# changelog

author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-514.rt7.303.el8]
changelog:
  - [rt] build kernel-rt-4.18.0-514.rt7.303.el8 [2180997]
  - redhat: fix to be able to build with rpm 4.19.0 (Denys Vlasenko)
  - redhat: add additional gating boot tests (Denys Vlasenko)
  - redhat: list Z-Jiras in the changelog before Y-Jiras (Herton R. Krzesinski)
  - scsi: st: Add third party poweron reset handling (John Meneghini) [1930388]
  - kvm: initialize all of the kvm_debugregs structure before sending it to userspace (Jon Maloy) [2179898] {CVE-2023-1513}
  - bpf: sockmap: Remove preempt_disable in sock_map_sk_acquire (Tomas Glozar) [2229965]
  - s390/ap: add ap status asynch error support (Tobias Huschle) [2110511]
  - s390/ap: implement SE AP bind, unbind and associate (Tobias Huschle) [2110511]
  - s390/ap: introduce low frequency polling possibility (Tobias Huschle) [2110511]
  - s390/ap: new low level inline functions ap_bapq() and ap_aapq() (Tobias Huschle) [2110511]
  - s390/ap: provide F bit parameter for ap_rapq() and ap_zapq() (Tobias Huschle) [2110511]
  - s390/ap: filter ap card functions, new queue functions attribute (Tobias Huschle) [2110511]
  - s390/ap: make tapq gr2 response a struct (Tobias Huschle) [2110511]
  - s390/ap: introduce new AP bus sysfs attribute features (Tobias Huschle) [2110511]
  - s390/ap: exploit new B bit from QCI config info (Tobias Huschle) [2110511]
  - s390/zcrypt: replace scnprintf with sysfs_emit (Tobias Huschle) [2110511]
  - s390/zcrypt: rework length information for dqap (Tobias Huschle) [2110511]
  - s390/zcrypt: make psmid unsigned long instead of long long (Tobias Huschle) [2110511]
  - s390/ap,zcrypt,vfio: introduce and use ap_queue_status_reg union (Tobias Huschle) [2110511]
  - s390/ap: fix status returned by ap_qact() (Tobias Huschle) [2110511]
  - s390/ap: fix status returned by ap_aqic() (Tobias Huschle) [2110511]
  - s390/ap: adjust whitespace (Tobias Huschle) [2110511]
  - s390/ap: use insn format for new instructions (Tobias Huschle) [2110511]
  - s390/zcrypt: Filter admin CPRBs on custom devices (Tobias Huschle) [2110511]
  - s390/zcrypt: Add admask to zcdn (Tobias Huschle) [2110511]
  - s390/zcrypt: CCA control CPRB sending (Tobias Huschle) [2110511]
  - s390/ap: add missing virt_to_phys address conversion (Tobias Huschle) [2110511]
  - s390/ap: get rid of register asm in ap_dqap() (Tobias Huschle) [2110511]
  - s390/ap: get rid of register asm (Tobias Huschle) [2110511]
  - s390/ap: Rework ap_dqap to deal with messages greater than recv buffer (Tobias Huschle) [2110511]
  - s390/ap: rework assembler functions to use unions for in/out register variables (Tobias Huschle) [2110511]
  - internal: add new files for RHEL_MINOR=10 change (Denys Vlasenko)
  - thunderbolt: Fix Thunderbolt 3 display flickering issue on 2nd hot plug onwards (Desnes Nunes) [2233974]
  - mm/userfaultfd: don't consider uffd-wp bit of writable migration entries (Rafael Aquini) [2231554]
  - mm/userfaultfd: fix uffd-wp handling for THP migration entries (Rafael Aquini) [2231554]
  - mm/userfaultfd: fix uffd-wp special cases for fork() (Rafael Aquini) [2231554]
  - mm/thp: simplify copying of huge zero page pmd when fork (Rafael Aquini) [2231554]
  - internal: update RHEL_MINOR for the start of RHEL-8.10 development (Denys Vlasenko)


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-515.rt7.304.el8]
changelog:
  - [rt] build kernel-rt-4.18.0-515.rt7.304.el8 [RHEL-5332]
  - s390/dasd: fix hanging device after quiesce/resume (Tobias Huschle) [RHEL-2838]
  - s390/dasd: fix hanging device after request requeue (Tobias Huschle) [RHEL-2830]
  - s390/dasd: fix command reject error on ESE devices (Tobias Huschle) [RHEL-2850]
  - s390/dasd: print copy pair message only for the correct error (Tobias Huschle) [RHEL-2831]
  - s390: add z16 elf platform (Tobias Huschle) [RHEL-2854]
  - s390/qeth: Don't call dev_close/dev_open (DOWN/UP) (Tobias Huschle) [RHEL-2410]
  - powerpc/kprobes: Fix null pointer reference in arch_prepare_kprobe() (Mamatha Inamdar) [2227601]
  - arm64: kdump: Remove custom linux,usable-memory-range handling (Baoquan He) [RHEL-2307]
  - arm64: kdump: Remove custom linux,elfcorehdr handling (Baoquan He) [RHEL-2307]
  - media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221 (Dean Nelson) [RHEL-1784] {CVE-2022-45919}
  - media: dvb-core: Fix use-after-free due to race at dvb_register_device() (Dean Nelson) [RHEL-1841] {CVE-2022-45884}
  - media: dvb-core: Fix use-after-free due on race condition at dvb_net (Dean Nelson) [RHEL-1842] {CVE-2022-45886}
  - media: dvb_ca_en50221: fix a size write bug (Dean Nelson) [RHEL-1784]
  - media: dvbdev: fix refcnt bug (Dean Nelson) [RHEL-1841]
  - media: dvbdev: adopts refcnt to avoid UAF (Dean Nelson) [RHEL-1841]
  - media: dvbdev: fix error logic at dvb_register_device() (Dean Nelson) [RHEL-1841]
  - media: dvb_net: avoid speculation from net slot (Dean Nelson) [RHEL-1842]
  - media: dvb_ca_en50221: avoid speculation from CA slot (Dean Nelson) [RHEL-1784]
  - media: dvbdev: Fix memleak in dvb_register_device (Dean Nelson) [RHEL-1841]
  - media: media/dvb: Use kmemdup rather than duplicating its implementation (Dean Nelson) [RHEL-1841]
  - media: dvbdev: remove double-unlock (Dean Nelson) [RHEL-1841]
  - media: dvb-core: fix epoll() by calling poll_wait first (Dean Nelson) [RHEL-1784]
  - media: dvb_ca_en50221: off by one in dvb_ca_en50221_io_do_ioctl() (Dean Nelson) [RHEL-1784]
  - drm/amd/display: fix the white screen issue when >= 64GB DRAM (Mika Penttilä) [2231934]
  - gfs2: conversion deadlock do_promote bypass (Bob Peterson) [2225228]
  - gfs2: do_promote cleanup (Andreas Gruenbacher) [2225228]
  - gfs2: Make use of list_is_first (Andreas Gruenbacher) [2225228]
  - x86/cpu: Enable STIBP on AMD if Automatic IBRS is enabled (Waiman Long) [2227916]
  - Documentation/hw-vuln: Document the interaction between IBRS and STIBP (Waiman Long) [2227916]
  - x86/CPU/AMD: Make sure EFER[AIBRSE] is set (Waiman Long) [2227916]
  - fs: don't audit the capability check in simple_xattr_list() (Andrey Albershteyn) [RHEL-863]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-516.rt7.305.el8]
changelog:
  - [rt] build kernel-rt-4.18.0-516.rt7.305.el8 [RHEL-5332]
  - bpf: Adjust insufficient default bpf_jit_limit (Viktor Malik) [2219567]
  - bpf: Prevent increasing bpf_jit_limit above max (Viktor Malik) [2219567]
  - NFS: Guard against READDIR loop when entry names exceed MAXNAMELEN (Benjamin Coddington) [2231130]
  - perf/arm-dmc620: Fix dmc620_pmu_irqs_lock/cpu_hotplug_lock circular lock dependency (Waiman Long) [2177103]
  - bonding: fix macvlan over alb bond support (Hangbin Liu) [2117816]
  - s390/ipl: add missing secure/has_secure file to ipl type 'unknown' (Tobias Huschle) [RHEL-2852]
  - s390/zcrypt: fix reply buffer calculations for CCA replies (Tobias Huschle) [2227778]
  - intel_th: pci: Add Meteor Lake-P support (Michael Petlan) [2156847]
  - perf/x86/rapl: Add support for Intel Meteor Lake (Michael Petlan) [2156816]
  - iavf: schedule a request immediately after add/delete vlan (Petr Oros) [2231174]
  - iavf: add iavf_schedule_aq_request() helper (Petr Oros) [2231174]
  - PCI: rpaphp: Error out on busy status from get-sensor-state (Mamatha Inamdar) [2230045]
  - powerpc/rtas: export rtas_error_rc() for reuse. (Mamatha Inamdar) [2230045]
  - powerpc/eeh: Set channel state after notifying the drivers (Mamatha Inamdar) [2230045]
  - s390/pkey: fix PKEY_TYPE_EP11_AES handling for sysfs attributes (Tobias Huschle) [2225520]
  - s390/pkey: fix PKEY_TYPE_EP11_AES handling in PKEY_VERIFYKEY2 IOCTL (Tobias Huschle) [2225520]
  - s390/pkey: fix PKEY_TYPE_EP11_AES handling in PKEY_KBLOB2PROTK[23] (Tobias Huschle) [2225520]
  - s390/pkey: fix PKEY_TYPE_EP11_AES handling in PKEY_CLR2SECK2 IOCTL (Tobias Huschle) [2225520]
  - s390/pkey: fix PKEY_TYPE_EP11_AES handling in PKEY_GENSECK2 IOCTL (Tobias Huschle) [2225520]
  - s390/pkey: fix/harmonize internal keyblob headers (Tobias Huschle) [2225520]
  - s390/pkey: add support for ecc clear key (Tobias Huschle) [2225520]
  - s390/pkey: do not use struct pkey_protkey (Tobias Huschle) [2225520]
  - s390/pkey: introduce reverse x-mas trees (Tobias Huschle) [2225520]
  - s390/pkey: zeroize key blobs (Tobias Huschle) [2225520]
  - md/raid1: fix error: ISO C90 forbids mixed declarations (Nigel Croxon) [RHEL-5084]
  - md raid1: allow writebehind to work on any leg device set WriteMostly (Nigel Croxon) [RHEL-5084]
  - md/raid1: hold the barrier until handle_read_error() finishes (Nigel Croxon) [RHEL-5084]
  - md/raid1: free the r1bio before waiting for blocked rdev (Nigel Croxon) [RHEL-5084]
  - md/raid1: call free_r1bio() before allow_barrier() in raid_end_bio_io() (Nigel Croxon) [RHEL-5084]
  - md/raid5-cache: fix null-ptr-deref for r5l_flush_stripe_to_raid() (Nigel Croxon) [RHEL-5084]
  - md/raid10: fix a 'conf->barrier' leakage in raid10_takeover() (Nigel Croxon) [RHEL-5084]
  - md: raid1: fix potential OOB in raid1_remove_disk() (Nigel Croxon) [RHEL-5084]
  - md/raid5-cache: fix a deadlock in r5l_exit_log() (Nigel Croxon) [RHEL-5084]
  - md/md-bitmap: hold 'reconfig_mutex' in backlog_store() (Nigel Croxon) [RHEL-5084]
  - md/md-bitmap: remove unnecessary local variable in backlog_store() (Nigel Croxon) [RHEL-5084]
  - md: restore 'noio_flag' for the last mddev_resume() (Nigel Croxon) [RHEL-5084]
  - md: don't quiesce in mddev_suspend() (Nigel Croxon) [RHEL-5084]
  - md: move initialization and destruction of 'io_acct_set' to md.c (Nigel Croxon) [RHEL-5084]
  - md: enhance checking in md_check_recovery() (Nigel Croxon) [RHEL-5084]
  - md: wake up 'resync_wait' at last in md_reap_sync_thread() (Nigel Croxon) [RHEL-5084]
  - md: refactor idle/frozen_sync_thread() to fix deadlock (Nigel Croxon) [RHEL-5084]
  - md: add a mutex to synchronize idle and frozen in action_store() (Nigel Croxon) [RHEL-5084]
  - md: refactor action_store() for 'idle' and 'frozen' (Nigel Croxon) [RHEL-5084]
  - Revert "md: unlock mddev before reap sync_thread in action_store" (Nigel Croxon) [RHEL-5084]
  - md/raid0: add discard support for the 'original' layout (Nigel Croxon) [RHEL-5084]
  - md/raid10: prevent soft lockup while flush writes (Nigel Croxon) [RHEL-5084]
  - md/raid10: fix io loss while replacement replace rdev (Nigel Croxon) [RHEL-5084]
  - md/raid10: Do not add spare disk when recovery fails (Nigel Croxon) [RHEL-5084]
  - md/raid10: clean up md_add_new_disk() (Nigel Croxon) [RHEL-5084]
  - md/raid10: prioritize adding disk to 'removed' mirror (Nigel Croxon) [RHEL-5084]
  - md/raid10: improve code of mrdev in raid10_sync_request (Nigel Croxon) [RHEL-5084]
  - md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request (Nigel Croxon) [RHEL-5084]
  - md/raid5: don't start reshape when recovery or replace is in progress (Nigel Croxon) [RHEL-5084]
  - md/bitmap: factor out a helper to set timeout (Nigel Croxon) [RHEL-5084]
  - md/bitmap: always wake up md_thread in timeout_store (Nigel Croxon) [RHEL-5084]
  - md: factor out a helper to wake up md_thread directly (Nigel Croxon) [RHEL-5084]
  - md/raid10: fix wrong setting of max_corr_read_errors (Nigel Croxon) [RHEL-5084]
  - md/raid10: fix overflow of md/safe_mode_delay (Nigel Croxon) [RHEL-5084]
  - md/raid5: fix a deadlock in the case that reshape is interrupted (Nigel Croxon) [RHEL-5084]
  - md: add a new api prepare_suspend() in md_personality (Nigel Croxon) [RHEL-5084]
  - md: export md_is_rdwr() and is_md_suspended() (Nigel Croxon) [RHEL-5084]
  - md: introduce md_ro_state (Nigel Croxon) [RHEL-5084]
  - md: fix data corruption for raid456 when reshape restart while grow up (Nigel Croxon) [RHEL-5084]
  - md/raid5: don't allow replacement while reshape is in progress (Nigel Croxon) [RHEL-5084]
  - md/raid10: check slab-out-of-bounds in md_bitmap_get_counter (Nigel Croxon) [RHEL-5084]
  - md: raid1: check if adding pages to resync bio fails (Nigel Croxon) [RHEL-5084]
  - md: raid1: use __bio_add_page for adding single page to bio (Nigel Croxon) [RHEL-5084]
  - md: check for failure when adding pages in alloc_behind_master_bio (Nigel Croxon) [RHEL-5084]
  - md: raid5: use __bio_add_page to add single page to new bio (Nigel Croxon) [RHEL-5084]
  - md: raid5-log: use __bio_add_page to add single page (Nigel Croxon) [RHEL-5084]
  - md: use __bio_add_page to add single page (Nigel Croxon) [RHEL-5084]
  - md/raid5: fix miscalculation of 'end_sector' in raid5_read_one_chunk() (Nigel Croxon) [RHEL-5084]
  - drm/i915: Do not disable preemption for resets (John B. Wyatt IV) [2212309 2213314]
  - drm/i915: Drop the irqs_disabled() check (John B. Wyatt IV) [2212309 2213314]
  - drm/i915/gt: Use spin_lock_irq() instead of local_irq_disable() + spin_lock() (John B. Wyatt IV) [2212309 2213314]
  - drm/i915/gt: Queue and wait for the irq_work item. (John B. Wyatt IV) [2212309 2213314]
  - drm/i915: Don't check for atomic context on PREEMPT_RT (John B. Wyatt IV) [2212309 2213314]
  - drm/i915: Don't disable interrupts on PREEMPT_RT during atomic updates (John B. Wyatt IV) [2212309 2213314]
  - drm/i915: Use preempt_disable/enable_rt() where recommended (John B. Wyatt IV) [2212309 2213314]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-517.rt7.306.el8]
changelog:
  - [rt] build kernel-rt-4.18.0-517.rt7.306.el8 [RHEL-5332]
  - Bluetooth: L2CAP: Fix u8 overflow (Wander Lairson Costa) [2152857] {CVE-2022-45934}
  - tracing/histograms: Fix parsing of "sym-offset" modifier (Jerome Marchand) [2229575]
  - ice: always add legacy 32byte RXDID in supported_rxdids (Michal Schmidt) [RHEL-3379]
  - task_work: cleanup notification modes (Audra Mitchell) [RHEL-1064]
  - perf test topology: Use !strncmp(right platform) to fix guest PPC comparision check (Michael Petlan) [2131821]
  - perf test session topology: Fix test to skip the test in guest environment (Michael Petlan) [2131821]
  - sched/fair: Block nohz tick_stop when cfs bandwidth in use (Phil Auld) [RHEL-2527]
  - sched, cgroup: Restore meaning to hierarchical_quota (Phil Auld) [RHEL-2527]
  - sched/fair: Hide unused init_cfs_bandwidth() stub (Phil Auld) [RHEL-2527]
  - rbd: take header_rwsem in rbd_dev_refresh() only when updating (Ilya Dryomov) [RHEL-11241]
  - rbd: decouple parent info read-in from updating rbd_dev (Ilya Dryomov) [RHEL-11241]
  - rbd: decouple header read-in from updating rbd_dev->header (Ilya Dryomov) [RHEL-11241]
  - rbd: move rbd_dev_refresh() definition (Ilya Dryomov) [RHEL-11241]
  - redhat: list Z-Jiras in the changelog before Y-Jiras (Herton R. Krzesinski)
  - Revert "mm, meminit: recalculate pcpu batch and high limits after init completes" (Chris von Recklinghausen) [RHEL-8539]
  - Revert "mm,memory_hotplug: factor out adjusting present pages into adjust_present_page_count()" (Chris von Recklinghausen) [RHEL-8539]
  - Revert "mm/page_alloc: move free_the_page" (Chris von Recklinghausen) [RHEL-8539]
  - Revert "mm/page_alloc: allow high-order pages to be stored on the per-cpu lists" (Chris von Recklinghausen) [RHEL-8539]
  - Revert "mm/page_alloc: fetch the correct pcp buddy during bulk free" (Chris von Recklinghausen) [RHEL-8539]
  - Revert "mm/page_alloc: track range of active PCP lists during bulk free" (Chris von Recklinghausen) [RHEL-8539]
  - Revert "mm/page_alloc: simplify how many pages are selected per pcp list during bulk free" (Chris von Recklinghausen) [RHEL-8539]
  - Revert "mm/page_alloc: drain the requested list first during bulk free" (Chris von Recklinghausen) [RHEL-8539]
  - Revert "mm/page_alloc: free pages in a single pass during bulk free" (Chris von Recklinghausen) [RHEL-8539]
  - Revert "mm/page_alloc: do not prefetch buddies during bulk free" (Chris von Recklinghausen) [RHEL-8539]
  - Revert "mm/page_alloc: check high-order pages for corruption during PCP operations" (Chris von Recklinghausen) [RHEL-8539]
  - Revert "mm/page_alloc: fix incorrect PGFREE and PGALLOC for high-order page" (Chris von Recklinghausen) [RHEL-8539]
  - Revert "cnic: Use the bitmap API to allocate bitmaps" (Chris Leech) [RHEL-1950]
  - Revert "cnic: don't pass bogus GFP_ flags to dma_alloc_coherent" (Chris Leech) [RHEL-1950]
  - scsi: lpfc: Prevent use-after-free during rmmod with mapped NVMe rports (Paul Ely) [RHEL-2602]
  - scsi: lpfc: Early return after marking final NLP_DROPPED flag in dev_loss_tmo (Paul Ely) [RHEL-2602]
  - gfs2: Add quota_change type (Bob Peterson) [2224075]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-518.rt7.307.el8]
changelog:
  - [rt] build kernel-rt-4.18.0-518.rt7.307.el8 [RHEL-5332]
  - trace: Add trace_ipi_send_cpu() (Jerome Marchand) [2192614]
  - sched, smp: Trace smp callback causing an IPI (Jerome Marchand) [2192614]
  - smp: reword smp call IPI comment (Jerome Marchand) [2192614]
  - treewide: Trace IPIs sent via smp_send_reschedule() (Jerome Marchand) [2192614]
  - irq_work: Trace self-IPIs sent via arch_irq_work_raise() (Jerome Marchand) [2192614]
  - smp: Trace IPIs sent via arch_send_call_function_ipi_mask() (Jerome Marchand) [2192614]
  - sched, smp: Trace IPIs sent via send_call_function_single_ipi() (Jerome Marchand) [2192614]
  - trace: Add trace_ipi_send_cpumask() (Jerome Marchand) [2192614]
  - RDMA/umem: Set iova in ODP flow (Kamal Heib) [RHEL-1032]
  - RDMA/core: Update CMA destination address on rdma_resolve_addr (Kamal Heib) [RHEL-1032]
  - RDMA/core: Refactor rdma_bind_addr (Kamal Heib) [RHEL-1032]
  - RDMA/cma: Remove NULL check before dev_{put, hold} (Kamal Heib) [RHEL-1032]
  - IB/isert: Fix possible list corruption in CMA handler (Kamal Heib) [RHEL-1028]
  - IB/isert: Fix dead lock in ib_isert (Kamal Heib) [RHEL-1028]
  - RDMA/srpt: Add a check for valid 'mad_agent' pointer (Kamal Heib) [RHEL-1028]
  - IB/iser: remove redundant new line (Kamal Heib) [RHEL-1028]
  - IB/iser: centralize setting desc type and done callback (Kamal Heib) [RHEL-1028]
  - IB/iser: remove unused macros (Kamal Heib) [RHEL-1028]
  - IB/uverbs: Fix to consider event queue closing also upon non-blocking mode (Kamal Heib) [RHEL-1028]
  - RDMA/uverbs: Restrict usage of privileged QKEYs (Kamal Heib) [RHEL-1028]
  - RDMA/cma: Always set static rate to 0 for RoCE (Kamal Heib) [RHEL-1028]
  - RDMA/core: Fix GID entry ref leak when create_ah fails (Kamal Heib) [RHEL-1028]
  - RDMA/cm: Trace icm_send_rej event before the cm state is reset (Kamal Heib) [RHEL-1028]
  - RDMA/cma: Remove NULL check before dev_{put, hold} (Kamal Heib) [RHEL-1028]
  - RDMA/core: Fix multiple -Warray-bounds warnings (Kamal Heib) [RHEL-1028]
  - RDMA/cma: Allow UD qp_type to join multicast only (Kamal Heib) [RHEL-1028]
  - md/raid5: release batch_last before waiting for another stripe_head (Nigel Croxon) [RHEL-9875]
  - CI: Remove unused kpet_tree_family (Nikolai Kondrashov)
  - ice: Don't tx before switchdev is fully configured (Michal Schmidt) [RHEL-10997]
  - fbcon: set_con2fb_map needs to set con2fb_map! (Wander Lairson Costa) [RHEL-1183] {CVE-2023-38409}
  - fbcon: Fix error paths in set_con2fb_map (Wander Lairson Costa) [RHEL-1183] {CVE-2023-38409}
  - mm/slab_common: fix slab_caches list corruption after kmem_cache_destroy() (Rafael Aquini) [RHEL-3652]
  - sched/rt: Fix bad task migration for rt tasks (Valentin Schneider) [RHEL-3872]
  - RDMA/irdma: Prevent zero-length STAG registration (Kamal Heib) [RHEL-6389] {CVE-2023-25775}
  - mm/memcontrol: export memcg.swap watermark via sysfs for v2 memcg (Waiman Long) [RHEL-10099]
  - cgroup: add pids.peak interface for pids controller (Waiman Long) [RHEL-10099]
  - mm/memcontrol: export memcg->watermark via sysfs for v2 memcg (Waiman Long) [RHEL-10099]
  - cpufreq: amd-pstate: fix global sysfs attribute type (Prarit Bhargava) [2218687]
  - cpufreq: amd-pstate: Add a kernel config option to set default mode (Prarit Bhargava) [2218687]
  - cpufreq: amd-pstate: Set a fallback policy based on preferred_profile (Prarit Bhargava) [2218687]
  - ACPI: CPPC: Add definition for undefined FADT preferred PM profile value (Prarit Bhargava) [2218687]
  - cpufreq: amd-pstate: Make amd-pstate EPP driver name hyphenated (Prarit Bhargava) [2218687]
  - cpufreq: amd-pstate: Write CPPC enable bit per-socket (Prarit Bhargava) [2218687]
  - cpufreq: amd-pstate: Update policy->cur in amd_pstate_adjust_perf() (Prarit Bhargava) [2218687]
  - cpufreq: amd-pstate: Remove fast_switch_possible flag from active driver (Prarit Bhargava) [2218687]
  - cpufreq: amd-pstate: Add ->fast_switch() callback (Prarit Bhargava) [2218687]
  - cpufreq: amd-pstate: Make varaiable mode_state_machine static (Prarit Bhargava) [2218687]
  - cpufreq: amd-pstate: Add guided mode control support via sysfs (Prarit Bhargava) [2218687]
  - amd-pstate: Fix amd_pstate mode switch (Prarit Bhargava) [2218687]
  - cpufreq: amd-pstate: Add guided autonomous mode (Prarit Bhargava) [2218687]
  - ACPI: CPPC: Add auto select register read/write support (Prarit Bhargava) [2218687]
  - cpufreq: amd-pstate: move to use bus_get_dev_root() (Prarit Bhargava) [2218687]
  - cpufreq: amd-pstate: remove MODULE_LICENSE in non-modules (Prarit Bhargava) [2218687]
  - cpufreq: amd-pstate: Let user know amd-pstate is disabled (Prarit Bhargava) [2218687]
  - cpufreq: amd-pstate: Fix invalid write to MSR_AMD_CPPC_REQ (Prarit Bhargava) [2218687]
  - cpufreq: amd-pstate: avoid uninitialized variable use (Prarit Bhargava) [2218687]
  - cpufreq: amd-pstate: convert sprintf with sysfs_emit() (Prarit Bhargava) [2218687]
  - cpufreq: amd-pstate: add driver working mode switch support (Prarit Bhargava) [2218687]
  - cpufreq: amd-pstate: implement suspend and resume callbacks (Prarit Bhargava) [2218687]
  - cpufreq: amd-pstate: implement amd pstate cpu online and offline callback (Prarit Bhargava) [2218687]
  - cpufreq: amd-pstate: implement Pstate EPP support for the AMD processors (Prarit Bhargava) [2218687]
  - cpufreq: amd-pstate: optimize driver working mode selection in amd_pstate_param() (Prarit Bhargava) [2218687]
  - ACPI: CPPC: Add AMD pstate energy performance preference cppc control (Prarit Bhargava) [2218687]
  - cpufreq: amd-pstate: fix kernel hang issue while amd-pstate unregistering (Prarit Bhargava) [2218687]
  - cpufreq: amd-pstate: Fix initial highest_perf value (Prarit Bhargava) [2218687]
  - cpufreq: amd-pstate: Expose struct amd_cpudata (Prarit Bhargava) [2218687]
  - cpufreq: amd-pstate: update pstate frequency transition delay time (Prarit Bhargava) [2218687]
  - cpufreq: amd_pstate: map desired perf into pstate scope for powersave governor (Prarit Bhargava) [2218687]
  - cpufreq: amd_pstate: fix wrong lowest perf fetch (Prarit Bhargava) [2218687]
  - cpufreq: amd-pstate: fix white-space (Prarit Bhargava) [2218687]
  - cpufreq: amd-pstate: simplify cpudata pointer assignment (Prarit Bhargava) [2218687]
  - locking: revert comment from KRTS JiraReadiness exercise (Eirik Fuller) [RHEL-11976]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-519.rt7.308.el8]
changelog:
  - [rt] build kernel-rt-4.18.0-519.rt7.308.el8 [RHEL-5332]
  - redhat: remove kabi-rhel810 directory (Prarit Bhargava)
  - redhat: Update .gitignore for 8.10 kabi files (Prarit Bhargava)
  - nvmet-tcp: Fix a possible UAF in queue intialization setup (John Meneghini) [RHEL-11509 RHEL-11527] {CVE-2023-5178}
  - sctp: update hb timer immediately after users change hb_interval (Xin Long) [RHEL-6045]
  - s390/zcrypt_ep11misc: support API ordinal 6 with empty pin-blob (Tobias Huschle) [RHEL-11200]
  - net: openvswitch: add support for l4 symmetric hashing (Antoine Tenart) [RHEL-10498]
  - igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU (Hangbin Liu) [RHEL-10475 RHEL-10477] {CVE-2023-42752}
  - ip_tunnel: Preserve pointer const in ip_tunnel_info_opts (Ivan Vecera) [RHEL-12418]
  - tracing: Fix race in perf_trace_buf initialization (Michael Petlan) [RHEL-8648]
  - Input: gtco - bounds check collection indent level (Desnes Nunes) [RHEL-3014 RHEL-3892] {CVE-2019-13631}
  - x86/microcode/AMD: Rip out static buffers (Prarit Bhargava) [2225261]
  - perf/x86/amd: Do not WARN() on every IRQ (Michael Petlan) [RHEL-12340]
  - netfilter: conntrack: Fix gre tunneling over ipv6 (Florian Westphal) [RHEL-12497]
  - netfilter: handle the connecting collision properly in nf_conntrack_proto_sctp (Xin Long) [RHEL-6157]
  - sctp: update transport state when processing a dupcook packet (Xin Long) [RHEL-6157]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-520.rt7.309.el8]
changelog:
  - [rt] build kernel-rt-4.18.0-520.rt7.309.el8 [RHEL-5332]
  - kernel/rh_messages.c: move hardware tables to rh_messages.h (Scott Weaver) [2181912]
  - kernel/rh_messages.c: Wire up new calls (Prarit Bhargava) [2181912]
  - drivers/pci: Update rh_messages.c (Prarit Bhargava) [2181912]
  - treewide: Remove mark_driver_deprecated() (Prarit Bhargava) [2181912]
  - treewide: Remove mark_hardware_deprecated() (Prarit Bhargava) [2181912]
  - treewide: Remove mark_driver_unmaintained() (Prarit Bhargava) [2181912]
  - drivers/pci: Remove RHEL-only pci_hw_*() functions (Prarit Bhargava) [2181912]
  - treewide: Remove pci_hw_disabled() calls (Prarit Bhargava) [2181912]
  - treewide: Remove pci_hw_deprecated() calls (Prarit Bhargava) [2181912]
  - treewide: Remove pci_hw_unmaintained() calls (Prarit Bhargava) [2181912]
  - redhat: fix bug/zjira sort in the changelog (Patrick Talbert)
  - blk-mq: enforce op-specific segment limits in blk_insert_cloned_request (Ming Lei) [RHEL-14504]
  - tunnels: fix kasan splat when generating ipv4 pmtu error (Guillaume Nault) [RHEL-14377]
  - net:ipv6: check return value of pskb_trim() (Guillaume Nault) [RHEL-14377]
  - sit: update dev->needed_headroom in ipip6_tunnel_bind_dev() (Guillaume Nault) [RHEL-14377]
  - ipv4: fix null-deref in ipv4_link_failure (Felix Maurer) [RHEL-5427] {CVE-2023-42754}
  - powerpc/perf/hv-24x7: Update domain value check (Michael Petlan) [RHEL-13718]
  - vxlan: Expose helper vxlan_build_gbp_hdr (Izabela Bakollari) [RHEL-12413]
  - vxlan: Remove unused argument from vxlan_build_gbp_hdr( ) and vxlan_build_gpe_hdr( ) (Izabela Bakollari) [RHEL-12413]
  - net: ipv4: fix one memleak in __inet_del_ifa() (Guillaume Nault) [RHEL-14375]
  - ipv4: Fix potential uninit variable access bug in __ip_make_skb() (Guillaume Nault) [RHEL-14375]
  - icmp: guard against too small mtu (Guillaume Nault) [RHEL-14375]
  - ipv6: ping: fix wrong checksum for large frames (Guillaume Nault) [RHEL-14375]
  - net: ipv6/addrconf: avoid integer underflow in ipv6_create_tempaddr (Hangbin Liu) [RHEL-13954]
  - ip6mr: Fix skb_under_panic in ip6mr_cache_report() (Hangbin Liu) [RHEL-13954]
  - ipv6 addrconf: fix bug where deleting a mngtmpaddr can create a new temporary address (Hangbin Liu) [RHEL-13954]
  - ipv6/addrconf: fix a potential refcount underflow for idev (Hangbin Liu) [RHEL-13954]
  - icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev(). (Hangbin Liu) [RHEL-13954]
  - ping6: Fix send to link-local addresses with VRF. (Hangbin Liu) [RHEL-13954]
  - ipv6: Fix out-of-bounds access in ipv6_find_tlv() (Hangbin Liu) [RHEL-13954]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-521.rt7.310.el8]
changelog:
  - [rt] build kernel-rt-4.18.0-521.rt7.310.el8 [RHEL-5332]
  - team: fix null-ptr-deref when team device type is changed (Hangbin Liu) [RHEL-13961]
  - team: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves (Hangbin Liu) [RHEL-13961]
  - team: reset team's flags when down link is P2P device (Hangbin Liu) [RHEL-13961]
  - teaming: deliver link-local packets with the link they arrive on (Hangbin Liu) [RHEL-13961]
  - kernfs: change kernfs_rename_lock into a read-write lock. (Ian Kent) [RHEL-11484]
  - kernfs: Separate kernfs_pr_cont_buf and rename_lock. (Ian Kent) [RHEL-11484]
  - kernfs: fix missing kernfs_iattr_rwsem locking (Ian Kent) [RHEL-11484]
  - kernfs: Use a per-fs rwsem to protect per-fs list of kernfs_super_info (Ian Kent) [RHEL-11484]
  - kernfs: Introduce separate rwsem to protect inode attributes (Ian Kent) [RHEL-11484]
  - kernfs: move struct kernfs_root out of the public view. (Ian Kent) [RHEL-11484]
  - iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry() (Kamal Heib) [RHEL-1734]
  - RDMA/cxgb4: Fix potential null-ptr-deref in pass_establish() (Kamal Heib) [RHEL-1734]
  - RDMA/cxgb4: add null-ptr-check after ip_dev_find() (Kamal Heib) [RHEL-1734]
  - RDMA/cxgb4: Replace 0-length arrays with flexible arrays (Kamal Heib) [RHEL-1734]
  - RDMA/cxgb4: remove unnecessary NULL check in __c4iw_poll_cq_one() (Kamal Heib) [RHEL-1734]
  - block: check_events: don't bother with events if unsupported (Ming Lei) [RHEL-2407]
  - Revert "block: unexport DISK_EVENT_MEDIA_CHANGE for legacy/fringe drivers" (Ming Lei) [RHEL-2407]
  - Revert "ide: unexport DISK_EVENT_MEDIA_CHANGE for ide-gd and ide-cd" (Ming Lei) [RHEL-2407]
  - block: disk_events: introduce event flags (Ming Lei) [RHEL-2407]
  - block: genhd: remove async_events field (Ming Lei) [RHEL-2407]
  - ibmvnic: Ensure login failure recovery is safe from other resets (Mamatha Inamdar) [RHEL-11211]
  - ibmvnic: Do partial reset on login failure (Mamatha Inamdar) [RHEL-11211]
  - ibmvnic: Handle DMA unmapping of login buffs in release functions (Mamatha Inamdar) [RHEL-11211]
  - ibmvnic: Unmap DMA login rsp buffer on send login fail (Mamatha Inamdar) [RHEL-11211]
  - ibmvnic: Enforce stronger sanity checks on login response (Mamatha Inamdar) [RHEL-11211]
  - ibmvnic: Free rwi on reset success (Mamatha Inamdar) [RHEL-11211]
  - selftests: tls: swap the TX and RX sockets in some tests (Hangbin Liu) [RHEL-13962]
  - selftests: mirror_gre_changes: Tighten up the TTL test match (Hangbin Liu) [RHEL-13962]
  - selftests: forwarding: tc_tunnel_key: Make filters more specific (Hangbin Liu) [RHEL-13962]
  - selftests: forwarding: tc_flower: Relax success criterion (Hangbin Liu) [RHEL-13962]
  - selftests: forwarding: ethtool_extended_state: Skip when using veth pairs (Hangbin Liu) [RHEL-13962]
  - selftests: forwarding: ethtool: Skip when using veth pairs (Hangbin Liu) [RHEL-13962]
  - selftests: forwarding: Add a helper to skip test when using veth pairs (Hangbin Liu) [RHEL-13962]
  - selftests: forwarding: Set default IPv6 traceroute utility (Hangbin Liu) [RHEL-13962]
  - selftests: forwarding: Switch off timeout (Hangbin Liu) [RHEL-13962]
  - selftests: forwarding: Skip test when no interfaces are specified (Hangbin Liu) [RHEL-13962]
  - selftests: rtnetlink: remove netdevsim device after ipsec offload test (Hangbin Liu) [RHEL-13962]
  - selftests: forwarding: Fix race condition in mirror installation (Hangbin Liu) [RHEL-13962]
  - selftests: fib_tests: mute cleanup error message (Hangbin Liu) [RHEL-13962]
  - sched/topology: Align group flags when removing degenerate domain (Phil Auld) [RHEL-2524]
  - sched/fair: Use recent_used_cpu to test p->cpus_ptr (Phil Auld) [RHEL-2524]
  - sched/core: Avoid double calling update_rq_clock() in __balance_push_cpu_stop() (Phil Auld) [RHEL-2524]
  - sched/core: Fixed missing rq clock update before calling set_rq_offline() (Phil Auld) [RHEL-2524]
  - sched/topology: Mark set_sched_topology() __init (Phil Auld) [RHEL-2524]
  - sched/wait: Fix a kthread_park race with wait_woken() (Phil Auld) [RHEL-2524]
  - sched: Add schedule_user() declaration (Phil Auld) [RHEL-2524]
  - sched/topology: Propagate SMT flags when removing degenerate domain (Phil Auld) [RHEL-2524]
  - sched_getaffinity: don't assume 'cpumask_size()' is fully initialized (Phil Auld) [RHEL-2524]
  - sched/topology: Make sched_energy_mutex,update static (Phil Auld) [RHEL-2524]
  - sched/fair: Fix inaccurate tally of ttwu_move_affine (Phil Auld) [RHEL-2524]
  - sched/fair: Revise comment about lb decision matrix (Phil Auld) [RHEL-2524]
  - sched/topology: Remove unused numa_distance in cpu_attach_domain() (Phil Auld) [RHEL-2524]
  - perf vendor events: Update metric events for power10 platform (Mamatha Inamdar) [RHEL-11205]
  - perf vendor events: Update metric event names for power10 platform (Mamatha Inamdar) [RHEL-11205]
  - perf vendor events: Update JSON/events for power10 platform (Mamatha Inamdar) [RHEL-11205]
  - perf vendor events: Move JSON/events to appropriate files for power10 platform (Mamatha Inamdar) [RHEL-11205]
  - perf vendor events: Drop STORES_PER_INST metric event for power10 platform (Mamatha Inamdar) [RHEL-11205]
  - perf vendor events: Drop some of the JSON/events for power10 platform (Mamatha Inamdar) [RHEL-11205]
  - perf vendor events: Update the JSON/events descriptions for power10 platform (Mamatha Inamdar) [RHEL-11205]
  - perf vendor events power10: Add JSON metric events to present CPI stall cycles in powerpc (Mamatha Inamdar) [RHEL-11205]
  - docs: ABI: sysfs-bus-event_source-devices-hv_gpci: Document affinity_domain_via_partition sysfs interface file (Mamatha Inamdar) [RHEL-11205]
  - powerpc/hv_gpci: Add sysfs file inside hv_gpci device to show affinity domain via partition information (Mamatha Inamdar) [RHEL-11205]
  - docs: ABI: sysfs-bus-event_source-devices-hv_gpci: Document affinity_domain_via_domain sysfs interface file (Mamatha Inamdar) [RHEL-11205]
  - powerpc/hv_gpci: Add sysfs file inside hv_gpci device to show affinity domain via domain information (Mamatha Inamdar) [RHEL-11205]
  - docs: ABI: sysfs-bus-event_source-devices-hv_gpci: Document affinity_domain_via_virtual_processor sysfs interface file (Mamatha Inamdar) [RHEL-11205]
  - powerpc/hv_gpci: Add sysfs file inside hv_gpci device to show affinity domain via virtual processor information (Mamatha Inamdar) [RHEL-11205]
  - docs: ABI: sysfs-bus-event_source-devices-hv_gpci: Document processor_config sysfs interface file (Mamatha Inamdar) [RHEL-11205]
  - powerpc/hv_gpci: Add sysfs file inside hv_gpci device to show processor config information (Mamatha Inamdar) [RHEL-11205]
  - docs: ABI: sysfs-bus-event_source-devices-hv_gpci: Document processor_bus_topology sysfs interface file (Mamatha Inamdar) [RHEL-11205]
  - powerpc/hv_gpci: Add sysfs file inside hv_gpci device to show processor bus topology information (Mamatha Inamdar) [RHEL-11205]
  - KVM: x86: Add SBPB support (Waiman Long) [RHEL-11272 RHEL-9298]
  - KVM: x86: Add IBPB_BRTYPE support (Waiman Long) [RHEL-11272 RHEL-9298]
  - x86/retpoline: Document some thunk handling aspects (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Remove unnecessary semicolon (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/rethunk: Use SYM_CODE_START[_LOCAL]_NOALIGN macros (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Disentangle rethunk-dependent options (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Move retbleed IBPB check into existing 'has_microcode' code block (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/bugs: Remove default case for fully switched enums (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Remove 'pred_cmd' label (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Unexport untraining functions (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Improve i-cache locality for alias mitigation (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Fix vulnerability reporting for missing microcode (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Print mitigation for retbleed IBPB case (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Print actual mitigation if requested mitigation isn't possible (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Fix SBPB enablement for (possible) future fixed HW (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/alternatives: Remove faulty optimization (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Fix SBPB enablement for spec_rstack_overflow=off (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Don't probe microcode in a guest (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Set CPUID feature bits independently of bug or mitigation status (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Fix srso_show_state() side effect (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/cpu: Fix amd_check_microcode() declaration (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/CPU/AMD: Remove amd_get_topology_early() (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Correct the mitigation status when SMT is disabled (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Explain the untraining sequences a bit more (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/cpu/kvm: Provide UNTRAIN_RET_VM (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/cpu: Cleanup the untrain mess (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/cpu: Rename srso_(.*)_alias to srso_alias_\1 (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/cpu: Rename original retbleed methods (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/cpu: Clean up SRSO return thunk mess (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/alternative: Make custom return thunk unconditional (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - objtool/x86: Fix SRSO mess (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/cpu: Fix up srso_safe_ret() and __x86_return_thunk() (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/cpu: Fix __x86_return_thunk symbol type (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/retpoline,kprobes: Fix position of thunk sections with CONFIG_LTO_CLANG (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Disable the mitigation on unaffected configurations (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/CPU/AMD: Fix the DIV(0) initial fix attempt (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20588}
  - x86/retpoline: Don't clobber RFLAGS during srso_safe_ret() (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/cpu/amd: Enable Zenbleed fix for AMD Custom APU 0405 (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20593}
  - driver core: cpu: Fix the fallback cpu_show_gds() name (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86: Move gds_ucode_mitigated() declaration to header (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/speculation: Add cpu_show_gds() prototype (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - driver core: cpu: Make cpu_show_not_affected() static (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Fix build breakage with the LLVM linker (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - Documentation/srso: Document IBPB aspect and fix formatting (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - driver core: cpu: Unify redundant silly stubs (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/CPU/AMD: Do not leak quotient data after a division by 0 (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20588}
  - x86/srso: Tie SBPB bit setting to microcode patch detection (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Add a forgotten NOENDBR annotation (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Fix return thunks in generated code (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Add IBPB on VMEXIT (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Add IBPB (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Add SRSO_NO support (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Add IBPB_BRTYPE support (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Add a Speculative RAS Overflow mitigation (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/retbleed: Add __x86_return_thunk alignment checks (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/retbleed: Fix return thunk alignment (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/alternative: Optimize returns patching (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/microcode/AMD: Load late on both threads too (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86/returnthunk: Allow different return thunks (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - x86: Sanitize linker script (Waiman Long) [RHEL-11272 RHEL-9298] {CVE-2023-20569}
  - objtool: Fix .return_sites generation (Waiman Long) [RHEL-11272 RHEL-9298]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-522.rt7.311.el8]
changelog:
  - [rt] build kernel-rt-4.18.0-522.rt7.311.el8 [RHEL-5332]
  - netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c (Florian Westphal) [RHEL-8444] {CVE-2023-42753}
  - cxgb4: fix use after free bugs caused by circular dependency problem (Ricardo Robaina) [RHEL-6261 RHEL-7058] {CVE-2023-4133}
  - ipvs: queue delayed work to expire no destination connections if expire_nodest_conn=1 (Florian Westphal) [RHEL-5742]
  - bpf: Fix incorrect verifier pruning due to missing register precision taints (Artem Savkov) [RHEL-7534 RHEL-7535] {CVE-2023-2163}
  - mm/memcontrol.c: remove the redundant updating of stats_flush_threshold (Waiman Long) [2238379]
  - virtio_balloon: Fix endless deflation and inflation on arm64 (Gavin Shan) [RHEL-1672]
  - i40e: Fix VF VLAN offloading when port VLAN is configured (Ivan Vecera) [RHEL-6384]
  - libfs: take cursors out of list when moving past the end of directory (Jeffrey Layton) [RHEL-15148]
  - net/core: Fix ETH_P_1588 flow dissector (Paolo Abeni) [RHEL-14379]
  - skbuff: skb_segment, Call zero copy functions before using skbuff frags (Paolo Abeni) [RHEL-14379]
  - net: prevent skb corruption on frag list segmentation (Paolo Abeni) [RHEL-14379]
  - udp6: Fix race condition in udp6_sendmsg & connect (Paolo Abeni) [RHEL-14379]
  - scsi: megaraid_sas: Driver version update to 07.727.03.00-rc1 (Tomas Henzl) [RHEL-8244]
  - scsi: megaraid_sas: Log message when controller reset is requested but not issued (Tomas Henzl) [RHEL-8244]
  - scsi: megaraid_sas: Increase register read retry rount from 3 to 30 for selected registers (Tomas Henzl) [RHEL-8244]
  - scsi: megaraid_sas: Fix deadlock on firmware crashdump (Tomas Henzl) [RHEL-8244]
  - scsi: megaraid_sas: Use pci_dev_id() to simplify the code (Tomas Henzl) [RHEL-8244]
  - scsi: megaraid_sas: Convert union megasas_sgl to flex-arrays (Tomas Henzl) [RHEL-8244]
  - scsi: smartpqi: Change driver version to 2.1.24-046 (Don Brace) [RHEL-1728]
  - scsi: smartpqi: Enhance error messages (Don Brace) [RHEL-1728]
  - scsi: smartpqi: Enhance controller offline notification (Don Brace) [RHEL-1728]
  - scsi: smartpqi: Enhance shutdown notification (Don Brace) [RHEL-1728]
  - scsi: smartpqi: Simplify lun_number assignment (Don Brace) [RHEL-1728]
  - scsi: smartpqi: Rename pciinfo to pci_info (Don Brace) [RHEL-1728]
  - scsi: smartpqi: Rename MACRO to clarify purpose (Don Brace) [RHEL-1728]
  - scsi: smartpqi: Add abort handler (Don Brace) [RHEL-1728]
  - x86/sgx: mark as supported (Vladis Dronov) [2041881]
  - x86/sgx: Resolves SECS reclaim vs. page fault for EAUG race (Vladis Dronov) [2041881]
  - x86/sgx: Break up long non-preemptible delays in sgx_vepc_release() (Vladis Dronov) [2041881]
  - Documentation: Fix typos (only the SGX part) (Vladis Dronov) [2041881]
  - x86/sgx: Avoid using iterator after loop in sgx_mmu_notifier_release() (Vladis Dronov) [2041881]
  - selftests/sgx: Add "test_encl.elf" to TEST_FILES (Vladis Dronov) [2041881]
  - convert sgx_set_attribute() to fdget()/fdput() (Vladis Dronov) [2041881]
  - x86/sgx: use VM_ACCESS_FLAGS (Vladis Dronov) [2041881]
  - x86/sgx: Replace kmap/kunmap_atomic() calls (Vladis Dronov) [2041881]
  - x86/sgx: Allow enclaves to use Asynchrounous Exit Notification (Vladis Dronov) [2041881]
  - x86/sgx: Reduce delay and interference of enclave release (Vladis Dronov) [2041881]
  - x86/vdso: Conditionally export __vdso_sgx_enter_enclave() (Vladis Dronov) [2041881]
  - x86/sgx: Add overflow check in sgx_validate_offset_length() (Vladis Dronov) [2041881]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-523.rt7.312.el8]
changelog:
  - [rt] build kernel-rt-4.18.0-523.rt7.312.el8 [RHEL-5332]
  - cifs: Fix UAF in cifs_demultiplex_thread() (Scott Mayhew) [RHEL-7930 RHEL-9046] {CVE-2023-1192}
  - x86/platform/uv: Use alternate source for socket to node data (Frank Ramsay) [RHEL-13360]
  - media: technisat-usb2: break out of loop at end of buffer (Desnes Nunes) [RHEL-3013 RHEL-3895] {CVE-2019-15505}
  - can: af_can: fix NULL pointer dereference in can_rcv_filter (Ricardo Robaina) [RHEL-6429 RHEL-7053] {CVE-2023-2166}
  - PCI/portdrv: Prevent LS7A Bus Master clearing on shutdown (Myron Stowe) [RHEL-5147]
  - kernel/fork: beware of __put_task_struct() calling context (Wander Lairson Costa) [RHEL-14767]
  - KVM: x86/mmu: Fix an sign-extension bug with mmu_seq that hangs vCPUs (Peter Xu) [RHEL-7210]
  - net: tun: fix bugs for oversize packet when napi frags enabled (Ricardo Robaina) [RHEL-7185 RHEL-7267] {CVE-2023-3812}
  - Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO (Jose Ignacio Tornos Martinez) [RHEL-6357] {CVE-2023-31083}
  - RDMA/qedr: clean up work queue on failure in qedr_alloc_resources() (Kamal Heib) [RHEL-10313 RHEL-11030]
  - RDMA/qedr: fix repeated words in comments (Kamal Heib) [RHEL-10313 RHEL-11030]
  - x86/sev: Check for user-space IOIO pointing to kernel space (Wander Lairson Costa) [RHEL-14978] {CVE-2023-46813}
  - x86/sev: Check IOBM for IOIO exceptions from user-space (Wander Lairson Costa) [RHEL-14978] {CVE-2023-46813}
  - x86/sev: Disable MMIO emulation from user mode (Wander Lairson Costa) [RHEL-14978] {CVE-2023-46813}
  - x86/sev-es: Fix SEV-ES OUT/IN immediate opcode vc handling (Wander Lairson Costa) [RHEL-14978] {CVE-2023-46813}
  - USB: core: Fix oversight in SuperSpeed initialization (Desnes Nunes) [RHEL-2569 RHEL-2675] {CVE-2023-37453}
  - USB: core: Fix race by not overwriting udev->descriptor in hub_port_init() (Desnes Nunes) [RHEL-2569 RHEL-2675] {CVE-2023-37453}
  - USB: core: Change usb_get_device_descriptor() API (Desnes Nunes) [RHEL-2569 RHEL-2675] {CVE-2023-37453}
  - USB: core: Unite old scheme and new scheme descriptor reads (Desnes Nunes) [RHEL-2569 RHEL-2675] {CVE-2023-37453}
  - bonding: do not assume skb mac_header is set (Hangbin Liu) [RHEL-13959]
  - bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves (Hangbin Liu) [RHEL-13959]
  - bonding: support balance-alb with openvswitch (Hangbin Liu) [RHEL-13959]
  - bonding: reset bond's flags when down link is P2P device (Hangbin Liu) [RHEL-13959]
  - net: fix stack overflow when LRO is disabled for virtual interfaces (Hangbin Liu) [RHEL-13959]
  - Documentation: bonding: fix the doc of peer_notif_delay (Hangbin Liu) [RHEL-13959]
  - bonding: fix send_peer_notif overflow (Hangbin Liu) [RHEL-13959]
  - bonding: Fix memory leak when changing bond type to Ethernet (Hangbin Liu) [RHEL-13959]
  - bonding: restore bond's IFF_SLAVE flag if a non-eth dev enslave fails (Hangbin Liu) [RHEL-13959]
  - bonding: restore IFF_MASTER/SLAVE flags on bond enslave ether type change (Hangbin Liu) [RHEL-13959]
  - drivers/net/bonding/bond_3ad: return when there's no aggregator (Hangbin Liu) [RHEL-13959]
  - KVM: s390: pv: Allow AP-instructions for pv-guests (Thomas Huth) [2111392]
  - KVM: s390: Add UV feature negotiation (Thomas Huth) [2111392]
  - s390/uv: UV feature check utility (Thomas Huth) [2111392]
  - s390/vfio-ap: make sure nib is shared (Thomas Huth) [2111392]
  - KVM: s390: export kvm_s390_pv*_is_protected functions (Thomas Huth) [2111392]
  - s390/uv: export uv_pin_shared for direct usage (Thomas Huth) [2111392]
  - s390/vfio-ap: check for TAPQ response codes 0x35 and 0x36 (Thomas Huth) [2111392]
  - s390/vfio-ap: handle queue state change in progress on reset (Thomas Huth) [2111392]
  - s390/vfio-ap: use work struct to verify queue reset (Thomas Huth) [2111392]
  - s390/vfio-ap: store entire AP queue status word with the queue object (Thomas Huth) [2111392]
  - s390/vfio-ap: remove upper limit on wait for queue reset to complete (Thomas Huth) [2111392]
  - s390/vfio-ap: allow deconfigured queue to be passed through to a guest (Thomas Huth) [2111392]
  - s390/vfio-ap: wait for response code 05 to clear on queue reset (Thomas Huth) [2111392]
  - s390/vfio-ap: clean up irq resources if possible (Thomas Huth) [2111392]
  - s390/vfio-ap: no need to check the 'E' and 'I' bits in APQSW after TAPQ (Thomas Huth) [2111392]
  - s390/vfio-ap: fix memory leak in vfio_ap device driver (Thomas Huth) [2111392]
  - s390/vfio-ap: remove redundant driver match function (Thomas Huth) [2111392]
  - s390/vfio_ap: increase max wait time for reset verification (Thomas Huth) [2111392]
  - s390/vfio_ap: fix handling of error response codes (Thomas Huth) [2111392]
  - s390/vfio_ap: verify ZAPQ completion after return of response code zero (Thomas Huth) [2111392]
  - s390/vfio_ap: use TAPQ to verify reset in progress completes (Thomas Huth) [2111392]
  - s390/vfio_ap: check TAPQ response code when waiting for queue reset (Thomas Huth) [2111392]
  - s390/vfio-ap: verify reset complete in separate function (Thomas Huth) [2111392]
  - s390/vfio-ap: fix an error handling path in vfio_ap_mdev_probe_queue() (Thomas Huth) [2111392]
  - s390/vfio-ap: add s390dbf logging to the vfio_ap_irq_enable function (Thomas Huth) [2111392]
  - s390-vfio-ap: introduces s390 kernel debug feature for vfio_ap device driver (Thomas Huth) [2111392]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-524.rt7.313.el8]
changelog:
  - [rt] build kernel-rt-4.18.0-524.rt7.313.el8 [RHEL-5332]
  - pNFS/filelayout: treat GETDEVICEINFO errors as layout failure (Scott Mayhew) [RHEL-4969]
  - mm/kmemleak: move up cond_resched() call in page scanning loop (Waiman Long) [RHEL-8630]
  - net/sched: cls_rsvp: always try to match inside the linear part of skb (Davide Caratti) [RHEL-11730] {CVE-2023-42755}
  - vc_screen: don't clobber return value in vcs_read (Ricardo Robaina) [2221468] {CVE-2023-3567}
  - vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF (Ricardo Robaina) [2221468] {CVE-2023-3567}
  - vt_kdsetmode: extend console locking (John W. Linville) [RHEL-3016] {CVE-2021-3753}
  - console: consume APC, DM, DCS (John W. Linville) [RHEL-3016] {CVE-2021-3753}
  - vt_ioctl: move vt_kdsetmode out of vt_k_ioctl (John W. Linville) [RHEL-3016] {CVE-2021-3753}
  - scsi: core: Fix legacy /proc parsing buffer overflow (Ewan D. Milne) [RHEL-14311]
  - scsi: core: Improve scsi_vpd_inquiry() checks (Ewan D. Milne) [RHEL-14311]
  - scsi: core: Fix a procfs host directory removal regression (Ewan D. Milne) [RHEL-14311]
  - scsi: core: Remove the /proc/scsi/${proc_name} directory earlier (Ewan D. Milne) [RHEL-14311]
  - ibmvnic: Assign XPS map to correct queue index (Mukesh Chaurasiya) [RHEL-11210]
  - ibmvnic: Toggle between queue types in affinity mapping (Mukesh Chaurasiya) [RHEL-11210]
  - ibmvnic: Update XPS assignments during affinity binding (Mukesh Chaurasiya) [RHEL-11210]
  - ibmvnic: Add hotpluggable CPU callbacks to reassign affinity hints (Mukesh Chaurasiya) [RHEL-11210]
  - ibmvnic: Assign IRQ affinity hints to device queues (Mukesh Chaurasiya) [RHEL-11210]
  - mm/slub: fix a slab missed to be freed problem (Rafael Aquini) [RHEL-9526]
  - mm/slub: simplify __cmpxchg_double_slab() and slab_[un]lock() (Rafael Aquini) [RHEL-9526]
  - mm/slub: convert object_map_lock to non-raw spinlock (Rafael Aquini) [RHEL-9526]
  - mm/slub: remove slab_lock() usage for debug operations (Rafael Aquini) [RHEL-9526]
  - mm/slub: restrict sysfs validation to debug caches and make it safe (Rafael Aquini) [RHEL-9526]
  - mm/slub: move free_debug_processing() further (Rafael Aquini) [RHEL-9526]
  - mm/slub: remove unneeded return value of slab_pad_check (Rafael Aquini) [RHEL-9526]
  - s390/qdio: fix do_sqbs() inline assembly constraint (Tobias Huschle) [RHEL-11194]
  - s390/lcs: Convert sysfs sprintf to sysfs_emit (Tobias Huschle) [RHEL-11194]
  - s390/lcs: Convert sprintf to scnprintf (Tobias Huschle) [RHEL-11194]
  - s390/ctcm: Convert sysfs sprintf to sysfs_emit (Tobias Huschle) [RHEL-11194]
  - s390/ctcm: Convert sprintf/snprintf to scnprintf (Tobias Huschle) [RHEL-11194]
  - s390/qeth: Fix vipa deletion (Tobias Huschle) [RHEL-11194]
  - s390/lcs: Remove FDDI option (Tobias Huschle) [RHEL-11194]
  - net/ism: Remove redundant pci_clear_master (Tobias Huschle) [RHEL-11198]
  - net/smc: Fix dependency of SMC on ISM (Tobias Huschle) [RHEL-11198]
  - s390/ism: Do not unregister clients with registered DMBs (Tobias Huschle) [RHEL-11198]
  - s390/ism: Fix and simplify add()/remove() callback handling (Tobias Huschle) [RHEL-11198]
  - s390/ism: Fix locking for forwarding of IRQs and events to clients (Tobias Huschle) [RHEL-11198]
  - s390/ism: Fix trying to free already-freed IRQ by repeated ism_dev_exit() (Tobias Huschle) [RHEL-11198]
  - s390/ism: Set DMA coherent mask (Tobias Huschle) [RHEL-11198]
  - net/ism: Remove extra include (Tobias Huschle) [RHEL-11198]
  - net/smc: Introduce explicit check for v2 support (Tobias Huschle) [RHEL-11198]
  - dm: fix a race condition in retrieve_deps (Benjamin Marzinski) [RHEL-13917]
  - dm raid: protect md_stop() with 'reconfig_mutex' (Benjamin Marzinski) [RHEL-13917]
  - dm raid: clean up four equivalent goto tags in raid_ctr() (Benjamin Marzinski) [RHEL-13917]
  - dm raid: fix missing reconfig_mutex unlock in raid_ctr() error paths (Benjamin Marzinski) [RHEL-13917]
  - dm integrity: fix double free on memory allocation failure (Benjamin Marzinski) [RHEL-13917]
  - dm integrity: scale down the recalculate buffer if memory allocation fails (Benjamin Marzinski) [RHEL-13917]
  - dm integrity: only allocate recalculate buffer when needed (Benjamin Marzinski) [RHEL-13917]
  - dm integrity: reduce vmalloc space footprint on 32-bit architectures (Benjamin Marzinski) [RHEL-13917]
  - dm ioctl: Refuse to create device named "." or ".." (Benjamin Marzinski) [RHEL-13917]
  - dm ioctl: Refuse to create device named "control" (Benjamin Marzinski) [RHEL-13917]
  - dm ioctl: structs and parameter strings must not overlap (Benjamin Marzinski) [RHEL-13917]
  - dm ioctl: Avoid pointer arithmetic overflow (Benjamin Marzinski) [RHEL-13917]
  - dm ioctl: Check dm_target_spec is sufficiently aligned (Benjamin Marzinski) [RHEL-13917]
  - dm thin: disable discards for thin-pool if no_discard_passdown (Benjamin Marzinski) [RHEL-13917]
  - dm thin metadata: Fix ABBA deadlock by resetting dm_bufio_client (Benjamin Marzinski) [RHEL-13917]
  - dm crypt: fix crypt_ctr_cipher_new return value on invalid AEAD cipher (Benjamin Marzinski) [RHEL-13917]
  - dm thin: update .io_hints methods to not require handling discards last (Benjamin Marzinski) [RHEL-13917]
  - dm thin: remove return code variable in pool_map (Benjamin Marzinski) [RHEL-13917]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-525.rt7.314.el8]
changelog:
  - [rt] build kernel-rt-4.18.0-525.rt7.314.el8 [RHEL-5332]
  - net: xfrm: Fix xfrm_address_filter OOB read (Wander Lairson Costa) [2227302] {CVE-2023-39194}
  - drm/qxl: fix UAF on handle creation (Wander Lairson Costa) [2218335] {CVE-2023-39198}
  - x86/sev: Make enc_dec_hypercall() accept a size instead of npages (Vitaly Kuznetsov) [RHEL-3656]
  - net: virtio_net_hdr_to_skb: count transport header in UFO (Cindy Lu) [RHEL-6030]
  - ice: reset first in crash dump kernels (Petr Oros) [2139761]
  - perf/core: Fix potential NULL deref (Wander Lairson Costa) [RHEL-14982] {CVE-2023-5717}
  - perf: Disallow mis-matched inherited group reads (Wander Lairson Costa) [RHEL-14982] {CVE-2023-5717}
  - scsi: mpt3sas: Drop redundant pci_enable_pcie_error_reporting() (Tomas Henzl) [RHEL-8246]
  - scsi: mpt3sas: Fix in error path (Tomas Henzl) [RHEL-8246]
  - scsi: mpt3sas: Fix loop logic (Tomas Henzl) [RHEL-8246]
  - scsi: mpt3sas: Remove volatile qualifier (Tomas Henzl) [RHEL-8246]
  - scsi: mpt3sas: Perform additional retries if doorbell read returns 0 (Tomas Henzl) [RHEL-8246]
  - scsi: mpi3mr: Split off bus_reset function from host_reset (Tomas Henzl) [RHEL-8232]
  - scsi: mpi3mr: Update driver version to 8.5.0.0.0 (Tomas Henzl) [RHEL-8232]
  - scsi: mpi3mr: Enhance handling of devices removed after controller reset (Tomas Henzl) [RHEL-8232]
  - scsi: mpi3mr: WRITE SAME implementation (Tomas Henzl) [RHEL-8232]
  - scsi: mpi3mr: Add support for more than 1MB I/O (Tomas Henzl) [RHEL-8232]
  - scsi: mpi3mr: Update MPI Headers to version 3.00.28 (Tomas Henzl) [RHEL-8232]
  - scsi: mpi3mr: Invoke soft reset upon TSU or event ack time out (Tomas Henzl) [RHEL-8232]
  - scsi: mpi3mr: Propagate sense data for admin queue SCSI I/O (Tomas Henzl) [RHEL-8232]
  - scsi: mpi3mr: Fix the type used for pointers to bitmap (Tomas Henzl) [RHEL-8232]
  - regmap: Drop initial version of maximum transfer length fixes (Mark Langsdorf) [RHEL-1022]
  - regmap: Account for register length when chunking (Mark Langsdorf) [RHEL-1022]
  - driver core: update comments in device_rename() (Mark Langsdorf) [RHEL-1022]
  - cacheinfo: Add use_arch[|_cache]_info field/function (Mark Langsdorf) [RHEL-1022]
  - arch_topology: Remove early cacheinfo error message if -ENOENT (Mark Langsdorf) [RHEL-1022]
  - cacheinfo: Allow early level detection when DT/ACPI info is missing/broken (Mark Langsdorf) [RHEL-1022]
  - cacheinfo: Check sib_leaf in cache_leaves_are_shared() (Mark Langsdorf) [RHEL-1022]
  - cacheinfo: Add arch specific early level initializer (Mark Langsdorf) [RHEL-1022]
  - regmap: Factor out single value register syncing (Mark Langsdorf) [RHEL-1022]
  - regmap: Add RAM backed register map (Mark Langsdorf) [RHEL-1022]
  - regmap: Removed compressed cache support (Mark Langsdorf) [RHEL-1022]
  - base: soc: populate machine name in soc_device_register if empty (Mark Langsdorf) [RHEL-1022]
  - regmap: Clarify error for unknown cache types (Mark Langsdorf) [RHEL-1022]
  - regmap: Handle sparse caches in the default sync (Mark Langsdorf) [RHEL-1022]
  - regmap: add a helper to translate the register address (Mark Langsdorf) [RHEL-1022]
  - regmap: cache: Silence checkpatch warning (Mark Langsdorf) [RHEL-1022]
  - regmap: cache: Return error in cache sync operations for REGCACHE_NONE (Mark Langsdorf) [RHEL-1022]
  - devres: Pass unique name of the resource to devm_add_action() (Mark Langsdorf) [RHEL-1022]
  - device property: Clarify description of returned value in some functions (Mark Langsdorf) [RHEL-1022]
  - driver core: Make state_synced device attribute writeable (Mark Langsdorf) [RHEL-1022]
  - PM: domains: fix memory leak with using debugfs_lookup() (Mark Langsdorf) [RHEL-1022]
  - PM: runtime: Do not call __rpm_callback() from rpm_idle() (Mark Langsdorf) [RHEL-1022]
  - kobject: kset_uevent_ops: make name() callback take a const * (Mark Langsdorf) [RHEL-1022]
  - kobject: kset_uevent_ops: make filter() callback take a const * (Mark Langsdorf) [RHEL-1022]
  - kobject: make get_ktype() take a const pointer (Mark Langsdorf) [RHEL-1022]
  - kobject: make kobject_get_ownership() take a constant kobject * (Mark Langsdorf) [RHEL-1022]
  - arm64: topology: move store_cpu_topology() to shared code (Mark Langsdorf) [RHEL-1022]
  - filemap: skip write and wait if end offset precedes start (Nico Pache) [RHEL-5620]
  - mm/mempolicy: clean up the code logic in queue_pages_pte_range (Nico Pache) [RHEL-5620]
  - mm:vmscan: fix inaccurate reclaim during proactive reclaim (Nico Pache) [RHEL-5620]
  - mm/page_alloc: don't wake kswapd from rmqueue() unless __GFP_KSWAPD_RECLAIM is specified (Nico Pache) [RHEL-5620]
  - writeback: fix call of incorrect macro (Nico Pache) [RHEL-5620]
  - mm/page_alloc: use write_seqlock_irqsave() instead write_seqlock() + local_irq_save(). (Nico Pache) [RHEL-5620]
  - mm/page_alloc: fix potential deadlock on zonelist_update_seq seqlock (Nico Pache) [RHEL-5620]
  - writeback, cgroup: fix null-ptr-deref write in bdi_split_work_to_wbs (Nico Pache) [RHEL-5620]
  - mm/khugepaged: check again on anon uffd-wp during isolation (Nico Pache) [RHEL-5620]
  - mm/swap: fix swap_info_struct race between swapoff and get_swap_pages() (Nico Pache) [RHEL-5620]
  - mm/fadvise: use LLONG_MAX instead of -1 for eof (Nico Pache) [RHEL-5620]
  - mm: Make failslab writable again (Nico Pache) [RHEL-5620]
  - mm: migrate: fix THP's mapcount on isolation (Nico Pache) [RHEL-5620]
  - mm/memremap.c: map FS_DAX device memory as decrypted (Nico Pache) [RHEL-5620]
  - mm/page_alloc: add missing is_migrate_isolate() check in set_page_guard() (Nico Pache) [RHEL-5620]
  - mm: pagewalk: Fix race between unmap and page walker (Nico Pache) [RHEL-5620]
  - mm/slub: add missing TID updates on slab deactivation (Nico Pache) [RHEL-5620]
  - hugetlb: fix huge_pmd_unshare address update (Nico Pache) [RHEL-5620]
  - fs-writeback: writeback_sb_inodes：Recalculate 'wrote' according skipped pages (Nico Pache) [RHEL-5620]
  - highmem: fix checks in __kmap_local_sched_{in,out} (Nico Pache) [RHEL-5620]
  - mm: fix race between MADV_FREE reclaim and blkdev direct IO read (Nico Pache) [RHEL-5620]
  - mm/thp: fix NR_FILE_MAPPED accounting in page_*_file_rmap() (Nico Pache) [RHEL-5620]
  - memblock: use kfree() to release kmalloced memblock regions (Nico Pache) [RHEL-5620]
  - mm/list_lru.c: prefer struct_size over open coded arithmetic (Nico Pache) [RHEL-5620]
  - mm/kmemleak: allow __GFP_NOLOCKDEP passed to kmemleak's gfp (Nico Pache) [RHEL-5620]
  - mm/hugetlb: initialize hugetlb_usage in mm_init (Nico Pache) [RHEL-5620]
  - mm: mempolicy: don't have to split pmd for huge zero page (Nico Pache) [RHEL-5620]
  - mm/thp: fix page_vma_mapped_walk() if THP mapped by ptes (Nico Pache) [RHEL-5620]
  - mm/thp: unmap_mapping_page() to fix THP truncate_cleanup_page() (Nico Pache) [RHEL-5620]
  - delayacct: clear right task's flag after blkio completes (Nico Pache) [RHEL-5620]
  - mm: remove lru_add_drain_all in alloc_contig_range (Nico Pache) [RHEL-5620]
  - mm: always have io_remap_pfn_range() set pgprot_decrypted() (Nico Pache) [RHEL-5620]
  - mm/page_alloc: fix documentation error (Nico Pache) [RHEL-5620]
  - s390/mm: mmap base does not depend on ADDR_NO_RANDOMIZE personality (Nico Pache) [RHEL-5620]
  - powerpc/mm: Fix "sz" set but not used warning (Nico Pache) [RHEL-5620]
  - powerpc/mm/hash: Handle mmap_min_addr correctly in get_unmapped_area topdown search (Nico Pache) [RHEL-5620]
  - mm: ksm: do not block on page lock when searching stable tree (Nico Pache) [RHEL-5620]
  - powerpc/hugetlbpage: Rmove unhelpful HUGEPD_*_SHIFT macros (Nico Pache) [RHEL-5620]
  - arm64: mm: Export __sync_icache_dcache() for xen-privcmd (Nico Pache) [RHEL-5620]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-526.rt7.315.el8]
changelog:
  - [rt] build kernel-rt-4.18.0-526.rt7.315.el8 [RHEL-5332]
  - cpupower: Fix cpuidle_set to accept only numeric values for idle-set operation. (Mamatha Inamdar) [RHEL-15215]
  - powerpc/vas: Limit open window failure messages in log bufffer (Mamatha Inamdar) [RHEL-14968]
  - udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated(). (Paolo Abeni) [RHEL-14372]
  - vxlan: calculate correct header length for GPE (Petr Oros) [RHEL-14527]
  - af_unix: Fix null-ptr-deref in unix_stream_sendpage(). (Guillaume Nault) [RHEL-2574] {CVE-2023-4622}
  - netfilter: xt_u32: validate user space input (Phil Sutter) [RHEL-11729] {CVE-2023-39192}
  - netfilter: nf_log_syslog: Consolidate entry checks (Phil Sutter) [RHEL-6044]
  - netfilter: nf_log_syslog: Don't ignore unknown protocols (Phil Sutter) [RHEL-6044]
  - netfilter: nf_log_syslog: Merge MAC header dumpers (Phil Sutter) [RHEL-6044]
  - tipc: fix a potential deadlock on &tx->lock (Xin Long) [RHEL-14830]
  - tipc: stop tipc crypto on failure in tipc_node_create (Xin Long) [RHEL-14830]
  - tipc: check return value of pskb_trim() (Xin Long) [RHEL-14830]
  - net: tipc: resize nlattr array to correct size (Xin Long) [RHEL-14830]
  - scsi: target: core: Fix deadlock due to recursive locking (Maurizio Lombardi) [RHEL-15311]
  - scsi: target: Replace strlcpy() with strscpy() (Maurizio Lombardi) [RHEL-15311]
  - scsi: target: iscsi: Stop using sprintf() in iscsi_target_configfs.c (Maurizio Lombardi) [RHEL-15311]
  - scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (Maurizio Lombardi) [RHEL-15311]
  - scsi: target: Fix multiple LUN_RESET handling (Maurizio Lombardi) [RHEL-15311]
  - scsi: target: iscsit: Free cmds before session free (Maurizio Lombardi) [RHEL-15311]
  - net: xfrm: skip policies marked as dead while reinserting policies (Sabrina Dubroca) [RHEL-14518]
  - ip_vti: fix potential slab-use-after-free in decode_session6 (Sabrina Dubroca) [RHEL-14518]
  - ip6_vti: fix slab-use-after-free in decode_session6 (Sabrina Dubroca) [RHEL-14518]
  - xfrm: fix slab-use-after-free in decode_session6 (Sabrina Dubroca) [RHEL-14518]
  - net: ipv4: Use kfree_sensitive instead of kfree (Sabrina Dubroca) [RHEL-14518]
  - xfrm: Linearize the skb after offloading if needed. (Sabrina Dubroca) [RHEL-14518]
  - xfrm: fix inbound ipv4/udp/esp packets to UDPv6 dualstack sockets (Sabrina Dubroca) [RHEL-14518]
  - net: skb_queue_purge_reason() optimizations (Antoine Tenart) [RHEL-14568]
  - net: add skb_queue_purge_reason and __skb_queue_purge_reason (Antoine Tenart) [RHEL-14568]
  - tcp: add TCP_OLD_SEQUENCE drop reason (Antoine Tenart) [RHEL-14568]
  - net: move dropreason.h to dropreason-core.h (Antoine Tenart) [RHEL-14568]
  - net: fix kfree_skb_list use of skb_mark_not_on_list (Antoine Tenart) [RHEL-14568]
  - net: kfree_skb_list use kmem_cache_free_bulk (Antoine Tenart) [RHEL-14568]
  - bpf: Clarify error expectations from bpf_clone_redirect (Davide Caratti) [RHEL-15040]
  - veth: Fixing transmit return status for dropped packets (Davide Caratti) [RHEL-15040]
  - net: fib: avoid warn splat in flow dissector (Davide Caratti) [RHEL-15040]
  - net: af_key: fix sadb_x_filter validation (Davide Caratti) [RHEL-15040]
  - net: dcb: choose correct policy to parse DCB_ATTR_BCN (Davide Caratti) [RHEL-15040]
  - llc: Don't drop packet from non-root netns. (Davide Caratti) [RHEL-15040]
  - vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit() (Davide Caratti) [RHEL-15040]
  - af_key: Reject optional tunnel/BEET mode templates in outbound policies (Davide Caratti) [RHEL-15040]
  - af_packet: Don't send zero-byte data in packet_sendmsg_spkt(). (Davide Caratti) [RHEL-15040]
  - ethtool: Fix uninitialized number of lanes (Davide Caratti) [RHEL-15040]
  - vlan: partially enable SIOCSHWTSTAMP in container (Davide Caratti) [RHEL-15040]
  - net/sched: act_ct: additional checks for outdated flows (Davide Caratti) [RHEL-14032]
  - netfilter: flowtable: GC pushes back packets to classic path (Davide Caratti) [RHEL-14032]
  - net: sched: sch_qfq: Use non-work-conserving warning handler (Davide Caratti) [RHEL-14032]
  - net: sched: sch_qfq: Fix UAF in qfq_dequeue() (Davide Caratti) [RHEL-14032]
  - net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve (Davide Caratti) [RHEL-14032]
  - net/sched: sch_hfsc: Ensure inner classes have fsc curve (Davide Caratti) [RHEL-14032]
  - net/sched: fix a qdisc modification with ambiguous command request (Davide Caratti) [RHEL-14032]
  - net/sched: mqprio: Add length check for TCA_MQPRIO_{MAX/MIN}_RATE64 (Davide Caratti) [RHEL-14032]
  - net/sched: mqprio: add extack to mqprio_parse_nlattr() (Davide Caratti) [RHEL-14032]
  - net: sched: cls_flower: Undo tcf_bind_filter in case of an error (Davide Caratti) [RHEL-14032]
  - net: sched: cls_bpf: Undo tcf_bind_filter in case of an error (Davide Caratti) [RHEL-14032]
  - net: sched: cls_u32: Undo refcount decrement in case update failed (Davide Caratti) [RHEL-14032]
  - net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode (Davide Caratti) [RHEL-14032]
  - net: sched: cls_matchall: Undo tcf_bind_filter in case of failure after mall_set_parms (Davide Caratti) [RHEL-14032]
  - net/sched: flower: Ensure both minimum and maximum ports are specified (Davide Caratti) [RHEL-14032]
  - net/sched: act_pedit: Add size check for TCA_PEDIT_PARMS_EX (Davide Caratti) [RHEL-14032]
  - sch_netem: fix issues in netem_change() vs get_dist_table() (Davide Caratti) [RHEL-14032]
  - sch_netem: acquire qdisc lock in netem_change() (Davide Caratti) [RHEL-14032]
  - selftests: tc-testing: add one test for flushing explicitly created chain (Davide Caratti) [RHEL-14032]
  - net/sched: cls_api: Fix lockup on flushing explicitly created chain (Davide Caratti) [RHEL-14032]
  - net/sched: qdisc_destroy() old ingress and clsact Qdiscs before grafting (Davide Caratti) [RHEL-14032]
  - net/sched: Refactor qdisc_graft() for ingress and clsact Qdiscs (Davide Caratti) [RHEL-14032]
  - net/sched: act_ct: Fix promotion of offloaded unreplied tuple (Davide Caratti) [RHEL-14032]
  - net/sched: fq_pie: ensure reasonable TCA_FQ_PIE_QUANTUM values (Davide Caratti) [RHEL-14032]
  - net: sched: fix NULL pointer dereference in mq_attach (Davide Caratti) [RHEL-14032]
  - net/sched: act_mirred: Add carrier check (Davide Caratti) [RHEL-14032]
  - redhat/configs: delete ftdi-elan driver config (Desnes Nunes) [RHEL-13071]
  - redhat/configs: delete u132-hcd driver config (Desnes Nunes) [RHEL-13071]
  - usb: typec: ucsi: acpi: fix a NULL vs IS_ERR() check in probe (Desnes Nunes) [RHEL-13071]
  - usb: typec: Fix fast_role_swap_current show function (Desnes Nunes) [RHEL-13071]
  - usb: typec: ucsi: Fix command cancellation (Desnes Nunes) [RHEL-13071]
  - USB: serial: option: add Quectel EM061KGL series (Desnes Nunes) [RHEL-13071]
  - usb: typec: tps6598x: Fix broken polling mode after system suspend/resume (Desnes Nunes) [RHEL-13071]
  - usb: usbfs: Use consistent mmap functions (Desnes Nunes) [RHEL-13071]
  - usb: usbfs: Enforce page requirements for mmap (Desnes Nunes) [RHEL-13071]
  - thunderbolt: Do not touch CL state configuration during discovery (Desnes Nunes) [RHEL-13071]
  - thunderbolt: Increase DisplayPort Connection Manager handshake timeout (Desnes Nunes) [RHEL-13071]
  - thunderbolt: dma_test: Use correct value for absent rings when creating paths (Desnes Nunes) [RHEL-13071]
  - xhci: Fix incorrect tracking of free space on transfer rings (Desnes Nunes) [RHEL-13071]
  - xhci-pci: Only run d3cold avoidance quirk for s2idle (Desnes Nunes) [RHEL-13071]
  - usb-storage: fix deadlock when a scsi command timeouts more than once (Desnes Nunes) [RHEL-13071]
  - usb: typec: tps6598x: Fix fault at module removal (Desnes Nunes) [RHEL-13071]
  - usb: typec: altmodes/displayport: fix pin_assignment_show (Desnes Nunes) [RHEL-13071]
  - USB: UHCI: adjust zhaoxin UHCI controllers OverCurrent bit value (Desnes Nunes) [RHEL-13071]
  - PCI: Add ACS quirk for Zhaoxin Root/Downstream Ports (Desnes Nunes) [RHEL-13071]
  - PCI: Add ACS quirk for Zhaoxin multi-function devices (Desnes Nunes) [RHEL-13071]
  - PCI: Add Zhaoxin Vendor ID (Desnes Nunes) [RHEL-13071]
  - USB: usbtmc: Fix direction for 0-length ioctl control messages (Desnes Nunes) [RHEL-13071]
  - usb: usbtmc: Fix bug in pipe direction for control transfers (Desnes Nunes) [RHEL-13071]
  - media: pvrusb2: fix DVB_CORE dependency (Desnes Nunes) [RHEL-13071]
  - USB: sisusbvga: Add endpoint checks (Desnes Nunes) [RHEL-13071]
  - USB: core: Add routines for endpoint checks in old drivers (Desnes Nunes) [RHEL-13071]
  - usb: typec: ucsi: don't print PPM init deferred errors (Desnes Nunes) [RHEL-13071]
  - usb: typec: tcpm: fix multiple times discover svids error (Desnes Nunes) [RHEL-13071]
  - usb: xhci: plat: Add USB 3.0 phy support (Desnes Nunes) [RHEL-13071]
  - usb: host: xhci-plat: Use dev_is_pci() helper (Desnes Nunes) [RHEL-13071]
  - xhci: fix debugfs register accesses while suspended (Desnes Nunes) [RHEL-13071]
  - debugfs: regset32: Add Runtime PM support (Desnes Nunes) [RHEL-13071]
  - USB: serial: option: add UNISOC vendor and TOZED LT70C product (Desnes Nunes) [RHEL-13071]
  - net: thunderbolt: Fix typos in comments (Desnes Nunes) [RHEL-13071]
  - net: thunderbolt: Fix sparse warnings in tbnet_xmit_csum_and_map() (Desnes Nunes) [RHEL-13071]
  - net: thunderbolt: Fix sparse warnings in tbnet_check_frame() and tbnet_poll() (Desnes Nunes) [RHEL-13071]
  - media: mc-device: remove unnecessary __must_check (Desnes Nunes) [RHEL-13071]
  - media: au0828: remove unnecessary (void*) conversions (Desnes Nunes) [RHEL-13071]
  - USB: core: Fix docs warning caused by wireless_status feature (Desnes Nunes) [RHEL-13071]
  - usb: typec: ucsi: acpi: add quirk for ASUS Zenbook UM325 (Desnes Nunes) [RHEL-13071]
  - ACPI: OSL: Remove the helper for deactivating memory region (Desnes Nunes) [RHEL-13071]
  - ACPI: OSL: Clean up printing messages (Desnes Nunes) [RHEL-13071]
  - usb: typec: ucsi: acpi: Map the mailbox with memremap() (Desnes Nunes) [RHEL-13071]
  - dt-bindings: usb: tps6598x: make interrupts optional (Desnes Nunes) [RHEL-13071]
  - dt-bindings: Explicitly allow additional properties in common schemas (Desnes Nunes) [RHEL-13071]
  - dt-bindings: connector: Convert Samsung 11-pin USB bindings to dtschema (Desnes Nunes) [RHEL-13071]
  - dt-bindings: Merge gpio-usb-b-connector with usb-connector (Desnes Nunes) [RHEL-13071]
  - dt-bindings: Clean-up schema indentation formatting (Desnes Nunes) [RHEL-13071]
  - dt-bindings: usb: typec-tcpci: convert to DT schema format (Desnes Nunes) [RHEL-13071]
  - usb: typec: tcpm: try to get role switch from tcpc fwnode (Desnes Nunes) [RHEL-13071]
  - USB: core: Add API to change the wireless_status (Desnes Nunes) [RHEL-13071]
  - USB: core: Add wireless_status sysfs attribute (Desnes Nunes) [RHEL-13071]
  - ABI: sysfs-bus-usb: better document variable argument (Desnes Nunes) [RHEL-13071]
  - thunderbolt: Introduce usb4_port_sb_opcode_err_to_errno() helper (Desnes Nunes) [RHEL-13071]
  - media: pvrusb2: clean up unneeded complexity in pvrusb2 class logic (Desnes Nunes) [RHEL-13071]
  - usb: move config USB_USS720 to usb's misc Kconfig (Desnes Nunes) [RHEL-13071]
  - dt-bindings: usb: usb-nop-xceiv: add power-domains property (Desnes Nunes) [RHEL-13071]
  - dt-bindings: usb: usb-nop-xceiv: Convert to DT schema (Desnes Nunes) [RHEL-13071]
  - thunderbolt: Make use of SI units from units.h (Desnes Nunes) [RHEL-13071]
  - thunderbolt: Get rid of redundant 'else' (Desnes Nunes) [RHEL-13071]
  - thunderbolt: ACPI: Replace tb_acpi_find_port() with acpi_find_child_by_adr() (Desnes Nunes) [RHEL-13071]
  - usb: pci-quirks: Reduce the length of a spinlock section in usb_amd_find_chipset_info() (Desnes Nunes) [RHEL-13071]
  - xhci: use pm_ptr() instead of #ifdef for CONFIG_PM conditionals (Desnes Nunes) [RHEL-13071]
  - usb: xhci-pci: Set PROBE_PREFER_ASYNCHRONOUS (Desnes Nunes) [RHEL-13071]
  - usb: typec: tps6598x: Add support for polling interrupts status (Desnes Nunes) [RHEL-13071]
  - usb: typec: ucsi: add PMIC Glink UCSI driver (Desnes Nunes) [RHEL-13071]
  - tracing: Acquire buffer from temparary trace sequence (Desnes Nunes) [RHEL-13071]
  - USB: serial: quatech2: remove unused qt2_setdevice function (Desnes Nunes) [RHEL-13071]
  - usb: typec: tipd: remove unused tps6598x_write16,32 functions (Desnes Nunes) [RHEL-13071]
  - usb: typec: tcpci_mt6360: remove unused mt6360_tcpc_read16 function (Desnes Nunes) [RHEL-13071]
  - usb: typec: tcpm: remove unnecessary (void*) conversions (Desnes Nunes) [RHEL-13071]
  - xhci: Move xhci MSI sync function to to xhci-pci (Desnes Nunes) [RHEL-13071]
  - xhci: Call MSI sync function from xhci-pci instead of generic xhci code (Desnes Nunes) [RHEL-13071]
  - xhci: Move functions to cleanup MSI to xhci-pci (Desnes Nunes) [RHEL-13071]
  - xhci: move PCI specific MSI/MSIX cleanup away from generic xhci functions (Desnes Nunes) [RHEL-13071]
  - xhci: Move functions to setup msi to xhci-pci (Desnes Nunes) [RHEL-13071]
  - xhci: Avoid PCI MSI/MSIX interrupt reinitialization at resume (Desnes Nunes) [RHEL-13071]
  - xhci: dbc: Provide sysfs option to configure dbc descriptors (Desnes Nunes) [RHEL-13071]
  - xhci: mem: Join string literals back (Desnes Nunes) [RHEL-13071]
  - xhci: mem: Replace explicit castings with appropriate specifiers (Desnes Nunes) [RHEL-13071]
  - xhci: mem: Use while (i--) pattern to clean up (Desnes Nunes) [RHEL-13071]
  - xhci: mem: Drop useless return:s (Desnes Nunes) [RHEL-13071]
  - xhci: mem: Get rid of redundant 'else' (Desnes Nunes) [RHEL-13071]
  - xhci: mem: Use dma_poll_zalloc() instead of explicit memset() (Desnes Nunes) [RHEL-13071]
  - xhci: mem: Carefully calculate size for memory allocations (Desnes Nunes) [RHEL-13071]
  - overflow: Provide constant expression struct_size (Desnes Nunes) [RHEL-13071]
  - test_overflow: Regularize test reporting output (Desnes Nunes) [RHEL-13071]
  - overflow: Implement size_t saturating arithmetic helpers (Desnes Nunes) [RHEL-13071]
  - test_overflow: Add shift overflow tests (Desnes Nunes) [RHEL-13071]
  - overflow.h: Add comment documenting __ab_c_size() (Desnes Nunes) [RHEL-13071]
  - docs: basics.rst: get rid of rcu kernel-doc macros (Desnes Nunes) [RHEL-13071]
  - docs: Do not seek comments in kernel/rcu/tree_plugin.h (Desnes Nunes) [RHEL-13071]
  - docs: deprecated.rst: Add zero-length and one-element arrays (Desnes Nunes) [RHEL-13071]
  - docs: Remove :c:func: from process/deprecated.rst (Desnes Nunes) [RHEL-13071]
  - docs: Introduce deprecated APIs list (Desnes Nunes) [RHEL-13071]
  - USB: misc: Remove unused include file usb_u132.h (Desnes Nunes) [RHEL-13071]
  - usb: ftdi-elan: Delete driver (Desnes Nunes) [RHEL-13071]
  - dt-bindings: usb: Drop unneeded quotes (Desnes Nunes) [RHEL-13071]
  - usb: host: u132-hcd: Delete driver (Desnes Nunes) [RHEL-13071]
  - media: pvrusb2: VIDEO_PVRUSB2 depends on DVB_CORE to use dvb_* symbols (Desnes Nunes) [RHEL-13071]
  - usb: misc: usb3503: support usb3803 and bypass mode (Desnes Nunes) [RHEL-13071]
  - usb: misc: usb3503: refactor code to prepare for usb3803 addition (Desnes Nunes) [RHEL-13071]
  - dt-bindings: usb: smsc,usb3503: Add usb3803 (Desnes Nunes) [RHEL-13071]
  - dt-bindings: usb: Convert SMSC USB3503 binding to a schema (Desnes Nunes) [RHEL-13071]
  - usb: typec: fusb302: mark OF related data as maybe unused (Desnes Nunes) [RHEL-13071]
  - usb: typec: hd3ss3220: Drop of_match_ptr for ID table (Desnes Nunes) [RHEL-13071]
  - usb: typec: hd3ss3220: Convert to i2c's .probe_new() (Desnes Nunes) [RHEL-13071]
  - usb: acpi: Switch to use acpi_evaluate_dsm_typed() (Desnes Nunes) [RHEL-13071]
  - usb: Use of_property_read_bool() for boolean properties (Desnes Nunes) [RHEL-13071]
  - usb: host: Fix refcount leak in ehci_hcd_ppc_of_probe (Desnes Nunes) [RHEL-13071]
  - usb: usb251xb: Switch to use dev_err_probe() helper (Desnes Nunes) [RHEL-13071]
  - thunderbolt: Refactor DROM reading (Desnes Nunes) [RHEL-13071]
  - thunderbolt: use `tb_eeprom_get_drom_offset` to discover DROM offset (Desnes Nunes) [RHEL-13071]
  - usb: xhci: change some trace event __dynamic_array() to __get_buf() (Desnes Nunes) [RHEL-13071]
  - dt-bindings: usb: allow evaluated properties in OHCI controllers (Desnes Nunes) [RHEL-13071]
  - dt-bindings: usb: usb-device: make "compatible" optional (Desnes Nunes) [RHEL-13071]
  - dt-bindings: usb: hcd: correct usb-device path (Desnes Nunes) [RHEL-13071]
  - dt-bindings: usb: fix yamllint check warning (Desnes Nunes) [RHEL-13071]
  - dt-bindings: usb: usb-device: fix typo in required properties (Desnes Nunes) [RHEL-13071]
  - dt-bindings: usb: convert usb-device.txt to YAML schema (Desnes Nunes) [RHEL-13071]
  - dt-bindings: Fix SPI and I2C bus node names in examples (Desnes Nunes) [RHEL-13071]
  - dt-bindings: mfd: mediatek: Add bindings for MT6360 PMIC (Desnes Nunes) [RHEL-13071]
  - usb typec: mt6360: Add MT6360 Type-C DT binding documentation (Desnes Nunes) [RHEL-13071]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-527.rt7.316.el8]
changelog:
  - [rt] build kernel-rt-4.18.0-527.rt7.316.el8 [RHEL-5332]
  - perf vendor events: Update PMC used in PM_RUN_INST_CMPL event for power10 platform (Michael Petlan) [RHEL-16880]
  - gfs2: Fix another freeze/thaw hang (Andrew Price) [RHEL-5340]
  - tcp: enforce receive buffer memory limits by allowing the tcp window to shrink (Felix Maurer) [RHEL-15023]
  - cpufreq: amd-pstate: Update policy->cur in amd_pstate_adjust_perf() (Prarit Bhargava) [RHEL-10028]
  - driver/base/cpu: Retry online operation if -EBUSY (Waiman Long) [RHEL-5730]
  - net: openvswitch: reject negative ifindex (Antoine Tenart) [RHEL-14350]
  - sctp: annotate data-races around sk->sk_wmem_queued (Xin Long) [RHEL-14838]
  - sctp: fix potential deadlock on &net->sctp.addr_wq_lock (Xin Long) [RHEL-14838]
  - sctp: fix an error code in sctp_sf_eat_auth() (Xin Long) [RHEL-14838]
  - sctp: handle invalid error codes without calling BUG() (Xin Long) [RHEL-14838]
  - sctp: fix an issue that plpmtu can never go to complete state (Xin Long) [RHEL-14838]
  - sctp: add bpf_bypass_getsockopt proto callback (Xin Long) [RHEL-14838]
  - powerpc/pseries: Always inline functions called from cpuidle (Mark Langsdorf) [RHEL-4666]
  - cpuidle: pseries: Mark ->enter() functions as __cpuidle (Mark Langsdorf) [RHEL-4666]
  - cpuidle: move to use bus_get_dev_root() (Mark Langsdorf) [RHEL-4666]
  - cpuidle: driver: Update microsecond values of state parameters as needed (Mark Langsdorf) [RHEL-4666]
  - cpuidle: sysfs: make kobj_type structures constant (Mark Langsdorf) [RHEL-4666]
  - cpuidle: Fix poll_idle() noinstr annotation (Mark Langsdorf) [RHEL-4666]
  - cpuidle-haltpoll: Replace default_idle() with arch_cpu_idle() (Mark Langsdorf) [RHEL-4666]
  - cpuidle-haltpoll: select haltpoll governor (Mark Langsdorf) [RHEL-4666]
  - cpuidle: Annotate poll_idle() (Mark Langsdorf) [RHEL-4666]
  - powerpc/cpuidle: Set CPUIDLE_FLAG_POLLING for snooze state (Mark Langsdorf) [RHEL-4666]
  - cpuidle: Remove redundant check in cpuidle_switch_governor() (Mark Langsdorf) [RHEL-4666]
  - cpuidle: powernv: move from strlcpy() with unused retval to strscpy() (Mark Langsdorf) [RHEL-4666]
  - cpuidle: coupled: Drop duplicate word from a comment (Mark Langsdorf) [RHEL-4666]
  - KVM: s390: add tracepoint in gmap notifier (Cédric Le Goater) [RHEL-11434]
  - KVM: s390: add stat counter for shadow gmap events (Cédric Le Goater) [RHEL-11434]
  - KVM: s390: fix gisa destroy operation might lead to cpu stalls (Cédric Le Goater) [RHEL-9581]
  - KVM: s390: interrupt: Fix single-stepping keyless mode exits (Cédric Le Goater) [RHEL-9581]
  - KVM: s390: interrupt: Fix single-stepping userspace-emulated instructions (Cédric Le Goater) [RHEL-9581]
  - KVM: s390: interrupt: Fix single-stepping kernel-emulated instructions (Cédric Le Goater) [RHEL-9581]
  - KVM: s390: interrupt: Fix single-stepping into program interrupt handlers (Cédric Le Goater) [RHEL-9581]
  - KVM: s390: interrupt: Fix single-stepping into interrupt handlers (Cédric Le Goater) [RHEL-9581]
  - KVM: s390: fix sthyi error handling (Cédric Le Goater) [RHEL-9581]
  - KVM: s390: pv: fix index value of replaced ASCE (Cédric Le Goater) [RHEL-9581]
  - KVM: s390/diag: fix racy access of physical cpu number in diag 9c handler (Cédric Le Goater) [RHEL-9581]
  - KVM: s390: vsie: fix the length of APCB bitmap (Cédric Le Goater) [RHEL-9581]
  - KVM: s390: fix KVM_S390_GET_CMMA_BITS for GFNs in memslot holes (Cédric Le Goater) [RHEL-9581]
  - KVM: s390: pci: fix virtual-physical confusion on module unload/load (Cédric Le Goater) [RHEL-9581]
  - KVM: s390: interrupt: fix virtual-physical confusion for next alert GISA (Cédric Le Goater) [RHEL-9581]
  - KVM: s390: pv: fix external interruption loop not always detected (Cédric Le Goater) [RHEL-9581]
  - s390: vfio-ap: tighten the NIB validity check (Cédric Le Goater) [RHEL-9581]
  - KVM: s390: pv: leak the topmost page table when destroy fails (Cédric Le Goater) [RHEL-9581]
  - mbcache: Avoid nesting of cache->c_list_lock under bit locks (Carlos Maiolino) [RHEL-15010]
  - ext4: fix deadlock due to mbcache entry corruption (Carlos Maiolino) [RHEL-15010]
  - mbcache: automatically delete entries from cache on freeing (Carlos Maiolino) [RHEL-15010]
  - ext4: fix use-after-free read in ext4_find_extent for bigalloc + inline (Carlos Maiolino) [RHEL-15010]
  - ext4: fix another off-by-one fsmap error on 1k block filesystems (Carlos Maiolino) [RHEL-15010]
  - ext4: fix task hung in ext4_xattr_delete_inode (Carlos Maiolino) [RHEL-15010]
  - ext4: Fix function prototype mismatch for ext4_feat_ktype (Carlos Maiolino) [RHEL-15010]
  - ext4: avoid unaccounted block allocation when expanding inode (Carlos Maiolino) [RHEL-15010]
  - ext4: avoid BUG_ON when creating xattrs (Carlos Maiolino) [RHEL-15010]
  - ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline (Carlos Maiolino) [RHEL-15010]
  - ext4: fix uninititialized value in 'ext4_evict_inode' (Carlos Maiolino) [RHEL-15010]
  - ext4: fix corruption when online resizing a 1K bigalloc fs (Carlos Maiolino) [RHEL-15010]
  - ext4: fix error code return to user-space in ext4_get_branch() (Carlos Maiolino) [RHEL-15010]
  - ext4: init quota for 'old.inode' in 'ext4_rename' (Carlos Maiolino) [RHEL-15010]
  - ext4: fix undefined behavior in bit shift for ext4_check_flag_values (Carlos Maiolino) [RHEL-15010]
  - ext4: fix bug_on in __es_tree_search caused by bad boot loader inode (Carlos Maiolino) [RHEL-15010]
  - ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode (Carlos Maiolino) [RHEL-15010]
  - ext4: add helper to check quota inums (Carlos Maiolino) [RHEL-15010]
  - ext4: fix bug_on in __es_tree_search caused by bad quota inode (Carlos Maiolino) [RHEL-15010]
  - ext4: silence the warning when evicting inode with dioread_nolock (Carlos Maiolino) [RHEL-15010]
  - ext4: fix use-after-free in ext4_ext_shift_extents (Carlos Maiolino) [RHEL-15010]
  - ext4: fix warning in 'ext4_da_release_space' (Carlos Maiolino) [RHEL-15010]
  - jbd2: wake up journal waiters in FIFO order, not LIFO (Carlos Maiolino) [RHEL-15010]
  - ext4: place buffer head allocation before handle start (Carlos Maiolino) [RHEL-15010]
  - ext4: fix check for block being out of directory size (Carlos Maiolino) [RHEL-15010] {CVE-2022-1184}
  - ext4: make ext4_lazyinit_thread freezable (Carlos Maiolino) [RHEL-15010]
  - ext4: fix null-ptr-deref in ext4_write_info (Carlos Maiolino) [RHEL-15010]
  - ext4: limit the number of retries after discarding preallocations blocks (Carlos Maiolino) [RHEL-15010]
  - ext4: fix bug in extents parsing when eh_entries == 0 and eh_depth > 0 (Carlos Maiolino) [RHEL-15010]
  - jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted (Carlos Maiolino) [RHEL-15010]
  - ext4: fix race when reusing xattr blocks (Carlos Maiolino) [RHEL-15010]
  - ext4: unindent codeblock in ext4_xattr_block_set() (Carlos Maiolino) [RHEL-15010]
  - ext4: remove EA inode entry from mbcache on inode eviction (Carlos Maiolino) [RHEL-15010]
  - ext4: use kmemdup() to replace kmalloc + memcpy (Carlos Maiolino) [RHEL-15010]
  - ext4: avoid remove directory when directory is corrupted (Carlos Maiolino) [RHEL-15010]
  - ext4: recover csum seed of tmp_inode after migrating to extents (Carlos Maiolino) [RHEL-15010]
  - mbcache: add functions to delete entry if unused (Carlos Maiolino) [RHEL-15010]
  - mbcache: don't reclaim used entries (Carlos Maiolino) [RHEL-15010]
  - redhat/configs: Disable AMD PMF driver (Prarit Bhargava) [RHEL-10011]
  - x86/amd_nb: Add PCI ID for family 19h model 78h (Prarit Bhargava) [RHEL-10011]
  - platform/x86: amd: pmc: provide user message where s0ix is not supported (Prarit Bhargava) [RHEL-10011]
  - platform/x86/amd: pmc: Fix memory leak in amd_pmc_stb_debugfs_open_v2() (Prarit Bhargava) [RHEL-10011]
  - platform/x86: amd: pmc: Remove __maybe_unused from amd_pmc_suspend_handler() (Prarit Bhargava) [RHEL-10011]
  - platform/x86/amd: pmc: Move out of BIOS SMN pair for STB init (Prarit Bhargava) [RHEL-10011]
  - platform/x86/amd: pmc: Utilize SMN index 0 for driver probe (Prarit Bhargava) [RHEL-10011]
  - platform/x86/amd: pmc: Move idlemask check into `amd_pmc_idlemask_read` (Prarit Bhargava) [RHEL-10011]
  - platform/x86/amd: pmc: Don't dump data after resume from s0i3 on picasso (Prarit Bhargava) [RHEL-10011]
  - platform/x86/amd: pmc: Hide SMU version and program attributes for Picasso (Prarit Bhargava) [RHEL-10011]
  - platform/x86/amd: pmc: Don't try to read SMU version on Picasso (Prarit Bhargava) [RHEL-10011]
  - platform/x86: amd: pmc: Convert to platform remove callback returning void (Prarit Bhargava) [RHEL-10011]
  - platform/x86: amd: hsmp: Convert to platform remove callback returning void (Prarit Bhargava) [RHEL-10011]
  - platform/x86/amd: pmc: remove CONFIG_SUSPEND checks (Prarit Bhargava) [RHEL-10011]
  - platform/x86/amd: pmc: Add line break for readability (Prarit Bhargava) [RHEL-10011]
  - platform/x86/amd: pmc: differentiate STB/SMU messaging prints (Prarit Bhargava) [RHEL-10011]
  - platform/x86/amd: pmc: Write dummy postcode into the STB DRAM (Prarit Bhargava) [RHEL-10011]
  - platform/x86/amd: pmc: Add num_samples message id support to STB (Prarit Bhargava) [RHEL-10011]
  - platform/x86/amd: pmc: add CONFIG_SERIO dependency (Prarit Bhargava) [RHEL-10011]
  - platform/x86/amd: pmc: Add a module parameter to disable workarounds (Prarit Bhargava) [RHEL-10011]
  - platform/x86/amd: pmc: Disable IRQ1 wakeup for RN/CZN (Prarit Bhargava) [RHEL-10011]
  - platform/x86/amd: Fix refcount leak in amd_pmc_probe (Prarit Bhargava) [RHEL-10011]
  - platform/x86/amd: pmc: Add new ACPI ID AMDI0009 (Prarit Bhargava) [RHEL-10011]
  - platform/x86/amd: pmc: Remove more CONFIG_DEBUG_FS checks (Prarit Bhargava) [RHEL-10011]
  - platform/x86/amd: pmc: Read SMU version during suspend on Cezanne systems (Prarit Bhargava) [RHEL-10011]
  - platform/x86/amd: pmc: remove CONFIG_DEBUG_FS checks (Prarit Bhargava) [RHEL-10011]
  - platform/x86/amd: pmc: Fix build without debugfs (Prarit Bhargava) [RHEL-10011]
  - platform/x86/amd: pmc: Add sysfs files for SMU (Prarit Bhargava) [RHEL-10011]
  - platform/x86/amd: pmc: Always write to the STB (Prarit Bhargava) [RHEL-10011]
  - platform/x86/amd: pmc: Add defines for STB events (Prarit Bhargava) [RHEL-10011]
  - platform/x86/amd/pmf: Add support for PMF core layer (Prarit Bhargava) [RHEL-10011]
  - platform/x86/amd/pmc: Add new platform support (Prarit Bhargava) [RHEL-10011]
  - platform/x86/amd/pmc: Add new acpi id for PMC controller (Prarit Bhargava) [RHEL-10011]
  - platform/x86: Move AMD platform drivers to separate directory (Prarit Bhargava) [RHEL-10011]
  - platform/x86: amd-pmc: Fix build error unused-function (Prarit Bhargava) [RHEL-10011]
  - platform/x86: amd-pmc: Shuffle location of amd_pmc_get_smu_version() (Prarit Bhargava) [RHEL-10011]
  - platform/x86: amd-pmc: Avoid reading SMU version at probe time (Prarit Bhargava) [RHEL-10011]
  - platform/x86: amd-pmc: Move FCH init to first use (Prarit Bhargava) [RHEL-10011]
  - platform/x86: amd-pmc: Move SMU logging setup out of init (Prarit Bhargava) [RHEL-10011]
  - platform/x86: amd-pmc: Fix compilation without CONFIG_SUSPEND (Prarit Bhargava) [RHEL-10011]
  - platform/x86: amd-pmc: Only report STB errors when STB enabled (Prarit Bhargava) [RHEL-10011]
  - platform/x86: amd-pmc: Drop CPU QoS workaround (Prarit Bhargava) [RHEL-10011]
  - platform/x86: amd-pmc: Output error codes in messages (Prarit Bhargava) [RHEL-10011]
  - platform/x86: amd-pmc: Move to later in the suspend process (Prarit Bhargava) [RHEL-10011]
  - platform/x86: amd-pmc: Validate entry into the deepest state on resume (Prarit Bhargava) [RHEL-10011]
  - platform/x86: amd-pmc: uninitialized variable in amd_pmc_s2d_init() (Prarit Bhargava) [RHEL-10011]
  - platform/x86: amd-pmc: Add support for AMD Spill to DRAM STB feature (Prarit Bhargava) [RHEL-10011]
  - platform/x86: amd-pmc: Correct usage of SMU version (Prarit Bhargava) [RHEL-10011]
  - platform/x86: amd-pmc: Make amd_pmc_stb_debugfs_fops static (Prarit Bhargava) [RHEL-10011]
  - scsi: qedf: Add synchronization between I/O completions and abort (Nilesh Javali) [RHEL-9861]
  - scsi: qedf: Remove unused declaration (Nilesh Javali) [RHEL-9861]
  - scsi: qedf: Fix firmware halt over suspend and resume (Nilesh Javali) [RHEL-9861]
  - scsi: qedf: Do not touch __user pointer in qedf_dbg_fp_int_cmd_read() directly (Nilesh Javali) [RHEL-9861]
  - scsi: qedf: Do not touch __user pointer in qedf_dbg_debug_cmd_read() directly (Nilesh Javali) [RHEL-9861]
  - scsi: qedf: Do not touch __user pointer in qedf_dbg_stop_io_on_error_cmd_read() directly (Nilesh Javali) [RHEL-9861]
  - scsi: qedf: Fix NULL dereference in error handling (Nilesh Javali) [RHEL-9861]
  - scsi: qedf: Remove unused 'num_handled' variable (Nilesh Javali) [RHEL-9861]
  - scsi: qla2xxx: Fix system crash due to bad pointer access (Nilesh Javali) [RHEL-9859]
  - qla2xxx: Fix double free of dsd_list during driver load. (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Fix NULL vs IS_ERR() bug for debugfs_create_dir() (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Use raw_smp_processor_id() instead of smp_processor_id() (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Correct endianness for rqstlen and rsplen (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Fix unused variable warning in qla2xxx_process_purls_pkt() (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Fix spelling mistake "tranport" -> "transport" (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Remove unused variables in qla24xx_build_scsi_type_6_iocbs() (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Fix nvme_fc_rcv_ls_req() undefined error (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Update version to 10.02.09.100-k (Nilesh Javali) [RHEL-9859]
  - Revert "scsi: qla2xxx: Fix buffer overrun" (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Fix smatch warn for qla_init_iocb_limit() (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Remove unsupported ql2xenabledif option (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Error code did not return to upper layer (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Add logs for SFP temperature monitoring (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Fix firmware resource tracking (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Flush mailbox commands on chip reset (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Add Unsolicited LS Request and Response Support for NVMe (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Allow 32-byte CDBs (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Move resource to allow code reuse (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Remove unused declarations (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Update version to 10.02.08.500-k (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: fix inconsistent TMF timeout (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Fix TMF leak through (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Turn off noisy message log (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Fix session hang in gnl (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Fix erroneous link up failure (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Fix command flush during TMF (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Limit TMF to 8 per function (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Adjust IOCB resource on qpair create (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Fix deletion race condition (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Fix error code in qla2x00_start_sp() (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Silence a static checker warning (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Update version to 10.02.08.400-k (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Correct the index of array (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Pointer may be dereferenced (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Fix buffer overrun (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport() (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Avoid fcport pointer dereference (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Fix potential NULL pointer dereference (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Array index may go out of bound (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Drop useless LIST_HEAD (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Replace one-element array with DECLARE_FLEX_ARRAY() helper (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Fix end of loop test (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Fix NULL pointer dereference in target mode (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Replace all non-returning strlcpy() with strscpy() (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Update version to 10.02.08.300-k (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Wait for io return on terminate rport (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Fix mem access after free (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Fix hang in task management (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Fix task management cmd fail due to unavailable resource (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Fix task management cmd failure (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Multi-que support for TMF (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Fix memory leak in qla2x00_probe_one() (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Refer directly to the qla2xxx_driver_template (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Remove default fabric ops callouts (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Drop redundant pci_enable_pcie_error_reporting() (Nilesh Javali) [RHEL-9859]
  - scsi: qla2xxx: Add option to disable FC2 Target support (Nilesh Javali) [RHEL-9859]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-528.rt7.317.el8]
changelog:
  - [rt] build kernel-rt-4.18.0-528.rt7.317.el8 [RHEL-5332]
  - s390/smp: move rcu_cpu_starting() earlier (Joel Savitz) [RHEL-8624]
  - net: fix net device address assign type (Michal Schmidt) [RHEL-6383]
  - net: add check for current MAC address in dev_set_mac_address (Michal Schmidt) [RHEL-6383]
  - writeback, cgroup: Fix kernel bootup panic with cgroup v2 (Waiman Long) [RHEL-17504]
  - net/tls: Remove the context from the list in tls_device_down (Jay Shin) [RHEL-17301]
  - tls: Fix context leak on tls_device_down (Jay Shin) [RHEL-17301]
  - RDMA/core: Require admin capabilities to set system parameters (Kamal Heib) [RHEL-1033]
  - RDMA/cma: Initialize ib_sa_multicast structure to 0 when join (Kamal Heib) [RHEL-1033]
  - RDMA/core: Use size_{add,sub,mul}() in calls to struct_size() (Kamal Heib) [RHEL-1033]
  - RDMA/cma: Fix truncation compilation warning in make_cma_ports (Kamal Heib) [RHEL-1033]
  - RDMA/uverbs: Fix typo of sizeof argument (Kamal Heib) [RHEL-1033]
  - IB/uverbs: Fix an potential error pointer dereference (Kamal Heib) [RHEL-1033]
  - scsi: RDMA/srp: Fix residual handling (Kamal Heib) [RHEL-1033]
  - rdma: fix INFINIBAND_USER_ACCESS dependency (Kamal Heib) [RHEL-1033]
  - gfs2: Fix quota=quiet oversight (Bob Peterson) [RHEL-14849]
  - gfs2: Free quota data objects synchronously (Andreas Gruenbacher) [RHEL-14849]
  - gfs2: Fix initial quota data refcount (Andreas Gruenbacher) [RHEL-14849]
  - gfs2: Factor out duplicate quota data disposal code (Andreas Gruenbacher) [RHEL-14849]
  - gfs2: Use gfs2_qd_dispose in gfs2_quota_cleanup (Andreas Gruenbacher) [RHEL-14849]
  - gfs2: Fix wrong quota shrinker return value (Andreas Gruenbacher) [RHEL-14849]
  - gfs2: ignore negated quota changes (Bob Peterson) [RHEL-14849]
  - gfs2: Introduce new quota=quiet mount option (Bob Peterson) [RHEL-14849]
  - gfs2: Rename sd_{ glock => kill }_wait (Andreas Gruenbacher) [RHEL-14849]
  - Bluetooth: btrtl: Set MSFT opcode for RTL8852 (David Marlin) [RHEL-2531]
  - Bluetooth: Fix return value in hci_dev_do_close() (David Marlin) [RHEL-2531]
  - Bluetooth: add timeout sanity check to hci_inquiry (David Marlin) [RHEL-2531]
  - Bluetooth: btusb: Remove WAKEUP_DISABLE and add WAKEUP_AUTOSUSPEND for Realtek devices (David Marlin) [RHEL-2531]
  - Bluetooth: mgmt: Pessimize compile-time bounds-check (David Marlin) [RHEL-2531]
  - Bluetooth: Fix race condition in handling NOP command (David Marlin) [RHEL-2531]
  - Bluetooth: btbcm: add patch ram for bluetooth (David Marlin) [RHEL-2531]
  - Bluetooth: Store advertising handle so it can be re-enabled (David Marlin) [RHEL-2531]
  - Bluetooth: Fix handling of LE Enhanced Connection Complete (David Marlin) [RHEL-2531]
  - Bluetooth: fix repeated calls to sco_sock_kill (David Marlin) [RHEL-2531]
  - Bluetooth: switch to lock_sock in RFCOMM (David Marlin) [RHEL-2531]
  - Bluetooth: serialize calls to sco_sock_{set,clear}_timer (David Marlin) [RHEL-2531]
  - Bluetooth: switch to lock_sock in SCO (David Marlin) [RHEL-2531]
  - Bluetooth: avoid circular locks in sco_sock_connect (David Marlin) [RHEL-2531]
  - Bluetooth: schedule SCO timeouts with delayed_work (David Marlin) [RHEL-2531]
  - Bluetooth: btusb: Fix fall-through warnings (David Marlin) [RHEL-2531]
  - Bluetooth: btintel: Combine setting up MSFT extension (David Marlin) [RHEL-2531]
  - Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow (David Marlin) [RHEL-2531]
  - Bluetooth: Add additional Bluetooth part for Realtek 8852AE (David Marlin) [RHEL-2531]
  - Bluetooth: btusb: Record debug log for Mediatek Chip. (David Marlin) [RHEL-2531]
  - Bluetooth: hci_bcm: Fix kernel doc comments (David Marlin) [RHEL-2531]
  - Bluetooth: Fix not generating RPA when required (David Marlin) [RHEL-2531]
  - Bluetooth: HCI: Add proper tracking for enable status of adv instances (David Marlin) [RHEL-2531]
  - Bluetooth: btusb: Enable MSFT extension for Mediatek Chip (MT7921) (David Marlin) [RHEL-2531]
  - Bluetooth: btusb: Make the CSR clone chip force-suspend workaround more generic (David Marlin) [RHEL-2531]
  - Bluetooth: btusb: Enable MSFT extension for WCN6855 controller (David Marlin) [RHEL-2531]
  - Bluetooth: btusb: Load Broadcom firmware for Dell device 413c:8197 (David Marlin) [RHEL-2531]
  - Bluetooth: btmrvl_sdio: Remove all strcpy() uses (David Marlin) [RHEL-2531]
  - Bluetooth: skip invalid hci_sync_conn_complete_evt (David Marlin) [RHEL-2531]
  - Bluetooth: btusb: Add valid le states quirk (David Marlin) [RHEL-2531]
  - Bluetooth: hci_h5: Add runtime suspend (David Marlin) [RHEL-2531]
  - Bluetooth: hci_h5: btrtl: Maintain flow control if wakeup is enabled (David Marlin) [RHEL-2531]
  - Bluetooth: hci_h5: add WAKEUP_DISABLE flag (David Marlin) [RHEL-2531]
  - Bluetooth: btrsi: use non-kernel-doc comment for copyright (David Marlin) [RHEL-2531]
  - Bluetooth: btusb: Add support for LG LGSBWAC92/TWCM-K505D (David Marlin) [RHEL-2531]
  - Bluetooth: sco: prevent information leak in sco_conn_defer_accept() (David Marlin) [RHEL-2531]
  - Bluetooth: btusb: Add support for IMC Networks Mediatek Chip (David Marlin) [RHEL-2531]
  - Bluetooth: hci_h5: Disable the hci_suspend_notifier for btrtl devices (David Marlin) [RHEL-2531]
  - Bluetooth: msft: Use the correct print format (David Marlin) [RHEL-2531]
  - Bluetooth: mgmt: Use the correct print format (David Marlin) [RHEL-2531]
  - Bluetooth: use inclusive language in hci_core.h (David Marlin) [RHEL-2531]
  - Bluetooth: btqca: Moved extracting rom version info to common place (David Marlin) [RHEL-2531]
  - Bluetooth: btqca: Add support for firmware image with mbn type for WCN6750 (David Marlin) [RHEL-2531]
  - Bluetooth: hci_qca: Add support for QTI Bluetooth chip wcn6750 (David Marlin) [RHEL-2531]
  - Bluetooth: use flexible-array member instead of zero-length array (David Marlin) [RHEL-2531]
  - Bluetooth: Fix default values for advertising interval (David Marlin) [RHEL-2531]
  - Bluetooth: Remove trailing semicolon in macros (David Marlin) [RHEL-2531]
  - Bluetooth: Fix crash in mgmt_add_adv_patterns_monitor_complete (David Marlin) [RHEL-2531]
  - Bluetooth: disable advertisement filters during suspend (David Marlin) [RHEL-2531]
  - Bluetooth: advmon offload MSFT interleave scanning integration (David Marlin) [RHEL-2531]
  - Bluetooth: advmon offload MSFT handle filter enablement (David Marlin) [RHEL-2531]
  - Bluetooth: advmon offload MSFT handle controller reset (David Marlin) [RHEL-2531]
  - Bluetooth: advmon offload MSFT remove monitor (David Marlin) [RHEL-2531]
  - Bluetooth: advmon offload MSFT add monitor (David Marlin) [RHEL-2531]
  - Bluetooth: advmon offload MSFT add rssi support (David Marlin) [RHEL-2531]
  - Bluetooth: btrtl: Enable MSFT extension for RTL8822CE controller (David Marlin) [RHEL-2531]
  - Bluetooth: btqca: Enable MSFT extension for Qualcomm WCN399x (David Marlin) [RHEL-2531]
  - Bluetooth: btqca: Use NVM files based on SoC ID for WCN3991 (David Marlin) [RHEL-2531]
  - Bluetooth: fix typo in struct name (David Marlin) [RHEL-2531]
  - Bluetooth: btqca: Add valid le states quirk (David Marlin) [RHEL-2531]
  - Bluetooth: ath3k: use usb_control_msg_send() and usb_control_msg_recv() (David Marlin) [RHEL-2531]
  - Bluetooth: Use fallthrough pseudo-keyword (David Marlin) [RHEL-2531]
  - Bluetooth: hci_qca: Enable WBS support for wcn3991 (David Marlin) [RHEL-2531]
  - Bluetooth: L2CAP: Replace zero-length array with flexible-array (David Marlin) [RHEL-2531]
  - Bluetooth: Replace BT_DBG with bt_dev_dbg for security manager support (David Marlin) [RHEL-2531]
  - Bluetooth: Replace BT_DBG with bt_dev_dbg for management support (David Marlin) [RHEL-2531]
  - Bluetooth: Clear HCI_LL_RPA_RESOLUTION flag on reset (David Marlin) [RHEL-2531]
  - Bluetooth: Sort list of LE features constants (David Marlin) [RHEL-2531]
  - Bluetooth: Add HCI device identifier for VIRTIO devices (David Marlin) [RHEL-2531]
  - Bluetooth: hci_qca: Add support for Qualcomm Bluetooth SoC QCA6390 (David Marlin) [RHEL-2531]
  - Bluetooth: Fixing a few comment typos in the quirk definitions. (David Marlin) [RHEL-2531]
  - Bluetooth: hci_qca: Add support for Qualcomm Bluetooth SoC WCN3991 (David Marlin) [RHEL-2531]
  - Bluetooth: btsdio: Use module_sdio_driver helper (David Marlin) [RHEL-2531]
  - mmc: sdio: Add helper macro for sdio_driver boilerplate (David Marlin) [RHEL-2531]
  - kasan: add compiler barriers to KUNIT_EXPECT_KASAN_FAIL (Nico Pache) [RHEL-5622]
  - redhat: add new tests (Nico Pache) [RHEL-5622]
  - redhat: disable kunit by default (Nico Pache) [RHEL-5622]
  - kasan: fix unit tests with CONFIG_UBSAN_LOCAL_BOUNDS enabled (Nico Pache) [RHEL-5622]
  - kasan: fix array-bounds warnings in tests (Nico Pache) [RHEL-5622]
  - kasan: test: Silence GCC 12 warnings (Nico Pache) [RHEL-5622]
  - tracepoint: Allow trace events in modules with TAINT_TEST (Nico Pache) [RHEL-5622]
  - kunit: Fix missed memory release in kunit_free_suite_set() (Nico Pache) [RHEL-5622]
  - kunit: fix kunit_test_init_section_suites(...) (Nico Pache) [RHEL-5622]
  - kunit: tool: print summary of failed tests if a few failed out of a lot (Nico Pache) [RHEL-5622]
  - kunit: alloc_string_stream_fragment error handling bug fix (Nico Pache) [RHEL-5622]
  - kunit: Fix wild-memory-access bug in kunit_free_suite_set() (Nico Pache) [RHEL-5622]
  - Documentation: kunit: Modular tests should not depend on KUNIT=y (Nico Pache) [RHEL-5622]
  - kunit: update NULL vs IS_ERR() tests (Nico Pache) [RHEL-5622]
  - Documentation: kunit: Update description of --alltests option (Nico Pache) [RHEL-5622]
  - kunit: declare kunit_assert structs as const (Nico Pache) [RHEL-5622]
  - kunit: rename base KUNIT_ASSERTION macro to _KUNIT_FAILED (Nico Pache) [RHEL-5622]
  - kunit: remove format func from struct kunit_assert, get it to 0 bytes (Nico Pache) [RHEL-5622]
  - kunit: make kunit_kfree(NULL) a no-op to match kfree() (Nico Pache) [RHEL-5622]
  - kunit: make kunit_kfree() not segfault on invalid inputs (Nico Pache) [RHEL-5622]
  - kunit: make kunit_kfree() only work on pointers from kunit_malloc() and friends (Nico Pache) [RHEL-5622]
  - kunit: drop test pointer in string_stream_fragment (Nico Pache) [RHEL-5622]
  - kunit: string-stream: Simplify resource use (Nico Pache) [RHEL-5622]
  - Documentation: Kunit: Use full path to .kunitconfig (Nico Pache) [RHEL-5622]
  - kunit: tool: rename all_test_uml.config, use it for --alltests (Nico Pache) [RHEL-5622]
  - kunit: tool: remove UML specific options from all_tests_uml.config (Nico Pache) [RHEL-5622]
  - lib: stackinit: update reference to kunit-tool (Nico Pache) [RHEL-5622]
  - Documentation: KUnit: update links in the index page (Nico Pache) [RHEL-5622]
  - Documentation: KUnit: add intro to the getting-started page (Nico Pache) [RHEL-5622]
  - Documentation: KUnit: Reword start guide for selecting tests (Nico Pache) [RHEL-5622]
  - Documentation: KUnit: add note about mrproper in start.rst (Nico Pache) [RHEL-5622]
  - Documentation: KUnit: avoid repeating "kunit.py run" in start.rst (Nico Pache) [RHEL-5622]
  - Documentation: KUnit: remove duplicated docs for kunit_tool (Nico Pache) [RHEL-5622]
  - Documentation: Kunit: Add ref for other kinds of tests (Nico Pache) [RHEL-5622]
  - Documentation: KUnit: Fix non-uml anchor (Nico Pache) [RHEL-5622]
  - Documentation: Kunit: Fix inconsistent titles (Nico Pache) [RHEL-5622]
  - Documentation: kunit: fix trivial typo (Nico Pache) [RHEL-5622]
  - kunit: no longer call module_info(test, "Y") for kunit modules (Nico Pache) [RHEL-5622]
  - kunit: add kunit.enable to enable/disable KUnit test (Nico Pache) [RHEL-5622]
  - kunit: tool: make --raw_output=kunit (aka --raw_output) preserve leading spaces (Nico Pache) [RHEL-5622]
  - module: kunit: Load .kunit_test_suites section when CONFIG_KUNIT=m (Nico Pache) [RHEL-5622]
  - MAINTAINERS: kunit: add David Gow as a maintainer of KUnit (Nico Pache) [RHEL-5622]
  - Documentation: KUnit: Fix example with compilation error (Nico Pache) [RHEL-5622]
  - Documentation: kunit: Add CLI args for kunit_tool (Nico Pache) [RHEL-5622]
  - kunit: flatten kunit_suite*** to kunit_suite** in .kunit_test_suites (Nico Pache) [RHEL-5622]
  - kunit: unify module and builtin suite definitions (Nico Pache) [RHEL-5622]
  - Documentation: kunit: fix example run_kunit func to allow spaces in args (Nico Pache) [RHEL-5622]
  - kunit: test.h: fix a kernel-doc markup (Nico Pache) [RHEL-5622]
  - kunit: tool: Enable virtio/PCI by default on UML (Nico Pache) [RHEL-5622]
  - kunit: tool: make --kunitconfig repeatable, blindly concat (Nico Pache) [RHEL-5622]
  - kunit: add coverage_uml.config to enable GCOV on UML (Nico Pache) [RHEL-5622]
  - kunit: tool: refactor internal kconfig handling, allow overriding (Nico Pache) [RHEL-5622]
  - kunit: tool: introduce --qemu_args (Nico Pache) [RHEL-5622]
  - kunit: tool: simplify creating LinuxSourceTreeOperations (Nico Pache) [RHEL-5622]
  - kunit: tool: cosmetic: don't specify duplicate kernel cmdline options (Nico Pache) [RHEL-5622]
  - kunit: tool: refactoring printing logic into kunit_printer.py (Nico Pache) [RHEL-5622]
  - kunit: tool: redo how we construct and mock LinuxSourceTree (Nico Pache) [RHEL-5622]
  - kunit: tool: drop unused load_config argument (Nico Pache) [RHEL-5622]
  - apparmor: test: Remove some casts which are no-longer required (Nico Pache) [RHEL-5622]
  - kunit: Taint the kernel when KUnit tests are run (Nico Pache) [RHEL-5622]
  - panic: Taint kernel if tests are run (Nico Pache) [RHEL-5622]
  - kunit: tool: Use qemu-system-i386 for i386 runs (Nico Pache) [RHEL-5622]
  - kunit: tool: update riscv QEMU config with new serial dependency (Nico Pache) [RHEL-5622]
  - kunit: tool: Add list of all valid test configs on UML (Nico Pache) [RHEL-5622]
  - kunit: take `kunit_assert` as `const` (Nico Pache) [RHEL-5622]
  - kunit: fix UAF when run kfence test case test_gfpzero (Nico Pache) [RHEL-5622]
  - lib: stackinit: Convert to KUnit (Nico Pache) [RHEL-5622]
  - lib/test_stackinit: Add assigned initializers (Nico Pache) [RHEL-5622]
  - lib/test_stackinit: Allow building stand-alone (Nico Pache) [RHEL-5622]
  - lib/test_stackinit: Fix static initializer test (Nico Pache) [RHEL-5622]
  - lib: test_stackinit.c: XFAIL switch variable init tests (Nico Pache) [RHEL-5622]
  - lib/test_stackinit: Handle Clang auto-initialization pattern (Nico Pache) [RHEL-5622]
  - lib: Introduce test_stackinit module (Nico Pache) [RHEL-5622]
  - kunit: cleanup assertion macro internal variables (Nico Pache) [RHEL-5622]
  - kunit: factor out str constants from binary assertion structs (Nico Pache) [RHEL-5622]
  - kunit: consolidate KUNIT_INIT_BINARY_ASSERT_STRUCT macros (Nico Pache) [RHEL-5622]
  - kunit: remove va_format from kunit_assert (Nico Pache) [RHEL-5622]
  - docs: dev-tools: kunit: don't use a table for docs name (Nico Pache) [RHEL-5622]
  - Documentation: dev-tools: Add Testing Overview (Nico Pache) [RHEL-5622]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-529.rt7.318.el8]
changelog:
  - [rt] build kernel-rt-4.18.0-529.rt7.318.el8 [RHEL-5332]
  - netfilter: xt_sctp: validate the flag_info count (Wander Lairson Costa) [RHEL-11728] {CVE-2023-39193}
  - nvmet: nul-terminate the NQNs passed in the connect command (Maurizio Lombardi) [RHEL-16690] {CVE-2023-6121}
  - x86/speculation: Mark all Skylake CPUs as vulnerable to GDS (Waiman Long) [RHEL-3876]
  - gve: Fix GFP flags when allocing pages (Izabela Bakollari) [2140228]
  - Fix double fget() in vhost_net_set_backend() (Jon Maloy) [RHEL-7162] {CVE-2023-1838}
  - mptcp: fix disconnect vs accept race (Davide Caratti) [RHEL-15347]
  - mptcp: fix accept vs worker race (Davide Caratti) [RHEL-15347]
  - mptcp: stops worker on unaccepted sockets at listener close (Davide Caratti) [RHEL-15347]
  - mptcp: fix UaF in listener shutdown (Davide Caratti) [RHEL-15347]
  - mptcp: fix lockdep false positive (Davide Caratti) [RHEL-15347]
  - mptcp: use the workqueue to destroy unaccepted sockets (Davide Caratti) [RHEL-15347]
  - mptcp: refactor passive socket initialization (Davide Caratti) [RHEL-15347]
  - mptcp: set msk local address earlier (Davide Caratti) [RHEL-15347]
  - mptcp: fix possible list corruption on passive MPJ (Davide Caratti) [RHEL-15347]
  - mptcp: fix possible deadlock in subflow_error_report (Davide Caratti) [RHEL-15347]
  - dmaengine: idxd: Modify the dependence of attribute pasid_enabled (Jerry Snitselaar) [RHEL-10101]
  - dmaengine: ioatdma: use pci_dev_id() to simplify the code (Jerry Snitselaar) [RHEL-10101]
  - dmaengine: Simplify dma_async_device_register() (Jerry Snitselaar) [RHEL-10101]
  - dmaengine: qcom: hidma_mgmt: Use devm_platform_get_and_ioremap_resource() (Jerry Snitselaar) [RHEL-10101]
  - dmaengine: qcom_hidma: Use devm_platform_get_and_ioremap_resource() (Jerry Snitselaar) [RHEL-10101]
  - dmaengine: ioat: fixing the wrong dma_dev->chancnt (Jerry Snitselaar) [RHEL-10101]
  - dmaengine: hidma: Don't set chancnt (Jerry Snitselaar) [RHEL-10101]
  - dmaengine: ioat: Free up __cleanup() name (Jerry Snitselaar) [RHEL-10101]
  - dmaengine: idxd: Fix passing freed memory in idxd_cdev_open() (Jerry Snitselaar) [RHEL-10101]
  - dmaengine: idxd: make misc interrupt one shot (Jerry Snitselaar) [RHEL-10101]
  - dmaengine: ioat: Drop redundant pci_enable_pcie_error_reporting() (Jerry Snitselaar) [RHEL-10101]
  - dmaengine: ioat: use PCI core macros for PCIe Capability (Jerry Snitselaar) [RHEL-10101]
  - dmaengine: idxd: Allow ATS disable update only for configurable devices (Jerry Snitselaar) [RHEL-10101]
  - dmaengine: idxd: Expose ATS disable knob only when WQ ATS is supported (Jerry Snitselaar) [RHEL-10101]
  - dmaengine: idxd: Simplify WQ attribute visibility checks (Jerry Snitselaar) [RHEL-10101]
  - dmaengine: idxd: use spin_lock_irqsave before wait_event_lock_irq (Jerry Snitselaar) [RHEL-10101]
  - dmaengine: Actually use devm_add_action_or_reset() (Jerry Snitselaar) [RHEL-10101]
  - clk: fix leak on devm_clk_bulk_get_all() unwind (Jerry Snitselaar) [RHEL-10101]
  - drm/amdgpu: Fix possible null pointer dereference (Jocelyn Falempe) [RHEL-14510] {CVE-2023-5633}
  - drm/amdgpu: Fix possible null pointer dereference (Jocelyn Falempe) [RHEL-14510] {CVE-2023-5633}
  - drm/vmwgfx: Keep a gem reference to user bos in surfaces (Jocelyn Falempe) [RHEL-14510] {CVE-2023-5633}
  - drm/vmwgfx: fix typo of sizeof argument (Jocelyn Falempe) [RHEL-14510] {CVE-2023-5633}
  - drm/vmwgfx: Fix possible invalid drm gem put calls (Jocelyn Falempe) [RHEL-14510] {CVE-2023-5633}
  - drm/vmwgfx: Fix shader stage validation (Jocelyn Falempe) [RHEL-14510] {CVE-2023-5633}
  - drm/vmwgfx: remove unused vmw_overlay function (Jocelyn Falempe) [RHEL-14510] {CVE-2023-5633}
  - drm/vmwgfx: Fix Legacy Display Unit atomic drm support (Jocelyn Falempe) [RHEL-14510] {CVE-2023-5633}
  - drm/vmwgfx: Print errors when running on broken/unsupported configs (Jocelyn Falempe) [RHEL-14510] {CVE-2023-5633}
  - drm/vmwgfx: Drop mksstat_init_record fn as currently unused (Jocelyn Falempe) [RHEL-14510] {CVE-2023-5633}
  - drm/vmwgfx: Fix src/dst_pitch confusion (Jocelyn Falempe) [RHEL-14510] {CVE-2023-5633}
  - drm/vmwgfx: Replace one-element array with flexible-array member (Jocelyn Falempe) [RHEL-14510] {CVE-2023-5633}
  - drm/vmwgfx: Do not drop the reference to the handle too soon (Jocelyn Falempe) [RHEL-14510] {CVE-2023-5633}
  - drm/vmwgfx: Stop accessing buffer objects which failed init (Jocelyn Falempe) [RHEL-14510] {CVE-2023-5633}
  - drm/vmwgfx: Make the driver work without the dummy resources (Jocelyn Falempe) [RHEL-14510] {CVE-2023-5633}
  - drm/vmwgfx: Stop using raw ttm_buffer_object's (Jocelyn Falempe) [RHEL-14510] {CVE-2023-5633}
  - drm/vmwgfx: Abstract placement selection (Jocelyn Falempe) [RHEL-14510] {CVE-2023-5633}
  - drm/vmwgfx: Rename dummy to is_iomem (Jocelyn Falempe) [RHEL-14510] {CVE-2023-5633}
  - drm/vmwgfx: Cleanup the vmw bo usage in the cursor paths (Jocelyn Falempe) [RHEL-14510] {CVE-2023-5633}
  - drm/vmwgfx: Simplify fb pinning (Jocelyn Falempe) [RHEL-14510] {CVE-2023-5633}
  - drm/vmwgfx: Rename vmw_buffer_object to vmw_bo (Jocelyn Falempe) [RHEL-14510] {CVE-2023-5633}
  - drm/vmwgfx: Remove the duplicate bo_free function (Jocelyn Falempe) [RHEL-14510] {CVE-2023-5633}
  - drm/vmwgfx: Use the common gem mmap instead of the custom code (Jocelyn Falempe) [RHEL-14510] {CVE-2023-5633}
  - drm/radeon: handle NULL bo->resource in move callback (Jocelyn Falempe) [RHEL-14510] {CVE-2023-5633}
  - drm/qxl: handle NULL bo->resource in move callback (Jocelyn Falempe) [RHEL-14510] {CVE-2023-5633}
  - drm/gem-vram: handle NULL bo->resource in move callback (Jocelyn Falempe) [RHEL-14510] {CVE-2023-5633}
  - drm/ttm: prevent moving of pinned BOs (Jocelyn Falempe) [RHEL-14510] {CVE-2023-5633}
  - drm/ttm: stop allocating a dummy resource for pipelined gutting (Jocelyn Falempe) [RHEL-14510] {CVE-2023-5633}
  - drm/ttm: stop allocating dummy resources during BO creation (Jocelyn Falempe) [RHEL-14510] {CVE-2023-5633}
  - drm/ttm: clear the ttm_tt when bo->resource is NULL (Jocelyn Falempe) [RHEL-14510] {CVE-2023-5633}
  - drm/i915/ttm: audit remaining bo->resource (Jocelyn Falempe) [RHEL-14510] {CVE-2023-5633}
  - Revert "drm/vmwgfx: Stop accessing buffer objects which failed init" (Jocelyn Falempe) [RHEL-14510] {CVE-2023-5633}
  - Revert "drm/vmwgfx: Do not drop the reference to the handle too soon" (Jocelyn Falempe) [RHEL-14510] {CVE-2023-5633}
  - Revert "drm/vmwgfx: Fix Legacy Display Unit atomic drm support" (Jocelyn Falempe) [RHEL-14510] {CVE-2023-5633}
  - ACPI: NFIT: Fix incorrect calculation of idt size (Mark Langsdorf) [RHEL-1021]
  - ACPI: resource: Add IRQ override quirk for LG UltraPC 17U70P (Mark Langsdorf) [RHEL-1021]
  - ACPI: property: Support strings in Apple _DSM props (Mark Langsdorf) [RHEL-1021]
  - ACPI: x86: utils: Remove Lenovo Yoga Tablet 2's MAGN0001 (Mark Langsdorf) [RHEL-1021]
  - ACPI: PM: Do not turn of unused power resources on the Toshiba Click Mini (Mark Langsdorf) [RHEL-1021]
  - ACPI: LPSS: Add 80862289 ACPI _HID for second PWM controller on Cherry Trail (Mark Langsdorf) [RHEL-1021]
  - ACPI: bus: Ensure that notify handlers are not running after removal (Mark Langsdorf) [RHEL-1021]
  - ACPI: bus: Add missing braces to acpi_sb_notify() (Mark Langsdorf) [RHEL-1021]
  - ACPI: resource: Skip IRQ override on ASUS ExpertBook B1502CBA (Mark Langsdorf) [RHEL-1021]
  - ACPI: x86: utils: Add Picasso to the list for forcing StorageD3Enable (Mark Langsdorf) [RHEL-1021]
  - ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects (Mark Langsdorf) [RHEL-1021]
  - ACPICA: acpi_madt_oem_data: Fix flexible array member definition (Mark Langsdorf) [RHEL-1021]
  - ACPICA: acpi_dmar_andd: Replace 1-element array with flexible array (Mark Langsdorf) [RHEL-1021]
  - ACPICA: acpi_pci_routing_table: Replace fixed-size array with flex array member (Mark Langsdorf) [RHEL-1021]
  - ACPICA: struct acpi_resource_dma: Replace 1-element array with flexible array (Mark Langsdorf) [RHEL-1021]
  - ACPICA: actbl1: Replace 1-element arrays with flexible arrays (Mark Langsdorf) [RHEL-1021]
  - ACPICA: struct acpi_resource_vendor: Replace 1-element array with flexible array (Mark Langsdorf) [RHEL-1021]
  - ACPICA: acpi_resource_irq: Replace 1-element arrays with flexible array (Mark Langsdorf) [RHEL-1021]
  - ACPICA: struct acpi_nfit_interleave: Replace 1-element array with flexible array (Mark Langsdorf) [RHEL-1021]
  - ACPICA: Avoid undefined behavior: load of misaligned address (Mark Langsdorf) [RHEL-1021]
  - ACPICA: Avoid undefined behavior: member access within null pointer (Mark Langsdorf) [RHEL-1021]
  - ACPICA: Avoid undefined behavior: member access within misaligned address (Mark Langsdorf) [RHEL-1021]
  - ACPICA: Avoid undefined behavior: member access within misaligned address (Mark Langsdorf) [RHEL-1021]
  - ACPICA: Avoid undefined behavior: member access within misaligned address (Mark Langsdorf) [RHEL-1021]
  - ACPICA: Avoid undefined behavior: member access within misaligned address (Mark Langsdorf) [RHEL-1021]
  - ACPICA: Avoid undefined behavior: applying zero offset to null pointer (Mark Langsdorf) [RHEL-1021]
  - ACPICA: Avoid undefined behavior: load of misaligned address (Mark Langsdorf) [RHEL-1021]
  - ACPICA: actbl2: Replace 1-element arrays with flexible arrays (Mark Langsdorf) [RHEL-1021]
  - ACPICA: Introduce ACPI_FLEX_ARRAY (Mark Langsdorf) [RHEL-1021]
  - ACPICA: add support for ClockInput resource (v6.5) (Mark Langsdorf) [RHEL-1021]
  - ACPICA: Update all copyrights/signons to 2023 (Mark Langsdorf) [RHEL-1021]
  - ACPICA: acpisrc: Add missing tables to astable (Mark Langsdorf) [RHEL-1021]
  - ACPICA: Add missing macro ACPI_FUNCTION_TRACE() for acpi_ns_repair_HID() (Mark Langsdorf) [RHEL-1021]
  - ACPI: EC: Fix oops when removing custom query handlers (Mark Langsdorf) [RHEL-1021]
  - ACPI: EC: Limit explicit removal of query handlers to custom query handlers (Mark Langsdorf) [RHEL-1021]
  - ACPI: SPCR: Amend indentation (Mark Langsdorf) [RHEL-1021]
  - ACPI: property: Refactor acpi_data_prop_read_single() (Mark Langsdorf) [RHEL-1021]
  - ACPI: APEI: EINJ: warn on invalid argument when explicitly indicated by platform (Mark Langsdorf) [RHEL-1021]
  - ACPI: sysfs: Enable ACPI sysfs support for CCEL records (Mark Langsdorf) [RHEL-1021]
  - ACPICA: iASL: Add CCEL table to both compiler/disassembler (Mark Langsdorf) [RHEL-1021]
  - ACPI: bus: Rework system-level device notification handling (Mark Langsdorf) [RHEL-1021]
  - ACPI: resource: Add Medion S17413 to IRQ override quirk (Mark Langsdorf) [RHEL-1021]
  - ACPI: LPIT: move to use bus_get_dev_root() (Mark Langsdorf) [RHEL-1021]
  - ACPI: SPCR: Prefix error messages with FW_BUG (Mark Langsdorf) [RHEL-1021]
  - ACPI: processor: Fix evaluating _PDC method when running as Xen dom0 (Mark Langsdorf) [RHEL-1021]
  - ACPI: s2idle: Log when enabling wakeup IRQ fails (Mark Langsdorf) [RHEL-1021]
  - ACPI: processor: Check for null return of devm_kzalloc() in fch_misc_setup() (Mark Langsdorf) [RHEL-1021]
  - ACPI: PPTT: Fix to avoid sleep in the atomic context when PPTT is absent (Mark Langsdorf) [RHEL-1021]
  - ACPI: x86: Add skip i2c clients quirk for Lenovo Yoga Book X90 (Mark Langsdorf) [RHEL-1021]
  - ACPI: x86: utils: Add Cezanne to the list for forcing StorageD3Enable (Mark Langsdorf) [RHEL-1021]
  - ACPI: resource: Skip IRQ override on Asus Expertbook B2402FBA (Mark Langsdorf) [RHEL-1021]
  - ACPI: resource: Do IRQ override on all TongFang GMxRGxx (Mark Langsdorf) [RHEL-1021]
  - ACPI: make kobj_type structures constant (Mark Langsdorf) [RHEL-1021]
  - ACPI: resource: Add IRQ overrides for MAINGEAR Vector Pro 2 models (Mark Langsdorf) [RHEL-1021]
  - ACPI: PMIC: Add comments with DSDT power opregion field names (Mark Langsdorf) [RHEL-1021]
  - ACPI: APEI: EINJ: Limit error type to 32-bit width (Mark Langsdorf) [RHEL-1021]
  - ACPI: NFIT: fix a potential deadlock during NFIT teardown (Mark Langsdorf) [RHEL-1021]
  - ACPI: Don't build ACPICA with '-Os' (Mark Langsdorf) [RHEL-1021]
  - ACPI: PRM: Check whether EFI runtime is available (Mark Langsdorf) [RHEL-1021]
  - ACPI: PNP: Introduce list of known non-PNP devices (Mark Langsdorf) [RHEL-1021]
  - ACPICA: nsrepair: handle cases without a return value correctly (Mark Langsdorf) [RHEL-1021]
  - ACPI: resource: Skip IRQ override on Asus Expertbook B2402CBA (Mark Langsdorf) [RHEL-1021]
  - ACPI: Silence missing prototype warnings (Mark Langsdorf) [RHEL-1021]
  - ACPI: processor: perflib: Avoid updating frequency QoS unnecessarily (Mark Langsdorf) [RHEL-1021]
  - ACPI: processor: perflib: Use the "no limit" frequency QoS (Mark Langsdorf) [RHEL-1021]
  - ACPI: processor: idle: Drop unnecessary (void *) conversion (Mark Langsdorf) [RHEL-1021]
  - ACPICA: Constify pathname argument for acpi_get_handle() (Mark Langsdorf) [RHEL-1021]
  - ACPICA: Drop port I/O validation for some regions (Mark Langsdorf) [RHEL-1021]
  - ACPI: PMIC: Add pmic_i2c_address to BYT Crystal Cove support (Mark Langsdorf) [RHEL-1021]
  - ACPI: tables: Add support for NBFT (Mark Langsdorf) [RHEL-1021]
  - ACPI: x86: s2idle: Force AMD GUID/_REV 2 on HP Elitebook 865 (Mark Langsdorf) [RHEL-1021]
  - ACPI: x86: s2idle: Stop using AMD specific codepath for Rembrandt+ (Mark Langsdorf) [RHEL-1021]
  - ACPI: resource: Add Asus ExpertBook B2502 to Asus quirks (Mark Langsdorf) [RHEL-1021]
  - ACPI: resource: do IRQ override on Lenovo 14ALC7 (Mark Langsdorf) [RHEL-1021]
  - ACPI: resource: do IRQ override on XMG Core 15 (Mark Langsdorf) [RHEL-1021]
  - ACPI: EC: Fix ECDT probe ordering issues (Mark Langsdorf) [RHEL-1021]
  - ACPI: EC: Fix EC address space handler unregistration (Mark Langsdorf) [RHEL-1021]
  - ACPICA: Allow address_space_handler Install and _REG execution as 2 separate steps (Mark Langsdorf) [RHEL-1021]
  - ACPI: x86: Add skip i2c clients quirk for Medion Lifetab S10346 (Mark Langsdorf) [RHEL-1021]
  - ACPI: APEI: EINJ: Refactor available_error_type_show() (Mark Langsdorf) [RHEL-1021]
  - ACPI: APEI: EINJ: Fix formatting errors (Mark Langsdorf) [RHEL-1021]
  - ACPI: processor: perflib: Adjust acpi_processor_notify_smm() return value (Mark Langsdorf) [RHEL-1021]
  - ACPI: processor: perflib: Rearrange acpi_processor_notify_smm() (Mark Langsdorf) [RHEL-1021]
  - ACPI: processor: perflib: Rearrange unregistration routine (Mark Langsdorf) [RHEL-1021]
  - ACPI: processor: perflib: Drop redundant parentheses (Mark Langsdorf) [RHEL-1021]
  - ACPI: processor: perflib: Adjust white space (Mark Langsdorf) [RHEL-1021]
  - ACPI: processor: idle: Drop unnecessary statements and parens (Mark Langsdorf) [RHEL-1021]
  - ACPI: thermal: Adjust critical.flags.valid check (Mark Langsdorf) [RHEL-1021]
  - ACPI: fan: Convert to use sysfs_emit_at() API (Mark Langsdorf) [RHEL-1021]
  - ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() (Mark Langsdorf) [RHEL-1021]
  - ACPI: use sysfs_emit() instead of scnprintf() (Mark Langsdorf) [RHEL-1021]
  - ACPI: x86: Add skip i2c clients quirk for Lenovo Yoga Tab 3 Pro (YT3-X90F) (Mark Langsdorf) [RHEL-1021]
  - ACPI: APEI: Remove a useless include (Mark Langsdorf) [RHEL-1021]
  - ACPI: APEI: Silence missing prototype warnings (Mark Langsdorf) [RHEL-1021]
  - ACPI: fan: Bail out if extract package failed (Mark Langsdorf) [RHEL-1021]
  - ACPI: pfr_telemetry: use ACPI_FREE() to free acpi_object (Mark Langsdorf) [RHEL-1021]
  - ACPI: pfr_update: use ACPI_FREE() to free acpi_object (Mark Langsdorf) [RHEL-1021]
  - ACPI: bus: Fix the _OSC capability check for FFH OpRegion (Mark Langsdorf) [RHEL-1021]
  - ACPI: HMAT: Fix initiator registration for single-initiator systems (Mark Langsdorf) [RHEL-1021]
  - ACPI: HMAT: remove unnecessary variable initialization (Mark Langsdorf) [RHEL-1021]
  - ACPI: APMT: Fix kerneldoc and indentation (Mark Langsdorf) [RHEL-1021]
  - ACPI: Implement a generic FFH Opregion handler (Mark Langsdorf) [RHEL-1021]
  - redhat: configs: enable  FFH OpRegion handlers (Mark Langsdorf) [RHEL-1021]
  - ACPI: Enable FPDT on arm64 (Mark Langsdorf) [RHEL-1021]
  - ACPI: sysfs: use sysfs_emit() to instead of scnprintf() (Mark Langsdorf) [RHEL-1021]
  - ACPI: irq: Fix some kernel-doc issues (Mark Langsdorf) [RHEL-1021]
  - ACPI: tables: Fix the stale comments for acpi_locate_initial_tables() (Mark Langsdorf) [RHEL-1021]
  - ACPI: HMAT: use hotplug_memory_notifier() directly (Mark Langsdorf) [RHEL-1021]
  - ACPICA: Fix error code path in acpi_ds_call_control_method() (Mark Langsdorf) [RHEL-1021]
  - ACPICA: Add utcksum.o to the acpidump Makefile (Mark Langsdorf) [RHEL-1021]
  - ACPI/IORT: Update SMMUv3 DeviceID support (Mark Langsdorf) [RHEL-1021]
  - ACPI: ARM Performance Monitoring Unit Table (APMT) initial support (Mark Langsdorf) [RHEL-1021]
  - ACPI: sysfs: Use kstrtobool() instead of strtobool() (Mark Langsdorf) [RHEL-1021]
  - ACPI: EC: Add quirk for the HP Pavilion Gaming 15-cx0041ur (Mark Langsdorf) [RHEL-1021]
  - ACPI: processor: throttling: remove variable count (Mark Langsdorf) [RHEL-1021]
  - ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value (Mark Langsdorf) [RHEL-1021]
  - ACPI: APEI: Drop unsetting driver data on remove (Mark Langsdorf) [RHEL-1021]
  - ACPI: x86: Add another system to quirk list for forcing StorageD3Enable (Mark Langsdorf) [RHEL-1021]
  - ACPICA: Finish support for the CDAT table (Mark Langsdorf) [RHEL-1021]
  - ACPICA: Improve warning message for "invalid ACPI name" (Mark Langsdorf) [RHEL-1021]
  - ACPICA: Check that EBDA pointer is in valid memory (Mark Langsdorf) [RHEL-1021]
  - arm64: acpi: Fix possible memory leak of ffh_ctxt (Mark Langsdorf) [RHEL-1021]
  - arm64: Add architecture specific ACPI FFH Opregion callbacks (Mark Langsdorf) [RHEL-1021]
  - ACPICA: Add support for FFH Opregion special context data (Mark Langsdorf) [RHEL-1021]
  - ACPICA: Do not touch VGA memory when EBDA < 1ki_b (Mark Langsdorf) [RHEL-1021]
  - ACPICA: Make acpi_ex_load_op() match upstream (Mark Langsdorf) [RHEL-1021]
  - ACPI: scan: Add LATT2021 to acpi_ignore_dep_ids[] (Mark Langsdorf) [RHEL-1021]
  - ACPI: resource: Skip IRQ override on Asus Vivobook S5602ZA (Mark Langsdorf) [RHEL-1021]
  - apei/ghes: Use xchg_release() for updating new cache slot instead of cmpxchg() (Mark Langsdorf) [RHEL-1021]
  - ACPI: PCI: Fix device reference counting in acpi_get_pci_dev() (Mark Langsdorf) [RHEL-1021]
  - ACPI: resource: note more about IRQ override (Mark Langsdorf) [RHEL-1021]
  - ACPI: resource: do IRQ override on LENOVO IdeaPad (Mark Langsdorf) [RHEL-1021]
  - ACPI: extlog: Handle multiple records (Mark Langsdorf) [RHEL-1021]
  - ACPI: APEI: Fix integer overflow in ghes_estatus_pool_init() (Mark Langsdorf) [RHEL-1021]
  - ACPI: thermal: Drop redundant parens from expressions (Mark Langsdorf) [RHEL-1021]
  - ACPI: thermal: Use white space more consistently (Mark Langsdorf) [RHEL-1021]
  - ACPI: thermal: Drop some redundant code (Mark Langsdorf) [RHEL-1021]
  - ACPI: APEI: do not add task_work to kernel thread to avoid memory leak (Mark Langsdorf) [RHEL-1021]
  - ACPI: PM: Take wake IRQ into consideration when entering suspend-to-idle (Mark Langsdorf) [RHEL-1021]
  - ACPI: resources: Add wake_capable parameter to acpi_dev_irq_flags (Mark Langsdorf) [RHEL-1021]
  - ACPI: LPSS: Replace loop with first entry retrieval (Mark Langsdorf) [RHEL-1021]
  - ACPI: LPSS: Deduplicate skipping device in acpi_lpss_create_device() (Mark Langsdorf) [RHEL-1021]
  - ACPI: x86: s2idle: Fix a NULL pointer dereference (Mark Langsdorf) [RHEL-1021]
  - ACPI: x86: s2idle: Add another ID to s2idle_dmi_table (Mark Langsdorf) [RHEL-1021]
  - ACPI: Kconfig: Drop link to https://01.org/linux-acpi (Mark Langsdorf) [RHEL-1021]
  - ACPI: DPTF: Drop stale link from Kconfig help (Mark Langsdorf) [RHEL-1021]
  - ACPI: x86: s2idle: Add a quirk for ASUSTeK COMPUTER INC. ROG Flow X13 (Mark Langsdorf) [RHEL-1021]
  - ACPI: x86: s2idle: Add a quirk for ASUS ROG Zephyrus G14 (Mark Langsdorf) [RHEL-1021]
  - ACPI: x86: s2idle: Add a quirk for Lenovo Slim 7 Pro 14ARH7 (Mark Langsdorf) [RHEL-1021]
  - ACPI: x86: s2idle: If a new AMD _HID is missing assume Rembrandt (Mark Langsdorf) [RHEL-1021]
  - ACPI: x86: s2idle: Add a quirk for ASUS TUF Gaming A17 FA707RE (Mark Langsdorf) [RHEL-1021]
  - ACPI: x86: s2idle: Move _HID handling for AMD systems into structures (Mark Langsdorf) [RHEL-1021]
  - ACPI: x86: s2idle: Add module parameter to prefer Microsoft GUID (Mark Langsdorf) [RHEL-1021]
  - ACPI: resource: Add ASUS model S5402ZA to quirks (Mark Langsdorf) [RHEL-1021]
  - ACPI: AMBA: Add ARM DMA-330 controller to the supported list (Mark Langsdorf) [RHEL-1021]
  - ACPI: APEI: Remove unneeded result variables (Mark Langsdorf) [RHEL-1021]
  - ACPI: fan: Reorder symbols to get rid of a few forward declarations (Mark Langsdorf) [RHEL-1021]
  - ACPI: x86: Add a quirk for Dell Inspiron 14 2-in-1 for StorageD3Enable (Mark Langsdorf) [RHEL-1021]
  - ACPI: PCI: Rework acpi_get_pci_dev() (Mark Langsdorf) [RHEL-1021]
  - ACPI: HMAT: Drop unused dev_fmt() and redundant 'HMAT' prefix (Mark Langsdorf) [RHEL-1021]
  - ACPI: x86: Refactor _UID handling to use acpi_dev_uid_to_integer() (Mark Langsdorf) [RHEL-1021]
  - ACPI: LPSS: Refactor _UID handling to use acpi_dev_uid_to_integer() (Mark Langsdorf) [RHEL-1021]
  - ACPI: utils: Add acpi_dev_uid_to_integer() helper to get _UID as integer (Mark Langsdorf) [RHEL-1021]
  - ACPI: resource: Add helper function acpi_dev_get_memory_resources() (Mark Langsdorf) [RHEL-1021]
  - ACPI: LPSS: Use the helper acpi_dev_get_memory_resources() (Mark Langsdorf) [RHEL-1021]
  - ACPI: resource: Skip IRQ override on Asus Vivobook K3402ZA/K3502ZA (Mark Langsdorf) [RHEL-1021]
  - ACPI: APD: Use the helper acpi_dev_get_memory_resources() (Mark Langsdorf) [RHEL-1021]
  - ACPI: resource: Filter out the non memory resources in is_memory() (Mark Langsdorf) [RHEL-1021]
  - ACPI: tables: FPDT: Don't call acpi_os_map_memory() on invalid phys address (Mark Langsdorf) [RHEL-1021]
  - ACPI: s2idle: Add a new ->check() callback for platform_s2idle_ops (Mark Langsdorf) [RHEL-1021]
  - ACPI: property: Silence missing-declarations warning in apple.c (Mark Langsdorf) [RHEL-1021]
  - ACPI: platform: Use PLATFORM_DEVID_NONE in acpi_create_platform_device() (Mark Langsdorf) [RHEL-1021]
  - ACPI: platform: Remove redundant print on -ENOMEM (Mark Langsdorf) [RHEL-1021]
  - ACPI: platform: Sort forbidden_id_list[] in ascending order (Mark Langsdorf) [RHEL-1021]
  - ACPI: platform: Use sizeof(*pointer) instead of sizeof(type) (Mark Langsdorf) [RHEL-1021]
  - ACPI: property: Use acpi_dev_parent() (Mark Langsdorf) [RHEL-1021]
  - ACPI: bus: Refactor ACPI matching functions for better readability (Mark Langsdorf) [RHEL-1021]
  - ACPI: bus: Drop kernel doc annotation from acpi_bus_notify() (Mark Langsdorf) [RHEL-1021]
  - ACPI: EC: Drop unneeded result variable from ec_write() (Mark Langsdorf) [RHEL-1021]
  - ACPI: APEI: Add BERT error log footer (Mark Langsdorf) [RHEL-1021]
  - platform/x86: asus-wmi: Move acpi_backlight=native quirks to ACPI video_detect.c (Mark Langsdorf) [RHEL-1021]
  - ACPI: video: Fix indentation of video_detect_dmi_table[] entries (Mark Langsdorf) [RHEL-1021]
  - platform/x86: acer-wmi: Move backlight DMI quirks to acpi/video_detect.c (Mark Langsdorf) [RHEL-1021]
  - platform/x86: asus-wmi: Move acpi_backlight=vendor quirks to ACPI video_detect.c (Mark Langsdorf) [RHEL-1021]
  - ACPI: video: Refactor acpi_video_get_backlight_type() a bit (Mark Langsdorf) [RHEL-1021]
  - ACPI: video: Simplify acpi_video_unregister_backlight() (Mark Langsdorf) [RHEL-1021]
  - ACPI: video: Remove acpi_video_bus from list before tearing it down (Mark Langsdorf) [RHEL-1021]
  - ACPI: video: Remove code to unregister acpi_video backlight when a native backlight registers (Mark Langsdorf) [RHEL-1021]
  - ACPI: PM: Fix NULL argument handling in acpi_device_get/set_power() (Mark Langsdorf) [RHEL-1021]
  - ACPI: bus: Remove the unneeded result variable (Mark Langsdorf) [RHEL-1021]
  - ACPI: OSI: Remove Linux-HPI-Hybrid-Graphics _OSI string (Mark Langsdorf) [RHEL-1021]
  - ACPI: OSI: Remove Linux-Lenovo-NV-HDMI-Audio _OSI string (Mark Langsdorf) [RHEL-1021]
  - ACPI: OSI: Remove Linux-Dell-Video _OSI string (Mark Langsdorf) [RHEL-1021]
  - ACPI: Drop parent field from struct acpi_device (Mark Langsdorf) [RHEL-1021]
  - ACPI: move from strlcpy() with unused retval to strscpy() (Mark Langsdorf) [RHEL-1021]
  - ACPI: PM: Fix acpi_dev_state_d0() kerneldoc (Mark Langsdorf) [RHEL-1021]
  - ACPI: scan: Eliminate __acpi_device_add() (Mark Langsdorf) [RHEL-1021]
  - ACPI: scan: Rearrange initialization of ACPI device objects (Mark Langsdorf) [RHEL-1021]
  - ACPI: Rename acpi_bus_get/put_acpi_device() (Mark Langsdorf) [RHEL-1021]
  - ACPI: scan: Rename acpi_bus_get_parent() and rearrange it (Mark Langsdorf) [RHEL-1021]


author: John Kacur <jkacur@redhat.com> - 2.7-8
changelog:
  - Install kernelshark manpage with kernelshark subpackage, not with trace-cmd
  Resolves: rhbz#1678252


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-37
changelog:
  - Doc: improve the usage documentation of the logger
  - Update the kdump sysconfig
  - Capitalize the configuration name of log level
  - Add the rd.kdumploglvl option to control log level in the second kernel
  - Appropriately converts logger numeric level to syslog log level
  - Remove unused log levels for kdump logger
  - Add sanity checks for the log levels
  - Add code comments to help better understanding
  - Doc: add a documentation for the usage of logger
  - Improve debugging in the kdump kernel
  - kdumpctl: add the '-d' option to enable the kexec loading debugging messages
  - kdump.sysconfig: add the kdump logger configurations
  - enable the logger for kdump
  - introduce the kdump logger from the dracut


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-38
changelog:
  - Don's try to restart dracut-initqueue if it's already failed
  - fadump-howto: update about 'nocma' and 'off' options for 'fadump=' parameter
  - dracut-module-setup.sh: use auto6 for ipv6
  - module-setup.sh: enable vlan on team interface
  - Fix rootfs detection in dump_fs
  - Remove RHEL-only patch: kexec-tools-2.0.18-makedumpfile-arm64-Add-support-for-ARMv8.2-LVA-52-bi.patch
  - Rebase to makedumpfile-1.6.8 (step1)


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-43
changelog:
  - Always include watchdog-modules
  - mkdumprd: Ensure kdumpbase is added
  - Move watchdog detect and install code to module-setup.sh
  - Add a helper to omit non-mandatory dracut module
  - Move some dracut module dependencies checks to module-setup.sh
  - Set watchdog's pretimeout to zero in kdump kernel
  - kdump-lib.sh: Use a more generic helper to detect omitted dracut module
  - Fix the watchdog drivers detection code
  - Add a helper for detecting watchdog drivers
  - Remove a redundant nfs check
  - kdumpctl: split the driver detection from fs dection function
  - kdump.service: use ConditionKernelCommandLine=crashkernel
  - Revert "Append both nofail and x-systemd.before to kdump mount target"
  - Revert "Don's try to restart dracut-initqueue if it's already failed"
  - Fix dump_fs mount point detection and fallback mount
  - kdump.conf: Update doc about core_collector for ssh target
  - Save the final failure information to log file if saving vmcore failed
  - Doc: Improve the kdump sysconfig document
  - kdumpctl: fix a variable expansion in check_fence_kdump_config()
  - Fedora 33 rhpkg build bug


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-44
changelog:
  - module-setup.sh: don't polute the namespace unnecessarily
  - module-setup.sh: don't source $dracutfunctions
  - logger: source the logger file individually
  - dracut-module-setup.sh: enable ForwardToConsole=yes in fadump mode


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-45
changelog:
  - origin/rhel-8.4.0) Revert "Revert "Append both nofail and x-systemd.before to kdump mount target""
  - kdump.conf: add ipv6 example for nfs and ssh dump
  - fix kdump failure of saving vmcore with the scp + ipv6 method


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-47
changelog:
  - Implement IP netmask calculation to replace "ipcalc -m"
  - kdumpctl: fix check_config error when kdump.conf is empty
  - Fix incorrect vmcore permissions when dumped through ssh
  - Fix incorrect permissions on kdump dmesg file


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-48
changelog:
  - kdumpctl: Add kdumpctl estimate
  - mkdumprd: make use of the new get_luks_crypt_dev helper
  - kdump-lib.sh: introduce a helper to get all crypt dev used by kdump
  - kdump-lib.sh: introduce a helper to get underlying crypt device
  - RHEL-only: keep total memory size coherent to RHEL-only kernel patch
  - Show write byte size in report messages
  - Add shorthand --show-stats option to show report stats
  - Add --dry-run option to prevent writing the dumpfile
  - kdump-lib.sh: introduce functions to return recommened mem size


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-50
changelog:
  - rd.route should use the name from kdump_setup_ifname
  - get kdump ifname once in kdump_install_netdev


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-51
changelog:
  - Stop reloading kdump service on CPU hotplug event for FADump
  - fadump: improve fadump-howto.txt about remote dump target setup


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-52
changelog:
  - Write to `/var/lib/kdump` if $KDUMP_BOOTDIR not writable
  - Iterate /sys/bus/ccwgroup/devices to tell if we should set up rd.znet
  - mkdumprd: display the absolute path of dump location in the check_user_configured_target()


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-53
changelog:
  - check for invalid physical address of /proc/kcore when making ELF dumpfile
  - check for invalid physical address of /proc/kcore when finding max_paddr
  - fix format issue in find_online_znet_device
  - check the existence of /sys/bus/ccwgroup/devices before trying to find online network device
  - kdump-lib.sh: fix a warning in prepare_kdump_bootinfo()


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-54
changelog:
  - kdump/ppc64: rebuild initramfs image after migration
  - Check the existence of /sys/bus/ccwgroup/devices/*/online beforehand
  - kdump.sysconfig.s390: Remove "prot_virt" from kdump kernel cmdline


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-59
changelog:
  - makedumpfile: printk: use committed/finalized state values
  - makedumpfile: printk: add support for lockless ringbuffer
  - kexec-tools: printk: Use %zu to format size_t
  - kexec-tools: printk: Use ULL suffix for 64-bit constants
  - kexec-tools: printk: add support for lockless ringbuffer


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-60
changelog:
  - fadump-init: clean up mount points properly
  - fadump: kdumpctl should check the modules used by the fadump initramfs
  - fadump: isolate fadump initramfs image within the default one
  - mkdumprd: Use xz for squash image compression


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-66
changelog:
  - kdump/ppc64: suppress the error message "Could not find a registered notification tool" from servicelog_notify
  - Enable zstd compression for makedumpfile in kexec-tools.spec


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-69
changelog:
  - s390: add support for --reuse-cmdline
  - use slurp_proc_file() in get_command_line()
  - add slurp_proc_file()
  - s390: use KEXEC_ALL_OPTIONS
  - s390: add variable command line size
  - util_lib/elf_info: harden parsing of printk buffer
  - print error when reading with unsupported compression
  - use cycle detection when parsing the prink log_buf
  - use pointer arithmetics for dump_dmesg
  - add generic cycle detection


author: Pingfan Liu <piliu@redhat.com> - 2.0.24-1
changelog:
  - kdumpctl: sync the $TARGET_INITRD after rebuild
  - Avoid false-positive mem_section validation with vmlinux
  - Rebase kexec-tools to 2.0.24
  - Rebase makedumpfile to 1.7.1


author: Pingfan Liu <piliu@redhat.com> - 2.0.24-6
changelog:
  - kdump-lib: Add the CoreOS kernel dir to the boot_dirlist
  - kdump-lib: attempt to fix BOOT_IMAGE detection
  - kdump-lib: change how ostree based systems are detected
  - kdump-lib: clear up references to Atomic/CoreOS


author: Pingfan Liu <piliu@redhat.com> - 2.0.25-2
changelog:
  - mkdumprd: Improve error messages on non-existing NFS target directories
  - fadump: avoid non-debug kernel use for fadump case


author: Pingfan Liu <piliu@redhat.com> - 2.0.25-3
changelog:
  - kdump.conf: use a simple generator script to maintain
  - Reduce kdump memory consumption by not letting NetworkManager manage unneeded network interfaces


author: Pingfan Liu <piliu@redhat.com> - 2.0.25-4
changelog:
  - Don't check fs modified when dump target is lvm2 thinp
  - Add dependency of dracut lvmthinpool-monitor module
  - lvm.conf should be check modified if lvm2 thinp enabled
  - Add lvm2 thin provision dump target checker
  - Fix the sync issue for dump_fs


author: Pingfan Liu <piliu@redhat.com> - 2.0.25-5
changelog:
  dracut-module-setup: Fix invalid rd.znet command line entry
   dracut-module-setup: Fix persistent nic name on s390


author: Pingfan Liu <piliu@redhat.com> - 2.0.26-6
changelog:
  - dracut-module-setup.sh: skip installing driver for the loopback interface
  - Reduce kdump memory consumption by only installing needed NIC drivers


author: Pingfan Liu <piliu@redhat.com> - 2.0.26-8
changelog:
  - mkdumprd: Use the correct syntax to redirect the stderr to null
  - mkdumprd: call dracut with --add-device to install the drivers needed by /boot partition automatically for FIPS
  - Add NICs that handle DNS queries to the allowlist


author: Pingfan Liu <piliu@redhat.com> - 2.0.26-11
changelog:
  - powerpc: update kdumpctl to load kernel signing key for fadump
  - powerpc: update kdumpctl to remove deletion of kernel signing key once loaded


author: Pingfan Liu <piliu@redhat.com> - 2.0.25-5
changelog:
  - dracut-module-setup: Fix invalid rd.znet command line entry
  - dracut-module-setup: Fix persistent nic name on s390


author: David Howells <dhowells@redhat.com> - 1.5.9-1
changelog:
  - Add manpages for get_persistent.
  - Fix memory leaks in keyctl_describe/read/get_security_alloc().
  - Use keyctl_describe_alloc in dump_key_tree_aux rather than open coding it.
  - Exit rather than returning from act_xxx() functions.
  - Fix memory leak in dump_key_tree_aux.
  - Only get the groups list if we need it.
  - Don't trust sscanf's %n argument.
  - Use the correct path macros in the specfile.
  - Avoid use realloc when the memory has no content.
  - Fix a bunch of issues in key.dns_resolver.
  - Fix command table searching in keyctl utility.
  - Fix a typo in the permissions mask constants.
  - Improve the keyctl_read manpage.
  - Add man7 pages describing various keyrings concepts.


author: David Howells <dhowells@redhat.com> - 1.5.10-1
changelog:
  - Include sys/types.h in keyutils.h.
  - The dns resolver needs limits.h.
  - Overhaul of all manual pages.
  - Some manual pages moved to Linux man-pages project.
  - Add Diffie-Helman keyctl function.


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 25-8
changelog:
  - weak-modules: fix initial state creation for dry-run
  - weak-modules: check compatibility in a temporary directory
    Resolves: rhbz#1622990.


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 25-10
changelog:
  - weak-modules: group modules on add-kernel
  - weak-modules: do not make groups if there are no extra modules
    Resolves: rhbz#1649211


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 25-16
changelog:
  - weak-modules: update_modules_for_krel: always finish sandbox
  - weak-modules: groupping: use dependencies of extra/ provider
    Resolves: rhbz#1778889


author: - Andy Walsh <awalsh@redhat.com> - 6.2.3.91-73
changelog:
  - Removed unused UDS bio statistics.
  - Resolves: rhbz#1827762
  - Removed support for old kernels.
  - Resolves: rhbz#1827762
  - Fixed Coverity errors.
  - Resolves: rhbz#1827763
  - Improved the error message when slab journal locks overflow.
  - Resolves: rhbz#1827761
  - Fixed a bug which could result in VDO issuing I/O while suspended.
  - Resolves: rhbz#1824789
  - Fixed a rare double-enqueue bug in the recovery journal.
  - Resolves: rhbz#1824802
  - Modified VDO to not allocate an index if the VDO device is started
    with deduplication disabled.
  - Resolves: rhbz#1755448
  - Nodified VDO to not log spurious journal lock warnings when cleaning up
    write requests which failed due to the VDO going read-only.
  - Resolves: rhbz#1840455


author: - Andy Walsh <awalsh@redhat.com> - 6.2.3.107-73
changelog:
  - Fixed a bug which can cause a soft lockup if users interrupt processes
    waiting on dm-setup commands.
  - Resolves: rhbz#1844651
  - Fixed a rare race which could cause a suspend of a VDO device to fail.
  - Resolves: rhbz#1847747


author: - Andy Walsh <awalsh@redhat.com> - 6.2.3.107-74
changelog:
  - Updated dependencies to prevent installing kernel-rt incorrectly.
  - Resolves: rhbz#1811923
  - Bumped requirement for new 4.18 kernel
  - Relates: rhbz#1812069


author: - Andy Walsh <awalsh@redhat.com> - 6.2.4.14-74
changelog:
  - Fixed a bug which causes the UDS index to consume an excessive
    number of CPU cycles when the VDO device is idle.
  - Resolves: rhbz#1870660


author: - Andy Walsh <awalsh@redhat.com> - 6.2.4.26-74
changelog:
  - Modified physical growth to validate the new VDO size against the size of
    the underlying storage.
  - Resolves: rhbz#1732922
  - Fixed issues which prevented lvrename from working on lvm managed
    VDO devices.
  - Resolves: rhbz#1888419


author: - Andy Walsh <awalsh@redhat.com> - 6.2.5.11-78
changelog:
  - Introduced new memory size parameter values for UDS indexes which have
    been converted from vdo script management to LVM.
  - Resolves: rhbz#1928284


author: - Andy Walsh <awalsh@redhat.com> - 6.2.5.41-78
changelog:
  - Fixed bugs in reading the UDS index of a VDO volume which was converted
    to LVM.
  - Resolves: rhbz#1928284


author: - Andy Walsh <awalsh@redhat.com> - 6.2.5.62-79
changelog:
  - Fixed chapter computation for a converted sparse index.
  - Resolves: rhbz#1965516
  - Fixed invalidation of converted chapters.
  - Resolves: rhbz#1966818
  - Removed extraneous fields from the super block of a converted index.
  - Resolves: rhbz#1965546
  - Fixed calculation of the number of expiring chapters in a converted
    index.
  - Resolves: rhbz#1975546
  - Fixed bugs rebuilding a converted index.
  - Resolves: rhbz#1966824


author: - Andy Walsh <awalsh@redhat.com> - 6.2.5.65-79
changelog:
  - Removed unneeded allocations from the previous fixes for rebuilding
    a converted index.
  - Resolves: rhbz#1966824


author: - Andy Walsh <awalsh@redhat.com> - 6.2.5.72-79
changelog:
  - Fixed a bug which could result in the UDS index issuing I/O while
    suspended.
  - Resolves: rhbz#1990180


author: - Andy Walsh <awalsh@redhat.com> - 6.2.6.3-83
changelog:
  - Adjusted kernel dependencies to grab the right packages.
  - Resolves: rhbz#2011426
  - Rebuilt for latest kernel.
  - Relates: rhbz#2000909


author: - Andy Walsh <awalsh@redhat.com> - 6.2.7.17-86
changelog:
  - Fixed bug which could result in empty flushes being issued to the storage
    below vdo while suspended.
  - Resolves: rhbz#2013056
  - Fixed syntax mismatch which prevented lvm from being able to configure a
    512MB UDS index.
  - Resolves: rhbz#2073203
  - Fixed a race handling timeouts of dedupe index queries.
  - Resolves: rhbz#2092075


author: - Andy Walsh <awalsh@redhat.com> - 6.2.8.1-87
changelog:
  - Fixed a bug which could produce a deadlock after multiple saves and resumes
    of a vdo.
  - Resolves: rhbz#2109047


author: - Susan LeGendre-McGhee <slegendr@redhat.com> - 6.2.8.7-88
changelog:
  - Fixed bug in read-only rebuild when the logical size of the volume is an
    exact multiple of 821 4K blocks.
  - Resolves: rhbz#2166131


author: Robbie Harwood <rharwood@redhat.com> - 1.18.2-3
changelog:
  - Match Heimdal behavior for channel bindings
  - Code hygiene + test stability fix included
  - Resolves: #1840518


author: Julien Rische <jrische@redhat.com> - 1.18.2-21
changelog:
  - Backport fix of memory use after free during libkrad cleanup
  - Backport support for larger RADIUS attributes in libkrad
  - Resolves: rhbz#2103125


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 1.10-3
changelog:
  PMTUd: Fix MTU calculation when using crypto
    Resolves: rhbz#1736872
    host: Fix defrag buffer reclaim logic that could cause delivery
          of corrupted data
    ResolveS: rhbz#1761711


author: Christine Caulfield <ccaulfie@redhat.com> - 1.22-1
changelog:
  Rebase to 1.22
    Resolves: rhbz#1999976

    * Wed Sep 23 2020 Christine Caulfield <ccaulfie@redhat.com> - 1.18-1
    Rebase to 1.18
    Resolves: rhbz#1855301


author: Christine Caulfield <ccaulfie@redhat.com> - 1.25-1
changelog:
  Rebase to 1.25 for PMTUd fixes
    Resolves: rhbz#2161172

    * Wed Jul 27 2022 Christine Caulfield <ccaulfie@redhat.com> - 1.24-2
    Don't run nozzle_up_down tests, as they don't work in RH CI
    Resolves: rhbz#2024095


author: Robert Scheck <robert@fedoraproject.org> 1.2.76-13
changelog:
  - Replace patch from openSUSE by the Debian one to not only build
    kyotocabinet with GCC >= 6 but also with GCC >= 7 (#1307706 #c15)


author: Tomas Orsava <torsava@redhat.com> - 2.6.0-5
changelog:
  - Require the Python interpreter directly instead of using the package name
  - Resolves: rhbz#1633617


author: Jakub Hrozek <jhrozek@redhat.com> - 2.6.0-7
changelog:
  - Resolves: rhbz#1634268 - ECP signature check fails with
                             LASSO_DS_ERROR_SIGNATURE_NOT_FOUND when
                             assertion signed instead of response


author: Jakub Hrozek <jhrozek@redhat.com> - 2.6.0-8
changelog:
  - Resolves: rhbz#1730018 - lasso includes "Destination" attribute in SAML
                             AuthnRequest populated with SP
                             AssertionConsumerServiceURL when ECP workflow
                             is used which leads to IdP-side errors


author: Jakub Hrozek <jhrozek@redhat.com> - 2.6.0-9
changelog:
  - Resolves: rhbz#1888195 - [RFE] release (built) python3-lasso pkg (coming
                             from lasso)


author: Jakub Hrozek <jhrozek@redhat.com> - 2.6.0-10
changelog:
  - Resolves: rhbz#1951653 - CVE-2021-28091 lasso: XML signature wrapping
                             vulnerability when parsing SAML responses [rhel-8]


author: Jakub Hrozek <jhrozek@redhat.com> - 2.6.0-11
changelog:
  - Bump release to force the package through OSCI as the previous
    build reached CI just in time for an outage
  - Related: rhbz#1888195 - [RFE] release (built) python3-lasso pkg (comingfrom lasso)


author: Jakub Hrozek <jhrozek@redhat.com> - 2.6.0-12
changelog:
  - Fix a dead code issue in the signature wrapping patch
  - Resolves: rhbz#1951653 - CVE-2021-28091 lasso: XML signature wrapping
                             vulnerability when parsing SAML responses [rhel-8]


author: John Dennis <jdennis@redhat.com> - 2.5.1-12
changelog:
  - Resolves: rhbz#1542126, rhbz#1556016
  - xmlsec removed SOAP support, reimplement missing xmlSecSoap* in Lasso


author: <jdennis@redhat.com> - 2.6.0-1
changelog:
  - Upgrade to latest upstream
  - Build using Python3, add python3 subpackage
  - Resolves: rhbz#1592416 Enable perl subpackage


author: <jdennis@redhat.com> - 2.6.0-2
changelog:
  - fix language bindings package names to comply with guidelines,
    instead of lasso-lang use lang-lasso
  - fix conditional logic used to build on rhel
  - Resolves: rhbz#1589856 Drop python2 subpackage from RHEL8


author: Rex Dieter <rdieter@fedoraproject.org> - 2.7-4
changelog:
  - %files: less globs, use %license
  - tighten subpkg deps
  - -devel: use %doc
  - use %version in Source URL
  - simplify %setup
  - %check: make check


author: Jakub Hrozek <jhrozek@redhat.com> - 1.5.4-1
changelog:
  - Resolves: rhbz#1684582 - Rebase libldb to version 1.5.4 for Samba
  - Resolves: rhbz#1567115 - libldb: Drop Python 2 subpackages from RHEL 8
  - Resolves: rhbz#1597243 - libldb uses Python 2 to build.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.5.4-2
changelog:
  - Fix some python2-related upgrade issues
  - Related: rhbz#1567115 - libldb: Drop Python 2 subpackages from RHEL 8


author: Isaac Boukris <iboukris@redhat.com> - 2.0.7-3
changelog:
  - Resolves: rhbz#1754423 - Rebase libldb to 2.0.7 version for samba
  - Related: rhbz#1754423 - Fix sssd tests (ldb)


author: Isaac Boukris <iboukris@redhat.com> - 2.2.0-1
changelog:
  - Resolves: rhbz#1878114 - Rebase libldb to the version required by Samba
  - Resolves: rhbz#1794349 - Build libldb with lmdb support


author: Andreas Schneider <asn@redhat.com> - 2.3.0-1
changelog:
  - resolves: rhbz#1945021 - Update to version 2.3.0
  - resolves: rhbz#1897082 - Fix libldb tests on aarch64


author: Petr Menšík <pemensik@redhat.com> - 1.7.0-14
changelog:
  - Add only extra flags to default RPM LDFLAGS
  - Fix multilib conflict of ldns-config (#1463423)
  - Make primary python3 in primary build, python2 in optional


author: Jan Macku <jamacku@redhat.com> - 0.97-1
changelog:
  - update to 0.97 (#2159588)
  - drop downstream patch - ipmi: avoid error messages on non-dell platforms


author: Ondrej Dubaj <odubaj@redhat.com> - 3.26.0-5
changelog:
  - Fixed CVE-2019-13752 (#1786529) 
  - Fixed CVE-2019-13753 (#1786535) 
  - Fixed CVE-2019-13734 (#1786509) 
  - Fixed CVE-2019-19924 (#1789776)
  - Fixed CVE-2019-19923 (#1789812)
  - Fixed CVE-2019-19925 (#1789808)
  - Fixed CVE-2019-19959 (#1789823)


author: Ondrej Dubaj <odubaj@redhat.com> - 3.26.0-10
changelog:
  - Fixed CVE-2020-13632 (#1845572)
  - Fixed CVE-2020-13631 (#1845474)
  - Fixed CVE-2020-13630 (#1845153)


author: Ondrej Dubaj <odubaj@redhat.com> - 3.26.0-14
changelog:
  - Fixed CVE-2019-5827 (#1710184)
  - Fixed CVE-2019-13750 (#1786510)
  - Fixed CVE-2019-13751 (#1786522)
  - Fixed CVE-2019-19603 (#1792013)
  - Fixed CVE-2020-13435 (#1841233)


author: Dominik 'Rathann' Mierzejewski <rpm@greysector.net> 1.0.9-1
changelog:
  - update to 1.0.9
  - use license macro
  - tighten file list wildcards
  - switch to https for source URL


author: José Expósito <jexposit@redhat.com> - 1.6.8-7
changelog:
  - Fix CVE-2023-43785: out-of-bounds memory access in _XkbReadKeySyms()
  - Fix CVE-2023-43786: stack exhaustion from infinite recursion in
    PutSubImage()
  - Fix CVE-2023-43787: integer overflow in XCreateImage() leading to
    a heap overflow


author: Peter Hutterer <peter.hutterer@redhat.com> - 3.5.12-9
changelog:
  - Fix CVE-2022-46285: infinite loop on unclosed comments (#2160229)
  - Fix CVE-2022-44617: runaway loop with width of 0 (#2160231)
  - Fix CVE-2022-4883: compression depends on $PATH (#2160239)


author: José Expósito <jexposit@redhat.com> - 3.5.12-10
changelog:
  - CVE-2023-43786 libX11: stack exhaustion from infinite recursion
    in PutSubImage()
  - CVE-2023-43787 libX11: integer overflow in XCreateImage() leading to
    a heap overflow
  - CVE-2023-43788 libXpm: out of bounds read in XpmCreateXpmImageFromBuffer()
  - CVE-2023-43789 libXpm: out of bounds read on XPM with corrupted colormap


author: Jeff Moyer <jmoyer@redhat.com> - 0.3.110-12.el8
changelog:
  - Pass in the distro-provided CFLAGS and LFLAGS. (Jeff Moyer)
  - Get rid of -nostartfiles -nostdlib (Jeff Moyer)
  - Resolves: rhbz#1630578


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 12.10.0-17
changelog:
  - Python 2 binary package renamed to python2-appindicator
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Richard Hughes <richard@hughsie.com> 0.7.8-1
changelog:
  - New upstream release
  - Add as_version_string() for fwupd
  - Add support for component agreements
  - Correctly compare version numbers like '1.2.3' and '1.2.3a'
  - Don't include the path component in the name when parsing the package filename
  - If the launchable is specified don't guess it when composing
  - Never add more than one component to the AppStream store when composing


author: Richard Hughes <richard@hughsie.com> 0.7.9-1
changelog:
  - New upstream release
  - Convert local icons found in metainfo files
  - Follow the Debian tilde usage when ordering versions
  - Use the launchable to find the desktop filename


author: Richard Hughes <richard@hughsie.com> 0.7.10-1
changelog:
  - New upstream release
  - Do not parse firmware files anymore
  - Do not require a release transaction when validating in relaxed mode
  - Extract release descriptions and agreement sections for translation


author: Richard Hughes <richard@hughsie.com> 0.7.11-1
changelog:
  - New upstream release
  - Add AS_APP_QUIRK_DEVELOPER_VERIFIED
  - Escape quotes in attributes
  - Provide async variants of store load functions


author: Richard Hughes <richard@hughsie.com> 0.7.13-1
changelog:
  - New upstream release
  - Do not restrict the maximum number of releases allowed
  - Throw an error when a launchable desktop-id is invalid


author: Richard Hughes <richard@hughsie.com> 0.7.14-1
changelog:
  - New upstream release
  - Add new API for gnome-software
  - Set the AppStream ID from the X-Flatpak desktop key


author: Karel Zak <kzak@redhat.com> 2.32.1-18
changelog:
  - fix #1739443 - lscpu reports wrong hypervisor in nested virt on s390x
  - fix #1743555 - command chfn adds some useless commas with GECOS information into /etc/password


author: Karel Zak <kzak@redhat.com> 2.32.1-23
changelog:
  - fix #1826251 - remove MD metadata 0.90 based tests from util-linux CI
  - fix #1812576 - RFE: Bitlocker detection for RHEL 8.3
  - fix #1817726 - add libblkid BLOCK_SIZE
  - fix #1803753 - RHEL-8: col struct char_str c_column field should be of unsigned type and/or larger than 16 bit
  - fix #1812118 - mount -a always tries to mount smb3 share subdir despite being already mounted
  - fix #1824727 - util-linux: Include python3-libmount package in the release
  - fix #1829245 - mount -a tries to mount already mounted cifs shares when we cannot query up to root dir


author: Karel Zak <kzak@redhat.com> 2.32.1-25
changelog:
  - fix #1884194 - RHEL-8: chrt command does not support the -R option
  - fix #1855759 - mount.8: clarify (no)suid behavior on file capabilities
  - fix #1861670 - lsblk can not show serial information for virtio disk
  - fix #1883783 - lscpu: avoid segfault on PowerPC systems with valid hardware configurations
  - fix #1900498 - libfdisk/libmount: backport two patches for upstream systemd
  - fix #1883056 - lscpu support for Fujitsu A64FX
  - fix #1882740 - lscpu: use SMBIOS Type 4 strings for CPU vendor and model on ARM


author: Karel Zak <kzak@redhat.com> 2.32.1-28
changelog:
  - fix #1906157 - after su from root to a normal user mesg is unable to show current status
  - fix #1917852 - findmnt: add option to list all fs-independent flags
  - fix #1922299 - throws error using /sbin/nologin: invalid option -- 'c'
  - fix #1940607 - lsblk sometimes returns block devices in wrong order with --pairs
  - fix #1919529 - [RFE] RHEL-8: Support option flags with mount(8) --bind
  - fix #1946921 - RHEL8: mount --rbind -o rprivate doesn't do recursive bind mount


author: Karel Zak <kzak@redhat.com> 2.32.1-29
changelog:
  - fix #1988955 - script command continues without stopping.
  - fix #2041498 - incorrect partition size calculation for BLKPG_* ioctls
  - fix #2011602 - logger from util-linux incorrectly handles long messages
  - fix #1916151 - [RFE] spread fstrim.timer across time
  - fix #1894192 - Update or backport setpriv --pdeathsig
  - fix #2026511 - blkid fails to complete when targeting  non-block devices


author: Karel Zak <kzak@redhat.com> 2.32.1-31
changelog:
  - improve #2026511 fix - blkid fails to complete when targeting non-block devices
  - fix #1950187 - Ambient capabilities failed to applied to non-root user


author: Karel Zak <kzak@redhat.com> 2.32.1-36
changelog:
  - fix #2060030 - Please backport patches for atari partition detection to RHEL 8
  - fix #2069187 - Internal testsuite for lscpu failed on aarch64
  - fix #2093166 - lslogins reports incorrect "Password is locked" status
  - fix #2059241 - rpm -V / --verify reports bad user/group/mtime for /run/uuidd
  - fix #2044592 - Move /var/log/lastlog ownership to systemd


author: Karel Zak <kzak@redhat.com> 2.32.1-40
changelog:
  - fix #2121699 - fstrim -av fails to trim root filesystem on Red Hat Coreos 
  - fix #2142496 - update upstream tests
  - fix #2149394 - umount outputs inaccurate error message when umount() fails with EACCES
  - fix #2159544 - lslogins "Password is locked" status changed in util-linux-2.32.1-38
  - fix #2160321 - [last] ut->ut_user is not null terminated


author: Karel Zak <kzak@redhat.com> 2.32.1-43
changelog:
  - fix #2117355 - Add additional documentation for fstab
  - fix #2184728 - libuuid - downport cache related patch
  - fix #2188894 - The swapon man page of -p(priority) option shows incorrect.
  - fix #2227097 - wall(1) fail when trying to use seat0


author: Vojtech Trefny <vtrefny@redhat.com> - 2.19-9
changelog:
  - Remove device-mapper-multipath dependency from fs and part plugins (vtrefny)
    Resolves: rhbz#1700297


author: Vojtech Trefny <vtrefny@redhat.com> - 2.19-12
changelog:
  - Use cryptsetup to check LUKS2 label
    Resolves: rhbz#1778689
  - Fix expected cache pool name with newest LVM
    Related: rhbz#1778689


author: Simone Caronni <negativo17@gmail.com> - 0.9.3-2
changelog:
  - Use autotools to get rid of RPATH.
  - Fix Java build requirements for RHEL/CentOS 7.
  - Clean up SPEC file, rpmlint fixes.
  - Add license macro.


author: Robert Scheck <robert@fedoraproject.org> 1.4.4-1
changelog:
  - Update to upstream 1.4.4 (#1352496)
  - Reworked spec file to build libburn1 for RHEL >= 6 (#750009)


author: Vratislav Podzimek <vpodzime@redhat.com> - 1.1-1
changelog:
  - Add NEWS.rst file (vtrefny)
  - Fix source and url in spec file (vtrefny)
  - Use only one git tag for new releases (vtrefny)
  - Actually translate the units when expected (vpodzime)
  - Add two temporary test files to .gitignore (vpodzime)


author: Vratislav Podzimek <vpodzime@redhat.com> - 1.2-1
changelog:
  - Use only version as a tag of the last release (vpodzime)
  - Do not require the glib-2.0 pkgconfig package (vpodzime)
  - Do not lie about tag creation (vpodzime)


author: Vojtech Trefny <vtrefny@redhat.com> - 1.3-1
changelog:
  - Allow building libbytesize without Python 2 support (vtrefny)
  - Sync spec with downstream (vtrefny)
  - Add gcc to BuildRequires (vtrefny)
  - Fix links for documentation and GH project (vtrefny)
  - Add a HACKING.rst file (vpodzime)
  - Do not segfault when trying to bs_size_free NULL (vtrefny)


author: Vojtech Trefny <vtrefny@redhat.com> - 1.4-1
changelog:
  - Squashed 'translation-canary/' changes from 840c2d6..fccbb1b (vtrefny)
  - Make sure the test script fails if one of the test runs fail (vtrefny)
  - Do not try to run python2 tests without python2 support (vtrefny)
  - Fix licence header for "gettext.h" (vtrefny)
  - Do not use rpm to check for Zanata client (vtrefny)
  - Use new ldconfig_scriptlets macro in spec (vtrefny)


author: Zoltan Fridrich <zfridric@redhat.com> - 2.26-5
changelog:
  - added CAP_PERFMON, CAP_BPF and CAP_CHECKPOINT_RESTORE capabilities
    resolves: rhbz#1946982 rhbz#1921576


author: Zoltan Fridrich <zfridric@redhat.com> - 2.48-2
changelog:
  - rebase to 2.48
    resolves: rhbz#2032813
  - fix ambient capabilities for non-root users
    resolves: rhbz#1950187


author: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> - 2.48-5
changelog:
  - Fix integer overflow in _libcap_strdup() (CVE-2023-2603)
    Resolves: rhbz#2210637
  - Correctly check pthread_create() return value to avoid memory leak (CVE-2023-2602)
    Resolves: rhbz#2210644


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.7.8-6
changelog:
  - Python 2 binary package renamed to python2-libcap-ng
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Nikola Forró <nforro@redhat.com> - 0.41-17
changelog:
  - backport several upstream fixes
  - set Delegate property for cgconfig service to make sure complete
    cgroup hierarchy is always created by systemd


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.1.16-1
changelog:
  - Update to 0.1.16
  - Make inline function __comps_objmrtree_all also static (RhBug:1793424)
  - Fix memory leaks and resource leaks
  - Fix: Check result "comps_parse_parsed_init()"


author: Kalev Lember <klember@redhat.com> - 0.6.9-1
changelog:
  - Update to 0.6.9
  - Use make_install macro
  - Mark COPYING and COPYING.LIB as %license
  - Tighten -devel subpackage deps


author: Josef Ridky <jridky@redhat.com> - 3.19.1-1
changelog:
  - Update to 3.19.1
  - Add patch to use libtirpc
  - Add BR gcc-c++
  - Resolves: #1580754 - FTBFS in RHEL-8


author: Filip Januš <fjanus@redhat.com> 5.3.28-42
changelog:
  - Apply the previous change only on aarch64 to limit the risk of unwanted impact
  - Resolves: #1992402


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.12-22
changelog:
  - Python 2 binary package renamed to python2-libdnet
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Nicola Sella <nsella@redhat.com> - 0.48.0-3
changelog:
  - Add log file level main config option (RhBug:1802074)
  - Accept '==' as an operator in reldeps (RhBug:1847946)


author: Nicola Sella <nsella@redhat.com> - 0.55.0-1
changelog:
  - Add vendor to dnf API (RhBug:1876561)
  - Add formatting function for solver error
  - Add error types in ModulePackageContainer
  - Implement module enable for context part
  - Improve string formatting for translation
  - Remove redundant printf and change logging info to notice (RhBug:1827424)
  - Add allow_vendor_change option (RhBug:1788371) (RhBug:1788371)


author: Nicola Sella <nsella@redhat.com> - 0.55.0-3
changelog:
  - Avoid multilib file conflict in config.h (RhBug:1918818)
  - [modules] Add special handling for src artifacts (RhBug:1809314)


author: Nicola Sella <nsella@redhat.com> - 0.55.0-4
changelog:
  - [context] improve retrieving repository configuration
  - Allow loading incomplete cache and loading ext solv files without its repodata


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.63.0-1
changelog:
  - Update to 0.62.0
  - Hardening: add signature check with rpmcliVerifySignatures (RhBug:1932079)
  - Support allow_vendor_change setting in dnf context API
  - Add a new option module_obsoletes
  - Add new API applyObsoletes() function to apply modular obsoletes
  - Do not allow 1 as installonly_limit value (RhBug:1926261)
  - Add a config option to check TLS certificate revocation status (using OCSP stapling), defaults to false (RhBug:1814383)
  - Swdb: Add a method to get the current transaction
  - [context,API] Functions for accessing main/global configuration options
  - [context,API] Function for adding setopt
  - Add getter for modular obsoletes from ModuleMetadata
  - Add ModulePackage.getStaticContext() and getRequires()
  - Fix modular queries with the new solver
  - Fix: Fully set ssl in newHandle function
  - [conf] Add options for working with certificates used with proxy
  - Modify module NSVCA parsing - context definition (RhBug:1926771)
  - [context] Fix: dnf_package_is_installonly (RhBug:1928056)
  - Add getApplicablePackages to advisory and isApplicable to advisorymodule
  - Keep isAdvisoryApplicable to preserve API
  - [context] Support config file option "proxy_auth_method", defaults "any"
  - Support main config file options "installonlypkgs" and "protected_packages". Changes behaviour of microdnf and PackageKit.
  - Properly handle multiple collections in updateinfo.xml (RhBug:1804234)
  - Fix a crash when [media] section in .treeinfo is missing for bootable media (RhBug:1946024)
  - Add new dnf_context_module_install() C API


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.63.0-2
changelog:
  - Fix: dnf_context_module_install: memory leaks
  - covscan: remove unused vars, mark private func static, return values
  - DNF does not fail on non UTF-8 file names in a package


author: Lukas Hrazky <lhrazky@redhat.com> - 0.63.0-8
changelog:
  - Substitute all repository config options (fixes substitution of baseurl)
  - Use solvfile userdata to store and check checksums and solv versions
  - Fix handling transaction id in resolveTransactionItemReason
  - Set short action for Reason Change


author: Lukas Hrazky <lhrazky@redhat.com> - 0.63.0-10
changelog:
  - Do not print errors on failovermethod repo option
  - the dnf_context_remove() function accepts `<package-spec>`, doc updates
  - advisory upgrade: filter out advPkgs with different arch


author: Jaroslav Rohel <jrohel@redhat.com> - 0.63.0-18
changelog:
  - filterAdvisory: match installed_solvables sort with lower_bound (RhBug:2212838, RHEL-1244)
  - Avoid reinstalling installonly packages marked for ERASE (RhBug:2163474, RHEL-1253)


author: Dominik Mierzejewski <rpm[AT]greysector.net> 5.0.3-4
changelog:
  - fix FTBFS due to doc files in the wrong place (#1307717)
  - use license macro
  - drop unnecessary defattr declarations


author: Filip Januš <fjanus@redhat.com> - 12.2-1
changelog:
  - Rebase onto: 12.2
  - update of patch(libecpg-10.5-external-libpq.patch) was needed
  - add upstream patch libecpg-12.2-dependency-build.patch
    https://www.postgresql.org/message-id/20200321221303.GA17979%40momjian.us


author: Honza Horak <hhorak@redhat.com> - 13.1-3
changelog:
  - Add Requires: libpgtypes to avoid the need to test interoperability
    between the various combinations of old and new subpackages


author: Jerry James <loganjerry@gmail.com> - 3.1-23.20170329cvs
changelog:
  - Add gcc BR
  - Build verbosely
  - Drop obsolete --enable-widec configure option
  - Fix "unused direct shared library dependency" warning from rpmlint again
  - Fix man page error due to BSD nroff macro that is not available on Linux
  - Drop explicit R on pkgconfig from the -devel package, autogenerated


author: Attila Lakatos <alakatos@redhat.com> - 0.1.10-3
changelog:
  - Rebuild due to the following message: libestr-0.1.10-2.el8 has already been built
    resolves: rhbz#2056293


author: Honggang Li <honli@redhat.com> - 1.11.1-1
changelog:
  - Rebase to upstream release v1.11.1
  - EFA Support requires libfabric
  - Resolves: bz1831145, bz1852636


author: Michal Schmidt <mschmidt@redhat.com> - 1.15.1-1
changelog:
  - Update to upstream release 1.15.1
  - Disable LTO on x86_64 due to memory issues (copied from Fedora)
  - Resolves: rhbz#2040450


author: DJ Delorie <dj@redhat.com> - 3.1-24
changelog:
  - Use /etc/sysconfig/libffi-force-shared-memory-check-first to
    override selinux permissions check for shared memory access (#2014228)


author: Hans de Goede <hdegoede@redhat.com> - 1.1.2-3
changelog:
  - Pass --with-fontrootdir to ./configure so that libfontenc can find the
    encoding files (rhbz#1046341)


author: Benjamin Berg <bberg@redhat.com> - 1.90.0-2
changelog:
  - Add patch to remove debug spew from udev rules
  - Add patch to fix compilation error
  - Related: rhbz1740752


author: Tomáš Mráz <tmraz@redhat.com> 1.8.3-2
changelog:
  - make only_urandom a default in non-presence of configuration file
  - run the full FIPS selftests only when the library is called from
    application


author: Tomáš Mráz <tmraz@redhat.com> 1.8.3-3
changelog:
  - add CMAC selftest for FIPS POST
  - add continuous FIPS entropy test
  - disable non-approved FIPS hashes in the enforced FIPS mode


author: Tomáš Mráz <tmraz@redhat.com> 1.8.5-3
changelog:
  - new upstream version 1.8.5
  - AES performance improvements backported from master branch
  - FIPS module is implicit with kernel FIPS flag
  - always run the FIPS selftests if FIPS module is installed


author: Jakub Jelen <jjelen@redhat.com> - 1.8.5-6
changelog:
  - Fix for CVE-2021-33560 (#1971421)
  - Enable HW optimizations in FIPS (#1976137)
  - Performance enchancements for ChaCha20 and Poly1305 (#1855231)


author: Jakub Jelen <jjelen@redhat.com> - 1.8.5-6
changelog:
  - Fix for CVE-2021-40528 (#1971421)
  - Enable HW optimizations in FIPS (#1976137)
  - Performance enchancements for ChaCha20 and Poly1305 (#1855231)


author: Kalev Lember <klember@redhat.com> - 0.17.6-1
changelog:
  - Update to 0.17.6
  - Don't set group tags
  - Co-own gir directories instead of depending on gobject-introspection
  - Use make_install macro
  - Update project URLs


author: Brian C. Lane <bcl@redhat.com> - 0.26.5-1
changelog:
  - Rebase to 0.26.5 (CVE-2018-11235, CVE-2018-10887, CVE-2018-10888)
  - Disable SSH so that libssh2 is not required
  - Use python3 when building
  - Add README.rhel8 explaining why SSH is disabled


author: Brian C. Lane <bcl@redhat.com> - 0.26.8-1
changelog:
  - Update to 0.26.8
    Resolves: rhbz#1638880
  - Disable upstream online tests
    Related: rhbz#1638880
  - tests: Increase TOOBIG value used on i686
    Related: rhbz#1638880


author: Brian C. Lane <bcl@redhat.com> - 0.26.4-1
changelog:
  - Update to libgit2-glib-0.26.4
  - Switch to using meson build system
  - Disable SSH so that libssh2 is not required
  - Add README.rhel8 explaining why SSH is disabled


author: Kalev Lember <klember@redhat.com> - 3.21.92-1
changelog:
  - Update to 3.21.92
  - Don't set group tags
  - Use make_install macro
  - Use license macro for COPYING
  - Use desktop-file-validate instead of desktop-file-install
  - Tighten -devel deps with the _isa macro


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.8.3-20
changelog:
  - Python 2 binary package renamed to python2-gpod
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Caolán McNamara <caolanm@redhat.com> 1.14.29-6
changelog:
  - Resolves: rhbz#1202683 thumbnails not created in absence of ImageMagick
    because gdk-pixbuf2-devel not present at build time


author: Pino Toscano <ptoscano@redhat.com> - 1:1.38.4-11
changelog:
  - Use a better icon for RHEL 7+ guests
    resolves: rhbz#1679483
  - Fix inspection of partition-less devices
    resolves: rhbz#1679966
  - v2v: ship a newer version of rhev-apt.exe
    resolves: rhbz#1688062


author: Pino Toscano <ptoscano@redhat.com> - 1:1.38.4-12
changelog:
  - v2v: update nbdkit information in documentation
    resolves: rhbz#1651115
  - v2v: use proper SELinux label for nbdkit sockets
    resolves: rhbz#1717088


author: Pino Toscano <ptoscano@redhat.com> - 1:1.40.2-23
changelog:
  - Ignore the user.WofCompressedData xattr
    resolves: rhbz#1811539
  - sysprep: new ipa-client and kerberos-hostkeytab operations
    resolves: rhbz#1789592


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.40.2-26
changelog:
  - insufficient default memsize to open anaconda default RHEL 8.2 luks device
    resolves: rhbz#1837765


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.40.2-27
changelog:
  - selinux-relabel does not work if SELINUXTYPE != targeted
  - tar-in command does not allow restoring file capabilities
    resolves: rhbz#1384241 rhbz#1828952


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.44.0-4
changelog:
  - Autodetect backing format for qemu-img create -b
  - Move appliance to separate subpackage
  - Read rpm database through librpm
    resolves: rhbz#2013916, rhbz#1989520, rhbz#1836094


author: Richard Hughes <richard@hughsie.com> 0.2.10-1
changelog:
  - New upstream version
  - Correctly detect removed devices when rescanning
  - Fix a memory leak when using control tranfers
  - Fix symbol version table up to version 0.2.9


author: Marek Kasik <mkasik@redhat.com> - 0.3.0-4
changelog:
  - Ensure gxps_archive_read_entry() fills the GError in case of failure
  - Handle errors returned by archive_read_data()
  - Fixes CVE-2018-10733
  - Resolves: #1576113


author: Marek Kasik <mkasik@redhat.com> - 0.3.0-5
changelog:
  - Fix integer overflow in png decoder
  - Clear the error before trying to load an image again
  - Resolves: #1524378


author: Rafael Aquini <aquini@redhat.com> - 2.21-4
changelog:
  - Fix: task-size-overrun hung over 8 hours on ppc64le (1737370)
  - Introduce libhugetlbfs-tests subpkg for CI tests (1688930)


author: Rafael Aquini <aquini@redhat.com> - 2.21-12
changelog:
  - Fix: Introduce libhugetlbfs-tests subpkg for CI tests (1688930)
  - trim repetitive changelogs for interim debug builds


author: Rafael Aquini <aquini@redhat.com> - 2.21-13
changelog:
  - Fix: huge_page_setup_helper.py: SyntaxError: Missing parentheses in call to 'print' (1821938)
  - libhugetlbfs-tests: harden the testcases to satisfy EXECSHIELD RPMDiff checks (1785296)


author: Miroslav Lichvar <mlichvar@redhat.com> - 1.34-1
changelog:
  - update to 1.34 (CVE-2017-14062)
  - include soname in file list
  - use macros for ldconfig
  - add gcc to build requirements


author: Miroslav Lichvar <mlichvar@redhat.com> - 1.34-2
changelog:
  - fix ABI compatibility with libidn-1.33 and earlier (#1566414 #1573961)
  - add texinfo to build requirements


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.2.11-24
changelog:
  - Python 2 binary package renamed to python2-libieee1284
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Bastien Nocera <bnocera@redhat.com> - 1.2.0-12
changelog:
  + libimobiledevice-1.2.0-12
  - Replace patches with a single mega-patch
  - Fixes usbmuxd for iOS 11 devices


author: Peter Hutterer <peter.hutterer@redhat.com> 1.12.3-3
changelog:
  - Allow for the tablet mode quirk to apply to touchpads (#1664225)
  - Add a quirk for the Asus VivoBook Flip to keep the
    keyboard and touchpad working in tablet mode


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-9
changelog:
  - Resolves: rhbz#1855323 - When ad_gpo_implicit_deny is True, it is permitting users to login when no gpo is applied


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-1
changelog:
  - Resolves: rhbz#1881992 - Rebase SSSD for RHEL 8.4
  - Resolves: rhbz#1722842 - sssd-kcm does not store TGT with ssh login using GSSAPI
  - Resolves: rhbz#1734040 - sssd crash in ad_get_account_domain_search()
  - Resolves: rhbz#1784459 - [RFE] tlog does not allow to exclude some users from session recording
  - Resolves: rhbz#1791300 - sporadic sssd_be crash on s390x
  - Resolves: rhbz#1817122 - 'getent group ldapgroupname' doesn't show any LDAP users or some LDAP users when 'rfc2307bis' schema is used with SSSD.
  - Resolves: rhbz#1819012 - [RFE] Improve AD site discovery process
  - Resolves: rhbz#1846778 - [RfE] `/usr/libexec/sssd/p11_child` cmdline argument '--nssdb' might be confusing when SSSD was built against OpenSSL
  - Resolves: rhbz#1873715 - automount sssd issue when 2 automount maps have the same key (one un uppercase, one in lowercase)
  - Resolves: rhbz#1879860 - correction in sssd.conf:pam_response_filter man page
  - Resolves: rhbz#1881336 - [RFE] sssd-ldap man page modification for parameter "ldap_referrals"
  - Resolves: rhbz#1883488 - [RfE] Implement a new sssd.conf option to disable the filter for AD domain local groups from trusted domains
  - Resolves: rhbz#1884196 - [RFE] Add "enabled" option to domain section in config file
  - Resolves: rhbz#1884205 - KCM: Increase client idle timeout to 5 minutes
  - Resolves: rhbz#1884207 - [RFE] ldap: add new option ldap_library_debug_level
  - Resolves: rhbz#1884213 - [RFE] add offline_timeout_max config option to control offline interval backoff
  - Resolves: rhbz#1884281 - Secondary LDAP group go missing from 'id' command
  - Resolves: rhbz#1884301 - [RFE] dyndns: suport asymmetric auth for nsupdate


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-3
changelog:
  - Resolves: rhbz#1900733 - sssd_be segfaults at be_refresh_get_values_ex() due to NULL ptrs in results of sysdb_search_with_ts_attr()
  - Resolves: rhbz#1876514 - High CPU utilization by the sssd_kcm process
  - Resolves: rhbz#1894540 - sssd component logging is now too generic in syslog/journal
  - Resolves: rhbz#1828483 - filtered ID is appearing due to strange negative cache behavior


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-4
changelog:
  - Resolves: rhbz#1876514 - High CPU utilization by the sssd_kcm process
  - Resolves: rhbz#1876658 - filter_groups option partially filters the group from 'id' output of the user because gidNumber still appears in 'id' output [RHEL 8]
  - Resolves: rhbz#1895001 - User lookups over the InfoPipe responder fail intermittently


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-5
changelog:
  - Resolves: rhbz#1631410 - Can't login with smartcard with multiple certs having same ID value
  - Resolves: rhbz#1884213 - [RFE] add offline_timeout_max config option to control offline interval backoff (additional patches)
  - Resolves: rhbz#1893159 - Default debug level should report all errors / failures
  - Resolves: rhbz#1893698 - [RFE] sudo kerberos authentication


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-6
changelog:
  - Resolves: rhbz#1113639 - autofs: return a connection failure until maps have been fetched
  - Resolves: rhbz#1915395 - Memory leak in the simple access provider
  - Resolves: rhbz#1915319 - SSSD: SBUS: failures during servers startup
  - Resolves: rhbz#1893698 - [RFE] sudo kerberos authentication (additional patches)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-7
changelog:
  - Resolves: rhbz#1920001 - Do not add '%' to group names already prefixed with '%' in IPA sudo rules
  - Resolves: rhbz#1918433 - sssd unable to lookup certmap rules
  - Resolves: rhbz#1917382 - [abrt] [faf] sssd: dp_client_handshake_timeout(): /usr/libexec/sssd/sssd_be killed by 11


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-8
changelog:
  - Resolves: rhbz#1926622 - Add support to verify authentication indicators in pam_sss_gss
  - Resolves: rhbz#1926454 - First smart refresh query contains modifyTimestamp even if the modifyTimestamp is 0.
  - Resolves: rhbz#1893159 - Default debug level should report all errors / failures (additional patch)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-9.1
changelog:
  - Resolves: rhbz#1949170 - pam_sss_gss.so doesn't work with large kerberos tickets [rhel-8.4.0.z]
  - Resolves: rhbz#1945656 - No gpo found and ad_gpo_implicit_deny set to True still permits user login [rhel-8.4.0.z]
  - Resolves: rhbz#1945655 - SSSD not detecting subdomain from AD forest (RHEL 8.3) [rhel-8.4.0.z]
  - Resolves: rhbz#1945654 - IPA missing secondary IPA Posix groups in latest sssd 1.16.5-10.el7_9.7 [rhel-8.4.0.z]
  - Resolves: rhbz#1942438 - Wrong default debug level of sssd tools [rhel-8.4.0.z]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.0-1
changelog:
  - Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
  - Resolves: rhbz#1930535 - [abrt] [faf] sssd: monitor_service_shutdown(): /usr/sbin/sssd killed by 11
  - Resolves: rhbz#1942387 - Wrong default debug level of sssd tools
  - Resolves: rhbz#1945888 - Inconsistant debug level for connection logging
  - Resolves: rhbz#1948657 - pam_sss_gss.so doesn't work with large kerberos tickets
  - Resolves: rhbz#1949149 - [RFE] Poor man's backtrace
  - Resolves: rhbz#1920500 - Authentication handshake (ldap_install_tls()) fails due to underlying openssl operation failing with EINTR
  - Resolves: rhbz#1923964 - [RFE] SSSD Error Msg Improvement: write_krb5info_file failed, authentication might fail.
  - Resolves: rhbz#1928648 - SSSD logs improvements: clarify which config option applies to each timeout in the logs
  - Resolves: rhbz#1632159 - sssd-kcm starts successfully for non existent socket_path
  - Resolves: rhbz#1627112 - RFE: Kerberos ticket renewal for sssd-kcm
  - Resolves: rhbz#1925505 - [RFE] improve the sssd refresh timers for SUDO queries
  - Resolves: rhbz#1925514 - [RFE] Randomize the SUDO timeouts upon reconnection
  - Resolves: rhbz#1925561 - sssd-ldap(5) does not report how to disable the SUDO smart queries
  - Resolves: rhbz#1925621 - document impact of indices and of scope on performance of LDAP queries
  - Resolves: rhbz#1855320 - [RFE] RHEL8 sssd: inheritance of the case_sensitive parameter for subdomains.
  - Resolves: rhbz#1925608 - [RFE] make 'random_offset' addon to 'offline_timeout' option configurable
  - Resolves: rhbz#1447945 - man page / docs update required: if two certificate matching rules with the same priority match only one is used
  - Resolves: rhbz#1703436 - sssd not thread-safe in innetgr()
  - Resolves: rhbz#1713143 - SSSD does not translate the 2FA text labels("first factor" / "second factor") on GDM login and screensaver unlock screen
  - Resolves: rhbz#1888977 - sss_override: Usage limitations clarification in man page
  - Resolves: rhbz#1890177 - Clarify "single_prompt" option in "PROMPTING CONFIGURATION SECTION" section of sssd.conf man page
  - Resolves: rhbz#1902280 - fix sss_cache to also reset cached timestamp
  - Resolves: rhbz#1935683 - SSSD not detecting subdomain from AD forest (RHEL 8.3)
  - Resolves: rhbz#1937919 - IPA missing secondary IPA Posix groups in latest sssd 1.16.5-10.el7_9.7
  - Resolves: rhbz#1944665 - No gpo found and ad_gpo_implicit_deny set to True still permits user login
  - Resolves: rhbz#1919942 - sss_override does not take precedence over override_homedir directive


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.1-1
changelog:
  - Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
  - Resolves: rhbz#1942387 - Wrong default debug level of sssd tools
  - Resolves: rhbz#1917444 - SSSD Error Msg Improvement: Server resolution failed: [2]: No such file or directory
  - Resolves: rhbz#1917511 - SSSD Error Msg Improvement: Failed to resolve server 'server.example.com': Error reading file
  - Resolves: rhbz#1917535 - sssd.conf man page: parameter dns_resolver_server_timeout and dns_resolver_op_timeout
  - Resolves: rhbz#1940509 - [RFE] Health and Support Analyzer: Link frontend to backend requests
  - Resolves: rhbz#1649464 - auto_private_groups not working as expected with posix ipa/ad trust
  - Resolves: rhbz#1925514 - [RFE] Randomize the SUDO timeouts upon reconnection
  - Resolves: rhbz#1961215 - Invalid sssd-kcm return code if requested operation is not found
  - Resolves: rhbz#1837090 - SSSD fails nss_getby_name for IPA user with SID if the user has user private group
  - Resolves: rhbz#1879869 - sudo commands incorrectly exports the KRB5CCNAME environment variable
  - Resolves: rhbz#1962550 - sss_pac_make_request fails on systems joined to Active Directory.
  - Resolves: rhbz#1737489 - [RFE] SSSD should honor default Kerberos settings (keytab name) in /etc/krb5.conf


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.1-2
changelog:
  - Resolves: rhbz#1974257 - 'debug_microseconds' config option is broken
  - Resolves: rhbz#1936902 - SSSD Error Msg Improvement: Invalid argument
  - Resolves: rhbz#1627112 - RFE: Kerberos ticket renewal for sssd-kcm (additional patches and rebuild)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.2-1
changelog:
  - Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
  - Resolves: rhbz#1693379 - sssd_be and sss_cache too heavy on CPU
  - Resolves: rhbz#1909373 - Missing search index for `originalADgidNumber`
  - Resolves: rhbz#1954630 - [RFE] Improve debug messages by adding a unique tag for each request the backend is handling
  - Resolves: rhbz#1936891 - SSSD Error Msg Improvement: Bad address
  - Resolves: rhbz#1364596 - sssd still showing ipa user after removed from last group
  - Resolves: rhbz#1979404 - Changes made to /etc/pam.d/sssd-shadowutils are overwritten back to default on sssd-common package upgrade


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.2-2
changelog:
  - Resolves: rhbz#1975169 - EMBARGOED CVE-2021-3621 sssd: shell command injection in sssctl [rhel-8]
  - Resolves: rhbz#1962042 - [sssd] RHEL 8.5 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.2-2.1
changelog:
  - Resolves: rhbz#2014460 - tps tests fail with cross dependency on sssd debuginfo package: removal of 'sssd-libwbclient-debuginfo' is missing [rhel-8.5.0.z]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.6.1-1
changelog:
  - Resolves: rhbz#2011216 - Rebase SSSD for RHEL 8.6
  - Resolves: rhbz#1968340 - 'exclude_groups' option provided in SSSD for session recording (tlog) doesn't work as expected
  - Resolves: rhbz#1952569 - SSSD should use "hidden" temporary file in its krb locator
  - Resolves: rhbz#1917970 - proxy provider: secondary group is showing in sssd cache after group is removed
  - Resolves: rhbz#1636002 - socket-activated services start as the sssd user and then are unable to read the confdb
  - Resolves: rhbz#2021196 - Make backtrace less "chatty" (avoid duplicate backtraces)
  - Resolves: rhbz#2018432 - 2.5.x based SSSD adds more AD domains than it should based on the configuration file (not trusted and from a different forest)
  - Resolves: rhbz#2015070 - Consistency in defaults between OpenSSH and SSSD
  - Resolves: rhbz#2013297 - disabled root ad domain causes subdomains to be marked offline
  - Resolves: rhbz#2013294 - Lookup with fully-qualified name does not work with 'cache_first = True'
  - Resolves: rhbz#2013218 - autofs lookups for unknown mounts are delayed for 50s
  - Resolves: rhbz#2013028 - [RFE] Health and Support Analyzer: Add sssctl sub-command to select and display a single request from the logs
  - Resolves: rhbz#2013024 - Add support for CKM_RSA_PKCS in smart card authentication.
  - Resolves: rhbz#2013006 - [RFE] support subid ranges managed by FreeIPA
  - Resolves: rhbz#2012308 - Add client certificate validation D-Bus API
  - Resolves: rhbz#2012122 - tps tests fail with cross dependency on sssd debuginfo package: removal of 'sssd-libwbclient-debuginfo' is missing


author: Alexey Tikhonov <atikhono@redhat.com> - 2.6.2-1
changelog:
  - Resolves: rhbz#2011216 - Rebase SSSD for RHEL 8.6
  - Resolves: rhbz#2013260 - [RHEL8] Add ability to parse child log files
  - Resolves: rhbz#2030386 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries
  - Resolves: rhbz#1859315 - sssd does not use kerberos port that is set.
  - Resolves: rhbz#1961182 - Passwordless (GSSAPI) SSH not working due to missing "includedir /var/lib/sss/pubconf/krb5.include.d" directive in /etc/krb5.conf
  - Resolves: rhbz#2008829 - sssd_be segfault due to empty forest root name
  - Resolves: rhbz#2012263 - pam responder does not call initgroups to refresh the user entry
  - Resolves: rhbz#2012308 - Add client certificate validation D-Bus API
  - Resolves: rhbz#2012327 - Groups are missing while performing id lookup as SSSD switching to offline mode due to the wrong domain name in the ldap-pings(netlogon).
  - Resolves: rhbz#2013028 - [RFE] Health and Support Analyzer: Add sssctl sub-command to select and display a single request from the logs
  - Resolves: rhbz#2013259 - [RHEL8] Add tevent chain ID logic into responders
  - Resolves: rhbz#2017301 - [sssd] RHEL 8.6 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.6.2-3
changelog:
  - Resolves: rhbz#2039892 - 2.6.2 regression: Daemon crashes when resolving AD user names
  - Resolves: rhbz#1859315 - sssd does not use kerberos port that is set.
  - Resolves: rhbz#2030386 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries
  - Resolves: rhbz#2035245 - AD Domain in the AD Forest Missing after sssd latest update
  - Resolves: rhbz#2017301 - [sssd] RHEL 8.6 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.0-2
changelog:
  - Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
  - Resolves: rhbz#2026799 - SSSD authenticating to LDAP with obfuscated password produces Invalid authtoken type message causing sssd_be to go offline (cross inter_ference of different provider plugins options)
  - Resolves: rhbz#2033347 - sssd error triggers backtrace : [write_krb5info_file_from_fo_server] (0x0020): [RID#73501] There is no server that can be written into kdc info file.
  - Resolves: rhbz#2056483 - [RFE] Add sssd internal krb5 plugin for authentication against external IdP via OAuth2
  - Resolves: rhbz#2062689 - [Improvement] Add user and group version of sss_nss_getorigbyname()
  - Resolves: rhbz#2065692 - [RHEL8] Ship new sub-package called sssd-idp into sssd
  - Resolves: rhbz#2072050 - sssd_nss exiting (due to missing 'sssd' local user) making SSSD service to restart in a loop
  - Resolves: rhbz#2072931 - Use right sdap_domain in ad_domain_info_send
  - Resolves: rhbz#2087088 - sssd does not enforce smartcard auth for kde screen locker
  - Resolves: rhbz#2087744 - Unable to lookup AD user if the AD group contains '@' symbol
  - Resolves: rhbz#2087745 - 2FA prompting setting ineffective
  - Resolves: rhbz#2087746 - sssd fails GPO-based access if AD have setup with Japanese language


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.2-1
changelog:
  - Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
  - Resolves: rhbz#2098620 - sdap_nested_group_deref_direct_process() triggers internal watchdog for large data sets
  - Resolves: rhbz#2098619 - [Improvement] add SSSD support for more than one CRL PEM file name with parameters certificate_verification and crl_file
  - Resolves: rhbz#2088817 - pam_sss_gss ceased to work after upgrade to 8.6
  - Resolves: rhbz#2098616 - Add idp authentication indicator in man page of sssd.conf
  - Resolves: rhbz#2056035 - 'getent hosts' not return hosts if they have more than one CN in LDAP
  - Resolves: rhbz#2098615 - Regression "Missing internal domain data." when setting ad_domain to incorrect
  - Resolves: rhbz#2098617 - Harden kerberos ticket validation
  - Resolves: rhbz#2087744 - Unable to lookup AD user if the AD group contains '@' symbol


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-1
changelog:
  - Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
  - Resolves: rhbz#2063016 - [sssd] RHEL 8.7 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-2
changelog:
  - Resolves: rhbz#2116488 - virsh command will hang after the host run several auto test cases
  - Resolves: rhbz#2116486 - [regression] sssctl analyze fails to parse PAM related sssd logs
  - Resolves: rhbz#2116487 - cache_req_data_set_hybrid_lookup: cache_req_data should never be NULL


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-3
changelog:
  - Resolves: rhbz#2116395 - NFS krb5 mount failed as "access denied" after test accessing a same file on krb5 nfs mount with multiple uids simultaneously since sssd-2.7.3-1.el8
  - Resolves: rhbz#2119726 - sssctl analyze --logdir option requires sssd to be configured
  - Resolves: rhbz#2120669 - Incorrect request ID tracking from responder to backend


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-4
changelog:
  - Resolves: rhbz#2116395 - NFS krb5 mount failed as "access denied" after test accessing a same file on krb5 nfs mount with multiple uids simultaneously since sssd-2.7.3-1.el8


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-5
changelog:
  - Related: rhbz#2132051 - Rebase Samba to the the latest 4.17.x release
    Rebuild against Samba rebase.


author: Alexey Tikhonov <atikhono@redhat.com> - 2.8.1-1
changelog:
  - Resolves: rhbz#2127511 - Rebase SSSD for RHEL 8.8
  - Resolves: rhbz#2144581 - [RFE] provide dbus method to find users by attr
  - Resolves: rhbz#2144579 - sssd timezone issues sudonotafter
  - Resolves: rhbz#2144519 - [RFE] SSSD does not support to change the user’s password when option ldap_pwd_policy equals to shadow in sssd.conf file
  - Resolves: rhbz#2127822 - Cannot SSH with AD user to ipa-client (`krb5_validate` and `pac_check` settings conflict)
  - Resolves: rhbz#2111393 - authenticating against external IdP services okta (native app) with OAuth client secret failed


author: Alexey Tikhonov <atikhono@redhat.com> - 2.8.2-1
changelog:
  - Resolves: rhbz#2127511 - Rebase SSSD for RHEL 8.8
  - Resolves: rhbz#2136701 - Lower the severity of the log message for SSSD so that it is not shown at the default debug level.
  - Resolves: rhbz#2139760 - [sssd] RHEL 8.8 Tier 0 Localization
  - Resolves: rhbz#2139865 - Analyzer: Optimize and remove duplicate messages in verbose list
  - Resolves: rhbz#2142795 - SSSD: `sssctl analyze` command shouldn't require 'root' privileged
  - Resolves: rhbz#2144491 - UPN check cannot be disabled explicitly but requires krb5_validate = false' as a work-around
  - Resolves: rhbz#2150357 - Smart Card auth does not work with p11_uri (with-smartcard-required)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.8.2-2
changelog:
  - Resolves: rhbz#2149091 - Update to sssd-2.7.3-4.el8_7.1.x86_64 resulted in "Request to sssd failed. Device or resource busy"


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.0-1
changelog:
  - Resolves: rhbz#2167836 - Rebase SSSD for RHEL 8.9
  - Resolves: rhbz#2101489 - [sssd] Auth fails if client cannot speak to forest root domain (ldap_sasl_interactive_bind_s failed)
  - Resolves: rhbz#2143925 - kinit switches KCM away from the newly issued ticket
  - Resolves: rhbz#2151403 - AD user is not found on IPA client after upgrading to RHEL8.7
  - Resolves: rhbz#2164805 - man page entry should make clear that a nested group needs a name
  - Resolves: rhbz#2170484 - Unable to lookup AD user from child domain (or "make filtering of the domains more configurable")
  - Resolves: rhbz#2180981 - sss allows extraneous @ characters prefixed to username #


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.0-4
changelog:
  - Related: rhbz#2190417 - Rebase Samba to the latest 4.18.x release
    Rebuild against rebased Samba libs


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.1-1
changelog:
  - Resolves: rhbz#2167836 - Rebase SSSD for RHEL 8.9
  - Resolves: rhbz#2196521 - [RHEL8] sssd : AD user login problem when modify ldap_user_name= name and restricted by GPO Policy
  - Resolves: rhbz#2195919 - sssd-be tends to run out of system resources, hitting the maximum number of open files
  - Resolves: rhbz#2192708 - [RHEL8] [sssd] User lookup on IPA client fails with 's2n get_fqlist request failed'
  - Resolves: rhbz#2139467 - [RHEL8] sssd attempts LDAP password modify extended op after BIND failure
  - Resolves: rhbz#2054825 - sssd_be segfault at 0 ip 00007f16b5fcab7e sp 00007fffc1cc0988 error 4 in libc-2.28.so[7f16b5e72000+1bc000]
  - Resolves: rhbz#2189583 - [sssd] RHEL 8.9 Tier 0 Localization
  - Resolves: rhbz#2170720 - [RHEL8] When adding attributes in sssd.conf that we have already, the cross-forest query just stop working
  - Resolves: rhbz#2096183 - BE_REQ_USER_AND_GROUP LDAP search filter can inadvertently catch multiple overrides
  - Resolves: rhbz#2151450 - [RHEL8] SSSD missing group membership when evaluating GPO policy with 'auto_private_groups = true'


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.2-1
changelog:
  - Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
  - Resolves: rhbz#2226021 - dbus and crond getting terminated with SIGBUS in sss_client code
  - Resolves: rhbz#2237253 - SSSD runs multiples lookup search for each NFS request (SBUS req chaining stopped working in sssd-2.7)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.3-1
changelog:
  - Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
  - Resolves: RHEL-14070 - sssd-2.9.2-1.el8 breaks smart card authentication
  - Resolves: RHEL-3665 - Unexplainable error "Unable to find primary gid [2]: No such file or directory" when SSSD performs lookup for an AD user


author: Jan Kratochvil <jan.kratochvil@redhat.com> - 1.6.1-6
changelog:
  - Fix v1.6.1-implicit-fallthrough.patch compatibility with gcc < 7.
  - Use %ldconfig_scriptlets.
    https://fedoraproject.org/wiki/Packaging:Scriptlets#Shared_Libraries


author: Jan Kratochvil <jan.kratochvil@redhat.com> - 1.6.1-7
changelog:
  - Add: BuildRequires: gcc
    https://fedoraproject.org/wiki/Packaging:C_and_C%2B%2B#BuildRequires_and_Requires


author: Jan Kratochvil <jan.kratochvil@redhat.com> - 1.6.1-8
changelog:
  - Enable tests (PTUNIT) and man pages (MAN).
  - Change BuildRequires: gcc -> gcc-c++ as PTUNIT tests require C++.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.0.4-19
changelog:
  - Python 2 binary package renamed to python2-libiptcdata
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Cole Robinson <crobinso@redhat.com> - 1.18.0-2
changelog:
  - Fix rdma deps and don't restrict archs
  - Add --disable-werror to fix gcc8 build (bz #1556044)
  - Spec file cleanups (bz #1483290)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 1.18.0-5.el8
changelog:
  - libiscsi-iser_rcv_completion-unify-error-handling.patch [bz#1634541]
  - libiscsi-iser-fix-posting-of-receive-descriptors.patch [bz#1634541]
  - libiscsi-sync-remove-unnecessary-checks.patch [bz#1634541]
  - libiscsi-do-not-warn-for-strncpy.patch [bz#1634541]
  - libiscsi-avoid-fallthrough.patch [bz#1634541]
  - libiscsi-avoid-truncation-when-logging-message-that-includes-.patch [bz#1634541]
  - Resolves: bz#1634541
    (Fix important coverity issues (libiscsi))


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> -
changelog:
  - libiscsi-fix-connection-to-LUN-with-IPv6-address.patch [bz#1597942]
  - Resolves: bz#1597942
    (Qemu-kvm fails to connect to iscsi LUN by IPV6 address)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 1.18.0-7.el8
changelog:
  - libiscsi-redhat-Remove-disable-werror-from-spec-file.patch [bz#1581025]
  - Resolves: bz#1581025
    (Remove --disable-werror from spec file)


author: Pavel Cahyna <pcahyna@redhat.com> - 1.4.8-4
changelog:
  - Remove KDE bits
  - Provide: mkisofs (as genisoimage does)
  - Increase alternative priority to win over genisoimage
  - Update RHEL conditionals for lib{isofs,burn} renaming to match those packages


author: Robert Scheck <robert@fedoraproject.org> 1.4.2-3
changelog:
  - Move large documentation into -doc subpackage (#744416)
  - Reworked spec file to build libisofs1 for RHEL >= 6 (#744416)


author: Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-14_2
changelog:
  - [RHEL] Re-enable AEAD tests and ignore test result
  - [RHEL] Drop the ppc64 ignore-failures workaround


author: Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-16_1
changelog:
  - [RHEL] Apply 'Add missing dependencies to the tests package'
  - [RHEL] Apply 'Update patch from upstream'


author: Sahana Prasad <sahana@redhat.com> - 1.1.5-3
changelog:
  - Enables building on old kernels [sync fix in Fedora from omosnance].
  - This is required for covscans as they run on RHEL7 machines.


author: Zoltan Fridrich <zfridric@redhat.com> - 1.4.0-1
changelog:
  - Update to new upstream release 1.4.0
    Resolves: RHEL-5366
  - Add a patch to fix auxiliary tests in FIPS mode
    Resolves: RHEL-2406
  - Add a patch to zeroize kcapi-hasher for FIPS 140-3
    Resolves: RHEL-15290
  - Add a patch to allow overriding target file in kcapi-hasher
    Resolves: RHEL-15300


author: Zoltan Fridrich <zfridric@redhat.com> - 1.4.0-2
changelog:
  - Backport fixes for kcapi-hasher target option
    Related: RHEL-15300
  - Fix kcapi tests in FIPS mode
    Resolves: RHEL-2406


author: Phil Sutter <psutter@redhat.com> - 0.3-2
changelog:
  - Add missing build requirement: gcc.
  - Add source code patches to facilitate following changes.
  - Patches managed in git, so add git as another build requirement.
  - Respect build system compiler flags.
  - Use %make_build instead of plain make in %build.
  - Add %check target which performs unattended runtime test.
  - Use -D install flag instead of manual mkdir.


author: Phil Sutter <psutter@redhat.com> - 0.3-3
changelog:
  - Use %autosetup flag '-p1' instead of '-S git' to get rid of git dependency.
  - Use %license macro in %files section.
  - Added comment about included patches' upstream status.


author: Akira TAGOH <tagoh@redhat.com> - 0.6.2-8
changelog:
  - Suppress documentation in Flatpak builds
    Resolves: rhbz#1896257
  - build gir with non-parallel to avoid strange behavior.


author: Martin Gieseking <martin.gieseking@uos.de> - 2.6.2-12
changelog:
  - Applied security fixes from EL 7.4 (CVE-2014-8184, CVE-2017-13738, CVE-2017-13740, CVE-2017-13741, CVE-2017-13742, CVE-2017-13743, CVE-2017-13744)
  - Dropped redundant parts of the spec file.
  - Updated URL.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2.6.2-13
changelog:
  - Python 2 binary package renamed to python2-louis
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: David King <dking@redhat.com> - 2.6.2-17
changelog:
  - Fix CVE-2018-11577 (#1585906)
  - Fix CVE-2018-11684 (#1588632)
  - Fix CVE-2018-11685 (#1588637)
  - Fix CVE-2018-12085 (#1589942)


author: Daniel Kopecek <dkopecek@redhat.com> - 9-3
changelog:
  - Enabled build gating
  - Synced layout test assumtions with recent cryptsetup changes
    Resolves: rhbz#1625683


author: Sergio Correia <scorreia@redhat.com> - 9-4
changelog:
  - LUKSMeta now sets error level from libcryptsetup to CRYPT_LOG_ERROR, and
    this output is logged to stderr
    Resolves: rhbz#1770395


author: Michal Ruprich <mruprich@redhat.com> - 1.2.0-6
changelog:
  - Adding libmaxminddb as a new package to RHEL-8 (rhbz#1607927)
  - Adding Recommends tag for geolite2 databases


author: Ana Cabral <acabral@redhat.com> - 1.26.0-2
changelog:
  - Add Conflicts tag because the bash-completion scripts moved
    from the main package to the utils sub package causing a file
    conflict on multilib systems between the old 32 bit main
    package and the new 64 bit utils sub package.


author: Martin Gansser <martinkg@fedoraproject.org> - 1:0.9.57-1
changelog:
  - Update to 0.9.57
  - Dropped dependency on libgcrypt
  - Dropped dependency on openssl
  - Update tarball link to "https:"
  - Add examples from doc/examples


author: Stephen Gallagher <sgallagh@redhat.com> - 2.5.0-2
changelog:
  - Fix memory corruption error using Module.search_rpms() from python
  - Speed up valgrind tests
  - Resolves: rhbz#1714766


author: Richard W.M. Jones <rjones@redhat.com> - 0.7-0.1.alpha
changelog:
  - New upstream version 0.7alpha.
  - No tarball was uploaded so temporarily use tarball from github.
  - Fixes CVE-2018-14679 libmspack: off-by-one error in the CHM PMGI/PMGL
    chunk number validity checks


author: Richard W.M. Jones <rjones@redhat.com> - 0.7-0.2.alpha.4
changelog:
  - Fix for CVE-2019-1010305
  - Remove "fix" for CVE-2018-14680 as this fix is included in base tar ball.
    resolves: rhbz#1736745, rhbz#1736743


author: Dominik Mierzejewski <dominik@greysector.net> - 1.1.13-2
changelog:
  - Use https source URL
  - Drop obsolete spec elements
  - Use license macro
  - Update libusbx-devel build dependency
  - Drop ancient (F15) Obsoletes:
  - Tighten file list


author: David King <amigadave@amigadave.com> 5.1.0-1
changelog:
  - Update to 5.1.0 (#1164434)
  - Drop libxml2 patch (fixed upstream)
  - Use pkgconfig for BuildRequires


author: David Tardon <dtardon@redhat.com> - 0.3.11-3
changelog:
  - Resolves: rhbz#1461763 CVE-2017-9433 Out-of-bounds write in the
    MsWrd1Parser::readFootnoteCorrespondence function


author: Richard W.M. Jones <rjones@redhat.com> - 1.0.2-1
changelog:
  - New upstream version 1.0.2.
  - Remove patches which are upstream.
  - Contains fix for NBD Protocol Downgrade Attack (CVE-2019-14842).
  - Fix previous commit message.


author: Richard W.M. Jones <rjones@redhat.com> - 1.0.3-1
changelog:
  - New upstream version 1.0.3.
  - Contains fix for remote code execution vulnerability.
  - Add new libnbd-security(3) man page.


author: Hangbin Liu <haliu@redhat.com> - 1.7-1
changelog:
  - Update to 1.7
  - libndp: apply filter to raw socket to only accept ND messages
  - libndp: move ndp_sock_{open,close}() after msg parsing functions
  - ndptool: Fix compilation on musl libc


author: Hangbin Liu <haliu@redhat.com> - 1.7-2
changelog:
  - ndptool: add -T target support (rhbz 1666194)
  - ndptool: fix target parameter typo (rhbz 1666194)
  - libndp: close sockfd after using to avoid handle leak (rhbz 1666194)
  - libndp: fix nd_msg typo when setting target address (rhbz 1666194)


author: Hangbin Liu <haliu@redhat.com> - 1.7-3
changelog:
  - ndptool: add -D dest support (rhbz 1697595)
  - ndptool: fix potential memory leak caused by strdup (rhbz 1697595)


author: Robert Scheck <robert@fedoraproject.org> 1.1.6-7
changelog:
  - Run autoreconf to recognize aarch64 (#925813)
  - Conditionalized usage of %{_lib} vs %{_libdir} for RHEL < 7
  - Tight run-time dependencies between sub-packages via %{?_isa}


author: Steve Dickson <steved@redhat.com> 2.3.3-32
changelog:
  - junction: Fixed debug statement (bz 1831829)
  - Userspace support for the latest nfsdcld daemon (bz 1817756)


author: Steve Dickson <steved@redhat.com> 2.3.3-33
changelog:
  - manpage: Add a description of the 'nconnect' mount option (bz 1761352)
  - nfsdclddb: Redname clddb-tool to nfsdclddb (bz 1836924)


author: Steve Dickson <steved@redhat.com> 2.3.3-38
changelog:
  - exports man page: warn about subdirectory exports (bz 1652437)
  - Don't modify /etc/group on upgrades (bz 1856881)
  - nfs-iostat: divide by zero with fresh mount (bz 1861823)
  - nfsiostat: Drop autofs entries before calling compare_iostats() (bz 1859130)
  - nfsdclddb: clddb-tool was recently renamed to nfsdclddb (bz 1893599)


author: Steve Dickson <steved@redhat.com> 2.3.3-39
changelog:
  - systemd: Ingnore export failures in nfs-server.serivce unit (bz 1894873)
  - exports.man: Remove some outdated verbiage (bz 1769688)


author: Steve Dickson <steved@redhat.com> 2.3.3-42
changelog:
  - gssd: Add options to allow for the use of ~/.k5identity file (bz 1868087)
  - man: Correct gssd(8) description of rpc-timeout and context-timeout (bz 1908232)
  - exportfs: fix unexporting of '/' (bz 1944119)


author: Steve Dickson <steved@redhat.com> 2.3.3-44
changelog:
  - gssd: Deal with failed thread creation (bz 1981400)
  - gssd: Add timeout for upcall threads (bz 1981403)
  - gssd: Cleaned up debug messages (bz 1961056)
  - spec: Updated description of the nfs-utils rpm (bz 1981419)


author: Steve Dickson <steved@redhat.com> 2.3.3-59
changelog:
  - Covscan Scan: Wrong Check of Return Value (bz 2151966)
  - Covscan Scan: Clang (experimental) (bz 2151971)


author: Phil Sutter <psutter@redhat.com> [1.1.1-2.el8]
changelog:
  - chain: Hash chain list by name (Phil Sutter) [1658533]
  - chain: Add lookup functions for chain list and rules in chain (Phil Sutter) [1658533]
  - chain: Support per chain rules list (Phil Sutter) [1658533]
  - src: remove nftnl_rule_cmp() and nftnl_expr_cmp() (Phil Sutter) [1658533]


author: Phil Sutter <psutter@redhat.com> [1.1.1-3.el8]
changelog:
  - src: chain: Fix nftnl_chain_rule_insert_at() (Phil Sutter) [1666495]
  - src: chain: Add missing nftnl_chain_rule_del() (Phil Sutter) [1666495]
  - flowtable: Fix for reading garbage (Phil Sutter) [1661327]
  - flowtable: Fix memleak in nftnl_flowtable_parse_devs() (Phil Sutter) [1661327]
  - flowtable: Fix use after free in two spots (Phil Sutter) [1661327]
  - flowtable: Add missing break (Phil Sutter) [1661327]
  - object: Avoid obj_ops array overrun (Phil Sutter) [1661327]


author: Phil Sutter <psutter@redhat.com> [1.1.4-2.el8]
changelog:
  - obj/ct_timeout: Fix NFTA_CT_TIMEOUT_DATA parser (Phil Sutter) [1758673]
  - set_elem: Validate nftnl_set_elem_set() parameters (Phil Sutter) [1758673]
  - obj/ct_timeout: Avoid array overrun in timeout_parse_attr_data() (Phil Sutter) [1758673]
  - set: Don't bypass checks in nftnl_set_set_u{32,64}() (Phil Sutter) [1758673]
  - obj/tunnel: Fix for undefined behaviour (Phil Sutter) [1758673]
  - set_elem: Fix return code of nftnl_set_elem_set() (Phil Sutter) [1758673]
  - obj: ct_timeout: Check return code of mnl_attr_parse_nested() (Phil Sutter) [1758673]


author: Phil Sutter <psutter@redhat.com> [1.1.5-2.el8]
changelog:
  - chain: Correctly check realloc() call (Phil Sutter) [1778952]
  - flowtable: Correctly check realloc() call (Phil Sutter) [1778952]
  - chain: Fix memleak in error path of nftnl_chain_parse_devs() (Phil Sutter) [1778952]
  - flowtable: Fix memleak in error path of nftnl_flowtable_parse_devs() (Phil Sutter) [1778952]


author: Phil Sutter <psutter@redhat.com> [1.1.5-3.el8]
changelog:
  - set_elem: Introduce support for NFTNL_SET_ELEM_KEY_END (Phil Sutter) [1795223]
  - set: Add support for NFTA_SET_DESC_CONCAT attributes (Phil Sutter) [1795223]
  - include: resync nf_tables.h cache copy (Phil Sutter) [1795223]


author: Phil Sutter <psutter@redhat.com> [1.1.5-5.el8]
changelog:
  - set: expose nftnl_set_elem_nlmsg_build() (Phil Sutter) [2040754]
  - expr: dynset: release stateful expression from .free path (Phil Sutter) [2040478]
  - set_elem: missing set and build for NFTNL_SET_ELEM_EXPR (Phil Sutter) [2040478]


author: Tomas Hoger <thoger@redhat.com> - 0.1.13-11
changelog:
  - Add conditional for building with(out) gst010 / GStreamer 0.10 support.
  - Disable gst010 plugin by default.


author: Stefan Becker <chemobejk@gmail.com> - 0.1.14-3
changelog:
  - update to 0.1.14-70-gfb2f1f7 with alternate server fixes for SIPE
  - add autoreconf build step
  - remove examples subpackage as examples are no longer installed


author: Kamil Dudka <kdudka@redhat.com> - 0.1.14-4.20171128gitfb2f1f7
changelog:
  - enable make check again
  - make tests pass in Koji
  - disable test-new-dribble that sometimes hangs indefinitely
  - make tests compile on i686
  - make the package build on armv7hl
  - make the package build on Fedora 28
  - avoid build failure if gstreamer-plugins-base-devel is installed
  - move autoreconf invocation to %prep
  - use Name Version Release that explicitly identifies an SCM snapshot (#1541646)


author: Kamil Dudka <kdudka@redhat.com> - 0.1.14-6.20171128gitfb2f1f7
changelog:
  - temporarily make the upstream test-suite run on Intel arches only
  - disable test-send-recv, which fails in Koji


author: Kamil Dudka <kdudka@redhat.com> - 0.1.14-7.20180504git34d6044
changelog:
  - component: accept TURN in nice_component_verify_remote_candidate() (#1541646)
  - update to 0.1.14-85-g34d6044 (#1541646)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.3.0-4
changelog:
  - Python 2 binary package renamed to python2-libnl3
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Lubomir Rintel <lkundrak@v3.sk> - 1.8.26-2
changelog:
  - Fixes suggested in review by Matthew Krupcale (#1763285):
  - Add gcc BR
  - Fixed the libnma-gtk4 conditional
  - Made dependencies arch-specific where relevant
  - Dropped obsolete macros
  - Install license file with libnma-gtk4


author: Thomas Haller <thaller@redhat.com> - 1.8.28-1
changelog:
  - Update to 1.8.28 release
  - move org.gnome.nm-applet.gschema.xml from network-manager-applet to here.
  - introduce wireless security dialogs


author: Ana Cabral <acabral@redhat.com> - 1.8.36-1
changelog:
  - Update to 1.8.36 release (rh #2062686)
  - Include OWE wireless security (rh #2060327)
  - Fix OWE wireless security entry in Hidden Networks dialog (rh #2057514)


author: Kalev Lember <klember@redhat.com> - 0.7.7-1
changelog:
  - Update to 0.7.7
  - Remove lib64 rpaths
  - Don't set group tags
  - Use make_install macro
  - Don't manually set deps that pkgconfig dep extractor automatically does
  - Drop old, unused build deps
  - Tighten deps with the _isa macro


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.2.0-4
changelog:
  - Resolves: rhbz#1649632 - libosinfo test suite should collect+report all
                             failures, not exit on first error


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.5.0-3
changelog:
  - Resolves: rhbz#1727843 - CVE-2019-13313 libosinfo: osinfo-install-script
                             option leaks password via command line argument


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.8.0-1
changelog:
  - Resolves: rhbz#1815158 - Rebase to libosinfo the latest upstream release
  - Resolves: rhbz#1754394 - Provide information about UEFI support for guests (libosinfo)
  - Resolves: rhbz#1032520 - WHQL'ed drivers should be made available for Boxes/libosinfo users


author: Michal Ruprich <michalruprich@gmail.com> - 14:1.9.1-1
changelog:
  - Resolves: #1806422 - rebase libpcap to version 1.9.1
  - Resolves: #1743650 - [RFE] enable inbox support for sniffing offloaded (RDMA) traffic with tcpdump
  - Resolves: #1785330 - Invalid IPv4 addresses are accepted without reporting even a warning
  - Resolves: #1792208 - Resource exhaustion while PHB header length validation


author: Bastien Nocera <bnocera@redhat.com> - 1.22.0-6
changelog:
  + libpeas-1.22.0-6
  - Remove python2 loader, all GNOME apps using libpeas were ported to Python3
    when ported to GTK+ 3.x, and obsolete libpeas-loader-python
  - Resolves: #1559090


author: Kalev Lember <klember@redhat.com> - 1.12-9
changelog:
  - Remove lib64 rpaths
  - Disable strict aliasing as it's not strict-aliasing clean on ppc64el
  - Don't redefine licensedir


author: Peter Robinson <pbrobinson@fedoraproject.org> 2.0.0-1
changelog:
  - Update to upstream 2.0.0
  - Fixes the following CVEs plus others
  - CVE-2017-6440 CVE-2017-6439 CVE-2017-6438 CVE-2017-6437 CVE-2017-6436
  - CVE-2017-6435 CVE-2017-5836 CVE-2017-5835 CVE-2017-5834 CVE-2017-5545
  - CVE-2017-5209


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2.0.0-4
changelog:
  - Python 2 binary package renamed to python2-libplist
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Bastien Nocera <bnocera@redhat.com> - 2.0.0-10
changelog:
  + libplist-2.0.0-10
  - The Python3 Cython binary is now called "cython" not "cython3"
  - Resolves: #1611726


author: Dan Winship <danw@redhat.com> - 0.4.15-5.1
changelog:
  - Drop python2 subpackage (#1559092)
  - Drop PAC runner based on the "pacrunner" package (#1569023)
  - Replace pacrunner-crash-fix patch with version from RHEL7
  - Drop kde subpackage (#1538147)


author: - 10.3.8-5
changelog:
  - Fix partial injection of Fedora build flags.
  - Double the sizeof array fdesc to fix a gcc compiling issue.
  - Resolves: bz1556062


author: Carl Byington <carl@five-ten-sg.com> 0.6.71-1
changelog:
  - fedora python naming scheme changes
  - Zachary Travis - Add support for the OST 2013 format, and
    Content-Disposition filename key fix for outlook compatibility


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.6.71-4
changelog:
  - Python 2 binary package renamed to python2-libpst
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.4.0-4
changelog:
  - Python 2 binary package renamed to python2-pwquality
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Tomáš Mráz <tmraz@redhat.com> 1.4.4-1
changelog:
  - Translation updates
  - Add usersubstr check for substrings of N characters from the username
    patch by Danny Sauer
  - pam_pwquality: Abort the retry loop if user requests it
  - Allow setting retry, enforce_for_root, and local_users_only options
    in the pwquality.conf config file


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1.4.4-3
changelog:
  - Resolves: rhbz#1919026 libpwquaily rpm requires cracklib to function but RPM missing requirement [updated]


author: Christine Caulfield <ccaulfie@redhat.com> - 1.0.3-11
changelog:
  Correctly set socket directory permissions when
    qb_ipcs_connection_auth_set() is called
    Resolves: rhbz#1836146


author: Nils Philippsen <nils@tiptoe.de> - 2.1.2-1
changelog:
  - version 2.1.2
  - tidy up spec file
  - use %license for license file
  - require same arch main from devel package


author: Attila Lakatos <alakatos@redhat.com> - 1.6.1-1
changelog:
  - Rebase to 1.6.1
    resolves: RHEL-12892
  - Fix warnings reported by rpmlint
  - Enable support for zlib/zstd compression and GSSAPI


author: Jiri Vymazal <jvymazal@redhat.com> - 1.2.13-1
changelog:
  - rebase to 1.2.13
    resolves: rhbz#1425638
  - added patch for GnuTLS crypto-policy adherence
    resolves: rhbz#1179317
  - added autoconf, automake and libtool because package
    has patches now


author: Attila Lakatos <alakatos@redhat.com> - 1.9.0-1
changelog:
  - rebase to 1.9.0
  - add patch to comply with crypto policies
  - add support for openssl
    resolves: rhbz#1932783
  - Properly end TLS connections
    resolves: rhbz#1886400


author: Caolán McNamara <caolanm@redhat.com> - 1:6.4.7.2-6
changelog:
  - Resolves: rhbz#1980800 allow convert to csv to write each sheet to
    separate file
  - Resolves: rhbz#1992695 two style tags where there should be one


author: Caolán McNamara <caolanm@redhat.com> - 1:6.4.7.2-7
changelog:
  - Resolves: rhbz#2013858 CVE-2021-25633
  - Resolves: rhbz#2014215 CVE-2021-25634
  - Resolves: rhbz#2014209 CVE-2021-25635


author: Caolán McNamara <caolanm@redhat.com> - 1:6.4.7.2-9
changelog:
  - Related: rhbz#2029810 set NoDisplay=true for .desktop on s390x/aarch64
  - Related: rhbz#2029810 don't Require any vclplug for s390x/aarch64


author: Caolán McNamara <caolanm@redhat.com> - 1:6.4.7.2-12
changelog:
  - Resolves: rhbz#2118928 CVE-2022-26305 Untrusted Macros
  - Resolves: rhbz#2118924 CVE-2022-26307 Weak Master Keys
  - Resolves: rhbz#2118920 CVE-2022-26306 Static Initialization Vector
  - Resolves: rhbz#2134702 CVE-2022-3140 Macro URL arbitrary script execution


author: Stephan Bergmann <sbergman@redhat.com> - 1:6.4.7.2-15
changelog:
  - Resolves: rhbz#2210191 CVE-2023-0950 Array Index UnderFlow in Calc Formula
    Parsing
  - Resolves: rhbz#2210195 CVE-2023-2255 libreoffice: Remote documents loaded
    without prompt via IFrame
  - Resolves: rhbz#2208509 CVE-2023-1183 libreoffice: Arbitrary File Write


author: Ales Matej <amatej@redhat.com> - 1.10.6-1
changelog:
  - Update to 1.10.6
  - Imporove handling of xattr to re-download damadged files (RhBug:1690894)
  - Rephrase repository GPG check error message (RhBug:1741442)
  - Add sleep before next try when all mirrors were tried (RhBug:1741931)
  - Raise logging level of error messages (RhBug:1737709)
  - Handle webservers that don't support ranges when downloading zck
  - Define LRO_SUPPORTS_CACHEDIR only with zchunk (RhBug:1726141)
  - Allow to use mirrors multiple times for a target (RhBug:1678588)
  - Allow to try baseurl multiple times (RhBug:1678588)


author: Ales Matej <amatej@redhat.com> - 1.11.0-1
changelog:
  - Update to 1.11.0
   - Retry mirrorlist/metalink downloads several times (RhBug:1741931)
   - Improve variable substitutions in URLs and add ${variable} support


author: Ales Matej <amatej@redhat.com> - 1.11.3-1
changelog:
  - Update to 1.11.3
   - Prefer mirrorlist/metalink over baseurl (RhBug:1775184)
   - Fix calling Python API without holding GIL (RhBug:1788918) 
   - Do not unref LrErr_Exception on exit (RhBug:1778854)


author: Nicola Sella <nsella@redhat.com> - 1.12.0-1
changelog:
  - Update to 1.12.0
  - Decode package URL when using for local filename (RhBug:1817130)
  - Fix memory leak in lr_download_metadata() and lr_yum_download_remote()
  - Download sources work when at least one of specified is working (RhBug:1775184)
  - Enable building on OSX


author: Pavla Kratochvilova <pkratoch@redhat.com> - 1.14.0-1
changelog:
  - Update to 1.14.0
  - Fix the key string parsing in url_substitution
  - When zchunk enabled and not using HTTP/S protocol, download the whole file (RhBug:1886706)
  - Add an option LRO_SSLVERIFYSTATUS to check TLS certificate revocation status (using OCSP stapling) (RhBug:1814383)
  - Fix: lr_perform() - Avoid 100% CPU usage
  - Add support for working with certificates used with proxy
  - Reposync does not re-download unchanged packages (RhBug:1931904)
  - Fix memory leaks


author: Pavla Kratochvilova <pkratoch@redhat.com> - 1.14.2-1
changelog:
  - Update to 1.14.2
  - Reduce time to load metadata
  - Fix resource leaks and memory leaks
  - Remove build dependency on python3-flask


author: Lukas Hrazky <lhrazky@redhat.com> - 1.14.2-4
changelog:
  - Fix termination of va_list in lr_metadatatarget_append_error()
  - Detailed error message when using non-existing TMPDIR


author: Matej Habrnal <mhabrnal@redhat.com> 2.9.5-6
changelog:
  - replace all Fedora URLs by corresponding values for RHEL
  - fix coverity issues
  - Resolves: #1602590, #1623406


author: Michal Fabik <mfabik@redhat.com> 2.9.5-7
changelog:
  - bugzilla: change the default bugzilla group
  - tests: Disable strcpm'ing a freed pointer
  - Add autogen.sh
  - Resolves #1660449


author: Martin Kutlak <mkutlak@redhat.com> - 2.9.5-10
changelog:
  - reportclient: Search for required packages recursively
  - reportclient: Find and download required debuginfo packages
  - report-client: Find debuginfos in own method
  - Resolves: rhbz#1783897


author: Michal Židek <mzidek@redhat.com> - 2.9.5-12
changelog:
  - Resolves: rhbz#1835388 - abrt-addon-ccpp causes failures during openscap scans on CCE-27119-7
  - This is just libreport side (abrt also needs to be patched)


author: Paul Wouters <pwouters@redhat.com> - 4.1-1
changelog:
  - Resolves: rhbz#1891128 [Rebase] rebase libreswan to 4.1
  - Resolves: rhbz#1889836 libreswan: add 3.x compat patches for obsoleted/removed keywords of 4.0 and re-port ikev2= patch


author: Paul Wouters <pwouters@redhat.com> - 4.2-1
changelog:
  - Resolves: rhbz#1891128 [Rebase] rebase libreswan to 4.2
  - Resolves: rhbz#1025061 - IKEv2 support for Labeled IPsec


author: Paul Wouters <pwouters@redhat.com> - 4.3-3
changelog:
  - Resolves: rhbz#1933064 - IKEv2 support for Labeled IPsec
  - Resolves: rhbz#1935150 RFE: Support IKE and ESP over TCP: RFC 8229
  - Resolves: rhbz#1935339 virtual_private setting is missing in the default config


author: Daiki Ueno <dueno@redhat.com> - 4.4-1
changelog:
  - Resolves: rhbz#1958968 Rebase libreswan to 4.4
  - Resolves: rhbz#1954423 Libreswan: TS_UNACCEPTABLE on multiple connections between the same peers


author: Daiki Ueno <dueno@redhat.com> - 4.5-1
changelog:
  - Resolves: rhbz#2017352 Rebase libreswan to 4.5
  - Resolves: rhbz#2036903 ikev1: disable diagnostics logging on receiving malformed packets


author: Daiki Ueno <dueno@redhat.com> - 4.9-1
changelog:
  - Resolves: rhbz#2128672 Rebase libreswan to 4.9
  - Remove libreswan-4.4-ikev1-disable-diagnostics.patch no longer necessary


author: Sahana Prasad <sahana@redhat.com> - 4.9-2
changelog:
  - Fix CVE-2023-30570 Malicious IKEv1 Aggressive Mode packets can crash libreswan
  - Resolves: rhbz#2187179


author: Paul Wouters <pwouters@redhat.com> - 3.32-3
changelog:
  - Resolves: rhbz#1842597 regression: libreswan does not send PLUTO_BYTES env variables to updown script
  - Resolves: rhbz#1847766 subsequent xfrmi interfaces configured outside of libreswan are not recognised properly
  - Resolves: rhbz#1840212 protect libreswan against unannounced nss ABI change


author: Paul Wouters <pwouters@redhat.com> - 4.3-3
changelog:
  - Resolves: rhbz#1372050 RFE: Support IKE and ESP over TCP: RFC 8229
  - Resolves: rhbz#1934186 virtual_private setting is missing in the default config


author: Sergio Durigan Junior <sergiodj@redhat.com> - 0.0.4-12
changelog:
  - Resolves: rhbz#1786466 Do not use %{?_isa} for GDB dependency. Recommend
    GDB, instead of requiring it.


author: Tomas Popela <tpopela@redhat.com> - 2.42.7-5
changelog:
  - Resolves: RHEL-635 Upgrade to procedural-masquerade 0.1.7 to fix FTBFS with newer Rust
  - Resolves: RHEL-636 librsvg2 is missing Provides: bundled()
  - Resolves: RHEL-637 Add git-core as a BR for autosetup


author: Nils Philippsen <nils@tiptoe.de> - 0.1.9-1
changelog:
  - version 0.1.9
  - change license to BSD (2-clause)
  - require gcc, alsa-lib-devel, fftw-devel for building


author: Petr Lautrbach <plautrba@redhat.com> - 2.9-2.1
changelog:
  - Use Python distutils to install SELinux python bindings (#1719771)
  - Move  sefcontext_compile to -utils package (#1612518)


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-6
changelog:
  - Describe fcontext regular expressions (#1904059)
  - Strip spaces before values in config (#2012145)


author: Petr Lautrbach <plautrba@redhat.com> - 2.9-5
changelog:
  - Revert "genhomedircon: check usepasswd" (rhbz#1871786)
  - semanage.conf - improve usepasswd=False explanation (rhbz#1871786)
  - semanage.conf - expand list of ignoredirs (rhbz#1871786)


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-7
changelog:
  - Trivial style fixes
  - Free contents of modkey in semanage_direct_remove
  - Fix USE_AFTER_FREE (CWE-672) in semanage_direct_write_langext()
  - add missing include to boolean_record.c
  - move module hashing into libsemanage
  - move compressed file handling into a separate object
  - clean up semanage_direct_commit() a bit
  - optionally rebuild policy when modules are changed externally
  - add command-line option to detect module changes (#2049186)


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-9
changelog:
  - allow spaces in user/group names (#2042408)
  - always write kernel policy when check_ext_changes is specified (#2089802)


author: Petr Lautrbach <plautrba@redhat.com> - 2.7-5
changelog:
  - cil: Create new keep field for type attribute sets
  - build: follow standard semantics for DESTDIR and PREFIX
  - cil: show an error when cil_expr_to_string() fails


author: Petr Lautrbach <plautrba@redhat.com> - 2.7-6
changelog:
  - Prevent freeing unitialized value in ibendport handling
  - Add support for the SCTP portcon keyword
  - Export sepol_polcap_getnum/name functions


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-3
changelog:
  - cil: Fix out-of-bound read of file context pattern ending with "\"
  - cil: Destroy classperms list when resetting classpermission (#1983517)
  - cil: Destroy classperm list when resetting map perms (#1983521)
  - cil: cil_reset_classperms_set() should not reset classpermission (#1983525)
  - cil: Set class field to NULL when resetting struct cil_classperms
  - cil: More strict verification of constraint leaf expressions
  - cil: Exit with an error if declaration name is a reserved word
  - cil: Allow permission expressions when using map classes
  - cil: Reorder checks for invalid rules when building AST
  - cil: Cleanup build AST helper functions
  - cil: Create new first child helper function for building AST
  - cil: Remove unused field from struct cil_args_resolve
  - cil: Destroy disabled optional blocks after pass is complete
  - cil: Check if name is a macro parameter first
  - cil: fix NULL pointer dereference in __cil_insert_name
  - cil: Report disabling an optional block only at high verbose levels
  - cil: Use AST to track blocks and optionals when resolving
  - cil: Reorder checks for invalid rules when resolving AST
  - cil: Sync checks for invalid rules in booleanifs
  - cil: Check for statements not allowed in optional blocks (#1983530)


author: Jindrich Novy <jnovy@redhat.com> - 4.3.0-3
changelog:
  - fix static analysis issues merged upstream
    (https://gitlab.freedesktop.org/slirp/libslirp/-/merge_requests/41)
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 4.3.0-4
changelog:
  - fix "CVE-2020-10756 QEMU: slirp: networking out-of-bounds read information disclosure vulnerability"
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 4.4.0-1
changelog:
  - Fix CVE-2021-3592 CVE-2021-3593 CVE-2021-3594 CVE-2021-3595 out-of-bounds access
  - Related: #1934415


author: Peter Jones <pjones@redhat.com> - 2.3.0-2
changelog:
  - Once again, don't complain about compilers newer than tested with in the
    public headers.
  - Fix up bad %global vs %define directives
  - Fix up bad old changelog dates
  - Note there's a missing changelog here from the 2.3.0 rebase


author: Michal Hlavinka <mhlavink@redhat.com> - 1.0.28-1
changelog:
  - updated to 1.0.28
  - fix possible buffer overflow when parsing crafted ID3 tags (#1440758, CVE-2017-7586)
  - fix possible buffer overflow when parsing crafted flac file (#1440756, CVE-2017-7585)


author: Michal Hlavinka <mhlavink@redhat.com> - 1.0.28-10
changelog:
  - fix CVE-2018-19661 and CVE-2018-19662 - buffer over-read in the function
    i2alaw_array in alaw (#1673085)


author: Michal Hlavinka <mhlavink@redhat.com> - 1.0.28-10.1
changelog:
  - a crafted wav file could cause heap buffer overflow that allowed an arbitrary code execution(#1985027)


author: Michal Hlavinka <mhlavink@redhat.com> - 1.0.28-11
changelog:
  - a crafted wav file could cause heap buffer overflow that allowed an arbitrary code execution(#1985028)


author: Pavla Kratochvilova <pkratoch@redhat.org> - 0.7.4-1
changelog:
  - soname bump to "1"
  - incompatible API changes:
    * bindings: Selection.flags is now an attribute
    * repodata_lookup_num now works like the other lookup_num functions
  - new functions:
    * selection_make_matchsolvable
    * selection_make_matchsolvablelist
    * pool_whatmatchessolvable
    * repodata_search_arrayelement
    * repodata_lookup_kv_uninternalized
    * repodata_search_uninternalized
    * repodata_translate_dir
  - new repowriter interface to write solv files allowing better
    control over what gets written
  - support for filtered file lists with a custom filter
  - dropped support of (since a long time unused) REPOKEY_TYPE_U32
  - selected bug fixes:
    * fix nasty off-by-one error in repo_write
    * do not autouninstall packages because of forcebest updates
    * fixed a couple of null pointer derefs and potential memory
      leaks
    * made disfavoring recommended packages work if strong recommends
      is enabled
    * no longer disable infarch rules when they don't conflict with
      the job
    * repo_add_rpmdb: do not copy bad solvables from the old solv file
    * fix cleandeps updates not updating all packages
  - new features:
    * support rpm's new '^' version separator
    * support set/get_considered_list in bindings
    * new experimental SOLVER_FLAG_ONLY_NAMESPACE_RECOMMENDED flag
    * do favor evaluation before pruning allowing to (dis)favor
      specific package versions
    * bindings: support pool.matchsolvable(), pool.whatmatchessolvable()
      pool.best_solvables() and selection.matchsolvable()
    * experimental DISTTYPE_CONDA and REL_CONDA support


author: Ales Matej <amatej@redhat.org> - 0.7.7-1
changelog:
  - Update to 0.7.7
  - selected bug fixes:
    * fix updating of too many packages in focusbest mode
    * fix handling of disabled installed packages in distupgrade
    * fix repository priority handling for multiversion packages
    * better support of inverval deps in pool_match_dep()
    * support src rpms that have non-empty provides
    * fix favorq leaking between solver runs if the solver is reused
    * fix SOLVER_FLAG_FOCUS_BEST updateing packages without reason
    * be more correct with multiversion packages that obsolete their
      own name
    * allow building with swig-4.0.0
    * lock jobs now take precedence over dup and forcebest jobs
  - new features
    * new POOL_FLAG_WHATPROVIDESWITHDISABLED pool flag 
    * bindings: add get_disabled_list() and set_disabled_list()
    * bindings: add whatcontainsdep()
    * bindings: make the selection filters return the self object
    * MSVC compilation support


author: Ales Matej <amatej@redhat.org> - 0.7.11-1
changelog:
  - Update to 0.7.11
  - selected bug fixes:
    * support arch<->noarch package changes when creating patch
      conflicts from the updateinfo data
    * also support other rpm database types
    * fixed solv_zchunk decoding error if large chunks are used
    * treat retracted pathes as irrelevant
    * made add_update_target work with multiversion installs
  - new features
    * support for SOLVER_BLACKLIST jobs that block the installation of matched
      packages unless they are directly selected by an SOLVER_INSTALL job
    * libsolv now also parses the patch status in the updateinfo parser
    * new solvable_matchessolvable() function
    * support conda constrains dependencies
    * new rpm_stat_database() function
    * new rpm_hash_database_state() function


author: Nicola Sella <nsella@redhat.com> - 0.7.16-1
changelog:
  - Update to 0.7.16
  - selected bug fixes:
    * make testcase_mangle_repo_names deal correctly with freed repos
    [bnc#1177238]
    * fix add_complex_recommends() selecting conflicted packages in
      rare cases leading to crashes
    * improve choicerule generation so that package updates are
      prefered in more cases
    * fix deduceq2addedmap clearing bits outside of the map
    * conda: feature depriorization and fix startswith implementation
    * Fix solvable swapping messing up idarrays
    * fix ruleinfo of complex dependencies returning the wrong origin
    * fix solv_zchunk decoding error if large chunks are used
      [bnc#1159314]
  - new features
    * new testcase_mangle_repo_names() function
    * new solv_fmemopen() function
    * Enable zstd compression support for sle15 and sle15-sp2
    * Support blacklisted packages in solver_findproblemrule()
      [bnc#1172135]
    * Support rules with multiple negative literals in choice rule
      generation
    * build with -DENABLE_RPMDB_LIBRPM=1 on SUSE to support
      multiple rpm database backends
    * added two new function to make libzypp independent of the rpm
      database format
    * support conda constrains dependencies


author: Pavla Kratochvilova <pkratoch@redhat.org> - 0.7.17-1
changelog:
  - Update to 0.7.17
  - selected bug fixes:
    * repo_write: fix handling of nested flexarray
    * improve choicerule generation a bit more to cover more cases
    * harden testcase parser against repos being added too late
    * support python-3.10
    * check /var/lib/rpm macro in rpmdb code
  - new features:
    * handle default/visible/langonly attributes in comps parser
    * support multiple collections in updateinfo parser
    * add '-D' option in rpmdb2solv to set the dbpath


author: Pavla Kratochvilova <pkratoch@redhat.org> - 0.7.19-1
changelog:
  - Update to 0.7.19
  - repo_add_conda: add flag to skip v2 packages
  - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt
  - fix error handling in solv_xfopen_fd()
  - fix memory leaks


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.7.20-1
changelog:
  - Update to 0.7.20
  - new SOLVER_EXCLUDEFROMWEAK job to ignore pkgs for weak dependencies
  - support for environments in comps parser
  - fix misparsing of '&' in attributes with libxml2
  - choice rules: treat orphaned packages as newest
  - fix compatibility with Python 3.10


author: Jaroslav Rohel <jrohel@redhat.com> - 0.7.20-5
changelog:
  - Backport Treat condition both as positive and negative literal in pool_add_pos_literals_complex_dep
    (RhBug:2185061,2190136)


author: Milan Crha <mcrha@redhat.com> - 2.62.2-1
changelog:
  - Update to 2.62.2
  - Backport upstream patch for CVE-2018-12910 - Crash in soup_cookie_jar.c:get_cookies() on empty hostnames


author: Rex Dieter <rdieter@fedoraproject.org> - 0.2.8-5
changelog:
  - BR: libgs-devel (f28+)
  - .spec cleanup/cosmetics (drop deprecated tags, use %autosetup/%license, tighten subpkg dep)


author: Anderson Sasaki <ansasaki@redhat.com> - 0.8.5-1
changelog:
  - Update to version 0.8.5
    * Fixed an issue where global known_hosts file was ignored (#1649321)
    * Fixed ssh_get_fd() to return writable file descriptor (#1649319)
    * Fixed regression introduced in known_hosts parsing (#1649315)
    * Fixed a regression which caused only the first algorithm in known_hosts to
      be considered (#1638790)


author: Anderson Sasaki <ansasaki@redhat.com> - 0.8.91-0.1
changelog:
  - Update to 0.9.0 pre release version (0.8.91)
  - Added default configuration files for client and server
  - Removed unused patch files left behind
  - Fixed issues found to run upstream test suite with SELinux


author: Anderson Sasaki <ansasaki@redhat.com> - 0.9.0-1
changelog:
  - Update to version 0.9.0
    https://www.libssh.org/2019/06/28/libssh-0-9-0/
  - Added explicit Requires for crypto-policies
  - Do not ignore known_hosts keys when SSH_OPTIONS_HOSTKEYS is set
  - Provide the configuration files in a separate libssh-config subpackage


author: Anderson Sasaki <ansasaki@redhat.com> - 0.9.0-3
changelog:
  - Add Obsoletes in libssh-config to avoid conflict with old libssh which
    installed the configuration files.


author: Anderson Sasaki <ansasaki@redhat.com> - 0.9.4-1
changelog:
  - Update to version 0.9.4
    https://www.libssh.org/2020/04/09/libssh-0-9-4-and-libssh-0-8-9-security-release/
  - Fixed CVE-2019-14889 (#1781782)
  - Fixed CVE-2020-1730 (#1802422)
  - Create missing directories in the path provided for known_hosts files (#1733914)
  - Removed inclusion of OpenSSH server configuration file from
    libssh_server.config (#1821339)


author: Anderson Sasaki <ansasaki@redhat.com> - 0.9.4-2
changelog:
  - Do not return error when server properly closed the channel (#1849071)
  - Add a test for CVE-2019-14889
  - Do not parse configuration file in torture_knownhosts test


author: Sahana Prasad <sahana@redhat.com> - 0.9.4-3
changelog:
  - Fix CVE-2020-16135 NULL pointer dereference in sftpserver.c if
    ssh_buffer_new returns NULL (#1862646)


author: Norbert Pocs <npocs@redhat.com> - 0.9.6-1
changelog:
  - Fix CVE-2021-3634: Fix possible heap-buffer overflow when
    rekeying with different key exchange mechanism (#1978810)


author: Norbert Pocs <npocs@redhat.com> - 0.9.6-1
changelog:
  - Fix CVE-2021-3634: Fix possible heap-buffer overflow when
    rekeying with different key exchange mechanism
  - Rebase to version 0.9.6
  - Rename SSHD_EXECUTABLE to SSH_EXECUTABLE in tests/torture.c
  - Resolves: rhbz#1896651, rhbz#1994600


author: Norbert Pocs <npocs@redhat.com> - 0.9.6-6
changelog:
  - Enable client and server testing build time
  - Fix failing rekey test on arch s390x
  - Resolves: rhbz#2126342


author: David Tardon <dtardon@redhat.com> - 0.0.3-3
changelog:
  - Resolves: rhbz#1458800 CVE-2017-9432 Stack-buffer overflow in the
    StarWriterStruct::DatabaseName::read


author: Tony Asleson <tasleson@redhat.com> - 1.9.1-7
changelog:
  - Remove valgrind dependency as not being used and causing
    build to fail as it pulls in python3.11


author: Jakub Hrozek <jhrozek@redhat.com> - 2.1.14-1
changelog:
  - New upstream release - 2.1.14
  - Patch the waf script to explicitly call python2 as "env python" doesn't
    yield py2 anymore


author: Jakub Hrozek <jhrozek@redhat.com> - 2.1.16-1
changelog:
  - Resolves: rhbz#1684577 - Rebase libtalloc to version 2.1.16 for Samba
  - Resolves: rhbz#1597315 - libtalloc uses Python 2 to build
  - Resolves: rhbz#1567136 - libtalloc: Drop Python 2 subpackage from RHEL 8


author: Jakub Hrozek <jhrozek@redhat.com> - 2.1.16-2
changelog:
  - Remove python2 libraries on upgrade
  - Resolves: rhbz#1567136 - libtalloc: Drop Python 2 subpackage from RHEL 8


author: Jakub Hrozek <jhrozek@redhat.com> - 2.1.16-3
changelog:
  - Also obsolete python2-libtalloc-debuginfo
  - Resolves: rhbz#1567136 - libtalloc: Drop Python 2 subpackage from RHEL 8


author: Kamil Dudka <kdudka@redhat.com> - 1.2.20-16
changelog:
  - fix memory leaks through gnu_long{name,link} (CVE-2021-33645 CVE-2021-33646)
  - fix out-of-bounds read in gnu_long{name,link} (CVE-2021-33643 CVE-2021-33644)


author: Peter Robinson <pbrobinson@fedoraproject.org> 4.9-2
changelog:
  - Move development related docs to devel sub package
  - Cleanup spec and macros
  - Update valgrind ExclusiveArch


author: Jakub Hrozek <jhrozek@redhat.com> - 1.3.16-1
changelog:
  - New upstream release 1.3.16
  - Use RHEL_ALLOW_PYTHON2_FOR_BUILD=1 until libtalloc uses waf3
  - Patch the waf script to explicitly call python2 as "env python" doesn't
    yield py2 anymore


author: Jakub Hrozek <jhrozek@redhat.com> - 1.3.18.1
changelog:
  - Resolves: rhbz#1684579 - Rebase libtdb to version 1.3.18 for Samba
  - Resolves: rhbz#1597319 - libtdb uses Python 2 to build
  - Resolves: rhbz#1567138 - libtdb: Drop Python 2 subpackage from RHEL 8


author: Jakub Hrozek <jhrozek@redhat.com> - 1.3.18.2
changelog:
  - Obsolete the python2 packages on upgrade
  - Resolves: rhbz#1567138 - libtdb: Drop Python 2 subpackage from RHEL 8


author: Isaac Boukris <iboukris@redhat.com> - 1.4.2-2
changelog:
  - Resolves: rhbz#1754420 - Rebase libtdb 1.4.2 for samba
  - Related: rhbz#1754420 - Fix sssd tests (tdb)


author: Xin Long <lxin@redhat.com> - 1.28-2
changelog:
  - teamd: use enabled option_changed to sync enabled to link_up for lb runner [1668132]
  - teamd: tdport has to exist if item->per_port is set in __find_by_item_path [1687336]
  - teamd: remove port if adding fails [1668744]


author: Xin Long <lxin@redhat.com> - 1.28-3
changelog:
  - teamd: return 0 if tdport doesn't exist in teamd_config_port_set [1722449]
  - teamd: improve the error output for non-integer port prio


author: Xin Long <lxin@redhat.com> - 1.29-1
changelog:
  - man teamd.conf: update some parameter default values [1732587]
  - 1.29 release
  - teamd: add port_master_ifindex_changed for link_watch_port_watch_ops
  - initscripts: fix if/fi align
  - teamd: fix a json object memleak in get_port_obj() [1767685]
  - libteam: set netlink event socket as non-blocking [1684389]
  - libteam: double NETLINK_RCVBUF to fix -ENOMEM error
  - teamd: add a default value 1000 for link_watch.interval


author: Xin Long <lxin@redhat.com> - 1.29-2
changelog:
  - teamd/lacp: fix segfault due to NULL pointer dereference [1758073]
  - teamd: fix build error in expansion of macro teamd_log_dbgx [1758073]
  - teamd: update ctx->hwaddr after setting team dev to new hwaddr
  - libteam: wapper teamd_log_dbg with teamd_log_dbgx [1758073]


author: Xin Long <lxin@redhat.com> - 1.31-1
changelog:
  - 1.31 release
  - utils/bond2team: remove TYPE in ifcfg file [1858518]
  - utils/bond2team: keep delivering config to file if stdout not supplied [1858518]
  - teamd/lacp: silence ignore none LACP frames
  - Send LACP PDU right after the Actor state has been changed
  - Skip setting the same hwaddr to a lag port if not needed
  - Make all netlink socket RCVBUF sizes configurable
  - Don't return an error when timerfd socket return 0
  - Fix ifinfo_link_with_port race condition with newlink
  - teamd: fix possible race in master ifname callback
  - 1.30 release
  - teamd: Disregard current state when considering port enablement [1851460]


author: Xin Long <lxin@redhat.com> - 1.31-4
changelog:
  - teamd: do no remove the ports on shutdown with -N [2148856]
  - teamd: stop iterating callbacks when a loop restart is requested [2148855]


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.37-1
changelog:
  - New upstream release 0.9.37
  - Use RHEL_ALLOW_PYTHON2_FOR_BUILD=1 for build
  - Use %{__python2}, not "python", as the Python2 interpreter


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.39-1
changelog:
  - Resolves: #1684580 - Rebase libtevent to version 0.9.36 for Samba
  - Resolves: #1597318 - libtevent uses Python 2 to build
  - Resolves: #1567139 - libtevent: Drop Python 2 subpackage from RHEL 8


author: Jakub Hrozek <jhrozek@redhat.com>
changelog:
  - Remove the python2 subpackages on upgrade
  - Resolves: #1567139 - libtevent: Drop Python 2 subpackage from RHEL 8


author: Isaac Boukris <iboukris@redhat.com> - 0.10.0-2
changelog:
  - Resolves: #1754421 - Upgrade tevent to 0.10.0 version for samba
  - Related: #1754421 - Fix sssd tests (tevent)


author: Daiki Ueno <dueno@redhat.com> - 0.1.24-1
changelog:
  - Update to 0.1.24
  - Apply patch from upstream, which fixes scim-thai FTBFS with GCC6 (Closes: #1308117)


author: Nikola Forró <nforro@redhat.com> - 4.0.9-19
changelog:
  - Fix CVE-2020-35521 (#1945539)
  - Fix CVE-2020-35522 (#1945555)
  - Fix CVE-2020-35523 (#1945542)
  - Fix CVE-2020-35524 (#1945546)


author: Matej Mužila <mmuzila@redhat.com> - 4.0.9-23
changelog:
  - Fix various CVEs
  - Resolves: CVE-2022-0561 CVE-2022-0562 CVE-2022-22844 CVE-2022-0865
    CVE-2022-0891 CVE-2022-0924 CVE-2022-0909 CVE-2022-0908 CVE-2022-1355


author: Matej Mužila <mmuzila@redhat.com> - 4.0.9-29
changelog:
  - Fix CVE-2023-0800 CVE-2023-0801 CVE-2023-0802 CVE-2023-0803 CVE-2023-0804
  - Resolves: RHEL-4683 RHEL-4685 RHEL-4686 RHEL-4687 RHEL-4688


author: David Shea <dshea@redhat.com> - 0.4.5-3
changelog:
  - Render the map directly from SVG (#1335158)
  - Fix memory leaks in tz.c
  - Fix an invalid memory access
  - Do not modify TZ in the process environment
  - Move all data files to /usr/share/libtimezonemap from .../libtimezonemap/ui
  - Add extra city data so all timezone offsets are clickable
  - Move Venezuela from -04:30 to -04:00
  - Fix the conversion of points just west of 180 longitude
  - Remove the out-of-date Olson map data
  - Update the "backward" file
  - Improve the location selected when setting the timezone by name (#1322648)
  - Remove an extra line in the +10:00 layer
  - Move Chile back an hour


author: Steve Dickson <steved@redhat.com> 1.1.4-4
changelog:
  - Enable gating using reverse dependency testing of nfs-utils (bz 1681965)
  - Updated the URL (bz 1638671)
  - Fix EOF detection on non-blocking socket (bz 1641875)


author: Steve Dickson <steved@redhat.com> 1.1.4-5
changelog:
  - blacklist: Add a few more well known ports (bz 1854147)
  - Disallow calling auth_refresh from clnt_call with RPCSEC_GSS (bz 1934866)


author: Steve Dickson <steved@redhat.com> 1.1.4-8
changelog:
  - rpcb_clnt.c add mechanism to try v2 protocol first (bz 2107650)
  - Multithreaded cleanup (bz 2112116)


author: Pavel Raiskup <praiskup@redhat.com> - 2.4.6-23
changelog:
  - bake in versioned requirement on automake (rhbz#1193591)
  - fix testsuite FTBFS against automake 1.16.1
  - bypass -specs=* to gcc (rhbz#985592)


author: Marc-André Lureau <marcandre.lureau@redhat.com> - 0.7.2-1.20200527git7325acb477
changelog:
  - Update to v0.7.2 stable snapshot, fixes rhbz#1809676
  - exclude i686 build
  - Following stable-0.7.0 branch for TPM 2 related fixes: RSA decryption,
    PSS salt length, symmetric decryption (padding)
  - Under certain circumstances an RSA decryption could cause a buffer overflow causing
    termination of the program (swtpm)
  - Following stable-0.7.0 branch for TPM 2 related fixes; v0.7.1 + gcc related patch
  - elliptic curve fixes
  - MANUFACTURER changed from "IBM " to "IBM"
  - gcc 10 related fix
  - Following stable-0.7.0 branch for TPM 1.2 related bugfix


author: Marc-André Lureau <marcandre.lureau@redhat.com> - 0.7.3-1.20200818git1d392d466a
changelog:
  - Update to v0.7.3 stable, fixes rhbz#1868447
  - (includes "tpm2: fix PCRBelongsTCBGroup for PCClient")


author: Marc-André Lureau <marcandre.lureau@redhat.com> - 0.7.4-5.20201106git2452a24dab
changelog:
  - Fix CVE-2021-3623: out-of-bounds access when trying to resume the state of the vTPM
    Fixes: rhbz#1976816


author: Marc-André Lureau <marcandre.lureau@redhat.com> - 0.7.4-6.20201106git2452a24dab
changelog:
  - Fix CVE-2021-3746 libtpms: out-of-bounds access via specially crafted TPM 2 command packets
    Resolves: rhbz#1999307


author: Marc-André Lureau <marcandre.lureau@redhat.com> - 0.9.1-2.20211126git1ff6fe1f43
changelog:
  - Backport "tpm2: Check size of buffer before accessing it" (CVE-2023-1017 & CVE-2023-1018)
    Resolves: rhbz#2173964
    Resolves: rhbz#2173970


author: Tomas Bzatek <tbzatek@redhat.com> - 2.9.0-14
changelog:
  - iscsi: CHAP auth algorithm selection fixes (#2188991)
  - tests: Use stronger passphrases for LUKS tests
  - lvm2: Improve uevent processing (#2039772)


author: Tomas Bzatek <tbzatek@redhat.com> - 2.9.0-16
changelog:
  - iscsi: Fix login on firmware-discovered nodes (#2213193)
  - tests: Extend iscsi method call timeouts (#2213715)


author: Tomas Bzatek <tbzatek@redhat.com> - 2.8.3-1
changelog:
  - Rebased to upstream 2.8.3 release (#1685210)
  - Fix leaking filedescriptors (#1614774)
  - Fix udisksctl pager scrolling (#1662336)
  - Fix LVM2 plugin CreateSnapshot() error (#1668291)
  - Add ISCSI plugin GetInitiatorNameRaw() method (#1710257)


author: Robert Scheck <robert@fedoraproject.org> 0.9.12-15
changelog:
  - Added patch to avoid a /usr/@DATADIRNAME@/locale/ directory
  - Use %{_udevrulesdir} macro rather /etc/udev/rules.d/ (#1226681)


author: Jeff Moyer <jmoyer@redhat.com> - 1.0.7-2.el8
changelog:
  - Fix versioning.  The installed library is 1.0.7, make the rpm match.
  - bump release number for build, which includes -fPIC fix
  - Related: rhbz#1862551


author: Jakub Hrozek <jhrozek@redhat.com> - 0.62-14
changelog:
  - Do not build python2-libuser at all in RHEL-8
  - Resolves: #1559103 - libuser: Drop Python 2 subpackage(s) from RHEL 8


author: Jakub Hrozek <jhrozek@redhat.com> - 0.62-16
changelog:
  - Use 2048bit keys in tests
  - Resolves: rhbz#1611729 - [RHEL8-S-BUILD] libuser Fails Scratch Build on rhel-8.0


author: Jakub Hrozek <jhrozek@redhat.com> - 0.62-17
changelog:
  - Resolves: rhbz#1558151 - libuser needs audit events around the account
                             lifecycle


author: Jakub Hrozek <jhrozek@redhat.com> - 0.62-19
changelog:
  - Resolves: rhbz#1602600 -  Please review important issues found by covscan
                              in "libuser-0.62-14.el8+7" package


author: Jakub Hrozek <jhrozek@redhat.com> - 0.62-20
changelog:
  - Resolves: rhbz#1637398 - libuser-python3 should be renamed to comply
                             with Packaging Guidelines


author: Jakub Hrozek <jhrozek@redhat.com> - 0.62-23
changelog:
  - Actually apply the patch from the previous build
  - Resolves: rhbz#1670997 - Amend the user lifecycle auditing


author: Miroslav Lichvar <mlichvar@redhat.com> - 1.1.6-14
changelog:
  - build with hardening LDFLAGS (#1548717)
  - remove obsolete macro and comments
  - add gcc to build requirements


author: Harald Hoyer <harald@redhat.com> - 16-1
changelog:
  - libvarlink 16
  - fixed coverity issues
  - Resolves: #1638294 - Interface name validation rule update


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-42
changelog:
  - RHEL: virscsi: Check device type before getting it's /dev node name (rhbz#1808388)
  - RHEL: virscsi: Support TAPEs in virSCSIDeviceGetDevName() (rhbz#1808388)
  - RHEL: virscsi: Introduce and use virSCSIDeviceGetUnprivSGIOSysfsPath() (rhbz#1808388)
  - RHEL: virutil: Accept non-block devices in virGetDeviceID() (rhbz#1808388)
  - RHEL: qemuSetUnprivSGIO: Actually use calculated @sysfs_path to set unpriv_sgio (rhbz#1808388)
  - RHEL: qemuCheckUnprivSGIO: use @sysfs_path to get unpriv_sgio (rhbz#1808399)


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-25
changelog:
  - Upgrade components in virt:rhel module:stream for RHEL-8.3 release (rhbz#1828317)
  - conf: Don't format http cookies unless VIR_DOMAIN_DEF_FORMAT_SECURE is used (CVE-2020-14301)
  - util: Introduce a parser for kernel cmdline arguments (rhbz#1848997)
  - qemu: Check if s390 secure guest support is enabled (rhbz#1848997)
  - qemu: Check if AMD secure guest support is enabled (rhbz#1848997)
  - tools: Secure guest check on s390 in virt-host-validate (rhbz#1848997)
  - tools: Secure guest check for AMD in virt-host-validate (rhbz#1848997)
  - docs: Update AMD launch secure description (rhbz#1848997)
  - docs: Describe protected virtualization guest setup (rhbz#1848997)


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-26
changelog:
  - qemu: blockjob: Don't base bitmap handling of active-layer block commit on QEMU_CAPS_BLOCKDEV_REOPEN (rhbz#1857779)
  - qemu: blockjob: Actually delete temporary bitmap on failed active commit (rhbz#1857779)
  - qemu: block: Remove 'active-write' bitmap even if there are no bitmaps to merge (rhbz#1857779)
  - qemuDomainBlockPivot: Rename 'actions' to 'bitmapactions' (rhbz#1857779)
  - qemuDomainBlockPivot: Ignore failures of creating active layer bitmap (rhbz#1857779)


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-27
changelog:
  - src: assume sys/sysmacros.h always exists on Linux (rhbz#1860421)
  - virdevmapper.c: Join two WITH_DEVMAPPER sections together (rhbz#1860421)
  - virDevMapperGetTargetsImpl: Use VIR_AUTOSTRINGLIST (rhbz#1860421)
  - virdevmapper: Don't use libdevmapper to obtain dependencies (CVE-2020-14339, rhbz#1860421)
  - virDevMapperGetTargets: Don't ignore EBADF (rhbz#1860421)


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-28
changelog:
  - virdevmapper: Don't cache device-mapper major (rhbz#1860421)
  - virdevmapper: Handle kernel without device-mapper support (rhbz#1860421)
  - virdevmapper: Ignore all errors when opening /dev/mapper/control (rhbz#1860421)


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-29
changelog:
  - qemu: substitute missing model name for host-passthrough (rhbz#1850680)
  - rpc: gendispatch: handle empty flags (CVE-2020-25637)
  - rpc: add support for filtering @acls by uint params (CVE-2020-25637)
  - rpc: require write acl for guest agent in virDomainInterfaceAddresses (CVE-2020-25637)
  - qemu: agent: set ifname to NULL after freeing (CVE-2020-25637)
  - qemu: Fix domfsinfo for non-PCI device information from guest agent (rhbz#1858771)
  - virDomainNetFindIdx: add support for CCW addresses (rhbz#1837495)
  - check for NULL before calling g_regex_unref (rhbz#1861176)
  - virhostcpu.c: fix 'die_id' parsing for Power hosts (rhbz#1876742)
  - qemuFirmwareFillDomain: Fill NVRAM template on migration too (rhbz#1880418)
  - node_device: refactor udevProcessCCW (rhbz#1853289, rhbz#1865932)
  - node_device: detect CSS devices (rhbz#1853289, rhbz#1865932)
  - virsh: nodedev: ability to filter CSS capabilities (rhbz#1853289, rhbz#1865932)
  - node_device: detect DASD devices (rhbz#1853289, rhbz#1865932)
  - udevProcessCSS: Check if def->driver is non-NULL (rhbz#1853289, rhbz#1865932)


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-30
changelog:
  - cpu_map: Add missing x86 features in 0x7 CPUID leaf (rhbz#1861506)
  - cpu_map: Add missing x86 features in 0x80000008 CPUID leaf (rhbz#1861506)
  - cpu_map: Add missing AMD SVM features (rhbz#1861506)
  - Add testdata for AMD EPYC 7502 (rhbz#1861506)
  - cpu_map: Defined and enable EPYC-Rome model (rhbz#1861506)
  - cpu_map: Remove monitor feature from EPYC-Rome (rhbz#1861506)
  - tests: qemuxml2argv: Use existing machine type for 'numatune-distances' case (rhbz#1749518)
  - qemuxml2xmltest: Add "numatune-distance" test case (rhbz#1749518)
  - conf: Move and rename virDomainParseScaledValue() (rhbz#1749518)
  - numa_conf: Drop CPU from name of two functions (rhbz#1749518)
  - qemu_command: Rename qemuBuildNumaArgStr() (rhbz#1749518)
  - qemuBuildMachineCommandLine: Drop needless check (rhbz#1749518)
  - numa_conf: Make virDomainNumaSetNodeCpumask() return void (rhbz#1749518)
  - Allow NUMA nodes without vCPUs (rhbz#1749518)
  - conf: Parse and format HMAT (rhbz#1749518)
  - conf: Validate NUMA HMAT configuration (rhbz#1749518)
  - numa: expose HMAT APIs (rhbz#1749518)
  - qemu: Introduce QEMU_CAPS_NUMA_HMAT capability (rhbz#1749518)
  - qemu: Build HMAT command line (rhbz#1749518)
  - qemuBuildNumaCommandLine: Fix @masterInitiator check (rhbz#1749518)
  - numa_conf: Properly check for caches in virDomainNumaDefValidate() (rhbz#1749518)
  - RNG: Allow interleaving of /domain/cpu/numa/cell children (rhbz#1749518)


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-31
changelog:
  - conf: properly clear out autogenerated macvtap names when formatting/parsing (rhbz#1872610)
  - qemu: format 'ramfb' attribute for mediated devices (rhbz#1876297)


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-32
changelog:
  - util: replace macvtap name reservation bitmap with a simple counter (rhbz#1874304)
  - util: assign tap device names using a monotonically increasing integer (rhbz#1874304)
  - util: virNetDevTapCreate: initialize fd to -1 (rhbz#1874304)


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-33
changelog:
  - cpu_map: Fix Icelake Server model number (rhbz#1537734)
  - cputestdata: Add test data for Snowridge (rhbz#1537734)
  - cpu_map: Add support for fsrm CPU feature (rhbz#1537734)
  - cpu_map: Add support for core-capability CPU feature (rhbz#1537734)
  - cpu_map: Add support for split-lock-detect CPU feature (rhbz#1537734)
  - cpu_map: Define and enable Snowridge model (rhbz#1537734)
  - util: fix typo in VIR_MOCK_WRAP_RET_ARGS() (rhbz#1607929)
  - util/tests: enable locking on iptables/ebtables commandlines in unit tests (rhbz#1607929)
  - util/tests: enable locking on iptables/ebtables commandlines by default (rhbz#1607929)
  - tests: fix iptables test case commandline options in virfirewalltest.c (rhbz#1607929)
  - network: be more verbose about the reason for a firewall reload (rhbz#1607929)
  - util: always check for ebtables/iptables binaries, even when using firewalld (rhbz#1607929)
  - util: synchronize with firewalld before we start calling iptables directly (rhbz#1607929)
  - util: call iptables directly rather than via firewalld (rhbz#1607929)
  - util: virhostcpu: Fail when fetching CPU Stats for invalid cpu (rhbz#1915183)


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-34
changelog:
  - qemu: move cgroup cpu period and quota defines to vircgroup.h (rhbz#1915733)
  - vircgroupv1: use defines for cpu period and quota limits (rhbz#1915733)
  - vircgroupv2: use defines for cpu period and quota limits (rhbz#1915733)
  - vircgroup: fix cpu quota maximum limit (rhbz#1915733)
  - util: add virNetDevGetPhysPortName (rhbz#1918708)
  - util: avoid manual VIR_FREE of a g_autofree pointer in virPCIGetName() (rhbz#1918708)
  - util: Add phys_port_name support on virPCIGetNetName (rhbz#1918708)


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-35
changelog:
  - vircgroupv2: properly detect placement of running VM (rhbz#1798463)
  - virsystemd: export virSystemdHasMachined (rhbz#1798463)
  - virsystemd: introduce virSystemdGetMachineByPID (rhbz#1798463)
  - virsystemd: introduce virSystemdGetMachineUnitByPID (rhbz#1798463)
  - vircgroup: use DBus call to systemd for some APIs (rhbz#1798463)
  - vircgroupv1: refactor virCgroupV1DetectPlacement (rhbz#1798463)
  - vircgroupv2: move task into cgroup before enabling controllers (rhbz#1798463)
  - vircgroup: introduce virCgroupV1Exists and virCgroupV2Exists (rhbz#1798463)
  - vircgroup: introduce nested cgroup to properly work with systemd (rhbz#1798463)
  - tests: add cgroup nested tests (rhbz#1798463)
  - vircgroup: correctly free nested virCgroupPtr (rhbz#1798463)
  - qemu: Add virtio related options to vsock (rhbz#1931548)
  - domain_validate: use defines for cpu period and quota limits (rhbz#1798463)
  - docs: use proper cpu quota value in our documentation (rhbz#1798463)
  - vircgroup: enforce range limit for cpu.shares (rhbz#1798463)
  - cgroup: use virCgroupSetCpuShares instead of virCgroupSetupCpuShares (rhbz#1798463)
  - cpumap: Add support for ibrs CPU feature (rhbz#1926864)
  - cpumap: Add support for svme-addr-check CPU feature (rhbz#1926864)
  - cpu_map: Add EPYC-Milan x86 CPU model (rhbz#1926864)
  - cpu_map: Install x86_EPYC-Milan.xml (rhbz#1926864)
  - cpu_map: Fix spelling of svme-addr-chk feature (rhbz#1926864)


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-36
changelog:
  - network: make it safe to call networkSetupPrivateChains() multiple times (rhbz#1942805)
  - network: force re-creation of iptables private chains on firewalld restart (rhbz#1942805)
  - hostdev: Update mdev pointer reference after checking device type (rhbz#1940449)
  - hostdev: mdev: Lookup mdevs by sysfs path rather than mdev struct (rhbz#1940449)
  - qemu_firmware: don't error out for unknown firmware features (rhbz#1961562)
  - docs: improve description of secure attribute for loader element (rhbz#1929357)
  - conf: introduce virDomainDefParseBootInitOptions (rhbz#1929357)
  - conf: introduce virDomainDefParseBootKernelOptions (rhbz#1929357)
  - conf: introduce virDomainDefParseBootFirmwareOptions (rhbz#1929357)
  - conf: introduce virDomainDefParseBootLoaderOptions (rhbz#1929357)
  - conf: introduce virDomainDefParseBootAcpiOptions (rhbz#1929357)
  - conf: use switch in virDomainDefParseBootOptions (rhbz#1929357)
  - conf: introduce support for firmware auto-selection feature filtering (rhbz#1929357)
  - qemu: implement support for firmware auto-selection feature filtering (rhbz#1929357)
  - domain_conf: Don't leak def->os.firmwareFeatures (rhbz#1929357)
  - conf: remove duplicated firmware type attribute (rhbz#1929357)


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-37
changelog:
  - security: fix SELinux label generation logic (CVE-2021-3631)
  - storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath (CVE-2021-3667)


author: Jiri Denemark <jdenemar@redhat.com> - 7.8.0-1
changelog:
  - Rebased to libvirt-7.8.0 (rhbz#2012802)
  - The rebase also fixes the following bugs:
      rhbz#1839070, rhbz#1942275, rhbz#1995865, rhbz#1806857, rhbz#1924616
      rhbz#1978574, rhbz#1989457, rhbz#1965589, rhbz#1677608, rhbz#1926508
      rhbz#1810863, rhbz#1845468, rhbz#1738392, rhbz#1965140


author: Jiri Denemark <jdenemar@redhat.com> - 7.9.0-1
changelog:
  - Rebased to libvirt-7.9.0 (rhbz#2012802)
  - The rebase also fixes the following bugs:
      rhbz#2011731, rhbz#2012385, rhbz#2013539


author: Jiri Denemark <jdenemar@redhat.com> - 7.10.0-1
changelog:
  - Rebased to libvirt-7.10.0 (rhbz#2012802)
  - The rebase also fixes the following bugs:
      rhbz#1845468, rhbz#2017928, rhbz#2024419, rhbz#1953389, rhbz#1510237


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-2
changelog:
  - Revert "report error when virProcessGetStatInfo() is unable to parse data" (rhbz#2041610)
  - qemu: fix inactive snapshot revert (rhbz#2043584)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-3
changelog:
  - qemuDomainSetupDisk: Initialize 'targetPaths' (rhbz#2046172)
  - RHEL: Remove <glib-2.64.0 workaround for GSource race (rhbz#2045879)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-4
changelog:
  - qemu_command: Generate memory only after controllers (rhbz#2050697)
  - qemu: Validate domain definition even on migration (rhbz#2050702)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-5
changelog:
  - node_device: Rework udevKludgeStorageType() (rhbz#2056673)
  - node_device: Treat NVMe disks as regular disks (rhbz#2056673)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-6
changelog:
  - conf: Introduce memory allocation threads (rhbz#2067126)
  - qemu_capabilities: Detect memory-backend-*.prealloc-threads property (rhbz#2067126)
  - qemu_validate: Validate prealloc threads against qemuCpas (rhbz#2067126)
  - qemu_command: Generate prealloc-threads property (rhbz#2067126)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-7
changelog:
  - cpu_map: Disable cpu64-rhel* for host-model and baseline (rhbz#1851227)
  - cputest: Drop some old artificial baseline tests (rhbz#1851227)
  - cputest: Give better names to baseline tests (rhbz#1851227)
  - cputest: Add some real world baseline tests (rhbz#1851227)
  - cpu_x86: Consolidate signature match in x86DecodeUseCandidate (rhbz#1851227)
  - cpu_x86: Refactor feature list comparison in x86DecodeUseCandidate (rhbz#1851227)
  - cpu_x86: Penalize disabled features when computing CPU model (rhbz#1851227)
  - cpu_x86: Ignore enabled features for input models in x86DecodeUseCandidate (rhbz#1851227)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-8
changelog:
  - nwfilter: fix crash when counting number of network filters (CVE-2022-0897, rhbz#2063902)
  - virDomainDiskDefValidate: Improve error messages for 'startupPolicy' checks (rhbz#2095758)
  - domain_validate: Split out validation of disk startup policy (rhbz#2095758)
  - virDomainDiskDefValidateStartupPolicy: Validate disk type better (rhbz#2095758)
  - virDomainDiskTranslateSourcePool: Fix check of 'startupPolicy' definition (rhbz#2095758)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-9
changelog:
  - conf: virtiofs: add thread_pool element (rhbz#2079582)
  - qemu: virtiofs: format --thread-pool-size (rhbz#2079582)
  - conf: Move virDomainObj::originalMemlock into qemuDomainObjPrivate (rhbz#2089433)
  - qemu_domain: Format qemuDomainObjPrivate::originalMemlock (rhbz#2089433)
  - qemu: Add qemuDomainSetMaxMemLock helper (rhbz#2089433)
  - qemu_migration: Use qemuDomainSetMaxMemLock (rhbz#2089433)
  - qemu_migration: Restore original memory locking limit (rhbz#2089433)
  - Add VIR_MIGRATE_ZEROCOPY flag (rhbz#2089433)
  - virsh: Add support for VIR_MIGRATE_ZEROCOPY flag (rhbz#2089433)
  - qemu_migration: Implement VIR_MIGRATE_ZEROCOPY flag (rhbz#2089433)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-10
changelog:
  - security_selinux.c: Relabel existing mode="bind" UNIX sockets (rhbz#2101575)
  - RHEL: qemu_migration: Fix restoring memlock limit on destination (rhbz#2107954)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-11
changelog:
  - qemu_process: Don't require a hugetlbfs mount for memfd (rhbz#2123196)
  - qemu_namespace: Tolerate missing ACLs when creating a path in namespace (rhbz#2123196)
  - qemu_namespace: Fix a corner case in qemuDomainGetPreservedMounts() (rhbz#2123196)
  - qemu_namespace: Introduce qemuDomainNamespaceSetupPath() (rhbz#2123196)
  - qemu_process.c: Propagate hugetlbfs mounts on reconnect (rhbz#2123196)
  - qemuProcessReconnect: Don't build memory paths (rhbz#2123196)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-12
changelog:
  - util: json: Split out array->strinlist conversion from virJSONValueObjectGetStringArray (rhbz#2149752)
  - qemuAgentGetDisks: Don't use virJSONValueObjectGetStringArray for optional data (rhbz#2149752)
  - virpidfile: Add virPidFileReadPathIfLocked func (rhbz#2152188)
  - qemu: tpm: Get swtpm pid without binary validation (rhbz#2152188)
  - qemu_tpm: Do async IO when starting swtpm emulator (rhbz#2152188)
  - qemu: gpu: Get pid without binary validation (rhbz#2152188)
  - spec: libvirt-daemon: Add optional dependency on *-client (rhbz#2136591)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-13
changelog:
  - build: Only install libvirt-guests when building libvirtd (rhbz#2153688)
  - tools: Fix install_mode for some scripts (rhbz#2153688)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-0rc1.1
changelog:
  - Rebased to libvirt-8.0.0-rc1 (rhbz#2012802)
  - The rebase also fixes the following bugs:
      rhbz#1689202, rhbz#2014369, rhbz#2030119, rhbz#2029380, rhbz#2035237
      rhbz#2035714, rhbz#2034180


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-15
changelog:
  - nodedev: fix reported error msg in css cap XML parsing (rhbz#2165011)
  - util: refactor virDomainDeviceCCWAddress into virccw.h (rhbz#2165011)
  - util: refactor virDomainCCWAddressAsString into virccw (rhbz#2165011)
  - util: make reuse of ccw device address format constant (rhbz#2165011)
  - util: refactor ccw address constants into virccw (rhbz#2165011)
  - util: refactor virDomainCCWAddressIncrement into virccw (rhbz#2165011)
  - util: refactor virDomainDeviceCCWAddressIsValid into virccw (rhbz#2165011)
  - util: refactor virDomainDeviceCCWAddressEqual into virccw (rhbz#2165011)
  - conf: adjust method name virDomainDeviceCCWAddressParseXML (rhbz#2165011)
  - util: add ccw device address parsing into virccw (rhbz#2165011)
  - util: add virCCWDeviceAddressFromString to virccw (rhbz#2165011)
  - nodedev: refactor css format from ccw format method (rhbz#2165011)
  - nodedev: refactor ccw device address parsing from XML (rhbz#2165011)
  - nodedev: refactor css XML parsing from ccw XML parsing (rhbz#2165011)
  - schemas: refactor out nodedev ccw address schema (rhbz#2165011)
  - nodedev: add optional device address of channel device to css device (rhbz#2165011)
  - nodedev: add tests for optional device address to css device (rhbz#2165011)
  - nodedev: prevent internal error on dev_busid parse (rhbz#2165011)
  - rpc: Fix memory leak of fds (rhbz#2165428)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-19
changelog:
  - qemu: domain: Fix logic when tainting domain (rhbz#2174447)
  - qemu: agent: Make fetching of 'can-offline' member from 'guest-query-vcpus' optional (rhbz#2174447)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-20
changelog:
  - qemu: monitor: Drop old monitor fields from 'struct _qemuMonitorMessage' (rhbz#2170472)
  - qemu: Make 'struct _qemuMonitorMessage' private (rhbz#2170472)
  - qemu: monitor: Move declaration of struct _qemuMonitor to qemu_monitor_priv.h (rhbz#2170472)
  - qemu: qemuBlockGetNamedNodeData: Remove pointless error path (rhbz#2170472)
  - qemu: monitor: Store whether 'query-named-block-nodes' supports 'flat' parameter (rhbz#2170472)
  - qemuMonitorJSONBlockStatsUpdateCapacityBlockdev: Use 'flat' mode of query-named-block-nodes (rhbz#2170472)
  - qemu: relax shared memory check for vhostuser daemons (rhbz#2177701)
  - virpci: Resolve leak in virPCIVirtualFunctionList cleanup (CVE-2023-2700)
  - node_device_conf: Avoid memleak in virNodeDeviceGetPCIVPDDynamicCap() (CVE-2023-2700)


author: Fabiano Fidêncio <fidencio@redhat.com> 3.0.0-1
changelog:
  - Update to 3.0.0 release
  - Resolves: rhbz#1754396 - Provide support for getting "firmwares" info from Domain Capabilities
  - Resolves: rhbz#1753670 - Enable bochs-display for UEFI guests (libvirt-glib)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-2
changelog:
  - [RFE] RFE backport allow enabling ZEROCOPY live migration to libvirt-python on RHEL8 to be consumed by VDSM (rhbz#2092756)


author: David Tardon <dtardon@redhat.com> - 0.1.5-5
changelog:
  - fix char background color in some cases
  - fix handling of bitmaps in Windows Bitmap format that contain a color
    palette


author: Jarod Wilson <jarod@redhat.com> - 8.6.10-0.1
changelog:
  - Rebase to upstream v8.6.10 pre-release, use 0.x release number scheme
    as means to differentiate pre-release from release


author: Petr Pisar <ppisar@redhat.com> - 0.9.11-9
changelog:
  - Fix CVE-2018-15127 (Heap out-of-bounds write in
    rfbserver.c:rfbProcessFileTransferReadBuffer()) (bug #1662997)


author: Michael Catanzaro <mcatanzaro@redhat.com> - 0.9.11-16
changelog:
  - Fix CVE-2019-20839
    Resolves: #1851032
  - Fix CVE-2018-21247
    Resolves: #1852516
  - Fix CVE-2020-14405
    Resolves: #1860527
  - Fix CVE-2020-14397
    Resolves: #1861152


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.8-6
changelog:
  - Python 2 binary package renamed to python2-libvoikko
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Mike FABIAN <mfabian@redhat.com> - 4.1.1-1
changelog:
  - Rebase to 4.1.1 from Fedora 29 (provides only python3-libvoikko,
    removes python2-libvoikko)
  - Resolves: rhbz#1636062


author: Mike FABIAN <mfabian@redhat.com> - 4.1.1-2
changelog:
  - Fix man file names for Flatpak builds, exclude __pycache__ files from Flatpak builds
  - Resolves: rhbz#1896322


author: David King <amigadave@amigadave.com> - 1.3.5-1
changelog:
  - Update to 1.3.5 (#1197923)
  - Use license macro for COPYING
  - Tighten subpackage dependencies
  - Use make_install and make_build macros
  - Use pkgconfig for BuildRequires
  - Remove unnecessary Requires from devel subpackage
  - Remove obsolete Obsoletes


author: Wim Taymans <wtaymans@redhat.com> - 1.7.0-7
changelog:
  - Fix for CVE-2019-9232, CVE-2019-9433, CVE-2019-9371, CVE-2019-2126
  - Resolves: rhbz#1796086, rhbz#1796100, rhbz#1796448, rhbz#1796454
  - Remove php-cli BR


author: Kalev Lember <klember@redhat.com> - 1.14.91-1
changelog:
  - Update to 1.14.91
  - Add new libwayland-egl subpackage and obsolete mesa-libwayland-egl
  - Remove ldconfig scriptlets


author: Tomas Popela <tpopela@redhat.com> - 1.0.0-8
changelog:
  - Add fix for mzbz#1819244
  - Fix tools subpackage dependency
  - Bump the release to "8" to accommodate the 8.7.0.z release bumps


author: Tomas Popela <tpopela@redhat.com> - 1.0.0-9
changelog:
  - Bump the release to "9" to accommodate the 9.1.0.z release bumps as
    libwebp-1.0.0-8.el9 < libwebp-1.0.0-8.el8_7


author: Caolán McNamara <caolanm@redhat.com> - 0.2.9-1
changelog:
  - Resolves: rhbz#1602602 new version with covscan warnings fixed
  - all cve fixes merged to that new upstream


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.6.5-1
changelog:
  - Update to openwsman-2.6.5
  - Simplify python binding build and drop python2 subpackage
  - Fix malformed HTTP 200 status line


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.6.5-3
changelog:
  - Fix wrong SSL_CTX_set_cipher_list() retval check
  - Explicitly disable build of java bindings (build fails if java-devel is installed)


author: Björn Esser <besser82@fedoraproject.org> - 4.0.1-5
changelog:
  - Add patch to update to recent development branch
  - Re-enable SUNMD5 support as it is BSD licensed now
  - Build compatibility symbols for glibc only
  - Skip failing testsuite once


author: David King <dking@redhat.com> - 2.9.7-10
changelog:
  - Fix CVE-2021-3516 (#1956976)
  - Fix CVE-2021-3517 (#1957001)
  - Fix CVE-2021-3518 (#1957028)
  - Fix CVE-2021-3537 (#1957284)


author: Tomas Korbar <tkorbar@redhat.com> - 0.16.105-1
changelog:
  - Change specfile accordingly to mosvald's review
  - Remove obsolete ldconfig scriptlets
  - libyang-devel-doc changed to noarch package
  - Add python_provide macro to python3-libyang subpackage
  - Remove obsolete Requires from libyang-cpp-devel
  - Start using cmake with smp_mflags macro


author: Michal Ruprich <mruprich@redhat.com> - 0.16.105-4
changelog:
  - Resolves: #1780311 - CVE-2019-19333 libyang: stack-based buffer overflow in make_canonical when bits leaf type is used
  - Resolves: #1780313 - CVE-2019-19334 libyang: stack-based buffer overflow in make_canonical when identityref leaf type is used


author: Remi Collet <remi@remirepo.net> - 1.3.2-1
changelog:
  - update to 1.3.2
  - drop multilib header hack
  - change URL to https://libzip.org/
  - test suite now ok on all arch


author: Remi Collet <remi@remirepo.net> - 1.5.1-1
changelog:
  - update to 1.5.1
  - drop dependency on zlib-devel and bzip2-devel no more
    referenced in libzip.pc
  - drop rpath patch merged upstream


author: Remi Collet <rcollet@redhat.com> - 1.5.2-1
changelog:
  - update to 1.5.2
  - add all explicit cmake options to ensure openssl is used
    even in local build with other lilbraries available


author: Miroslav Lichvar <mlichvar@redhat.com> 2.0-3
changelog:
  - add support for active-backup team interface (#1685467)
  - add support for more accurate synchronization to phc2sys (#1677217)
  - add hwts_filter option to ptp4l (#1708554)
  - limit unicast message rate per address and grant duration (#1707395)
  - fix comparing of unicast addresses (#1707395)
  - fix building with new kernel headers (#1707395)
  - update testsuite (#1707395)
  - don't leak memory when allocation fails (#1707395)


author: Miroslav Lichvar <mlichvar@redhat.com> 2.0-5
changelog:
  - fix sample timestamps when synchronizing PHC to system clock (#1787376)
  - fix handling of zero-length messages (#1827275)


author: Miroslav Lichvar <mlichvar@redhat.com> 3.1.1-1
changelog:
  - update to 3.1.1 (#1895005 CVE-2021-3571)
  - add read-only UDS port (#1929797)
  - add option to set clockClass threshold (#1980386)
  - don't repeat some log messages in multi-port configuration (#1980377)
  - increase default TX timestamp timeout to 10 ms (#1977136)


author: Xin Long <lxin@redhat.com> - 1.0.18-3
changelog:
  - Added a patch to fix netinet/sctp.h not to be installed.
  - Added some fixes for kernel feature detection.


author: Aaron Conole <aconole@redhat.com> - 1.0.1-14.git036e314
changelog:
  - Update to branch-1.1 compatibility
  - Fixes to avoid assert in the agent state machine
  - Remove the memory constraint on the event socket buffer (#1554110)


author: Tulio Magno Quites Machado Filho <tuliom@redhat.com> - 16.0.6-2
changelog:
  - Improve error messages for unsupported relocs on s390x (rhbz#2216906)
  - Disable LLVM_UNREACHABLE_OPTIMIZE


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.4.0-21.20180522git70f7e08
changelog:
  - Fix printing CPU info on non-x86 architectures in sensors-detect
  - Resolves: rhbz#1752854
  - Fix printing lm_sensors version in sensors-detect and pwmconfig
  - Resolves: rhbz#1677414


author: Artem Egorenkov <aegorenk@redhat.com> - 3.4.0-23
changelog:
  - New flag for no sensors added. This flag is used in VM environment
    to make sensors binaries not fail if no sensors was detected.


author: Fedora Release Engineering <releng@fedoraproject.org> - 1.0.4-0.27.20111007git
changelog:
  - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
  - Explicitly include <sys/sysmacros.h> due to glibc-headers changes.
  Definition of major and minor macros is no longer transitively included
  through <sys/types.h>, hence make it explicit.
  Ref:
  https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=NEWS;hb=HEAD


author: Kamil Dudka <kdudka@redhat.com> - 3.14.0-3
changelog:
  - fix programming mistakes detected by Coverity Analysis
  - document the --version option in the logrotate(8) man page (#1611498)


author: Kamil Dudka <kdudka@redhat.com> - 3.14.0-4
changelog:
  - logrotate.8: encourage admins to use the `su` directive (#1759770)
  - do not abort globbing on broken symlink (#1723265)


author: Lianbo Jiang <lijiang@redhat.com> - B.02.18-22
changelog:
  - Display proper logical name of network device
  - Resolves: rhbz#1724087
  - Add DIMM running speed and Print dimm rank information
  - Resolves: rhbz#1725199


author: Jan Rybar <jrybar@redhat.com> - 4.93.2-1
changelog:
  - Rebase to lsof-4.93.2
  - Upstream moved to GitHub (original unreachable) and tarball structure changed
  - Manpage patch needed to reflect the tarball changes
  - Resolves: rhbz#1778228


author: Tomas Bzatek <tbzatek@redhat.com> - 0.32-1
changelog:
  - Upgrade to 0.32 upstream snapshot (#1855766)
  - Fix NVMe device parsing (#1687841, #1845977)
  - Fix WWN string reporting (#1846559)
  - Implement SCSI identifier sort priority (#1846566)


author: Omair Majid <omajid@redhat.com> - 2.8.1-9
changelog:
  - Build with standard distro-wide optimization flags even on s390 and s390x
  - Resolves: rhbz#1630591


author: Kamil Dudka <kdudka@redhat.com> - 2.8.9-0.17.dev16
changelog:
  - fix rpmlint warnings
  - do not depend on perl
  - update upstream project URL
  - update to the latest upstream pre-release


author: Kamil Dudka <kdudka@redhat.com> - 2.8.9-0.23.dev19
changelog:
  - do not require 'rsh' installed at build time (#1581747)
  - update to the latest upstream pre-release


author: Robert Scheck <robert@fedoraproject.org> - 1.03-13
changelog:
  - Added patch by Khem Raj to use static inlines as the external
    inline definition has changed with GCC 5 (to fix ppc64 builds)


author: Patsy Griffin Franklin <pfrankli@redhat.com> 1:4.2.1-7
changelog:
  - Fix build failure caused by automake versioning differences related
    to the glob changes. (#1589769)
  - Fix testing failure due to Perl changes related to expanding paths.


author: Nikola Forró <nforro@redhat.com> - 2.7.6.1-18
changelog:
  - schedule interrupted cache update for the next boot, instead of blocking
    system reboot/shutdown
    resolves #1874010


author: Honza Horak <hhorak@redhat.com> - 3:10.3.8-3
changelog:
  - Move config files mysql-clients.cnf and enable_encryption.preset to correct
    sub-packages, similar to what upstream does


author: Michal Schorm <mschorm@redhat.com> - 3:10.3.8-6
changelog:
  - Use openssl-devel instead of pkgconfig(openssl)
  - Enable conflicts against mysql (instead of community-mysql)
    Related: #1581034


author: Michal Schorm <mschorm@redhat.com> - 3:10.3.9-1
changelog:
  - Rebase to 10.3.9
  - Add workaround for short SSL certificates
  - Fix parallel installability for x86_64 and i686 devel packages
  - CVEs fixed: #1603531
    CVE-2018-3058 CVE-2018-3063 CVE-2018-3064 CVE-2018-3066


author: Michal Schorm <mschorm@redhat.com> - 3:10.3.10-3
changelog:
  - Fix "-fstack-protector-strong" static analysis errors
    Resolves: #1624139
  - Add wsrep_sst_rsync_tunnel script, add README
    Resolves: #1650463
  - Fix few covscan issues
    Resolves: #1649707
  - Fix galera_new_cluster script
    Resolves: #1641663


author: Michal Schorm <mschorm@redhat.com> - 3:10.3.11-1
changelog:
  - Rebase to 10.3.11
  - Remove README.mysql-cnf as we don't ship example configuration files anymore
    Resolves: #1653318
  - CVEs fixed:
    CVE-2018-3282, CVE-2016-9843, CVE-2018-3174, CVE-2018-3143, CVE-2018-3156
    CVE-2018-3251, CVE-2018-3185, CVE-2018-3277, CVE-2018-3162, CVE-2018-3173
    CVE-2018-3200, CVE-2018-3284


author: Michal Schorm <mschorm@redhat.com> - 3:10.3.17-1
changelog:
  - Rebase to 10.3.17
    Resolves: #1711265
    Resolves: #1701687
  - Add patch for server pkgconfig file location
  - Use logrotatedir macro on one more spot
  - Fix building of TokuDB with Jemalloc 5
  - Fix building with / without lz4
  - Fix "ggsapi" -> "gssapi" typo but keep the broken behaviour
  - Control building of the CACHING_SHA2_PASSWORD plugin
  - Fix the license tag
    Resolves: #1702707


author: Michal Schorm <mschorm@redhat.com> - 3:10.3.23-1
changelog:
  - Rebase to 10.3.23
  - Make conflicts between corresponding mariadb and mysql packages explicit
  - Get rid of the Conflicts macro, it was intended to mark conflicts with
    *upstream* packages
    Resolves: #1853159


author: Michal Schorm <mschorm@redhat.com> - 3:10.3.27-1
changelog:
  - Rebase to 10.3.27
  - mariadb-debug_build.patch is no more needed, upstream did the changes:
    https://github.com/MariaDB/server/commit/31eaa2029f3c2a4f8e5609ce8b87682286238d9a#diff-32766783af7cac683980224d63c59929
    https://github.com/MariaDB/server/commit/23c6fb3e6231b8939331e2d9f157092f24ed8f4f#diff-78f3162f137407db5240950beb2bcd7c


author: Michal Schorm <mschorm@redhat.com> - 3:10.3.27-2
changelog:
  - Disable building of the ed25519 client plugin.
    From now on it will be shipped by 'mariadb-connector-c' package


author: Michal Schorm <mschorm@redhat.com> - 3:10.3.27-3
changelog:
  - Remove mariadb_rpl.h from includedir
    This file is shipped in mariadb-connector-c package
  - Require matching version of mariadb-connector-c package


author: Michal Schorm <mschorm@redhat.com> - 3.0.8-2
changelog:
  - Add "zlib-devel" requirement in "-devel" subpackage. MariaDB requires
    linking with "-lz", which will fail without the zlib library
  - Resolves: #1710471


author: Michal Schorm <mschorm@redhat.com> - 3.0.10-1
changelog:
  - Rebase to 3.0.10
  - Use macro for tarball name
  - Use macro to set build flags
  - Use macros for make commands
  - Remove the scriptlets non relevant for RHEL-8
  - Add info for the testsuite execution
  - Remove glob from library version
  - Remove info about the upstream issues


author: Michal Schorm <mschorm@redhat.com> - 3.1.2-1
changelog:
  - Rebase to 3.1.2
  - Introducing ED25519 plugin
  - Plugindir issues (from 3.0.9 release) fixed by upstream
    Resolves: #1691176


author: Lukas Javorsky <ljavorsk@redhat.com> - 3.1.9-1
changelog:
  - Rebase to 3.1.9
  - Overlinking issues fixed by upstream in 3.1.3 release
  - Add explicit confict between mariadb-connector-c-devel and mysql-devel packages


author: Lukas Javorsky <ljavorsk@redhat.com> - 3.1.11-1
changelog:
  - Rebase to 3.1.11
  - Add updates for paths in libraries_include_path.patch
  - Patch add_docs_license_dir_option upstreamed


author: Parag Nemade <pnemade AT redhat DOT com> - 0.2.4-27
changelog:
  - Correct the conditional builds for fedora and rhel
  - Remove Group tag as its no longer needed
  - added %license macro for license files
  - Correct the license tag
  - Added fileslists more verbose for subpackages


author: Parag Nemade <pnemade AT redhat DOT com> - 0.2.4-38
changelog:
  - Resolves:rh#2180735 - move marisa-devel in rhel8 CRB repository
    also fix missing gating test execution


author: Tomasz Kłoczko <kloczek@fedoraproject.org> - 1:4.8.19-1
changelog:
  - updated to 4.8.19
  - drop use slang and use ncurses. There are only few packages which are using
    slang. As ncurses support is fully working now it makes more sense to
    use it instead slang (Solaris 11.3 mc uses now ncurses)
  - instead passing -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE to CFLAGS use
    --enable-largefile autoconf param
  - removed Group, BuildRoot and %clear (new packaging policy)
  - added pkgconfig to BuildRequires
  - replaced groff by groff-base in BuildRequires (only nfroff is used)
  - use %autosetup in %prep
  - added using %{make_build} and %{make_build} macros
  - "rm -rf $RPM_BUILD_ROOT" on beginning %install is no longer needed
  - mcfs is no longer supported (removed --enable-vfs-mcfs autoconf option)
  - added explicit enabled other VFSesess to force necessary checks


author: Tomasz Kłoczko <kloczek@fedoraproject.org> - 1:4.8.19-2
changelog:
  - go back to slang as it is serious issue with shift-f6 when ncurses is used
    displaying "Delete" instead "Move As" dialog (#1436394)
  - added slang %bcond to simplify experiments with switching to ncurses
  - reformat %description to 80 cols
  - really remove Group
  - %defattr() is no longer needed
  - simplifications in %files
  - use %{buildroot} macro
  - build --with-x (it does not add X11 libraries dependencies)
  - cons.saver no longer need to be 711 (changed to 755)


author: Prarit Bhargava <prarit@redhat.com> - 3:160-1
changelog:
  - Deduce channel number for Haswell/Broadwell/Skylake systems [1641046]
  - Add decoding for Optane DC persistent memory mode [1645344]


author: Prarit Bhargava <prarit@redhat.com> - 3:173-0
changelog:
  - Update to v173
  - adds support for Tigerlake, Rocketlake, Alderlake, Lakefield
  - adds support for CometLake, Icelake server, Icelake-D, and Snow Ridge


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-2
changelog:
  - Revert "mcstransd select correct colour range." (#1731451)
  - Fix mcstrans secolor examples (#1731451)


author: Xiao Ni <xni@redhat.com> - 4.1.12
changelog:
  - Update mdadm to latest upstream && change tmpfiles directory && correct changelog date
  - Resolves rhbz#1800521 and rhbz#1657265


author: Xiao Ni <xni@redhat.com> - 4.2-6
changelog:
  - Keep udev rule close to upstream and update to latest upstream
  - Resolves rhbz#1991596, rhbz#2129088, rhbz#2107150


author: Xiao Ni <xni@redhat.com> - 4.2-7
changelog:
  - Update to latest to upstream to fix some bugs
  - Resolves rhbz#2149307, rhbz#2149473, rhbz#2151208, rhbz#2127096


author: Xiao Ni <xni@redhat.com> - 4.2-9
changelog:
  - Update to latest upstream and fix mdcheck service bug
  - Resolves rhbz#2116418, rhbz#2150862, rhbz#2159584


author: Alex Williamson <alex.williamson@redhat.com> - 0.57-1
changelog:
  - 13f1322e576c ("Remove systemd support")
  - d84a2737e79c ("Fix device udev tagging")
  - 68c92c7beaca ("Tag before generating spec file")
  - c34c4f1ade60 ("Update mdevctl.spec.in for lsmdev.8")
  - ed86d345aae0 ("Fix systemd UUID escaping")
  - d4e83f08161d ("Merge pull request #13 from cpaelzer/fix-lsmdev-man-page")
  - 3c0d285b75ab ("lsmdev - add the alternative name to the man page")


author: Alex Williamson <alex.williamson@redhat.com> - 0.61-1
changelog:
  - d7dfac5f5bfb ("Merge pull request #15 from cohuck/attr_sanity")
  - 28a9fa17b51e ("validate attribute names")


author: Eduardo Lima (Etrunko) <etrunko@redhat.com> - 1.1.0-2
changelog:
  - Create additonal directories required by installation.
  - Fix sporadic callout test failures
    Related: rhbz#1999687


author: Rafael Aquini <aquini@redhat.com> - 1.10.0-1
changelog:
  - Update to memkind source file to 1.10.0 upstream (1780394)
  - add Tier1 tests for CI gating (1688933)


author: Sebastian Kisela <skisela@redhat.com> - 4.6.2-1
changelog:
  - New release 4.6.2.
  - Convert deprecated specfile python macros to use python2 macros.
  - Explicitly depend on gcc, as it was removed from buildroot default packages.


author: Ales Matej <amatej@redhat.com> - 3.4.0-1
changelog:
  - Update to 3.4.0
  - Fix: do not download metadata in remove command
  - Add reinstall command
  - Add "--setopt=tsflags=test" support
  - Add "--setopt=reposdir=<path>" and "--setopt=varsdir=<path1>,<path2>,..." support
  - Add "--config=<path_to_config_file>" support
  - Add "--disableplugin", "--enableplugin" support (RhBug:1781126)
  - Add "--noplugins" support
  - Add "--setopt=cachedir=<path_to_cache_directory>" support
  - Add "--installroot=<path_to_installroot_directory>" support
  - Add "--refresh" support
  - Support "install_weak_deps" conf option and "--setopt=install_weak_deps=0/1"
  - Respect reposdir from conf file
  - Respect "metadata_expire" conf file opton (RhBug:1771147)
  - [repolist] Print padding spaces only if output is terminal


author: Nicola Sella <nsella@redhat.com> - 3.4.0-3
changelog:
  - Patch: Add support for setting a platform module ID
  - Rename "update" command to "upgrade", "update" remain as compatibility alias


author: Pavla Kratochvilova <pkratoch@redhat.com> - 3.8.0-1
changelog:
  - Update to 3.8.0
  - Don't set default value of "assumeyes" to TRUE
  - Support for user confirmation and assumeyes, assumeno, defaultyes
  - Add commands: distro-sync, makecache
  - Add subcommands support
  - Add support for command aliases
  - Added alias "update" to "upgrade" command
  - Relicense to GPLv2+
  - Add support for setting allow_vendor_change
  - [download] Support for "--resolve", "--alldeps" and "--archlist=" arguments
  - [download] several optimizations
  - Support "--setopt=keepcache=0/1"
  - Extend "--setopt" to support repository options


author: Uri Lublin <uril@redhat.com> - 2.30-2
changelog:
  - Remove PROVIDE() qualifiers from definition of __CTOR_LIST__ and __DTOR_LIST__
    Resolves: rhbz#1846152


author: Eduardo Lima (Etrunko) <etrunko@redhat.com> - 1.14.1-2
changelog:
  - ExclusiveArch: i686, x86_64
    Related: rhbz#1615874
  - BuildRequires: python3-devel
    Related: rhbz#1615874


author: Erik van Pienbroek <epienbro@fedoraproject.org> - 1.0.2h-1
changelog:
  - Synced with native openssl-1.0.2h-1
  - Fixes RHBZ #1332591 #1332589 #1330104 #1312861 #1312857 #1307773 #1302768


author: Christophe Fergeau <cfergeau@redhat.com> - 1.0.2k-1
changelog:
  - Sync with rhel 7.6 OpenSSL 1.0.2k+patches in order to get the latest security
    fixes
  - Related: rhbz#1615874


author: Erik van Pienbroek <epienbro@fedoraproject.org> - 8.38-1
changelog:
  - Update to 8.38
  - Fixes various CVE's:
    RHBZ #1236660, #1249905, #1250947, #1256453, #1256454, #1287616,
    RHBZ #1287619, #1287626, #1287628, #1287631, #1287634, #1287640,
    RHBZ #1287642, #1287648, #1287650, #1287656, #1287658, #1287661,
    RHBZ #1287663, #1287668, #1287670, #1287673, #1287675, #1287692,
    RHBZ #1287694, #1287698, #1287700, #1287704, #1287706, #1287720,
    RHBZ #1287722


author: Uri Lublin <uril@redhat.com> - 3.26.0.0-1
changelog:
  - Rebase to sqlite 3.26.0
  - Fix CVE-2019-8457  CVE-2019-13752 CVE-2019-13753 CVE-2019-13734
  - Fix CVE-2019-19924 CVE-2019-19923 CVE-2019-19925 CVE-2019-19959
  - Fix CVE-2019-20218 CVE-2020-6405  CVE-2020-9327  CVE-2019-5018
  - Fix CVE-2019-16168
    Resolves: rhbz#1826898
  - Fix CVE-2020-13632
    Resolves: rhbz#1845615
  - Fix CVE-2020-13631
    Resolves: rhbz#1845475
  - Fix CVE-2020-13630
    Resolves: rhbz#1845212
  - Fix CVE-2020-13434
    Resolves: rhbz#1845851
  - Fix CVE-2020-15358


author: Michal Hlavinka <mhlavink@redhat.com> 56-1
changelog:
  - Upgrade to 56 (#1479800)
  - fixes wait exit codes of co-processes when run in interactive mode (#1479320)


author: Michal Sekletar <msekleta@redhat.com> - 0.26-14
changelog:
  - start timer after the installation (#1278587)
  - make mlocate-updatedb.service of the type simple, systemd will then not wait for its completion (#1282232)


author: Francisco Trivino <ftrivino@redhat.com> 1.6.1-9
changelog:
  - Add missing repos to the osci tests
  - Fix gss localname test to work with older gssapi version
  - Resolves: #2083122
  - Add ability to expose the used mechanism
  - Resolves: #2046231


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-4
changelog:
  - Resolves: rhbz#1702695 - fresh install of mod_auth_mellon shows rpm
                             verification warnings


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-5
changelog:
  - Resolves: rhbz#1692457 - CVE-2019-3878 mod_auth_mellon: authentication
                             bypass in ECP flow [rhel-8.1.0]


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-6
changelog:
  - Resolves: rhbz#1692471 - CVE-2019-3877 appstream/mod_auth_mellon: open
                             redirect in logout url when using URLs with
                             backslashes [rhel-8]


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-7
changelog:
  - Apply the patch from the previous commit
  - Resolves: rhbz#1692471 - CVE-2019-3877 appstream/mod_auth_mellon: open
                             redirect in logout url when using URLs with
                             backslashes [rhel-8]


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-9
changelog:
  - Just bump the release number
  - Related: rhbz#1718238 - mod_auth_mellon-diagnostics RPM not in product
                            listings


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-10
changelog:
  - Resolves: rhbz#1761774 - mod_auth_mellon fix for AJAX header name
                             X-Requested-With


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-11
changelog:
  - Resolves: rhbz#1731053 - CVE-2019-13038 mod_auth_mellon: an Open Redirect
                             via the login?ReturnTo= substring which could
                             facilitate information theft [rhel-8]


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-12
changelog:
  - Resolves: rhbz#1791262 - Backport SameSite=None cookie from upstream to
                             support latest browsers


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-12.1
changelog:
  - Resolves: rhbz#1986805 - CVE-2021-3639 mod_auth_mellon: Open Redirect
                             vulnerability in logout URLs [rhel-8]


author: <jdennis@redhat.com> - 2.3.7-3
changelog:
  - Resolves: rhbz# 1614977 - fix unit test segfault,
    the problem was not limited exclusively to s390x, but s390x provoked it.


author: Jakub Hrozek <jhrozek@redhat.com> - 2.3.7-5
changelog:
  - Resolves: rhbz#1805749 - CVE-2019-14857 mod_auth_openidc:2.3/mod_auth_openidc:
                             Open redirect in logout url when using URLs with
                             leading slashes
  - Resolves: rhbz#1805068 - CVE-2019-20479 mod_auth_openidc:2.3/mod_auth_openidc:
                             open redirect issue exists in URLs with slash and
                             backslash


author: Jakub Hrozek <jhrozek@redhat.com> - 2.3.7-6
changelog:
  - Fix the previous backport
  - Related: rhbz#1805749 - CVE-2019-14857 mod_auth_openidc:2.3/mod_auth_openidc:
                            Open redirect in logout url when using URLs with
                            leading slashes
  - Related: rhbz#1805068 - CVE-2019-20479 mod_auth_openidc:2.3/mod_auth_openidc:
                            open redirect issue exists in URLs with slash and
                            backslash


author: Jakub Hrozek <jhrozek@redhat.com> - 2.3.7-7
changelog:
  - Resolves: rhbz#1897992 - OIDCStateInputHeaders &
                             OIDCStateMaxNumberOfCookies in existing
                             mod_auth_openidc version
  - Backport the OIDCStateMaxNumberOfCookies option
  - Configure which header value is used to calculate the fingerprint of
    the auth state


author: Jakub Hrozek <jhrozek@redhat.com> - 2.3.7-8
changelog:
  - Resolves: rhbz#1823756 - Backport SameSite=None cookie from
                             mod_auth_openidc upstream to support latest browsers


author: Tomas Halman <thalman@redhat.com> - 2.3.7-9
changelog:
  - Resolves: rhbz#2001853 - CVE-2021-39191 open redirect by supplying a crafted URL
                             in the target_link_uri parameter


author: Tomas Halman <thalman@redhat.com> - 2.3.7-10
changelog:
  - Resolves: rhbz#1987216 - CVE-2021-32791 hardcoded static IV and AAD with a
                             reused key in AES GCM encryption [rhel-8] (edit)


author: Tomas Halman <thalman@redhat.com> - 2.4.9.4-2
changelog:
  - Resolves: rhbz#2153659 - CVE-2022-23527 - Open Redirect in
        oidc_validate_redirect_url() using tab character


author: Tomas Halman <thalman@redhat.com> - 2.4.9.4-3
changelog:
  - Resolves: rhbz#2184144 - CVE-2023-28625 NULL pointer dereference
        when OIDCStripCookies is set and a crafted Cookie header is supplied


author: Jan Pazdziora <jpazdziora@redhat.com> - 1.1.0-1
changelog:
  - Logging improvements; success logging moved from notice to info level.
  - Fix redirect for AuthPAMExpiredRedirect with Basic Auth.
  - Fix AuthPAMExpiredRedirect %s escaping on Apache 2.2.


author: Joe Orton <jorton@redhat.com> - 1.10.0-6
changelog:
  - really disable Berkeley DB support if required by bcond
  - add build conditional to disable swig binding subpackages


author: Lubos Uhliarik <luhliari@redhat.com> - 1.10.2-2
changelog:
  - Resolves: #1733443 - CVE-2019-0203 subversion:1.10/subversion: remote
    unauthenticated denial-of-service in subversion svnserve


author: Joe Orton <jorton@redhat.com> - 1.14.0~rc2-2
changelog:
  - switch subpackages to lock-step requires on -libs rather than subversion
  - fixed the build-requires (Jitka Plesnikova)


author: Lubos Uhliarik <luhliari@redhat.com> - 2.3.9-17
changelog:
  - Resolves: #1876525 - mod_fcgid does not pass more than 64 variables to an FCGI
    server process environment


author: Lubos Uhliarik <luhliari@redhat.com> - 1.11.3-1
changelog:
  - new version 1.11.3
  - Resolves: #1633401 - CVE-2018-11763 mod_http2: httpd:  DoS for HTTP/2
    connections by continuous SETTINGS


author: Lubos Uhliarik <luhliari@redhat.com> - 1.15.7-1
changelog:
  - new version 1.15.7
  - Resolves: #1814236 - RFE: mod_http2 rebase 
  - Resolves: #1747289 - CVE-2019-10082 httpd:2.4/mod_http2: httpd: 
    read-after-free in h2 connection shutdown
  - Resolves: #1696099 - CVE-2019-0197 httpd:2.4/mod_http2: httpd: 
    mod_http2: possible crash on late upgrade
  - Resolves: #1696094 - CVE-2019-0196 httpd:2.4/mod_http2: httpd:
    mod_http2: read-after-free on a string compare
  - Resolves: #1677591 - CVE-2018-17189 httpd:2.4/mod_http2: httpd: 
    mod_http2: DoS via slow, unneeded request bodies


author: Lubos Uhliarik <luhliari@redhat.com> - 1.15.7-2
changelog:
  - Resolves: #1869073 - CVE-2020-9490 httpd:2.4/mod_http2: httpd: 
    Push diary crash on specifically crafted HTTP/2 header


author: Luboš Uhliarik <luhliari@redhat.com> - 1.15.7-4
changelog:
  - Resolves: #1966728 - CVE-2021-33193 httpd:2.4/mod_http2: httpd:
    Request splitting via HTTP/2 method injection and mod_proxy


author: Jan Pazdziora <jpazdziora@redhat.com> - 0.9.7-1
changelog:
  - 1347490 - Rebase to upstream version 0.9.7.
  - Ensure lookup_user_by_certificate runs after mod_nss as well.


author: Jan Pazdziora <jpazdziora@redhat.com> - 0.9.9-1
changelog:
  - 1434814 - Rebase to upstream version 0.9.9.
  - Add support for multiple users mapped to single certificate.


author: Jan Pazdziora <jpazdziora@redhat.com> - 1.0.0-1
changelog:
  - 1439711 - Rebase to upstream version 1.0.0.
  - Make LookupUserGECOS optional (no default) to support non-POSIX
    user identities.


author: Lubos Uhliarik <luhliari@redhat.com> - 1:2.0.8-8
changelog:
  - Resolves: #1832844 - mod_md does not work with ACME server that does not
    provide keyChange or revokeCert resources


author: Lubos Uhliarik <luhliari@redhat.com> - 2.9.2-9
changelog:
  - Resolves: #1824859 - RFE: Add a feature that can set a mod_security/libcurl
    timeout for retrieving the rules


author: Lubos Uhliarik <luhliari@redhat.com> - 4.6.4-4
changelog:
  - Resolves: #1779705 - python3-mod_wsgi: Remove the Provides and Obsoletes for
    the name `mod_wsgi`


author: Javier Martinez Canillas <javierm@redhat.com> - 0.3.0-10
changelog:
  - Add mokutil code to consume data from /sys/firmware/efi/mok-variables/
    as well as attempting to consume numbered mok variables from efivarfs
    when mok-variables aren't present (pjones)
    Resolves: rhbz#1907418


author: José Expósito <jexposit@redhat.com> - 2.3.4-20
changelog:
  - Fix CVE-2023-43788: out of bounds read in XpmCreateXpmImageFromBuffer()
  - Fix CVE-2023-43789: out of bounds read on XPM with corrupted colormap


author: Charalampos Stratakis <cstratak@redhat.com> - 2.5.1-1
changelog:
  - Import into RHEL
  - Fedora contributions by:
        Charalampos Stratakis <cstratak@redhat.com>
        Igor Gnatenko <ignatenkobrain@fedoraproject.org>
        Jan Vcelak <jvcelak@fedoraproject.org>
        Jaroslav Škarvada <jskarvad@redhat.com>
        Jeff Law <law@redhat.com>
        Lukas Zachar <lzachar@redhat.com>
        Miro Hrončok <miro@hroncok.cz>
        Tom Stellard <tstellar@redhat.com>


author: Miro Hrončok <mhroncok@redhat.com> - 2.5.1-3
changelog:
  - Split libmpdec++ into a mpdecimal++ subpackage
  - This prevents packages only using the libmpdec library from transitively depending on libstdc++


author: James Paul Turner <jamesturner246@fedoraproject.org> - 3.1.6-1
changelog:
  - Update to MPFR version 3.1.6
  - Use autosetup specfile macro for applying patches (patches 1 and 2 applied)
  - Removed iconv calls, as they were breaking .info files, which are now unicode
    resolves #1299649
  - Other minor cleanups
  - BuildRequire gcc per https://fedoraproject.org/wiki/Packaging:C_and_C%2B%2B#BuildRequires_and_Requires


author: Wim Taymans <wtaymans@redhat.com> - 1.23.8-3
changelog:
  - Remove pointless Enhances:
  - Fix splelling mistake
  - change package name from libs-devel to devel and add Obsolete:
  - see rhbz#1394147


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.2.1-2
changelog:
  - Update $modincdir in mpifort after moving .mod files (#1301533)
  - Move compiler wrappers to mpich-devel (#1353621)
  - Remove bogus rpath (#1361586)


author: Jarod Wilson <jarod@redhat.com> - 3.2.1-8
changelog:
  - Remove python2 bits entirely, fix mpi lib dependencies
  - Remove obsolete Provides/Obsoletes for mpich2
  - Resolves: rhbz#1628628


author: Honggang Li <honli@redhat.com> - 3.3.2-8
changelog:
  - Sync with Fedora build
  - Update to latest upstream release 3.3.2
  - Resolves: rhbz#1657316, rhbz#1732982, rhbz#1850080


author: Honggang Li <honli@redhat.com> - 5.6.2-1
changelog:
  - Update OSU benchmarks to upstream release 5.6.2
  - Update IMB benchmarks to upstream release v2019.6
  - Resolves: rhbz#1817837


author: Honggang Li <honli@redhat.com> - 5.7-2
changelog:
  - Update OSU benchmarks to upstream release 5.7.1
  - Update Intel MPI Benchmarks 2021.2
  - Resolves: rhbz#1960078


author: Honggang Li <honli@redhat.com> - 5.8-1
changelog:
  - Update OSU benchmarks to upstream release 5.8
  - Update Intel MPI Benchmarks 2021.3
  - Resolves: rhbz#2008517


author: Honggang Li <honli@redhat.com> - 4.10.0.2
changelog:
  - Rebase to latest upstream release v4.10.0-2
  - Fix license issue of mtcr_ul.c
  - Resolves: bz1541741


author: Pavel Cahyna <pcahyna@redhat.com> - 4.0.18-15
changelog:
  - Add dependency on glibc-gconv-extra
    mtools need codepage 850, which was split from glibc into a subpackage.
    (Fedora bug #2021637, RHEL bug #2073842)


author: Jonas Ådahl <jadahl@redhat.com> - 3.32.2-52
changelog:
  - Support polyinstantiation
    Resolves: #1861769
  - Mitigate nouveau misidentifying connectors
    Resolves: #1786496


author: Jan Grulich <jgrulich@redhat.com> - 3.32.2-72
changelog:
  - Do not use DMA buffers for screencast when the client doesn't support it
  - Use DMA buffers only for i195 drivers
    Resolves: RHEL-4405


author: Jarod Wilson <jarod@redhat.com> 2.3-1
changelog:
  - Update to upstream v2.3 release
  - Initial build for RHEL-8, featuring v2.3 only
  - Resolves: #1483744


author: Jarod Wilson <jarod@redhat.com> 2.3-4
changelog:
  - Clean up build/linker commands to better propagate distro-wide flags
  - Explicitly disable ftb, blcr and fuse to prevent rpath flag creep
  - Related: rhbz#1624147


author: Jarod Wilson <jarod@redhat.com> 2.3-5
changelog:
  - Add missing Provides: mpi and Requires: environment-modules to base mvapich2 package
  - Resolves: rhbz#1647177


author: Honggang Li <honli@redhat.com> - 2.3.3-1
changelog:
  - Update to upstream stable point release v2.3.3
  - Fix floating point exception for non-NUMA machine
  - Resolves: rhbz#1815962, rhbz#1814296


author: Honggang Li <honli@redhat.com> - 2.3.4-1
changelog:
  - Update to upstream stable point release v2.3.4
  - Build against hwloc-2.2.0
  - Resolves: rhbz#1850084


author: Michal Schorm <mschorm@redhat.com> - 8.0.12-6
changelog:
  - Fix the default configuration of the server, so it uses same authentication
    method as MySQL 5.7
    Resolves: #1631400


author: Michal Schorm <mschorm@redhat.com> - 8.0.13-1
changelog:
  - Rebase to 8.0.13
  - ICU patch removed; upstreamed
  - Patch for MySQL Router introduced. Do not build it.
  - Fixes for annocheck hardening
    Resolves: #1624148
  - CVEs fixed:
    CVE-2018-3276 CVE-2018-3200 CVE-2018-3137 CVE-2018-3284 CVE-2018-3195
    CVE-2018-3173 CVE-2018-3212 CVE-2018-3279 CVE-2018-3162 CVE-2018-3247
    CVE-2018-3156 CVE-2018-3161 CVE-2018-3278 CVE-2018-3174 CVE-2018-3282
    CVE-2018-3285 CVE-2018-3187 CVE-2018-3277 CVE-2018-3144 CVE-2018-3145
    CVE-2018-3170 CVE-2018-3186 CVE-2018-3182 CVE-2018-3133 CVE-2018-3143
    CVE-2018-3283 CVE-2018-3171 CVE-2018-3251 CVE-2018-3286 CVE-2018-3185
    CVE-2018-3280 CVE-2018-3203 CVE-2018-3155


author: Matej Mužila <mmuzila@redhat.com> - 8.0.17-1
changelog:
  - Rebase to 8.0.17
  - Resolves: #1732043
  - CVEs fixed:
    CVE-2019-2737 CVE-2019-2738 CVE-2019-2739 CVE-2019-2740 CVE-2019-2741
    CVE-2019-2743 CVE-2019-2746 CVE-2019-2747 CVE-2019-2752 CVE-2019-2755
    CVE-2019-2757 CVE-2019-2758 CVE-2019-2774 CVE-2019-2778 CVE-2019-2780
    CVE-2019-2784 CVE-2019-2785 CVE-2019-2789 CVE-2019-2791 CVE-2019-2795
    CVE-2019-2796 CVE-2019-2797 CVE-2019-2798 CVE-2019-2800 CVE-2019-2801
    CVE-2019-2802 CVE-2019-2803 CVE-2019-2805 CVE-2019-2808 CVE-2019-2810
    CVE-2019-2811 CVE-2019-2812 CVE-2019-2814 CVE-2019-2815 CVE-2019-2819
    CVE-2019-2822 CVE-2019-2826 CVE-2019-2830 CVE-2019-2834 CVE-2019-2879


author: Lukas Javorsky <ljavorsk@redhat.com> - 8.0.21-1
changelog:
  - Rebase to 8.0.21
  - Use bundled libzstd and libevent for RHSCL and RHEL-8.0.0
  - Check that we have correct versions in bundled(*) Provides
  - Remove re2 bundled dependency


author: Lukas Javorsky <ljavorsk@redhat.com> - 8.0.22-1
changelog:
  - Update to MySQL 8.0.22
  - mysql-certs-expired.patch patched by upstream
  - New zlib_decompress binary file in test package


author: Lars Tangvald <lars.tangvald@oracle.com> - 8.0.23-1
changelog:
  - Update to MySQL 8.0.23
  - Created mysql-fix-includes-robin-hood.patch
  - Created mysql-main-cast.patch


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 2.13.01-3
changelog:
  - Fix use-after-free and heap buffer overflow vulnerabilities
  - Resolves: CVE-2017-10686, CVE-2017-11111


author: Michael Simacek <msimacek@redhat.com> - 2.13.02-1
changelog:
  - Update to upstream version 2.13.02
  - Resolves: CVE-2017-17810, CVE-2017-17811, CVE-2017-17812, CVE-2017-17813,
    CVE-2017-17814, CVE-2017-17815, CVE-2017-17816, CVE-2017-17817,
    CVE-2017-17818, CVE-2017-17819, CVE-2017-17820


author: Carlos Soriano <csoriano@redhat.com> - 3.28.1-7
changelog:
  - Disable extension doc generation, since generated files differ and
    rpmlint fails when checking that both architectures of the -devel
    library generate the same files.
    It's an issue in docbook, used by gtk-doc, and althought fixed upstream
    they didn't have a new release yet.
    https://github.com/docbook/xslt10-stylesheets/issues/54
    Resolves: RHBZ#1667136


author: Ondrej Holy <oholy@redhat.com> - 3.28.1-9
changelog:
  - Fix criticals when connecting to remote locations (rhbz#1643175)
  - Remove geometry option from man page (rhbz#1612852)


author: Ondrej Holy <oholy@redhat.com> - 3.28.1-10
changelog:
  - Add screenshots for GNOME Software in Appdata file (rhbz#1725107)
  - Add website link to About dialog (rhbz#1725101)
  - Use Files instead of Nautilus in Appdata file (rhbz#1725120)
  - Add nautilus-autorun-software man page (rhbz#1725766)


author: Ondrej Holy <oholy@redhat.com> - 3.28.1-11
changelog:
  - Fix criticals when moving file to trash (rhbz#1721133)
  - Fix criticals when closing properties window (rhbz#1721124)


author: Ondrej Holy <oholy@redhat.com> - 3.28.1-13
changelog:
  - Clear selection if any files don't match the pattern (rhbz#1207179)
  - Fix endless content size calculations (rhbz#1566027)
  - Honor umask when creating new files (rhbz#1778579)
  - Close "There is no application..." dialog after response (rhbz#1816070)


author: Richard W.M. Jones <rjones@redhat.com> - 1.4.0-1
changelog:
  - New upstream version 1.4.0.
  - New plugins: random, zero.
  - New bash tab completion subpackage.
  - Remove unused build dependencies.


author: Richard W.M. Jones <rjones@redhat.com> - 1.4.2-4
changelog:
  - Remove misguided LDFLAGS hack which removed server hardening.
    https://bugzilla.redhat.com/show_bug.cgi?id=1624149#c6
    resolves: rhbz#1624149


author: Miroslav Lichvar <mlichvar@redhat.com> 6.1-5.20180224
changelog:
  - fix crash in parsing of terminfo use capability (CVE-2018-10754)
  - add gcc-c++ to build requirements


author: Miroslav Lichvar <mlichvar@redhat.com> 6.1-8.20180224
changelog:
  - fix buffer overflow in terminfo entry hashtable (CVE-2019-17594)
  - handle missing character after backslash in terminfo entry (CVE-2019-17595)


author: Miroslav Lichvar <mlichvar@redhat.com> 6.0-14.20170916
changelog:
  - update to 6.0-20170916 (CVE-2017-13728 CVE-2017-13729 CVE-2017-13730
    CVE-2017-13731 CVE-2017-13732 CVE-2017-13733 CVE-2017-13734)


author: Josef Ridky <jridky@redhat.com> - 1:5.8-14
changelog:
  - fix double free or corruption error when freeing security context (#1809077)
  - remove deprecated CFLAG


author: Josef Ridky <jridky@redhat.com> - 1:5.8-15
changelog:
  - proxied OIDs unspecified in proxy statement in snmpd.conf (#1658134)
  - UCD-SNMP-MIB::dskTable doesn't update dynamically (#1658185)
  - expand SNMPCONFPATH variable (#1660146)
  - remove file with Apple license (#1690936)
  - log meningful message on duplicate IP address (#1692286)
  - memory reporting adjustment (#1695497 and #1766521)
  - fix typos in man page (#1700262)
  - speedup ipAddressTable loading(#1700391)
  - fix memory leak when shut down librpm (#1763008)
  - services starts after network-online.target (#1775304)
  - add missing part of memory leak patch (#1829860)
  - add support for AES192 and AES256 (#1846252)


author: Josef Ridky <jridky@redhat.com> - 1:5.8-19
changelog:
  - revert permission of config files to 600 (#1601060)
  - fix error message when the address specified by clientaddr option
    is wrong or cannot be bound (#1877375)
  - log error with /proc/net/if_inet6 only when IPv6 is enabled (#1824367)
  - fix issue with quoting empty passphrase (#1817225)


author: Josef Ridky <jridky@redhat.com> - 1:5.8-21
changelog:
  - prevent parsing IP address twice (#1768908)
  - add support for digests detected from ECC certs (#1919714)
  - fix broken ErrorMsg at ucd-snmp (#1933150)
  - add support for intermediate certs (#1914656)
  - fix crash of certs with longer extension (#1908718)


author: Josef Ridky <jridky@redhat.com> - 1:5.8-27
changelog:
  - fix memory leak due of proc file creating (#2105957)
  - fix CVE-2022-44792 and CVE-2022-44793 (#2141901) and (#2141905)
  - fix memory leak when ipv6 disable set to 1 (#2151537)
  - fix proxy timeout issue (#2160723)


author: Michal Ruprich <mruprich@redhat.com> - 2.0-0.50.20160912git
changelog:
  - Resolves: 1557470 - netstat -i cut's interface names
  - Resolves: 1566084 - netstat -agn only shows 10 character interface name for IPv4 addressing


author: Michal Ruprich <michalruprich@gmail.com> - 2.0-0.52.20160912git
changelog:
  - Resolves: #1711119 - netstat says "packetes" instead of "packets"
  - Resolves: #1670355 - Exit code on wrong parameter is zero for many net-tools binaries
  - Resolves: #1807989 - The output of `route -A inet6` does not display properly when the 'Use' column output is over 6 digits


author: Laine Stump <laine@redhat.com>
changelog:
  - Improve performance with large number of interfaces
     (Bug 1268384, Bug 1271341)
   - recognize bond devices with no slaves


author: Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.3-5
changelog:
  - Removed executables from the library to allow parallel installation
    of x86-64 and x86 packages. The executables had testing purpose, and
    may be re-introduced in a separate package if needed.


author: Tomáš Mráz <tmraz@redhat.com> - 3.4-4
changelog:
  - Cover the gaps in annotation coverage for assembler sources
  - Add .hmac checksums for FIPS mode integrity checking


author: Daiki Ueno <dueno@redhat.com> - 3.4.1-5
changelog:
  - Backport powerpc64 optimization patches from upstream (#1855228)
    Patch from Christopher M. Riedl.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.52.20-4
changelog:
  - Python 2 binary package renamed to python2-newt
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Miroslav Lichvar <mlichvar@redhat.com> - 0.52.20-8
changelog:
  - rename newt-python3 subpackage to python3-newt
  - build python3 subpackage unconditionally
  - don't use unversioned python_sitearch macro
  - drop static subpackage
  - use macro for ldconfig scriptlets
  - add gcc to build requirements
  - fix description of python2-newt


author: Miroslav Lichvar <mlichvar@redhat.com> - 0.52.20-10
changelog:
  - move snack provides to python3-newt subpackage (#1640153)
  - fix radio button selection check in snack (#1714517)


author: Steve Dickson <steved@redhat.com> 0.3.5-2
changelog:
  - nfs4_getfacl: Add new option -c/--omit-header (bz 1698281)
  - nfs4_setfacl: Skip comment field while reading ACE(s) (bz 1687299)


author: Phil Sutter <psutter@redhat.com> [0.9.3-9.el8]
changelog:
  - netlink: Avoid potential NULL-pointer deref in netlink_gen_payload_stmt() (Phil Sutter) [1793030]
  - netlink: Fix leaks in netlink_parse_cmp() (Phil Sutter) [1793030]
  - netlink: Fix leak in unterminated string deserializer (Phil Sutter) [1793030]


author: Phil Sutter <psutter@redhat.com> [0.9.3-10.el8]
changelog:
  - scanner: Extend asteriskstring definition (Phil Sutter) [1763652]
  - doc: nft.8: Mention wildcard interface matching (Phil Sutter) [1763652]
  - tests: py: Support testing host binaries (Phil Sutter) [1754047]
  - tests: monitor: Support testing host's nft binary (Phil Sutter) [1754047]
  - tests: monitor: Support running individual test cases (Phil Sutter) [1754047]
  - tests: json_echo: Support testing host binaries (Phil Sutter) [1754047]
  - tests: json_echo: Fix for Python3 (Phil Sutter) [1754047]


author: Phil Sutter <psutter@redhat.com> [0.9.3-11.el8]
changelog:
  - Package requires libnftnl-1.1.5-3 (Phil Sutter) [1795224]
  - src: Add support for concatenated set ranges (Phil Sutter) [1795224]
  - src: Add support for NFTNL_SET_DESC_CONCAT (Phil Sutter) [1795224]
  - include: resync nf_tables.h cache copy (Phil Sutter) [1795224]
  - parser: add a helper for concat expression handling (Phil Sutter) [1795224]


author: Phil Sutter <psutter@redhat.com> [0.9.3-14.el8]
changelog:
  - JSON: Improve performance of json_events_cb() (Phil Sutter) [1835300]
  - doc: Document notrack statement (Phil Sutter) [1841292]


author: Phil Sutter <psutter@redhat.com> [0.9.3-15.el8]
changelog:
  - segtree: Fix get element command with prefixes (Phil Sutter) [1832235]
  - tests: 0034get_element_0: do not discard stderr (Phil Sutter) [1832235]
  - segtree: Merge get_set_interval_find() and get_set_interval_end() (Phil Sutter) [1832235]
  - segtree: Use expr_clone in get_set_interval_*() (Phil Sutter) [1832235]
  - segtree: Fix missing expires value in prefixes (Phil Sutter) [1832235]


author: Phil Sutter <psutter@redhat.com> [0.9.3-16.el8]
changelog:
  - src: Set NFT_SET_CONCAT flag for sets with concatenated ranges (Phil Sutter) [1820684]
  - include: Resync nf_tables.h cache copy (Phil Sutter) [1820684]


author: Phil Sutter <psutter@redhat.com> [0.9.3-17.el8]
changelog:
  - json: don't leave dangling pointers on hlist (Phil Sutter) [1900565]
  - json: Fix seqnum_to_json() functionality (Phil Sutter) [1900565]
  - json: echo: Speedup seqnum_to_json() (Phil Sutter) [1900565]
  - proto: Fix ARP header field ordering (Phil Sutter) [1896334]
  - proto: add sctp crc32 checksum fixup (Phil Sutter) [1895804]
  - mergesort: unbreak listing with binops (Phil Sutter) [1891790]
  - evaluate: missing datatype definition in implicit_set_declaration() (Phil Sutter) [1877022]
  - evaluate: Perform set evaluation on implicitly declared (anonymous) sets (Phil Sutter) [1877022]
  - src: store expr, not dtype to track data in sets (Phil Sutter) [1877022]


author: Phil Sutter <psutter@redhat.com> [0.9.3-19.el8]
changelog:
  - evaluate: Reject quoted strings containing only wildcard (Phil Sutter) [1818117]
  - tests: monitor: use correct $nft value in EXIT trap (Phil Sutter) [1919203]
  - monitor: Fix for use after free when printing map elements (Phil Sutter) [1919203]
  - tests: Disable tests known to fail on RHEL8 (Phil Sutter) [1919203]


author: Phil Sutter <psutter@redhat.com> [0.9.3-20.el8]
changelog:
  - src: Optimize prefix matches on byte-boundaries (Phil Sutter) [1934926]
  - src: Support odd-sized payload matches (Phil Sutter) [1934926]
  - spec: Add an rpminspect.yaml file to steer rpminspect (Phil Sutter) [1962184]
  - spec: Explicitly state dist string in Release tag (Phil Sutter) [1962184]


author: Phil Sutter <psutter@redhat.com> [0.9.3-21.el8]
changelog:
  - tests: shell: Fix bogus testsuite failure with 100Hz (Phil Sutter) [1919203]
  - doc: nft.8: Extend monitor description by trace (Phil Sutter) [1820365]
  - include: missing sctp_chunk.h in Makefile.am (Phil Sutter) [1979334]
  - exthdr: Implement SCTP Chunk matching (Phil Sutter) [1979334]
  - scanner: sctp: Move to own scope (Phil Sutter) [1979334]
  - scanner: introduce start condition stack (Phil Sutter) [1979334]
  - json: Simplify non-tcpopt exthdr printing a bit (Phil Sutter) [1979334]
  - json: tcp: add raw tcp option match support (Phil Sutter) [1979334]
  - tcp: add raw tcp option match support (Phil Sutter) [1979334]
  - tcpopt: allow to check for presence of any tcp option (Phil Sutter) [1979334]
  - tcpopt: split tcpopt_hdr_fields into per-option enum (Phil Sutter) [1979334]
  - tcpopt: rename noop to nop (Phil Sutter) [1979334]
  - tcpopts: clean up parser -> tcpopt.c plumbing (Phil Sutter) [1979334]
  - parser: merge sack-perm/sack-permitted and maxseg/mss (Phil Sutter) [1979334]
  - tests/py: Move tcpopt.t to any/ directory (Phil Sutter) [1979334]


author: Phil Sutter <psutter@redhat.com> [0.9.3-22.el8]
changelog:
  - json: Drop pointless assignment in exthdr_expr_json() (Phil Sutter) [1999059]
  - parser_json: Fix for memleak in tcp option error path (Phil Sutter) [1999059]
  - parser_bison: Fix for implicit declaration of isalnum (Phil Sutter) [1999059]
  - parser_json: Fix error reporting for invalid syntax (Phil Sutter) [1994141]


author: Phil Sutter <psutter@redhat.com> [0.9.3-23.el8]
changelog:
  - tests: cover baecd1cf2685 ("segtree: Fix segfault when restoring a huge interval set") (Phil Sutter) [1908127]
  - segtree: Fix segfault when restoring a huge interval set (Phil Sutter) [1908127]


author: Phil Sutter <psutter@redhat.com> [0.9.3-24.el8]
changelog:
  - tests: shell: better parameters for the interval stack overflow test (Phil Sutter) [1908127]
  - tests: shell: $NFT needs to be invoked unquoted (Phil Sutter) [1908127]


author: Phil Sutter <psutter@redhat.com> [0.9.3-25.el8]
changelog:
  - mnl: do not build nftnl_set element list (Phil Sutter) [2047821]
  - tests: py: add dnat to port without defining destination address (Phil Sutter) [2030773]
  - evaluate: fix inet nat with no layer 3 info (Phil Sutter) [2030773]
  - evaluate: attempt to set_eval flag if dynamic updates requested (Phil Sutter) [2039594]
  - src: support for restoring element counters (Phil Sutter) [2039594]
  - netlink: remove unused parameter from netlink_gen_stmt_stateful() (Phil Sutter) [2039594]


author: Phil Sutter <psutter@redhat.com> [0.9.3-26.el8]
changelog:
  - libnftables: call nft_cmd_expand() only with CMD_ADD (Phil Sutter) [2073287]
  - src: add CMD_OBJ_SETELEMS (Phil Sutter) [2073287]
  - src: rename CMD_OBJ_SETELEM to CMD_OBJ_ELEMENTS (Phil Sutter) [2073287]
  - rule: fix element cache update in __do_add_setelems() (Phil Sutter) [2073287]
  - rule: memleak in __do_add_setelems() (Phil Sutter) [2073287]
  - tests: shell: auto-removal of chain hook on netns removal (Phil Sutter) [2070924]
  - mnl: do not use expr->identifier to fetch device name (Phil Sutter) [2070924]


author: Phil Sutter <psutter@redhat.com> [1.0.4-1.el8]
changelog:
  - Synchronize patch level with nftables-1.0.4-10.el9 (Phil Sutter) [2211076]
  - Rebase onto version 1.0.4 (Phil Sutter) [2211076]


author: Phil Sutter <psutter@redhat.com> [1.0.4-2.el8]
changelog:
  - Add expected error records for testsuite runs (Phil Sutter) [2211076]
  - tests: monitor: Summarize failures per test case (Phil Sutter) [2211076]


author: Phil Sutter <psutter@redhat.com> [1.0.4-3.el8]
changelog:
  - spec: Rename variables to avoid a clash (Phil Sutter) [INTERNAL]
  - rule: check address family in set collapse (Phil Sutter) [RHEL-5160]


author: Luboš Uhliarik <luhliari@redhat.com> - 1:1.14.0-1
changelog:
  - Resolves: #1558420 - directory permissions are now correct after processing
    USR1 signal
  - Resolves: #1601414 - nginx: drop GeoIP support


author: Lubos Uhliarik <luhliari@redhat.com> - 1:1.14.1-1
changelog:
  - new version 1.14.1
  - Resolves: #1647257 - CVE-2018-16845 nginx: Denial of service and
    memory disclosure via mp4 module
  - Resolves: #1647262 - CVE-2018-16844 nginx: Excessive CPU usage
    via flaw in HTTP/2 implementation
  - Resolves: #1647263 - CVE-2018-16843 nginx: Excessive memory consumption
    via flaw in HTTP/2 implementation


author: Lubos Uhliarik <luhliari@redhat.com> - 1:1.14.1-9
changelog:
  - Resolves: #1744811 - CVE-2019-9511 nginx:1.14/nginx: HTTP/2: large amount of
    data request leads to denial of service
  - Resolves: #1744325 - CVE-2019-9513 nginx:1.14/nginx: HTTP/2: flood using
    PRIORITY frames resulting in excessive resource consumption
  - Resolves: #1745094 - CVE-2019-9516 nginx:1.14/nginx: HTTP/2: 0-length
    headers leads to denial of service


author: Lubos Uhliarik <luhliari@redhat.com> - 1:1.16.0-1
changelog:
  - new version 1.16.0
  - enable ngx_stream_ssl_preread module
  - main package does NOT require all-modules package


author: Lubos Uhliarik <luhliari@redhat.com> - 1:1.16.1-1
changelog:
  - update to 1.16.1
  - Resolves: #1745697 - CVE-2019-9511 nginx:1.16/nginx: HTTP/2: large amount
    of data request leads to denial of service
  - Resolves: #1745690 - CVE-2019-9513 nginx:1.16/nginx: HTTP/2: flood using
    PRIORITY frames resulting in excessive resource consumption
  - Resolves: #1745645 - CVE-2019-9516 nginx:1.16/nginx: HTTP/2: 0-length
    headers leads to denial of service


author: Lubos Uhliarik <luhliari@redhat.com> - 1:1.16.1-2
changelog:
  - Resolves: #1798230 - CVE-2019-20372 nginx:1.16/nginx: HTTP request smuggling
    via error pages in http/ngx_http_special_response.c


author: Luboš Uhliarik <luhliari@redhat.com> - 1:1.16.1-2.1
changelog:
  - Resolves: #1963174 - CVE-2021-23017 nginx:1.16/nginx: Off-by-one in
    ngx_resolver_copy() when labels are followed by a pointer to a root
    domain name


author: Lubos Uhliarik <luhliari@redhat.com> - 1:1.18.0-2
changelog:
  - new version 1.18.0
  - Resolves: #1668717 - [RFE] Support loading certificates from hardware token
    (PKCS#11)
  - Increased types_hash_max_size to 4096 in default config
  - Drop location / from default config (rhbz#1564768)
  - Drop default_sever from default config (rhbz#1373822)


author: Lubos Uhliarik <luhliari@redhat.com> - 1:1.18.0-3
changelog:
  - Resolves: #1651377 - centralizing default index.html on nginx
  - Resolves: #1825683 - Outdated Red Hat branding used in nginx default pages


author: Luboš Uhliarik <luhliari@redhat.com> - 1:1.18.0-3.1
changelog:
  - Resolves: #1963178 - CVE-2021-23017 nginx:1.18/nginx: Off-by-one in
    ngx_resolver_copy() when labels are followed by a pointer to a root
    domain name


author: Luboš Uhliarik <luhliari@redhat.com> - 1:1.22.1-1
changelog:
  - Resolves: #2112345 - nginx:1.22 for RHEL 8
  - add stream_geoip_module and stream_realip_module
  - remove obsolete --with-ipv6


author: Martin Osvald <mosvald@redhat.com> - 2:7.92-1
changelog:
  - New version 7.92
  - Resolves: #2166178 - Nmap much slower after libpcap fix
  - Resolves: #2169766 - Rebase nmap for TLS v1.3 support


author: Gris Ge <fge@redhat.com> - 1.1.0-3
changelog:
  - Fix state=ignore for OVS interface. RHBZ#1944054
  - Fix verification for next hop address 0.0.0.0. RHBZ#1985879


author: Ana Cabral <acabral@redhat.com> - 1.1.1-0.1.alpha1
changelog:
  - Upgrade to 1.1.1 alpha1.
  - Canonicalize ipv6 addresses for dns nameservers. RHBZ#1911241
  - Throw better error when peer is missing for veth interfaces. RHBZ#1973973


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 1:10.21.0-1
changelog:
  - Security update to 10.21.0
  - Resolves: RHBZ#1845307
  - Fixes CVE-2020-11080, CVE-2020-8174, CVE-2020-10531
  - Bundle brotli, because --shared-brotli configure option is missing
  - Add i18n subpackage


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 1:10.23.1-1
changelog:
  - January Security release
  - https://nodejs.org/en/blog/vulnerability/january-2021-security-releases/
  - Rebase to 10.23.1
  - Resolves: RHBZ#1916461, RHBZ#1914789
  - Resolves: RHBZ#1914783, RHBZ#1916462, RHBZ#1916395, RHBZ#1916459
  - Resolves: RHBZ#1916691, RHBZ#1916689, RHBZ#1916388
  - Remove dot-prop patch, as it is fixed by npm rebase


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 1:12.19.1-1
changelog:
  - Resolves: RHBZ#1901044, #1901045, #1901046, #1901047
  - c-ares, ajv and y18n CVEs and yarn installability issues


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 1:12.20.1-1
changelog:
  - Security rebase for January security release
  - https://nodejs.org/en/blog/vulnerability/january-2021-security-releases/
  - Resolves: RHBZ#1916460, RHBZ#1914786
  - Resolves: RHBZ#1914784, RHBZ#1916396


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 1:14.15.4-1
changelog:
  - Security rebase to 14.15.4
  - https://nodejs.org/en/blog/vulnerability/january-2021-security-releases/
  - Resolves: RHBZ#1916463, RHBZ#1914788
  - Resolves: RHBZ#1914785, RHBZ#1916387, RHBZ#1916389, RHBZ#1916390, RHBZ#1916690


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 1:14.15.4-1
changelog:
  - Security rebase to 14.15.4
  - https://nodejs.org/en/blog/vulnerability/january-2021-security-releases/
  - Resolves: RHBZ#1913001, RHBZ#1912953
  - Resolves: RHBZ#1912636, RHBZ#1898602, RHBZ#1898768, RHBZ#1893987, RHBZ#1893184


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 1:14.17.3-1
changelog:
  - Resolves: RHBZ#1980032, RHBZ#1978203
  - Resolves RHBZ#1842826
  - Resolves CVE-2021-22918(libuv), use system cipher list


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 1:14.17.3-3
changelog:
  - Resolves: RHBZ#1991584, RHBZ#1991578
  - Resolves CVE-2021-23362 CVE-2021-27290
  - Bump for missing mentions of CVEs


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 1:14.17.5-1
changelog:
  - Resolves CVE-2021-22930, CVE-2021-22931, CVE-2021-22939, CVE-2021-22940,
  - CVE-2021-23343, CVE-2021-32803, CVE-2021-32804, CVE-2021-3672
  - Resolves RHBZ#1847529 (make FIPS always available)
  - Resolves: RHBZ#1988599, RHBZ#1994000, RHBZ#1993998, RHBZ#1993095
  - Resolves: RHBZ#1994028, RHBZ#1994402, RHBZ#1994406, RHBZ#1994398
  - Resolves: RHBZ#1993924 (make FIPS always available)


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 1:14.16.0-1
changelog:
  - Resolves CVE-2021-22883 CVE-2021-22884
  - Resolves: RHBZ#1934566, RHBZ#1934599
  - Rebase, remove ini patch


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 1:14.17.3-1
changelog:
  - Resolves: RHBZ#1979844, RHBZ#1977829
  - Resolves: RHBZ#1842826
  - Resolves CVE-2021-22918(libuv), use system cipher list


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 1:14.17.3-3
changelog:
  - Resolves: RHBZ#1945513, RHBZ#1945287
  - Resolves CVE-2021-23362 CVE-2021-27290
  - Bump for missing mentions of CVEs


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 1:14.17.5-1
changelog:
  - Resolves CVE-2021-22930, CVE-2021-22931, CVE-2021-22939, CVE-2021-22940,
  - CVE-2021-23343, CVE-2021-32803, CVE-2021-32804, CVE-2021-3672
  - Resolves RHBZ#1847529 (make FIPS always available)
  - Resolves: RHBZ#1988600, RHBZ#1993815, RHBZ#1993809, RHBZ#1993096
  - Resolves: RHBZ#1986743, RHBZ#1993947, RHBZ#1993940, RHBZ#1989427
  - Resolves: RHBZ#1951620 (make FIPS always available)


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 1:14.18.2-1
changelog:
  - Resolves: RHBZ#2026325
  - Resolves: RHBZ#2014130, RHBZ#2014124, RHBZ#2013826, RHBZ#2024921
  - Rebase to new version to fix CVEs


author: Jan Staněk <jstanek@redhat.com> - 1:14.18.2-2
changelog:
  - Replace with_* macros with RPM confitionals
  - Unify configure calls into single command
  - Refactor bootstrap-related parts
  - Decouple dependency bundling from bootstrapping


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 1:14.20.0-1
changelog:
  - Rebase to latest release
  - Resolves: #2106281, #2108056, #2108061, #2108066, #2108071, #2108139
  - Remove libs patch
  - Build without corepack


author: Jan Staněk <jstanek@redhat.com> - 1:14.20.1-2
changelog:
  - Record issues fixed in the current version
    Resolves: CVE-2021-44531 CVE-2021-44532 CVE-2021-44533 CVE-2022-21824


author: Jan Staněk <jstanek@redhat.com> - 1:14.21.1-2
changelog:
  - Apply upstream fix for CVE-2022-24999
    Resolves: CVE-2022-24999
  - Record CVEs fixed by current or previous upstream releases
    Resolves: CVE-2021-44906


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 1:16.1.0-1
changelog:
  - Resolves: RHBZ#1953991
  - Rebase to v16.x
  - Update version of gcc and gcc-c++ needed
  - Remove libs conditionals
  - Remove unused patches
  - Bundle nghttp3 and ngtcp2


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 1:16.4.2-1
changelog:
  - Resolves: RHBZ#1979847
  - Resolves CVE-2021-22918(libuv)
  - Use system cipher list(1842826, 1952915)


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 1:16.7.0-1
changelog:
  - Resolves CVE-2021-22930, CVE-2021-22931, CVE-2021-22939,
  - CVE-2021-22940, CVE-2021-32803, CVE-2021-32804, CVE-2021-3672
  - Resolves: RHBZ#1988608, RHBZ#1993816, RHBZ#1993810
  - Resolves: RHBZ#1993097, RHBZ#1993948, RHBZ#1993941, RHBZ#1994963


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 1:16.7.0-2
changelog:
  - Resolves CVE-2021-22930, CVE-2021-22931, CVE-2021-22939,
  - CVE-2021-22940, CVE-2021-32803, CVE-2021-32804, CVE-2021-3672
  - Resolves: RHBZ#1988608, RHBZ#1993816, RHBZ#1993810
  - Resolves: RHBZ#1993097, RHBZ#1993948, RHBZ#1993941, RHBZ#1994963
  - fix python3 in gyp


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 1:16.8.0-1
changelog:
  - Resolves CVE-2021-32803, CVE-2021-32804, CVE-2021-37701, CVE-2021-37712
  - Resolves: RHBZ#1993948, RHBZ#1993941, RHBZ#2000151, RHBZ#2002176


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 1:16.13.1-1
changelog:
  - Resolves: RHBZ#2014132, RHBZ#2014126, RHBZ#2013828, RHBZ#2024920
  - Resolves: RHBZ#2026329
  - Rebase to LTS release and to fix multiple low and medium CVEs


author: Jan Staněk <jstanek@redhat.com> - 1:16.14.0-5
changelog:
  - Unify configure calls into single command
  - Refactor bootstrap-related parts
  - Decouple dependency bundling from bootstrapping


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 1:16.16.0-1
changelog:
  - Resolves: #2104754, #2108057, #2108062, #2108067, #2108072
  - Resolves CVE-2022-29244, CVE-2022-32212/3/4/5
  - Resolves: #2106285
  - Rebase to latest release


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 1:16.17.1-1
changelog:
  - Rebase to version 16.17.1
  - Resolves: CVE-2022-35255 CVE-2022-35256
  - Resolves: #2130553
  - Resolves #2132003
  - Resolves #2121095


author: Jan Staněk <jstanek@redhat.com> - 1:16.18.1-2
changelog:
  - Record CVE references already addressed in this or previous upstream versions
    Resolves: CVE-2021-44531 CVE-2021-44532 CVE-2021-44533 CVE-2022-21824


author: Jan Staněk <jstanek@redhat.com> - 1:18.6.0-1
changelog:
  - Rebase to version 18.6.0
    Resolves: CVE-2022-32212 CVE-2022-32213 CVE-2022-32214 CVE-2022-32215
    Resolves: CVE-2022-29244


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 1:18.14.2-1
changelog:
  - Rebase to 18.14.2
  - Resolves: #2178086
  - Resolves: CVE-2022-25881, CVE-2023-23936, CVE-2023-24807
  - Resolves: CVE-2023-23918, CVE-2023-23919, CVE-2023-23920


author: Jan Staněk <jstanek@redhat.com> - 1:18.14.2-3
changelog:
  - Update bundled c-ares to 1.19.1
    Resolves: CVE-2022-4904
    Resolves: CVE-2023-31124 CVE-2023-31130 CVE-2023-31147 CVE-2023-32067


author: Jan Staněk <jstanek@redhat.com> - 1:18.16.1-1
changelog:
  - Rebase to 18.16.1
    Resolves: rhbz#2188290 rhbz#2166926
    Resolves: CVE-2023-30581 CVE-2023-30588 CVE-2023-30589 CVE-2023-30590
  - Replace /usr/etc/npmrc symlink with builtin configuration
    Resolves: rhbz#2222287


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 1:20.5.0-1
changelog:
  - Update to v20.5.0
  - Remove dtrace support
  - bcond corepack, so we don't provide it by default
  - Decrease debuginfo verbosity for all arches
  - Resolves: #2186718
  - Resolves RHELPLAN-155624


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 1:20.5.1-1
changelog:
  - Rebase to new security release
  - Address CVE-2023-32002, CVE-2023-32004, CVE-2023-32558 (high)
  - Address CVE-2023-32006, CVE-2023-32559 (medium)
  - Address CVE-2023-32005, CVE-2023-32003 (low)
  - Resolves: #2186718
  - Resolves RHELPLAN-155624


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 1:20.8.1-1
changelog:
  - Update node and nghttp
  - Add fips patch
  - Fixes CVE-2023-44487 (nghttp)
  - Fixes CVE-2023-45143, CVE-2023-39331, CVE-2023-39332, CVE-2023-38552, CVE-2023-39333


author: Bob Relyea <rrelyea@redhat.com> - 3.53.1-11
changelog:
  - Fix issue with upgradedb where upgradedb expects standard to
    generate dbm databases, not sql databases (default in RHEL8)


author: Bob Relyea <rrelyea@redhat.com> - 3.53.1-12
changelog:
  - fips need to reject small primes even if they are approved
  - code to autodetect whether or not to use the cache needs to do so
    in a way that doesn't mess with filesystem negative file caching.
  - add kdf selftests


author: Bob Relyea <rrelyea@redhat.com> - 3.53.1-14
changelog:
  - Add support for enable/disable in policy. Now if your policy
    file has disallow=x enable=y it will act just like our other 
    libraries.


author: Bob Relyea <rrelyea@redhat.com> - 3.53.1-16
changelog:
  - Fix the following CVE
  - CVE-2020-12403 chacha-poly issues
  - CVE-2020-12400 constant time ECC.
  - CVE-2020-6829  constant time ECC.


author: Bob Relyea <rrelyea@redhat.com> - 3.67.0-4
changelog:
  - Better fix for the sdb timeout. The issue wasn't a race, it was
    the sqlite timeout waiting to begin a transaction under heavy
    thread usage.


author: Bob Relyea <rrelyea@redhat.com> - 3.79.0-1
changelog:
  - Rebase to NSS 3.79
  - Set FIPS Module ID
  - skip attribute verification on attributes with default values
  - don't export trust objects if they are default trust objects from dbm
  - add dbtool to nss-tools


author: Bob Relyea <rrelyea@redhat.com> - 3.79.0-5
changelog:
  - FIPS 140-3 changes
  -  Reject Small RSA keys, 1024 bit keys are marked as FIP OK when verifying, reject
     signature keys by policy
  -  Allow applications to retrigger selftests on demand.


author: Bob Relyea <rrelyea@redhat.com> - 3.79.0-8
changelog:
  - Update fips default for pk12util to AES rather than TDES
  - Fix bug in pkcs12 files with null passwords


author: Bob Relyea <rrelyea@redhat.com> - 3.79.0-11
changelog:
  - Fix QA found failures:
  -  remove extra '+' from sslpolicy.txt file causing test error values
  -  only use GRND_RANDOM if the kernel is in FIPS mode.


author: Bob Relyea <rrelyea@redhat.com> - 3.90.0-4
changelog:
  - FIPS review changes
  -   add PORT_SafeZero to avoid compiler optimizing a way zeroing memory.
  -   update the indicators for this release
  -   allow hashing of longer than int32 values in a single PKCS #11 call.


author: Nalin Dahyabhai <nalin@redhat.com> 0.8.14-7
changelog:
  - move the packaged tmpfiles.d file from /etc/tmpfiles.d to %{_tmpfilesdir},
    per heads-up from Ville Skyttä on devel@


author: Jakub Hrozek <jhrozek@redhat.com> - 0.8.14-12
changelog:
  - Get rid of all conditions that are always true for both EPEL-7 and Fedora
    as it's quite unlikely we'd use this specfile on EPEL-6
  - Remove the sysvinit script and all the scriptlets around it
  - Unconditionally use systemd scriptlet macros and systemd_requires
  - Unconditionally build the PAM module as the PADL module is long dead
  - Remove the auto-migration of settings from nss_ldap as it's been
    long gone from Fedora
  - Don't check /etc/sysconfig/authconfig as authconfig is on its way
    out from Fedora
  - Use only spaces, not tabs, to stop my editor from looking like a
    Christmas tree
  - Remove the obsolete Group stanza
  - Make nscd Recommended, not Required


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.9-1
changelog:
  - Upgrade to the latest upstream
    - Disable the python utilities
    - Don't bother with failing pylint test as we don't ship the python
      utilities
  - Drop unused validname and exitcode patches, port strtoid overflow
    patch


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.9-2
changelog:
  - Apply a patch by Lukas Slebodnik to allow root to write to the
    /var/run/nslcd directory
  - Resolves: rhbz#1583211 - nslcd, the local LDAP daemon, fails to start
                             with SELinux enabled


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.9-3
changelog:
  - Also change the pemissions on tmpfiles
  - Related: rhbz#1583211 - nslcd, the local LDAP daemon, fails to start
                            with SELinux enabled


author: Tomas Halman <thalman@redhat.com> - 0.9.9-4
changelog:
  - moving temp files from /var/run to /run
  - Resolves: rhbz#1969826 - tmpfiles snippet needs updated path for
                             nss-pam-ldapd


author: Andreas Schneider <asn@redhat.com> - 1.1.0-1
changelog:
  - Update to version 1.1.0
    * Added support for initgroups()
    * Added support for shadow files (getspnam(), etc.)
    * Improved support for multi address handling in getaddrinfo()
    * Improved file parser
    * Fixed compilation on machines without IPv4 support
    * Fixed service string sanity check in getaddrinfo() (bso #11501)
    * Fixed AI_NUMERICHOST handling in getaddrinfo() (bso #11477)


author: Andreas Schneider <asn@redhat.com> - 1.1.3-1
changelog:
  - Update to version 1.1.3
    * Added support for BSD 'struct passwd' members
    * Replaced strcpy() with snprintf()
    * Fixed segfault while reloading hosts file
    * Fixed issue where are not fault tolerant if an alias has already
      been added
    * Fixed nss_wrapper build on Solaris


author: Andreas Schneider <asn@redhat.com> - 1.1.12-1
changelog:
  - resolves: rhbz#2139665 - Rebase to version 1.1.12
  - resolves: rhbz#2124635 - Reduce dependencies of the package


author: Dridi Boukelmoune <dridi@fedoraproject.org>- 2.1-1
changelog:
  - Update to 2.1
  - Upstream moved to github
  - Upstream switched to autotools
  - Disable --as-needed until it's patched upstream
  - Drop defunct 32bit x86 support
  - Add ppc64le support
  - Run the new test suite


author: Charalampos Stratakis <cstratak@redhat.com> - 1.14.2-12
changelog:
  - Set proper build flags for https://fedoraproject.org/wiki/Changes/Python_Extension_Flags
  - Resolves: rhbz#1715036


author: luto@kernel.org - 1.9-1
changelog:
  - Update to 1.9
  - Certain fabric functionality may not work yet due to missing dracut
    support and missing hostid and hostnqn configuration.


author: Jindrich Novy <jnovy@redhat.com> - 1.1.1-1
changelog:
  - update to https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.1.1
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 1.1.2-1
changelog:
  - update to https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.1.2
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 1.2.1-1
changelog:
  - update to https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.2.1
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1.2.1-1
changelog:
  - update to
    https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.2.1
  - require crun >= 0.17
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1.2.3-1
changelog:
  - update to https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.2.3
  - fix build
  - Related: #1934415


author: Jindrich Novy <jnovy@redhat.com> - 1.2.5-1
changelog:
  - update to https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.2.5
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 1.2.6-1
changelog:
  - update to https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.2.6
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 1.2.7-1
changelog:
  - update to https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.2.7
  - Related: #2123641


author: Jindrich Novy <jnovy@redhat.com> - 1.2.8-1
changelog:
  - update to https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.2.8
  - Related: #2123641


author: Jindrich Novy <jnovy@redhat.com> - 1.2.8-2
changelog:
  - update to https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.2.8
  - Related: #2176055


author: Jindrich Novy <jnovy@redhat.com> - 1.2.9-1
changelog:
  - update to https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.2.9
  - Related: #2176055


author: Dan Walsh <dwalsh@redhat.com> - 1:0.1.15-1.git
changelog:
  - Fix issue with oci-systemd-hook running in user namespaces
  - fix json file to run container with proper stage field.


author: Dan Walsh <dwalsh@redhat.com> - 2:2.2.0-2.git0a4dcd6
changelog:
  * Thu Sep 21 2017 Dan Walsh <dwalsh@redhat.com> - 2:2.2.0-2.git0a4dcd6
  - Add support for multiple configuration files.
    oci-umount will still read config file /etc/oci-umount.conf if it
    exists, but will also read config files in /usr/share/oci-umount/oci-umount.d
    and config files in /etc/oci-umount/oci-umount.d.  If the same file name exists
    in both directories, then oci-umount will only use the content in /ect/oci-umount/oci-umount.d.
  - Make Logs less noisy
  - Improve logs output, adding containier id, and needed file information
  - Add support for specifying submounts PATH/* will unmount all mountpoints 
    under PATH in a container
  - Support for oci configuration files to specify when to run the plugin


author: Nalin Dahyabhai <nalin@redhat.com> - 0.34.4-7
changelog:
  - Drop Python 2 build-time dependency, which hasn't been used since we turned
    off building the python bindings years ago (#1595853, #1642502).


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.34.5-1
changelog:
  - Upstream release 0.34.5
  - Resolves: rhbz#1833289 - Rebase oddjob to 0.34.5
  - Resolves: rhbz#1833052 - CVE-2020-10737 
    oddjob: race condition in oddjob_selinux_mkdir function in mkhomedir.c can lead to symlink attack


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.34.7-1
changelog:
  - Upstream release 0.34.7
  - Force LC_ALL=C.UTF-8 in oddjobd systemd service environment
  - Resolves: rhbz#1907481 - oddjob locale issue
  - Resolves: rhbz#1907541 - rebase oddjob to 0.34.7


author: Jan Friesse <jfriesse@redhat.com> - 0.0.4-15
changelog:
  - Modernize spec file a bit
  - Fix spec file changelog dates
  - Add gcc build requirement

  - Related rhbz#1682115


author: Honggang Li <honli@redhat.com> - 10.3.1.0-8
changelog:
  - Rebase to upstream branch v10_3_1 as required.
  - Clean up change log.
  - Apply Epoch tag.
  - Resolves: bz1257452, bz1382792


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.0.0-1.el8
changelog:
  - Rebase to 11.0.0 [bz#1754658]
  - Resolves: bz#1754658
    (Rebase open-vm-tools to 11.0 for 8.2.0)
  - Resolves: bz#1760891
    (Need to backport some severe memory leak fixes from upstream)


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.0.0-3.el8
changelog:
  - ovt-Address-Coverity-issues-reported-in-bora-lib-file-fi.patch [bz#1769881]
  - ovt-Fix-a-potential-NULL-pointer-dereference-in-the-vmba.patch [bz#1769881]
  - ovt-Address-two-Coverity-reported-issues-in-hostinfoPosi.patch [bz#1769881]
  - ovt-Fix-a-resource-leak-issue-in-deployPkg.patch [bz#1769881]
  - Resolves: bz#1769881
    ([ESXi][RHEL8.2]Important issues found by covscan in "open-vm-tools-11.0.0-2.el8" package)


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.0.0-4.el8
changelog:
  - ovt-Rectify-a-log-spew-in-vmsvc-logging-vmware-vmsvc-roo.patch [bz#1800812]
  - Resolves: bz#1800812
    ([ESXi][RHEL8]Log spew "[ warning] [guestinfo] GuestInfoGetDiskDevice: Missing disk device name)


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.0.5-1.el8
changelog:
  - Rebase to 11.0.5 (bz#1798285)
  - Resolves: bz#1798285
    ([ESXi][RHEL8.2.1]Rebase open-vm-tools to 11.0.5 for 8.2.1)


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.0.5-3.el8
changelog:
  - ovt-Fix-a-trivial-memory-leak-in-namespacetool.c.patch [bz#1811729]
  - ovt-Update-copyright-to-reflect-previous-change.patch [bz#1811729]
  - ovt-add-appinfo-plugin.patch [bz#1809751]
  - Resolves: bz#1809751
    ([ESXi][RHEL8.2.1]open-vm-tools add appinfo plugin patch)
  - Resolves: bz#1811729
    ([ESXi][RHEL8.2.1]open-vm-tools coverity scan issue)


author: Mirosalv Rezanina <mrezanin@redhat.com> - 11.1.0-1.el8
changelog:
  - Rebase to 11.1.0 [bz#1806677]
  - Added open-vm-tools-sdmp package [bz#1833157)
  - Resolves: bz#1806677
    ([ESXi][RHEL8]Rebase open-vm-tools to 11.1.0 for RHEL 8.3)
  - Resolves: bz#1833157
    ([ESXi][RHEL8]Add new open-vm-tools-sdmp package for RHEL 8.3)


author: Miroslav Rezanina <mrezanin@redaht.com> - 11.1.0-2.el8
changelog:
  - Remove net-tools dependency [bz#1849459]
  - Resolves: bz#1849459
    ([ESXi][RHEL8]Incorporate SDMP related fixes and removal of net-tools dependency)


author: Miroslav Rezanina <mrezanin@redaht.com> - 11.1.5-1.el8
changelog:
  - Rebase to 11.1.5 [bz#1870781]
  - Resolves: bz#1870781
    ([ESXi][RHEL8]Rebase open-vm-tools to 11.1.5 for 8.4)


author: Miroslav Rezanina <mrezanin@redaht.com> - 11.2.0-1.el8
changelog:
  - Rebase to 11.2.0 [bz#1890831]
  - Resolves: bz#1890831
    ([ESXi][RHEL8]Rebase open-vm-tools to 11.2.0 for 8.4)


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.2.0-2.el8
changelog:
  - ovt-Fix-memory-leaks.patch [bz#1896804]
  - Resolves: bz#1896804
    ([ESXi][open-vm-tools] Coverity detected important defects in open-vm-tools-11.2.0 rebase)


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.2.5-1.el8
changelog:
  - Rebase to 11.2.5 [bz#1916561]
  - Resolves: bz#1916561
    ([ESXi][RHEL8.5]Open-vm-tools update release 11.2.5 has been released)


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.2.5-2.el8
changelog:
  - ovt-Fix-a-memory-leak-reported-by-a-partner-from-their-C.patch [bz#1935807]
  - Resolves: bz#1935807
    ([ESXi][RHEL-8.5][open-vm-tools] Coverity detected an important defect in open-vm-tools-11.2.5 rebase)


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.2.5-1.el8
changelog:
  - Rebase to 11.2.5 [bz#1916561]
    ([ESXi][RHEL8.5]Open-vm-tools update release 11.2.5 has been released)


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.3.0-1.el8
changelog:
  - Rebase to open-vm-tools 11.3.0 [bz#1974468]
  - Resolves: bz#1974468
    ([ESXi][RHEL8]Open-vm-tools release 11.3.0 has been released - please rebase)


author: Miroslav Rezanian <mrezanin@redhat.com> - 11.3.5-1.el9
changelog:
  - Rebase to open-vm-tools 11.3.5 [bz#2008244]
  - Resolves: bz#2008244
    ([ESXi][RHEL8]Open-vm-tools release 11.3.5 has been released - please rebase)


author: Miroslav Rezanian <mrezanin@redhat.com> - 12.0.0-1
changelog:
  - Rebase to open-vm-tools 12.0.0 [bz#2061189]
  - Resolves: bz#2061189
    ([ESXi][RHEL8]Open-vm-tools release 12.0.0 has been released - please rebase)


author: Miroslav Rezanina <mrezanin@redhat.com> - 12.0.5-1
changelog:
  - Rebase to open-vm-tools 12.0.5 [bz#2090273]
  - Resolves: bz#2090273
    ([ESXi][RHEL8]Open-vm-tools release 12.0.5 has been released - please rebase)


author: Jon Maloy <jmaloy@redhat.com> - 12.0.5-2
changelog:
  - ovt-Properly-check-authorization-on-incoming-guestOps-re.patch [bz#2119284]
  - Resolves: bz#2119284
    (CVE-2022-31676 open-vm-tools: local root privilege escalation in the virtual machine [rhel-8.7.0])


author: Miroslav Rezanina <mrezanin@redhat.com> 12.1.0-1
changelog:
  - Rebase to open-vm-tools 12.1.0
  - Resolves: bz#2121196
    ([ESXi][RHEL8]Open-vm-tools release 12.1.0 has been released - please rebase)


author: Miroslav Rezanina <mrezanin@redhat.com> 12.1.5-1
changelog:
  - Rebase to open-vm-tools 12.1.5 [bz#2150188]
  - Resolves: bz#2150188
    (ESXi][RHEL8]Open-vm-tools release 12.1.5 has been released - please rebase)


author: Miroslav Rezanina <mrezanin@redhat.com> - 12.2.0-1
changelog:
  - Rebase to open-vm-tools 12.2.0 [bz#2177068]
  - Resolves: bz#2177068
    ([ESXi][RHEL8]open-vm-tools version 12.2.0 has been released - please rebase)


author: Jon Maloy <jmaloy@redhat.com> - 12.2.0-3
changelog:
  - ovt-Remove-some-dead-code.patch [bz#2215563]
  - Resolves: bz#2215563
    ([CISA Major Incident] CVE-2023-20867 open-vm-tools: authentication bypass vulnerability in the vgauth module [rhel-8])


author: Miroslav Rezanina <mrezanin@redhat.com> - 12.2.5-1
changelog:
  - Rebase to open-vm-tools 12.2.5 [bz#2214861]
  - Resolves: bz#2214861
    ([ESXi][RHEL8]open-vm-tools version 12.2.5 has been released - please rebase)
  - Resolves: bz#2216415
    ([ESXi][RHEL8] URL in service unit files are started from http instead of https)


author: Miroslav Rezanina <mrezanin@redhat.com> - 12.2.5-3
changelog:
  - Rebuild CVE-2023-20900 for 8.10
  - Resolves: RHEL-4584
    (CVE-2023-20900 open-vm-tools: SAML token signature bypass [rhel-8.10.0])


author: Jon Maloy <jmaloy@redhat.com> - 12.2.5-4
changelog:
  - ovt-Provide-alternate-method-to-allow-expected-pre-froze.patch [RHEL-7012]
  - Resolves: RHEL-7012
    ([RHEL8.10][ESXi]Latest version of open-vm-tools breaks VM backups)


author: Miroslav Rezanina <mrezanin@redhat.com> - 12.3.5-1
changelog:
  - Rebase to 12.3.5 [RHEL-15059]
  - Fix CVE-2023-34058 [RHEL-14649]
  - Fix CVE-2023-34059 [RHEL-14683]
  - Resolves: RHEL-15059
    ([ESXi][RHEL8]open-vm-tools version 12.3.5 has been released - please rebase)
  - Resolves: RHEL-14649
    (CVE-2023-34058 open-vm-tools: SAML token signature bypass [rhel-8.10.0])
  - Resolves: RHEL-14683
    (CVE-2023-34059 open-vm-tools: file descriptor hijack vulnerability in the vmware-user-suid-wrapper [rhel-8.10.0])


author: Miroslav Rezanina <mrezanin@redhat.com> - 12.3.5-2
changelog:
  - ovt-Restart-tools-on-failure.patch [RHEL-17683]
  - Resolves: RHEL-17683
    (Add Restart=on-failure to vmtoolsd.service [rhel-8])


author: Tomasz Kłoczko <kloczek@fedoraproject.org> - 1.18.2-4
changelog:
  - remove support for no longer supported Fedora versions (<=25)
  - fix: add %{_libdir}/cmake/OpenAL directory to devel
  - fix: s/_datarootdir/_datadir/ as this package does not uses datarootdir
    but datadir
  - fix: add %{_datadir}/openal to main package as well and to %exclude
    %{_datadir}/openal/{alsoftrc.sample,presets/presets.txt} as those files
    are not needed
  - removed Group fields
    (https://fedoraproject.org/wiki/Packaging:Guidelines#Tags_and_Sections)
  - add use more macros (%autosetup, %make_build, %make_install)


author: Hans de Goede <hdegoede@redhat.com> - 1.18.2-5
changelog:
  - Allow pulseaudio to move openal-soft output streams (rhbz#1544381)
  - Fix release -4 not building (rhbz#1544012)
  - Drop unnecessary qt-devel BuildRequires (we also BuildRequire qt5-devel)


author: Nikola Forró <nforro@redhat.com> - 0.3.15-1
changelog:
  - Rebase to version 0.3.15
  - Use gcc-toolset-11 to benefit from POWER 10 optimizations
    resolves: #1983218


author: Nikola Forró <nforro@redhat.com> - 0.3.15-3
changelog:
  - Fix missing header files in openblas-devel subpackage by enabling
    gcc-toolset-11 in %install as well
    related: #1983218


author: Than Ngo <than@redhat.com> - 3.15.0-1
changelog:
  - Resolves: #1847433, rebase to 3.15.0 
  - Resolves: #1851105, PKCS #11 3.0 - baseline provider support
  - Resolves: #1851108, openCryptoki ep11 token: enhanced functionality
  - Resolves: #1851109, openCryptoki key management tool: key deletion function


author: Than Ngo <than@redhat.com> - 3.15.1-1
changelog:
  - Related: #1847433
    upstream fixes:
      - Free generated key in all error cases
      - CCA: Zeroize key buffer to avoid CCA 8/32 error
      - Do not delete the map-btree entry if destroying an object is not allowed
      - Remove now unused header timeb.h
      - TESTCASES: Use FIPS conforming keys for 3DES CBC-MAC test vectors
      - Fix buffer overrun in C_CopyObject
      - TPM: Fix double free in openssl_gen_key


author: Than Ngo <than@redhat.com> - 3.15.1-3
changelog:
  - Resolves: #1902022
     Fix compiling with c++
     Added error message handling for p11sak remove-key command


author: Than Ngo <than@redhat.com> - 3.16.0-1
changelog:
  - Resolves: #1919223, rebase to 3.16.0
  - Resolves: #1922195, Event Notification Support
  - Resolves: #1959936, Soft token does not check if an EC key is valid
  - Resolves: #1851104, import and export of secure key objects
  - Resolves: #1851106, openCryptoki ep11 token: protected key support
  - Resolves: #1851107, openCryptoki ep11 token: support attribute bound keys


author: Than Ngo <than@redhat.com> - 3.16.0-5
changelog:
  - Resolves: #1987256, pkcstok_migrate leaves options with multiple strings in opencryptoki.conf options without double-quotes


author: Than Ngo <than@redhat.com> - 3.18.0-1
changelog:
  - Resolves: #2043845, rebase to 3.18.0
  - Resolves: #2043854, add crypto counters
  - Resolves: #2043855, support crypto profiles


author: Than Ngo <than@redhat.com> - 3.18.0-3
changelog:
  - Related: #2043854, do not touch opencryptoki.conf if it is in place already and even if it is unchanged
  - Resolves: #2112785, EP11: Fix C_GetMechanismList returning CKR_BUFFER_TOO_SMALL


author: Than Ngo <than@redhat.com> - 3.19.0-1
changelog:
  - Resolves: #2126612, opencryptoki fails after generating > 500 RSA keys
  - Resolves: #2110315, rebase to 3.19.0
  - Resolves: #2110990, openCryptoki key generation with expected MKVP only on CCA and EP11 tokens
  - Resolves: #2110477, openCryptoki ep11 token: master key consistency
  - Resolves: #1984871, openCryptoki ep11 token: vendor specific key derivation


author: Than Ngo <than@redhat.com> - 3.21.0-1
changelog:
  - Resolves: #1984865, ep11 and cca: support concurrent HSM master key changes
  - Resolves: #2110500, ep11 token: PKCS #11 3.0 - support AES_XTS 
  - Resolves: #2111011, cca token: protected key support
  - Resolves: #2159697, update to 3.21.0
  - Resolves: #2159740, pkcsslotd hardening
  - Resolves: #2159741, p11sak support Dilithium and Kyber keys
  - Resolves: #2159742, ica and soft tokens: PKCS #11 3.0 - support AES_XTS


author: Than Ngo <than@redhat.com> - 3.21.0-2
changelog:
  - add missing /var/lib/opencryptoki/HSM_MK_CHANGE
  - disable unsupported sandbox options and add /run to ReadWritePaths to exclude
    /run directory from being made read-only on rhel8
  Related: #2159697


author: Than Ngo <than@redhat.com> - 3.21.0-3
changelog:
  - pkcsstats: Fix handling of user name
  - p11sak: Fix user confirmation prompt behavior when stdin is closed
  Related: #2159697


author: Than Ngo <than@redhat.com> - 3.21.0-7
changelog:
  - Resolves: #2222595, p11sak tool: slot option does not accept argument 0 for slot index 0
  - Resolves: #2222594, p11sak fails as soon as there reside non-key objects


author: Jiri Kucera <jkucera@redhat.com> - 3.4.6-2
changelog:
  - fix cmakes location
  - remove -DENABLE_PKG_CONFIG=OFF (it was neither defined nor used)
  - remove confusing comment
  - WITH_GDAL=OFF (gdal dependency has been already removed)
    Related: #1694647


author: Jiri Kucera <jkucera@redhat.com> - 3.4.6-5
changelog:
  - Move libopencv_{calib3d,cvv,hfs}.so.* to their proper packages
  - Fix issues found by rpmdiff
    Related: #1694647


author: Paul Wouters <pwouters@redhat.com> - 1.4.9-3
changelog:
  - Resolves: rbz#1303965 upgrade to opendnssec-1.4.9-1.fc23 breaks old installations
  - On initial install, after token init, also run ods-ksmutil setup


author: Paul Wouters <pwouters@redhat.com> - 1.4.14-1
changelog:
  - Update to 1.4.14 as first steop to migrating to 2.x
  - Resolves: rhbz#1413254 Move tmpfiles.d config to %{_tmpfilesdir}, install LICENSE as %license


author: Nikola Forró <nforro@redhat.com> - 2.4.0-1
changelog:
  - Rebase to 2.4.0
  - Resolves: CVE-2018-5727 (#1538467)
  - Resolves: CVE-2018-5785 (#1538556)
  - Resolves: CVE-2018-20845 (#1730679)
  - Resolves: CVE-2018-20847 (#1734337)
  - Resolves: CVE-2019-12973 (#1739076)
  - Resolves: CVE-2020-15389 (#1855115)
  - Resolves: CVE-2020-27814 (#1908965)
  - Resolves: CVE-2020-27823 (#1906222)
  - Resolves: CVE-2020-27824 (#1906216)
  - Resolves: CVE-2020-27842 (#1908165)
  - Resolves: CVE-2020-27843 (#1908164)
  - Resolves: CVE-2020-27845 (#1908168)


author: Matus Honek <mhonek@redhat.com> - 2.4.46-6
changelog:
  - Build with LDAP_USE_NON_BLOCKING_TLS (#1594928)
  - Remove unused leftover MozNSS Compat. Layer references (cont.) (#1557967)


author: Honggang Li <honli@redhat.com> - 4.1.1-2
changelog:
  - fbtl-posix: link to common_ompio
  - Require environment(modules)
  - Revert upstream commit c36d7459b6331c4da82
  - Resolves: rhbz#1974780, rhbz#1971771


author: Jakub Jelen <jjelen@redhat.com> - 0.19.0-2
changelog:
  - Avoid mismatching coolkey cards for muscle ones (#1588722)
  - Implement legacy CAC1 driver (#1638052)
  - Disable pinpad
  - Fixup verification after RSA-PSS implementation


author: Jakub Jelen <jjelen@redhat.com> - 0.19.0-3
changelog:
  - Unbreak the RSA-PSS mechanisms (#1595626)
  - Unbreak the signing using hashed mechanisms in CardOS and others (#1644338)


author: Jakub Jelen <jjelen@redhat.com> - 0.19.0-4
changelog:
  - Unbreak the Dual CAC cards in PIV driver (#1651748)
  - Fix few more corner cases for handling different types of padding (#1595626)
  - Unbreak signature verification in pkcs11-tool (#1651748)


author: Jakub Jelen <jjelen@redhat.com> - 0.19.0-6
changelog:
  - Add support for Gemalto IDPrime smart cards (#1657970)
  - Fix 2k RSA key operations with Coolkey (#1766712)


author: Jakub Jelen <jjelen@redhat.com> - 0.20.0-3
changelog:
  - Support PIN change for HID Alt tokens (#1830901)
  - Fix CVE-2020-26570, CVE-2020-26571 and CVE-2020-26572
  - Fix right padding of token labels of some cards (#1877973)


author: Jakub Jelen <jjelen@redhat.com> - 0.20.0-5
changelog:
  - Avoid potential crash because of missing list terminator (#2196234)
  - Fix CVE-2023-2977: potential buffer overrun in pkcs15 cardos_have_verifyrc_package (#2211093)
  - Backport upstream changes regarding to reader removal (#2097048)


author: Evgeny Kolesnikov <ekolesni@redhat.com> - 1.3.3-1
changelog:
  - Upgrade to the latest upstream release (rhbz#1829761)
  - Added a Python script that can be used for CLI tailoring (autotailor)
  - Added timezone to XCCDF TestResult start/end time
  - Added yamlfilecontent independent probe (proposal/draft implementation)
  - Added ability to generate `machineconfig` fix
  - Introduced `urn:xccdf:fix:script:kubernetes` fix type in XCCDF
  - Fixed filepath pattern matching in offline mode in textfilecontent58 probe
  - Fixed #170: The rpmverifyfile probe can't verify files from '/bin' directory
  - Fixed #1512: Severity refinement lost in generated guide
  - Fixed #1453: Pointer lost in Swig API
  - The data system_info probe return for offline and online modes is consistent and actual
  - Evaluation Characteristics of the XCCDF report are now consistent with OVAL entities
    from system_info probe


author: Evgenii Kolesnikov <ekolesni@redhat.com> - 1.3.4-1
changelog:
  - Upgrade to the latest upstream release (RHBZ#1887794)
  - Treat GPFS as a remote file system (RHBZ#1840578, RHBZ#1840579)
  - Fixed the most problematic memory issues that were causing OOM situations
    for systems with large amount of files (RHBZ#1824152)
  - Proper handling of OVALs with circular dependencies between definitions (RHBZ#1812476)


author: Evgenii Kolesnikov <ekolesni@redhat.com> - 1.3.5-1
changelog:
  - Upgrade to the latest upstream release (RHBZ#1953092)
  - Fix segfault when using --stig-viewer option and latest XML file from DoD (RHBZ#1912000)
  - Improve doc about --stig-viewer (RHBZ#1918759)
  - Backport an upstream patch adding CentOS CPE (RHBZ#1907935)


author: Evgenii Kolesnikov <ekolesni@redhat.com> - 1.3.5-3
changelog:
  - Waive known issue with hugepages in upstream testsuite (RHBZ#1912000)
  - Fix issues reported by the coverity scan
  - Introduce OSBuild 'blueprint' fix type


author: Jan Černý <jcerny@redhat.com> - 1.3.5-8
changelog:
  - Allow local DS components (rhbz#1970529)
  - Fix hostname detection in offline scan of UBI 9 images (rhbz#1893888)
  - Add an alternative source of hostname (rhbz#1977668)
  - Fix oscap-chroot errors in process58_probe caused by empty /proc (rhbz#2008922)


author: Jan Černý <jcerny@redhat.com> - 1.3.5-9
changelog:
  - Lower memory limits and improve their checking (rhbz#2021851)
  - Remove timestamp from the user manual (rhbz#2022364)


author: Evgenii Kolesnikov <ekolesni@redhat.com> - 1.3.3-6
changelog:
  - Enable profile composition with a specific platform (RHBZ#1896676)
  - Enable YAML probe to work with sets of values (RHBZ#1895715)


author: Jan Černý <jcerny@redhat.com> - 1.3.6-1
changelog:
  - Upgrade to the latest upstream release (rhbz#2041781)
  - Select and exclude groups of rules on the command line
  - The boot-time remediation service for systemd's Offline Update mode


author: Jan Černý <jcerny@redhat.com> - 1.3.6-4
changelog:
  - Fix potential invalid scan results in OpenSCAP (rhbz#2111040)
  - Remove oscap-remediate service (rhbz#2111360)


author: Jan Černý <jcerny@redhat.com> - 1.3.7-1
changelog:
  - Upgrade to the latest upstream release (rhbz#2159290)
  - Fix error when processing OVAL filters (rhbz#2126882)
  - Don't emit xmlfilecontent items if XPath doesn't match (rhbz#2139060)


author: Evgenii Kolesnikov <ekolesni@redhat.com> - 1.3.8-1
changelog:
  - Upgrade to the latest upstream release (rhbz#2217441)
  - Add offline support for sysctl probe (rhbz#2185791)
  - Fix systemd* probes unit enumeration (rhbz#2219533)


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.0.0-15
changelog:
  - Removed dependency on net-tools
    Resolves: #1496138
  - Removed init script, Group tag and macro from changelog in spec file
  - Slightly modified openssl-1.1 fix to be able build the package
    with OpenSSL version lower than 1.1


author: Jakub Jelen <jjelen@redhat.com> - 8.0p1-3 + 0.10.3-7
changelog:
  - Fix typos in manual pages (#1668325)
  - Use the upstream support for PKCS#8 PEM files alongside with the legacy PEM files (#1712436)
  - Unbreak ssh-keygen -A in FIPS mode (#1732424)
  - Add missing RSA certificate types to offered hostkey types in FIPS mode (#1732449)


author: Jakub Jelen <jjelen@redhat.com> - 8.0p1-5 + 0.10.3-7
changelog:
  - Do not print "no slots" warning by default (#1744220)
  - Unbreak connecting using gssapi through proxy commands (#1749862)
  - Document in manual pages that CASignatureAlgorithms are handled by crypto policies (#1790604)
  - Use SHA2-based signature algorithms by default for signing certificates (#1790610)
  - Prevent simple ProxyJump loops in configuration files (#1804099)
  - Teach ssh-keyscan to use SHA2 RSA variants (#1744108)
  - Do not fail hard if getrandom() is not available and no SSH_USE_STRONG_RNG is specified (#1812120)
  - Improve wording of crypto policies references in manual pages (#1812854)
  - Do not break X11 forwarding if IPv6 is disabled (#1662189)
  - Enable SHA2-based GSSAPI key exchange algorithms by default (#1816226)
  - Mark RDomain server configuration option unsupported in RHEL (#1807686)
  - Clarify crypto policies defaults in manual pages (#1724195)
  - Mention RSA SHA2 variants in ssh-keygen manual page (#1665900)


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.0p1-7 + 0.10.3-7
changelog:
  - SFTP sort upon the modification time (#1909988)
  - ssh-keygen printing fingerprint issue with Windows keys (#1901518)
  - PIN is lost when iterating over tokens when adding pkcs11 keys to ssh-agent (#1843372)
  - ssh-agent segfaults during ssh-add -s pkcs11 (#1868996)
  - ssh-copy-id could not resolve ipv6 address ends with colon (#1933517)
  - sshd provides PAM an incorrect error code (#1879503)


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.0p1-9
changelog:
  - CVE-2020-14145 openssh: Observable Discrepancy leading to an information
    leak in the algorithm negotiation (#1882252)
  - Hostbased ssh authentication fails if session ID contains a '/' (#1944125)


author: Zoltan Fridrich <zfridric@redhat.com> - 8.0p1-14
changelog:
  - Upstream: add a local implementation of BSD realpath() for sftp-server (#2064249)
  - Change product name from Fedora to RHEL in openssh-7.8p1-UsePAM-warning.patch (#1953807)
  - Include caveat for crypto-policy in sshd manpage (#2044354)
  - Change log level of FIPS specific log message to verbose (#2050511)
  - Clarify force_file_perms (-m) documentation in sftp-server manpage (#1862504)
  - Minimize the use of SHA1 as a proof of possession for RSA key (#2093897)


author: Dmitry Belyavskiy - 8.0p1-17
changelog:
  - Fix parsing of IPv6 IPs in sftp client (#2151334)
  - Avoid ssh banner one-byte overflow (#2138344)
  - Avoid crash of sshd when Include folder does not exist (#2133087)


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.0p1-20
changelog:
  - Limit artificial delays in sshd while login using AD user
    Resolves: RHEL-1684
  - Add comment to OpenSSH server config about FIPS-incompatible key
    Resolves: RHEL-5221
  - Avoid killing all processes on system in case of race condition
    Resolves: RHEL-11548
  - Avoid sshd_config 256K limit
    Resolves: RHEL-5279
  - Using DigestSign/DigestVerify functions for better FIPS compatibility
    Resolves: RHEL-5217
  - Fix GSS KEX causing ssh failures when connecting to WinSSHD
    Resolves: RHEL-5321


author: Jakub Jelen <jjelen@redhat.com> - 7.7p1-6 + 0.10.3-4
changelog:
  - Fix listing of kex algoritms in FIPS mode
  - Allow aes-gcm cipher modes in FIPS mode
  - Coverity fixes


author: Jakub Jelen <jjelen@redhat.com> - 7.8p1-2 + 0.10.3-5
changelog:
  - New upstream release fixing CVE 2018-15473
  - Remove unused patches
  - Remove reference to unused enviornment variable SSH_USE_STRONG_RNG
  - Address coverity issues
  - Unbreak scp between two IPv6 hosts (#1620333)
  - Unbreak GSSAPI key exchange (#1624323)
  - Unbreak rekeying with GSSAPI key exchange (#1624344)


author: Jakub Jelen <jjelen@redhat.com> - 7.8p1-3 + 0.10.3-5
changelog:
  - Disable OpenSSH hardening flags and use the ones provided by system (#1630615)
  - Ignore unknown parts of PKCS#11 URI (#1631478)
  - Do not fail with GSSAPI enabled in match blocks (#1580017)
  - Fix the segfaulting cavs test (#1629692)


author: Jakub Jelen <jjelen@redhat.com> - 7.8p1-4 + 0.10.3-5
changelog:
  - Unbreak PKCS#11 URI tests (#1648262)
  - Allow to disable RSA signatures with SHA1 (#1648898)
  - Dump missing GSS options from client configuration (#1649505)
  - Minor fixes from Fedora related to GSSAPI and keberos
  - Follow the system-wide PATH settings


author: Jakub Jelen <jjelen@redhat.com> - 8.0p1-1 + 0.10.3-7
changelog:
  - New upstream release (#1691045)
  - Remove support for unused VendorPatchLevel configuration option
  - Fix kerberos cleanup procedures (#1683295)
  - Do not negotiate arbitrary primes with DH GEX in FIPS (#1685096)
  - Several GSSAPI key exchange improvements and sync with Debian
  - Allow to use labels in PKCS#11 URIs even if they do not match on private key (#1671262)
  - Do not fall back to sshd_net_t SELinux context (#1678695)
  - Use FIPS compliant high-level signature OpenSSL API and KDF
  - Mention crypto-policies in manual pages
  - Do not fail if non-FIPS approved algorithm is enabled in FIPS
  - Generate the PEM files in new PKCS#8 format without the need of MD5 (#1712436)


author: Jakub Jelen <jjelen@redhat.com> - 8.0p1-2 + 0.10.3-7
changelog:
  - Allow specifying a pin-value in PKCS #11 URI in ssh-add (#1639698)
  - Whitelist another syscall variant for s390x cryptographic module (ibmca engine) (#1714915)


author: Tomáš Mráz <tmraz@redhat.com> 1.1.1g-7
changelog:
  - Disallow dropping Extended Master Secret extension
    on renegotiation
  - Return alert from s_server if ALPN protocol does not match
  - SHA1 is allowed in @SECLEVEL=2 only if allowed by
    TLS SigAlgs configuration


author: Tomáš Mráz <tmraz@redhat.com> 1.1.1g-9
changelog:
  - Rewire FIPS_drbg API to use the RAND_DRBG
  - Use the well known DH groups in TLS even for 2048 and 1024 bit parameters


author: Tomáš Mráz <tmraz@redhat.com> 1.1.1g-11.1
changelog:
  - Implemented new FIPS requirements in regards to KDF and DH selftests
  - Disallow certificates with explicit EC parameters


author: Sahana Prasad <sahana@redhat.com> 1.1.1g-14
changelog:
  - Fix CVE-2021-3450 openssl: CA certificate check bypass with
    X509_V_FLAG_X509_STRICT
  - Fix CVE-2021-3449 NULL pointer deref in signature_algorithms processing


author: Daiki Ueno <dueno@redhat.com> 1.1.1g-16
changelog:
  - Use AI_ADDRCONFIG only when explicit host name is given
  - Allow only curves defined in RFC 8446 in TLS 1.3


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.1.1k-2
changelog:
  - Fixes FIPS_selftest to work in FIPS mode. Resolves: rhbz#1940085
  - Using safe primes for FIPS DH self-test


author: Sahana Prasad <sahana@redhat.com> - 1:1.1.1k-4
changelog:
  - Fixes bugs in s390x AES code.
  - Uses the first detected address family if IPv6 is not available
  - Reverts the changes in https://github.com/openssl/openssl/pull/13305
    as it introduces a regression if server has a DSA key pair, the handshake fails
    when the protocol is not explicitly set to TLS 1.2. However, if the patch is reverted,
    it has an effect on the "ssl_reject_handshake" feature in nginx. Although, this feature
    will continue to work, TLS 1.3 protocol becomes unavailable/disabled. This is already
    known - https://trac.nginx.org/nginx/ticket/2071#comment:1
    As per https://github.com/openssl/openssl/issues/16075#issuecomment-879939938, nginx
    could early callback instead of servername callback.
  - Resolves: rhbz#1978214
  - Related: rhbz#1934534


author: Sahana Prasad <sahana@redhat.com> - 1:1.1.1k-5
changelog:
  - Fixes CVE-2021-3712 openssl: Read buffer overruns processing ASN.1 strings
  - Resolves: rhbz#2005402


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-6
changelog:
  - Fixes CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  - Resolves: rhbz#2067146


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-7
changelog:
  - Fix CVE-2022-2097: AES OCB fails to encrypt some bytes on 32-bit x86
    Resolves: CVE-2022-2097
  - Update expired certificates used in the testsuite
    Resolves: rhbz#2092462
  - Fix CVE-2022-1292: openssl: c_rehash script allows command injection
    Resolves: rhbz#2090372
  - Fix CVE-2022-2068: the c_rehash script allows command injection
    Resolves: rhbz#2098279


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.1.1k-9
changelog:
  - Fixed Timing Oracle in RSA Decryption
    Resolves: CVE-2022-4304
  - Fixed Double free after calling PEM_read_bio_ex
    Resolves: CVE-2022-4450
  - Fixed Use-after-free following BIO_new_NDEF
    Resolves: CVE-2023-0215
  - Fixed X.400 address type confusion in X.509 GeneralName
    Resolves: CVE-2023-0286


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-10
changelog:
  - Fix CVE-2023-3446: Excessive time spent checking DH keys and parameters
    Resolves: RHEL-14245
  - Fix CVE-2023-3817: Excessive time spent checking DH q parameter value
    Resolves: RHEL-14239


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-11
changelog:
  - Fix CVE-2023-5678: Generating excessively long X9.42 DH keys or checking
    excessively long X9.42 DH keys or parameters may be very slow
    Resolves: RHEL-16538


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-6
changelog:
  - Fixes CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  - Resolves: rhbz#2067144


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-6
changelog:
  - Fixes CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  - Resolves: rhbz#2067145


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-7
changelog:
  - Fix CVE-2022-2097: AES OCB fails to encrypt some bytes on 32-bit x86
    Resolves: CVE-2022-2097
  - Update expired certificates used in the testsuite
    Resolves: rhbz#2100554
  - Fix CVE-2022-1292: openssl: c_rehash script allows command injection
    Resolves: rhbz#2090371
  - Fix CVE-2022-2068: the c_rehash script allows command injection
    Resolves: rhbz#2098278


author: Anderson Sasaki <ansasaki@redhat.com> - 0.4.8-1
changelog:
  - Update to 0.4.8-1
  - RSA key generation on the token
  - RSA-OAEP and RSA-PKCS encryption support
  - RSA-PSS signature support
  - Support for OpenSSL 1.1.1 beta
  - Removed support for OpenSSL 0.9.8
  - Various bug fixes and enhancements


author: Anderson Sasaki <ansasaki@redhat.com> - 0.4.8-2
changelog:
  - Require OpenSSL >= 1.0.2
  - Fixed missing declaration of ERR_get_CKR_code()
  - Add support to use EC keys and tests (#1625338)
  - Exposed check_fork() API
  - Fixed memory leak of RSA objects in pkcs11_store_key()
  - Updated OpenSSL license in eng_front.c
  - Fixed build for old C dialects
  - Allow engine to use private key without PIN
  - Require DEBUG to be defined to print debug messages
  - Changed package description


author: Anderson Sasaki <ansasaki@redhat.com> - 0.4.10-1
changelog:
  - Update to 0.4.10 (#1745082)
  - Add BuildRequires for OpenSSL >= 1.0.2, required for testing
  - Print tests logs if failed during build
  - Small bug fixes such as removal of unused variable
  - Search objects in all matching tokens (#1705505)


author: Neal Gompa <ngompa13@gmail.com> - 1.74-1
changelog:
  - Update to upstream version 1.74
  - Drop merged patches
  - Rediff remaining patches
  - Move newns to /usr/libexec/os-prober (debuginfo generation works)
  - Mark copyright file as license file


author: Peter Jones <pjones@redhat.com> - 1.74-7
changelog:
  - Make gcc use -Wl,-z,now -Wl,-z,relro -pie.  Dunno why the default didn't
    pick this up.
    Resolves: rhbz#1624158


author: Ondrej Budai <obudai@redhat.com> - 17-1
changelog:
  - New upstream release 17 (rhbz#1831653)
  - Obsolete lorax-composer in favor of osbuild-composer (rhbz#1836844)


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.5.0-2
changelog:
  - Resolves: rhbz#1681879 - osinfo-db-tools changes blocked until gating
                             tests are added


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.5.0-3
changelog:
  - Resolves: rhbz#1712426 - New defects found in
                             osinfo-db-tools-1.5.0-2.el8


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.5.0-4
changelog:
  - Related: rhbz#1712426 - New defects found in
                            osinfo-db-tools-1.5.0-2.el8


author: Colin Walters <walters@verbum.org> - 2020.4-1
changelog:
  - https://github.com/ostreedev/ostree/releases/tag/v2020.4
  - We plan to use per-object-fsync for etcd in OpenShift 4
  - Resolves: #1861507


author: Colin Walters <walters@verbum.org> - 2020.5-2
changelog:
  - Update to https://github.com/ostreedev/ostree/releases/tag/v2020.5
    Specifically to fix readonly-sysroot for e.g. RHEL Edge and
    older RHCOS versions
  - Related: #1861507


author: Colin Walters <walters@verbum.org> - 2020.5-3
changelog:
  - Backport
    https://github.com/ostreedev/ostree/pull/2179/commits/06ed04a816141914adb9bd3e32392801fce5bc8e
    Resolves: #1867601


author: Luca BRUNO <lucab@redhat.com> - 2021.3-1
changelog:
  - New upstream version
    https://github.com/ostreedev/ostree/releases/tag/v2021.3
    Resolves: rhbz#1981865


author: Colin Walters <walters@verbum.org> - 2021.3-2
changelog:
  - Backport
    https://github.com/ostreedev/ostree/pull/2453/commits/e6a560b40797324aa8b90e7100c6d50bff91f14d
    Resolves: rhbz#2027788


author: Luca BRUNO <lucab@redhat.com> - 2022.2-5
changelog:
  - Backport enablement patches for Secure Execution on s390x
    https://github.com/ostreedev/ostree/pull/2694
    Resolves: rhbz#2120522
  - Backport security fix to verify signatures are minimum length (advisory GHSA-gqf4-p3gv-g8vw)
    https://github.com/ostreedev/ostree/pull/2696
    Resolves: rhbz#2119444


author: Colin Walters <walters@verbum.org> - 2022.2-6
changelog:
  - Backport https://github.com/ostreedev/ostree/commit/0085494e350c72599fc5c0e00422885d80b3c660
  - Resolves: rhbz#2134629


author: Joseph Marrero <jmarrero@fedoraproject.org> - 2022.2-8
changelog:
  - Backport for https://github.com/ostreedev/ostree/commit/7f70614a1ac1950ebde3df0e26cc9ab1d72b2f1f
  - Resolves: rhbz#2229895


author: Daiki Ueno <dueno@redhat.com> - 0.23.21-4
changelog:
  - Fix realloc usage on proxy cleanup (#1894979)
  - Make 'trust anchor --store' preserve all attributes from .p11-kit files


author: Daiki Ueno <dueno@redhat.com> - 0.23.22-1
changelog:
  - Rebase to 0.23.22 to fix memory safety issues (CVE-2020-29361, CVE-2020-29362, and CVE-2020-29363)
  - Preserve DT_NEEDED information from the previous version, flagged by rpmdiff
  - Add xsltproc to BR


author: Ken Gaillot <kgaillot@redhat.com> - 2.0.5-1
changelog:
  - crm_mon --resource option to filter output by resource
  - Avoid filling /dev/shm after frequent corosync errors
  - Allow configurable permissions for log files
  - Ensure ACL write permission always supersedes read
  - Use fence device monitor timeout for starts and probes
  - Allow type="integer" in rule expressions
  - Avoid error messages when running crm_node inside bundles
  - Avoid situation where promotion is not scheduled until next transition
  - crm_mon should show more clearly when an entire group is disabled
  - Rebase on upstream 2.0.5-rc1 release
  - Resolves: rhbz1300597
  - Resolves: rhbz1614166
  - Resolves: rhbz1647136
  - Resolves: rhbz1833173
  - Resolves: rhbz1856015
  - Resolves: rhbz1866573
  - Resolves: rhbz1874391
  - Resolves: rhbz1835717
  - Resolves: rhbz1748139
  - Resolves: rhbz1885645


author: Ken Gaillot <kgaillot@redhat.com> - 2.0.5-2
changelog:
  - Rebase on upstream 2.0.5-rc2 release
  - Prevent ACL bypass (CVE-2020-25654)
  - Resolves: rhbz1885645
  - Resolves: rhbz1889582


author: Klaus Wenninger <kwenning@redhat.com> - 2.0.5-4
changelog:
  - Rebase on upstream 2.0.5 release
  - Make waiting to be pinged by sbd via pacemakerd-api the default
  - Resolves: rhbz1885645
  - Resolves: rhbz1873138


author: Ken Gaillot <kgaillot@redhat.com> - 2.0.5-5
changelog:
  - Allow non-critical resources that stop rather than make another resource move
  - Support crm_resource --digests option for showing operation digests
  - Clean-up of all resources should work from remote nodes
  - Resolves: rhbz1371576
  - Resolves: rhbz1872376
  - Resolves: rhbz1907726


author: Ken Gaillot <kgaillot@redhat.com> - 2.0.5-6
changelog:
  - crm_mon --daemonize should reconnect if cluster restarts
  - crm_mon should show more informative messages when cluster is starting
  - crm_mon should show rest of status if fencing history is unavailable
  - cibsecret now works on remote nodes (as long as name can be reached via ssh)
  - Stop remote nodes correctly when connection history is later than node history
  - Resolves: rhbz1466875
  - Resolves: rhbz1872490
  - Resolves: rhbz1880426
  - Resolves: rhbz1881537
  - Resolves: rhbz1898457


author: Ken Gaillot <kgaillot@redhat.com> - 2.0.5-9.1
changelog:
  - Fix regression in crm_mon during cluster shutdown that affects ocf:heartbeat:pgsql agent
  - Resolves: rhbz1951098


author: Ken Gaillot <kgaillot@redhat.com> - 2.1.0-1
changelog:
  - Add crm_simulate --show-attrs and --show-failcounts options
  - Retry getting fence agent meta-data after initial failure
  - Add debug option for more verbose ocf:pacemaker:ping logs
  - Rebase on upstream 2.1.0-rc2 release
  - Support OCF Resource Agent API 1.1 standard
  - Fix crm_mon regression that could cause certain agents to fail at shutdown
  - Allow setting OCF check level for crm_resource --validate and --force-check
  - Resolves: rhbz1686426
  - Resolves: rhbz1797579
  - Resolves: rhbz1843177
  - Resolves: rhbz1935464
  - Resolves: rhbz1936696
  - Resolves: rhbz1948620
  - Resolves: rhbz1955792


author: Ken Gaillot <kgaillot@redhat.com> - 2.1.0-2
changelog:
  - Rebase on upstream 2.1.0 final release
  - Correct schema for crm_resource XML output
  - Resolves: rhbz1935464
  - Resolves: rhbz1967087


author: Ken Gaillot <kgaillot@redhat.com> - 2.1.0-3
changelog:
  - crm_resource now supports XML output from resource agent actions
  - Correct output for crm_simulate --show-failcounts
  - Avoid remote node unfencing loop
  - Resolves: rhbz1644628
  - Resolves: rhbz1686426
  - Resolves: rhbz1961857


author: Ken Gaillot <kgaillot@redhat.com> - 2.1.0-4
changelog:
  - Show better error messages in crm_resource with invalid resource types
  - Avoid selecting wrong device when dynamic-list fencing is used with host map
  - Do not schedule probes of unmanaged resources on pending nodes
  - Fix regressions in crm_attribute and crm_master argument handling
  - Resolves: rhbz1447918
  - Resolves: rhbz1978010
  - Resolves: rhbz1982453
  - Resolves: rhbz1984120


author: Ken Gaillot <kgaillot@redhat.com> - 2.1.0-6
changelog:
  - Fix watchdog agent version information
  - Ensure transient attributes are cleared when multiple nodes are lost
  - Resolves: rhbz1443666
  - Resolves: rhbz1986998


author: Ken Gaillot <kgaillot@redhat.com> - 2.1.2-1
changelog:
  - Allow per-host fence delays for a single fence device
  - Use OCF 1.1 enum type in cluster option metadata for better validation
  - crm-resource --force-* now works with LSB resources
  - Allow spaces in pcmk_host_map
  - ACL group names are no longer restricted to a unique XML id
  - Rebase on upstream 2.1.2
  - Ensure upgrades get compatible Corosync libraries
  - Resolves: rhbz1082146
  - Resolves: rhbz1281463
  - Resolves: rhbz1346014
  - Resolves: rhbz1376538
  - Resolves: rhbz1384420
  - Resolves: rhbz2011973
  - Resolves: rhbz2027006


author: Ken Gaillot <kgaillot@redhat.com> - 2.1.2-2
changelog:
  - Correctly get metadata for systemd agent names that end in '@'
  - Use correct OCF 1.1 syntax in ocf:pacemaker:Stateful meta-data
  - Fix regression in displayed times in crm_mon's fence history
  - Resolves: rhbz2003151
  - Resolves: rhbz2027370
  - Resolves: rhbz2032027


author: Ken Gaillot <kgaillot@redhat.com> - 2.1.2-3
changelog:
  - Improve display of failed actions
  - Handle certain probe failures as stopped instead of failed
  - Update pcmk_delay_base description in option meta-data
  - Avoid crash when using clone notifications
  - Retry Corosync shutdown tracking if first attempt fails
  - Resolves: rhbz1470834
  - Resolves: rhbz1506372
  - Resolves: rhbz2027370
  - Resolves: rhbz2039675
  - Resolves: rhbz2042550


author: Ken Gaillot <kgaillot@redhat.com> - 2.1.3-1
changelog:
  - crm_resource --restart fails to restart clone instances except instance 0
  - Add new multiple-active option for "stop unexpected instances"
  - Unable to show metadata for "service" agents with "@" and "." in the name
  - Resource ocf:pacemaker:attribute does not comply with the OCF 1.1 standard
  - Allow resource meta-attribute to exempt resource from node health restrictions
  - Show node health states in crm_mon
  - Rebase pacemaker on upstream 2.1.3-rc2 release
  - crm_mon API result does not validate against schema if fence event has exit-reason
  - Resolves: rhbz1930578
  - Resolves: rhbz2036815
  - Resolves: rhbz2045096
  - Resolves: rhbz2049722
  - Resolves: rhbz2059638
  - Resolves: rhbz2065812
  - Resolves: rhbz2072107
  - Resolves: rhbz2086230


author: Ken Gaillot <kgaillot@redhat.com> - 2.1.3-2
changelog:
  - crm_attribute works on remote node command line when hostname differs
  - Rebase pacemaker on upstream 2.1.3 final release
  - Resolves: rhbz1384172
  - Resolves: rhbz2072107


author: Ken Gaillot <kgaillot@redhat.com> - 2.1.4-1
changelog:
  - Fencer should not ignore CIB updates when stonith is disabled
  - Rebase pacemaker on upstream 2.1.4 final release
  - Fix typo in ocf:pacemaker:HealthSMART meta-data
  - Resolves: rhbz2055935
  - Resolves: rhbz2072107
  - Resolves: rhbz2094855


author: Ken Gaillot <kgaillot@redhat.com> - 2.1.4-4
changelog:
  - Ensure all nodes are re-unfenced after device configuration change
  - crm_resource --why now checks node health status
  - Resolves: rhbz1872483
  - Resolves: rhbz2065818


author: Chris Lumens <clumens@redhat.com> - 2.1.5-1
changelog:
  - Rebase on upstream 2.1.5-rc2 release
  - Resolves: rhbz1822125
  - Resolves: rhbz2095662
  - Resolves: rhbz2121852
  - Resolves: rhbz2122806
  - Resolves: rhbz2133497
  - Resolves: rhbz2142681


author: Chris Lumens <clumens@redhat.com> - 2.1.5-4
changelog:
  - Rebase pacemaker on upstream 2.1.5 final release
  - Add support for sync points to attribute daemon
  - Resolves: rhbz1463033
  - Resolves: rhbz1866578
  - Resolves: rhbz2122352


author: Chris Lumens <clumens@redhat.com> - 2.1.5-6
changelog:
  - Backport fix for migration history cleanup causing resource recovery
  - Backport fix for SIGABRT during pacemaker-fenced shutdown
  - Resolves: rhbz2166388
  - Resolves: rhbz2168249


author: Chris Lumens <clumens@redhat.com> - 2.1.5-7
changelog:
  - Additional fixes for SIGABRT during pacemaker-fenced shutdown
  - Backport fix for attrd_updater -QA not displaying all nodes
  - Related: rhbz2168249
  - Resolves: rhbz2168675


author: Chris Lumens <clumens@redhat.com> - 2.1.5-8
changelog:
  - Rebuild with new release due to build system problems
  - Related: rhbz2168249
  - Related: rhbz2168675


author: Chris Lumens <clumens@redhat.com> - 2.1.6-1
changelog:
  - Rebase pacemaker on upstream 2.1.6 final release
  - Resolves: rhbz1578820
  - Resolves: rhbz1632951
  - Resolves: rhbz1876173
  - Resolves: rhbz2010084
  - Resolves: rhbz2030869
  - Resolves: rhbz2078611
  - Resolves: rhbz2106642
  - Resolves: rhbz2160206
  - Resolves: rhbz2168633


author: Chris Lumens <clumens@redhat.com> - 2.1.6-3
changelog:
  - Fix moving groups when there's a constraint for a single group member
  - Resolves: rhbz2218232
  - Resolves: rhbz2189300


author: Chris Lumens <clumens@redhat.com> - 2.1.6-4
changelog:
  - Clone instances should not shuffle unnecessarily
  - Fix a bug in clone resource description display
  - Resolves: rhbz1931023
  - Resolves: rhbz1688149
  - Related: rhbz2106642
  - Related: rhbz2189300


author: Chris Lumens <clumens@redhat.com> - 2.1.6-5
changelog:
  - Apply dampening when creating attributes with attrd_updater -U
  - Resolves: rhbz2224046
  - Related: rhbz2189300


author: Tomáš Mráz <tmraz@redhat.com> 1.3.1-5
changelog:
  - pam_faillock: Support configuration file /etc/security/faillock.conf
  - pam_faillock: Support local_users_only option
  - pam_namespace: Support noexec, nosuid and nodev flags for tmpfs mounts
  - Drop tallylog and pam_tally[2] documentation
  - pam_lastlog: Do not display failed attempts with PAM_SILENT flag
  - pam_lastlog: Support unlimited option to override fsize limit
  - pam_unix: Log if user authenticated without password
  - pam_tty_audit: Improve manual page
  - Optimize closing fds when spawning helpers
  - Fix duplicate password verification in pam_authtok_verify()


author: Iker Pedrosa <ipedrosa@redhat.com> 1.3.1-9
changelog:
  - pam_usertype: new module to tell if uid is in login.defs ranges (#1810474)
  - pam_tty_audit: if kernel audit is disabled return PAM_IGNORE (#1775357)


author: Peter Robinson <pbrobinson@redhat.com> - 1.3.1-12
changelog:
  - Add the motd.d directories (empty) to silence warnings and to
    provide proper ownership for them (#1847501)


author: Iker Pedrosa <ipedrosa@redhat.com> 1.3.1-13
changelog:
  - pam_wheel: if getlogin fails fallback to PAM_RUSER: fixed malformed patch (#1866866)
  - pam_namespace: polyinstantiation refer to gdm doc (#1861841)


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.3.1-17
changelog:
  - pam_keyinit: thread-safe implementation. Resolves: #1997969
  - pam_motd: support multiple motd paths specified, with filename overrides. Resolves: #2014458


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.3.1-19
changelog:
  - Add the motd.d directories (empty) to silence warnings and to
    provide proper ownership for them. Resolves: #2014458


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.3.1-25
changelog:
  - pam_motd: avoid unnecessary logging. Resolves: #2091062
  - pam_lastlog: check localtime_r() return value. Resolves: #2012871
  - pam_faillock: clarify missing user faillock files after reboot. Resolves: #2062512
  - pam_faillock: avoid logging an erroneous consecutive login failure message. Resolves: #2082442


