# changelog

author: Iryna Shcherbina <ishcherb@redhat.com> - 0.77.0-2
changelog:
  - Update Python 2 dependency declarations to new packaging standards
    (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)


author: Jan Pokorný <jpokorny+rpm-clufter@fedoraproject.org> - 0.77.1-1
changelog:
  - drop no longer favoured Group tag
  - replace unqualified python invocations with explicit python3
  - bump upstream package, see https://pagure.io/clufter/releases


author: Jan Pokorný <jpokorny+rpm-clufter@fedoraproject.org> - 0.77.1-2
changelog:
  - stop creating Python 2 packages by default (nothing in Fedora uses it)
  - fix a previously omitted unqualified python invocation


author: Jan Pokorný <jpokorny+rpm-clufter@fedoraproject.org> - 0.77.1-3
changelog:
  - fix previously omitted unqualified python invocations, drop no longer
    needed byte-compilation products through a full grip on such a process,
    and also use -I switch to python3 instead of possibly weaker -Es


author: Jan Pokorný <jpokorny+rpm-clufter@fedoraproject.org> - 0.77.1-4
changelog:
  - fix missing explicit BuildRequires to ensure environment for compiling
    C code per the guidelines, and to fix FTBFS: rhbz#1603658
    (contributed by Igor Gnatenko <ignatenkobrain@fedoraproject.org>)
  - fix a thinko in py_byte_compile space-contained argument passing
    (https://github.com/rpm-software-management/rpm/issues/222#issuecomment-410026431)
  - fix a violation of "unversioned docdirs" guideline
    (https://fedoraproject.org//wiki/Changes/UnversionedDocdirs)
    Resolves: rhbz#1638027


author: Pavel Cahyna <pcahyna@redhat.com> - 2.18.1-2
changelog:
  - Fix build when apr-util does not pull in apr-util-bdb, adapt the existing Fedora condition.
    Problem caused by changes in #1633973 and #1491151.
  - Fix builds without docs and without cvs and/or p4 (from skisela)
  - Fix smart-http test due to changes in cookie sort order in curl-7.61.1


author: Pavel Cahyna <pcahyna@redhat.com> - 2.18.1-3
changelog:
  - apply upstream run-command PATH fix (CVE-2018-19486)
  - config: document value 2 for protocol.version (upstream patch)


author: Ondrej Pohorelsky <opohorel@redhat.com> - 2.18.2-1
changelog:
  - Update to release 2.18.2
  - Remote code execution in recursive clones with nested submodules
    Resolves: CVE-2019-1387
  - Fixes CVE-2019-1348, CVE-2019-1349, CVE-2019-1350, CVE-2019-1351,	
    CVE-2019-1352, CVE-2019-1353, CVE-2019-1354


author: Miroslav Lisik <mlisik@redhat.com> - 0.10.4-5
changelog:
  - Fixed link to sbd man page from `sbd enable` doc
  - Fixed safe-disabling clones, groups, bundles
  - Fixed sinatra wrapper performance issue
  - Fixed detecting fence history support
  - Fixed cookie options
  - Updated hint for 'resource create ... master'
  - Updated gating tests execution, smoke tests run from upstream sources
  - Resolves: rhbz#1750427 rhbz#1781303 rhbz#1783106 rhbz#1793574


author: Miroslav Lisik <mlisik@redhat.com> - 0.10.6-1
changelog:
  - Rebased to latest upstream sources (see CHANGELOG.md)
  - Added python bundled dependencies: dacite, dataclasses
  - Added new bundled rubygem ruby2_keywords
  - Updated rubygem bundled packages: backports, ethon, ffi, json, mustermann, rack, rack_protection, rack_test, sinatra, tilt
  - Updated pcs-web-ui
  - Updated test run, only tier0 tests are running during build
  - Removed BuildRequires needed for tier1 tests which were removed for build (pacemaker-cli, fence_agents-*, fence_virt, booth-site)
  - Resolves: rhbz#1387358 rhbz#1684676 rhbz#1722970 rhbz#1778672 rhbz#1782553 rhbz#1790460 rhbz#1805082 rhbz#1810017 rhbz#1817547 rhbz#1830552 rhbz#1832973 rhbz#1833114 rhbz#1833506 rhbz#1838853 rhbz#1839637


author: Miroslav Lisik <mlisik@redhat.com> - 0.10.6-2
changelog:
  - Added resource and operation defaults that apply to specific resource/operation types
  - Added Requires/BuildRequires: python3-pyparsing
  - Added Requires: logrotate
  - Fixed resource and stonith documentation
  - Fixed rubygem licenses
  - Fixed update_times()
  - Updated rubygem rack to version 2.2.3
  - Removed BuildRequires execstack (it is not needed)
  - Resolves: rhbz#1805082 rhbz#1817547


author: Miroslav Lisik <mlisik@redhat.com> - 0.10.6-3
changelog:
  - Added Upgrade CIB if user specifies on-fail=demote
  - Fixed rpmdiff issue with binary stripping checker
  - Fixed removing non-empty tag by removing tagged resource group or clone
  - Resolves: rhbz#1843079 rhbz#1857295


author: Miroslav Lisik <mlisik@redhat.com> - 0.10.6-4
changelog:
  - Fixed invalid CIB error caused by resource and operation defaults with mixed and-or rules
  - Updated pcs-web-ui
  - Resolves: rhbz#1867516


author: Miroslav Lisik <mlisik@redhat.com> - 0.10.7-1
changelog:
  - Rebased to latest upstream sources (see CHANGELOG.md)
  - Added python bundled dependency dateutil
  - Fixed virtual bundle provides for ember, handelbars, jquery and jquery-ui
  - Resolves: rhbz#1222691 rhbz#1741056 rhbz#1851335 rhbz#1862966 rhbz#1869399 rhbz#1873691 rhbz#1875301 rhbz#1883445 rhbz#1885658 rhbz#1885841


author: Miroslav Lisik <mlisik@redhat.com> - 0.10.7-2
changelog:
  - Rebased to latest upstream sources (see CHANGELOG.md)
  - Changed BuildRequires from git to git-core
  - Resolves: rhbz#1869399 rhbz#1885658 rhbz#1896379


author: Miroslav Lisik <mlisik@redhat.com> - 0.10.7-3
changelog:
  - Rebased to latest upstream sources (see CHANGELOG.md)
  - Add BuildRequires: make
  - Resolves: rhbz#1667061 rhbz#1667066 rhbz#1774143 rhbz#1885658


author: Miroslav Lisik <mlisik@redhat.com> - 0.10.8-1
changelog:
  - Rebased to latest upstream sources (see CHANGELOG.md)
  - Updated pcs-web-ui
  - Updated python bundled dependencies: dacite, dataclasses
  - Resolves: rhbz#1457314 rhbz#1619818 rhbz#1667066 rhbz#1762816 rhbz#1794062 rhbz#1845470 rhbz#1856397 rhbz#1877762 rhbz#1917286


author: Lubos Uhliarik <luhliari@redhat.com> - 1.10.2-2
changelog:
  - Resolves: #1733443 - CVE-2019-0203 subversion:1.10/subversion: remote
    unauthenticated denial-of-service in subversion svnserve


author: Josh Stone <jistone@redhat.com> - 1.51.0-1
changelog:
  - Update to 1.51.0. Update to 1.51.0. Includes security fixes for
    CVE-2021-28875 and CVE-2021-28877.


author: Josh Stone <jistone@redhat.com> - 1.52.1-1
changelog:
  - Update to 1.52.1. Includes security fixes for CVE-2020-36323,
    CVE-2021-28876, CVE-2021-28878, CVE-2021-28879, and CVE-2021-31162.


author: Chris Leech <cleech@redhat.com> - 1.0.32-6
changelog:
  - remove fcoe from SUPPORTED_DRIVERS in /etc/sysconfig/fcoe
  - add qedf to SUPPORTED_DRIVERS in /etc/sysconf/fcoe
  - added upstream fix for large fcoe ctrl numbers


author: wuchangsheng <wuchangsheng2@huawei.com> - 1.0.1-40
changelog:
  - add dfx rcv_nxt info
    mbuf private cache line align
    send pkts index bug fix
    free recv pkts in main loop


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.5.0-7
changelog:
  - Python 2 binary package renamed to python2-cherrypy
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Dan Radez <dradez@redhat.com> - 18.1.2-3
changelog:
  - Update to 18.1.2
  - Replaced Python2 package with Python 3 package
  - python3-cherrypy-18.1.2-2 is already built by package python3-cherrypy
    this release is to migrate python3-cherrypy into python-cherrypy


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.3.5-2
changelog:
  - Python 2 binary package renamed to python2-logutils
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Miro Hrončok <mhroncok@redhat.com> - 1.3.2-5
changelog:
  - Subpackage python2-pecan has been removed
    See https://fedoraproject.org/wiki/Changes/Mass_Python_2_Package_Removal


author: Miro Hrončok <mhroncok@redhat.com> - 19.0.0-5
changelog:
  - Subpackage python2-pyOpenSSL has been removed
    See https://fedoraproject.org/wiki/Changes/Mass_Python_2_Package_Removal


author: Miro Hrončok <mhroncok@redhat.com> - 1.3.0-4
changelog:
  - Subpackage python2-zc-lockfile has been removed
    See https://fedoraproject.org/wiki/Changes/Mass_Python_2_Package_Removal


author: chunchao <chunchao@nfschina.com> [4.19.113-18.71.nfs]
changelog:
  - Fix: disable loongarch LS_DUP defaule.
  - Fix: change loongarch HAVE_LIVEPATCH to HAVE_LIVEPATCH_FTRACE.


author: chunchao <chunchao@nfschina.com> [4.19.113-18.72.nfs]
changelog:
  - Config sw for VHOST_VSOCK modules:
  - Modify VIRTIO_VSOCKETS=y to VIRTIO_VSOCKETS=m;
  - Modify VIRTIO_VSOCKETS_COMMON=y to VIRTIO_VSOCKETS_COMMON=m.


author: xunian <xunian@nfschina.com> [4.19.113-18.74.nfs]
changelog:
  - Config sw: add CIFS for samba.
  - 	CONFIG_CIFS=m
  -	CONFIG_CIFS_ALLOW_INSECURE_LEGACY=y
  -	CONFIG_CIFS_DEBUG=y
  - Config sw: kernel samepage merging support for ksm.service (CONFIG_KSM=y).


author: zhangjun <zhangjun2023@nfschina.com> [4.19.113-18.75.nfs]
changelog:
  - config sw: add NFT CONFIG for firewalld
  -  	CONFIG_NFT_FIB_INET=m CONFIG_NFT_FIB_NETDEV=m
  -  	CONFIG_NFT_CHAIN_ROUTE_IPV6=m CONFIG_NFT_CHAIN_NAT_IPV6=m
  -  	CONFIG_NFT_DUP_IPV6=m CONFIG_NFT_FIB_IPV6=m
  -  	CONFIG_NF_DUP_IPV6=m  CONFIG_NF_NAT_IPV6=m
  - config sw: support firewalld log no err


author: fenghui <fenghui@nfschina.com> [4.19.113-18.76.nfs]
changelog:
  - Support: misp openstack and guest network.
  - Config: openstack
  - 	CONFIG_NF_TABLES_INET=y
  -	CONFIG_NF_TPROXY_IPV6=m
  -	CONFIG_NF_TABLES_IPV6=y
  -	CONFIG_NFT_REJECT_IPV6=m
  -	CONFIG_NFT_REJECT_INET=m
  -	CONFIG_NF_REJECT_IPV6=m
  - config: guest network
  -	CONFIG_IP6_NF_RAW=m
  -	CONFIG_NF_NAT_IPV6=m


author: fenghui <fenghui@nfschina.com> [4.19.113-18.77.nfs]
changelog:
  - Support: Export task/process statistics through netlink
  - config:
  - 	CONFIG_TASKSTATS=y
  - 	CONFIG_TASK_DELAY_ACCT=y
  - 	CONFIG_TASK_XACCT=y
  - 	CONFIG_TASK_IO_ACCOUNTING=y


author: Gabriel Somlo <somlo at cmu.edu> 2.1.4-2
changelog:
  - reimplement debug info patch in configure script
  - remove autoconf build dependency
  - fix autoconf-2.71 related FTBFS (#1999454)


author: Miro Hrončok <mhroncok@redhat.com> - 0.5.3-6
changelog:
  - Subpackage python2-pyroute2 has been removed
    See https://fedoraproject.org/wiki/Changes/Mass_Python_2_Package_Removal


author: Marek Kasik <mkasik@redhat.com> - 3.22.0-22
changelog:
  - Rebuild due to new version of FreeRDP
  - Fix an issue when RDP connection shows just black screen
  - Resolves: #1839744


author: Michel Dänzer <mdaenzer@redhat.com> - 1.20.8-8
changelog:
  - CVE fixes for: CVE-2020-14345 (#1872391), CVE-2020-14346 (#1872395),
    CVE-2020-14361 (#1872402), CVE-2020-14362 (#1872409)


author: feifei <feifei@nfs-hlj.com> - 1.20.11-2.1
changelog:
  - add 0002-xorg-server-CVE-2023-0494.patch 
    add 0003-xorg-server-CVE-2022-46342.patch
    add 0004-xorg-server-CVE-2022-46343.patch
    add 0005-xorg-server-CVE-2022-46344.patch
    add 0006-xorg-server-CVE-2022-4283.patch
    add 0007-xorg-server-CVE-2022-46340.patch
    add 0008-xorg-server-CVE-2022-46341.patch


author: Olivier Fourdan <ofourdan@redhat.com> - 21.0.99.902-1
changelog:
  - xwayland 21.0.99.902
  - Remove xdmcp, udev, udev_kms build options
  - Stop overriding the vendor name, same as xorg-x11-server


author: Cdos Support Team <support_os@cpu-os.ac.cn> - 1.1.13-m1.3
changelog:
  - 解决没有生成/var/nfs/license.db文件，造成注册日期随系统时间调整而顺延的问题.
  - Added: /etc/xdg/autostart/nfs-license-agent.desktop 
  - Patch02:	nfs-license-add-log-test-0002.patch
  - deleted /lib/systemd/system/license.service


author: Wen Liang <wenliang@redhat.com> - 1:1.32.0-1
changelog:
  - update to 1.32.0 release
  - veth: fix null error when deleting the device (rh #1915278)
  - veth: fix crash when deleting the device profile (rh #1915276)
  - firewall: add new "nftables" firewall-backend (rh #1548825)
  - DNS: fix lookup of hostname via DNS (rh #1970335)


author: Wen Liang <wenliang@redhat.com> - 1:1.32.2-1
changelog:
  - update to 1.32.2 release
  - device: prefer IPv6 not-deprecated addresses for hostname lookup (rh #1820770)
  - docs: describe qdiscs and tfilters in nm-settings manpage (rh #1847894)
  - cloud-setup: preserve IPv4 addresses/routes/rules from profile (rh #1971527)
  - daemon: performance improvements (rh #1847125)
  - dhcp/systemd: ignore FORCERENEW requests for DHCPV4 (rh #1961251, CVE-2020-13529)
  - Add bridge_role in 802-3-ethernet.s390-options using nmcli (rh #1935842)


author: Gris Ge <fge@redhat.com> - 1:1.32.4-1
changelog:
  - Upgrade to 1.32.4 with fixes of:
  - nmcli: show DNS SEARCH field in device information. (rh #1852317)
  - device: avoid crash setting VPN config during unrealize. (rh #1912423)
  - core: send ARP announcements when there is carrier. (rh #1956793)
  - core: add ipv[46].required-timeout option to wait for IP configuration while activating. (rh #1961666)
  - core: start DHCPv6 when a prefix delegation is needed for shared mode. (rh #1973199)
  - ifcfg: log warning about invalid keys in ifcfg files. (rh #1959656)
  - cloud-setup: add support for Aliyun cloud. (rh #1823315)


author: Gris Ge <fge@redhat.com> - 1:1.32.6-1
changelog:
  - Upgrade to 1.32.6 release
  - core: fix adding stale local routes when address changes (rh #1979192)
  - dhcp: handle filename/bootfile_name DHCP option and write it to device state
    file for initrd/kickstart (rh #1979387)
  - initrd: add "ib.pkey=" command line option (rh #1805708)
  - core: introduce "keep-configuration" device option to forcefully activate a
    profile on start (rh #1934122)


author: Fernando Fernandez Mancera <ferferna@redhat.com> - 1:1.32.8-1
changelog:
  - Upgrade to 1.32.8 release
  - firewalld: configure zones on "Reloaded" signal (rh #1982403)
  - ethtool: support configuring newer gigabit ethernet speeds (rh #1897004)
  - core: fix wrong MTU for bridge interfaces (rh #1973536)
  - cloud-setup: fix gateway address for Aliyun cloud (rh #1823315)


author: Wen Liang <wenliang@redhat.com> - 1:1.32.10-1
changelog:
  - update to 1.32.10 release
  - nm-initrd-generator: add kernel command line options ethtool autoneg and speed (rh #1940934)
  - IP: fix the order of IP addresses during service restart (rh #1988751)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.32.10-3
changelog:
  - preserve the IPv6 multicast route added by kernel (rh #2004212)
  - cloud-setup: better handle other route configuration (rh #1977984)


author: Rex Dieter <rdieter@fedoraproject.org> - 2.0.14-7
changelog:
  - cleanup cmake usage, move to %build
  - %build: explicitly disable doc generation
  - kill hard-coded rpath
  - -libs: explicit soname so bumps aren't a surprise
  - use %license, %make_build, 'make install/fast'


author: Miroslav Lichvar <mlichvar@redhat.com> 6.1-5.20180224
changelog:
  - fix crash in parsing of terminfo use capability (CVE-2018-10754)
  - add gcc-c++ to build requirements


author: Miroslav Lichvar <mlichvar@redhat.com> 6.1-8.20180224
changelog:
  - fix buffer overflow in terminfo entry hashtable (CVE-2019-17594)
  - handle missing character after backslash in terminfo entry (CVE-2019-17595)


author: Mark Huth <mhuth@redhat.com> - 0.9.7-6
changelog:
  - Resolves: rhbz#1314606 - show progress with addattachment
  - Resolves: rhbz#1314607 - problem with addattachment -s switch


author: Pranita Ghole<pghole@redhat.com> - 0.10.1-1
changelog:
  - Resolves: rhbz#1670001 - redhat-support-tool -o option does not work (soscleaner)
  - Resolves: rhbz#1670369 - redhat-support-lib-python: Traceback on make_report from utils.reporthelper
  - Resolves: rhbz#1670044 - redhat-support-tool proxy does not work on rhel-8


author: Pranita Ghole<pghole@redhat.com> - 0.11.2-1
changelog:
  - Resolves: rhbz#1677257 - redhat-support-lib-python: AttributeError from utils/reporthelper.py no buf


author: Vikas Rathee <vrathee@redhat.com> - 0.9.10-1
changelog:
  - Resolves: rhbz#1342627 - List cases by group.
  - Resolves: rhbz#1379619 - Inform when http_proxy environment variable is used.


author: Pranita Ghole<pghole@redhat.com> - 0.11.2-2
changelog:
  - Resolves: rhbz#1685296 - redhat-support-tool env var http_proxy does not work with user and password
  - Resolves: rhbz#1685295 - [RFE][RHEL8] Include Reason in cases of failed proxy
  - Resolves: rhbz#1684321 - redhat-support-tool config debug <level>` fails with "ERROR: debug is not a valid configuration file option.


author: Pranita Ghole<pghole@redhat.com> - 0.11.3-2
changelog:
  - Resolves: rhbz#1882771 - redhat-support-tool: UnboundLocalError: local variable 'timer' referenced before assignment
  - Resolves: rhbz#1882772 - [RFE] Add functionality to generate and send sosreport after selecting the case.
  - Resolves: rhbz#1882773 - [RFE] Generate and upload sosreport to case from cli


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-16
changelog:
  - 2004974 - CVE-2021-3796 vim: use-after-free in nv_replace() in normal.c [rhel-8.5.0]
  - 2004891 - CVE-2021-3778 vim: heap-based buffer overflow in utf_ptr2char() in mbyte.c [rhel-8.5.0]


author: zhangjun <zhangjun2023@nfschina.com> - 2:8.0.1763-17
changelog:
  - Fix CVE-2022-2206,CVE-2022-2207,CVE-2022-2210,
  - CVE-2021-3872,CVE-2021-4069,CVE-2022-0261,CVE-2022-0318,
  - CVE-2022-0359,CVE-2022-0361,CVE-2022-0392,CVE-2022-0413,
  - CVE-2022-2124,CVE-2022-2125,CVE-2022-2126,CVE-2022-2129,
  - CVE-2022-1616,CVE-2022-1620,CVE-2021-4192,CVE-2021-4193,
  - CVE-2021-4019,CVE-2021-3984


author: Miroslav Lichvar <mlichvar@redhat.com> - 1.2.0-1
changelog:
  - update to 1.2.0
  - use macro for ldconfig scriptlets
  - add gcc to build requirements
  - include soname in file list
  - use license macro


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.37-33
changelog:
  - Resolves: #1868608 - Intermittent Segfault in Apache httpd due to pool
    concurrency issues
  - Resolves: #1861380 - httpd/mod_proxy_http/mod_ssl aborted when sending
    a client cert to backend server
  - Resolves: #1680118 - unorderly connection close when client attempts
    renegotiation


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.37-36
changelog:
  - Resolves: #1896176 - [RFE] ProxyWebsocketIdleTimeout from httpd
    mod_proxy_wstunnel
  - Resolves: #1847585 - mod_ldap: High CPU usage at apr_ldap_rebind_remove()


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.37-37
changelog:
  - Resolves: #1883648 - [RFE] Update httpd directive SSLProxyMachineCertificateFile
    to be able to handle certs without matching private key


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.37-40
changelog:
  - Resolves: #1952557 - mod_proxy_wstunnel.html is a malformed XML
  - Resolves: #1937334 - SSLProtocol with based virtual hosts


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-41
changelog:
  - Resolves: #1680111 - httpd sends reply to HTTPS GET using two TLS records
  - Resolves: #1905613 - mod_ssl does not like valid certificate chain
  - Resolves: #1935742 - [RFE] backport samesite/httponly/secure flags for
    usertrack
  - Resolves: #1972500 - CVE-2021-30641 httpd:2.4/httpd: MergeSlashes regression
  - Resolves: #1968307 - CVE-2021-26690 httpd:2.4/httpd: mod_session NULL pointer
    dereference in parser
  - Resolves: #1934741 - Apache trademark update - new logo


author: chaodong <chaodong@nfschina.com> - 2.4.37-41.2
changelog:
  - Fix CVE-2021-39275, CVE-2021-34798
  - httpd-2.4.37-CVE-2021-39275.patch
  - httpd-2.4.37-CVE-2021-34798.patch


author: Lubos Uhliarik <luhliari@redhat.com> - 1.11.3-1
changelog:
  - new version 1.11.3
  - Resolves: #1633401 - CVE-2018-11763 mod_http2: httpd:  DoS for HTTP/2
    connections by continuous SETTINGS


author: Lubos Uhliarik <luhliari@redhat.com> - 1.11.3-3
changelog:
  - Resolves: #1744999 - CVE-2019-9511 httpd:2.4/mod_http2: HTTP/2: large amount
    of data request leads to denial of service
  - Resolves: #1745086 - CVE-2019-9516 httpd:2.4/mod_http2: HTTP/2: 0-length
    headers leads to denial of service
  - Resolves: #1745154 - CVE-2019-9517 httpd:2.4/mod_http2: HTTP/2: request for
    large response leads to denial of service


author: Lubos Uhliarik <luhliari@redhat.com> - 1.15.7-1
changelog:
  - new version 1.15.7
  - Resolves: #1814236 - RFE: mod_http2 rebase 
  - Resolves: #1747289 - CVE-2019-10082 httpd:2.4/mod_http2: httpd: 
    read-after-free in h2 connection shutdown
  - Resolves: #1696099 - CVE-2019-0197 httpd:2.4/mod_http2: httpd: 
    mod_http2: possible crash on late upgrade
  - Resolves: #1696094 - CVE-2019-0196 httpd:2.4/mod_http2: httpd:
    mod_http2: read-after-free on a string compare
  - Resolves: #1677591 - CVE-2018-17189 httpd:2.4/mod_http2: httpd: 
    mod_http2: DoS via slow, unneeded request bodies


author: Lubos Uhliarik <luhliari@redhat.com> - 1.15.7-2
changelog:
  - Resolves: #1869073 - CVE-2020-9490 httpd:2.4/mod_http2: httpd: 
    Push diary crash on specifically crafted HTTP/2 header


author: Lubos Uhliarik <luhliari@redhat.com> - 1:2.0.8-8
changelog:
  - Resolves: #1832844 - mod_md does not work with ACME server that does not
    provide keyChange or revokeCert resources


author: Lubos Uhliarik <luhliari@redhat.com> - 1:1.14.1-1
changelog:
  - new version 1.14.1
  - Resolves: #1647257 - CVE-2018-16845 nginx: Denial of service and
    memory disclosure via mp4 module
  - Resolves: #1647262 - CVE-2018-16844 nginx: Excessive CPU usage
    via flaw in HTTP/2 implementation
  - Resolves: #1647263 - CVE-2018-16843 nginx: Excessive memory consumption
    via flaw in HTTP/2 implementation


author: Lubos Uhliarik <luhliari@redhat.com> - 1:1.14.1-9
changelog:
  - Resolves: #1744811 - CVE-2019-9511 nginx:1.14/nginx: HTTP/2: large amount of
    data request leads to denial of service
  - Resolves: #1744325 - CVE-2019-9513 nginx:1.14/nginx: HTTP/2: flood using
    PRIORITY frames resulting in excessive resource consumption
  - Resolves: #1745094 - CVE-2019-9516 nginx:1.14/nginx: HTTP/2: 0-length
    headers leads to denial of service


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-50
changelog:
  - rd.route should use the name from kdump_setup_ifname
  - get kdump ifname once in kdump_install_netdev


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-51
changelog:
  - Stop reloading kdump service on CPU hotplug event for FADump
  - fadump: improve fadump-howto.txt about remote dump target setup


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-52
changelog:
  - Write to `/var/lib/kdump` if $KDUMP_BOOTDIR not writable
  - Iterate /sys/bus/ccwgroup/devices to tell if we should set up rd.znet
  - mkdumprd: display the absolute path of dump location in the check_user_configured_target()


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-53
changelog:
  - check for invalid physical address of /proc/kcore when making ELF dumpfile
  - check for invalid physical address of /proc/kcore when finding max_paddr
  - fix format issue in find_online_znet_device
  - check the existence of /sys/bus/ccwgroup/devices before trying to find online network device
  - kdump-lib.sh: fix a warning in prepare_kdump_bootinfo()


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-54
changelog:
  - kdump/ppc64: rebuild initramfs image after migration
  - Check the existence of /sys/bus/ccwgroup/devices/*/online beforehand
  - kdump.sysconfig.s390: Remove "prot_virt" from kdump kernel cmdline


author: Petr Pisar <ppisar@redhat.com> - 10.31-6
changelog:
  - Fix global search/replace in pcre2test and pcre2_substitute() when the pattern
    matches an empty string, but never at the starting offset


author: Petr Pisar <ppisar@redhat.com> - 10.31-7
changelog:
  - Fix checking that a lookbehind assertion has a fixed length if the
    lookbehind assertion is used inside a lookahead assertion
  - Fix parsing VERSION conditions


author: Petr Pisar <ppisar@redhat.com> - 10.31-8
changelog:
  - Fix backtracking atomic groups when they are not separated by something with
    a backtracking point


author: Petr Pisar <ppisar@redhat.com> - 10.31-9
changelog:
  - Recognize all Unicode space characters with /x option in a pattern
    (bug #1617960)
  - Fix changing dynamic options (bug #1617960)
  - Fix autopossessifying a repeated negative class with no characters less than
    256 that is followed by a positive class with only characters less than 255,
    (bug #1617960)
  - Fix autopossessifying a repeated negative class with no characters less than
    256 that is followed by a positive class with only characters less than 256,
    (bug #1617960)


author: Petr Pisar <ppisar@redhat.com> - 10.32-1
changelog:
  - 10.32 bump (bug #1628200)
  - Fix a subject buffer overread in JIT when UTF is disabled and \X or \R has
    a greater than 1 fixed quantifier (bug #1628200)
  - Fix matching a zero-repeated subroutine call at a start of a pattern
    (bug #1628200)
  - Fix heap limit checking overflow in pcre2_dfa_match() (bug #1628200)


author: zhuyunfei <zhuyunfei@nfschina.com> [4.19.113-18.79.nfs]
changelog:
  - Add libperf-jvmti.so in sw_64
  - Support smzy feature from zhuanyong with ko module
    Include interface:
    smzy_selinux_audit_on、smzy_is_enable、smzy_avc_denied、smzy_avc_has_perm_noaudit

  - Disable 1394 support for control requirement
    config x86_64 :CONFIG_FIREWIRE=n 

  - Add AQTJ patches:
    kernel-4.19.113-ngac-kernel-key-module.patch
    kernel-4.19.113-ngac-kernel-key-pro.patch
    kernel-4.19.113-ngac-kernel-lsm-extend.patch
    kernel-4.19.113-ngac-kernel-privilege-proc.patch
    kernel-4.19.113-ngac-kernel-software-pro.patch
    kernel-4.19.113-ngac-kernel-software-vim-bugfix.patch
    kernel-4.19.113-ngac-kernel-support-multi-privilage.patch
    kernel-4.19.113-ngac-kernel-hook.patch
    kernel-4.19.113-ngac-kernel-add-nfssec-switch.patch
    kernel-4.19.113-ngac-spro-panic-fixbug.patch


author: fenghui <fenghui@nfschina.com> [4.19.113-18.80.nfs]
changelog:
  - Support: mips64 support FCoE Offload functionality over Chelsio \
  		T4-based 10Gb Converged Network Adapters
    Config: CONFIG_SCSI_CHELSIO_FCOE=m

  - Support: mips64 zram support wirteback
    Config: CONFIG_ZRAM_WRITEBACK=y


author: fenghui <fenghui@nfschina.com> [4.19.113-18.81.nfs]
changelog:
  - Support: Add dm-raid.ko to support lvcreate cmd.
  - Config: mips64 CONFIG_DM_RAID=m
  - Config: loongarch CONFIG_DM_RAID=m


author: fenghui <fenghui@nfschina.com> [4.19.113-18.83.nfs]
changelog:
  - Add: Newly added char drivers app-control.ko
  - Del: Delete "linux-firmware >=20150904-56.git6ebf5d57" dependent packages.
         Support for mini installation of JOS


author: Dong Chuanjian <chuanjian@nfschina.com> - 4.0-****.nfs4.1
changelog:
  - 修改"/etc/nfs-release"文件中的版本标识
  - 修改此软件包版本命名规则，去除之前的升级标识，以后有修改在dist信息后升级版本号，添加4.0标识
  - 去除"/etc/os-release"文件中的"BETA"标识


author: Dong Chuanjian <chuanjian@nfschina.com> - 4.0-****.nfs4.7
changelog:
  - add "if $USER==root" for performance.sh
  - add "update-batch-time" for nfs-autoupdate
  - add "RTM4-G310" for VERSION of os-release


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.25-1
changelog:
  - Update to 9.11.25
  - Require libcap from devel package
  - Fix crash on NTA recheck failure (#1893761)


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.26-2
changelog:
  - Add DNSTAP support (#1854148), new dnstap-read tool
  - Add JSON support in statistics-channel (#1899257)


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.26-4
changelog:
  - Possible assertion failure on DNAME processing (CVE-2021-25215)
  - Insufficient IXFR checks could lead to assertion failure (CVE-2021-25214)


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.20-5
changelog:
  - Fix tsig-request verify (CVE-2020-8622)
  - Prevent PKCS11 daemon crash on crafted packet (CVE-2020-8623)
  - Correct update-policy type subdomain to match documentation (CVE-2020-8624)
  - Include available test


author: zhuyunfei <zhuyunfei@nfschina.com> [4.19.113-18.79.nfs]
changelog:
  - Support smzy feature from zhuanyong with ko module
    Include interface:
    smzy_selinux_audit_on、smzy_is_enable、smzy_avc_denied、smzy_avc_has_perm_noaudit

  - Disable 1394 support for control requirement
    config x86_64 :CONFIG_FIREWIRE=n

  - Add AQTJ patches:
    kernel-4.19.113-ngac-kernel-key-module.patch
    kernel-4.19.113-ngac-kernel-key-pro.patch
    kernel-4.19.113-ngac-kernel-lsm-extend.patch
    kernel-4.19.113-ngac-kernel-privilege-proc.patch
    kernel-4.19.113-ngac-kernel-software-pro.patch
    kernel-4.19.113-ngac-kernel-software-vim-bugfix.patch
    kernel-4.19.113-ngac-kernel-support-multi-privilage.patch
    kernel-4.19.113-ngac-kernel-hook.patch
    kernel-4.19.113-ngac-kernel-add-nfssec-switch.patch
    kernel-4.19.113-ngac-spro-panic-fixbug.patch


author: chunchao <chunchao@nfschina.com> [4.19.113-18.86.nfs]
changelog:
  - Fix: fs/btrfs allow btrfs_truncate_block() to fallback to nocow for data
  - upstream commitid: 6d4572a9d71d5fc2affee0258d8582d39859188c
  - Config: set CONFIG_IGB to m


author: yangminglei <minglei@nfschina.com> [4.19.113-18.87.nfs]
changelog:
  - Fix: CVE patches:
          kernel-CVE-2021-0920.patch
          kernel-CVE-2021-34981.patch
          kernel-CVE-2021-45486.patch
          kernel-CVE-2022-1789.patch
          kernel-CVE-2022-2586.patch
          kernel-CVE-2022-2588.patch
          kernel-CVE-2022-2639.patch
          kernel-CVE-2022-3061.patch
          kernel-CVE-2022-3239.patch
          kernel-CVE-2022-3545.patch
          kernel-CVE-2022-3586.patch
          kernel-CVE-2022-3594.patch
          kernel-CVE-2022-4378.patch
          kernel-CVE-2022-39842.patch
          kernel-CVE-2022-42896.patch
          kernel-CVE-2022-43750.patch
          kernel-CVE-2023-0266.patch
          kernel-CVE-2023-26545.patch


author: Jeff Layton <jlayton@redhat.com> - 6.7-5
changelog:
  - more updates, switch to rst for manpages
  - update mount.cifs manpage to describe defaults better (BZ#1474539)


author: Sachin Prabhu <sprabhu@redhat.com> - 6.8-3
changelog:
  - Add manual gating tests
  - docs: cleanup rst formating
  - mount.cifs.rst: document new (no)handlecache mount option
  - manpage: update mount.cifs manpage with info about rdma option
  - checkopts: add python script to cross check mount options
  - mount.cifs.rst: document missing options, correct wrong ones
  - checkopts: report duplicated options in man page
  - mount.cifs.rst: more cleanups
  - mount.cifs.rst: document vers=3 mount option
  - mount.cifs.rst: document vers=3.02 mount option
  - cifs: Allow DNS resolver key to expire
  - mount.cifs: be more verbose and helpful regarding mount errors
  - Update mount.cifs with vers=default mount option and SMBv3.0.2
  - mount.cifs.rst: update vers=3.1.1 option description
  - getcifsacl: Do not go to parse_sec_desc if getxattr fails.
  - getcifsacl: Improve help usage and add -h option.
  - setcifsacl: fix adding ACE when owner sid in unexpected location
  - cifs.upcall: fix a compiler warning
  - mount.cifs Add various missing parms from the help text
  - mount.cifs: add more options to help message
  - mount.cifs: detect GMT format of snapshot version
  - Update man page for mount.cifs to add new options
  - mount.cifs.rst: mention kernel version for snapshots
  - Fix authors and maintainers


author: Kamil Dudka <kdudka@redhat.com> - 7.61.1-18
changelog:
  - http: send payload when (proxy) authentication is done (#1918692)
  - curl: Inferior OCSP verification (CVE-2020-8286)
  - libcurl: FTP wildcard stack overflow (CVE-2020-8285)
  - curl: trusting FTP PASV responses (CVE-2020-8284)


author: Kamil Dudka <kdudka@redhat.com> - 7.61.1-19
changelog:
  - make `curl --head file://` work as expected (#1947493)
  - prevent automatic referer from leaking credentials (CVE-2021-22876)


author: Kamil Dudka <kdudka@redhat.com> - 7.61.1-21
changelog:
  - fix TELNET stack contents disclosure again (CVE-2021-22925)
  - fix TELNET stack contents disclosure (CVE-2021-22898)
  - fix bad connection reuse due to flawed path name checks (CVE-2021-22924)
  - disable metalink support to fix the following vulnerabilities
      CVE-2021-22923 - metalink download sends credentials
      CVE-2021-22922 - wrong content via metalink not discarded


author: Kamil Dudka <kdudka@redhat.com> - 7.61.1-22
changelog:
  - fix STARTTLS protocol injection via MITM (CVE-2021-22947)
  - fix protocol downgrade required TLS bypass (CVE-2021-22946)


author: zhouchang <zhouchang@nfschina.com> - 7.61.1-22.3
changelog:
  - Fix CVE-2019-5436,CVE-2022-27781
  - 1002-curl-7.61.1-CVE-2019-5436.patch
  - 1003-curl-7.61.1-CVE-2022-27781.patch


author: ZhangPing <zhangping@nfs-hlj.com> - 7.6.1-22.5
changelog:
  - fix CVE-2022-22576 CVE-2022-27774 CVE-2022-27776
  - add: 1004-curl-7.61.1-CVE-2022-22576.patch
  - add: 1005-curl-7.61.1-CVE-2022-27774-CVE-2022-27776.patch


author: ZhangPing <zhangping@nfs-hlj.com> - 2.9.1-4.1
changelog:
  - add: freetype-2.9.1-CVE-2022-27404.patch
  - add: freetype-2.9.1-CVE-2022-27405.patch 
  - add: freetype-2.9.1-CVE-2022-27406.patch


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.1.1k-2
changelog:
  - Fixes FIPS_selftest to work in FIPS mode. Resolves: rhbz#1940085
  - Using safe primes for FIPS DH self-test


author: Sahana Prasad <sahana@redhat.com> - 1:1.1.1k-4
changelog:
  - Fixes bugs in s390x AES code.
  - Uses the first detected address family if IPv6 is not available
  - Reverts the changes in https://github.com/openssl/openssl/pull/13305
    as it introduces a regression if server has a DSA key pair, the handshake fails
    when the protocol is not explicitly set to TLS 1.2. However, if the patch is reverted,
    it has an effect on the "ssl_reject_handshake" feature in nginx. Although, this feature
    will continue to work, TLS 1.3 protocol becomes unavailable/disabled. This is already
    known - https://trac.nginx.org/nginx/ticket/2071#comment:1
    As per https://github.com/openssl/openssl/issues/16075#issuecomment-879939938, nginx
    could early callback instead of servername callback.
  - Resolves: rhbz#1978214
  - Related: rhbz#1934534


author: Sahana Prasad <sahana@redhat.com> - 1:1.1.1k-5
changelog:
  - Fixes CVE-2021-3712 openssl: Read buffer overruns processing ASN.1 strings
  - Resolves: rhbz#2005402


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-6
changelog:
  - Fixes CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  - Resolves: rhbz#2067145


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-7
changelog:
  - Fix CVE-2022-2097: AES OCB fails to encrypt some bytes on 32-bit x86
    Resolves: CVE-2022-2097
  - Update expired certificates used in the testsuite
    Resolves: rhbz#2100554
  - Fix CVE-2022-1292: openssl: c_rehash script allows command injection
    Resolves: rhbz#2090371
  - Fix CVE-2022-2068: the c_rehash script allows command injection
    Resolves: rhbz#2098278


author: feifei <feifei@nfs-hlj.com> - 1:1.1.1k-7.0.5
changelog:
  - add: openssl-1.1.1-CVE-2023-0215.patch
  - add: openssl-1.1.1-CVE-2022-4450.patch
  - add: openssl-1.1.1-CVE-2023-0286.patch


author: Peter Jones <pjones@redhat.com> - 0.112-25
changelog:
  - Preserve .py timestamp during install so .pyc/.pyo files have the same
    timestamp on all arches, preventing rpmdiff from complaining.
    Related: rhbz#1625388


author: Jiri Vymazal <jvymazal@redhat.com> - 8.1911.0-3
changelog:
  RHEL 8.2.0 ERRATUM
  - added patch reverting rejecting expired certs by default
    resolves: rhbz#1782353
  - added patch silencing false errors on config.enabled statement
    resolves: rhbz#1659383


author: Jiri Vymazal <jvymazal@redhat.com> - 8.1911.0-5
changelog:
  RHEL 8.3.0 ERRATUM
  - added qpid-proton as another source and enabled omamqp1 module
    in a separate sub-package with it statically linked
    resolves: rhbz#1713427
  - extended config.enabled patch to cover rest of the cases
    resolves: rhbz#1659383
  - added patch making json serialization thread-safe
    resolves: rhbz#1789675
  - added another patch for imfile state-files id
    resolves: rhbz#1793569
  - fixed typo in commend-out part of default rsyslog.conf


author: Jiri Vymazal <jvymazal@redhat.com> - 8.1911.0-6
changelog:
  RHEL 8.3.0 ERRATUM
  - added patch preventing imfile crash when selinux blocks symlink
    access
    resolves: rhbz#1843994
  - fixed config-enabled patch
    resolves: rhbz#1659383


author: Attila Lakatos <alakatos@redhat.com> - 8.2102.0-2
changelog:
  RHEL 8.5.0 ERRATUM
  - rebase to 8.2102.0
    resolves: rhbz#1932795
  - Enable openssl
    resolves: rhbz#1891458
  - EKU check for client cert on server side
    resolves: rhbz#1783348
  - Use GNUTLS_SHUT_WR when ending TLS connections
    resolves: rhbz#1880434
  - Use librelp with openssl enabled
    resolves: rhbz#1795607
  - Close dir when fsync=on
    resolves: rhbz#1960536


author: Attila Lakatos <alakatos@redhat.com> - 8.2102.0-3
changelog:
  - Priority field must have valid length
    resolves: rhbz#1866877
  - Allocate more memory on too large groups
    resolves: rhbz#1944718


author: Attila Lakatos <alakatos@redhat.com> - 8.2102.0-5
changelog:
  - Do not exit when user/group can not be found
    resolves: rhbz#1984489
  - Remove abortOnIDResolution fail


author: Michel Dänzer <mdaenzer@redhat.com> - 1.20.8-5
changelog:
  - xwayland: Hold a pixmap reference in struct xwl_present_event
    Related: #1728684
  - glamor: Fix glamor_poly_fill_rect_gl xRectangle::width/height handling
    Resolves: #1740250


author: Paul Howarth <paul@city-fan.org> - 1.0.5-17
changelog:
  - ldconfig scriptlets replaced by RPM File Triggers from Fedora 28
  - Drop legacy BuildRoot: and Group: tags
  - Drop redundant explicit buildroot cleaning
  - Specify all explicitly-used build requirements
  - Use %license where possible
  - Drop %defattr, redundant since rpm 4.4


author: bzhaoop<bzhaojyathousandy@gmail.com> -4:10.5.15-1
changelog:
  - Bump to 10.5.15
  - For resolving CVEs:
  - CVE-2022-24048
  - CVE-2022-24052
  - CVE-2022-24050
  - CVE-2022-24051
  - CVE-2021-46668
  - CVE-2021-46658


author: bzhaoop<bzhaojyathousandy@gmail.com> - 4:10.5.15-2
changelog:
  - Fix the systemd service issue about the env variable.
  - Apply the patches from old branch.
  - Adaption the cmake version and integrate into the spec file.


author: bzhaoop<bzhaojyathousandy@gmail.com> - 4:10.5.16-1
changelog:
  - Bump to 10.5.16 for resolving CVEs below
  - CVE-2022-27385
  - CVE-2022-27382
  - CVE-2022-27451
  - CVE-2022-27457
  - CVE-2022-27446
  - CVE-2022-27455
  - CVE-2022-27444
  - CVE-2022-27379
  - CVE-2022-27386
  - CVE-2022-27447
  - CVE-2022-27448
  - CVE-2022-27449
  - CVE-2022-27445
  - CVE-2022-27456
  - CVE-2022-27458
  - CVE-2022-27452
  - CVE-2022-27376
  - CVE-2022-27378
  - CVE-2022-27377
  - CVE-2022-27381
  - CVE-2022-27383
  - CVE-2022-27380
  - CVE-2022-27384
  - CVE-2022-27387
  - And we fit the latest packages for the new mariadb release, such as errmsg package.


author: zengyi <zengyi@nfschina.com> [4.19.113-18.89.nfs]
changelog:
  -kernel-CVE-2022-3028.patch
  -kernel-CVE-2022-3524.patch
  -kernel-CVE-2022-3565.patch
  -kernel-CVE-2022-3567.patch
  -kernel-CVE-2022-3621.patch
  -kernel-CVE-2022-3635.patch
  -kernel-CVE-2022-3649.patch
  -kernel-CVE-2022-42895.patch


author: yangminglei <minglei@nfschina.com> [4.19.113-18.90.nfs]
changelog:
  - backport nvme double reset prevention.
  - fix CVE patches:
      kernel-CVE-2022-1184.patch
      kernel-CVE-2022-2977.patch
      kernel-CVE-2022-3169.patch
      kernel-CVE-2023-1281.patch


author: wangxi <wangxi@nfschina.com> [4.19.113-18.91.nfs]
changelog:
  - fix CVE patches:
      kernel-CVE-2022-2663.patch
      kernel-CVE-2022-3303.patch
      kernel-CVE-2022-36280.patch
      kernel-CVE-2022-41848.patch
      kernel-CVE-2022-41850.patch


author: Andreas Schneider <asn@redhat.com> - 4.14.4-0
changelog:
  - related: rhbz#1944657 - Update to version 4.14.5
  - resolves: rhbz#1969787 - Fix memory leak in RPC server
  - resolves: rhbz#1954974 - Validate smb.conf option for domain members with testparm
  - resolves: rhbz#1963298 - Fix smbd trying to delete files with wrong permissions
  - resolves: rhbz#1890008 - Update rpcclient manpage to list all available commands
  - resolves: rhbz#1857254 - Update smbcacls manpage to document inhertance flags


author: Andreas Schneider <asn@redhat.com> - 4.14.4-1
changelog:
  - resolves: rhbz#1974792 - Create a subpackage for vfs-io-uring
  - resolves: rhbz#1965397 - Raise log level for dfs ENOENT debug message


author: Andreas Schneider <asn@redhat.com> - 4.14.4-4
changelog:
  - resolves: rhbz#2021163
    Fix CVE-2016-2124
  - resolves: rhbz#2021167
    Fix CVE-2021-23192
  - resolves: rhbz#2021171
    Fix CVE-2020-25717


author: Andreas Schneider <asn@redhat.com> - 4.14.5-5
changelog:
  - resolves: rhbz#2021493 - Add missing PAC buffer types to krb5pac.idl
  - related: rbhz#2021171 - Fix regression with 'allow trusted domains = no'


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.2.6-35
changelog:
  - 1825254 - CVE-2020-3898 cups: heap based buffer overflow in libcups's ppdFindOption() in ppd-mark.c


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.2.6-36
changelog:
  - 1838449 - ipp/socket backends connect to turned off device for eternity (contimeout is not applied)
  - 1689207 - Add failover backend
  - 1833516 - DirtyCleanInterval ignored if there are open client connections


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.2.6-39
changelog:
  - 1941437 - cupsd doesn't log job ids when logging into journal
  - 1782216 - Print queue is paused after ipp backend ends with CUPS_BACKEND_STOP
  - 1938384 - CUPS doesn't start if sssd starts after cupsd


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.2.6-40
changelog:
  - 1955964 - PreserveJobHistory doesn't work with seconds
  - 1927452 - CVE-2020-10001 cups: access to uninitialized buffer in ipp.c [rhel-8]


author: Petr Menšík <pemensik@redhat.com> - 2.79-15
changelog:
  - Fix various issues in dnssec validation (CVE-2020-25681)
  - Accept responses only on correct sockets (CVE-2020-25684)
  - Use strong verification on queries (CVE-2020-25685)


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.8-3
changelog:
  - fix CVE-2020-10957 dovecot: malformed NOOP commands leads to DoS (#1840354)
  - fix CVE-2020-10958 dovecot: command followed by sufficient number of newlines
    leads to use-after-free (#1840357)
  - fix CVE-2020-10967 dovecot: sending mail with empty quoted localpart
    leads to DoS (#1840356)


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.8-4
changelog:
  - fix CVE-2020-12100 resource exhaustion via deeply nested MIME parts (#1866756)
  - fix CVE-2020-12673 out of bound reads in dovecot NTLM implementation (#1866761)
  - fix CVE-2020-12674 crash due to assert in RPA implementation (#1866768)


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.8-6
changelog:
  - fix mail storage block count parsing (#1894418)
  - MIME parser crashed when boundaries were wrong (#1888111)


author: Jan Grulich <jgrulich@redhat.com> - 0.27.3-4
changelog:
  - CVE-2021-29458 exiv2: out-of-bounds read in Exiv2::Internal::CrwMap::encode
    Resolves: bz#1953758

  - CVE-2021-29457 exiv2: heap-based buffer overflow in Exiv2::Jp2Image::doWriteMetadata
    Resolves: bz#1953772


author: Jan Grulich <jgrulich@redhat.com> - 0.27.3-5
changelog:
  - CVE-2021-29473 exiv2: out-of-bounds read in Exiv2::Jp2Image::doWriteMetadata
    Resolves: bz#1954065

  - CVE-2021-29470 exiv2: out-of-bounds read in Exiv2::Jp2Image::encodeJp2Header
    Resolves: bz#1955014


author: Jan Grulich <jgrulich@redhat.com> - 0.27.3-6
changelog:
  - CVE-2021-29623 exiv2: a read of uninitialized memory may lead to information leak
    Resolves: bz#1964182

  - CVE-2021-32617 exiv2: DoS due to quadratic complexity in ProcessUTF8Portion
    Resolves: bz#1964188


author: Jan Grulich <jgrulich@redhat.com> - 0.27.4-3
changelog:
  - Fix out-of-bounds read in Exiv2::Jp2Image::printStructure
    Resolves: bz#1993282

  - Fix out-of-bounds read in Exiv2::Jp2Image::encodeJp2Header
    Resolves: bz#1993245


author: Daiki Ueno <dueno@redhat.com> - 3.6.14-7
changelog:
  - Increase DH key bits to >= 2048 in self-tests (#1879506)
  - Implement self-tests for KDF and CMAC (#1890870)
  - Fix CVE-2020-24659: heap buffer-overflow when "no_renegotiation" alert is received (#1873959)


author: Daiki Ueno <dueno@redhat.com> - 3.6.16-1
changelog:
  - Update to upstream 3.6.16 release (#1956783)
  - Fix potential use-after-free in key_share handling (#1927597)
  - Fix potential use-after-free in pre_shared_key handling (#1927593)
  - Stop gnutls-serv relying on AI_ADDRCONFIG to decide listening address (#1908334)
  - Fix cert expiration issue in tests (#1908110)


author: Jakub Martisko <jamartis@redhat.com> - 1.9-7
changelog:
  - Fix FTBFS bug (gnulib problems)
  - more details: https://lists.gnu.org/r/bug-gnulib/2018-03/msg00000.html
    Resolves 1604303


author: Peter Hutterer <peter.hutterer@redhat.com> 1.12.3-3
changelog:
  - Allow for the tablet mode quirk to apply to touchpads (#1664225)
  - Add a quirk for the Asus VivoBook Flip to keep the
    keyboard and touchpad working in tablet mode


author: Nikola Forró <nforro@redhat.com> - 4.0.9-19
changelog:
  - Fix CVE-2020-35521 (#1945539)
  - Fix CVE-2020-35522 (#1945555)
  - Fix CVE-2020-35523 (#1945542)
  - Fix CVE-2020-35524 (#1945546)


author: Steve Dickson <steved@redhat.com> 1.1.4-4
changelog:
  - Enable gating using reverse dependency testing of nfs-utils (bz 1681965)
  - Updated the URL (bz 1638671)
  - Fix EOF detection on non-blocking socket (bz 1641875)


author: Steve Dickson <steved@redhat.com> 1.1.4-5
changelog:
  - blacklist: Add a few more well known ports (bz 1854147)
  - Disallow calling auth_refresh from clnt_call with RPCSEC_GSS (bz 1934866)


author: Petr Pisar <ppisar@redhat.com> - 0.9.11-9
changelog:
  - Fix CVE-2018-15127 (Heap out-of-bounds write in
    rfbserver.c:rfbProcessFileTransferReadBuffer()) (bug #1662997)


author: Michael Catanzaro <mcatanzaro@redhat.com> - 0.9.11-16
changelog:
  - Fix CVE-2019-20839
    Resolves: #1851032
  - Fix CVE-2018-21247
    Resolves: #1852516
  - Fix CVE-2020-14405
    Resolves: #1860527
  - Fix CVE-2020-14397
    Resolves: #1861152


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.0.0-4.el8
changelog:
  - ovt-Rectify-a-log-spew-in-vmsvc-logging-vmware-vmsvc-roo.patch [bz#1800812]
  - Resolves: bz#1800812
    ([ESXi][RHEL8]Log spew "[ warning] [guestinfo] GuestInfoGetDiskDevice: Missing disk device name)


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.0.5-1.el8
changelog:
  - Rebase to 11.0.5 (bz#1798285)
  - Resolves: bz#1798285
    ([ESXi][RHEL8.2.1]Rebase open-vm-tools to 11.0.5 for 8.2.1)


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.0.5-3.el8
changelog:
  - ovt-Fix-a-trivial-memory-leak-in-namespacetool.c.patch [bz#1811729]
  - ovt-Update-copyright-to-reflect-previous-change.patch [bz#1811729]
  - ovt-add-appinfo-plugin.patch [bz#1809751]
  - Resolves: bz#1809751
    ([ESXi][RHEL8.2.1]open-vm-tools add appinfo plugin patch)
  - Resolves: bz#1811729
    ([ESXi][RHEL8.2.1]open-vm-tools coverity scan issue)


author: Mirosalv Rezanina <mrezanin@redhat.com> - 11.1.0-1.el8
changelog:
  - Rebase to 11.1.0 [bz#1806677]
  - Added open-vm-tools-sdmp package [bz#1833157)
  - Resolves: bz#1806677
    ([ESXi][RHEL8]Rebase open-vm-tools to 11.1.0 for RHEL 8.3)
  - Resolves: bz#1833157
    ([ESXi][RHEL8]Add new open-vm-tools-sdmp package for RHEL 8.3)


author: Miroslav Rezanina <mrezanin@redaht.com> - 11.1.0-2.el8
changelog:
  - Remove net-tools dependency [bz#1849459]
  - Resolves: bz#1849459
    ([ESXi][RHEL8]Incorporate SDMP related fixes and removal of net-tools dependency)


author: Miroslav Rezanina <mrezanin@redaht.com> - 11.1.5-1.el8
changelog:
  - Rebase to 11.1.5 [bz#1870781]
  - Resolves: bz#1870781
    ([ESXi][RHEL8]Rebase open-vm-tools to 11.1.5 for 8.4)


author: Miroslav Rezanina <mrezanin@redaht.com> - 11.2.0-1.el8
changelog:
  - Rebase to 11.2.0 [bz#1890831]
  - Resolves: bz#1890831
    ([ESXi][RHEL8]Rebase open-vm-tools to 11.2.0 for 8.4)


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.2.0-2.el8
changelog:
  - ovt-Fix-memory-leaks.patch [bz#1896804]
  - Resolves: bz#1896804
    ([ESXi][open-vm-tools] Coverity detected important defects in open-vm-tools-11.2.0 rebase)


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.2.5-1.el8
changelog:
  - Rebase to 11.2.5 [bz#1916561]
  - Resolves: bz#1916561
    ([ESXi][RHEL8.5]Open-vm-tools update release 11.2.5 has been released)


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.2.5-2.el8
changelog:
  - ovt-Fix-a-memory-leak-reported-by-a-partner-from-their-C.patch [bz#1935807]
  - Resolves: bz#1935807
    ([ESXi][RHEL-8.5][open-vm-tools] Coverity detected an important defect in open-vm-tools-11.2.5 rebase)


author: Jakub Jelen <jjelen@redhat.com> - 8.0p1-3 + 0.10.3-7
changelog:
  - Fix typos in manual pages (#1668325)
  - Use the upstream support for PKCS#8 PEM files alongside with the legacy PEM files (#1712436)
  - Unbreak ssh-keygen -A in FIPS mode (#1732424)
  - Add missing RSA certificate types to offered hostkey types in FIPS mode (#1732449)


author: Jakub Jelen <jjelen@redhat.com> - 8.0p1-5 + 0.10.3-7
changelog:
  - Do not print "no slots" warning by default (#1744220)
  - Unbreak connecting using gssapi through proxy commands (#1749862)
  - Document in manual pages that CASignatureAlgorithms are handled by crypto policies (#1790604)
  - Use SHA2-based signature algorithms by default for signing certificates (#1790610)
  - Prevent simple ProxyJump loops in configuration files (#1804099)
  - Teach ssh-keyscan to use SHA2 RSA variants (#1744108)
  - Do not fail hard if getrandom() is not available and no SSH_USE_STRONG_RNG is specified (#1812120)
  - Improve wording of crypto policies references in manual pages (#1812854)
  - Do not break X11 forwarding if IPv6 is disabled (#1662189)
  - Enable SHA2-based GSSAPI key exchange algorithms by default (#1816226)
  - Mark RDomain server configuration option unsupported in RHEL (#1807686)
  - Clarify crypto policies defaults in manual pages (#1724195)
  - Mention RSA SHA2 variants in ssh-keygen manual page (#1665900)


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.0p1-7 + 0.10.3-7
changelog:
  - SFTP sort upon the modification time (#1909988)
  - ssh-keygen printing fingerprint issue with Windows keys (#1901518)
  - PIN is lost when iterating over tokens when adding pkcs11 keys to ssh-agent (#1843372)
  - ssh-agent segfaults during ssh-add -s pkcs11 (#1868996)
  - ssh-copy-id could not resolve ipv6 address ends with colon (#1933517)
  - sshd provides PAM an incorrect error code (#1879503)


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.0p1-9
changelog:
  - CVE-2020-14145 openssh: Observable Discrepancy leading to an information
    leak in the algorithm negotiation (#1882252)
  - Hostbased ssh authentication fails if session ID contains a '/' (#1944125)


author: zhouchang <zhouchang@nfschina.com> - 1:1.1.1k-7.0.8
changelog:
  - Fix CVE-2023-0464,CVE-2023-0465,CVE-2023-3817
  - add: openssl-1.1.1-CVE-2023-0464.patch
  - add: openssl-1.1.1-CVE-2023-0465.patch
  - add: openssl-1.1.1-CVE-2023-3817.patch


author: Jan Rybar <jrybar@redhat.com> - 0.115-7
changelog:
  - pkttyagent: polkit-agent-helper-1 timeout leaves tty echo disabled
  - Mitigation of regression caused by fix of CVE-2018-19788
  - Resolves: rhbz#1693781
  - Resolves: rhbz#1693814


author: Filip Januš <fjanus@redhat.com> - 10.19-2
changelog:
  - Add missing files into file section of server package
    postgresql-setup v8.6 newly provides postgresql-upgrade


author: Filip Januš <fjanus@redhat.com> - 10.21-1
changelog:
  - Resolves: CVE-2022-1552
  - Update to 10.21
  - Release notes: https://www.postgresql.org/docs/release/10.21/


author: Filip Januš <fjanus@redhat.com> - 10.21-2
changelog:
  - Resolves: CVE-2022-1552
  - Release bump due to wrongly reported CVE of libpq
    Build after reverted changes in libpq package


author: chaodong <chaodong@nfschina.com> - 10.21-2.0.1.1
changelog:
  - Disable plperl on loongarch64.
  - Support sw_64; Disable runselftest,spinlocks on sw_64.
  - postgresql-10.21-Support-sw_64.patch


author: Matthias Runge <mrunge@redhat.com> - 2.2.3-1
changelog:
  - fix CVE-2019-12781 Incorrect HTTP detection with reverse-proxy connecting
    via HTTPS (rhbz#1726014)


author: Matthias Runge <mrunge@redhat.com> - 2.2.4-1
changelog:
  - fix CVE-2019-14235 (rhbz#1735784)
  - fix CVE-2019-14234 (rhbz#1735780)
  - fix CVE-2019-14233 (rhbz#1735775)
  - fix CVE-2019-14232 (rhbz#1735771)


author: Miro Hrončok <mhroncok@redhat.com> - 2.2.13-1
changelog:
  - Update to 2.2.13
  - Security fix for CVE-2020-7471 (rhbz#1798516)
  - Security fix for CVE-2020-9402 (rhbz#1810093)
  - Security fix for CVE-2020-13254 (rhbz#1843617)
  - Security fix for CVE-2020-13596 (rhbz#1843627)


author: Lubos Uhliarik <luhliari@redhat.com> - 4.6.4-4
changelog:
  - Resolves: #1779705 - python3-mod_wsgi: Remove the Provides and Obsoletes for
    the name `mod_wsgi`


author: Lumír Balhar <lbalhar@redhat.com> - 5.1.1-14
changelog:
  - Fixes for CVE-2021-25290, CVE-2021-25292, CVE-2021-25293, CVE-2021-27921
  CVE-2021-27922, and CVE-2021-27923
  Resolves: rhbz#1934685 rhbz#1934699 rhbz#1934705 rhbz#1935384 rhbz#1935396 rhbz#1935401


author: Lumír Balhar <lbalhar@redhat.com> - 5.1.1-15
changelog:
  - Fixes for CVE-2021-25288, CVE-2021-25287, CVE-2021-28675, CVE-2021-28676,
  CVE-2021-28677 and CVE-2021-28678
  Resolves: rhbz#1958231, rhbz#1958226, rhbz#1958240, rhbz#1958252, rhbz#1958257, rhbz#1958263


author: Lumír Balhar <lbalhar@redhat.com> - 5.1.1-7
changelog:
  - Add upstream patch to solve build-time warning
  - Move patches to dist-git
  - Resolves: rhbz#1639348


author: Anna Khaitovich <akhaitov@redhat.com> - 1.7.3-12
changelog:
  - Remove KSK-2010 from configuration files
  - Resolves: rhbz#1665502
  - Replace legacy directory /var/run/ with /run
  - Resolves: rhbz#1766463
  - Resolves: rhbz#1805978
  - Fix memory leak when DNS over TLS forwarding is configured
  - Resolves: rhbz#1819870


author: Anna Khaitovich <akhaitov@redhat.com> - 1.7.3-13
changelog:
  - Fix two previous patches and add missing patch lines to %prep
  - Fix amplifying an incoming query into a large number of queries directed to a target
  - Resolves: rhbz#1839178 (CVE-2020-12662)


author: Anna Khaitovich <akhaitov@redhat.com> - 1.7.3-14
changelog:
  - Fix unbound-1.7.3-amplifying-an-incoming-query.patch patch
  - Resolves: rhbz#1839178 (CVE-2020-12662)


author: Anna Khaitovich <akhaitov@redhat.com> - 1.7.3-15
changelog:
  - Fix SPEC file to not check md5 mtime and size of /var/lib/unbound/root.key
  - Resolves: rhbz#1714175
  - Use system-wide crypto policy setting (PROFILE=SYSTEM) instead of custom setting
  - Resolves: rhbz#1842837
  - Enable additional logging in unbound
  - Resolves: rhbz#1850460
  - security hardening from x41 report
  - Resolves: rhbz#1859933
  - symbolic link traversal when writing PID file
  - Resolves: rhbz#1899058


author: Artem Egorenkov <aegorenk@redhat.com> - 1.7.3-16
changelog:
  - Don't start unbound-anchor before unbound service if DISABLE_UNBOUND_ANCHOR
    environment variable equals to "yes"
  - Resolves: rhbz#1922448


author: Artem Egorenkov <aegorenk@redhat.com> - 1.7.3-17
changelog:
  - Option --enable-linux-ip-local-port-range added to use system configured port range for libunbound on Linux
  - Resolves: rhbz#1830625


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.28-188
changelog:
  - CVE-2022-23218, CVE-2022-23219: Fix buffer overflows in sunrpc clnt_create
    for "unix" and svcunix_create (#2045063).


author: Dmitry Butskoy <Dmitry@Butskoy.name> - 1.2.6.3-1
changelog:
  - update to 1.2.6.3
  - add fixes for php >= 8.0 (patches from Patrick Monnerat <patrick@monnerat.net>)


author: Nick Clifton <nickc@redhat.com> - 2.35-3
changelog:
  - Do not enable debuginfod support by default.
  - Add run-time dependency on libdebuginfod library when debuginfod support is enabled.


author: Nick Clifton <nickc@redhat.com> - 2.35-5
changelog:
  - Fix building with LTO enabled.
  - Set the sh_entsize field of the AArch64's PLT section to 0.  (PR 26312)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20.3-9.el8
changelog:
  - ci-DataSourceAzure-update-password-for-defuser-if-exist.patch [bz#1900892]
  - ci-Revert-ssh_util-handle-non-default-AuthorizedKeysFil.patch [bz#1919972]
  - Resolves: bz#1900892
    ([Azure] Update existing user password RHEL8x)
  - Resolves: bz#1919972
    ([RHEL-8.4] ssh keys can be shared across users giving potential root access)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20.3-10.el8
changelog:
  - ci-fix-a-typo-in-man-page-cloud-init.1-752.patch [bz#1913127]
  - Resolves: bz#1913127
    (A typo in cloud-init man page)


author: Miroslav Rezanina <mrezanin@redhat.com> - 21.1-2
changelog:
  - ci-rhel-cloud.cfg-remove-ssh_genkeytypes-in-settings.py.patch [bz#1957532]
  - ci-cloud-init.spec.template-update-systemd_postun-param.patch [bz#1952089]
  - Resolves: bz#1957532
    ([cloud-init] From RHEL 82+ cloud-init no longer displays sshd keys fingerprints from instance launched from a backup image)
  - Resolves: bz#1952089
    (cloud-init brew build fails on Fedora 33)


author: Miroslav Rezanina <mrezanin@redhat.com> - 21.1-3
changelog:
  - ci-write-passwords-only-to-serial-console-lock-down-clo.patch [bz#1945891]
  - Resolves: bz#1945891
    (CVE-2021-3429 cloud-init: randomly generated passwords logged in clear-text to world-readable file [rhel-8])


author: Miroslav Rezanina <mrezanin@redhat.com> - 21.1-4
changelog:
  - ci-ssh-util-allow-cloudinit-to-merge-all-ssh-keys-into-.patch [bz#1862967]
  - Resolves: bz#1862967
    ([cloud-init]Customize ssh AuthorizedKeysFile causes login failure)


author: Miroslav Rezanina <mrezanin@redhat.com> - 21.1-5
changelog:
  - ci-Add-dhcp-client-as-a-dependency.patch [bz#1977385]
  - Resolves: bz#1977385
    ([Azure][RHEL-8] cloud-init must require dhcp-client on Azure)


author: Miroslav Rezanina <mrezanin@redhat.com> - 21.1-6
changelog:
  - ci-Stop-copying-ssh-system-keys-and-check-folder-permis.patch [bz#1862967]
  - Resolves: bz#1862967
    ([cloud-init]Customize ssh AuthorizedKeysFile causes login failure)


author: Miroslav Rezanina <mrezanin@redhat.com> - 21.1-7
changelog:
  - ci-Fix-home-permissions-modified-by-ssh-module-SC-338-9.patch [bz#1995840]
  - Resolves: bz#1995840
    ([cloudinit]  Fix home permissions modified by ssh module)


author: lidongyue <dongyue@nfschina.com> - 7.6.1-22.6
changelog:
  - fix CVE-2023-28320 CVE-2023-28321 CVE-2023-28322
  - add: 1006-curl-7.61.1-CVE-2023-28320.patch
  - add: 1007-curl-7.61.1-CVE-2023-28321.patch
  - add: 1008-curl-7.61.1-CVE-2023-28322.patch


author: zhouchang <zhouchang@nfschina.com> - 2.4.37-41.3
changelog:
  - Fix CVE-2022-26377,CVE-2022-28614,CVE-2022-28615,CVE-2022-29404，CVE-2022-30522，CVE-2022-30556，CVE-2022-31813
  - httpd-2.4.37-CVE-2022-26377.patch
  - httpd-2.4.37-CVE-2022-28614.patch
  - httpd-2.4.37-CVE-2022-28615.patch
  - httpd-2.4.37-CVE-2022-29404.patch
  - httpd-2.4.37-CVE-2022-30522.patch
  - httpd-2.4.37-CVE-2022-30556.patch
  - httpd-2.4.37-CVE-2022-31813.patch


author: lidongyue <dongyue@nfschina.com> - 2.4.37-41.6
changelog:
  - Fix CVE-2023-25690 CVE-2021-33193 CVE-2022-36760 CVE-2023-27522 CVE-2021-36160 CVE-2020-11993
  - httpd-2.4.37-CVE-2023-25690.patch
  - httpd-2.4.37-CVE-2021-33193.patch 
  - httpd-2.4.37-CVE-2022-36760.patch
  - httpd-2.4.37-CVE-2023-27522-CVE-2021-36160.patch
  - httpd-2.4.37-CVE-2020-11993.patch


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.17.0.7-0.2.ea
changelog:
  - Update in-tree tzdata to 2022e with JDK-8294357 & JDK-8295173
  - Update CLDR data with Europe/Kyiv (JDK-8293834)
  - Drop JDK-8292223 patch which we found to be unnecessary
  - Update TestTranslations.java to use public API based on TimeZoneNamesTest upstream


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.17.0.8-1
changelog:
  - Update to jdk-11.0.17+8 (GA)
  - Update release notes to 11.0.17+8
  - Switch to GA mode for release
  - The stdc++lib, zlib & freetype options should always be set from the global, so they are not altered for staticlibs builds
  - Remove freetype sources along with zlib sources


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.18.0.1-0.1.ea
changelog:
  - Update to jdk-11.0.18+1
  - Update release notes to 11.0.18+1
  - Switch to EA mode for 11.0.18 pre-release builds.
  - Drop local copies of JDK-8294357 & JDK-8295173 now upstream contains tzdata 2022e


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.18.0.9-0.1.ea
changelog:
  - Update to jdk-11.0.18+9
  - Update release notes to 11.0.18+9
  - Drop local copy of JDK-8293834 now this is upstream
  - Require tzdata 2022g due to inclusion of JDK-8296108, JDK-8296715 & JDK-8297804
  - Update TestTranslations.java to test the new America/Ciudad_Juarez zone


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.18.0.10-1
changelog:
  - Update to jdk-11.0.18+10 (GA)
  - Update release notes to 11.0.18+10
  - Switch to GA mode for release


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.19.0.7-1
changelog:
  - updated to 17.0.7.0.7 underlying portables
  - requirign 17.0.7.0.7-2 due to news, and much more tuning
  - now untarring enforced version
  - repacked bits are now requested in exact version
  - repacked portables
  - using icons from source package
  - providing full sources via src package
  - requiring exact version.reelase of portables
  - todo, lost alt java manpage.. probably already in portables
  - TODO conslut this clean up - javdoc
  - todo, debuginfo


author: Jiri Vanek <jvanek@redhat.com> - 1:17.0.6.0.10-5
changelog:
  - using icons from source package
  - providing full sources via src package
  - requiring exact version.reelase of portables
  - returned libsystemconf.so


author: Jiri Vanek <jvanek@redhat.com> - 1:17.0.7.0.7-5
changelog:
  - rebuilding aginst new portables:
  - - returned lost nss.fips.cfg
  - - enabled all crypto
  - - added and applied, on demand, patch2003 jdk8305995-footprint_regression_from_jdk_8224957


author: Paul Wouters <pwouters@redhat.com> - 3.32-3
changelog:
  - Resolves: rhbz#1842597 regression: libreswan does not send PLUTO_BYTES env variables to updown script
  - Resolves: rhbz#1847766 subsequent xfrmi interfaces configured outside of libreswan are not recognised properly
  - Resolves: rhbz#1840212 protect libreswan against unannounced nss ABI change


author: Paul Wouters <pwouters@redhat.com> - 4.1-1
changelog:
  - Resolves: rhbz#1891128 [Rebase] rebase libreswan to 4.1
  - Resolves: rhbz#1889836 libreswan: add 3.x compat patches for obsoleted/removed keywords of 4.0 and re-port ikev2= patch


author: Paul Wouters <pwouters@redhat.com> - 4.2-1
changelog:
  - Resolves: rhbz#1891128 [Rebase] rebase libreswan to 4.2
  - Resolves: rhbz#1025061 - IKEv2 support for Labeled IPsec


author: Paul Wouters <pwouters@redhat.com> - 4.3-3
changelog:
  - Resolves: rhbz#1933064 - IKEv2 support for Labeled IPsec
  - Resolves: rhbz#1935150 RFE: Support IKE and ESP over TCP: RFC 8229
  - Resolves: rhbz#1935339 virtual_private setting is missing in the default config


author: Daiki Ueno <dueno@redhat.com> - 4.4-1
changelog:
  - Resolves: rhbz#1958968 Rebase libreswan to 4.4
  - Resolves: rhbz#1954423 Libreswan: TS_UNACCEPTABLE on multiple connections between the same peers


author: Fedora Release Engineering <releng@fedoraproject.org> - 6.2-4.20200222
changelog:
  - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
  - Use make macros
  - Remove MIT definition
  - Add BuildRequires: make


author: Miroslav Lichvar <mlichvar@redhat.com> 6.2-9.20210508
changelog:
  - fix buffer overflow on terminfo with too many capabilities (CVE-2023-29491)
  - ignore TERMINFO and HOME environment variables if running as root (#2211666)


author: Lumír Balhar <lbalhar@redhat.com> - 3.6.8-33
changelog:
  - Add support for upstream architecture names
  https://fedoraproject.org/wiki/Changes/Python_Upstream_Architecture_Names
  Resolves: rhbz#1868003


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-34
changelog:
  - Security fix for CVE-2020-27619: eval() call on content received via HTTP in the CJK codec tests
  Resolves: rhbz#1890237


author: Victor Stinner <vstinner@redhat.com> - 3.6.8-39
changelog:
  - Fix reentrant call to threading.enumerate() (rhbz#1959459)
  - Don't exit Python with abort() when a thread exit and there is no available
    file descriptor to load dynamically the libgcc_s.so.1 library (rhbz#1972293)


author: Lumír Balhar <lbalhar@redhat.com> - 3.6.8-41
changelog:
  - Security fix for CVE-2021-3733: Denial of service when identifying crafted invalid RFCs
  Resolves: rhbz#1995234


author: Remi Collet <rcollet@redhat.com> - 6.0.9-4
changelog:
  - fix lua scripts can overflow the heap-based Lua stack
    CVE-2021-32626
  - fix integer overflow issue with Streams
    CVE-2021-32627
  - fix integer overflow bug in the ziplist data structure
    CVE-2021-32628
  - fix integer overflow issue with intsets
    CVE-2021-32687
  - fix integer overflow issue with strings
    CVE-2021-41099


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.4.2-10
changelog:
  - Fixed CVE-2018-11805
  - Resolves: rhbz#1787514
  - Fixed CVE-2020-1930
  - Resolves: rhbz#1820649
  - Fixed CVE-2020-1931
  - Resolves: rhbz#1820650


author: Jan Macku <jamacku@redhat.com> - 239-47
changelog:
  - systemd-binfmt: Add safeguard in triggers (#1787144)
  - spec: Requires(post) openssl-libs to fix missing /etc/machine-id (#1947438)
  - spec: Go back to using systemctl preset-all in post (#1783263, #1647172, #1118740)
  - spec: Disable libiptc support (#1817265)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-48
changelog:
  - cgroup: Also set io.bfq.weight (#1927290)
  - seccomp: allow turning off of seccomp filtering via env var (#1916835)
  - meson: remove strange dep that causes meson to enter infinite loop (#1970860)
  - copy: handle copy_file_range() weirdness on procfs/sysfs (#1970860)
  - core: Hide "Deactivated successfully" message (#1954802)
  - util: rework in_initrd() to make use of path_is_temporary_fs() (#1959339)
  - initrd: extend SYSTEMD_IN_INITRD to accept non-ramfs rootfs (#1959339)
  - initrd: do a debug log if failed to detect rootfs type (#1959339)
  - initrd: do a debug log if /etc/initrd-release doesn't take effect (#1959339)
  - units: assign user-runtime-dir@.service to user-%i.slice (#1946453)
  - units: order user-runtime-dir@.service after systemd-user-sessions.service (#1946453)
  - units: make sure user-runtime-dir@.service is Type=oneshot (#1946453)
  - user-runtime-dir: downgrade a few log messages to LOG_DEBUG that we ignore (#1946453)
  - shared/install: Preserve escape characters for escaped unit names (#1952686)
  - basic/virt: Detect PowerVM hypervisor (#1937989)
  - man: document differences in clean exit status for Type=oneshot (#1940078)
  - busctl: add a timestamp to the output of the busctl monitor command (#1909214)
  - basic/cap-list: parse/print numerical capabilities (#1946943)
  - shared/mount-util: convert to libmount (#1885143)
  - mount-util: bind_remount: avoid calling statvfs (#1885143)
  - mount-util: use UMOUNT_NOFOLLOW in recursive umounter (#1885143)
  - test-install-root: create referenced targets (#1835351)
  - install: warn if WantedBy targets don't exist (#1835351)
  - test-install-root: add test for unknown WantedBy= target (#1835351)
  - ceph is a network filesystem (#1952013)
  - sysctl: set kernel.core_pipe_limit=16 (#1949729)
  - core: don't drop timer expired but not yet processed when system date is changed (#1899402)
  - core: Detect initial timer state from serialized data (#1899402)
  - rc-local: order after network-online.target (#1934028)
  - set core ulimit to 0 like on RHEL-7 (#1905582)
  - test-mountpointutil-util: do not assert in test_mnt_id() (#1910425)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-49
changelog:
  - remove a left-over break (#1970860)
  - basic/unit-name: do not use strdupa() on a path (#1974700)
  - sd-event: change ordering of pending/ratelimited events (#1968528)
  - sd-event: drop unnecessary "else" (#1968528)
  - sd-event: use CMP() macro (#1968528)
  - sd-event: use usec_add() (#1968528)
  - sd-event: make event_source_time_prioq_reshuffle() accept all event source type (#1968528)
  - sd-event: always reshuffle time prioq on changing online/offline state (#1968528)
  - ci: run unit tests on z-stream branches as well (#1970860)
  - ci: drop forgotten Travis references (#1934504)
  - ci: run unit tests on CentOS 8 Stream as well (#1934504)
  - ci: add missing test dependencies (#1934504)
  - meson: bump timeout for test-udev to 180s (#1934504)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-50
changelog:
  - Added option --check-inhibitors for non-tty usage (#1269726)
  - logind: Introduce RebootWithFlags and others (#1269726)
  - logind: add …WithFlags methods to policy (#1269726)
  - logind: simplify flags handling a bit (#1269726)
  - Update link to RHEL documentation (#1982584)
  - Set default core ulimit to 0, but keep the hard limit ulimited (#1905582)
  - shared/seccomp-util: address family filtering is broken on ppc (#1982650)
  - logind: rework Seat/Session/User object allocation and freeing a bit (#1642460)
  - logind: fix serialization/deserialization of user's "display session" (#1642460)
  - logind: turn of stdio locking when writing session files too (#1642460)
  - units: set StopWhenUnneeded= for the user slice units too (#1642460)
  - units: improve Description= string a bit (#1642460)
  - logind: improve logging in manager_connect_console() (#1642460)
  - logind: save/restore User object's "stopping" field during restarts (#1642460)
  - logind: correct bad clean-up path (#1642460)
  - logind: fix bad error propagation (#1642460)
  - logind: never elect a session that is stopping as display (#1642460)
  - logind: introduce little helper that checks whether a session is ready (#1642460)
  - logind: propagate session stop errors (#1642460)
  - logind: rework how we manage the slice and user-runtime-dir@.service unit for each user (#1642460)
  - logind: optionally, keep the user@.service instance for eached logged in user around for a while (#1642460)
  - logind: add a RequiresMountsFor= dependency from the session scope unit to the home directory of the user (#1642460)
  - logind: improve error propagation of user_check_linger_file() (#1642460)
  - logind: automatically GC lingering users for who now user@.service (nor slice, not runtime dir service) is running anymore (#1642460)
  - pam_systemd: simplify code which with we set environment variables (#1642460)
  - logind: validate /run/user/1000 before we set it (#1642460)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-51
changelog:
  - define newly needed constants (#1850986)
  - sd-netlink: support IFLA_PROP_LIST and IFLA_ALT_IFNAME attributes (#1850986)
  - sd-netlink: introduce sd_netlink_message_read_strv() (#1850986)
  - sd-netlink: introduce sd_netlink_message_append_strv() (#1850986)
  - test: add a test for sd_netlink_message_{append,read}_strv() (#1850986)
  - util: introduce ifname_valid_full() (#1850986)
  - rename function (#1850986)
  - udev: support AlternativeName= setting in .link file (#1850986)
  - network: make Name= in [Match] support alternative names of interfaces (#1850986)
  - udev: extend the length of ID_NET_NAME_XXX= to ALTIFNAMSIZ (#1850986)
  - udev: do not fail if kernel does not support alternative names (#1850986)
  - udev: introduce AlternativeNamesPolicy= setting (#1850986)
  - network: set AlternativeNamesPolicy= in 99-default.link (#1850986)
  - random-util: call initialize_srand() after fork() (#1850986)
  - sd-netlink: introduce rtnl_resolve_link_alternative_names() (#1850986)
  - udev: sort alternative names (#1850986)
  - netlink: introduce rtnl_get/delete_link_alternative_names() (#1850986)
  - netlink: do not fail when new interface name is already used as an alternative name (#1850986)
  - udev: do not try to reassign alternative names (#1850986)
  - Fix LGTM build (#1850986)
  - sd-hwdb: allow empty properties (#1930568)
  - Update hwdb (#1930568)


author: zengyi <zengyi@nfschina.com> - 2:8.0.1763-17.3
changelog:
  -vim-8.0-CVE-2023-4735.patch
  -vim-8.0-CVE-2023-4736.patch
  -vim-8.0-CVE-2023-4751.patch
  -vim-8.0-CVE-2023-4781.patch


author: Remi Collet <remi@remirepo.net> - 7.0.10-2
changelog:
  - fix modules directory ownership and permissions #2176173
  - drop redis-shutdown helper and rely on systemd #2181181


author: Michal Ruprich <mruprich@redhat.com> - 3.2.5-1
changelog:
  - New version 3.2.5
  - Resolves: #2115430 - remote arbitrary files write inside the directories of connecting peers
  - Fix for CVE-2022-37434


author: Michal Ruprich <mruprich@redhat.com> - 3.2.6-2
changelog:
  - Resolves: #2128682 - rsync fail with "ERROR: rejecting unrequested file-list name..." depend of parameters order


author: Lukáš Zaoral <lzaoral@redhat.com> - 12.5.6-1
changelog:
  - Update to v12.5.6 (#2059133)
  - Build position independent executables
  - Use systemd-rpm-macros
     - See https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_scriptlets


author: Lukáš Zaoral <lzaoral@redhat.com> - 12.7.2-1
changelog:
  - Update to v12.7.2 (rhbz#2165400)
  - Use SPDX license format
  - Modernize the spec file according to the current packaging guidelines


author: Lukáš Zaoral <lzaoral@redhat.com> - 12.7.4-1
changelog:
  - Update to v12.7.4 (rhbz#2216900)
  - CVE-2023-33204 - check_overflow() function can work incorrectly that lead to an overflow


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 0.6.3-2
changelog:
  - Correct License tag (command line tool is GPLv2+)
  - Adjust Source tag to get a more descriptive tarfile name


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 0.7.4-1
changelog:
  - Update to version 0.7.4
  - Enable runtime detection of sse2/avx2/avx512 on intel architectures
  - Fix compiler warning for 32 bit architectures


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 0.8.0-1
changelog:
  - Update to version 0.8.0
  - Drop patches xxhash-compiler-warning-32-bit.patch (accepted upstream)
    and xxhash-pkgconfig.patch (issue fixed upstream)
  - Fix empty version in .pc file


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 0.8.1-1
changelog:
  - Update to version 0.8.1
  - Drop patch xxhash-pkgconfig-version.patch (accepted upstream)
  - Fix compilation on RHEL 7 ppc64le (gcc 4.8)
  - The x86 dispatch code now enables sse2 and avx2 separately, it can now use
    sse2 on EPEL 7 without trying to use avx2 which is not supported by gcc 4.8
  - Add documentation package - doxygen mark-up was added


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-9
changelog:
  - do not mistake a regular user process for a namespaced one (#1788696)
  - add HOME_MODE support in login.defs (#1777718)


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-12
changelog:
  - lib/sssd: redirect warning message to file (#1749001)
  - useradd: clarify valid usernames/groupnames (#1869432)
  - login.defs: link login specific information to its own package (#1804766)


author: Michael Petlan <mpetlan@redhat.com> - 1.0.0-5
changelog:
  - Added some linker hardening flags to pass annocheck
    Related: rhbz#2031802

    * Tue Dec 14 2021 Michael Petlan <mpetlan@redhat.com> - 1.0.0-5
  - Added gating
    Related: rhbz#2031794


author: Michael Petlan <mpetlan@redhat.com> - 1.2.0-2
changelog:
  - Update to upstream 1.2.0 -- fix opencsd_tag
    Related: rhbz#2041578

    * Fri Jan 21 2022 Michael Petlan <mpetlan@redhat.com> - 1.2.0-1
  - Update to upstream 1.2.0
    Related: rhbz#2041578


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-7
changelog:
  - Add 0052-libmultipath-check-for-null-wwid-before-strcmp.patch
    * Missing part of fix for bz #1897815
  - Add 0053-libmultipath-make-find_err_path_by_dev-static.patch
  - Add 0054-multipathd-avoid-io_err_stat-crash-during-shutdown.patch
  - Add 0055-multipathd-avoid-io_err_stat-ABBA-deadlock.patch
  - Add 0056-multipathd-use-get_monotonic_time-in-io_err_stat-cod.patch
  - Add 0057-multipathd-combine-free_io_err_stat_path-and-destroy.patch
  - Add 0058-multipathd-cleanup-logging-for-marginal-paths.patch
    * The above 6 patches fix bz #1920795
  - Add 0059-libmpathpersist-fix-thread-safety-of-default-functio.patch
    * Fixes bz #1913549
  - Resolves: bz #1897815, #1913549, #1920795


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-9
changelog:
  - Add 0060-kpartx-free-loop-device-after-listing-partitions.patch
    * Fixes bz #1925490
  - Add 0061-RH-fix-find_multipaths-in-mpathconf.patch
    * Fixes bz #1921651
  - Resolves: bz #1921651, #1925490


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-11
changelog:
  - Add 0062-libmultipath-select_action-don-t-drop-map-if-alias-c.patch
    * Fall back to WWID names instead of removing existing device
  - Add 0063-libmultipath-check-if-user_friendly_name-is-in-use.patch
    * make sure to choose a user_friendly_name that isn't in use
    * Fixes bz #1937832
  - Add alias_clash CI test
  - Remove unused multipath.conf
  - Resolves: bz #1937832


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-12
changelog:
  - Add 0064-libmultipath-check-udev_device_get_-return-value-to-.patch
    * Fixes bz #1946940
  - Resolves: bz #1946940


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-13
changelog:
  - Add 0065-libmultipath-cleanup-code-to-strip-wwid-trailing-spa.patch
  - Add 0066-multipathd-add-recheck_wwid-option-to-verify-the-pat.patch
  - Add 0067-libmultipath-avoid-infinite-loop-with-bad-vpd-page-8.patch
  - Add 0068-libmultipath-fix-priorities-in-parse_vpd_pg83.patch
  - Add 0069-RH-make-parse_vpd_pg83-match-scsi_id-output.patch
  - Add 0070-multipathd-improve-getting-parent-udevice-in-rescan_.patch
  - Add 0071-multipathd-don-t-trigger-uevent-for-partitions-on-ww.patch
    * add recheck_wwid option
    * Fixes bz #1907904
  - Resolves: bz #1907904


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-17
changelog:
  - Add 0074-mpathpersist-fail-commands-when-no-usable-paths-exis.patch
    * Fixes bz #1984723
  - Add 0075-multipath-print-warning-if-multipathd-is-not-running.patch
    * Fixes bz #1973592
  - Add 0076-multipathd-don-t-access-path-if-it-was-deleted.patch
    * Found by coverity
  - Resolves: bz #1973592, #1984723


author: Karel Zak <kzak@redhat.com> 2.37.4-6
changelog:
  - fix #2094216 - lslogins reports incorrect "Password is locked" status
  - fix #2117203 - loop-overlay test failed


author: Karel Zak <kzak@redhat.com> 2.37.4-10
changelog:
  - fix #2165981 - fstrim -av fails to trim root filesystem on Red Hat Coreos
  - fix #2141970 - add --cont-clock feature for libuuid and uuidd
  - fix #2133385 - uuidd returns time-based UUIDs when asked for random UUIDs.
  - fix #2156946 - agetty does not handle the \l sequence in /etc/issue correctly
  - fix #2166653 - last(1) should be more robust with work with strings
  - fix #2120246 - use {_tmpfilesdir} also in install section
  - fix #2134143 - publish libsmartcols-devel subpackages to C9S yum repos


author: Karel Zak <kzak@redhat.com> 2.37.4-12
changelog:
  - fix #2133396 - Internal testsuite for cramfs fails on s390x
  - fix #2174748 - enable uuidd cont-clock by default
  - fix #2182169 - lscpu: backport ARM human-readable names from upstream
  - fix #2189947 - libuuid - downport cache related patch
  - fix #2203324 - zram module does not have algorithms mentioned in zramctl command
  - fix #2209267 - Add additional documentation on devices being auto-mounted if a device exists within fstab.
  - fix #2215082 - For the 'sfdisk' man page to further clarify the expected behavior and intended use of the -d option


author: Patsy Griffin <patsy@redhat.com> - 2022b-1
changelog:
  - Rebase to tzdata-2022b
    - Chile transitions to DST on 2022-09-11, not 2022-09-04
    - 'make install' now defaults LOCALTIME to Factory rather than GMT
    - More zones that are the same since 1970 have been moved to backzone.
    - Include patch for awk workaround.


author: Patsy Griffin <patsy@redhat.com> - 2022c-1
changelog:
  - Rebase to tzdata-2022c - supersedes tzdata-2022b
    - Add a work-around for an awk bug in FreeBSD, macOS, etc.
    - Improve tzselect with respect to intercontinental Zones.


author: Patsy Griffin <patsy@redhat.com> - 2022f-1
changelog:
  - Rebase to tzdata-2022f
    - Mexico will stop observing DST except near the US border.
    - Chihuahua moved to -06 year round starting on 2022-10-30.
    - Fiji no longer observes DST.


author: Patsy Griffin <patsy@redhat.com> - 2022g-1
changelog:
  - Rebase to tzdata-2022g
    - The northern edge of the Mexican state of Chihuahua will
      change time zone to agree with nearby US locations on
      2022-11-30.
    - Added a new Zone America/Ciudad_Juarez that splits from
      America/Ojinaga.


author: Patsy Griffin <patsy@redhat.com> - 2023a-1
changelog:
  - Rebase to tzdata-2023a
    - Egypt reintroduced DST, from April through October.
    - Morocco springs forward April 23, not April 30.
    - Palestine delayed the start of DST this year.


author: yangminglei <minglei@nfschina.com> [4.19.113-18.99.nfs]
changelog:
  - fix CVE-2022-21123, CVE-2022-21125, CVE-2022-21166
  - backport the following patches:
  x86/cpu: Add a steppings field to struct x86_cpu_id
  x86/cpu: Add 'table' argument to cpu_matches()
  x86/speculation: Add Special Register Buffer Data Sampling (SRBDS)
  x86/speculation: Add SRBDS vulnerability and mitigation documentation
  x86/speculation: Add Ivy Bridge to affected list
  cpu/speculation: Add prototype for cpu_show_srbds()
  Documentation: Add documentation for Processor MMIO Stale Data
  x86/speculation/mmio: Enumerate Processor MMIO Stale Data bug
  x86/speculation: Add a common function for MD_CLEAR mitigation update
  x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data
  x86/bugs: Group MDS, TAA & Processor MMIO Stale Data mitigations
  x86/speculation/mmio: Enable CPU Fill buffer clearing on idle
  x86/speculation/mmio: Add sysfs reporting for Processor MMIO Stale
  x86/speculation/srbds: Update SRBDS mitigation selection
  x86/speculation/mmio: Reuse SRBDS mitigation for SBDS
  KVM: x86/speculation: Disable Fill buffer clear within guests
  - Add Intel CPU models Lakefield, Alder Lake and Rocket Lake etc.


author: fenghui <fenghui@nfschina.com> [4.19.113-18.102.nfs]
changelog:
  - fix 66286:
  	fix sw cpufreq. Add SW64_CPUFREQ in cpufreq/Makefile.
  	Error deleting SW64_CPUFREQ in loongarch-3C500-support.patch file.


author: Martin Osvald <mosvald@redhat.com> - 12:4.4.3-4.P1
changelog:
  - New version 4.4.3-P1 (rhbz#2132240)
  - Fix for CVE-2022-2928 (rhbz#2132429)
  - Fix for CVE-2022-2929 (rhbz#2132430)


author: Ondrej Holy <oholy@redhat.com> - 2:2.9.0-1
changelog:
  - Update to 2.9.0 (CVE-2022-39316, CVE-2022-39317, CVE-2022-39318,
  CVE-2022-39319, CVE-2022-39320, CVE-2022-41877, CVE-2022-39347).


author: Ondrej Holy <oholy@redhat.com> - 2:2.11.0-1
changelog:
  - Update to 2.11.0 (CVE-2023-39350, CVE-2023-39351, CVE-2023-39352,
    CVE-2023-39353, CVE-2023-39354, CVE-2023-39356, CVE-2023-40181,
    CVE-2023-40186, CVE-2023-40188, CVE-2023-40567, CVE-2023-40569 and
    CVE-2023-40589).


author: Ondrej Holy <oholy@redhat.com> - 2:2.0.0-47.rc4
changelog:
  - Fix SCARD_INSUFFICIENT_BUFFER error (rhbz#1803054)
  - Do not advertise /usb in help output (rhbz#1761144)


author: Jason L Tibbitts III <tibbs@math.uh.edu> - 6.5-5
changelog:
  - Fix bug in fix-info-dir which prevented the transfiletriggerpostun script
    from working properly.


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 6.5-6
changelog:
  - Fix fail of test because of unescaped left brace with Perl 5.28
    (patch by Jitka Plesnikova)
    Resolves: #1590308


author: Jason L Tibbitts III <tibbs@math.uh.edu> - 6.5-11
changelog:
  - Fix another issue in fix-info-dir which could lead to an infinite loop in odd
    circumstances.
    Resolves: #1614162


author: Michal Hlavinka <mhlavink@redhat.com> - 1.0.28-10
changelog:
  - fix CVE-2018-19661 and CVE-2018-19662 - buffer over-read in the function
    i2alaw_array in alaw (#1673085)


author: Michal Hlavinka <mhlavink@redhat.com> - 1.0.28-10.1
changelog:
  - a crafted wav file could cause heap buffer overflow that allowed an arbitrary code execution(#1985027)


author: Pavel Raiskup <praiskup@redhat.com> 2.15-1
changelog:
  - argparse: handle old-style commands *before* ignoring "--" (awilliam@redhat.com)
  - Update mock.1 (cheese@nosuchhost.net)


author: Pavel Raiskup <praiskup@redhat.com> 2.16-1
changelog:
  - disable system call filtering
  - pass env to podman run (dani@lapiole.org)
  - give user alternative help for missing 'epel-8-*' configs
  - podman, explictily specify stdin as tar source (vreeland.justin@gmail.com)
  - add a new 'ssl_extra_certs' option (patrick@laimbock.com)


author: Pavel Raiskup <praiskup@redhat.com> 3.0-1
changelog:
  - mock v3 contains several Python 2.7 (EL7) incompatibilites
    https://github.com/rpm-software-management/mock/issues/755
  - disable SECCOMP for Podman by default
  - opt in for SECCOMP invented
  - create simple_load_config() for use in 3rd party SW (msuchy@redhat.com)
  - implement --list-chroots command (msuchy@redhat.com)
  - add cachedir to output of hw_info plugin (msuchy@redhat.com)
  - mock: copy /usr/share/pki source CA certificates (dereks@lifeofadishwasher.com)
  - add missing args for --scrub and --short-circuit into bash
    completion (didiksupriadi41@fedoraproject.org)
  - remove el7 specific parts from the spec file (msuchy@redhat.com)


author: Pavel Raiskup <praiskup@redhat.com> 3.1-1
changelog:
  - let rpmbuild know that it should not clean up after itself (msuchy@redhat.com)
  - typo in the subscription error message
  - root_cache: simplify decompressing with BSD tar
  - switch from /bin/gtar to /bin/tar by default


author: Pavel Raiskup <praiskup@redhat.com> 3.2-1
changelog:
  - Fix the docker environment check for cgroupv2 (achal.velani@oracle.com)
  - mock-scm: recommend rpkg-util
  - don't use rpmbuild --noclean option if not supported
  - do only one fork() while reading --list-chroots configs
  - Error() (exceptions) code rewritten and simplified
  - dropped mock SGID from /var/{lib,cache}/mock dirs
  - change license to spdx (msuchy@redhat.com)
  - podman.py: don't let podman warnings taint container id (micho@redhat.com)


author: Pavel Raiskup <praiskup@redhat.com> 3.4-1
changelog:
  - make device mapper control device available if supported (neal@gompa.dev)
  - check for target specific qemu-user-static (msuchy@redhat.com)


author: Pavel Raiskup <praiskup@redhat.com> 3.5-1
changelog:
  - check for qemu-user-static raises InvalidArchitecture()
  - forcearch: map armv7hl to the /usr/bin/qemu-arm-static binary
  - more pedantic check for the qemu-*-static binaries


author: Pavel Raiskup <praiskup@redhat.com> 4.0-1
changelog:
  - cleanup the bootstrap image logic so it works if Mock is run in container
  - rebuild: kill orphans when mounted
  - bootstrap: delay the buildroot-in-bootstrap recursive mount
  - use shlex instead of pipes
  - fix bootstrap_* prefixed config_opts options
  - manual page: fix the "how to fill an issue" info
  - support for DNF5 added
  - use -N instead of -n for useradd (msuchy@redhat.com)
  - mock: don't use distutils copy_tree()


author: Pavel Raiskup <praiskup@redhat.com> 4.1-1
changelog:
  - bootstrap: fix certificate copying into the bootstrap chroot
  - don't strictly require any package manager
  - config: properly configure package manager commands
  - unify the fallback-detection for host/bootstrap/bootstrap-image
  - bind_mount plug-in: pre-create dest directory before bind-mounting a file
  - bootstrap: use DNF5 in package manager fallbacks
  - fix --dnf-cmd traceback with the new package_manager logic


author: Nathan Scott <nathans@redhat.com> - 5.3.0-1
changelog:
  - Allow pcp-atop to filter processes on state (BZ 1807046)
  - Dynamically adjust the pmproxy open file limit (BZ 1954711)
  - Rebase to a more recent upstream version of PCP (BZ 1922040)
  - PCP scalability and memory footprint improvements (BZ 1942292)


author: Nathan Scott <nathans@redhat.com> - 5.3.0-4
changelog:
  - Improve pmchart duplicate archive diagnostics (BZ 1615718)
  - Save pmchart users prefered archive locations (BZ 1615742)
  - Remove libvarlink dependency from podman PMDA (BZ 1956608)


author: Nathan Scott <nathans@redhat.com> - 5.3.1-1
changelog:
  - Improved diagnostics from pmie service scripts (BZ 1954576)
  - Drop option configuration file env var setting (BZ 1967174)
  - Add pmie support for thermal throttle detection (BZ 1908212)
  - Annotate a couple of obscure config files in rpm (BZ 1964253)
  - Rebase to a more recent upstream version of PCP (BZ 1922040)


author: Nathan Scott <nathans@redhat.com> - 5.3.1-2
changelog:
  - Fix pmproxy parallel TLS requests bug (BZ 1947989)
  - Backport pmrep archive creation fix (BZ 1974266)


author: Mark Goodwin <mgoodwin@redhat.com> - 5.3.1-3
changelog:
  - Improve pmproxy and libpcp_web scalability (BZ 1975069)
  - Provide a pcp-ss(1) tool in pcp-system-tools (BZ 1879350)


author: guoqing <guoqing@nfschina.com> - 3.28.2-28.14
changelog:
  - Bug 75196  【产品优化】解决随机生成的密码强度可能不足
  - Add gnome-control-center-3.28.2-fix-password-strength-level.patch


author: xupengfei <xupengfei@nfschina.com> - 3.28.2-28.3
changelog:
  - Bug_0370877：通过设置-详细信息-用户新建普通用户时输入全名出现报错
  - Add patch: gnome-control-center-3.28.2-some-changes-about-user-account.patch


author: Jarod Wilson <jarod@redhat.com> - 3.2.1-8
changelog:
  - Remove python2 bits entirely, fix mpi lib dependencies
  - Remove obsolete Provides/Obsoletes for mpich2
  - Resolves: rhbz#1628628


author: Honggang Li <honli@redhat.com> - 3.3.2-8
changelog:
  - Sync with Fedora build
  - Update to latest upstream release 3.3.2
  - Resolves: rhbz#1657316, rhbz#1732982, rhbz#1850080


author: Gopal Tiwari <gtiwari@redhat.com> - 5.56-1
changelog:
  + bluez-5.56-1
  - Fixing (#1965057)
  - Removing bccmd, enabling hid2hci as upstream removed the support in bluez-5.56


author: Daiki Ueno <dueno@redhat.com> - 4.9-2
changelog:
  - Fix CVE-2023-23009: remote DoS via crafted TS payload with an
    incorrect selector length (rhbz#2173674)


author: Sahana Prasad <sahana@redhat.com> - 4.9-3
changelog:
  - Fix CVE-2023-30570:Malicious IKEv1 Aggressive Mode packets can crash
    libreswan
  - Resolves: rhbz#2187171


author: Sahana Prasad <sahana@redhat.com> - 4.9-5
changelog:
  - Just bumping up the version to include bugs for CVE-2023-2295. There is no
    code fix for it. Fix for it is including the code fix for CVE-2023-30570.
  - Fix CVE-2023-2295 Regression of CVE-2023-30570 fixes in the
    Red Hat Enterprise Linux
  - Resolves: rhbz#2189777, rhbz#2190148


author: Sandro Mani <manisandro@gmail.com> - 5.2.1-5
changelog:
  - Fix several defects found by Coverity scan
  - Generate HTML docs with consistent section IDs to avoid multilib difference


author: Ryan O'Hara <rohara@redhat.com> - 2.4.7-1
changelog:
  - Update to 2.4.7 (#1966688)
  - Fix domain parts in :scheme and :path fields (CVE-2021-39240, #1998196)
  - Fix spaces in the :method field (CVE-2021-39241, #1998198)
  - Fix mismatch between :authority and Host fields (CVE-2021-39242, #1998200)
  - Fix request smuggling attack or response splitting (CVE-2021-40346, #2000621)


author: Pavel Raiskup <praiskup@redhat.com> - 1.30-1
changelog:
  - rebase to latest upstream release, per release notes
    http://lists.gnu.org/archive/html/info-gnu/2017-12/msg00011.html


author: Jakub Martisko <jamartis@redhat.com> - 0.13.71-1
changelog:
  - Rebase to 0.13.71
  - Drop the CVE patches, they are now part of the upstream package
  - Build no longer requires python2
  - Resolves: 1807565


author: Jakub Martisko <jamartis@redhat.com> - 0.13.71-7
changelog:
  - Remove the doc/zzipdoc/{options,match}.py scritps from the original tar
  - Replace them with a current github version
  - The original version of the files contains autogenerated header with incompatible license
  - This build thus uses modified tar archive
  Resolves: rhbz#1982241


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.52.20-4
changelog:
  - Python 2 binary package renamed to python2-newt
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Miroslav Lichvar <mlichvar@redhat.com> - 0.52.20-8
changelog:
  - rename newt-python3 subpackage to python3-newt
  - build python3 subpackage unconditionally
  - don't use unversioned python_sitearch macro
  - drop static subpackage
  - use macro for ldconfig scriptlets
  - add gcc to build requirements
  - fix description of python2-newt


author: Michal Hlavinka <mhlavink@redhat.com> - 3.7.0-1
changelog:
  - pciutils updated to 3.7.0, add support for basic DVSEC and CXL DVSEC (#1856436)
  - add support for RCEC Associated Endpoint (#1856440)


author: chunchao <chunchao@nfschina.com> [4.19.113-18.107.nfs]
changelog:
  - Fix: net/phy: hns3 driver error message about mac speed -1.
  - Upstream patch: c36757eb9dee13681227ad3676d37f14b3a2b2af
  - net: phy: consider AN_RESTART status when reading link status
  - Upstream patch: 729f9d5ee3740196071dc15031ce48f3e7659b9a
  - phy: avoid unnecessary link-up delay in polling mode


author: fenghui <fenghui@nfschina.com> [4.19.113-18.108.nfs]
changelog:
  - Fix:	fix rtc on the SW. add kernel-4.19.113-fix-rtc-on-sw.patch from yangminglei.
    	Config: CONFIG_I2C_DEBUG_CORE=y CONFIG_I2C_DEBUG_BUS=y CONFIG_RTC_DRV_PCF8523=y


author: zhuyunfei <zhuyunfei@nfschina.com> [4.19.113-18.109.nfs]
changelog:
  - Fix bug77288: drivers/base/memory.c: indicate all memory blocks as removable
  - commit id : 51f1a9252159db4fa871381c0d34c97fa94eb500 from anolis cloud-kernel
    commit id : 53cdc1cb29e87ce5a61de5bb393eb08925d14ede from upstream kernel.org


author: Sérgio Basto <sergio@serjux.com> - 0.103.3-7
changelog:
  - (#2006490) follow the Fedora Packaging Guidelines by adding %dir
    %attr(0710,%scanuser,virusgroup) to %files section, it is needed on epel7 on
    initial installation without reboot.


author: Sérgio Basto <sergio@serjux.com> - 0.103.3-8
changelog:
  - (#2006490) second try to fix epel7, revert previous commit and add on
    initial installation (not in updates) run /bin/systemd-tmpfiles --create (...)


author: Sérgio Basto <sergio@serjux.com> - 0.103.3-9
changelog:
  - Get rid of pkgdatadir variable %{_datadir}/%{name} is more informative
  - Get rid og milterlog variable %{_var}/log/clamav-milter.log is more readable
  - we can remove %{_var}/log/clamav-milter.log because journalctl -u clamav-milter
    supersede it
  - Fix substitution of /var/run/clamd/clamd.socket on file clamav-milter.conf
  - Get rid of scanstatedir and milterstatedir variables
  - smartsubst deleted since we notice does not replace anything
  - more cleanups
  - $RPM_BUILD_ROOT  + /builddir/build/BUILDROOT/clamav-0.103.6-1.1.nfs4.x86_64
  - all variavels with {}
  - BR _chmod and chown only in oldfreshclam
  - clean rpath clean


author: wanggy <guangyun@nfschina.com> [4.19.113-18.111.nfs]
changelog:
  - iommu/vt-d: Fix agaw for a supported 48 bit guest address width
  - from https://gitee.com/anolis/cloud-kernel.git  
  - commit:44778532633e6f49089a628fd785228e8ac6c372


author: chunchao <chunchao@nfschina.com> [4.19.113-18.112.nfs]
changelog:
  - crypto/ccp: Verify access to device registers before initializing
  - upstream commmit id: 03f008c52b76114b83483de2cf15ed36fc34930c


author: chunchao <chunchao@nfschina.com> [4.19.113-18.113.nfs]
changelog:
  - PCI/ACPI: Allow _OSC presence to be optional for PCI
  - upstream commmit id: c238252f86c1833fc0cbee3ce3b4c295d3ab24ef


author: Davide Caratti <dcaratti@redhat.com> - 1:2.9-2
changelog:
  - Fix AP mode PMF disconnection protection bypass (CVE-2019-16275)
  - Fix NULL dereference in d-bus handler when P2P control interface is removed (rh #1752780)
  - enable WIFI_DISPLAY (rh #1755941)


author: Davide Caratti <dcaratti@redhat.com> - 1:2.9-3
changelog:
  - fix p2p_listen unexpectedly stopped after 5 seconds (rh #1693684)
  - allow changing 'bridge' via D-Bus (rh #1888050)
  - expose OWE configurability via D-Bus (rh #1888718)


author: Davide Caratti <dcaratti@redhat.com> - 1:2.9-5
changelog:
  - P2P: Fix a corner case in peer addition based on PD Request (CVE-2021-27803)
  - Fix buffer overflow when processing P2P group information (CVE-2021-0326)


author: Paul Howarth <paul@city-fan.org> - 1.8.0-10
changelog:
  - Explicitly run the test suite in the en_US.UTF-8 locale to work around flaky
    locale settings in mock builders


author: Paul Howarth <paul@city-fan.org> - 1.8.1-1
changelog:
  - Update to 1.8.1
    - Fixed possible integer overflow when reading a specially crafted packet
      (CVE-2019-3855)
    - Fixed possible integer overflow in userauth_keyboard_interactive with a
      number of extremely long prompt strings (CVE-2019-3863)
    - Fixed possible integer overflow if the server sent an extremely large
      number of keyboard prompts (CVE-2019-3856)
    - Fixed possible out of bounds read when processing a specially crafted
      packet (CVE-2019-3861)
    - Fixed possible integer overflow when receiving a specially crafted exit
      signal message channel packet (CVE-2019-3857)
    - Fixed possible out of bounds read when receiving a specially crafted exit
      status message channel packet (CVE-2019-3862)
    - Fixed possible zero byte allocation when reading a specially crafted SFTP
      packet (CVE-2019-3858)
    - Fixed possible out of bounds reads when processing specially crafted SFTP
      packets (CVE-2019-3860)
    - Fixed possible out of bounds reads in _libssh2_packet_require(v)
      (CVE-2019-3859)
  - Fix mis-applied patch in the fix of CVE-2019-3859
    - https://github.com/libssh2/libssh2/issues/325
    - https://github.com/libssh2/libssh2/pull/327


author: Paul Howarth <paul@city-fan.org> - 1.8.2-1
changelog:
  - Update to 1.8.2
    - Fixed the misapplied userauth patch that broke 1.8.1
    - Moved the MAX size declarations from the public header


author: Paul Howarth <paul@city-fan.org> - 1.9.0-1
changelog:
  - Update to 1.9.0
    - Fixed integer overflow leading to out-of-bounds read (CVE-2019-13115)
    - Adds ECDSA keys and host key support when using OpenSSL
    - Adds ED25519 key and host key support when using OpenSSL 1.1.1
    - Adds OpenSSH style key file reading
    - Adds AES CTR mode support when using WinCNG
    - Adds PEM passphrase protected file support for libgcrypt and WinCNG
    - Adds SHA256 hostkey fingerprint
    - Adds libssh2_agent_get_identity_path() and libssh2_agent_set_identity_path()
    - Adds explicit zeroing of sensitive data in memory
    - Adds additional bounds checks to network buffer reads
    - Adds the ability to use the server default permissions when creating sftp directories
    - Adds support for building with OpenSSL no engine flag
    - Adds support for building with LibreSSL
    - Increased sftp packet size to 256k
    - Fixed oversized packet handling in sftp
    - Fixed building with OpenSSL 1.1
    - Fixed a possible crash if sftp stat gets an unexpected response
    - Fixed incorrect parsing of the KEX preference string value
    - Fixed conditional RSA and AES-CTR support
    - Fixed a small memory leak during the key exchange process
    - Fixed a possible memory leak of the ssh banner string
    - Fixed various small memory leaks in the backends
    - Fixed possible out of bounds read when parsing public keys from the server
    - Fixed possible out of bounds read when parsing invalid PEM files
    - No longer null terminates the scp remote exec command
    - Now handle errors when Diffie Hellman key pair generation fails
    - Fixed compiling on Windows with the flag STDCALL=ON
    - Improved building instructions
    - Improved unit tests
  - Needs OpenSSL ≥ 1.0.1 now as ECC support is assumed
  - Modernize spec somewhat as EL-6 can no longer be supported


author: Paul Howarth <paul@city-fan.org> - 1.9.0-5
changelog:
  - Switch to https:// upstream URLs
  - Full groff (not just groff-base) needed for the mansyntax check


author: Jason L Tibbitts III <tibbs@math.uh.edu> - 3.7.4-16
changelog:
  - Change dependency from ghostscript to ghostscript-x11 to match the
    reorganized ghostscript package.


author: Antonio Trande <sagitter@fedoraproject.com> - 1.8.20-3
changelog:
  - Force default ldflags for Fedora (bz#1548533)
  - Switch -shared flag to -Wl,--as-needed
  - Modify low optimization level for gnu compilers
  - New URL


author: Orion Poplawski <orion@nwra.com> - 0.19-3
changelog:
  - Use autoreconf -f to remove rpath
  - Use --disable-static to disable static builds
  - Use current make macros


author: Norbert Pocs <npocs@redhat.com> - 0.9.6-1
changelog:
  - Fix CVE-CVE-2021-3634 libssh: possible heap-based buffer
    overflow when rekeying
  - Resolves: rhbz#1994600


author: Andreas Schneider <asn@redhat.com> - 0.10.3-1
changelog:
  - Update to version 0.10.3
    https://git.libssh.org/projects/libssh.git/tag/?h=libssh-0.10.3
    https://git.libssh.org/projects/libssh.git/tag/?h=libssh-0.10.2
    https://git.libssh.org/projects/libssh.git/tag/?h=libssh-0.10.1
    https://git.libssh.org/projects/libssh.git/tag/?h=libssh-0.10.0
  - Removed libssh-0.9.6-openssh-8.8p1-compat.patch
  - resolves: rhbz#2121741


author: Pavel Raiskup <praiskup@redhat.com> 34.3-1
changelog:
  - Add Oracle Linux 8 (ngompa13@gmail.com)
  - Add Oracle Linux 7 (ngompa13@gmail.com)
  - Add openSUSE Leap 15.3 (ngompa13@gmail.com)
  - openSUSE Leap 15.1 is EOL (ngompa13@gmail.com)
  - Add openSUSE Tumbleweed s390x config (ngompa13@gmail.com)
  - Add AlmaLinux 8 configs (ngompa13@gmail.com)
  - Remove make from default ELN buildroot (miro@hroncok.cz)


author: Pavel Raiskup <praiskup@redhat.com> 34.4-1
changelog:
  - Add GPG keys and RPM repositories for openSUSE Leap 15.3 (ngompa13@gmail.com)
  - EOL Fedora 32 (msuchy@redhat.com)
  - sync centos-stream-8 with centos-stream-repos (msuchy@redhat.com)


author: Pavel Raiskup <praiskup@redhat.com> 34.5-1
changelog:
  - Add CentOS Stream 9 "preview" files
  - Add rocky support to mock (tucklesepk@gmail.com)
  - Add AlmaLinux 8 AArch64 target (ngompa13@gmail.com)
  - Add AlmaLinux Devel repo as an optional repo for AlmaLinux 8 (ngompa13@gmail.com)
  - Fix GPG key path for SLE updates in openSUSE Leap 15.3 (ngompa13@gmail.com)
  - Move Requires of shadow-utils from mock-core-configs to mock-filesystem (msuchy@redhat.com)
  - Switch CentOS templates to use quay.io images for bootstrap (carl@george.computer)
  - Add epel-next-8 configs (carl@george.computer)


author: Pavel Raiskup <praiskup@redhat.com> 34.6-1
changelog:
  - Disable Rocky Linux "Devel" repo by default (ngompa13@gmail.com)
  - Fix URL for Rocky Linux repos in commented out "baseurl" lines
    (ngompa13@gmail.com)


author: Miroslav Suchý <msuchy@redhat.com> 36-1
changelog:
  - config: Align CentOS Stream 9 with the production configuration
    (ngompa13@gmail.com)
  - config: Disable installing weak dependencies on RHEL rebuilds
    (ngompa13@gmail.com)
  - config: Disable installing weak dependencies on CentOS Stream
    (ngompa13@gmail.com)
  - config: Validate GPG signatures for CentOS Stream 9 (ngompa13@gmail.com)
  - Add eurolinux-8 x86_64 and i686 buildroots (alex@euro-linux.com)


author: Pavel Raiskup <praiskup@redhat.com> 36.1-1
changelog:
  - Finalize CentOS Stream 9 configuration (ngompa13@gmail.com)
  - Update Oraclelinux 7/8 configs and add Oraclelinux EPEL 7/8 configs (darren.archibald@oracle.com)


author: Pavel Raiskup <praiskup@redhat.com> 36.3-1
changelog:
  - add EuroLinux 8 aarch64 (alex@euro-linux.com)
  - add HA and RS configs to EuroLinux configs (alex@euro-linux.com)
  - Add epel9-next configs (carl@george.computer)


author: Paul Howarth <paul@city-fan.org> - 1.21-1
changelog:
  - Update to 1.21
    - Declare variables with our() to avoid warnings (GH#109, GH#171)
    - Empty mapping value at the end resolves to null (was becoming empty string)
      (GH#131, GH#170)
    - Output key in warning when duplicate key was found (GH#119, GH#169)
    - Allow reading and writing to IO::Handle (GH#157, GH#168)


author: Paul Howarth <paul@city-fan.org> - 1.24-1
changelog:
  - Update to 1.24
    - Fix $LoadCode (GH#180, GH#181, GH#182)
  - This release by TINITA → update source URL
  - Drop redundant Group: tag


author: Miro Hrončok <mhroncok@redhat.com> - 1.2.1-9
changelog:
  - Subpackage python2-Bottleneck has been removed
    See https://fedoraproject.org/wiki/Changes/Mass_Python_2_Package_Removal


author: Paul Howarth <paul@city-fan.org> - 2.10.2-1
changelog:
  - Update to 2.10.2
    - Fix Python 2 compatibility breakage introduced in 2.10.1 (GH#2001)
  - Re-enable sftp tests, no longer failing under mock


author: Paul Howarth <paul@city-fan.org> - 2.10.3-1
changelog:
  - Update to 2.10.3
    - Certificate-based pubkey auth was inadvertently broken when adding SHA2
      support in version 2.9.0 (GH#1963, GH#1977)
    - Switch from module-global to thread-local storage when recording thread IDs
      for a logging helper; this should avoid one flavor of memory leak for
      long-running processes (GH#2002, GH#2003)


author: Paul Howarth <paul@city-fan.org> - 2.10.4-1
changelog:
  - Update to 2.10.4
    - Update 'camelCase' method calls against the 'threading' module to be
      'snake_case'; this and related tweaks should fix some deprecation warnings
      under Python 3.10 (GH#1838, GH#1870, GH#2028)
    - '~paramiko.pkey.PKey' instances' '__eq__' did not have the usual safety
      guard in place to ensure they were being compared to another 'PKey' object,
      causing occasional spurious 'BadHostKeyException', among other things
      (GH#1964, GH#2023, GH#2024)
    - Servers offering certificate variants of hostkey algorithms (e.g.
      'ssh-rsa-cert-v01@openssh.com') could not have their host keys verified by
      Paramiko clients, as it only ever considered non-cert key types for that
      part of connection handshaking (GH#2035)


author: Paul Howarth <paul@city-fan.org> - 2.11.0-1
changelog:
  - Update to 2.11.0
    - Align signature verification algorithm with OpenSSH re: zero-padding
      signatures that don't match their nominal size/length; this shouldn't
      affect most users, but will help Paramiko-implemented SSH servers handle
      poorly behaved clients such as PuTTY (GH#1933)
    - OpenSSH 7.7 and older has a bug preventing it from understanding how to
      perform SHA2 signature verification for RSA certificates (specifically
      certs - not keys), so when we added SHA2 support it broke all clients using
      RSA certificates with these servers; this has been fixed in a manner similar
      to what OpenSSH's own client does - a version check is performed and the
      algorithm used is downgraded if needed (GH#2017)
    - Recent versions of Cryptography have deprecated Blowfish algorithm support;
      in lieu of an easy method for users to remove it from the list of
      algorithms Paramiko tries to import and use, we've decided to remove it
      from our "preferred algorithms" list, which will both discourage use of a
      weak algorithm, and avoid warnings (GH#2038, GH#2039)
    - Windows-native SSH agent support as merged in 2.10 could encounter
      'Errno 22' 'OSError' exceptions in some scenarios (e.g. server not cleanly
      closing a relevant named pipe); this has been worked around and should be
      less problematic (GH#2008, GH#2010)
    - Add SSH config token expansion (eg '%h', '%p') when parsing 'ProxyJump'
      directives (GH#1951)
    - Apply unittest 'skipIf' to tests currently using SHA1 in their critical
      path, to avoid failures on systems starting to disable SHA1 outright in
      their crypto backends (e.g. RHEL 9) (GH#2004, GH#2011)


author: Paul Howarth <paul@city-fan.org> - 2.12.0-1
changelog:
  - Update to 2.12.0 (rhbz#2140281)
    - Add a 'transport_factory' kwarg to 'SSHClient.connect' for advanced users
      to gain more control over early Transport setup and manipulation (GH#2054,
      GH#2125)
    - Update '~paramiko.client.SSHClient' so it explicitly closes its wrapped
      socket object upon encountering socket errors at connection time; this
      should help somewhat with certain classes of memory leaks, resource
      warnings, and/or errors (though we hasten to remind everyone that Client
      and Transport have their own '.close()' methods for use in non-error
      situations!) (GH#1822)
    - Raise '~paramiko.ssh_exception.SSHException' explicitly when blank private
      key data is loaded, instead of the natural result of 'IndexError'; this
      should help more bits of Paramiko or Paramiko-adjacent codebases to
      correctly handle this class of error (GH#1599, GH#1637)
  - Use SPDX-format license tag


author: Paul Howarth <paul@city-fan.org> - 2.12.0-2
changelog:
  - Address CVE 2023-48795 (a.k.a. the "Terrapin Attack", a vulnerability found
    in the SSH protocol re: treatment of packet sequence numbers) as follows:
    - The vulnerability only impacts encrypt-then-MAC digest algorithms in tandem
      with CBC ciphers, and ChaCha20-poly1305; of these, Paramiko currently only
      implements ``hmac-sha2-(256|512)-etm`` in tandem with 'AES-CBC'
    - As the fix for the vulnerability requires both ends of the connection to
      cooperate, the below changes will only take effect when the remote end is
      OpenSSH ≥ 9.6 (or equivalent, such as Paramiko in server mode, as of this
      patch version) and configured to use the new "strict kex" mode
    - Paramiko will always attempt to use "strict kex" mode if offered by the
      server, unless you override this by specifying 'strict_kex=False' in
      'Transport.__init__'
    - Paramiko will now raise an 'SSHException' subclass ('MessageOrderError')
      when protocol messages are received in unexpected order; this includes
      situations like receiving 'MSG_DEBUG' or 'MSG_IGNORE' during initial key
      exchange, which are no longer allowed during strict mode
    - Key (re)negotiation, i.e. 'MSG_NEWKEYS', whenever it is encountered, now
      resets packet sequence numbers (this should be invisible to users during
      normal operation, only causing exceptions if the exploit is encountered,
      which will usually result in, again, 'MessageOrderError')
    - Sequence number rollover will now raise 'SSHException' if it occurs during
      initial key exchange (regardless of strict mode status)
  - Tweak 'ext-info-(c|s)' detection during KEXINIT protocol phase; the original
    implementation made assumptions based on an OpenSSH implementation detail
  - 'Transport' grew a new 'packetizer_class' kwarg for overriding the
    packet-handler class used internally; this is mostly for testing, but advanced
    users may find this useful when doing deep hacks
  - A handful of lower-level classes (notably 'paramiko.message.Message' and
    'paramiko.pkey.PKey') previously returned 'bytes' objects from their
    implementation of '__str__', even under Python 3, and there was never any
    '__bytes__' method; these issues have been fixed by renaming '__str__' to
    '__bytes__' and relying on Python's default "stringification returns the
    output of '__repr__'" behavior re: any real attempts to 'str()' such objects


author: Miro Hrončok <mhroncok@redhat.com> - 3.5.2-2
changelog:
  - Subpackage python2-tables has been removed
    See https://fedoraproject.org/wiki/Changes/Mass_Python_2_Package_Removal


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.0.4-3
changelog:
  - Python 2 binary package renamed to python2-chardet
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.4.1-8
changelog:
  - Python 2 binary package renamed to python2-nose-exclude
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Frantisek Zatloukal <fzatlouk@redhat.com> - 0.3.7-1
changelog:
  - Update to upstream 0.3.7 release
  - Drop upstreamed patch: 0003-Fix-tests_api-list-traceback.patch
  - Drop upstreamed patch: 0001-Fix-arguments-with-type-list-705.patch
  - Drop upstreamed patch: 0002-Support-aniso8601-3.0-in-tests.patch
  - Drop no longer needed patch: python-flask-restful.remove_q0_testcase.patch
  - Drop Fedora 27 support
  - Drop Python 2 support


author: Miro Hrončok <mhroncok@redhat.com> - 2.6.6-3
changelog:
  - Subpackage python2-numexpr has been removed
    See https://fedoraproject.org/wiki/Changes/Mass_Python_2_Package_Removal


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2.7.0-1
changelog:
  - Update to latest version (#1614993)
  - Various modernization to the spec file. Actually fail %check if the test
    suite fails.


author: Miro Hrončok <mhroncok@redhat.com> - 0.24.1-2
changelog:
  - Subpackage python2-pandas has been removed
    See https://fedoraproject.org/wiki/Changes/Mass_Python_2_Package_Removal


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.1.10-11
changelog:
  - Drop explicit locale setting
    See https://fedoraproject.org/wiki/Changes/Remove_glibc-langpacks-all_from_buildroot


author: Miro Hrončok <mhroncok@redhat.com> - 1.1.10-13
changelog:
  - Subpackage python2-setproctitle has been removed
    See https://fedoraproject.org/wiki/Changes/Mass_Python_2_Package_Removal


author: Pavel Raiskup <praiskup@redhat.com>
changelog:
  - make the TemplatedDictionary objects picklable
  - Use a sandboxed jinja2 environment, CVE-2023-6395


author: Pavel Raiskup <praiskup@redhat.com>
changelog:
  - make the TemplatedDictionary objects picklable
  - use a sandboxed jinja2 environment, fixes CVE-2023-6395


author: Miro Hrončok <mhroncok@redhat.com> - 1.2.0-3
changelog:
  - Subpackage python2-vine has been removed
    See https://fedoraproject.org/wiki/Changes/Mass_Python_2_Package_Removal


author: Jaroslav Škarvada <jskarvad@redhat.com> - 4.96-2
changelog:
  - Fixed "tainted search query is not properly quoted" for greylisting,
    patch provided by Marcel Härry <mh+fedora@scrit.ch>


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.19.2-6
changelog:
  - Drop old trigger scriplet
  - Reenable package notes and strip LDFLAGS from krb5-config (rhbz#2048909)


author: Julien Rische <jrische@redhat.com> - 1.19.2-10
changelog:
  - Use p11-kit as default PKCS11 module
  - Resolves: rhbz#2073274
  - Try harder to avoid password change replay errors
  - Resolves: rhbz#2072059


author: Julien Rische <jrische@redhat.com> - 1.19.2-11
changelog:
  - Allow libkrad UDP/TCP connection to localhost in FIPS mode
  - Resolves: rhbz#2082189
  - Read GSS configuration files with mtime 0


author: Andreas Schneider <asn@redhat.com> - 1.19.2-12
changelog:
  - Use baserelease to set the release number
  - Do not define netlib, but use autoconf detection for res_* functions
  - Add missing BR for resolv_wrapper to run t_discover_uri.py


author: Isaac Boukris <iboukris@redhat.com> - 2.2.0-1
changelog:
  - Resolves: rhbz#1878114 - Rebase libldb to the version required by Samba
  - Resolves: rhbz#1794349 - Build libldb with lmdb support


author: Andreas Schneider <asn@redhat.com> - 2.3.0-1
changelog:
  - resolves: rhbz#1945021 - Update to version 2.3.0
  - resolves: rhbz#1897082 - Fix libldb tests on aarch64


author: Matt Domsch <mdomsch@fedoraproject.org> - 1.4.2-5
changelog:
  - Add systemd protections and restart
  - Use systemd RuntimeDirectory instead of tmpfiles where possible
  - Default config file to using local socket


author: Jakub Hrozek <jhrozek@redhat.com> - 2.1.16-1
changelog:
  - Resolves: rhbz#1684577 - Rebase libtalloc to version 2.1.16 for Samba
  - Resolves: rhbz#1597315 - libtalloc uses Python 2 to build
  - Resolves: rhbz#1567136 - libtalloc: Drop Python 2 subpackage from RHEL 8


author: Jakub Hrozek <jhrozek@redhat.com> - 2.1.16-2
changelog:
  - Remove python2 libraries on upgrade
  - Resolves: rhbz#1567136 - libtalloc: Drop Python 2 subpackage from RHEL 8


author: Jakub Hrozek <jhrozek@redhat.com> - 2.1.16-3
changelog:
  - Also obsolete python2-libtalloc-debuginfo
  - Resolves: rhbz#1567136 - libtalloc: Drop Python 2 subpackage from RHEL 8


author: Jakub Hrozek <jhrozek@redhat.com> - 1.3.16-1
changelog:
  - New upstream release 1.3.16
  - Use RHEL_ALLOW_PYTHON2_FOR_BUILD=1 until libtalloc uses waf3
  - Patch the waf script to explicitly call python2 as "env python" doesn't
    yield py2 anymore


author: Jakub Hrozek <jhrozek@redhat.com> - 1.3.18.1
changelog:
  - Resolves: rhbz#1684579 - Rebase libtdb to version 1.3.18 for Samba
  - Resolves: rhbz#1597319 - libtdb uses Python 2 to build
  - Resolves: rhbz#1567138 - libtdb: Drop Python 2 subpackage from RHEL 8


author: Jakub Hrozek <jhrozek@redhat.com> - 1.3.18.2
changelog:
  - Obsolete the python2 packages on upgrade
  - Resolves: rhbz#1567138 - libtdb: Drop Python 2 subpackage from RHEL 8


author: Isaac Boukris <iboukris@redhat.com> - 1.4.2-2
changelog:
  - Resolves: rhbz#1754420 - Rebase libtdb 1.4.2 for samba
  - Related: rhbz#1754420 - Fix sssd tests (tdb)


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.37-1
changelog:
  - New upstream release 0.9.37
  - Use RHEL_ALLOW_PYTHON2_FOR_BUILD=1 for build
  - Use %{__python2}, not "python", as the Python2 interpreter


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.39-1
changelog:
  - Resolves: #1684580 - Rebase libtevent to version 0.9.36 for Samba
  - Resolves: #1597318 - libtevent uses Python 2 to build
  - Resolves: #1567139 - libtevent: Drop Python 2 subpackage from RHEL 8


author: Jakub Hrozek <jhrozek@redhat.com>
changelog:
  - Remove the python2 subpackages on upgrade
  - Resolves: #1567139 - libtevent: Drop Python 2 subpackage from RHEL 8


author: Isaac Boukris <iboukris@redhat.com> - 0.10.0-2
changelog:
  - Resolves: #1754421 - Upgrade tevent to 0.10.0 version for samba
  - Related: #1754421 - Fix sssd tests (tevent)


author: Pavel Filipenský <pfilipen@redhat.com> - 4.16.3-0
changelog:
  - related: rhbz#2077468 - Rebase Samba to 4.16.3
  - resolves: rhbz#2106672 - The pcap background queue process should not be stopped
  - resolves: rhbz#2106263 - Fix crash in rpcd_classic
  - resolves: rhbz#2100093 - Fix net ads info returns LDAP server and LDAP server name


author: Andreas Schneider <asn@redhat.com> - 4.17.2-1
changelog:
  - resolves: rhbz#2132051 - Update to version 4.17.2
  - resolves: rhbz#2126174 - Fix CVE-2022-1615
  - resolves: rhbz#2108487 - ctdb: Add dependency to samba-winbind-clients


author: Pavel Filipenský <pfilipen@redhat.com> - 4.17.2-2
changelog:
  - Always add epoch to samba_depver to fix osci.brew-build.rpmdeplint.functional
  - related: rhbz#2132051


author: Pavel Filipenský <pfilipenn@redhat.com> - 4.17.4-0
changelog:
  - related: rhbz#2132051 - Update to version 4.17.4
  - resolves: rhbz#2154370 - Fix CVE-2022-38023
  - resolves: rhbz#2142331 - Fix %U include directive for share listing (netshareenum)
  - resolves: rhbz#2148943 - Fix Winbind to retrieve user groups from Active Directory


author: tingfu <tingfu@nfs-hlj.com> - 8.0p1-10.8 + 0.10.3-7.4
changelog:
  - fix CVE-2023-48795 CVE-2023-38408 CVE-2020-15778
  - add openssh-8.0p1-CVE-2023-48795.patch and openssh-8.0p1-CVE-2023-38408.patch and openssh-8.0p1-CVE-2020-15778.patch


author: fenghui <fenghui@nfschina.com> [4.19.113-18.118.nfs]
changelog:
  - Add: Add hygon security patch
  	0002-bugfix-tpm-revert-patch-newfeature-tpm-ad-sm3-suppor.patch
  	0003-tp0002-bum-use-u32-instead-of-int-for-PCR-index.patch
  	0004-tp0002-bum-add-_head-suffix-to-tcg_efi_specid_event-and-tcg.patch
  	0005-tp0002-bum-dynamically-allocate-the-allocated_banks-array.patch
  	0006-tp0002-bum-rename-and-export-tpm2_digest-and-tpm2_algorithm.patch
  	0007-tp0002-bum-retrieve-digest-size-of-unknown-algorithms-with-.patch
  	0008-tp0002-bum-move-tpm_chip-definition-to-include-linux-tpm.h.patch
  	0009-KE0002-buYS-trusted-explicitly-use-tpm_chip-structure-from-.patch
  	0010-tp0002-bum-pass-an-array-of-tpm_extend_digest-structures-to.patch
  	0011-KE0002-buYS-trusted-allow-module-init-if-TPM-is-inactive-or.patch
  	0012-KE0002-buYS-trusted-correctly-initialize-digests-and-fix-lo.patch
  	0013-cr0002-buypto-rename-sm3-256-to-sm3-in-hash_algo_name.patch
  	0014-tp0002-bum-fix-wrong-return-value-in-tpm_pcr_extend.patch
  	0015-im0002-bua-Switch-to-ima_hash_algo-for-boot-aggregate.patch
  	0016-op0002-buensource-mm-always-have-io_remap_pfn_range-set-pgp.patch
  	0001-op0002-buensource-crypto-AF_ALG-add-sign-verify-API.patch
  	0002-op0002-buensource-crypto-AF_ALG-add-setpubkey-setsockopt-ca.patch
  	0003-op0002-buensource-crypto-AF_ALG-add-asymmetric-cipher.patch
  	0004-ne0002-buwfeature-crypto-CCP-Support-SM2-algorithm-for-hygo.patch
  	0005-ne0002-buwfeature-crypto-CCP-Support-SM3-algorithm-for-hygo.patch
  	0006-ne0002-buwfeature-crypto-CCP-Support-SM4-algorithm-for-hygo.patch
  	0007-ne0002-buwfeature-crypto-CCP-Support-SM4-high-security-modu.patch
  	0008-ne0002-buwfeature-crypto-CCP-Userspace-can-exchange-context.patch
  	0009-bu0002-bugfix-crypto-The-output-data-length-is-not-fixed-fo.patch
  	0010-ne0002-buwfeature-Crypto-ccp-Optimize-the-exchanging-contex.patch
  	0011-bu0002-bugfix-crypto-ccp-It-prompt-ILLEGAL_MEM_ADDR-when-us.patch
  	0012-bu0002-bugfix-crypto-ccp-Only-handle-interrupts-by-completi.patch
  	0013-ne0002-buwfeature-crypto-ccp-Modify-value-of-COMMANDS_PER_Q.patch
  	0014-ne0002-buwfeature-crypto-ccp-Process-multiple-VQ-commands-o.patch
  	0015-bu0002-bugfix-crypto-ccp-It-prompt-failed-when-encrypted-si.patch
  	0016-ne0002-buwfeature-crypto-ccp-Process-multiple-VQ-commands-o.patch
  	0017-bu0002-bugfix-crypto-ccp-Fix-a-problem-that-vq-thread-may-s.patch
  	0018-bu0002-bugfix-crypto-fix-coredump-when-the-data-address-fro.patch
  	0019-hc0002-but-delete-hymccp-moudule-it-will-be-instead-by-hct-.patch
  	0020-Co0002-bummit-Message-Provides-hygon-crypto-technology-ccp-.patch
  	0021-op0002-buensource-x86-KVM-svm-don-t-pretend-to-advance-RIP-.patch
  	0022-op0002-buensource-KVM-SVM-refactor-msr-permission-bitmap-al.patch
  	0023-op0002-buensource-KVM-x86-Refactor-up-kvm_-g-s-et_msr-to-si.patch
  	0024-op0002-buensource-KVM-X86-Move-ignore_msrs-handling-upper-t.patch
  	0025-op0002-buensource-KVM-X86-Do-the-same-ignore_msrs-check-for.patch
  	0026-op0002-buensource-KVM-x86-Return-ENOENT-on-unimplemented-MS.patch
  	0027-op0002-buensource-KVM-x86-Allow-deflecting-unknown-MSR-acce.patch
  	0028-op0002-buensource-KVM-x86-Add-infrastructure-for-MSR-filter.patch
  	0029-op0002-buensource-KVM-x86-Prepare-MSR-bitmaps-for-userspace.patch
  	0030-op0002-buensource-KVM-x86-SVM-Prevent-MSR-passthrough-when-.patch
  	0031-op0002-buensource-KVM-x86-VMX-Prevent-MSR-passthrough-when-.patch
  	0032-op0002-buensource-KVM-VMX-Fix-x2APIC-MSR-intercept-handling.patch
  	0033-op0002-buensource-KVM-x86-Introduce-MSR-filtering.patch
  	0034-op0002-buensource-swiotlb-clear-io_tlb_start-and-io_tlb_end.patch
  	0035-op0002-buensource-swiotlb-Introduce-swiotlb_max_mapping_siz.patch
  	0036-op0002-buensource-swiotlb-Add-is_swiotlb_active-function.patch
  	0037-op0002-buensource-dma-Introduce-dma_max_mapping_size.patch
  	0038-op0002-buensource-virtio-Introduce-virtio_max_dma_size.patch
  	0039-op0002-buensource-virtio_ring-Fix-querying-of-maximum-DMA-m.patch
  	0040-op0002-buensource-virtio-blk-Consider-virtio_max_dma_size-f.patch
  	0041-op0002-buensource-KVM-SVM-Serialize-access-to-the-SEV-ASID-.patch
  	0042-op0002-buensource-KVM-SVM-Guard-against-DEACTIVATE-when-per.patch
  	0043-op0002-buensource-KVM-SVM-Remove-unneeded-WBINVD-and-DF_FLU.patch
  	0044-op0002-buensource-KVM-SVM-Reduce-WBINVD-DF_FLUSH-invocation.patch
  	0045-op0002-buensource-KVM-SVM-Issue-WBINVD-after-deactivating-a.patch
  	0046-op0002-buensource-KVM-SVM-Periodically-schedule-when-unregi.patch
  	0047-op0002-buensource-x86-mem_encrypt-Correct-physical-address-.patch
  	0048-op0002-buensource-KVM-SVM-Add-KVM_SEV-SEND_START-command.patch
  	0049-op0002-buensource-KVM-SVM-Add-KVM_SEND_UPDATE_DATA-command.patch
  	0050-op0002-buensource-KVM-SVM-Add-KVM_SEV_SEND_FINISH-command.patch
  	0051-op0002-buensource-KVM-SVM-Add-support-for-KVM_SEV_SEND_CANC.patch
  	0052-op0002-buensource-KVM-SVM-Add-support-for-KVM_SEV_RECEIVE_S.patch
  	0053-op0002-buensource-KVM-SVM-Add-KVM_SEV_RECEIVE_UPDATE_DATA-c.patch
  	0054-op0002-buensource-KVM-SVM-Add-KVM_SEV_RECEIVE_FINISH-comman.patch
  	0055-op0002-buensource-KVM-SVM-Fix-SEV-SEND_START-session-length.patch
  	0056-op0002-buensource-KVM-SVM-Call-SEV-Guest-Decommission-if-AS.patch
  	0057-op0002-buensource-KVM-X86-Introduce-KVM_HC_MAP_GPA_RANGE-hy.patch
  	0058-op0002-buensource-KVM-SVM-Return-EFAULT-if-copy_to_user-for.patch
  	0059-op0002-buensource-KVM-SVM-fix-missing-sev_decommission-in-s.patch
  	0060-op0002-buensource-KVM-SEV-Pin-guest-memory-for-write-for-RE.patch
  	0061-op0002-buensource-KVM-SEV-Flush-cache-on-non-coherent-syste.patch
  	0062-op0002-buensource-x86-kvm-Add-AMD-SEV-specific-Hypercall3.patch
  	0063-op0002-buensource-mm-x86-Invoke-hypercall-when-page-encrypt.patch
  	0064-op0002-buensource-EFI-Introduce-the-new-AMD-Memory-Encrypti.patch
  	0065-op0002-buensource-x86-kvm-Add-guest-support-for-detecting-a.patch
  	0066-op0002-buensource-x86-kvm-Add-kexec-support-for-SEV-Live-Mi.patch
  	0067-op0002-buensource-anolis-crypto-ccp-Introduce-init-and-free.patch
  	0068-op0002-buensource-anolis-crypto-ccp-Add-support-for-enqueue.patch
  	0069-op0002-buensource-anolis-crypto-ccp-Add-support-for-dequeue.patch
  	0070-op0002-buensource-anolis-crypto-ccp-Add-support-to-switch-t.patch
  	0071-op0002-buensource-anolis-crypto-ccp-Add-support-for-issue-c.patch
  	0072-op0002-buensource-anolis-KVM-SVM-Add-KVM_CSV_COMMAND_BATCH-.patch
  	0073-op0002-buensource-anolis-KVM-SVM-Prepare-memory-pool-to-all.patch
  	0074-op0002-buensource-anolis-KVM-SVM-Add-SEND_UPDATE_DATA-comma.patch
  	0075-op0002-buensource-anolis-KVM-SVM-Add-RECEIVE_UPDATE_DATA-co.patch
  	0076-bu0002-bugfix-HYGON-KVM-SVM-Flush-caches-when-userspace-get.patch
  	0077-bu0002-bugfix-HYGON-x86-mm-Pass-variable-start-to-notify_ra.patch
  	0078-bu0002-bugfix-HYGON-x86-kvm-Correct-number-of-pages-calcula.patch
  	0079-op0002-buensource-crypto-ccp-Add-support-for-SEV-ES-to-the-.patch
  	0080-op0002-buensource-anolis-crypto-ccp-Fix-definition-of-struc.patch
  	0081-op0002-buensource-x86-entry-64-Document-idtentry.patch
  	0082-op0002-buensource-x86-entry-64-Use-the-TSS-sp2-slot-for-SYS.patch
  	0083-op0002-buensource-x86-pti-64-Remove-the-SYSCALL64-entry-tra.patch
  	0084-op0002-buensource-x86-ioremap-Add-an-ioremap_encrypted-help.patch
  	0085-op0002-buensource-iommu-amd-Remap-the-IOMMU-device-table-wi.patch
  	0086-op0002-buensource-kdump-proc-vmcore-Enable-kdumping-encrypt.patch
  	0087-op0002-buensource-fs-proc-vmcore-Enable-dumping-of-encrypte.patch
  	0088-op0002-buensource-x86-kdump-Export-the-SME-mask-to-vmcorein.patch
  	0089-op0002-buensource-x86-boot-Save-several-bytes-in-decompress.patch
  	0090-op0002-buensource-crypto-ccp-fix-the-SEV-probe-in-kexec-boo.patch
  	0091-op0002-buensource-crypto-ccp-Update-driver-messages-to-remo.patch
  	0092-op0002-buensource-x86-entry-Remove-unneeded-need_resched-lo.patch
  	0093-op0002-buensource-x86-irq-64-Remove-a-hardcoded-irq_stack_u.patch
  	0094-op0002-buensource-x86-irq-64-Sanitize-the-top-bottom-confus.patch
  	0095-op0002-buensource-x86-idt-Remove-unused-macro-SISTG.patch
  	0096-op0002-buensource-x86-exceptions-Remove-unused-stack-define.patch
  	0097-op0002-buensource-x86-exceptions-Make-IST-index-zero-based.patch
  	0098-op0002-buensource-x86-cpu_entry_area-Cleanup-setup-function.patch
  	0099-op0002-buensource-x86-exceptions-Add-structs-for-exception-.patch
  	0100-op0002-buensource-x86-cpu_entry_area-Prepare-for-IST-guard-.patch
  	0101-op0002-buensource-x86-cpu_entry_area-Provide-exception-stac.patch
  	0102-op0002-buensource-x86-traps-Use-cpu_entry_area-instead-of-o.patch
  	0103-op0002-buensource-x86-irq-64-Use-cpu-entry-area-instead-of-.patch
  	0104-op0002-buensource-x86-dumpstack-Fix-off-by-one-errors-in-st.patch
  	0105-op0002-buensource-x86-dumpstack-64-Use-cpu_entry_area-inste.patch
  	0106-op0002-buensource-x86-cpu-Prepare-TSS.IST-setup-for-guard-p.patch
  	0107-op0002-buensource-x86-cpu-Remove-orig_ist-array.patch
  	0108-op0002-buensource-x86-exceptions-Disconnect-IST-index-and-s.patch
  	0109-op0002-buensource-x86-exceptions-Enable-IST-guard-pages.patch
  	0110-op0002-buensource-x86-exceptions-Split-debug-IST-stack.patch
  	0111-op0002-buensource-x86-dumpstack-64-Speedup-in_exception_sta.patch
  	0112-op0002-buensource-x86-dumpstack-64-Don-t-evaluate-exception.patch
  	0113-op0002-buensource-x86-kexec-Do-not-map-kexec-area-as-decryp.patch
  	0114-op0002-buensource-x86-kexec-Set-the-C-bit-in-the-identity-m.patch
  	0115-op0002-buensource-x86-boot-Make-the-GDT-8-byte-aligned.patch
  	0116-op0002-buensource-x86-xen-Move-pv-irq-related-functions-und.patch
  	0117-op0002-buensource-x86-entry-64-Simplify-idtentry-a-little.patch
  	0118-op0002-buensource-x86-entry-64-Update-comments-and-sanity-t.patch
  	0119-op0002-buensource-x86-asm-Make-some-functions-local-labels.patch
  	0120-op0002-buensource-linkage-Introduce-new-macros-for-assemble.patch
  	0121-op0002-buensource-x86-asm-Annotate-local-pseudo-functions.patch
  	0122-op0002-buensource-x86-boot-Annotate-data-appropriately.patch
  	0123-op0002-buensource-x86-asm-Use-SYM_INNER_LABEL-instead-of-GL.patch
  	0124-op0002-buensource-x86-insn-eval-Add-support-for-64-bit-kern.patch
  	0125-op0002-buensource-x86-boot-compressed-64-Use-LEA-to-initial.patch
  	0126-op0002-buensource-x86-boot-compressed-64-Use-32-bit-zero-ex.patch
  	0127-op0002-buensource-x86-boot-Remove-KEEP_SEGMENTS-support.patch
  	0128-op0002-buensource-efi-x86-Don-t-depend-on-firmware-GDT-layo.patch
  	0129-op0002-buensource-x86-boot-Reload-GDTR-after-copying-to-the.patch
  	0130-op0002-buensource-x86-boot-GDT-limit-value-should-be-size-1.patch
  	0131-op0002-buensource-x86-boot-Micro-optimize-GDT-loading-instr.patch
  	0132-op0002-buensource-x86-boot-compressed-Fix-reloading-of-GDTR.patch
  	0133-op0002-buensource-x86-boot-Correct-relocation-destination-o.patch
  	0134-op0002-buensource-x86-boot-compressed-Move-.got.plt-entries.patch
  	0135-op0002-buensource-x86-boot-compressed-Force-hidden-visibili.patch
  	0136-op0002-buensource-x86-boot-compressed-Get-rid-of-GOT-fixup-.patch
  	0137-op0002-buensource-x86-boot-compressed-64-Switch-to-__KERNEL.patch
  	0138-op0002-buensource-tracing-Provide-lockdep-less-trace_hardir.patch
  	0139-op0002-buensource-vmlinux.lds.h-Create-section-for-protecti.patch
  	0140-op0002-buensource-lockdep-Prepare-for-noinstr-sections.patch
  	0141-op0002-buensource-x86-traps-Split-trap-numbers-out-in-a-sep.patch
  	0142-op0002-buensource-x86-entry-32-Simplify-common_exception.patch
  	0143-ne0002-buwfeature-HYGON-x86-Move-GET_CR2_INTO-into-common-h.patch
  	0144-op0002-buensource-x86-mm-tracing-Fix-CR2-corruption.patch
  	0145-op0002-buensource-x86-entry-64-Prevent-clobbering-of-saved-.patch
  	0146-op0002-buensource-x86-entry-32-Pass-cr2-to-do_async_page_fa.patch
  	0147-op0002-buensource-x86-entry-64-Reorder-idtentries.patch
  	0148-op0002-buensource-x86-idtentry-Provide-macros-to-define-dec.patch
  	0149-op0002-buensource-x86-entry-common-Provide-idtentry_enter-e.patch
  	0150-op0002-buensource-x86-idtentry-Provide-IDTENTRY_ERRORCODE.patch
  	0151-op0002-buensource-x86-idtentry-Provide-IDTENTRY_RAW.patch
  	0152-op0002-buensource-x86-idtentry-Provide-IDTENTRY_IST.patch
  	0153-op0002-buensource-x86-idtentry-Provide-IDTRENTRY_NOIST-vari.patch
  	0154-op0002-buensource-x86-idtentry-Provide-IDTENTRY_DF.patch
  	0155-op0002-buensource-KVM-SVM-fix-svn_pin_memory-s-use-of-get_u.patch
  	0156-op0002-buensource-x86-cpufeatures-Add-SEV-ES-CPU-feature.patch
  	0157-op0002-buensource-x86-traps-Move-pf-error-codes-to-asm-trap.patch
  	0158-op0002-buensource-x86-insn-Make-inat-tables.c-suitable-for-.patch
  	0159-op0002-buensource-x86-umip-Factor-out-instruction-fetch.patch
  	0160-op0002-buensource-KVM-SVM-Add-GHCB-definitions.patch
  	0161-op0002-buensource-x86-umip-Factor-out-instruction-decoding.patch
  	0162-op0002-buensource-x86-insn-Add-insn_get_modrm_reg_off.patch
  	0163-op0002-buensource-KVM-SVM-Add-GHCB-Accessor-functions.patch
  	0164-op0002-buensource-KVM-SVM-Use-__packed-shorthand.patch
  	0165-op0002-buensource-x86-insn-Add-insn_has_rep_prefix-helper.patch
  	0166-op0002-buensource-x86-boot-compressed-64-Disable-red-zone-u.patch
  	0167-op0002-buensource-x86-boot-compressed-64-Add-IDT-Infrastruc.patch
  	0168-op0002-buensource-x86-boot-compressed-64-Rename-kaslr_64.c-.patch
  	0169-op0002-buensource-x86-boot-compressed-64-Add-page-fault-han.patch
  	0170-op0002-buensource-x86-boot-compressed-64-Always-switch-to-o.patch
  	0171-op0002-buensource-x86-boot-64-Initialize-5-level-paging-var.patch
  	0172-op0002-buensource-x86-boot-compressed-64-Don-t-pre-map-memo.patch
  	0173-op0002-buensource-x86-boot-compressed-64-Change-add_identit.patch
  	0174-op0002-buensource-x86-boot-compressed-64-Add-stage1-VC-hand.patch
  	0175-op0002-buensource-x86-boot-compressed-64-Call-set_sev_encry.patch
  	0176-op0002-buensource-x86-boot-compressed-64-Check-return-value.patch
  	0177-op0002-buensource-x86-boot-compressed-64-Add-set_page_en-de.patch
  	0178-op0002-buensource-x86-boot-compressed-64-Setup-a-GHCB-based.patch
  	0179-op0002-buensource-x86-boot-compressed-64-Unmap-GHCB-page-be.patch
  	0180-op0002-buensource-x86-sev-es-Add-support-for-handling-IOIO-.patch
  	0181-op0002-buensource-x86-fpu-Move-xgetbv-xsetbv-into-a-separat.patch
  	0182-op0002-buensource-x86-sev-es-Add-CPUID-handling-to-VC-handl.patch
  	0183-op0002-buensource-x86-idt-Split-idt_data-setup-out-of-set_i.patch
  	0184-op0002-buensource-x86-head-64-Install-startup-GDT.patch
  	0185-op0002-buensource-x86-head-64-Load-GDT-after-switch-to-virt.patch
  	0186-op0002-buensource-x86-head-64-Load-segment-registers-earlie.patch
  	0187-op0002-buensource-x86-head-64-Switch-to-initial-stack-earli.patch
  	0188-op0002-buensource-x86-head-64-Install-a-CPU-bringup-IDT.patch
  	0189-op0002-buensource-x86-idt-Make-IDT-init-functions-static-in.patch
  	0190-op0002-buensource-x86-head-64-Move-early-exception-dispatch.patch
  	0191-op0002-buensource-x86-sev-es-Add-SEV-ES-Feature-Detection.patch
  	0192-op0002-buensource-x86-sev-es-Print-SEV-ES-info-into-the-ker.patch
  	0193-op0002-buensource-anolis-x86-mm-Print-CSV-info-into-the-ker.patch
  	0194-op0002-buensource-x86-sev-es-Compile-early-handler-code-int.patch
  	0195-op0002-buensource-x86-sev-es-Setup-an-early-VC-handler.patch
  	0196-op0002-buensource-x86-sev-es-Setup-GHCB-based-boot-VC-handl.patch
  	0197-op0002-buensource-x86-sev-es-Setup-per-CPU-GHCBs-for-the-ru.patch
  	0198-op0002-buensource-x86-sev-es-Allocate-and-map-an-IST-stack-.patch
  	0199-op0002-buensource-x86-sev-es-Adjust-VC-IST-Stack-on-enterin.patch
  	0200-op0002-buensource-x86-dumpstack-64-Add-noinstr-version-of-g.patch
  	0201-op0002-buensource-x86-entry-64-Add-entry-code-for-VC-handle.patch
  	0202-op0002-buensource-x86-sev-es-Add-a-Runtime-VC-Exception-Han.patch
  	0203-op0002-buensource-x86-sev-es-Wire-up-existing-VC-exit-code-.patch
  	0204-op0002-buensource-x86-sev-es-Handle-instruction-fetches-fro.patch
  	0205-op0002-buensource-x86-sev-es-Handle-MMIO-events.patch
  	0206-op0002-buensource-x86-sev-es-Handle-MMIO-String-Instruction.patch
  	0207-op0002-buensource-x86-sev-es-Handle-MSR-events.patch
  	0208-op0002-buensource-x86-sev-es-Handle-DR7-read-write-events.patch
  	0209-op0002-buensource-x86-sev-es-Handle-WBINVD-Events.patch
  	0210-op0002-buensource-x86-sev-es-Handle-RDTSC-P-Events.patch
  	0211-op0002-buensource-x86-sev-es-Handle-RDPMC-Events.patch
  	0212-op0002-buensource-x86-sev-es-Handle-INVD-Events.patch
  	0213-op0002-buensource-x86-sev-es-Handle-MONITOR-MONITORX-Events.patch
  	0214-op0002-buensource-x86-sev-es-Handle-MWAIT-MWAITX-Events.patch
  	0215-op0002-buensource-x86-sev-es-Handle-VMMCALL-Events.patch
  	0216-op0002-buensource-x86-sev-es-Handle-AC-Events.patch
  	0217-op0002-buensource-x86-sev-es-Handle-DB-Events.patch
  	0218-op0002-buensource-x86-paravirt-Allow-hypervisor-specific-VM.patch
  	0219-op0002-buensource-x86-kvm-Add-KVM-specific-VMMCALL-handling.patch
  	0220-op0002-buensource-x86-vmware-Add-VMware-specific-handling-f.patch
  	0221-op0002-buensource-x86-realmode-Add-SEV-ES-specific-trampoli.patch
  	0222-op0002-buensource-x86-realmode-Setup-AP-jump-table.patch
  	0223-op0002-buensource-x86-smpboot-Load-TSS-and-getcpu-GDT-entry.patch
  	0224-op0002-buensource-x86-head-64-Don-t-call-verify_cpu-on-star.patch
  	0225-op0002-buensource-x86-sev-es-Support-CPU-offline-online.patch
  	0226-op0002-buensource-x86-sev-es-Handle-NMI-State.patch
  	0227-op0002-buensource-x86-efi-Add-GHCB-mappings-when-SEV-ES-is-.patch
  	0228-op0002-buensource-x86-sev-es-Check-required-CPU-features-fo.patch
  	0229-op0002-buensource-x86-sev-es-Use-GHCB-accessor-for-setting-.patch
  	0230-op0002-buensource-x86-head-64-Disable-stack-protection-for-.patch
  	0231-op0002-buensource-x86-boot-64-Explicitly-map-boot_params-an.patch
  	0232-op0002-buensource-x86-boot-compressed-64-Introduce-sev_stat.patch
  	0233-op0002-buensource-x86-boot-compressed-64-Sanity-check-CPUID.patch
  	0234-op0002-buensource-x86-boot-compressed-64-Check-SEV-encrypti.patch
  	0235-op0002-buensource-x86-head-64-Check-SEV-encryption-before-s.patch
  	0236-op0002-buensource-x86-sev-es-Do-not-support-MMIO-to-from-en.patch
  	0237-op0002-buensource-x86-boot-Remove-unused-finalize_identity_.patch
  	0238-op0002-buensource-x86-uprobes-Do-not-use-prefixes.nbytes-wh.patch
  	0239-op0002-buensource-x86-insn-eval-Use-new-for_each_insn_prefi.patch
  	0240-op0002-buensource-x86-sev-es-Use-new-for_each_insn_prefix-m.patch
  	0241-op0002-buensource-x86-swiotlb-Adjust-SWIOTLB-bounce-buffer-.patch
  	0242-op0002-buensource-x86-cpu-Add-VM-page-flush-MSR-availablili.patch
  	0243-op0002-buensource-KVM-SVM-Remove-the-call-to-sev_platform_s.patch
  	0244-op0002-buensource-KVM-SVM-Add-support-for-SEV-ES-capability.patch
  	0245-op0002-buensource-KVM-SVM-Add-GHCB-accessor-functions-for-r.patch
  	0246-op0002-buensource-KVM-SVM-Add-support-for-the-SEV-ES-VMSA.patch
  	0247-op0002-buensource-KVM-x86-Mark-GPRs-dirty-when-written.patch
  	0248-op0002-buensource-KVM-x86-remove-bogus-GP-injection.patch
  	0249-op0002-buensource-KVM-x86-use-kvm_complete_insn_gp-in-emula.patch
  	0250-op0002-buensource-KVM-x86-introduce-complete_emulated_msr-c.patch
  	0251-op0002-buensource-KVM-SVM-Add-required-changes-to-support-i.patch
  	0252-op0002-buensource-KVM-SVM-Prevent-debugging-under-SEV-ES.patch
  	0253-op0002-buensource-KVM-SVM-Workaround-errata-1096-insn_len-m.patch
  	0254-op0002-buensource-kvm-vmx-fix-coccinelle-warnings.patch
  	0255-op0002-buensource-KVM-SVM-Fix-detection-of-AMD-Errata-1096.patch
  	0256-op0002-buensource-KVM-x86-Add-kvm_x86_ops-hook-to-short-cir.patch
  	0257-op0002-buensource-KVM-SVM-Do-not-allow-instruction-emulatio.patch
  	0258-op0002-buensource-KVM-SVM-Cannot-re-initialize-the-VMCB-aft.patch
  	0259-op0002-buensource-KVM-SVM-Prepare-for-SEV-ES-exit-handling-.patch
  	0260-op0002-buensource-KVM-Introduce-a-new-guest-mapping-API.patch
  	0261-op0002-buensource-kvm-fix-compilation-on-aarch64.patch
  	0262-op0002-buensource-kvm-fix-compilation-on-s390.patch
  	0263-op0002-buensource-kvm-fix-compile-on-s390-part-2.patch
  	0264-op0002-buensource-KVM-Properly-check-if-page-is-valid-in-kv.patch
  	0265-op0002-buensource-KVM-SVM-Add-initial-support-for-a-VMGEXIT.patch
  	0266-op0002-buensource-KVM-SVM-Add-support-for-SEV-ES-GHCB-MSR-p.patch
  	0267-op0002-buensource-KVM-SVM-Add-support-for-SEV-ES-GHCB-MSR-p.patch
  	0268-op0002-buensource-KVM-SVM-Add-support-for-SEV-ES-GHCB-MSR-p.patch
  	0269-op0002-buensource-KVM-SVM-Create-trace-events-for-VMGEXIT-p.patch
  	0270-op0002-buensource-KVM-SVM-Create-trace-events-for-VMGEXIT-M.patch
  	0271-op0002-buensource-KVM-SVM-Support-MMIO-for-an-SEV-ES-guest.patch
  	0272-op0002-buensource-KVM-SVM-Support-string-IO-operations-for-.patch
  	0273-op0002-buensource-KVM-SVM-Add-support-for-EFER-write-traps-.patch
  	0274-op0002-buensource-KVM-SVM-Add-support-for-CR0-write-traps-f.patch
  	0275-op0002-buensource-KVM-SVM-Add-support-for-CR4-write-traps-f.patch
  	0276-op0002-buensource-KVM-SVM-Add-support-for-CR8-write-traps-f.patch
  	0277-op0002-buensource-KVM-x86-Update-__get_sregs-__set_sregs-to.patch
  	0278-op0002-buensource-KVM-SVM-Do-not-report-support-for-SMM-for.patch
  	0279-op0002-buensource-KVM-SVM-Guest-FPU-state-save-restore-not-.patch
  	0280-op0002-buensource-KVM-SVM-Add-NMI-support-for-an-SEV-ES-gue.patch
  	0281-op0002-buensource-KVM-SVM-Set-the-encryption-mask-for-the-S.patch
  	0282-op0002-buensource-KVM-SVM-Update-ASID-allocation-to-support.patch
  	0283-op0002-buensource-KVM-SVM-Provide-support-for-SEV-ES-vCPU-c.patch
  	0284-op0002-buensource-KVM-SVM-Provide-support-for-SEV-ES-vCPU-l.patch
  	0285-op0002-buensource-KVM-SVM-Provide-an-updated-VMRUN-invocati.patch
  	0286-op0002-buensource-KVM-SVM-Provide-support-to-launch-and-run.patch
  	0287-op0002-buensource-KVM-SVM-Add-AP_JUMP_TABLE-support-in-prep.patch
  	0288-op0002-buensource-KVM-SVM-Fix-offset-computation-bug-in-__s.patch
  	0289-op0002-buensource-KVM-SVM-fix-32-bit-compilation.patch
  	0290-op0002-buensource-x86-sev-es-Fix-SEV-ES-OUT-IN-immediate-op.patch
  	0291-op0002-buensource-KVM-SVM-Add-support-for-booting-APs-in-an.patch
  	0292-op0002-buensource-KVM-SVM-Mark-SEV-launch-secret-pages-as-d.patch
  	0293-op0002-buensource-x86-sev-es-Handle-string-port-IO-to-kerne.patch
  	0294-op0002-buensource-x86-sev-Fix-nonistr-violation.patch
  	0295-op0002-buensource-KVM-SVM-Unconditionally-sync-GPRs-to-GHCB.patch
  	0296-op0002-buensource-KVM-x86-Revert-KVM-x86-Mark-GPRs-dirty-wh.patch
  	0297-op0002-buensource-anolis-KVM-SVM-Add-KVM_SEV_SEND_UPDATE_VM.patch
  	0298-op0002-buensource-anolis-KVM-SVM-Add-KVM_SEV_RECEIVE_UPDATE.patch
  	0299-op0002-buensource-anolis-KVM-SVM-Keep-track-EFER-even-thoug.patch
  	0300-op0002-buensource-anolis-KVM-x86-Restore-control-registers-.patch
  	0301-op0002-buensource-anolis-KVM-SVM-Export-MSR_AMD64_SEV_ES_GH.patch
  	0302-op0002-buensource-x86-sev-es-Do-not-unroll-string-I-O-for-S.patch
  	0303-op0002-buensource-x86-sev-es-Remove-subtraction-of-res-vari.patch
  	0304-op0002-buensource-x86-sev-es-Introduce-ip_within_syscall_ga.patch
  	0305-op0002-buensource-x86-sev-es-Check-regs-sp-is-trusted-befor.patch
  	0306-op0002-buensource-x86-sev-es-Use-__copy_from_user_inatomic.patch
  	0307-op0002-buensource-crypto-ccp-Add-SEV_INIT_EX-support.patch
  	0308-op0002-buensource-x86-sev-es-Split-vc_decode_insn.patch
  	0309-op0002-buensource-x86-boot-compressed-64-Cleanup-exception-.patch
  	0310-op0002-buensource-x86-sev-Do-not-require-Hypervisor-CPUID-b.patch
  	0311-op0002-buensource-x86-boot-compressed-64-Reload-CS-in-start.patch
  	0312-op0002-buensource-x86-boot-compressed-64-Setup-IDT-in-start.patch
  	0313-op0002-buensource-x86-boot-compressed-64-Add-32-bit-boot-VC.patch
  	0314-op0002-buensource-x86-boot-compressed-64-Add-CPUID-sanity-c.patch
  	0315-op0002-buensource-x86-boot-compressed-64-Check-SEV-encrypti.patch
  	0316-op0002-buensource-x86-sev-es-Replace-open-coded-hlt-loops-w.patch
  	0317-op0002-buensource-x86-sev-es-Optimize-__sev_es_ist_enter-fo.patch
  	0318-op0002-buensource-KVM-SVM-Use-online_vcpus-not-created_vcpu.patch
  	0319-op0002-buensource-KVM-SVM-Do-not-set-sev-es_active-until-KV.patch
  	0320-op0002-buensource-KVM-SVM-Do-not-allow-SEV-SEV-ES-initializ.patch
  	0321-op0002-buensource-KVM-SVM-Make-sure-GHCB-is-mapped-before-u.patch
  	0322-op0002-buensource-x86-sev-Drop-redundant-and-potentially-mi.patch
  	0323-op0002-buensource-KVM-SVM-Free-sev_asid_bitmap-during-init-.patch
  	0324-op0002-buensource-KVM-SVM-Skip-SEV-cache-flush-if-no-ASIDs-.patch
  	0325-op0002-buensource-KVM-SVM-Move-GHCB-unmapping-to-fix-RCU-wa.patch
  	0326-op0002-buensource-x86-sev-es-Rename-sev-es.-ch-to-sev.-ch.patch
  	0327-op0002-buensource-x86-sev-Move-GHCB-MSR-protocol-and-NAE-de.patch
  	0328-op0002-buensource-x86-sev-es-Move-sev_es_put_ghcb-in-prep-f.patch
  	0329-op0002-buensource-x86-sev-es-Invalidate-the-GHCB-after-comp.patch
  	0330-op0002-buensource-x86-sev-es-Don-t-return-NULL-from-sev_es_.patch
  	0331-op0002-buensource-x86-sev-es-Forward-page-faults-which-happ.patch
  	0332-op0002-buensource-x86-sev-es-Use-__put_user-__get_user-for-.patch
  	0333-op0002-buensource-x86-sev-Check-SME-SEV-support-in-CPUID-fi.patch
  	0334-op0002-buensource-x86-sev-Fix-error-message-in-runtime-VC-h.patch
  	0335-op0002-buensource-x86-insn-eval-Make-0-a-valid-RIP-for-insn.patch
  	0336-op0002-buensource-x86-insn-Extend-error-reporting-from-insn.patch
  	0337-op0002-buensource-x86-sev-Propagate-GP-if-getting-linear-in.patch
  	0338-op0002-buensource-x86-sev-Make-sure-IRQs-are-disabled-while.patch
  	0339-op0002-buensource-x86-sev-Split-up-runtime-VC-handler-for-c.patch
  	0340-op0002-buensource-x86-sev-Add-defines-for-GHCB-version-2-MS.patch
  	0341-op0002-buensource-x86-sev-Use-SEV-prefix-for-messages-from-.patch
  	0342-op0002-buensource-KVM-SEV-Acquire-vcpu-mutex-when-updating-.patch
  	0343-op0002-buensource-x86-sev-Return-an-error-on-a-returned-non.patch
  	0344-op0002-buensource-KVM-SEV-ES-fix-length-of-string-I-O.patch
  	0345-op0002-buensource-KVM-SEV-ES-Set-guest_state_protected-afte.patch
  	0346-op0002-buensource-KVM-SEV-ES-reduce-ghcb_sa_len-to-32-bits.patch
  	0347-op0002-buensource-x86-sev-Carve-out-HV-call-s-return-value-.patch
  	0348-op0002-buensource-x86-sev-Include-fpu-xcr.h.patch
  	0349-op0002-buensource-x86-sev-Fix-stack-type-check-in-vc_switch.patch
  	0350-op0002-buensource-x86-sev-Allow-VC-exceptions-on-the-VC2-st.patch
  	0351-op0002-buensource-KVM-SEV-ES-rename-guest_ins_data-to-sev_p.patch
  	0352-op0002-buensource-KVM-x86-leave-vcpu-arch.pio.count-alone-i.patch
  	0353-op0002-buensource-KVM-SEV-ES-clean-up-kvm_sev_es_ins-outs.patch
  	0354-op0002-buensource-KVM-x86-split-the-two-parts-of-emulator_p.patch
  	0355-op0002-buensource-KVM-x86-remove-unnecessary-arguments-from.patch
  	0356-op0002-buensource-KVM-SEV-ES-keep-INS-functions-together.patch
  	0357-op0002-buensource-KVM-SEV-ES-go-over-the-sev_pio_data-buffe.patch
  	0358-op0002-buensource-x86-sev-Expose-sev_es_ghcb_hv_call-for-us.patch
  	0359-op0002-buensource-KVM-SEV-ES-fix-another-issue-with-string-.patch
  	0360-op0002-buensource-x86-sev-Fix-SEV-ES-INS-OUTS-instructions-.patch
  	0361-op0002-buensource-anolis-KVM-x86-Introduce-control_-pre-pos.patch
  	0362-op0002-buensource-anolis-KVM-SVM-Add-support-for-rebooting-.patch
  	0363-op0002-buensource-anolis-KVM-SVM-Force-flush-caches-before-.patch
  	0364-op0002-buensource-efi-Save-location-of-EFI-confidential-com.patch
  	0365-op0002-buensource-virt-Add-efi_secret-module-to-expose-conf.patch
  	0366-op0002-buensource-efi-Register-efi_secret-platform-device-i.patch
  	0367-op0002-buensource-docs-security-Add-secrets-coco-documentat.patch
  	0368-op0002-buensource-KVM-SEV-WARN-if-SEV-ES-is-marked-active-b.patch
  	0369-op0002-buensource-KVM-SEV-Return-appropriate-error-codes-if.patch
  	0370-op0002-buensource-KVM-SEV-Fall-back-to-vmalloc-for-SEV-ES-s.patch
  	0371-op0002-buensource-KVM-SVM-Do-not-terminate-SEV-ES-guests-on.patch
  	0372-op0002-buensource-dma-direct-always-leak-memory-that-can-t-.patch
  	0373-op0002-buensource-crypto-ccp-Add-SEV_INIT-rc-error-logging-.patch
  	0374-op0002-buensource-swiotlb-do-not-zero-buffer-in-set_memory_.patch
  	0375-op0002-buensource-KVM-SVM-Don-t-intercept-GP-for-SEV-guests.patch
  	0376-op0002-buensource-KVM-SVM-Explicitly-require-DECODEASSISTS-.patch
  	0377-op0002-buensource-KVM-SVM-Never-reject-emulation-due-to-SMA.patch
  	0378-op0002-buensource-KVM-x86-Pass-emulation-type-to-can_emulat.patch
  	0379-op0002-buensource-KVM-SVM-WARN-if-KVM-attempts-emulation-on.patch
  	0380-op0002-buensource-KVM-SVM-Inject-UD-on-attempted-emulation-.patch
  	0381-op0002-buensource-KVM-SVM-Don-t-apply-SEV-SMAP-workaround-o.patch
  	0382-op0002-buensource-KVM-SVM-Don-t-kill-SEV-guest-if-SMAP-erra.patch
  	0383-op0002-buensource-KVM-SVM-Exit-to-userspace-on-ENOMEM-EFAUL.patch
  	0384-op0002-buensource-KVM-SEV-Add-cond_resched-to-loop-in-sev_c.patch
  	0385-op0002-buensource-x86-sev-es-Replace-open-coded-hlt-loop-wi.patch
  	0386-op0002-buensource-KVM-SEV-Add-KVM_EXIT_SHUTDOWN-metadata-fo.patch
  	0387-op0002-buensource-KVM-SVM-Simplify-and-harden-helper-to-flu.patch
  	0388-op0002-buensource-x86-sev-Annotate-stack-change-in-the-VC-h.patch
  	0389-op0002-buensource-x86-sev-Mark-the-code-returning-to-user-s.patch
  	0390-op0002-buensource-dma-direct-don-t-over-decrypt-memory.patch
  	0391-op0002-buensource-anolis-mm-early_ioremap.c-Always-build-ea.patch
  	0392-op0002-buensource-anolis-x86-setup-Preserve-_ENC-flag-when-.patch
  	0393-op0002-buensource-anolis-crypto-ccp-Print-Hygon-CSV-API-ver.patch
  	0394-bu0002-bugfix-HYGON-crypto-ccp-Check-the-firmware-version-w.patch
  	0395-op0002-buensource-anolis-KVM-SVM-Print-Hygon-CSV-support-in.patch
  	0396-op0002-buensource-anolis-KVM-SVM-Fix-the-available-ASID-ran.patch
  	0397-op0002-buensource-anolis-x86-csv2-Keep-in-atomic-context-wh.patch
  	0398-op0002-buensource-KVM-SVM-Fix-off-by-one-indexing-when-null.patch
  	0399-op0002-buensource-x86-sev-Remove-duplicated-assignment-to-v.patch
  	0400-op0002-buensource-x86-head-64-Re-enable-stack-protection.patch
  	0401-op0002-buensource-KVM-SVM-Zero-out-the-VMCB-array-used-to-t.patch
  	0402-op0002-buensource-x86-efi-Restore-Firmware-IDT-before-calli.patch
  	0403-op0002-buensource-x86-entry-64-Move-non-entry-code-into-.te.patch
  	0404-op0002-buensource-KVM-SVM-fix-error-return-code-in-svm_crea.patch
  	0405-op0002-buensource-KVM-x86-Fix-NULL-dereference-at-kvm_msr_i.patch
  	0406-op0002-buensource-KVM-x86-Exit-to-userspace-if-emulation-pr.patch
  	0407-op0002-buensource-KVM-x86-Add-proper-ReST-tables-for-usersp.patch
  	0408-op0002-buensource-KVM-VMX-Ignore-userspace-MSR-filters-for-.patch
  	0409-op0002-buensource-KVM-VMX-Forbid-userspace-MSR-filters-for-.patch
  	0410-op0002-buensource-KVM-x86-Protect-userspace-MSR-filter-with.patch
  	0411-op0002-buensource-doc-kvm-Fix-wrong-entry-for-KVM_CAP_X86_M.patch
  	0412-op0002-buensource-KVM-nVMX-Handle-dynamic-MSR-intercept-tog.patch
  	0413-op0002-buensource-KVM-x86-Add-compat-handler-for-KVM_X86_SE.patch
  	0414-op0002-buensource-swiotlb-using-SIZE_MAX-needs-limits.h-inc.patch
  	0415-op0002-buensource-Documentation-DMA-API-fix-a-function-name.patch
  	0416-op0002-buensource-dma-mapping-add-a-dma_addressing_limited-.patch
  	0417-op0002-buensource-dma-direct-only-limit-the-mapping-size-if.patch
  	0418-op0002-buensource-dma-mapping-use-dma_get_mask-in-dma_addre.patch
  	0419-op0002-buensource-docs-virt-kvm-close-inline-string-literal.patch
  	0420-op0002-buensource-vfio-pci-Use-io_remap_pfn_range-for-PCI-I.patch
  	0421-op0002-buensource-KVM-SVM-Use-kzalloc-for-sev-ioctl-interfa.patch
  	0422-op0002-buensource-KVM-SVM-Fix-potential-overflow-in-SEV-s-s.patch
  	0423-op0002-buensource-crypto-ccp-shutdown-SEV-firmware-on-kexec.patch
  	0424-op0002-buensource-crypto-ccp-Flush-the-SEV-ES-TMR-memory-be.patch
  	0425-op0002-buensource-x86-asm-Replace-__force_order-with-a-memo.patch
  	0426-op0002-buensource-x86-debug-Fix-stack-recursion-caused-by-w.patch
  	0427-op0002-buensource-x86-xen-avoid-warning-in-Xen-pv-guest-wit.patch
  	0428-op0002-buensource-x86-sev-es-Correctly-track-IRQ-states-in-.patch
  	0429-op0002-buensource-KVM-X86-Fix-failure-to-boost-kernel-lock-.patch
  	0430-op0002-buensource-KVM-x86-Assume-a-64-bit-hypercall-for-gue.patch
  	0431-bu0002-bugfix-HYGON-KVM-x86-Avoid-warning-when-CSV2-guest-i.patch
  	0432-op0002-buensource-KVM-x86-Always-set-kvm_run-if_flag.patch
  	0433-op0002-buensource-KVM-SVM-Add-register-operand-to-vmsave-ca.patch
  	0434-op0002-buensource-crypto-ccp-Fix-the-INIT_EX-data-file-open.patch
  	0435-op0002-buensource-crypto-ccp-Fail-the-PSP-initialization-wh.patch
  	0436-op0002-buensource-KVM-x86-Don-t-WARN-if-userspace-mucks-wit.patch
  	0437-op0002-buensource-x86-unwind-fp-Fix-FP-unwinding-in-ret_fro.patch
  	0438-op0002-buensource-KVM-VMX-Heed-the-msr-argument-in-msr_writ.patch
  	0439-op0002-buensource-crypto-ccp-During-shutdown-check-SEV-data.patch
  	0440-op0002-buensource-x86-xen-Fix-noinstr-fail-in-exc_xen_unkno.patch
  	0441-ne0002-buwfeature-HYGON-x86-cpu-Show-Hygon-csv-csv2-feature.patch
  	0442-op0002-buensource-swiotlb-Remove-call-to-sme_active.patch
  	0443-op0002-buensource-x86-speculation-Rename-RETPOLINE_AMD-to-R.patch
  	0444-op0002-buensource-anolis-x86-cpufeatures-Add-CPUID_8C86_000.patch
  	0445-op0002-buensource-anolis-x86-cpufeatures-Add-CSV3-CPU-featu.patch
  	0446-bu0002-bugfix-HYGON-vfio-pci-Disable-VFIO-pci-reset-for-hyg.patch
  	0447-op0002-buensource-anolis-crypto-ccp-Add-CCP-PSP-PCI-interfa.patch
  	0448-op0002-buensource-KVM-x86-Move-HF_NMI_MASK-and-HF_IRET_MASK.patch
  	0449-op0002-buensource-KVM-SVM-Don-t-defer-NMI-unblocking-until-.patch
  	0450-op0002-buensource-x86-sev-Make-enc_dec_hypercall-accept-a-s.patch
  	0451-bu0002-bugfix-HYGON-x86-csv2-Fix-VC-VC2-stack-cea-mapping.patch
  	0452-op0002-buensource-crypto-ccp-Clear-PSP-interrupt-status-reg.patch
  	0453-op0002-buensource-Fix-unsynchronized-access-to-sev-members-.patch
  	0454-bu0002-bugfix-HYGON-KVM-SVM-Unmap-ghcb-pages-if-they-re-sti.patch
  	0455-ne0002-buwfeature-HYGON-crypto-ccp-Add-CCP-PSP-PCI-interfac.patch
  	0456-op0002-buensource-mm-cma-add-PF-flag-to-force-non-cma-alloc.patch
  	0457-op0002-buensource-mm-update-get_user_pages_longterm-to-migr.patch
  	0458-bu0002-bugfix-KVM-SVM-Pin-SEV-guest-memory-out-of-CMA-area.patch
  	0459-ne0002-buwfeature-crypto-ccp-Define-CSV-key-management-comm.patch
  	0460-op0002-butimization-HYGON-mm-cma-Add-API-to-enable-concurre.patch
  	0461-ne0002-buwfeature-x86-csv-Manage-CSV-guest-s-private-memory.patch
  	0462-ne0002-buwfeature-crypto-ccp-Add-SET_SMR-SET_SMCR-commands-.patch
  	0463-ne0002-buwfeature-KVM-Define-CSV-key-management-command-id.patch
  	0464-ne0002-buwfeature-KVM-SVM-CSV-Add-KVM_CSV_INIT-command.patch
  	0465-ne0002-buwfeature-KVM-SVM-CSV-Add-KVM_CSV_LAUNCH_ENCRYPT_DA.patch
  	0466-ne0002-buwfeature-KVM-SVM-CSV-Add-KVM_CSV_LAUNCH_ENCRYPT_VM.patch
  	0467-ne0002-buwfeature-KVM-SVM-CSV-Manage-CSV-guest-s-nested-pag.patch
  	0468-ne0002-buwfeature-x86-boot-compressed-64-Add-CSV-guest-dete.patch
  	0469-ne0002-buwfeature-x86-boot-compressed-64-Init-CSV-secure-ca.patch
  	0470-ne0002-buwfeature-x86-boot-compressed-64-Add-CSV-update-pag.patch
  	0471-ne0002-buwfeature-x86-kernel-Add-CSV-early-update-enc-dec-r.patch
  	0472-ne0002-buwfeature-x86-kernel-Set-bss-decrypted-memory-as-sh.patch
  	0473-ne0002-buwfeature-x86-Update-memory-shared-private-attribut.patch
  	0474-ne0002-buwfeature-x86-Add-support-for-changing-the-memory-a.patch
  	0475-ne0002-buwfeature-x86-mm-Print-CSV-info-into-kernel-log.patch
  	0476-op0002-buensource-mm-thp-compaction-cma-allow-THP-migration.patch
  	0477-op0002-buensource-mm-page_alloc-cma-conditionally-prefer-cm.patch
  	0478-op0002-buensource-mm-apply-per-task-gfp-constraints-in-fast.patch
  	0479-op0002-buensource-mm-compaction-let-isolate_migratepages_-r.patch
  	0480-op0002-buensource-mm-make-alloc_contig_range-handle-free-hu.patch
  	0481-op0002-buensource-mm-make-alloc_contig_range-handle-in-use-.patch
  	0482-bu0002-bugfix-HYGON-mm-release-hugetlb-pages-to-buddy-alloc.patch
  	0483-op0002-buensource-mm-page_alloc-move-draining-pcplists-to-p.patch
  	0484-op0002-buensource-mm-page_alloc-avoid-expensive-reclaim-whe.patch
  	0485-ne0002-buwfeature-HYGON-crypto-ccp-Define-CSV-migration-com.patch
  	0486-ne0002-buwfeature-HYGON-KVM-SVM-CSV-Add-KVM_CSV_SEND_ENCRYP.patch
  	0487-ne0002-buwfeature-HYGON-KVM-SVM-CSV-Add-KVM_CSV_SEND_ENCRYP.patch
  	0488-ne0002-buwfeature-HYGON-KVM-SVM-CSV-Add-KVM_CSV_RECEIVE_ENC.patch
  	0489-ne0002-buwfeature-HYGON-KVM-SVM-CSV-Add-KVM_CSV_RECEIVE_ENC.patch
  	0490-ne0002-buwfeature-crypto-ccp-Add-psp-interrupt-x86-register.patch
  	0001-bu0002-bugfix-fix-bug-that-SM2-encryption-of-long-data-caus.patch
  	0002-bu0002-bugfix-fix-driver-corruption-due-to-incorrent-variab.patch
  	0003-ne0002-buwfeature-Support-psp-virtualization.patch
  	0004-ne0002-buwfeature-Support-tkm-virtualization.patch
  	0005-ne0002-buwfeature-support-tkm-key-isolation-for-kernel-4.19.patch
  	0006-op0002-butimize-Allow-VM-without-a-configured-vid-to-use-TK.patch
  	0001-bu0002-bugfix-fix-csv-migration-issue.patch


author: dash <dash@nfschina.com> [4.19.113-18.119.nfs]
changelog:
  - add AQTJ devctl functions
  - 0001-add-aqtj-devctl-call-code.patch
  - 0002-add-aqtj-devctl-core-code.patch
  - 0003-usb-endpoint-judge.patch
  - 0004-use-bus-find-device.patch
  - 0005-recover-usb-endpoint.patch
  - 0006-aqtj-add-fs-perm-chk.patch
  - kernel-4.19.113-fix-cdrom-readonly-and-disable-can-burn-error.patch
  - 0001-fix-devt-coredump.patch
  - 0008-fix-null-pointer.patch
  - aqtj-vm_devctl.patch


author: wenyu <wenyu1@nfschina.com> [4.19.113-18.120.nfs]
changelog:
  - init for nfssec
  - 0001-port-kernel-change.patch
  - 0002-add-nfssec-security-mode.patch
  - 0003-add-lsm-hooks-for-nfssec.patch


author: wangkerong <kerong@nfschina.com> [4.19.113-18.123.nfs]
changelog:
  - fix
  - CVE-2021-46909   CVE-2021-46915   CVE-2021-46921   CVE-2021-46924   
  - CVE-2021-46928   CVE-2021-46929   CVE-2021-46932   CVE-2021-46933   
  - CVE-2021-46934   CVE-2021-46935   CVE-2021-46936   CVE-2021-46938   
  - CVE-2021-46939   CVE-2021-46953   CVE-2021-46955   CVE-2021-46960   
  - CVE-2021-46988   CVE-2021-46989   CVE-2021-46991   CVE-2021-46992   
  - CVE-2021-46998   CVE-2021-46999   CVE-2021-47006   CVE-2021-47010   
  - CVE-2021-47013   CVE-2021-47015   CVE-2021-47024   CVE-2021-47034   
  - CVE-2021-47061   CVE-2023-52477   CVE-2023-52478   CVE-2023-52500   
  - CVE-2023-52502   CVE-2023-52504   CVE-2023-52509   CVE-2023-52507   
  - CVE-2023-52510   CVE-2023-52515   CVE-2023-52525   CVE-2023-52527   
  - CVE-2023-52528   CVE-2023-52530   CVE-2023-52566   CVE-2023-52567   
  - CVE-2023-52574   CVE-2023-52577   CVE-2021-47114   CVE-2021-47117   
  - CVE-2021-47118   CVE-2021-47121   CVE-2021-47122   CVE-2024-26624   
  - CVE-2024-26625   CVE-2023-52583   CVE-2023-52587   CVE-2023-52594   
  - CVE-2023-52597   CVE-2023-52598   CVE-2023-52599   CVE-2023-52600   
  - CVE-2023-52602   CVE-2023-52603   CVE-2023-52604   CVE-2023-52605   
  - CVE-2023-52606   CVE-2023-52607   CVE-2021-47082   CVE-2021-47084   
  - CVE-2021-47085   CVE-2021-47100   CVE-2021-47103   CVE-2022-48629   
  - CVE-2021-47115


author: fenghui <fenghui@nfschina.com> [4.19.113-18.125.nfs]
changelog:
  - Supports Hygon 4 CPU. v2 v3
  - 	Hygon_000_x86_hygon_family18h_addon_20230103.patch
  - 	Hygon_001_backport_dependent_upstream_patches_202303.patch
  - 	Hygon_002_x86_add_hygon_family18h_model4h_202303.patch
  - 	Hygon_003_x86_add_hygon_family18h_model5h_202303.patch
  - 	Hygon_004_x86_add_hygon_family18h_model6h_202303.patch
  - 	004-EDAC-amd64-Revert-hi_addr_offset-for-Hygon-famil.patch
  - 	005-EDAC-amd64-Fix-intlv_num_chan-for-Hygon-family-1.patch
  - 	006-x86-amd_nb-Get-DF-ID-from-F5-device-for-Hygon-fa.patch
  - 	007-EDAC-amd64-Adjust-UMC-channel-for-Hygon-family-1.patch
  - 	008-ALSA-hda-Add-Hygon-HD-Audio-support.patch
  - 	009-ALSA-hda-Fix-single-byte-write-failure-issue-for.patch
  - 	010-perf-x86-uncore-Add-L3-PMU-support-for-Hygon-fam.patch
  - 	011-Add-support-for-Hygon-family-18h-model-4h-5h-6h-.patch


author: wangkerong <kerong@nfschina.com> [4.19.113-18.126.nfs]
changelog:
  - fix 
  - CVE-2024-26668 CVE-2024-26671 CVE-2024-26675 CVE-2024-26679 
  - CVE-2023-52639 CVE-2024-26685 CVE-2024-26686 CVE-2024-26687 
  - CVE-2024-26696 CVE-2024-26697 CVE-2024-26704 CVE-2024-26715 
  - CVE-2024-26720 CVE-2024-26722 CVE-2024-26726 CVE-2024-26733 
  - CVE-2024-26735 CVE-2024-26736 CVE-2024-26743 CVE-2024-26744 
  - CVE-2024-26751 CVE-2024-26752 CVE-2024-26754 CVE-2024-26759 
  - CVE-2024-26763 CVE-2024-26764 CVE-2024-26766 CVE-2024-26772 
  - CVE-2024-26773 CVE-2024-26775 CVE-2024-26777 CVE-2024-26778 
  - CVE-2024-26779 CVE-2024-26791 CVE-2024-26793 CVE-2024-26801 
  - CVE-2024-26804 CVE-2024-26805 CVE-2024-26810 CVE-2021-47182 
  - CVE-2021-47181 CVE-2021-47184 CVE-2021-47189 CVE-2021-47194 
  - CVE-2021-47203 CVE-2021-47206 CVE-2021-47207 CVE-2021-47210 
  - CVE-2021-47216 CVE-2021-47217 CVE-2024-26816 CVE-2024-26817 
  - CVE-2023-52644 CVE-2024-26878


author: Martin Kutlak <mkutlak@redhat.com> - 2.9.5-10
changelog:
  - reportclient: Search for required packages recursively
  - reportclient: Find and download required debuginfo packages
  - report-client: Find debuginfos in own method
  - Resolves: rhbz#1783897


author: Michal Židek <mzidek@redhat.com> - 2.9.5-12
changelog:
  - Resolves: rhbz#1835388 - abrt-addon-ccpp causes failures during openscap scans on CCE-27119-7
  - This is just libreport side (abrt also needs to be patched)


author: zhangbinchen <zhangbinchen@openanolis.org> - 2.9.5-15.0.1
changelog:
  - Disable centos sub package
  - Don't requires subscription for Anolis OS
  - Remove unused sub packages
  - cherry-pick [1acfc44 00b6684 2f29df5]


author: shangyb <yibin@nfschina.com> - 2:2.11.2-2
changelog:
  - fix CVE-2024-32039、CVE-2024-32040、CVE-2024-32041、CVE-2024-32458、
    CVE-2024-32459、CVE-2024-32460、CVE-2024-32658、CVE-2024-32659、CVE-2024-32660


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-7
changelog:
  - Resolves: rhbz#1920001 - Do not add '%' to group names already prefixed with '%' in IPA sudo rules
  - Resolves: rhbz#1918433 - sssd unable to lookup certmap rules
  - Resolves: rhbz#1917382 - [abrt] [faf] sssd: dp_client_handshake_timeout(): /usr/libexec/sssd/sssd_be killed by 11


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-8
changelog:
  - Resolves: rhbz#1926622 - Add support to verify authentication indicators in pam_sss_gss
  - Resolves: rhbz#1926454 - First smart refresh query contains modifyTimestamp even if the modifyTimestamp is 0.
  - Resolves: rhbz#1893159 - Default debug level should report all errors / failures (additional patch)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.0-1
changelog:
  - Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
  - Resolves: rhbz#1930535 - [abrt] [faf] sssd: monitor_service_shutdown(): /usr/sbin/sssd killed by 11
  - Resolves: rhbz#1942387 - Wrong default debug level of sssd tools
  - Resolves: rhbz#1945888 - Inconsistant debug level for connection logging
  - Resolves: rhbz#1948657 - pam_sss_gss.so doesn't work with large kerberos tickets
  - Resolves: rhbz#1949149 - [RFE] Poor man's backtrace
  - Resolves: rhbz#1920500 - Authentication handshake (ldap_install_tls()) fails due to underlying openssl operation failing with EINTR
  - Resolves: rhbz#1923964 - [RFE] SSSD Error Msg Improvement: write_krb5info_file failed, authentication might fail.
  - Resolves: rhbz#1928648 - SSSD logs improvements: clarify which config option applies to each timeout in the logs
  - Resolves: rhbz#1632159 - sssd-kcm starts successfully for non existent socket_path
  - Resolves: rhbz#1627112 - RFE: Kerberos ticket renewal for sssd-kcm
  - Resolves: rhbz#1925505 - [RFE] improve the sssd refresh timers for SUDO queries
  - Resolves: rhbz#1925514 - [RFE] Randomize the SUDO timeouts upon reconnection
  - Resolves: rhbz#1925561 - sssd-ldap(5) does not report how to disable the SUDO smart queries
  - Resolves: rhbz#1925621 - document impact of indices and of scope on performance of LDAP queries
  - Resolves: rhbz#1855320 - [RFE] RHEL8 sssd: inheritance of the case_sensitive parameter for subdomains.
  - Resolves: rhbz#1925608 - [RFE] make 'random_offset' addon to 'offline_timeout' option configurable
  - Resolves: rhbz#1447945 - man page / docs update required: if two certificate matching rules with the same priority match only one is used
  - Resolves: rhbz#1703436 - sssd not thread-safe in innetgr()
  - Resolves: rhbz#1713143 - SSSD does not translate the 2FA text labels("first factor" / "second factor") on GDM login and screensaver unlock screen
  - Resolves: rhbz#1888977 - sss_override: Usage limitations clarification in man page
  - Resolves: rhbz#1890177 - Clarify "single_prompt" option in "PROMPTING CONFIGURATION SECTION" section of sssd.conf man page
  - Resolves: rhbz#1902280 - fix sss_cache to also reset cached timestamp
  - Resolves: rhbz#1935683 - SSSD not detecting subdomain from AD forest (RHEL 8.3)
  - Resolves: rhbz#1937919 - IPA missing secondary IPA Posix groups in latest sssd 1.16.5-10.el7_9.7
  - Resolves: rhbz#1944665 - No gpo found and ad_gpo_implicit_deny set to True still permits user login
  - Resolves: rhbz#1919942 - sss_override does not take precedence over override_homedir directive


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.1-1
changelog:
  - Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
  - Resolves: rhbz#1942387 - Wrong default debug level of sssd tools
  - Resolves: rhbz#1917444 - SSSD Error Msg Improvement: Server resolution failed: [2]: No such file or directory
  - Resolves: rhbz#1917511 - SSSD Error Msg Improvement: Failed to resolve server 'server.example.com': Error reading file
  - Resolves: rhbz#1917535 - sssd.conf man page: parameter dns_resolver_server_timeout and dns_resolver_op_timeout
  - Resolves: rhbz#1940509 - [RFE] Health and Support Analyzer: Link frontend to backend requests
  - Resolves: rhbz#1649464 - auto_private_groups not working as expected with posix ipa/ad trust
  - Resolves: rhbz#1925514 - [RFE] Randomize the SUDO timeouts upon reconnection
  - Resolves: rhbz#1961215 - Invalid sssd-kcm return code if requested operation is not found
  - Resolves: rhbz#1837090 - SSSD fails nss_getby_name for IPA user with SID if the user has user private group
  - Resolves: rhbz#1879869 - sudo commands incorrectly exports the KRB5CCNAME environment variable
  - Resolves: rhbz#1962550 - sss_pac_make_request fails on systems joined to Active Directory.
  - Resolves: rhbz#1737489 - [RFE] SSSD should honor default Kerberos settings (keytab name) in /etc/krb5.conf


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.1-2
changelog:
  - Resolves: rhbz#1974257 - 'debug_microseconds' config option is broken
  - Resolves: rhbz#1936902 - SSSD Error Msg Improvement: Invalid argument
  - Resolves: rhbz#1627112 - RFE: Kerberos ticket renewal for sssd-kcm (additional patches and rebuild)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.2-1
changelog:
  - Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
  - Resolves: rhbz#1693379 - sssd_be and sss_cache too heavy on CPU
  - Resolves: rhbz#1909373 - Missing search index for `originalADgidNumber`
  - Resolves: rhbz#1954630 - [RFE] Improve debug messages by adding a unique tag for each request the backend is handling
  - Resolves: rhbz#1936891 - SSSD Error Msg Improvement: Bad address
  - Resolves: rhbz#1364596 - sssd still showing ipa user after removed from last group
  - Resolves: rhbz#1979404 - Changes made to /etc/pam.d/sssd-shadowutils are overwritten back to default on sssd-common package upgrade


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.2-2
changelog:
  - Resolves: rhbz#1975169 - EMBARGOED CVE-2021-3621 sssd: shell command injection in sssctl [rhel-8]
  - Resolves: rhbz#1962042 - [sssd] RHEL 8.5 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.2-2.1
changelog:
  - Resolves: rhbz#2014460 - tps tests fail with cross dependency on sssd debuginfo package: removal of 'sssd-libwbclient-debuginfo' is missing [rhel-8.5.0.z]


author: tingfu <tingfu@nfs-hlj.com> - 8.0p1-10.8 + 0.10.3-7.4
changelog:
  - update CVE-2023-48795 
  - add openssh-8.0p1-CVE-2023-48795-add.patch 
  - fix CVE-2023-48795 ssh command issue


author: liuda <liuda@nfschina.com> - 1:1.1.1k-7.0.11
changelog:
  - Fix CVE-2024-2511
  - add: openssl-1.1.1-1-CVE-2024-2511.patch
  - add: openssl-1.1.1-2-CVE-2024-2511.patch


author: chaodong <chaodong@nfschina.com> - 3.6.8-41.2
changelog:
  - Support loongarch64, sw_64.
    Python-3.6.8-nfs4-platform.patch
    Python-3.6.8-Support-loongarch64.patch
    Python-3.6.8-Support-sw_64.patch


author: tingfu <tingfu@nfs-hlj.com> - 3.6.8-41.5
changelog:
  - fix CVE-2022-0391 CVE-2019-9674 CVE-2019-20907 CVE-2023-24329
  - add Python-3.6.8-CVE-2022-0391.patch Python-3.6.8-CVE-2019-9674.patch Python-3.6.8-CVE-2019-20907.patch Python-3.6.8-CVE-2023-24329.patch


author: Zhang Dongjun <dongjun@cpu-os.ac.cn> - 1.0.4.nfs.16
changelog:
  - bug#0357410: RTM1.7 设备管理器中主板、光驱没有显示硬件品牌Logo
  - Patch: device-manager-1.0-For4.0-Add-suma-cancon-logo.patch


author: Xunian Tang <xunian@nfschina.com> - 1.0.4.nfs.17
changelog:
  - 从svs2.4移植:device-manager-1.0-For4.0-MdySystem-to-MainServer.patch
  - Fix 0357667:H620-G30S3,设备管理器下电脑概览中电脑描述错误,应Main Server Chassis.


author: xunian <xunian@nfschina.com> [4.19.113-18.130.nfs]
changelog:
  - Support PHYTIUM 5000C;
  - Update PHYTIUM codes ver12.
  - Fix: pcieplug for PHYTIUM 5000C;
  - Fix: reconfig for x86_64 compile.


author: wangkerong <kerong@nfschina.com> [4.19.113-18.138.nfs]
changelog:
  - fix CVE
  - CVE-2024-26894 CVE-2024-26898 CVE-2024-26901 CVE-2024-26903 
  - CVE-2023-52646 CVE-2022-48636 CVE-2022-48651 CVE-2022-48659 
  - CVE-2023-52650 CVE-2023-52651 CVE-2024-26931 CVE-2024-26934 
  - CVE-2024-26955 CVE-2024-26956 CVE-2024-26957 CVE-2024-26965 
  - CVE-2024-26966 CVE-2024-26969 CVE-2024-26973 CVE-2024-26976 
  - CVE-2024-26981 CVE-2024-26984 CVE-2024-26993 CVE-2024-26999 
  - CVE-2024-27000 CVE-2024-27008 CVE-2024-27013 CVE-2024-27024 
  - CVE-2024-27028 CVE-2024-27046 CVE-2024-27059 CVE-2024-27074 
  - CVE-2022-48671 CVE-2024-27075 CVE-2024-27077 CVE-2024-27078 
  - CVE-2024-27388 CVE-2022-48672 CVE-2022-48687 CVE-2022-48688 
  - CVE-2022-48693 CVE-2022-48697 CVE-2022-48701 CVE-2022-48702 
  - CVE-2022-48704 CVE-2024-26663 CVE-2024-26654


author: Carl George <carlwgeorge@fedoraproject.org> - 1.2.26-1
changelog:
  - Update to version 1.2.26
  - CVE-2023-49084, CVE-2023-49085, CVE-2023-49086, CVE-2023-49088, CVE-2023-50250, CVE-2023-51448


author: Carl George <carlwgeorge@fedoraproject.org> - 1.2.27-1
changelog:
  - Update to version 1.2.27
  - CVE-2024-25641, CVE-2024-29894, CVE-2024-31443, CVE-2024-31444, CVE-2024-31445, CVE-2024-31458, CVE-2024-31459, CVE-2024-31460, CVE-2024-34340


author: Remi Collet <remi@remirepo.net> - 8.0-3
changelog:
  - rebuild for https://fedoraproject.org/wiki/Changes/php81
  - add patch for PHP 8.1 from
    https://github.com/websupport-sk/pecl-memcache/pull/88


author: Remi Collet <remi@remirepo.net> - 8.0-6
changelog:
  - rebuild for https://fedoraproject.org/wiki/Changes/php82
  - add patch for PHP 8.2 from
    https://github.com/websupport-sk/pecl-memcache/pull/104


author: Thomas Woerner <twoerner@redhat.com> - 8.10-7
changelog:
  - removed fakeroot requirement and all qa_robot scripts (RHBZ#1615605)
  - Fixed missing build requires for python3-devel


author: Michal Domonkos <mdomonko@redhat.com> - 8.10-8
changelog:
  - spectool: ignore query string in URL (RHBZ#1826299)
  - Fix TypeError in rpmdev-rmdevelrpms and rpmdev-checksig (RHBZ#1851499)


author: shangyb <yibin@nfschina.com> [4.19.113-18.155.nfs]
changelog:
  - fix CVEs
    CVE-2024-38618 CVE-2024-38621 CVE-2024-38627 CVE-2024-38633 CVE-2024-38634
    CVE-2024-38637 CVE-2024-38659 CVE-2024-38780 CVE-2024-39292 CVE-2024-38661
    CVE-2024-39276 CVE-2024-39301 CVE-2021-47576 CVE-2021-47579 CVE-2021-47583
    CVE-2021-47587 CVE-2021-47588 CVE-2021-47589 CVE-2021-47598 CVE-2021-47600
    CVE-2021-47602 CVE-2021-47603 CVE-2021-47606 CVE-2021-47609 CVE-2021-47611
    CVE-2021-47612 CVE-2024-38549 CVE-2024-38552 CVE-2024-31076 CVE-2024-36286
    CVE-2024-37353 CVE-2024-38612 CVE-2024-38613 CVE-2022-48732 CVE-2022-48736
    CVE-2022-48737 CVE-2022-48738 CVE-2022-48742 CVE-2022-48743 CVE-2022-48754
    CVE-2022-48756 CVE-2022-48757 CVE-2022-48758 CVE-2022-48759 CVE-2022-48760
    CVE-2024-38558 CVE-2024-38559 CVE-2024-38560 CVE-2024-38565 CVE-2024-38567
    CVE-2024-38578 CVE-2024-38579 CVE-2024-38589 CVE-2024-38596 CVE-2024-38599
    CVE-2024-38601 CVE-2021-4439  CVE-2021-47619 CVE-2022-48715 CVE-2022-48717
    CVE-2022-48722 CVE-2024-39475 CVE-2024-39480 CVE-2023-52628


author: Miroslav Rezanina <mrezanin@redhat.com> - 20190829git37eef91017ad-9.el8
changelog:
  - edk2-OvmfPkg-QemuVideoDxe-unbreak-secondary-vga-and-bochs.patch [bz#1806359]
  - Resolves: bz#1806359
    (bochs-display cannot show graphic wihout driver attach)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20200602gitca407c7246bf-1.el8
changelog:
  - Rebase to edk2-stable202005 [bz#1817035]
  - Resolves: bz#1817035
    ((edk2-rebase-rhel-8.3) - rebase edk2 to upstream tag edk2-stable202005 for RHEL-8.3)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20200602gitca407c7246bf-2.el8
changelog:
  - edk2-OvmfPkg-QemuKernelLoaderFsDxe-suppress-error-on-no-k.patch [bz#1844682]
  - edk2-OvmfPkg-GenericQemuLoadImageLib-log-Not-Found-at-INF.patch [bz#1844682]
  - edk2-SecurityPkg-Tcg2Dxe-suppress-error-on-no-swtpm-in-si.patch [bz#1844682]
  - Resolves: bz#1844682
    (silent build of edk2-aarch64 logs DEBUG_ERROR messages that don't actually report serious errors)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20200602gitca407c7246bf-3.el8
changelog:
  - edk2-UefiCpuPkg-PiSmmCpuDxeSmm-pause-in-WaitForSemaphore-.patch [bz#1861718]
  - Resolves: bz#1861718
    (Very slow boot when overcommitting CPU)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20200602gitca407c7246bf-4.el8
changelog:
  - edk2-OvmfPkg-SmmControl2Dxe-negotiate-ICH9_LPC_SMI_F_CPU_.patch [bz#1849177]
  - edk2-OvmfPkg-CpuHotplugSmm-fix-CPU-hotplug-race-just-befo.patch [bz#1849177]
  - edk2-OvmfPkg-CpuHotplugSmm-fix-CPU-hotplug-race-just-afte.patch [bz#1849177]
  - edk2-CryptoPkg-OpensslLib-Upgrade-OpenSSL-to-1.1.1g.patch [bz#1893806]
  - edk2-redhat-bump-OpenSSL-dist-git-submodule-to-1.1.1g-RHE.patch [bz#1893806]
  - Resolves: bz#1849177
    (OVMF: negotiate "SMI on VCPU hotplug" with QEMU)
  - Resolves: bz#1893806
    (attempt advancing RHEL8 edk2's OpenSSL submodule to RHEL8 OpenSSL 1.1.1g (or later))


author: Miroslav Rezanina <mrezanin@redhat.com> - 20200602gitca407c7246bf-5.el8
changelog:
  - edk2-MdeModulePkg-LzmaCustomDecompressLib-catch-4GB-uncom.patch [bz#1892318]
  - edk2-redhat-add-OVMF-binary-that-will-support-SEV-ES.patch [bz#1956837]
  - Resolves: bz#1892318
    (edk2: possible heap corruption with LzmaUefiDecompressGetInfo [rhel-8])
  - Resolves: bz#1956837
    (Additional build of edk2 without SMM (dual build / sub-package) for SEV-ES)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20210527gite1999b264f1f-1
changelog:
  - Rebase to edk2-stable202105 [bz#1938238]
  - Resolves: bz#1938238
    ((edk2-rebase-rhel-8.5) - rebase edk2 to edk2-stable202105 for RHEL-8.5)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20210527gite1999b264f1f-2
changelog:
  - edk2-NetworkPkg-IScsiDxe-wrap-IScsiCHAP-source-files-to-8.patch [bz#1956408]
  - edk2-NetworkPkg-IScsiDxe-simplify-ISCSI_CHAP_AUTH_DATA.In.patch [bz#1956408]
  - edk2-NetworkPkg-IScsiDxe-clean-up-ISCSI_CHAP_AUTH_DATA.Ou.patch [bz#1956408]
  - edk2-NetworkPkg-IScsiDxe-clean-up-library-class-dependenc.patch [bz#1956408]
  - edk2-NetworkPkg-IScsiDxe-fix-potential-integer-overflow-i.patch [bz#1956408]
  - edk2-NetworkPkg-IScsiDxe-assert-that-IScsiBinToHex-always.patch [bz#1956408]
  - edk2-NetworkPkg-IScsiDxe-reformat-IScsiHexToBin-leading-c.patch [bz#1956408]
  - edk2-NetworkPkg-IScsiDxe-fix-IScsiHexToBin-hex-parsing.patch [bz#1956408]
  - edk2-NetworkPkg-IScsiDxe-fix-IScsiHexToBin-buffer-overflo.patch [bz#1956408]
  - edk2-NetworkPkg-IScsiDxe-check-IScsiHexToBin-return-value.patch [bz#1956408]
  - Resolves: bz#1956408
    (edk2: remote buffer overflow in IScsiHexToBin function in NetworkPkg/IScsiDxe [rhel-8.5.0])


author: Miroslav Rezanina <mrezanin@redhat.com> - 20210527gite1999b264f1f-3
changelog:
  - edk2-MdeModulePkg-PartitionDxe-Ignore-PMBR-BootIndicator-.patch [bz#1988762]
  - Resolves: bz#1988762
    (edk2 does not ignore PMBR protective record BootIndicator as required by UEFI spec)


author: Hangbin Liu <haliu@redhat.com> - 1.7-1
changelog:
  - Update to 1.7
  - libndp: apply filter to raw socket to only accept ND messages
  - libndp: move ndp_sock_{open,close}() after msg parsing functions
  - ndptool: Fix compilation on musl libc


author: Hangbin Liu <haliu@redhat.com> - 1.7-2
changelog:
  - ndptool: add -T target support (rhbz 1666194)
  - ndptool: fix target parameter typo (rhbz 1666194)
  - libndp: close sockfd after using to avoid handle leak (rhbz 1666194)
  - libndp: fix nd_msg typo when setting target address (rhbz 1666194)


author: Hangbin Liu <haliu@redhat.com> - 1.7-3
changelog:
  - ndptool: add -D dest support (rhbz 1697595)
  - ndptool: fix potential memory leak caused by strdup (rhbz 1697595)


author: chunchao <chunchao@nfschina.com> [4.19.113-18.157.nfs]
changelog:
  - ipmi_si: Phytium S2500 workaround for MMIO-based IPMI
  - commit id: 88f04d8bd2d27d3140a26ef70a996000c7379e5e from openEuler


author: zhuyunfei <zhuyunfei@nfschina.com> [4.19.113-18.158.nfs]
changelog:
  - chore: update base loongarch code from 4.19.190-7.2 to 4.19.190-7.9
  - remove nfs-megaraid-zj.patch for loongarch kdump hang issue


author: xunian <xunian@nfschina.com> [4.19.113-18.159.nfs]
changelog:
  - Fix: Unapply CVE-2018-20784, This Patch caused system scheduling blockage.
  - X86/aarch64/sw_64: Apply nfs-megaraid-zj.patch  support sas 9560.


author: shangyb <yibin@nfschina.com> [4.19.113-18.161.nfs]
changelog:
  - fix CVE
    CVE-2022-48799 CVE-2022-48804 CVE-2022-48810 CVE-2023-52885 CVE-2024-40959
    CVE-2024-40960 CVE-2024-40968 CVE-2024-40974 CVE-2024-40981 CVE-2024-40984
    CVE-2024-40987 CVE-2024-40988 CVE-2024-41006 CVE-2022-48822
    CVE-2024-39509 CVE-2024-40901 CVE-2024-40902 CVE-2024-40904 CVE-2024-40912
    CVE-2024-40932 CVE-2024-40941 CVE-2024-40942 CVE-2024-40943
    CVE-2024-39487 CVE-2024-39488 CVE-2024-39489 CVE-2022-48775 CVE-2022-48788
    CVE-2022-48790 CVE-2022-48794 CVE-2022-48795 CVE-2024-39499 CVE-2024-39501
    CVE-2022-48836 CVE-2022-48838 CVE-2022-48839 CVE-2022-48850 CVE-2022-48851
    CVE-2022-48855 CVE-2022-48856 CVE-2022-48857 CVE-2022-48860 CVE-2021-22555


author: Jiri Vanek <gnu.andrew@redhat.com> - 1:1.8.0.342.b06-0.4.ea
changelog:
  - moved to build only on %{java_arches}
  -- https://fedoraproject.org/wiki/Changes/Drop_i686_JDKs
  - reverted :
  -- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild (always mess up release)
  -- Try to build on x86 again by creating a husk of a JDK which does not depend on itself
  -- Exclude x86 from builds as the bootstrap JDK is now completely broken and unusable
  -- Reinstate demo package on x86
  -- Temporarily disable noarch status of javadoc and javadoc-zip so x86 can differ
  -- Replaced binaries and .so files with bash-stubs on i686
  - added ExclusiveArch:  %{java_arches}
  -- this now excludes i686
  -- this is safely backport-able to older fedoras, as the macro was  backported proeprly (with i686 included)
  - https://bugzilla.redhat.com/show_bug.cgi?id=2104129


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.342.b07-1
changelog:
  - Update to shenandoah-jdk8u342-b07 (GA)
  - Update release notes for 8u342-b07.
  - Switch to GA mode for final release.
  - Exclude x86 where java_arches is undefined, in order to unbreak build


author: Wim Taymans <wtaymans@redhat.com> - 1.7.0-7
changelog:
  - Fix for CVE-2019-9232, CVE-2019-9433, CVE-2019-9371, CVE-2019-2126
  - Resolves: rhbz#1796086, rhbz#1796100, rhbz#1796448, rhbz#1796454
  - Remove php-cli BR


author: Katerina Koukiou <kkoukiou@redhat.com> - 244.1-1
changelog:
  - Shell: sudo is invoked only when explicitly requested
  - Dynamically manage motd/issue symlinks in package scripts (rhbz#1876848)


author: Martin Pitt <mpitt@redhat.com> - 250-1
changelog:
  - Shell: Improve admin switcher and session menu
  - Update Insights links to point to console.redhat.com (rhbz#1984841)


author: shangyb <yibin@nfschina.com> - 3.5.1-13.3
changelog:
  - privilege escaltion from root to amandbackup using RSH env setting
  - Update the fix for CVE-2022-37704
  - fix CVE-2023-30547


author: Robert-André Mauchin <zebob.m@gmail.com> - 1.0.0-5.20180925gitd0076f5
changelog:
  - Update to commit d0076f507a6027455540e2e4f25f84ca38803e07
  - Set CONFIG_LOWBITDEPTH to 1
  - Fix #1632658


author: Robert-André Mauchin <zebob.m@gmail.com> - 3.1.1-1
changelog:
  - Update to 3.1.1
  - Close: rhbz#1954337
  - Security fix for CVE-2021-30473
  - Fix: rhbz#1961375
  - Fix: rhbz#1961376
  - Security fix for CVE-2021-30475
  - Fix: rhbz#1968017
  - Fix: rhbz#1968018


author: Petr Menšík <pemensik@redhat.com> - 32:9.16.23-0.13
changelog:
  - Prevent flooding with UPDATE requests (CVE-2022-3094)
  - Handle RRSIG queries when server-stale is active (CVE-2022-3736)
  - Fix crash when soft-quota is reached and serve-stale is active (CVE-2022-3924)


author: Petr Menšík <pemensik@redhat.com> - 32:9.16.23-0.17
changelog:
  - Prevent increased CPU load on large DNS messages (CVE-2023-4408)
  - Prevent assertion failure when nxdomain-redirect is used with
   RFC 1918 reverse zones (CVE-2023-5517)
  - Prevent assertion failure if DNS64 and serve-stale is used (CVE-2023-5679)
  - Specific recursive query patterns may lead to an out-of-memory
    condition (CVE-2023-6516)
  - Prevent increased CPU consumption in DNSSEC validator (CVE-2023-50387
    CVE-2023-50868)
  - Import tests for large DNS messages fix
  - Add downstream change complementing CVE-2023-50387


author: liuda <liuda@nfschina.com> - 2.36.1-1.3
changelog:
  - Fix CVE-2021-45078,CVE-2021-46174,CVE-2022-38533,
        CVE-2022-44840,CVE-2022-47673,CVE-2022-47695,
        CVE-2022-47696,CVE-2022-48063,CVE-2022-48064,CVE-2022-48065


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.99-0.34.beta19
changelog:
  - Python 2 binary package renamed to python2-caca
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Sérgio Basto <sergio@serjux.com> - 0.103.7-3
changelog:
  - (#2128276) Please port your pcre dependency to pcre2
  - Explicit dependency on systemd since systemd-devel no longer has this dependency on F37+


author: yangxinyu <yangxinyu@nfschina.com> - 2.28-189.5.0.2.5
changelog:
  - add glibc-2.28-fix-cve-2020-6096.patch
  - add glibc-2.28-fix-cve-2023-0687.patch
  - add glibc-2.28-fix-cve-2023-4813.patch
  - add glibc-2.28-fix-cve-2019-6488.patch


author: Ondrej Kozina <okozina@redhat.com> - 2.2.0-2
changelog:
  - patch: Fix mapped segments overflow on 32bit architectures.
  - patch: Take optimal io size in account with LUKS2 reencryption.
  - Resolves: #1742815 #1746532


author: Ondrej Kozina <okozina@redhat.com> - 2.2.2-1
changelog:
  - Update to cryptsetup 2.2.2
  - LUKS2 reencryption honors activation flags (one time and persistent).
  - LUKS2 reencryption works also without volume keys put in kernel
    keyring service.
  - Resolves: #1757783 #1750680 #1753597 #1743399


author: Ondrej Kozina <okozina@redhat.com> - 2.3.3-2
changelog:
  - patch: Fix possible memory corruption in LUKS2 validation
  	 code in 32bit library.
  - Resolves: #1872294


author: Ondrej Kozina <okozina@redhat.com> - 2.3.3-4
changelog:
  - patch: Fix reencryption for custom devices with data segments
    set to use cipher_null.
  - Resolves: #1927409


author: Zhang Hui <zhanghui1@nfschina.com> - 4.17.5-0.3
changelog:
  - fix CVE-2018-14628
  - fix CVE-2023-0614
  - fix CVE-2023-0922
  - fix CVE-2023-34966
  - fix CVE-2023-34967
  - fix CVE-2023-34968
  - fix CVE-2023-3691
  - fix CVE-2023-4091
  - fix CVE-2023-4154
  - fix CVE-2023-42669
  - fix CVE-2023-42670


author: wangkr <kerong@nfschina.com> - 7.6.1-22.10
changelog:
  - fix CVE-2023-23916,CVE-2023-27533,CVE-2023-27534,CVE-2023-46218
  - CVE-2023-27535,CVE-2023-27536,CVE-2023-27538,CVE-2023-27782
  - CVE-2024-7264


author: Simo Sorce <simo@redhat.com> - 2.1.27-0.4rc7
changelog:
  - Add patch form Upstream PR559 to use RC4 implementation from OpenSSL
  - Resolves bz#1618744
  - Fix multilib issue bz#1663120


author: Martin Pitt <mpitt@redhat.com>
changelog:
  - Drop unpublished -doc package to fix FTBFS rhbz#1640736
  - Add dist-git smoketest rhbz#1625683
  - Move dbus system user creation to correct package rhbz#1634496


author: Lianbo Jiang <lijiang@redhat.com> - 1:3.2-6
changelog:
  - Updated to the latest upstream(5b3c8e995026 ("Allow overriding
    build settings from the environment"))
  - Resolves: rhbz#1796581


author: xunian <xunian@nfschina.com> - 1:3.3-4.1
changelog:
  - Support sw64
  - Support loongarch64
  - Resolves: rhbz#2042224
  - Resolves: rhbz#2027665
  - Resolves: rhbz#1996651
  - Rebase to upsteam 3.3
  - Resolves: rhbz#1998772


author: Christopher Snyder <csnyder@redhat.com> 1.28.30-1
changelog:
  - Add 8.7 tito releaser (csnyder@redhat.com)
  - spec: relax subscription-manager-rhsm-certificates requires
    (ptoscano@redhat.com)
  - 2073347: [1.28] Print correct status, when access mode has changed
    (jhnidek@redhat.com)
  - 2056896: Handle all exceptions of gathering data properly
    (jhnidek@redhat.com)
  - Improve azure determination method (suttner@atix.de)
  - ENT-4939: [1.28] Drop old dbus_interface.py (mhorky@redhat.com)
  - cockpit: Read files in /var/lib/insights as superuser (mvollmer@redhat.com)
  - refresh: clear also the release status (ptoscano@redhat.com)
  - 2074111: clear the release cache on release change (ptoscano@redhat.com)
  - 1.28 Add gcp_license_codes to system facts. (jhnidek@redhat.com)
  - build: always build & ship syspurpose bits (ptoscano@redhat.com)
  - 2057732: [1.28] Fix inaccurate module status in combined profile
    (jhnidek@redhat.com)
  - 2064002: fix named argument for registerConsumer() (ptoscano@redhat.com)
  - 2057053: Improve API of detection of cloud-what (jhnidek@redhat.com)
  - 2057053: Facts: do no use heuristics detection of cloud (jhnidek@redhat.com)
  - 2018215: Cockpit use "Organization ID" in label (jhnidek@redhat.com)
  - 1822242: Cockpit: another improvement of curtain view (jhnidek@redhat.com)
  - 1822242: cockpit: improve handling of main curtain view (ptoscano@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 1.28.31-1
changelog:
  - Translated using Weblate (Korean) (simmon@nplob.com)
  - Update translation files (noreply@weblate.org)
  - Translated using Weblate (Chinese (Simplified) (zh_CN)) (suanand@redhat.com)
  - New extraction for translatable strings (ptoscano@redhat.com)
  - 2043331: Do not delete installed SCA cert during registration
    (jhnidek@redhat.com)
  - Translated using Weblate (Korean) (simmon@nplob.com)
  - build: fix extraction of cockpit messages (ptoscano@redhat.com)
  - cockpit: Fix continuation lines for gettext strings (ptoscano@redhat.com)
  - 1822242: cockpit: fix/simplify the loading/error view checks
    (ptoscano@redhat.com)
  - 2076522: enable sslverifystatus on repos if advertized by CP
    (ptoscano@redhat.com)
  - RepoUpdateActionCommand: lazy load the consumer auth (ptoscano@redhat.com)
  - 2071622: Updated redhat-uep.pem to not use SHA-1 algorithm
    (jhnidek@redhat.com)
  - cockpit: insights: properly show error message in Insights dialog
    (ptoscano@redhat.com)
  - cockpit: insights: fix formatting of multiline insights-client output
    (ptoscano@redhat.com)
  - cockpit: insights: improve handling of registration/unregistration errors
    (ptoscano@redhat.com)
  - cockpit: insights: merge insights-client stderr with stdout
    (ptoscano@redhat.com)
  - cockpit: Remove extra toString() call (ptoscano@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 1.28.32-1
changelog:
  - cockpit: Allow unexpected message from RHEL 8.5 version of cockpit-ws
    (martin@piware.de)
  - test: use --track-naughties option (martin@piware.de)
  - Bump cockpit test API to 273 + run-tests scheduler fix (martin@piware.de)
  - ENT-5215: Handle all exceptions caused by network problems
    (mhorky@redhat.com)
  - ENT-5215: Handle errors raised in DNF plugin (mhorky@redhat.com)
  - Translated using Weblate (Chinese (Simplified) (zh_CN)) (ljanda@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 1.28.33-1
changelog:
  - Translated using Weblate (Korean) (simmon@nplob.com)
  - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com)
  - 2096852: [1.28] Fixed script hang in non-interactive execution
    (jajerome@redhat.com)
  - 2134165: Fixed incorrect registration warning with yum/dnf
    (jajerome@redhat.com)
  - 2097672: Fixed expected message for manual attach case (jajerome@redhat.com)
  - 2097672: [1.28] Improve warning message (auto-attach in SCA mode)
    (jhnidek@redhat.com)
  - build: switch rpmlint check to rpmlint 2.x (ptoscano@redhat.com)
  - Only rpmlint our specfiles (csnyder@redhat.com)
  - integration-test: Use custom TLS certs for mock-insights
    (mvollmer@redhat.com)
  - integration-test: Updates for newer insights-client (mvollmer@redhat.com)
  - test: Rely on insights-client.service to succeed in testSubAndInAndFail
    (mvollmer@redhat.com)
  - integration-tests: Run testSubAndInAndFail with "setenforce 0"
    (mvollmer@redhat.com)
  - 2101510: [1.28] Fix D-Bus Register() and update entitlement certs
    (jhnidek@redhat.com)
  - 2097672: [RFE][1.28] Improve the message, when SCA is enabled
    (jhnidek@redhat.com)


author: Pino Toscano <ptoscano@redhat.com> 1.28.34-1
changelog:
  - tito: add rhel 8.8 releaser (ptoscano@redhat.com)
  - Translated using Weblate (Japanese) (suanand@redhat.com)
  - Translated using Weblate (French) (vincent.lefebvre59@gmail.com)
  - Translated using Weblate (Korean) (simmon@nplob.com)
  - ENT-5510: Fix issues with proxy and cockpit interaction (jajerome@redhat.com)
  - 2118486: [1.28] Implement "force" register option in rhsm dbus python binding
    (jajerome@redhat.com)


author: Pino Toscano <ptoscano@redhat.com> 1.28.35-1
changelog:
  - Translated using Weblate (Spanish) (ptoscano@redhat.com)
  - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com)
  - Translated using Weblate (Chinese (Simplified) (zh_CN)) (ljanda@redhat.com)
  - Translated using Weblate (Korean) (simmon@nplob.com)
  - Update translation files (noreply@weblate.org)
  - Translated using Weblate (German) (atalanttore@googlemail.com)
  - New extraction for translatable strings (ptoscano@redhat.com)
  - Base DBusServerStubProvider on SubManFixture (mhorky@redhat.com)
  - Mark D-Bus tests (mhorky@redhat.com)
  - Remove unused classes of DBus tests (mhorky@redhat.com)
  - ENT-5533: Update D-Bus tests of Unregister (mhorky@redhat.com)
  - ENT-5350: Implement "force" register option in rhsm dbus python bindings
    (mhorky@redhat.com)
  - ENT-5533: Fix failures of D-Bus' Register tests (mhorky@redhat.com)
  - ENT-5533: Update D-Bus tests of Register (mhorky@redhat.com)
  - ENT-5533: Update D-Bus tests of Products (mhorky@redhat.com)
  - ENT-5533: Update D-Bus tests of AllFacts (mhorky@redhat.com)
  - ENT-5533: Update D-Bus tests of Entitlement (mhorky@redhat.com)
  - Fix typo in method name of EntitlementService (mhorky@redhat.com)
  - ENT-5533: Update D-Bus tests of Consumer (mhorky@redhat.com)
  - ENT-5533: Update D-Bus tests of Attach (mhorky@redhat.com)
  - ENT-5533: Update D-Bus tests of Config (mhorky@redhat.com)
  - Skip AsyncPool tests (mhorky@redhat.com)
  - Catch generic OSError during BaseRestLib._request() (ptoscano@redhat.com)
  - Catch also CertificateLoadingError for identity cert loading
    (ptoscano@redhat.com)
  - Fix formatting of proxy errors w/o errno (ptoscano@redhat.com)
  - Improve formatting of CertificateLoadingError (ptoscano@redhat.com)
  - Raise a new CertificateLoadingError on X.509 loading failures
    (ptoscano@redhat.com)
  - Improve formatting of UnknownContentException (ptoscano@redhat.com)
  - connection: improve the internal UnknownContentException
    (ptoscano@redhat.com)
  - utils: add terminal_printable_content (ptoscano@redhat.com)
  - connection: rename NetworkException to UnknownContentException
    (ptoscano@redhat.com)
  - Improve formatting of ProxyException (ptoscano@redhat.com)
  - connection: improve the internal ProxyException (ptoscano@redhat.com)
  - Improve formatting of socket.gaierror (ptoscano@redhat.com)
  - Improve formatting of ConnectionError (ptoscano@redhat.com)
  - Improve formatting of BadCertificateException (ptoscano@redhat.com)
  - connection: extend BadCertificateException w/ SSL exception
    (ptoscano@redhat.com)
  - connection: drop dead code (ptoscano@redhat.com)
  - ENT-4286: Additional fix for exception handling (jajerome@redhat.com)
  - ENT-4286: Simplify exception reporting with system_exit()
    (jajerome@redhat.com)
  - Cloud-what: Make saving token file more robust (jhnidek@redhat.com)
  - Remove deprecated function call (mhorky@redhat.com)
  -  Fix failures of D-Bus' Register tests (mhorky@redhat.com)
  - Show locals in pytest output (mhorky@redhat.com)


author: Pino Toscano <ptoscano@redhat.com> 1.28.36-1
changelog:
  - Translated using Weblate (French) (ljanda@redhat.com)
  - Translated using Weblate (French) (suanand@redhat.com)
  - Translated using Weblate (Korean) (jsefler@redhat.com)
  - 2168576: cockpit: insights: fix spawn_error_to_string in more cases
    (ptoscano@redhat.com)
  - cockpit: Fix the issue, when it is not possible to install insights-client
    (jhnidek@redhat.com)
  - ENT-5542: Build package using GitHub Actions (mhorky@redhat.com)
  - 2166317: gui: do not use an empty environment string (ptoscano@redhat.com)
  - Test libdnf plugin using GitHub Actions (mhorky@redhat.com)
  - libdnf: fix return value of findProductId() (ptoscano@redhat.com)
  - 1938878: Fix issues discovered by static code analyzers (#2644)
    (jhnidek@redhat.com)
  - ENT-5541: Publish PR coverage (mhorky@redhat.com)
  - 2166623: gui: use UnknownContentException instead of NetworkException
    (ptoscano@redhat.com)
  - ENT-3759: Test on GitHub Actions (mhorky@redhat.com)
  - Alter import of rhsm.config functions (mhorky@redhat.com)
  - ENT-5536: Fix FileMonitor tests (mhorky@redhat.com)
  - tests: drop test_po_files.py (ptoscano@redhat.com)
  - Ensure tests don't fail when run under root (mhorky@redhat.com)
  - build: pin pytest to < 7 (ptoscano@redhat.com)
  - rhsm: drop custom which() implementation (ptoscano@redhat.com)
  - facts: switch to shutil.which() (ptoscano@redhat.com)
  - Fix tests for Python 3.6 runner (mhorky@redhat.com)
  - Stop calling pytest with --failed-first (mhorky@redhat.com)
  - Handle tests in containers better (mhorky@redhat.com)


author: Pino Toscano <ptoscano@redhat.com> 1.28.37-1
changelog:
  - 2174887: register: do a simple strip() on environment(s) input
    (ptoscano@redhat.com)
  - [1.28] Remove source code of rhsm-icon (jhnidek@redhat.com)
  - Fix of unit tests of d-bus register: extended list of exceptions for
    catching. (jhnidek@redhat.com)
  - [1.28] Include D-Bus sender in User-Agent http header; Singleton
    (jhnidek@redhat.com)
  - Revert "Try to use --forked for all unit tests." (ptoscano@redhat.com)
  - test: add simple test for 1982670 (ptoscano@redhat.com)
  - 2076948: [1.28] Fix issue with race condition in rhsm.service
    (jhnidek@redhat.com)
  - 1982670: do not collect unentitled products in SCA mode (ptoscano@redhat.com)
  - Use dmidecode on aarch64 (jhnidek@redhat.com)
  - Fix possible parsing issues of dmidecode output (mhorky@redhat.com)
  - zypper: drop dead python-dmidecode usage (ptoscano@redhat.com)
  - facts: drop DmiFirmwareInfoCollector (ptoscano@redhat.com)
  - facts: switch to DmidecodeFactCollector for DMI facts (ptoscano@redhat.com)
  - facts: add dmidecode parser and facts collector (ptoscano@redhat.com)
  - cloud-what: switch MiniHostCollector to dmidecode(1) (ptoscano@redhat.com)
  - Remove pytest arguments for CentOS 9 Stream image (mhorky@redhat.com)
  - tests: Install dnf-plugins-core every time (mhorky@redhat.com)


author: zengyi <zengyi@nfschina.com> - 2.3.15-4.2
changelog:
  - update code version to v15
  - 6420,CVE-2019-19722 CVE-2020-10957 CVE-2020-10958 CVE-2020-10967 CVE-2020-28200 CVE-2021-33515 and so on


author: wangkr <kerong@nfschina.com> - 0.27.4-5.2
changelog:
  - fix CVE-2021-32815,CVE-2021-34334,CVE-2021-34335,CVE-2021-37615
  - CVE-2021-37616,CVE-2021-37620,CVE-2021-37621,CVE-2021-37622,CVE-2021-37623


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 4.1.4-7
changelog:
  - Revert previous change of adding 'awk*' symlinks for info pages (bug #1486924)
  - Added patch to correctly fix the info pages issue (bug #1486924)
  - specfile content refactored for better readability
  - Package now provides its ABI version via gawk(abi)
  - Added test for usage of correct gawk(abi) into %check section


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 4.2.0-1
changelog:
  - Update to latest stable release from upstream [new API version - 2.0]
  - Added latest relevant patches from upstream's gawk-4.2-stable branch


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 4.2.0-2
changelog:
  - 'noarch' removed from *-devel subpackage
  - added arch requirement for *-devel subpackage
  - updated the build process to use %make_build macro


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 4.2.1-2
changelog:
  - 5 important patches backported from upstream per their request:
      gawk-4.2.1-000-add-support-for-a-and-A-in-printf.patch
      gawk-4.2.1-001-remove-the-tail-recursion-optimization.patch
      gawk-4.2.1-002-copy-MPZ-MPFR-bits-also-in-r_dupnode.patch
      gawk-4.2.1-003-fix-rebuilding-records-if-using-API-parser.patch
      gawk-4.2.1-004-fix-a-corner-case-with-EPIPE-to-stdout-stderr.patch


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 1:6.1.2-8
changelog:
  - Missing fipschecks added into build process (bug #1553679)
  - --enable-fat option added to %configure (bug #1493218)


author: Jakub Martisko <jamartis@redhat.com> - 1:6.1.2-9
changelog:
  - Add support for intel CET and -fcf-protection
  - Add missing compiler/linker flags
  Related: #1630567


author: Jakub Martisko <jamartis@redhat.com> - 1.9-5
changelog:
  - Fix wrong skip size in gzexe
  - Add new test dealing with the ^^ (needs autoreconf)
  - Enable make check (needs less)
    Resolves: 1705413

   * Tue Aug 07 2018 Jakub Martisko <jamartis@redhat.com> - 1.9-4
   - Fix FTBFS bug (gnulib problems)
   - more details: https://lists.gnu.org/r/bug-gnulib/2018-03/msg00000.html
     Resolves 1611722


author: Björn Esser <besser82@fedoraproject.org> - 0.13-3
changelog:
  - Add upstream patch for adding size_t json_c_object_sizeof()
  - Enable partial multi-threaded support


author: Ondrej Dubaj <odubaj@redhat.com> - 3.26.0-10
changelog:
  - Fixed CVE-2020-13632 (#1845572)
  - Fixed CVE-2020-13631 (#1845474)
  - Fixed CVE-2020-13630 (#1845153)


author: Ondrej Dubaj <odubaj@redhat.com> - 3.26.0-14
changelog:
  - Fixed CVE-2019-5827 (#1710184)
  - Fixed CVE-2019-13750 (#1786510)
  - Fixed CVE-2019-13751 (#1786522)
  - Fixed CVE-2019-19603 (#1792013)
  - Fixed CVE-2020-13435 (#1841233)


author: Jens Petersen <petersen@redhat.com> - 0.8.6-1
changelog:
  - update to 0.8.6 (#1462722)
  - fixes manpage conflict (#1504831)
  - condition the gcc deprecation patch on epel < 7
  - clean up spec file


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2.6.2-13
changelog:
  - Python 2 binary package renamed to python2-louis
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: David King <dking@redhat.com> - 2.6.2-17
changelog:
  - Fix CVE-2018-11577 (#1585906)
  - Fix CVE-2018-11684 (#1588632)
  - Fix CVE-2018-11685 (#1588637)
  - Fix CVE-2018-12085 (#1589942)


author: Michal Ruprich <mruprich@redhat.com> - 1.2.0-6
changelog:
  - Adding libmaxminddb as a new package to RHEL-8 (rhbz#1607927)
  - Adding Recommends tag for geolite2 databases


author: Till Maas <opensource@till.name> - 2.7.2-14
changelog:
  - Rebuilt for Fedora 23 Change
    https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code


author: Peter Robinson <pbrobinson@fedoraproject.org> 2.0.0-1
changelog:
  - Update to upstream 2.0.0
  - Fixes the following CVEs plus others
  - CVE-2017-6440 CVE-2017-6439 CVE-2017-6438 CVE-2017-6437 CVE-2017-6436
  - CVE-2017-6435 CVE-2017-5836 CVE-2017-5835 CVE-2017-5834 CVE-2017-5545
  - CVE-2017-5209


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2.0.0-4
changelog:
  - Python 2 binary package renamed to python2-libplist
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Bastien Nocera <bnocera@redhat.com> - 2.0.0-10
changelog:
  + libplist-2.0.0-10
  - The Python3 Cython binary is now called "cython" not "cython3"
  - Resolves: #1611726


author: Dan Winship <danw@redhat.com> - 0.4.15-5.1
changelog:
  - Drop python2 subpackage (#1559092)
  - Drop PAC runner based on the "pacrunner" package (#1569023)
  - Replace pacrunner-crash-fix patch with version from RHEL7
  - Drop kde subpackage (#1538147)


author: Peter Robinson <pbrobinson@fedoraproject.org> 4.9-2
changelog:
  - Move development related docs to devel sub package
  - Cleanup spec and macros
  - Update valgrind ExclusiveArch


author: weiliuhu <liuhu@nfschina.com> - 4.0.9-20-4
changelog:
  - fix CVE-2017-17095 CVE-2018-15209(CVE-2018-16335)
  - fix CVE-2018-17000 CVE-2018-17101 CVE-2018-19210
  - fix CVE-2022-0561 CVE-2022-0562 CVE-2022-0891
  - fix CVE-2022-0908 CVE-2022-1355 CVE-2022-3970
  - fix CVE-2022-40090 CVE-2023-0800 CVE-2023-3316
  - fix CVE-2023-3576 CVE-2023-3618 
  - fix CVE-2023-40745 CVE-2023-41175 CVE-2022-3597
  - fix CVE-2022-48281 CVE-2023-0795 CVE-2022-2953
  - fix CVE-2022-3626 CVE-2023-2731 CVE-2023-1916
  - fix CVE-2023-3164 CVE-2022-2867 CVE-2023-26965
  - fix CVE-2023-2731


author: dash <dash@nfschina.com> - 0.9.11-19
changelog:
  - fix cve
  - cve-2020-14399 cve-2020-14401 
  - cve-2018-15126 cve-2018-20020   
  - cve-2018-20022 cve-2018-20024   
  - cve-2019-15681 cve-2020-14400 
  - cve-2020-14402 cve-2018-20019 
  - cve-2018-20021 cve-2018-20023 
  - cve-2018-6307


author: Remi Collet <remi@remirepo.net> - 1.5.1-1
changelog:
  - update to 1.5.1
  - drop dependency on zlib-devel and bzip2-devel no more
    referenced in libzip.pc
  - drop rpath patch merged upstream


author: Remi Collet <rcollet@redhat.com> - 1.5.2-1
changelog:
  - update to 1.5.2
  - add all explicit cmake options to ensure openssl is used
    even in local build with other lilbraries available


author: Xiao Ni <xni@redhat.com> - 4.1.12
changelog:
  - Update mdadm to latest upstream && change tmpfiles directory && correct changelog date
  - Resolves rhbz#1800521 and rhbz#1657265


author: Josef Ridky <jridky@redhat.com> - 1:5.8-14
changelog:
  - fix double free or corruption error when freeing security context (#1809077)
  - remove deprecated CFLAG


author: Josef Ridky <jridky@redhat.com> - 1:5.8-15
changelog:
  - proxied OIDs unspecified in proxy statement in snmpd.conf (#1658134)
  - UCD-SNMP-MIB::dskTable doesn't update dynamically (#1658185)
  - expand SNMPCONFPATH variable (#1660146)
  - remove file with Apple license (#1690936)
  - log meningful message on duplicate IP address (#1692286)
  - memory reporting adjustment (#1695497 and #1766521)
  - fix typos in man page (#1700262)
  - speedup ipAddressTable loading(#1700391)
  - fix memory leak when shut down librpm (#1763008)
  - services starts after network-online.target (#1775304)
  - add missing part of memory leak patch (#1829860)
  - add support for AES192 and AES256 (#1846252)


author: Josef Ridky <jridky@redhat.com> - 1:5.8-19
changelog:
  - revert permission of config files to 600 (#1601060)
  - fix error message when the address specified by clientaddr option
    is wrong or cannot be bound (#1877375)
  - log error with /proc/net/if_inet6 only when IPv6 is enabled (#1824367)
  - fix issue with quoting empty passphrase (#1817225)


author: Josef Ridky <jridky@redhat.com> - 1:5.8-21
changelog:
  - prevent parsing IP address twice (#1768908)
  - add support for digests detected from ECC certs (#1919714)
  - fix broken ErrorMsg at ucd-snmp (#1933150)
  - add support for intermediate certs (#1914656)
  - fix crash of certs with longer extension (#1908718)


author: Tomáš Mráz <tmraz@redhat.com> - 3.4-4
changelog:
  - Cover the gaps in annotation coverage for assembler sources
  - Add .hmac checksums for FIPS mode integrity checking


author: Daiki Ueno <dueno@redhat.com> - 3.4.1-5
changelog:
  - Backport powerpc64 optimization patches from upstream (#1855228)
    Patch from Christopher M. Riedl.


author: Neal Gompa <ngompa@datto.com> - 2:2021.8.22-1
changelog:
  - Rebase to version 2021.8.22 to fix various CVEs (RHBZ#1999869)
  - Clean up old cruft for RHEL < 7
  - Split libraries out to libs subpackage


author: liuda <liuda@nfschina.com> - 2:2021.8.22-2.2
changelog:
  - Fix CVE-2021-46790,CVE-2022-30783,CVE-2022-30784
        CVE-2022-30785,CVE-2022-30786,CVE-2022-30787
        CVE-2022-30788,CVE-2022-30789,CVE-2022-40284


author: dash <dash@nfschina.com> - 2.4.46-18.3
changelog:
  - fix cve
  - openldap-2.4.46-cve-2019-13565.patch
  - openldap-2.4.46-cve-2020-12243.patch   
  - openldap-2.4.46-cve-2020-15719.patch  
  - openldap-2.4.46-cve-2020-25692.patch  
  - openldap-2.4.46-cve-2020-25709.patch  
  - openldap-2.4.46-cve-2020-25710.patch 
  - openldap-2.4.46-cve-2020-36221.patch  
  - openldap-2.4.46-cve-2020-36222.patch  
  - openldap-2.4.46-cve-2020-36223.patch  
  - openldap-2.4.46-cve-2020-36224.patch 
  - openldap-2.4.46-cve-2020-36227.patch  
  - openldap-2.4.46-cve-2020-36228.patch  
  - openldap-2.4.46-cve-2020-36230.patch  
  - openldap-2.4.46-cve-2020-36229.patch 
  - openldap-2.4.46-cve-2021-27212.patch


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.0.0-15
changelog:
  - Removed dependency on net-tools
    Resolves: #1496138
  - Removed init script, Group tag and macro from changelog in spec file
  - Slightly modified openssl-1.1 fix to be able build the package
    with OpenSSL version lower than 1.1


author: liuda <liuda@nfschina.com> - 1:1.1.1k-7.0.14
changelog:
  - fix CVE-2023-2650,CVE-2023-4807,CVE-2023-5678,CVE-2024-0727
  - add openss1-1.1.1k-CVE-2023-2650.patch
  - add openss1-1.1.1k-CVE-2023-4807.patch
  - add openss1-1.1.1k-CVE-2023-5678.patch
  - add DH_check-excessive-time-with-over-sized-modulus.patch
  - add openss1-1.1.1k-CVE-2024-0727.patch


author: Than Ngo <than@redhat.com> - 2.7.6-10
changelog:
  - CVE-2019-13636 , Don't follow symlinks unless --follow-symlinks is given
  - Resolves: #1665928, patch has a huge error output and segfaults when the file to be patched does not exist


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.26.3-416
changelog:
  - 5.26.3 bump (bug #1655526)
  - Fix CVE-2018-18311 (integer overflow leading to buffer overflow) (bug #1654920)
  - Fix CVE-2018-18312 (heap buffer overflow in regcomp.c) (bug #1654922)
  - Fix CVE-2018-18313 (heap buffer overflow read in regcomp.c) (bug #1654924)
  - Fix CVE-2018-18314 (heap based buffer overflow) (bug #1654925)


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.26.3-417
changelog:
  - Fix Time-Local tests to pass after year 2019 (bug #1807120)
  - Run-require perl(Encode) by perl-libs (bug #1903503)


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.26.3-419
changelog:
  - Fix CVE-2020-10543 (bug #1839273)
  - Fix CVE-2020-10878 (bug #1839276)
  - Fix a file mode of a perl-example.stp example (bug #1913693)


author: Remi Collet <rcollet@redhat.com> - 7.4.6-1
changelog:
  - update to 7.4.6
  - add ffi extension
  - add /usr/share/php/preload as default ffi.preload configuration
  - run FPM tests
  - set opcache.enable_cli in provided default configuration
  - ensure all shared extensions can be loaded
  - drop wddx, recode and extensions
  - run test suite using 4 concurrent workers


author: Remi Collet <rcollet@redhat.com> - 7.4.19-2
changelog:
  - fix SSRF bypass in FILTER_VALIDATE_URL
    CVE-2021-21705
  - fix Local privilege escalation via PHP-FPM
    CVE-2021-21703


author: Remi Collet <rcollet@redhat.com> - 7.4.33-1
changelog:
  - rebase to 7.4.33
  - fix: due to an integer overflow PDO::quote() may return unquoted string
    CVE-2022-31631


author: Remi Collet <rcollet@redhat.com> - 1:1.10.12-1
changelog:
  - update PEAR to 1.10.12
  - update Archive_Tar to 1.4.9
  - update Console_Getopt to 1.4.3
  - update XML_Util to 1.4.5


author: Marek Kasik <mkasik@redhat.com> - 0.66.0-25
changelog:
  - Check whether input is RGB in PSOutputDev::checkPageSlice()
  - also when using "-optimizecolorspace" flag
  - Resolves: #1697576


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2:3.3.1-10
changelog:
  - Release bump and rebuild for relengs to be able to ship postfix-pcre,
    postfix-cdb, postfix-sqlite
    Resolves: rhbz#1745321


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2:3.5.8-2
changelog:
  - Fixed cleanup crash when processing messages with whitespace only fullname
    Resolves: rhbz#1977732


author: weiliuhu <liuhu@nfschina.com> - 4.14.3-22.19
changelog:
  - fix CVE-2021-3521 
  - fix rpm-backport-Upgrade-FA_TOUCH-to-FA_CREATE-if-the-file-went-away-.patch
  - fix rpm-backport-Clean-up-file-unpack-iteration-logic-a-bit.patch
  - fix rpm-backport-Refactor-file-install-and-remove-around-a-common-str.patch
  - fix rpm-backport-Refactor-fsmMkfile-to-take-advantage-of-the-new-stat.patch
  - fix rpm-backport-Drop-unused-filename-variable.patch
  - fix rpm-backport-Handle-hardlink-tracking-with-a-file-state-pointer.patch
  - fix rpm-backport-Handle-file-install-failures-more-gracefull.patch
  - fix rpm-backport-Add-hardlink-helper-to-fsm-to-make-it-debuggable.patch
  - fix rpm-backport-Make-file-open-and-close-in-fsm-debuggable.patch
  - fix rpm-backport-Streamline-consolidate-the-hardlink-handlin.patch
  - fix rpm-backport-Add-diagnostics-to-archive-unpacking.patch
  - fix rpm-backport-Make-rpmfiSetFX-return-code-meaningful.patch
  - fix rpm-backport-Add-optional-callback-on-directory-changes-during-rp.patch
  - fix rpm-backport-CVE-2021-35937-CVE-2021-35939.patch
  - fix rpm-backport-Consolidate-skipped-hardlink-with-content-case-with-.patch
  - fix rpm-backport-Fix-sanitize-the-hardlink-metadata-setting-.patch
  - fix rpm-backport-Convert-the-file-creation-steps-the-at-family-of-cal.patch
  - fix rpm-backport-Bury-rpmio-FD-use-to-fsmUnpack.patch
  - fix rpm-backport-Move-file-metadata-setting-back-to-unpack-stage.patch
  - fix rpm-backport-Return-descriptor-of-created-file-from-fsmMkfile.patch
  - fix rpm-backport-CVE-2021-35938.patch


author: Sérgio Basto <sergio@serjux.com> - 1.9.2-2
changelog:
  - Add license tag.
  - Add back sed on -O3 .
  - Not modify soundtouch_config.h because looks correct, just have one line !.


author: Zhang Hui <zhanghui1@nfschina.com> - 1.30-5.3
changelog:
  - TASK:6420. CVE-2019-9923
  - TASK:6420. CVE-2021-20193
  - TASK:6420. CVE-2022-48303
  - fix build error


author: Jakub Martisko <jamartis@redhat.com> - 6.0-38
changelog:
  - Fix CVE-2018-1000035 - heap based buffer overflow when opening
    password protected files.
    Resolves: 1537043


author: Jakub Martisko <jamartis@redhat.com> - 6.0-40
changelog:
  - fix several possibly unterminated strings
    When copying to OEM_CP and ISO_CP strings, the string could end unterminated
    (stncpy does not append '\0').
  - Related: #1602721


author: Jakub Martisko <jamartis@redhat.com> - 6.0-45
changelog:
  Fix a false positive zipbomb detection
  Related: 1954649
  Related: 1953565
  Related: 1969876
  Resolves: 1970326


author: Jakub Martisko <jamartis@redhat.com> - 3.0-22
changelog:
  - Add missing linker flags
  - Port the configure patch from unzip that allows linker flags configuration
    from the spec file
  - Related: #1624188


author: Jakub Martisko <jamartis@redhat.com> - 3.0-23
changelog:
  - Set the ziperr function as noreturn
  - Fix email in the previous chnagelog entry
  - Related: #1602741


author: Ondrej Dubaj <odubaj@redhat.com> - 1.2.11-11
changelog:
  - IBM Z hardware-accelerated deflate for s390x architectures
  - IBM CRC32 optimalization for POWER 8+ architectures
  - fixed firefox crash due to zlib (#1741266)
  - added test for crc32


author: Ondrej Dubaj <odubaj@redhat.com> - 1.2.11-13
changelog:
  - Added -DDFLTCC parameter to configure to enable 
  - Z hardware-accelerated deflate for s390x architectures (#1659433)


author: Ondrej Dubaj <odubaj@redhat.com> - 1.2.11-16
changelog:
  - Permit a deflateParams() parameter change
  - Another fix for Z hardware-accelerated deflate for s390x architectures
  - according to previous change by upstream


author: Ondrej Dubaj <odubaj@redhat.com> - 1.2.11-17
changelog:
  - Fixed DFLTCC compression level switching issues (#1875492)
  - Enabled HW compression for compression levels 1 through 6 (#1847438)
  - Fixed inflateSyncPoint() bad return value on z15 (#1888930)


author: Ding-Yi Chen <dchen@redhat.com> - 0.3.5-1
changelog:
  - Initial import to Fedora
  - Add logrotate
  - Applied patch for https://github.com/openSUSE/cepces/issues/15


author: Ding-Yi Chen <dchen@redhat.com> - 0.3.5-4
changelog:
  - Add Pull request #18
  - Replaces kerberos with gssapi
  - Replaces requests_kerberos with requests_gssapi


author: Ding-Yi Chen <dchen@redhat.com> - 0.3.5-5
changelog:
  - Add Pull request #19
  - Remove Pull request #17 as it is not accepted
  - Review comment #13, #14 addressed


author: Ding-Yi Chen <dchen@redhat.com> - 0.3.5-6
changelog:
  - Review comment #16 addressed
  - It make more sense that -selinux and -certmonger depends on main package,
    Not the other round
  - Recommends: logrotate
  - Supplements: -selinux, -certmonger


author: Danilo de Paula <ddepaula@redhat.com> - 1.3.15-7
changelog:
  - Rebuild all virt packages to fix RHEL's upgrade path
  - Resolves: rhbz#1695587
    (Ensure modular RPM upgrade path)


author: Richard W.M. Jones <rjones@redhat.com> - 7.2-2
changelog:
  - Fix for handling guest filenames with invalid or incomplete
    multibyte or wide characters
    resolves: rhbz#1301593


author: Richard W.M. Jones <rjones@redhat.com> - 8.0-1
changelog:
  - Rebase to 2017.3.23.
  - Remove patches which are now upstream.
  - Resynch with Fedora package.
  - Enable all architectures for RHEL 8.


author: Richard W.M. Jones <rjones@redhat.com> - 8.0-3
changelog:
  - Fix for CVE-2019-9755
    (heap-based buffer overflow leads to local root privilege escalation)
    resolves: rhbz#1698503


author: Cole Robinson <crobinso@redhat.com> - 1.18.0-2
changelog:
  - Fix rdma deps and don't restrict archs
  - Add --disable-werror to fix gcc8 build (bz #1556044)
  - Spec file cleanups (bz #1483290)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 1.18.0-5.el8
changelog:
  - libiscsi-iser_rcv_completion-unify-error-handling.patch [bz#1634541]
  - libiscsi-iser-fix-posting-of-receive-descriptors.patch [bz#1634541]
  - libiscsi-sync-remove-unnecessary-checks.patch [bz#1634541]
  - libiscsi-do-not-warn-for-strncpy.patch [bz#1634541]
  - libiscsi-avoid-fallthrough.patch [bz#1634541]
  - libiscsi-avoid-truncation-when-logging-message-that-includes-.patch [bz#1634541]
  - Resolves: bz#1634541
    (Fix important coverity issues (libiscsi))


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> -
changelog:
  - libiscsi-fix-connection-to-LUN-with-IPv6-address.patch [bz#1597942]
  - Resolves: bz#1597942
    (Qemu-kvm fails to connect to iscsi LUN by IPV6 address)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 1.18.0-7.el8
changelog:
  - libiscsi-redhat-Remove-disable-werror-from-spec-file.patch [bz#1581025]
  - Resolves: bz#1581025
    (Remove --disable-werror from spec file)


author: Richard W.M. Jones <rjones@redhat.com> - 1.0.2-1
changelog:
  - New upstream version 1.0.2.
  - Remove patches which are upstream.
  - Contains fix for NBD Protocol Downgrade Attack (CVE-2019-14842).
  - Fix previous commit message.


author: Richard W.M. Jones <rjones@redhat.com> - 1.0.3-1
changelog:
  - New upstream version 1.0.3.
  - Contains fix for remote code execution vulnerability.
  - Add new libnbd-security(3) man page.


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-32
changelog:
  - util: replace macvtap name reservation bitmap with a simple counter (rhbz#1874304)
  - util: assign tap device names using a monotonically increasing integer (rhbz#1874304)
  - util: virNetDevTapCreate: initialize fd to -1 (rhbz#1874304)


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-33
changelog:
  - cpu_map: Fix Icelake Server model number (rhbz#1537734)
  - cputestdata: Add test data for Snowridge (rhbz#1537734)
  - cpu_map: Add support for fsrm CPU feature (rhbz#1537734)
  - cpu_map: Add support for core-capability CPU feature (rhbz#1537734)
  - cpu_map: Add support for split-lock-detect CPU feature (rhbz#1537734)
  - cpu_map: Define and enable Snowridge model (rhbz#1537734)
  - util: fix typo in VIR_MOCK_WRAP_RET_ARGS() (rhbz#1607929)
  - util/tests: enable locking on iptables/ebtables commandlines in unit tests (rhbz#1607929)
  - util/tests: enable locking on iptables/ebtables commandlines by default (rhbz#1607929)
  - tests: fix iptables test case commandline options in virfirewalltest.c (rhbz#1607929)
  - network: be more verbose about the reason for a firewall reload (rhbz#1607929)
  - util: always check for ebtables/iptables binaries, even when using firewalld (rhbz#1607929)
  - util: synchronize with firewalld before we start calling iptables directly (rhbz#1607929)
  - util: call iptables directly rather than via firewalld (rhbz#1607929)
  - util: virhostcpu: Fail when fetching CPU Stats for invalid cpu (rhbz#1915183)


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-34
changelog:
  - qemu: move cgroup cpu period and quota defines to vircgroup.h (rhbz#1915733)
  - vircgroupv1: use defines for cpu period and quota limits (rhbz#1915733)
  - vircgroupv2: use defines for cpu period and quota limits (rhbz#1915733)
  - vircgroup: fix cpu quota maximum limit (rhbz#1915733)
  - util: add virNetDevGetPhysPortName (rhbz#1918708)
  - util: avoid manual VIR_FREE of a g_autofree pointer in virPCIGetName() (rhbz#1918708)
  - util: Add phys_port_name support on virPCIGetNetName (rhbz#1918708)


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-35
changelog:
  - vircgroupv2: properly detect placement of running VM (rhbz#1798463)
  - virsystemd: export virSystemdHasMachined (rhbz#1798463)
  - virsystemd: introduce virSystemdGetMachineByPID (rhbz#1798463)
  - virsystemd: introduce virSystemdGetMachineUnitByPID (rhbz#1798463)
  - vircgroup: use DBus call to systemd for some APIs (rhbz#1798463)
  - vircgroupv1: refactor virCgroupV1DetectPlacement (rhbz#1798463)
  - vircgroupv2: move task into cgroup before enabling controllers (rhbz#1798463)
  - vircgroup: introduce virCgroupV1Exists and virCgroupV2Exists (rhbz#1798463)
  - vircgroup: introduce nested cgroup to properly work with systemd (rhbz#1798463)
  - tests: add cgroup nested tests (rhbz#1798463)
  - vircgroup: correctly free nested virCgroupPtr (rhbz#1798463)
  - qemu: Add virtio related options to vsock (rhbz#1931548)
  - domain_validate: use defines for cpu period and quota limits (rhbz#1798463)
  - docs: use proper cpu quota value in our documentation (rhbz#1798463)
  - vircgroup: enforce range limit for cpu.shares (rhbz#1798463)
  - cgroup: use virCgroupSetCpuShares instead of virCgroupSetupCpuShares (rhbz#1798463)
  - cpumap: Add support for ibrs CPU feature (rhbz#1926864)
  - cpumap: Add support for svme-addr-check CPU feature (rhbz#1926864)
  - cpu_map: Add EPYC-Milan x86 CPU model (rhbz#1926864)
  - cpu_map: Install x86_EPYC-Milan.xml (rhbz#1926864)
  - cpu_map: Fix spelling of svme-addr-chk feature (rhbz#1926864)


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-36
changelog:
  - network: make it safe to call networkSetupPrivateChains() multiple times (rhbz#1942805)
  - network: force re-creation of iptables private chains on firewalld restart (rhbz#1942805)
  - hostdev: Update mdev pointer reference after checking device type (rhbz#1940449)
  - hostdev: mdev: Lookup mdevs by sysfs path rather than mdev struct (rhbz#1940449)
  - qemu_firmware: don't error out for unknown firmware features (rhbz#1961562)
  - docs: improve description of secure attribute for loader element (rhbz#1929357)
  - conf: introduce virDomainDefParseBootInitOptions (rhbz#1929357)
  - conf: introduce virDomainDefParseBootKernelOptions (rhbz#1929357)
  - conf: introduce virDomainDefParseBootFirmwareOptions (rhbz#1929357)
  - conf: introduce virDomainDefParseBootLoaderOptions (rhbz#1929357)
  - conf: introduce virDomainDefParseBootAcpiOptions (rhbz#1929357)
  - conf: use switch in virDomainDefParseBootOptions (rhbz#1929357)
  - conf: introduce support for firmware auto-selection feature filtering (rhbz#1929357)
  - qemu: implement support for firmware auto-selection feature filtering (rhbz#1929357)
  - domain_conf: Don't leak def->os.firmwareFeatures (rhbz#1929357)
  - conf: remove duplicated firmware type attribute (rhbz#1929357)


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-37
changelog:
  - security: fix SELinux label generation logic (CVE-2021-3631)
  - storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath (CVE-2021-3667)


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-37
changelog:
  - security: test ...
  - storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath (CVE-2021-3667)


author: fenghui <fenghui@nfschina.com> 6.0.0-37.3
changelog:
  - Sup:sup hygon cpu 4.
     100-cpu_x86-Consolidate-signature-match-in-x86DecodeUseC.patch
     101-cpu_x86-Refactor-feature-list-comparison-in-x86Decod.patch
     102-cpu_x86-Penalize-disabled-features-when-computing-CP.patch
     000-cpu-Add-new-Dharma-CPU-model.patch
     001-Add-monitor-feature-for-Dharma-CPU-model.patch


author: Richard W.M. Jones <rjones@redhat.com> - 1.4.0-1
changelog:
  - New upstream version 1.4.0.
  - New plugins: random, zero.
  - New bash tab completion subpackage.
  - Remove unused build dependencies.


author: Richard W.M. Jones <rjones@redhat.com> - 1.4.2-4
changelog:
  - Remove misguided LDFLAGS hack which removed server hardening.
    https://bugzilla.redhat.com/show_bug.cgi?id=1624149#c6
    resolves: rhbz#1624149


author: Laine Stump <laine@redhat.com>
changelog:
  - Improve performance with large number of interfaces
     (Bug 1268384, Bug 1271341)
   - recognize bond devices with no slaves


author: Daniel P. Berrangé <berrange@redhat.com> - 4.5.0-4
changelog:
  - Fix typed parameter memory handling (rhbz #1602346)
  - Fix missing NWFilterBinding module (rhbz #1615841)


author: Jon Maloy <jmaloy@redhat.com> - 4.2.0-59
changelog:
  - kvm-scsi-make-io_timeout-configurable.patch [bz#1994041]
  - Resolves: bz#1994041
    (qemu-kvm scsi: change default passthrough timeout to non-infinite)


author: Jon Maloy <jmaloy@redhat.com> - 4.2.0-59.el8_5
changelog:
  - kvm-hw-scsi-scsi-disk-MODE_PAGE_ALLS-not-allowed-in-MODE.patch [bz#2025605]
  - kvm-e1000-fix-tx-re-entrancy-problem.patch [bz#2025011]
  - Resolves: bz#2025605
    (CVE-2021-3930 virt:rhel/qemu-kvm: QEMU: off-by-one error in mode_sense_page() in hw/scsi/scsi-disk.c [rhel-8.5.0.z])
  - Resolves: bz#2025011
    (CVE-2021-20257 virt:rhel/qemu-kvm: QEMU: net: e1000: infinite loop while processing transmit descriptors [rhel-8.5.0.z])


author: zhouchang <zhouchang@nfschina.com> - 4.2.0-59.6
changelog:
  - Fix CVE-2022-3872,CVE-2023-3180
  - add qemu-4.2.0-CVE-2022-3872.patch
  - add qemu-4.2.0-CVE-2023-3180.patch


author: fenghui <fenghui@nfschina.com> 4.2.0-59.7
changelog:
  - Add: Increase CSV support
   0001-opensource-doc-update-AMD-SEV-API-spec-web-link.patch
   0002-opensource-doc-update-AMD-SEV-to-include-Live-migrat.patch
   0003-opensource-migration.json-add-AMD-SEV-specific-migra.patch
   0004-opensource-linux-headers-update-kernel-header-to-inc.patch
   0005-opensource-hw-machine-add-helper-to-query-the-memory.patch
   0006-opensource-hw-machine-introduce-MachineMemoryEncrypt.patch
   0007-opensource-target-i386-sev-provide-callback-to-setup.patch
   0008-opensource-target-i386-sev-do-not-create-launch-cont.patch
   0009-opensource-target-i386-sev-add-support-to-encrypt-th.patch
   0010-opensource-target-i386-sev-add-support-to-load-incom.patch
   0011-opensource-kvm-Add-support-for-SEV-shared-regions-li.patch
   0012-opensource-migration-add-support-to-migrate-shared-r.patch
   0013-opensource-migration-ram-add-support-to-send-encrypt.patch
   0014-opensource-migration-ram-Force-encrypted-status-for-.patch
   0015-opensource-migration-for-SEV-live-migration-bump-dow.patch
   0016-opensource-kvm-Add-support-for-userspace-MSR-filteri.patch
   0017-bugfix-HYGON-migration-ram-Force-encrypted-status-fo.patch
   0018-newfeature-HYGON-CSV-return-path-set-the-return-path.patch
   0019-newfeature-HYGON-CSV-return-path-send-MIG_CMD_PROVID.patch
   0020-newfeature-HYGON-CSV-return-path-response-MIG_CMD_PR.patch
   0021-newfeature-HYGON-CSV-return-path-response-MIG_RP_MSG.patch
   0022-bugfix-HYGON-target-i386-sev-Clear-shared_regions_li.patch
   0023-bugfix-HYGON-migration-ram-Fix-calculation-of-gfn-co.patch
   0024-newfeature-HYGON-target-i386-sev-add-support-to-queu.patch
   0025-newfeature-HYGON-target-i386-sev-add-support-to-encr.patch
   0026-newfeature-HYGON-target-i386-sev-add-support-to-queu.patch
   0027-newfeature-HYGON-target-i386-sev-add-support-to-load.patch
   0028-newfeature-HYGON-migration-ram-Accelerate-the-encryp.patch
   0029-newfeature-HYGON-migration-ram-Accelerate-the-incomm.patch
   0030-opensource-pc-add-parser-for-OVMF-reset-block.patch
   0031-opensource-sev-i386-Add-initial-support-for-SEV-ES.patch
   0032-opensource-sev-i386-Require-in-kernel-irqchip-suppor.patch
   0033-opensource-sev-i386-Allow-AP-booting-under-SEV-ES.patch
   0034-opensource-sev-i386-Don-t-allow-a-system-reset-under.patch
   0035-opensource-kvm-i386-Use-a-per-VM-check-for-SMM-capab.patch
   0036-opensource-sev-i386-Enable-an-SEV-ES-guest-based-on-.patch
   0037-opensource-docs-Add-SEV-ES-documentation-to-amd-memo.patch
   0038-opensource-docs-interop-firmware.json-Add-SEV-ES-sup.patch
   0039-opensource-docs-Add-spec-of-OVMF-GUIDed-table-for-SE.patch
   0040-newfeature-HYGON-target-i386-sev-Add-support-for-mig.patch
   0041-newfeature-HYGON-target-i386-get-set-migrate-GHCB-st.patch
   0042-newfeature-HYGON-target-i386-kvm-Return-resettable-w.patch
   0043-newfeature-HYGON-kvm-Add-support-for-CSV2-reboot.patch
   0044-newfeature-csv-i386-add-CSV-context.patch
   0045-newfeature-csv-i386-add-command-to-initialize-CSV-co.patch
   0046-newfeature-csv-i386-add-command-to-load-data-to-gues.patch
   0047-newfeature-csv-i386-add-command-to-load-vmcb-to-gues.patch
   0048-newfeature-cpu-i386-populate-CPUID-0x8000_001F-when-.patch
   0049-newfeature-csv-i386-CSV-guest-do-not-need-register-u.patch
   0050-newfeature-target-i386-csv-load-initial-image-to-pri.patch
   0051-newfeature-target-i386-csv-Don-t-allow-reboot-for-CS.patch
   0052-newfeature-vfio-csv-only-map-shared-region-for-CSV-g.patch
   0053-newfeature-vga-force-full-update-for-CSV-guest.patch
   0054-newfeature-linux-headers-update-kernel-headers-to-in.patch
   0055-newfeature-csv-i386-add-support-to-migrate-the-outgo.patch
   0056-newfeature-csv-i386-add-support-to-migrate-the-incom.patch
   0057-newfeature-csv-i386-add-support-to-migrate-the-outgo.patch
   0058-newfeature-csv-i386-add-support-to-migrate-the-incom.patch


author: fenghui <fenghui@nfschina.com> 4.2.0-59.8
changelog:
  - Sup:sup hygon cpu 4.
     100-target-i386-Add-new-property-note-to-versioned-CPU-m.patch
     101-target-i386-Add-CPU-model-versions-supporting-xsaves.patch
     000-target-i386-Add-Hygon-Dhyana-v3-CPU-model.patch
     001-target-i386-Add-new-Hygon-Dharma-CPU-model.patch


author: Danilo C. L. de Paula <ddepaula@redhat.com> - 1.11.0-1.el8
changelog:
  - Creating RHEL-8.0 initial branch based on 1.11.0
  - Resolves: bz#1515300
  - (Prepare seabios for RHEL-8.0)


author: liuda <liuda@nfschina.com> - 2.36.1-1.3
changelog:
  - Fix CVE-2021-45078,CVE-2021-46174,CVE-2022-38533,
        CVE-2022-44840,CVE-2022-47673,CVE-2022-47695,
        CVE-2022-48063,CVE-2022-48064,CVE-2022-48065


author: zhangping <zhangping@nfs-hlj.com> [4.19.113-18.169.nfs]
changelog:
  - Add: Net-ethernet-support-bzwx-nic-driver-nce.patch
  - CONFIG_NET_VENDOR_BZW,CONFIG_NCE,CONFIG_NE6X,CONFIG_NE6XVF


author: zhangping <zhangping@nfs-hlj.com> [4.19.113-18.173.nfs]
changelog:
  - qualcomm: Update qca_7k_common, emac, and rmnet in qualcomm
  - Net-ethernet-update-qualcomm-nic-drivers-from-euler.patch


author: shangyb <yibin@nfschaina.com> [4.19.113-18.177.nfs]
changelog:
  - fix CVEs
    CVE-2024-41015  CVE-2024-41017  CVE-2024-41020  CVE-2024-41035  CVE-2024-41042
    CVE-2024-41046  CVE-2024-41059  CVE-2024-41063  CVE-2024-41068  CVE-2024-41072
    CVE-2024-41089  CVE-2024-41095  CVE-2024-41097  CVE-2024-42084  CVE-2024-42086
    CVE-2024-42087  CVE-2024-42089  CVE-2024-42090  CVE-2024-42092  CVE-2024-42094
    CVE-2024-42096  CVE-2024-42097  CVE-2024-42101  CVE-2024-42102  CVE-2024-42105
    CVE-2024-42106  CVE-2024-42115  CVE-2024-42119  CVE-2024-42104
    CVE-2024-42131  CVE-2024-42223  CVE-2024-42224  CVE-2024-42232
    CVE-2024-42246  CVE-2024-42259  CVE-2024-42265  CVE-2024-42271  CVE-2024-42280
    CVE-2024-42284  CVE-2024-42285  CVE-2024-42286  CVE-2024-42289  CVE-2024-42292
    CVE-2024-42295  CVE-2024-42297  CVE-2024-42301  CVE-2024-42304  CVE-2024-42305
    CVE-2024-42309  CVE-2024-42310  CVE-2024-42311  CVE-2024-42313  CVE-2022-48877
    CVE-2022-48891  CVE-2022-48899  CVE-2023-52893  CVE-2023-52898  CVE-2023-52899
    CVE-2023-52900
    CVE-2023-52907  CVE-2024-43830  CVE-2024-43839  CVE-2024-43856  CVE-2024-43858
    CVE-2024-43861  CVE-2022-48905  CVE-2022-48908  CVE-2022-48911  CVE-2022-48912
    CVE-2022-48917  CVE-2022-48919  CVE-2022-48924  CVE-2022-48926  CVE-2022-48928
    CVE-2022-48930  CVE-2022-48931  CVE-2024-43879  CVE-2024-43882  CVE-2024-43883
    CVE-2024-43884  CVE-2024-43890  CVE-2024-43893  CVE-2024-43914  CVE-2024-44946
    CVE-2024-44947  CVE-2024-44948
    CVE-2024-44965  CVE-2024-44969  CVE-2024-44987   CVE-2023-52915  CVE-2024-44998
    CVE-2024-44999  CVE-2024-45006  CVE-2024-45008   CVE-2024-45021  CVE-2024-45028
    CVE-2024-46673  CVE-2024-46674  CVE-2024-46677   CVE-2024-46685  CVE-2024-46721
    CVE-2024-46722  CVE-2024-46723  CVE-2024-46739   CVE-2024-46743  CVE-2024-46744
    CVE-2024-46745  CVE-2024-46747  CVE-2024-46750   CVE-2024-46755  CVE-2024-46756
    CVE-2024-46757  CVE-2024-46758  CVE-2024-46758   CVE-2024-46759  CVE-2024-46761
    CVE-2024-46771  CVE-2024-46800

  - add bpf-Verifer-adjust_scalar_min_max_vals-to-always-cal.patch
  - fix memory leak in bpf modules


author: Tomas Korbar <tkorbar@redhat.com> - 2.2.5-5
changelog:
  - Fix multiple CVEs
  - CVE-2022-23852 expat: integer overflow in function XML_GetBuffer
  - CVE-2021-45960 expat: Large number of prefixed XML attributes on a single tag can crash libexpat
  - CVE-2021-46143 expat: Integer overflow in doProlog in xmlparse.c
  - CVE-2022-22827 Integer overflow in storeAtts in xmlparse.c
  - CVE-2022-22826 Integer overflow in nextScaffoldPart in xmlparse.c
  - CVE-2022-22825 Integer overflow in lookup in xmlparse.c
  - CVE-2022-22824 Integer overflow in defineAttribute in xmlparse.c
  - CVE-2022-22823 Integer overflow in build_model in xmlparse.c
  - CVE-2022-22822 Integer overflow in addBinding in xmlparse.c
  - Resolves: CVE-2022-23852
  - Resolves: CVE-2021-45960
  - Resolves: CVE-2021-46143
  - Resolves: CVE-2022-22827
  - Resolves: CVE-2022-22826
  - Resolves: CVE-2022-22825
  - Resolves: CVE-2022-22824
  - Resolves: CVE-2022-22823
  - Resolves: CVE-2022-22822


author: Tomas Korbar <tkorbar@redhat.com> - 2.2.5-6
changelog:
  - Fix multiple CVEs
  - CVE-2022-25236 expat: namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution
  - CVE-2022-25235 expat: malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution
  - CVE-2022-25315 expat: integer overflow in storeRawNames()
  - Resolves: CVE-2022-25236
  - Resolves: CVE-2022-25235
  - Resolves: CVE-2022-25315


author: Michal Ruprich <michalruprich@gmail.com> - 14:1.9.1-1
changelog:
  - Resolves: #1806422 - rebase libpcap to version 1.9.1
  - Resolves: #1743650 - [RFE] enable inbox support for sniffing offloaded (RDMA) traffic with tcpdump
  - Resolves: #1785330 - Invalid IPv4 addresses are accepted without reporting even a warning
  - Resolves: #1792208 - Resource exhaustion while PHB header length validation


author: Jun Aruga <jaruga@redhat.com> - 2.5.5-105
changelog:
  - Use ffi_closure_alloc to avoid segmentation fault by libffi on aarch64.
    Resolves: rhbz#1727832
  - Properly support %prerelease in %gemspec_ macros.
    Related: rhbz#1688758
  - Fix rdoc gzipped javascript pages are not the same across multilib.
    Resolves: rhbz#1719647


author: Pavel Valena <pvalena@redhat.com> - 2.5.9-107
changelog:
  - Update to Ruby 2.5.9.
    * Remove Patch20: ruby-2.6.0-rdoc-6.0.1-fix-template-typo.patch; subsumed
    Resolves: rhbz#1757844
  - Resolv::DNS: timeouts if multiple IPv6 name servers are given and address
    contains leading zero
    Resolves: rhbz#1950308


author: Jarek Prokop <jprokop@redhat.com> - 2.5.9-108
changelog:
  - Fix command injection vulnerability in RDoc.
    Resolves: CVE-2021-31799
  - Fix StartTLS stripping vulnerability in Net::IMAP
    Resolves: CVE-2021-32066
  - Fix FTP PASV command response can cause Net::FTP to connect to arbitrary host.
    Resolves: CVE-2021-31810


author: Jun Aruga <jaruga@redhat.com> - 2.5.9-110
changelog:
  - Fix FTBFS due to an incompatible load directive.
  - Fix a fiddle import test on an optimized glibc on Power 9.
  - Fix by adding length limit option for methods that parses date strings.
    Resolves: CVE-2021-41817
  - CGI::Cookie.parse no longer decodes cookie names to prevent spoofing security
    prefixes in cookie names.
    Resolves: CVE-2021-41819


author: Weitao Zhou <zhouwt@linux.alibaba.com> - 2.5.9-110.0.1
changelog:
  - Fix FTBFS due to glibc 2.31.9000 implementing lchmod(2), compatible with glibc2.28 also
    * Patch: ruby-2.8.0-Brace-the-fact-that-lchmod-can-EOPNOTSUPP.patch
    * Patch: ruby-2.8.0-Moved-not-implemented-method-tests.patch
  - Avoid possible timeout errors in TestBugReporter#test_bug_reporter_add.
    * Patch: ruby-2.7.1-Timeout-the-test_bug_reporter_add-witout-raising-err.patch


author: tingfu <tingfu@nfs-hlj.com> - 2.5.9-110.0.4
changelog:
  - update rexml-3.3.6 to fix CVE-2024-39908 CVE-2024-41123 CVE-2024-41946 CVE-2024-43398
  - add update-rexml-3.3.6-add-rexml-rb.patch update-rexml-3.3.6-fix-CVEs.patch


author: lihaipeng <lihaipeng@openanolis.org> - 1.0.0-2.0.1
changelog:
  - Changed the way how/when parameters are interpret
  - Reference https://github.com/ged/ruby-pg/commit/73cd5e158ba4af73243c22f8918b1754256db17b


author: Tomas Kasparek <tkasparek@redhat.com> 2.8.4-1
changelog:
  - 1494389 - Revert "[1260527] RHEL7 reboot loop"
  - 1494389 - Revert "fix except in rhnlib to make it compatible with Python 2.4"


author: Michael Mraka <michael.mraka@redhat.com> 2.8.6-1
changelog:
  - remove install/clean section initial cleanup
  - removed Group from specfile
  - removed BuildRoot from specfiles


author: Tomas Kasparek <tkasparek@redhat.com> 2.8.6-4
changelog:
  - don't package python2 files for rhnlib (tkasparek@redhat.com)
  - be compliant with new packaging guidelines when requiring python2 packages
    (tkasparek@redhat.com)


author: Nick Clifton <nickc@redhat.com> - 9.21-1
changelog:
  - Initial check-in for scl-gcc-toolset-10 branch.  (#1817171)
  - Fix stack clash protection problem. (#1803173)


author: Nick Clifton <nickc@redhat.com> - 9.29-1
changelog:
  - Fix AArch64 checks in annobin plugin.  (#1873416)
  - gcc plugin: Detect any attempt to access the global_options array.
  - gcc plugin: Do not complain about missing pre-processor options when examining a preprocessed input file.  (#1862718)
  - Use more robust checks for AArch64 options.
  - Detect CLANG compiled assembler that is missing IBT support.
  - Improved target pointer size discovery.
  - Add support for installing clang and llvm plugins.
  - Temporary suppression of aarch64 pointer size check.  (#1860549)


author: Pavel Raiskup <praiskup@redhat.com> - 2.4.6-23
changelog:
  - bake in versioned requirement on automake (rhbz#1193591)
  - fix testsuite FTBFS against automake 1.16.1
  - bypass -specs=* to gcc (rhbz#985592)


author: Pavel Raiskup <praiskup@redhat.com> - 2.4.6-26
changelog:
  - cleanup post/postun, there are RPM triggers nowadays
  - fix error: line 2642: func__fatal_error: command not found (rhbz#1622611)


author: Kevin Buettner <kevinb@redhat.com> - 9.1-6
changelog:
  - Backport patches fixing abort when working directory is deleted.
    (RHBZ 1869484, Sergio Durigan Junior)


author: Remi Collet <remi@remirepo.net> - 1.3.2-1
changelog:
  - update to 1.3.2
  - drop multilib header hack
  - change URL to https://libzip.org/
  - test suite now ok on all arch


author: Kaleb S. KEITHLEY <kkeithle@redhat.com>
changelog:
  - remove unneeded ldconfig in scriptlets
  -  reported by Igor Gnatenko in Fedora
  -   https://src.fedoraproject.org/rpms/glusterfs/pull-request/5


author: Stephen Augustus <saugustus@vmware.com> - 1.15.1
changelog:
  - Source cri-tools from https://github.com/kubernetes-sigs/cri-tools
    instead of https://github.com/kubernetes-incubator/cri-tools


author: Stephen Augustus <saugustus@vmware.com> - 1.15.1
changelog:
  - Bump minimum versions of all kubernetes dependencies
  - Remove conditional logic for unsupported versions of Kubernetes


author: Stephen Augustus <saugustus@vmware.com> - 1.18.4
changelog:
  - Source CNI plugins from https://storage.googleapis.com/k8s-artifacts-cni/release
    instead of https://dl.k8s.io/network-plugins


author: Stephen Augustus <saugustus@vmware.com> - 1.18.4
changelog:
  - Source cri-tools from https://storage.googleapis.com/k8s-artifacts-cri-tools/release
    instead of https://github.com/kubernetes-sigs/cri-tools


