# changelog

author: Jaroslav Škarvada <jskarvad@redhat.com> - 2:3.5.8-2
changelog:
  - Fixed cleanup crash when processing messages with whitespace only fullname
    Resolves: rhbz#1977732


author: Jan Rybar <jrybar@redhat.com> - 3.3.15-4
changelog:
  - pidof: new option to show kernel worker threads
  - pidof: empty input causes to show kernel worker threads
  - Resolves: rhbz#1860486
  - Resolves: rhbz#1894526
  - Related: rhbz#1803640
  -


author: Jan Rybar <jrybar@redhat.com> - 3.3.15-5
changelog:
  - version bump due to unspotted malformed backport patch
  - Resolves: rhbz#1860486
  - Resolves: rhbz#1894526
  - Related: rhbz#1803640


author: Jan Rybar <jrybar@redhat.com> - 3.3.15-8
changelog:
  - vmstat: added -y option to omit first report
  - Resolves: rhbz#2027350
  - sysctl: backport config directory order, align with systemd
  - Resolves: rhbz#2111915


author: Jan Rybar <jrybar@redhat.com> - 3.3.15-3
changelog:
  - pgrep: uid/gid conversion overflow
  - vmstat: align manpage with procfs wording
  - watch: manpage presumes NTP on system
  - Resolves: rhbz#1827731
  - Resolves: rhbz#1829920
  - Resolves: rhbz#1583669


author: Jan Rybar <jrybar@redhat.com> - 6.6.3-2
changelog:
  - lastcomm: added new --pid option to show process PID and PPID
  - changelog update: 6.6.3-1 author change
  - spec file update: added correct access mode to created /var/account/pacct


author: Jan Rybar <jrybar@redhat.com> - 23.1
changelog:
  - Rebase to the newest upstream official release
  - Source0 updated to latest functional SourceForge URL format
  - peekfd manpage now not present if peekfd binary missing on given architecture
  - URL of the project updated
  - new tool pslog added with rebase
  - Resolves: #1460695


author: Ray Strode <rstrode@redhat.com> - 3.28.3-2
changelog:
  - Add lock to avoid two type object wrappers getting generated at
    the same time in multi-threaded programs.
    Resolves: #1844578


author: Iryna Shcherbina <ishcherb@redhat.com> - 1:2.6.1-2
changelog:
  - Fix ambiguous Python 2 dependency declarations
    (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.0.4-3
changelog:
  - Python 2 binary package renamed to python2-chardet
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1:1.1.fb23-4
changelog:
  - Python 2 binary package renamed to python2-configshell
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Christian Heimes <cheimes@redhat.com> - 2.2.1-2
changelog:
  - Drop Python 2 subpackages from RHEL 8, fixes RHBZ#1589754
  - Remove unnecessary copy and shebang mangling


author: Christian Heimes <cheimes@redhat.com> - 2.3-1
changelog:
  - New upstream release 2.3
  - Fix AEAD tag truncation bug, CVE-2018-10903, RHBZ#1602755, RHBZ#1602932


author: Miro Hrončok <mhroncok@redhat.com> - 0.13-1
changelog:
  - Updated to 0.13
  - Added python3 and python2 subpackages
  - Add --with tests
  - Modernize spec
  - Remove merged patch
  - Update upstream URL


author: Lumír Balhar <lbalhar@redhat.com> - 0.14-3
changelog:
  - Backport patch from upstream/rhel7 which allows pifconfig to show
    multiple IPv4 addresses for each interface
  - Move patches to dist-git
  - Resolves: rhbz#1652174


author: Carl George <carl@george.computer> - 1.6.1-1
changelog:
  - Latest upstream
  - Add patch0 to remove pytest-{cov,runner} deps
  - Share doc and license dir between subpackages
  - Enable EPEL PY3 build


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.9-16
changelog:
  - Python 2 binary package renamed to python2-kmod
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: John Kacur <jkacur@redhat.com> - 0.6.2-1
changelog:
  - Add bitmasklist_test
  - Clean-ups including using a more modern python spacing, tabbing, etc
  - Fix to parse number of cpus correctly on s390(x)
  Resolves: rhbz#1849215


author: John Kacur <jkacur@redhat.com> - 0.6.3-4
changelog:
  - various clean-ups including using 'with' context managers in try-except
  - Fix to ignore UnicodeDecodeError when it occurs
  Resolves: rhbz#2016204


author: John Dennis <jdennis@redhat.com> - 2.0.1-1
changelog:
  - Upgrade to upstream 2.0.1
  - port from jwt to jwcrypto (conditional build)
  - bring into alignment with rhel spec file


author: mulhern <amulhern@redhat.com> - 0.19.0
changelog:
  - Never raise a DeviceNotFoundError when iterating over a device enumeration
  - Device.subsystem() now returns None if device has no subsystem
  - Add DeprecationWarnings to deprecated Device methods
  - Replace "/" with "!" in Device.from_name() sys_name parameter
  - Add some unstable classes for parsing some kinds of values
  - Make version info more like Python's including micro numbers and levels
  - Refactor some internal modules into subdirectories
  - Work on tests and reproducers


author: mulhern <amulhern@redhat.com> - 0.20.0
changelog:
  - Remove parsing code added in previous release
  - No longer do CI for Python 2.6
  - Eliminate all wildcard imports and __all__ statements
  - No longer use deprecated Device.from_sys_path() method
  - Minor pylint induced changes
  - Documentation fixes


author: mulhern <amulhern@redhat.com> - 0.21.1
changelog:
  - Deprecate use of Device object as mapping from udev property names to values
  - Add a Properties class and a Device.properties() method for udev properties
  - Fix places where Device object was incorrectly used in a boolean context
  - Return an empty string, not None, if the property value is an empty string
  - Exceptions re-raised from libudev calls now have a message string
  - Insert a warning about using a Device in a boolean context in docs
  - Infrastructure for vagrant tests is removed
  - Various internal refactorings
  - Extensive test improvements
  - Numerous documentation fixes


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.10.0-3
changelog:
  - Python 2 binary package renamed to python2-pywbem
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Tony Asleson <tasleson@redhat.com> - 0.11.0-8
changelog:
  - Fix the conflict with sblim-wbemcli: RHBZ #1757855
  - Corrected warning about multiple file inclusion


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.12-6
changelog:
  - Python 2 binary package renamed to python2-pyyaml
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Miro Hrončok <mhroncok@redhat.com> - 3.12-12
changelog:
  - Rename python3-PyYAML to python3-pyyaml
  - Modernize spec
  - Fix python2 invocation

  - Cherry-picked from: https://src.fedoraproject.org/rpms/PyYAML/pull-request/2


author: Tomas Orsava <torsava@redhat.com> - 2.18.4-6
changelog:
  - Skip all tests needing httpbin: httpbin has too many dependencies to be
    shipped in RHEL just for build-time package tests


author: Florian Festi <ffesti@redhat.com> - 4.14.3-5
changelog:
  - Don't error out when replacing an invalid signature (#1874062)
  - Raise an expection when erasing a package fails in Python (#1872623)
  - Fix builds on NFS filesystems (#1840728)


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-12
changelog:
  - Bump up the limit of signature header to 64MB (#1918777)
  - Add fapolicyd plugin (#1923167)
  - Unblock signals in forked scriptlets (#1913765)
  - Fix ambiguous diagnostics output on file triggers (#1883338)
  - Ensure ELF files get stripped when debuginfo is disabled (#1634084)


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-13
changelog:
  - Fix minor issues found by COVSCAN in fapolicyd plugin
  - Actually honor libarchive bcond at configure time (#1902887)


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-15
changelog:
  - Add out-of-bounds checks to hdrblobInit() (#1929445)
  - Fixes CVE-2021-20266
  - Fix regression in brp-strip causing kmods to lose SecureBoot sig (#1967291)


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-16
changelog:
  - Add support for read-only sqlite rpmdb (#1938928)
  - Drop compat .decode() method from returned Py3 strings (#1840142)


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-20
changelog:
  - Add --path query option (#1940895)
  - Macroize find-debuginfo script location (#2019540)
  - Validate and require subkey binding sigs on PGP pubkeys (#1958480)
  - Fixes CVE-2021-3521


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-22
changelog:
  - Fix spurious %transfiletriggerpostun execution (#2023693)
  - Skip recorded symlinks in --setperms (#1900662)


author: Maurizio Lombardi <mlombard@redhat.com> - 2.1.fb67-4
changelog:
  - epydoc is used only with python2 but the latter is not supported in RHEL8
    I remove the dependency


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.5-5
changelog:
  - Python 2 binary package renamed to python2-schedutils
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Tomas Popela <tpopela@redhat.com> - 0.35.9
changelog:
  - Bump the release so we can resurrect the python3 subpackages that we need for
    newer Inkscape
  - Related: rhbz#1891732


author: Vit Mojzis <vmojzis@redhat.com> - 4.2.1-3
changelog:
  - Use 
    CFLAGS="${CFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m32 -march=x86-64 -mtune=generic -mfpmath=sse -mstackrealign -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection}" ; export CFLAGS ; 
    CXXFLAGS="${CXXFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m32 -march=x86-64 -mtune=generic -mfpmath=sse -mstackrealign -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection}" ; export CXXFLAGS ; 
    FFLAGS="${FFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m32 -march=x86-64 -mtune=generic -mfpmath=sse -mstackrealign -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -I/usr/lib/gfortran/modules}" ; export FFLAGS ; 
    FCFLAGS="${FCFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m32 -march=x86-64 -mtune=generic -mfpmath=sse -mstackrealign -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -I/usr/lib/gfortran/modules}" ; export FCFLAGS ; 
    LDFLAGS="${LDFLAGS:--Wl,-z,relro  -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld}" ; export LDFLAGS instead of -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m32 -march=x86-64 -mtune=generic -mfpmath=sse -mstackrealign -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection


author: Vit Mojzis <vmojzis@redhat.com> - 4.3.0-1
changelog:
  - SETools 4.3.0 release (#1820079)
  - Revised sediff method for TE rules. This drastically reduced memory and run time.
  - Added infiniband context support to seinfo, sediff, and apol.
  - Added apol configuration for location of Qt assistant.
  - Fixed sediff issue where properties header would display when not requested.
  - Fixed sediff issue with type_transition file name comparison.
  - Fixed permission map socket sendto information flow direction.
  - Added methods to TypeAttribute class to make it a complete Python collection.
  - Genfscon now will look up classes rather than using fixed values which
    were dropped from libsepol.
  - setools requires -console, -console-analyses and -gui packages (#1820078)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.6.4-8
changelog:
  - Python 2 binary package renamed to python2-slip
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.6.4-10
changelog:
  - Also rename python-slip-dbus and python-slip-gtk to python2-*
  - Add missing %python_provide macros
  - Use new python2- names in dependencies


author: Charalampos Stratakis <cstratak@redhat.com> - 0.6.4-12
changelog:
  - Make firewalld to not log errors when running commands as root
    in the absence of polkitd.
  Resolves: rhbz#2076606


author: Lukas Slebodnik <lslebodn@fedoraproject.org> - 1.22-9
changelog:
  - Do not lowercase hostnames with custom-protocol (rhbz 1567862)
  - upstream: https://github.com/urllib3/urllib3/issues/1267


author: Tomas Orsava <torsava@redhat.com> - 1.24.2-1
changelog:
  - Rebased to 1.24.2 to fix CVE-2019-11324
  - Added patches for CVE-2019-11236 (AKA CVE-2019-9740)
  - Resolves: rhbz#1703361 rhbz#1706026


author: Lumír Balhar <lbalhar@redhat.com> - 1.24.2-3
changelog:
  - Enable TLS 1.3 post-handshake authentication
  - Adjust RECENT_DATE variable according to rules
  Resolves: rhbz#1726743


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.3.0-11
changelog:
  - Python 2 binary package renamed to python2-urwid
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: David Cantrell <dcantrell@redhat.com> - 1.3.1-2
changelog:
  - Apply upstream fix for EINTR handling in test_vterm test case
  - Apply upstream fix for test_remove_watch_file flakiness
  - Apply upstream fix for test_vterm handling of NUL characters


author: Petr Pisar <ppisar@redhat.com> - 1:4.04-3
changelog:
  - rpcgen tool split from glibc-common package
  - Pass TIRPC header files location to all RPC compilation units
  - Do not iterate over negative UIDs in repquota
  - Fix mistakes in warnquota reported by GCC 8


author: Petr Pisar <ppisar@redhat.com> - 1:4.04-4
changelog:
  - Avoid questions in quotacheck non-interactive mode
  - Report an error when quotacheck fails to cache quota files
  - Report an error if quota file magic is invalid


author: Aristeu Rozanski <aris@redhat.com> 0.6.1-9
changelog:
  - Prevent ras-mc-ctl trying to access extlog and mce tables if rasdaemon was built without support for them [2011404]


author: René Genz <liebundartig@freenet.de> - 0.16.3-12
changelog:
  - use correct authselect syntax for *-disable-logins to fix rhbz#1558245
  - Iryna Shcherbina <ishcherb@redhat.com>
    Update Python 2 dependency declarations to new packaging standards
    (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)


author: Sumit Bose <sbose@redhat.com> - 0.16.3-13
changelog:
  - Add latests patches from RHEL7
  - Add polkit runtime dependency
    Resolves: rhbz#1577179
  - Drop python2 build dependency
    Resolves: rhbz#1595813
  - Fix documentation reference in systemd unit file
    Resolves: rhbz#1596325


author: Sumit Bose <sbose@redhat.com> - 0.16.3-14
changelog:
  - Fix python BuildRequires
    Resolves: rhbz#1615564
  - Add RHEL specific patch for IPA
    Resolves: rhbz#1615320
  - Fix issues found by Coverity
    Resolves: rhbz#1602677


author: Sumit Bose <sbose@redhat.com> - 0.16.3-17
changelog:
  - rebuild fails if DISTRO variable is exported
    Resolves: rhbz#1747454
  - realmd.conf user-principal RFE and clarification
    Resolves: rhbz#1747452
  - realmd.conf documentation incorrect
    Resolves: rhbz#1747457
  - Document realmd.conf and how realmd reads the configuration
    Resolves: rhbz#1747456


author: Sumit Bose <sbose@redhat.com> - 0.16.3-19
changelog:
  - Realm join fails with error 'Failed to join domain: failed to lookup
    DC info ...'
    Resolves: rhbz#1859503
  - realm command to use option like dnshostname=fqdn
    Resolves: rhbz#1867912


author: Sumit Bose <sbose@redhat.com> - 0.16.3-20
changelog:
  - realmd should handle default_realm in krb5.conf
    Resolves: rhbz#1791016
  - [RFE] Enable LDAPS functionality in realmd join
    Resolves: rhbz#1826964


author: Sumit Bose <sbose@redhat.com> - 0.16.3-24
changelog:
  - Avoid duplicated log messages and use Samba's new CLI options
    Resolves: rhbz#2024248
    Resolves: rhbz#2028528


author: Josh Boyer <jwboyer@redhat.com> - 8.2-0.8.el8
changelog:
  - Allow stateless system usage of os-release (RhBug: 1766754)
  - Based on a contribution from Neal Gompa


author: Leon Kang <lekang@redhat.com> - 8.2-0.9.el8
changelog:
  - enable nvmefc-boot-connections.service in
    /usr/lib/systemd/system-preset/90-default.preset
  - Resolves: RCM-77224


author: Eugene Syromiatnikov <esyr@redhat.com> - 115-1
changelog:
  - Revert back to usage of join in find-requires.ksym:mod_requires()
    as generated "Requires:" and "Provides:" lists have different format
    and unsuitable for processing with comm (#1622016)


author: Eugene Syromiatnikov <esyr@redhat.com> - 116-1
changelog:
  - Forward-port RHEL-specific kmodtool/macros.kmp changes from RHEL 7,
    update kmodtool script for RHEL 8 (#1658414, #1666162)


author: Christopher Snyder <csnyder@redhat.com> 1.27.5-1
changelog:
  - Revert "1667792: added --disable-auto-attach option to register command;
    ENT-1684" (csnyder@redhat.com)
  - 1834792: Try to terminate rhsmd after timeout; ENT-2368 (jhnidek@redhat.com)
  - 1837244: Fix wrong version provided by subscription-manager version; ENT-2388
    (jhnidek@redhat.com)
  - 1838012: prevent redundant remote syspurpose sync (pmoravec@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 1.28.0-1
changelog:
  - 1804454: collect uuid on aarch64 system (wpoteat@redhat.com)
  - WIP: Try to fix build of rpms on suse. (jhnidek@redhat.com)
  - 1842474: Update local and cache file during sync(); ENT-2433
    (jhnidek@redhat.com)
  - 1725525: Mark one string for translation; ENT-1680 (jhnidek@redhat.com)
  - 1789457: Syspurpose exception message parsing (wpoteat@redhat.com)
  - Fix building sub-man on Fedora 32 (jhnidek@redhat.com)
  - cockpit: Call run-tests from common to run cockpit integration tests
    (sanne.raymaekers@gmail.com)


author: Christopher Snyder <csnyder@redhat.com> 1.27.9-1
changelog:
  - 1840364: Kill rhsmd during post-install on rhel8
    (jhnidek@redhat.com)
  - 1848636, 1849074: Update insights machine-id path (csnyder@redhat.com)
  - 1700441: Create directories, when missing (jhnidek@redhat.com)


author: William Poteat <wpoteat@redhat.com> 1.27.10-1
changelog:
  - 1847636: error when registering in intial-setup-graphical
    (wpoteat@redhat.com)
  - Added unit test for this case. (jhnidek@redhat.com)
  - 1845399: List available subscription ondate options failed
    (wpoteat@redhat.com)
  - 1657269: Do not use /var/run, but use /run; ENT-1086 (jhnidek@redhat.com)
  - cockpit: change button order to conform with patternfly guidelines
    (anilsson@redhat.com)


author: William Poteat <wpoteat@redhat.com> 1.27.11-1
changelog:
  - 1780028: Remove man page entries for rhsmd (wpoteat@redhat.com)
  - 1838423: Fix getting list of releases from CDN; (jhnidek@redhat.com)
  - 1838670: set permissions on rhsm.conf (jbastian@redhat.com)
  - cockpit: Fix AppStream launchable metainfo (martin@piware.de)
  - 1838967: Sync syspurpose cache on registration (wpoteat@redhat.com)
  - 1859532: Role --list handle wrong proxy conf (unregistered case) (jhnidek@redhat.com)
  - 1859532: No traceback, when wrong proxy conf is used (jhnidek@redhat.com)
  - 1857100: Do not print empty string as valid value (jhnidek@redhat.com)
  - 1634023: Use list of valid syspurpose values provided by candlepin server (jhnidek@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 1.27.12-1
changelog:
  - 1832990: Add rhsm.no_insights config option, improve messaging
    (csnyder@redhat.com)
  - Add --no-insights option; ENT-2471 (khowell@redhat.com)


author: William Poteat <wpoteat@redhat.com> 1.27.13-1
changelog:
  - 1663116: 1663390: 1663402: 1663408: Update translations (wpoteat@redhat.com)
  - 1862425: Fix setting service-level (jhnidek@redhat.com)
  - 1862419: Make repo-override working again (jhnidek@redhat.com)
  - 1858296: Do not print unchanged profile (jhnidek@redhat.com)
  - 1861255: Catch all exception and print traceback to rhsm.log
    (jhnidek@redhat.com)
  - 1841600: D-Bus - update ent. cert., when act. key is used
    (jhnidek@redhat.com)
  - Support Insights registration by default in cockpit (khowell@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 1.27.14-1
changelog:
  - 1862415: Print proper message, when consumer is deleted; ENT-2709
    (jhnidek@redhat.com)
  - 1855893: Generate redhat.repo properly; ENT-2636 (jhnidek@redhat.com)
  - Revert "Add --no-insights option; ENT-2471" (csnyder@redhat.com)
  - Revert "Add insights-client messaging on registration" (csnyder@redhat.com)
  - Revert "Address review feedback" (csnyder@redhat.com)
  - Revert "1832990: Add rhsm.no_insights config option, improve messaging"
    (csnyder@redhat.com)
  - Automatic commit of package [subscription-manager] release [1.27.13-1].
    (wpoteat@redhat.com)
  - 1663116: 1663390: 1663402: 1663408: Update translations (wpoteat@redhat.com)
  - 1862425: Fix setting service-level; ENT-1862425 (jhnidek@redhat.com)
  - 1862419: Make repo-override working again; ENT-2710 (jhnidek@redhat.com)
  - 1858296: Do not print unchanged profile; ENT-2639 (jhnidek@redhat.com)
  - 1861255: Catch all exception and print traceback to rhsm.log
    (jhnidek@redhat.com)
  - 1841600: D-Bus - update ent. cert., when act. key is used; ENT-2453
    (jhnidek@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 1.27.15-1
changelog:
  - 1615429: Fix sorting of plugin hooks (csnyder@redhat.com)
  - 1820534: Update translations (csnyder@redhat.com)
  - 1841601: Set default encoding properly; ENT-2499 (jhnidek@redhat.com)
  - 1839199: More rhsmd cleanup (wpoteat@redhat.com)
  - 1869725: Do not print traceback, when profile upload failed; ENT-2754
    (jhnidek@redhat.com)


author: William Poteat <wpoteat@redhat.com> 1.27.17-1
changelog:
  - Use python3-requests and not python-requests. (jhnidek@redhat.com)
  - ENT-3289: automatic registration on public cloud (#2407) (jhnidek@redhat.com)
  - ENT-3191: Collect metadata of cloud providers (#2381) (jhnidek@redhat.com)
  - Detecting of cloud providers; ENT-3288 (#2367) (jhnidek@redhat.com)
  - Syntax update to translation commands (#2396) (wpoteat@redhat.com)
  - Update project to use Weblate for translations (#2389) (wpoteat@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 1.28.6-1
changelog:
  - 1850624: Uncaught JSONDecodeError when content_access.json is empty and
    registering to Satellite6 (wpoteat@redhat.com)
  - 1831082: Better messages for attach --auto for SCA mode; ENT-3175
    (jhnidek@redhat.com)


author: Neil Horman <nhorman@redhat.com> - 6.8-2
changelog:
  - Fix erroneous message due to bad errno check (bz 1776710)
  - Enable addition of 0 value for fill-watermark (bz 1776710)


author: Vladis Dronov <vdronov@redhat.com> - 6.8-4
changelog:
  - There is no need to hardcode _sbindir anymore, also the old value is
    incorrect
  - Update the rngd.service file
  - Fix a busyloop bug (bz 1956248)
  - Fix /dev/hwrng permission issue (bz 1955522)


author: Vladis Dronov <vdronov@redhat.com> - 6.8-6
changelog:
  - Adjust rngd-wake-threshold.service and post section so udevadm is not
    run in a container (bz 1975554)


author: Vladis Dronov <vdronov@redhat.com> - 6.13-1.git.d207e0b6
changelog:
  - Update to the upstream v6.13 + tip of origin/master + onecpu
    branch + revert of 2ce93190
  - Rebuild rng-tools against the latest jitterentropy library
    3.0.2-2.git.409828cf with fixes for an important issue
  - Fix a number of issues (bz 1974103, bz 1980421, bz 1859154)


author: Vladis Dronov <vdronov@redhat.com> - 6.14-4.git.b2b7934e
changelog:
  - Update rng-tools to v6.14 @ b2b7934e (bz 2015570)
  - Update jitterentropy library to v3.3.1 @ 887c9871
  - Add a config file for storing rngd options
  - Fix a security issue found by a covscan in jitterentropy library


author: Vladis Dronov <vdronov@redhat.com> - 6.14-5.git.b2b7934e
changelog:
  - Fix udevadm issues on systems lacking it (bz 2057030)
  - Fix a missing working directory issue (bz 2053160)
  - Add some upstream patches


author: Vladis Dronov <vdronov@redhat.com> - 6.15-1
changelog:
  - Update rng-tools to v6.15 @ 172bf0e3 (bz 2075974)
  - Update jitterentropy library to v3.4.0 @ 887c9871
  - Allow rngd process to drop privileges with "-D user:group"
  - Fix an error building with jitterentropy-3.4.0
  - Add a requirement for selinux-policy of a certain version
  - Fix a build failure on ppc64
  - Small edits in test scripts


author: Vladis Dronov <vdronov@redhat.com> - 6.15-2
changelog:
  - Update rng-tools to v6.15 @ 6dcc9ec2 (bz 2124602)
  - Update jitterentropy library to v3.4.1 @ 4544e113
  - Do not require selinux-policy if it is not present


author: Vladis Dronov <vdronov@redhat.com> - 6.15-3
changelog:
  - Update rng-tools to v6.15 @ cb8cc624 (bz 2141379)
  - Update jitterentropy library to v3.4.1 @ 7bf9f85d
  - Fix a stack corruption on s390x
  - Fix a number of issues found by covscan code scanner
  - Add a jitter init timeout for tests
  - Add a start condition for the FIPS mode (bz 2154804)


author: Vladis Dronov <vdronov@redhat.com> - 6.8-4
changelog:
  - There is no need to hardcode _sbindir anymore, also the old value is incorrect
  - Update the rngd.service file
  - Fix a busyloop bug (bz 1956248)
  - Fix /dev/hwrng permission issue (bz 1955522)


author: Ondrej Vasik <ovasik@redhat.com> 0.1-13
changelog:
  - copy content of /etc/skel directory for root as posstrans,
    don't overwrite  existing files (#999114)


author: Steve Dickson <steved@redhat.com> - 1.2.5-1
changelog:
  - Fixed stack buffer overflow in rpcinfo (bz 1637565)
  - Make sure /var/lib/rpcbind exists (bz 1628901)


author: Nils Philippsen <nils@redhat.com> - 0.2.4-8.rc2
changelog:
  - create and formally own the state directory so it is available from the time
    of first installation until reboot


author: Michal Ruprich <mruprich@redhat.com> - 3.1.3-19
changelog:
  - Resolves: #2116668 - zlib: a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field


author: Petr Stodulka <pstodulk@redhat.com> - 4.2.2-14
changelog:
  - remove meaningless redefinition of _bindir - it's standard macro now;
    sed will be store in /usr/bin/sed
    Resovles: #1305835


author: Jakub Martisko <jamartis@redhat.com> - 4.4-4
changelog:
  - When editing file inplace, the SELinux context should
    be based on the link instead of the target file itself.
    --follow-symlinks option remains unchanged
  - Resolves: #1401442


author: Jakub Martisko <jamartis@redhat.com> - 4.5-2
changelog:
  - fix "in-place edits on FUSE filesystems create files with all-zero mode bits"
  - Resolves: #1835761


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-98
changelog:
  - Allow sysadm user execute init scripts with a transition
  Resolves: rhbz#2039662
  - Change invalid type redisd_t to redis_t in redis_stream_connect()
  Resolves: rhbz#1897517
  - Allow php-fpm write access to /var/run/redis/redis.sock
  Resolves: rhbz#1897517
  - Allow sssd read systemd-resolved runtime directory
  Resolves: rhbz#2060721
  - Allow postfix stream connect to cyrus through runtime socket
  Resolves: rhbz#2066005
  - Allow insights-client create_socket_perms for tcp/udp sockets
  Resolves: rhbz#2073395
  - Allow insights-client read rhnsd config files
  Resolves: rhbz#2073395
  - Allow sblim-sfcbd connect to sblim-reposd stream
  Resolves: rhbz#2075810
  - Allow rngd drop privileges via setuid/setgid/setcap
  Resolves: rhbz#2076641
  - Allow rngd_t domain to use nsswitch
  Resolves: rhbz#2076641


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-99
changelog:
  - Allow ifconfig_t domain to manage vmware logs
  Resolves: rhbz#1721943
  - Allow insights-client manage gpg admin home content
  Resolves: rhbz#2060834
  - Add the gpg_manage_admin_home_content() interface
  Resolves: rhbz#2060834
  - Label /var/cache/insights with insights_client_cache_t
  Resolves: rhbz#2063195
  - Allow insights-client search gconf homedir
  Resolves: rhbz#2087069
  - Allow insights-client create and use unix_dgram_socket
  Resolves: rhbz#2087069
  - Label more vdsm utils with virtd_exec_t
  Resolves: rhbz#2063871
  - Label /usr/libexec/vdsm/supervdsmd and vdsmd with virtd_exec_t
  Resolves: rhbz#2063871
  - Allow sblim-gatherd the kill capability
  Resolves: rhbz#2082677
  - Allow privoxy execmem
  Resolves: rhbz#2083940


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-100
changelog:
  - Update logging_create_generic_logs() to use create_files_pattern()
  Resolves: rhbz#2081907
  - Add the auth_read_passwd_file() interface
  Resolves: rhbz#2083504
  - Allow auditd_t noatsecure for a transition to audisp_remote_t
  Resolves: rhbz#2081907
  - Add support for samba-dcerpcd
  Resolves: rhbz#2083504
  - Allow rhsmcertd create generic log files
  Resolves: rhbz#1852086
  - Allow ctdbd nlmsg_read on netlink_tcpdiag_socket
  Resolves: rhbz#2090800


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-101
changelog:
  - Add the init_status_config_transient_files() interface
  Resolves: rhbz#2091117
  - Allow init_t to rw insights_client unnamed pipe
  Resolves: rhbz#2091117
  - Update kernel_read_unix_sysctls() for sysctl_net_unix_t handling
  Resolves: rhbz#2091117
  - Allow insights-client get status of the systemd transient scripts
  Resolves: rhbz#2091117
  - Allow insights-client execute its private memfd: objects
  Resolves: rhbz#2091117
  - Update policy for insights-client to run additional commands 2
  Resolves: rhbz#2091117
  - Do not call systemd_userdbd_stream_connect() for insights-client
  Resolves: rhbz#2091117
  - Use insights_client_tmp_t instead of insights_client_var_tmp_t
  Resolves: rhbz#2091117
  - Change space indentation to tab in insights-client
  Resolves: rhbz#2091117
  - Use socket permissions sets in insights-client
  Resolves: rhbz#2091117
  - Update policy for insights-client to run additional commands
  Resolves: rhbz#2091117
  - Change rpm_setattr_db_files() to use a pattern
  Resolves: rhbz#2091117
  - Add rpm setattr db files macro
  Resolves: rhbz#2091117
  - Fix insights client
  Resolves: rhbz#2091117
  - Do not let system_cronjob_t create redhat-access-insights.log with var_log_t
  Resolves: rhbz#2091117


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-102
changelog:
  - Allow transition to insights_client named content
  Resolves: rhbz#2091117
  - Add the insights_client_filetrans_named_content() interface
  Resolves: rhbz#2091117
  - Update policy for insights-client to run additional commands 3
  Resolves: rhbz#2091117


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-103
changelog:
  - Allow domain read usermodehelper state information
  Resolves: rhbz#2083504
  - Remove all kernel_read_usermodehelper_state() interface calls
  Resolves: rhbz#2083504
  - Allow samba-dcerpcd work with sssd
  Resolves: rhbz#2096825
  - Allow winbind_rpcd_t connect to self over a unix_stream_socket
  Resolves: rhbz#2096825
  - Update samba-dcerpcd policy for kerberos usage
  Resolves: rhbz#2096825
  - Allow keepalived read the contents of the sysfs filesystem
  Resolves: rhbz#2098189
  - Update policy for samba-dcerpcd
  Resolves: rhbz#2083504
  - Remove all kernel_read_usermodehelper_state() interface calls 2/2
  Resolves: rhbz#2083504
  - Update insights_client_filetrans_named_content()
  Resolves: rhbz#2091117


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-105
changelog:
  - Do not call systemd_userdbd_stream_connect() for winbind-rpcd
  Resolves: rhbz#2108383
  - Update winbind_rpcd_t
  Resolves: rhbz#2108383
  - Allow irqbalance file transition for pid sock_files and directories
  Resolves: rhbz#2111916
  - Update irqbalance runtime directory file context
  Resolves: rhbz#2111916


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-106
changelog:
  - Allow networkmanager to signal unconfined process
  Resolves: rhbz#1918148
  - Allow sa-update to get init status and start systemd files
  Resolves: rhbz#2011239
  - Allow samba-bgqd get a printer list
  Resolves: rhbz#2114737
  - Allow insights-client rpm named file transitions
  Resolves: rhbz#2104913
  - Add /var/tmp/insights-archive to insights_client_filetrans_named_content
  Resolves: rhbz#2104913
  - Use insights_client_filetrans_named_content
  Resolves: rhbz#2104913
  - Make default file context match with named transitions
  Resolves: rhbz#2104913
  - Allow rhsmcertd to read insights config files
  Resolves: rhbz#2104913
  - Label /etc/insights-client/machine-id
  Resolves: rhbz#2104913


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-107
changelog:
  - Label 319/udp port with ptp_event_port_t
  Resolves: rhbz#2118628
  - Allow unconfined and sysadm users transition for /root/.gnupg
  Resolves: rhbz#2119507
  - Add the kernel_read_proc_files() interface
  Resolves: rhbz#2119507
  - Add userdom_view_all_users_keys() interface
  Resolves: rhbz#2119507
  - Allow system_cronjob_t domtrans to rpm_script_t
  Resolves: rhbz#2118362
  - Allow smbd_t process noatsecure permission for winbind_rpcd_t
  Resolves: rhbz#2117199
  - Allow chronyd bind UDP sockets to ptp_event ports
  Resolves: rhbz#2118628
  - Allow samba-bgqd to read a printer list
  Resolves: rhbz#2118958
  - Add gpg_filetrans_admin_home_content() interface
  Resolves: rhbz#2119507
  - Update insights-client policy for additional commands execution
  Resolves: rhbz#2119507
  - Allow gpg read and write generic pty type
  Resolves: rhbz#2119507
  - Allow chronyc read and write generic pty type
  Resolves: rhbz#2119507
  - Disable rpm verification on interface_info
  Resolves: rhbz#2119472


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-108
changelog:
  - Allow unconfined_service_t insights client content filetrans
  Resolves: rhbz#2119507
  - Allow nsswitch_domain to connect to systemd-machined using a unix socket
  Resolves: rhbz#2119507
  - Add init_status_all_script_files() interface
  Resolves: rhbz#2119507
  - Add dev_dontaudit_write_raw_memory() and dev_read_vsock() interfaces
  Resolves: rhbz#2119507
  - Update insights-client policy for additional commands execution 5
  Resolves: rhbz#2119507
  - Confine insights-client systemd unit
  Resolves: rhbz#2119507
  - Update insights-client policy for additional commands execution 4
  Resolves: rhbz#2119507
  - Change rhsmcertd_t to insights_client_t in insights-client policy
  Resolves: rhbz#2119507
  - Allow insights-client send signull to unconfined_service_t
  Resolves: rhbz#2119507
  - Update insights-client policy for additional commands execution 3
  Resolves: rhbz#2119507
  - Allow journalctl read init state
  Resolves: rhbz#2119507
  - Update insights-client policy for additional commands execution 2
  Resolves: rhbz#2119507


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-108.1
changelog:
  - Add the files_map_read_etc_files() interface
  Resolves: rhbz#2136762
  - Allow insights-client manage samba var dirs
  Resolves: rhbz#2136762
  - Allow insights-client send null signal to rpm and system cronjob
  Resolves: rhbz#2136762
  - Update rhcd policy for executing additional commands 4
  Resolves: rhbz#2136762
  - Allow insights-client connect to postgresql with a unix socket
  Resolves: rhbz#2136762
  - Allow insights-client domtrans on unix_chkpwd execution
  Resolves: rhbz#2136762
  - Add file context entries for insights-client and rhc
  Resolves: rhbz#2136762


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-108.2
changelog:
  - Add domain_unix_read_all_semaphores() interface
  Resolves: rhbz#2170510
  - Add interfaces in domain, files, and unconfined modules
  Resolves: rhbz#2170510
  - Allow insights-client manage fsadm pid files
  Resolves: rhbz#2170510
  - Allow insights-client work with su and lpstat
  Resolves: rhbz#2170510
  - Allow insights-client read nvme devices
  Resolves: rhbz#2170510
  - Allow insights-client tcp connect to all ports
  Resolves: rhbz#2170510
  - Add insights additional capabilities
  Resolves: rhbz#2170510
  - Allow insights client work with gluster and pcp
  Resolves: rhbz#2170510
  - Allow insights-client tcp connect to various ports
  Resolves: rhbz#2170510
  - Allow insights-client work with pcp and manage user config files
  Resolves: rhbz#2170510
  - Allow insights-client dbus chat with various services
  Resolves: rhbz#2170510
  - Allow insights-client dbus chat with abrt
  Resolves: rhbz#2170510
  - Allow insights client communicate with cupsd, mysqld, openvswitch, redis
  Resolves: rhbz#2170510
  - Allow insights client read raw memory devices
  Resolves: rhbz#2170510
  - Allow insights-client domain transition on semanage execution
  Resolves: rhbz#2170510
  - Allow insights-client create gluster log dir with a transition
  Resolves: rhbz#2170510
  - Allow insights-client manage generic locks
  Resolves: rhbz#2170510
  - Allow insights-client unix_read all domain semaphores
  Resolves: rhbz#2170510


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-109
changelog:
  - Add the files_map_read_etc_files() interface
  Resolves: rhbz#2132230
  - Allow insights-client manage samba var dirs
  Resolves: rhbz#2132230
  - Allow insights-client send null signal to rpm and system cronjob
  Resolves: rhbz#2132230
  - Update rhcd policy for executing additional commands 4
  Resolves: rhbz#2132230
  - Allow insights-client connect to postgresql with a unix socket
  Resolves: rhbz#2132230
  - Allow insights-client domtrans on unix_chkpwd execution
  Resolves: rhbz#2132230
  - Add file context entries for insights-client and rhc
  Resolves: rhbz#2132230
  - Allow snmpd_t domain to trace processes in user namespace
  Resolves: rhbz#2121084
  - Allow sbd the sys_ptrace capability
  Resolves: rhbz#2124552
  - Allow pulseaudio create gnome content (~/.config)
  Resolves: rhbz#2124387


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-110
changelog:
  - Add the systemd_connectto_socket_proxyd_unix_sockets() interface
  Resolves: rhbz#208441
  - Add the dev_map_vhost() interface
  Resolves: rhbz#2122920
  - Allow init remount all file_type filesystems
  Resolves: rhbz#2122239
  - added policy for systemd-socket-proxyd
  Resolves: rhbz#2088441
  - Allow virt_domain map vhost devices
  Resolves: rhbz#2122920
  - Allow virt domains to access xserver devices
  Resolves: rhbz#2122920
  - Allow rotatelogs read httpd_log_t symlinks
  Resolves: rhbz#2030633
  - Allow vlock search the contents of the /dev/pts directory
  Resolves: rhbz#2122838
  - Allow system cronjobs dbus chat with setroubleshoot
  Resolves: rhbz#2125008
  - Allow ptp4l_t name_bind ptp_event_port_t
  Resolves: rhbz#2130168
  - Allow pcp_domain execute its private memfd: objects
  Resolves: rhbz#2090711
  - Allow samba-dcerpcd use NSCD services over a unix stream socket
  Resolves: rhbz#2121709
  - Allow insights-client manage samba var dirs
  Resolves: rhbz#2132230


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-111
changelog:
  - Add domain_unix_read_all_semaphores() interface
  Resolves: rhbz#2141311
  - Allow iptables list cgroup directories
  Resolves: rhbz#2134820
  - Allow systemd-hostnamed dbus chat with init scripts
  Resolves: rhbz#2111632
  - Allow systemd to read symlinks in /var/lib
  Resolves: rhbz#2118784
  - Allow insights-client domain transition on semanage execution
  Resolves: rhbz#2141311
  - Allow insights-client create gluster log dir with a transition
  Resolves: rhbz#2141311
  - Allow insights-client manage generic locks
  Resolves: rhbz#2141311
  - Allow insights-client unix_read all domain semaphores
  Resolves: rhbz#2141311
  - Allow winbind-rpcd use the terminal multiplexor
  Resolves: rhbz#2107106
  - Allow mrtg send mails
  Resolves: rhbz#2103675
  - Allow sssd dbus chat with system cronjobs
  Resolves: rhbz#2132922
  - Allow postfix/smtp and postfix/virtual read kerberos key table
  Resolves: rhbz#1983308


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-112
changelog:
  - Allow ipsec_t only read tpm devices
  Resolves: rhbz#2147380
  - Allow ipsec_t read/write tpm devices
  Resolves: rhbz#2147380
  - Label udf tools with fsadm_exec_t
  Resolves: rhbz#1972230
  - Allow the spamd_update_t domain get generic filesystem attributes
  Resolves: rhbz#2144501
  - Allow cdcc mmap dcc-client-map files
  Resolves: rhbz#2144505
  - Allow insights client communicate with cupsd, mysqld, openvswitch, redis
  Resolves: rhbz#2143878
  - Allow insights client read raw memory devices
  Resolves: rhbz#2143878
  - Allow winbind-rpcd get attributes of device and pty filesystems
  Resolves: rhbz#2107106
  - Allow postfix/smtpd read kerberos key table
  Resolves: rhbz#1983308


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-113
changelog:
  - Allow systemd-socket-proxyd get attributes of cgroup filesystems
  Resolves: rhbz#2088441
  - Allow systemd-socket-proxyd get filesystems attributes
  Resolves: rhbz#2088441
  - Allow sysadm read ipmi devices
  Resolves: rhbz#2148561
  - Allow system mail service read inherited certmonger runtime files
  Resolves: rhbz#2143337
  - Add lpr_roles  to system_r roles
  Resolves: rhbz#2151111
  - Allow insights-client tcp connect to various ports
  Resolves: rhbz#2151111
  - Allow insights-client work with pcp and manage user config files
  Resolves: rhbz#2151111
  - Allow insights-client dbus chat with various services
  Resolves: rhbz#2152867
  - Allow insights-client dbus chat with abrt
  Resolves: rhbz#2152867
  - Allow redis get user names
  Resolves: rhbz#2112228
  - Add winbind-rpcd to samba_enable_home_dirs boolean
  Resolves: rhbz#2143696


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-114
changelog:
  - Add interfaces in domain, files, and unconfined modules
  Resolves: rhbz#2141311
  - Allow sysadm_t read/write ipmi devices
  Resolves: rhbz#2148561
  - Allow sudodomain use sudo.log as a logfile
  Resolves: rhbz#2143762
  - Add insights additional capabilities
  Resolves: rhbz#2158779
  - Allow insights client work with gluster and pcp
  Resolves: rhbz#2141311
  - Allow prosody manage its runtime socket files
  Resolves: rhbz#2157902
  - Allow system mail service read inherited certmonger runtime files
  Resolves: rhbz#2143337
  - Add lpr_roles  to system_r roles
  Resolves: rhbz#2151111


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-115
changelog:
  - Fix syntax problem in redis.te
  Resolves: rhbz#2112228
  - Allow unconfined user filetransition for sudo log files
  Resolves: rhbz#2164047
  - Allow winbind-rpcd make a TCP connection to the ldap port
  Resolves: rhbz#2152642
  - Allow winbind-rpcd manage samba_share_t files and dirs
  Resolves: rhbz#2152642
  - Allow insights-client work with su and lpstat
  Resolves: rhbz#2134125
  - Allow insights-client read nvme devices
  Resolves: rhbz#2143878
  - Allow insights-client tcp connect to all ports
  Resolves: rhbz#2143878
  - Allow redis-sentinel execute a notification script
  Resolves: rhbz#2112228


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-116
changelog:
  - Allow sysadm_t run initrc_t script and sysadm_r role access
  Resolves: rhbz#2039662
  - Allow insights-client manage fsadm pid files
  Resolves: rhbz#2166802
  - Add journalctl the sys_resource capability
  Resolves: rhbz#2136189


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-117
changelog:
  - Fix opencryptoki file names in /dev/shm
  Resolves: rhbz#2028637
  - Allow system_cronjob_t transition to rpm_script_t
  Resolves: rhbz#2154242
  - Revert "Allow system_cronjob_t domtrans to rpm_script_t"
  Resolves: rhbz#2154242
  - Allow httpd work with tokens in /dev/shm
  Resolves: rhbz#2028637
  - Allow keepalived to set resource limits
  Resolves: rhbz#2168638
  - Allow insights-client manage fsadm pid files


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-60
changelog:
  - Allow wireshark create and use rdma socket
  Resolves: rhbz#1844370
  - Allow to use nnp_transition in pulseaudio_role
  Resolves: rhbz#1854471
  - Allow certmonger fsetid capability
  Resolves: rhbz#1873211
  - Add rsync_sys_admin tunable to allow rsync sys_admin capability
  Resolves: rhbz#1889673
  - Allow sysadm read and write /dev/rfkill
  Resolves: rhbz#1831630
  - Allow staff_u run pam_console_apply
  Resolves: rhbz#1817690
  - Label /dev/vhost-vdpa-[0-9]+ as vhost_device_t
  Resolves: rhbz#1907485


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-61
changelog:
  - Add kpatch_exec() interface
  Resolves: rhbz#1895322
  - Allow rhsmcertd execute kpatch
  Resolves: rhbz#1895322
  - Allow openvswitch_t perf_event open permission
  Resolves: rhbz#1916046
  - Allow openvswitch fowner capability and create netlink sockets
  Resolves: rhbz#1883980
  - Add net_broadcast capability to openvswitch_t domain
  Resolves: rhbz#1883980
  - Update interface modutils_read_module_deps to allow caller domain also mmap modules_dep_t files
  Resolves: rhbz#1883980
  - Allow machinectl to run pull-tar
  Resolves: rhbz#1788055


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-62
changelog:
  - Allow rhsmcertd_t domain transition to kpatch_t
  Resolves: rhbz#1895322
  - Revert "Add kpatch_exec() interface"
  Resolves: rhbz#1895322
  - Revert "Allow rhsmcertd execute kpatch"
  Resolves: rhbz#1895322
  - Dontaudit NetworkManager_t domain to write to kdump temp pipies
  Resolves: rhbz#1842897
  - Allow NetworkManager_t domain to get status of samba services
  Resolves: rhbz#1781806
  - Allow openvswitch create and use xfrm netlink sockets
  Resolves: rhbz#1916046
  - Allow openvswitch_t perf_event write permission
  Resolves: rhbz#1916046
  - Add write_perf_event_perms object permission set
  Related: rhbz#1916046


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-63
changelog:
  - Allow rtkit_daemon_t domain set process nice value in user namespaces
  Resolves: rhbz#1910507
  - Allow gpsd read and write ptp4l_t shared memory.
  Resolves: rhbz#1803845
  - Label /var/run/pcsd-ruby.socket socket with cluster_var_run_t type
  Resolves: rhbz#1804626
  - Allow Certmonger to use opencryptoki services
  Resolves: rhbz#1894132
  - Dontaudit vhostmd to write in /var/lib/rpm/ dir and allow signull rpm
  Resolves: rhbz#1815603
  - Allow rhsmcertd_t read kpatch lib files
  Resolves: rhbz#1895322
  - Allow ipsec_t connectto ipsec_mgmt_t
  Resolves: rhbz#1848355
  - Allow IPsec to use opencryptoki services
  Resolves: rhbz#1894132
  - Allow systemd-importd create /run/systemd/machines.lock file
  Resolves: rhbz#1788055


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-64
changelog:
  - Allow unconfined_t and kprop_t to create krb5_0.rcache2 with the right context
  Resolves: rhbz#1874527
  Resolves: rhbz#1877044
  - Allow rhsmcertd bind tcp sockets to a generic node
  Resolves: rhbz#1923985
  - Allow ipsec_mgmt_t mmap ipsec_conf_file_t files
  Resolves: rhbz#1889542
  - Allow strongswan start using swanctl method
  Resolves: rhbz#1889542
  - Allow systemd-importd manage machines.lock file
  Resolves: rhbz#1788055


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-71
changelog:
  - Allow nmap create and use rdma socket
  Resolves: rhbz#1844530
  - Label /.k5identity file allow read of this file to rpc.gssd
  Resolves: rhbz#1951093
  - Label /var/lib/kdump with kdump_var_lib_t
  Resolves: rhbz#1965985
  - Label /run/libvirt/common with virt_common_var_run_t
  Resolves: rhbz#1966842


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-72
changelog:
  - Allow systemd-sleep get attributes of fixed disk device nodes
  Resolves: rhbz#1931460
  - Allow systemd-sleep create hardware state information files
  Resolves: rhbz#1968610
  - virtiofs supports Xattrs and SELinux
  Resolves: rhbz#1899703
  - Label 4460/tcp port as ntske_port_t
  Resolves: rhbz#1961207
  - Add the miscfiles_map_generic_certs macro to the sysnet_dns_name_resolve macro.
  Resolves: rhbz#1961207
  - Allow chronyd_t to accept and make NTS-KE connections
  Resolves: rhbz#1961207
  - Dontaudit NetworkManager write to initrc_tmp_t pipes
  Resolves: rhbz#1963162
  - Allow logrotate rotate container log files
  Resolves: rhbz#1892170
  - Allow rhsmd read process state of all domains and kernel threads
  Resolves: rhbz#1878020


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-73
changelog:
  - Removed adding to attribute unpriv_userdomain from userdom_unpriv_type template
  Resolves: rhbz#1947841
  - Allow transition from xdm domain to unconfined_t domain.
  Resolves: rhbz#1947841
  - Allow nftables read NetworkManager unnamed pipes
  Resolves: rhbz#1967857
  - Create a policy for systemd-journal-upload
  Resolves: rhbz#1913414
  - Add dev_getattr_infiniband_dev() interface.
  Resolves: rhbz#1972522
  - Allow tcpdump and nmap get attributes of infiniband_device_t
  Resolves: rhbz#1972522
  - Allow fcoemon create sysfs files
  Resolves: rhbz#1978562
  - Allow nftables read NetworkManager unnamed pipes
  Resolves: rhbz#1967857
  - Allow radius map its library files
  Resolves: rhbz#1854650
  - Allow arpwatch get attributes of infiniband_device_t devices
  Resolves: rhbz#1936522


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-75
changelog:
  - Add the unconfined_dgram_send() interface
  Resolves: rhbz#1978562
  - Change dev_getattr_infiniband_dev() to use getattr_chr_files_pattern()
  Resolves: rhbz#1936522
  - Add checkpoint_restore cap2 capability
  Resolves: rhbz#1973325
  - Allow fcoemon talk with unconfined user over unix domain datagram socket
  Resolves: rhbz#1978562
  - Allow hostapd bind UDP sockets to the dhcpd port
  Resolves: rhbz#1977676
  - Allow NetworkManager read and write z90crypt device
  Resolves: rhbz#1938203
  - Allow abrt_domain read and write z90crypt device
  Resolves: rhbz#1938203
  - Label /usr/lib/pcs/pcs_snmp_agent with cluster_exec_t
  Resolves: rhbz#1937111
  - Allow mdadm read iscsi pid files
  Resolves: rhbz#1924716


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-76
changelog:
  - Allow login_userdomain read and map /var/lib/systemd files
  Resolves: rhbz#1965251
  - Allow sysadm acces to kernel module resources
  Resolves: rhbz#1965251
  - Allow sysadm to read/write scsi files and manage shadow
  Resolves: rhbz#1965251
  - Allow sysadm access to files_unconfined and bind rpc ports
  Resolves: rhbz#1965251
  - Allow sysadm read and view kernel keyrings
  Resolves: rhbz#1965251
  - Allow bootloader to read tuned etc files
  Resolves: rhbz#1965251
  - Update the policy for systemd-journal-upload
  Resolves: rhbz#1913414
  - Allow journal mmap and read var lib files
  Resolves: rhbz#1965251
  - Allow tuned to read rhsmcertd config files
  Resolves: rhbz#1965251
  - Allow bootloader to read tuned etc files
  Resolves: rhbz#1965251
  - Confine rhsm service and rhsm-facts service as rhsmcertd_t
  Resolves: rhbz#1846081
  - Allow virtlogd_t read process state of user domains
  Resolves: rhbz#1797899
  - Allow cockpit_ws_t get attributes of fs_t filesystems
  Resolves: rhbz#1979182


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-77
changelog:
  - Revert "update libs_filetrans_named_content() to have support for /usr/lib/debug directory"
  Resolves: rhbz#1887739
  - Allow sysadm to read/write scsi files and manage shadow
  Resolves: rhbz#1956302
  - Allow rhsmcertd execute gpg
  Resolves: rhbz#1887572
  - Allow lldpad send to kdump over a unix dgram socket
  Resolves: rhbz#1979121
  - Remove glusterd SELinux module from distribution policy
  Resolves: rhbz#1816718


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-78
changelog:
  - Label /usr/bin/Xwayland with xserver_exec_t
  Resolves: rhbz#1984584
  - Label /usr/libexec/gdm-runtime-config with xdm_exec_t
  Resolves: rhbz#1984584
  - Allow D-bus communication between avahi and sosreport
  Resolves: rhbz#1916397
  - Allow lldpad send to kdumpctl over a unix dgram socket
  Resolves: rhbz#1979121
  - Revert "Allow lldpad send to kdump over a unix dgram socket"
  Resolves: rhbz#1979121
  - Allow chronyc respond to a user chronyd instance
  Resolves: rhbz#1993104
  - Allow ptp4l respond to pmc
  Resolves: rhbz#1993104
  - Allow lldpad send to unconfined_t over a unix dgram socket
  Resolves: rhbz#1993270


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-79
changelog:
  - Introduce xdm_manage_bootloader booelan
  Resolves: rhbz#1994096
  - Rename samba_exec() to samba_exec_net()
  Resolves: rhbz#1855215
  - Allow sssd to set samba setting
  Resolves: rhbz#1855215
  - Allow dirsrv read slapd tmpfs files
  Resolves: rhbz#1843238
  - Allow rhsmcertd to create cache file in /var/cache/cloud-what
  Resolves: rhbz#1994718


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-84
changelog:
  - Allow sysadm_t read/write pkcs shared memory segments
  Resolves: rhbz#1965251
  - Allow sysadm_t connect to sanlock over a unix stream socket
  Resolves: rhbz#1965251
  - Allow sysadm_t dbus chat with sssd
  Resolves: rhbz#1965251
  - Allow sysadm_t set attributes on character device nodes
  Resolves: rhbz#1965251
  - Allow sysadm_t read and write watchdog devices
  Resolves: rhbz#1965251
  - Allow sysadm_t connect to cluster domains over a unix stream socket
  Resolves: rhbz#1965251
  - Allow sysadm_t dbus chat with tuned 2/2
  Resolves: rhbz#1965251
  - Update userdom_exec_user_tmp_files() with an entrypoint rule
  Resolves: rhbz#1920883
  - Allow sudodomain send a null signal to sshd processes
  Resolves: rhbz#1966945
  - Allow sysadm_t dbus chat with tuned 1/2
  Resolves: rhbz#1965251
  - Allow cloud-init dbus chat with systemd-logind
  Resolves: rhbz#2009769
  - Allow svnserve send mail from the system
  Resolves: rhbz#2004843
  - Allow svnserve_t domain to read system state
  Resolves: rhbz#2004843


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-85
changelog:
  - Allow unconfined_t to node_bind icmp_sockets in node_t domain
  Resolves: rhbz#2025445
  - Allow rhsmcertd get attributes of tmpfs_t filesystems
  Resolves: rhbz#2015820
  - The nfsdcld service is now confined by SELinux
  Resolves: rhbz#2026588
  - Allow smbcontrol use additional socket types
  Resolves: rhbz#2027740
  - Allow lldpd use an snmp subagent over a tcp socket
  Resolves: rhbz#2028379


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-86
changelog:
  - Allow sysadm execute sysadmctl in sysadm_t domain using sudo
  Resolves: rhbz#2013749
  - Allow local_login_t get attributes of tmpfs filesystems
  Resolves: rhbz#2015539
  - Allow local_login_t get attributes of filesystems with ext attributes
  Resolves: rhbz#2015539
  - Allow local_login_t domain to getattr cgroup filesystem
  Resolves: rhbz#2015539
  - Allow systemd read unlabeled symbolic links
  Resolves: rhbz#2021835
  - Allow userdomains use pam_ssh_agent_auth for passwordless sudo
  Resolves: rhbz#1917879
  - Allow sudodomains execute passwd in the passwd domain
  Resolves: rhbz#1943572
  - Label authcompat.py with authconfig_exec_t
  Resolves: rhbz#1919122
  - Dontaudit pkcsslotd sys_admin capability
  Resolves: rhbz#2021887
  - Allow lldpd connect to snmpd with a unix domain stream socket
  Resolves: rhbz#1991029


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-87
changelog:
  - Set default file context for /sys/firmware/efi/efivars
  Resolves: rhbz#2039458
  - Allow sysadm_t start and stop transient services
  Resolves: rhbz#2031065
  - Label /etc/cockpit/ws-certs.d with cert_t
  Resolves: rhbz#1907473
  - Allow smbcontrol read the network state information
  Resolves: rhbz#2033873
  - Allow rhsm-service read/write its private memfd: objects
  Resolves: rhbz#2029873
  - Allow fcoemon request the kernel to load a module
  Resolves: rhbz#1940317
  - Allow radiusd connect to the radacct port
  Resolves: rhbz#2038955
  - Label /var/lib/shorewall6-lite with shorewall_var_lib_t
  Resolves: rhbz#2041447
  - Exclude container.if from selinux-policy-devel
  Resolves: rhbz#1861968


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-89
changelog:
  - Allow NetworkManager talk with unconfined user over unix domain dgram socket
  Resolves: rhbz#2044048
  - Allow system_mail_t read inherited apache system content rw files
  Resolves: rhbz#1988339
  - Add apache_read_inherited_sys_content_rw_files() interface
  Related: rhbz#1988339
  - Allow rhsm-service execute its private memfd: objects
  Resolves: rhbz#2029873
  - Allow dirsrv read configfs files and directories
  Resolves: rhbz#2042568
  - Label /run/stratisd with stratisd_var_run_t
  Resolves: rhbz#1879585
  - Fix path for excluding container.if from selinux-policy-devel
  Resolves: rhbz#1861968


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-90
changelog:
  - Fix badly indented used interfaces
  Resolves: rhbz#2030156
  - Allow domain transition to sssd_t 1/2
  Resolves: rhbz#2022690
  - Allow confined users to use kinit,klist and etc.
  Resolves: rhbz#2026598
  - Allow login_userdomain open/read/map system journal
  Resolves: rhbz#2046481
  - Allow init read stratis data symlinks 2/2
  Resolves: rhbz#2048514
  - Label new utility of NetworkManager nm-priv-helper
  Resolves: rhbz#1986076
  - Label NetworkManager-dispatcher service with separate context
  Resolves: rhbz#1989070
  - Allow domtrans to sssd_t and role access to sssd
  Resolves: rhbz#2030156
  - Creating interface sssd_run_sssd()
  Resolves: rhbz#2030156
  - Allow domain transition to sssd_t 2/2
  Resolves: rhbz#2022690
  - Allow timedatex dbus chat with xdm
  Resolves: rhbz#2040214
  - Associate stratisd_data_t with device filesystem
  Resolves: rhbz#2048514
  - Allow init read stratis data symlinks 1/2
  Resolves: rhbz#2048514
  - Allow rhsmcertd create rpm hawkey logs with correct label
  Resolves: rhbz#1949871


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-92
changelog:
  - Allow postfix_domain read dovecot certificates 1/2
  Resolves: rhbz#2043599
  - Dontaudit dirsrv search filesystem sysctl directories 1/2
  Resolves: rhbz#2042568
  - Allow chage domtrans to sssd
  Resolves: rhbz#2054718
  - Allow postfix_domain read dovecot certificates 2/2
  Resolves: rhbz#2043599
  - Allow ctdb create cluster logs
  Resolves: rhbz#2049481
  - Allow alsa bind mixer controls to led triggers
  Resolves: rhbz#2049730
  - Allow alsactl set group Process ID of a process
  Resolves: rhbz#2049730
  - Dontaudit mdadm list dirsrv tmpfs dirs
  Resolves: rhbz#2011174
  - Dontaudit dirsrv search filesystem sysctl directories 2/2
  Resolves: rhbz#2042568
  - Revert "Label NetworkManager-dispatcher service with separate context"
  Related: rhbz#1989070
  - Revert "Allow NetworkManager-dispatcher dbus chat with NetworkManager"
  Related: rhbz#1989070


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-93
changelog:
  - Allow systemd-networkd dbus chat with sosreport
  Resolves: rhbz#1949493
  - Allow sysadm_passwd_t to relabel passwd and group files
  Resolves: rhbz#2053457
  - Allow confined sysadmin to use tool vipw
  Resolves: rhbz#2053457
  - Allow sosreport dbus chat with abrt and timedatex
  Resolves: rhbz#1949493
  - Remove unnecessary /etc file transitions for insights-client
  Resolves: rhbz#2031853
  - Label all content in /var/lib/insights with insights_client_var_lib_t
  Resolves: rhbz#2031853
  - Update insights-client policy
  Resolves: rhbz#2031853
  - Update insights-client: fc pattern, motd, writing to etc
  Resolves: rhbz#2031853
  - Remove permissive domain for insights_client_t
  Resolves: rhbz#2031853
  - New policy for insight-client
  Resolves: rhbz#2031853
  - Add the insights_client module
  Resolves: rhbz#2031853
  - Update specfile to buildrequire policycoreutils-devel >= 2.9-19
  - Add modules_checksum to %files


author: Nikola Knazekova nknazeko@redhat.com - 3.14.3-94
changelog:
  - Allow chronyd send a message to sosreport over datagram socket
  - Allow systemd-logind dbus chat with sosreport
  Resolves: rhbz#1949493


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-95.2
changelog:
  - Add the init_status_config_transient_files() interface
  Resolves: rhbz#2103606
  - Allow transition to insights_client named content
  Resolves: rhbz#2103606
  - Allow init_t to rw insights_client unnamed pipe
  Resolves: rhbz#2103606
  - Update kernel_read_unix_sysctls() for sysctl_net_unix_t handling
  Resolves: rhbz#2103606
  - Add the gpg_manage_admin_home_content() interface
  Resolves: rhbz#2103606
  - Update insights_client_filetrans_named_content()
  Resolves: rhbz#2103606
  - Add the insights_client_filetrans_named_content() interface
  Resolves: rhbz#2103606
  - Update policy for insights-client to run additional commands 3
  Resolves: rhbz#2103606
  - Allow insights-client get status of the systemd transient scripts
  Resolves: rhbz#2103606
  - Allow insights-client execute its private memfd: objects
  Resolves: rhbz#2103606
  - Update policy for insights-client to run additional commands 2
  Resolves: rhbz#2103606
  - Do not call systemd_userdbd_stream_connect() for insights-client
  Resolves: rhbz#2103606
  - Use insights_client_tmp_t instead of insights_client_var_tmp_t
  Resolves: rhbz#2103606
  - Change space indentation to tab in insights-client
  Resolves: rhbz#2103606
  - Use socket permissions sets in insights-client
  Resolves: rhbz#2103606
  - Update policy for insights-client to run additional commands
  Resolves: rhbz#2103606
  - Change rpm_setattr_db_files() to use a pattern
  Resolves: rhbz#2103606
  - Add rpm setattr db files macro
  Resolves: rhbz#2103606
  - Fix insights client
  Resolves: rhbz#2103606
  - Do not let system_cronjob_t create redhat-access-insights.log with var_log_t
  Resolves: rhbz#2103606
  - Allow insights-client manage gpg admin home content
  Resolves: rhbz#2103606
  - Label /var/cache/insights with insights_client_cache_t
  Resolves: rhbz#2103606
  - Allow insights-client search gconf homedir
  Resolves: rhbz#2103606
  - Allow insights-client create and use unix_dgram_socket
  Resolves: rhbz#2103606
  - Allow insights-client create_socket_perms for tcp/udp sockets
  Resolves: rhbz#2103606
  - Allow insights-client read rhnsd config files
  Resolves: rhbz#2103606
  - Allow insights-client search rhnsd configuration directory
  Resolves: rhbz#2103606


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-95.3
changelog:
  - Allow insights-client rpm named file transitions
  Resolves: rhbz#2103606
  - Add /var/tmp/insights-archive to insights_client_filetrans_named_content
  Resolves: rhbz#2103606
  - Use insights_client_filetrans_named_content
  Resolves: rhbz#2103606
  - Make default file context match with named transitions
  Resolves: rhbz#2103606
  - Allow rhsmcertd to read insights config files
  Resolves: rhbz#2103606
  - Label /etc/insights-client/machine-id
  Resolves: rhbz#2103606


author: Ondrej Vasik <ovasik@redhat.com> - 2.12.0-1
changelog:
  - move /etc/networks from initscripts to setup
  - move /etc/profile.d/lang.{sh,csh} from initscripts to setup


author: Ondrej Vasik <ovasik@redhat.com> - 2.12.2-2
changelog:
  - do not ship /etc/hosts.allow and /etc/hosts.deny (no need for them
    as we don't allow tcp_wrappers in RHEL8, #1663556)


author: Martin Osvald <mosvald@redhat.com> - 2.12.2-3
changelog:
  - add pcp user to /etc/aliases (#1744089)
  - set PATH if it is empty in csh.login (#1744104)
  - lang.csh: prevent grep from failing so scripts do not end
    prematurely when tcsh -e option in use (#1678706)
  - use full path for non-builtins (#1688302)
  - add nrpe tcp port 5666 to /etc/services (#1730396)


author: Martin Osvald <mosvald@redhat.com> - 2.12.2-7
changelog:
  - Move /var/log/lastlog ownership to systemd (#2044589)
  - tcsh sets variable p to /usr/sbin from /etc/csh.login (#1945400)
  - bashrc: Don't set up VTE-specific PROMPT_COMMAND (#1917934)


author: Tomas Bzatek <tbzatek@redhat.com> - 1.44-3
changelog:
  - Fix sg_turs help invocation in an old mode (#1683343)
  - Fix sg_raw printing error about device not specified on version request (#1627657)


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.6-1
changelog:
  - Update to current upstream release 4.6
  - Raise limit for passwd and shadow entry length but also prevent
    writing longer entries (#1422497)


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.6-5
changelog:
  - use cap_setxid file capabilities for newxidmap instead of making them setuid
  - limit the SYS_U/GID_MIN value to 1 as the algorithm does not work with 0
    and the 0 is always used by root anyway
  - manual page improvements
  - flush sssd caches - patch by Jakub Hrozek


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.6-8
changelog:
  - properly audit group password change
  - do not add uid of a new (not yet added) user to the audit message
  - use lckpwdf() again to disable concurrent edits of databases by
    other applications
  - clarify chage manual page in regards to shadow and passwd
    inconsistency
  - fix minor issues in groupadd and login.defs manual pages
  - Ignore LOGIN_PLAIN_PROMPT variable in login.defs
  - force regeneration of getdate.c otherwise the date parsing fix
    is not applied


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-9
changelog:
  - do not mistake a regular user process for a namespaced one (#1788696)
  - add HOME_MODE support in login.defs (#1777718)


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-12
changelog:
  - lib/sssd: redirect warning message to file (#1749001)
  - useradd: clarify valid usernames/groupnames (#1869432)
  - login.defs: link login specific information to its own package (#1804766)


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-15
changelog:
  - Creation of subid and subid-devel subpackages (#2013009)
  - libsubid: creation and nsswitch support
  - libsubid: don't print error messages on stderr by default
  - libsubid: libsubid_init return false if out of memory
  - libsubid: don't return owner in list_owner_ranges API call
  - libsubid: libsubid_init don't print messages on error
  - libsubid: fix newusers when nss provides subids
  - libsubid: make shadow_logfd not extern
  - useradd: fix SUB_UID_COUNT=0
  - man: mention NSS in new[ug]idmap manpages
  - man: clarify subid delegation


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-16
changelog:
  - getsubids: provide system binary and man page. Resolves: #2013016
  - groupdel: fix SIGSEGV when passwd does not exist. Resolves: #1986782


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-17
changelog:
  - subordinateio: also compare the owner ID. Resolves: #2093311
  - Fix release sources
  - Add subid requirement for subid-devel


author: Čestmír Kalina <ckalina@redhat.com> - 1.6.0-1
changelog:
  - Resolves: #1869292 Statistics Support - smc-tools part
  - Resolves: #1919225 Add SMC-D Setup Check (smc-tools)
  - Resolves: #1919240 Upgrade smc-tools to latest version


author: Čestmír Kalina <ckalina@redhat.com> - 1.6.0-3
changelog:
  - Patch stats.c to fix overruns
  - Patch stats.c to fix leaks
  - Patch stats.c to fix fallback counter values
  - Resolves: #1993469


author: Čestmír Kalina <ckalina@redhat.com> - 1.8.1-1
changelog:
  - Upgrade smc-tools to latest version
  - Add User-defined EID (Enterprise ID) Support
  - Resolves: #1919228
  - Resolves: #2043841


author: Martin Gieseking <martin.gieseking@uos.de> - 1.1.4-2
changelog:
  - Rebuilt with https://github.com/google/snappy/archive/1.1.4.tar.gz since
    %{source0} contains different and buggy code.
    https://groups.google.com/forum/#!topic/snappy-compression/uhELq553TrI


author: Bhupesh Sharma <bhsharma@redhat.com> - 1.1.8-1
changelog:
  - Rebase to latest github version Snappy-1.1.8
  - Also change the URL to reflect to the updated github location.


author: Pavel Moravec <pmoravec@redhat.com> = 3.8-2
changelog:
  - [plugins] improve heuristic for applying --since
    Resolves: bz1789049
  - [Predicate] Override __bool__ to allow py3 evaluation
    Resolves: bz1789018
  - [ceph] Add 'ceph insights' command output
    Resolves: bz1783034
  - [dnf] Collect dnf module list
    Resolves: bz1781819
  - [kernel,networking] collect bpftool net list for each
    Resolves: bz1768956
  - [libreswan] New plugin for "libreswan" IPsec
    Resolves: bz1741330
  - [kernel] collect "bpftool net list"
    Resolves: bz1721779
  - [grub2] call grub2-config with --no-grubenv-update
    Resolves: bz1709682


author: Pavel Moravec <pmoravec@redhat.com> = 3.9.1-2
changelog:
  - Rebase on upstream 3.9
    Resolves: bz1826656
  - [redhat] fix RH containers without sysroot Attempting to run
    Resolves: bz1825283
  - [containers_common] Add plugin for common containers configs
    Resolves: bz1823488
  - [rabbitmq] Call containerised rabbitmqctl report on
    Resolves: bz1819662
  - [insights] collect insights-client dump
    Resolves: bz1814867
  - [nvmetcli] Add new plugin for NVMe Target CLI
    Resolves: bz1785546
  - [containers_common] collect rootless containers info
    Resolves: bz1776549
  - [networking] collect iptables when proper kernel modules
    Resolves: bz1633006
  - [navicli] replace interactive prompt by plugin option
    Resolves: bz1457191
  - [xdp] Add XDP plugin
    Resolves: bz1838123


author: Pavel Moravec <pmoravec@redhat.com> = 3.9.1-4
changelog:
  - [gluster] fix gluster volume splitlines iteration
    Resolves: bz1843562
  - [nfs] merge nfsserver plugin into nfs one
    Resolves: bz1844853
  - [pacemaker] Fix scrubbing when password contains an equa
    Resolves: bz1845386
  - [powerpc] Add support to collect component logs
    Resolves: bz1843754


author: Pavel Moravec <pmoravec@redhat.com> = 3.9.1-5
changelog:
  - [logs] collect also non-persistent journal logs
    Resolves: bz1850926
  - [block] Fix typo in LUKS detection
    Resolves: bz1850554
  - [powerpc] Fix enablement triggers
    Resolves: bz1851923
  - [pci] Update gating for lspci commands
    Resolves: bz1853700
  - [containers_common] collect user-related commands outputs
    Resolves: bz1776549
  - [gluster] remove only dump files + generated state files
    Resolves: bz1857590
  - [kubernetes] ignore blank+empty lines in "kubectl get nodes"
    Resolves: bz1859888


author: Pavel Moravec <pmoravec@redhat.com> = 4.0-3
changelog:
  - [ovirt] collect /etc/pki/ovirt-engine/.truststore
    Resolves: bz1848095
  - [collector] allow overriding plain --cluster-type
    Resolves: bz1895316
  - [component] Add log verbosity from presets
    Resolves: bz1904045
  - [options] Fix --log-size=0 being ignored and unreported
    Resolves: bz1905657
  - [report] collect broken symlinks
    Resolves: bz1906598


author: Pavel Moravec <pmoravec@redhat.com> = 4.0-5
changelog:
  - [component] honour plugopts from config file
    Resolves: bz1912889
  - [collector] declare sysroot for each component
    Resolves: bz1912821
  - [plugins] Dont stop collecting by empty specfile when sizelimit=0
    Resolves: bz1912910


author: Pavel Moravec <pmoravec@redhat.com> = 4.0-7
changelog:
  - [kdump] Gather the file kexec-dmesg.log
    Resolves: bz1887402
  - [Policy] Handle additional FTP authentication issues
    Resolves: bz1916729


author: Pavel Moravec <pmoravec@redhat.com> = 4.1-4
changelog:
  - [options] allow variant option names in config file
    Resolves: bz1923938
  - [plugins] Set default predicate instead of None
    Resolves: bz1985986
  - [MigrationResults] collect info about conversions
    Resolves: bz1959598


author: Pavel Moravec <pmoravec@redhat.com> = 4.1-5
changelog:
  - [report,collect] unify --map-file arguments
    Resolves: bz1923938
  - [rhui] add new plugin for RHUI 4
    Resolves: bz1665947
  - [username parser] Load usernames from `last` for LDAP users
    Resolves: bz1985037


author: Alex Baranowski <alex@euro-linux.com> - 4.1-9
changelog:
  - Pull from upstrea:
    -> [redhat] Fix broken URI to upload to customer portal
      Resolves: bz2011349
    -> [Red Hat] Update policy to use SFTP, update RHST API to v2
      Resolves: bz2011349


author: Pavel Moravec <pmoravec@redhat.com> = 4.2-5
changelog:
  - [clean,hostname_parser] Source /etc/hosts for obfuscation
    Resolves: bz2023867
  - [clean, hostname] Fix unintentionally case sensitive
    Resolves: bz2023863
  - [redhat] update SFTP API version to v2
    Resolves: bz2025610


author: Pavel Moravec <pmoravec@redhat.com> = 4.2-8
changelog:
  - [rhui] New log folder
    Resolves: bz2030741
  - nvidia]:Patch to update nvidia plugin for GPU info
    Resolves: bz2025403
  - [hostname] Fix edge case for new hosts in a known subdomain
    Resolves: bz2023867


author: Pavel Moravec <pmoravec@redhat.com> = 4.2-9
changelog:
  - add oc transport, backport various PRs for OCP
    Resolves: bz2036697
  - [report] Provide better warning about estimate-mode
    Resolves: bz1873185
  - [hostname] Fix loading and detection of long base domains
    Resolves: bz2023867


author: Pavel Moravec <pmoravec@redhat.com> = 4.2-12
changelog:
  - [foreman] Use psql-msgpack-decode wrapper for dynflow >= 1.6
    Resolves: bz2043102
  - [virsh] Call virsh commands in the foreground / with a TTY
    Resolves: bz2041488
  - [ovn_central] Account for Red Hat ovn package naming
    Resolves: bz2042966
  - [clean,parsers] Build regex lists for static items only once
    Resolves: bz2036697


author: Pavel Moravec <pmoravec@redhat.com> = 4.2-15
changelog:
  - [sosnode] Handle downstream versioning for runtime option
    Resolves: bz2036697
  - [options] Fix logging on plugopts in effective sos command
    Resolves: bz2054882
  - [report] Honor plugins' hardcoded plugin_timeout
    Resolves: bz2055547
  - [policies] Set fallback to None sysroot, don't chroot to '/'
    Resolves: bz1873185
  - [ovn_central] Rename container responsable of Red Hat
    Resolves: bz2042966


author: Jan Jansky <jjansky@redhat.com> = 4.2-16
changelog:
  - OCP backport
    Resolves: bz2071824
  - [pacemaker] Update collect cluster profile for pacemaker
    Resolves: bz2071695
  - [Plugin] oom excessive memory usage
    Resolves: bz2071825


author: Jan Jansky <jjansky@redhat.com> = 4.2-20
changelog:
  - [ovirt] obfuscate answer file
    Resolves: bz2098639
  - [crio] from output to json
    Resolves: bz2098643


author: Jan Jansky <jjansky@redhat.com> = 4.2-21
changelog:
  - [vdsm] Set LVM option use_devicesfile=0
    Resolves: bz2121774
  - [Plugin] Make forbidden path checks more efficient
    Resolves: bz2125656


author: Jan Jansky <jjansky@redhat.com> = 4.2-22
changelog:
  - [vdsm] Set LVM option use_devicesfile=0
    Resolves: bz2121774
  - [Plugin] Make forbidden path checks more efficient
    Resolves: bz2125656
  - [convert2rhel] Add archived log collection
    Resolves: bz2129105


author: Pavel Moravec <pmoravec@redhat.com> = 4.3-1
changelog:
  - Rebase on upstream 4.3
    Resolves: bz2055002
  - [sapnw] Fix IndexError exception
    Resolves: bz1992938
  - [Plugin, utilities] Allow writing command output directly to disk
    Resolves: bz1726023
  - [Ceph] Add support for containerized Ceph setup
    Resolves: bz1882544
  - [unbound] Add new plugin for Unbound DNS resolver
    Resolves: bz2018228
  - [discovery] Add new discovery plugin
    Resolves: bz2018549
  - [vdsm] Exclude /var/lib/vdsm/storage/transient_disks
    Resolves: bz2029154


author: Pavel Moravec <pmoravec@redhat.com> = 4.3-2
changelog:
  - [ovirt] answer files: Filter out all password keys
    Resolves: bz2095263
  - [plugins] Allow 'str' PlugOpt type to accept any value
    Resolves: bz2079485
  - [tigervnc] Update collections for newer versions of TigerVNC
    Resolves: bz2062908
  - [pacemaker] Redesign node enumeration logic
    Resolves: bz2065805
  - crio: switch from parsing output in table format to json
    Resolves: bz2092969
  - [report] Honor plugins' hardcoded plugin_timeout
    Resolves: bz2079187
  - [report] --list-plugins should report used, not default,
    Resolves: bz2079484
  - [utilities] Close file only when storing to file
    Resolves: bz2079486
  - [presets] Adjust OCP preset options, more OCP backports
    Resolves: bz2058279


author: Pavel Moravec <pmoravec@redhat.com> = 4.3-3
changelog:
  - [vdsm] Set LVM option use_devicesfile=0
    Resolves: bz2093993
  - [Plugin] Make forbidden path checks more efficient
    Resolves: bz2099598


author: Pavel Moravec <pmoravec@redhat.com> = 4.3-5
changelog:
  - [ovn_central] Rename container responsable of Red Hat
    Resolves: bz2042966
  - [PATCH] [host] Skip entire /etc/sos/cleaner directory
    Resolves: bz2023867


author: Pavel Moravec <pmoravec@redhat.com> = 4.4-1
changelog:
  - Rebase on upstream 4.4
    Resolves: bz2082614
  - [redhat] Honour credential-less --upload-url on RedHat distro properly
    Resolves: bz2059572
  - [sos] Fix unhandled exception when concurrently removing temp dir
    Resolves: bz2088439
  - [specfile] drop python3-libxml2 dependency
    Resolves: bz2125486
  - [md] Restrict data capture to raid members
    Resolves: bz2125485
  - [cleaner] Use compiled regex lists for parsers by default
    Resolves: bz2043233
  - [cgroups] not collect memory.kmem.slabinfo
    Resolves: bz1995120
  - [report] Fix loop devices data gathering
    Resolves: bz2010735
  - [insights] Collect /var/lib/insights
    Resolves: bz2103233
  - [candlepin] collect information about SCA
    Resolves: bz2060925
  - [manpages] Clarify --upload-directory applicable to FTP protocol only
    Resolves: bz2063259
  - [cleaner] Dont obfuscate tmpdir path of local private_map
    Resolves: bz2064815
  - [fibrechannel] collect Cisco fnic statistics
    Resolves: bz2074715
  - [pulpcore] Collect db_tables_sizes
    Resolves: bz2081433
  - [fibrechannel]: Update fibrechannel plugin to collect HBA logs
    Resolves: bz2089591
  - [arcconf]: Update arcconf plugin to collect UART logs
    Resolves: bz2090283
  - [pulpcore] Stop collecting commands relevant to old taskig system
    Resolves: bz2093191
  - [dnf,yum] Merge plugins into dnf, remove yum plugin
    Resolves: bz2100154
  - [policies] Simplify flow in _container_init()
    Resolves: bz2100480
  - [pacemaker] Update collect cluster profile for pacemaker
    Resolves: bz2065821


author: Pavel Moravec <pmoravec@redhat.com> = 4.4-2
changelog:
  - [utilities] Relax from hard dependency of python3-magic
    Resolves: bz2129038
  - [dnf] Collect legacy yum config symlinks, properly obfuscate pwds
    Resolves: bz2100154


author: Pavel Moravec <pmoravec@redhat.com> = 4.5.1-3
changelog:
  - Rebase on upstream 4.5.1
    Resolves: bz2175806
  - [composer] Capure /etc/osbuild-composer file
    Resolves: bz2169776
  - [ostree] Collect "ostree fsck" under plugin specific opt
    Resolves: bz2161533
  - [iprconfig] guard whole plugin by sg kmod predicate
    Resolves: bz2176086
  - [cleaner] dont clean sys_tmp from final_path
    Resolves: bz2176218


author: Abhi Das <adas@redhat.com> - 4.3-19
changelog:
  - rhbz#1602698 - Fix coverity issues
    rhbz#1624173 - Fix annocheck failures
    rhbz#1716278 - limit max cpus in mksquashfs
    Resolves: rhbz#1602698, rhbz#1624173, rhbz#1716278


author: Abhi Das <adas@redhat.com> - 4.3-20
changelog:
  - rhbz#1895017 - unsquashfs does not preserve file capabilities
    rhbz#1754815 - Kdump: Building kdump initramfs img may fail with 'dracut: Failed making squash image' occasionally
    Resolves: rhbz#1895017, rhbz#1754815


author: Alexey Tikhonov <atikhono@redhat.com> - 2.2.3-19
changelog:
  - Resolves: rhbz#1580506 - [RFE]: sssd to be able to read smartcard
                             certificate EKU and perform an action based
                             on value when generating SSH key from a certificate
                             (additional patch)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-1
changelog:
  - Resolves: rhbz#1839037 - Rebase SSSD for RHEL 8.3
  - Resolves: rhbz#1843872 - sssd 2.3.0 breaks AD auth due to GPO parsing failure
  - Resolves: rhbz#1834156 - sssd or sssd-ad not updating their dependencies on "yum update" which breaks working


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-2
changelog:
  - Resolves: rhbz#Bug 1723273 - RFE: Add option to specify alternate sssd config file location with "sssctl config-check" command.


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-3
changelog:
  - Resolves: rhbz#1829470 - `sssd.api.conf` and `sssd.api.d` should belong to `python-sssdconfig` package
  - Resolves: rhbz#1544457 - sssd fails to release file descriptor on child logs after receiving HUP
  - Resolves: rhbz#1824323 - SSSD user filtering is failing on RHEL 8 after "files" provider rebuilds cache
  - Resolves: rhbz#1827432 - When the passwd or group files are replaced, sssd stops monitoring the file for
                             inotify events, and no updates are triggered
  - Resolves: rhbz#1835710 - Change the message "Please enter smart card" to "Please insert smart card"
                             on GDM login with smart-card
  - Resolves: rhbz#1838037 - Oddjob-mkhomedir fails when using NSS compat
  - Resolves: rhbz#1845904 - gdm smart card authentication does not work shortly after disconnecting from network.
  - Resolves: rhbz#1845975 - sssd doesn't follow the link order of AD Group Policy Management
  - Resolves: rhbz#1845980 - sssd is failing to discover other subdomains in the forest
                             if LDAP entries do not contain AD forest root information
  - Resolves: rhbz#1845987 - Document how to prevent invalid selinux context for default home directories
                             in SSSD-AD direct integration.
  - Resolves: rhbz#1845994 - GDM failure loop when no user mapped for smart card
  - Resolves: rhbz#1846003 - GDM password prompt when cert mapped to multiple users and promptusername is False
  - Resolves: rhbz#1850961 - /usr/share/systemtap/tapset/sssd_functions.stp missing a comma


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-4
changelog:
  - Resolves: rhbz#1815584 - id_provider = proxy proxy_lib_name = files returns * in password field, breaking PAM authentication
  - Resolves: rhbz#1794607 - SSSD must be able to resolve membership involving root with files provider
  - Resolves: rhbz#1803134 - Improve "unlock" time when user session already active


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-5
changelog:
  - Resolves: rhbz#1821719 - sssd (sssd_be) is consuming 100% CPU, partially due to failing mem-cache
  - Fixed "requires/provides" rpmdiff warning


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-7
changelog:
  - Resolves: rhbz#1723273 - RFE: Add option to specify alternate sssd config file location with "sssctl config-check" command.
  - Resolves: rhbz#1780404 - smartcards: special characters must be escaped when building search filter


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-8
changelog:
  - Resolves: rhbz#1868387 - system not enforcing GPO rule restriction. ad_gpo_implicit_deny = True is not working
  - Resolves: rhbz#1854951 - sss-certmap man page change to add clarification for userPrincipalName attribute from AD schema
  - Resolves: rhbz#1856861 - False errors/warnings are logged in sssd.log file after enabling 2FA prompting settings in sssd.conf
  - Resolves: rhbz#1869683 - p11_child: default value of ocsp_dgst == sha256 doesn't conform RFC5019 and has to be changed to sha1


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-9
changelog:
  - Resolves: rhbz#1855323 - When ad_gpo_implicit_deny is True, it is permitting users to login when no gpo is applied


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-1
changelog:
  - Resolves: rhbz#1881992 - Rebase SSSD for RHEL 8.4
  - Resolves: rhbz#1722842 - sssd-kcm does not store TGT with ssh login using GSSAPI
  - Resolves: rhbz#1734040 - sssd crash in ad_get_account_domain_search()
  - Resolves: rhbz#1784459 - [RFE] tlog does not allow to exclude some users from session recording
  - Resolves: rhbz#1791300 - sporadic sssd_be crash on s390x
  - Resolves: rhbz#1817122 - 'getent group ldapgroupname' doesn't show any LDAP users or some LDAP users when 'rfc2307bis' schema is used with SSSD.
  - Resolves: rhbz#1819012 - [RFE] Improve AD site discovery process
  - Resolves: rhbz#1846778 - [RfE] `/usr/libexec/sssd/p11_child` cmdline argument '--nssdb' might be confusing when SSSD was built against OpenSSL
  - Resolves: rhbz#1873715 - automount sssd issue when 2 automount maps have the same key (one un uppercase, one in lowercase)
  - Resolves: rhbz#1879860 - correction in sssd.conf:pam_response_filter man page
  - Resolves: rhbz#1881336 - [RFE] sssd-ldap man page modification for parameter "ldap_referrals"
  - Resolves: rhbz#1883488 - [RfE] Implement a new sssd.conf option to disable the filter for AD domain local groups from trusted domains
  - Resolves: rhbz#1884196 - [RFE] Add "enabled" option to domain section in config file
  - Resolves: rhbz#1884205 - KCM: Increase client idle timeout to 5 minutes
  - Resolves: rhbz#1884207 - [RFE] ldap: add new option ldap_library_debug_level
  - Resolves: rhbz#1884213 - [RFE] add offline_timeout_max config option to control offline interval backoff
  - Resolves: rhbz#1884281 - Secondary LDAP group go missing from 'id' command
  - Resolves: rhbz#1884301 - [RFE] dyndns: suport asymmetric auth for nsupdate


author: Eugene Syromiatnikov <esyr@redhat.com> - 5.13-1
changelog:
  - Rebase to v5.13; drop upstream patches on top of 5.7 (#2015917).
  - Address some issues reported by covscan.


author: Eugene Syromiatnikov <esyr@redhat.com> - 5.18-2
changelog:
  - Fix the issues reported by covscan (#2103068).
  - Fix SELinux context matching for the deleted paths (#2087693).
  - Fix sloppy FD usage in the bpf test (#2103137).


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.24-6
changelog:
  - Pull upstream fix for ioctl evdev bitset decoding, fix the tests (#1747214).
  - Include commit v4.26~65 "s390x: beautify sthyi data tail prints" (#1747514).
  - Include upstream patches that fix issues reported by covscan (#1747526):
    91281fec "v4l2: avoid shifting left a signed number by 31 bit",
    522ad3a0 "syscall.c: avoid infinite loop in subcalls parsing",
    9446038e "kvm: avoid bogus vcpu_info assignment in vcpu_register", and
    2b64854e "xlat: use unsgined type for mount_flags fallback values".


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.24-7
changelog:
  - Fix printing stack traces for early syscalls on process attach (#1790053):
    69b2c33a "unwind-libdw: fix initialization of libdwfl cache" and
    8e515c74 "tests: add strace-k-p test".
  - Properly decode struct sockaddr_hci without hci_channel field.
  - Update tests-m32/ioctl_evdev.c and tests-mx32/ioctl_evdev.c
    in 0002-evdev-fix-decoding-of-EVIOCGBIT-0.patch.
  - Update tests-m32/Makefile.in and tests-mx32/Makefile.in
    in 0032-tests-check-decoding-of-successful-evdev-ioctl.patch.


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.24-8
changelog:
  - Fix expected alignment for IPC tests (#1795251):
    4377e3a1 "tests: fix expected output for some ipc tests", and
    a75c7c4b "tests: fix -a argument in ipc_msgbuf-Xraw test".
  - Update tests-m32/looping_threads.test and tests-mx32/looping_threads.test
    in 0025-tests-check-tracing-of-looping-threads.patch.
  - Update the bpf syscall decoder:
    d6c71dd0 "Fix preprocessor indentation",
    cabd6955 "bpf: print struct bpf_prog_info.gpl_compatible",
    14a9b6ca "bpf: add support for btf_* fields in BPF_MAP_CREATE",
    27bd13d3 "bpf: add support for btf_* fields in struct bpf_map_info",
    d1f90bcd "bpf: add support for *jited_ksyms and *jited_func_lens fields
             in struct bpf_prog_info", and
    940fe50f "bpf: add support for new twelve fields in struct bpf_prog_info".
    c661605b "tests: robustify bpf-obj_get_info_by_fd test against future kernels"


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.24-9
changelog:
  - Fix the "extra tokens at end of #ifdef directive" warning:
    579f2702 "bpf: exclude bit fields from the check".


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.24-4
changelog:
  - Sync up thread handling unfairness fix with the upstream version.
  - Fix "xlat_idx: Unexpected xlat value 0 at index ..." messages (#1660759).
  - Remove "ptrace(SYSCALL): No such process" messages (#1662936).
  - Wire up rseq and kexec_file_load on aarch64 (#1676045).


author: Sahana Prasad <sahana@redhat.com> - 5.56-5
changelog:
  - Fix CVE-2021-20230 stunnel: client certificate not
    correctly verified when redirect and verifyChain options are used.


author: Radovan Sroka <rsroka@redhat.com> - 1.8.25-6
changelog:
  - RHEL 8.1 ERRATUM
  - Fixed The LDAP backend which is not properly parsing sudoOptions,
    resulting in selinux roles not being applied
  Resolves: rhbz#1738326


author: Radovan Sroka <rsroka@redhat.com> - 1.8.28p1-1
changelog:
  - RHEL 8.2 ERRATUM
  - rebase to 1.8.28p1
  Resolves: rhbz#1733961
  - fixed man page for always_set_home
  Resolves: rhbz#1576880
  - sudo does not work with notbefore/after
  Resolves: rhbz#1679508
  - NOTBEFORE showing value of sudoNotAfter Ldap attribute
  Resolves: rhbz#1715516
  - CVE-2019-14287 sudo
  - Privilege escalation via 'Runas' specification with 'ALL' keyword
  Resolves: rhbz#1760697


author: Radovan Sroka <rsroka@redhat.com> - 1.8.29-7
changelog:
  - RHEL 8.4 ERRATUM
  - CVE-2021-3156
  Resolves: rhbz#1917734
  - CVE-2021-23239 sudo: possible directory existence test due to race condition in sudoedit
  Resolves: rhzb#1916434
  - CVE-2021-23240 sudo: symbolic link attack in SELinux-enabled sudoedit
  Resolves: rhbz#1917038
  - updated upstream url
  Resolves: rhbz#1923825


author: Radovan Sroka <rsroka@redhat.com> - 1.8.29-8
changelog:
  RHEL 8.6.0 ERRATUM
  - sudoedit does not work with selinux args
  Resolves: rhbz#2029551
  - Make sure SIGCHLD is not ignored when sudo is executed
  Resolves: rhbz#1999751
  - [RFE] pass KRB5CCNAME to pam_authenticate environment if available
  Resolves: rhbz#1917379
  - utmp resource leak in sudo
  Resolves: rhbz#1986572


author: Radovan Sroka <rsroka@redhat.com> - 1.8.29.9
changelog:
  RHEL 8.8.0 ERRATUM
  - CVE-2023-22809 sudo: arbitrary file write with privileges of the RunAs user
  Resolves: rhbz#2161221
  - sudo digest check fails incorrectly for certain file sizes (SHA512/SHA384)
  Resolves: rhbz#2114576


author: Radovan Sroka <rsroka@redhat.com> - 1.8.25-5
changelog:
  - RHEL 8.1 ERRATUM
  - Fixed problem with sudo-1.8.23 and 'who am i'
  Resolves: rhbz#1673886
  - Backporting sudo bug with expired passwords
  Resolves: rhbz#1676819


author: RAdovan Sroka <rsroka@redhat.com> - 1.8.29-7.1
changelog:
  RHEL 8.4.0 ZSTREAM ERRATUM
  - Make sure SIGCHLD is not ignored when sudo is executed
  Resolves: rhbz#2015136


author: Radovan Sroka <rsroka@redhat.com> - 1.8.29.8.1
changelog:
  RHEL 8.7.0.Z ERRATUM
  - CVE-2023-22809 sudo: arbitrary file write with privileges of the RunAs user
  Resolves: rhbz#2161220


author: Robert Scheck <robert@fedoraproject.org> - 6.04-0.3
changelog:
  - Own %{_datadir}/syslinux/diag directory (#894529)
  - Allow rebuilding on RHEL/CentOS 6 and 7 (#1291428)


author: Jan Tulak <jtulak@redhat.com> - 1.2-1
changelog:
  - Upstream release 1.2 which fixes:
  - use pwquality to test password strength for cryptsetup (#1141871)
  - add multipath detection support (#1309729)
  - add migrate command (#1014708)


author: Jan Tulak <jtulak@redhat.com> - 1.2-3:
changelog:
  - Gating tests implementation, which meant adding few more changes
    to the existing patches (#1681969)
  - sphinx patch was merged to python3 change
  - add seq numbers to patch files


author: Jan Tulak <jtulak@redhat.com> - 1.4-1:
changelog:
  - Bring changes from upstream 1.4 (mostly bugfixes)
  - Remove multipath from the list of default backends (rhbz#1685019)
  - Fix locale issue (rhbz#1679587)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-39
changelog:
  - device: make sure we emit PropertiesChanged signal once we set sysfs (#1793533)
  - device: don't emit PropetiesChanged needlessly (#1793533)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-40
changelog:
  - units: add generic boot-complete.target (#1872243)
  - man: document new "boot-complete.target" unit (#1872243)
  - core: make sure to restore the control command id, too (#1829867)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-42
changelog:
  - logind: don't print warning when user@.service template is masked (#1880270)
  - build: use simple project version in pkgconfig files (#1862714)
  - basic/virt: try the /proc/1/sched hack also for PID1 (#1868877)
  - seccomp: rework how the S[UG]ID filter is installed (#1860374)
  - vconsole-setup: downgrade log message when setting font fails on dummy console (#1889996)
  - units: fix systemd.special man page reference in system-update-cleanup.service (#1871827)
  - units: drop reference to sushell man page (#1871827)
  - sd-bus: break the loop in bus_ensure_running() if the bus is not connecting (#1885553)
  - core: add new API for enqueing a job with returning the transaction data (#846319)
  - systemctl: replace switch statement by table of structures (#846319)
  - systemctl: reindent table (#846319)
  - systemctl: Only wait when there's something to wait for. (#846319)
  - systemctl: clean up start_unit_one() error handling (#846319)
  - systemctl: split out extra args generation into helper function of its own (#846319)
  - systemctl: add new --show-transaction switch (#846319)
  - test: add some basic testing that "systemctl start -T" does something (#846319)
  - man: document the new systemctl --show-transaction option (#846319)
  - socket: New option 'FlushPending' (boolean) to flush socket before entering listening state (#1870638)
  - core: remove support for API bus "started outside our own logic" (#1764282)
  - mount-setup: fix segfault in mount_cgroup_controllers when using gcc9 compiler (#1868877)
  - dbus-execute: make transfer of CPUAffinity endian safe (#12711) (#1740657)
  - core: add support for setting CPUAffinity= to special "numa" value (#1740657)
  - basic/user-util: always use base 10 for user/group numbers (#1848373)
  - parse-util: sometimes it is useful to check if a string is a valid integer, but not actually parse it (#1848373)
  - basic/parse-util: add safe_atoux64() (#1848373)
  - parse-util: allow tweaking how to parse integers (#1848373)
  - parse-util: allow '-0' as alternative to '0' and '+0' (#1848373)
  - parse-util: make return parameter optional in safe_atou16_full() (#1848373)
  - parse-util: rewrite parse_mode() on top of safe_atou_full() (#1848373)
  - user-util: be stricter in parse_uid() (#1848373)
  - strv: add new macro STARTSWITH_SET() (#1848373)
  - parse-util: also parse integers prefixed with 0b and 0o (#1848373)
  - tests: beef up integer parsing tests (#1848373)
  - shared/user-util: add compat forms of user name checking functions (#1848373)
  - shared/user-util: emit a warning on names with dots (#1848373)
  - user-util: Allow names starting with a digit (#1848373)
  - shared/user-util: allow usernames with dots in specific fields (#1848373)
  - user-util: switch order of checks in valid_user_group_name_or_id_full() (#1848373)
  - user-util: rework how we validate user names (#1848373)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-43
changelog:
  - man: mention System Administrator's Guide in systemctl manpage (#1623116)
  - udev: introduce udev net_id "naming schemes" (#1827462)
  - meson: make net.naming-scheme= default configurable (#1827462)
  - man: describe naming schemes in a new man page (#1827462)
  - udev/net_id: parse _SUN ACPI index as a signed integer (#1827462)
  - udev/net_id: don't generate slot based names if multiple devices might claim the same slot (#1827462)
  - fix typo in ProtectSystem= option (#1871139)
  - remove references of non-existent man pages (#1876807)
  - log: Prefer logging to CLI unless JOURNAL_STREAM is set (#1865840)
  - locale-util: add new helper locale_is_installed() (#1755287)
  - test: add test case for locale_is_installed() (#1755287)
  - tree-wide: port various bits over to locale_is_installed() (#1755287)
  - install: allow instantiated units to be enabled via presets (#1812972)
  - install: small refactor to combine two function calls into one function (#1812972)
  - test: fix a memleak (#1812972)
  - docs: Add syntax for templated units to systemd.preset man page (#1812972)
  - shared/install: fix preset operations for non-service instantiated units (#1812972)
  - introduce setsockopt_int() helper (#1887181)
  - socket-util: add generic socket_pass_pktinfo() helper (#1887181)
  - core: add new PassPacketInfo= socket unit property (#1887181)
  - resolved: tweak cmsg calculation (#1887181)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-44
changelog:
  - ci: PowerTools repo was renamed to powertools in RHEL 8.3 (#1871827)
  - ci: use quay.io instead of Docker Hub to avoid rate limits (#1871827)
  - ci: move jobs from Travis CI to GH Actions (#1871827)
  - unit: make UNIT() cast function deal with NULL pointers (#1871827)
  - use link to RHEL-8 docs (#1623116)
  - cgroup: Also set blkio.bfq.weight (#1657810)
  - units: make sure initrd-cleanup.service terminates before switching to rootfs (#1657810)
  - core: reload SELinux label cache on daemon-reload (#1888912)
  - selinux: introduce mac_selinux_create_file_prepare_at() (#1888912)
  - selinux: add trigger for policy reload to refresh internal selabel cache (#1888912)
  - udev/net_id: give RHEL-8.4 naming scheme a name (#1827462)
  - basic/stat-util: make mtime check stricter and use entire timestamp (#1642728)
  - udev: make algorithm that selects highest priority devlink less susceptible to race conditions (#1642728)
  - test: create /dev/null in test-udev.pl (#1642728)
  - test: missing "die" (#1642728)
  - udev-test: remove a check for whether the test is run in a container (#1642728)
  - udev-test: skip the test only if it can't setup its environment (#1642728)
  - udev-test: fix test skip condition (#1642728)
  - udev-test: fix missing directory test/run (#1642728)
  - udev-test: check if permitted to create block device nodes (#1642728)
  - test-udev: add a testcase of too long line (#1642728)
  - test-udev: use proper semantics for too long line with continuation (#1642728)
  - test-udev: add more tests for line continuations and comments (#1642728)
  - test-udev: add more tests for line continuation (#1642728)
  - test-udev: fix alignment and drop unnecessary white spaces (#1642728)
  - test/udev-test.pl: cleanup if skipping test (#1642728)
  - test: add test cases for empty string match (#1642728)
  - test: add test case for multi matches when use "||" (#1642728)
  - udev-test: do not rely on "mail" group being defined (#1642728)
  - test/udev-test.pl: allow multiple devices per test (#1642728)
  - test/udev-test.pl: create rules only once (#1642728)
  - test/udev-test.pl: allow concurrent additions and removals (#1642728)
  - test/udev-test.pl: use computed devnode name (#1642728)
  - test/udev-test.pl: test correctness of symlink targets (#1642728)
  - test/udev-test.pl: allow checking multiple symlinks (#1642728)
  - test/udev-test.pl: fix wrong test descriptions (#1642728)
  - test/udev-test.pl: last_rule is unsupported (#1642728)
  - test/udev-test.pl: Make some tests a little harder (#1642728)
  - test/udev-test.pl: remove bogus rules from magic subsys test (#1642728)
  - test/udev-test.pl: merge "space and var with space" tests (#1642728)
  - test/udev-test.pl: merge import parent tests into one (#1642728)
  - test/udev-test.pl: count "good" results (#1642728)
  - tests/udev-test.pl: add multiple device test (#1642728)
  - test/udev-test.pl: add repeat count (#1642728)
  - test/udev-test.pl: generator for large list of block devices (#1642728)
  - test/udev-test.pl: suppress umount error message at startup (#1642728)
  - test/udev_test.pl: add "expected good" count (#1642728)
  - test/udev-test: gracefully exit when imports fail (#1642728)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-45
changelog:
  - Revert "test: add test cases for empty string match" and "test: add test case for multi matches when use ||" (#1931947)
  - test/sys-script.py: add missing DEVNAME entries to uevents (#1931947)
  - sd-event: split out helper functions for reshuffling prioqs (#1819868)
  - sd-event: split out enable and disable codepaths from sd_event_source_set_enabled() (#1819868)
  - sd-event: mention that two debug logged events are ignored (#1819868)
  - sd-event: split clock data allocation out of sd_event_add_time() (#1819868)
  - sd-event: split out code to add/remove timer event sources to earliest/latest prioq (#1819868)
  - sd-event: fix delays assert brain-o (#17790) (#1819868)
  - sd-event: let's suffix last_run/last_log with "_usec" (#1819868)
  - sd-event: refuse running default event loops in any other thread than the one they are default for (#1819868)
  - sd-event: ref event loop while in sd_event_prepare() ot sd_event_run() (#1819868)
  - sd-event: follow coding style with naming return parameter (#1819868)
  - sd-event: remove earliest_index/latest_index into common part of event source objects (#1819868)
  - sd-event: update state at the end in event_source_enable (#1819868)
  - sd-event: increase n_enabled_child_sources just once (#1819868)
  - sd-event: add ability to ratelimit event sources (#1819868)
  - test: add ratelimiting test (#1819868)
  - core: prevent excessive /proc/self/mountinfo parsing (#1819868)
  - udev: run link_update() with increased retry count in second invocation (#1931947)
  - pam-systemd: use secure_getenv() rather than getenv() (#1687514)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-45.1
changelog:
  - Revert "udev: run link_update() with increased retry count in second invocation" (#1963980)
  - Revert "udev: make algorithm that selects highest priority devlink less susceptible to race conditions" (#1963980)
  - test/udev-test.pl: drop test cases that add mutliple devices (#1963980)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-45.3
changelog:
  - sd-event: change ordering of pending/ratelimited events (#1984406)
  - sd-event: drop unnecessary "else" (#1984406)
  - sd-event: use CMP() macro (#1984406)
  - sd-event: use usec_add() (#1984406)
  - sd-event: make event_source_time_prioq_reshuffle() accept all event source type (#1984406)
  - sd-event: always reshuffle time prioq on changing online/offline state (#1984406)
  - meson: remove strange dep that causes meson to enter infinite loop (#1984406)
  - copy: handle copy_file_range() weirdness on procfs/sysfs (#1984406)
  - ci: run unit tests on z-stream branches as well (#1984406)
  - remove a left-over break (#1984406)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-45
changelog:
  - Revert "test: add test cases for empty string match" and "test: add test case for multi matches when use ||" (#1935124)
  - test/sys-script.py: add missing DEVNAME entries to uevents (#1935124)
  - sd-event: split out helper functions for reshuffling prioqs (#1937315)
  - sd-event: split out enable and disable codepaths from sd_event_source_set_enabled() (#1937315)
  - sd-event: mention that two debug logged events are ignored (#1937315)
  - sd-event: split clock data allocation out of sd_event_add_time() (#1937315)
  - sd-event: split out code to add/remove timer event sources to earliest/latest prioq (#1937315)
  - sd-event: fix delays assert brain-o (#17790) (#1937315)
  - sd-event: let's suffix last_run/last_log with "_usec" (#1937315)
  - sd-event: refuse running default event loops in any other thread than the one they are default for (#1937315)
  - sd-event: ref event loop while in sd_event_prepare() ot sd_event_run() (#1937315)
  - sd-event: follow coding style with naming return parameter (#1937315)
  - sd-event: remove earliest_index/latest_index into common part of event source objects (#1937315)
  - sd-event: update state at the end in event_source_enable (#1937315)
  - sd-event: increase n_enabled_child_sources just once (#1937315)
  - sd-event: add ability to ratelimit event sources (#1937315)
  - test: add ratelimiting test (#1937315)
  - core: prevent excessive /proc/self/mountinfo parsing (#1937315)
  - udev: run link_update() with increased retry count in second invocation (#1935124)
  - pam-systemd: use secure_getenv() rather than getenv() (#1936866)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-46
changelog:
  - Revert "udev: run link_update() with increased retry count in second invocation" (#1942299)
  - Revert "udev: make algorithm that selects highest priority devlink less susceptible to race conditions" (#1942299)
  - test/udev-test.pl: drop test cases that add mutliple devices (#1942299)


author: Jan Macku <jamacku@redhat.com> - 239-47
changelog:
  - systemd-binfmt: Add safeguard in triggers (#1787144)
  - spec: Requires(post) openssl-libs to fix missing /etc/machine-id (#1947438)
  - spec: Go back to using systemctl preset-all in post (#1783263, #1647172, #1118740)
  - spec: Disable libiptc support (#1817265)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-48
changelog:
  - cgroup: Also set io.bfq.weight (#1927290)
  - seccomp: allow turning off of seccomp filtering via env var (#1916835)
  - meson: remove strange dep that causes meson to enter infinite loop (#1970860)
  - copy: handle copy_file_range() weirdness on procfs/sysfs (#1970860)
  - core: Hide "Deactivated successfully" message (#1954802)
  - util: rework in_initrd() to make use of path_is_temporary_fs() (#1959339)
  - initrd: extend SYSTEMD_IN_INITRD to accept non-ramfs rootfs (#1959339)
  - initrd: do a debug log if failed to detect rootfs type (#1959339)
  - initrd: do a debug log if /etc/initrd-release doesn't take effect (#1959339)
  - units: assign user-runtime-dir@.service to user-%i.slice (#1946453)
  - units: order user-runtime-dir@.service after systemd-user-sessions.service (#1946453)
  - units: make sure user-runtime-dir@.service is Type=oneshot (#1946453)
  - user-runtime-dir: downgrade a few log messages to LOG_DEBUG that we ignore (#1946453)
  - shared/install: Preserve escape characters for escaped unit names (#1952686)
  - basic/virt: Detect PowerVM hypervisor (#1937989)
  - man: document differences in clean exit status for Type=oneshot (#1940078)
  - busctl: add a timestamp to the output of the busctl monitor command (#1909214)
  - basic/cap-list: parse/print numerical capabilities (#1946943)
  - shared/mount-util: convert to libmount (#1885143)
  - mount-util: bind_remount: avoid calling statvfs (#1885143)
  - mount-util: use UMOUNT_NOFOLLOW in recursive umounter (#1885143)
  - test-install-root: create referenced targets (#1835351)
  - install: warn if WantedBy targets don't exist (#1835351)
  - test-install-root: add test for unknown WantedBy= target (#1835351)
  - ceph is a network filesystem (#1952013)
  - sysctl: set kernel.core_pipe_limit=16 (#1949729)
  - core: don't drop timer expired but not yet processed when system date is changed (#1899402)
  - core: Detect initial timer state from serialized data (#1899402)
  - rc-local: order after network-online.target (#1934028)
  - set core ulimit to 0 like on RHEL-7 (#1905582)
  - test-mountpointutil-util: do not assert in test_mnt_id() (#1910425)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-49
changelog:
  - remove a left-over break (#1970860)
  - basic/unit-name: do not use strdupa() on a path (#1974700)
  - sd-event: change ordering of pending/ratelimited events (#1968528)
  - sd-event: drop unnecessary "else" (#1968528)
  - sd-event: use CMP() macro (#1968528)
  - sd-event: use usec_add() (#1968528)
  - sd-event: make event_source_time_prioq_reshuffle() accept all event source type (#1968528)
  - sd-event: always reshuffle time prioq on changing online/offline state (#1968528)
  - ci: run unit tests on z-stream branches as well (#1970860)
  - ci: drop forgotten Travis references (#1934504)
  - ci: run unit tests on CentOS 8 Stream as well (#1934504)
  - ci: add missing test dependencies (#1934504)
  - meson: bump timeout for test-udev to 180s (#1934504)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-50
changelog:
  - Added option --check-inhibitors for non-tty usage (#1269726)
  - logind: Introduce RebootWithFlags and others (#1269726)
  - logind: add …WithFlags methods to policy (#1269726)
  - logind: simplify flags handling a bit (#1269726)
  - Update link to RHEL documentation (#1982584)
  - Set default core ulimit to 0, but keep the hard limit ulimited (#1905582)
  - shared/seccomp-util: address family filtering is broken on ppc (#1982650)
  - logind: rework Seat/Session/User object allocation and freeing a bit (#1642460)
  - logind: fix serialization/deserialization of user's "display session" (#1642460)
  - logind: turn of stdio locking when writing session files too (#1642460)
  - units: set StopWhenUnneeded= for the user slice units too (#1642460)
  - units: improve Description= string a bit (#1642460)
  - logind: improve logging in manager_connect_console() (#1642460)
  - logind: save/restore User object's "stopping" field during restarts (#1642460)
  - logind: correct bad clean-up path (#1642460)
  - logind: fix bad error propagation (#1642460)
  - logind: never elect a session that is stopping as display (#1642460)
  - logind: introduce little helper that checks whether a session is ready (#1642460)
  - logind: propagate session stop errors (#1642460)
  - logind: rework how we manage the slice and user-runtime-dir@.service unit for each user (#1642460)
  - logind: optionally, keep the user@.service instance for eached logged in user around for a while (#1642460)
  - logind: add a RequiresMountsFor= dependency from the session scope unit to the home directory of the user (#1642460)
  - logind: improve error propagation of user_check_linger_file() (#1642460)
  - logind: automatically GC lingering users for who now user@.service (nor slice, not runtime dir service) is running anymore (#1642460)
  - pam_systemd: simplify code which with we set environment variables (#1642460)
  - logind: validate /run/user/1000 before we set it (#1642460)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-51
changelog:
  - define newly needed constants (#1850986)
  - sd-netlink: support IFLA_PROP_LIST and IFLA_ALT_IFNAME attributes (#1850986)
  - sd-netlink: introduce sd_netlink_message_read_strv() (#1850986)
  - sd-netlink: introduce sd_netlink_message_append_strv() (#1850986)
  - test: add a test for sd_netlink_message_{append,read}_strv() (#1850986)
  - util: introduce ifname_valid_full() (#1850986)
  - rename function (#1850986)
  - udev: support AlternativeName= setting in .link file (#1850986)
  - network: make Name= in [Match] support alternative names of interfaces (#1850986)
  - udev: extend the length of ID_NET_NAME_XXX= to ALTIFNAMSIZ (#1850986)
  - udev: do not fail if kernel does not support alternative names (#1850986)
  - udev: introduce AlternativeNamesPolicy= setting (#1850986)
  - network: set AlternativeNamesPolicy= in 99-default.link (#1850986)
  - random-util: call initialize_srand() after fork() (#1850986)
  - sd-netlink: introduce rtnl_resolve_link_alternative_names() (#1850986)
  - udev: sort alternative names (#1850986)
  - netlink: introduce rtnl_get/delete_link_alternative_names() (#1850986)
  - netlink: do not fail when new interface name is already used as an alternative name (#1850986)
  - udev: do not try to reassign alternative names (#1850986)
  - Fix LGTM build (#1850986)
  - sd-hwdb: allow empty properties (#1930568)
  - Update hwdb (#1930568)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-51.1
changelog:
  - sd-event: take ref on event loop object before dispatching event sources (#2024903)
  - pid1: fix free of uninitialized pointer in unit_fail_if_noncanonical() (#2024903)
  - Disable iptables for CI (#2024903)
  - test-seccomp: accept ENOSYS from sysctl(2) too (#2024903)
  - Disable libpitc to fix CentOS Stream CI (#2024903)
  - test: accept that char device 0/0 can now be created witout privileges (#2024903)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-51.3
changelog:
  - Do not fail if the same alt. name is set again (#2030027)
  - meson: avoid bogus meson warning (#2030027)
  - meson: do not fail if rsync is not installed with meson 0.57.2 (#2030027)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-51.4
changelog:
  - mount: don't propagate errors from mount_setup_unit() further up (#2039327)
  - test: make TEST-47 less racy (#2039327)
  - macro: define HAS_FEATURE_ADDRESS_SANITIZER also on gcc (#2039327)
  - tests: add helper function to autodetect CI environments (#2039327)
  - strv: rework FOREACH_STRING() macro (#2039327)
  - test,systemctl: use "const char*" instead of "char*" (#2039327)
  - ci: pass the $GITHUB_ACTIONS variable to the CentOS container (#2039327)
  - core: rename unit_{start_limit|condition|assert}_test() to unit_test_xyz() (#2037395)
  - core: Check unit start rate limiting earlier (#2037395)
  - sd-event: introduce callback invoked when event source ratelimit expires (#2037395)
  - core: rename/generalize UNIT(u)->test_start_limit() hook (#2037395)
  - mount: make mount units start jobs not runnable if /p/s/mountinfo ratelimit is in effect (#2037395)
  - mount: retrigger run queue after ratelimit expired to run delayed mount start jobs (#2037395)
  - pid1: add a manager_trigger_run_queue() helper (#2037395)
  - unit: add jobs that were skipped because of ratelimit back to run_queue (#2037395)
  - udev/net_id: introduce naming scheme for RHEL-8.5 (#2040244)
  - udev/net_id: remove extraneous bracket (#2040244)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-51.5
changelog:
  - mount: do not update exec deps on mountinfo changes (#2038878)
  - core/mount: add implicit unit dependencies even if when mount unit is generated from /proc/self/mountinfo (#2038878)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-53
changelog:
  - sd-hwdb: allow empty properties (#2005009)
  - Update hwdb (#2005009)
  - Disable libpitc to fix CentOS Stream CI (#2017033)
  - rpm: Fix typo in %_environmentdir (#2018024)
  - rpm: Add misspelled %_environmentdir macro for temporary compatibility (#2018024)
  - rpm: emit warning when macro with typo is used (#2018024)
  - Remove unintended additions to systemd-analyze man page (#2004765)
  - core: fix SIGABRT on empty exec command argv (#2020239)
  - core/service: also check path in exec commands (#2020239)
  - mount-util: fix fd_is_mount_point() when both the parent and directory are network fs (#2015057)
  - basic: add vmware hypervisor detection from device-tree (#1959150)
  - pam: do not require a non-expired password for user@.service (#1961746)
  - udev rules: add rule to create /dev/ptp_hyperv (#1991834)
  - process-util: explicitly handle processes lacking parents in get_process_ppid() (#1977569)
  - errno-util: add ERRNO_IS_PRIVILEGE() helper (#1977569)
  - procfs-util: fix confusion wrt. quantity limit and maximum value (#1977569)
  - test-process-util: also add EROFS to the list of "good" errors (#1977569)
  - journal: refresh cached credentials of stdout streams (#1931806)
  - util-lib: introduce HAS_FEATURE_ADDRESS_SANITIZER (#2017033)
  - ci: skip test-execute on GH Actions under ASan (#2017033)
  - test-seccomp: accept ENOSYS from sysctl(2) too (#2017033)
  - test: accept that char device 0/0 can now be created witout privileges (#2017033)
  - meson: do not fail if rsync is not installed with meson 0.57.2 (#2017033)
  - pid1: fix free of uninitialized pointer in unit_fail_if_noncanonical() (#1970945)
  - sd-event: take ref on event loop object before dispatching event sources (#1970945)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-54
changelog:
  - core: consider service with no start command immediately started (#1860899)
  - man: move description of *Action= modes to FailureAction=/SuccessAction= (#1860899)
  - core: define "exit" and "exit-force" actions for user units and only accept that (#1860899)
  - core: accept system mode emergency action specifiers with a warning (#1860899)
  - core: allow services with no commands but SuccessAction set (#1860899)
  - core: limit service-watchdogs=no to actual "watchdog" commands (#1860899)
  - units: use SuccessAction=exit-force in systemd-exit.service (#1860899)
  - units: use SuccessAction=reboot-force in systemd-reboot.service (#1860899)
  - units: use SuccessAction=poweroff-force in systemd-poweroff.service (#1860899)
  - units: allow and use SuccessAction=exit-force in system systemd-exit.service (#1860899)
  - core: do not "warn" about mundane emergency actions (#1860899)
  - core: return true from cg_is_empty* on ENOENT (#1860899)
  - macro: define HAS_FEATURE_ADDRESS_SANITIZER also on gcc (#2017033)
  - tests: add helper function to autodetect CI environments (#2017033)
  - strv: rework FOREACH_STRING() macro (#2017033)
  - test,systemctl: use "const char*" instead of "char*" (#2017033)
  - ci: pass the $GITHUB_ACTIONS variable to the CentOS container (#2017033)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-55
changelog:
  - lgtm: detect uninitialized variables using the __cleanup__ attribute (#2017033)
  - lgtm: replace the query used for looking for fgets with a more general query (#2017033)
  - lgtm: beef up list of dangerous/questionnable API calls not to make (#2017033)
  - lgtm: warn about strerror() use (#2017033)
  - lgtm: complain about accept() [people should use accept4() instead, due to O_CLOEXEC] (#2017033)
  - lgtm: don't treat the custom note as a list of tags (#2017033)
  - lgtm: ignore certain cleanup functions (#2017033)
  - lgtm: detect more possible problematic scenarios (#2017033)
  - lgtm: enable more (and potentially useful) queries (#2017033)
  - test: make TEST-47 less racy (#2017033)
  - core: rename unit_{start_limit|condition|assert}_test() to unit_test_xyz() (#2036608)
  - core: Check unit start rate limiting earlier (#2036608)
  - sd-event: introduce callback invoked when event source ratelimit expires (#2036608)
  - core: rename/generalize UNIT(u)->test_start_limit() hook (#2036608)
  - mount: make mount units start jobs not runnable if /p/s/mountinfo ratelimit is in effect (#2036608)
  - mount: retrigger run queue after ratelimit expired to run delayed mount start jobs (#2036608)
  - pid1: add a manager_trigger_run_queue() helper (#2036608)
  - unit: add jobs that were skipped because of ratelimit back to run_queue (#2036608)
  - Revert "Revert "sysctl: Enable ping(8) inside rootless Podman containers"" (#2037807)
  - sysctl: prefix ping port range setting with a dash (#2037807)
  - mount: don't propagate errors from mount_setup_unit() further up (#2036853)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-57
changelog:
  - udev/net_id: introduce naming scheme for RHEL-8.5 (#2039797)
  - udev/net_id: remove extraneous bracket (#2039797)
  - udev/net_id: introduce naming scheme for RHEL-8.6 (#2039797)
  - define newly needed constants (#2005008)
  - sd-netlink: support IFLA_PROP_LIST and IFLA_ALT_IFNAME attributes (#2005008)
  - sd-netlink: introduce sd_netlink_message_read_strv() (#2005008)
  - sd-netlink: introduce sd_netlink_message_append_strv() (#2005008)
  - test: add a test for sd_netlink_message_{append,read}_strv() (#2005008)
  - util: introduce ifname_valid_full() (#2005008)
  - rename function (#2005008)
  - udev: support AlternativeName= setting in .link file (#2005008)
  - network: make Name= in [Match] support alternative names of interfaces (#2005008)
  - udev: extend the length of ID_NET_NAME_XXX= to ALTIFNAMSIZ (#2005008)
  - udev: do not fail if kernel does not support alternative names (#2005008)
  - udev: introduce AlternativeNamesPolicy= setting (#2005008)
  - network: set AlternativeNamesPolicy= in 99-default.link (#2005008)
  - random-util: call initialize_srand() after fork() (#2005008)
  - sd-netlink: introduce rtnl_resolve_link_alternative_names() (#2005008)
  - udev: sort alternative names (#2005008)
  - netlink: introduce rtnl_get/delete_link_alternative_names() (#2005008)
  - netlink: do not fail when new interface name is already used as an alternative name (#2005008)
  - udev: do not try to reassign alternative names (#2005008)
  - Do not fail if the same alt. name is set again (#2005008)
  - mount: do not update exec deps on mountinfo changes (#2008825)
  - core/mount: add implicit unit dependencies even if when mount unit is generated from /proc/self/mountinfo (#2008825)
  - core: fix unfortunate typo in unit_is_unneeded() (#2040147)
  - core: make destructive transaction error a bit more useful (#2040147)
  - tmpfiles: use a entry in hashmap as ItemArray in read_config_file() (#1944468)
  - tmpfiles: rework condition check (#1944468)
  - TEST-22-TMPFILES: add reproducer for bug with X (#1944468)
  - core: make sure we don't get confused when setting TERM for a tty fd (#2045307)
  - hash-funcs: introduce macro to create typesafe hash_ops (#2037807)
  - hash-func: add destructors for key and value (#2037807)
  - util: define free_func_t (#2037807)
  - hash-funcs: make basic hash_ops typesafe (#2037807)
  - test: add tests for destructors of hashmap or set (#2037807)
  - man: document the new sysctl.d/ - prefix (#2037807)
  - sysctl: if options are prefixed with "-" ignore write errors (#2037807)
  - sysctl: fix segfault (#2037807)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-58
changelog:
  - ci: drop CentOS 8 CI (#2017033)
  - test: adapt to the new capsh format (#2017033)
  - test: ignore IAB capabilities in `test-execute` (#2017033)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-53
changelog:
  - sd-hwdb: allow empty properties (#2005009)
  - Update hwdb (#2005009)
  - Disable libpitc to fix CentOS Stream CI (#2017033)
  - rpm: Fix typo in /usr/lib/environment.d (#2018024)
  - rpm: Add misspelled /usr/lib/environment.d macro for temporary compatibility (#2018024)
  - rpm: emit warning when macro with typo is used (#2018024)
  - Remove unintended additions to systemd-analyze man page (#2004765)
  - core: fix SIGABRT on empty exec command argv (#2020239)
  - core/service: also check path in exec commands (#2020239)
  - mount-util: fix fd_is_mount_point() when both the parent and directory are network fs (#2015057)
  - basic: add vmware hypervisor detection from device-tree (#1959150)
  - pam: do not require a non-expired password for user@.service (#1961746)
  - udev rules: add rule to create /dev/ptp_hyperv (#1991834)
  - process-util: explicitly handle processes lacking parents in get_process_ppid() (#1977569)
  - errno-util: add ERRNO_IS_PRIVILEGE() helper (#1977569)
  - procfs-util: fix confusion wrt. quantity limit and maximum value (#1977569)
  - test-process-util: also add EROFS to the list of "good" errors (#1977569)
  - journal: refresh cached credentials of stdout streams (#1931806)
  - util-lib: introduce HAS_FEATURE_ADDRESS_SANITIZER (#2017033)
  - ci: skip test-execute on GH Actions under ASan (#2017033)
  - test-seccomp: accept ENOSYS from sysctl(2) too (#2017033)
  - test: accept that char device 0/0 can now be created witout privileges (#2017033)
  - meson: do not fail if rsync is not installed with meson 0.57.2 (#2017033)
  - pid1: fix free of uninitialized pointer in unit_fail_if_noncanonical() (#1970945)
  - sd-event: take ref on event loop object before dispatching event sources (#1970945)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-58.1
changelog:
  - acpi-fpdt: mark structures as packed (#2084052)
  - core/slice: make slice_freezer_action() return 0 if freezing state is unchanged (#2084052)
  - core/unit: fix use-after-free (#2084052)
  - sd-bus: fix reference counter to be incremented (#2084052)
  - sd-bus: do not read unused value (#2084052)
  - sd-bus: do not return negative errno when unknown name is specified (#2084052)
  - sd-bus: switch to a manual overflow check in sd_bus_track_add_name() (#2084052)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-58.2
changelog:
  - unit: don't emit PropertiesChanged signal if adding a dependency to a unit is a no-op (#2091590)
  - core: propagate triggered unit in more load states (#2086553)
  - core: propagate unit start limit hit state to triggering path unit (#2086553)
  - core: Move 'r' variable declaration to start of unit_start() (#2086553)
  - core: Delay start rate limit check when starting a unit (#2086553)
  - core: Propagate condition failed state to triggering units. (#2086553)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-58.7
changelog:
  - sd-event: don't invalidate source type on disconnect (#2116892)
  - test-procfs-util: skip test on certain errors (#2087152)
  - Try stopping MD RAID devices in shutdown too (#2120608)
  - shutdown: get only active md arrays. (#2120608)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-58.8
changelog:
  - unit-name: tighten checks for building valid unit names (#2094712)
  - core: shorten long unit names that are based on paths and append path hash at the end (#2094712)
  - test: add extended test for triggering mount rate limit (#2094712)
  - tests: add test case for long unit names (#2094712)
  - Revert "core: Propagate condition failed state to triggering units." (#2123801)
  - core: Check unit start rate limiting earlier (#2123801)
  - core: Add trigger limit for path units (#2123801)
  - resolved: pin stream while calling callbacks for it (#2110548)
  - core: move reset_arguments() to the end of main's finish (#2127171)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-59
changelog:
  - core: disallow using '-.service' as a service name (#2051520)
  - shared/dropin: support -.service.d/ top level drop-in for service units (#2051520)
  - core: change top-level drop-in from -.service.d to service.d (#2051520)
  - shared/dropin: fix assert for invalid drop-in (#2051520)
  - udev: fix slot based network names on s390 (#1939914)
  - udev: it is not necessary that the path is readable (#1939914)
  - udev: allow onboard index up to 65535 (#1939914)
  - Revert "basic: use comma as separator in cpuset cgroup cpu ranges" (#1858220)
  - acpi-fpdt: mark structures as packed (#2047373)
  - core/slice: make slice_freezer_action() return 0 if freezing state is unchanged (#2047373)
  - core/unit: fix use-after-free (#2047373)
  - sd-bus: fix reference counter to be incremented (#2047373)
  - sd-bus: do not read unused value (#2047373)
  - sd-bus: do not return negative errno when unknown name is specified (#2047373)
  - sd-bus: switch to a manual overflow check in sd_bus_track_add_name() (#2047373)
  - spec: Add dependency on timedatex (#2066946)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-60
changelog:
  - unit: don't emit PropertiesChanged signal if adding a dependency to a unit is a no-op (#1948480)
  - tests: make inverted tests actually count (#2087152)
  - TEST-*: make failure tests actually fail on failure (#2087152)
  - ci(Mergify): configuration update (#2087152)
  - core: propagate triggered unit in more load states (#2065322)
  - core: propagate unit start limit hit state to triggering path unit (#2065322)
  - core: Move 'r' variable declaration to start of unit_start() (#2065322)
  - core: Delay start rate limit check when starting a unit (#2065322)
  - core: Propagate condition failed state to triggering units. (#2065322)
  - unit: check for mount rate limiting before checking active state (#2095744)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-61
changelog:
  - mkosi: Add gnutls package (#2101227)
  - unit-name: tighten checks for building valid unit names (#1940973)
  - core: shorten long unit names that are based on paths and append path hash at the end (#1940973)
  - test: add extended test for triggering mount rate limit (#1940973)
  - tests: add test case for long unit names (#1940973)
  - core: unset HOME=/ that the kernel gives us (#2056527)
  - journal-remote: check return value from MHD_add_response_header (#2051981)
  - journalctl: in --follow mode watch stdout for POLLHUP/POLLERR and exit (#2003236)
  - sd-bus: make BUS_DEFAULT_TIMEOUT configurable (#2039461)
  - fstab-generator: fix debug log (#2101433)
  - logind-session-dbus: allow to set display name via dbus (#1857969)
  - Allow restart for oneshot units (#2042896)
  - test: correct TEST-41 StartLimitBurst test (#2042896)
  - core: fix assert() about number of built environment variables (#2049788)
  - core: add one more assert() (#2049788)
  - strv: introduce strv_join_prefix() (#2049788)
  - test: add tests for strv_join_prefix() (#2049788)
  - test: replace swear words by 'hoge' (#2049788)
  - core: add new environment variable $RUNTIME_DIRECTORY= or friends (#2049788)
  - test-execute: add tests for $RUNTIME_DIRECTORY= or friends (#2049788)
  - man: document RUNTIME_DIRECTORY= or friends (#2049788)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-64
changelog:
  - ci: bump the worker Ubuntu version to Jammy (#2087152)
  - test: make test-execute pass on Linux 5.15 (#2087152)
  - ci: install iputils (#2087152)
  - ci(Mergify): Add `ci-waived` logic (#2087152)
  - sd-event: don't invalidate source type on disconnect (#2115396)
  - tests: make sure we delay running mount start jobs when /p/s/mountinfo is rate limited (#2095744)
  - core: drop references to 'StandardOutputFileToCreate' (#2093479)
  - dbus-execute: fix indentation (#2093479)
  - dbus-execute: generate the correct transient unit setting (#2093479)
  - bus-unit-util: properly accept StandardOutput=append:… settings (#2093479)
  - core: be more careful when inheriting stdout fds to stderr (#2093479)
  - test: add a test for StandardError=file:… (#2093479)
  - tree-wide: allow ASCII fallback for → in logs (#2093479)
  - tree-wide: allow ASCII fallback for … in logs (#2093479)
  - core: allow to set default timeout for devices (#1967245)
  - man: document DefaultDeviceTimeoutSec= (#1967245)
  - Revert "core: Propagate condition failed state to triggering units." (#2114005)
  - core: Check unit start rate limiting earlier (#2114005)
  - core: Add trigger limit for path units (#2114005)
  - meson: add syscall-names-update target (#2040247)
  - syscall-names: add process_madvise which is planned for 5.10 (#2040247)
  - shared: add @known syscall list (#2040247)
  - generate-syscall-list: require python3 (#2040247)
  - shared/seccomp: reduce scope of indexing variables (#2040247)
  - shared/syscall-list: filter out some obviously platform-specific syscalls (#2040247)
  - seccomp: tighten checking of seccomp filter creation (#2040247)
  - shared/seccomp-util: added functionality to make list of filtred syscalls (#2040247)
  - nspawn: return ENOSYS by default, EPERM for "known" calls (#2040247)
  - revert: resolved: pin stream while calling callbacks for it (#2110549)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-66
changelog:
  - Try stopping MD RAID devices in shutdown too (#1817706)
  - shutdown: get only active md arrays. (#1817706)
  - scope: allow unprivileged delegation on scopes (#2068575)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-67
changelog:
  - resolved: pin stream while calling callbacks for it (#2110549)
  - ci(functions): Add `useradd` and `userdel` (#2110549)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-68
changelog:
  - logind: optionally watch utmp for login data (#2122288)
  - logind: add hashtable for finding session by leader PID (#2122288)
  - core/load-fragment: move config_parse_sec_fix_0 to src/shared (#2122288)
  - sd-event: add relative timer calls (#2122288)
  - logind: add option to stop idle sessions after specified timeout (#2122288)
  - logind: schedule idle check full interval from now if we couldn't figure out atime timestamp (#2122288)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-68.1
changelog:
  - time-util: fix buffer-over-run (#2139390)
  - core: move reset_arguments() to the end of main's finish (#2127170)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-68.4
changelog:
  - basic: add STRERROR() wrapper for strerror_r() (#2155519)
  - coredump: put context array into a struct (#2155519)
  - coredump: do not allow user to access coredumps with changed uid/gid/capabilities (#2155519)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-69
changelog:
  - logind: optionally watch utmp for login data (#2122288)
  - logind: add hashtable for finding session by leader PID (#2122288)
  - core/load-fragment: move config_parse_sec_fix_0 to src/shared (#2122288)
  - sd-event: add relative timer calls (#2122288)
  - logind: add option to stop idle sessions after specified timeout (#2122288)
  - logind: schedule idle check full interval from now if we couldn't figure out atime timestamp (#2122288)
  - ci(lint): add shell linter - Differential ShellCheck (#2122499)
  - meson: do not compare objects of different types (#2122499)
  - journal-remote: use MHD_HTTP_CONTENT_TOO_LARGE as MHD_HTTP_PAYLOAD_TOO_LARGE is deprecated since 0.9.74 (#2122499)
  - Fix build with µhttpd 0.9.71 (#2122499)
  - ci: replace LGTM with CodeQL (#2122499)
  - ci(mergify): Update policy - Drop LGTM checks (#2122499)
  - time-util: fix buffer-over-run (#2139391)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-70
changelog:
  - basic: recognize pdfs filesystem as a network filesystem (#2094661)
  - core: move reset_arguments() to the end of main's finish (#2127131)
  - manager: move inc. of n_reloading into a function (#2136869)
  - core: Add new DBUS properties UnitsReloadStartTimestamp and UnitsLoadTimestampMontonic (#2136869)
  - core: Indicate the time when the manager started loading units the last time (#2136869)
  - core: do not touch /run/systemd/systemd-units-load from user session instances (#2136869)
  - sysctl: downgrade message when we have no permission (#2158160)
  - core: respect SELinuxContext= for socket creation (#2136738)
  - manager: use target process context to set socket context (#2136738)
  - virt: detect Amazon EC2 Nitro instance (#2117948)
  - machine-id-setup: generate machine-id from DMI product ID on Amazon EC2 (#2117948)
  - virt: use string table to detect VM or container (#2117948)
  - fileio: introduce read_full_virtual_file() for reading virtual files in sysfs, procfs (#2117948)
  - Use BIOS characteristics to distinguish EC2 bare-metal from VMs (#2117948)
  - device: drop refuse_after (#2043524)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-71
changelog:
  - manager: limit access to private dbus socket (#2119405)
  - journalctl: do not treat EINTR as an error when waiting for events (#2161683)
  - core: bring manager_startup() and manager_reload() more inline (#2059633)
  - pam: add a call to pam_namespace (#1861836)
  - virt: Support detection for ARM64 Hyper-V guests (#2158307)
  - virt: Fix the detection for Hyper-V VMs (#2158307)
  - basic: add STRERROR() wrapper for strerror_r() (#2155520)
  - coredump: put context array into a struct (#2155520)
  - coredump: do not allow user to access coredumps with changed uid/gid/capabilities (#2155520)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-72
changelog:
  - test: import logind test from debian/ubuntu test suite (#1866955)
  - test: introduce inst_recursive() helper function (#1866955)
  - tests: verify that Lock D-Bus signal is sent when IdleAction=lock (#1866955)
  - systemctl: simplify halt_main() (#2053273)
  - systemctl: shutdown don't fallback on auth fail (#2053273)
  - systemctl: reintroduce the original halt_main() (#2053273)
  - systemctl: preserve old behavior unless requested (#2053273)
  - pam_systemd: suppress LOG_DEBUG log messages if debugging is off (#2170084)
  - udev/net_id: introduce naming scheme for RHEL-8.8 (#2170499)
  - pam: add a call to pam_namespace (#1861836)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-73
changelog:
  - journald: add API to move logging from /var to /run again (#1873540)
  - journalctl: add new --relinquish and --smart-relinquish options (#1873540)
  - units: automatically revert to /run logging on shutdown if necessary (#1873540)
  - pstore: Tool to archive contents of pstore (#2158832)
  - meson: drop redundant line (#2158832)
  - pstore: drop unnecessary initializations (#2158832)
  - pstopre: fix return value of list_files() (#2158832)
  - pstore: remove temporary file on failure (#2158832)
  - pstore: do not add FILE= journal entry if content_size == 0 (#2158832)
  - pstore: run only when /sys/fs/pstore is not empty (#2158832)
  - pstore: fix use after free (#2158832)
  - pstore: refuse to run if arguments are specified (#2158832)
  - pstore: allow specifying src and dst dirs are arguments (#2158832)
  - pstore: rework memory handling for dmesg (#2158832)
  - pstore: fixes for dmesg.txt reconstruction (#2158832)
  - pstore: Don't start systemd-pstore.service in containers (#2158832)
  - units: pull in systemd-pstore.service from sysinit.target (#2158832)
  - units: drop dependency on systemd-remount-fs.service from systemd-pstore.service (#2158832)
  - units: make sure systemd-pstore stops at shutdown (#2158832)
  - pstore: Run after modules are loaded (#2158832)
  - pstore: do not try to load all known pstore modules (#2158832)
  - logind-session: make stopping of idle session visible to admins (#2156780)
  - journald: Increase stdout buffer size sooner, when almost full (#2029426)
  - journald: rework end of line marker handling to use a field table (#2029426)
  - journald: use the fact that client_context_release() returns NULL (#2029426)
  - journald: rework pid change handling (#2029426)
  - test: Add a test case for #15654 (#2029426)
  - test: Stricter test case for #15654 (Add more checks) (#2029426)
  - man: document the new _LINE_BREAK= type (#2029426)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-74
changelog:
  - journald-server: always create state file in signal handler (#2174645)
  - journald-server: move relinquish code into function (#2174645)
  - journald-server: always touch state file in signal handler (#2174645)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-74.1
changelog:
  - pager: set $LESSSECURE whenver we invoke a pager (#2175623)
  - test-login: always test sd_pid_get_owner_uid(), modernize (#2175623)
  - pager: make pager secure when under euid is changed or explicitly requested (#2175623)
  - test: ignore ENOMEDIUM error from sd_pid_get_cgroup() (#2175623)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-74.2
changelog:
  - pstore: fix crash and forward dummy arguments instead of NULL (#2190153)
  - ci: workflow for gathering metadata for source-git automation (#2190153)
  - ci: first part of the source-git automation - commit linter (#2190153)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-74.3
changelog:
  - login: add a missing error check for session_set_leader() (#2223602)
  - logind: reset session leader if we know for a fact that it is gone (#2223602)


author: Pavel Raiskup <praiskup@redhat.com> - 1.29-3
changelog:
  - revert back some docs
  - fix --create to use --xattrs-include/exclude (rhbz#1341787)
  - don't hang with '-x --skip-old-files --xattrs' (rhbz#1399036)


author: Pavel Raiskup <praiskup@redhat.com> - 1.30-1
changelog:
  - rebase to latest upstream release, per release notes
    http://lists.gnu.org/archive/html/info-gnu/2017-12/msg00011.html


author: Ondrej Dubaj <odubaj@redhat.com> - 1.30-6
changelog:
  - added "padding with zeros" info message (#1913566)
  - do not report disk error as file shrank (#1913569)


author: Tony Camuso <tcamuso@redhat.com> - 1:1.9.6-3
changelog:
  - Incorporate latest upstream patches, including a newer version
    of the OpenSSL patch in 1.9.6-2
    Resolves: rhbz#1492771
    Resolves: rhbz#1499435


author: Tony Camuso <tcamuso@redhat.com> - 1:1.9.7-1
changelog:
  - Rebase to the latest upstream version.
    Resolves: rhbz#1511799
  - Do not override OPTFLAGS in the make
    Resolves: rhbz#1620070


author: Tony Camuso <tcamuso@redhat.com> - 1:1.9.12-1
changelog:
  - Add patch to revert "Disable GCC9 address-of-packed-member warning"
    While it was able to build locally with 'rhpkg local', the brew
    build failed, because the compiler on the brew systems did not
    recognized the new GCC9 command line flag:
    -Wno-address-of-packed-member


author: Tony Camuso <tcamuso@redhat.com> - 1:1.9.12-2
changelog:
  - Fix build issues with one upstream patch.
    This patch also reverts the previous patch concerning the
    -Wno-address-of-packed-member cflag.
    Resolves: rhbz#1847938


author: Tony Camuso <tcamuso@redhat.com> - 1:1.10.0-0
changelog:
  Upgrade to latest upstream version
    Added upstream patch to remove deprecated man pages
    Resolves: rhbz#1857068


author: Tony Camuso <tcamuso@redhat.com> - 1:1.10.0-1
changelog:
  Build problem creating directory for grub modules. We can't
    know if the modules are there, so it's up to the end user to
    find the modules and copy them to the correct location.
    Specifically, for systems booting from EFI, the
    /boot/efi/EFI/redhat/x86_64-efi/multiboot2.mod file, if it
    exists, must be copied to the /boot/efi/EFI/redhat/x86_64-efi/
    directory. If that file does not exist, then the system has
    the wrong version of grub for using tboot in an EFI system.
    Resolves: rhbz#1857068


author: Tony Camuso <tcamuso@redhat.com> - 1:1.10.0-1
changelog:
  Need to add BuildRequires: perl, since it has beem moved
    from BuildRoot.
    See: https://fedoraproject.org/wiki/Packaging:Perl#Build_Dependencies
    Resolves: rhbz#1857068


author: Tony Camuso <tcamuso@redhat.com> - 1:1.10.1-1
changelog:
  Upgrade to tboot-1.10.2-1 provides some bug fixes and updates.
    Remove 0001-Do-not-install-man-pages-for-deprecated-tools.patch
    from the git repo, since it is no longer needed.
    Resolves: rhbz#1857068
    Resolves: rhbz#1873296
    Resolves: rhbz#1920386


author: Tony Camuso <tcamuso@redhat.com> - 1:1.10.5-1
changelog:
  Upgrade to tboot-1.10.5-1 for fixes and updates.
    Added a scriptlet to the tboot.spec file to automatically install
    grub2-efi-x64-modules and move them to the correct directory.
    Resolves: rhbz#2040082
    Resolves: rhbz#2041759


author: Tony Camuso <tcamuso@redhat.com> - 1:1.10.5-2
changelog:
  - The install scriptlet in %post was not choosing the correct
    grubenv directory. In RHEL8, the efi and legacy bios grubenv
    directories are different. This change assures that the
    correct directory is used for grub.cfg and related modules.
    Added a %postun section to cleanup when removing tboot with
    dnf erase.
    Resolves: rhbz#2121836


author: Jaroslav Škarvada <jskarvad@redhat.com> - 1:8.6.6-2
changelog:
  - Splitted documentation to the doc subpackage
    Resolves: rhbz#1380291
  - Fixed whitespace
  - Dropped obsoleted defattr


author: Jaroslav Škarvada <jskarvad@redhat.com> - 1:8.6.8-2
changelog:
  - Reverted _module_build macro check which fixes systemtap probes on RHEL-8
    Resolves: rhbz#1579386


author: Petr Pisar <ppisar@redhat.com> - 1.8-1
changelog:
  - 1.8 bump
  - License changed from GPLv2+ to (GPLv3+ and GFDL)
  - Disable printing command failure in POSIX mode


author: Filipe Rosset <rosset.filipe@gmail.com> - 2.5-1
changelog:
  - New upstream release 2.5 - fixes rhbz #1449666
  - https://raw.githubusercontent.com/tmux/tmux/2.5/CHANGES


author: Filipe Rosset <rosset.filipe@gmail.com> - 2.5-4
changelog:
  - Fixes rhbz #1476851 tmux bell-action other not working
  - Fixes rhbz #1476892 tmux update in F26 broke tmuxinator


author: Michal Schmidt <mschmidt@redhat.com> - 1.3.8-6
changelog:
  - Fix FTBFS with current autotools (#1083627)
  - Drop tpm-tools-1.3.7-build.patch, the package builds without it (#952372)


author: Michal Schmidt <mschmidt@redhat.com> - 1.3.9-1
changelog:
  - Upstream release 1.3.9.
  - Add fixes for build errors with OpenSSL 1.1.
  - Add fixes for NULL cipher context use in seal/unseal.
  - spec file modernization.


author: Sun Yunying <yunying.sun@intel.com> - 1.1.0-6
changelog:
  - Add tss user if doesn't currently exist - PR#1 from Jerry Snitselaar
  - Removed source tarball and cleared it from .gitignore


author: Javier Martinez Canillas <javierm@redhat.com> - 2.0.0-1
changelog:
  - Download the distributed tarball instead of the source code tarball
  - Update URLs to point to the new project location
  - Update to 2.0.0 release


author: Jerry Snitselaar <jsnitsel@redhat.com> - 3.1.1-4
changelog:
  - lib/tpm2_options: restore TCTI configuration environment variables
  - tpm2_getcap: restore tool output to print properties with TPM_PT prefix
  resolves: rhbz#1648001


author: Jerry Snitselaar <jsnitsel@redhat.com> - 4.1.1-2
changelog:
  - Fix ESYS_TR hierarchy transition.
  - Refactor fix_esys_hierarchies to return actual TSS2_RC return code.
  - tpm2_alg_util.c: fix a bug where the string rsa3072 wasn't being parsed.
  - tpm2_create.c: Fix an issue where userwithauth attr cleared if policy specified.
  - tpm2_hierarchycontrol: Fix bug where hierarchycontrol operation failed silently.
  - tpm2_nvdefine.c: Fix error reporting message.
  - tpm2_policyor: Fix silent failure for invalid/unspecified policy digest alg.
  resolves: rhbz#1854774


author: Jerry Snitselaar <jsnitsel@redhat.com> - 4.1.1-3
changelog:
  - Fix resource leak.
  - Fix to restrict policy digest size.
  - Fix incompatible pointer cast.
  - Fix error message in files_load_##name
  - Fix issue where execution couldn't reach function return.
  resolves: rhbz#1920821


author: Javier Martinez Canillas <javierm@redhat.com> - 1.4.0-1
changelog:
  - Update URLs to point to the new project location
  - Add README.md CHANGELOG.md to %files directive
  - Update to 1.4.0 release (RHBZ#1508870)


author: Yunying Sun <yunying.sun@intel.com> - 2.0.0-1
changelog:
  - Update to 2.0.0 release (RHBZ#1508870)
  - Remove patch file 60-tpm-udev.rules, use upstream tpm-udev.rules instead
  - Disable ESAPI to fix build errors caused by dependency to libgcrypt 1.6.0
  - Add scriptlet to fix Rpath errors
  - Update file installation paths and names accordingly


author: Yunying Sun <yunying.sun@intel.com> - 2.0.0-2
changelog:
  - Re-enable ESAPI since gcrypt dependency is not an issue for Fedora
  - Bump release version to 2.0.0-2


author: Jerry Snitselaar <jsnitsel@redhat.com> - 2.3.2-3
changelog:
  - Add tss user if doesn't exist.
  - Update exported symbols map for libtss2-mu
  - esys: Check object handle node before calling compute_session_value
  - esys: fix resource name calculation
  - esys: fix Esys_StartAuthSession called with optional params
  - esys: fix keysize of ECC curve TPM2_ECC_NISTP224
  - esys: fixup compute_encrypted_salt error handling
  - esys: use memcmp in byte array comparison
  - esys: zero out ctx->salt after startAuthSession_finish
  - mu: Remove use of VLAs for Marshalling TPML types
  - return proper error code on memory allocation failure
  - sys: match counter variable type for cmdAuthsArray->count
  - tcti-device: getPollHandles should allow num_handles query
  - tctildr: fix segmentation fault if name_conf is too big
  resolves: rhbz#1879071 rhbz#1855180


author: Jerry Snitselaar <jsnitsel@redhat.com> - 2.3.2-4
changelog:
  - Fix hmac calculation for tpm2_clear command.
  - Remove private implementation of strndup.
  resolves: rhbz#1920825 rhbz#1940861


author: Kamil Dudka <kdudka@redhat.com> - 1.7.0-11
changelog:
  - do not escape UTF-8 chars in file names by default in UTF-8 locale (#1480778)
  - modernize spec file (Group, BuildRoot, autosetup, clean, defattr)


author: Tomáš Mráz <tmraz@redhat.com> 0.3.13-4
changelog:
  - Split libtspi to a trousers-lib subpackage (#1225062)
  - Fix FTBFS with current gcc (drop inline keyword when bogus)


author: Jerry Snitselaar <jsnitsel@redhat.com> - 0.3.15-1
changelog:
  - Rebase to 0.3.15
  - Fix CVE-2020-24330 CVE-2020-24331 CVE-2020-24332
  resolves: rhbz#1725782 rhbz#1877517 rhbz#1882402 rhbz#1882414


author: Merlin Mathesius <mmathesi@redhat.com> - 1027-1
changelog:
  - Version bump. Now supported for all architectures.
  - Generate man pages since they are no longer included in source archive.


author: Jerry Snitselaar <jsnitsel@redhat.com> - 1234-5
changelog:
  - Move header files to ibmtss directory.
  - Check return value of TSS_Hash_Generate.
  resolves: rhbz#1636245


author: John Kacur <jkacur@redhat.com> - 0.14-2
changelog:
  - Add method to compare class cpu for sorting
  - Use args attributes for exceptions for python3
  Resolves: rhbz#1651465


author: John Kacur <jkacur@redhat.com> - 0.15-1
changelog:
  - Upgrade to latest upstream code
  - Upstream drops python-schedutils and uses built-in schedutils
  Resolves: rhbz#1890558


author: John Kacur <jkacur@redhat.com> - 0.16-4
changelog:
  - Make it clear in online help and man pages that --include and --isolate
    affect IRQs as well as threads
  Resolves: rhbz#1886804


author: Leah Leshchinsky <lleshchi@redhat.com> - 0.17-2
changelog:
  - Fix typo for variable parm
  - Handle get_policy_and_rtprio exceptions
  - Remove finally block in get_policy_and_rtprio
  Resolves: rhbz#2049746


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.14.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#1792264
    - oracle: turned off NUMA balancing
      resolves: rhbz#1782233
    - man: documented the possibility to apply multiple profiles
      resolves: rhbz#1794337
    - cpu-partitioning: disabled kernel.timer_migration
      resolves: rhbz#1797629
    - profiles: new profile optimize-serial-console
      resolves: rhbz#1840689
    - added support for a post-loaded profile
      resolves: rhbz#1798183
    - plugins: new irqbalance plugin
      resolves: rhbz#1784645
    - throughput-performance: added architecture specific tuning for Marvell ThunderX
      resolves: rhbz#1746961
    - throughput-performance: added architecture specific tuning for AMD
      resolves: rhbz#1746957
    - scheduler: added support for cgroups
      resolves: rhbz#1784648


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.14.0-3.1
changelog:
  - realtime-virtual-host: remove lapic advancement calculation and
    related qemu-kvm-tools-rhev requirement
    Resolves: rhbz#1884544


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.14.0-4
changelog:
  - realtime-virtual-host: remove lapic advancement calculation and
    related qemu-kvm-tools-rhev requirement
    Resolves: rhbz#1845717


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.15.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#1874052
    - added plugin service for linux services control
      resolves: rhbz#1869991
    - scheduler: added default_irq_smp_affinity option
      resolves: rhbz#1896348
    - bootloader: skip boom managed BLS snippets
      resolves: rhbz#1901532
    - scheduler: added perf_process_fork option to enable processing of fork
      resolves: rhbz#1894610
    - scheduler: added perf_mmap_pages option to set perf buffer size
      resolves: rhbz#1890219
    - bootloader: fixed cmdline duplication with BLS and grub2-mkconfig
      resolves: rhbz#1777874


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.16.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#1936426
    - realtime: "isolate_managed_irq=Y" should be mentioned in
      "/etc/tuned/realtime-virtual-*-variables.conf"
      resolves: rhbz#1817827
    - realtime: changed tuned default to "isolcpus=domain,managed_irq,X-Y"
      resolves: rhbz#1820626
    - applying a profile with multiple inheritance where parents include a common
      ancestor fails
      resolves: rhbz#1825882
    - failure in moving i40e IRQ threads to housekeeping CPUs from isolated CPUs
      resolves: rhbz#1933069
    - sort network devices before matching by regex
      resolves: rhbz#1939970
    - net: fixed traceback while adjusting the netdev queue count
      resolves: rhbz#1943291
    - net: fixed traceback if the first listed device returns netlink error
      resolves: rhbz#1944686
    - realtime: improve verification
      resolves: rhbz#1947858
    - bootloader: add support for the rpm-ostree
      resolves: rhbz#1950164
    - net: fixed traceback if a device channel contains n/a
      resolves: rhbz#1974071
    - mssql: updated the profile
      resolves: rhbz#1942733


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.18.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#2003833
    - profiles: fix improper parsing of include directive
      resolves: rhbz#2017924
    - disk: added support for the nvme
      resolves: rhbz#1854816
    - cpu: extended cstate force_latency syntax to allow skipping zero latency
      resolves: rhbz#2002744
    - net: added support for the txqueuelen
      resolves: rhbz#2015044
    - bootloader: on s390(x) remove TuneD variables from the BLS
      resolves: rhbz#1978786
    - daemon: don't do full rollback on systemd failure
      resolves: rhbz#2011459


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.18.0-1
changelog:
  - new release
    - rebased tuned to latest upstream
      related: rhbz#2003833
    - tuned-gui: fixed creation of new profile


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.19.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#2057602
    - fixed parsing of inline comments
      resolves: rhbz#2060138
    - added support for quotes in isolated_cores specification
      resolves: rhbz#1891036
    - recommend: preset balanced profile for notebook, laptop or portable if
      syspurpose is not defined
      resolves: rhbz#1896717


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.20.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#2133814
    - systemd: relax polkit requirement
      resolves: rhbz#2065591
    - sysvinit: fixed path
    - plugin_cpu: added support for pm_qos_resume_latency_us
    - do not exit on duplicate config lines
      resolves: rhbz#2071418
    - profiles: new cpu-partitioning-powersave profile
    - profiles: new profile for AWS EC2
    - API: add support for moving devices between instances
    - D-Bus: send tracebacks through D-Bus only in debug mode
    - Makefile: added fix for python-3.12
    - throughput-performance: set net.core.somaxconn to at least 2048
      resolves: rhbz#1998310
    - plugin_scheduler: do not leak FDs from the perf
      resolves: rhbz#2080227
    - plugin_cpu: added support for intel_pstate scaling driver
    - added support for the API access through the Unix Domain Socket


author: Patsy Griffin Franklin <pfrankli@redhat.com> - 2018i-1
changelog:
  - Rebase to tzdata-2018i (includes changes from tzdata-2018h)
    - São Tomé and Príncipe changed from UTC+01 to UTC+00 on 2019-01-01.
    - Qyzylorda, Kazakhstan changed from UTC+06 to UTC+05 on 2018-12-21.
    - Created a new zone Asia/Qostanay since Qostanay, Kazakhstan didn't 
      transition with the Qyzylorda change.
    - Metlakatla, Alaska will observe PST for this winter only.
    - Predict that Morocco will continue to adjust clocks around Ramadan.
    - Also include predictions for Iran from 2038 through 2090.


author: Patsy Griffin Franklin <patsy@redhat.com> - 2019a-1
changelog:
  - Rebase to tzdata-2019a
    - Palestine will start DST on 2019-03-30, rather than 2019-03-23 as
      previously predicted.
    - Metlakatla rejoined Alaska time on 2019-01-20, ending its observances
      of Pacific standard time.


author: Patsy Griffin <patsy@redhat.com> - 2019b-1
changelog:
  - Rebase to tzdata-2019b
    - Brazil will no longer observe DST going forward.
    - The 2019 spring transition for Palestine occurred 03-29, not 03-30.


author: Patsy Griffin <patsy@redhat.com> - 2019c-1
changelog:
  - Rebase to tzdata-2019c
    - Fiji will observe DST from 2019-11-10 to 2020-01-12.
    - Norfolk Island will begin observing Australian-style DST on 2019-10-06.


author: Patsy Griffin <patsy@redhat.com> - 2020a-1
changelog:
  - Rebase to tzdata-2020a
    - Morocco will spring forward on 2020-05-31 rather than
      previously predicted 2020-05-24.
    - Canada's Yukon region changed to year round UTC -07
      effective 2020-03-08.
    - America/Godthab was renamed to America/Nuuk.


author: Patsy Griffin <patsy@redhat.com> - 2020b-1
changelog:
  - Rebase to tzdata-2020b
    - Yukon timezones represented by America/Whitehorse and
      America/Dawson will change time zone rules from -08/-07 to
      permanent -07 on 2020-11-01, not on 2020-03-08 as 2020a had it.
    - The most recent winter(+08)/summer(+11) transition for Casey Station,
      Antarctica was 2020-10-04 00:01.
    - Remove obsolete files pacificnew, systemv, and yearistype.sh
      from the distribution.


author: Patsy Griffin <patsy@redhat.com> - 2020b-2
changelog:
  - Include the upstream patch to support pacificnew for java tzupdater.
  - Set POSIXRULES macro to continue installing posixrules file.


author: Patsy Griffin <patsy@redhat.com> - 2020c-1
changelog:
  - Rebase to tzdata-2020c
    - Fiji starts DST later than usual, on 2020-12-20.
    - Rearguard now provides an empty file pacificnew to support
      downstream software that expects it.


author: Patsy Griffin <patsy@redhat.com> - 2020d-1
changelog:
  - Rebase to tzdata-2020d
   - Palestine will end summer time on 2020-10-24 rather than the
     predicted 2020-10-31.


author: Patsy Griffin <patsy@redhat.com> - 2020f-1
changelog:
  - Rebase to tzdata-2020f including changes for tzdata-2020e
    - tzdata-2020f fixes a bug in tzdata-2020e that caused an
      invalid zi file in rearguard format
    - Volgograd changes time zone from UTC+04 to UTC+03 on 2020-12-27.
    - Australia/Currie is identical to Australia/Hobart for all
      timestamps since 1970 and was therefore created by mistake,
      now moved to the "backward" file.


author: Patsy Griffin <patsy@redhat.com> - 2021b-1
changelog:
  - Rebase to tzdata-2021b
    - Innclude patch for Mayen
    - Jordan now starts DST on February's last Thursday.
    - Samoa no longer observes DST.
    - Merge more location-based Zones whose timestamps agree since 1970.
    - Move some backward-compatibility links to 'backward'.
    - Rename Pacific/Enderbury to Pacific/Kanton.
    - Correct many pre-1993 transitions in Malawi, Portugal, etc.
    - zic now creates each output file or link atomically.
    - zic -L no longer omits the POSIX TZ string in its output.
    - zic fixes for truncation and leap second table expiration.
    - zic now follows POSIX for TZ strings using all-year DST.
    - Fix some localtime crashes and bugs in obscure cases.
    - zdump -v now outputs more-useful boundary cases.
    - tzfile.5 better matches a draft successor to RFC 8536.


author: Patsy Griffin <patsy@redhat.com> - 2021c-1
changelog:
  - Rebase to tzdata-2021c
    - Revert most of 2021b changes to 'backward'.
    - Fix 'zic -b fat' bug in pre-1970 32-bit data.
    - Fix two Link line typos.
    - Distribute SECURITY file.


author: Patsy Griffin <patsy@redhat.com> - 2021c-1
changelog:
  - Rebase to tzdata-2021c - supersedes tzdata-2021b
    - Revert most of 2021b changes to 'backward'.
    - Fix 'zic -b fat' bug in pre-1970 32-bit data.
    - Fix two Link line typos.
    - Distribute SECURITY file.
  - Includes changes in tzdata-2021b
    - Innclude patch for Mayen
    - Jordan now starts DST on February's last Thursday.
    - Samoa no longer observes DST.
    - Merge more location-based Zones whose timestamps agree since 1970.
    - Move some backward-compatibility links to 'backward'.
    - Rename Pacific/Enderbury to Pacific/Kanton.
    - Correct many pre-1993 transitions in Malawi, Portugal, etc.
    - zic now creates each output file or link atomically.
    - zic -L no longer omits the POSIX TZ string in its output.
    - zic fixes for truncation and leap second table expiration.
    - zic now follows POSIX for TZ strings using all-year DST.
    - Fix some localtime crashes and bugs in obscure cases.
    - zdump -v now outputs more-useful boundary cases.
    - tzfile.5 better matches a draft successor to RFC 8536.


author: Patsy Griffin <patsy@redhat.com> - 2021e-1
changelog:
  - Rebase to tzdata-2021e - supersedes tzdata-2021d
    - Pacific/Fiji suspended DST for the 2021/2022 season.
    - 'zic -r' now marks unspecified timestamps with "-00".
    - Palestine will fall back 2021-10-29 at 01:00, rather
      than the predicted 2021-10-30.


author: Patsy Griffin <patsy@redhat.com> - 2022a-1
changelog:
  - Rebase to tzdata-2022a
    - Palestine springs forward on 2022-03-27, not -03-26.
    - zdump -v now outputs better failure information
    - fixes for code that reads corrupted TZif data


author: Patsy Griffin <patsy@redhat.com> - 2022b-1
changelog:
  - Rebase to tzdata-2022b
    - Chile transitions to DST on 2022-09-11, not 2022-09-04
    - 'make install' now defaults LOCALTIME to Factory rather than GMT
    - More zones that are the same since 1970 have been moved to backzone.
    - Include patch for awk workaround.


author: Patsy Griffin <patsy@redhat.com> - 2022c-1
changelog:
  - Rebase to tzdata-2022c - supersedes tzdata-2022b
    - Add a work-around for an awk bug in FreeBSD, macOS, etc.
    - Improve tzselect with respect to intercontinental Zones.


author: Patsy Griffin <patsy@redhat.com> - 2022d-1
changelog:
  - Rebase to tzdata-2022d
    - Palestine's DST transition will be on October 29, 2022,
      not October 28, 2022.
    - Europe/Uzhgorod and Europe/Zaporozhye are moved to 'backzone'.


author: Patsy Griffin <patsy@redhat.com> - 2022e-1
changelog:
  - Rebase to tzdata-2022e
    - Jordan and Syria cancelled the DST transition planned
      for 2022-10-28, remaining at +03 permanently.


author: Patsy Griffin <patsy@redhat.com> - 2022f-1
changelog:
  - Rebase to tzdata-2022f
    - Mexico will stop observing DST except near the US border.
    - Chihuahua moved to -06 year round starting on 2022-10-30.
    - Fiji no longer observes DST.


author: Patsy Griffin <patsy@redhat.com> - 2022g-1
changelog:
  - Rebase to tzdata-2022g
    - The northern edge of the Mexican state of Chihuahua will
      change time zone to agree with nearby US locations on
      2022-11-30.
    - Added a new Zone America/Ciudad_Juarez that splits from
      America/Ojinaga.


author: Patsy Griffin <patsy@redhat.com> - 2023a-1
changelog:
  - Rebase to tzdata-2023a
    - Egypt reintroduced DST, from April through October.
    - Morocco springs forward April 23, not April 30.
    - Palestine delayed the start of DST this year.


author: Kamil Dudka <kdudka@redhat.com> - 2.17-5
changelog:
  - do not update currency.units from network during build
  - units_cur: validate rate data from server (#1598913)


author: Jakub Martisko <jamartis@redhat.com> - 6.0-38
changelog:
  - Fix CVE-2018-1000035 - heap based buffer overflow when opening
    password protected files.
    Resolves: 1537043


author: Jakub Martisko <jamartis@redhat.com> - 6.0-40
changelog:
  - fix several possibly unterminated strings
    When copying to OEM_CP and ISO_CP strings, the string could end unterminated
    (stncpy does not append '\0').
  - Related: #1602721


author: Jakub Martisko <jamartis@redhat.com> - 6.0-45
changelog:
  Fix a false positive zipbomb detection
  Related: 1954649
  Related: 1953565
  Related: 1969876
  Resolves: 1970326


author: Lubomir Rintel <lkundrak@v3.sk> - 2.4.0-2
changelog:
  - Add the previously omitted systemd service file (rh #1352055)
  - Fix crash with invalid arguments (rh #1358472)


author: Miloslav Trmač <mitr@redhat.com> - 1.111-10
changelog:
  - Fix a FBFS with  -Werror=format-security
    Resolves #1444750
  - Fix inconsistent dates in %changelog


author: Jiri Kucera <jkucera@redhat.com> - 1.112-2
changelog:
  - Dropped need to run autotools
  - <sys/sysmacros.h> must be now included manually
    Resolves #1611752
  - Fixed bad FSF address


author: Jiri Kucera <jkucera@redhat.com> - 1.113-2
changelog:
  - Fix typo in pam-panel-icon manpage
    Do not use deprecated selinux API
    Do not use fexecve
    Resolves: #1775931


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.10.1-3
changelog:
  - Replace arch-dependent /usr/include/urcu/config.h with arch-independent
    stub when needed. (bz #1853168)
  - Added CI gating tests (bz #1682555)
  - Resolves: bz #1682555, #1853168


author: Richard W.M. Jones <rjones@redhat.com> - 0.5-17
changelog:
  - Remove ldconfig
    https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/SU3LJVDZ7LUSJGZR5MS72BMRAFP3PQQL/


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-8
changelog:
  - 1640919 - augroup fedora, test case failure: /CoreOS/vim/Regression/bz241308-use-augroup-for-rh-autocmds


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-16
changelog:
  - 2004974 - CVE-2021-3796 vim: use-after-free in nv_replace() in normal.c [rhel-8.5.0]
  - 2004891 - CVE-2021-3778 vim: heap-based buffer overflow in utf_ptr2char() in mbyte.c [rhel-8.5.0]


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-16.3
changelog:
  - 2028341 - CVE-2021-3984 vim: illegal memory access when C-indenting could lead to Heap Buffer Overflow [rhel-8.6.0]
  - 2028430 - CVE-2021-4019 vim: heap-based buffer overflow in find_help_tags() in src/help.c [rhel-8.6.0]


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-16.4
changelog:
  - CVE-2021-4193 vim: vulnerable to Out-of-bounds Read
  - CVE-2021-4192 vim: vulnerable to Use After Free


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-16.5
changelog:
  - CVE-2022-0261 vim: Heap-based Buffer Overflow in block_insert() in src/ops.c
  - CVE-2022-0318 vim: heap-based buffer overflow in utf_head_off() in mbyte.c


author: Tomas Korbar <tkorbar@redhat.com> - 2:8.0.1763-16.8
changelog:
  - CVE-2022-0392 vim: heap-based buffer overflow in getexmodeline() in ex_getln.c
  - Resolves: rhbz#2049403


author: Tomas Korbar <tkorbar@redhat.com> - 2:8.0.1763-16.9
changelog:
  - CVE-2022-0392 vim: heap-based buffer overflow in getexmodeline() in ex_getln.c
  - Improve fix
  - Resolves: rhbz#2049403


author: Tomas Korbar <tkorbar@redhat.com> - 2:8.0.1763-16.11
changelog:
  - CVE-2022-0413 vim: use after free in src/ex_cmds.c
  - Fix specfile problems
  - Resolves: rhbz#2048525


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-16
changelog:
  - 2004975 - CVE-2021-3796 vim: use-after-free in nv_replace() in normal.c [rhel-8.6.0]
  - 2004892 - CVE-2021-3778 vim: heap-based buffer overflow in utf_ptr2char() in mbyte.c [rhel-8.6.0]


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-17
changelog:
  - 2016201 - CVE-2021-3872 vim: heap-based buffer overflow in win_redr_status() drawscreen.c [rhel-8.6.0]


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-18
changelog:
  - fix test suite after fix for CVE-2022-0318
  - CVE-2022-0359 vim: heap-based buffer overflow in init_ccline() in ex_getln.c


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-18
changelog:
  - CVE-2022-0392 vim: heap-based buffer overflow in getexmodeline() in ex_getln.c
  - CVE-2022-0413 vim: use after free in src/ex_cmds.c


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-19.3
changelog:
  - CVE-2022-1785 vim: Out-of-bounds Write
  - CVE-2022-1897 vim: out-of-bounds write in vim_regsub_both() in regexp.c
  - CVE-2022-1927 vim: buffer over-read in utf_ptr2char() in mbyte.c


author: Richard W.M. Jones <rjones@redhat.com> - 1.18-1
changelog:
  - New upstream version 1.18.
  - Update RPM description section with complete list of supported guests.
  - If ‘make check’ fails, dump ‘test-suite.log’.


author: Richard W.M. Jones <rjones@redhat.com> - 1.18-8
changelog:
  - Add support for Nutanix AHV
    resolves: rhbz#1756381
  - Add all patches since 1.18 was released, up to 1.20 and beyond.


author: Jason L Tibbitts III <tibbs@math.uh.edu> - 2.21-8
changelog:
  - Fix invalid [ ... ] syntax which results in complaints by zsh.
    https://bugzilla.redhat.com/show_bug.cgi?id=1546221
  - Remove pointless Group tag, buildroot cleaning and %defattr.


author: Than Ngo <than@redhat.com> - 2.21-17
changelog:
  - Resolves: #2025709, check shell correctly 
  - Resolves: #2009547, which treats function contents as aliases when parsing ksh


author: Jiří Klimeš <blueowl@centrum.cz> - 1:2.6-12
changelog:
  - Fix crash when using MACsec without loaded macsec.ko (rh #1497640)
  - Enable Fast BSS Transition for station mode (rh #1372928)


author: Davide Caratti <dcaratti@redhat.com> - 1:2.6-15
changelog:
  - Disable build of wpa_gui (rh #1542234)
  - Fix build issue with latest kernel headers (rh #1582604)
  - Disable WEXT (rh #1537143)
  - Fix memory leak when macsec MKA/PSK is used (rh #1582511)
  - Fix authentication failure when the MAC is updated externally (rh #1582508)
  - Let the kernel discard EAPOL if packet type is PACKET_OTHERHOST (rh #1582501)


author: Davide Caratti <dcaratti@redhat.com> - 1:2.9-2
changelog:
  - Fix AP mode PMF disconnection protection bypass (CVE-2019-16275)
  - Fix NULL dereference in d-bus handler when P2P control interface is removed (rh #1752780)
  - enable WIFI_DISPLAY (rh #1755941)


author: Eric Sandeen <sandeen@redhat.com> 5.0.0-1
changelog:
  - New upstream version (#1712147)
  - mkfs.xfs: validate extent size hint parameters (#1683007)
  - mkfs.xfs: null-terminate symlinks created via protofile (#1640503)
  - xfs_repair: allow '/' in attribute names (#1667354)
  - xfs_info: allow device name as parameter (#1679840)
  - xfs_quota: fix project inheritance flag handling (#1664105)
  - xfs_metadump: handle symlinks correctly (#1693074)
  - xfs_db: fix finobt record decoding with sparse inodes (#1690245)


author: Eric Sandeen <sandeen@redhat.com> 5.0.0-2
changelog:
  - mkfs.xfs: validate log stripe unit alignment (#1632596)
  - xfs_growfs: allow mounted device node as argument (#1765217)


author: Bill O'Donnell <billodo@redhat.com> 5.0.0-6
changelog:
  - xfs_repair: improve AG btree ptr validation (libxfs_verify_agbno) (#1887288)
  - mkfs.xfs: fix ASSERT on too-small device with stripe geometry (#1887401)
  - xfs_repair: fix rebuilding btree block less than minrecs (#1759452)


author: Bill O'Donnell <billodo@redhat.com> 5.0.0-7
changelog:
  - xfs_quota: document how the default quota is stored (#1850188)
  - xfs_db: skip type change if type_f unchanged (#1867474)


author: Eric Sandeen <sandeen@redhat.com> 4.19.0-1
changelog:
  - New upstream release (#1652248)
  - Note reflink default in mkfs.xfs manpage (#1641698)
  - Fix xfs_db sign extension in agi freecount (#1640090)
  - Fix xfs_repair hang on large filesystem (#1630674)


author: Rob Crittenden <rcritten@redhat.com> - 1.51.0-7
changelog:
  - lib: Prevent more integer overflows (CVE-2022-22822 to CVE-2022-22827)
    (#2058567, #2058576, #2058582, #2058589, #2058595, #2058602)
  - Prevent integer overflow on m_groupSize in doProlog
    (CVE-2021-46143) (#2058560)


author: Michel Dänzer <mdaenzer@redhat.com> - 1.20.8-3
changelog:
  - Downgrade modesetting "glamor initialization failed" X_ERROR → X_INFO
    Resolves: #1724573
  - Xwayland / Present leak fixes for #1728684


author: Michel Dänzer <mdaenzer@redhat.com> - 1.20.8-5
changelog:
  - xwayland: Hold a pixmap reference in struct xwl_present_event
    Related: #1728684
  - glamor: Fix glamor_poly_fill_rect_gl xRectangle::width/height handling
    Resolves: #1740250


author: Michel Dänzer <mdaenzer@redhat.com> - 1.20.8-8
changelog:
  - CVE fixes for: CVE-2020-14345 (#1872391), CVE-2020-14346 (#1872395),
    CVE-2020-14361 (#1872402), CVE-2020-14362 (#1872409)


author: Pavel Raiskup <praiskup@redhat.com> - 5.2.3-1
changelog:
  - rebase to stable 5.2.3 per release notes:
    http://www.mail-archive.com/xz-devel@tukaani.org/msg00285.html


author: Pavel Raiskup <praiskup@redhat.com> - 5.2.4-1
changelog:
  - rebase to 5.2.4 (rhbz#1574039), per release notes:
    https://www.mail-archive.com/xz-devel@tukaani.org/msg00295.html


author: Pavel Raiskup <praiskup@redhat.com> - 5.2.4-2
changelog:
  - drop ppc64p7 hack, per fedora devel list discussion:
    https://lists.fedoraproject.org/archives/list/
    devel@lists.fedoraproject.org/thread/2OWD2QRDFBEC6HTPVQ7FMJENH32BWT54/
  - don't explicitly set _FILE_OFFSET_BITS, package uses AC_SYS_LARGEFILE


author: Jakub Martisko <jamartis@redhat.com> - 3.0-22
changelog:
  - Add missing linker flags
  - Port the configure patch from unzip that allows linker flags configuration
    from the spec file
  - Related: #1624188


author: Jakub Martisko <jamartis@redhat.com> - 3.0-23
changelog:
  - Set the ziperr function as noreturn
  - Fix email in the previous chnagelog entry
  - Related: #1602741


author: Ondrej Dubaj <odubaj@redhat.com> - 1.2.11-11
changelog:
  - IBM Z hardware-accelerated deflate for s390x architectures
  - IBM CRC32 optimalization for POWER 8+ architectures
  - fixed firefox crash due to zlib (#1741266)
  - added test for crc32


author: Ondrej Dubaj <odubaj@redhat.com> - 1.2.11-13
changelog:
  - Added -DDFLTCC parameter to configure to enable 
  - Z hardware-accelerated deflate for s390x architectures (#1659433)


author: Ondrej Dubaj <odubaj@redhat.com> - 1.2.11-16
changelog:
  - Permit a deflateParams() parameter change
  - Another fix for Z hardware-accelerated deflate for s390x architectures
  - according to previous change by upstream


author: Ondrej Dubaj <odubaj@redhat.com> - 1.2.11-17
changelog:
  - Fixed DFLTCC compression level switching issues (#1875492)
  - Enabled HW compression for compression levels 1 through 6 (#1847438)
  - Fixed inflateSyncPoint() bad return value on z15 (#1888930)


author: Lukas Javorsky <ljavorsk@redhat.com> - 1.2.11-19
changelog:
  - Apply IBM patch for compressBound() function
  - Source from https://github.com/madler/zlib/issues/410#issuecomment-947212824
  - Resolves: #2056900


author: Matej Mužila <mmuzila@redhat.com> - 1.2.11.19
changelog:
  - Fix heap-based buffer over-read or buffer overflow in inflate in inflate.c
  - Resolves: CVE-2022-37434


author: Kamil Dudka <kdudka@redhat.com> - 5.4.2-7
changelog:
  - avoid crash when copying empty hash table (CVE-2018-7549)
  - avoid NULL dereference when using ${(PA)...} on an empty array (CVE-2018-7548)


author: Kamil Dudka <kdudka@redhat.com> - 5.5-1
changelog:
  - update to latest upstream release, which fixes the following vulnerabilities:
      CVE-2018-1100 - stack-based buffer overflow in utils.c:checkmailpath()
      CVE-2018-1083 - stack-based buffer overflow in compctl.c:gen_matches_files()
      CVE-2018-1071 - stack-based buffer overflow in exec.c:hashcmd()


