into subdirectory (khowell@redhat.com)


author: Kevin Howell <khowell@redhat.com> 1.19.3-1
changelog:
  - 1435475: Support older versions of M2Crypto (awood@redhat.com)
  - 1427069: Prioritize content from Basic entitlements (khowell@redhat.com)


author: Kevin Howell <khowell@redhat.com> 1.19.4-1
changelog:
  - 1438552: Allows releases to be listed through a proxy (csnyder@redhat.com)
  - 1420533: Add no_proxy option to API, config, UI (khowell@redhat.com)


author: Kevin Howell <khowell@redhat.com> 1.19.6-1
changelog:
  - 1426343: fixed rct to display cert without subjectAltName.
    (jhnidek@redhat.com)
  - Add Update subscriptions pools (tcoufal@redhat.com)
  - Add support to list future subscription pools (tcoufal@redhat.com)


author: Kevin Howell <khowell@redhat.com> 1.19.7-1
changelog:
  - 1443159: Added default value for splay configuration (jhnidek@redhat.com)
  - 1451166: Fix Host header when using proxy (khowell@redhat.com)


author: Kevin Howell <khowell@redhat.com> 1.19.9-1
changelog:
  - 1444453: Have gettext return unicode instead of bytes. (awood@redhat.com)
  - 1457197: Env. variable no_proxy=* is not ignored (jhnidek@redhat.com)


author: Arnaldo Carvalho de Melo <acme@redhat.com> - 0.2-1
changelog:
  - Add get_priority_{min,max} methods
  - Add constants for SCHED_{BATCH,FIFO,OTHER,RR}
  - Implement get_priority method
  - Add pchrt utility for testing the bindings, chrt clone
  - Add ptaskset utility for testing the bindings, taskset clone


author: Charalampos Stratakis <cstratak@redhat.com> - 1.0.13-8
changelog:
  - Fix memory leak in the auth_fn callback.
  - Make sure auth info is NUL-terminated.
  Resolves: rhbz#1248519


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.2.6-9
changelog:
  - Python 2 binary package renamed to python2-subprocess32
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Marcel Plch <mplch@redhat.com> - 3.2.6-14
changelog:
  - Backport upstream patch for heap overflow when parsing too many arguments
  - Resolves: rhbz#1619386


author: Thomas Spura <tomspur@fedoraproject.org> - 2.2.1-1
changelog:
  - update to upstream release 2.2.1 (fixes CVE-2012-2374)
  - fix typo for epel6 macro bug #822972 (Florian La Roche)


author: Julian Sikorski <belegdol@fedoraproject.org> - 11.1.0-1
changelog:
  - Updated to 11.1.0
  - Obsoleted zsh subpackage (upstream ticket #3078)
  - mktap is gone (upstream ticket #5293)
  - Dropped obsolete Group, Buildroot, %clean and %defattr


author: Lumir Balhar & Tomas Orsava <lbalhar@redhat.com> - 3.6.8-2
changelog:
  - Converting F28 python3 specfile to RHEL7
  - Updated the bootstrapping sequence
  - Disabled LTO because of buggy support for it in gcc on RHEL7
  - Removed deprecated system-python and platform-python tags and files
  - Removed a tag from `python3-libs` that recommended the `python3` package,
    because the Recommends tag doesn't work in RHEL7
  - Remove unnecessary unversioned requires on glibc and gdbm
  - Changes from RHEL8:
    - Move macros.pybytecompile to python-rpm-macros
    - Enable test_gdb, test_faulthandler
  - Changes from Fedora:
    - Security fix for CVE-2019-5010 (#1666519, #1666522)
    - Make sure we don't ship any exe files (not needed an prebuilt)
  Resolves: rhbz#1597718


author: Tomas Orsava <torsava@redhat.com> - 3.6.8-4
changelog:
  - Add explicit conflicts with python34 < 3.4.9-3, which was the main python3
    package in EPEL before that version and contained conflicting files,
    e.g. /usr/bin/python3
  Resolves: rhbz#1597718


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-8
changelog:
  - Disallow control chars in http URLs
  - Fixes CVE-2019-9740 and CVE-2019-9947
  Resolves: rhbz#1703535 and rhbz#1704364


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-18
changelog:
  - Avoid infinite loop when reading specially crafted TAR files (CVE-2019-20907)
  Resolves: rhbz#1856481
  - Resolve hash collisions for Pv4Interface and IPv6Interface (CVE-2020-14422)
  Resolves: rhbz#1854926


author: Marcin Zajaczkowski <mszpak ATT wp DOTT pl> - 0.5.0-5
changelog:
  - remove prodive/obsolete of python-xattr (bug 781838)
  - fix problem with mixed use of tabs and spaces


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.1.0-2.el7
changelog:
  - Create separate qemu-guest-agent package based on qemu-kvm-rhev-2.1.0-1.el7 [bz#1117096]
  - Resolves: #bz1117096


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.1.0-3.el7
changelog:
  - Allow building qemu-guest-agent on ppc64le
  - Synchronize with qemu-kvm-rhev-2.1.0-3.el7
  - Resolves: bz#1132718
    (qemu-guest-agent fails to build for ppc64le)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.1.0-4.el7
changelog:
  - kvm-Mark-etc-sysconfig-qemu-ga-as-config-noreplace.patch [bz#1150924]
  - Resolves: bz#1150924
    (/etc/sysconfig/qemu-ga is replaced when updated)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.3.0-2.el7
changelog:
  - synchronized with qemu-kvm-rhev-2.3.0-9.el7
  - qemuga-Change-fsreeze-hook-default-location.patch [bz#1210707]
  - qemuga-qga-commands-posix-Fix-bug-in-guest-fstrim.patch [bz#1211973]
  - Resolves: bz#1210707
    (The default path '/etc/qemu/fsfreeze-hook' for 'fsfreeze-hook' script doesn't exist)
  - Resolves: bz#1211973
    ('guest-fstrim' failed for guest with os on spapr-vscsi disk)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.3.0-3.el7
changelog:
  - qemuga-Do-not-stop-qemu-guest-agent-service-on-target-switc.patch [bz#1160930]
  - Resolves: bz#1160930
    (The guest agent service in rhel7 guest will be stopped after run the init command)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.5.0-2.el7
changelog:
  - qemuga-redhat-blacklist-guest-exec-commands.patch [bz#1340346]
  - Resolves: bz#1340346
    (blacklist guest-exec in newer version of qemu-guest-agent)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.5.0-3.el7
changelog:
  - qemuga-spec-add-qemu-ga-man-page.patch [bz#1101556]
  - Resolves: bz#1101556
    ([RFE] qemu-ga should have a config file)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.8.0-1.el7
changelog:
  - Rebase to 2.8.0 base [bz#1414676]
  - Resolves: bz#1414676
    (Rebase qemu-guest-agent to 2.8.0 base)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.8.0-2.el7
changelog:
  - qemuga-Remove-unnecessary-dependencies.patch [bz#1441999]
  - Resolves: bz#1441999
    (Clean qemu-ga dependencies)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.12.0-1.el7
changelog:
  - Rebase to 2.12.0 base [bz#1562218]
  - Resolves: bz#1562218
    (Rebase qemu-guest-agent for RHEL-7.6)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.12.0-2.el7
changelog:
  - qemuga-qemu-ga-make-get-fsinfo-work-over-pci-bridges.patch [bz#1567041]
  - qemuga-qga-fix-driver-leak-in-guest-get-fsinfo.patch [bz#1567041]
  - Resolves: bz#1567041
    (qemu-guest-agent does not parse PCI bridge links in "build_guest_fsinfo_for_real_device" (q35))


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.12.0-3.el7
changelog:
  - qemuga-qga-ignore-non-present-cpus-when-handling-qmp_guest_.patch [bz#1611062]
  - qemuga-qemu-guest-agent.spec-add-systemd-devel-dependency.patch [bz#1635571]
  - qemuga-configure-add-test-for-libudev.patch [bz#1635571]
  - qemuga-qga-linux-report-disk-serial-number.patch [bz#1635571]
  - qemuga-qga-linux-return-disk-device-in-guest-get-fsinfo.patch [bz#1635571]
  - Resolves: bz#1611062
    ("virsh vcpucount --guest" fails after hotunplug a vcpu with intermediate order by "setvcpu")
  - Resolves: bz#1635571
    ([RFE] Report disk device name and serial number (qemu-guest-agent on Linux))


author: Wainer dos Santos Moschetta <wainersm@redhat.com> - 2.8.0-3.el7
changelog:
  - qemuga-qga-Add-guest-get-host-name-command.patch [bz#1598210]
  - qemuga-qga-Add-guest-get-users-command.patch [bz#1598210]
  - qemuga-qga-Add-guest-get-timezone-command.patch [bz#1598210]
  - qemuga-qemu-ga-check-if-utmpx.h-is-available-on-the-system.patch [bz#1598210]
  - qemuga-qemu-ga-add-guest-get-osinfo-command.patch [bz#1598210]
  - qemuga-test-qga-pass-environemnt-to-qemu-ga.patch [bz#1598210]
  - qemuga-test-qga-add-test-for-guest-get-osinfo.patch [bz#1598210]
  - Resolves: bz#1598210
    (Backport some features to 2.8 in RHEL 7.5 [rhel-7.5.z])


author: Wainer dos Santos Moschetta <wainersm@redhat.com> - 2.8.0-2.el7_5.1
changelog:
  - Corrected the package version from 2.8.0-3.el7 to 2.8.0-2.el7_5.1
  - Resolves: bz#1598210
    (Backport some features to 2.8 in RHEL 7.5 [rhel-7.5.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-97.el7
changelog:
  - kvm-ide-Check-array-bounds-before-writing-to-io_buffer-C.patch [bz#1243690]
  - kvm-ide-atapi-Fix-START-STOP-UNIT-command-completion.patch [bz#1243690]
  - kvm-ide-Clear-DRQ-after-handling-all-expected-accesses.patch [bz#1243690]
  - Resolves: bz#1243690
    (EMBARGOED CVE-2015-5154 qemu-kvm: qemu: ide: atapi: heap overflow during I/O buffer memory access [rhel-7.2])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-98.el7
changelog:
  - kvm-block-curl-Don-t-lose-original-error-when-a-connecti.patch [bz#1235812]
  - kvm-vfio-pci-Add-pba_offset-PCI-quirk-for-Chelsio-T5-dev.patch [bz#1244347]
  - kvm-block-Print-its-file-name-if-backing-file-opening-fa.patch [bz#1238639]
  - kvm-block-Propagate-error-in-bdrv_img_create.patch [bz#1238639]
  - kvm-iotests-Add-test-for-non-existing-backing-file.patch [bz#1238639]
  - Resolves: bz#1235812
    (block/curl: Fix generic "Input/output error" on failure)
  - Resolves: bz#1238639
    (qemu-img shows error message for backing file twice)
  - Resolves: bz#1244347
    (Quirk for Chelsio T5 MSI-X PBA)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-99.el7
changelog:
  - kvm-usb-ccid-add-missing-wakeup-calls.patch [bz#1243731]
  - kvm-vpc-Handle-failure-for-potentially-large-allocations.patch [bz#1217349]
  - kvm-block-vpc-prevent-overflow-if-max_table_entries-0x40.patch [bz#1217349]
  - kvm-block-qemu-iotests-add-check-for-multiplication-over.patch [bz#1217349]
  - kvm-virtio-scsi-use-virtqueue_map_sg-when-loading-reques.patch [bz#1249718]
  - kvm-scsi-disk-fix-cmd.mode-field-typo.patch [bz#1249718]
  - kvm-rtl8139-avoid-nested-ifs-in-IP-header-parsing-CVE-20.patch [bz#1248766]
  - kvm-rtl8139-drop-tautologous-if-ip-.-statement-CVE-2015-.patch [bz#1248766]
  - kvm-rtl8139-skip-offload-on-short-Ethernet-IP-header-CVE.patch [bz#1248766]
  - kvm-rtl8139-check-IP-Header-Length-field-CVE-2015-5165.patch [bz#1248766]
  - kvm-rtl8139-check-IP-Total-Length-field-CVE-2015-5165.patch [bz#1248766]
  - kvm-rtl8139-skip-offload-on-short-TCP-header-CVE-2015-51.patch [bz#1248766]
  - kvm-rtl8139-check-TCP-Data-Offset-field-CVE-2015-5165.patch [bz#1248766]
  - Resolves: bz#1217349
    (qemu-img vpc driver segfault)
  - Resolves: bz#1243731
    (smart card emulation doesn't work with USB3 (nec-xhci) controller)
  - Resolves: bz#1248766
    (CVE-2015-5165 qemu-kvm: Qemu: rtl8139 uninitialized heap memory information leakage to guest [rhel-7.2])
  - Resolves: bz#1249718
    (Segfault occurred at Dst VM while completed migration upon ENOSPC)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-100.el7
changelog:
  - kvm-block-update-test-070-for-vhdx.patch [bz#1171576]
  - kvm-block-coverity-fix-check-return-value-for-fcntl-in-g.patch [bz#1219217]
  - Resolves: bz#1171576
    (test case 064 and 070 of qemu-iotests fail for vhdx with qemu-kvm-1.5.3-83.el7)
  - Resolves: bz#1219217
    (Coverity-detected defect: call to fcntl without checking return value)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-101.el7
changelog:
  - kvm-serial-reset-state-at-startup.patch [bz#922014]
  - kvm-ide-Check-validity-of-logical-block-size.patch [bz#1134670]
  - Resolves: bz#1134670
    (fail to specify the physical_block_size/logical_block_size value not 512 for IDE disk)
  - Resolves: bz#922014
    (RFE: support hotplugging chardev & serial ports (Windows guests))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-102.el7
changelog:
  - kvm-mc146818rtc-add-rtc-reset-reinjection-QMP-command.patch [bz#1191226]
  - Resolves: bz#1191226
    (libvirt requires rtc-reset-reinjection command, backport it to RHEL7.1)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-103.el7
changelog:
  - kvm-Drop-superfluous-conditionals-around-g_strdup.patch [bz#1218919]
  - kvm-util-Drop-superfluous-conditionals-around-g_free.patch [bz#1218919]
  - kvm-util-Fuse-g_malloc-memset-into-g_new0.patch [bz#1218919]
  - kvm-util-uri-uri_new-can-t-fail-drop-dead-error-handling.patch [bz#1218919]
  - kvm-util-uri-realloc2n-can-t-fail-drop-dead-error-handli.patch [bz#1218919]
  - kvm-util-uri-URI-member-path-can-be-null-compare-more-ca.patch [bz#1218919]
  - kvm-util-uri-Add-overflow-check-to-rfc3986_parse_port.patch [bz#1218919]
  - Resolves: bz#1218919
    (Coverity-detected defect: buffer overrun at uri.c:2035)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-104.el7
changelog:
  - kvm-qemu-iotests-Filter-qemu-io-output-in-025.patch [bz#1170974]
  - Resolves: bz#1170974
    (test case 025 of qemu-iotests fail for raw with qemu-kvm-1.5.3-83.el7.x86_64)


author: Jeff E. Nelson <jen@redhat.com> - 1.5.3-105.el7
changelog:
  - kvm-qtest-ide-test-disable-flush-test.patch [bz#1270341]
  - Resolves: bz#1270341
    (qemu-kvm build failure race condition in tests/ide-test)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-105.el7_2.1
changelog:
  - kvm-rbd-make-qemu-s-cache-setting-override-any-ceph-sett.patch [bz#1279389]
  - kvm-rbd-fix-ceph-settings-precedence.patch [bz#1279389]
  - Resolves: bz#1279389
    (ceph.conf properties override qemu's command-line properties)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-105.el7_2.2
changelog:
  - kvm-raw-posix-Fix-.bdrv_co_get_block_status-for-unaligne.patch [bz#1298828]
  - Resolves: bz#1298828
    ([abrt] qemu-img: get_block_status(): qemu-img killed by SIGABRT)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-105.el7_2.3
changelog:
  - kvm-fw_cfg-add-check-to-validate-current-entry-value-CVE.patch [bz#1298047]
  - Resolves: bz#1298047
    (CVE-2016-1714 qemu-kvm: Qemu: nvram: OOB r/w access in processing firmware configurations [rhel-7.2.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-105.el7_2.4
changelog:
  - kvm-vga-Remove-some-should-be-done-in-BIOS-comments.patch [bz#1331412]
  - kvm-vga-fix-banked-access-bounds-checking-CVE-2016-3710.patch [bz#1331412]
  - kvm-vga-add-vbe_enabled-helper.patch [bz#1331412]
  - kvm-vga-factor-out-vga-register-setup.patch [bz#1331412]
  - kvm-vga-update-vga-register-setup-on-vbe-changes.patch [bz#1331412]
  - kvm-vga-make-sure-vga-register-setup-for-vbe-stays-intac.patch [bz#1331412]
  - Resolves: bz#1331412
    (EMBARGOED CVE-2016-3710 qemu-kvm: qemu: incorrect banked access bounds checking in vga module [rhel-7.2.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-105.el7_2.5
changelog:
  - kvm-vga-add-sr_vbe-register-set.patch [bz#1347527]
  - Resolves: bz#1347527
    (Regression from CVE-2016-3712: windows installer fails to start)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-105.el7_2.6
changelog:
  - kvm-virtio-error-out-if-guest-exceeds-virtqueue-size.patch [bz#1359728]
  - Resolves: bz#1359728
    (EMBARGOED CVE-2016-5403 qemu-kvm: Qemu: virtio: unbounded memory allocation on host via guest leading to DoS [rhel-7.2.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-105.el7_2.7
changelog:
  - kvm-block-iscsi-avoid-potential-overflow-of-acb-task-cdb.patch [bz#1358996]
  - Resolves: bz#1358996
    (CVE-2016-5126 qemu-kvm: Qemu: block: iscsi: buffer overflow in iscsi_aio_ioctl [rhel-7.2.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.1
changelog:
  - kvm-ide-fix-halted-IO-segfault-at-reset.patch [bz#1393042]
  - kvm-hw-i386-regenerate-checked-in-AML-payload-RHEL-only.patch [bz#1392027]
  - kvm-SPEC-file-flip-the-build-from-IASL-to-checked-in-AML.patch [bz#1392027]
  - Resolves: bz#1392027
    (shutdown rhel 5.11 guest failed and stop at "system halted")
  - Resolves: bz#1393042
    (system_reset should clear pending request for error (IDE))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.2
changelog:
  - kvm-virtio-introduce-virtqueue_unmap_sg.patch [bz#1393484]
  - kvm-virtio-introduce-virtqueue_discard.patch [bz#1393484]
  - kvm-virtio-decrement-vq-inuse-in-virtqueue_discard.patch [bz#1393484]
  - kvm-balloon-fix-segfault-and-harden-the-stats-queue.patch [bz#1393484]
  - kvm-virtio-balloon-discard-virtqueue-element-on-reset.patch [bz#1393484]
  - kvm-virtio-zero-vq-inuse-in-virtio_reset.patch [bz#1393484]
  - kvm-virtio-add-virtqueue_rewind.patch [bz#1393484]
  - kvm-virtio-balloon-fix-stats-vq-migration.patch [bz#1393484]
  - Resolves: bz#1393484
    ([RHEL7.3] KVM guest shuts itself down after 128th reboot)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.3
changelog:
  - kvm-net-check-packet-payload-length.patch [bz#1398217]
  - Resolves: bz#1398217
    (CVE-2016-2857 qemu-kvm: Qemu: net: out of bounds read in net_checksum_calculate() [rhel-7.3.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.4
changelog:
  - kvm-virtio-blk-Release-s-rq-queue-at-system_reset.patch [bz#1420049]
  - kvm-cirrus_vga-fix-off-by-one-in-blit_region_is_unsafe.patch [bz#1418232]
  - kvm-display-cirrus-check-vga-bits-per-pixel-bpp-value.patch [bz#1418232]
  - kvm-display-cirrus-ignore-source-pitch-value-as-needed-i.patch [bz#1418232]
  - kvm-cirrus-handle-negative-pitch-in-cirrus_invalidate_re.patch [bz#1418232]
  - kvm-cirrus-allow-zero-source-pitch-in-pattern-fill-rops.patch [bz#1418232]
  - kvm-cirrus-fix-blit-address-mask-handling.patch [bz#1418232]
  - kvm-cirrus-fix-oob-access-issue-CVE-2017-2615.patch [bz#1418232]
  - Resolves: bz#1418232
    (CVE-2017-2615 qemu-kvm: Qemu: display: cirrus: oob access while doing bitblt copy backward mode [rhel-7.3.z])
  - Resolves: bz#1420049
    (system_reset should clear pending request for error (virtio-blk))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.5
changelog:
  - kvm-cirrus-fix-patterncopy-checks.patch [bz#1420490]
  - kvm-Revert-cirrus-allow-zero-source-pitch-in-pattern-fil.patch [bz#1420490]
  - kvm-cirrus-add-blit_is_unsafe-call-to-cirrus_bitblt_cput.patch [bz#1420490]
  - Resolves: bz#1420490
    (EMBARGOED CVE-2017-2620 qemu-kvm: Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo [rhel-7.3.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.6
changelog:
  - kvm-fix-cirrus_vga-fix-OOB-read-case-qemu-Segmentation-f.patch [bz#1430059]
  - kvm-cirrus-vnc-zap-bitblit-support-from-console-code.patch [bz#1430059]
  - kvm-cirrus-add-option-to-disable-blitter.patch [bz#1430059]
  - kvm-cirrus-fix-cirrus_invalidate_region.patch [bz#1430059]
  - kvm-cirrus-stop-passing-around-dst-pointers-in-the-blitt.patch [bz#1430059]
  - kvm-cirrus-stop-passing-around-src-pointers-in-the-blitt.patch [bz#1430059]
  - kvm-cirrus-fix-off-by-one-in-cirrus_bitblt_rop_bkwd_tran.patch [bz#1430059]
  - Resolves: bz#1430059
    (CVE-2016-9603 qemu-kvm: Qemu: cirrus: heap buffer overflow via vnc connection [rhel-7.3.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.7
changelog:
  - kvm-char-serial-cosmetic-fixes.patch [bz#1452332]
  - kvm-char-serial-Use-generic-Fifo8.patch [bz#1452332]
  - kvm-char-serial-serial_ioport_write-Factor-out-common-co.patch [bz#1452332]
  - kvm-char-serial-fix-copy-paste-error-fifo8_is_full-vs-em.patch [bz#1452332]
  - kvm-char-serial-Fix-emptyness-check.patch [bz#1452332]
  - kvm-char-serial-Fix-emptyness-handling.patch [bz#1452332]
  - kvm-serial-poll-the-serial-console-with-G_IO_HUP.patch [bz#1452332]
  - kvm-serial-change-retry-logic-to-avoid-concurrency.patch [bz#1452332]
  - kvm-qemu-char-ignore-flow-control-if-a-PTY-s-slave-is-no.patch [bz#1452332]
  - kvm-serial-check-if-backed-by-a-physical-serial-port-at-.patch [bz#1452332]
  - kvm-serial-reset-thri_pending-on-IER-writes-with-THRI-0.patch [bz#1452332]
  - kvm-serial-clean-up-THRE-TEMT-handling.patch [bz#1452332]
  - kvm-serial-update-LSR-on-enabling-disabling-FIFOs.patch [bz#1452332]
  - kvm-serial-only-resample-THR-interrupt-on-rising-edge-of.patch [bz#1452332]
  - kvm-serial-make-tsr_retry-unsigned.patch [bz#1452332]
  - kvm-serial-simplify-tsr_retry-reset.patch [bz#1452332]
  - kvm-serial-separate-serial_xmit-and-serial_watch_cb.patch [bz#1452332]
  - kvm-serial-remove-watch-on-reset.patch [bz#1452332]
  - Resolves: bz#1452332
    (RHEL 7.2 based VM (Virtual Machine) hung for several hours apparently waiting for lock held by main_loop)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.8
changelog:
  - kvm-char-change-qemu_chr_fe_add_watch-to-return-unsigned.patch [bz#1452332]
  - Resolves: bz#1452332
    (RHEL 7.2 based VM (Virtual Machine) hung for several hours apparently waiting for lock held by main_loop)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.9
changelog:
  - kvm-spice-fix-spice_chr_add_watch-pre-condition.patch [bz#1452332]
  - Resolves: bz#1452332
    (RHEL 7.2 based VM (Virtual Machine) hung for several hours apparently waiting for lock held by main_loop)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.10
changelog:
  - kvm-nbd-Fully-initialize-client-in-case-of-failed-negoti.patch [bz#1460179]
  - kvm-nbd-Fix-regression-on-resiliency-to-port-scan.patch [bz#1460179]
  - Resolves: bz#1460179
    (CVE-2017-9524 qemu-kvm: Qemu: nbd: segmentation fault due to client non-negotiation [rhel-7.3.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-120.el7
changelog:
  - kvm-Add-install-dependency-to-newer-libusbx-version.patch [bz#1351106]
  - kvm-virtio-error-out-if-guest-exceeds-virtqueue-size.patch [bz#1359729]
  - Resolves: bz#1351106
    (symbol lookup error: /usr/libexec/qemu-kvm: undefined symbol: libusb_get_port_numbers)
  - Resolves: bz#1359729
    (CVE-2016-5403 qemu-kvm: Qemu: virtio: unbounded memory allocation on host via guest leading to DoS [rhel-7.3])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-121.el7
changelog:
  - kvm-json-parser-drop-superfluous-assignment-for-token-va.patch [bz#1276036]
  - kvm-qjson-Apply-nesting-limit-more-sanely.patch [bz#1276036]
  - kvm-qjson-Don-t-crash-when-input-exceeds-nesting-limit.patch [bz#1276036]
  - kvm-check-qjson-Add-test-for-JSON-nesting-depth-limit.patch [bz#1276036]
  - kvm-qjson-Spell-out-some-silent-assumptions.patch [bz#1276036]
  - kvm-qjson-Give-each-of-the-six-structural-chars-its-own-.patch [bz#1276036]
  - kvm-qjson-Inline-token_is_keyword-and-simplify.patch [bz#1276036]
  - kvm-qjson-Inline-token_is_escape-and-simplify.patch [bz#1276036]
  - kvm-qjson-replace-QString-in-JSONLexer-with-GString.patch [bz#1276036]
  - kvm-qjson-Convert-to-parser-to-recursive-descent.patch [bz#1276036]
  - kvm-qjson-store-tokens-in-a-GQueue.patch [bz#1276036]
  - kvm-qjson-surprise-allocating-6-QObjects-per-token-is-ex.patch [bz#1276036]
  - kvm-qjson-Limit-number-of-tokens-in-addition-to-total-si.patch [bz#1276036]
  - kvm-json-streamer-Don-t-leak-tokens-on-incomplete-parse.patch [bz#1276036]
  - kvm-json-streamer-fix-double-free-on-exiting-during-a-pa.patch [bz#1276036]
  - kvm-trace-remove-malloc-tracing.patch [bz#1360137]
  - Resolves: bz#1276036
    (Crash on QMP input exceeding limits)
  - Resolves: bz#1360137
    (GLib-WARNING **: gmem.c:482: custom memory allocation vtable not supported)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-122.el7
changelog:
  - kvm-virtio-validate-the-existence-of-handle_output-befor.patch [bz#1367040]
  - Resolves: bz#1367040
    (QEMU crash when guest notifies non-existent virtqueue)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-123.el7
changelog:
  - kvm-Fix-backport-of-target-i386-add-feature-flags-for-CP.patch [bz#1371619]
  - kvm-Add-skip_dump-flag-to-ignore-memory-region-during-du.patch [bz#1373088]
  - Resolves: bz#1371619
    (Flags xsaveopt xsavec xgetbv1 are missing on qemu-kvm)
  - Resolves: bz#1373088
    ([FJ7.3 Bug]: virsh dump with both --memory-only and --format option fails)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-124.el7
changelog:
  - kvm-target-i386-Add-support-for-FEAT_7_0_ECX.patch [bz#1372459]
  - kvm-target-i386-Add-more-Intel-AVX-512-instructions-supp.patch [bz#1372459]
  - Resolves: bz#1372459
    ([Intel 7.3 Bug] SKL-SP Guest cpu doesn't support avx512 instruction sets(avx512bw, avx512dq and avx512vl) (qemu-kvm))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-125.el7
changelog:
  - kvm-nbd-server-Set-O_NONBLOCK-on-client-fd.patch [bz#1285453]
  - Resolves: bz#1285453
    (An NBD client can cause QEMU main loop to block when connecting to built-in NBD server)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7
changelog:
  - kvm-virtio-recalculate-vq-inuse-after-migration.patch [bz#1376542]
  - Resolves: bz#1376542
    (RHSA-2016-1756 breaks migration of instances)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-132.el7
changelog:
  - kvm-cirrus-fix-patterncopy-checks.patch [bz#1420492]
  - kvm-Revert-cirrus-allow-zero-source-pitch-in-pattern-fil.patch [bz#1420492]
  - kvm-cirrus-add-blit_is_unsafe-call-to-cirrus_bitblt_cput.patch [bz#1420492]
  - Resolves: bz#1420492
    (EMBARGOED CVE-2017-2620 qemu-kvm: Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo [rhel-7.4])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-133.el7
changelog:
  - kvm-target-i386-add-Ivy-Bridge-CPU-model.patch [bz#1368375]
  - kvm-x86-add-AVX512_4VNNIW-and-AVX512_4FMAPS-features.patch [bz#1382122]
  - kvm-target-i386-kvm_cpu_fill_host-Kill-unused-code.patch [bz#1382122]
  - kvm-target-i386-kvm_cpu_fill_host-No-need-to-check-level.patch [bz#1382122]
  - kvm-target-i386-kvm_cpu_fill_host-No-need-to-check-CPU-v.patch [bz#1382122]
  - kvm-target-i386-kvm_cpu_fill_host-No-need-to-check-xleve.patch [bz#1382122]
  - kvm-target-i386-kvm_cpu_fill_host-Set-all-feature-words-.patch [bz#1382122]
  - kvm-target-i386-kvm_cpu_fill_host-Fill-feature-words-in-.patch [bz#1382122]
  - kvm-target-i386-kvm_check_features_against_host-Kill-fea.patch [bz#1382122]
  - kvm-target-i386-Make-TCG-feature-filtering-more-readable.patch [bz#1382122]
  - kvm-target-i386-Filter-FEAT_7_0_EBX-TCG-features-too.patch [bz#1382122]
  - kvm-target-i386-Filter-KVM-and-0xC0000001-features-on-TC.patch [bz#1382122]
  - kvm-target-i386-Define-TCG_-_FEATURES-earlier-in-cpu.c.patch [bz#1382122]
  - kvm-target-i386-Loop-based-copying-and-setting-unsetting.patch [bz#1382122]
  - kvm-target-i386-Loop-based-feature-word-filtering-in-TCG.patch [bz#1382122]
  - kvm-spice-remove-spice-experimental.h-include.patch [bz#1430606]
  - kvm-spice-replace-use-of-deprecated-API.patch [bz#1430606]
  - Resolves: bz#1368375
    ([Intel 7.4 Bug] qemu-kvm does not support “-cpu IvyBridge”)
  - Resolves: bz#1382122
    ([Intel 7.4 FEAT] KVM Enable the avx512_4vnniw, avx512_4fmaps instructions in qemu)
  - Resolves: bz#1430606
    (Can't build qemu-kvm with newer spice packages)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-134.el7
changelog:
  - kvm-ui-vnc-introduce-VNC_DIRTY_PIXELS_PER_BIT-macro.patch [bz#1377977]
  - kvm-ui-vnc-derive-cmp_bytes-from-VNC_DIRTY_PIXELS_PER_BI.patch [bz#1377977]
  - kvm-ui-vnc-optimize-dirty-bitmap-tracking.patch [bz#1377977]
  - kvm-ui-vnc-optimize-setting-in-vnc_dpy_update.patch [bz#1377977]
  - kvm-ui-vnc-fix-vmware-VGA-incompatiblities.patch [bz#1377977]
  - kvm-ui-vnc-fix-potential-memory-corruption-issues.patch [bz#1377977]
  - kvm-vnc-fix-memory-corruption-CVE-2015-5225.patch [bz#1377977]
  - kvm-vnc-fix-overflow-in-vnc_update_stats.patch [bz#1377977]
  - kvm-i386-kvmvapic-initialise-imm32-variable.patch [bz#1335751]
  - kvm-qemu-iotests-Filter-out-actual-image-size-in-067.patch [bz#1427176]
  - vm-qcow2-Don-t-rely-on-free_cluster_index-in-alloc_ref2.patch [bz#1427176]
  - kvm-qemu-iotests-Fix-core-dump-suppression-in-test-039.patch [bz#1427176]
  - kvm-qemu-io-Add-sigraise-command.patch [bz#1427176]
  - kvm-iotests-Filter-for-Killed-in-qemu-io-output.patch [bz#1427176]
  - kvm-iotests-Fix-test-039.patch [bz#1427176]
  - kvm-blkdebug-Add-bdrv_truncate.patch [bz#1427176]
  - kvm-vhdx-Fix-zero-fill-iov-length.patch [bz#1427176]
  - kvm-qemu-iotests-Disable-030-040-041.patch [bz#1427176]
  - kvm-x86-add-AVX512_VPOPCNTDQ-features.patch [bz#1415830]
  - kvm-usb-ccid-check-ccid-apdu-length.patch [bz#1419818]
  - kvm-usb-ccid-better-bulk_out-error-handling.patch [bz#1419818]
  - kvm-usb-ccid-move-header-size-check.patch [bz#1419818]
  - kvm-usb-ccid-add-check-message-size-checks.patch [bz#1419818]
  - kvm-spec-Update-rdma-build-dependency.patch [bz#1433920]
  - Resolves: bz#1335751
    (CVE-2016-4020 qemu-kvm: Qemu: i386: leakage of stack memory to guest in kvmvapic.c [rhel-7.4])
  - Resolves: bz#1377977
    (qemu-kvm coredump in vnc_raw_send_framebuffer_update [rhel-7.4])
  - Resolves: bz#1415830
    ([Intel 7.4 FEAT] Enable vpopcntdq for KNM - qemu/kvm)
  - Resolves: bz#1419818
    (CVE-2017-5898 qemu-kvm: Qemu: usb: integer overflow in emulated_apdu_from_guest [rhel-7.4])
  - Resolves: bz#1427176
    (test cases of qemu-iotests failed)
  - Resolves: bz#1433920
    (Switch from librdmacm-devel to rdma-core-devel)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-135.el7
changelog:
  - kvm-fix-cirrus_vga-fix-OOB-read-case-qemu-Segmentation-f.patch [bz#1430060]
  - kvm-cirrus-vnc-zap-bitblit-support-from-console-code.patch [bz#1430060]
  - kvm-cirrus-add-option-to-disable-blitter.patch [bz#1430060]
  - kvm-cirrus-fix-cirrus_invalidate_region.patch [bz#1430060]
  - kvm-cirrus-stop-passing-around-dst-pointers-in-the-blitt.patch [bz#1430060]
  - kvm-cirrus-stop-passing-around-src-pointers-in-the-blitt.patch [bz#1430060]
  - kvm-cirrus-fix-off-by-one-in-cirrus_bitblt_rop_bkwd_tran.patch [bz#1430060]
  - Resolves: bz#1430060
    (CVE-2016-9603 qemu-kvm: Qemu: cirrus: heap buffer overflow via vnc connection [rhel-7.4])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-136.el7
changelog:
  - kvm-target-i386-get-set-migrate-XSAVES-state.patch [bz#1327593]
  - kvm-Removing-texi2html-from-build-requirements.patch [bz#1440987]
  - kvm-Disable-build-of-32bit-packages.patch [bz#1441778]
  - kvm-Add-sample-images-to-srpm.patch [bz#1436280]
  - Resolves: bz#1327593
    ([Intel 7.4 FEAT] KVM Enable the XSAVEC, XSAVES and XRSTORS instructions)
  - Resolves: bz#1436280
    (sample images  for qemu-iotests are missing in the SRPM)
  - Resolves: bz#1440987
    (Remove texi2html build dependancy from RPM)
  - Resolves: bz#1441778
    (Stop building qemu-img for 32bit architectures.)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-137.el7
changelog:
  - kvm-ide-fix-halted-IO-segfault-at-reset.patch [bz#1299875]
  - Resolves: bz#1299875
    (system_reset should clear pending request for error (IDE))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-138.el7
changelog:
  - kvm-char-serial-cosmetic-fixes.patch [bz#1451470]
  - kvm-char-serial-Use-generic-Fifo8.patch [bz#1451470]
  - kvm-char-serial-serial_ioport_write-Factor-out-common-co.patch [bz#1451470]
  - kvm-char-serial-fix-copy-paste-error-fifo8_is_full-vs-em.patch [bz#1451470]
  - kvm-char-serial-Fix-emptyness-check.patch [bz#1451470]
  - kvm-char-serial-Fix-emptyness-handling.patch [bz#1451470]
  - kvm-serial-poll-the-serial-console-with-G_IO_HUP.patch [bz#1451470]
  - kvm-serial-change-retry-logic-to-avoid-concurrency.patch [bz#1451470]
  - kvm-qemu-char-ignore-flow-control-if-a-PTY-s-slave-is-no.patch [bz#1451470]
  - kvm-serial-check-if-backed-by-a-physical-serial-port-at-.patch [bz#1451470]
  - kvm-serial-reset-thri_pending-on-IER-writes-with-THRI-0.patch [bz#1451470]
  - kvm-serial-clean-up-THRE-TEMT-handling.patch [bz#1451470]
  - kvm-serial-update-LSR-on-enabling-disabling-FIFOs.patch [bz#1451470]
  - kvm-serial-only-resample-THR-interrupt-on-rising-edge-of.patch [bz#1451470]
  - kvm-serial-make-tsr_retry-unsigned.patch [bz#1451470]
  - kvm-serial-simplify-tsr_retry-reset.patch [bz#1451470]
  - kvm-serial-separate-serial_xmit-and-serial_watch_cb.patch [bz#1451470]
  - kvm-serial-remove-watch-on-reset.patch [bz#1451470]
  - Resolves: bz#1451470
    (RHEL 7.2 based VM (Virtual Machine) hung for several hours apparently waiting for lock held by main_loop)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-139.el7
changelog:
  - kvm-char-change-qemu_chr_fe_add_watch-to-return-unsigned.patch [bz#1451470]
  - Resolves: bz#1451470
    (RHEL 7.2 based VM (Virtual Machine) hung for several hours apparently waiting for lock held by main_loop)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-140.el7
changelog:
  - kvm-spice-fix-spice_chr_add_watch-pre-condition.patch [bz#1456983]
  - Resolves: bz#1456983
    (Character device regression due to missing patch)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-141.el7
changelog:
  - kvm-Fix-memory-slot-page-alignment-logic-bug-1455745.patch [bz#1455745]
  - kvm-Do-not-hang-on-full-PTY.patch [bz#1452067]
  - kvm-serial-fixing-vmstate-for-save-restore.patch [bz#1452067]
  - kvm-serial-reinstate-watch-after-migration.patch [bz#1452067]
  - kvm-nbd-Fully-initialize-client-in-case-of-failed-negoti.patch [bz#1451614]
  - kvm-nbd-Fix-regression-on-resiliency-to-port-scan.patch [bz#1451614]
  - Resolves: bz#1451614
    (CVE-2017-9524 qemu-kvm: segment fault when private user nmap qemu-nbd server [rhel-7.4])
  - Resolves: bz#1452067
    (migration can confuse serial port user)
  - Resolves: bz#1455745
    (Backport fix for broken logic that's supposed to ensure memory slots are page aligned)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-141.el7_4.1
changelog:
  - kvm-qemu-nbd-Ignore-SIGPIPE.patch [bz#1468107]
  - Resolves: bz#1468107
    (CVE-2017-10664 qemu-kvm: Qemu: qemu-nbd: server breaks with SIGPIPE upon client abort [rhel-7.4.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-141.el7_4.2
changelog:
  - kvm-virtio-net-dynamic-network-offloads-configuration.patch [bz#1482468]
  - kvm-Workaround-rhel6-ctrl_guest_offloads-machine-type-mi.patch [bz#1482468]
  - Resolves: bz#1482468
    (KVM: windows guest migration from EL6 to EL7 fails. [rhel-7.4.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - rhev-2.3.0-21.el7
changelog:
  - kvm-vnc-fix-memory-corruption-CVE-2015-5225.patch [bz#1255898]
  - Resolves: bz#1255898
    (CVE-2015-5225 qemu-kvm-rhev: Qemu: ui: vnc: heap memory corruption in vnc_refresh_server_surface [rhel-7.2])


author: Miroslav Rezanina <mrezanin@redhat.com> - rhev-2.3.0-22.el7
changelog:
  - kvm-mirror-Fix-coroutine-reentrance.patch [bz#1251487]
  - kvm-RHEL-Set-vcpus-hard-limit-to-240-for-Power.patch [bz#1257781]
  - kvm-provide-vhost-module-config-file-with-max_mem_region.patch [bz#1255349]
  - Resolves: bz#1251487
    (qemu core dump when do drive mirror)
  - Resolves: bz#1255349
    (vhost: default value of 'max_mem_regions' should be set  larger(>=260) than 64)
  - Resolves: bz#1257781
    (The prompt is confusing when boot a guest with larger vcpu number than host physical cpu)


author: Miroslav Rezanina <mrezanin@redhat.com> - rhev-2.3.0-23.el7
changelog:
  - kvm-scsi-disk-Fix-assertion-failure-on-WRITE-SAME.patch [bz#1247042]
  - kvm-mirror-Speed-up-bitmap-initial-scanning.patch [bz#1259229]
  - kvm-qemu-iotests-Disable-099-requires-blkverify.patch [bz#1257059]
  - kvm-spapr-Reduce-advertised-max-LUNs-for-spapr_vscsi.patch [bz#1260464]
  - kvm-vnc-Don-t-assert-if-opening-unix-socket-fails.patch [bz#1261263]
  - kvm-qcow2-Handle-EAGAIN-returned-from-update_refcount.patch [bz#1254927]
  - kvm-pc-memhotplug-fix-incorrectly-set-reserved-memory-en.patch [bz#1261846]
  - kvm-pc-memhotplug-keep-reserved-memory-end-broken-on-rhe.patch [bz#1261846]
  - Resolves: bz#1247042
    (qemu quit when using sg_write_same command inside RHEL7.2 guest)
  - Resolves: bz#1254927
    (qemu-img shows Input/output error when compressing guest image)
  - Resolves: bz#1257059
    (qemu-iotests 099 failed for vmdk)
  - Resolves: bz#1259229
    (drive-mirror blocks QEMU due to lseek64() on raw image files)
  - Resolves: bz#1260464
    (The spapr vscsi disks for lun id '9-31' and channel id '4-7' could not be recognized inside a power pc guest)
  - Resolves: bz#1261263
    (qemu crash while start a guest with invalid vnc socket path)
  - Resolves: bz#1261846
    (qemu-kvm-rhev: 64-bit PCI bars may overlap hotplugged memory and vice verse)


author: Miroslav Rezanina <mrezanin@redhat.com> - rhev-2.3.0-24.el7
changelog:
  - kvm-spapr-Don-t-use-QOM-syntax-for-DR-connectors.patch [bz#1262143]
  - kvm-virtio-mmio-ioeventfd-support.patch [bz#1185480]
  - kvm-scsi-fix-buffer-overflow-in-scsi_req_parse_cdb-CVE-2.patch [bz#1244334]
  - kvm-spapr-Populate-ibm-associativity-lookup-arrays-corre.patch [bz#1262670]
  - kvm-ppc-spapr-Fix-buffer-overflow-in-spapr_populate_drco.patch [bz#1262670]
  - kvm-spapr_pci-Introduce-a-liobn-number-generating-macros.patch [bz#1263795]
  - kvm-spapr_iommu-Make-spapr_tce_find_by_liobn-public.patch [bz#1263795]
  - kvm-spapr_pci-Rework-device-tree-rendering.patch [bz#1263795]
  - kvm-spapr_pci-enumerate-and-add-PCI-device-tree.patch [bz#1263795]
  - kvm-spapr_pci-populate-ibm-loc-code.patch [bz#1263795]
  - kvm-tests-remove-irrelevant-assertions-from-test-aio.patch [bz#1211689]
  - kvm-aio-posix-move-pollfds-to-thread-local-storage.patch [bz#1211689]
  - kvm-aio-Introduce-type-in-aio_set_fd_handler-and-aio_set.patch [bz#1211689]
  - kvm-aio-Save-type-to-AioHandler.patch [bz#1211689]
  - kvm-aio-posix-Introduce-aio_poll_clients.patch [bz#1211689]
  - kvm-block-Mark-fd-handlers-as-protocol.patch [bz#1211689]
  - kvm-nbd-Mark-fd-handlers-client-type-as-nbd-server.patch [bz#1211689]
  - kvm-aio-Mark-ctx-notifier-s-client-type-as-context.patch [bz#1211689]
  - kvm-dataplane-Mark-host-notifiers-client-type-as-datapla.patch [bz#1211689]
  - kvm-block-Introduce-bdrv_aio_poll.patch [bz#1211689]
  - kvm-block-Replace-nested-aio_poll-with-bdrv_aio_poll.patch [bz#1211689]
  - kvm-block-Only-poll-block-layer-fds-in-bdrv_aio_poll.patch [bz#1211689]
  - Resolves: bz#1185480
    (backport ioeventfd support for virtio-mmio)
  - Resolves: bz#1211689
    (atomic live snapshots are not atomic with dataplane-backed devices)
  - Resolves: bz#1244334
    (qemu-kvm-rhev: Qemu: scsi stack buffer overflow [rhel-7.2])
  - Resolves: bz#1262143
    (VM startup is very slow with large amounts of hotpluggable memory)
  - Resolves: bz#1262670
    ([PowerKVM]SIGSEGV when boot up guest with -numa node and set up the cpus in one node to the boundary)
  - Resolves: bz#1263795
    (vfio device can't be hot unplugged on powerpc guest)


author: Miroslav Rezanina <mrezanin@redhat.com> - rhev-2.3.0-25.el7
changelog:
  - kvm-block-backend-Expose-bdrv_write_zeroes.patch [bz#1256541]
  - kvm-qemu-img-convert-Rewrite-copying-logic.patch [bz#1256541]
  - kvm-main-loop-fix-qemu_notify_event-for-aio_notify-optim.patch [bz#1256541]
  - kvm-error-New-error_fatal.patch [bz#1232308]
  - kvm-Fix-bad-error-handling-after-memory_region_init_ram.patch [bz#1232308]
  - kvm-loader-Fix-memory_region_init_resizeable_ram-error-h.patch [bz#1232308]
  - kvm-memory-Fix-bad-error-handling-in-memory_region_init_.patch [bz#1232308]
  - kvm-spapr_pci-encode-class-code-including-Prog-IF-regist.patch [bz#1264845]
  - kvm-scripts-dump-guest-memory.py-fix-after-RAMBlock-chan.patch [bz#1234802]
  - kvm-spec-Require-proper-version-of-SLOF.patch [bz#1263795]
  - Resolves: bz#1232308
    ([abrt] qemu-system-x86: qemu_ram_alloc(): qemu-system-x86_64 killed by SIGABRT)
  - Resolves: bz#1234802
    ([RHEL7.2] dump-guest-memory failed because of Python Exception <class 'gdb.error'> There is no member named length.)
  - Resolves: bz#1256541
    (qemu-img hangs forever in aio_poll when used to convert some images)
  - Resolves: bz#1263795
    (vfio device can't be hot unplugged on powerpc guest)
  - Resolves: bz#1264845
    ([regression] Guest usb mouse/keyboard could not be used on qemu-kvm-rhev-2.3.0-24.el7.ppc64le)


author: Miroslav Rezanina <mrezanin@redhat.com> - rhev-2.3.0-26.el7
changelog:
  - kvm-qcow2-Make-size_to_clusters-return-uint64_t.patch [bz#1260365]
  - kvm-iotests-Add-test-for-checking-large-image-files.patch [bz#1260365]
  - Resolves: bz#1260365
    (Guest image created coredump after installation.)


author: Miroslav Rezanina <mrezanin@redhat.com> - rhev-2.3.0-27.el7
changelog:
  - kvm-sdl2-Fix-RGB555.patch [bz#1247479]
  - kvm-spice-surface-switch-fast-path-requires-same-format-.patch [bz#1247479]
  - kvm-virtio-blk-only-clear-VIRTIO_F_ANY_LAYOUT-for-legacy.patch [bz#1207687]
  - kvm-vhost-enable-vhost-without-without-MSI-X.patch [bz#1207687]
  - kvm-vhost-user-Send-VHOST_RESET_OWNER-on-vhost-stop.patch [bz#1207687]
  - kvm-virtio-avoid-leading-underscores-for-helpers.patch [bz#1207687]
  - kvm-vhost-user-use-VHOST_USER_XXX-macro-for-switch-state.patch [bz#1207687]
  - kvm-vhost-user-add-protocol-feature-negotiation.patch [bz#1207687]
  - kvm-vhost-rename-VHOST_RESET_OWNER-to-VHOST_RESET_DEVICE.patch [bz#1207687]
  - kvm-vhost-user-add-VHOST_USER_GET_QUEUE_NUM-message.patch [bz#1207687]
  - kvm-vhost-introduce-vhost_backend_get_vq_index-method.patch [bz#1207687]
  - kvm-vhost-user-add-multiple-queue-support.patch [bz#1207687]
  - kvm-vhost-user-add-a-new-message-to-disable-enable-a-spe.patch [bz#1207687]
  - Resolves: bz#1207687
    ([6wind 7.2 FEAT]: vhost-user does not support multique)
  - Resolves: bz#1247479
    (display mess when boot a win2012-r2-64 guest with -vga std)


author: Miroslav Rezanina <mrezanin@redhat.com> - rhev-2.3.0-28.el7
changelog:
  - kvm-rhel-Revert-unwanted-cannot_instantiate_with_device_.patch [bz#1224542]
  - kvm-Disable-additional-e1000-models.patch [bz#1224542 bz#1265161]
  - kvm-Remove-intel-iommu-device.patch [bz#1224542]
  - kvm-virtio-net-unbreak-self-announcement-and-guest-offlo.patch [bz#1262232]
  - kvm-block-mirror-fix-full-sync-mode-when-target-does-not.patch [bz#1136382]
  - Resolves: bz#1136382
    (block: Mirroring to raw block device doesn't zero out unused blocks)
  - Resolves: bz#1224542
    (unsupported devices need to be disabled in qemu-kvm-rhev after rebasing to 2.3.0)
  - Resolves: bz#1262232
    (self announcement and ctrl offloads does not work after migration)
  - Resolves: bz#1265161
    (Support various e1000 variants)


author: Miroslav Rezanina <mrezanin@redhat.com> - rhev-2.3.0-29.el7
changelog:
  - kvm-vfio-Remove-unneeded-union-from-VFIOContainer.patch [bz#1259556]
  - kvm-vfio-Generalize-vfio_listener_region_add-failure-pat.patch [bz#1259556]
  - kvm-vfio-Check-guest-IOVA-ranges-against-host-IOMMU-capa.patch [bz#1259556]
  - kvm-vfio-Record-host-IOMMU-s-available-IO-page-sizes.patch [bz#1259556]
  - kvm-memory-Allow-replay-of-IOMMU-mapping-notifications.patch [bz#1259556]
  - kvm-vfio-Allow-hotplug-of-containers-onto-existing-guest.patch [bz#1259556]
  - kvm-spapr_pci-Allow-PCI-host-bridge-DMA-window-to-be-con.patch [bz#1259556]
  - kvm-spapr_iommu-Rename-vfio_accel-parameter.patch [bz#1259556]
  - kvm-spapr_iommu-Provide-a-function-to-switch-a-TCE-table.patch [bz#1259556]
  - kvm-spapr_pci-Allow-VFIO-devices-to-work-on-the-normal-P.patch [bz#1259556]
  - Resolves: bz#1259556
    (Allow VFIO devices on the same guest PHB as emulated devices)


author: Jeff E. Nelson <jen@redhat.com> - rhev-2.3.0-30.el7
changelog:
  - kvm-memhp-extend-address-auto-assignment-to-support-gaps.patch [bz#1267533]
  - kvm-pc-memhp-force-gaps-between-DIMM-s-GPA.patch [bz#1267533]
  - kvm-memory-allow-destroying-a-non-empty-MemoryRegion.patch [bz#1264347]
  - kvm-hw-do-not-pass-NULL-to-memory_region_init-from-insta.patch [bz#1264347]
  - kvm-tests-Fix-how-qom-test-is-run.patch [bz#1264347]
  - kvm-libqtest-Clean-up-unused-QTestState-member-sigact_ol.patch [bz#1264347]
  - kvm-libqtest-New-hmp-friends.patch [bz#1264347]
  - kvm-device-introspect-test-New-covering-device-introspec.patch [bz#1264347]
  - kvm-qmp-Fix-device-list-properties-not-to-crash-for-abst.patch [bz#1264347]
  - kvm-qdev-Protect-device-list-properties-against-broken-d.patch [bz#1264347]
  - kvm-Revert-qdev-Use-qdev_get_device_class-for-device-typ.patch [bz#1264347]
  - Resolves: bz#1264347
    (QMP device-list-properties crashes for CPU devices)
  - Resolves: bz#1267533
    (qemu quit when rebooting guest which hotplug memory >=13 times)


author: Miroslav Rezanina <mrezanin@redhat.com> - rhev-2.3.0-31.el7
changelog:
  - kvm-Migration-Generate-the-completed-event-only-when-we-.patch [bz#1271145]
  - Resolves: bz#1271145
    (Guest OS paused after migration.)


author: Miroslav Rezanina <mrezanin@redhat.com> - rhev-2.3.0-31.el7_2.1
changelog:
  - kvm-virtio-blk-only-clear-VIRTIO_F_ANY_LAYOUT-for-legacy.patch [bz#1276100]
  - kvm-vhost-enable-vhost-without-without-MSI-X.patch [bz#1276100]
  - kvm-virtio-avoid-leading-underscores-for-helpers.patch [bz#1276100]
  - kvm-vhost-user-use-VHOST_USER_XXX-macro-for-switch-state.patch [bz#1276100]
  - kvm-vhost-user-add-protocol-feature-negotiation.patch [bz#1276100]
  - kvm-vhost-user-add-VHOST_USER_GET_QUEUE_NUM-message.patch [bz#1276100]
  - kvm-vhost-introduce-vhost_backend_get_vq_index-method.patch [bz#1276100]
  - kvm-vhost-user-add-multiple-queue-support.patch [bz#1276100]
  - kvm-vhost-user-add-a-new-message-to-disable-enable-a-spe.patch [bz#1276100]
  - kvm-Revert-pc-memhp-force-gaps-between-DIMM-s-GPA.patch [bz#1278282]
  - kvm-Revert-memhp-extend-address-auto-assignment-to-suppo.patch [bz#1278282]
  - Resolves: bz#1276100
    ([6wind 7.2 FEAT]: vhost-user does not support multique)
  - Resolves: bz#1278282
    (memory unplug triggers BUG_ON: kernel BUG at mm/memory_hotplug.c:703!)


author: Miroslav Rezanina <mrezanin@redhat.com> - rhev-2.3.0-31.el7_2.2
changelog:
  - kvm-target-ppc-fix-hugepage-support-when-using-memory-ba.patch [bz#1279387]
  - kvm-spapr-Enable-in-kernel-H_SET_MODE-handling.patch [bz#1283073]
  - kvm-rbd-make-qemu-s-cache-setting-override-any-ceph-sett.patch [bz#1279391]
  - kvm-rbd-fix-ceph-settings-precedence.patch [bz#1279391]
  - kvm-file_ram_alloc-propagate-error-to-caller-instead-of-.patch [bz#1283079]
  - kvm-acpi-add-acpi_send_gpe_event-to-rise-sci-for-hotplug.patch [bz#1283072]
  - kvm-pc-memhp-do-not-emit-inserting-event-for-coldplugged.patch [bz#1283072]
  - kvm-libqtest-add-qmp_eventwait.patch [bz#1279388]
  - kvm-configure-probe-for-memfd.patch [bz#1279388]
  - kvm-linux-headers-add-unistd.h.patch [bz#1279388]
  - kvm-build-sys-split-util-obj-on-multi-lines.patch [bz#1279388]
  - kvm-util-add-linux-only-memfd-fallback.patch [bz#1279388]
  - kvm-util-add-memfd-helpers.patch [bz#1279388]
  - kvm-util-add-fallback-for-qemu_memfd_alloc.patch [bz#1279388]
  - kvm-vhost-logs-sharing.patch [bz#1279388]
  - kvm-vhost-document-log-resizing.patch [bz#1279388]
  - kvm-vhost-add-vhost_set_log_base-op.patch [bz#1279388]
  - kvm-vhost-user-add-vhost_user_requires_shm_log.patch [bz#1279388]
  - kvm-vhost-alloc-shareable-log.patch [bz#1279388]
  - kvm-vhost-user-send-log-shm-fd-along-with-log_base.patch [bz#1279388]
  - kvm-vhost-user-add-a-migration-blocker.patch [bz#1279388]
  - kvm-vhost-user-document-migration-log.patch [bz#1279388]
  - kvm-net-add-trace_vhost_user_event.patch [bz#1279388]
  - kvm-vhost-user-add-support-of-live-migration.patch [bz#1279388]
  - kvm-vhost-user-add-rarp-sending-after-live-migration-for.patch [bz#1279388]
  - kvm-vhost-user-use-an-enum-helper-for-features-mask.patch [bz#1279388]
  - kvm-vhost-add-migration-block-if-memfd-failed.patch [bz#1279388]
  - kvm-vhost-user-test-move-wait_for_fds-out.patch [bz#1279388]
  - kvm-vhost-user-test-do-not-reinvent-glib-compat.h.patch [bz#1279388]
  - kvm-vhost-user-unit-test-for-new-messages.patch [bz#1279388]
  - kvm-vhost-user-test-use-tmpfs-by-default.patch [bz#1279388]
  - kvm-vhost-user-test-fix-predictable-filename-on-tmpfs.patch [bz#1279388]
  - kvm-vhost-user-test-remove-useless-static-check.patch [bz#1279388]
  - kvm-vhost-user-test-wrap-server-in-TestServer-struct.patch [bz#1279388]
  - kvm-vhost-user-test-learn-to-tweak-various-qemu-argument.patch [bz#1279388]
  - kvm-vhost-user-test-add-live-migration-test.patch [bz#1279388]
  - kvm-vhost-user-test-check-ownership-during-migration.patch [bz#1279388]
  - kvm-vhost-send-SET_VRING_ENABLE-at-start-stop.patch [bz#1279388]
  - kvm-vhost-user-modify-SET_LOG_BASE-to-pass-mmap-size-and.patch [bz#1279388]
  - kvm-vhost-let-SET_VRING_ENABLE-message-depends-on-protoc.patch [bz#1279388]
  - kvm-vhost-user-test-don-t-rely-on-RESET_OWNER.patch [bz#1279388]
  - kvm-vhost-user-remove-superfluous-n-around-error_report.patch [bz#1279388]
  - kvm-vhost-user-print-original-request-on-error.patch [bz#1279388]
  - kvm-vhost-user-start-stop-all-rings.patch [bz#1279388]
  - Resolves: bz#1279387
    (hugepage could not be used inside guest if start the guest with NUMA supported huge pages)
  - Resolves: bz#1279388
    ([6wind 7.3 Feat]: vhost user support of livemigration)
  - Resolves: bz#1279391
    (ceph.conf properties override qemu's command-line properties)
  - Resolves: bz#1283072
    (cold-plugged DIMM can't be unplugged on the first unplug request)
  - Resolves: bz#1283073
    (gdb skips hardware watchpoints)
  - Resolves: bz#1283079
    (qemu process exit after hot-plug a memory device which guest use 1G hugepages)


author: Miroslav Rezanina <mrezanin@redhat.com> - rhev-2.3.0-31.el7_2.3
changelog:
  - kvm-vhost-user-ignore-qemu-only-features.patch [bz#1279388]
  - kvm-vhost-user-fix-log-size.patch [bz#1279388]
  - Resolves: bz#1279388
    ([6wind 7.3 Feat]: vhost user support of livemigration)


author: Jeff E. Nelson <jen@redhat.com> - rhev-2.3.0-31.el7_2.4
changelog:
  - kvm-virtio-blk-Fix-double-completion-for-werror-stop.patch [bz#1283987]
  - kvm-virtio-blk-Move-resetting-of-req-mr_next-to-virtio_b.patch [bz#1283987]
  - kvm-spapr-Allocate-HTAB-from-machine-init.patch [bz#1285337]
  - kvm-spapr-Abort-when-HTAB-of-requested-size-isn-t-alloca.patch [bz#1285337]
  - Resolves: bz#1283987
    (Aborted (core dumped) for "qemu-kvm: block.c:3332: bdrv_aligned_pwritev: Assertion `!qiov || bytes == qiov->size' failed." after 'lvextend' the guest primary image and 'cont' the installing guest for the 2nd time)
  - Resolves: bz#1285337
    ([PPC64LE] Guest freezes if qemu allocates smaller page table than requested)


author: Miroslav Rezanina <mrezanin@redhat.com> - rhev-2.3.0-31.el7_2_2.5
changelog:
  - kvm-virtio-introduce-virtio_map.patch [bz#1288096]
  - kvm-virtio-switch-to-virtio_map.patch [bz#1288096]
  - kvm-virtio-blk-convert-to-virtqueue_map.patch [bz#1288096]
  - kvm-virtio-serial-convert-to-virtio_map.patch [bz#1288096]
  - kvm-virtio-scsi-convert-to-virtqueue_map.patch [bz#1288096]
  - kvm-virtio-drop-virtqueue_map_sg.patch [bz#1288096]
  - kvm-dataplane-simplify-indirect-descriptor-read.patch [bz#1288096]
  - kvm-virtio-dataplane-adapt-dataplane-for-virtio-Version-.patch [bz#1288096]
  - kvm-dataplane-support-non-contigious-s-g.patch [bz#1288096]
  - Resolves: bz#1288096
    (qemu quit when rebooting guest which hotplug memory >=13 times)


author: Miroslav Rezanina <mrezanin@redhat.com> - rhev-2.3.0-31.el7_2.6
changelog:
  - kvm-ohci-delay-first-SOF-interrupt.patch [bz#1298971]
  - kvm-ohci-clear-pending-SOF-on-suspend.patch [bz#1298971]
  - kvm-raw-posix-Fix-.bdrv_co_get_block_status-for-unaligne.patch [bz#1299345]
  - Resolves: bz#1298971
    (OHCI can cause irq jam in guest [rhel-7.2.z])
  - Resolves: bz#1299345
    ([abrt] qemu-img: get_block_status(): qemu-img killed by SIGABRT)


author: Miroslav Rezanina <mrezanin@redhat.com> - rhev-2.3.0-31.el7_2.7
changelog:
  - kvm-fw_cfg-add-check-to-validate-current-entry-value-CVE.patch [bz#1298435]
  - kvm-ahci-clean-up-ncq_tfs-used-on-error.patch [bz#1297292]
  - Resolves: bz#1297292
    (CVE-2016-1568 qemu-kvm-rhev: Qemu: ide: ahci use-after-free vulnerability in aio port commands [rhel-7.2.z])
  - Resolves: bz#1298435
    (CVE-2016-1714 qemu-kvm-rhev: Qemu: nvram: OOB r/w access in processing firmware configurations [rhel-7.2.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - rhev-2.9.0-4.el7
changelog:
  - kvm-Reenable-Educational-device.patch [bz#1414694]
  - kvm-usb-xhci-Fix-PCI-capability-order.patch [bz#1447874]
  - kvm-block-vxhs.c-Add-support-for-a-new-block-device-type.patch [bz#1265869]
  - kvm-block-vxhs.c-Add-qemu-iotests-for-new-block-device-t.patch [bz#1265869]
  - kvm-qemu-iotests-exclude-vxhs-from-image-creation-via-pr.patch [bz#1265869]
  - kvm-block-vxhs-modularize-VXHS-via-g_module.patch [bz#1265869]
  - kvm-Remove-the-dependencies-to-seavgabios-bin-and-ipxe-r.patch [bz#1449939]
  - Resolves: bz#1265869
    (RFE: Veritas HyperScale VxHS block device support (qemu-kvm-rhev))
  - Resolves: bz#1414694
    (Reenable edu device for kvm-unit-tests support)
  - Resolves: bz#1447874
    (Migration failed from rhel7.2.z->rhel7.4 with "-M rhel7.0.0" and "-device nec-usb-xhci")
  - Resolves: bz#1449939
    (Remove dependency on seavgabios-bin and ipxe-roms-qemu for qemu-kvm-rhev on s390x)


author: Miroslav Rezanina <mrezanin@redhat.com> - rhev-2.9.0-5.el7
changelog:
  - kvm-blockdev-ignore-aio-native-for-empty-drives.patch [bz#1402645]
  - kvm-dump-Acquire-BQL-around-vm_start-in-dump-thread.patch [bz#1445174]
  - kvm-Downstream-Don-t-disable-SMT-on-POWER9-hosts.patch [bz#1450724]
  - kvm-aio-add-missing-aio_notify-to-aio_enable_external.patch [bz#1446498]
  - kvm-Update-configuration-for-qemu-2.9.patch [bz#1400962]
  - Resolves: bz#1400962
    (Verify configuration coverage for rebased qemu-kvm-rhev)
  - Resolves: bz#1402645
    (Required cache.direct=on when set aio=native)
  - Resolves: bz#1445174
    ([RHEV7.4] [guest memory dump]dump-guest-memory QMP command with "detach" param makes qemu-kvm process aborted)
  - Resolves: bz#1446498
    (Guest freeze after live snapshot with data-plane)
  - Resolves: bz#1450724
    ([Pegas 1.0] qemu package scripts should not disable host multi-threading for POWER9)


author: Miroslav Rezanina <mrezanin@redhat.com> - rhev-2.9.0-6.el7
changelog:
  - kvm-aarch64-Enable-usb-xhci.patch [bz#1446570]
  - kvm-scsi-Disable-deprecated-implicit-SCSI-HBA-creation-m.patch [bz#971799]
  - kvm-block-vhdx-Make-vhdx_create-always-set-errp.patch [bz#1447551]
  - kvm-block-Add-errp-to-b-lk-drv-_truncate.patch [bz#1447551]
  - kvm-blockdev-use-drained_begin-end-for-qmp_block_resize.patch [bz#1447551]
  - kvm-spapr-Don-t-accidentally-advertise-HTM-support-on-PO.patch [bz#1449007]
  - kvm-target-ppc-Allow-workarounds-for-POWER9-DD1.patch [bz#1443289]
  - kvm-xhci-relax-link-check.patch [bz#1444003]
  - kvm-curl-strengthen-assertion-in-curl_clean_state.patch [bz#1437393]
  - kvm-curl-never-invoke-callbacks-with-s-mutex-held.patch [bz#1437393]
  - kvm-curl-avoid-recursive-locking-of-BDRVCURLState-mutex.patch [bz#1437393]
  - kvm-curl-split-curl_find_state-curl_init_state.patch [bz#1437393]
  - kvm-curl-convert-CURLAIOCB-to-byte-values.patch [bz#1437393]
  - kvm-curl-convert-readv-to-coroutines.patch [bz#1437393]
  - kvm-curl-do-not-do-aio_poll-when-waiting-for-a-free-CURL.patch [bz#1437393]
  - kvm-usb-hub-clear-PORT_STAT_SUSPEND-on-wakeup.patch [bz#1447581]
  - kvm-migration-setup-bi-directional-I-O-channel-for-exec-.patch [bz#1430620]
  - kvm-block-Reuse-bs-as-backing-hd-for-drive-backup-sync-n.patch [bz#1452066]
  - kvm-migration-Fix-non-multiple-of-page-size-migration.patch [bz#1449037]
  - kvm-postcopy-Require-RAMBlocks-that-are-whole-pages.patch [bz#1449037]
  - kvm-hw-virtio-fix-vhost-user-fails-to-startup-when-MQ.patch [bz#1447592]
  - kvm-iommu-Don-t-crash-if-machine-is-not-PC_MACHINE.patch [bz#1451483]
  - kvm-migration-Call-blk_resume_after_migration-for-postco.patch [bz#1452148]
  - kvm-migration-Unify-block-node-activation-error-handling.patch [bz#1452148]
  - kvm-disable-pulseaudio-and-alsa.patch [bz#1452605]
  - kvm-block-An-empty-filename-counts-as-no-filename.patch [bz#1452702]
  - kvm-block-Do-not-unref-bs-file-on-error-in-BD-s-open.patch [bz#1452752]
  - Resolves: bz#1430620
    (TLS encryption migration via exec failed with "TLS handshake failed: The TLS connection was non-properly terminated")
  - Resolves: bz#1437393
    (snapshot created base on the image in https server will hang during booting)
  - Resolves: bz#1443289
    ([Pegas1.0 04/03 nightly build + 4.10.0-7 kernel] qemu+guest fail to apply POWER9 DD1 workarounds)
  - Resolves: bz#1444003
    (USB 3.0 flash drive not accessible on Windows guest)
  - Resolves: bz#1446570
    (enable qemu-xhci USB3 controller device model for the aarch64 target)
  - Resolves: bz#1447551
    (qemu hang when do block_resize guest disk during crystal running)
  - Resolves: bz#1447581
    ([RHEV7.4] [usb-hub] input devices under usb hub don't work on win2016 with xhci)
  - Resolves: bz#1447592
    (vhost-user/reply-ack: Wait for ack even if no request sent (one-time requests))
  - Resolves: bz#1449007
    (Pegas 1.0: Booting pegas guest on pegas host (POWER9 DD1) panics with signal 4 at userspace entry)
  - Resolves: bz#1449037
    (Dst qemu quit when migrate guest with hugepage and total memory is not a multiple of pagesize)
  - Resolves: bz#1451483
    (QEMU crashes with "-machine none -device intel-iommu")
  - Resolves: bz#1452066
    (Fix backing image referencing in drive-backup sync=none)
  - Resolves: bz#1452148
    (Op blockers don't work after postcopy migration)
  - Resolves: bz#1452605
    (disable pulseaudio and alsa support)
  - Resolves: bz#1452702
    (qemu-img aborts on empty filenames)
  - Resolves: bz#1452752
    (Some block drivers incorrectly close their associated file)
  - Resolves: bz#971799
    (qemu should not crash when if=scsi although it's unsupportable device)


author: Miroslav Rezanina <mrezanin@redhat.com> - rhev-2.9.0-7.el7
changelog:
  - kvm-e1000e-Fix-ICR-Other-causes-clear-logic.patch [bz#1449490]
  - kvm-pc-fwcfg-unbreak-migration-from-qemu-2.5-and-qemu-2..patch [bz#1441394]
  - kvm-disable-linuxboot_dma.bin-option-rom-for-7.3-machine.patch [bz#1441394]
  - kvm-Revert-hw-pci-disable-pci-bridge-s-shpc-by-default.patch [bz#1434706]
  - kvm-qemu-img-wait-for-convert-coroutines-to-complete.patch [bz#1451849]
  - kvm-target-ppc-Show-POWER9-in-cpu-help.patch [bz#1449969]
  - Resolves: bz#1434706
    ([pci-bridge] Hotplug devices to pci-bridge failed)
  - Resolves: bz#1441394
    (fw_cfg.dma_enabled value incorrect in pc-i440fx-7.3.0 compat_props)
  - Resolves: bz#1449490
    ([q35] guest hang after do migration with virtio-scsi-pci.)
  - Resolves: bz#1449969
    ([Pegas1.0] POWER9* cpu model is not listed in  /usr/libexec/qemu-kvm -cpu ?)
  - Resolves: bz#1451849
    (qemu-img convert crashes on error)


author: Miroslav Rezanina <mrezanin@redhat.com> - rhev-2.9.0-8.el7
changelog:
  - kvm-input-don-t-queue-delay-if-paused.patch [bz#1444326]
  - kvm-block-gluster-glfs_lseek-workaround.patch [bz#1451191]
  - kvm-mirror-Drop-permissions-on-s-target-on-completion.patch [bz#1456456]
  - kvm-stream-fix-crash-in-stream_start-when-block_job_crea.patch [bz#1456424]
  - kvm-qemu-iotests-Test-streaming-with-missing-job-ID.patch [bz#1456424]
  - kvm-monitor-Use-numa_get_node_for_cpu-on-info-numa.patch [bz#1274567]
  - kvm-virtio_net-Bypass-backends-for-MTU-feature-negotiati.patch [bz#1452756]
  - kvm-vhost-user-pass-message-as-a-pointer-to-process_mess.patch [bz#1447592]
  - kvm-virtio-serial-bus-Unset-hotplug-handler-when-unreali.patch [bz#1458782]
  - kvm-gluster-add-support-for-PREALLOC_MODE_FALLOC.patch [bz#1450759]
  - kvm-numa-Allow-setting-NUMA-distance-for-different-NUMA-.patch [bz#1395339]
  - kvm-tests-acpi-extend-cphp-and-memhp-testcase-with-numa-.patch [bz#1395339]
  - kvm-copy-SLIT-test-reference-blobs-into-tests-directory.patch [bz#1395339]
  - Resolves: bz#1274567
    (HMP doesn't reflect the correct numa topology after hot plugging vCPU)
  - Resolves: bz#1395339
    ([Intel 7.4 FEAT] Enable configuration of NUMA distance in QEMU)
  - Resolves: bz#1444326
    (Keyboard inputs are buffered when qemu in stop status)
  - Resolves: bz#1447592
    (vhost-user/reply-ack: Wait for ack even if no request sent (one-time requests))
  - Resolves: bz#1450759
    (Creating fallocated image using qemu-img using gfapi fails)
  - Resolves: bz#1451191
    (qemu-img: block/gluster.c:1307: find_allocation: Assertion `offs >= start' failed.)
  - Resolves: bz#1452756
    (Enable VIRTIO_NET_F_MTU feature in QEMU)
  - Resolves: bz#1456424
    (qemu crash when starting image streaming job fails)
  - Resolves: bz#1456456
    (qemu crashes on job completion during drain)
  - Resolves: bz#1458782
    (QEMU crashes after hot-unplugging virtio-serial device)


author: Miroslav Rezanina <mrezanin@redhat.com> - rhev-2.9.0-9.el7
changelog:
  - kvm-shutdown-Simplify-shutdown_signal.patch [bz#1418927]
  - kvm-shutdown-Prepare-for-use-of-an-enum-in-reset-shutdow.patch [bz#1418927]
  - kvm-shutdown-Preserve-shutdown-cause-through-replay.patch [bz#1418927]
  - kvm-shutdown-Add-source-information-to-SHUTDOWN-and-RESE.patch [bz#1418927]
  - kvm-shutdown-Expose-bool-cause-in-SHUTDOWN-and-RESET-eve.patch [bz#1418927]
  - kvm-irqchip-trace-changes-on-msi-add-remove.patch [bz#1448813]
  - kvm-msix-trace-control-bit-write-op.patch [bz#1448813]
  - kvm-irqchip-skip-update-msi-when-disabled.patch [bz#1448813]
  - kvm-vhost-propagate-errors-in-vhost_device_iotlb_miss.patch [bz#1451862]
  - kvm-vhost-rework-IOTLB-messaging.patch [bz#1451862]
  - kvm-vhost-user-add-vhost_user-to-hold-the-chr.patch [bz#1451862]
  - kvm-vhost-user-add-slave-req-fd-support.patch [bz#1451862]
  - kvm-spec-vhost-user-spec-Add-IOMMU-support.patch [bz#1451862]
  - kvm-pc-Use-min-x-level-on-compat_props-on-RHEL-machine-t.patch [bz#1454641]
  - kvm-usb-don-t-wakeup-during-coldplug.patch [bz#1452512]
  - kvm-ehci-fix-overflow-in-frame-timer-code.patch [bz#1449609]
  - kvm-ehci-fix-frame-timer-invocation.patch [bz#1449609]
  - Resolves: bz#1418927
    (The lifecycle event for Guest OS Shutdown is not distinguishable from a qemu process that was quit with SIG_TERM)
  - Resolves: bz#1448813
    (qemu crash when shutdown guest with '-device intel-iommu' and '-device vfio-pci')
  - Resolves: bz#1449609
    (qemu coredump when dd on multiple usb-storage devices concurrently in guest)
  - Resolves: bz#1451862
    (IOMMU support in QEMU for Vhost-user backend)
  - Resolves: bz#1452512
    (qemu coredump when add more than 12 usb-storage devices to ehci)
  - Resolves: bz#1454641
    (Windows 10 BSOD when using rhel6.4.0/rhel6.5.0/rhel6.6.0)


author: Miroslav Rezanina <mrezanin@redhat.com> - rhev-2.9.0-10.el7
changelog:
  - kvm-Revert-Change-net-socket.c-to-use-socket_-functions-.patch [bz#1451629]
  - kvm-nbd-Fully-initialize-client-in-case-of-failed-negoti.patch [bz#1447948]
  - kvm-nbd-Fix-regression-on-resiliency-to-port-scan.patch [bz#1447948]
  - kvm-nbd-make-it-thread-safe-fix-qcow2-over-nbd.patch [bz#1454582]
  - kvm-commit-Fix-use-after-free-in-completion.patch [bz#1452048]
  - kvm-qemu-iotests-Test-automatic-commit-job-cancel-on-hot.patch [bz#1452048]
  - kvm-commit-Fix-completion-with-extra-reference.patch [bz#1453169]
  - kvm-qemu-iotests-Allow-starting-new-qemu-after-cleanup.patch [bz#1453169]
  - kvm-qemu-iotests-Test-exiting-qemu-with-running-job.patch [bz#1453169]
  - kvm-virtio-serial-fix-segfault-on-disconnect.patch [bz#1447257]
  - kvm-block-fix-external-snapshot-abort-permission-error.patch [bz#1447184]
  - kvm-xhci-only-update-dequeue-ptr-on-completed-transfers.patch [bz#1451631]
  - kvm-virtio-scsi-Unset-hotplug-handler-when-unrealize.patch [bz#1449031]
  - Resolves: bz#1447184
    (qemu abort when live snapshot for multiple block device simultaneously with transaction and one is to a non-exist path)
  - Resolves: bz#1447257
    (QEMU coredump while doing hexdump test onto virtio serial ports)
  - Resolves: bz#1447948
    (qemu-nbd segment fault when nmap sweeps its port [rhel-7.4])
  - Resolves: bz#1449031
    (qemu core dump when hot-unplug/hot-plug scsi controller in turns)
  - Resolves: bz#1451629
    (TCP tunnel network: the guest with interface type=client can not start)
  - Resolves: bz#1451631
    (Keyboard does not work after migration)
  - Resolves: bz#1452048
    (qemu abort when hot unplug block device during live commit)
  - Resolves: bz#1453169
    (qemu aborts if quit during live commit process)
  - Resolves: bz#1454582
    (Qemu crashes when start guest with qcow2 nbd image)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.9.0-11.el7
changelog:
  - kvm-Enable-USB_CONFIG-for-aarch64.patch [bz#1460010]
  - Resolves: bz#1460010
    (USB HID (keyboard and tablet) missing [aarch64])


author: Miroslav Rezanina <mrezanin@redhat.com> - rhev-2.9.0-12.el7
changelog:
  - kvm-pseries-Correct-panic-behaviour-for-pseries-machine-.patch [bz#1458705]
  - kvm-virtio-scsi-Reject-scsi-cd-if-data-plane-enabled-RHE.patch [bz#1378816]
  - kvm-block-rbd-enable-filename-option-and-parsing.patch [bz#1457088]
  - kvm-block-iscsi-enable-filename-option-and-parsing.patch [bz#1457088]
  - kvm-nbd-fix-NBD-over-TLS-bz1461827.patch [bz#1461827]
  - kvm-monitor-add-handle_hmp_command-trace-event.patch [bz#1457740]
  - kvm-monitor-resurrect-handle_qmp_command-trace-event.patch [bz#1457740]
  - kvm-hw-pcie-fix-the-generic-pcie-root-port-to-support-mi.patch [bz#1455150]
  - Resolves: bz#1378816
    (Core dump when use "data-plane" and execute change cd)
  - Resolves: bz#1455150
    (Unable to detach virtio disk from pcie-root-port after migration)
  - Resolves: bz#1457088
    (rbd/iscsi: json: pseudo-protocol format is incompatible with 7.3)
  - Resolves: bz#1457740
    ([Tracing] compling qemu-kvm failed through systemtap)
  - Resolves: bz#1458705
    (pvdump: QMP reports "GUEST_PANICKED" event but HMP still shows VM running after guest crashed)
  - Resolves: bz#1461827
    (QEMU hangs in aio wait when trying to access NBD volume over TLS)


author: Miroslav Rezanina <mrezanin@redhat.com> - rhev-2.9.0-14.el7
changelog:
  - kvm-sockets-ensure-we-can-bind-to-both-ipv4-ipv6-separat.patch [bz#1446003]
  - Resolves: bz#1446003
    (vnc cannot find a free port to use)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.10.0-12.el7
changelog:
  - kvm-block-add-bdrv_co_drain_end-callback.patch [bz#1506531]
  - kvm-block-rename-bdrv_co_drain-to-bdrv_co_drain_begin.patch [bz#1506531]
  - kvm-blockjob-do-not-allow-coroutine-double-entry-or-entr.patch [bz#1506531]
  - kvm-coroutine-abort-if-we-try-to-schedule-or-enter-a-pen.patch [bz#1506531]
  - kvm-qemu-iotests-add-option-in-common.qemu-for-mismatch-.patch [bz#1506531]
  - kvm-qemu-iotest-add-test-for-blockjob-coroutine-race-con.patch [bz#1506531]
  - kvm-blockjob-Remove-the-job-from-the-list-earlier-in-blo.patch [bz#1506531]
  - kvm-block-Expect-graph-changes-in-bdrv_parent_drained_be.patch [bz#1506531]
  - kvm-blockjob-remove-clock-argument-from-block_job_sleep_.patch [bz#1506531]
  - kvm-blockjob-introduce-block_job_do_yield.patch [bz#1506531]
  - kvm-blockjob-reimplement-block_job_sleep_ns-to-allow-can.patch [bz#1506531]
  - kvm-blockjob-Make-block_job_pause_all-keep-a-reference-t.patch [bz#1506531]
  - kvm-target-ppc-Move-setting-of-patb_entry-on-hash-table-.patch [bz#1517051]
  - kvm-target-ppc-Fix-setting-of-cpu-compat_pvr-on-incoming.patch [bz#1517051]
  - kvm-BZ1513294-spapr-Include-pre-plugged-DIMMS-in-ram-siz.patch [bz#1513294]
  - kvm-virtio-Add-queue-interface-to-restore-avail-index-fr.patch [bz#1491909]
  - kvm-vhost-restore-avail-index-from-vring-used-index-on-d.patch [bz#1491909]
  - kvm-dump-guest-memory.py-fix-No-symbol-vmcoreinfo_find.patch [bz#1398633]
  - kvm-ppc-fix-setting-of-compat-mode.patch [bz#1396119]
  - kvm-pc-fix-crash-on-attempted-cpu-unplug.patch [bz#1506856]
  - kvm-sockets-avoid-crash-when-cleaning-up-sockets-for-an-.patch [bz#1506218]
  - Resolves: bz#1396119
    ([IBM 7.5 Feature] POWER9 - Virt: QEMU: POWER8/P8-Compat mode for POWER8 Guests on POWER9 platform)
  - Resolves: bz#1398633
    ([RFE] Kernel address space layout randomization [KASLR] support (qemu-kvm-rhev))
  - Resolves: bz#1491909
    (IP network can not recover after several vhost-user reconnect)
  - Resolves: bz#1506218
    (seg at exit - due to missing fd?)
  - Resolves: bz#1506531
    ([data-plane] Qemu-kvm core dumped when hot-unplugging a block device with data-plane while the drive-mirror job is running)
  - Resolves: bz#1506856
    ([abrt] qemu-kvm-rhev: object_get_class(): qemu-kvm killed by SIGSEGV)
  - Resolves: bz#1513294
    (Guest got stuck when attached memory beforehand.[-device dimm and object memory-backend-ram])
  - Resolves: bz#1517051
    (POWER9 - Virt: QEMU: Migration of HPT guest on Radix host fails)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.10.0-13.el7
changelog:
  - kvm-target-ppc-Add-POWER9-DD2.0-model-information.patch [bz#1523235]
  - kvm-block-vxhs-improve-error-message-for-missing-bad-vxh.patch [bz#1505654]
  - kvm-qemu-img-Clarify-about-relative-backing-file-options.patch [bz#1451269]
  - kvm-nbd-server-CVE-2017-15119-Reject-options-larger-than.patch [bz#1518529 bz#1518551]
  - kvm-nbd-server-CVE-2017-15118-Stack-smash-on-large-expor.patch [bz#1516545 bz#1518548]
  - kvm-vfio-Fix-vfio-kvm-group-registration.patch [bz#1520294]
  - Resolves: bz#1451269
    (Clarify the relativity of backing file and created image in "qemu-img create")
  - Resolves: bz#1505654
    (Missing libvxhs share-able object  file when try to query vxhs protocol)
  - Resolves: bz#1516545
    (CVE-2017-15118 qemu-kvm-rhev: qemu NBD server vulnerable to stack smash from client requesting long export name [rhel-7.5])
  - Resolves: bz#1518529
    (CVE-2017-15119 qemu-kvm-rhev: qemu: DoS via large option request [rhel-7.5])
  - Resolves: bz#1518548
    (CVE-2017-15118 qemu-kvm-ma: Qemu: stack buffer overflow in NBD server triggered via long export name [rhel-7.5])
  - Resolves: bz#1518551
    (CVE-2017-15119 qemu-kvm-ma: qemu: DoS via large option request [rhel-7.5])
  - Resolves: bz#1520294
    (Hot-unplug the second pf cause qemu promote " Failed to remove group $iommu_group_num from KVM VFIO device:")
  - Resolves: bz#1523235
    (Pegas1.0 - qemu cpu information is not up-to-date (qemu-kvm))


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.10.0-14.el7
changelog:
  - kvm-spapr-don-t-initialize-PATB-entry-if-max-cpu-compat-.patch [bz#1525866]
  - kvm-block-avoid-recursive-AioContext-acquire-in-bdrv_ina.patch [bz#1520824]
  - kvm-io-send-proper-HTTP-response-for-websocket-errors.patch [bz#1518649]
  - kvm-io-include-full-error-message-in-websocket-handshake.patch [bz#1518649]
  - kvm-io-use-case-insensitive-check-for-Connection-Upgrade.patch [bz#1518649]
  - kvm-ui-Always-remove-an-old-VNC-channel-watch-before-add.patch [bz#1518649]
  - kvm-io-Small-updates-in-preparation-for-websocket-change.patch [bz#1518649]
  - kvm-io-Add-support-for-fragmented-websocket-binary-frame.patch [bz#1518649]
  - kvm-io-Allow-empty-websocket-payload.patch [bz#1518649]
  - kvm-io-Ignore-websocket-PING-and-PONG-frames.patch [bz#1518649]
  - kvm-io-Reply-to-ping-frames.patch [bz#1518649]
  - kvm-io-Attempt-to-send-websocket-close-messages-to-clien.patch [bz#1518649]
  - kvm-io-add-trace-events-for-websockets-frame-handling.patch [bz#1518649]
  - kvm-io-monitor-encoutput-buffer-size-from-websocket-GSou.patch [bz#1518650]
  - kvm-io-simplify-websocket-ping-reply-handling.patch [bz#1518649]
  - kvm-io-get-rid-of-qio_channel_websock_encode-helper-meth.patch [bz#1518649]
  - kvm-io-pass-a-struct-iovec-into-qio_channel_websock_enco.patch [bz#1518649]
  - kvm-io-get-rid-of-bounce-buffering-in-websock-write-path.patch [bz#1518649]
  - kvm-io-cope-with-websock-Connection-header-having-multip.patch [bz#1518649]
  - kvm-io-add-trace-points-for-websocket-HTTP-protocol-head.patch [bz#1518649]
  - kvm-io-fix-mem-leak-in-websock-error-path.patch [bz#1518649]
  - kvm-io-Add-missing-GCC_FMT_ATTR-fix-Werror-suggest-attri.patch [bz#1518649]
  - kvm-qemu.py-make-VM-a-context-manager.patch [bz#1519721]
  - kvm-iotests.py-add-FilePath-context-manager.patch [bz#1519721]
  - kvm-qemu-iothread-IOThread-supports-the-GMainContext-eve.patch [bz#1519721]
  - kvm-qom-provide-root-container-for-internal-objs.patch [bz#1519721]
  - kvm-iothread-provide-helpers-for-internal-use.patch [bz#1519721]
  - kvm-iothread-export-iothread_stop.patch [bz#1519721]
  - kvm-iothread-delay-the-context-release-to-finalize.patch [bz#1519721]
  - kvm-aio-fix-assert-when-remove-poll-during-destroy.patch [bz#1519721]
  - kvm-blockdev-hold-AioContext-for-bdrv_unref-in-external_.patch [bz#1519721]
  - kvm-block-don-t-keep-AioContext-acquired-after-external_.patch [bz#1519721]
  - kvm-block-don-t-keep-AioContext-acquired-after-drive_bac.patch [bz#1519721]
  - kvm-block-don-t-keep-AioContext-acquired-after-blockdev_.patch [bz#1519721]
  - kvm-block-don-t-keep-AioContext-acquired-after-internal_.patch [bz#1519721]
  - kvm-iothread-add-iothread_by_id-API.patch [bz#1519721]
  - kvm-blockdev-add-x-blockdev-set-iothread-testing-command.patch [bz#1519721]
  - kvm-qemu-iotests-add-202-external-snapshots-IOThread-tes.patch [bz#1519721]
  - kvm-blockdev-add-x-blockdev-set-iothread-force-boolean.patch [bz#1519721]
  - kvm-iotests-add-VM.add_object.patch [bz#1519721]
  - kvm-iothread-fix-iothread_stop-race-condition.patch [bz#1519721]
  - kvm-qemu-iotests-add-203-savevm-with-IOThreads-test.patch [bz#1519721]
  - Resolves: bz#1518649
    (Client compatibility flaws in VNC websockets server)
  - Resolves: bz#1518650
    (CVE-2017-15268 qemu-kvm-rhev: Qemu: I/O: potential memory exhaustion via websock connection to VNC [rhel-7.5])
  - Resolves: bz#1519721
    (Both qemu and guest hang when performing live snapshot transaction with data-plane)
  - Resolves: bz#1520824
    (Migration with dataplane, qemu processor hang, vm hang and migration can't finish)
  - Resolves: bz#1525866
    (P9 to P8 guest migration fails when kernel is not started)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.10.0-15.el7
changelog:
  - kvm-target-i386-add-support-for-SPEC_CTRL-MSR.patch [CVE-2017-5715]
  - kvm-target-i386-cpu-add-new-CPUID-bits-for-indirect-bran.patch [CVE-2017-5715]
  - kvm-target-i386-cpu-add-new-CPU-models-for-indirect-bran.patch [CVE-2017-5715]


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.10.0-16.el7
changelog:
  - kvm-gicv3-Convert-to-DEFINE_PROP_LINK.patch [bz#1513323]
  - kvm-hw-intc-arm_gicv3_its-Fix-the-VM-termination-in-vm_c.patch [bz#1513323]
  - kvm-hw-intc-arm_gicv3_its-Don-t-abort-on-table-save-fail.patch [bz#1513323]
  - kvm-hw-intc-arm_gicv3_its-Don-t-call-post_load-on-reset.patch [bz#1513323]
  - kvm-hw-intc-arm_gicv3_its-Implement-a-minimalist-reset.patch [bz#1513323]
  - kvm-linux-headers-Partial-header-update-against-v4.15-rc.patch [bz#1513323]
  - kvm-hw-intc-arm_gicv3_its-Implement-full-reset.patch [bz#1513323]
  - kvm-block-throttle-groups.c-allocate-RestartData-on-the-.patch [bz#1525868]
  - kvm-redhat-Fix-permissions-of-dev-kvm-on-a-freshly-boote.patch [bz#1527947]
  - Resolves: bz#1513323
    (vITS reset)
  - Resolves: bz#1525868
    (Guest hit core dump with both IO throttling and data plane)
  - Resolves: bz#1527947
    (Pegas1.1 - virsh domcapabilities doesn't report KVM capabilities on s390x)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.10.0-17.el7
changelog:
  - kvm-tools-kvm_stat-fix-command-line-option-g.patch [bz#1529676]
  - kvm-redhat-globally-limit-the-maximum-number-of-CPUs.patch [bz#1527449]
  - kvm-redhat-remove-manual-max_cpus-limitations-for-ppc.patch [bz#1527449]
  - kvm-dump-guest-memory.py-fix-You-can-t-do-that-without-a.patch [bz#1398633]
  - kvm-hw-ppc-spapr.c-abort-unplug_request-if-previous-unpl.patch [bz#1528173]
  - kvm-spapr-Correct-compatibility-mode-setting-for-hotplug.patch [bz#1528234]
  - kvm-ui-fix-dcl-unregister.patch [bz#1510809]
  - kvm-block-Open-backing-image-in-force-share-mode-for-siz.patch [bz#1526212]
  - kvm-fw_cfg-fix-memory-corruption-when-all-fw_cfg-slots-a.patch [bz#1462145]
  - kvm-block-Don-t-use-BLK_PERM_CONSISTENT_READ-for-format-.patch [bz#1515604]
  - kvm-block-Don-t-request-I-O-permission-with-BDRV_O_NO_IO.patch [bz#1515604]
  - kvm-block-Formats-don-t-need-CONSISTENT_READ-with-NO_IO.patch [bz#1515604]
  - Resolves: bz#1398633
    ([RFE] Kernel address space layout randomization [KASLR] support (qemu-kvm-rhev))
  - Resolves: bz#1462145
    (Qemu crashes when all fw_cfg slots are used)
  - Resolves: bz#1510809
    (qemu-kvm core dumped when booting up guest using both virtio-vga and VGA)
  - Resolves: bz#1515604
    (qemu-img info: failed to get "consistent read" lock on a mirroring image)
  - Resolves: bz#1526212
    (qemu-img should not need a write lock for creating the overlay image)
  - Resolves: bz#1527449
    (qemu-kvm-ma: vCPU count should be limited to 240 on all arches)
  - Resolves: bz#1528173
    (Hot-unplug memory  during booting early stage induced qemu-kvm coredump)
  - Resolves: bz#1528234
    (Pegas1.1 Alpha: Hotplugged vcpu does not guarantee CPU P8compat mode on POWER9 host (qemu-kvm))
  - Resolves: bz#1529676
    (kvm_stat: option '--guest' doesn't work)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.10.0-18.el7
changelog:
  - kvm-serial-always-transmit-send-receive-buffers-on-migra.patch [bz#1459945]
  - kvm-hw-acpi-Move-acpi_set_pci_info-to-pcihp.patch [bz#1507693]
  - kvm-scsi-block-Add-share-rw-option.patch [bz#1518482]
  - kvm-scsi-generic-Add-share-rw-option.patch [bz#1518482]
  - kvm-target-i386-sanitize-x86-MSR_PAT-loaded-from-another.patch [bz#1529461]
  - kvm-scsi-disk-release-AioContext-in-unaligned-WRITE-SAME.patch [bz#1526423]
  - kvm-hw-pci-bridge-fix-QEMU-crash-because-of-pcie-root-po.patch [bz#1520858]
  - kvm-spapr-Capabilities-infrastructure.patch [bz#1523414]
  - kvm-spapr-Treat-Hardware-Transactional-Memory-HTM-as-an-.patch [bz#1523414]
  - kvm-spapr-Validate-capabilities-on-migration.patch [bz#1523414]
  - kvm-spapr-Handle-VMX-VSX-presence-as-an-spapr-capability.patch [bz#1523414]
  - kvm-spapr-Handle-Decimal-Floating-Point-DFP-as-an-option.patch [bz#1523414]
  - kvm-hw-ppc-spapr_caps-Rework-spapr_caps-to-use-uint8-int.patch [bz#1523414]
  - kvm-spapr-Remove-unnecessary-options-field-from-sPAPRCap.patch [bz#1523414]
  - kvm-ppc-Change-Power9-compat-table-to-support-at-most-8-.patch [bz#1529243]
  - kvm-target-ppc-Clarify-compat-mode-max_threads-value.patch [bz#1529243]
  - kvm-spapr-Allow-some-cases-where-we-can-t-set-VSMT-mode-.patch [bz#1529243]
  - kvm-spapr-Adjust-default-VSMT-value-for-better-migration.patch [bz#1529243]
  - kvm-qemu-img-info-Force-U-downstream.patch [bz#1535992]
  - kvm-dump-guest-memory.py-fix-python-2-support.patch [bz#1398633]
  - kvm-spapr-fix-device-tree-properties-when-using-compatib.patch [bz#1535752]
  - Resolves: bz#1398633
    ([RFE] Kernel address space layout randomization [KASLR] support (qemu-kvm-rhev))
  - Resolves: bz#1459945
    (migration fails with hungup serial console reader on -M pc-i440fx-rhel7.0.0 and pc-i440fx-rhel7.1.0)
  - Resolves: bz#1507693
    (Unable to hot plug device to VM reporting libvirt errors.)
  - Resolves: bz#1518482
    ("share-rw" property is unavailable on scsi passthrough devices)
  - Resolves: bz#1520858
    (qemu-kvm core dumped when booting guest with more pcie-root-ports than available slots and io-reserve=0)
  - Resolves: bz#1523414
    ([POWER guests] Verify compatible CPU & hypervisor capabilities across migration)
  - Resolves: bz#1526423
    (QEMU hang with data plane enabled after some sg_write_same operations in guest)
  - Resolves: bz#1529243
    (Migration from P9 to P8, migration failed and qemu quit on dst end with "error while loading state for instance 0x0 of device 'ics'")
  - Resolves: bz#1529461
    (On amd hosts, after migration from rhel6.9.z to rhel7.5, CPU utilization of qemu-kvm is always more than 100% on destination rhel7.5 host)
  - Resolves: bz#1535752
    (Device tree incorrectly advertises compatibility modes for secondary CPUs)
  - Resolves: bz#1535992
    (Set force shared option "-U" as default option for "qemu-img info")


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.10.0-19.el7
changelog:
  - kvm-Drop-105th-key-from-en-us-keymap.patch [bz#1513870]
  - kvm-linux-headers-update.patch [bz#1535606]
  - kvm-s390x-kvm-Handle-bpb-feature.patch [bz#1535606]
  - kvm-s390x-kvm-provide-stfle.81.patch [bz#1535606]
  - kvm-osdep-Retry-SETLK-upon-EINTR.patch [bz#1529053]
  - kvm-vga-check-the-validation-of-memory-addr-when-draw-te.patch [bz#1534682]
  - kvm-usb-storage-Fix-share-rw-option-parsing.patch [bz#1525324]
  - kvm-spapr-disable-memory-hotplug.patch [bz#1535952]
  - Resolves: bz#1513870
    (For VNC connection, characters '|' and '<' are both recognized as '>' in linux guests, while '<' and '>' are both recognized as '|' in windows guest)
  - Resolves: bz#1525324
    (2 VMs both with 'share-rw=on' appending on '-device usb-storage' for the same source image can not be started at the same time)
  - Resolves: bz#1529053
    (Miss the handling of EINTR in the fcntl calls made by QEMU)
  - Resolves: bz#1534682
    (CVE-2018-5683 qemu-kvm-rhev: Qemu: Out-of-bounds read in vga_draw_text routine [rhel-7.5])
  - Resolves: bz#1535606
    (Spectre mitigation patches for qemu-kvm-ma on z Systems)
  - Resolves: bz#1535952
    (qemu-kvm-ma differentiation - memory hotplug)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.10.0-20.el7
changelog:
  - kvm-console-fix-dpy_gfx_replace_surface-assert.patch [bz#1505696]
  - kvm-ui-add-tracing-of-VNC-operations-related-to-QIOChann.patch [bz#1527404]
  - kvm-ui-add-tracing-of-VNC-authentication-process.patch [bz#1527404]
  - kvm-ui-remove-sync-parameter-from-vnc_update_client.patch [bz#1527404]
  - kvm-ui-remove-unreachable-code-in-vnc_update_client.patch [bz#1527404]
  - kvm-ui-remove-redundant-indentation-in-vnc_client_update.patch [bz#1527404]
  - kvm-ui-avoid-pointless-VNC-updates-if-framebuffer-isn-t-.patch [bz#1527404]
  - kvm-ui-track-how-much-decoded-data-we-consumed-when-doin.patch [bz#1527404]
  - kvm-ui-introduce-enum-to-track-VNC-client-framebuffer-up.patch [bz#1527404]
  - kvm-ui-correctly-reset-framebuffer-update-state-after-pr.patch [bz#1527404]
  - kvm-ui-refactor-code-for-determining-if-an-update-should.patch [bz#1527404]
  - kvm-ui-fix-VNC-client-throttling-when-audio-capture-is-a.patch [bz#1527404]
  - kvm-ui-fix-VNC-client-throttling-when-forced-update-is-r.patch [bz#1527404]
  - kvm-ui-place-a-hard-cap-on-VNC-server-output-buffer-size.patch [bz#1527404]
  - kvm-ui-add-trace-events-related-to-VNC-client-throttling.patch [bz#1527404]
  - kvm-ui-mix-misleading-comments-return-types-of-VNC-I-O-h.patch [bz#1527404]
  - kvm-ui-avoid-sign-extension-using-client-width-height.patch [bz#1527404]
  - kvm-ui-correctly-advance-output-buffer-when-writing-SASL.patch [bz#1527404]
  - kvm-dump-guest-memory.py-skip-vmcoreinfo-section-if-not-.patch [bz#1398633]
  - kvm-virtio-gpu-disallow-vIOMMU.patch [bz#1540182]
  - Resolves: bz#1398633
    ([RFE] Kernel address space layout randomization [KASLR] support (qemu-kvm-rhev))
  - Resolves: bz#1505696
    (Qemu crashed when open the second display of virtio video)
  - Resolves: bz#1527404
    (CVE-2017-15124 qemu-kvm-rhev: Qemu: memory exhaustion through framebuffer update request message in VNC server [rhel-7.5])
  - Resolves: bz#1540182
    (QEMU: disallow virtio-gpu to boot with vIOMMU)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.10.0-21.el7
changelog:
  - kvm-migration-Recover-block-devices-if-failure-in-device.patch [bz#1538494]
  - kvm-migration-savevm.c-set-MAX_VM_CMD_PACKAGED_SIZE-to-1.patch [bz#1540003]
  - kvm-pci-bus-let-it-has-higher-migration-priority.patch [bz#1538953]
  - kvm-spapr-set-vsmt-to-MAX-8-smp_threads.patch [bz#1542421]
  - kvm-target-ppc-spapr_caps-Add-macro-to-generate-spapr_ca.patch [bz#1532050]
  - kvm-target-ppc-kvm-Add-cap_ppc_safe_-cache-bounds_check-.patch [bz#1532050]
  - kvm-target-ppc-spapr_caps-Add-support-for-tristate-spapr.patch [bz#1532050]
  - kvm-target-ppc-spapr_caps-Add-new-tristate-cap-safe_cach.patch [bz#1532050]
  - kvm-target-ppc-spapr_caps-Add-new-tristate-cap-safe_boun.patch [bz#1532050]
  - kvm-target-ppc-spapr_caps-Add-new-tristate-cap-safe_indi.patch [bz#1532050]
  - kvm-target-ppc-introduce-the-PPC_BIT-macro.patch [bz#1532050]
  - kvm-target-ppc-spapr-Add-H-Call-H_GET_CPU_CHARACTERISTIC.patch [bz#1532050]
  - kvm-spapr-add-missing-break-in-h_get_cpu_characteristics.patch [bz#1532050]
  - kvm-vfio-pci-Add-option-to-disable-GeForce-quirks.patch [bz#1508330]
  - kvm-Disable-GeForce-quirks-in-vfio-pci-for-RHEL-machines.patch [bz#1508330]
  - Resolves: bz#1508330
    (Interrupt latency issues with vGPU on KVM hypervisor.)
  - Resolves: bz#1532050
    ([CVE-2017-5754] Variant3: POWER {qemu-kvm-rhev} (rhel 7.5))
  - Resolves: bz#1538494
    (Guest crashed on the source host when cancel migration by virDomainMigrateBegin3Params sometimes)
  - Resolves: bz#1538953
    (IOTLB entry size mismatch before/after migration during DPDK PVP testing)
  - Resolves: bz#1540003
    (Postcopy migration failed with "Unreasonably large packaged state")
  - Resolves: bz#1542421
    (Pegas1.1 Snapshot1 [4.14.0-35.el7a.ppc64le] [qemu-kvm-ma-2.10.0-18.el7.ppc64le] qemu-kvm behaves incorrectly for guest boot with invalid threads)


author: Miroslav Rezanina <mrezanin@redhat.com> - ma-2.10.0-21.el7_5.1
changelog:
  - kvm-memory-inline-some-performance-sensitive-accessors.patch [bz#1554930]
  - kvm-address_space_write-address_space_to_flatview-needs-.patch [bz#1554930]
  - kvm-address_space_read-address_space_to_flatview-needs-R.patch [bz#1554930]
  - kvm-address_space_access_valid-address_space_to_flatview.patch [bz#1554930]
  - kvm-address_space_map-address_space_to_flatview-needs-RC.patch [bz#1554930]
  - kvm-address_space_rw-address_space_to_flatview-needs-RCU.patch [bz#1554930]
  - kvm-ppc-spapr-caps-Change-migration-macro-to-take-full-s.patch [bz#1554957]
  - kvm-ppc-spapr-caps-Disallow-setting-workaround-for-spapr.patch [bz#1554957]
  - kvm-target-ppc-Check-mask-when-setting-cap_ppc_safe_indi.patch [bz#1554957]
  - kvm-ppc-spapr-caps-Add-support-for-custom-spapr_capabili.patch [bz#1554957]
  - kvm-ppc-spapr-caps-Convert-cap-cfpc-to-custom-spapr-cap.patch [bz#1554957]
  - kvm-ppc-spapr-caps-Convert-cap-sbbc-to-custom-spapr-cap.patch [bz#1554957]
  - kvm-ppc-spapr-caps-Convert-cap-ibs-to-custom-spapr-cap.patch [bz#1554957]
  - kvm-ppc-spapr-caps-Define-the-pseries-2.12-sxxm-machine-.patch [bz#1554957]
  - kvm-redhat-Define-the-pseries-rhel7.5-sxxm-machine-type.patch [bz#1554957]
  - kvm-redhat-Define-the-pseries-rhel7.4-sxxm-machine-type.patch [bz#1554957]
  - kvm-redhat-Define-the-pseries-rhel7.3-sxxm-machine-type.patch [bz#1554957]
  - Resolves: bz#1554930
    (incorrect locking (possible use-after-free) with bug 1481593 fix [rhel-7.5.z])
  - Resolves: bz#1554957
    ([CVE-2017-5754] Variant3: POWER {qemu-kvm-ma} Add machine type variants [rhel-7.5.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - ma-2.10.0-21.el7_5.2
changelog:
  - kvm-block-Fix-flags-in-reopen-queue.patch [bz#1557206]
  - kvm-iotests-Add-regression-test-for-commit-base-locking.patch [bz#1557206]
  - kvm-vga-add-ram_addr_t-cast.patch [bz#1566878]
  - kvm-vga-fix-region-calculation.patch [bz#1566878]
  - Resolves: bz#1557206
    ([Regression] Cannot delete VM's snapshot [rhel-7.5.z])
  - Resolves: bz#1566878
    (CVE-2018-7858 qemu-kvm-ma: Qemu: cirrus: OOB access when updating vga display [rhel-7] [rhel-7.5.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - ma-2.10.0-21.el7_5.3
changelog:
  - kvm-scsi-disk-allow-customizing-the-SCSI-version.patch [bz#1593193]
  - kvm-hw-scsi-support-SCSI-2-passthrough-without-PI.patch [bz#1593193]
  - kvm-s390x-fix-storage-attributes-migration-for-non-small.patch [bz#1596553]
  - Resolves: bz#1593193
    (Pegas1.1 - SCSI pass-thru of aacraid RAID1 is inaccessible (qemu-kvm-ma) [rhel-7.5.z])
  - Resolves: bz#1596553
    (RHEL-Alt-7.5 - qemu has error during migration of larger guests [rhel-7.5.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - ma-2.10.0-21.el7_5.4
changelog:
  - kvm-slirp-correct-size-computation-while-concatenating-m.patch [bz#1586247]
  - kvm-slirp-reformat-m_inc-routine.patch [bz#1586247]
  - kvm-slirp-Correct-size-check-in-m_inc.patch [bz#1586247]
  - Resolves: bz#1586247
    (CVE-2018-11806 qemu-kvm-ma: QEMU: slirp: heap buffer overflow while reassembling fragmented datagrams [rhel-7.5.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.12.0-9.el7
changelog:
  - kvm-Disable-aarch64-devices-reappeared-after-2.12-rebase.patch [bz#1586357]
  - kvm-Disable-split-irq-device.patch [bz#1586357]
  - kvm-Disable-AT24Cx-i2c-eeprom.patch [bz#1586357]
  - kvm-Disable-CAN-bus-devices.patch [bz#1586357]
  - kvm-Disable-new-superio-devices.patch [bz#1586357]
  - kvm-Disable-new-pvrdma-device.patch [bz#1586357]
  - kvm-Disable-PCIe-to-PCI-bridge-device.patch [bz#1586357]
  - kvm-qdev-add-HotplugHandler-post_plug-callback.patch [bz#1607891]
  - kvm-virtio-scsi-fix-hotplug-reset-vs-event-race.patch [bz#1607891]
  - kvm-i386-Allow-TOPOEXT-to-be-enabled-on-older-kernels.patch [bz#1608698]
  - kvm-e1000-Fix-tso_props-compat-for-82540em.patch [bz#1608778]
  - kvm-Revert-redhat-support-POWER8-on-POWER9-settings-in-k.patch [bz#1607443]
  - kvm-slirp-correct-size-computation-while-concatenating-m.patch [bz#1586255]
  - kvm-s390x-sclp-fix-maxram-calculation.patch [bz#1595740]
  - kvm-Fix-update-of-qemu-kvm-tools.patch [bz#1598104]
  - Resolves: bz#1586255
    (CVE-2018-11806 qemu-kvm-rhev: QEMU: slirp: heap buffer overflow while reassembling fragmented datagrams [rhel-7.6])
  - Resolves: bz#1586357
    (Disable new devices in 2.12)
  - Resolves: bz#1595740
    (RHEL-Alt-7.6 - qemu has error during migration of larger guests)
  - Resolves: bz#1598104
    (Upgrade failed from qemu-kvm-tools-rhev-2.12.0-6.el7 to qemu-kvm-tools-rhev-2.12.0-7.el7)
  - Resolves: bz#1607443
    (qemu-kvm-rhev: Remove POWER8-on-POWER9 settings from kvm-setup)
  - Resolves: bz#1607891
    (Hotplug events are sometimes lost with virtio-scsi + iothread)
  - Resolves: bz#1608698
    (topoext support should not require kernel support)
  - Resolves: bz#1608778
    (qemu/migration: migrate failed from RHEL.7.6 to RHEL.7.5 with e1000-82540em)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.12.0-10.el7
changelog:
  - kvm-qemu-img-Add-C-option-for-convert-with-copy-offloadi.patch [bz#1607774]
  - kvm-iotests-Add-test-for-qemu-img-convert-C-compatibilit.patch [bz#1607774]
  - kvm-qemu-img-Fix-assert-when-mapping-unaligned-raw-file.patch [bz#1601310]
  - kvm-iotests-Add-test-221-to-catch-qemu-img-map-regressio.patch [bz#1601310]
  - kvm-pc-acpi-fix-memory-hotplug-regression-by-reducing-st.patch [bz#1609234]
  - kvm-block-qapi-Add-qdev-field-to-query-blockstats-result.patch [bz#1612114]
  - kvm-block-qapi-Include-anonymous-BBs-in-query-blockstats.patch [bz#1612114]
  - kvm-qemu-iotests-Test-query-blockstats-with-drive-and-bl.patch [bz#1612114]
  - kvm-Add-local-build-configure-for-s390x.patch [bz#1573135]
  - kvm-Update-build-configuration.patch [bz#1573135]
  - kvm-Update-local-build-to-work-with-2.12.0-configuration.patch [bz#1573135]
  - kvm-Ensure-all-iotests-are-executable-on-build-from-srpm.patch [bz#1608229]
  - Resolves: bz#1573135
    (Update build configure for QEMU 2.12.0)
  - Resolves: bz#1601310
    (qemu-img map 'Aborted (core dumped)' when specifying a plain file)
  - Resolves: bz#1607774
    (Target files for 'qemu-img convert' do not support thin_provisoning with iscsi/nfs backend)
  - Resolves: bz#1608229
    (Parts of iotest cases in SRPM don't have execute permission)
  - Resolves: bz#1609234
    (Win2016 guest can't recognize pc-dimm hotplugged to node 0)
  - Resolves: bz#1612114
    (Anonymous BlockBackends are missing in query-blockstats)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.12.0-11.el7
changelog:
  - kvm-slirp-reformat-m_inc-routine.patch [bz#1586255]
  - kvm-slirp-Correct-size-check-in-m_inc.patch [bz#1586255]
  - kvm-Revert-Disable-PCIe-to-PCI-bridge-device.patch [bz#1390329]
  - kvm-aio-posix-Don-t-count-ctx-notifier-as-progress-when-.patch [bz#1562750]
  - kvm-aio-Do-aio_notify_accept-only-during-blocking-aio_po.patch [bz#1562750]
  - Resolves: bz#1390329
    (PCIe: Add Generic PCIe-PCI bridge)
  - Resolves: bz#1562750
    (VM doesn't boot from HD)
  - Resolves: bz#1586255
    (CVE-2018-11806 qemu-kvm-rhev: QEMU: slirp: heap buffer overflow while reassembling fragmented datagrams [rhel-7.6])


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.12.0-12.el7
changelog:
  - kvm-e1000e-Do-not-auto-clear-ICR-bits-which-aren-t-set-i.patch [bz#1596010]
  - kvm-e1000e-Prevent-MSI-MSI-X-storms.patch [bz#1596010]
  - kvm-hw-usb-dev-smartcard-reader-Handle-64-B-USB-packets.patch [bz#1589147]
  - kvm-i386-Disable-TOPOEXT-by-default-on-cpu-host.patch [bz#1613277]
  - kvm-RHEL-Disable-transparent-hugepages-on-POWER8-KVM-hos.patch [bz#1620378]
  - Resolves: bz#1589147
    (Handle 64 B USB packets for Smart Card redirection)
  - Resolves: bz#1596010
    (The network link can't be detected on guest when the guest uses e1000e model type)
  - Resolves: bz#1613277
    (kernel panic in init_amd_cacheinfo)
  - Resolves: bz#1620378
    (qemu-kvm-rhev: Failed to allocate KVM HPT with vfio device enabled - disable THP for POWER8 guests)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.12.0-13.el7
changelog:
  - kvm-linux-headers-asm-s390-kvm.h-header-sync.patch [bz#1622962]
  - kvm-s390x-kvm-add-etoken-facility.patch [bz#1622962]
  - kvm-block-for-jobs-do-not-clear-user_paused-until-after-.patch [bz#1605026]
  - kvm-iotests-Add-failure-matching-to-common.qemu.patch [bz#1605026]
  - kvm-block-iotest-to-catch-abort-on-forced-blockjob-cance.patch [bz#1605026]
  - kvm-i386-define-the-ssbd-CPUID-feature-bit-CVE-2018-3639.patch [bz#1574216]
  - kvm-target-i386-sev-fix-memory-leaks.patch [bz#1624390]
  - kvm-i386-Fix-arch_query_cpu_model_expansion-leak.patch [bz#1624390]
  - kvm-migration-discard-non-migratable-RAMBlocks.patch [bz#1539280]
  - kvm-vfio-pci-do-not-set-the-PCIDevice-has_rom-attribute.patch [bz#1539280]
  - kvm-memory-exec-Expose-all-memory-block-related-flags.patch [bz#1539280]
  - kvm-memory-exec-switch-file-ram-allocation-functions-to-.patch [bz#1539280]
  - kvm-configure-add-libpmem-support.patch [bz#1539280]
  - kvm-hostmem-file-add-the-pmem-option.patch [bz#1539280]
  - kvm-mem-nvdimm-ensure-write-persistence-to-PMEM-in-label.patch [bz#1539280]
  - kvm-migration-ram-Add-check-and-info-message-to-nvdimm-p.patch [bz#1539280]
  - kvm-migration-ram-ensure-write-persistence-on-loading-al.patch [bz#1539280]
  - kvm-intel-iommu-send-PSI-always-even-if-across-PDEs.patch [bz#1623859]
  - kvm-intel-iommu-remove-IntelIOMMUNotifierNode.patch [bz#1623859]
  - kvm-intel-iommu-add-iommu-lock.patch [bz#1623859]
  - kvm-intel-iommu-only-do-page-walk-for-MAP-notifiers.patch [bz#1623859]
  - kvm-intel-iommu-introduce-vtd_page_walk_info.patch [bz#1623859]
  - kvm-intel-iommu-pass-in-address-space-when-page-walk.patch [bz#1623859]
  - kvm-intel-iommu-trace-domain-id-during-page-walk.patch [bz#1623859]
  - kvm-util-implement-simple-iova-tree.patch [bz#1623859]
  - kvm-intel-iommu-rework-the-page-walk-logic.patch [bz#1623859]
  - kvm-qemu-img-fix-regression-copying-secrets-during-conve.patch [bz#1575578]
  - kvm-redhat-rewrap-build_configure.sh-cmdline-for-the-rh-.patch [bz#1500753]
  - kvm-redhat-enable-opengl-for-x86_64.patch [bz#1500753]
  - Resolves: bz#1500753
    ([RFE] Support console on Intel vGPU - qemu)
  - Resolves: bz#1539280
    ([Intel 7.6 Bug] [KVM][Crystal Ridge] Lack of data persistence guarantee of QEMU writes to host PMEM)
  - Resolves: bz#1574216
    (CVE-2018-3639 qemu-kvm-rhev: hw: cpu: speculative store bypass [rhel-7.6])
  - Resolves: bz#1575578
    (Failed to convert a source image to the qcow2 image encrypted by luks)
  - Resolves: bz#1605026
    (Quitting VM causes qemu core dump once the block mirror job paused for no enough target space)
  - Resolves: bz#1622962
    (Add etoken support to qemu-kvm for s390x KVM guests)
  - Resolves: bz#1623859
    (Guest "Detected Tx unit Hang" and host "DMAR: fault addr" when booting guest with ixgbe device assignment,)
  - Resolves: bz#1624390
    (Memory leaks)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.12.0-14.el7
changelog:
  - kvm-mirror-Fail-gracefully-for-source-target.patch [bz#1582042]
  - Resolves: bz#1582042
    (Segfault on 'blockdev-mirror' with same node as source and target)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.12.0-15.el7
changelog:
  - kvm-jobs-change-start-callback-to-run-callback.patch [bz#1626061]
  - kvm-jobs-canonize-Error-object.patch [bz#1626061]
  - kvm-jobs-add-exit-shim.patch [bz#1626061]
  - kvm-block-commit-utilize-job_exit-shim.patch [bz#1626061]
  - kvm-block-mirror-utilize-job_exit-shim.patch [bz#1626061]
  - kvm-jobs-utilize-job_exit-shim.patch [bz#1626061]
  - kvm-block-backup-make-function-variables-consistently-na.patch [bz#1626061]
  - kvm-jobs-remove-ret-argument-to-job_completed-privatize-.patch [bz#1626061]
  - kvm-jobs-remove-job_defer_to_main_loop.patch [bz#1626061]
  - kvm-block-commit-add-block-job-creation-flags.patch [bz#1626061]
  - kvm-block-mirror-add-block-job-creation-flags.patch [bz#1626061]
  - kvm-block-stream-add-block-job-creation-flags.patch [bz#1626061]
  - kvm-block-commit-refactor-commit-to-use-job-callbacks.patch [bz#1626061]
  - kvm-block-mirror-don-t-install-backing-chain-on-abort.patch [bz#1626061]
  - kvm-block-mirror-conservative-mirror_exit-refactor.patch [bz#1626061]
  - kvm-block-stream-refactor-stream-to-use-job-callbacks.patch [bz#1626061]
  - kvm-tests-blockjob-replace-Blockjob-with-Job.patch [bz#1626061]
  - kvm-tests-test-blockjob-remove-exit-callback.patch [bz#1626061]
  - kvm-tests-test-blockjob-txn-move-.exit-to-.clean.patch [bz#1626061]
  - kvm-jobs-remove-.exit-callback.patch [bz#1626061]
  - kvm-qapi-block-commit-expose-new-job-properties.patch [bz#1626061]
  - kvm-qapi-block-mirror-expose-new-job-properties.patch [bz#1626061]
  - kvm-qapi-block-stream-expose-new-job-properties.patch [bz#1626061]
  - kvm-block-backup-qapi-documentation-fixup.patch [bz#1626061]
  - kvm-blockdev-document-transactional-shortcomings.patch [bz#1626061]
  - Resolves: bz#1626061
    (qemu blockjobs other than backup do not support job-finalize or job-dismiss)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.12.0-16.el7
changelog:
  - kvm-commit-Add-top-node-base-node-options.patch [bz#1624012]
  - kvm-qemu-iotests-Test-commit-with-top-node-base-node.patch [bz#1624012]
  - kvm-block-rbd-pull-out-qemu_rbd_convert_options.patch [bz#1610605]
  - kvm-block-rbd-Attempt-to-parse-legacy-filenames.patch [bz#1610605]
  - kvm-block-rbd-add-iotest-for-rbd-legacy-keyvalue-filenam.patch [bz#1610605]
  - kvm-pc-acpi-revert-back-to-1-SRAT-entry-for-hotpluggable.patch [bz#1626059]
  - kvm-blockdev-backup-add-bitmap-argument.patch [bz#1628373]
  - kvm-test-bdrv-drain-bdrv_drain-works-with-cross-AioConte.patch [bz#1601212]
  - kvm-block-Use-bdrv_do_drain_begin-end-in-bdrv_drain_all.patch [bz#1601212]
  - kvm-block-Remove-recursive-parameter-from-bdrv_drain_inv.patch [bz#1601212]
  - kvm-block-Don-t-manually-poll-in-bdrv_drain_all.patch [bz#1601212]
  - kvm-tests-test-bdrv-drain-bdrv_drain_all-works-in-corout.patch [bz#1601212]
  - kvm-block-Avoid-unnecessary-aio_poll-in-AIO_WAIT_WHILE.patch [bz#1601212]
  - kvm-block-Really-pause-block-jobs-on-drain.patch [bz#1601212]
  - kvm-block-Remove-bdrv_drain_recurse.patch [bz#1601212]
  - kvm-test-bdrv-drain-Add-test-for-node-deletion.patch [bz#1601212]
  - kvm-block-Drain-recursively-with-a-single-BDRV_POLL_WHIL.patch [bz#1601212]
  - kvm-test-bdrv-drain-Test-node-deletion-in-subtree-recurs.patch [bz#1601212]
  - kvm-block-Don-t-poll-in-parent-drain-callbacks.patch [bz#1601212]
  - kvm-test-bdrv-drain-Graph-change-through-parent-callback.patch [bz#1601212]
  - kvm-block-Defer-.bdrv_drain_begin-callback-to-polling-ph.patch [bz#1601212]
  - kvm-test-bdrv-drain-Test-that-bdrv_drain_invoke-doesn-t-.patch [bz#1601212]
  - kvm-block-Allow-AIO_WAIT_WHILE-with-NULL-ctx.patch [bz#1601212]
  - kvm-block-Move-bdrv_drain_all_begin-out-of-coroutine-con.patch [bz#1601212]
  - kvm-block-ignore_bds_parents-parameter-for-drain-functio.patch [bz#1601212]
  - kvm-block-Allow-graph-changes-in-bdrv_drain_all_begin-en.patch [bz#1601212]
  - kvm-test-bdrv-drain-Test-graph-changes-in-drain_all-sect.patch [bz#1601212]
  - kvm-block-Poll-after-drain-on-attaching-a-node.patch [bz#1601212]
  - kvm-test-bdrv-drain-Test-bdrv_append-to-drained-node.patch [bz#1601212]
  - kvm-block-linux-aio-acquire-AioContext-before-qemu_laio_.patch [bz#1601212]
  - kvm-util-async-use-qemu_aio_coroutine_enter-in-co_schedu.patch [bz#1601212]
  - kvm-job-Fix-nested-aio_poll-hanging-in-job_txn_apply.patch [bz#1601212]
  - kvm-job-Fix-missing-locking-due-to-mismerge.patch [bz#1601212]
  - kvm-blockjob-Wake-up-BDS-when-job-becomes-idle.patch [bz#1601212]
  - kvm-aio-wait-Increase-num_waiters-even-in-home-thread.patch [bz#1601212]
  - kvm-test-bdrv-drain-Drain-with-block-jobs-in-an-I-O-thre.patch [bz#1601212]
  - kvm-test-blockjob-Acquire-AioContext-around-job_cancel_s.patch [bz#1601212]
  - kvm-job-Use-AIO_WAIT_WHILE-in-job_finish_sync.patch [bz#1601212]
  - kvm-test-bdrv-drain-Test-AIO_WAIT_WHILE-in-completion-ca.patch [bz#1601212]
  - kvm-block-Add-missing-locking-in-bdrv_co_drain_bh_cb.patch [bz#1601212]
  - kvm-block-backend-Add-.drained_poll-callback.patch [bz#1601212]
  - kvm-block-backend-Fix-potential-double-blk_delete.patch [bz#1601212]
  - kvm-block-backend-Decrease-in_flight-only-after-callback.patch [bz#1601212]
  - kvm-mirror-Fix-potential-use-after-free-in-active-commit.patch [bz#1601212]
  - kvm-blockjob-Lie-better-in-child_job_drained_poll.patch [bz#1601212]
  - kvm-block-Remove-aio_poll-in-bdrv_drain_poll-variants.patch [bz#1601212]
  - kvm-test-bdrv-drain-Test-nested-poll-in-bdrv_drain_poll_.patch [bz#1601212]
  - kvm-job-Avoid-deadlocks-in-job_completed_txn_abort.patch [bz#1601212]
  - kvm-test-bdrv-drain-AIO_WAIT_WHILE-in-job-.commit-.abort.patch [bz#1601212]
  - Resolves: bz#1601212
    (qemu coredumps on block-commit)
  - Resolves: bz#1610605
    (rbd json format of 7.6 is incompatible with 7.5)
  - Resolves: bz#1624012
    (allow using node-names with block-commit)
  - Resolves: bz#1626059
    (RHEL6 guest panics on boot if  hotpluggable memory (pc-dimm) is present  at boot time)
  - Resolves: bz#1628373
    (blockdev-backup does not accept bitmap parameter)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.12.0-17.el7
changelog:
  - kvm-aio-posix-fix-concurrent-access-to-poll_disable_cnt.patch [bz#1628191]
  - kvm-aio-posix-compute-timeout-before-polling.patch [bz#1628191]
  - kvm-aio-posix-do-skip-system-call-if-ctx-notifier-pollin.patch [bz#1628191]
  - Resolves: bz#1628191
    (~40% virtio_blk disk performance drop for win2012r2 guest when comparing qemu-kvm-rhev-2.12.0-9 with qemu-kvm-rhev-2.12.0-12)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.12.0-18.el7
changelog:
  - kvm-test-bdrv-drain-Fix-outdated-comments.patch [bz#1618584]
  - kvm-block-Use-a-single-global-AioWait.patch [bz#1618584]
  - kvm-test-bdrv-drain-Test-draining-job-source-child-and-p.patch [bz#1618584]
  - Resolves: bz#1618584
    (block commit aborts with "Co-routine was already scheduled")


author: Miroslav Rezanina <mrezanin@redhat.com> - ma-2.12.0-18.el7_6.2
changelog:
  - kvm-s390x-refuse-to-start-guests-backed-by-hugetlbfs.patch [bz#1672919]
  - kvm-s390x-tcg-avoid-overflows-in-time2tod-tod2time.patch [bz#1672920]
  - kvm-s390x-kvm-pass-values-instead-of-pointers-to-kvm_s39.patch [bz#1672920]
  - kvm-s390x-tod-factor-out-TOD-into-separate-device.patch [bz#1672920]
  - kvm-s390x-tcg-drop-tod_basetime.patch [bz#1672920]
  - kvm-s390x-tcg-properly-implement-the-TOD.patch [bz#1672920]
  - kvm-s390x-tcg-SET-CLOCK-COMPARATOR-can-clear-CKC-interru.patch [bz#1672920]
  - kvm-s390x-tcg-implement-SET-CLOCK.patch [bz#1672920]
  - kvm-s390x-tcg-rearm-the-CKC-timer-during-migration.patch [bz#1672920]
  - kvm-s390x-tcg-fix-locking-problem-with-tcg_s390_tod_upda.patch [bz#1672920]
  - kvm-hw-s390x-Include-the-tod-qemu-also-for-builds-with-d.patch [bz#1672920]
  - kvm-s390x-tod-Properly-stop-the-KVM-TOD-while-the-guest-.patch [bz#1672920]
  - kvm-hw-s390x-Fix-bad-mask-in-time2tod.patch [bz#1672920]
  - kvm-s390x-Return-specification-exception-for-unimplement.patch [bz#1668424]
  - Resolves: bz#1668424
    (RHEL-Alt-7.6 - Backport diag308 stable exception fix (qemu-kvm-ma) [rhel-7.6.z])
  - Resolves: bz#1672919
    (Trying to start a guest with hugetlbfs backing does not bail out so providing saying that hugetlbfs is not supported before actually trying to start the guest. [rhel-7.6.z])
  - Resolves: bz#1672920
    (Stress guest and stop it, then do live migration, guest hit call trace on destination end [rhel-7.6.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.12.0-18.el7_6.3
changelog:
  - kvm-device_tree-Fix-integer-overflowing-in-load_device_t.patch [bz#1693112]
  - Resolves: bz#1693112
    (CVE-2018-20815 qemu-kvm-ma: QEMU: device_tree: heap buffer overflow while loading device tree blob [rhel-7.6.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.12.0-23.el7
changelog:
  - kvm-iotests-153-Fix-dead-code.patch [bz#1551486]
  - kvm-file-posix-Include-filename-in-locking-error-message.patch [bz#1551486]
  - kvm-file-posix-Skip-effectiveless-OFD-lock-operations.patch [bz#1551486]
  - kvm-file-posix-Drop-s-lock_fd.patch [bz#1551486]
  - kvm-tests-Add-unit-tests-for-image-locking.patch [bz#1551486]
  - kvm-file-posix-Fix-shared-locks-on-reopen-commit.patch [bz#1551486]
  - kvm-iotests-Test-file-posix-locking-and-reopen.patch [bz#1551486]
  - kvm-scsi-disk-Don-t-use-empty-string-as-device-id.patch [bz#1673080]
  - kvm-scsi-disk-Add-device_id-property.patch [bz#1673080]
  - kvm-scsi-generic-avoid-possible-out-of-bounds-access-to-.patch [bz#1668999]
  - kvm-block-remove-bdrv_dirty_bitmap_make_anon.patch [bz#1658343]
  - kvm-block-simplify-code-around-releasing-bitmaps.patch [bz#1658343]
  - kvm-hbitmap-Add-advance-param-to-hbitmap_iter_next.patch [bz#1658343]
  - kvm-test-hbitmap-Add-non-advancing-iter_next-tests.patch [bz#1658343]
  - kvm-block-dirty-bitmap-Add-bdrv_dirty_iter_next_area.patch [bz#1658343]
  - kvm-dirty-bitmap-switch-assert-fails-to-errors-in-bdrv_m.patch [bz#1658343]
  - kvm-dirty-bitmap-rename-bdrv_undo_clear_dirty_bitmap.patch [bz#1658343]
  - kvm-dirty-bitmap-make-it-possible-to-restore-bitmap-afte.patch [bz#1658343]
  - kvm-blockdev-rename-block-dirty-bitmap-clear-transaction.patch [bz#1658343]
  - kvm-qapi-add-transaction-support-for-x-block-dirty-bitma.patch [bz#1658343]
  - kvm-block-dirty-bitmaps-add-user_locked-status-checker.patch [bz#1658343]
  - kvm-block-dirty-bitmaps-fix-merge-permissions.patch [bz#1658343]
  - kvm-block-dirty-bitmaps-allow-clear-on-disabled-bitmaps.patch [bz#1658343]
  - kvm-block-dirty-bitmaps-prohibit-enable-disable-on-locke.patch [bz#1658343]
  - kvm-block-backup-prohibit-backup-from-using-in-use-bitma.patch [bz#1658343]
  - kvm-nbd-forbid-use-of-frozen-bitmaps.patch [bz#1658343]
  - kvm-bitmap-Update-count-after-a-merge.patch [bz#1658343]
  - kvm-iotests-169-drop-deprecated-autoload-parameter.patch [bz#1658343]
  - kvm-block-qcow2-improve-error-message-in-qcow2_inactivat.patch [bz#1658343]
  - kvm-bloc-qcow2-drop-dirty_bitmaps_loaded-state-variable.patch [bz#1658343]
  - kvm-dirty-bitmaps-clean-up-bitmaps-loading-and-migration.patch [bz#1658343]
  - kvm-iotests-improve-169.patch [bz#1658343]
  - kvm-iotests-169-add-cases-for-source-vm-resuming.patch [bz#1658343]
  - Resolves: bz#1551486
    (QEMU image locking needn't double open fd number (i.e. drop file-posix.c:s->lock_fd))
  - Resolves: bz#1658343
    (QEMU incremental backup fixes and improvements (from upstream and in RHEL8))
  - Resolves: bz#1668999
    (CVE-2019-6501 qemu-kvm-rhev: QEMU: scsi-generic: possible OOB access while handling inquiry request [rhel-7])
  - Resolves: bz#1673080
    ("An unknown error has occurred" when using cdrom to install the system with two blockdev disks.(when choose installation destination))


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.12.0-24.el7
changelog:
  - kvm-exec-move-memory-access-declarations-to-a-common-hea.patch [bz#1597482]
  - kvm-exec-small-changes-to-flatview_do_translate.patch [bz#1597482]
  - kvm-exec-extract-address_space_translate_iommu-fix-page_.patch [bz#1597482]
  - kvm-exec-reintroduce-MemoryRegion-caching.patch [bz#1597482]
  - kvm-virtio-update-MemoryRegionCaches-when-guest-negotiat.patch [bz#1597482]
  - kvm-exec-Fix-MAP_RAM-for-cached-access.patch [bz#1597482]
  - kvm-virtio-Return-true-from-virtio_queue_empty-if-broken.patch [bz#1597482]
  - kvm-block-backend-Set-werror-rerror-defaults-in-blk_new.patch [bz#1631615]
  - kvm-block-Apply-auto-read-only-for-ro-whitelist-drivers.patch [bz#1667320]
  - kvm-qcow2-Give-the-refcount-cache-the-minimum-possible-s.patch [bz#1656913]
  - kvm-docs-Document-the-new-default-sizes-of-the-qcow2-cac.patch [bz#1656913]
  - kvm-qcow2-Fix-Coverity-warning-when-calculating-the-refc.patch [bz#1656913]
  - kvm-qcow2-Options-documentation-fixes.patch [bz#1656913]
  - kvm-include-Add-a-lookup-table-of-sizes.patch [bz#1656913]
  - kvm-qcow2-Make-sizes-more-humanly-readable.patch [bz#1656913]
  - kvm-qcow2-Avoid-duplication-in-setting-the-refcount-cach.patch [bz#1656913]
  - kvm-qcow2-Assign-the-L2-cache-relatively-to-the-image-si.patch [bz#1656913]
  - kvm-qcow2-Increase-the-default-upper-limit-on-the-L2-cac.patch [bz#1656913]
  - kvm-qcow2-Resize-the-cache-upon-image-resizing.patch [bz#1656913]
  - kvm-qcow2-Set-the-default-cache-clean-interval-to-10-min.patch [bz#1656913]
  - kvm-qcow2-Explicit-number-replaced-by-a-constant.patch [bz#1656913]
  - kvm-qcow2-Fix-cache-clean-interval-documentation.patch [bz#1656913]
  - kvm-Add-raw-qcow2-nbd-and-luks-iotests-to-run-during-the.patch [bz#1676728 bz#1678898]
  - Resolves: bz#1597482
    (qemu crashed when disk enable the IOMMU)
  - Resolves: bz#1631615
    (Wrong werror default for -device drive=<node-name>)
  - Resolves: bz#1656913
    (qcow2 cache is too small)
  - Resolves: bz#1667320
    (-blockdev: auto-read-only is ineffective for drivers on read-only whitelist)
  - Resolves: bz#1676728
    (RHEL77:  Run iotests as part of build process)
  - Resolves: bz#1678898
    (Run iotests in rhel77 qemu-kvm-ma build %check phase)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.12.0-25.el7
changelog:
  - kvm-block-backend-Make-blk_inc-dec_in_flight-public.patch [bz#1671173]
  - kvm-virtio-blk-Increase-in_flight-for-request-restart-BH.patch [bz#1671173]
  - kvm-block-Fix-AioContext-switch-for-drained-node.patch [bz#1671173]
  - kvm-test-bdrv-drain-AioContext-switch-in-drained-section.patch [bz#1671173]
  - kvm-block-Use-normal-drain-for-bdrv_set_aio_context.patch [bz#1671173]
  - kvm-qapi-Add-rendernode-display-option-for-egl-headless.patch [bz#1648236]
  - kvm-ui-Allow-specifying-rendernode-display-option-for-eg.patch [bz#1648236]
  - kvm-qapi-add-query-display-options-command.patch [bz#1648236]
  - kvm-egl-headless-parse-rendernode.patch [bz#1648236]
  - Resolves: bz#1648236
    (QEMU doesn't expose rendernode option for egl-headless display type)
  - Resolves: bz#1671173
    (qemu with iothreads enabled crashes on resume after enospc pause for disk extension)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.12.0-27.el7
changelog:
  - kvm-tests-virtio-blk-test-Disable-auto-read-only.patch [bz#1685989]
  - kvm-block-Avoid-useless-local_err.patch [bz#1685989]
  - kvm-block-Simplify-bdrv_reopen_abort.patch [bz#1685989]
  - kvm-block-Always-abort-reopen-after-prepare-succeeded.patch [bz#1685989]
  - kvm-block-Make-permission-changes-in-reopen-less-wrong.patch [bz#1685989]
  - kvm-block-Fix-use-after-free-error-in-bdrv_open_inherit.patch [bz#1685989]
  - kvm-qemu-iotests-Test-snapshot-on-with-nonexistent-TMPDI.patch [bz#1685989]
  - kvm-file-posix-Fix-bdrv_open_flags-for-snapshot-on.patch [bz#1685989]
  - kvm-file-posix-Use-error-API-properly.patch [bz#1685989]
  - kvm-file-posix-Factor-out-raw_reconfigure_getfd.patch [bz#1685989]
  - kvm-file-posix-Store-BDRVRawState.reopen_state-during-re.patch [bz#1685989]
  - kvm-file-posix-Lock-new-fd-in-raw_reopen_prepare.patch [bz#1685989]
  - kvm-file-posix-Prepare-permission-code-for-fd-switching.patch [bz#1685989]
  - kvm-file-posix-Make-auto-read-only-dynamic.patch [bz#1685989]
  - kvm-qapi-bitmap-merge-document-name-change.patch [bz#1668956]
  - kvm-iotests-Enhance-223-to-cover-multiple-bitmap-granula.patch [bz#1668956]
  - kvm-iotests-Unify-log-outputs-between-Python-2-and-3.patch [bz#1668956]
  - kvm-blockdev-n-ary-bitmap-merge.patch [bz#1668956]
  - kvm-block-remove-x-prefix-from-experimental-bitmap-APIs.patch [bz#1668956]
  - kvm-iotests.py-don-t-abort-if-IMGKEYSECRET-is-undefined.patch [bz#1668956]
  - kvm-iotests-add-filter_generated_node_ids.patch [bz#1668956]
  - kvm-iotests-add-qmp-recursive-sorting-function.patch [bz#1668956]
  - kvm-iotests-remove-default-filters-from-qmp_log.patch [bz#1668956]
  - kvm-iotests-change-qmp_log-filters-to-expect-QMP-objects.patch [bz#1668956]
  - kvm-iotests-implement-pretty-print-for-log-and-qmp_log.patch [bz#1668956]
  - kvm-iotests-add-iotest-236-for-testing-bitmap-merge.patch [bz#1668956]
  - kvm-iotests-236-fix-transaction-kwarg-order.patch [bz#1668956]
  - kvm-iotests-Re-add-filename-filters.patch [bz#1668956]
  - kvm-iotests-Remove-superfluous-rm-from-232.patch [bz#1668956]
  - kvm-iotests-Fix-232-for-LUKS.patch [bz#1668956]
  - kvm-iotests-Fix-207-to-use-QMP-filters-for-qmp_log.patch [bz#1668956]
  - kvm-iotests.py-Add-is_str.patch [bz#1668956]
  - kvm-iotests.py-Filter-filename-in-any-string-value.patch [bz#1668956]
  - kvm-iotest-Fix-filtering-order-in-226.patch [bz#1691018]
  - kvm-iotests-Don-t-lock-dev-null-in-226.patch [bz#1691018]
  - kvm-dirty-bitmap-improve-bdrv_dirty_bitmap_next_zero.patch [bz#1691048]
  - kvm-tests-add-tests-for-hbitmap_next_zero-with-specified.patch [bz#1691048]
  - kvm-dirty-bitmap-add-bdrv_dirty_bitmap_next_dirty_area.patch [bz#1691048]
  - kvm-tests-add-tests-for-hbitmap_next_dirty_area.patch [bz#1691048]
  - kvm-Revert-block-dirty-bitmap-Add-bdrv_dirty_iter_next_a.patch [bz#1691048]
  - kvm-Revert-test-hbitmap-Add-non-advancing-iter_next-test.patch [bz#1691048]
  - kvm-Revert-hbitmap-Add-advance-param-to-hbitmap_iter_nex.patch [bz#1691048]
  - kvm-bdrv_query_image_info-Error-parameter-added.patch [bz#1691048]
  - kvm-qcow2-Add-list-of-bitmaps-to-ImageInfoSpecificQCow2.patch [bz#1691048]
  - kvm-qcow2-list-of-bitmaps-new-test-242.patch [bz#1691048]
  - kvm-blockdev-acquire-aio_context-for-bitmap-add-remove.patch [bz#1672010]
  - kvm-nbd-client-fix-nbd_negotiate_simple_meta_context.patch [bz#1691563]
  - kvm-nbd-client-Fix-error-messages-during-NBD_INFO_BLOCK_.patch [bz#1691563]
  - kvm-nbd-client-Relax-handling-of-large-NBD_CMD_BLOCK_STA.patch [bz#1691563]
  - kvm-tests-Simplify-.gitignore.patch [bz#1691563]
  - kvm-iotests-nbd-Stop-qemu-nbd-before-remaking-image.patch [bz#1691563]
  - kvm-iotests-Disallow-compat-0.10-in-223.patch [bz#1691563]
  - kvm-nbd-server-fix-bitmap-export.patch [bz#1691563]
  - kvm-nbd-server-send-more-than-one-extent-of-base-allocat.patch [bz#1691563]
  - kvm-nbd-Don-t-take-address-of-fields-in-packed-structs.patch [bz#1691563]
  - kvm-qemu-nbd-Document-tls-creds.patch [bz#1691563]
  - kvm-qemu-nbd-drop-old-style-negotiation.patch [bz#1691563]
  - kvm-nbd-server-drop-old-style-negotiation.patch [bz#1691563]
  - kvm-qemu-iotests-remove-unused-variable-here.patch [bz#1691563]
  - kvm-qemu-iotests-convert-pwd-and-pwd-to-PWD.patch [bz#1691563]
  - kvm-qemu-iotests-Modern-shell-scripting-use-instead-of.patch [bz#1691563]
  - kvm-nbd-fix-whitespace-in-server-error-message.patch [bz#1691563]
  - kvm-nbd-server-Ignore-write-errors-when-replying-to-NBD_.patch [bz#1691563]
  - kvm-io-return-0-for-EOF-in-TLS-session-read-after-shutdo.patch [bz#1691563]
  - kvm-tests-pull-qemu-nbd-iotest-helpers-into-common.nbd-f.patch [bz#1691563]
  - kvm-tests-check-if-qemu-nbd-is-still-alive-before-waitin.patch [bz#1691563]
  - kvm-tests-add-iotests-helpers-for-dealing-with-TLS-certi.patch [bz#1691563]
  - kvm-tests-exercise-NBD-server-in-TLS-mode.patch [bz#1691563]
  - kvm-iotests-Also-test-I-O-over-NBD-TLS.patch [bz#1691563]
  - kvm-iotests-Drop-use-of-bash-keyword-function.patch [bz#1691563]
  - kvm-nbd-server-Advertise-all-contexts-in-response-to-bar.patch [bz#1691563]
  - kvm-nbd-client-Make-x-dirty-bitmap-more-reliable.patch [bz#1691563]
  - kvm-nbd-client-Send-NBD_CMD_DISC-if-open-fails-after-con.patch [bz#1691563]
  - kvm-iotests-fix-nbd-test-233-to-work-correctly-with-raw-.patch [bz#1691563]
  - kvm-iotests-Skip-233-if-certtool-not-installed.patch [bz#1691009]
  - kvm-iotests-Make-nbd-fault-injector-flush.patch [bz#1691009]
  - kvm-iotests-make-083-specific-to-raw.patch [bz#1691009]
  - kvm-nbd-publish-_lookup-functions.patch [bz#1691009]
  - kvm-nbd-client-Trace-all-server-option-error-messages.patch [bz#1691009]
  - kvm-block-nbd-client-use-traces-instead-of-noisy-error_r.patch [bz#1691009]
  - kvm-qemu-nbd-Use-program-name-in-error-messages.patch [bz#1691009]
  - kvm-nbd-Document-timeline-of-various-features.patch [bz#1691009]
  - kvm-nbd-client-More-consistent-error-messages.patch [bz#1691009]
  - kvm-qemu-nbd-Fail-earlier-for-c-d-on-non-linux.patch [bz#1691009]
  - kvm-nbd-client-Drop-pointless-buf-variable.patch [bz#1691009]
  - kvm-qemu-nbd-Rename-exp-variable-clashing-with-math-exp-.patch [bz#1691009]
  - kvm-nbd-Add-some-error-case-testing-to-iotests-223.patch [bz#1691009]
  - kvm-nbd-Forbid-nbd-server-stop-when-server-is-not-runnin.patch [bz#1691009]
  - kvm-nbd-Only-require-disabled-bitmap-for-read-only-expor.patch [bz#1691009]
  - kvm-nbd-Merge-nbd_export_set_name-into-nbd_export_new.patch [bz#1691009]
  - kvm-nbd-Allow-bitmap-export-during-QMP-nbd-server-add.patch [bz#1691009]
  - kvm-nbd-Remove-x-nbd-server-add-bitmap.patch [bz#1691009]
  - kvm-nbd-Merge-nbd_export_bitmap-into-nbd_export_new.patch [bz#1691009]
  - kvm-qemu-nbd-Add-bitmap-NAME-option.patch [bz#1691009]
  - kvm-qom-Clean-up-error-reporting-in-user_creatable_add_o.patch [bz#1691009]
  - kvm-qemu-img-fix-error-reporting-for-object.patch [bz#1691009]
  - kvm-iotests-Make-233-output-more-reliable.patch [bz#1691009]
  - kvm-maint-Allow-for-EXAMPLES-in-texi2pod.patch [bz#1691009]
  - kvm-qemu-nbd-Enhance-man-page.patch [bz#1691009]
  - kvm-qemu-nbd-Sanity-check-partition-bounds.patch [bz#1691009]
  - kvm-nbd-server-Hoist-length-check-to-qmp_nbd_server_add.patch [bz#1691009]
  - kvm-nbd-server-Favor-u-int64_t-over-off_t.patch [bz#1691009]
  - kvm-qemu-nbd-Avoid-strtol-open-coding.patch [bz#1691009]
  - kvm-nbd-client-Refactor-nbd_receive_list.patch [bz#1691009]
  - kvm-nbd-client-Move-export-name-into-NBDExportInfo.patch [bz#1691009]
  - kvm-nbd-client-Change-signature-of-nbd_negotiate_simple_.patch [bz#1691009]
  - kvm-nbd-client-Split-out-nbd_send_meta_query.patch [bz#1691009]
  - kvm-nbd-client-Split-out-nbd_receive_one_meta_context.patch [bz#1691009]
  - kvm-nbd-client-Refactor-return-of-nbd_receive_negotiate.patch [bz#1691009]
  - kvm-nbd-client-Split-handshake-into-two-functions.patch [bz#1691009]
  - kvm-nbd-client-Pull-out-oldstyle-size-determination.patch [bz#1691009]
  - kvm-nbd-client-Refactor-nbd_opt_go-to-support-NBD_OPT_IN.patch [bz#1691009]
  - kvm-nbd-client-Add-nbd_receive_export_list.patch [bz#1691009]
  - kvm-nbd-client-Add-meta-contexts-to-nbd_receive_export_l.patch [bz#1691009]
  - kvm-qemu-nbd-Add-list-option.patch [bz#1691009]
  - kvm-nbd-client-Work-around-3.0-bug-for-listing-meta-cont.patch [bz#1691009]
  - kvm-iotests-Enhance-223-233-to-cover-qemu-nbd-list.patch [bz#1691009]
  - kvm-qemu-nbd-Deprecate-qemu-nbd-partition.patch [bz#1691009]
  - kvm-nbd-generalize-usage-of-nbd_read.patch [bz#1691009]
  - kvm-block-nbd-client-split-channel-errors-from-export-er.patch [bz#1691009]
  - kvm-block-nbd-move-connection-code-from-block-nbd-to-blo.patch [bz#1691009]
  - kvm-block-nbd-client-split-connection-from-initializatio.patch [bz#1691009]
  - kvm-block-nbd-client-fix-nbd_reply_chunk_iter_receive.patch [bz#1691009]
  - kvm-block-nbd-client-don-t-check-ioc.patch [bz#1691009]
  - kvm-block-nbd-client-rename-read_reply_co-to-connection_.patch [bz#1691009]
  - kvm-nbd-server-Kill-pointless-shadowed-variable.patch [bz#1691009]
  - kvm-iotests-ensure-we-print-nbd-server-log-on-error.patch [bz#1691009]
  - kvm-iotests-avoid-broken-pipe-with-certtool.patch [bz#1691009]
  - kvm-iotests-Wait-for-qemu-to-end-in-223.patch [bz#1691009]
  - kvm-qemu-kvm-rhev.spec-add-iotest-233.patch [bz#1691009]
  - kvm-slirp-check-sscanf-result-when-emulating-ident.patch [bz#1689793]
  - kvm-dirty-bitmap-Expose-persistent-flag-to-query-block.patch [bz#1677073]
  - kvm-block-dirty-bitmap-Documentation-and-Comment-fixups.patch [bz#1677073]
  - kvm-block-dirty-bitmap-add-recording-and-busy-properties.patch [bz#1677073]
  - kvm-block-dirty-bitmaps-rename-frozen-predicate-helper.patch [bz#1677073]
  - kvm-block-dirty-bitmap-remove-set-reset-assertions-again.patch [bz#1677073]
  - kvm-block-dirty-bitmap-change-semantics-of-enabled-predi.patch [bz#1677073]
  - kvm-nbd-change-error-checking-order-for-bitmaps.patch [bz#1677073]
  - kvm-block-dirty-bitmap-explicitly-lock-bitmaps-with-succ.patch [bz#1677073]
  - kvm-block-dirty-bitmaps-unify-qmp_locked-and-user_locked.patch [bz#1677073]
  - kvm-block-dirty-bitmaps-move-comment-block.patch [bz#1677073]
  - kvm-blockdev-remove-unused-paio-parameter-documentation.patch [bz#1677073]
  - kvm-iotests-add-busy-recording-bit-test-to-124.patch [bz#1677073]
  - kvm-block-dirty-bitmaps-add-inconsistent-bit.patch [bz#1677073]
  - kvm-block-dirty-bitmap-add-inconsistent-status.patch [bz#1677073]
  - kvm-block-dirty-bitmaps-add-block_dirty_bitmap_check-fun.patch [bz#1677073]
  - kvm-block-dirty-bitmaps-prohibit-readonly-bitmaps-for-ba.patch [bz#1677073]
  - kvm-block-dirty-bitmaps-prohibit-removing-readonly-bitma.patch [bz#1677073]
  - kvm-block-dirty-bitmaps-disallow-busy-bitmaps-as-merge-s.patch [bz#1677073]
  - kvm-block-dirty-bitmaps-implement-inconsistent-bit.patch [bz#1677073]
  - kvm-bitmaps-Fix-typo-in-function-name.patch [bz#1677073]
  - kvm-qemu-kvm-rhev.spec-add-bitmap-related-tests.patch [bz#1677073]
  - kvm-block-file-posix-do-not-fail-on-unlock-bytes.patch [bz#1603104]
  - kvm-docs-interop-qcow2-Improve-bitmap-flag-in_use-specif.patch [bz#1666884]
  - kvm-block-qcow2-bitmap-Don-t-check-size-for-IN_USE-bitma.patch [bz#1666884]
  - kvm-block-qcow2-bitmap-Allow-resizes-with-persistent-bit.patch [bz#1666884]
  - kvm-tests-qemu-iotests-add-bitmap-resize-test-246.patch [bz#1666884]
  - kvm-qemu-kvm-rhev.spec-add-iotest-246.patch [bz#1666884]
  - kvm-x86-host-phys-bits-limit-option.patch [bz#1691519]
  - kvm-rhel-Set-host-phys-bits-limit-48-on-rhel-machine-typ.patch [bz#1691519]
  - kvm-device_tree-Fix-integer-overflowing-in-load_device_t.patch [bz#1693115]
  - kvm-mmap-alloc-unfold-qemu_ram_mmap.patch [bz#1672819]
  - kvm-mmap-alloc-fix-hugetlbfs-misaligned-length-in-ppc64.patch [bz#1672819]
  - Resolves: bz#1603104
    (Qemu Aborted (core dumped) for 'qemu-kvm: Failed to lock byte 100' when remote NFS or GlusterFS volume stopped during the block mirror(or block commit/stream) process)
  - Resolves: bz#1666884
    (persistent bitmaps prevent qcow2 image resize)
  - Resolves: bz#1668956
    (incremental backup bitmap API needs a finalized interface)
  - Resolves: bz#1672010
    ([RHEL7]Qemu coredump when remove a persistent bitmap after vm re-start(dataplane enabled))
  - Resolves: bz#1672819
    (RHEL7.6/RHV4.2 - qemu doesn't free up hugepage memory when hotplug/hotunplug using memory-backend-file (qemu-kvm-rhev))
  - Resolves: bz#1677073
    (Backport additional QEMU 4.0 Bitmap API changes to RHEL 7.7)
  - Resolves: bz#1685989
    (Add facility to use block jobs with backing images without write permission)
  - Resolves: bz#1689793
    (CVE-2019-9824 qemu-kvm-rhev: QEMU: Slirp: information leakage in tcp_emu() due to uninitialized stack variables [rhel-7])
  - Resolves: bz#1691009
    (NBD pull mode incremental backup API needs a finalized interface)
  - Resolves: bz#1691018
    (Fix iotest 226 for local development builds)
  - Resolves: bz#1691048
    (Add qemu-img info support for querying bitmaps offline)
  - Resolves: bz#1691519
    (physical bits should  <= 48  when host with 5level paging &EPT5 and qemu command with "-cpu qemu64" parameters.)
  - Resolves: bz#1691563
    (QEMU NBD Feature parity roundup (QEMU 3.1.0))
  - Resolves: bz#1693115
    (CVE-2018-20815 qemu-kvm-rhev: QEMU: device_tree: heap buffer overflow while loading device tree blob [rhel-7.7])


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.12.0-28.el7
changelog:
  - kvm-x86-cpu-Enable-CLDEMOTE-Demote-Cache-Line-cpu-featur.patch [bz#1537776]
  - kvm-scsi-generic-prevent-guest-from-exceeding-SG_IO-limi.patch [bz#1693879]
  - kvm-tests-crypto-Use-the-IEC-binary-prefix-definitions.patch [bz#1666336]
  - kvm-crypto-expand-algorithm-coverage-for-cipher-benchmar.patch [bz#1666336]
  - kvm-crypto-remove-code-duplication-in-tweak-encrypt-decr.patch [bz#1666336]
  - kvm-crypto-introduce-a-xts_uint128-data-type.patch [bz#1666336]
  - kvm-crypto-convert-xts_tweak_encdec-to-use-xts_uint128-t.patch [bz#1666336]
  - kvm-crypto-convert-xts_mult_x-to-use-xts_uint128-type.patch [bz#1666336]
  - kvm-crypto-annotate-xts_tweak_encdec-as-inlineable.patch [bz#1666336]
  - kvm-crypto-refactor-XTS-cipher-mode-test-suite.patch [bz#1666336]
  - kvm-crypto-add-testing-for-unaligned-buffers-with-XTS-ci.patch [bz#1666336]
  - kvm-block-Fix-AioContext-switch-for-bs-drv-NULL.patch [bz#1631227]
  - Resolves: bz#1537776
    ([Intel 7.7 Feat] KVM Enabling SnowRidge new NIs - qemu-kvm-rhev)
  - Resolves: bz#1631227
    (Qemu Core dump when quit vm that's in status "paused(io-error)" with data plane enabled)
  - Resolves: bz#1666336
    (severe performance impact using encrypted Cinder volume (QEMU luks))
  - Resolves: bz#1693879
    (RHV VM pauses when 'dd' issued inside guest to a direct lun configured as virtio-scsi with scsi-passthrough)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.12.0-29.el7
changelog:
  - kvm-qemu-img-Report-bdrv_block_status-failures.patch [bz#1692018]
  - kvm-nbd-Tolerate-some-server-non-compliance-in-NBD_CMD_B.patch [bz#1692018]
  - kvm-nbd-Don-t-lose-server-s-error-to-NBD_CMD_BLOCK_STATU.patch [bz#1692018]
  - kvm-nbd-Permit-simple-error-to-NBD_CMD_BLOCK_STATUS.patch [bz#1692018]
  - kvm-qemu-img-Gracefully-shutdown-when-map-can-t-finish.patch [bz#1692018]
  - kvm-nbd-client-Work-around-server-BLOCK_STATUS-misalignm.patch [bz#1692018]
  - kvm-iotests-Add-241-to-test-NBD-on-unaligned-images.patch [bz#1692018]
  - kvm-nbd-client-Lower-min_block-for-block-status-unaligne.patch [bz#1692018]
  - kvm-nbd-client-Report-offsets-in-bdrv_block_status.patch [bz#1692018]
  - kvm-nbd-client-Reject-inaccessible-tail-of-inconsistent-.patch [bz#1692018]
  - kvm-nbd-client-Support-qemu-img-convert-from-unaligned-s.patch [bz#1692018]
  - kvm-block-Add-bdrv_get_request_alignment.patch [bz#1692018]
  - kvm-nbd-server-Advertise-actual-minimum-block-size.patch [bz#1692018]
  - kvm-nbd-client-Trace-server-noncompliance-on-structured-.patch [bz#1692018]
  - kvm-nbd-server-Fix-blockstatus-trace.patch [bz#1692018]
  - kvm-nbd-server-Trace-client-noncompliance-on-unaligned-r.patch [bz#1692018]
  - kvm-nbd-server-Don-t-fail-NBD_OPT_INFO-for-byte-aligned-.patch [bz#1692018]
  - kvm-nbd-client-Fix-error-message-for-server-with-unusabl.patch [bz#1692018]
  - kvm-iotest-Fix-241-to-run-in-generic-directory.patch [bz#1692018]
  - kvm-virtio-scsi-Move-BlockBackend-back-to-the-main-AioCo.patch [bz#1673397 bz#1673402]
  - kvm-scsi-disk-Acquire-the-AioContext-in-scsi_-_realize.patch [bz#1673397 bz#1673402]
  - kvm-virtio-scsi-Forbid-devices-with-different-iothreads-.patch [bz#1673397 bz#1673402]
  - kvm-monitor-move-init-global-earlier.patch [bz#1624009]
  - kvm-block-pflash_cfi02-Fix-memory-leak-and-potential-use.patch [bz#1624009]
  - kvm-pflash-Rename-pflash_t-to-PFlashCFI01-PFlashCFI02.patch [bz#1624009]
  - kvm-pflash_cfi01-Do-not-exit-on-guest-aborting-write-to-.patch [bz#1624009]
  - kvm-pflash_cfi01-Log-use-of-flawed-write-to-buffer.patch [bz#1624009]
  - kvm-pflash-Rename-CFI_PFLASH-to-PFLASH_CFI.patch [bz#1624009]
  - kvm-hw-Use-PFLASH_CFI0-1-2-and-TYPE_PFLASH_CFI0-1-2.patch [bz#1624009]
  - kvm-sam460ex-Don-t-size-flash-memory-to-match-backing-im.patch [bz#1624009]
  - kvm-ppc405_boards-Delete-stale-disabled-DEBUG_BOARD_INIT.patch [bz#1624009]
  - kvm-ppc405_boards-Don-t-size-flash-memory-to-match-backi.patch [bz#1624009]
  - kvm-r2d-Fix-flash-memory-size-sector-size-width-device-I.patch [bz#1624009]
  - kvm-mips_malta-Delete-disabled-broken-DEBUG_BOARD_INIT-c.patch [bz#1624009]
  - kvm-hw-mips-malta-Remove-fl_sectors-variable.patch [bz#1624009]
  - kvm-hw-mips-malta-Restrict-bios_size-variable-scope.patch [bz#1624009]
  - kvm-mips_malta-Clean-up-definition-of-flash-memory-size-.patch [bz#1624009]
  - kvm-pflash-Clean-up-after-commit-368a354f02b-part-1.patch [bz#1624009]
  - kvm-pflash-Clean-up-after-commit-368a354f02b-part-2.patch [bz#1624009]
  - kvm-qdev-Loosen-coupling-between-compat-and-other-global.patch [bz#1624009]
  - kvm-vl-Prepare-fix-of-latent-bug-with-global-and-onboard.patch [bz#1624009]
  - kvm-vl-Fix-latent-bug-with-global-and-onboard-devices.patch [bz#1624009]
  - kvm-sysbus-Fix-latent-bug-with-onboard-devices.patch [bz#1624009]
  - kvm-vl-Improve-legibility-of-BlockdevOptions-queue.patch [bz#1624009]
  - kvm-vl-Factor-configure_blockdev-out-of-main.patch [bz#1624009]
  - kvm-vl-Create-block-backends-before-setting-machine-prop.patch [bz#1624009]
  - kvm-pflash_cfi01-Add-pflash_cfi01_get_blk-helper.patch [bz#1624009]
  - kvm-pc_sysfw-Remove-unused-PcSysFwDevice.patch [bz#1624009]
  - kvm-pc_sysfw-Pass-PCMachineState-to-pc_system_firmware_i.patch [bz#1624009]
  - kvm-pc-Support-firmware-configuration-with-blockdev.patch [bz#1624009]
  - kvm-docs-interop-firmware.json-Prefer-machine-to-if-pfla.patch [bz#1624009]
  - kvm-Revert-migration-move-only_migratable-to-MigrationSt.patch [bz#1624009]
  - kvm-migration-Support-adding-migration-blockers-earlier.patch [bz#1624009]
  - Resolves: bz#1624009
    (allow backing of pflash via -blockdev)
  - Resolves: bz#1673397
    ([RHEL.7] qemu-kvm core dumped after hotplug the deleted disk with iothread parameter)
  - Resolves: bz#1673402
    (Qemu core dump when start guest with two disks using same drive)
  - Resolves: bz#1692018
    (qemu-img: Protocol error: simple reply when structured reply chunk was expected)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.12.0-30.el7
changelog:
  - kvm-slirp-fix-big-little-endian-conversion-in-ident-prot.patch [bz#1669071]
  - kvm-slirp-ensure-there-is-enough-space-in-mbuf-to-null-t.patch [bz#1669071]
  - kvm-slirp-don-t-manipulate-so_rcv-in-tcp_emu.patch [bz#1669071]
  - Resolves: bz#1669071
    (CVE-2019-6778 qemu-kvm-rhev: QEMU: slirp: heap buffer overflow in tcp_emu() [rhel-7.7])


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.12.0-31.el7
changelog:
  - kvm-seccomp-set-the-seccomp-filter-to-all-threads.patch [bz#1618504]
  - Resolves: bz#1618504
    (qemu-kvm-rhev: Qemu: seccomp: blacklist is not applied to all threads [rhel-7])


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.12.0-32.el7
changelog:
  - kvm-rtl8139-fix-possible-out-of-bound-access.patch [bz#1636727 bz#1636780]
  - kvm-net-ignore-packet-size-greater-than-INT_MAX.patch [bz#1636779 bz#1636780]
  - kvm-net-drop-too-large-packet-early.patch [bz#1636779 bz#1636780]
  - kvm-Introduce-new-no_guest_reset-parameter-for-usb-host-.patch [bz#1710861]
  - kvm-usb-call-reset-handler-before-updating-state.patch [bz#1710861]
  - kvm-usb-host-skip-reset-for-untouched-devices.patch [bz#1710861]
  - kvm-usb-host-avoid-libusb_set_configuration-calls.patch [bz#1710861]
  - kvm-blockdev-fix-missed-target-unref-for-drive-backup.patch [bz#1703916]
  - kvm-vl-Fix-drive-blockdev-persistent-reservation-managem.patch [bz#1714160]
  - Resolves: bz#1636727
    (CVE-2018-17958 qemu-kvm: Qemu: rtl8139: integer overflow leads to buffer overflow [rhel-7])
  - Resolves: bz#1636779
    (CVE-2018-17963 qemu-kvm: Qemu: net: ignore packets with large size [rhel-7])
  - Resolves: bz#1636780
    (CVE-2018-17963 qemu-kvm-rhev: Qemu: net: ignore packets with large size [rhel-7])
  - Resolves: bz#1703916
    (Qemu core dump when quit vm after forbidden to do backup with a read-only bitmap)
  - Resolves: bz#1710861
    (Detached device when trying to upgrade USB device firmware when in doing USB Passthrough via QEMU)
  - Resolves: bz#1714160
    (Guest with 'reservations' for a disk start failed)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.12.0-33.el7
changelog:
  - kvm-vhost_net-don-t-set-backend-for-the-uninitialized-vi.patch [bz#1608226]
  - Resolves: bz#1608226
    ([virtual-network][mq] prompt warning "qemu-kvm: unable to start vhost net: 14: falling back on userspace virtio" when boot with win8+ guests with multi-queue)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.12.0-33.el7_7.1
changelog:
  - kvm-Fix-heap-overflow-in-ip_reass-on-big-packet-input.patch [bz#1735652]
  - Resolves: bz#1735652
    (CVE-2019-14378 qemu-kvm-ma: QEMU: slirp: heap buffer overflow during packet reassembly [rhel-7.7.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.12.0-35.el7
changelog:
  - kvm-i386-Add-new-MSR-indices-for-IA32_PRED_CMD-and-IA32_.patch [bz#1709972]
  - kvm-i386-Add-CPUID-bit-and-feature-words-for-IA32_ARCH_C.patch [bz#1709972]
  - kvm-Add-support-to-KVM_GET_MSR_FEATURE_INDEX_LIST-an.patch [bz#1709972]
  - kvm-x86-Data-structure-changes-to-support-MSR-based-feat.patch [bz#1709972]
  - kvm-x86-define-a-new-MSR-based-feature-word-FEATURE_WORD.patch [bz#1709972]
  - kvm-Use-KVM_GET_MSR_INDEX_LIST-for-MSR_IA32_ARCH_CAP.patch [bz#1709972]
  - kvm-i386-kvm-Disable-arch_capabilities-if-MSR-can-t-be-s.patch [bz#1709972]
  - kvm-i386-Make-arch_capabilities-migratable.patch [bz#1709972]
  - kvm-block-Remove-error-messages-in-bdrv_make_zero.patch [bz#1648622]
  - kvm-block-Add-BDRV_REQ_NO_FALLBACK.patch [bz#1648622]
  - kvm-block-Advertise-BDRV_REQ_NO_FALLBACK-in-filter-drive.patch [bz#1648622]
  - kvm-file-posix-Fix-write_zeroes-with-unmap-on-block-devi.patch [bz#1648622]
  - kvm-file-posix-Factor-out-raw_thread_pool_submit.patch [bz#1648622]
  - kvm-file-posix-Avoid-aio_worker-for-QEMU_AIO_WRITE_ZEROE.patch [bz#1648622]
  - kvm-file-posix-Support-BDRV_REQ_NO_FALLBACK-for-zero-wri.patch [bz#1648622]
  - kvm-qemu-img-Use-BDRV_REQ_NO_FALLBACK-for-pre-zeroing.patch [bz#1648622]
  - kvm-qemu-io-Add-write-n-for-BDRV_REQ_NO_FALLBACK.patch [bz#1648622]
  - kvm-qxl-check-release-info-object.patch [bz#1712704]
  - kvm-ccid-Fix-dwProtocols-advertisement-of-T-0.patch [bz#1721522]
  - kvm-vl-add-qemu_add_vm_change_state_handler_prio.patch [bz#1673546]
  - kvm-qdev-add-qdev_add_vm_change_state_handler.patch [bz#1673546]
  - kvm-virtio-scsi-restart-DMA-after-iothread.patch [bz#1673546]
  - kvm-block-Drain-source-node-in-bdrv_replace_node.patch [bz#1711643]
  - Resolves: bz#1648622
    ([v2v] Migration performance regression)
  - Resolves: bz#1673546
    (QEMU gets stuck on resume/cont call from libvirt)
  - Resolves: bz#1709972
    ([Intel 7.8 Bug] [KVM][CLX] CPUID_7_0_EDX_ARCH_CAPABILITIES is not enabled in VM qemu-kvm-rhev)
  - Resolves: bz#1711643
    (qemu aborts in blockCommit: qemu-kvm: block.c:3486: bdrv_replace_node: Assertion `!({ _Static_assert(!(sizeof(*&from->in_flight) > 8), "not expecting: " "sizeof(*&from->in_flight) > ATOMIC_REG_SIZE"); __atomic_load_n(&from->in_flight, 0); })' failed.)
  - Resolves: bz#1712704
    (CVE-2019-12155 qemu-kvm-rhev: QEMU: qxl: null pointer dereference while releasing spice resources [rhel-7])
  - Resolves: bz#1721522
    (ccid: Fix incorrect dwProtocol advertisement of T=0)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.12.0-36.el7
changelog:
  - kvm-Using-ip_deq-after-m_free-might-read-pointers-from-a.patch [bz#1749723]
  - kvm-block-create-Do-not-abort-if-a-block-driver-is-not-a.patch [bz#1746224]
  - kvm-migration-Do-not-re-read-the-clock-on-pre_save-in-ca.patch [bz#1743508]
  - kvm-mirror-Confirm-we-re-quiesced-only-if-the-job-is-pau.patch [bz#1665256]
  - Resolves: bz#1665256
    (Live storage migration fails with: TimeoutError: Timed out during operation: cannot acquire state change lock (held by monitor=remoteDispatchConnectGetAllDomainStats) and the VM becomes 'Not Responding')
  - Resolves: bz#1743508
    (ISST-LTE:RHV4.3 on RHEL7.6 kvm host:Power8:Tuleta-L:lotg7: call traces dumped on guest while performing guest migration (qemu-kvm-rhev))
  - Resolves: bz#1746224
    (qemu coredump: qemu-kvm: block/create.c:68: qmp_blockdev_create: Assertion `drv' failed)
  - Resolves: bz#1749723
    (CVE-2019-15890 qemu-kvm-ma: QEMU: Slirp: use-after-free during packet reassembly [rhel-7])


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.12.0-37.el7
changelog:
  - kvm-i386-halt-poll-control-MSR-support.patch [bz#1734502]
  - kvm-target-i386-add-MDS-NO-feature.patch [bz#1716726]
  - kvm-file-posix-Handle-undetectable-alignment.patch [bz#1743365]
  - kvm-qemu-img-Enable-BDRV_REQ_MAY_UNMAP-in-convert.patch [bz#1648622]
  - Resolves: bz#1648622
    ([v2v] Migration performance regression)
  - Resolves: bz#1716726
    ([Intel 7.8 FEAT] MDS_NO exposure to guest - qemu-kvm-rhev)
  - Resolves: bz#1734502
    (qemu-kvm: backport cpuidle-haltpoll support)
  - Resolves: bz#1743365
    (qemu, qemu-img fail to detect alignment with XFS and Gluster/XFS on 4k block device)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.12.0-38.el7
changelog:
  - kvm-usb-drop-unnecessary-usb_device_post_load-checks.patch [bz#1724048]
  - kvm-i386-Add-new-model-of-Cascadelake-Server.patch [bz#1638472]
  - kvm-i386-Disable-OSPKE-on-Cascadelake-Server.patch [bz#1638472]
  - kvm-i386-remove-the-INTEL_PT-CPUID-bit-from-Cascadelake-.patch [bz#1638472]
  - Resolves: bz#1638472
    ([Intel 7.8 Feat] qemu-kvm-rhev Introduce Cascade Lake (CLX) cpu model)
  - Resolves: bz#1724048
    (Fail to migrate a rhel6.10-mt7.6 guest with dimm device)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.12.0-39.el7
changelog:
  - kvm-virtio-scsi-fixed-virtio_scsi_ctx_check-failed-when-.patch [bz#1764120]
  - Resolves: bz#1764120
    ([Data plane]virtio_scsi_ctx_check: Assertion `blk_get_aio_context(d->conf.blk) == s->ctx' failed when unplug a device that running block stream on it)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.12.0-40.el7
changelog:
  - kvm-vhost-fix-vhost_log-size-overflow-during-migration.patch [bz#1775251]
  - Resolves: bz#1775251
    (qemu-kvm crashes when Windows VM is migrated with multiqueue)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.12.0-41.el7
changelog:
  - kvm-mc146818rtc-fix-timer-interrupt-reinjection.patch [bz#1639098]
  - kvm-Revert-mc146818rtc-fix-timer-interrupt-reinjection.patch [bz#1639098]
  - kvm-mc146818rtc-fix-timer-interrupt-reinjection-again.patch [bz#1639098]
  - Resolves: bz#1639098
    (After host update, older windows clients have large time drift)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.12.0-42.el7
changelog:
  - kvm-target-i386-Export-TAA_NO-bit-to-guests.patch [bz#1779530]
  - kvm-target-i386-add-support-for-MSR_IA32_TSX_CTRL.patch [bz#1779530]
  - Resolves: bz#1779530
    (CVE-2019-11135 qemu-kvm-rhev: hw: TSX Transaction Asynchronous Abort (TAA) [rhel-7.8])


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.12.0-43.el7
changelog:
  - kvm-tcp_emu-Fix-oob-access.patch [bz#1791563 bz#1791570]
  - kvm-slirp-use-correct-size-while-emulating-IRC-commands.patch [bz#1791570]
  - kvm-slirp-use-correct-size-while-emulating-commands.patch [bz#1791570]
  - Resolves: bz#1791570
    (CVE-2020-7039 qemu-kvm-ma: QEMU: slirp: OOB buffer access while emulating tcp protocols in tcp_emu() [rhel-7.8])


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.12.0-44.el7
changelog:
  - kvm-iscsi-Avoid-potential-for-get_status-overflow.patch [bz#1794505]
  - kvm-iscsi-Cap-block-count-from-GET-LBA-STATUS-CVE-2020-1.patch [bz#1794505]
  - Resolves: bz#1794505
    (CVE-2020-1711 qemu-kvm-ma: QEMU: block: iscsi: OOB heap access via an unexpected response of iSCSI Server [rhel-7.8])


author: Miroslav Rezanina <mrezanin@redhat.com> - ma-2.12.0-44.el7_8.1
changelog:
  - kvm-util-add-slirp_fmt-helpers.patch [bz#1798974]
  - kvm-tcp_emu-fix-unsafe-snprintf-usages.patch [bz#1798974]
  - Resolves: bz#1798974
    (CVE-2020-8608 qemu-kvm-ma: QEMU: Slirp: potential OOB access due to unsafe snprintf() usages [rhel-7.8.z])


author: Jon Maloy <jmaloy@redhat.com> - 2.12.0-45.el7
changelog:
  - kvm-gluster-Handle-changed-glfs_ftruncate-signature.patch [bz#1802216]
  - kvm-gluster-the-glfs_io_cbk-callback-function-pointer-ad.patch [bz#1802216]
  - kvm-target-i386-kvm-initialize-feature-MSRs-very-early.patch [bz#1791653]
  - kvm-target-i386-add-a-ucode-rev-property.patch [bz#1791653]
  - kvm-target-i386-kvm-initialize-microcode-revision-from-K.patch [bz#1791653]
  - kvm-target-i386-fix-TCG-UCODE_REV-access.patch [bz#1791653]
  - kvm-target-i386-check-for-availability-of-MSR_IA32_UCODE.patch [bz#1791653]
  - kvm-target-i386-enable-monitor-and-ucode-revision-with-c.patch [bz#1791653]
  - kvm-clean-up-callback-when-del-virtqueue.patch [bz#1721403]
  - kvm-virtio-add-ability-to-delete-vq-through-a-pointer.patch [bz#1721403]
  - kvm-virtio-reset-region-cache-when-on-queue-deletion.patch [bz#1721403]
  - kvm-virtio-net-delete-also-control-queue-when-TX-RX-dele.patch [bz#1721403]
  - Resolves: bz#1721403
    (After hot unplug virtio-net and vfio nic, hot plug vfio-pci device fails in Win2019 guest)
  - Resolves: bz#1791653
    (Backport: Passthrough host CPU microcode version to KVM guest if using CPU passthrough to RHEL 7.7/7.8)
  - Resolves: bz#1802216
    (Add support for newer glusterfs)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.12.0-46.el7
changelog:
  - kvm-seccomp-set-the-seccomp-filter-to-all-threads.patch [bz#1622976]
  - Resolves: bz#1622976
    (CVE-2018-15746 qemu-kvm-ma: Qemu: seccomp: blacklist is not applied to all threads [rhel-7])


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.12.0-47.el7
changelog:
  - kvm-file-posix-Use-max-transfer-length-segment-count-onl.patch [bz#1819253]
  - Resolves: bz#1819253
    (Fix overzealous I/O request splitting performance regression)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.12.0-48.el7
changelog:
  - kvm-vnc-add-magic-cookie-to-VncState.patch [bz#1810409]
  - kvm-vnc-fix-memory-leak-when-vnc-disconnect.patch [bz#1810409]
  - Resolves: bz#1810409
    (CVE-2019-20382 qemu-kvm-rhev: QEMU: vnc: memory leakage upon disconnect [rhel-7])


author: Jon Maloy <jmaloy@redhat.com> - ma-2.12.0-48.el7_9.1
changelog:
  - kvm-usb-fix-setup_len-init-CVE-2020-14364.patch [bz#1869706]
  - Resolves: bz#1869706
    (CVE-2020-14364 qemu-kvm-ma: QEMU: usb: out-of-bounds r/w access issue while processing usb packets [rhel-7.9.z])


author: Jon Maloy <jmaloy@redhat.com> - ma-2.12.0-48.el7_9.2
changelog:
  - kvm-hw-net-net_tx_pkt-fix-assertion-failure-in-net_tx_pk.patch [bz#1860961]
  - kvm-Fix-use-afte-free-in-ip_reass-CVE-2020-1983.patch [bz#1837568]
  - Resolves: bz#1860961
    (CVE-2020-16092 qemu-kvm-ma: QEMU: reachable assertion failure in net_tx_pkt_add_raw_fragment() in hw/net/net_tx_pkt.c [rhel-7.9.z])
  - Resolves: bz#1837568
    (CVE-2020-1983 qemu-kvm-ma: QEMU: slirp: use-after-free in ip_reass() function in ip_input.c [rhel-7.9.z]


author: Rex Dieter <rdieter@fedoraproject.org> - 0.0.4-2
changelog:
  - update summary/description/Source_url
  - %files: track soname
  - cleaner cmake-fu
  - upstream noexecstack patch


author: Kevin Kofler <Kevin@tigcc.ticalc.org> - 0.0.4-3
changelog:
  - require the main package with exact version-release in -examples
  - remove explicit Requires: qt4-devel pkgconfig from -devel, now autodetected


author: Rex Dieter <rdieter@fedoraproject.org> - 0.7.1-8
changelog:
  - skip stripping some compiler flags (undocumented)
  - %files: track files closer (lib soname in particular)
  - -devel: avoid dep on cmake 
  - %check: +make test, pkgconfig check


author: Doug Ledford <dledford@redhat.com> - 0.4.6-6
changelog:
  - Fix the fact that qperf was using the wrong PF_RDS define now that RDS
    is integrated upstream and its assigned number is no longer temporary


author: Matthieu Saulnier <fantom@fedoraproject.org> - 3.2.0-1
changelog:
  - update to 3.2.0
  - remove BuildRoot tag in spec file
  - remove "rm -rf $RPM_BUILD_ROOT" at the beginning of %install section
  - remove %clean section
  - remove %defattr lines
  - add a joker for libqrencode.so.* files


author: Peter Gordon <peter@thecodergeek.com> - 3.2.0-2
changelog:
  - Add patch to fix improper LIBPTHREAD macro in the pkgconfig file:
    + fix-LIBPTHREAD-macro.patch
  - Resolves: #795582 (qrencode-devel: Malformed pkgconfig file causes build to
    fail ("@LIBPTHREAD@: No such file or directory"))


author: Matthieu Saulnier <fantom@fedoraproject.org> - 3.3.1-1
changelog:
  - update to 3.3.1
  - remove "Group" tag in spec file
  - fix manfile suffix
  - remove patch to fix improper LIBPTHREAD macro in the pkgconfig file:
    - upstream issue


author: Jan Grulich <jgrulich@redhat.com> - 1:4.8.5-14
changelog:
  * Mon May 02 2016 Jan Grulich <jgrulich@redhat.com> - 1:4.8.5-13
  - Prefer adwaita-qt theme over gtk
    Resolves: bz#1332094


author: Jan Grulich <jgrulich@redhat.com> - 1:4.8.7-1
changelog:
  - Update to 4.8.7 (+ sync with Fedora)
    Resolves: bz#1484361

  - Don't close Qt apps in Gnome on shutdown dialog
    Resolves: bz#1378865


author: Jan Grulich <jgrulich@redhat.com> - 1:4.8.7-4
changelog:
  - Bump build version for RPM to not consider z-stream build as newer
    Revert fix for font cache check in QFontEngineFT::recalcAdvances()
    Resolves: bz#1684167


author: Jan Grulich <jgrulich@redhat.com> - 1:4.8.7-8
changelog:
  - Fix QImage allocation failure in qgifhandler
    Resolves: bz#1667863

  - Fix QTgaFile CPU exhaustion
    Resolves: bz#1667879

  - Fix QBmpHandler segmentation fault on malformed BMP file
    Resolves: bz#1667862


author: Rex Dieter <rdieter@fedoraproject.org> - 5.6.0-8
changelog:
  - make 10-qt5-check-opengl2.sh xinit script more robust
  - enable journald support for el7+ (#1315239)


author: Jan Grulich <jgrulich@redhat.com> - 5.9.7-3
changelog:
  - Fix multilib issue with qtcore-config.h header file
    Resolves: bz#1534528

  - Move libQt5EglFSDeviceIntegration lib into correct subpackage
    Resolves: bz#1792680


author: Jan Grulich <jgrulich@redhat.com> - 5.9.7-4
changelog:
  - Fix: Files placed by attacker can influence the working directory and lead to malicious code execution
    Resolves: bz#1814740
    Resolves: bz#1814685


author: Rex Dieter <rdieter@fedoraproject.org> - 5.6.0-4
changelog:
  - backport upstream fixes
  - drop -fno-delete-null-pointer-checks hack (included in qt5-rpm-macros as needed now)


author: Jan Grulich <jgrulich@redhat.com> - 5.9.7-2
changelog:
  - libwebp security fixes:
    Resolves: bz#1961742
    Resolves: bz#1961743
    Resolves: bz#1961744
    Resolves: bz#1961745


author: Michal Sekletar <msekleta@redhat.com> - 0.99.22.1-6
changelog:
  - obsolete quagga-sysvinit subpackage
  - use macro to specify location where to install tmpfiles configuration file
  - fix rpm scripts handling documentation in info format


author: Michal Sekletar <msekleta@redhat.com> - 0.99.22.1-7
changelog:
  - quagga is service which might implement networking, thus it should not have
    WantedBy=network.target in its systemd configuration
  - resolves: #976883


author: Michal Sekletar <msekleta@redhat.com> - 0.99.22.3-1
changelog:
  - update to 0.99.22.3
  - disable ospfapi and ospfclient
  - fix bogus dates in changelog
  - resolves : #984532


author: Michal Sekletar <msekleta@redhat.com> - 0.99.22.4-4
changelog:
  - fix link to upstream tarball (#1059219)
  - reference pidfiles of quagga daemons in service files (#842309)


author: Ondřej Lysoněk <olysonek@redhat.com> - 0.99.22.4-5
changelog:
  - Fixed CVE-2018-5379 - Double free vulnerability in bgpd when processing
    certain forms of UPDATE message allowing to crash or potentially execute
    arbitrary code
  - Resolves: rhbz#1546015


author: Petr Pisar <ppisar@redhat.com> - 1:4.01-4
changelog:
  - Do not fiddle with quota files on XFS and GFS (bug #846296)
  - Make sure option -d at quotacheck provides at least as much information as
    option -v (SF#3602777)


author: Petr Pisar <ppisar@redhat.com> - 1:4.01-6
changelog:
  - Add LGPLv2+ and GPLv2 to license declaration
  - Correct changelog dates
  - Package additional LDAP scripts as a documentation
  - Package XFS-specific tools


author: Petr Pisar <ppisar@redhat.com> - 1:4.01-9
changelog:
  - Move /sbin/* files under /usr (bug #983179)
  - Harden executables due to rpc.rquotad and quota_nld daemons (bug #983179)
  - Document quotagrpadmins(5), quotatab(5), warnquota.conf(5), rcp.rquota(8)
    (bug #983179)


author: Petr Pisar <ppisar@redhat.com> - 1:4.01-12
changelog:
  - Do not warn if rquotad RPC service is not registered (bug #1155584)
  - Query kernel for next quota on XFS or file system with hidden quota files
    (bug #1305968)
  - Add rpc-rquotad.service file which was known as nfs-rquotad.service
    in nfs-utils (bug #1207239)


author: Petr Pisar <ppisar@redhat.com> - 1:4.01-14
changelog:
  - Add nfs-rquotad.service alias for backward compatibility (bug #1207239)
  - Start rpc-rquotad.service when starting nfs-server.service (bug #1207239)


author: Petr Pisar <ppisar@redhat.com> - 1:4.01-18
changelog:
  - Distinguish between none quota limits and no allocated resources in quota(1)
    tool (bug #1601109)


author: Prarit Bhargava <prarit@redhat.com>
changelog:
  - Initial import from https://github.com/andikleen/mce-inject.git
  - Initial import from git://git.kernel.org/pub/scm/linux/kernel/git/gong.chen/aer-inject.git


author: Prarit Bhargava <prarit@redhat.com>
changelog:
  - Initial import from git://git.kernel.org/pub/scm/utils/cpu/mce/mce-test.git
  - updated mce-inject to commit 4cbe4632


author: Aristeu Rozanski <aris@redhat.com> 0.4.1-8.el7
changelog:
  - Revert patch in 0.4.1-7.el7, replaced by a better patch
  - Fix sizeof() usage on pointer [1035742]
  - Added macro to build the package with stack protector [1092558]
  - Handle failures of snprintf() [1035741]
  - Fix range checking on signed char variables [1035746]
  - Added aarch64 as architecture [1070973]
  - Start recording by default [1117366] [1117367]


author: Honza Horak <hhorak@redhat.com> - 5.8.1-2
changelog:
  - Provides: bundled(gnulib) added, as per #821786
  - minor spec file clean up
  - install-info run in postin/postun


author: Jarod Wilson <jarod@redhat.com> - 12-3
changelog:
  - Take libi40iw out of tech-preview state (rhbz 1428930)
  - Add ibv_*_pingpong man pages (rhbz 1416541)


author: Jarod Wilson <jarod@redhat.com> - 12-4
changelog:
  - Clean up devel files list
  - Fix up a few dependencies rpmdiff complained about (rhbz 1404035)
  - Add Requires: pciutils for dracut to behave in minimalist cases (rhbz 1429046)
  - Adjust Conflicts: on infiniband-diags to match RHEL packaging (rhbz 1428785)


author: Jarod Wilson <jarod@redhat.com> - 13-1
changelog:
  - Update to rdma-core v13 release (rhbz 1404035)
  - Mellanox mlx5 Direct Verbs support (rhbz 1426430)
  - Get build working on s390x, less mlx5 (rhbz 1434029)


author: Jarod Wilson <jarod@redhat.com> 13-6
changelog:
  - Clean up htonll/ntohll handling for opa-ff/infiniband-diags compile
  - Add necessary Provides/Obsoletes for old -static packages
  - Remove ibverbs providers that we aren't currently able to support
  - Resolves: rhbz#1453096, rhbz#1451607


author: Jarod Wilson <jarod@redhat.com> 15-2
changelog:
  - Fix ibacm segfault and improper multicast handling
  - Resolves: rhbz#1502745
  - Resolves: rhbz#1502759


author: Honggang Li <honli@redhat.com> 15-3
changelog:
  - srp_daemon: Don't create async_ev_thread if only run once
  - srp_daemon: Remove unsupported systemd configurations
  - srp_daemon: Start srp_daemon service after network target
  - Resolves: bz1525193
  - Resolves: bz1528671


author: Jarod Wilson <jarod@redhat.com> 15-4
changelog:
  - Add support for extended join multicast API in librdmacm
  - Add support for striding RQ on mlx5
  - Resolves: rhbz#1515487, rhbz#1516571


author: Jarod Wilson <jarod@redhat.com> 15-5
changelog:
  - libmlx4: report RSS caps for improved DPDK support
  - Fix double mutex unlock in iwpmd
  - Resolves: rhbz#1527350
  - Resolves: rhbz#1542362


author: Jarod Wilson <jarod@redhat.com> 15-7
changelog:
  - i40iw: revoke systemd udev rules auto-load on i40e hardware, due to
    causing problems with suspend and resume, and fall back to load via
    systemd rdma initscript.
  - Resolves: rhbz#1568325


author: Jarod Wilson <jarod@redhat.com> 15-7
changelog:
  - i40iw: revoke systemd udev rules auto-load on i40e hardware, due to
    causing problems with suspend and resume, and fall back to load via
    systemd rdma initscript.
  - Resolves: rhbz#1561566


author: Jarod Wilson <jarod@redhat.com> 17.1-1
changelog:
  - Rebase to upstream rdma-core v17.1 stable release
  - No more libibcm or ib sysv initscripts
  - Resolves: rhbz#1515647
  - Resolves: rhbz#1517208
  - Resolves: rhbz#1523201
  - Resolves: rhbz#1541751


author: Jarod Wilson <jarod@redhat.com> 17.1-3
changelog:
  - Grab latest stable-v17 fixes from upstream
  - Fix Provides/Obsoletes on removed libibcm
  - Fix Provides/Obsoletes on removed libehca
  - Straighten out SW parsing feature support for DPDK
  - Fix mlx5 rate-limiting support
  - Resolves: rhbz#1588096
  - Resovles: rhbz#1534856
  - Resolves: rhbz#1589525


author: Jarod Wilson <jarod@redhat.com> 17.2-2
changelog:
  - Restore SysV Initscripts ib ifup and ifdown helpers
  - Adjust MTU limit for IPoIB in datagram mode via ifup-ib
  - Resolves: rhbz#1593426
  - Resolves: rhbz#1593334


author: Jarod Wilson <jarod@redhat.com> 22-1
changelog:
  - Rebase to upstream rdma-core v22
  - Resolves: rhbz#1641921
  - Add mlx5 IB Device Memory support (MEMIC)
  - Resolves: rhbz#1644697
  - Add mlx5 Tunnel protocol RX decap/encap offload
  - Resolves: rhbz#1644709
  - Add mlx5 Tunnel protocol TX decap/encap offload
  - Resolves: rhbz#1644778
  - Add support for mlx5 infiniband flow counters
  - Resolves: rhbz#1644714
  - Add mlx5 DEVX interface
  - Resolves: rhbz#1644722
  - Add libbnxt_re support for SRQ
  - Resolves: rhbz#1570393


author: Jarod Wilson <jarod@redhat.com> 22.1-1
changelog:
  - Update to upstream v22.1 release with stable-v22 branch fixes
  - Add support for Broadcom 57500 RoCE adapter
  - Resolves: rhbz#1678274


author: Jarod Wilson <jarod@redhat.com> 22.4-1
changelog:
  - Update to v22.4 stable release
  - Support mlx5 scatter to CQE over DCT QP
  - Fix ibacm segfault on non-IB hardware
  - Resolves: rhbz#1715489
  - Resolves: rhbz#1712296


author: Stef Walter <stefw@redhat.com> - 0.14.3-1
changelog:
  - Update to upstream 0.14.3 point release
  - Populate LoginFormats correctly [#967011]
  - Documentation clarifications [#985773] [#967565]
  - Set sssd.conf default_shell per domain [#967569]
  - Notify in terminal output when installing packages [#984960]
  - If joined via adcli, delete computer with adcli too [#967008]
  - If input is not a tty, then read from stdin without getpass()
  - Configure pam_winbind.conf appropriately [#985819]
  - Refer to FreeIPA as IPA [#967019]
  - Support use of kerberos ccache to join when winbind [#985817]


author: Stef Walter <stefw@redhot.com> - 0.14.4-1
changelog:
  - Update to upstream 0.14.4 point release
  - Fix up the [sssd] section in sssd.conf if it's screwed up [#987491]
  - Add an --unattended argument to realm command line client [#976593]
  - Clearer 'realm permit' manual page example [#985800]


author: Stef Walter <stefw@redhat.com> - 0.14.5-1
changelog:
  - Update to upstream 0.14.5 point release
  - Fix regression conflicting --unattended and -U as in --user args [#996223]
  - Pass discovered server address to adcli tool [#996995]


author: Stef Walter <stefw@redhat.com> - 0.14.6-1
changelog:
  - Update to upstream 0.14.6 point release
  - Set 'kerberos method = system keytab' in smb.conf properly [#997580]
  - Limit Netbios name to 15 chars when joining AD domain [#1001667]


author: Stef Walter <stefw@redhat.com> - 0.14.6-5
changelog:
  - Don't crash when full_name_format is not in sssd.conf [#1051033]
    This is a regression from a prior update.


author: Sumit Bose <sbose@redhat.com> - 0.16.1-6
changelog:
  - Resolves: rhbz#1258745
  - Resolves: rhbz#1258488
  - Resolves: rhbz#1267563
  - Resolves: rhbz#1293390
  - Resolves: rhbz#1273924
  - Resolves: rhbz#1274368
  - Resolves: rhbz#1291924


author: Sumit Bose <sbose@redhat.com> - 0.16.1-10
changelog:
  Use current Samba options and read NetBIOS name from keytab
  - Resolves: rhbz#1484072
  - Resolves: rhbz#1370457


author: Sumit Bose <sbose@redhat.com> - 0.16.1-12
changelog:
  Fixes for RHEL-7.9
  - Resolves: rhbz#1625001
  - Resolves: rhbz#1625005
  - Resolves: rhbz#1638396
  - Resolves: rhbz#1714223
  - Resolves: rhbz#1832134


author: Stef Walter <stefw@redhat.com> - 0.16.0-1
changelog:
  - Updated to upstream 0.16.0
  - Resolves: rhbz#1174911
  - Resolves: rhbz#1142191
  - Resolves: rhbz#1142148


author: Petr Hracek <phracek@redhat.com> - 1.17.2-2
changelog:
  - rear does not require syslinux
  - changing to arch package so that syslinux is installed
  - Resolves: #1283927


author: Pavel Cahyna <pcahyna@redhat.com> - 2.00-4
changelog:
  - cd to the correct directory before md5sum to fix BACKUP_INTEGRITY_CHECK.
    Upstream PR#1685, bz1532676


author: Pavel Cahyna <pcahyna@redhat.com> - 2.00-5
changelog:
  - Ensure that NetBackup is started automatically upon recovery (PR#1544)
    Also do not kill daemons spawned by sysinit.service at the service's end
    (PR#1610, applies to NetBackup and also to dhclient)
    Resolves #1506231


author: Pavel Cahyna <pcahyna@redhat.com> - 2.00-6
changelog:
  - Ensure that NetBackup is started automatically upon recovery (PR#1544)
    Also do not kill daemons spawned by sysinit.service at the service's end
    (PR#1610, applies to NetBackup and also to dhclient)
    Resolves #1506231
  - Print a warning if grub2-mkimage is about to fail and suggest what to do.
    bz#1492177
  - Update the patch for #1388653 to the one actually merged upstream (PR1418)


author: Pavel Cahyna <pcahyna@redhat.com> - 2.00-7
changelog:
  - Backport upstream PR1383: Allow backup to be stored in ISO for ppc64/ppc64le
    Includes also commit 30099a98fdc1eab6373bc3682929bc4b9c09b54b.
    Resolves: #1596182


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-1
changelog:
  - Rebase to version 2.4, drop patches integrated upstream
    Resolves #1534646 #1484051 #1498828 #1571266 #1496518


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-3
changelog:
  - Backport fixes for upstream bugs 1974 and 1975
  - Apply upstream PR1954 (record permanent MAC address for bond members)
  - Apply upstream PR2004 (support for custom network interface naming)
  - Backport fix for upstream bug 1926 (support for LACP bonding and teaming)


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-7
changelog:
  - Backport fix for upstream bug 1913 (backup succeeds in case of tar error)
    Resolves: rhbz1631183
  - Apply upstream patch PR1885
    Partition information recorded is unexpected when disk has 4K block size
    Resolves: rhbz1610638
  - Apply upstream patch PR1887
    LPAR/PPC64 bootlist is incorrectly set when having multiple 'prep' partitions
    Resolves: rhbz1610647
  - Apply upstream patch PR1993
    Automatically exclude $BUILD_DIR from the backup
    Resolves: rhbz1655956
  - Require xorriso instead of genisoimage, it is now the preferred method
    and supports files over 4GB in size.
    Resolves: rhbz1462189


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-8
changelog:
  - Backport fix for upstream issue 2187 (disklayout.conf file contains
    duplicate lines, breaking recovery in migration mode or when
    thin pools are used). PR2194, 2196.
    Resolves: rhbz1732328


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-9
changelog:
  - Apply upstream PR2173 - Cannot restore using Bacula method
    due to "bconsole" not showing its prompt
    Resolves: rhbz1726982


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-10
changelog:
  - Apply upstream PR2122: add additional NBU library path to fix support for
    NetBackup 8.
    Resolves: rhbz1700807


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-11
changelog:
  - Apply upstream PR2122: add additional NBU library path to fix support for
    NetBackup 8.
    Resolves: rhbz1700807
  - Apply upstream PR212: Be safe against empty docker_root_dir (issue 1989)
    Resolves: rhbz1711123, where ReaR can not create a backup in rescue mode,
    because it thinks that the Docker daemon is running and hits the problem
    with empty docker_root_dir.
  - Apply upstream PR2223 and commit 36cf20e to avoid an empty string in the
    list of users to clone, which can lead to bash overflow with lots of users
    and groups per user and to wrong passwd/group files in the rescue system.
    Resolves: rhbz1692575
  - Backport of Upstream fix for issue 2035: /run is not mounted in the rescue
    chroot, which causes LVM to hang, especially if rebuilding initramfs.
    Resolves: rhbz1697815
  - Backport upstream PR 2218: avoid keeping build dir on errors
    by default when used noninteractively
    Resolves: rhbz1693608


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-15
changelog:
  - Backport PR2608:
    Fix setting boot path in case of UEFI partition (ESP) on MD RAID
    Resolves: rhbz1945869
  - Backport PR2625 & 2675
    Prevents accidental backup removal in case of errors
    Resolves: rhbz1843585
  - Fix rsync error and option handling
    Fixes metadata storage when rsync user is not root
    Resolves: rhbz1947064
  - Changes for NetBackup (NBU) support, upstream PR2544
    Resolves: rhbz2031833
  - On POWER add bootlist & ofpathname to the list of required programs
    conditionally (bootlist only if running under PowerVM, ofpathname
    always except on PowerNV) - upstream PR2665, add them to package
    dependencies
    Resolves: rhbz1983008
  - On POWER mount /sys in the chroot, otherwise ofpathname does not work
    and we risk ending up with not instlaling the bootloader properly
    Resolves: rhbz1983000


author: Zoltan Kota <z.kota[AT]gmx.net> 3.6-29
changelog:
  - Fix build on x86_64. Run autoreconf to update config files.
    autoconf >= 2.64 needs to patch the flex.m4 file.
    Fixing FTBFS bug #564601.


author: Ondrej Vasik <ovasik@redhat.com> - 4.1-14
changelog:
  - require spax instead of pax (more POSIX compatible) (#965658)
  - require another set of perl modules in -languages (#959129)
  - polish a bit the nsswitch.conf hack - include mdns4_minimal (#915147)


author: Ondrej Vasik <ovasik@redhat.com> - 4.1-16
changelog:
  - add provides/obsoletes for redhat-lsb-compat to better
    deal with possible upgrade RHEL-6->RHEL-7 (#976792)


author: Ondrej Vasik <ovasik@redhat.com> - 4.1-18
changelog:
  - Require sil-abyssinica-fonts in supplemental(#994341)
  - Fully specify requirements on subpackages(#971386)


author: David Shea <dshea@redhat.com> - 0.8.9-1
changelog:
  - backup old product id certificates before installation of new ones (jdornak)
    Resolves: rhbz#1148783


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-102
changelog:
  - LVM: update metadata on start/relocate
  - LVM: warn when cache mode is not writethrough

    Resolves: rhbz#1451933


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-105.6
changelog:
  - ocf_attribute_target: add fallback for Pacemaker versions without
    bundle support

    Resolves: rhbz#1524454


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-116
changelog:
  - azure-lb: new resource agent
  - CTDB: fix initial probe

    Resolves: rhbz#1516435
    Resolves: rhbz#1512580


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-117
changelog:
  - ocf_attribute_target: add fallback for Pacemaker versions without
    bundle support

    Resolves: rhbz#1520574


author: David Vossel <dvossel@redhat.com> - 3.9.5-20
changelog:
  - tomcat agent updates for pacemaker support
  - slapd agent updates for pacemaker support
  - Fixes missing etab file required for nfsserver

    Resolves: rhbz#1033016
    Resolves: rhbz#917681


author: David Vossel <dvossel@redhat.com> - 3.9.5-24
changelog:
  - Addition of the clvmd resource-agent
  - Support monitoring qemu based VirtualDomain resources without
    requiring libvirtd to be running.

    Resolves: rhbz#1064512
    Resolves: rhbz#1060367


author: David Vossel <dvossel@redhat.com> - 3.9.5-25
changelog:
  - Rename clvmd agent to clvm to avoid problems associated
    with having a resource-agent named the same exact name
    as the binary the agent manages.

    Resolves: rhbz#1064512


author: David Vossel <dvossel@redhat.com> - 3.9.5-26
changelog:
  - Handle monitor qemu based VirtualDomain resources without
    requiring libvirtd even if configuration file does not
    contain an 'emulator' value pointing to the emulator binary.

    Resolves: rhbz#1060367


author: David Vossel <dvossel@redhat.com> - 3.9.5-17
changelog:
  - Split send_ua utility out of IPv6addr.c source so it can be
    re-used in IPaddr2 without requiring cluster-glue.
  - Fixes issue with pgsql and SAPInstance not setting transient
    attributes correctly when local corosync node name is not
    equal to 'uname -n'
  - High: ocft: Fedora supported test cases

    Resolves: rhbz#917681


author: David Vossel <dvossel@redhat.com> - 3.9.5-18
changelog:
  - Remove support for (nginx, mysql-proxy, rsyslog). nginx and
    mysql-proxy are not a supported projects. Rsyslog is not an
    agent we will be supporting in an HA environment.

    Resolves: rhbz#917681


author: David Vossel <dvossel@redhat.com> - 3.9.5-34
changelog:
  - Fixes mysql agents behavior when monitoring resource instance
    when environment validation fails.

    Resolves: rhbz#1138871


author: David Vossel <dvossel@redhat.com> - 3.9.5-35
changelog:
  - Introduces docker resource-agent for managing docker containers.
    The docker agent is being released as tech preview.

    Resolves: rhbz#1135026


author: David Vossel <dvossel@redhat.com> - 3.9.5-36
changelog:
  - Fixes cleaning up stale docker containers during stop if
    container instance failed.

    Resolves: rhbz#1135026


author: David Vossel <dvossel@redhat.com> - 3.9.5-37
changelog:
  - Rename docker agent's 'container' arg to 'name' to avoid confusion
    with pacemaker's metadata 'container' argument.
  - Introduce monitor_cmd into docker agent.

    Resolves: rhbz#1135026


author: David Vossel <dvossel@redhat.com> - 3.9.5-40.6
changelog:
  - Improve galera resource-agent to not require use of read-only
    mode to retrieve last known write sequence number.

    Resolves: rhbz#1242339


author: David Vossel <dvossel@redhat.com> - 3.9.5-31
changelog:
  - Man page updates give pcs config examples
  - add iscsi agent support
  - add infiniband support to ethmonitor
  - add resource-agent support of exit reason string
  - add safe umount option to Filesystem resource agent

    Resolves: rhbz#1058102
    Resolves: rhbz#1118029
    Resolves: rhbz#1122285
    Resolves: rhbz#1128933
    Resolves: rhbz#1095944


author: David Vossel <dvossel@redhat.com> - 3.9.5-32
changelog:
  - Fixes iSCSILogicalUnit syntax error
  - Fixes mysql stop operation when db storage is unavailable

    Resolves: rhbz#1118029
    Resolves: rhbz#1138871


author: David Vossel <dvossel@redhat.com> - 3.9.5-33
changelog:
  - Merges latest upstream patches for galera agent
  - Merges latest upstream patchs for exit reason string

    Resolves: rhbz#1116166
    Resolves: rhbz#1128933


author: David Vossel <dvossel@redhat.com> - 3.9.5-46
changelog:
  - iface-vlan agent
  - Allow partial activation when physical volumes are missing.
  - Properly handle 'includes' during apache config parsing
  - Support for NovaCompute resource-agent

    Resolves: rhbz#1160365
    Resolves: rhbz#1214781
    Resolves: rhbz#1223615
    Resolves: rhbz#1214360


author: David Vossel <dvossel@redhat.com> - 3.9.5-47
changelog:
  - NovaCompute and NovaEvacuate updates
  - dhcpd chroot fix
  - redis 0byte error fix

    Resolves: rhbz#1214360
    Resolves: rhbz#1227293
    Resolves: rhbz#1231032


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-54.4
changelog:
  - NovaEvacuate: invoke off action
  - galera: add custom host/port support

    Resolves: rhbz#1304019
    Resolves: rhbz#1304711


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-54.6
changelog:
  - nfsserver: fix systemd status detection
  - Replace NovaCompute with nova-compute-wait which lets systemd
    manage the nova-compute process

    Resolves: rhbz#1304370
    Resolves: rhbz#1304811


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-54.10
changelog:
  - nfsserver: fix nfs-idmapd fails to start due to var-lib-nfs-rpc_pipefs.mount being active

    Resolves: rhbz#1332435


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-54.17
changelog:
  - nfsserver: fix monitor issues causing NFS to start on "debug-monitor"
    and "resource cleanup"

    Resolves: rhbz#1370385


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-73
changelog:
  - portblock: fix tickle_tcp bug
  - nfsserver: use rpcpipefs_dir variable
  - mysql: use replication_port variable
  - oracle: inform user that monprofile must start with C## for
    container databases

    Resolves: rhbz#1337109
    Resolves: rhbz#1337615
    Resolves: rhbz#1337124
    Resolves: rhbz#1328386


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-78
changelog:
  - nfsserver: fix monitor issues causing NFS to start on
    "debug-monitor" and "resource cleanup"
  - nfsserver: remove "up to 10 tries" on start to avoid issues with
    some services taking longer to start
  - nfsserver: stop rpc-gssd to allow unmounting of "rpcpipefs_dir"

    Resolves: rhbz#1356866
    Resolves: rhbz#1126073
    Resolves: rhbz#1346733


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-81
changelog:
  - oracle: fix issue with C## in monprofile and inform user that
    monuser must start with C## as well for container databases

    Resolves: rhbz#1328386


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-82
changelog:
  - portblock: create tickle_dir if it doesn't exist
  - tomcat: use systemd if available

    Resolves: rhbz#1303037
    Resolves: rhbz#1249430


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-1
changelog:
  - rebase to v4.1.1
  - IPaddr2: add "monitor_retries" parameter

    Resolves: rhbz#1596139
    Resolves: rhbz#1484920


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-3
changelog:
  - gcp-vpc-move-vip: new resource agent for Google Cloud
  - vdo-vol: new resource agent
  - LVM-activate: fix issue with dashes
  - dont use attribute_target for metadata

    Resolves: rhbz#1568588
    Resolves: rhbz#1538689
    Resolves: rhbz#1513957
    Resolves: rhbz#1602783


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-8
changelog:
  - lvmlockd: add cmirrord support
  - LVM-activate: warn about incorrect vg_access_mode

    Resolves: rhbz#1606316
    Resolves: rhbz#1619428


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-10
changelog:
  - aws-vpc-move-ip: avoid false positive monitor result on initial probe
  - timeout/interval add "s"-suffix

    Resolves: rhbz#1624741
    Resolves: rhbz#1523318


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-12.5
changelog:
  - rabbitmq-cluster: get cluster status from mnesia during monitor
  - rabbitmq-cluster: fail monitor when node is in minority partition

    Resolves: rhbz#1641944
    Resolves: rhbz#1641946


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-12.10
changelog:
  - ocf_log: do not log debug messages when HA_debug unset
  - tomcat: use systemd when catalina.sh is unavailable

    Resolves: rhbz#1655655
    Resolves: rhbz#1646770


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-12.13
changelog:
  - aws-vpc-move-ip: use "--query" to avoid a possible race condition
  - aws-vpc-move-ip: add multi route-table support and fix issue
    w/multiple NICs

    Resolves: rhbz#1711165
    Resolves: rhbz#1711925


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-18
changelog:
  - SAPInstance: add reload-action
  - LVM-activate: support LVs from same VG
  - Remove grpc from bundle

    Resolves: rhbz#1642069
    Resolves: rhbz#1667413
    Resolves: rhbz#1683629


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-20
changelog:
  - IPsrcaddr: add proto and table parameters
  - iSCSILogicalUnit: only create iqn when it doesnt exist

    Resolves: rhbz#1504055
    Resolves: rhbz#1598969


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-22
changelog:
  - IPsrcaddr: make proto optional to fix regression when used without
    NetworkManager

    Resolves: rhbz#1504055


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-23
changelog:
  - aws-vpc-move-ip: add multi route-table support and fix issue
    w/multiple NICs

    Resolves: rhbz#1697558


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-30.1
changelog:
  - dhcpd: keep SELinux context in chroot
  - CTDB: add support for v4.9+

    Resolves: rhbz#1731426
    Resolves: rhbz#1731427


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-30.5
changelog:
  - exportfs: allow multiple exports with same fsid
  - rabbitmq-cluster: delete nodename when stop fails
  - oralsnr: allow using same tns_admin directory for listeners


    Resolves: rhbz#1803800
    Resolves: rhbz#1803798
    Resolves: rhbz#1803024


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-32
changelog:
  - iSCSITarget/iSCSILogicalUnit: only create iqn/acls when it doesnt
    exist

    Resolves: rhbz#1598969


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-46.1
changelog:
  - exportfs: allow multiple exports with same fsid
  - rabbitmq-cluster: delete nodename when stop fails
  - oralsnr: allow using same tns_admin directory for listeners
  - Rebase resource-agents-sap-hana to SAPHanaSR 0.154.0 upstream release.

    Resolves: rhbz#1803801
    Resolves: rhbz#1803799
    Resolves: rhbz#1803025
    Resolves: rhbz#1803916


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-46.2
changelog:
  - sap-cluster-connector: allow dashes/underscores in nodenames
  - sap-hana-scaleout: set default timeouts based on recommendations
    and a couple of bugfixes

    Resolves: rhbz#1834800
    Resolves: rhbz#1834796


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-53
changelog:
  - redis: fix validate-all action and run it during start-action
  - ocf-shellfuncs: ocf_is_clone(): fix to return true when clone-max
    is set to 0
  - Filesystem: add symlink support
  - azure-events: new resource agent for Azure
  - pgsql: get correct status during start-action, and set initial
    score for primary and hot standby

    Resolves: rhbz#1792241
    Resolves: rhbz#1818035
    Resolves: rhbz#1624203
    Resolves: rhbz#1640575
    Resolves: rhbz#1744431


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-54
changelog:
  - aws-vpc-route53: new resource agent for AWS
  - aws-vpc-move-ip: add "routing_table_role" parameter
  - aws-vpc-move-ip: delete remaining route entries

    Resolves: rhbz#1759113
    Resolves: rhbz#1810466
    Resolves: rhbz#1828895


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-56
changelog:
  - sap-hana-scaleout: set default timeouts based on recommendations
    and a couple of bugfixes

    Resolves: rhbz#1829081


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-61.1
changelog:
  - gcp-vpc-move-vip: add support for multiple alias IPs
  - sybaseASE: run verify action during start action only
  - azure-events: handle exceptions in urlopen

    Resolves: rhbz#1846732
    Resolves: rhbz#1848673
    Resolves: rhbz#1862121


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-61.8
changelog:
  - gcp-vpc-move-route, gcp-vpc-move-vip: add project parameter and
    make vpc_network parameter optional

    Resolves: rhbz#1913936


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-61.13
changelog:
  - SAPHana: use actual_mode from global.ini and fallback to mode when
    it's not set

    Resolves: rhbz#1855888


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-61.15
changelog:
  - gcp-pd-move/gcp-vpc-move-route/gcp-vpc-move-vip: dont fail with
    configuration rc when it might be a network hickup

    Resolves: rhbz#2042070


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-61.18
changelog:
  - db2: add PRIMARY/REMOTE_CATCHUP_PENDING/CONNECTED status to promote-check

    Resolves: rhbz#2127477


author: Tom Lane <tgl@redhat.com> 9.0.0-1
changelog:
  - Update pg_filedump to version 9.0.0, to support PostgreSQL 9.0.
  - Relabel license as PostgreSQL now that that's separately recognized by OSI.


author: Tom Lane <tgl@redhat.com> 9.1.0-1
changelog:
  - Update pg_filedump to version 9.1.0, to support PostgreSQL 9.1.
  - Point to new upstream home at pgfoundry.org.


author: Gennadii Altukhov <galt@redhat.com> 2.0.2-15
changelog:
  - Related: #1378903 - fix keywords in a changelog1378903 - fix keywords in a
    changelog (galt@redhat.com)


author: Gennadii Altukhov <galt@redhat.com> 2.0.2-16
changelog:
  - Resolves: #1415742 - rhn-search traceback - immediateTrigger-server exists
    with certain identification1415742 - rhn-search traceback - immediateTrigger-
    server exists with certain identification (eherget@redhat.com)


author: Tomas Lestach <tlestach@redhat.com> 2.0.2-17
changelog:
  - Reverts: bz 1415742 - rhn-search traceback - immediateTrigger-server exists with certain identification" (michael.mraka@redhat.com)


author: Tomas Kasparek <tkasparek@redhat.com> 2.0.2-18
changelog:
  - Resolves: #1430298 - rhnreg_ks man page missing documentation for some
    options (ogajduse@redhat.com)


author: Tomas Kasparek <tkasparek@redhat.com> 2.0.2-19
changelog:
  - Related: #1494389 - detect if action has been picked up for 2nd time
    (tkasparek@redhat.com)
  - Resolves: #1494389 - revert previous reboot loop changes
    (tkasparek@redhat.com)


author: Michael Mraka <michael.mraka@redhat.com> 5.0.10-1
changelog:
  - let rhnsd.service be enabled after installation
  - Purging %changelog entries preceding Spacewalk 1.0, in active packages.


author: Grant Gainey 5.0.13-5
changelog:
  - Bump release to get past weirdness in brew-tags (ggainey@redhat.com)
  - Related: #1138939 - up2date and systemid files are managed by rhnsd itself,
    no need to break init script if they do not exist (jdobes@redhat.com)
  - Related: #1092518 - PIE+RELRO for rhnsd (mkollar@redhat.com)
  - Revert changes in order to clean up tagging issues with brew
    (ggainey@redhat.com)
  - Automatic commit of package [rhnsd] minor release [5.0.13-4-el7].
    (ggainey@redhat.com)
  - Bump release to get past weirdness in brew-tags (ggainey@redhat.com)
  - Automatic commit of package [rhnsd] minor release [5.0.13-2-el7].
    (ggainey@redhat.com)
  - Resolves: #1138939 - up2date and systemid files are managed by rhnsd itself,
    no need to break init script if they do not exist (jdobes@redhat.com)
  - Resolves: #1092518 - PIE+RELRO for rhnsd (mkollar@redhat.com)


author: Gennadii Altukhov <galt@redhat.com> 5.0.13-6
changelog:
  - 1409562 - RHEL7 rhnsd reload doesn't work (jdostal@redhat.com)
  - 1409562 - Reboot loop - rhn_check, rhnsd (jdostal@redhat.com)


author: Tomas Kasparek <tkasparek@redhat.com> 5.0.13-8
changelog:
  - Resolves: #1480306 - change permissions for rhnsd.pid (grinrag@gmail.com)
  - Resolves: #1489989 - umask(0) does not reset to default umask
    (tkasparek@redhat.com)
  - Resolves: #1475039 - close and reopen syslog when redirecting child output
    (martin.matuska@axelspringer.de)


author: Tomas Kasparek <tkasparek@redhat.com> 5.0.13-9
changelog:
  - Related: #1499793 - revert previous reboot loop changes
    (tkasparek@redhat.com)
  - Resolves: #1499793 - Revert "1260527 RHEL7 rhnsd reload doesn't work"
    (tkasparek@redhat.com)


author: Jan Pazdziora 5.0.7-1
changelog:
  - Only run chkconfig if we are in the SysV world.
  - rhnsd needs to be marked as forking.
  - When talking to systemctl, we need to say .service.


author: Milan Zazrivec <mzazrivec@redhat.com> 5.0.9-1
changelog:
  - Update .po and .pot files for rhnsd.
  - New translations from Transifex for rhnsd.
  - Download translations from Transifex for rhnsd.


author: Than Ngo <than@redhat.com> - 3.11-1
changelog:
  - 3.11
  - bz#540763, add IP allocation by pppd ability to pppoe-server
  - bz#808676, add missing % symbol for triggerun


author: Steve Dickson <steved@redhat.com> - 0.2.0-18
changelog:
  - Fixed typo causing rpcbind to run as root (bz 734598)
  - Added /etc/sysconfig/rpcbind config file (bz 861025)


author: Steve Dickson <steved@redhat.com> - 0.2.0-25
changelog:
  - Fixed some warnings in in6_fillscopeid() (bz 884165)
  - Fixed typo in rpcinfo manpage (bz 963512)
  - Removed unnecessary targets from rpcbind.service  (bz 1036791)


author: Steve Dickson <steved@redhat.com> - 0.2.0-27
changelog:
  - Add nss-altfiles to rpcbind user lookup path (bz 1171291)
  - Add support for systemd socket activation (bz 1203820)
  - Added a tmpfiles.d configuration (bz 1181779)
  - Shutdown cleanly (bz 1174653)


author: Steve Dickson <steved@redhat.com> - 0.2.0-29
changelog:
  - Change RPCBDIR to be /run since that will exist after a
    reboot and bindings wil be perserved during upgrades
    but not reboots. (bz 1240817)


author: Steve Dickson <steved@redhat.com> - 0.2.0-35
changelog:
  - Restart rpcbind.socket on restarts (bz 1303751)
  - Added localhost:111 to rpcbind socket activation (bz 1293430)
  - Soft static allocate rpc uid/gid (bz 1321279)


author: Steve Dickson <steved@redhat.com> - 0.2.0-39
changelog:
  - Added libtirpc dependency (bz 1396291)
  - Removed xlog warning (bz 1377531)
  - Removed an 'i' warning (bz 1377560)


author: Panu Matilainen <pmatilai@redhat.com> - 4.11.1-7
changelog:
  - Fix relocation regression wrt unowned directories (#1001553)
  - Fix build-time double-free wrt %caps() on wildcard file entry (#1002089)
  - Fix source URL in spec


author: Panu Matilainen <pmatilai@redhat.com> - 4.11.1-8
changelog:
  - Fix segfault on empty -p <lua> scriptlet body (#1004062)
  - Add missing dependency on tar to rpm-build (#986539)


author: Florian Festi <ffesti@redhat.com> - 4.11.1-9
changelog:
  - Fix byteorder for 64 bit tags on big endian machines (#1012946)
   - Better RPMSIGTAG_SIZE vs PMSIGTAG_LONGSIZE detection (#1012595)


author: Florian Festi <ffesti@redhat.com> - 4.11.1-17
changelog:
  - Fix race condidition where unchecked data is exposed in the file system
    (#1163060)
  - Fixes CVE-2013-6435


author: Aldy Hernandez <aldyh@redhat.com> - 4.11.1-17
changelog:
  - Import from rawhide:
    * Tue Oct 01 2013 Panu Matilainen <pmatilai@redhat.com> - 4.11.1-8
    - add support for ppc64le architecture


author: Aldy Hernandez <aldyh@redhat.com> - 4.11.1-18
changelog:
  - Import from rawhide:
    * Wed Jan 15 2013 Panu Matilainen <pmatilai@redhat.com> - 4.11.1-12
    - include ppc64le in %power64 macro (#1052930)


author: Florian Festi <ffesti@redhat.com> - 4.11.3-18
changelog:
  - Fixed failing upstream test 257 on big endian systems (#1264463)
  - Fixed problems with perl.req script (#1320214, #1275551)
  - Fixed race condition in rpm file deployment when updating an existing file
    (#1320181)
  - Move bdb warnings from stdin to stdout (#1297793)
  - Add --justdb to the erase section of the man page, too (#1310561)
  - Backport support for multi threaded xz compression (#1278924)
  - Update config.guess (#1291377)
  - Add --noplugins option (#1264031)
  - Overwrite a file if it is not marked as config any more (#1290463)
  - Add man page for systemd-inhibit plugin (#1265578)


author: Florian Festi <ffesti@redhat.com> - 4.11.3-22
changelog:
  - Move rpm-plugin-systemd-inhibit man page to that package (#1360706)
  - Fix off by one error in base64 code (#1341913)
  - Add sources to lua to prevent %autosetup failing in some cases (#1359084)
  - Fix refcounting for Python hdr objects (#1358467)
  - Perl dependecy generator: Skip blocks after variable definitions (#1378307)
  - Verify signatures properly (#1371487)
  - Export function in Python binding for yum (#1343692)


author: Florian Festi <ffesti@redhat.com> - 4.11.3-28
changelog:
  - Make sure files in /usr/src/debug are not world writable (RHBZ #1441098)
  - Increase maximal header size (RHBZ #1434656)
  - Increase buffer to be able to render Korean dates (RHBZ #1425231)
  - Add --noconfig option (RHBZ #1406611)


author: Panu Matilainen <pmatilai@redhat.com> - 4.11.3-31
changelog:
  - Backport missing infra for --noconfig option (#1406611)
  - As a side-effect, this also makes --noghost work as intended


author: Pavlina Moravcova Varekova <pmoravco@redhat.com> - 4.11.3-33
changelog:
  - Repair of --noghost option implementation (#1395818)
  - Backport fix rpmSign() return value in case of failure (#1419590)
  - Backport passing _find_debuginfo_opts -g to eu-strip for executables
    (#1540653)


author: Pavlina Moravcova Varekova <pmoravco@redhat.com> - 4.11.3-34
changelog:
  - Adjust --noghost documentation (#1395818)
  - Provide audit events on update verification (#1555326)


author: Pavlina Moravcova Varekova <pmoravco@redhat.com> - 4.11.3-36
changelog:
  - Add popt-based options --setcaps and --restore (#1550745)
  - Improve hardlink handling in disk space calculation (#1491786)
  - Remove perl dependencies that are provided in the same file (#1570181)


author: Jaroslav Škarvada <jskarvad@redhat.com> - 1.4.8-1
changelog:
  - New version
    Resolves: rhbz#966639
  - Updated and defuzzified patches
  - Still use lua-5.1 (fedoras < f20)


author: Michal Sekletar <msekleta@redhat.com> - 0.17-71
changelog:
  - resolves: RHBZ #737244 #896583 #947213
  - migrate from xinetd to systemd configuration
  - close pam session correctly when client does not ask for separate error channel
  - fix pty handling which was broken by changes in /bin/login


author: Michal Sekletar <msekleta@redhat.com> - 0.17-72
changelog:
  - unit files must not be marked as config files
  - fix handling of non-native IPv6 connections via AF_INET6 socket


author: Michal Ruprich <mruprich@redhat.com> - 0.17-78
changelog:
  - Resolves: #1502657 - Copying remote file to local dir fails with "rcp: protocol screwup: expected control record"
  - Resolves: #1338037 - rsh/rlogin sessions ignore SIGPIPE due to systemd
  - Resolves: #1477207 - rlogin killed when changing run level
  - Resolves: #1503112 - rexecd Could not allocate space for cmdbuf
  - Resolves: #1505226 - have a proposed patch for rsh-0.17-76.el7_1.1


author: Pavel Šimerda <psimerda@redhat.com> - 3.0.9-14
changelog:
  - Resolves: #1052814 - rsync command is terminated with SIGSEGV
  - Resolves: #1052814 - add missing patch file


author: Luboš Uhliarik <luhliari@redhat.com> - 3.0.9-17
changelog:
  - Resolves: #1082496 - socket activation for rsync doesn't work (added missing
    rsyncd@.service file)


author: Michal Ruprich - 3.1.2-4
changelog:
  - Related: #1432899 - removing dependencies on perl
  - using the bundled zlib.h(#1491582)
  - turning on upstream tests


author: Michal Ruprich <mruprich@redhat.com> - 3.1.2-10
changelog:
  - Resolves: #1672779 - Rsync bug resets modification time of every destination file that has not changed


author: Tomas Heinrich <theinric@redhat.com> 7.4.7-1
changelog:
  - rebase to 7.4.7
    add requirement on libestr >= 0.1.9
    resolves: #836485
    resolves: #1020854
    resolves: #1040036
  - drop patch 4; not needed anymore
    rsyslog-7.4.2-imuxsock-rfc3339.patch
  - install the rsyslog-recover-qi.pl tool
  - fix a typo in a package description
  - add missing defattr directives
  - add a patch to remove references to Google ads in the html docs
    rsyslog-7.4.7-bz1030044-remove-ads.patch
    Resolves: #1030043
  - add a patch to allow numeric specification of UIDs/GUIDs
    rsyslog-7.4.7-numeric-uid.patch
    resolves: #1032198
  - change the installation prefix to "/usr"
    resolves: #1032223
  - fix a bad date in the changelog
    resolves: #1043622
  - resolve a build issue with missing mysql_config by adding
    additional BuildRequires for the mysql package
  - add a patch to resolve build issue on ppc
    rsyslog-7.4.7-omelasticsearch-atomic-inst.patch


author: Tomas Heinrich <theinric@redhat.com> 7.4.7-3
changelog:
  - replace rsyslog-7.3.15-imuxsock-warning.patch
    with rsyslog-7.4.7-bz1053669-imuxsock-wrn.patch
    resolves: #1053669
  - add rsyslog-7.4.7-bz1052266-dont-link-libee.patch to prevent
    linking the main binary with libee
    resolves: #1052266
  - add rsyslog-7.4.7-bz1054171-omjournal-warning.patch to fix
    a condition for issuing a warning in omjournal
    resolves: #1054171
  - drop the "v5" string from the conf file as it's misleading
    resolves: #1040036


author: Tomas Heinrich <theinric@redhat.com> 7.4.7-5
changelog:
  - move the rscryutil man page to the crypto subpackage
    resolves: #1056565
  - add a patch to prevent message loss in imjournal
    rsyslog-7.4.7-bz1038136-imjournal-message-loss.patch
    resolves: #1038136


author: Tomas Heinrich <theinric@redhat.com> 7.4.7-6
changelog:
  - disable the imklog plugin by default
    the patch for rhbz#1038136 caused duplication of kernel messages since the
    messages read by the imklog plugin were now also pulled in from journald
    resolves: #1078654


author: Tomas Heinrich <theinric@redhat.com> 7.4.7-14
changelog:
  - add a patch to prevent loss of partial messages
    resolves: rhbz#1312459
  - add a patch to allow multiple rulesets in imrelp
    resolves: rhbz#1223566
  - add a patch to fix a race condition during shutdown
    resolves: rhbz#1295798
  - add a patch to backport the mmutf8fix plugin
    resolves: rhbz#1146237
  - add a patch to order service startup after the network
    resolves: rhbz#1263853


author: Tomas Heinrich <theinric@redhat.com> 7.4.7-15
changelog:
  - add a patch to make state file handling in imjournal more robust
    resolves: rhbz#1245194
  - add a patch to support wildcards in imfile
    resolves: rhbz#1303617


author: Radovan Sroka <rsroka@redhat.com> - 8.24.0-6
changelog:
  - RHEL 7.4 ERRATUM
  - rsyslog rebase to 8.24
  - added patch to prevent segfault while setting aclResolveHostname
    config options
    resolves: rhbz#1422414
  - added patch to check config variable names at startup
    resolves: rhbz#1427828
  - added patch for str2num to handle empty strings
    resolves: rhbz#1427821
  - fixed typo in added-chdir patch
    resolves: rhbz#1422789
  - added patch to log source process when beginning rate-limiting
    resolves: rhbz#1196230
  - added patch to chdir after chroot
    resolves: rhbz#1422789
  - added patch to remove "inputname" imudp module parameter 
    deprecation warnings
    resolves: rhbz#1403907
  - added patch which resolves situation when time goes backwards
    and statefile is invalid
    resolves rhbz#1088021
  - added a patch to bring back deprecated cmd-line switches and
    remove associated warnings
    resolves: rhbz#1403831
  - added documentation recover_qi.pl
    resolves: rhbz#1286707
  - add another setup for doc package
  - add --enable-generate-man-pages to configure parameters;
    the rscryutil man page isn't generated without it
    https://github.com/rsyslog/rsyslog/pull/469
  - enable mmcount, mmexternal modules
  - remove omruleset and pmrfc3164sd modules


author: Radovan Sroka <rsroka@redhat.com> - 8.24.0-8
changelog:
  RHEL 7.4 ERRATUM
  - added dependency automake autoconf libtool due to yum-builddep
  - reenable omruleset module
    resolves: rhbz#1431615
    resolves: rhbz#1428403
    resolves: rhbz#1427821(fix regression, failed QA)
    resolves: rhbz#1432069
  - resolves: rhbz#1165236
    resolves: rhbz#1419228
    resolves: rhbz#1431616 
    resolves: rhbz#1196230(failed QA)


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-9
changelog:
  RHEL 7.4 ERRATUM
  - added autoreconf call
  - added patch to replace gethostbyname with getaddrinfo call
    resolves: rhbz#1056548(failed QA)


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-10
changelog:
  RHEL 7.4 ERRATUM
  - edited patches Patch19 and Patch21
    resolves: rhbz#1419228(coverity scan problems)
    resolves: rhbz#1056548(failed QA, coverity scan problems)


author: Radovan Sroka <rsroka@redhat.com> - 8.24.0-11
changelog:
  RHEL 7.4 ERRATUM
  - added new patch that backports num2ipv4 due to rhbz#1427821
    resolves: rhbz#1427821
  - enable pmrfc3164sd module
    resolves: rhbz#1431616


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-13
changelog:
  RHEL 7.5 ERRATUM
  - added patch to properly resolve FQDN
    resolves: rhbz#1401456
  - added documentation patch correcting qeues default values
    resolves: rhbz#1459896
  - added patch adjusting log level of journal reloaded msg
    resolves: rhbz#1497985 
  - added patch to prevent crash with invalid set statement
    this also obsoletes patch2 (for 1188503) 
    resolves: rhbz#1462160
  - added patch with nullptr check to prevent ABRT
    resolves: rhbz#1488186


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-14
changelog:
  RHEL 7.5 ERRATUM
  - renamed patch for undocumented recover_qi script to correct bz number
    resolves: rhbz#1507028
  - added patch ensuring relp conneciton is active before closing it
    resolves: rhbz#1505103


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-15
changelog:
  RHEL 7.5 ERRATUM
  - made rsyslog-doc noarch and fixed search on doc regeneration
    resolves: rhbz#1507028


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-16
changelog:
  RHEL 7.5 ERRATUM
  - edited the patch to conform to latest upstream doc
    resolves: rhbz#1459896 (failedQA)
  - disabled 32-bit builds on all arches as they are not shipped
    anymore in RHEL7


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-16.5
changelog:
  RHEL 7.5.z ERRATUM
  - fixed imjournal duplicating msgs under some conditions
    resolves: rhbz#1545582


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-24
changelog:
  RHEL 7.6 ERRATUM
  - updated imfile rewrite patch with fixes from covscan
    resolves: rhbz#1531295
  - updated mmkubernetes patch with fixes from covscan
    resolves: rhbz#1539193
  - updated imjournal duplicates patch with fixes from covscan
    resolves: rhbz#1538372
  - updated omelastic enhancement patch with fixes from covscan
    resolves: rhbz#1565214


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-26
changelog:
  RHEL 7.6 ERRATUM
  - updated imfile rewrite patch according to early testing
    resolves: rhbz#1531295
  - added patch fixing pid file name in manpage
    resolves: rhbz#1597264
  - updated json-parsing patch with one more bugfix
    resolves: rhbz#1565219


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-27
changelog:
  RHEL 7.6 ERRATUM
  - updated imfile rewrite patch fixing last update regressions
    resolves: rhbz#1531295
  - added patch fixing deadlock in async logging
    resolves: rhbz#1559408
  - added patch fixing NULL access in worktable create
    resolves: rhbz#1600462
  - now putting release number into configure to have it present
    in error messages


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-28
changelog:
  RHEL 7.6 ERRATUM
  - updated imfile rewrite patch fixing next round of regressions
    resolves: rhbz#1531295
    resolves: rhbz#1602156
  - updated mmkubernetes patch with NULL ret-check
    resolves: rhbz#1539193


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-30
changelog:
  RHEL 7.6 ERRATUM
  - updated imfile rewrite patch with next bugfix
    resolves: rhbz#1531295
  - updated imjournal duplicates patch making slower code optional
    and added corresponding doc patch
    resolves: rhbz#1538372


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-31
changelog:
  RHEL 7.6 ERRATUM
  - added new patch fixing ompipe dropping messages when pipe full
    resolves: rhbz#1591819
  - updated mmkubernetes patch to accept non-kubernetes containers
    resolves: rhbz#1539193
    resolves: rhbz#1609023
  - removed json-parsing patches as the bug is now fixed in liblognorm


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-32
changelog:
  RHEL 7.6 ERRATUM
  - updated imfile rewrite patch with no log on EACCES
    resolves: rhbz#1531295
  - removed now needless build-deps


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-33
changelog:
  RHEL 7.6 ERRATUM
  - updated imfile rewrite patch with extended symlink watching
    resolves: rhbz#1531295
  - updated mmkubernetes patch to accept dots in pod name
    resolves: rhbz#1539193


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-35
changelog:
  RHEL 7.7 ERRATUM
  - added patch fixing memory corruption in omfwd module
    resolves: rhbz#1632659
  - added patch fixing imfile sopping monitor after rotation
    resolves: rhbz#1649250
  - added patch addressing imptcp CVE-2018-16881
    resolves: rhbz#1658288


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-36
changelog:
  RHEL 7.7 ERRATUM
  - added patch fixing mmkubernetes halt after pod deletition
    resolves: rhbz#1622767


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-37
changelog:
  RHEL 7.7 ERRATUM
  - edited patch fixing mmkubernetes halt after pod deletition
    (covscan found an issue in previous version)
    resolves: rhbz#1622767
  - added patch stopping flooding logs with journald errors
    resolves: rhbz#1632211
  - added patch stopping flooding logs with symlink false-positives
    resolves: rhbz#1685901
  - added patch stopping memory leak when processing internal msgs
    resolves: rhbz#1666365
  - added documentation patch with info about CRI-O to mmkubernetes
    resolves: rhbz#1625935


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-38
changelog:
  RHEL 7.7 ERRATUM
  - added patch increasing max path size preventing buffer overflow
    with too long paths
    resolves: rhbz#1656860


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-41.1
changelog:
  RHEL 7.7.z ERRATUM
  - added patch resolving possible segfault in core-ratelimiter
    resolves: rhbz#1746497


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-41.2
changelog:
  RHEL 7.7.z ERRATUM
  - edited imjournal memleaks patch to fix introduced regression
    resolves: rhbz#1752424


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-41.3
changelog:
  RHEL 7.7.z ERRATUM
  - added patch fixing hash file_id feature to properly monitor files
    after rotation
    resolves: rhbz#1805675


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-41.4
changelog:
  RHEL 7.7.z ERRATUM
  - edited patch fixing hashed file_ids for imfile statefiles
    resolves: rhbz#1805675


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-41
changelog:
  RHEL 7.8 ERRATUM
  - added patch and doc-patch with new "fsync" imjournal option
    resolves: rhbz#1696686
  - added patch resolving omelasticsearch crash on "nothing" reply
    resolves: rhbz#1684236


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-44
changelog:
  RHEL 7.8 ERRATUM
  - added patch and doc-patch for new caseSensitive imUDP/TCP option
    resolves: rhbz#1309698


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-46
changelog:
  RHEL 7.8 ERRATUM
  - Support Intermediate Certificate Chains in rsyslog
    resolves: rhbz#1627799
  - fixed WorAroundJournalBug patch to not cause leaks
    resolves: rhbz#1744617
  - added patch fixing possible segfault in rate-limiter
    resolves: rhbz#1744682


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-47
changelog:
  RHEL 7.8 ERRATUM
  - edited imfile truncation detection patch with reression fix
    resolves: rhbz#1744856


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-48
changelog:
  RHEL 7.8 ERRATUM
  - added patch resolving crash on wrong MsgProperty
    resolves: rhbz#1549706
  - added patch resolving CVE in pmaixforward module
    resolves: rhbz#1768320
  - added patch resolving CVE in pmcisconames module
    resolves: rhbz#1768323
  - added patch implementing file ID for imfile
    resolves: rhbz#1763746
  - added patch fixing omelasticsearch with ES 6.X
    resolves: rhbz#1600171


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-49
changelog:
  RHEL 7.8 ERRATUM
  - fixed fsync patch to actually revognize the new option
    resolves: rhbz#1696686 (failedQA)


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-52
changelog:
  RHEL 7.8 ERRATUM
  - edited patch file ID for imfile to not log useless errors
    also improved file-id behavior to adress newly found problems
    resolves: rhbz#1763746


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-53
changelog:
  RHEL 7.9 ERRATUM
  - one more fix for file ID patch to extend to offline behavior
    resolves: rhbz#1806493
  - added patch resoving race in serialization resulting in crash
    resolves: rhbz#1778841


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-55
changelog:
  RHEL 7.9 ERRATUM
  - edited imfile file-id patch to not segfault on selinux block
    resolves: rhbz#1843992


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-57
changelog:
  RHEL 7.9 ERRATUM
  - added patch resolving buffer overflows in select() function
    resolves: rhbz#1858297


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.247-16
changelog:
  - Fix version regex algorithmic complexity vulnerability (CVE for incomplete
    fix for CVE-2013-4287) (CVE-2013-4363).
    - Related: rhbz#1006429


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.247-17
changelog:
  - Heap overflow in floating point parsing (CVE-2013-4164).
    * ruby-2.0.0-p353-CVE-2013-4164-ignore-too-long-fraction-part.patch
    - Resolves: rhbz#1033503
  - Allow MD5 in OpenSSL tests.


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.247-18
changelog:
  - Fix FTBFS due to expired certificate for IMAP test case.
  - Fix test_aes_gcm_wrong_tag random failures.
    - Resolves: rhbz#1048899


author: Josef Stribny <jstribny@redhat.com> - 2.0.0.353-22
changelog:
  - Fix FTBFS with new tzdata
    Resolves: rhbz#1144023
  - Fix FTBFS due to a support for RFC 5649 in OpenSSL
    Resolves: rhbz#1145692


author: Josef Stribny <jstribny@redhat.com> - 2.0.0.353-23
changelog:
  - Add missing patch for new tzdata
    Related: rhbz#1144023
  - Add missing patch for RFC 5649 in OpenSSL
    Related: rhbz#1145692


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.598-24
changelog:
  - Rebased to Ruby 2.0.0-p598.
    * Remove Patch19: ruby-2.0.0-p247-Make-stable-Gem-Specification.files-in-
        default-.gems.patch; subsumed
    * Remove Patch20: ruby-2.1.1-fix-test-failures-due-to-expired-certs.patch;
        subsumed
    * Remove Patch21: ruby-2.1.0-test_aes_gcm_wrong_tag-Dont-use-String
        -succ.patch; subsumed
    * Remove Patch22: ruby-2.2.0-fix-error-with-tzdata.patch; subsumed
    Resolves: rhbz#1071187
  - Incorporates fixes for CVE-2014-8080 and CVE-2015-8090.
    Resolves: rhbz#1164000
  - Fix for Proxy Realm feature.
    Resolves: rhbz#1122140
  - Fix off-by-one stack-based buffer overflow in the encodes() function
    (CVE-2014-4975).
    Related: rhbz#1164000


author: Pavel Valena <pvalena@redhat.com> - 2.0.0.648-26
changelog:
  - Rebase to Ruby 2.0.0-p648
    Resolves: rhbz#1197720, rhbz#1298282, rhbz#1258863
    * Remove Patch18: ruby-2.0.0-p247-Revert-mkmf.rb-prefix-install_dirs-only-
        with-DESTDIR.patch; subsumed
    * Remove Patch23: ruby-openssl-wrap-cipher-fix.patch; subsumed
    * Remove Patch25: ruby-2.0.0-p607-DNS-Resolv-fall-back-if-canonicalization-
        fails.patch; subsumed
  - Remove tests depending on europe/moscow to avoid failures due to tzdata change
    https://github.com/eggert/tz/commit/8ee11a301cf173afb0c76e0315b9f9ec8ebb9d95
  - Add checks for systemtap, abrt hook and rubygems version
  - Fix significant hash table performance slowdown on ppc64le
    Resolves: rhbz#1163032
  - Support in no_proxy for domain names with whitespaces and leading dots
    Resolves: rhbz#1300433


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.648-30
changelog:
  - Fix test_npn_protocol_selection_ary and test_npn_protocol_selection_enum
    failures with newest openssl.
    Resolves: rhbz#1416123
  - Add gemspec_add_dep and gemspec_remove_dep macros.
  - Extend 'gem_' macros for pre-release version support.
    Resolves: rhbz#1397390
  - Make symlinks for json gem.
    Resolves: rhbz#1308992


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.648-31
changelog:
  - Fix unsafe object deserialization in RubyGems (CVE-2017-0903).
    * ruby-2.4.3-CVE-2017-0903-Fix-unsafe-object-deserialization
        -vulnerability.patch
    Resolves: CVE-2017-0903
  - Fix an ANSI escape sequence vulnerability (CVE-2017-0899).
    Resolves: CVE-2017-0899
  - Fix a DOS vulernerability in the query command (CVE-2017-0900).
    Resolves: CVE-2017-0900
  - Fix a vulnerability in the gem installer that allowed a malicious gem
      to overwrite arbitrary files (CVE-2017-0901).
    Resolves: CVE-2017-0901
  - Fix a DNS request hijacking vulnerability (CVE-2017-0902).
    * ruby-2.2.8-lib-rubygems-fix-several-vulnerabilities-in-RubyGems.patch
    Resolves: CVE-2017-0902
  - Fix buffer underrun vulnerability in Kernel.sprintf (CVE-2017-0898).
    * ruby-2.2.8-Buffer-underrun-vulnerability-in-Kernel.sprintf.patch
    Resolves: CVE-2017-0898
  - Escape sequence injection vulnerability in the Basic
      authentication of WEBrick (CVE-2017-10784).
    * ruby-2.2.8-sanitize-any-type-of-logs.patch
    Resolves: CVE-2017-10784
  - Arbitrary heap exposure during a JSON.generate call (CVE-2017-14064).
    * ruby-2.2.8-Fix-arbitrary-heap-exposure-during-a-JSON.generate-call.patch
    Resolves: CVE-2017-14064
  - Command injection vulnerability in Net::FTP (CVE-2017-17405).
    * ruby-2.2.9-Fix-a-command-injection-vulnerability-in-Net-FTP.patch
    Resolves: CVE-2017-17405
  - Buffer underrun in OpenSSL ASN1 decode (CVE-2017-14033).
    * ruby-2.2.8-asn1-fix-out-of-bounds-read-in-decoding-constructed-objects.patch
    Resolves: CVE-2017-14033
  - Command injection in lib/resolv.rb:lazy_initialize() allows arbitrary code
      execution(CVE-2017-17790).
    * ruby-2.5.0-Fixed-command-Injection.patch
    Resolves: CVE-2017-17790


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.648-32
changelog:
  - Add Psych.safe_load
    * ruby-2.1.0-there-should-be-only-one-exception.patch
    * ruby-2.1.0-Adding-Psych.safe_load.patch
    Related: CVE-2017-0903
  - Disable Tokyo TZ tests broken by recen tzdata update.
    * ruby-2.5.0-Disable-Tokyo-TZ-tests.patch
    Related: CVE-2017-0903


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.648-35
changelog:
  - Introduce `Gem::UserInteraction#verbose` method as precondition to fix
    CVE-2019-8321.
    * rubygems-2.3.0-refactor-checking-really_verbose.patch
  - Fix escape sequence injection vulnerability in verbose.
  - Fix escape sequence injection vulnerability in gem owner.
  - Fix escape sequence injection vulnerability in API response handling.
  - Prohibit arbitrary code execution when installing a malicious gem.
  - Fix escape sequence injection vulnerability in errors.
    * ruby-2.4.6-Applied-security-patches-for-RubyGems.patch
    Resolves: rhbz#1699283


author: Jun Aruga <jaruga@redhat.com> - 2.0.0.648-35
changelog:
  - Kill bundled certificates.
  - Add macros to edit files lists in .gemspec
  - Fix buffer under-read in String#unpack
    Resolves: CVE-2018-8778
  - Fix HTTP response splitting in WEBrick
    Resolves: CVE-2017-17742
  - Fix DoS by large request in WEBrick
    Resolves: CVE-2018-8777
  - Fix directory traversal by poisoned NULL byte in Dir.
    Resolves: CVE-2018-8780
  - Fix file and directory creation with directory traversal.
    Resolves: CVE-2018-6914
  - Fix socket creation by poisoned NULL byte.
    Resolves: CVE-2018-8779
  - Fix: return default path with nonexistent home dir
  - Fix flags not propagated in Array#pack and String#unpack.
    Resolves: CVE-2018-16396
  - Fix strictly interpret octal fields in tar headers.
    Resolves: CVE-2018-1000075
  - Fix a security error for duplicate files in a package.
    Resolves: CVE-2018-1000076
  - Enforce URL validation on spec homepage attribute.
    Resolves: CVE-2018-1000077
  - Mitigate XSS vulnerability in homepage attribute.
    Resolves: CVE-2018-1000078
  - Prevent Path Traversal issue during gem installation.
    Resolves: CVE-2018-1000079
  - Fix unsafe Object Deserialization Vulnerability in gem owner.
    Resolves: CVE-2018-1000074
  - Refresh expired certificates.
  - Fix path traversal when writing to a symlinked basedir outside of the root
    Resolves: CVE-2018-1000073


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.648-36
changelog:
  - Introduce `Gem::UserInteraction#verbose` method as precondition to fix
    CVE-2019-8321.
    * rubygems-2.3.0-refactor-checking-really_verbose.patch
  - Fix escape sequence injection vulnerability in verbose.
  - Fix escape sequence injection vulnerability in gem owner.
    Resolves: CVE-2019-8322
  - Fix escape sequence injection vulnerability in API response handling.
    Resolves: CVE-2019-8323
  - Prohibit arbitrary code execution when installing a malicious gem.
    Resolves: CVE-2019-8324
  - Fix escape sequence injection vulnerability in errors.
    Resolves: CVE-2019-8325
    * ruby-2.4.6-Applied-security-patches-for-RubyGems.patch


author: Frantisek Kluknavsky <fkluknav@redhat.com> - 1.0.0-24.rc4.dev.gitc6e4a1e.1
changelog:
  - rebase to c6e4a1ebeb1a72b529c6f1b6ee2b1ae5b868b14f
  - https://github.com/opencontainers/runc/pull/1651


author: Lokesh Mandvekar <lsm5@redhat.com> - 2:1.0.0-52.dev.git70ca035
changelog:
  - built commit 70ca035 with additional patches to change default root and
  to revert apply cgroups earlier


author: Jindrich Novy <jnovy@redhat.com> - 1.0.0-68.rc10
changelog:
  - fix "RHEL 7.8: cleaning up mounts of Kubernetes service account secrets of deleted pods failing"
  - Resolves: #1823374


author: Honza Horak <hhorak@redhat.com> - 0.17-70
changelog:
  - Minor spec file changes
  - Use new systemd macros (Resolves: #850302)
  - Use systemd notify messages


author: Honza Horak <hhorak@redhat.com> - 0.17-77
changelog:
  - Free already alocated memory when parsing of RPC request failed
  - Require systemd instead of systemd-units
  - Remove SysV init converting


author: Petr Kubat <pkubat@redhat.com> - 0.17-81
changelog:
  - Remove execute permissions from *.service files (#1422022)
  - Fix wrong Source url (#1418690)
  - Add BSD license text (#1418686)


author: - Alexander Bokovoy <abokovoy@redhat.com> - 4.1.1-30
changelog:
  - resolves: #1083859  - Force KRB5CCNAME in Samba systemd units.
  - related: #1082598 - Fully enables systemd integration.


author: - Guenther Deschner <gdeschner@redhat.com> - 4.1.1-35
changelog:
  - resolves: #1105504 - CVE-2014-0244: DoS in nmbd.
  - resolves: #1108844 - CVE-2014-3493: DoS in smbd with unicode path names.
  - resolves: #1105573 - CVE-2014-0178: Uninitialized memory exposure.


author: - Andreas Schneider <asn@redhat.com> - 4.1.12-11
changelog:
  - resolves: #1163748 - Fix smbclient -L fails against new Windows versions
                         over TCP.
  - resolves: #1167849 - Fix smbstatus --profile always returning EXIT_FAILURE.


author: - Andreas Schneider <asn@redhat.com> - 4.1.12-13
changelog:
  - resolves: #1172089 - Fix 'net rpc join' with schannel changes.
  - resolves: #1170883 - Fix 'net time system' segfault.


author: Andreas Schneider <asn@redhat.com> - 4.1.12-18
changelog:
  - resolves: #1179787 - Fix authentication against Kerberos domains.
  - resolves: #1181319 - Package pam_smbpass again.
  - resolves: #1184023 - Fix authentication with long 'netbios_name' set.
  - resolves: #1183546 - Fix 'net time' segfault.


author: Isaac Boukris <iboukris@redhat.com> - 4.10.16-2
changelog:
  - resolves: #1828354 - add additioanl hostnames to the keytab
  - resolves: #1836427 - add dnshostname option net-ads-join


author: Andreas Schneider <asn@redhat.com> - 4.10.16-8
changelog:
  - resolves: #1878205 - Fix restarting winbind on package upgrade
  - resolves: #1892632 - Fix CVE-2020-14318
  - resolves: #1891687 - Fix CVE-2020-14323
  - resolves: #1879834 - Fix CVE-2020-1472
  - resolves: #1892313 - Fix memory leak in winbindd (wbinfo -u)
  - resolves: #1868917 - Fix %U substitution for 'valid users' option
  - resolves: #1853272 - Fix 'require_membership_of' documentation in
                         pam_winbind{.conf} manpage


author: Andreas Schneider <asn@redhat.com> - 4.10.16-14
changelog:
  - resolves: #1937867 - Fix possible core dump with printing support
  - resolves: #1930747 - Ensure that libwbclient has been updated before
                         restarting services


author: Andreas Schneider <asn@redhat.com> - 4.10.16-16
changelog:
  - resolves: #2019661 - Fix CVE-2016-2124
  - resolves: #2019673 - Fix CVE-2020-25717
  - resolves: #2021428 - Add missing PAC buffer types to krb5pac.idl


author: Andreas Schneider <asn@redhat.com> - 4.10.16-18
changelog:
  - resolves: #2034800 - Fix usermap script regression caused by CVE-2020-25717
  - resolves: #2036595 - Fix MIT realm regression caused by CVE-2020-25717
  - resolves: #2046148 - Fix CVE-2021-44142


author: Andreas Schneider <asn@redhat.com> - 4.10.16-19
changelog:
  - resolves: #2081649 - Fix idmap_rfc2307 and idmap_nss returning wrong
                         mapping for uid/gid conflict


author: Andreas Schneider <asn@redhat.com> - 4.10.13-1
changelog:
  - resolves: #1785121 - Rebase to vesion 4.10.13
  - resolves: #1791208 - Fix CVE-2019-14907
  - resolves: #1737888 - Fix manual libwbclient alternative settings
  - resolves: #1634057 - Return correct stat for SMB1 with POSIX extensions


author: Andreas Schneider <asn@redhat.com> - 4.10.15-1
changelog:
  - related: #1785121 - Rebase to version 4.10.15
  - resolves: #1828924 - Fix typo in pam_winbind documentation about require_membership_of
  - resolves: #1801496 - Add missing ctdb directories


author: Andreas Schneider <asn@redhat.com> - 4.10.4-1
changelog:
  - resolves: #1497809 - Add --resolve-uids for 'smbstatus -L'
  - resolves: #1714947 - Fix idmap_tdb2 scripts


author: Andreas Schneider <asn@redhat.com> - 4.10.4-6
changelog:
  - resolves: #1753254 - Fix trusted domain enumeration in windind caused
                         a Active Directory update


author: Isaac Boukris <iboukris@redhat.com> - 4.10.4-7
changelog:
  - resolves: #1657428 - Fix spnego downgrade
  - resolves: #1663064 - Fix net ads join in hardened environments


author: Andreas Schneider <asn@redhat.com> - 4.10.4-11
changelog:
  - resolves: #1797560 - Fix Kerberos authentication with trusted domains
  - resolves: #1797561 - Fix smbclient mkdir log spam
  - resolves: #1797562 - Fix client tools log spam about messaging


author: Guenther Deschner <gdeschner@redhat.com> - 4.2.3-11
changelog:
  - resolves: #1290710
  - CVE-2015-3223 Remote DoS in Samba (AD) LDAP server
  - CVE-2015-5299 Missing access control check in shadow copy code
  - CVE-2015-5252 Insufficient symlink verification in smbd
  - CVE-2015-5296 Samba client requesting encryption vulnerable to
                  downgrade attack


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.2.10-6.1
changelog:
  - Fix issues caused by security tightening for Badlock:
    - Only validate MIC when "map to guest" is set
    - NetApp SMB servers don't negotiate NTLMSSP_SIGN
    - Anonymous connections don't work anymore
    - wbinfo -u or 'net ads search' don't work anymore
    - Handle empty session in client code
  - resolves: #1333794


author: Andreas Schneider <asn@redhat.com> - 4.2.10-6.2
changelog:
  - related: #1333794 - Fix issues caused by security tightening for Badlock
    o ntlm_auth issues and segfault
    o rpcclient doesn't respect "client ipc *" options
    o fix anonymous authentication if signing is mandatory


author: Andreas Schneider <asn@redhat.com> - 4.2.10-6.3
changelog:
  - resolves: #1350759 - Fix idmap_hash when used with other modules
  - resolves: #1351260 - Fix krb5 encryption type setup during join


author: Andreas Schneider <asn@redhat.com> - 4.2.3-2
changelog:
  - resolves: #1238194 - Fix the 'dfree command'
  - resolves: #1216062 - Document netbios name length limitation


author: Andreas Schneider <asn@redhat.com> - 4.2.3-6
changelog:
  - resolves: #1255322 - Fix 'map to guest = Bad uid' option
  - resolves: #1255326 - Fix segfault with 'mangling method = hash'


author: Andreas Schneider <asn@redhat.com> - 4.2.3-9
changelog:
  - resolves: #1273912 - Fix dependencies to samba-common
  - resolves: #1273393 - Fix user after free in smb name resolution


author: Andreas Schneider <asn@redhat.com> - 4.4.4-3
changelog:
  - related: #1260214 - Correctly warn about missing realm for ad domains
                        with 'security=domain'


author: Andreas Schneider <asn@redhat.com> - 4.4.4-4
changelog:
  - resolves: #1351655 - Fix winbind meomory leak with each cached credentials
                         login
  - resolves: #1351961 - Fix CVE-2016-2119


author: Andreas Schneider <asn@redhat.com> - 4.4.4-5
changelog:
  - resolves: #1359091 - Package /usr/lib/samba/ldb in the common-libs package
  - resolves: #1360788 - Fix multilib issue with ctdb-tests package
  - resolves: #1362385 - Fix Samba ignoring supplementary groups
  - resolves: #1364051 - Fix smbd panic with stale ctdb entries


author: Andreas Schneider <asn@redhat.com> - 4.4.4-6
changelog:
  - resolves: #1367316 - Increase required Kerbersion version number
  - resolves: #1366477 - Fix using the right krb5 ccache in libads
  - resolves: #1356501 - Fix high CPU usage with smbclient connection to
                         non-reachable IP


author: Andreas Schneider <asn@redhat.com> - 4.4.4-10
changelog:
  - resolves: #1393050 - Fix linking nss_wins with libreplace
  - resolves: #1393051 - Fix nss_wins function definitions for gethostbyname*
  - resolves: #1393048 - Fix %G substitution in AD case
  - resolves: #1393052 - Fix regression of smbclient unable to connect to
                         Apple and Azure


author: Andreas Schneider <asn@redhat.com> - 4.4.4-13
changelog:
  - resolves: #1437816 - Fix krb5 memory cache in libads sasl code
  - resolves: #1437741 - Fix CVE-2016-2125, CVE-2016-2126 and CVE-2017-2619


author: Andreas Schneider <asn@redhat.com> - 4.4.4-1
changelog:
  - resolves: #1303076 - Rebase Samba to version 4.4.4
  - resolves: #1314673 - Fix CVE-2015-7560
  - resolves: #1263322 - Add '--no-dns-updates' option to 'net ads join'
  - resolves: #1264433 - Fix segfault in pam_winbind.so with invalid config
                         options
  - resolves: #1193504 - Fix smbget to retrieve files recursively
  - resolves: #1193502 - Fix smbget to use command line credentials
  - resolves: #1193493 - Fix smbget url credentials parsing
  - resolves: #1273999 - Support printing with Kerberos credentials on newer
                         CUPS versions
  - resolves: #1296821 - Define /etc/pam.d/samba as a non replaceable config
  - resolves: #1261107 - Fix memory leak because of missing talloc stackframe
  - resolves: #1333562 - Fix memory leak after smbc_free_context()
  - resolves: #1315422 - Fix regression from CVE-2015-5252
  - resolves: #1316899 - Fixed idmap_hash module issues when used with others
  - resolves: #1322691 - Fix badlock related bugs
  - Fix CVE-2015-5370
  - Fix CVE-2016-2110
  - Fix CVE-2016-2111
  - Fix CVE-2016-2112
  - Fix CVE-2016-2113
  - Fix CVE-2016-2114
  - Fix CVE-2016-2115
  - Fix CVE-2016-2118
  - resolves: #1327951 - Fix regression with anonymous connections from OS X
  - resolves: #1327845 - Fix pcap_cache_reload() with spoolssd
  - resolves: #1289640 - Fix ctdb selinux issue with read only tracking dbs
  - resolves: #1341208 - Fix enumerating groups over NSS with idmap_ad
  - resolves: #1345827 - Fix resolving trusted domain users on domain member
  - resolves: #1346334 - Fix typo in smb.conf.example
  - resolves: #1335292 - Fix site-aware 'net ads join -k'
  - resolves: #1260214 - Accept empty realm for ad domains with 'security=domain'


author: Andreas Schneider <asn@redhat.com> - 4.6.2-7
changelog:
  - resolves: #1461336 - Fix smbclient username parsing
  - resolves: #1460937 - Fix username normalization with winbind


author: Andreas Schneider <asn@redhat.com> - 4.6.2-10
changelog:
  - resolves: #1484423 - Require at least krb5 version 1.15.1
  - resolves: #1484713 - Fix password changes for users via smbpasswd
  - resolves: #1484723 - Be more graceful on FSCTL_VALIDATE_NEGOTIATE_INFO
                         returned errors


author: Andreas Schneider <asn@redhat.com> - 4.7.0-1
changelog:
  - resolves: #1470048 - Rebase Samba to version 4.7.0
  - resolves: #1335710 - Improve performance of smbd for a lot
                         of new client connections


author: Andreas Schneider <asn@redhat.com> - 4.7.0-3
changelog:
  - related: #1470048 - Fix dependency issues
  - resolves: #1486318 - Move /var/lib/samba/lock to common package
  - resolves: #1497162 - Fix smbcacls command line password handling


author: Andreas Schneider <asn@redhat.com> - 4.7.1-3
changelog:
  - resolves: #1498353 - Fix broken MacOSX client which can't handle file_ids
                         correctly
  - resolves: #1495490 - Fix client rename over SMB2
  - resolves: #1510598 - Fix client volume cmd over SMB2


author: Andreas Schneider <asn@redhat.com> - 4.7.1-5
changelog:
  - resolves: #1505940 - Fix 'net ads keytab list'
  - resolves: #1518732 - Enable AES-NI to make SMB3 encryption and signing
                         faster


author: Andreas Schneider <asn@redhat.com> - 4.7.1-6
changelog:
  - resolves: #1476153 - Handle SMB echo responses more gracefully
  - resolves: #1523212 - Fix SMB2 client read-after-free issue


author: Andreas Schneider <asn@redhat.com> - 4.7.1-7
changelog:
  - resolves: #1581369 - Fix segfault updating dns during 'net ads join'
  - resolves: #1581373 - Fix segfault during NT1 session setup
  - resolves: #1581376 - Fix segfault in keytab handling
  - resolves: #1581377 - Fix segfault in smbclient dfsgetinfo


author: Andreas Schneider <asn@redhat.com> - 4.8.1-1
changelog:
  - related: #1558560 - Rebase to newer Samba version
  - resolves: #1567896 - Fix possible crash if secrets db is emtpy
  - resolves: #1570020 - Fix a crash in smbd when dfsgetinfo is called


author: Andreas Schneider <asn@redhat.com> - 4.8.1-3
changelog:
  - resolves: #1575205 - Fix segfault when updating DNS with 'net ads join'
  - resolves: #1525511 - Fix idmap_rid dependency on trusted domain list


author: Andreas Schneider <asn@redhat.com> - 4.8.3-1
changelog:
  - related: #1558560 - Rebase to Samba version 4.8.3
  - resolves: #1579398 - Add winbind localauth krb5 plugin


author: Andreas Schneider <asn@redhat.com> - 4.8.3-4
changelog:
  - resolves: #1614132 - Fix delete-on-close after smb2_find
  - resolves: #1614265 - Fix CVE-2018-1139
  - resolves: #1614269 - Fix CVE-2018-10858


author: Andreas Schneider <asn@redhat.com> - 4.9.1-1
changelog:
  - resolves: #1649434 - Update to version 4.9.1
  - resolves: #1648852 - Fix out of bound array access in ctdb
  - resolves: #1647960 - Fix segfault in the debug system with hardended build
  - resolves: #1644328 - Fix segfault if wrong 'passdb backend' is configured
  - resolves: #1650452 - Add smbc_setOptionProtocols()
  - resolves: #1659513 - Fix testparm/pdbedit crash
  - resolves: #1529301 - Added new 'net ads spn' command
  - resolves: #1595277 - Fix manpage for 'net ads lookup'
  - resolves: #1600274 - Fix vfs_audit log which does not show full path names
  - resolves: #1623140 - Fix handling the 'disable netbios' option
  - resolves: #1624227 - Connect to spoolss with the correct version information
  - resolves: #1659533 - Fix new file and folder creation with vfs_glusterfs
  - resolves: #1579401 - Implement 'net ads leave --keep-account'
  - resolves: #1624227 - Fix spoolss client operations against newer Windows
                         versions
  - resolves: #1656405 - Fix looking up local system accounts


author: Andreas Schneider <asn@redhat.com> - 4.9.1-2
changelog:
  - resolves: #1674403 - Fix panic when setting 'force group' on a share with
                         an active connections
  - resolves: #1670720 - Fix installation of samba-python
  - resolves: #1669476 - Fix user lookup via UPN


author: Andreas Schneider <asn@redhat.com> - 4.9.1-3
changelog:
  - resolves: #1479451 - Fix 'net' command auth with Kerberos
  - resolves: #1686158 - Fix printing with CUPS
  - resolves: #1662408 - Fix username/password printing with CUPS


author: Andreas Schneider <asn@redhat.com> - 4.9.1-4
changelog:
  - resolves: #1690222 - Fix --max-protocol documentation of smbclient
  - resolves: #1518353 - Fix 'net ads join -Uadmin@forestdomain'
  - resolves: #1696524 - Fix CVE-2019-3880


author: Andreas Schneider <asn@redhat.com> - 4.9.1-8
changelog:
  - resolves: #1754838 - Fix username/password auth with smbspool
  - resolves: #1754835 - Fix builtin groups creation.


author: Andreas Schneider <asn@redhat.com> - 4.9.1-9
changelog:
  - resolves: #1759445 - Fix trusted domain enumeration in windind caused
                         a Active Directory update


author: Nils Philippsen <nils@redhat.com> - 1.0.23-18
changelog:
  - build against libusb-1.0 on Fedora >= 18 (#1003193)
  - require libusbx-devel instead of libusb1-devel which is obsolete


author: Nils Philippsen <nils@redhat.com> - 1.0.24-1
changelog:
  - version 1.0.24
  - use (hopefully stable) Alioth download URL
  - update udev patch, remove obsolete patches
  - use udev hwdb instead of huge rulesets


author: Nils Philippsen <nils@redhat.com> - 1.0.14-10
changelog:
  - add missing documentation files AUTHORS, COPYING, README
  - don't distribute sane-style.rc
  - use %buildroot consistently
  - explain missing xcam.desktop file


author: Nils Philippsen <nils@redhat.com> - 1.0.14-14
changelog:
  - clean up:
    - don't BR: gimp-devel, R: sane-backends
    - get rid of buildroot, %makeinstall and %clean section
    - dont obsolete/provide "sane" (ancient)


author: Matej Habrnal <mhabrnal@redhat.com> - 0.13-13
changelog:
  - add support for Ruby
    - Related: #1334604
  - actualize list of normalization function in satyr
    - Related: #1332869
  - fix defects found by coverity
    - Related: #1336390


author: Richard Marko<rmarko@redhat.com> 0.8-1
changelog:
  - New upstream version
    - Added support for json de/serialization of reports and stacktraces.
    - Library version number increased, as the interface changed since the last release


author: Jakub Filak <jfilak@redhat.com> 0.9-1
changelog:
  - New upstream version
    - Enrich koops uReport data with koops text and kernel version.
    - Improve koops modules handling.


author: Martin Milata <mmilata@redhat.com> 0.9-2
changelog:
  - Fix malformed JSON for some Java and koops reports
    - Resolves: #1035317
    - Resolves: #1036790
  - Fix memory leak in RPM handling
    - Resolves: #1016780
  - Check for unsigned overflows
    - Resolves: #1034869


author: Martin Milata <mmilata@redhat.com> 0.13-2
changelog:
  - Use elfutils unwinder
    - Resolves: #1051569
  - Disable function fingerprinting
    - Resolves: #1052402


author: Martin Milata <mmilata@redhat.com> - 0.13-5
changelog:
  - Fix minor bugs found by static analyzers
    - Resolves: #1142856
  - Return empty duphash for koopses with no reliable frames
    - Resolves: #1123262
  - Fix parsing of python SyntaxError exceptions
    - Resolves: #1142339
  - Fix parsing of ppc64 gdb stacktraces
    - Resolves: #1142338
  - Limit the depth of generated stacktrace to avoid huge reports
    - Resolves: #1142346
  - Add authentication support to uReport, needed for reporting to customer portal
    - Resolves: #1139555


author: <kwenning@redhat.com> - 1.3.0-3
changelog:
  - prevent creation of duplicate servants
  - check 2Node flag in corosync to support
    2-node-clusters with shared disk fencing
  - move disk-triggered reboot/off/crashdump
    to inquisitor to have sysrq observed by watchdog

    Resolves: rhbz#1413951


author: <kwenning@redhat.com> - 1.3.1-2
changelog:
  - rebase to upstream v1.3.1

    Resolves: rhbz#1499864
              rhbz#1468580
              rhbz#1462002


author: <kwenning@redhat.com> - 1.3.1-3
changelog:
  - mention timeout caveat with SBD_DELAY_START
    in configuration template
  - make systemd wait for sbd-start to finish
    before starting pacemaker or dlm

    Resolves: rhbz#1525981


author: <kwenning@redhat.com> - 1.3.1-7
changelog:
  - reenable sbd on upgrade so that additional
    links to make pacemaker properly depend on
    sbd are created

    Resolves: rhbz#1525981


author: Klaus Wenninger <kwenning@redhat.com> - 1.4.0-2
changelog:
  - rebuild against pacemaker 1.20 to make sbd actually use
    the new libpengine API

    Resolves: rhbz#1661233


author: Klaus Wenninger <kwenning@redhat.com> - 1.4.0-3
changelog:
  - finalize cmap connection if disconnected from cluster
  - make handling of cib-connection loss more robust

    Resolves: rhbz#1691484


author: Klaus Wenninger <kwenning@redhat.com> - 1.4.0-11
changelog:
  - synchronize with rhel-8.1.0

    Resolves: rhbz#1718297
    Resolves: rhbz#1713023
    Resolves: rhbz#1732368


author: Klaus Wenninger <kwenning@redhat.com> - 1.4.0-12
changelog:
  - rebuild with updated brew-root

    Resolves: rhbz#1718297
    Resolves: rhbz#1713023
    Resolves: rhbz#1732368


author: Klaus Wenninger <kwenning@redhat.com> - 1.4.0-13
changelog:
  - properly increment release

    Resolves: rhbz#1718297
    Resolves: rhbz#1713023
    Resolves: rhbz#1732368


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.5.1-11
changelog:
  - Fix mounted filesystem is shown as disabled when fstab entry uses link, UUID or LABEL
    Resolves: #921487


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.4.0-5
changelog:
  - Add support for arbitrary names of network devices in Linux_NetworkPortImplementsIPEndpoint
    association
    Resolves: #682386
  - Remove macros from changelog, register to sfcb


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.2.0-3
changelog:
  - Fix provider segfaults when enumerating instances of Linux_SysfsAttribute class
  - Fix provider doesn't show much sysfs entries
  - Add mofs registration for various CIMOMs


author: Tomas Bzatek <tbzatek@redhat.com> - 0.8.0-10.20120315cvs
changelog:
  - Add support for rsyslog $IncludeConfig directive (#971807)
  - Add support for filter definitions (#971807)
  - Various rsyslog compatibility fixes (#971807)


author: Roman Rakus <rrakus@redhat.com> - 2.2.7-3
changelog:
  - Fixed a typo
  - Added missing providers
  - improved providers registration
  - Fixed owning of filesystem's directories (man)


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.2.8-7
changelog:
  - Fix sblim-gather is installing files under /etc/tmpfiles.d/
    Resolves: #1180992
  - Build with PIE and full RELRO
    Resolves: #1092566


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.2.8-8
changelog:
  - Fix reposd crashes with SIGFPE during calcluation of interval metric when there
    are duplicate data values in the repository
    Resolves: #1467038


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.2.8-9
changelog:
  - Use Pegasus root/interop instead of root/PG_Interop
  - Enable System Z specific providers for s390 and s390x architecture
    Resolves: #1545811


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.3.16-3
changelog:
  - Fix indCIMXmlHandler crash in IndCIMXMLHandlerInvokeMethod with Embedded Instances 
    Resolves: #957747
  - Fix sfcb creates invalid XML with embedded object inside embedded object
    Resolves: #957742


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.3.16-11
changelog:
  - Fix connection fails to openwsman with sfcbLocal frontend
    Resolves: #1047781
  - Fix multilib issue with man page and config file
    Resolves: #1067842


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.2.5-6
changelog:
  - Move libcimcClientXML.so from -devel to main package - it's needed for proper function
    Resolves: #1056407


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.6.2-7
changelog:
  - Fix wrong usage of libcurl API, which caused segfaults when wbemcli was used
    with https scheme (patch by kdudka@redhat.com)


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.6.2-10
changelog:
  - Backport (slightly modified) configurable SSL version feature from upstream,
    update man page accordingly
    Resolves: #1239115


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.6.2-11
changelog:
  - Update default CA certificate file path due to recent changes in tog-pegasus
    Resolves: #1320077
  - Fix wbemcli dont accept dot (.) as password character on command line
    Resolves: #1103368
  - Fix bogus date in %changelog


author: Martin Preisler <mpreisle@redhat.com> 0.8.2-1
changelog:
  - Updated to new version
  - Added a workaround to the cmake invocation because of faulty openscap .pc file


author: Martin Preisler <mpreisle@redhat.com> 0.8.6-1
changelog:
  - Upgrade to upstream 0.8.6 version:
    https://fedorahosted.org/scap-workbench/query?milestone=0.8.6&status=closed
  - Require polkit


author: Martin Preisler <mpreisle@redhat.com> 1.1.1-1
changelog:
  - Require English fonts (bz#1134418)
  - Updated with latest upstream URLs
  - Reorganized the spec a little
  - Removed SCL related parts from the spec
  - Updated to new upstream release 1.1.1


author: Watson Sato <wsato@redhat.com> 1.1.4-1
changelog:
  - Updated to new upstream release 1.1.4 (rhbz#1404394)
  - UX improvements
  - Fixed fetch remote resources warning (rhbz#1367923)
  - Improved error message when scanning a remote machine in which openscap-scanner
    is not installed (rhbz#1368463)
  - Fixed search on disabled item (rhbz#1368493)
  - Fixed multi benchmark tailoring use case
  - Fixed a bug that caused tailored profiles to have titles duplicated (rhbz#1320197)
  - Fixed path of tailoring file in dry run output (rhbz#1368516)
  - Now Workbench doesn't allow edit of values with prohibitedChanges attribute
  - Added --version and --help command line options (rhbz#1368527)
  - Improved workflow of dry run execution (rhbz#1385549)
  - Check capabilities of oscap with propper arguments (rhbz#1368463)
  - Show number of selected rules in profile listing


author: Martin Preisler <mpreisle@redhat.com> 1.1.6-1
changelog:
  - Updated to new upstream release 1.1.6
  - Tri-state checkboxes for tailoring
  - Fixed remote host and port being cleared when scan starts
  - Fiixed formating of Profile html description in Tailoring Window
  - Fixed oscap message "Downloading ... ok" appearing as an error
  - Fixed tab order of widgets in main window
  - Load Content as the default button of the SSG integration dialog
  - New validation of the customization file name
  - Generate bash and Ansible remediation roles from profiles
  - Generate bash and Ansible remediation roles from results after scanning
  - Fixed a short integer overflow when using ssh port numbers higher than 32k
  - Fixed long loading times on OSX
  - Open tailoring file directly via command line


author: Tomas Tomecek <ttomecek@redhat.com> - 0.12.0-4
changelog:
  - Add patch to use build_dir argument in build_extension
  - Fix rpmlint warnings
  - License Updated
  - Don't build with python3


author: Tomas Tomecek <ttomecek@redhat.com> - 0.12.1-1
changelog:
  - Update to 0.12.1 - fixes CVE-2013-4251 (rhbz#997579)
  - change working directory to build directory when building ext (rhbz#916695)
  - use SHA-256 instead of md5 -- FIPS mode (rhbz#877920)
  - unbundle python-six (bug rhbz#1019642)


author: Lubos Kardos <lkardos@redhat.com> - 20130529-10
changelog:
  - Allow to use vendor prefix in packages names
  - Include %nfsmountable macro into scl's rpm macros file


author: Jan Zeleny <jzeleny@redhat.com> - 20130529-13
changelog:
  - bump the version to get in sync with 7.1 branch
  - Reflect the state of %nfsmountable macro in collections' rpm macro files
  - escape all the % chars in changelog


author: Jindrich Novy <jnovy@redhat.com> 20120927-1
changelog:
  - update to 20120927
  - better BUILDROOT processing
  - bash completition for scl command
  - debuginfo package now has SCL-specific provide
  - non-SCL builds are without warning in build log
  - improved help


author: Jindrich Novy <jnovy@redhat.com> 20121110-1
changelog:
  - introduce sclbuild utility
  - fix exporting of env. variables when mutiple collections are
    enabled at the same time
  - better bash completion
  - fix changelog


author: Jan Zeleny <jzeleny@redhat.com> - 20130529-2
changelog:
  - add scl_source script for intercollection dependencies (#1032444)
  - updated macros in macros.scl-filesystem (#1032451, #1032451)
  - add delimiter between collections and command (#1032460)
  - fix the name of attr macros (#1023628)


author: Jan Zeleny <jzeleny@redhat.com> - 20130529-4
changelog:
  - fixed some coverity-reported bugs (related: #1032616)
  - a note about env. variables in man page (#968954)
  - drop the /var/spool/uucp from the default fs structure (#1033674)


author: Jan Zeleny <jzeleny@redhat.com> - 20130529-6
changelog:
  Catch up with Fedora and RHEL6
  - add automatic Provides: scl-package(%scl) to all scl packages
    (except for metapackages)
  - add automatic Requires: %scl_runtime to all scl packages
    (except for metapackages)
  - the "filesystem" file renamed back to "filelist"
  - add correct dependencies to debug packages.
  - allow disabling debuginfo generation
  - remove automatic creation of debuginfo for metapackage.
  - rephrase command description in man page
  - fix system paths in __os_install_post
  - remove the sclbuild utility, as it's mostly useless
  - add the command set to register/deregister collection
  - fix missing allocation check in read_script_output()
  - drop recursive ownership of /usr/lib within SCL root
  - introduce %scl_dependency_generators macro


author: Lubos Kardos <lkardos@redhat.com - 20130529-7
changelog:
  Support for importing collections from NFS mounts
  - Add execution of register and deregister scripts during registration
    and deregistration if they exist.
  - Add capability to make collection nfs mountable using macro nfsmountable.


author: Lubos Kardos <lkardos@redhat.com - 20130529-8
changelog:
  - Modified paths of state and conf files
  - Add owning and creating of state and conf files if nfsmountable is defined
  - Add printing file names in error messages


author: Petr Hracek <phracek> - 4.1.0-0.20.20120314git3c2946
changelog:
  - Multiple packages are installing files under /etc/tmpfiles.d
  - comply http://fedoraproject.org/wiki/Packaging:Guidelines#Tmpfiles.d
  - Resolves: rhbz#1121958


author: Rui Matos <rmatos@redhat.com> - 3.8.0-5
changelog:
  - Fix for "seahorse-nautilus broken by glib2 regression related to
    SIGCHLD warnings"
  - Resolves: #1093123


author: Martin Briza <mbriza@redhat.com> - 4.2.1-9
changelog:
  - Backported commit from upstream to fix treating "x26" as "&" character
  - Added virtual provide for gnulib according to http://fedoraproject.org/wiki/Packaging:No_Bundled_Libraries 
    Resolves: #812067 #821776


author: Martin Briza <mbriza@redhat.com> - 4.2.2-1
changelog:
  - New release
  - Dropping included patches: sed-4.2.1-data-loss.patch sed-4.2.1-fix-0x26-on-RHS.patch sed-4.2.1-makecheck.patch
  - Dropping unused patch sed-4.2.1-dummyparam.diff
  - Regenerated sed-4.2.{1,2}-copy.patch
  - Minor change to patching (creating backup files)


author: Jan Pacner <jpacner@redhat.com> - 4.2.2-5
changelog:
  - Related: #948598 (Man page scan results for sed; introduce -c argument, add
    help for -b --binary arguments, cleanup arguments & help)


author: Jakub Martisko <jamartis@redhat.com> - 4.2.2-7
changelog:
  - Fix: "in-place edits on FUSE filesystems create files with all-zero mode bits"
    Resolves: #1836317


author: Jaroslav Škarvada <jskarvad@redhat.com> - 8.14.6-2
changelog:
  - Fixed milter_helo regression (milter-helo-fix patch)
    Resolves: rhbz#895552
  - Fixed bogus dates in changelog


author: Jaroslav Škarvada <jskarvad@redhat.com> - 8.14.7-5
changelog:
  - Explicitly enabled sm-client statistics
    Resolves: rhbz#890585
  - Enable ECDHE support
    Resolves: rhbz#1124827
  - Properly set {client_port} value on little endian machines,
    patch by Kelsey Cumminngs <kgc@corp.sonic.net>
    Resolves: rhbz#1210914
  - Added makemap and its manual page into alternatives
    Resolves: rhbz#1225891
  - Modified nm-dispatcher script to asynchronously restart sendmail and
    not block the connection activation
    Resolves: rhbz#1237070
  - Added config options allowing disablement of TLS 1.1/2
    Resolves: rhbz#1281476
  - Fixed problem with e-mails not sending from IPv6 enabled server
    to servers with MX record pointing to CNAME
    Resolves: rhbz#1294870
  - Added editmap
    Resolves: rhbz#1342393
  - Removed systemd limit for sendmail restarts to workaround failure due to
    rapid restarts caused by NetworkManager dispatcher script
    Resolves: rhbz#1395102
  - Fixed op.pdf
    Resolves: rhbz#1401070


author: Jaroslav Škarvada <jskarvad@redhat.com> - 8.14.7-6
changelog:
  - Use SSL_CTX_use_certificate_chain_file() to handle intermediate
    certificates passed additionally in confSERVER_CERT
    Resolves: rhbz#1596725


author: Petr Lautrbach <plautrba@redhat.com> 3.2.24-1.1
changelog:
  - Stop sending syslog.LOG_DEBUG Messages unless loglevel is set to debug
  - Add the policy rpm string to the user comments of an already reported bug from jfilak@redhat.com
  - Remove at_console lines from policykit so cockpit can use dbus interfaces.
  - Fix handling of target paths that decode screws up
  - Provide the policy rpm in Bugzilla bug reports by jfilak@redhat.com
  - setroubleshootd is set to be run as setroubleshoot user instead of root user
  - translations updated from https://fedora.zanata.org/project/view/setroubleshoot


author: Petr Lautrbach <plautrba@redhat.com> - 3.2.28-1
changelog:
  - Fix sealert message for capability2
  - Spelling fixes
  - sealert - provide a better error message when SELinux is disabled (#1420084)
  - Fix report problem summary string (#1343397)
  - Update setroubleshootd.8 (#1348140)


author: Vit Mojzis <vmojzis@redhat.com> - 3.2.29-1
changelog:
  - Fix sealert message for process2 (#1507909)
  - Remove additional "If " string from plugin messages (#1177347)
  - Fix semi-translated messages (#1332126)
  - Make labels on GtkButtons translatable
  - Set translation domain for Gtk.Builder() object to have strings correctly translated (#1370100)
  - Do not split If sentences to framework and plugins (#1177347)
  - Don't stop when the plugin directory is empty
  - Change "check_for_man" return value upon failure
  - Fix "plugin details" message content
  - Add "init_args" function to Plugin 
  - Fix sealert crash when setroubleshootd fails to start (#1405003)


author: Vit Mojzis <vmojzis@redhat.com> - 3.2.30-1
changelog:
  - Fix summary and "if" text for AVCs with unknown target path (#1437772)
  - Remove unused booleans.py file
  - src/sealert: Finish dbus communication after error (#1461486)


author: Vit Mojzis <vmojzis@redhat.com> - 3.2.30-3
changelog:
  - Check for the existence of setroubleshoot group separately (#1478118)
  - Fix AVC.__typeMatch to handle aliases properly (#1459844, #1459835, #1459875)
  - Fix allowed_target_types (#1460642, #1460648)


author: Vit Mojzis <vmojzis@redhat.com> - 3.2.30-4
changelog:
  - Catch exceptions caused by lookup_signature (#1636369, #1627908)
  - Fix translation of hex values in AVCs (#1477236)


author: Dan Horák <dan@danny.cz> - 1.37-5
changelog:
  - fix various man pages (#948463)
  - add man page for the rescan-scsi-bus.sh script (#948463)
  - Resolves: #948463


author: David Sommerseth <davids@redhat.com> - 1.37-7
changelog:
  - Avoid deletion of /dev/null (#1298737)
  - Fix syntax error in rescan-scsi-bus related to multipath flushing (#1255564)
  - Add upstream updates to sg_inq, sg_rdac and sg_vpd (#1170719)


author: Gris Ge <fge@redhat.com> 1.37-17
changelog:
  - Fix help documents of sg_requests, sg_senddiag and sg_write_buffer.
    (RHBZ #1359282, #1359286, #1359292)


author: Tomas Bzatek <tbzatek@redhat.com> 1:1.37-19
changelog:
  - Reorder 59-fc-wwpn-id.rules to run after 60-persistent-storage.rules (#1785303)
  - Fix the 59-fc-wwpn-id.rules syntax (#1750417)
  - Add 59-fc-wwpn-id.rules (#1684302)


author: Jan Synáček <jsynacek@redhat.com> - 1.2.0.10-9
changelog:
  - dos2unix'ed the patch
  - Call dos2unix before patching and dos2unix Makefile as well
  - Use %{_sbindir} instead of '/sbin'


author: Tomas Mraz <tmraz@redhat.com> - 2:4.1.5.1-6
changelog:
  - report error to stdout when SELinux context for home directory
    cannot be determined (#973647)
  - audit the changing home directory owner (#885797)
  - do not set the default SELinux MLS range (#852676)


author: Tomas Mraz <tmraz@redhat.com> - 2:4.1.5.1-8
changelog:
  - slightly more meaningful error messages if crypt() returns NULL (#988184)
  - explicit suid permissions


author: Tomas Mraz <tmraz@redhat.com> - 2:4.1.5.1-14
changelog:
  - label the newly created home dir correctly (#1077809)
  - mention that chage -d 0 forces password change (#1135010)
  - improve date parsing and error detecting in chage
  - avoid full group database scanning in newgrp in most common case
  - report error if usermod asked for moving homedir and it does not exist


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.1.5.1-16
changelog:
  - update auditing to cover more events and fix some incorrect audit
    records - patch by Steve Grubb (#1151580)


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.1.5.1-19
changelog:
  - documentation fixes (#1292820)
  - usermod: make password unlocking compatible with passwd (#1185425)
  - usermod: disallow ':' in raw password setting (#1292815)
  - improve the gid and uid allocation mechanism (#1279321)
  - lastlog: add options to unexpire unused accounts (#1285547)


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.1.5.1-25
changelog:
  - prevent creating users ".." or "." or with all numeric usernames (#1373645)
  - raise limit for passwd and shadow entry length but also prevent
    writing longer entries (#1422497)
  - consider also supplementary group membership in newgrp (#1425078)


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.1.5.1-25.1
changelog:
  - re-allow all numeric usernames when SHADOW_ALLOW_ALL_NUMERIC_USER
    environment variable is set (#1651450)


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.6-1
changelog:
  - rebase to current upstream release to bring newuidmap and newgidmap
  - re-allow all numeric usernames when SHADOW_ALLOW_ALL_NUMERIC_USER
    environment variable is set


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.6-2
changelog:
  - ignore LOGIN_PLAIN_PROMPT variable in login.defs
  - correct wrong SUB_UID/GID_COUNT default in manual page (#1690522)


author: Bastien Nocera <bnocera@redhat.com> - 1.8-3
changelog:
  + shared-mime-info-1.8-3
  - Remove triggers, they're not supported in RHEL 7.4's RPM
  Resolves: #1433916


author: Bastien Nocera <bnocera@redhat.com> - 1.8-4
changelog:
  + shared-mime-info-1.8-4
  - Fix CSV files being associated with LibreOffice Math instead
    of LibreOffice Calc
  - Resolves: #1438589


author: Petr Pisar <ppisar@redhat.com> - 4.13.3-2
changelog:
  - Fix decoding from positional argument while overriding output file
    (bug #901895)
  - Fix decoding to standard output when output file is - or /dev/stdout
    (bug #901895)


author: Peter Jones <pjones@redhat.com> - 0.7-8
changelog:
  - out-of-bounds memory read flaw in DHCPv6 packet processing
    Resolves: CVE-2014-3675
  - heap-based buffer overflow flaw in IPv6 address parsing
    Resolves: CVE-2014-3676
  - memory corruption flaw when processing Machine Owner Keys (MOKs)
    Resolves: CVE-2014-3677


author: Peter Jones <pjones@redhat.com> - 0.7-8
changelog:
  - Build -8 for arm as well.
    Related: rhbz#1100048
  - out-of-bounds memory read flaw in DHCPv6 packet processing
    Resolves: CVE-2014-3675
  - heap-based buffer overflow flaw in IPv6 address parsing
    Resolves: CVE-2014-3676
  - memory corruption flaw when processing Machine Owner Keys (MOKs)
    Resolves: CVE-2014-3677


author: Peter Jones <pjones@redhat.com> - 0.7-10
changelog:
  - Fix a couple more minor bugs aavmf has found in fallback.
    Related: rhbz#1190191
  - Build lib/ with the right CFLAGS
    Related: rhbz#1190191


author: Peter Jones <pjones@redhat.com> - 0.9-1
changelog:
  - Update to 0.9-1
  - Fix early call to BS->Exit()
    Resolves: rhbz#1115843
  - Implement shim on aarch64
    Resolves: rhbz#1100048
    Resolves: rhbz#1190191


author: Peter Jones <pjones@redhat.com> - 10-1
changelog:
  - Update to 10-1
  - Support ia32
    Resolves: rhbz#1310766
  - Handle various different load option implementation differences
  - TPM 1 and TPM 2 support.
  - Update to OpenSSL 1.0.2k


author: Peter Jones <pjones@redhat.com> - 11-1
changelog:
  - Update to 11-1
    Related: rhbz#1310766
  - Fix regression in PE loader
    Related: rhbz#1310766
  - Fix case where BDS invokes us wrong and we exec shim again as a result
    Related: rhbz#1310766


author: Lokesh Mandvekar <lsm5@redhat.com> - 1:0.1.24-2.dev.git28d4e08
changelog:
  - Update container/storage.conf and containers-storage.conf man page
  - Default override to true so it is consistent with RHEL.


author: Lokesh Mandvekar <lsm5@redhat.com> - 1:0.1.24-3.dev.git28d4e08
changelog:
  - add rhel subscription secrets date to skopeo-containers
  - skopeo-containers conflicts with docker >= 2:1.13.1-61


author: dwalsh <dwalsh@redhat.com> - 0.1.25-1.git7fd6f66b
changelog:
  -   Fix CVE in tar-split
  -   copy: add shared blob directory support for OCI sources/destinations
  -   Aligning Docker version between containers/image and skopeo
  -   Update image-tools, and remove the duplicate Sirupsen/logrus vendor
  -   makefile: use -buildmode=pie


author: dwalsh <dwalsh@redhat.com> - 0.1.25-2.git2e8377a7
changelog:
  -  Add manifest type conversion to skopeo copy
  -  User can select from 3 manifest types: oci, v2s1, or v2s2
  -   e.g skopeo copy --format v2s1 --compress-blobs docker-archive:alp.tar dir:my-directory


author: dwalsh <dwalsh@redhat.com> - 0.1.29-2.git
changelog:
  - bump to 0.1.29-1
  - Updated containers/image
      docker-archive generates docker legacy compatible images
      Do not create $DiffID subdirectories for layers with no configs
      Ensure the layer IDs in legacy docker/tarfile metadata are unique
      docker-archive: repeated layers are symlinked in the tar file
      sysregistries: remove all trailing slashes
      Improve docker/* error messages
      Fix failure to make auth directory
      Create a new slice in Schema1.UpdateLayerInfos
      Drop unused storageImageDestination.{image,systemContext}
      Load a *storage.Image only once in storageImageSource
      Support gzip for docker-archive files
      Remove .tar extension from blob and config file names
      ostree, src: support copy of compressed layers
      ostree: re-pull layer if it misses uncompressed_digest|uncompressed_size
      image: fix docker schema v1 -> OCI conversion
      Add /etc/containers/certs.d as default certs directory


author: Jindrich Novy <jnovy@redhat.com> - 1:0.1.40-7
changelog:
  - fix "CVE-2020-8945 proglottis/gpgme: Use-after-free in GPGME bindings during container image pull"
  - Resolves: #1806944


author: Jindrich Novy <jnovy@redhat.com> - 1:0.1.40-10
changelog:
  - fix "CVE-2020-1702 skopeo: containers/image: Container images read entire image manifest into memory"
  - Resolves: #1810613


author: Nalin Dahyabhai <nalin@redhat.com> - 0.47.6-1
changelog:
  - only buildrequire libsss_nss_idmap-devel on releases that included SSSD
    version 1.10 or later, where it first appeared


author: Nalin Dahyabhai <nalin@redhat.com> - 0.47.7-1
changelog:
  - fix building against versions of directory server older than 1.3.0, which
    first introduced slapi_escape_filter_value()


author: Nalin Dahyabhai <nalin@redhat.com> - 0.48-1
changelog:
  - try to gracefully handle failures obtaining internal locks
  - fix locating-by-name of entries with names that require escaping
  - add self-tests for nsswitch and PAM functionality
  - make nsswitch mode properly handle user and group names with commas in them
  - handle attempts to PAM authenticate to compat groups (i.e., with failure)
  - drop the "schema-compat-origin" attribute


author: Nalin Dahyabhai <nalin@redhat.com> - 0.49-1
changelog:
  - add {nis,schema-compat}-ignore-subtree and -restrict-subtree settings,
    which should let us avoid deadlocks when tasks are modifying data in
    the backend database (#1007451)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.50-1
changelog:
  - if we get an EPIPE while registering with rpcbind, try to reconnect and
    retransmit before giving up


author: Nalin Dahyabhai <nalin@redhat.com> - 0.51-1
changelog:
  - fix another request argument memory leak in NIS server (#1040159)
  - fix miscellaneous items found by static analysis


author: Nalin Dahyabhai <nalin@redhat.com> - 0.52-1
changelog:
  - correctly reflect whether or not we're built with transaction support in
    the module's nsslapd-pluginVersion attribute
  - fix a couple of should've-used-memmove()-instead-of-memcpy() cases which
    would hit when removing maps or groups of maps (#1043546/#1043638)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.52-3
changelog:
  - remove ExclusiveArch if %{rhel} is 7 or higher, because 389-ds-base gets
    built for everything now (#1055711)


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.54-2
changelog:
  - Complete ID views support to BIND operation
  - Ignore ID views outside schema-compat subtrees
  - Use 389-ds API compatible with RHEL 7.0
  - Resolves: #1151436


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.54-6
changelog:
  - delay sending responses from compat tree after map cache search
  - Resolves: #1281748
  - fix processing of ID views
  - Resolves: #1281750, #1281752


author: Nalin Dahyabhai <nalin@redhat.com> - 0.52-5
changelog:
  - backport correction to the default settings for hosts.byname and
    hosts.byaddr NIS maps, so that their data items start with the host's
    address rather than a name (#1090948)


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.54-1
changelog:
  - Add support for IDM's ID views
  - Allow searching SSSD-provided users as memberUid case-insensitevly
  - Resolves: #1151436


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.56.0-4
changelog:
  - Fixed: UPN-based search for AD users does not match an entry in slapi-nis map cache
  - Resolves: #1361123
  - Fixed: slapi-nis plugin modifies DS data
  - Resolves: #1360245


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.56.0-5
changelog:
  - Resolves: #1473572
  - Fixed: Make changes in overrides available in the compat tree at runtime
  - Resolves: #1473577
  - Fixed: slapi-nis should use requests to SSSD with ability to cancel them with a timeout


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.56.0-8
changelog:
  - Fixed: #1473572
  - Changes of ID overrides now force clearing of affected SSSD cache entries on IPA master
  - Related: #1473577
  - Synchronize timeout-enabled code with ipa-extdom-extop


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.54-6
changelog:
  - delay sending responses from compat tree after map cache search
  - Resolves: #1273587
  - fix processing of ID views
  - Resolves: #1277576, #1265465


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.56.0-1
changelog:
  - New upstream release:
    - support updating passwords for the users from the primary tree
    - populate map cache in a separate thread to avoid blocking the DS
  - Resolves: #1292148


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.56.0-2
changelog:
  - Fix reported coverity issues
  - Make sure slapi-nis continue to work with SSSD 1.14 when default domain is defined
  - Resolves: #1292148


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.56.5-1
changelog:
  - Upstream release 0.56.5
  - Resolves: rhbz#1820124 When sync-repl is enabled, slapi-nis can deadlock during retrochanglog trimming
  - Resolves: rhbz#1820122 ERR - schemacompat - map rdlock: old way MAP_MONITOR_DISABLED
  - Resolves: rhbz#1819018 ipa slapi-nis stack traces review request for LDAP server deadlock
  - Resolves: rhbz#1830894 Memory leak during search of idview overrides


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.56.5-4
changelog:
  - CVE 2021-3480:  slapi-nis: NULL dereference (DoS) with specially crafted Binding DN
  - Resolves: rhbz#1942937


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.60.0-1
changelog:
  - upstream release 0.60.0
  - Change license from GPLv2 to GPLv3+ to follow 389-ds licensing
  - Resolves: rhbz#1978748
    Release adds following fixes:
    - Fix ID views integration
    - Fix base scope lookups
    - Bump NIS max dgram size to 8KB by default instead of 1KB
    - Allow to rebuild the compat tree


author: Michal Hlavinka <mhlavink@redhat.com> - 1:6.5-1
changelog:
  - smartmontools updated to 6.5
  - adds support for NVMe devices (#1369731)
  - minor spec cleanup (#1463148)


author: Michal Hlavinka <mhlavink@redhat.com> - 1:7.0-1
changelog:
  - smartmontools updated to 7.0 (#1588532)
  - fixed detection of Device Statistics log with 256 sectors (#1590190)


author: Ondrej Kozina <okozina@redhat.com> - 0.1.3-1.20130418git7ca81a2
changelog:
  - updatet to latest upstream version
  - add support to compare extended attributes ('xadiff' command)
  - add support to revert modificiations in file's extended attributes
  - patch: avoid useless build dependency on libattr-devel


author: Ondrej Kozina <okozina@redhat.com> - 0.1.5-1
changelog:
  - updated to latest upstream
  - allow whitespace in ALLOW_USERS and ALLOW_GROUPS in snapper's config
  - enable new pam module
  - patch: pam module installed in proper libdir


author: Ondrej Kozina <okozina@redhat.com> - 0.1.7-3
changelog:
  - enable btrfs compare using send/receive in libbtrfs
  - patch: adapt sources to change in libtrfs API (btrfs_read_and_process_send_stream)
  - Resolves: #1055579


author: Ondrej Kozina <okozina@redhat.com> - 0.1.7-5
changelog:
  - patch: Fix failure in invoking btrfs internal comparison of subvolumes
  - patch: Remove references to missing programs from man pages
  - Resolves: #1060806, #1063844


author: Ondrej Kozina <okozina@redhat.com> - 0.1.7-6
changelog:
  - patch: Add norecovery option mounting XFS read-only snapshot
  - patch: Fix ACL modification failure with XFS filesystem
  - patch: Sync SELinux context of .snapshots subvolume (btrfs only)
  - Resolves: #1064111, #1065969, #1069312


author: Ondrej Kozina <okozina@redhat.com> - 0.1.7-7
changelog:
  - patch: fix empty-pre-post cleanup algorithm
  - patch: add conditionals for btrfs library versions
  - Resolves: #1071973 #1142954


author: Ondrej Kozina <okozina@redhat.com> - 0.1.7-9
changelog:
  - patch: fix snapperd abort while passing large data over dbus
  - patch: workaround linkage issue on s390 and ppc64le
  - Resolves: #1229353


author: Ondrej Kozina <okozina@redhat.com> - 0.2.8-1
changelog:
  - Update to snapper 0.2.8
  - patch: rule out race while mounting lvm snapshot
  - Resolves: #1250371 #1262370


author: Paul Wouters <paul@nohats.ca> - 1.7.2.0-1
changelog:
  - Upgraded to 1.7.2.0 which allows tun/tap interfaces without IP address
    and introduces options openssl-compress and max-children.


author: Paul Wouters <pwouters@redhat.com> - 1.7.2.1-1
changelog:
  - Updated to 1.7.2.1 for CVE-2012-0219, rhbz#821553, rhbz#821688
  - Remove patch merged upstream
  - Remove --disable-fips from configure


author: Paul Wouters <pwouters@redhat.com> - 1.7.2.2-2
changelog:
  - Resolves: rhel#1017015 Use readline, not compat-readline5-devel
  - Added two patches fixing -Wformat issues
  - Enable hardened build
  - Cleanup obsolete spec file lines


author: Paul Wouters <pwouters@redhat.com> - 2.0.0b1-2
changelog:
  - Change install directory to /usr/lib*/pkcs11/
  - Install pkcs11 module file
  - Use official upstream tar ball
  - Create ods user to own softhsm/token files
  - Enable migration tools (for epel6 softhsm-v1 installs)
  - Require p11-kit, nss-tools, for SoftHSM PKCS #11 Module file
  - Copy pk11install.c from coolkey package which is not built on all arches
  - Enable hardened build
  - Add upstream official source url
  - Add devel package
  - Excluding i686/ppc (make check fails and we are a leave package)
  - (thanks to Petr for jumping in for the initial build while I was too busy)


author: Paul Wouters <pwouters@redhat.com> - 2.0.0b1-3
changelog:
  - Fix softhsm2-pk11install buid and post call
  - Do not use --with-objectstore-backend-db (causes issues on i686)


