# changelog

author: Ken Gaillot <kgaillot@redhat.com> - 1.1.15-11
changelog:
  - Sanitize readable CIB output collected by crm_report
  - Document crm_report --sos-mode option
  - Speed up crm_report on Pacemaker Remote nodes
  - Avoid sbd fencing when upgrading pacemaker_remote package
  - Resolves: rhbz#1219188
  - Resolves: rhbz#1235434
  - Resolves: rhbz#1323544
  - Resolves: rhbz#1372009


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.18-4
changelog:
  - Rebase to upstream 1a4ef7d180e77bcd6423f342d62e05e516c4e852 (1.1.18-rc4)
  - Resolves: rhbz#1381754
  - Resolves: rhbz#1474428
  - Resolves: rhbz#1499217
  - Resolves: rhbz#1508373


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.18-5
changelog:
  - Properly clean up primitive inside bundle
  - Scalability improvements
  - Resolves: rhbz#1499217
  - Resolves: rhbz#1508373


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.18-6
changelog:
  - Rebase to upstream 2b07d5c5a908998891c3317faa30328c108d3a91 (1.1.18)
  - If on-fail=ignore, migration-threshold should also be ignored
  - Resolves: rhbz#1474428
  - Resolves: rhbz#1507344


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.18-7
changelog:
  - Avoid node attribute write delay when corosync.conf has only IP addresses
  - Fix regressions in "pcs resource cleanup" behavior
  - Restore ordering of unfencing before fence device starts
  - Ensure --wait options work when bundles are in use
  - Fix possible invalid transition with bundle ordering constraints
  - Resolves: rhbz#1454960
  - Resolves: rhbz#1508350
  - Resolves: rhbz#1517796
  - Resolves: rhbz#1519812
  - Resolves: rhbz#1522822


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.18-10
changelog:
  - Always trigger transition when quorum changes
  - Match clone names correctly with crm_resource --cleanup
  - Fix pcs resource --wait timeout when bundles are used
  - Observe colocation constraints correctly with bundles in master role
  - Resolves: rhbz#1464068
  - Resolves: rhbz#1508350
  - Resolves: rhbz#1519812
  - Resolves: rhbz#1527072


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.18-11.1
changelog:
  - Do not schedule notifications for unrunnable actions
  - Do not expire remote failures if fencing is pending
  - Do not consider attribute order difference as CIB change in crm_diff
  - Resolves: rhbz#1563345
  - Resolves: rhbz#1566533
  - Resolves: rhbz#1568720


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.18-11.3
changelog:
  - Fix regression in handling of mixed-case node names
  - Avoid multiple recovery of stonith devices
  - Resolves: rhbz#1583747
  - Resolves: rhbz#1585741


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.19-1
changelog:
  - Rebase to upstream 29ac12ad21f73524f69c0580798e07cdf1fe3fa0 (1.1.19-rc1)
  - Allow crm_node to work on Pacemaker Remote nodes
  - Implement new --validate option to stonith_admin
  - Support .path, .mount, and .timer systemd unit files as resources
  - Handle INFINITY fail count correctly in crm_failcount
  - Resolves: rhbz#1374175
  - Resolves: rhbz#1434936
  - Resolves: rhbz#1562255
  - Resolves: rhbz#1590483
  - Resolves: rhbz#1591045


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.19-2
changelog:
  - Ensure resource agent meta-data actions can get local node name
  - Do not record pending clone notifications in CIB
  - Resolves: rhbz#1374175
  - Resolves: rhbz#1570130


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.19-4
changelog:
  - Fix srpm build on ppc64le systems with libservicelog-devel, OpenIPMI-devel
  - Resolves: rhbz#1478451


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.19-7
changelog:
  - Shutdown corosync locally if fenced
  - Count start failure once
  - Resolves: rhbz#1448221
  - Resolves: rhbz#1549576


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.19-8.1
changelog:
  - Route remote clone notifications through correct cluster node
  - Allow clean-up of managed guest nodes and bundle nodes
  - Allow use of guest nodes and bundles in clusters with sbd fencing
  - Resolves: rhbz#1646347
  - Resolves: rhbz#1646350
  - Resolves: rhbz#1646872


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.19-8.3
changelog:
  - Fix regression in crm_resource --refresh
  - Order resource moves after remote connection starts
  - Resolves: rhbz#1664242
  - Resolves: rhbz#1664243


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.18-12
changelog:
  - Pull in latest fixes from upstream 1.1 branch
  - Build for aarch64
  - Resolves: rhbz#1422602
  - Resolves: rhbz#1463015
  - Resolves: rhbz#1469255
  - Resolves: rhbz#1519379
  - Resolves: rhbz#1543278
  - Resolves: rhbz#1545449
  - Resolves: rhbz#1550829
  - Resolves: rhbz#1561617
  - Resolves: rhbz#1562255
  - Resolves: rhbz#1565187
  - Resolves: rhbz#1568593
  - Resolves: rhbz#1570130


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.18-13
changelog:
  - Pull latest upstream 1.1 branch fixes
  - Resolves: rhbz#1478451
  - Resolves: rhbz#1501505
  - Resolves: rhbz#1514492
  - Resolves: rhbz#1550829
  - Resolves: rhbz#1564536
  - Resolves: rhbz#1576148
  - Resolves: rhbz#1577300


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.20-1
changelog:
  - pcs status now shows when a standby node still has active resources
  - Allow clean-up of guest nodes and bundles without unmanaging first
  - pcs status now shows pending and failed fence actions by default
  - Improve pcs status display when disconnected from cluster
  - Ensure node attributes are recorded if attrd writer is shutting down
  - Synchronize fencing history across all nodes
  - Add stonith_admin option to clear fencing history
  - Don't schedule unneeded bundle actions when connection is on different node
  - Allow use of sbd in clusters with guest nodes and bundles
  - Schedule bundle clone notifications correctly when connection is moving
  - Rebase on upstream 1.1.20-rc1 version
  - Avoid unneeded resource restarts when remote connection fails to start
  - Allow crm_resource --move to work when a previous move had a lifetime
  - Wait for all replies when refreshing a resource
  - Don't schedule clone notifications for a stopped bundle
  - Allow option to crm_resource --clear to clear only expired constraints
  - Fix result reporting when cleanup is done while an operation is in-flight
  - Resolves: rhbz#1419548
  - Resolves: rhbz#1448467
  - Resolves: rhbz#1461964
  - Resolves: rhbz#1486869
  - Resolves: rhbz#1535221
  - Resolves: rhbz#1555938
  - Resolves: rhbz#1595422
  - Resolves: rhbz#1627948
  - Resolves: rhbz#1638593
  - Resolves: rhbz#1644076
  - Resolves: rhbz#1644864
  - Resolves: rhbz#1648507
  - Resolves: rhbz#1648620
  - Resolves: rhbz#1652053
  - Resolves: rhbz#1652752
  - Resolves: rhbz#1658650
  - Resolves: rhbz#1665343


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.20-2
changelog:
  - Assume unprivileged ACL if unable to get user information from host
  - Delay 2 seconds before re-attempting a failed node attribute write
  - SNMP alert sample script now sends all OIDs with every alert
  - Recover dependent resources correctly with asymmetric ordering
  - Rebase on upstream 1.1.20 final version
  - Resolves: rhbz#1596125
  - Resolves: rhbz#1597695
  - Resolves: rhbz#1608979
  - Resolves: rhbz#1628966
  - Resolves: rhbz#1644864


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.20-3
changelog:
  - Support more than 64KB of fence agent output
  - Avoid unnecessary recovery of group member
  - Improve IPC clients' authentication of servers (CVE-2018-16877)
  - Improve pacemakerd authentication of running subdaemons (CVE-2018-16878)
  - Fix use-after-free with potential information disclosure (CVE-2019-3885)
  - Resolves: rhbz#1549366
  - Resolves: rhbz#1609453
  - Resolves: rhbz#1694556
  - Resolves: rhbz#1694559
  - Resolves: rhbz#1694907


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.20-4
changelog:
  - Update security patches
  - Resolves: rhbz#1694556
  - Resolves: rhbz#1694559
  - Resolves: rhbz#1694907


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.21-1
changelog:
  - Recover from quiesced DC disk
  - Avoid timeouts and excessive stonithd CPU usage at start-up in large clusters
  - Default serialized order constraints to symmetrical=false
  - Avoid fence loops due to incorrect Pacemaker Remote ordering
  - Default concurrent-fencing to true
  - Harden GnuTLS priorities
  - Rebase on upstream 1.1.21 final version
  - Resolves: rhbz#1596125
  - Resolves: rhbz#1625671
  - Resolves: rhbz#1672225
  - Resolves: rhbz#1704870
  - Resolves: rhbz#1710422
  - Resolves: rhbz#1727280
  - Resolves: rhbz#1731189


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.21-3
changelog:
  - Avoid invalid transition when guest node's host is unclean but can't be fenced
  - Resolves: rhbz#1755659


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.22-1
changelog:
  - Show correct disabled resource count in status display
  - Run-time option for Pacemaker Remote bind address
  - Avoid restart loop when migration is left dangling
  - Improve help for clean-up option
  - Do not overweight group colocation scores
  - Rebase on upstream 1.1.22+63d2d79
  - Resolves: rhbz#1458953
  - Resolves: rhbz#1743373
  - Resolves: rhbz#1757951
  - Resolves: rhbz#1758969
  - Resolves: rhbz#1760669
  - Resolves: rhbz#1792492


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.23-1
changelog:
  - Improve help for clean-up option
  - Avoid pending DC fencing getting "stuck" in status display
  - Rebase on upstream 1.1.23-rc1
  - Resolves: rhbz#1758969
  - Resolves: rhbz#1787749
  - Resolves: rhbz#1792492


author: Tomáš Mráz <tmraz@redhat.com> 1.1.8-7
changelog:
  - rename the 90-nproc.conf to 20-nproc.conf (#1071618)
  - canonicalize user name in pam_selinux (#1071010)


author: Tomáš Mráz <tmraz@redhat.com> 1.1.8-9
changelog:
  - fix CVE-2014-2583: potential path traversal issue in pam_timestamp
  - pam_pwhistory: call the helper if SELinux enabled


author: Tomáš Mráz <tmraz@redhat.com> 1.1.8-11
changelog:
  - be tolerant to corrupted opasswd file
  - audit the module names that granted access
  - pam_userdb: correct the example in man page (#1078784)
  - pam_limits: check whether the utmp login entry is valid (#1080023)
  - pam_console_apply: do not print error if console.perms.d is empty
  - pam_limits: nofile refers to open file descriptors (#1111220)
  - apply PIE and full RELRO to all binaries built


author: Tomáš Mráz <tmraz@redhat.com> 1.1.8-14
changelog:
  - pam_unix: add no_pass_expiry option for ignoring password
    expiration in crond and sshd with public key authentication
  - add manual page for environment(5) (#1110257)
  - pam_loginuid: log if auditd not detected
  - always ignore audit error when -EPERM is returned (#1287800)
  - pam_lastlog: fix possible NULL dereference when localtime fails (#1313537)


author: Tomáš Mráz <tmraz@redhat.com> 1.1.8-19
changelog:
  - pam_access: (group) match syntax is prioritized over network@netgroup
    match (#1358881), add support for additional /etc/security/access.d/*.conf
    files, improve documentation (#1421735)
  - pam_lastlog: fix pt_BR translation (#1185697)
  - pam_faillock: support admin_group with users equivalent to root in
    faillock handling (#1285550)


author: Tomáš Mráz <tmraz@redhat.com> 1.1.8-23
changelog:
  - pam_get_authtok_verify: ensure no double verification happens
  - manual page fixes for pam_tty_audit and pam_wheel
  - pam_unix: lower the excessive maximum number of closed fd descriptors
    when spawning handlers
  - pam_loginuid: do not prevent login in unprivileged containers


author: Nalin Dahyabhai <nalin@redhat.com> - 2.4.5-1
changelog:
  - update to 2.4.5
    - handle non-unique ccname templates
  - switch to a non-unique default ccname template on newer releases


author: Nalin Dahyabhai <nalin@redhat.com> - 2.4.6-1
changelog:
  - handle ccache creation correctly for users who are mapped to principal
    names in realms other than the default (#999604)


author: Nalin Dahyabhai <nalin@redhat.com> - 2.4.7-1
changelog:
  - drop some no-longer-necessary code to cede ownership of keyring ccaches
    to an unprivileged user at login-time to work better with upcoming changes
    to libkrb5's keyring ccache support (libkrb5: #991148, this one's #1005376)
  - if we don't have a ccname_template, if we're built against a libkrb5 that
    provides interfaces for reading its configuration files, try to read the
    default_ccache_name value from the [libdefaults] section before falling
    back to the default we've set at compile-time (#more of #1005376)
  - stop specifying a default ccache location at compile-time on F21 and later,
    to make our unconfigured default better line up with libkrb5's unconfigured
    default


author: Nalin Dahyabhai <nalin@redhat.com> - 2.4.8-4
changelog:
  - fix to only prompt for passwords when obtaining credentials for performing
    password changes by toggling the subsequent_prompt default to off when
    called to perform a password change (#1063933)


author: Bob Relyea <rrelyea@redhat.com> - 0.6.2-14
changelog:
  - Install into /usr/lib/system rather then /lib/system (rpmdiff error)
  - Fix coverity issues
  - Silence coverity warnings


author: Bob Relyea <rrelyea@redhat.com> - 0.6.2-14
changelog:
  - Install into /usr/lib64/system rather then /lib64/system (rpmdiff error)
  - Fix coverity issues
  - Silence coverity warnings


author: Bob Relyea <rrelyea@redhat.com> 0.6.2-22
changelog:
  - Don't rebuild documentation for each platform. Doing so creates unique 
  document files which are shared and conflict on multilib installations.


author: Bob Relyea <rrelyea@redhat.com> 0.6.2.29
changelog:
  - Coverity and compilier warning fixes
  - Use the PKIX validator
  - Fix crash when ldap connection fails and debugging is enabled.


author: Akira TAGOH <tagoh@redhat.com> - 1.34.1-2
changelog:
  - Fix duplicate file list for modules.cache
  - s/%define/%global/g
  - Fix bogus date in %changelog
  - Do not suppress the detailed build log.


author: William Cohen <wcohen@redhat.com> - 5.2.0-7
changelog:
  - Update papi presets for Intel processors. Resolves rhbz1126090 
  - Eliminate some errors found by coverity. Releated rhbz1057778


author: William Cohen <wcohen@redhat.com> - 5.2.0-15
changelog:
  - Update papi L1 cache events on POWER7
  - Prevent papi-testsuite segfaults
  - Identify kernels that support rdpmc
  - Correct papi-testsuite byte_profile and sprofile tests on ppc64le
  - Update PAPI_L1_TCM event on Haswells


author: William Cohen <wcohen@redhat.com> - 5.2.0-25
changelog:
  - Update IBM Power 9 events. rhbz1510684
  - Make lmsensor dynamically size internal array. rhbz1510497


author: William Cohen <wcohen@redhat.com> - 5.1.1-5
changelog:
  - rhbz986673 - /usr/lib64/libpapi.so is unowned
  - Package files in /usr/share/papi only once.
  - Avoid dependency problem with parallel make of man pages.


author: Akira TAGOH <tagoh@redhat.com> - 0.6.8-23
changelog:
  - the spec file cleanup
  - Fix the undefined symbol issue in libpaps.so.0
  - Correct FSF address in the COPYING.LIB


author: Brian C. Lane <bcl@redhat.com> 3.1-8
changelog:
  - change partition UUID to use partX-UUID (#858704)
  - fixup losetup usage in tests
  - add support for implicit FBA DASD partitions (#707027)
  - add support for EAV DASD partitions (#707032)


author: Brian C. Lane <bcl@redhat.com> 3.1-10
changelog:
  - libparted: mklabel to support EAV DASD (#707032)
  - libparted: Avoid dasd as default disk type while probe (#707032)


author: Brian C. Lane <bcl@redhat.com> 3.1-13
changelog:
  - libparted: Recognize btrfs filesystem (#857101)
  - tests: Add btrfs and xfs to the fs probe test (#857101)


author: Brian C. Lane <bcl@redhat.com> 3.1-16
changelog:
  - tests: Remove rmmod loop from t8001
    Resolves: rhbz#1040504
  - tests: Increase size of container filesystem in t4100
    Resolves: rhbz#1036149
  - tests: Disable t4100 dvh test for now
    Resolves: rhbz#1036093
  - libparted: Make sure not to treat percentages as exact
    Resolves: rhbz#1045957
  - tests: Use mkfs.xfs to create files
    Resolves: rhbz#1036152


author: Brian C. Lane <bcl@redhat.com> 3.1-18
changelog:
  - Fix manpage NAME so whatis works with parted
    Resolves: rhbz#948424
  - GPT add support for PReP GUID
    Resolves: rhbz#1108196


author: Brian C. Lane <bcl@redhat.com> 3.1-21
changelog:
  - Backport fix for 1 sector logical partition separation from start of extended
    Resolves: rhbz#1212323


author: Brian C. Lane <bcl@redhat.com> 3.1-22
changelog:
  - Use 512b sector size when communicating with device-mapper
    Resolves: rhbz#1188431
  - Add a test to make sure partitions are the correct size on device-mapper
    Related: rhbz#1188431


author: Brian C. Lane <bcl@redhat.com> 3.1-23
changelog:
  - libparted: Use read only when probing devices on linux
    Resolves: rhbz#1245144
  - tests: Use wait_for_dev_to_ functions
    Related: rhbz#1245144


author: Brian C. Lane <bcl@redhat.com> 3.1-24
changelog:
  - tests: Add udevadm settle to wait_for_ loop
    Related: rhbz#1260664
  - tests: Add-wait-to-t9042
    Resolves: rhbz#1257415
  - tests: Fix t1700 failing on a host with a 4k xfs file
    Related: rhbz#1260664


author: Brian C. Lane <bcl@redhat.com> 3.1-25
changelog:
  - docs: Add list of filesystems for fs-type
    Resolves: rhbz#1311596
  - libparted: Remove fdasd geometry code from alloc_metadata
    Resolves: rhbz#1244833


author: Brian C. Lane <bcl@redhat.com> - 3.1-29
changelog:
  - Add support for NVMe devices
    Resolves: rhbz#1316239
  - Backport partition resize command
    Resolves: rhbz#1423357


author: Brian C. Lane <bcl@redhat.com> - 3.1-30
changelog:
  - partprobe: always close dev when probing disks
    Resolves: rhbz#1551411
  - tests: Add t4201 to test partprobe with 1025 devices
    Related: rhbz#1551411


author: Brian C. Lane <bcl@redhat.com> - 3.1-31
changelog:
  - Backport patches for dasd on virtio
    fdasd: geometry handling updated from upstream s390-tools
    dasd: enhance device probing
    parted: fix build error on s390
    fdasd.c: Safeguard against geometry misprobing
    Resolves: rhbz#1676604
  - Add part-label documentation to mkpart command
    Resolves: rhbz#1686659


author: Tomas Mraz <tmraz@redhat.com> 0.78.99-1
changelog:
  - use better (auditable) libselinux calls for checking
    the access to passwd (#518268)
  - add support for the -e option as seen on Debian passwd
  - make the binary PIE and full RELRO (#784483)


author: Jiri Kucera <jkucera@redhat.com> - 0.79-5
changelog:
  - Backport ca46cac (allow passwords longer than 79 characters)
    Backport Steve Grubb's patches
    - stop double auditing, use appropriate record types, update op field in
      audit events, don't audit status check, fix password aging logging
    Backport 02d4478 (better document -S option)
    Fix URL and Source tags
    Resolves: #1276570, #1489086, #1638105, #1145256, #1472567


author: Than Ngo <than@redhat.com> - 2.7.1-11
changelog:
  - Fixed CVE-2016-10713 - Out-of-bounds access in pch_write_line function 
  - Fixed CVE-2018-6952 - Double free of memory
  - Resolves: #1626473, honor new file mode 100755 when applying patches
  - Resolves: #1653294, Added virtual provides for bundled gnulib library


author: Tim Waugh <twaugh@redhat.com> 2.7-1
changelog:
  - 2.7.  No longer need sigsegv, get-arg, CVE-2010-4651,
    backup-if-mismatch or coverity-leak patches.


author: Hans de Goede <hdegoede@redhat.com> - 2.0-8
changelog:
  - Add a patch fixing various crashes due to referencing freed memory (#1133339)
  - Cherry-pick some other fixes from upstream git


author: Kalev Lember <kalevlember@gmail.com> - 3.0-1
changelog:
  - Update to 3.0
  - Use license macro for the LICENCE file
  - Use desktop-file-validate instead of desktop-file-install


author: Nathan Scott <nathans@redhat.com> - 3.9.10-7
changelog:
  - Tackle bugs and test failures found by QE (BZ 1161515)
  - Resolve pcp web packaging issues, regression (BZ 1163560)


author: Dave Brolley <brolley@redhat.com> - 3.10.5-2
changelog:
  - Update to latest PCP sources (BZ 1200584)
  - Support for per-containtainer cgroup metrics (BZ 1121218)
  - Allow pmlogger/pmie start when not chkconfig on (BZ 1186012)
  - No pmlogger_daily messages when not chkconfig on (BZ 1208699)
  - Fix pmdamounts potential stack corruption (BZ 1213833)
  - Tackle numerous testsuite issues on aarch64 (BZ 1190680)
  - Tackle numerous testsuite issues on ppc64le (BZ 1194244)
  - Allow pmlogger to run in local context mode (BZ 1129539)
  - Deprecate hinv.map.lvname for hinv.map.dmname (BZ 1109539)


author: Dave Brolley <brolley@redhat.com> - 3.10.5-3
changelog:
  - Update with missing package dependency for pmda-lustrecomm.
  - Rebuild to pickup bintils fix (BZ 1238469)


author: Nathan Scott <nathans@redhat.com> - 3.10.6-1
changelog:
  - Export the softnet_stat kernel networking metrics (BZ 1190912)
  - Latest upstream PCP, dropping all earlier patches (BZ 1200584)
  - Re-enable the pcp-pmda-jsonpointer package build (BZ 1238134)
  - Fix failing test cases and bugs from Red Hat QE (BZ 1241591)
  - pcp2graphite support for exporting from archives (BZ 1242622)
  - Remove percpu interrupt metrics from default set (BZ 1243809)
  - pcp-collector meta-package enables pmcd+pmlogger (BZ 1249090)


author: Nathan Scott <nathans@redhat.com> - 3.10.6-2
changelog:
  - Fixes targetting several QE reported test failures (BZ 1241591)
  - Remove tool-specific interval settings for pmlogconf (BZ 1243809)


author: Nathan Scott <nathans@redhat.com> - 3.11.2-1
changelog:
  - Improve PMAPI python clients signal handling (BZ 1238550)
  - Fix issues in postfix PMDA search for mail log (BZ 1252308)
  - Fix local_sock() souble free error in perl API (BZ 1258860)
  - Fix sigsegv in pcp-uptime(1) --archive option (BZ 1262721)
  - Update to current stable PCP version (BZ 1284307)
  - Fix pcp-compat dependency drawing in many packages (BZ 1293466)
  - Support for per-processor softnet kernel metrics (BZ 1316085)
  - Fix GFS2 PMDA Install script PMNS parsing error (BZ 1320591)
  - Report Docker version 1.10+ container information (BZ 1327737)


author: Nathan Scott <nathans@redhat.com> - 3.11.3-1
changelog:
  - Latest upstream PCP, dropping all earlier patches (BZ 1284307)
  - Minimal package dependencies for PMAPI applications (BZ 1298993)
  - Resolve perl Net:SNMP pmdasnmp dependency problem (BZ 1332624)
  - Improve time taken to detect pmcd startup failure (BZ 1336210)
  - Fix cron service stopping disabled pmie/pmlogger (BZ 1336792)
  - Fix instance domain handling in derived metrics (BZ 1337212)
  - Include latest Oracle database PMDA enhancements (BZ 1340430)
  - Workaround valgrind failure for pmmgr test case (BZ 1343319)


author: Nathan Scott <nathans@redhat.com> - 3.11.3-3
changelog:
  - Install the missing /etc/pcp/nssdb directory (BZ 1360206)
  - pcp-pmda-ds389 requires perl-LDAP dependency (BZ 1357605)
  - Switch pcp-pmda-ds389log to the dirsrv user (BZ 1357607)
  - pcp-pmda-ds389log requires perl-Date-Manip (BZ 1354055)
  - Remove multi-archive loglabel timezone check (BZ 1351223)


author: Nathan Scott <nathans@redhat.com> - 3.8.10-1
changelog:
  - Add symbol-versioning for PCP shared libraries (BZ 1037771)
  - Fix pmcd/Avahi interaction with multiple ports (BZ 1035513)
  - Confine set of exported symbols from DSO PMDAs (BZ 1025694)
  - Ensure pcpqa user created by pcp-testsuite rpm (BZ 1025688)
  - Remove empty pmlogger configuration directory (BZ 1025599)
  - Resolve warning messages from pcp rpm scripts (BZ 1025587)
  - Remove world-writeable private temp directory (BZ 1025583)
  - Tackle remaining failing pcp-testsuite cases (BZ 987086)
  - Update to latest PCP sources.


author: Nathan Scott <nathans@redhat.com> - 3.8.10-2
changelog:
  - Fix pmdalinux failure on unexpected ICMP types (BZ 1055826)
  - Add man pages for all of the PMDAs missing out (BZ 1053094)


author: Nathan Scott <nathans@redhat.com> - 3.8.10-5
changelog:
  - Resolve pmdammv induced pmcd segv during tests (BZ 1061330)
  - Fix python-pcp time API wrapper implementation (BZ 1062467)


author: Nathan Scott <nathans@redhat.com> - 3.8.10-6
changelog:
  - Added missing qualified output for test qa/844 (BZ 1064311)
  - Fix pmdalinux memory corruption issue on s390x (BZ 1064254)
  - PMDA installation works without a running pmcd (BZ 1062443)
  - Fix some more issues in pcpqa account creation (BZ 1025688)


author: Nathan Scott <nathans@redhat.com> - 3.8.10-7
changelog:
  - Fix a handful of QE-found test-induced failures (BZ 987086)
  - Multilib packaging support for libs and devel (BZ 1059642)


author: Lukas Berk <lberk@redhat.com> - 3.12.2-5
changelog:
  - Correction to spec file and selinux policy (BZ 1488116)
  - Show all perfevent metrics in pcpatop (BZ 1525864)
  - Multilib corrections (BZ 1537623)


author: Nathan Scott <nathans@redhat.com> - 4.0.2-1
changelog:
  - Ensure sans font dependency resolved for webapps (BZ 1568109)
  - Ensure sans font dependency resolved for pmchart (BZ 1546640)
  - Update to latest PCP sources (BZ 1565370).


author: Nathan Scott <nathans@redhat.com> - 4.0.2-3
changelog:
  - Resolve rpm verification problem on /var/run/pcp (BZ 1533154)
  - Fix device mapper PMDA histogram metrics sigsegv (BZ 1569854)
  - Fix pmlogger_daily log rotation open port issue (BZ 1579881)


author: Nathan Scott <nathans@redhat.com> - 4.3.2-1
changelog:
  - Numerous fixes in pmlogger daily scripts (BZs 1677848, 1697182, 1579881, 1603143)
  - Update PCP selinux policy rules (BZs 1692305, 1695066)
  - Adjust spec file /var/run/pcp settings (BZ 1533154)
  - Fix pmdaproc kernel process misreporting (BZ 1673250)
  - Fix pmdalinux SYSV IPC metric scalability (BZ 1699232)
  - Ensure pmdaroot reaps all of its children (BZ 1698517)
  - Corrections to python version dependencies (BZ 1676867)
  - Fix pcp-atopsar(1) -A (all) option handling (BZ 1673996)
  - Update to a more recent PCP bug fix release (BZ 1647308)


author: Nathan Scott <nathans@redhat.com> - 4.3.2-2
changelog:
  - Rework the pcp-libs ldconfig post-op (BZ 1705362)
  - Resolve a QA file permissions diagnostic issue


author: Nathan Scott <nathans@redhat.com> - 4.3.2-4
changelog:
  - Fix a pmdaproc memory leak (BZ 1721107)
  - Rebuild with selinux runtime dependency update (BZ 1714101)
  - Update selinux-policy to latest upstream (BZs 1699830, 1700989)


author: Nathan Scott <nathans@redhat.com> - 4.3.2-7
changelog:
  - Fix hugepage metrics in pmdalinux (BZ 1730107)
  - Fix NUMA nodes instance domain in pmdalinux (BZ 1730492)
  - Several selinux policy fixes (BZs 1749870, 1756252, 1760750)
  - Fix pcp-atopsar sample count command line argument (BZ 1764748)
  - Fix pcp-atop sigsegv with certain process state changes (BZ 1765641)
  - Add pcp-zeroconf pmieconf rule to enable per-thread logging (BZ 1775373)


author: Nathan Scott <nathans@redhat.com> - 4.3.2-8
changelog:
  - Fix rpm %post privilege escalation CVEs (BZs 1815249, 1815528)
  - Resolve an selinux policy issue with pmlogger (BZ 1792859)


author: Nathan Scott <nathans@redhat.com> - 4.3.2-13
changelog:
  - Fix pcp-atopsar memory allocation problem with some options (BZ 1857580)
  - Fix __pmGetArchiveEnd_ctx sigsegv with corrupt PCP archives (BZ 1878754)


author: Nathan Scott <nathans@redhat.com> - 1.5.8-2
changelog:
  - Update to latest PCP GUI sources.
  - Build fix when building against older PCP headers.
  - Force PCP_PMSNAPCONTROL_PATH to the preferred location.


author: Nathan Scott <nathans@redhat.com> - 1.5.9-1
changelog:
  - Fix problems with pmchart Samples/Visible History (BZ 968825)
  - Fix pmchart startup handling lack of metrics source (BZ 957007)
  - Fix missing metric handling for archive View files (BZ 981140)
  - UX improvements for the New/Edit Chart Apply button (BZ 957669)
  - Resolve packaging issue where /usr/bin was installed (BZ 988176)
  - Improve pmchart show-/hide-time-control mechanism (BZ 957002)
  - Add a close button to pmchart Preferences dialog (BZ 922198)
  - Fix pmchart Preferences dialog color scheme sigsegv (BZ 963505)


author: Nathan Scott <nathans@redhat.com> - 1.5.10-1
changelog:
  - Updates to the PCP Users and Administrators Guide.
  - Updates to the PCP Programmers Guide.
  - Install a known-good pdf version of each book (BZ 990303).
  - Improve pmchart hostname reporting via pmGetContextHostName.


author: Nathan Scott <nathans@redhat.com> - 1.5.11-1
changelog:
  - Updates to the PCP Programmers Guide.
  - Fix pmchart value/units reporting issue on chart selection.


author: Petr Pisar <ppisar@redhat.com> - 8.32-4
changelog:
  - Fix forward search in JIT when link size is 3 or greater
  - Fix buffer over-read in UTF-16 and UTF-32 modes with JIT


author: Petr Pisar <ppisar@redhat.com> - 8.32-5
changelog:
  - Fix bad handling of empty lines in pcregrep tool (bug #961789)
  - Fix possible pcretest crash with a data line longer than 65536 bytes


author: Petr Pisar <ppisar@redhat.com> - 8.32-13
changelog:
  - Disable unsupported JIT mode on little-endian 64-bit PowerPC platform
    (bug #1125642)
  - Raise optimization level to 3 on little-endian 64-bit PowerPC (bug #1123498)


author: Petr Pisar <ppisar@redhat.com> - 8.32-15
changelog:
  - Fix compiling expression where start-anchored character with more than one
    other case follows circumflex in multiline UTF mode (bug #1110621)
  - Fix character class with a literal quotation (bug #1111091)
  - Fix empty-matching possessive zero-repeat groups in interpreted mode
    (bug #1119320)
  - Fix compiler crash for zero-repeated groups with a recursive back reference
    (bug #1119356)
  - Reset non-matched groups within capturing group up to forced match
    (bug #1161597)
  - Fix static linking (bug #1217111)
  - Package pcredemo.c as a documentation for pcre-devel (bug #1217118)


author: Petr Pisar <ppisar@redhat.com> - 8.32-15.1
changelog:
  - Fix CVE-2015-2328 (infinite recursion compiling pattern with recursive
    reference in a group with indefinite repeat) (bug #1330508)
  - Fix CVE-2015-8385 (buffer overflow caused by named forward reference to
    duplicate group number) (bug #1330508)
  - Fix CVE-2015-8386 (buffer overflow caused by lookbehind assertion)
    (bug #1330508)
  - Fix CVE-2015-3217 (stack overflow caused by mishandled group empty match)
    (bug #1330508)
  - Fix CVE-2015-5073 and CVE-2015-8388 (buffer overflow for forward reference
    within backward assertion with excess closing parenthesis) (bug #1330508)
  - Fix CVE-2015-8391 (inefficient posix character class syntax check)
    (bug #1330508)
  - Fix CVE-2016-3191 (workspace overflow for (*ACCEPT) with deeply nested
    parentheses) (bug #1330508)


author: Petr Pisar <ppisar@redhat.com> - 8.32-16
changelog:
  - Fix CVE-2015-2328 (infinite recursion compiling pattern with recursive
    reference in a group with indefinite repeat) (bug #1330509)
  - Fix CVE-2015-8385 (buffer overflow caused by named forward reference to
    duplicate group number) (bug #1330509)
  - Fix CVE-2015-8386 (buffer overflow caused by lookbehind assertion)
    (bug #1330509)
  - Fix CVE-2015-3217 (stack overflow caused by mishandled group empty match)
    (bug #1330509)
  - Fix CVE-2015-5073 and CVE-2015-8388 (buffer overflow for forward reference
    within backward assertion with excess closing parenthesis) (bug #1330509)
  - Fix CVE-2015-8391 (inefficient posix character class syntax check)
    (bug #1330509)
  - Fix CVE-2016-3191 (workspace overflow for (*ACCEPT) with deeply nested
    parentheses) (bug #1330509)


author: Petr Pisar <ppisar@redhat.com> - 8.32-17
changelog:
  - Let [:graph:], [:print:], and [:punct:] POSIX classes to handle Unicode
    characters in UCP mode to match Perl behavior (bug #1400267)
  - Fix matching Unicode ranges in JIT mode (bug #1402288)


author: Chris Feist <cfeist@redhat.com> - 0.9.115-24
changelog:
  - Added support for meta attributes in the GUI
  - Moved pcmk_host_list/map/check to optional arguments


author: Chris Feist <cfeist@redhat.com> - 0.9.115-26
changelog:
  - Fixed dialog text when removing a fence device
  - Show tool tips for optional fence agent arguments
  - Fix bad link on resource remove sprite
  - When removing a resource or fence device, show blank info
  - Fix resource management issues when pacemaker is not running
  - If first node is down, allow other nodes to show resource/stonith forms
  - Removing all nodes, now removes cluster configuration
  - Added ability to see nodes corosync/pacemaker/pcsd startup settings
  - Added extra colspan to improve long cluster name display
  - Added ability to configure IPv6 cluster
  - Added ability to set corosync transport in GUI
  - Added ability to set advanced cluster options on creation
  - Renamed last_node_standing to last_man_standing
  - On cluster creation color unauthorized nodes in orange
  - Added proper redirect when session variable times out
  - Fixed traceback when missing authentication tokens


author: Chris Feist <cfeist@redhat.com> - 0.9.115-28
changelog:
  - Remove leading/trailing white space in resource descriptions
  - Added tooltips for advanced cluster creation options
  - Fixed other 'Remove fence devices' button
  - When deleting a resource with pcsd use --force to prevent issues
  - Add proper tooltip for resource description info icon
  - Fix for long cluster names in menu
  - Do a better job of detecting when to send a redirect and when to notif
  - Don't silently ignore bad operation names


author: Chris Feist <cfeist@redhat.com> - 0.9.115-29
changelog:
  - Don't allow users to clone groups that have already been cloned
  - Fix order remove <resource> to remove resources from sets
  - Don't allow a user to force-start a group, clone or master/slave
  - When using debug-start use proper return code
  - Added cluster properties hover text
  - Fixed issue with stripping a nil value
  - HTML escape resource descriptions


author: Chris Feist <cfeist@redhat.com> - 0.9.115-30
changelog:
  - Fix traceback with bad arguments to location rules
  - Fix results code when attempting to remove an order that doesn't exist


author: Tomas Jelinek <tojeline@redhat.com> - 0.9.143-7
changelog:
  - Multiple fixes in web UI
  - Fixed crash on missing nagios agents metadata
  - Check user/group membership on each request
  - Print output of crm_resource in pcs resource cleanup
  - Resolves: #rhbz1158571 #rhbz1189857 #rhbz1235022 #rhbz1257369


author: Tomas Jelinek <tojeline@redhat.com> - 0.9.143-8
changelog:
  - Fixes in loading cluster status for web UI
  - Fixed checking user/group membership
  - Fixed a typo in an error message
  - Resolves: #rhbz1158566 #rhbz1158569 #rhbz1158571


author: Tomas Jelinek <tojeline@redhat.com> - 0.9.143-9
changelog:
  - Multiple fixes in web UI (dashboard, nodes, resources, fence devices)
  - Fixed an authentication issue in web UI
  - Port parameter of fence agents is now considered optional
  - Resolves: rhbz#1158566 rhbz#1188361 rhbz#1189857


author: Tomas Jelinek <tojeline@redhat.com> - 0.9.143-10
changelog:
  - Web UI fixes
  - Added more detailed warnings for 'pcs stonith confirm'
  - Resolves: rhbz#1189857 rhbz#1245264


author: Chris Feist <cfeist@redhat.com> - 0.9.143-12
changelog:
  - Fixed issue managing resources that were clones and had the unmanaged
    meta attribute set under the clone/master
  - Resolves: rhbz#1268801


author: Chris Feist <cfeist@redhat.com> - 0.9.143-14
changelog:
  - Fixed remaining issues when managing resources/groups/etc. that were
    previously unmanaged
  - Resolves: rhbz#1268801


author: Tomas Jelinek <tojeline@redhat.com> - 0.9.143-5
changelog:
  - Fixed pcsd certificates synchronization
  - Multiple fixes in web UI
  - Resolves: #rhbz1158566 #rhbz1158577 #rhbz1189857


author: Ivan Devat <idevat@redhat.com> - 0.9.152-3
changelog:
  - Added support for pacemaker alerts
  - Added support for qdevice/qnetd provided by corosync
  - Fixed sbd calls on python3
  - Fixed bad request when resource removal takes longer than pcs expects
  - Added support for set expected votes on a live cluster
  - Added a wrapper for holding SELinux context when pcsd is started by systemd
  - Resolves: rhbz#1315371 rhbz#1158805 rhbz#1164402 rhbz#1346852 rhbz#1327739 rhbz#1348579 rhbz#1349465


author: Ivan Devat <idevat@redhat.com> - 0.9.152-4
changelog:
  - Added colocation constraint support in web UI
  - Fixed displaying cluster config when cib is provided as a file
  - Removed side effect on /etc/hosts during build
  - Recipient id is used as identifier in alarms
  - Improved quorum device commands syntax
  - Fixed pcs client for running on a remote node
  - Resolves: rhbz#1281364 rhbz#1269242 rhbz#1353607 rhbz#1315371 rhbz#1158805 rhbz#1289418


author: Ivan Devat <idevat@redhat.com> - 0.9.152-5
changelog:
  - Fixed traceback when stopping pcsd shortly after start
  - Fixed removing a dead node from a cluster
  - Added support for clufter's 'dist' parameter
  - Fixed filtering by property name in "pcs property show"
  - Fixed an error in web UI when removing resources takes a long time
  - Fixed occasional missing optional arguments of resources in web UI
  - Improved help for alerts
  - Fixed recreating a remote node resource
  - Fixed exceptions when authenticating cluster nodes
  - Fixed permissions for bash completion file
  - Resolves: rhbz#1348579 rhbz#1225423 rhbz#1357945 rhbz#1302010 rhbz#1301993 rhbz#1346852 rhbz#1231858 rhbz#1315371 rhbz#1303136 rhbz#1329472 rhbz#1359154 rhbz#1349465


author: Ivan Devat <idevat@redhat.com> - 0.9.152-6
changelog:
  - Fixed documentation regarding clufter
  - Added possibility to change order of resources in a group in web UI
  - Added support for unmanaged resources in web UI
  - Added support for booth (cluster ticket manager)
  - Resolves: rhbz#1357945 rhbz#1281391 rhbz#1264360 rhbz#1308514


author: Ivan Devat <idevat@redhat.com> - 0.9.152-7
changelog:
  - Added possibility to hide inactive resources in "pcs resource show" command
  - Fixed exceptions handling when waiting for response from user in command line
  - Fixed nonexisting resource detection in pcsd
  - Fixed SBD_WATCHDOG_TIMEOUT option value validation
  - Removed possibility to change SBD_PACEMAKER
  - Fixed exception when disabling service on systemd systems
  - Added automatic auto_tie_breaker quorum option set whenever it is needed for SBD to work
  - Fixed setting sbd watchdog in config
  - Fixed error handling when upgrading cib schema
  - Improved consistency of syntax 'pcs alert recipient add' command
  - Resolves: rhbz#1298585 rhbz#1354498 rhbz#1346852 rhbz#1164402 rhbz#1315371 rhbz#1366307


author: Ivan Devat <idevat@redhat.com> - 0.9.152-8
changelog:
  - Fixed error message in node maintenance/unmaintenance commands
  - Fixed missing line at the end of booth config 
  - Fixed documentation regarding booth
  - Fixed remove multiple booth resources with "--force" flag
  - Fixed cleanup of ip resource if it fails to create booth resource
  - Added bash completion for booth
  - Fixed display full booth configuration
  - Added ability to display booth config from remote node
  - Added support for ticket options during adding booth ticket
  - Fixed adding node to cluster when booth is not installed
  - Added restart command for booth
  - Fixed check if auto_tie_breaker is required when enabling sbd
  - Improved way of displaying status of unmanaged primitive resources in web UI
  - Resolves: rhbz#1247088 rhbz#1308514 rhbz#1164402 rhbz#1264360


author: Ivan Devat <idevat@redhat.com> - 0.9.152-9
changelog:
  - Added warning when stopping/destroying qdevice instance which is being used 
  - Fiexed removing qdevice from a cluster which uses sbd
  - Fixed re-running "pcs cluster node add" if it failed due to qdevice
  - Fixed documentation regarding booth
  - Added warning when using unknown booth ticket option
  - Added constraint ticket remove command
  - Fixed return code and message when displaying node utilization for nonexistent node
  - Fixed setting utilization attributes in web UI
  - Fixed support for node utilization on remote node
  - Fixed updating of selected group when displaying new resource dialog
  - Fixed group list when managing cluster running older pcs in web UI 
  - Fixed displaying unmanaged status for resources for older pcs in web UI
  - Fixed clone/master/unclone group/ungroup buttons for older pcs in web UI
  - Fixed node standby/unstandby for older pcs in web UI
  - Resolves: rhbz#1158805 rhbz#1308514 rhbz#1305049 rhbz#1158500 rhbz#1231858


author: Ivan Devat <idevat@redhat.com> - 0.9.152-10
changelog:
  - Fixed error when stopping qdevice if is not running
  - Fixed removing qdevice from a cluster
  - Fixed documentation regarding booth
  - Fixed return code when no matching ticket constraint found during remove
  - Resolves: rhbz#1158805 rhbz#1305049


author: Ivan Devat <idevat@redhat.com> - 0.9.158-5
changelog:
  - `pcs cluster setup` uses existing pacemaker authkey if it exists
  - `pcs resource create` shows only warning when case of remote node is detected
  - Resolves: rhbz#1459503


author: Ivan Devat <idevat@redhat.com> - 0.9.158-6
changelog:
  - It is now possible to disable, enable, unmanage and manage bundle resources and set their meta attributes
  - Fixed timeout when cluster setup takes long time in web UI
  - It is now mandatory to specify container type in the "resource bundle create" command
  - Resolves: rhbz#1447910 rhbz#1284404


author: Ivan Devat <idevat@redhat.com> - 0.9.160-1
changelog:
  - Rebased to latest upstream sources (see CHANGELOG.md)
  - Resolves: rhbz#1499749 rhbz#1443647 rhbz#1432283 rhbz#1421702 rhbz#1443418 rhbz#1464781 rhbz#1435697 rhbz#1441673 rhbz#1420437 rhbz#1388783 rhbz#1463327 rhbz#1418199 rhbz#1341582 rhbz#1489682 rhbz#1491631 rhbz#1213946


author: Ivan Devat <idevat@redhat.com> - 0.9.161-1
changelog:
  - Rebased to latest upstream sources (see CHANGELOG.md)
  - Resolves: rhbz#1499749 rhbz#1415197 rhbz#1501274 rhbz#1502715 rhbz#1230919 rhbz#1503110


author: Ondrej Mular <omular@redhat.com> - 0.9.162-1
changelog:
  - Rebased to latest upstream sources (see CHANGELOG.md)
  - Resolves: rhbz#1389943 rhbz#1389209 rhbz#1506220 rhbz#1508351 rhbz#1415197 rhbz#1506864 rhbz#1367808 rhbz#1499749


author: Ivan Devat <idevat@redhat.com> - 0.9.162-2
changelog:
  - Changed snmp agent logfile path
  - It is now possible to set the `action` option of stonith devices in GUI by using force
  - Do not crash when `--wait` is used in `pcs stonith create`
  - A warning is displayed in `pcs status` and a stonith device detail in web UI  when a stonith device has its `method` option set to `cycle`
  - Resolves: rhbz#1367808 rhbz#1421702 rhbz#1522813 rhbz#1523378


author: Ivan Devat <idevat@redhat.com> - 0.9.162-3
changelog:
  - Pcs now properly exits with code 1 when an error occurs in pcs cluster node add-remote and pcs cluster node add-guest commands
  - Fixed a crash in the pcs booth sync command
  - Resolves: rhbz#1464781 rhbz#1527530


author: Ondrej Mular <omular@redhat.com> - 0.9.162-5
changelog:
  - Fixed `pcs cluster auth` in a cluster when not authenticated and using a non-default port
  - Fixed `pcs cluster auth` in a cluster when previously authenticated using a non-default port and reauthenticating using an implicit default port
  - Resolves: rhbz#1415197


author: Ondrej Mular <omular@redhat.com> - 0.9.162-5.el7_5.1
changelog:
  - Fixed CVE-2018-1086 pcs: Debug parameter removal bypass, allowing information disclosure
  - Fixed CVE-2018-1079 pcs: Privilege escalation via authorized user malicious REST call
  - Fixed CVE-2018-1000119 rack-protection: Timing attack in authenticity_token.rb
  - Resolves: rhbz#1557253


author: EL Errata <el-errata_ww@oracle.com> - 0.9.162-5.0.3.el7_5.1
changelog:
  - Unlike RHEL we DO have corosync/pacemaker for aarch64 on EL7
  - replace logo pcsd/public/favicon.ico in tarball
  - remove Source1 HAM-logo.png


author: Ondrej Mular <omular@redhat.com> - 0.9.162-5.el7_5.2
changelog:
  - Fix instance attributes setting for fence agents `fence_compute` and `fence_evacuate`
  - Resolves: rhbz#1628070


author: Ivan Devat <idevat@redhat.com> - 0.9.165-1
changelog:
  - Rebased to latest upstream sources (see CHANGELOG.md)
  - Resolves: rhbz#1572886 rhbz#1581150 rhbz#1579911 rhbz#1533849 rhbz#1557252 rhbz#1568353 rhbz#1574898 rhbz#1427273 rhbz#1475318 rhbz#1476862 rhbz#1535967 rhbz#1566382 rhbz#1588667 rhbz#1590533 rhbz#1403832 rhbz#1517333 rhbz#1529508


author: Ivan Devat <idevat@redhat.com> - 0.9.165-2
changelog:
  - Fixed validation for an unaccessible resource inside a bundle 
  - Fixed test of watchdog devices
  - Fixed command `pcs cluster node add-outside`
  - Fixed large key files distribution
  - Resolves: rhbz#1462248 rhbz#1475318 rhbz#1599758 rhbz#1600169


author: Ondrej Mular <omular@redhat.com> - 0.9.165-5
changelog:
  - Fixed `pcs stonith sbd watchdog test` error messages
  - Fixed avaliable watchdog devices listing
  - Resolves: rhbz#1475318


author: Ondrej Mular <omular@redhat.com> - 0.9.165-6
changelog:
  - Fix instance attributes setting for fence agents `fence_compute` and
    `fence_evacuate`
  - Resolves: rhbz#1623181


author: EL Errata <el-errata_ww@oracle.com> - 0.9.165-6.0.1
changelog:
  - Revert the prior change to disable aarch64 build
  - Unlike RHEL we DO have corosync/pacemaker for aarch64 on EL7
  - replace logo pcsd/public/favicon.ico in tarball
  - remove Source1 HAM-logo.png


author: Ivan Devat <idevat@redhat.com> - 0.9.165-6.el7_6.1
changelog:
  - `pcs` no longer spawns unnecessary processes for reading node tokens
  - Fixed a bug causing most of the messages not being logged into pcsd.log
  - Lower load caused by periodical config files syncing in pcsd by making it sync less frequently
  - Improve logging of periodical config files syncing in pcsd
  - Resolves: rhbz#1683959 rhbz#1683957 rhbz#1683958


author: Ivan Devat <idevat@redhat.com> - 0.9.167-1
changelog:
  - Rebased to latest upstream sources (see CHANGELOG.md)
  - Resolves: rhbz#1649732 rhbz#1554302 rhbz#1447349 rhbz#1647640 rhbz#1594738 rhbz#1676956 rhbz#1474747 rhbz#1679534 rhbz#1642514 rhbz#1389140 rhbz#1522858 rhbz#1676944 rhbz#1638376 rhbz#1515021 rhbz#1598197


author: Edward Leung <edward.leung@oracle.com> - 0.9.167-3.0.1
changelog:
  - remove change for favicon.ico from replace-favicon.patch
  - replace logo pcsd/public/favicon.ico in tarball
  - remove Source1 HAM-logo.png


author: Ivan Devat <idevat@redhat.com> - 0.9.168-1
changelog:
  - Rebased to latest upstream sources (see CHANGELOG.md)
  - Resolves: rhbz#1730747 rhbz#1725849 rhbz#1551663 rhbz#1595444 rhbz#1671174 rhbz#1712315 rhbz#1619253 rhbz#1710750 rhbz#1466088 rhbz#1558063 rhbz#1665898 rhbz#1500012 rhbz#1673829


author: Ivan Devat <idevat@redhat.com> - 0.9.168-2
changelog:
  - Do not generate custom DH key if it was not requested by setting its custom length
  - Resolves: rhbz#1760434


author: Ivan Devat <idevat@redhat.com> - 0.9.168-3
changelog:
  - More fixes for the case when PATH environment variable is not set
  - Pcsd no longer sends Server HTTP header
  - Empty constraint option are not allowed in pcs constraint order and pcs constraint colocation add commands
  - Resolves: rhbz#1500012 rhbz#1765606 rhbz#1671174


author: Ondrej Mular <omular@redhat.com> - 0.9.168-4
changelog:
  - Added command 'pcs resource relations'
  - Added command 'pcs resource safe-disable'
  - Resolves: rhbz#1770975 rhbz#1770973


author: Ivan Devat <idevat@redhat.com> - 0.9.169-1
changelog:
  - Rebased to latest upstream sources (see CHANGELOG.md)
  - Resolves: rhbz#1822078 rhbz#1759269 rhbz#1448569


author: Ivan Devat <idevat@redhat.com> - 0.9.169-2
changelog:
  - Keep autogenerated IDs of set constraints reasonably short
  - Use fixed version of python module subprocess (package python2-subprocess32)
  - Resolves: rhbz#1820813 rhbz#1824206


author: Ivan Devat <idevat@redhat.com> - 0.9.169-3
changelog:
  - Added option: pcs resource [safe-]disable --simulate` has a new option `--brief` to print only a list of affected resources
  - Fixed race-condition when removing multiple resources from web UI
  - Resolves: rhbz#1833115 rhbz#1843593


author: Robert Relyea <rrelyea@redhat.com - 1.4.10-13
changelog:
  - Add support for missing readers (broadcom, cherry).
  - mark deprecated readers as unsupported and needing an update


author: Robert Relyea <rrelyea@redhat.com> - 1.8.8-7
changelog:
  - Don't hang if the daemon is blocked by systemd
  - Make sure we have a new enough systemd-devel to have the udev headers


author: Doug Ledford <dledford@redhat.com> - 1.3.0-1
changelog:
  - Update to latest upstream release (1.2.3 -> 1.3.0)
  - Strip rocee related code out of upstream update
  - Add a buildrequires on libibumad because upstream needs it now
  - Fix lack of build on i686
  - Related: bz725016
  - Resolves: bz724896


author: Doug Ledford <dledford@redhat.com> - 1.3.0-2
changelog:
  - Update to latest upstream release
  - Initial import into Fedora
  - Remove runme from docs section (review item)
  - Improve description of package (review item)


author: Kyle McMartin <kmcmarti@redhat.com> - 2.0-4
changelog:
  - aarch64: add get_cycles implementation since <asm/timex.h> is no longer
    exported by the kernel.
  - Resolves: #1100043


author: Jarod Wilson <jarod@redhat.com> - 3.0-6
changelog:
  - Update to upstream 3.0-3.1.gb36a595 tarball for upstream fixes
  - Add in manpages
  - Related: rhbz#1365750
  - Resolves: rhbz#948476


author: Jarod Wilson <jarod@redhat.com> - 3.0-7
changelog:
  - Address a myriad more coverity/clang warnings
  - Add raw_ethernet_* man page symlinks
  - Related: rhbz#1273176
  - Related: rhbz#948476


author: Paul Howarth <paul@city-fan.org> - 0.04-1
changelog:
  - Update to 0.04:
    - Some small test changes for the latest Module::Implementation and
      Class::Load
  - Bump Class::Load version requirement to 0.15
  - BR: perl(constant), perl(Module::Implementation) ≥ 0.04, 
    perl(Test::Requires), perl(Test::Without::Module) and perl(version) for test 
    suite


author: Paul Howarth <paul@city-fan.org> - 0.06-1
changelog:
  - Update to 0.06:
    - Require Class::Load 0.20 in the code, not just the distro metadata
      (CPAN RT#80002)
    - Weird classes with either an ISA or VERSION constant would cause the XS to
      blow up badly (CPAN RT#79998)
    - Fixed some broken logic that lead to a segfault from the
      014-weird-constants.t test on some Perls (CPAN RT#80059)
  - Bump perl(Class::Load) version requirement to 0.20
  - Drop explicit requirement for perl(Class::Load), no longer needed


author: Paul Howarth <paul@city-fan.org> - 2.055-1
changelog:
  - Update to 2.055
    - Fix misuse of magic in API (CPAN RT#78080)
  - Drop redundant explicit requires for perl(Exporter) and perl(File::Temp)


author: Paul Howarth <paul@city-fan.org> - 2.058-1
changelog:
  - Update to 2.058
    - Compress::Raw::Bzip2 needs to use PERL_NO_GET_CONTEXT (CPAN RT#80318)
    - Install to 'site' instead of 'perl' when perl version is 5.11+
      (CPAN RT#79811)
    - Update to ppport.h that includes SvPV_nomg_nolen (CPAN RT#78080)


author: Paul Howarth <paul@city-fan.org> - 2.058-1
changelog:
  - Update to 2.058
    - Compress::Raw::Zlib needs to use PERL_NO_GET_CONTEXT (CPAN RT#80319)
    - Install to 'site' instead of 'perl' when perl version is 5.11+
      (CPAN RT#79812)
    - Update to ppport.h that includes SvPV_nomg_nolen (CPAN RT#78079)


author: Paul Howarth <paul@city-fan.org> - 2.061-1
changelog:
  - Update to 2.061
    - Include zlib 1.2.8 source
    - Typo fix (CPAN RT#85431)
    - Silence compiler warning by making 2nd parameter to DispStream a const char*


author: Paul Howarth <paul@city-fan.org> - 0.64-3
changelog:
  - Remove circular BR: perl(Net::SSL) provided by this package
  - Placate rpmlint regarding file permissions
  - Don't need to remove empty directories from the buildroot


author: Marcela Mašláňová <mmaslano@redhat.com> - 2.135.07-240
changelog:
  - update the version to override the module from perl.srpm
  - bump release to override sub-package from perl.spec


author: Marcela Mašláňová <mmaslano@redhat.com> 0.33-1
changelog:
  - Specfile autogenerated by cpanspec 1.79.
  - apply patch to automatically create alias -> DP on Data::Peek


author: Marcela Mašláňová <mmaslano@redhat.com> - 0.03-20
changelog:
  - Remove BuildRoot definition.
  - Remove BuildRoot cleaning.
  - Replace PERL_INSTALL_ROOT with DESTDIR.
  - Remove cleaning empty directories.
  - Remove %defattr.
  - Do not export private library (Leak.so()).


author: Petr Pisar <ppisar@redhat.com> - 2.51-6
changelog:
  - Rebuild against "file" package fixed by Jan Kaluza to correct run-time
    dependencies (bug #1048910)


author: Petr Šabata <contyk@redhat.com> - 2.46-1
changelog:
  - 2.46 bump
  - Specify all dependencies
  - Drop command macros
  - Modernize the spec and clean whitespace


author: Paul Howarth <paul@city-fan.org> - 0.33-1
changelog:
  - Update to 0.33
    - Updated can_xs to fix a bug in it
  - Reinstate compatibility with old distributions like EL-5
  - Drop Test::More version requirement to 0.42
  - BR: perl(ExtUtils::MakeMaker)
  - BR: perl(Test::LeakTrace) except on EL-4/EL-5 where it's not available
  - BR: perl(Pod::Simple), perl(Test::CPAN::Meta), perl(Test::MinimumVersion)
    (if we're not bootstrapping) and perl(Test::Pod), and run the developer tests
    too
  - Don't use macros for commands
  - Use %{_fixperms} macro rather than our own chmod incantation
  - Make %files list more specific
  - Use tabs


author: Paul Howarth <paul@city-fan.org> - 0.33-7
changelog:
  - BR:/R: perl(Carp)
  - BR: perl(constant), perl(Exporter) and perl(ExtUtils::CBuilder)
  - Add commentary regarding non-use of Test::LeakTrace for EL-7 builds
  - Use Test::LeakTrace for EL-5 builds
  - Drop support for EL-4 builds since it was EOL-ed ages ago
  - Drop %defattr, redundant since rpm 4.4
  - Don't need to remove empty directories from the buildroot
  - Remove more command macros


author: Paul Howarth <paul@city-fan.org> - 1.49-1
changelog:
  - update to 1.49
    - fixed problem where on some platforms test t/local/07_tcpecho.t would bail
      out if it could not bind port 1212; it now tries a number of ports to bind
      to until successful
    - improvements to unsigned casting
    - improvements to Net::SSLeay::read to make it easier to use with
      non-blocking IO: it modifies Net::SSLeay::read() to return the result from
      SSL_read() as the second return value, if Net::SSLeay::read() is called in
      list context (its behavior should be unchanged if called in scalar or void
      context)
    - fixed a problem where t/local/kwalitee.t fails with
      Module::CPANTS::Analyse 0.86
    - fixed a number of typos
    - fixed a compiler warning from Compiling with gcc-4.4 and -Wall
    - Fixed problems with get_https4: documentation was wrong, $header_ref was
      not correctly set and $server_cert was not returned
    - fixed a problem that could cause a Perl exception about no blength method
      on undef (CPAN RT#79309)
    - added documentation about how to mitigate various SSL/TLS vulnerabilities
    - SSL_MODE_* are now available as constants
  - drop upstreamed pod encoding patch


author: Paul Howarth <paul@city-fan.org> - 1.50-1
changelog:
  - update to 1.50
    - fixed a problem where t/handle/external/50_external.t would crash if any of
      the test sites were not contactable
    - now builds on VMS, added README.VMS
    - fixed a few compiler warnings in SSLeay.xs; most of them are just
      signed/unsigned pointer mismatches but there is one that actually fixes
      returning what would be an arbitrary value off the stack from
      get_my_thread_id if it happened to be called in a non-threaded build
    - added SSL_set_tlsext_host_name, SSL_get_servername, SSL_get_servername_type,
      SSL_CTX_set_tlsext_servername_callback for server side Server Name
      Indication (SNI) support
    - fixed a problem with C++ comments preventing builds on AIX and HPUX
    - perdition.org not available for tests, changed to www.open.com.au
    - added SSL_FIPS_mode_set
    - improvements to test suite so it succeeds with and without FIPS mode
      enabled
    - added documentation, warning not to pass UTF-8 data in the content
      argument to post_https


author: Paul Howarth <paul@city-fan.org> - 1.51-1
changelog:
  - update to 1.51
    - fixed a problem where SSL_set_SSL_CTX is not available with
      OpenSSL < 0.9.8f (CPAN RT#81940)
  - fix bogus date in spec changelog


author: Paul Howarth <paul@city-fan.org> - 1.52-1
changelog:
  - update to 1.52
    - rebuild package with gnu format tar, to prevent problems with unpacking on
      other systems such as old Solaris


author: Paul Howarth <paul@city-fan.org> - 1.54-1
changelog:
  - update to 1.54
    - added support for SSL_export_keying_material where present (i.e. in OpenSSL
      1.0.1 and later)
    - changed t/handle/external/50_external.t to use www.airspayce.com instead of
      perldition.org, who no longer have an https server
    - patch to fix a crash: P_X509_get_crl_distribution_points on an X509
      certificate with values in the CDP extension that do not have an ia5 string
      would cause a segmentation fault when accessed
    - change in t/local/32_x509_get_cert_info.t to not use
      Net::SSLeay::ASN1_INTEGER_get, since it works differently on 32 and 64 bit
      platforms
    - updated author and distribution location details to airspayce.com
    - improvement to test 07_sslecho.t so that if set_cert_and_key fails we can
      tell why


author: Paul Howarth <paul@city-fan.org> - 1.55-1
changelog:
  - update to 1.55
    - added support for TLSV1_1 and TLSV1_2 methods with SSL_CTX_tlsv1_1_new(),
      SSL_CTX_tlsv1_2_new(), TLSv1_1_method() and TLSv1_2_method(), where
      available in the underlying openssl
    - added CRL support functions X509_CRL_get_ext(), X509_CRL_get_ext_by_NID(),
      X509_CRL_get_ext_count()
    - fixed a problem that could cause content with a value of '0' to be
      incorrectly encoded by do_httpx3 and friends (CPAN RT#85417)
    - added support for SSL_get_tlsa_record_byname() required for DANE support in
      openssl-1.0.2 and later
    - testing with openssl-1.0.2-stable-SNAP-20130521
    - added X509_NAME_new and X509_NAME_hash


author: Paul Howarth <paul@city-fan.org> - 4.064-1
changelog:
  - Update to 4.064
    - Updated GPL v2.0 text and address in all modules
    - Added support for rfc3021 /31 networks to hostenum
  - Update UTF8 patch


author: Paul Howarth <paul@city-fan.org> - 4.067-1
changelog:
  - Update to 4.067
    - Improved diagnostic message for "die" with bad mask for hostenum,
      hostenumref, split, splitref, rsplit, rsplitref
  - Include new docfile About-NetAddr-IP.txt


author: Paul Howarth <paul@city-fan.org> - 4.069-1
changelog:
  - Update to 4.069
    - Add proper pod encoding in Lite.pm
    - Changed Makefile.PL to check for config.h when building for XS with 'gcc',
      try building with 'cc', and check again; if config.h is not found, force
      Pure Perl mode
    - Kill XS in winduhs and Darwin, both of which misbehave when compiling XS
      code
  - Drop UTF8 patch, no longer needed


author: Paul Howarth <paul@city-fan.org> - 0.25-1
changelog:
  - Update to 0.25
    - Invalid package names (for instance, Foo:Bar) are not allowed
    - Invalid stash entry names (anything containing ::) are not allowed
  - Update patches to apply cleanly


author: Paul Howarth <paul@city-fan.org> - 0.25-6
changelog:
  - Drop EPEL-4 support
    - Test::LeakTrace now universally available
    - Suitably recent version of ExtUtils::MakeMaker now universally available
    - Drop %defattr, redundant since rpm 4.4
  - BR: perl(File::Temp)
  - Don't need to remove empty directories from the buildroot


author: Paul Howarth <paul@city-fan.org> - 0.26-1
changelog:
  - Update to 0.26
    - Internal refactorings to support Package::Anon stashes
  - BR: perl(base) and perl(Test::Requires) for test suite
  - Update patch for old distro compatibility
  - Explicitly run the release/author tests


author: Ralf Corsépius <corsepiu@fedoraproject.org> - 1.08-1
changelog:
  - Upstream update.
  - Update patch.
  - Update BRs.
  - Add %bcond --with network.
  - Fix up %changelog dates.


author: Paul Howarth <paul@city-fan.org> - 1.05-10
changelog:
  - Drop -tests subpackage (general lack of interest in this), but include
    them as documentation for the main package
  - Don't use macros for commands
  - No need to remove empty directories from buildroot
  - Add buildreqs for Perl core modules that might be dual-lived
  - Rename makefile patch to include module name and version
  - Fix script interpreter for test suite since we're packaging it
  - Add filter for doc-file dependencies if we don't have %perl_default_filter
  - Make %files list more explicit
  - Use tabs


author: Daniel P. Berrange <berrange@redhat.com> - 1.1.1-2
changelog:
  - Fix incorrect handling of flags in $dom->get_vcpu_info() (rhbz #994139)
  - Fix error handling in $dev->get_parent() (rhbz #994141)


author: Daniel P. Berrange <berrange@redhat.com> - 1.2.8-4
changelog:
  - Add agent lifecycle event callbacks & constants (rhbz #1167392)
  - Fix docs for get_time method (rhbz #1164972)
  - Fix docs for GET_ALL_STATS constnats (rhbz #1170481)


author: Daniel P. Berrangé <berrange@redhat.com> - 4.5.0-2
changelog:
  - Fix typed parameter memory handling (rhbz#1613227)
  - Fix missing NWFilterBinding module (rhbz#1608755)


author: Petr Pisar <ppisar@redhat.com> - 2.30-17
changelog:
  - Modernize spec file
  - Specify all dependencies
  - Change license to "(Copyright only) and (Artistic or GPL+)" because of
    ppport.h


author: Jitka Plesnikova <jplesnik@redhat.com> - 1.04-19
changelog:
  - Specify all dependencies
  - Drop %defattr, redundant since rpm 4.4
  - Fix mixed use of spaces and tabs


author: Jitka Plesnikova <jplesnik@redhat.com> - 804.030-2
changelog:
  - Update license - add SWL
  - Specify all dependencies
  - Replace PERL_INSTALL_ROOT with DESTDIR
  - Drop removing of empty directory
  - Package COPYING


author: Petr Pisar <ppisar@redhat.com> - 804.030-4
changelog:
  - Fix file modes changed while building (bug #1017322)
  - Correct change log entry date (bug #1017322)


author: Petr Pisar <ppisar@redhat.com> - 1:2.0016-1
changelog:
  - 2.0016 bump (disable XML_PARSE_HUGE by default to prevent from
    CVE-2003-1564, a recursive XML entity expansion leads to memory exhaustion
    in a XML parser)


author: Jitka Plesnikova <jplesnik@redhat.com> - 2.41-8
changelog:
  - Update dependencies and summary
  - Remove pre-RPM-4.9 filters
  - Remove deleting empty directories
  - Update REC-xml-19980210.xml to match new encoding


author: Paul Howarth <paul@city-fan.org> 1.23-1
changelog:
  - Update to 1.23
    - Synchronize JSON::Syck with YAML::Syck version number
    - Add DumpInto functions (YAML+Syck), which dump into a provided scalar
      instead of a newly-allocated one
    - Modify DumpFile functions to output directly to the specified
      file/filehandle instead of buffering all output in memory
    - Avoid modifying numbers into strings when emitting
    - Fix error message typo: s/existant/existent/g
    - Fix for non-printable character detection
    - Quote if non-printable characters are present
    - Make sure that LoadBlessed=0 blocks all blessing
    - Start listing primary repo as http://github.com/toddr/YAML-Syck
    - README refreshed via perldoc -t
  - Require perl(XSLoader) at runtime
  - Drop %defattr, redundant since rpm 4.4
  - Don't need to remove empty directories from the buildroot
  - Don't use macros for commands
  - Use DESTDIR rather than PERL_INSTALL_ROOT
  - Make %files list more explicit


author: Paul Howarth <paul@city-fan.org> 1.24-1
changelog:
  - Update to 1.24
    - Implement $JSON::Syck::MaxDepth
    - Prevent failure when the same object is seen twice during Dump
    - Prevent YAML from being influenced by the previous change
    - MinGW64 compatibility (CPAN RT#78363)


author: Paul Howarth <paul@city-fan.org> 1.27-1
changelog:
  - Update to 1.27
    - Fix for hash randomization in yaml-alias.t on perl 5.18.0 (CPAN RT#84882,
      CPAN RT#84466)


author: Petr Pisar <ppisar@redhat.com> - 4:5.16.3-277
changelog:
  - Move CPANPLUS-Dist-Build files from perl-CPANPLUS
  - Move CPAN-Meta-Requirements files from CPAN-Meta
  - Add perl-Scalar-List-Utils to perl-core dependencies


author: Petr Pisar <ppisar@redhat.com> - 4:5.16.3-278
changelog:
  - Update SystemTap scripts to recognize new phase__change marker and new probe
    arguments (bug #971094)
  - Update h2ph(1) documentation (bug #948538)
  - Update pod2html(1) documentation (bug #948538)
  - Do not double-own archlib directory (bug #894195)


author: Petr Pisar <ppisar@redhat.com> - 4:5.16.3-279
changelog:
  - Do not distribute File::Spec::VMS (bug #973713)
  - Remove bundled CPANPLUS-Dist-Build (bug #973041)


author: Petr Pisar <ppisar@redhat.com> - 4:5.16.3-284
changelog:
  - Use a macro to cover all 64-bit PowerPC architectures (bug #1061792)
  - Declare dependencies for cpan tool (bug #1122368)
  - Use stronger algorithm needed for FIPS in t/op/crypt.t (bug #1084796)
  - Make *DBM_File desctructors thread-safe (bug #1107542)


author: Petr Pisar <ppisar@redhat.com> - 4:5.16.3-286
changelog:
  - Remove CPU-speed-sensitive test in Benchmark test (bug #1238567)
  - Rebuild with corrected binutils to fix systemtap support (bug #1238472)


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.16.3-288
changelog:
  - Fix CRLF conversion in ASCII FTP upload (bug #1263734)
  - Don't leak the temp utf8 copy of namepv (bug #1063330)


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.16.3-291
changelog:
  - Backported and sub-packaged libraries historically supplied with Perl 4
    into perl-Perl4-CoreLibs


author: Petr Pisar <ppisar@redhat.com> - 4:5.16.3-293
changelog:
  - Add SSL support to Net::SMTP (bug #1557574)
  - Do not overload ".." in Math::BigInt (bug #1497734)
  - Provide perl(:VERSION) and perl-interpreter RPM symbols (bug #1410347)


author: Petr Šabata <contyk@redhat.com> - 1.05-26.2
changelog:
  - Fix the package for el7
  - Modernize the spec
  - Correct a bogus date in changelog
  - Unify spec whitespace


author: Jitka Plesnikova <jplesnik@redhat.com> - 1.42-2
changelog:
  - Add BR perl(File::Spec)
  - Replace PERL_INSTALL_ROOT with DESTDIR
  - Remove deleting empty directories
  - Remove defattr


author: Jacob Wang <jacob.wang@oracle.com> - 0.109-10.0.1
changelog:
  - updates for Oracle Linux test certificate (Alexey Petrenko)
  - update Oracle Linux certificates (Alexey Petrenko)


author: Remi Collet <rcollet@redhat.com> - 5.5.16-19
changelog:
  - fix memory leak introduce in patch for CVE-2014-1943
  - fix heap-based buffer over-read in DateInterval CVE-2013-6712


author: Remi Collet <rcollet@redhat.com> - 5.4.16-23
changelog:
  - fileinfo: cdf_unpack_summary_info() excessive looping
    DoS. CVE-2014-0237
  - fileinfo: CDF property info parsing nelements infinite
    loop. CVE-2014-0238
  - fileinfo: cdf_check_stream_offset insufficient boundary
    check. CVE-2014-3479
  - fileinfo: cdf_count_chain insufficient boundary check
    CVE-2014-3480
  - fileinfo: cdf_read_short_sector insufficient boundary
    check. CVE-2014-0207
  - fileinfo: cdf_read_property_info insufficient boundary
    check. CVE-2014-3487
  - fileinfo: fix extensive backtracking CVE-2013-7345
  - core: type confusion issue in phpinfo(). CVE-2014-4721
  - core: fix heap-based buffer overflow in DNS TXT record
    parsing. CVE-2014-4049
  - core: unserialize() SPL ArrayObject / SPLObjectStorage
    type confusion flaw. CVE-2014-3515


author: Remi Collet <rcollet@redhat.com> - 5.4.16-23.1
changelog:
  - gd: fix NULL pointer dereference in gdImageCreateFromXpm().
    CVE-2014-2497
  - gd: fix NUL byte injection in file names. CVE-2014-5120
  - fileinfo: fix extensive backtracking in regular expression
    (incomplete fix for CVE-2013-7345). CVE-2014-3538
  - fileinfo: fix mconvert incorrect handling of truncated
    pascal string size. CVE-2014-3478
  - fileinfo: fix cdf_read_property_info
    (incomplete fix for CVE-2012-1571). CVE-2014-3587
  - spl: fix use-after-free in ArrayIterator due to object
    change during sorting. CVE-2014-4698
  - spl: fix use-after-free in SPL Iterators. CVE-2014-4670
  - network: fix segfault in dns_get_record
    (incomplete fix for CVE-2014-4049). CVE-2014-3597


author: Remi Collet <rcollet@redhat.com> - 5.4.16-23.2
changelog:
  - xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
  - core: fix integer overflow in unserialize() CVE-2014-3669
  - exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670


author: Remi Collet <rcollet@redhat.com> - 5.4.16-33
changelog:
  - core: use after free vulnerability in unserialize()
    CVE-2014-8142 and CVE-2015-0231
  - core: fix use-after-free in unserialize CVE-2015-2787
  - core: fix NUL byte injection in file name argument of
    move_uploaded_file() CVE-2015-2348
  - date: use after free vulnerability in unserialize CVE-2015-0273
  - enchant: fix heap buffer overflow in enchant_broker_request_dict
    CVE-2014-9705
  - exif: free called on unitialized pointer CVE-2015-0232
  - fileinfo: fix out of bounds read in mconvert CVE-2014-9652
  - gd: fix buffer read overflow in gd_gif_in.c CVE-2014-9709
  - phar: use after free in phar_object.c CVE-2015-2301
  - soap: fix type confusion through unserialize


author: Remi Collet <rcollet@redhat.com> - 5.4.16-34
changelog:
  - fix memory corruption in fileinfo module on big endian
    machines #1082624
  - fix segfault in pdo_odbc on x86_64 #1159892
  - fix segfault in gmp allocator #1154760


author: Remi Collet <rcollet@redhat.com> - 5.4.16-35
changelog:
  - core: fix multipart/form-data request can use excessive
    amount of CPU usage CVE-2015-4024
  - fix various functions accept paths with NUL character
    CVE-2015-4025, CVE-2015-4026, #1213407
  - fileinfo: fix denial of service when processing a crafted
    file #1213442
  - ftp: fix integer overflow leading to heap overflow when
    reading FTP file listing CVE-2015-4022
  - phar: fix buffer over-read in metadata parsing CVE-2015-2783
  - phar: invalid pointer free() in phar_tar_process_metadata()
    CVE-2015-3307
  - phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
  - phar: fix memory corruption in phar_parse_tarfile caused by
    empty entry file name CVE-2015-4021
  - soap: fix type confusion through unserialize #1222538
  - apache2handler: fix pipelined request executed in deinitialized
    interpreter under httpd 2.4 CVE-2015-3330


author: Remi Collet <rcollet@redhat.com> - 5.4.16-38
changelog:
  - curl: add options to enable TLS #1291667
  - mysqli: fix segfault in mysqli_stmt::bind_result() when
    link is closed #1096800
  - fpm: fix incorrectly defined SCRIPT_NAME variable when
    using Apache #1138563
  - core: fix segfault when a zend_extension is loaded twice #1289457
  - openssl: change default_md algo from MD5 to SHA1 #1073388
  - wddx: fix segfault in php_wddx_serialize_var #1131979


author: Remi Collet <rcollet@redhat.com> - 5.4.16-41
changelog:
  - gd: fix integer overflow in _gd2GetHeader() resulting in
    heap overflow CVE-2016-5766
  - gd: fix integer overflow in gdImagePaletteToTrueColor()
    resulting in heap overflow CVE-2016-5767
  - mbstring: fix double free in _php_mb_regex_ereg_replace_exec
    CVE-2016-5768


author: Remi Collet <rcollet@redhat.com> - 5.4.16-43
changelog:
  - gd: fix DoS vulnerability in gdImageCreateFromGd2Ctx() CVE-2016-10167
  - gd: Signed Integer Overflow gd_io.c CVE-2016-10168


author: Remi Collet <rcollet@redhat.com> - 5.4.16-44
changelog:
  - fix php should provide php(httpd) #1215429
  - fpm: backport PHP-FPM's clear_env option from 5.4.27 #1410010
    default value is "yes", preserving previous behaviour
  - openssl: fix default_socket_timeout does not work with SSL #1378196


author: David Kubat <david.kubat@oracle.com> - 7.4.8-1.0.1.el7
changelog:
  - update to 7.4.8
  - define _unpackaged_files_terminate_build macro
  - modify php-7.0.0-fixheader.patch


author: Remi Collet <remi@fedoraproject.org> - 3.0.7-5
changelog:
  - add patch for https://bugs.php.net/59602
    segfault in getExtendedStats
  - also provides php-memcache


author: Stefan Becker <chemobejk@gmail.com> - 1.18.1-1
changelog:
  - update to 1.18.1:
      - fixes crash when gstreamer nice plugin is missing (bz #1071710)
      - fixes false "not delivered" errors in conference
      - fixes incorrect HTML escaping for URLs
      - fixes conference call ending in error message
      - fixes endless loop with failed HTTP Basic authentication
      - fixes EWS autodiscover for some Office 365 users
      - fixes missing "Copy to" in buddy menu


author: Stefan Becker <chemobejk@gmail.com> - 1.18.2-1
changelog:
  - update to 1.18.2:
      - fixes crash when PersistentChat sends BYE
      - fixes joining of conference for some users
      - fixes conference call ending in error message
      - fixes EWS autodiscover for some Office 365 users
      - UCS now honors email URL set by user


author: Stefan Becker <chemobejk@gmail.com> - 1.18.3-1
changelog:
  - update to 1.18.3:
      - fixes audio/video call if host has IPv6 address (bz #1124510)
      - fixes assert triggered by EWS autodiscover in older libxml2 versions
      - fixes crash triggered by EWS autodiscover when glib2 < 2.30.0


author: Stefan Becker <chemobejk@gmail.com> - 1.18.4-1
changelog:
  - update to 1.18.4:
      - fixes ADFS failure when user and login name differ
      - fixes a longstanding issue that the Pidgin user status sometimes
        didn't switch back to "Available" after the end of a meeting
      - fixes some memory leaks


author: Stefan Becker <chemobejk@gmail.com> - 1.18.5-1
changelog:
  - update to 1.18.5:
      - fixes Pidgin user status being stuck in "Away"
      - fixes RealmInfo request when user and login name differ


author: Stefan Becker <chemobejk@gmail.com> - 1.19.0-1
changelog:
  - update to 1.19.0:
      - added support for automatic authentication scheme selection
      - added support for Multi-Factor Authentication (MFA)
      - added support for buddy photos from contact card
      - added support for SIP ID in contact search
      - added support for EWS based contact search when UCS is used
      - improves user experience for [MS-DLX] based contact search
      - fixes calendar state machine when EWS URL is set


author: Stefan Becker <chemobejk@gmail.com> - 1.19.1-1
changelog:
  - update to 1.19.1:
      - add workaround for farstream 0.1.x with libnice >= 0.1.10
      - fix SIP re-authentication timeout to be max. 8 hours


author: Stefan Becker <chemobejk@gmail.com> - 1.20.0-1
changelog:
  - update to 1.20.0:
      - add support for SRTP (requires libpurple >= 3.0.0)
      - parse HTML from Lync conference URL
      - fixes Office365 authentication failure (bz #1257485)


author: Stefan Becker <chemobejk@gmail.com> - 1.20.1-1
changelog:
  - update to 1.20.1:
      - add support for another type of ADFS response
      - improve configure check for back-ported features


author: Matthew Harmsen <mharmsen@redhat.com> 10.0.4-0.4
changelog:
  - Bugzilla Bug #986506 - Need to determine RPM packages to be excluded
    from compose . . . (exclude pki-kra, pki-ocsp, and pki-tks from rhel 7)


author: Ade Lee <alee@redhat.com> 10.0.5-2
changelog:
  - Trac #739, BZ#999722 - Fixed error handling in DoUnrevoke servlet.
  - Trac #775, BZ#1018628 - Fixed errors during Tomcat shutdown.
  - Trac #776, BZ#1024679 - Added missing link for apache-commons-io
  - Trac #781, BZ#1024445 - Admin cert signed with SHA1, should be SHA256
  - Trac #780 - Store authentication info in session.
  - Trac #763 - Backup upgrade tracker.
  - Trac #779 - Renamed some CLI commands.
  - Trac #743 - Fixed references to /var/run and /var/lock in tmpfiles.


author: Dogtag Team <pki-devel@redhat.com> 10.2.5-3
changelog:
  - Dogtag 10.2.5-3 patch for RHEL 7.2 Re-base
  -   git format-patch cc97f8628b23f8ea75308bb97a31307cb4f162b9^..
      ac5447a8e0bac5112882be700a17a9274e322adc --stdout > pki-core-rhel-7-2.patch
  -   remove e5c4e87ac5ce881efa160352ce87ad81026f3446 (QE test)
  - Contents of 'pki-core-rhel-7-2.patch':
  -   PKI TRAC Ticket #1249 -	Misleading self test log message [edewata]
  -   PKI TRAC Ticket #1444 - pkispawn: installation aborts when HSM contains
      empty slots [edewata]
  -   PKI TRAC Ticket #995 - Provide more info on how to use --input with pki
      cert-find in the man page [edewata]
  -   PKI TRAC Ticket #1122 - Need to describe paging options in 'pki' man page
      [edewata]
  -   Cleaned up SystemConfigService.validateRequest() [edewata]
  -   Cleaned up SystemConfigService.configureClone() [edewata]
  -   PKI TRAC Ticket #1438 - pkispawn: SSL_ForceHandshake issue for non-CA on
      HSM on both shared and nonshared tomcat instances [cfu]
  -   PKI TRAC Ticket #1442 - Ability to toggle profile usablity in Web vs CLI
      tools [jmagne]
  -   PKI TRAC Ticket #1441 - Lack of Interactive Installation Support
     (Cloning, Subordinates, Externals, HSMs, ECC) [mharmsen]
  -   PKI TRAC Ticket #1446 - Unable to select ECC Curves from EE [jmagne]
  -   Fixed pki help CLI [edewata]
  -   Fixed NPE in key-archive CLI [edewata]
  -   PKI TRAC Ticket #891 - Missing fail-over code in HttpConnection [edewata]
  -   PKI TRAC Ticket #1447 - pkispawn: findCertByNickname fails to find cert in
      creating shared tomcat subsystems on HSM [cfu]
  -   PKI TRAC Ticket #1425 - pkispawn CA with HSM - if the config file has
      pki_client related params the dir is not created and the admin cert p12
      file is stored nowhere [mharmsen]
  -   PKI TRAC Ticket #1358 - Retrying failed OCSP clone results duplicate
      replecation id and a failure [jmagne]
  -   PKI TRAC Ticket #1462 - profile update in raw format accepts bad config
      [ftweedal]
  -   PKI TRAC Ticket #1449 - pki cert-find could be time consuming: add VLV
      index for new installations [edewata]


author: Dogtag Team <pki-devel@redhat.com> 10.2.5-4
changelog:
  - Bugzilla Bug #1143067 - The pkiuser user/group should be created in
    rpm %pre, and ideally with fixed uid/gid [cheimes]


author: Dogtag Team <pki-devel@redhat.com> 10.2.5-5
changelog:
  - Bugzilla Bug #1253045 - handle_exceptions() raises JSONDecodeError [cheimes]
    'pki-core-handle-JSON-decode-error.patch'
  -    modified for RHEL 7.2 by removing changes to '.gitignore',
       'tests/python/test_pki.py', and 'tox.ini' [mharmsen]
  - Bugzilla Bug #1253047 - issues in cloning from dogtag 9 to 10 [alee]
    'pki-core-fix-exception-when-talking-to-Dogtag-9-systems.patch'


author: Dogtag Team <pki-devel@redhat.com> 10.2.5-6
changelog:
  - Bugzilla Bug #1258630 - Upgraded CA lacks ca.sslserver.certreq
    in CS.cfg [edewata]
  - Bugzilla Bug #1258634 - CA fails to authenticate to KRA for
    archival [edewata]


author: Dogtag Team <pki-devel@redhat.com> 10.2.5-7
changelog:
  - Bugzilla Bug #1289323 -  [RFE] Provide the user the ability to import their
    own CA certificate with private key [edewata]
  - Bugzilla Bug #1277691 - ipa-cacert-manage renew failed with validity
    out of range [edewata]
  - PKI TRAC Ticket #2040 - Determine supported javadoc options [mharmsen]


author: Dogtag Team <pki-devel@redhat.com> 10.2.5-9
changelog:
  - Bugzilla Bug #1318302 - pkispawn ignores 3rd-party CA certs in
    pki_clone_pkcs12_path
  - Bugzilla Bug #1320580 - IPA replica installation fails if password
    has % character in it.


author: Dogtag Team <pki-devel@redhat.com> 10.2.5-10
changelog:
  - Bugzilla Bug #1318302 - pkispawn ignores 3rd-party CA certs in
    pki_clone_pkcs12_path (python hash fix)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-3
changelog:
  - PKI TRAC Ticket #691  - [MAN] pki-server man pages (mharmsen)
  - PKI TRAC Ticket #1114 - [MAN] Generting Symmetric key fails with
    key-generate when --usages verify is passed (jmagne)
  - PKI TRAC Ticket #1306 - [RFE] Add granularity to token termination in TPS
    (cfu)
  - PKI TRAC Ticket #1308 - [RFE] Provide ability to perform off-card key
    generation for non-encryption token keys (cfu)
  - PKI TRAC Ticket #1405 - [MAN] Add additional HSM details to
    'pki_default.cfg' & 'pkispawn' man pages (mharmsen)
  - PKI TRAC Ticket #1607 - [MAN] man pkispawn has inadequate description for
    shared vs non shared tomcat instance installation (mharmsen)
  - PKI TRAC Ticket #1664 - [BUG] Add ability to disallow TPS to enroll a single
    user on multiple tokens. (jmagne)
  - PKI TRAC Ticket #1711 - CLI :: pki-server ca-cert-request-find throws
    IOError (edewata, ftweedal)
  - PKI TRAC Ticket #2285 - freeipa fails to start correctly after pki-core
    update on upgraded system (ftweedal)
  - PKI TRAC Ticket #2311 - When pki_token_name=Internal, consider normalizing
    it to "internal" (mharmsen)
  - PKI TRAC Ticket #2349 - Separated TPS does not automatically receive shared
    secret from remote TKS (jmagne)
  - PKI TRAC Ticket #2364 - CLI :: pki-server ca-cert-request-show throws
    attribute error (ftweedal)
  - PKI TRAC Ticket #2368 - pki-server subsystem subcommands throws error with
    --help option (edewata)
  - PKI TRAC Ticket #2374 - KRA cloning overwrites CA signing certificate trust
    flags (edewata)
  - PKI TRAC Ticket #2380 - Pki-server instance commands throws exception while
    specifying invalid parameters. (edewata)
  - PKI TRAC Ticket #2384 - CA installation with HSM prompts for HSM password
    during silent installation (edewata)
  - PKI TRAC Ticket #2385 - Upgraded CA lacks ca.sslserver.certreq in CS.cfg
    (ftweedal)
  - PKI TRAC Ticket #2387 - Add config for default OCSP URI if none given
    (ftweedal)
  - PKI TRAC Ticket #2388 - CA creation responds 500 if certificate issuance
    fails (ftweedal)
  - PKI TRAC Ticket #2389 - Installation: subsystem certs could have notAfter
    beyond CA signing cert in case of external or existing CA (cfu)
  - PKI TRAC Ticket #2390 - Dogtag 10.3.4: Miscellaneous Enhancements
    (akasurde, edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-5
changelog:
  - PKI TRAC Ticket #978  - TPS connector man page: add revocation routing
    info (cfu)
  - PKI TRAC Ticket #1285 - [MAN] Apply 'generateCRMFRequest() removed from
    Firefox' workarounds to appropriate 'pki' man page (jmagne)
  - PKI TRAC Ticket #2246 - [MAN] Man Page: AuditVerify (cfu)
  - PKI TRAC Ticket #2381 - Throws exception while providing invalid module.
    (edewata)
  - PKI TRAC Ticket #2383 - CLI :: pki client-cert-request --extractable
    should accept only boolean value (edewata)
  - PKI TRAC Ticket #2389 - Installation: subsystem certs could have notAfter
    beyond CA signing cert in case of external or existing CA (cfu)
  - PKI TRAC Ticket #2399 - Dogtag 10.3.5: Miscellaneous Enhancements
    (akasurde, alee, cheimes, edewata, jmagne, mharmsen)
  - PKI TRAC Ticket #2401 - pkispawn calls dnsdomainname even if it does not
    rpm-require hostname (mharmsen)
  - PKI TRAC Ticket #2402 - Conflict in file ownership in pki-base and
    pki-server (cheimes)
  - PKI TRAC Ticket #2403 - Deployment problem with RESTEasy 3.0.17 (edewata)
  - PKI TRAC Ticket #2406 - Make starting CRL Number configurable (jmagne)
  - PKI TRAC Ticket #2412 - pki client-cert-import --trust option does not
    apply the specified trust bits (alee)
  - PKI TRAC Ticket #2418 - [TPS] Some template substitution didn't happen
    during installation (alee)
  - PKI TRAC Ticket #2420 - CA subsystem OSCP responder fails when LWCAs are
    not used (ftweedal)
  - PKI TRAC Ticket #2421 - Incorrect SELinux contexts
    Installation/Configuration (edewata)
  - PKI TRAC Ticket #2424 - ipa-ca-install fails on replica when IPA server
    is converted from CA-less to CA-full (edewata)
  - PKI TRAC Ticket #2428 - broken request links for CA's system certs in
    agent request viewing (cfu)
  - PKI TRAC Ticket #2430 - CA Agent certificate list is not sorted by serial
    number in migration case (jmagne)
  - PKI TRAC Ticket #2431 - Errors noticed during ipa server upgrade.
    (mharmsen)
  - PKI TRAC Ticket #2433 - Lightweight CA GET <id>/chain returns bogus PEM
    data (ftweedal)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-7
changelog:
  - PKI TRAC Ticket #690 - [MAN] pki-tools man pages (mharmsen)
    - CMCEnroll
  - PKI TRAC Ticket #833 - pki user-mod fullName="" gives an error message
    "PKIException: LDAP error (21): error result" (edewata)
  - PKI TRAC Ticket #2431 - Errors noticed during ipa server upgrade.
    (cheimes, edewata, mharmsen)
  - PKI TRAC Ticket #2432 - Kra-selftest behavior is not as expected (edewata)
  - PKI TRAC Ticket #2436 - Dogtag 10.3.6: Miscellaneous Enhancements
    (edewata, mharmsen)
  - PKI TRAC Ticket #2437 - TPS UI: while adding certs for users from TPSUI pem
    format with/without header works while pkcs7 with header is not allowed
    (edewata)
  - PKI TRAC Ticket #2440 - Optional CA signing CSR for migration (edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-8
changelog:
  - PKI TRAC Ticket #1578 - Authentication Instance Id PinDirEnrollment with authType value as SslclientAuth is not working (jmagne)
  - PKI TRAC TIcket #2414 - pki pkcs12-cert-del shows a successfully deleted message when a wrong nickname is provided (gkapoor)
  - PKI TRAC Ticket #2423 - pki_ca_signing_token when not specified does not fallback to pki_token_name value (edewata)
  - PKI TRAC Ticket #2436 - Dogtag 10.3.6: Miscellaneous Enhancements (akasurde) - ticket remains open
  - PKI TRAC Ticket #2439 - Outdated deployment descriptors in upgraded server(edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-9
changelog:
  - PKI TRAC Ticket #1638 - Lightweight CAs: revoke certificate on CA deletion
    (ftweedal)
  - PKI TRAC Ticket #2436 - Dogtag 10.3.6: Miscellaneous Enhancements
    (edewata)
  - PKI TRAC Ticket #2443 - Prevent deletion of host CA's keys if LWCA entry
    deleted (ftweedal)
  - PKI TRAC Ticket #2444 - Authority entry without entryUSN is skipped even if
    USN plugin enabled (ftweedal)
  - PKI TRAC Ticket #2446 - pkispawn: make subject_dn defaults unique per
    instance name (for shared HSM) (cfu)
  - PKI TRAC Ticket #2447 - CertRequestInfo has incorrect URLs (vakwetu)
  - PKI TRAC Ticket #2449 - Unable to create system certificates in different
    tokens (edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-10
changelog:
  - Revert Patch:  PKI TRAC Ticket #2449 - Unable to create system certificates
    in different tokens (edewata)
  - Removes from Errata:  rhbz #1372041 - Unable to create system certificates
    in different tokens


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-10
changelog:
  - Revert Patch:  PKI TRAC Ticket #2449 - Unable to create system certificates
    in different tokens (edewata)
  - Resolves:  rhbz #1374054 - ipa-replica-install fails setting up certificate
  - Restores:  rhbz #1319557 - pkispawn KRA instance is failing server
  - Removes from Errata:  rhbz #1372041 - Unable to create system certificates
    in different tokens


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-11
changelog:
  - PKI TRAC Ticket #1527 - TPS Enrollment always goes to "ca1" (cfu)
  - PKI TRAC Ticket #1664 - [BUG] Add ability to disallow TPS to enroll a single
    user on multiple tokens. (jmagne)
  - PKI TRAC Ticket #2478 - pkispawn fails as it is not able to find openssl as a
    dependency package (mharmsen)
  - PKI TRAC Ticket #2483 - Unable to read an encrypted email using renewed
    tokens (jmagne)
  - PKI TRAC Ticket #2496 - Cert/Key recovery is successful when the cert serial
    number and key id on the ldap user mismatches (cfu)
  - PKI TRAC Ticket #2505 - Fix packaging duplicates of classes in multiple jar
    files (edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-12
changelog:
  - ## RHEL 7.3.z Batch Update 1
  - Bugzilla Bug #1390318 - CA EE: Submit caUserCert request without uid does
    not show proper error message (alee)
  - Bugzilla Bug #1390319 - Failed to start pki-tomcatd Service
    ("ipa-cacert-manage renew" failed?) (edewata)
  - Bugzilla Bug #1390320 - pkispawn fails as it is not able to find openssl as
    a dependency package (mharmsen)
  - Bugzilla Bug #1390321 - two-step externally-signed CA installation fails due
    to missing AuthorityID (ftweedal)
  - Bugzilla Bug #1390322 - Spurious host authority entries created (ftweedal)
  - Bugzilla Bug #1390324 - KRA installation failed against externally-signed CA
    with partial certificate chain (edewata)
  - Bugzilla Bug #1389757 - Problems with FIPS mode (edewata)
  - Bugzilla Bug #1390311 - Fix packaging duplicates of classes in multiple jar
    files (edewata)
  - Bugzilla Bug #1390325 - Typo in comment line of UserPwdDirAuthentication.java
    (edewata)
  - ## RHCS 9.1.z Batch Update 1
  - Bugzilla Bug #1248553 - TPS Enrollment always goes to "ca1" (cfu)
  - Bugzilla Bug #1274096 -  [BUG] Add ability to disallow TPS to enroll a
    single user on multiple tokens. (jmagne)
  - Bugzilla Bug #1379379 - Unable to read an encrypted email using renewed
    tokens (jmagne)
  - Bugzilla Bug #1379749 - Automatic recovery of encryption cert is not working
    when a token is physically damaged and a temporary token is issued (jmagne)
  - Bugzilla Bug #1381375 - Cert/Key recovery is successful when the cert serial
    number and key id on the ldap user mismatches
  - Bugzilla Bug #1381635 - Token format with external reg fails when
    op.format.externalRegAddToToken.revokeCert=true (cfu)
  - Bugzilla Bug #1382762 - PIN_RESET policy is not giving expected results when
    set on a token (jmagne)
  - Bugzilla Bug #1382862 - TPS token enrollment fails to setupSecureChannel
    when TPS and TKS security db is on fips mode. (jmagne)
  - Bugzilla Bug #1386257 - Changes to target.agent.approve.list parameter is
    not reflected in the TPS Web UI (edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-13
changelog:
  - ## RHEL 7.3.z Batch Update 1
  - Bugzilla Bug #1389757 - Problems with FIPS mode (edewata)
    (added KRA key recovery via CLI in FIPS mode)
  - ## RHCS 9.1.z Batch Update 1
  - Reverted patches associated with
    Bugzilla Bug #1386257 - Changes to target.agent.approve.list parameter is
    not reflected in the TPS Web UI (edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-14
changelog:
  - Marked the following RHCS 9.1.z bug:
    Bugzilla Bug #1382862 - TPS token enrollment fails to setupSecureChannel
    when TPS and TKS security db is on fips mode. (jmagne)
    as a duplicate of RHEL 7.3.z bug:
    Bugzilla Bug #1389757 - Problems with FIPS mode (edewata)
    and moved the patch from the RHCS 9.1.z bug to the RHEL 7.3.z bug.


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-15
changelog:
  - ## RHEL 7.3.z Batch Update 2
  - Bugzilla Bug #1404173 - user-cert-add --serial CLI request to secure port
    with remote CA shows authentication failure (edewata)
  - Bugzilla Bug #1404175 -  pki ca-cert-request-submit fails presumably because
    of missing authentication even if it should not require any (edewata)
  - Bugzilla Bug #1404178 - Changes to target.agent.approve.list parameter is
    not reflected in the TPS Web UI [pki-base] (edewata)
  - Bugzilla Bug #1404172 - Unable to install subordinate CA with HSM in FIPS
    mode (edewata)
  - Bugzilla Bug #1403689 - pkispawn does not change default ecc key size from
    nistp256 when nistp384 is specified in spawn config (jmagne)
  - Bugzilla Bug #1404176 - logging properties and man pages (edewata)
  - ## RHCS 9.1.z Batch Update 2
  - Bugzilla Bug #1386257 - Changes to target.agent.approve.list parameter is
    not reflected in the TPS Web UI [pki-tps] (edewata)
  - Bugzilla Bug #1391207 - Automatic recovery of encryption cert - CA and TPS
    tokendb shows different certificate status (cfu)
  - Bugzilla Bug #1395479 -  TPS throws "err=6" when attempting to format and
    enroll G&D Cards (jmagne)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-16
changelog:
  - Separate original patches into RHEL and RHCS portions
  - ## RHEL 7.3.z Batch Update 2
  - Bugzilla Bug #1404176 - logging properties and man pages (edewata)
  - Bugzilla Bug #1405328 - TPS throws "err=6" when attempting to format and
    enroll G&D Cards (jmagne)
  - ## RHCS 9.1.z Batch Update 2
  - Bugzilla Bug #1395479 - TPS throws "err=6" when attempting to format and
    enroll G&D Cards (jmagne)
  - Bugzilla Bug #1404900 - RHCS logging properties (edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-17
changelog:
  - ## RHCS 9.1.z Batch Update 3
  - Bugzilla Bug #1391207 - Automatic recovery of encryption cert - CA and TPS
    tokendb shows different certificate status (cfu)
  - ## RHEL 7.3.z Batch Update 3
  - Bugzilla Bug #1417063 - ECDSA Certificates Generated by Certificate System
    8.1 fail NIST validation test with parameter field. (cfu)
  - Bugzilla Bug #1417064 - Unable to search certificate requests using the
    latest request ID (edewata)
  - Bugzilla Bug #1417065 - CA Certificate Issuance Date displayed on CA website
    incorrect (alee)
  - Bugzilla Bug #1417066 - update to 7.3 IPA with otpd bugfixes, tomcat will
    not finish start, hangs (ftweedal)
  - Bugzilla Bug #1417067 - pki-tomcat for 10+ minutes before generating cert
    (edewata)
  - Bugzilla Bug #1417190 - Problem with default AJP hostname in IPv6
    environment. (edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-18
changelog:
  - ## RHEL 7.3.z Batch Update 4
  - Bugzilla Bug #1429492 - Add profile component that copies CN to SAN
    (ftweedal)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-19
changelog:
  - ## RHEL 7.3.z Batch Update 6
  - Bugzilla Bug #1447095 - RHCS 9.1 RC5 CA in the certificate profiles the
    startTime parameter is not working as expected. (jmagne)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-2
changelog:
  - ############################################################################
  - RHEL 7.4:
  - ############################################################################
  - Bugzilla Bug #1282504 - Installing pki-server in container reports
    scriptlet failed, exit status 1 (jpazdziora)
  - Bugzilla Bug #1400149 - pkispawn fails to create CA subsystem on FIPS
    enabled system (edewata)
  - Bugzilla Bug #1410650 - [RFE] Add SCP03 support
    for sc 7 g & d cards (RHEL) (jmagne)
  - Bugzilla Bug #1437591 - cli authentication using expired cert throws an
    exception (edewata)
  - Bugzilla Bug #1437602 - non-CA cli looks for CA in the instance during a
    request (edewata)
  - ############################################################################
  - RHCS 9.2:
  - ############################################################################
  - Bugzilla Bug #1274086 - [RFE] Add SCP03 support
    for sc 7 g & d cards (RHCS) (jmagne)
  - ############################################################################
  - Common Criteria
  - ############################################################################
  - Bugzilla Bug #1404080 - CC: add audit event: various SSL/TLS failures
    (edewata)
  - Bugzilla Bug #1417307 - CC: Audit Review /Searches (edewata)
  - Bugzilla Bug #1419737 - CC: CMC: id-cmc-popLinkWitnessV2 feature
    implementation (cfu)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-3
changelog:
  - ############################################################################
  - RHEL 7.4:
  - ############################################################################
  - Bugzilla Bug #1303683 - dogtag should support GSSAPI based auth in
    conjuction with FreeIPA (ftweedal)
  - Bugzilla Bug #1385208 - RHCS 9.1 RC5 CA in the certificate profiles the
    startTime parameter is not working as expected. (jmagne)
  - Bugzilla Bug #1419756 - CC: allow CA to process pre-signed CMC non-signing
    certificate requests (cfu)
  - Bugzilla Bug #1426754 - PKCS12: upgrade to at least AES and SHA2 (ftweedal)
  - Bugzilla Bug #1445088 - profile modification cannot remove existing config
    parameters (ftweedal)
  - Bugzilla Bug #1445535 - CC: Crypto Operation (AES Encryption/Decryption)
    (RHEL) (alee)
  - Bugzilla Bug #1446874 - Missing ClientIP and ServerIP in audit log when
    pki CLI terminates SSL connection (edewata)
  - Bugzilla Bug #1446875 - Session timeout for PKI console (RHEL) (edewata)
  - ############################################################################
  - RHCS 9.2:
  - ############################################################################
  - Bugzilla Bug #1404480 - CC: Crypto Operation (AES Encryption/Decryption)
    (RHCS) (alee)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-4
changelog:
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1386303 - cannot extract generated private key from KRA when
    HSM is used. (alee)
  - Bugzilla Bug #1446364 - pkispawn returns before tomcat is ready (cheimes)
  - Bugzilla Bug #1447145 - CMC: cmc.popLinkWitnessRequired=false would cause
    error (cfu)
  - Bugzilla Bug #1448203 - CAInfoService: retrieve KRA-related values from
    the KRA (ftweedal)
  - Bugzilla Bug #1448204 - pkispawn of clone install fails with
    InvalidBERException (ftweedal)
  - Bugzilla Bug #1448521 - kra unable to extract symmetric keys generated on
    thales hsm (alee)
  - Updated "jss" build and runtime requirements (mharmsen)
  - ##########################################################################
  - RHCS 9.2:
  - ##########################################################################
  - Bugzilla Bug #1274086 - [RFE] Add SCP03 support (RHCS) (jmagne)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-5
changelog:
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1419761 - CC: allow CA to process pre-signed CMC renewal
    non-signing cert requests (cfu)
  - Bugzilla Bug #1447080 - CC: CMC: allow enrollment key signed (self-signed)
    CMC with identity proof (cfu)
  - Bugzilla Bug #1447144 - CA brought down during separate KRA instance
    creation (mharmsen)
  - Bugzilla Bug #1448903 - exception Invalid module "--ignore-banner" when
    defined in ~/.dogtag/pki.conf and run pki pkcs12-import --help (edewata)
  - Bugzilla Bug #1450143 - CA installation with HSM in FIPS mode fails (jmagne)
  - Bugzilla Bug #1452123 - CA CS.cfg shows default port (mharmsen)
  - Bugzilla Bug #1452250 - Inconsistent CERT_REQUEST_PROCESSED event in
    ConnectorServlet. (edewata)
  - Bugzilla Bug #1452340 - Ensuring common audit log correctness (edewata)
  - Bugzilla Bug #1452344 - Adding serial number into CERT_REQUEST_PROCESSED
    audit event. (edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-7
changelog:
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1393633 - Creating symmetric key (sharedSecret)
    using tkstool is failing when RHEL 7.3 is in FIPS mode. (jmagne)
  - Bugzilla Bug #1445519 - CA Server installation with HSM fails
    (jmagne)
  - Bugzilla Bug #1452617 - Unable to create IPA Sub CA
    (ftweedal)
  - Bugzilla Bug #1454471 - Enabling all subsystems on startup
    (edewata)
  - Bugzilla Bug #1455617 - Key recovery on token fails because
    key record is not marked encrypted (alee)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-8
changelog:
  - Require "selinux-policy-targeted >= 3.13.1-159" as a runtime requirement
  - Require "tomcatjss >= 7.2.1-4" as a build and runtime requirement
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1400149 - pkispawn fails to create CA subsystem on FIPS
    enabled system (edewata)
  - Bugzilla Bug #1447144 - CA brought down during separate KRA instance
    creation (edewata)
  - Bugzilla Bug #1447762 - pkispawn fails occasionally with this failure
    ACCESS_SESSION_ESTABLISH_FAILURE (edewata)
  - Bugzilla Bug #1454450 - SubCA installation failure with 2 step
    installation in fips enabled mode (edewata)
  - Bugzilla Bug #1456597 - Certificate import using pki client-cert-import
    is asking for password when already provided (edewata)
  - Bugzilla Bug #1456940 - Build failure due to Pylint issues (cheimes)
  - Bugzilla Bug #1458043 - Key recovery using externalReg fails
    with java null pointer exception on KRA (alee)
  - Bugzilla Bug #1458379 - Upgrade script for keepAliveTimeout parameter
    (edewata)
  - Bugzilla Bug #1458429 - client-cert-import --ca-cert should
    import CA cert with trust bits "CT,C,C" (edewata)
  - ##########################################################################
  - RHCS 9.2:
  - ##########################################################################
  - Bugzilla Bug #1274086 - [RFE] Add SCP03 support (RHCS) (jmagne)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-9
changelog:
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1393633 - Creating symmetric key (sharedSecret)
    using tkstool is failing when RHEL 7.3 is in FIPS mode. (jmagne)
  - Bugzilla Bug #1419756 - CC: allow CA to process pre-signed CMC
    non-signing certificate requests (cfu)
  - Bugzilla Bug #1419777 - CC: allow CA to process pre-signed CMC
     revocation non-signing cert requests (cfu)
  - Bugzilla Bug #1458047 - change the way aes clients refer to
    aes keysets (alee)
  - Bugzilla Bug #1458055 - dont reuse IVs in the CMC code
    (alee)
  - Bugzilla Bug #1460028 - In keywrap mode, key recovery on
    KRA with HSM causes KRA to crash (ftweedal)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-10
changelog:
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1458043 - Key recovery on token fails with
    invalid public key error on KRA (alee)
  - Bugzilla Bug #1460764 - CC: CMC: check HTTPS client
    authentication cert against CMC signer (cfu)
  - Bugzilla Bug #1461533 - Unable to find keys in the p12 file after
    deleting the any of the subsystem certs from it (ftweedal)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-11
changelog:
  - Resolves: rhbz #1469432
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1469432 - CMC plugin default change
  - Resolves CVE-2017-7537
  - Fixes BZ #1470948


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-12
changelog:
  - Resolves: rhbz #1472615,1472617,1469447,1463350,1469449,1472619,1464970,1469437,1469439,1469446
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1472615 - CC: allow CA to process pre-signed CMC non-signing
    certificate requests (cfu)
    [PREVIOUS PATCH:  pki-core-beta.patch]
    [PREVIOUS PATCH:  pki-core-snapshot-4.patch]
  - Bugzilla Bug #1472617 - CMC: cmc.popLinkWitnessRequired=false would cause
    error (cfu)
    [PREVIOUS PATCH:  pki-core-post-beta.patch]
  - Bugzilla Bug #1469447 - CC: CMC: check HTTPS client authentication cert
    against CMC signer (cfu)
    [PREVIOUS PATCH:  pki-core-CMC-check-HTTPS-client-authentication-cert.patch]
  - Bugzilla Bug #1463350 - Access banner validation (edewata)
    [pki-core-server-access-banner-validation.patch]
  - Bugzilla Bug #1469449 - CC: allow CA to process pre-signed CMC renewal
    non-signing cert requests (cfu)
    [PREVIOUS PATCH:  pki-core-snapshot-1.patch]
    [pki-core-pre-signed-CMC-renewal-UniqueKeyConstraint.patch]
  - Bugzilla Bug #1472619 - Platform Dependent Python Import (mharmsen)
    [pki-core-platform-dependent-python-import.patch]
  - Bugzilla Bug #1464970 - CC: CMC: replace id-cmc-statusInfo with
    id-cmc-statusInfoV2 (cfu)
    [pki-core-CMC-id-cmc-statusInfoV2.patch]
  - Bugzilla Bug #1469437 - subsystem-cert-update command lacks --cert option
    (dmoluguw)
    [pki-core-subsystem-cert-update-CLI-cert-option.patch]
  - Bugzilla Bug #1469439 - Fix Key Changeover with HSM to support SCP03
    (jmagne)
    [pki-core-HSM-key-changeover-SCP03-support.patch]
  - Bugzilla Bug #1469446 - CC: need CMC enrollment profiles for system
    certificates (cfu)
    [pki-core-system-cert-CMC-enroll-profile.patch]


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-13
changelog:
  - Resolves: rhbz #1463350
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1463350 - Access banner validation (edewata)
    [pki-core-server-access-banner-retrieval-validation.patch]


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-14
changelog:
  - Require "jss >= 4.4.0-8" as a build and runtime requirement
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Resolves: rhbz #1486870,1485833,1487509,1490241,1491332
  - Bugzilla Bug #1486870 - Lightweight CA key replication fails (regressions)
    [RHEL 7.4.z] (ftweedal)
  - Bugzilla Bug #1485833 - Missing CN in user signing cert would cause error
    in cmc user-signed [rhel-7.4.z] (cfu)
  - Bugzilla Bug #1487509 - pki-server-upgrade fails when upgrading from
    RHEL 7.1 [rhel-7.4.z] (ftweedal)
  - Bugzilla Bug #1490241 - PKCS12: upgrade to at least AES and SHA2 (FIPS)
    [rhel-7.4.z] (ftweedal)
  - Bugzilla Bug #1491332 - TPS UI: need to display tokenType and tokenOrigin
    for token certificates on TPS UI Server [rhel-7.4.z] (edewata)
  - dogtagpki Pagure Issue #2764 - py3: pki.key.archive_encrypted_data:
    TypeError: ... is not JSON serializable (ftweedal)
  - ##########################################################################
  - RHCS 9.2:
  - ##########################################################################
  - Resolves: rhbz #1486870,1485833,1487509,1490241,1491332,1482729,1462271
  - Bugzilla Bug #1462271 - TPS incorrectly assigns "tokenOrigin" and
    "tokenType" certificate attribute for recovered certificates. (cfu)
  - Bugzilla Bug #1482729 - TPS UI: need to display tokenType and tokenOrigin
    for token certificates on TPS UI (edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-16
changelog:
  - ###########################################################################
  - ## RHCS 9.2
  - ###########################################################################
  - #Bugzilla Bug #1439228 - externalRegRecover does not support multiple
    - #Bugzilla Bug #1507160 - TPS new configuration to allow the protocol of
    - #Bugzilla Bug #1471996 - Certificate Revocation Reasons not being updated
    - ###########################################################################
  - ## RHEL 7.4
  - ###########################################################################
  - Bugzilla Bug #1500499 - Certificate Revocation Reasons not being updated
    in some cases [rhel-7.4.z] (cfu)
  - Bugzilla Bug #1502527 - CA cert without Subject Key Identifier causes
    issuance failure [rhel-7.4.z] (ftweedal)
  - Bugzilla Bug #1492560 - ipa-replica-install --setup-kra broken on DL0
    [rhel-7.4.z] (ftweedal)
    NOTE: Check-ins for #1492560 all reference the dogtagpki Pagure Issue
          associated with Bugzilla Bug #1402280 - CA Cloning: Failed to
          update number range in few cases (which is not yet fully resolved)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-17
changelog:
  - ###########################################################################
  - ## RHCS 9.2
  - ###########################################################################
  - #Bugzilla Bug #1507160 - TPS new configuration to allow the protocol of


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-5
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release
    (RHEL)
  - Bugzilla Bug #1466066 - CC: Secure removal of secret data storage
    (jmagne)
  - Bugzilla Bug #1518096 - ExternalCA: Failures in ExternalCA when tried to
    setup with CMC signed certificates (cfu)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-6
changelog:
  - Updated jss, nuxwdog, and openssl dependencies
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release
    (RHEL)
  - Bugzilla Bug #1402280 - CA Cloning: Failed to update number range in
    few cases (ftweedal)
  - Bugzilla Bug #1428021 - CC: shared token storage and retrieval
    mechanism (cfu)
  - Bugzilla Bug #1447145 - CMC: cmc.popLinkWitnessRequired=false
    would cause error (cfu)
  - Bugzilla Bug #1498957 - pkidestroy does not work with nuxwdog
     (alee)
  - Bugzilla Bug #1520277 - PR_FILE_NOT_FOUND_ERROR during
    pkispawn (alee)
  - Bugzilla Bug #1520526 - p12 admin certificate is missing when
    certificate is signed Externally (edewata)
  - Bugzilla Bug #1523410 - Unable to have non "pkiuser" owned CA
     instance (alee)
  - Bugzilla Bug #1523443 - HAProxy rejects OCSP responses due to
    missing nextupdate field (ftweedal)
  - Bugzilla Bug #1526881 - Not able to setup CA with ECC (mharmsen)
  - Bugzilla Bug #1532759 - pkispawn seems to be leaving our passwords
    in several different files after installation completes (alee)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-7
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - # Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release
    - Bugzilla Bug #1445532 - CC: Audit Events: Update the default audit event
    set (RHEL) (edewata)
  - Bugzilla Bug #1522938 - CC: Missing faillure resumption detection and
    audit event logging at startup (jmagne)
  - Bugzilla Bug #1523410 -  Unable to have non "pkiuser" owned CA instance
    (alee)
  - Bugzilla Bug #1525306 - CC: missing CMC request and response record
    (cfu)
  - Bugzilla Bug #1532933 - Installing subsystems with external CMC
    certificates in HSM environment shows import error (edewata)
  - Bugzilla Bug #1535797 - ExternalCA: Failures when installed with hsm
    (edewata)
  - Bugzilla Bug #1539125 - restrict default cipher suite to those ciphers
    permitted in fips mode (mharmsen)
  - Bugzilla Bug #1539198 - Inconsistent CERT_REQUEST_PROCESSED
    outcomes. (edewata)
  - Bugzilla Bug #1540440 - CMC: Audit Events needed for failures in
    SharedToken scenario's (cfu)
  - Bugzilla Bug #1541526 - CMC: Revocation works with an unknown
    revRequest.issuer (cfu)
  - Bugzilla Bug #1541853 - ProfileService: config values with
    backslashes have backslashes removed (ftweedal)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,
    - # Bugzilla Bug #1404075 - CC: Audit Events: Update the default audit
    - # Bugzilla Bug #1501436 - TPS CS.cfg should be reflected with the


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-8
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - # Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release
    - Bugzilla Bug #1542210 - pki console configurations that involves ldap
    passwords leave the plain text password in debug logs (jmagne)
  - Bugzilla Bug #1543242 - Regression in lightweight CA key replication
    (ftweedal)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-9
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - # Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release
    - Bugzilla Bug #1445532 - CC: Audit Events: Update the default audit event
    set (RHEL) (edewata)
  - Bugzilla Bug #1532867 - Inconsistent key ID encoding (edewata)
  - Bugzilla Bug #1540687 - CC: External OCSP Installation failure with HSM
    and FIPS (edewata)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,
    - # Bugzilla Bug #1404075 - CC: Audit Events: Update the default audit event


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-10
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1550581 - CMCAuth throws
    org.mozilla.jss.crypto.TokenException: Unable to insert certificate into
    temporary database [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1551067 - [MAN] Add --skip-configuration
    and --skip-installation into pkispawn man page. [rhel-7.5.z] (edewata)
  - Bugzilla Bug #1552241 - Make sslget aware of TLSv1_2 ciphers
    [rhel-7.5.z] (cheimes, mharmsen)
  - Bugzilla Bug #1553068 - Using a Netmask produces an odd entry
    in a certifcate [rhel-7.5.z] (ftweedal)
  - Bugzilla Bug #1554726 - Need ECC-specific Enrollment Profiles for
    standard conformance [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1554727 - Permit additional FIPS ciphers to be enabled
    by default for RSA . . . [rhel-7.5.z] (mharmsen, cfu)
  - Bugzilla Bug #1557880 - [MAN] Missing Man pages for tools
    CMCRequest, CMCResponse, CMCSharedToken [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1557883 - Console: Adding ACL from pki-console gives
    StringIndexOutOfBoundsException [rhel-7.5.z] (ftweedal)
  - Bugzilla Bug #1558919 - Not able to generate certificate request
    with ECC using pki client-cert-request [rhel-7.5.z] (akahat)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1560233 - libtps does not directly depend on libz


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-11
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1554726 - Need ECC-specific Enrollment Profiles for
    standard conformance [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1557880 - [MAN] Missing Man pages for tools
    CMCRequest, CMCResponse, CMCSharedToken [rhel-7.5.z] (cfu)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1560233 - libtps does not directly depend on libz


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-12
changelog:
  - Updated "jss" build and runtime requirements (mharmsen)
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1571582 - [MAN] Missing Man pages for tools CMCRequest,
    CMCResponse, CMCSharedToken (typos) [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1572548 - IPA install with external-CA is failing when
    FIPS mode enabled. [rhel-7.5.z] (edewata)
  - Bugzilla Bug #1574848 - servlet profileSubmitCMCSimple throws NPE
    [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1575521 - subsystem -> subsystem SSL handshake issue
    with TLS_ECDHE_RSA_* on Thales HSM [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1581134 - ECC installation for non CA subsystems needs
    improvement [rhel-7.5.z] (jmagne)
  - Bugzilla Bug #1581135 - SAN in internal SSL server certificate in
    pkispawn configuration step [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1581167 - CC: CMC profiles: Some CMC profiles have wrong
    input class_id [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1581382 - ECDSA Certificates Generated by Certificate System
    9.3 fail NIST validation test with parameter field. [rhel-7.5.z] (cfu)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-13
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1553068 - Using a Netmask produces an odd
    entry in a certifcate [rhel-7.5.z] (ftweedal)
  - Bugzilla Bug #1585945 - CMC CRMF requests result in
    InvalidKeyFormatException when signing algorithm is ECC
    [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1587826 - ExternalCA: Installation failed during
    csr generation with ecc [rhel-7.5.z] (rrelyea, gkapoor)
  - Bugzilla Bug #1588944 - Cert validation for installation with
    external CA cert [rhel-7.5.z] (edewata)
  - Bugzilla Bug #1588945 - CRMFPopClient tool - should allow
    option to do no key archival (cfu)
  - Bugzilla Bug #1589307 - CVE-2018-1080 pki-core: Mishandled
    ACL configuration in AAclAuthz.java reverses rules that allow
    and deny access [rhel-7.5.z] (ftweedal, cfu)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-14
changelog:
  - Updated "jss" build and runtime requirements (mharmsen)
  - Updated "tomcatjss" build and runtime requirements (mharmsen)
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1574848 - servlet profileSubmitCMCSimple throws NPE
    [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1593585 - Need proper default subjectDN for CMC request
    authenticated through SharedToken [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1594128 - CMC: Audit Events needed for failures in
    SharedToken scenario's [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1595606 - AuditVerify failure due to line breaks
    [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1596525 - Address ECC profile overrides [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1596551 - X500Name.directoryStringEncodingOrder overridden
    by CSR encoding [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1553068 - Using a Netmask produces an odd entry in a
    certifcate [rhel-7.5.z] (ftweedal)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-15
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1600905 - pki console configurations that involves ldap
    passwords leave the plain text password in signed audit logs
    [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1611245 - Certificate generation happens with partial
    attributes in CMCRequest file [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1611250 - Better understanding of
    NSS_USE_DECODED_CKA_EC_POINT for ECC [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1612880 - CMC Revocations throws exception with
    same reqIssuer & certissuer [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1614837 - ipa-replica-install --setup-kra broken on
    DL0 with latest version [rhel-7.5.z] (abokovoy)
  - Bugzilla Bug #1614839 - CC: Enable all config audit events
    [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1615266 - ECC keys not supported for signing audit
    logs [rhel-7.5.z] (cfu)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1539933 - keyGen fails when only Identity


author: Dogtag Team <pki-devel@redhat.com> 10.5.9-7
changelog:
  - Require "tomcatjss >= 7.2.1-8" as a build and runtime requirement
  - ##########################################################################
  - # RHEL 7.6:
  - ##########################################################################
  - Bugzilla Bug #1632116 - CC: missing audit event for CS acting as
    TLS client [rhel-7.6.z] (cfu)
  - Bugzilla Bug #1632120 - Unsupported RSA_ ciphers should be
    removed from the default ciphers list [rhel-7.6.z] (cfu)
  - Bugzilla Bug #1632615 - Permit certain SHA384 FIPS ciphers to be
    enabled by default for RSA and ECC . . . [rhel-7.6.z] (cfu)
  - Bugzilla Bug #1632616 - X500Name.directoryStringEncodingOrder
    overridden by CSR encoding (coverity changes) [rhel-7.6.z] (mharmsen)
  - Bugzilla Bug #1633104 - CMC: add config to allow non-clientAuth
    [rhel-7.6.z] (cfu)
  - Bugzilla Bug #1636490 - Installation of CA using an existing CA fails
    [rhel-7.6.z] (edewata)
  - Bugzilla Bug #1643878 - pki cli command for RHCS doesn't prompt for
    a password [rhel-7.6.z] (edewata)
  - Bugzilla Bug #1643879 - CC: Identify version/release of pki-ca, pki-kra,
    pki-ocsp, pki-tks, and pki-tps remotely [RHEL] [rhel-7.6.z] (cfu, jmagne)
  - Bugzilla Bug #1643880 - PKI subsystem process is not shutdown when
    there is no space on the disk to write logs [rhel-7.6.z] (edewata)
  - ##########################################################################
  - # RHCS 9.4:
  - ##########################################################################
  - # Bugzilla Bug #1639836 - CC: Identify RHCS version of CA, KRA,


author: Dogtag Team <pki-devel@redhat.com> 10.5.9-8
changelog:
  - ##########################################################################
  - # RHEL 7.6:
  - ##########################################################################
  - Bugzilla Bug #1645262 - pkidestroy may not remove all files [rhel-7.6.z]
    (dmoluguw)
  - Bugzilla Bug #1645263 - Auth plugins leave passwords in the access
    log and audit log using REST [rhel-7.6.z] (dmoluguw)
  - Bugzilla Bug #1645429 - pkispawn fails due to name collision with
    /var/log/pki/<instance> [rhel-7.6.z] (dmoluguw)
  - Bugzilla Bug #1655951 - CC: tools supporting CMC requests output
    keyID needs to be captured in file [rhel-7.6.z] (cfu)
  - Bugzilla Bug #1656297 - Unable to install with admin-generated keys
    [rhel-7.6.z] (edewata)
  - ##########################################################################
  - # RHCS 9.4:
  - ##########################################################################
  - # Bugzilla Bug #1639836 - CC: Identify RHCS version of CA, KRA,


author: Dogtag Team <pki-devel@redhat.com> 10.5.9-9
changelog:
  - ##########################################################################
  - # RHEL 7.6:
  - ##########################################################################
  - Bugzilla Bug #1657922 - CC: CA/OCSP startup fail on SystemCertsVerification
    if enableOCSP is true [rhel-7.6.z] (jmagne)
  - ##########################################################################
  - # RHCS 9.4:
  - ##########################################################################
  - # Bugzilla Bug #1639836 - CC: Identify RHCS version of CA, KRA,


author: Dogtag Team <pki-devel@redhat.com> 10.5.9-10
changelog:
  - ##########################################################################
  - # RHEL 7.6:
  - ##########################################################################
  - Bugzilla Bug #1659939 - CC: Simplifying Web UI session timeout
    configuration [rhel-7.6.z] (edewata)
  - ##########################################################################
  - # RHCS 9.4:
  - ##########################################################################
  - # Bugzilla Bug #1639836 - CC: Identify RHCS version of CA, KRA,
    - # Added Batch Update Information to Product Version (mharmsen)


author: Dogtag Team <pki-devel@redhat.com> 10.5.9-11
changelog:
  - Updated jss dependencies
  - ##########################################################################
  - # RHEL 7.6:
  - ##########################################################################
  - Bugzilla Bug #1671245 - CC: unable to verify cert before import
    [rhel-7.6.z] (ascheel)
  - Bugzilla Bug #1671303 - CC: Upgrade scripts for audit event names (RHEL)
    [rhel-7.6.z] (edewata)
  - ##########################################################################
  - # RHCS 9.4:
  - ##########################################################################
  - # Bugzilla Bug #1671586 - CC: Upgrade scripts for audit event names (RHCS)


author: Dogtag Team <pki-devel@redhat.com> 10.5.9-13
changelog:
  - Updated jss dependencies
  - ##########################################################################
  - # RHEL 7.6:
  - ##########################################################################
  - Bugzilla Bug #1671245 - CC: unable to verify cert before import
    [rhel-7.6.z] [manpage] (ascheel)
  - Bugzilla Bug #1671303 - CC: Upgrade scripts for audit event names (RHEL)
    [rhel-7.6.z] (edewata)
  - ##########################################################################
  - # RHCS 9.4:
  - ##########################################################################
  - # Bugzilla Bug #1671586 - CC: Upgrade scripts for audit event names (RHCS)


author: Dogtag Team <pki-devel@redhat.com> 10.5.16-1
changelog:
  - Updated jss dependencies
  - ##########################################################################
  - # RHEL 7.7:
  - ##########################################################################
  - Bugzilla Bug #1633422 - Rebase pki-core from 10.5.1 to 10.5.16 (RHEL) 
  - ##########################################################################
  - # RHCS 9.5:
  - ##########################################################################
  - # Bugzilla Bug #1633423 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.16-2
changelog:
  - ##########################################################################
  - # RHEL 7.7:
  - ##########################################################################
  - Bugzilla Bug #1491453 - Need Method to Include SKI in CA Signing
    Certificate Request [ftweedal]
  - ##########################################################################
  - # RHCS 9.5:
  - ##########################################################################
  - # Bugzilla Bug #1633423 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.16-3
changelog:
  - ##########################################################################
  - # RHEL 7.7:
  - ##########################################################################
  - Bugzilla Bug #1638379 - PKI startup initialization process should not
    depend on LDAP operational attributes [ftweedal]
  - ##########################################################################
  - # RHCS 9.5:
  - ##########################################################################
  - Bugzilla Bug #1633423 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.16 in RHCS 9.5


author: Dogtag Team <pki-devel@redhat.com> 10.5.16-4
changelog:
  - ##########################################################################
  - # RHEL 7.7:
  - ##########################################################################
  - Bugzilla Bug #1743122 - RHCS-9 CA clone SSL server cert not issued with its
    custom SAN extension, RHEL-7.6 and HSM [rhel-7.7.z] (edewata)
  - ##########################################################################
  - # RHCS 9.5:
  - ##########################################################################
  - # Bugzilla Bug #1633423 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.16-5
changelog:
  - ##########################################################################
  - # RHEL 7.7:
  - ##########################################################################
  - Bugzilla Bug #1750277 - CC: missing audit event for CS acting as TLS client
    [rhel-7.7.z] (cfu)
  - ##########################################################################
  - # RHCS 9.5:
  - ##########################################################################
  - # Bugzilla Bug #1633423 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.16-6
changelog:
  - ##########################################################################
  - # RHEL 7.7:
  - ##########################################################################
  - Bugzilla Bug #1754845 - number range depletion when multiple clones
    created from same master (ftweedal)
  - ##########################################################################
  - # RHCS 9.5:
  - ##########################################################################
  - # Bugzilla Bug #1633423 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-3
changelog:
  - Updated jss dependencies
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug #1794213 - Server-Side keygen Enrollment for EE (cfu)
  - Bugzilla Bug #1809273 - CRL generation performs an unindexed search (jmagne)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - # Bugzilla Bug #1549307 - No default TPS Auditor group (ascheel)


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-4
changelog:
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug #1794213 - Server-Side keygen Enrollment for EE
    additional support and touch-up (cfu)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - # Bugzilla Bug #1710975 - TPS - Searching the certificate DB for a brand new


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-6
changelog:
  - Patch for CMC Credential Error, RSA PSS typo, and new profile
    for directory-authentication-based Server-Side keygen
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug #1710109 - add RSA PSS support (jmagne)
  - Bugzilla Bug #1794213 - Server-Side keygen Enrollment for EE (cfu)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-7
changelog:
  - Patch for CMCResponse tool
  - Bugzilla Bug #1710109 - add RSA PSS support - fix CMCResponse tool (jmagne)


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-8
changelog:
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug #1883639 - add profile caAuditSigningCert (cfu)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - # Bugzilla Bug #1710978 - TPS - Add logging to tdbAddCertificatesForCUID if
    - # Bugzilla Bug #1858860 - TPS - Update Error Codes returned to client
    - # Bugzilla Bug #1858861 - TPS - Server side key generation is not working
    - # Bugzilla Bug #1858867 - TPS does not check token cuid on the user


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-9
changelog:
  - Bugzilla Bug #1883639 - additional support on upgrade for audit
    cert profile and auditProfileUpgrade + auditProfileUpgrade part 2 (cfu)


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-11
changelog:
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug 1883639 - Add KRA Transport and Storage Certificates
    profiles, audit for IPA (edewata)
  - ##########################################################################
  - # Backported CVEs (ascheel):
  - ##########################################################################
  - Bugzilla Bug 1724697 - CVE-2019-10180 pki-core: unsanitized token
    parameters in TPS resulting in stored XSS [certificate_system_9-default]
    (edewata, ascheel)
  - Bugzilla Bug 1725128 - CVE-2019-10178 pki-core: stored Cross-site
    scripting (XSS) in the pki-tps web Activity tab
    [certificate_system_9-default] (edewata, ascheel)
  - Bugzilla Bug 1791100 - CVE-2020-1696 pki-core: Stored XSS in TPS profile
    creation [certificate_system_9-default] (edewata, ascheel)
  - Bugzilla Bug 1724688 - CVE-2019-10146 pki-core: Reflected Cross-Site
    Scripting in 'path length' constraint field in CA's Agent page
    [rhel-7.9.z] (dmoluguw, ascheel)
  - Bugzilla Bug 1789843 - CVE-2019-10221 pki-core: reflected cross site
    scripting in getcookies?url= endpoint in CA [rhel-7.9.z]
    (dmoluguw, ascheel)
  - Bugzilla Bug 1724713 - CVE-2019-10179 pki-core: pki-core/pki-kra:
    Reflected XSS in recoveryID search field at KRA's DRM agent page in
    authorize recovery tab [rhel-7.9.z] (ascheel)
  - Bugzilla Bug 1798011 - CVE-2020-1721 pki-core: KRA vulnerable to
    reflected XSS via the getPk12 page [rhel-7.9.z] (ascheel,jmagne)
  - ##########################################################################
  - Update to jquery v3.4.1 (ascheel)
  - Update to jquery-i18n-properties v1.2.7 (ascheel)
  - Update to backbone v1.4.0 (ascheel)
  - Upgrade to underscore v1.9.2 (ascheel)
  - Update to patternfly v3.59.3 (ascheel)
  - Update to jQuery v3.5.1 (ascheel)
  - Upgrade to bootstrap v3.4.1 (ascheel)
  - Link in new Bootstrap CSS file (ascheel)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-12
changelog:
  - Change variable 'TPS' to 'tps'
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug 1883639 - Add KRA Transport and Storage Certificates
    profiles, audit for IPA (edewata)
  - ##########################################################################
  - # Backported CVEs (ascheel):
  - ##########################################################################
  - Bugzilla Bug 1724697 - CVE-2019-10180 pki-core: unsanitized token
    parameters in TPS resulting in stored XSS [certificate_system_9-default]
    (edewata, ascheel)
  - Bugzilla Bug 1725128 - CVE-2019-10178 pki-core: stored Cross-site
    scripting (XSS) in the pki-tps web Activity tab
    [certificate_system_9-default] (edewata, ascheel)
  - Bugzilla Bug 1791100 - CVE-2020-1696 pki-core: Stored XSS in TPS profile
    creation [certificate_system_9-default] (edewata, ascheel)
  - Bugzilla Bug 1724688 - CVE-2019-10146 pki-core: Reflected Cross-Site
    Scripting in 'path length' constraint field in CA's Agent page
    [rhel-7.9.z] (dmoluguw, ascheel)
  - Bugzilla Bug 1789843 - CVE-2019-10221 pki-core: reflected cross site
    scripting in getcookies?url= endpoint in CA [rhel-7.9.z]
    (dmoluguw, ascheel)
  - Bugzilla Bug 1724713 - CVE-2019-10179 pki-core: pki-core/pki-kra:
    Reflected XSS in recoveryID search field at KRA's DRM agent page in
    authorize recovery tab [rhel-7.9.z] (ascheel)
  - Bugzilla Bug 1798011 - CVE-2020-1721 pki-core: KRA vulnerable to
    reflected XSS via the getPk12 page [rhel-7.9.z] (ascheel,jmagne)
  - ##########################################################################
  - Update to jquery v3.4.1 (ascheel)
  - Update to jquery-i18n-properties v1.2.7 (ascheel)
  - Update to backbone v1.4.0 (ascheel)
  - Upgrade to underscore v1.9.2 (ascheel)
  - Update to patternfly v3.59.3 (ascheel)
  - Update to jQuery v3.5.1 (ascheel)
  - Upgrade to bootstrap v3.4.1 (ascheel)
  - Link in new Bootstrap CSS file (ascheel)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-13
changelog:
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug 1949136 - PKI instance creation failed with new 389-ds-base
    build (jmagne)
  - Bugzilla Bug 1949656 - CRMF requests with extensions other than SKID cannot
    be processed (cfu)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 6)


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-14
changelog:
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug 1911472 - Revoke via REST API not working when Agent
    certificate not issued by CA [rhel-7.9.z] (cfu)
  - Bugzilla Bug 1914587 - RHEL IPA PKI - Failed to read product version
    String.java.io.FileNotFoundException (ckelley)
  - Bugzilla Bug 1942687 - TPS not populating Token Policy, or switching
    PIN_RESET=YES to NO [rhel-7.9.z] (jmagne)
  - Bugzilla Bug 1955633 - Recovery of Keys migrated to latest version of KRA
    fail to recover and result in Null Point Exception [rhel-7.9.z] (jmagne)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 6)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-15
changelog:
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug 1905374 - restrict EE profile list and enrollment submission
    per LDAP group without immediate issuance [rhel-7.9.z] (cfu)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-16
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 8):
  - ##########################################################################
  - Bugzilla Bug 1958277 - PKCS10Client EC Attribute Encoding [cfu]
  - Bugzilla Bug 1958788 - ipa: ERROR: Request failed with status 500:
    Non-2xx response from CA REST API: 500 [ftweedale, ckelley]
  - ##########################################################################
  - # RHCS 9.7 (Batch Update 8):
  - ##########################################################################
  - Bugzilla Bug 1959937 - TPS Allowing Token Transactions while
    the CA is Down [cfu]
  - Bugzilla Bug 1979710 - TPS Not properly enforcing Token Profile
    Separation [cfu]


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-17
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 8):
  - ##########################################################################
  - Bugzilla Bug 1958788 - ipa: ERROR: Request failed with status 500: Non-2xx
    response from CA REST API: 500 [ftweedal, ckelley]
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-17
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 9):
  - ##########################################################################
  - Bugzilla Bug 1958788 - ipa: ERROR: Request failed with status 500: Non-2xx
    response from CA REST API: 500 [ftweedal, ckelley]
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-18
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 10):
  - ##########################################################################
  - Bugzillla Bug 1978345 - End Entity's List Certificates Page Back/Forward
    Buttons are Broken (ckelley, jonahon.d.parrish@mail.mil, mharmsen)
  - Bugzilla Bug 2008707 - pkispawn bails out too easily for things that could
    have been worked around after installation [RHEL 7.9.z] (cfu)
  - Bugzilla Bug 2016773 - Directory authentication plugin requires directory
    admin password just for user authentication (rhel-7.9.z)
    (awnuk@purestorage.com, jmagne)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <pki-devel@redhat.com> 10.5.17-5
changelog:
  - ##########################################################################
  - # RHEL 7.8:
  - ##########################################################################
  - Bugzilla Bug #1523330 - CC: missing audit event for CS acting as TLS client
    (cfu)
  - ##########################################################################
  - # RHCS 9.6:
  - ##########################################################################
  - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.17-6
changelog:
  - ##########################################################################
  - # RHEL 7.8:
  - ##########################################################################
  - Bugzilla Bug #1723008 - ECC Key recovery failure with
    CKR_TEMPLATE_INCONSISTENT (cfu)
  - Bugzilla Bug #1774282 - pki-server-nuxwdog template has pid file name with
    non-breakable space char encoded instead of 0x20 space char (ascheel)
  - ##########################################################################
  - # RHCS 9.6:
  - ##########################################################################
  - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-1
changelog:
  - Updated jss dependencies
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug #1774174 - Rebase pki-core from 10.5.17 to 10.5.18 (RHEL)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - # Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    - # Bugzilla Bug #1774181 - Update RHCS version of CA, KRA, OCSP, and TKS so


author: Dogtag Team <pki-devel@redhat.com> 10.5.9-1
changelog:
  - ##########################################################################
  - # RHEL 7.6:
  - ##########################################################################
  - Bugzilla Bug #1538311 - Using a Netmask produces an odd
    entry in a certifcate (ftweedal)
  - Bugzilla Bug #1544843 - ExternalCA: Installation failed during
    csr generation with ecc (rrelyea, gkapoor)
  - Bugzilla Bug #1557569 - Re-base pki-core from 10.5.1 to latest
    upstream 10.5.x (RHEL) (mharmsen)
  - Bugzilla Bug #1580394 - CMC CRMF requests result in
    InvalidKeyFormatException when signing algorithm is ECC (cfu)
  - Bugzilla Bug #1580527 - CVE-2018-1080 pki-core: Mishandled
    ACL configuration in AAclAuthz.java reverses rules that allow
    and deny access (ftweedal, cfu)
  - Bugzilla Bug #1585866 - CRMFPopClient tool - should allow
    option to do no key archival (cfu)
  - Bugzilla Bug #1588655 - Cert validation for installation with
    external CA cert (edewata)
  - ##########################################################################
  - # RHCS 9.4:
  - ##########################################################################
  - # Bugzilla Bug #1557570 - Re-base pki-core from 10.5.1 to


author: Dogtag Team <pki-devel@redhat.com> 10.5.9-2
changelog:
  - ##########################################################################
  - # RHEL 7.6:
  - ##########################################################################
  - Bugzilla Bug #1471935 - X500Name.directoryStringEncodingOrder overridden
    by CSR encoding (cfu)
  - Bugzilla Bug #1538311 - Using a Netmask produces an odd entry in a
    certificate (ftweedal)
  - Bugzilla Bug #1540440 - CMC: Audit Events needed for failures in
    SharedToken scenario's (cfu)
  - Bugzilla Bug #1550742 - Address ECC profile overrides (cfu)
  - Bugzilla Bug #1562841 - servlet profileSubmitCMCSimple throws NPE (cfu)
  - Bugzilla Bug #1572432 - AuditVerify failure due to line breaks (cfu)
  - Bugzilla Bug #1592961 - Need proper default subjectDN for CMC request
    authenticated through SharedToken (cfu)
  - ##########################################################################
  - # RHCS 9.4:
  - ##########################################################################
  - # Bugzilla Bug #1557570 - Re-base pki-core from 10.5.1 to


author: Dogtag Team <pki-devel@redhat.com> 10.5.9-4
changelog:
  - ##########################################################################
  - # RHEL 7.6:
  - ##########################################################################
  - Bugzilla Bug #1548203 - pki console configurations that involves ldap
    passwords leave the plain text password in signed audit logs (cfu)
  - ##########################################################################
  - # RHCS 9.4:
  - ##########################################################################
  - # Bugzilla Bug #1494591 - keyGen fails when only Identity


author: Dogtag Team <pki-devel@redhat.com> 10.5.9-5
changelog:
  - ##########################################################################
  - # RHEL 7.6:
  - ##########################################################################
  - Bugzilla Bug #1596629 - ipa-replica-install --setup-kra broken on DL0
    with latest version (abokovoy)
  - ##########################################################################
  - # RHCS 9.4:
  - ##########################################################################
  - # Bugzilla Bug #1557570 - Re-base pki-core from 10.5.1 to


author: Dogtag Team <pki-devel@redhat.com> 10.5.9-6
changelog:
  - Updated nuxwdog dependencies
  - ##########################################################################
  - # RHEL 7.6:
  - ##########################################################################
  - Bugzilla Bug #673182 - ECC keys not supported for signing
    audit logs (cfu)
  - Bugzilla Bug #1593805 - Better understanding of
    NSS_USE_DECODED_CKA_EC_POINT for ECC (cfu)
  - Bugzilla Bug #1601071 - Certificate generation happens with
    partial attributes in CMCRequest file (cfu)
  - Bugzilla Bug #1601569 - CC: Enable all config audit events
    (cfu)
  - Bugzilla Bug #1608375 - CMC Revocations throws exception
    with same reqIssuer & certissuer (cfu)
  - ##########################################################################
  - # RHCS 9.4:
  - ##########################################################################
  - # Bugzilla Bug #1557570 - Re-base pki-core from 10.5.1 to


author: Ray Strode <rstrode@redhat.com> 0.8.9-0.3.20140113
changelog:
  - Read OS string from REDHAT_BUGZILLA_PRODUCT instead of PRETTY_NAME
    in /etc/os-release to work around a lorax bug.
    Resolves: #911553
  - Fix text splash when explicitly configured by user
    Related: #911553
    Related: #1026571


author: Ray Strode <rstrode@redhat.com> 0.8.9-0.9.20140113
changelog:
  - Ignore early fb devices
    Resolves: #1063758
    Resolves: #1064235
    Resolves: #1066641
  - Ignore udev if using lone serial console
    Resolves: #1058049
  - Fix password at start up race
    Resolves: #1070707
    Resolves: #1073145


author: Ray Strode <rstrode@redhat.com> 0.8.9-0.16.20140113
changelog:
  - Ensure graphical special gets terminal even if drm driver isn't
    boot_vga (more fixes for hyper-v)
    Related: #1097174 1244858


author: Ray Strode <rstrode@redhat.com> 0.8.9-0.15.20140113
changelog:
  - Ship label plugin in initrd
    Resolves: #801932
  - Backport udev queue detection fix which may help missing password
    prompt on hyper-v
    Related: #1097174 1244858


author: Ray Strode <rstrode@redhat.com> - 0.8.9-0.25.20140113
changelog:
  - Read OS string from PRETTY_NAME instead of REDHAT_BUGZILLA_PRODUCT
    again, this time munging it to get rid of parts we want to hide.
    Related: #911553
    Resolves: #1306543


author: Ray Strode <rstrode@redhat.com> - 0.8.9-0.26.20140113
changelog:
  - Fix color of text progress bar
    Related: #1167735
  - Fix escape key during media check of live image
    Resolves: #1167735


author: Ray Strode <rstrode@redhat.com> - 0.8.9-0.28.20140113
changelog:
  - Don't change file mode of boot.log.  Instead, remember what mode
    the admin set it to.
    Related: #916704
  - Don't unlink boot.log before opening it.
    Related: #916704


author: Ray Strode <rstrode@redhat.com> - 0.8.9-0.29.20140113
changelog:
  - Fall back to text mode if /dev/dri/card0 can't modeset
    Resolves: #1431141
  - Remove unnecessary post scripts that rpm -V output
    Resolves: #1266085


author: Tim Waugh <twaugh@redhat.com> - 1:1.04-19
changelog:
  - Consistent use of macros.
  - Removed ancient obsoletes tag.
  - Clean buildroot in install section not prep section.
  - Make setup quiet.
  - Use noreplace for config files.


author: Dan Walsh <dwalsh@redhat.com> - 2.2.5-3
changelog:
  - Add Miroslav patch to
  - Fix previously_modified_initialize() to show modified changes properly for all selections
  Resolves: #1049977


author: Miroslav Grepl <mgrepl@redhat.com> - 2.2.5-5
changelog:
  - Remove default s0 range from semanage-login command. It is handled in seobject.py.
  Resolves:#1028106


author: Miroslav Grepl <mgrepl@redhat.com> - 2.2.5-11.el7_0.1
changelog:
  - Make selinux-policy build working also on another architectures related to sepolicy-manpage generate
  Resolves:#1135434


author: Miroslav Grepl <mgrepl@redhat.com> - 2.2.5-12
changelog:
  - Make selinux-policy build working also on another architectures related to sepolicy-manpage generate
  Resolves:#1103292


author: Miroslav Grepl <mgrepl@redhat.com> - 2.2.5-13
changelog:
  - If the user attempts to restorecon the label of a file that does not exist, do not report this as an error
  Resolves:#1082956
  - Make fixfiles_exclude_dirs working if there is a substituion for the given directory
  Resolves:#1082676
  - Add ability to list the actual active modules
  Resolves:#1075023
  - Update XDG_RUNTIME_DIR directory
  Resolves:#1112811
  - Fix semanage man page to talk about  semanage-* (8) man pages.
  Resolves:#1084390


author: Petr Lautrbach <plautrba@redhat.com> 2.2.5-16
changelog:
  - semanage: Use OrderedDict for list of fcontexts
  Resolves: rhbz#1206769
  - fixfiles: Cover file_context.XXX.homedir
  Resolves: rhbz#1186640


author: Petr Lautrbach <plautrba@redhat.com> 2.2.5-17
changelog:
  - Fix handling of Forking daemon, to allow systemd to handle it better
  Resolves: rhbz#1186648
  - Fix typo in semanage args for minimum policy store
  Resolves: rhbz#1208797
  - Allow to define sock file in /etc directory
  Resolves: rhbz#1188360


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-3
changelog:
  - Update sandbox types in sandbox manual
  - Fix typos in semanage manpages
  - Fix the documentation of -l,--list for semodule
  - Minor fix in a French translation
  - Fix the extract example in semodule.8
  - Update sandbox.8 man page
  - Remove typos from chcat --help
  - Fix multiple spelling errors
  - hll/pp: Warn if module name different than output filename


author: Petr Lautrbach <plautrba@redhat.com> 2.5-6.2
changelog:
  - open_init_pty: Do not error on EINTR
  - Fix [-s STORE] typos in semanage
  - Don't use subprocess.getstatusoutput() in Python 2 code


author: Petr Lautrbach <plautrba@redhat.com> 2.5-7
changelog:
  - fixfiles: Pass -n to restorecon for fixfiles check
  - sepolicy: Check get_rpm_nvr_list() return value
  - Don't use subprocess.getstatusoutput() in Python 2 code
  - semanage: Add auditing of changes in records
  - Remove unused 'q' from semodule getopt string


author: Petr Lautrbach <plautrba@redhat.com> 2.5-8
changelog:
  - audit2allow: tests should use local copy not system
  - audit2allow: remove audit2why so that it gets symlinked
  - semanage: fix man page and help message for import option
  - semanage: fix error message for fcontext -m
  - semanage: Fix semanage fcontext -D
  - semanage: Correct fcontext auditing
  - semanage: Default serange to "s0" for port modify
  - semanage: Use socket.getprotobyname for protocol
  - semanage: fix modify action in node and interface


author: Petr Lautrbach <plautrba@redhat.com> 2.5-9
changelog:
  - sandbox: create a new session for sandboxed processes - CVE-2016-7545
  - sandbox: do not try to setup directories without -X or -M


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-13
changelog:
  - hll/pp: Fix pp crash when processing base module (#1350806)
  - sepolicy: fix obtaining domain name in HTMLManPages (#1174744)


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-14
changelog:
  - Fix export of fcontext socket entries (#1435100)
  - Fix checks whether a module name is passed to semanage-module (#1420527)


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-15
changelog:
  - sepolicy: Do not fail when file_contexts.{homedirs,local} are not present (#1395778)
  - fixfiles - use quotes around "$FILEPATH" (#1241946)


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-16
changelog:
  - Strip non-printable characters when parsing audit messages (#1406328)
  - Install seobject python module into arch specific path (#1061049)
  - restorecond: Decrease loglevel of termination message (#1422121)
  - semodule_package: do not fail with an empty fc file (#1390535)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-18
changelog:
  - semanage: Enable listing file_contexts.homedirs
  - semanage: Fix manpage author for ibpkey and ibendport pages.
  - semanage: Update man pages for infiniband
  - semanage: Update semanage to allow runtime labeling of ibendports
  - semanage: Update semanage to allow runtime labeling of Infiniband Pkeys
  - semanage: Improve semanage-port man page
  - fixfiles: do not dereference link files in tmp


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-20
changelog:
  - setfiles: Mention customizable types in restorecon man page (#1260238)
  - sepolicy: do not fail when file_contexts.local or .subs do not exist (#1512590)
  - semanage: Fix export of ibendport entries (#1471809)


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-22
changelog:
  - semanage: Fix fcontext help message (#1499259)
  - semanage: Improve semanage-user.8 man page (#1079946)
  - semodule: Improve man page (#1337192)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-23
changelog:
  - Update translation files and remove empty ones (#1375915)
  - sepolicy: Fix sepolicy manpage (#1509383)
  - semanage/seobject: Fix moduleRecords.modify() (#1408331)
  - semodule: Improve man page and unify it with --help (#1320565)
  - setfiles: Improve description of -d switch (#1271327)
  - sepolgen: Try to translate SELinux contexts to raw (#1356149)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-24
changelog:
  - Stop rejecting SCTP and DCCP in sepolicy.info
  - semanage: Replace bare except with specific one (#1598444)
  - semanage: Fix logger class definition (#1598444)
  - semanage: Stop rejecting aliases in semanage commands (#1544793)
  - sepolicy: Stop rejecting aliases in sepolicy commands (#1600009)
  - semanage: Stop logging loginRecords changes (#1294663)
  - Use file_contexts.local in fixfiles restore (#1559808)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-30
changelog:
  - semanage/seobject: Fix listing boolean values (#1391605)
  - sepolicy: Make policy files sorting more robust
  - semanage: Fix setting alternative policy store (#1558033)
  - semanage: Load a store policy and set the store SELinux policy root
  - sepolicy: Add sepolicy.load_store_policy(store)
  - semanage: import sepolicy only when it's needed
  - semanage: move valid_types initialisations to class constructors
  - semanage/seobject: Fix indentation issues
  - scripts/fixfiles: Do not fail on file_contexts.local (#1647714)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-31
changelog:
  - semanage: Start exporting "ibendport" and "ibpkey" entries (#1657196)
  - semanage: Do not show "None" levels when using a non-MLS policy (#1400482)
  - semanage: Include MCS/MLS range when exporting local customizations (#1400482)


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-2
changelog:
  - sepolgen: Add support for TYPEBOUNDS statement in INTERFACE policy
    files (#1319338)
  - Add documentation for MCS separated domains
  - Move svirt man page out of libvirt into its own


author: Miloslav Trmač <mitr@redhat.com> - 0.112-2
changelog:
  - Workaround pam_systemd setting broken XDG_RUNTIME_DIR
    Resolves: #1033774
  - Always use mozjs-17.0 even if js-devel is installed


author: Miloslav Trmač <mitr@redhat.com> - 0.112-12
changelog:
  - Fix a memory leak in PolkitPermission.
    Patch by Rui Matos <tiagomatos@gmail.com>
    Resolves: #1433915


author: Miloslav Trmač <mitr@redhat.com> - 0.110-4
changelog:
  - Make the JavaScript engine mandatory.  The polkit-js-engine package has been
    removed, main polkit package Provides:polkit-js-engine for compatibility.
  - Add Requires: polkit-pkla-compat
    Resolves: #908808


author: Miloslav Trmač <mitr@redhat.com> - 0.110-4
changelog:
  - Shut up rpmlint about Summary:
  - Build with V=1
  - Use %{_unitdir} instead of hard-coding the path
  - Use the new systemd macros, primarily to run (systemctl daemon-reload)
    Resolves: #857382


author: Miloslav Trmač <mitr@redhat.com> - 0.111-1
changelog:
  - Update to polkit-0.111
    Resolves: #917888
  - Use SpiderMonkey from mozjs17 instead of js
  - Ship the signature in the srpm
  - Try to preserve timestamps in (make install)


author: Rex Dieter <rdieter@fedoraproject.org> 0.99.0-3
changelog:
  - patch to bring polkit auth dialog to front
  - patch restart polkit-kde on crash 
  - patch to remove unimplimented 'remember authorization' checkbox


author: Miloslav Trmač <mitr@redhat.com> - 0.1-2
changelog:
  - Add a comment above License about SRPM-only licenses
  - Reword Summary: to avoid a rpmlint warning
  - Move INSTALL= to the %install section


author: Rex Dieter <rdieter@fedoraproject.org> 0.99.0-3
changelog:
  - upstream crash patch (kde#258916,#684625)
  - pull a couple more upstream patches
  - -devel: drop Req: polkit-devel


author: Marek Kasik <mkasik@redhat.com> 0.22.5-2
changelog:
  - Add poppler-0.22.5-CVE-2013-4473.patch
      (Limit length of output to pathName buffer)
  - Add poppler-0.22.5-CVE-2013-4474.patch
      (Check file pattern)
  - Resolves: #1025160


author: Marek Kasik <mkasik@redhat.com> - 0.26.5-33
changelog:
  - Only embed mime data for gray/rgb/cmyk colorspaces
  - if image decode map is identity
  - Resolves: #1636103


author: Marek Kasik <mkasik@redhat.com> - 0.26.5-38
changelog:
  - Constrain number of cycles in rescale filter
  - Compute correct coverage values for box filter
  - Resolves: #1688417


author: Panu Matilainen <pmatilai@redhat.com> - 1.13-12
changelog:
  - Hack poptBadOption() to return something semi-meaningful on exec alias
    failures (#697435, #710267)
  - Run internal test-suite on build, minimal as it might be


author: Tim Waugh <twaugh@redhat.com> - 0.0.5-8
changelog:
  - Avoid a race during start-up if there are no configured ports (bug #1034139).
  - Moved tmpfiles configuration file to correct location.
  - Don't use %ghost in manifest for state directory, in order to make
    sure it is ready to use after installation.


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2:2.10.0-2
changelog:
  - Fixed systemd error message regarding chroot-update, patch provided
    by John Heidemann <johnh@isi.edu>
    Resolves: rhbz#917463


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2:2.10.1-7
changelog:
  - Fixed haproxy with TLS
    Resolves: rhbz#1370455
  - Fixed documentation about canonical maps
    Resolves: rhbz#1381871
  - Fixed build with kernel-4.*
    Resolves: rhbz#1575658


author: Jozef Mlich <jmlich@redhat.com> - 9.2.6-1
changelog:
  - Resolves #1038688
  - rebase to 9.2.6 see changes at
    http://www.postgresql.org/docs/9.2/static/release-9-2-6.html


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.7-1
changelog:
  - update to 9.2.7 per release notes (#1065845)
    http://www.postgresql.org/docs/9.2/static/release-9-2-7.html


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.10-1
changelog:
  - update to 9.2.10 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-10.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-9.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-8.html
    (rhbz#1198672 rhbz#1198673)


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.11-1
changelog:
  - update to 9.2.11 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-11.html


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.12-1
changelog:
  - update to 9.2.12 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-12.html


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.13-1
changelog:
  - update to 9.2.13 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-13.html


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.14-1
changelog:
  - update to 9.2.14 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-14.html


author: Pavel Kajaba <pkajaba@redhat.com> - 9.2.15-1
changelog:
  - update to 9.2.15 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-15.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.18-1
changelog:
  - update to 9.2.18 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-18.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-17.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-16.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.21-1
changelog:
  - update to 9.2.21 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-21.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-20.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-19.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.22-1
changelog:
  - update to 9.2.22 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-22.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.23-1
changelog:
  - update to 9.2.23 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-23.html


author: Jozef Mlich <jmlich@redhat.com> - 9.2.5-2
changelog:
  - Resolves: #1019762 
  - additionally fixes rpmdiff filelist problem with
    /usr/share/doc/postgresql-9.2.5/html/bookindex.html.orig


author: Tom Lane <tgl@redhat.com> 09.01.0200-1
changelog:
  - Update to version 09.01.0200
  - Minor specfile cleanup per suggestions from Tom Callaway
  Related: #845110


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.3-5
changelog:
  - Fixed some possible unregistered parameters errors
    (by reg-net-param patch)
    Resolves: rhbz#1014662
  - Unlimit FDs (by unlimit-fds patch)
    Printed friendly error message if the system is running out
    of FDs (by fd-limit-err patch)
    Resolves: rhbz#1017668


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.3-8
changelog:
  - Fixed buffer overflow in cpufreq tunables on systems with many CPUs
    (by tunable-overflow-fix patch)
    Resolves: rhbz#1080191


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.3-9
changelog:
  - MSR read errors are no more fatal (by msr-check patch)
    Resolves: rhbz#1102088
  - Backported --auto-tune feature and added one-shot systemd service
    (by auto-tune patch)
    Resolves: rhbz#1143014
  - Improved handling of reporting filenames (by improve-reporting patch)
    Resolves: rhbz#1039822


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.3-10
changelog:
  - Reintroduced -d, --dump option and added plain report mode,
    fixed parameters and manual page
    Resolves: rhbz#1333495


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.3-1
changelog:
  - New version
    Resolves: rhbz#923729
  - Dropped fix-crash-on-readonly-fs, reduce-syscalls,
    gpu-wiggle-fix patches (upstreamed)
  - Dropped version-fix patch (not needed)


author: Michal Sekletar <msekleta@redhat.com> - 2.4.5-29
changelog:
  - make radius plugin config parser less strict
  - add creation of dip system group
  - resolves : #906913, #918296


author: Michal Sekletar <msekleta@redhat.com> - 2.4.5-30
changelog:
  - don't ship /var/lock/ppp in rpm payload and create it in %post instead
  - fix installation of tmpfiles.d configuration
  - enable hardened build
  - fix bogus dates in changelog
  - compile all binaries with hardening flags
  - fix possible NULL pointer dereferencing


author: Kevin Lyons <kevin.x.lyons@oracle.com> - 2.4.5-34.0.2
changelog:
  - Userland headers should always appear before kernel - [Orabug: 27656836]
    (philip.copeland@oracle.com)


author: Miroslav Lichvar <mlichvar@redhat.com> 0-0.7.20120407git0deb9c
changelog:
  - update to 20120407git0deb9c
  - move timepps.h to sys (#852950)
  - include license files in devel subpackage
  - remove obsolete macros


author: Paul Howarth <paul@city-fan.org> 1.7.2-13.2
changelog:
  - Add patch to fix highly-parallel build (e.g. -j16)
  - Add additional compiler warning flags to highlight questionable code
  - Add patch to fix comparisons between signed and unsigned integers
  - Add patch to fix const usage
  - Add patch to fix missing field initializers
  - Add patch to suppress warnings about possibly unused variables
  - Add patch to fix declarations that are not prototypes
  - Add patch to fix warnings about nested externs
  - Add patch to fix dubious typecasts that violate strict-aliasing rules
  - Update the FSF address references and GPLv2 license text
  - Use default optimization level (-O2) again


author: Paul Howarth <paul@city-fan.org> 1.7.2-14
changelog:
  - Build with warning-fix patches to address occasional segfaults (#749455)
  - Patches have all now been merged upstream


author: Paul Howarth <paul@city-fan.org> 1.7.2-17
changelog:
  - Add note in options.pptp about MPPE not being available in FIPS mode
    (#845112)
  - Add note in options.pptp about PPTP with MSCHAP-V2 being insecure


author: Jakub Jelinek <jakub@redhat.com> 0.5.0-3
changelog:
  - fix R_390_IRELATIVE handling on s390/s390x (#973259, #1010392, #1010398)
  - change cron.daily/prelink permissions to rwxr-x--- (#1012538)


author: Jaromir Capik <jcapik@redhat.com> - 3.3.10-1
changelog:
  - Upgrading to 3.3.10
  - top.1: physical memory - has used / is using (#1119263)
  - Include man pages for openproc, readproc and readproctab (#1119260)
  - ps -p cycles over all PIDs instead of just one (#1060715)
  - Remove explicit dependency on systemd-libs package (#1113206)
  - Allow longer usernames to display in ps output (#1112734)
  - w doesn't display FROM by default (#1078310)
  - Return value of pgrep is incorrect (#1116309)
  - Should shared memory be accounted in cached in free output? (#1070736)
  - Resolves: rhbz#1119263 rhbz#1119260 rhbz#1060715 rhbz#1113206
  - Resolves: rhbz#1112734 rhbz#1078310 rhbz#1116309 rhbz#1070736


author: Jaromir Capik <jcapik@redhat.com> - 3.3.10-2
changelog:
  - Replacing RC tarball with final 3.3.10 release
  - Related: rhbz#1119263 rhbz#1119260 rhbz#1060715 rhbz#1113206
  - Related: rhbz#1112734 rhbz#1078310 rhbz#1116309 rhbz#1070736


author: Jaromir Capik <jcapik@redhat.com> - 3.3.10-3
changelog:
  - Disabling translated man pages due to conflicts with man-pages-*
  - Removing /etc/sysctl.d (quietly stolen by systemd)
  - Related: rhbz#1119263 rhbz#1119260 rhbz#1060715 rhbz#1113206
  - Related: rhbz#1112734 rhbz#1078310 rhbz#1116309 rhbz#1070736


author: Jan Rybar <jrybar@redhat.com> - 3.3.10-7
changelog:
  - Fixing sysinfo - devices with length exceeding 15 chars are not displayed in vmstat -d
  - Resolves: #1169349


author: Jan Rybar <jrybar@redhat.com> - 3.3.10-9
changelog:
  - Fixes showing same cgroups for threads under process by adding format option
  - Resolves: rhbz#1284087


author: Jan Rybar <jrybar@redhat.com> - 3.3.10-10
changelog:
  - Fixes sysinfo - devices with name longer than 20 chars are mistaken for partitions
  - Resolves: rhbz#1169349


author: Jan Rybar <jrybar@redhat.com> - 3.3.10-28
changelog:
  - pgrep: uid/gid conversion overflow
  - vmstat: manpage line about I/O blocked procs unclear
  - Resolves: rhbz#1624514, rhbz#1796043


author: Jaromir Capik <jcapik@redhat.com> - 3.3.9-5
changelog:
  - Support for timestamps & wide diskstat (#1053428, #1025833)
  - Fixing fd leak in watch
  - Fixing format-security build issues
  - Skipping trailing zeros in read_unvectored (#1057600)
  - Resolves: rhbz#1053428, Related: rhbz#1025833


author: Adrian Reber <areber@redhat.com> - 1.0.2-1
changelog:
  - new upstream release
  - split off protoc-c into protobuf-c-compiler to reduce runtime
    dependencies of the main package


author: Conrad Meyer <cemeyer@uw.edu> - 2.5.0-2
changelog:
  - Remove changelog history from before 2010
  - This spec already runs autoreconf -fi during %build, but bump build for
    rhbz #926374


author: Jaromir Capik <jcapik@redhat.com> - 6.5.5-8
changelog:
  - #759321 - psacct logrotate script references init.d service
  - #735300 - Enabling psacct causes daily cron spam


author: Jaromir Capik <jcapik@redhat.com> - 22.20-6
changelog:
  - Fixing null pointer dereference introduced with namespaces
  - Fixing bogus dates in the changelog
  - Related: rhbz#980514


author: Jan Rybar <jrybar@redhat.com> 22.20-13
changelog:
  - fuser manpage: note about invisible other PIDs moved to RESTRICTIONS section
  - Resolves: rhbz#1400126


author: Richard W.M. Jones <rjones@redhat.com> 22.20-1
changelog:
  - Update to 22.20.
    Contains a fix for: http://sourceforge.net/p/psmisc/bugs/53/
  - Fix src/pstree.c when SELinux is available.


author: Jiri Popelka <jpopelka@redhat.com> - 1.17-40
changelog:
  - fix dist tag and URL
  - put psutils-copyright.patch among sources as it's used only in
    psutils-remove-copyrighted-files
  - no need to define BuildRoot and clean it in %clean and %install anymore
  - %defattr no longer needed in %files


author: Michael Schwendt <mschwendt@fedoraproject.org> - 2.0.7-19
changelog:
  - Build with -D_FILE_OFFSET_BITS=64 to get stat64 in pth_high.c
  - Guard the ARM CFLAGS sed substitution.


author: Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.10.2-4
changelog:
  * Sat Aug 25 2012 Peter Robinson <pbrobinson@fedoraproject.org> - 2.10.7-1
  - New 2.10.7 stable release


author: Wim Taymans <wtaymans@redhat.com> - 6.0-4
changelog:
  - Add more Requires to avoid testing multiple versions
  - enable hardened build
  - Fix missing %endif
  - Resolves: #1174548


author: Rex Dieter <rdieter@fedoraproject.org> - 6.0-7
changelog:
  - better autostart.patch, handle case were autospawn is disabled
    (or otherwise doesn't work, like for root user)
  - Resolves: #1269104


author: Wim Taymans <wtaymans@redhat.com> - 10.0-4
changelog:
  - Add support for usb audio in the Dell dock TB16
  - Add patches to improve default sinks
  - Resolves: #1457385


author: Wim Taymans <wtaymans@redhat.com> - 3.0-16
changelog:
  - Build SUID proximity-helper with full relro
  - don't mark .desktop and dbus configurations as %config
  - Related #884146


author: Wim Taymans <wtaymans@redhat.com> - 3.0-17
changelog:
  - Use the statically allocated UID and GID from /usr/share/doc/setup/uidgid (#1056656)
  - The pulse-rt group doesn't exist (#885020)
  - Related #884146


author: Tomáš Mráz <tmraz@redhat.com> - 0.13-6
changelog:
  - Check for error returns which cause segfaults in FIPS mode
  - Fix missing error check and leak found by gcc-with-cpychecker (#800086)


author: Tomáš Mráz <tmraz@redhat.com> - 0.13.1-1
changelog:
  - new upstream release fixing a security issue with string
    formatting subjectAltName of a certificate


author: Tomáš Mráz <tmraz@redhat.com> - 0.13.1-4
changelog:
  - fix various testsuite failures
  - fix exception propagation from private key passphrase callback (#1227505)
  - add optional digest parameter to CRL.export method (#1523772)


author: John (J5) Palmieri <johnp@redhat.com> - 2.28.6-2
changelog:
  - disable introspection in anticipation of pygobject3
  - https://bugzilla.redhat.com/show_bug.cgi?id=731851
  - pygobject2 now becomes legacy for static binding support (e.g. PyGTK)


author: Colin Walters <walters@redhat.com> - 2.28.6-8
changelog:
  - Add various missing BuildRequires, switch to pkgconfig() syntax
  - Backport upstream patch which fixes a crasher in some applications


author: Toshio Kuratomi <toshio@fedoraproject.org> - 0.3-1
changelog:
  - New upstream release
  - Build a python3 subpackage
  - Run the test suite even though we ignore the output


author: Miloslav Trmač <mitr@redhat.com> - 0.3-5
changelog:
  - Disable -fstrict-aliasing (see http://www.python.org/dev/peps/pep-3123/ for
    rationale)
  - Don't ship .pyc files from the test suite in %doc, to avoid multilib
    conflicts


author: David Cantrell <dcantrell@redhat.com> - 1:3.9-9
changelog:
  - Disable python-coverage tests on s390x
    Related: rhbz#1057626
  - Fix python-coverage tests (some disabled that are not working)
    Resolves: rhbz#1057626


author: Toshio Kuratomi <toshio@fedoraproject.org> - 3.5.3-2
changelog:
  - Patch from upstream for traceback when people use this with python2 and
    python3 in the same directory


author: Matej Cepl <mcepl@redhat.com> - 0.6.1-2
changelog:
  - Fix requires, for reasons why other development files were not
    eliminated see https://github.com/pyca/cryptography/issues/1463.


author: Nathaniel McCallum <npmccallum@redhat.com> - 0.7.2-1
changelog:
  - New upstream release. BSD is now an optional license.
  - Fix test running on python3
  - Add upstream patch to fix test paths


author: Christian Heimes <cheimes@redhat.com> - 1.7.2-1
changelog:
  - Update to 1.7.2
  - Disable pytest.deprecated_call() tests
  - Remove versioned pytest
  - Add build requirements pytz


author: Christian Heimes <cheimes@redhat.com> - 1.7.2-1.1
changelog:
  - Ignore errors on OpenSSL's error stack when initializing, fixes RHBZ#1485896
  - Fix parsing of long OIDs, fixes RHBZ#1485898


author: Robert Kuska <rkuska@redhat.com> - 2.7.5-32
changelog:
  - Backport SSLSocket.version function
  - Temporary disable test_gdb on ppc64le rhbz#1260558
  Resolves: rhbz#1259421


author: Tomas Orsava <torsava@redhat.com> - 2.7.5-36
changelog:
  - Fix for CVE-2016-0772 python: smtplib StartTLS stripping attack (rhbz#1303647)
    Raise an error when STARTTLS fails (upstream patch)
  - Fix for CVE-2016-5699 python: http protocol steam injection attack (rhbz#1303699)
    Disabled HTTP header injections in httplib (upstream patch)
  Resolves: rhbz#1346356


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-39
changelog:
  - Fix hashlib algorithms breaking by initializing OpenSSL_add_all_digests
  function in _hashlib library
  Resolves: rhbz#1371132


author: Tomas Orsava <torsava@redhat.com> - 2.7.5-45
changelog:
  - Fix for CVE-2016-0772 python: smtplib StartTLS stripping attack (rhbz#1303647)
    Raise an error when STARTTLS fails (upstream patch)
  - Fix for CVE-2016-5699 python: http protocol steam injection attack (rhbz#1303699)
    Disabled HTTP header injections in httplib (upstream patch)
  Resolves: rhbz#1346357


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-46
changelog:
  - Drop patch 221 that backported sslwrap function since it was introducing regressions
  - Refactor patch 227
  Resolves: rhbz#1331425


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-47
changelog:
  - Fix for CVE-2016-5636: possible integer overflow and heap corruption in zipimporter.get_data()
  Resolves: rhbz#1356364


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-52
changelog:
  - Workaround Python's threading library issue with non returning wait, for signals with timeout
  Resolves: rhbz#1368076


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-57
changelog:
  - Fix implicit declaration warnings of functions added by patches 147 and 265
  Resolves: rhbz#1441237


author: Petr Viktorin <pviktori@redhat.com> - 2.7.5-63
changelog:
  - Make it more likely for the system allocator to release free()d memory arenas
  Resolves: rhbz#1468410


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-65
changelog:
  - Fix hanging of all threads when trying to access an inaccessible NFS server.
  Resolves: rhbz#1520068


author: Tomas Orsava <torsava@redhat.com> - 2.7.5-68
changelog:
  - Add Conflicts tag with old virtualenv versions due to new behaviour of
    httplib (patch 295)
  Resolves: rhbz#1483438


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-71
changelog:
  - Limit the number of CPU cores when building the package on power architectures
  Resolves: rhbz#1568974


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-72
changelog:
  - Fix CVE-2018-1060 and CVE-2018-1061
  Resolves: rhbz#1563454 and rhbz#1549192
  - Provide python2-libs from the python-libs subpackage
  Resolves: rhbz#1557460


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-74
changelog:
  - Fix OSERROR 17 due to _multiprocessing/semaphore.c assuming
    a one-to-one Pid -> process mapping
  Resolves: rhbz#1579432


author: Tomas Orsava <torsava@redhat.com> - 2.7.5-79
changelog:
  - Moved the macros.python/2 files into their own packages python/2-rpm-macros
  Resolves: rhbz#1679221


author: Victor Stinner <vstinner@redhat.com> - 2.7.5-80
changelog:
  - Security fix for CVE-2019-5010: crash on parsing a specially crafted X509 certificate
    (resolves: rhbz#1666788)


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-84
changelog:
  - Disallow control chars in http URLs
  - Fixes CVE-2019-9740 and CVE-2019-9947
  Resolves: rhbz#1704362 and rhbz#1703530


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-90
changelog:
  - Avoid infinite loop when reading specially crafted TAR files (CVE-2019-20907)
  Resolves: rhbz#1856481


author: David Sommerseth <davids@redhat.com> - 0.7-1
changelog:
  - Fixed several memory leaks (commit aa2c20e697af, abc7f912f66d)
  - Improved error checking towards NULL values(commit 4e928d62a8e3)
  - Fixed typo in pethtool --help (commit 710766dc722)
  - Only open a NETLINK connection when needed (commit 508ffffbb3c)
  - Added man page for pifconfig and pethtool (commit 9f0d17aa532, rhbz#638475)
  - Force NETLINK socket to close on fork() using FD_CLOEXEC (commit 1680cbeb40e)


author: Bohuslav Kabrda <bkabrda@redhat.com> - 0.8-2
changelog:
  - Fixed reporting of more IPv4 addresses per interface
  Resolves: rhbz#1027685
  - Make get_active_devices() return IPv6-only devices, too
  Resolves: rhbz#1027678


author: Mike Bonnet <mikeb@redhat.com> - 1.0.90-1
changelog:
  - return the contents of the AP_REP message from rd_rep()
  - improved memory handling
  - removed use of KRB_PRIVATE


author: Matthew Barnes <mbarnes@redhat.com> - 0:2.4.15-2
changelog:
  - Add syncrepl_refreshdone() method to SyncreplConsumer class.
    Need by FreeIPA, subsequently accepted upstream.
  - Resolves: rhbz#1122495


author: Jeffrey Ollie <jeff@ocjtech.us> - 2.3.5-1
changelog:
  - Bugs fixed
  -
  -  * Crash when merging text nodes in element.remove().
  -  * Crash in sax/target parser when reporting empty doctype.


author: Jeffrey Ollie <jeff@ocjtech.us> - 3.0-1
changelog:
  - 3.0 (2012-10-08)
  - ================
  -
  - Features added
  - --------------
  -
  - Bugs fixed
  - ----------
  -
  - * End-of-file handling was incorrect in iterparse() when reading from
  -   a low-level C file stream and failed in libxml2 2.9.0 due to its
  -   improved consistency checks.
  -
  - Other changes
  - -------------
  -
  - * The build no longer uses Cython by default unless the generated C files
  -   are missing.  To use Cython, pass the option "--with-cython".  To ignore
  -   the fatal build error when Cython is required but not available (e.g. to
  -   run special setup.py commands that do not actually run a build), pass
  -   "--without-cython".
  -
  -
  - 3.0beta1 (2012-09-26)
  - =====================
  -
  - Features added
  - --------------
  -
  - * Python level access to (optional) libxml2 memory debugging features
  -   to simplify debugging of memory leaks etc.
  -
  - Bugs fixed
  - ----------
  -
  - * Fix a memory leak in XPath by switching to Cython 0.17.1.
  -
  - * Some tests were adapted to work with PyPy.
  -
  - Other changes
  - -------------
  -
  - * The code was adapted to work with the upcoming libxml2 2.9.0 release.
  -
  -
  - 3.0alpha2 (2012-08-23)
  - ======================
  -
  - Features added
  - --------------
  -
  - * The .iter() method of elements now accepts tag arguments like "{*}name"
  -   to search for elements with a given local name in any namespace.  With
  -   this addition, all combinations of wildcards now work as expected:
  -   "{ns}name", "{}name", "{*}name", "{ns}*", "{}*" and "{*}*".  Note that
  -   "name" is equivalent to "{}name", but "*" is "{*}*".  The same change
  -   applies to the .getiterator(), .itersiblings(), .iterancestors(),
  -   .iterdescendants(), .iterchildren() and .itertext() methods,  the
  -   strip_attributes(), strip_elements() and strip_tags() functions as well
  -   as the iterparse() function.
  -
  - * C14N allows specifying the inclusive prefixes to be promoted to
  -   top-level during exclusive serialisation.
  -
  - Bugs fixed
  - ----------
  -
  - * Passing long Unicode strings into the feed() parser interface failed to
  -   read the entire string.
  -
  - Other changes
  - -------------
  -
  -
  - 3.0alpha1 (2012-07-31)
  - ======================
  -
  - Features added
  - --------------
  -
  - * Initial support for building in PyPy (through cpyext).
  -
  - * DTD objects gained an API that allows read access to their
  -   declarations.
  -
  - * xpathgrep.py gained support for parsing line-by-line (e.g.
  -   from grep output) and for surrounding the output with a new root
  -   tag.
  -
  - * E-factory in lxml.builder accepts subtypes of known data
  -   types (such as string subtypes) when building elements around them.
  -
  - * Tree iteration and iterparse() with a selective tag
  -   argument supports passing a set of tags.  Tree nodes will be
  -   returned by the iterators if they match any of the tags.
  -
  - Bugs fixed
  - ----------
  -
  - * The .find*() methods in lxml.objectify no longer use XPath
  -   internally, which makes them faster in many cases (especially when
  -   short circuiting after a single or couple of elements) and fixes
  -   some behavioural differences compared to lxml.etree.  Note that
  -   this means that they no longer support arbitrary XPath expressions
  -   but only the subset that the ElementPath language supports.
  -   The previous implementation was also redundant with the normal
  -   XPath support, which can be used as a replacement.
  -
  - * el.find('*') could accidentally return a comment or processing
  -   instruction that happened to be in the wrong spot.  (Same for the
  -   other .find*() methods.)
  -
  - * The error logging is less intrusive and avoids a global setup where
  -   possible.
  -
  - * Fixed undefined names in html5lib parser.
  -
  - * xpathgrep.py did not work in Python 3.
  -
  - * Element.attrib.update() did not accept an attrib of
  -   another Element as parameter.
  -
  - * For subtypes of ElementBase that make the .text or .tail
  -   properties immutable (as in objectify, for example), inserting text
  -   when creating Elements through the E-Factory feature of the class
  -   constructor would fail with an exception, stating that the text
  -   cannot be modified.
  -
  - Other changes
  - --------------
  -
  - * The code base was overhauled to properly use 'const' where the API
  -   of libxml2 and libxslt requests it.  This also has an impact on the
  -   public C-API of lxml itself, as defined in etreepublic.pxd, as
  -   well as the provided declarations in the lxml/includes/ directory.
  -   Code that uses these declarations may have to be adapted.  On the
  -   plus side, this fixes several C compiler warnings, also for user
  -   code, thus making it easier to spot real problems again.
  -
  - * The functionality of "lxml.cssselect" was moved into a separate PyPI
  -   package called "cssselect".  To continue using it, you must install
  -   that package separately.  The "lxml.cssselect" module is still
  -   available and provides the same interface, provided the "cssselect"
  -   package can be imported at runtime.
  -
  - * Element attributes passed in as an attrib dict or as keyword
  -   arguments are now sorted by (namespaced) name before being created
  -   to make their order predictable for serialisation and iteration.
  -   Note that adding or deleting attributes afterwards does not take
  -   that order into account, i.e. setting a new attribute appends it
  -   after the existing ones.
  -
  - * Several classes that are for internal use only were removed
  -   from the lxml.etree module dict:
  -   _InputDocument, _ResolverRegistry, _ResolverContext, _BaseContext,
  -   _ExsltRegExp, _IterparseContext, _TempStore, _ExceptionContext,
  -   __ContentOnlyElement, _AttribIterator, _NamespaceRegistry,
  -   _ClassNamespaceRegistry, _FunctionNamespaceRegistry,
  -   _XPathFunctionNamespaceRegistry, _ParserDictionaryContext,
  -   _FileReaderContext, _ParserContext, _PythonSaxParserTarget,
  -   _TargetParserContext, _ReadOnlyProxy, _ReadOnlyPIProxy,
  -   _ReadOnlyEntityProxy, _ReadOnlyElementProxy, _OpaqueNodeWrapper,
  -   _OpaqueDocumentWrapper, _ModifyContentOnlyProxy,
  -   _ModifyContentOnlyPIProxy, _ModifyContentOnlyEntityProxy,
  -   _AppendOnlyElementProxy, _SaxParserContext, _FilelikeWriter,
  -   _ParserSchemaValidationContext, _XPathContext,
  -   _XSLTResolverContext, _XSLTContext, _XSLTQuotedStringParam
  -
  - * Several internal classes can no longer be inherited from:
  -   _InputDocument, _ResolverRegistry, _ExsltRegExp, _ElementUnicodeResult,
  -   _IterparseContext, _TempStore, _AttribIterator, _ClassNamespaceRegistry,
  -   _XPathFunctionNamespaceRegistry, _ParserDictionaryContext,
  -   _FileReaderContext, _PythonSaxParserTarget, _TargetParserContext,
  -   _ReadOnlyPIProxy, _ReadOnlyEntityProxy, _OpaqueDocumentWrapper,
  -   _ModifyContentOnlyPIProxy, _ModifyContentOnlyEntityProxy,
  -   _AppendOnlyElementProxy, _FilelikeWriter, _ParserSchemaValidationContext,
  -   _XPathContext, _XSLTResolverContext, _XSLTContext,
  -   _XSLTQuotedStringParam, _XSLTResultTree, _XSLTProcessingInstruction


author: Jeffrey Ollie <jeff@ocjtech.us> - 3.0.1-1
changelog:
  - 3.0.1 (2012-10-14)
  - Bugs fixed
  -
  -  * LP#1065924: Element proxies could disappear during garbage collection
  -    in PyPy without proper cleanup.
  -  * GH#71: Failure to work with libxml2 2.6.x.
  -  * LP#1065139: static MacOS-X build failed in Py3.


author: Jeffrey Ollie <jeff@ocjtech.us> - 3.1.0-1
changelog:
  - 3.1.0 (2013-02-10)
  - ==================
  -
  - Features added
  - --------------
  -
  - * GH#89: lxml.html.clean allows overriding the set of attributes that it
  -   considers 'safe'.  Patch by Francis Devereux.
  -
  - Bugs fixed
  - ----------
  -
  - * LP#1104370: ``copy.copy(el.attrib)`` raised an exception.  It now returns
  -   a copy of the attributes as a plain Python dict.
  -
  - * GH#95: When used with namespace prefixes, the  ``el.find*()`` methods
  -   always used the first namespace mapping that was provided for each
  -   path expression instead of using the one that was actually passed
  -   in for the current run.
  -
  - * LP#1092521, GH#91: Fix undefined C symbol in Python runtimes compiled
  -   without threading support.  Patch by Ulrich Seidl.
  -
  - Other changes
  - -------------
  -
  -
  - 3.1beta1 (2012-12-21)
  - =====================
  -
  - Features added
  - --------------
  -
  - * New build-time option ``--with-unicode-strings`` for Python 2 that
  -   makes the API always return Unicode strings for names and text
  -   instead of byte strings for plain ASCII content.
  -
  - * New incremental XML file writing API ``etree.xmlfile()``.
  -
  - * E factory in lxml.objectify is callable to simplify the creation of
  -   tags with non-identifier names without having to resort to getattr().
  -
  - Bugs fixed
  - ----------
  -
  - * When starting from a non-namespaced element in lxml.objectify, searching
  -   for a child without explicitly specifying a namespace incorrectly found
  -   namespaced elements with the requested local name, instead of restricting
  -   the search to non-namespaced children.
  -
  - * GH#85: Deprecation warnings were fixed for Python 3.x.
  -
  - * GH#33: lxml.html.fromstring() failed to accept bytes input in Py3.
  -
  - * LP#1080792: Static build of libxml2 2.9.0 failed due to missing file.
  -
  - Other changes
  - -------------
  -
  - * The externally useless class ``_ObjectifyElementMakerCaller`` was
  -   removed from the module API of lxml.objectify.
  -
  - * LP#1075622: lxml.builder is faster for adding text to elements with
  -   many children.  Patch by Anders Hammarquist.


author: Jeffrey Ollie <jeff@ocjtech.us> - 3.2.0-1
changelog:
  - 3.2.0 (2013-04-28)
  - ==================
  -
  - Features added
  - --------------
  -
  - Bugs fixed
  - ----------
  -
  - * LP#690319: Leading whitespace could change the behaviour of the string
  -   parsing functions in ``lxml.html``.
  -
  - * LP#599318: The string parsing functions in ``lxml.html`` are more robust
  -   in the face of uncommon HTML content like framesets or missing body tags.
  -   Patch by Stefan Seelmann.
  -
  - * LP#712941: I/O errors while trying to access files with paths that
  -   contain non-ASCII characters could raise ``UnicodeDecodeError`` instead
  -   of properly reporting the ``IOError``.
  -
  - * LP#673205: Parsing from in-memory strings disabled network access in the
  -   default parser and made subsequent attempts to parse from a URL fail.
  -
  - * LP#971754: lxml.html.clean appends 'nofollow' to 'rel' attributes instead
  -   of overwriting the current value.
  -
  - * LP#715687: lxml.html.clean no longer discards scripts that are explicitly
  -   allowed by the user provided whitelist.  Patch by Christine Koppelt.
  -
  - 3.1.2 (2013-04-12)
  - ==================
  -
  - Bugs fixed
  - ----------
  -
  - * LP#1136509: Passing attributes through the namespace-unaware API of
  -   the sax bridge (i.e. the ``handler.startElement()`` method) failed
  -   with a ``TypeError``.  Patch by Mike Bayer.
  -
  - * LP#1123074: Fix serialisation error in XSLT output when converting
  -   the result tree to a Unicode string.
  -
  - * GH#105: Replace illegal usage of ``xmlBufLength()`` in libxml2 2.9.0
  -   by properly exported API function ``xmlBufUse()``.
  -
  - 3.1.1 (2013-03-29)
  - ==================
  -
  - Features added
  - --------------
  -
  - Bugs fixed
  - ----------
  -
  - * LP#1160386: Write access to ``lxml.html.FormElement.fields`` raised
  -   an AttributeError in Py3.
  -
  - * Illegal memory access during cleanup in incremental xmlfile writer.
  -
  - Other changes
  - -------------
  -
  - * The externally useless class ``lxml.etree._BaseParser`` was removed
  -   from the module dict.


author: Jeffrey Ollie <jeff@ocjtech.us> - 3.2.1-1
changelog:
  - 3.2.1 (2013-05-11)
  - ==================
  -
  - Features added
  - --------------
  -
  - * The methods ``apply_templates()`` and ``process_children()`` of XSLT
  -   extension elements have gained two new boolean options ``elements_only``
  -   and ``remove_blank_text`` that discard either all strings or
  -   whitespace-only strings from the result list.
  -
  - Bugs fixed
  - ----------
  -
  - * When moving Elements to another tree, the namespace cleanup mechanism
  -   no longer drops namespace prefixes from attributes for which it finds
  -   a default namespace declaration, to prevent them from appearing as
  -   unnamespaced attributes after serialisation.
  -
  - * Returning non-type objects from a custom class lookup method could lead
  -   to a crash.
  -
  - * Instantiating and using subtypes of Comments and ProcessingInstructions
  -   crashed.


author: pcpa <paulo.cesar.pereira.de.andrade@gmail.com> - 1.2.0-8
changelog:
  - Update fontconfig patch to apply issue found by upstream
  - Update fontconfig patch to apply issue with missing afm fonts (#896182)


author: pcpa <paulo.cesar.pereira.de.andrade@gmail.com> - 1.2.0-10
changelog:
  - Use stix fonts avoid problems with missing cm fonts (#908717)
  - Correct type mismatch in python3 font_manager (#912843, #928326)


author: John Dennis <jdennis@redhat.com> - 0.12-2
changelog:
  - add patch python-nss-0.12-rsapssparams.patch to fix build problem
    which appears only with nss 3.13 and later.


author: John Dennis <jdennis@redhat.com> - 0.13-0
changelog:
  - Update to version 0.13
    Introduced in 0.13:

    * Fix NSS SECITEM_CompareItem bug via workaround.

    * Fix incorrect format strings in PyArg_ParseTuple* for:
      - GeneralName
      - BasicConstraints
      - cert_x509_key_usage

    * Fix bug when decoding certificate BasicConstraints extension

    * Fix hang in setup_certs.

    * For NSS >= 3.13 support CERTDB_TERMINAL_RECORD

    * You can now query for a specific certificate extension
      Certficate.get_extension()

    * The following classes were added:
      - RSAGenParams

    * The following class methods were added:
      - nss.nss.Certificate.get_extension
      - nss.nss.PK11Slot.generate_key_pair
      - nss.nss.DSAPublicKey.format
      - nss.nss.DSAPublicKey.format_lines

    * The following module functions were added:
      - nss.nss.pub_wrap_sym_key

    * The following internal utilities were added:
      - PyString_UTF8
      - SecItem_new_alloc()

    * The following class constructors were modified to accept
      intialization parameters

      - KEYPQGParams (DSA generation parameters)

    * The PublicKey formatting (i.e. format_lines) was augmented
      to format DSA keys (formerly it only recognized RSA keys).

    * Allow lables and values to be justified when printing objects

    * The following were deprecated:
      - nss.nss.make_line_pairs (replaced by nss.nss.make_line_fmt_tuples)

      Deprecated Functionality:
      -------------------------
      - make_line_pairs() has been replaced by make_line_fmt_tuples()
        because 2-valued tuples were not sufficently general. It is
        expected very few programs will have used this function, it's mostly
        used internally but provided as a support utility.


author: John Dennis <jdennis@redhat.com> - 0.14-1
changelog:
  External Changes:
    -----------------

    The primary enhancements in this version is support of certifcate
    validation, OCSP support, and support for the certificate "Authority
    Information Access" extension.

    Enhanced certifcate validation including CA certs can be done via
    Certificate.verify() or Certificate.is_ca_cert(). When cert
    validation fails you can now obtain diagnostic information as to why
    the cert failed to validate. This is encapsulated in the
    CertVerifyLog class which is a iterable collection of
    CertVerifyLogNode objects. Most people will probablby just print the
    string representation of the returned CertVerifyLog object. Cert
    validation logging is handled by the Certificate.verify() method.
    Support has also been added for the various key usage and cert type
    entities which feature prominently during cert validation.


    * Certificate() constructor signature changed from

      Certificate(data=None, der_is_signed=True)

      to

      Certificate(data, certdb=cert_get_default_certdb(), perm=False, nickname=None)

      This change was necessary because all certs should be added to the
      NSS temporary database when they are loaded, but earlier code
      failed to to that. It's is not likely that an previous code was
      failing to pass initialization data or the der_is_signed flag so
      this change should be backwards compatible.

    * Fix bug #922247, PKCS12Decoder.database_import() method. Importing into
      a NSS database would sometimes fail or segfault.

    * Error codes and descriptions were updated from upstream NSPR & NSS.

    * The password callback did not allow for breaking out of a password
      prompting loop, now if None is returned from the password callback
      the password prompting is terminated.

    * nss.nss_shutdown_context now called from InitContext destructor,
      this assures the context is shutdown even if the programmer forgot
      to. It's still best to explicitly shut it down, this is just
      failsafe.

    * Support was added for shutdown callbacks.

    * The following classes were added:
      - nss.CertVerifyLogNode
      - nss.CertVerifyLog
      - error.CertVerifyError (exception)
      - nss.AuthorityInfoAccess
      - nss.AuthorityInfoAccesses


    * The following class methods were added:
      - nss.Certificate.is_ca_cert
      - nss.Certificate.verify
      - nss.Certificate.verify_with_log
      - nss.Certificate.get_cert_chain
      - nss.Certificate.check_ocsp_status
      - nss.PK11Slot.list_certs
      - nss.CertVerifyLogNode.format_lines
      - nss.CertVerifyLog.format_lines
      - nss.CRLDistributionPts.format_lines

    * The following class properties were added:
      - nss.CertVerifyLogNode.certificate
      - nss.CertVerifyLogNode.error
      - nss.CertVerifyLogNode.depth
      - nss.CertVerifyLog.count

    * The following module functions were added:
      - nss.x509_cert_type
      - nss.key_usage_flags
      - nss.list_certs
      - nss.find_certs_from_email_addr
      - nss.find_certs_from_nickname
      - nss.nss_get_version
      - nss.nss_version_check
      - nss.set_shutdown_callback
      - nss.get_use_pkix_for_validation
      - nss.set_use_pkix_for_validation
      - nss.enable_ocsp_checking
      - nss.disable_ocsp_checking
      - nss.set_ocsp_cache_settings
      - nss.set_ocsp_failure_mode
      - nss.set_ocsp_timeout
      - nss.clear_ocsp_cache
      - nss.set_ocsp_default_responder
      - nss.enable_ocsp_default_responder
      - nss.disable_ocsp_default_responder

    * The following files were added:
        src/py_traceback.h
        doc/examples/verify_cert.py
        test/test_misc.py

    * The following constants were added:
      - nss.KU_DIGITAL_SIGNATURE
      - nss.KU_NON_REPUDIATION
      - nss.KU_KEY_ENCIPHERMENT
      - nss.KU_DATA_ENCIPHERMENT
      - nss.KU_KEY_AGREEMENT
      - nss.KU_KEY_CERT_SIGN
      - nss.KU_CRL_SIGN
      - nss.KU_ENCIPHER_ONLY
      - nss.KU_ALL
      - nss.KU_DIGITAL_SIGNATURE_OR_NON_REPUDIATION
      - nss.KU_KEY_AGREEMENT_OR_ENCIPHERMENT
      - nss.KU_NS_GOVT_APPROVED
      - nss.PK11CertListUnique
      - nss.PK11CertListUser
      - nss.PK11CertListRootUnique
      - nss.PK11CertListCA
      - nss.PK11CertListCAUnique
      - nss.PK11CertListUserUnique
      - nss.PK11CertListAll
      - nss.certUsageSSLClient
      - nss.certUsageSSLServer
      - nss.certUsageSSLServerWithStepUp
      - nss.certUsageSSLCA
      - nss.certUsageEmailSigner
      - nss.certUsageEmailRecipient
      - nss.certUsageObjectSigner
      - nss.certUsageUserCertImport
      - nss.certUsageVerifyCA
      - nss.certUsageProtectedObjectSigner
      - nss.certUsageStatusResponder
      - nss.certUsageAnyCA
      - nss.ocspMode_FailureIsVerificationFailure
      - nss.ocspMode_FailureIsNotAVerificationFailure

    * cert_dump.py extended to print NS_CERT_TYPE_EXTENSION

    * cert_usage_flags, nss_init_flags now support optional repr_kind parameter

    Internal Changes:
    -----------------

    * Reimplement exception handling
      - NSPRError is now derived from StandardException instead of
        EnvironmentError. It was never correct to derive from
        EnvironmentError but was difficult to implement a new subclassed
        exception with it's own attributes, using EnvironmentError had
        been expedient.

      - NSPRError now derived from StandardException, provides:
        * errno (numeric error code)
        * strerror (error description associated with error code)
        * error_message (optional detailed message)
        * error_code (alias for errno)
        * error_desc (alias for strerror)

      - CertVerifyError derived from NSPRError, extends with:
        * usages (bitmask of returned usages)
        * log (CertVerifyLog object)

    * Expose error lookup to sibling modules

    * Use macros for bitmask_to_list functions to reduce code
      duplication and centralize logic.

    * Add repr_kind parameter to cert_trust_flags_str()

    * Add support for repr_kind AsEnumName to bitstring table lookup.

    * Add cert_type_bitstr_to_tuple() lookup function

    * Add PRTimeConvert(), used to convert Python time values
      to PRTime, centralizes conversion logic, reduces duplication

    * Add UTF8OrNoneConvert to better handle unicode parameters which
      are optional.

    * Add Certificate_summary_format_lines() utility to generate
      concise certificate identification info for output.

    * Certificate_new_from_CERTCertificate now takes add_reference parameter
      to properly reference count certs, should fix shutdown busy problems.

    * Add print_traceback(), print_cert() debugging support.


author: John Dennis <jdennis@redhat.com> - 0.14.0-2
changelog:
  - resolves: bug#1002589
  - resolves: bug#1003979

  - Rewrite setup_certs.py. No longer behaves like an expect script
    which was fragile. By default now creates a sql style database.
  - By default all examples & tests use new sql format for NSS database
  - db-name is now used instead of dbdir to provide distinction between
    the database directory and it's scheme (e.g. 'sql:')
  - all examples and tests now default db-name to 'sql:pki'
  - replaced legacy getopt & optparse command line argument handling
    with modern argparse.


author: John Dennis <jdennis@redhat.com> - 0.14.0-3
changelog:
  - resolves: bug#1003979
  - In coordination with QE with regards to bz 1019934 it was requested
    the unittest patches be enhanced with a more robust version of
    test_pkcs12, no actual bug, just better testing.


author: John Dennis <jdennis@redhat.com> - 0.15.0-1
changelog:
  - resolves: bug#1109769 rebase to 0.15.0
  - includes fixes for 1087031 and 1060314
    See doc/Changelog for details


author: John Dennis <jdennis@redhat.com> - 0.16.0-1
changelog:
  - resolves: bug#1155703 - Add API call for SSL_VersionRangeSet (rebase)
    rebased to 0.16.0
  - The primary enhancements in this version is adding support for the
    setting trust attributes on a Certificate, the SSL version range API,
    information on the SSL cipher suites and information on the SSL connection.

    * The following module functions were added:

      - ssl.get_ssl_version_from_major_minor
      - ssl.get_default_ssl_version_range
      - ssl.get_supported_ssl_version_range
      - ssl.set_default_ssl_version_range
      - ssl.ssl_library_version_from_name
      - ssl.ssl_library_version_name
      - ssl.get_cipher_suite_info
      - ssl.ssl_cipher_suite_name
      - ssl.ssl_cipher_suite_from_name

    * The following deprecated module functions were removed:

      - ssl.nssinit
      - ssl.nss_ini
      - ssl.nss_shutdown

    * The following classes were added:

      - SSLCipherSuiteInfo
      - SSLChannelInfo

    * The following class methods were added:

      - Certificate.trust_flags
      - Certificate.set_trust_attributes

      - SSLSocket.set_ssl_version_range
      - SSLSocket.get_ssl_version_range
      - SSLSocket.get_ssl_channel_info
      - SSLSocket.get_negotiated_host
      - SSLSocket.connection_info_format_lines
      - SSLSocket.connection_info_format
      - SSLSocket.connection_info_str
  	
      - SSLCipherSuiteInfo.format_lines
      - SSLCipherSuiteInfo.format

      - SSLChannelInfo.format_lines
      - SSLChannelInfo.format

    * The following class properties were added:

      - Certificate.ssl_trust_flags
      - Certificate.email_trust_flags
      - Certificate.signing_trust_flags

      - SSLCipherSuiteInfo.cipher_suite
      - SSLCipherSuiteInfo.cipher_suite_name
      - SSLCipherSuiteInfo.auth_algorithm
      - SSLCipherSuiteInfo.auth_algorithm_name
      - SSLCipherSuiteInfo.kea_type
      - SSLCipherSuiteInfo.kea_type_name
      - SSLCipherSuiteInfo.symmetric_cipher
      - SSLCipherSuiteInfo.symmetric_cipher_name
      - SSLCipherSuiteInfo.symmetric_key_bits
      - SSLCipherSuiteInfo.symmetric_key_space
      - SSLCipherSuiteInfo.effective_key_bits
      - SSLCipherSuiteInfo.mac_algorithm
      - SSLCipherSuiteInfo.mac_algorithm_name
      - SSLCipherSuiteInfo.mac_bits
      - SSLCipherSuiteInfo.is_fips
      - SSLCipherSuiteInfo.is_exportable
      - SSLCipherSuiteInfo.is_nonstandard

      - SSLChannelInfo.protocol_version
      - SSLChannelInfo.protocol_version_str
      - SSLChannelInfo.protocol_version_enum
      - SSLChannelInfo.major_protocol_version
      - SSLChannelInfo.minor_protocol_version
      - SSLChannelInfo.cipher_suite
      - SSLChannelInfo.auth_key_bits
      - SSLChannelInfo.kea_key_bits
      - SSLChannelInfo.creation_time
      - SSLChannelInfo.creation_time_utc
      - SSLChannelInfo.last_access_time
      - SSLChannelInfo.last_access_time_utc
      - SSLChannelInfo.expiration_time
      - SSLChannelInfo.expiration_time_utc
      - SSLChannelInfo.compression_method
      - SSLChannelInfo.compression_method_name
      - SSLChannelInfo.session_id

    * The following files were added:

      - doc/examples/cert_trust.py
      - doc/examples/ssl_version_range.py

    * The following constants were added:
      - nss.CERTDB_TERMINAL_RECORD
      - nss.CERTDB_VALID_PEER
      - nss.CERTDB_TRUSTED
      - nss.CERTDB_SEND_WARN
      - nss.CERTDB_VALID_CA
      - nss.CERTDB_TRUSTED_CA
      - nss.CERTDB_NS_TRUSTED_CA
      - nss.CERTDB_USER
      - nss.CERTDB_TRUSTED_CLIENT_CA
      - nss.CERTDB_GOVT_APPROVED_CA
      - ssl.SRTP_AES128_CM_HMAC_SHA1_32
      - ssl.SRTP_AES128_CM_HMAC_SHA1_80
      - ssl.SRTP_NULL_HMAC_SHA1_32
      - ssl.SRTP_NULL_HMAC_SHA1_80
      - ssl.SSL_CK_DES_192_EDE3_CBC_WITH_MD5
      - ssl.SSL_CK_DES_64_CBC_WITH_MD5
      - ssl.SSL_CK_IDEA_128_CBC_WITH_MD5
      - ssl.SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
      - ssl.SSL_CK_RC2_128_CBC_WITH_MD5
      - ssl.SSL_CK_RC4_128_EXPORT40_WITH_MD5
      - ssl.SSL_CK_RC4_128_WITH_MD5
      - ssl.SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA
      - ssl.SSL_FORTEZZA_DMS_WITH_NULL_SHA
      - ssl.SSL_FORTEZZA_DMS_WITH_RC4_128_SHA
      - ssl.SSL_RSA_OLDFIPS_WITH_3DES_EDE_CBC_SHA
      - ssl.SSL_RSA_OLDFIPS_WITH_DES_CBC_SHA
      - ssl.TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA
      - ssl.TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA
      - ssl.TLS_DHE_DSS_WITH_AES_128_GCM_SHA256
      - ssl.TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA
      - ssl.TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA
      - ssl.TLS_DHE_DSS_WITH_DES_CBC_SHA
      - ssl.TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA
      - ssl.TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
      - ssl.TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
      - ssl.TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
      - ssl.TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
      - ssl.TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA
      - ssl.TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA
      - ssl.TLS_DHE_RSA_WITH_DES_CBC_SHA
      - ssl.TLS_DH_ANON_WITH_CAMELLIA_128_CBC_SHA
      - ssl.TLS_DH_ANON_WITH_CAMELLIA_256_CBC_SHA
      - ssl.TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA
      - ssl.TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA
      - ssl.TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA
      - ssl.TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA
      - ssl.TLS_DH_DSS_WITH_DES_CBC_SHA
      - ssl.TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA
      - ssl.TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA
      - ssl.TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA
      - ssl.TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA
      - ssl.TLS_DH_RSA_WITH_DES_CBC_SHA
      - ssl.TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA
      - ssl.TLS_DH_anon_EXPORT_WITH_RC4_40_MD5
      - ssl.TLS_DH_anon_WITH_3DES_EDE_CBC_SHA
      - ssl.TLS_DH_anon_WITH_AES_128_CBC_SHA
      - ssl.TLS_DH_anon_WITH_AES_256_CBC_SHA
      - ssl.TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA
      - ssl.TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA
      - ssl.TLS_DH_anon_WITH_DES_CBC_SHA
      - ssl.TLS_DH_anon_WITH_RC4_128_MD5
      - ssl.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
      - ssl.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
      - ssl.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
      - ssl.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
      - ssl.TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256
      - ssl.TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256
      - ssl.TLS_EMPTY_RENEGOTIATION_INFO_SCSV
      - ssl.TLS_FALLBACK_SCSV
      - ssl.TLS_NULL_WITH_NULL_NULL
      - ssl.TLS_RSA_EXPORT_WITH_DES40_CBC_SHA
      - ssl.TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5
      - ssl.TLS_RSA_EXPORT_WITH_RC4_40_MD5
      - ssl.TLS_RSA_WITH_3DES_EDE_CBC_SHA
      - ssl.TLS_RSA_WITH_AES_128_CBC_SHA256
      - ssl.TLS_RSA_WITH_AES_128_GCM_SHA256
      - ssl.TLS_RSA_WITH_AES_256_CBC_SHA256
      - ssl.TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
      - ssl.TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
      - ssl.TLS_RSA_WITH_DES_CBC_SHA
      - ssl.TLS_RSA_WITH_IDEA_CBC_SHA
      - ssl.TLS_RSA_WITH_NULL_MD5
      - ssl.TLS_RSA_WITH_NULL_SHA
      - ssl.TLS_RSA_WITH_NULL_SHA256
      - ssl.TLS_RSA_WITH_RC4_128_MD5
      - ssl.TLS_RSA_WITH_RC4_128_SHA
      - ssl.TLS_RSA_WITH_SEED_CBC_SHA
      - ssl.SSL_VARIANT_DATAGRAM
      - ssl.SSL_VARIANT_STREAM
      - ssl.SSL_LIBRARY_VERSION_2
      - ssl.SSL_LIBRARY_VERSION_3_0
      - ssl.SSL_LIBRARY_VERSION_TLS_1_0
      - ssl.SSL_LIBRARY_VERSION_TLS_1_1
      - ssl.SSL_LIBRARY_VERSION_TLS_1_2
      - ssl.SSL_LIBRARY_VERSION_TLS_1_3
      - ssl.ssl2
      - ssl.ssl3
      - ssl.tls1.0
      - ssl.tls1.1
      - ssl.tls1.2
      - ssl.tls1.3

     * The following methods were missing thread locks, this has been fixed.

       - nss.nss_initialize
       - nss.nss_init_context
       - nss.nss_shutdown_context


author: John Dennis <jdennis@redhat.com> - 0.16.0-3
changelog:
  - Resolves: #1225212
    Reads from file like objects actually only worked for file objects
  - Resolves: #1179573
    python-nss-doc package is missing the run_tests script
  - Resolves: #1194349
    test_pkcs12.py does not works in FIPS mode


author: Toshio Kuratomi <toshio@fedoraproject.org> - 2.0.0-7.gitd1c6db8
changelog:
  - Remove Obsoletes in the python-pillow-qt subpackage. Obsoletes isn't
    appropriate since qt support didn't exist in the previous python-pillow
    package so there's no reason to drag in python-pillow-qt when updating
    python-pillow.


author: Roman Rakus <rrakus@redhat.com> - 2.0.0-12
changelog:
  - Mark doc subpackage arch dependent. Docs are built depending on supported
    features, which are different across archs.
    Resolves: rhbz#987839


author: Devrim Gündüz <devrim@gunduz.org> 2.5-1
changelog:
  - Update to 2.5, per changes described at:
    http://www.psycopg.org/psycopg/articles/2013/04/07/psycopg-25-released/


author: Kamil Dudka <kdudka@redhat.com> - 7.19.0-15
changelog:
  - allow to return -1 from the write callback (#857875) 
  - remove the patch for curl-config --static-libs no longer needed
  - run the tests against the just built pycurl, not the system one


author: Arnaldo Carvalho de Melo <acme@redhat.com> - 0.2-1
changelog:
  - Add get_priority_{min,max} methods
  - Add constants for SCHED_{BATCH,FIFO,OTHER,RR}
  - Implement get_priority method
  - Add pchrt utility for testing the bindings, chrt clone
  - Add ptaskset utility for testing the bindings, taskset clone


author: John Kacur <jkacur@redhat.com> - 0.4-5
changelog:
  - Add man pages for pchrt and ptaskset
  - Fix and update usage messages for pchrt and ptaskset
  - Resolves:rhbz#948381


author: John Kacur <jkacur@redhat.com> - 0.4-6
changelog:
  - python-schedutils-Update-URL-in-python-schedutils.sp.patch
  - schedutils.c-added-support-for-SCHED_DEADLINE.patch
  Resolves: rhbz#1298388


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.2.6-9
changelog:
  - Python 2 binary package renamed to python2-subprocess32
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Marcel Plch <mplch@redhat.com> - 3.2.6-14
changelog:
  - Backport upstream patch for heap overflow when parsing too many arguments
  - Resolves: rhbz#1619386


author: Julian Sikorski <belegdol@fedoraproject.org> - 11.1.0-1
changelog:
  - Updated to 11.1.0
  - Obsoleted zsh subpackage (upstream ticket #3078)
  - mktap is gone (upstream ticket #5293)
  - Dropped obsolete Group, Buildroot, %clean and %defattr


author: Lumir Balhar & Tomas Orsava <lbalhar@redhat.com> - 3.6.8-2
changelog:
  - Converting F28 python3 specfile to RHEL7
  - Updated the bootstrapping sequence
  - Disabled LTO because of buggy support for it in gcc on RHEL7
  - Removed deprecated system-python and platform-python tags and files
  - Removed a tag from `python3-libs` that recommended the `python3` package,
    because the Recommends tag doesn't work in RHEL7
  - Remove unnecessary unversioned requires on glibc and gdbm
  - Changes from RHEL8:
    - Move macros.pybytecompile to python-rpm-macros
    - Enable test_gdb, test_faulthandler
  - Changes from Fedora:
    - Security fix for CVE-2019-5010 (#1666519, #1666522)
    - Make sure we don't ship any exe files (not needed an prebuilt)
  Resolves: rhbz#1597718


author: Tomas Orsava <torsava@redhat.com> - 3.6.8-4
changelog:
  - Add explicit conflicts with python34 < 3.4.9-3, which was the main python3
    package in EPEL before that version and contained conflicting files,
    e.g. /usr/bin/python3
  Resolves: rhbz#1597718


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-8
changelog:
  - Disallow control chars in http URLs
  - Fixes CVE-2019-9740 and CVE-2019-9947
  Resolves: rhbz#1703535 and rhbz#1704364


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-18
changelog:
  - Avoid infinite loop when reading specially crafted TAR files (CVE-2019-20907)
  Resolves: rhbz#1856481
  - Resolve hash collisions for Pv4Interface and IPv6Interface (CVE-2020-14422)
  Resolves: rhbz#1854926


author: Marcin Zajaczkowski <mszpak ATT wp DOTT pl> - 0.5.0-5
changelog:
  - remove prodive/obsolete of python-xattr (bug 781838)
  - fix problem with mixed use of tabs and spaces


author: Karl Heubaum <karl.heubaum@oracle.com> - 15:4.2.1-1.el7
changelog:
  - hw/sd/sdcard: Do not switch to ReceivingData if address is invalid (Philippe Mathieu-Daudé)  [Orabug: 31414336]  {CVE-2020-13253}
  - hw/sd/sdcard: Update coding style to make checkpatch.pl happy (Philippe Mathieu-Daudé)  [Orabug: 31414336] 
  - hw/sd/sdcard: Do not allow invalid SD card sizes (Philippe Mathieu-Daudé)  [Orabug: 31414336]  {CVE-2020-13253}
  - hw/sd/sdcard: Simplify realize() a bit (Philippe Mathieu-Daudé)  [Orabug: 31414336] 
  - hw/sd/sdcard: Restrict Class 6 commands to SCSD cards (Philippe Mathieu-Daudé)  [Orabug: 31414336] 
  - libslirp: Update to v4.3.1 to fix CVE-2020-10756 (Karl Heubaum)  [Orabug: 31604999]  {CVE-2020-10756}
  - Document CVEs as fixed 2/2 (Karl Heubaum)  [Orabug: 30618035]  {CVE-2017-18043} {CVE-2018-10839} {CVE-2018-11806} {CVE-2018-12617} {CVE-2018-15746} {CVE-2018-16847} {CVE-2018-16867} {CVE-2018-17958} {CVE-2018-17962} {CVE-2018-17963} {CVE-2018-18849} {CVE-2018-19364} {CVE-2018-19489} {CVE-2018-3639} {CVE-2018-5683} {CVE-2018-7550} {CVE-2018-7858} {CVE-2019-12068} {CVE-2019-15034} {CVE-2019-15890} {CVE-2019-20382} {CVE-2020-10702} {CVE-2020-10761} {CVE-2020-11102} {CVE-2020-11869} {CVE-2020-13361} {CVE-2020-13765} {CVE-2020-13800} {CVE-2020-1711} {CVE-2020-1983} {CVE-2020-8608}
  - Document CVEs as fixed 1/2 (Karl Heubaum)  [Orabug: 30618035]  {CVE-2017-10806} {CVE-2017-11334} {CVE-2017-12809} {CVE-2017-13672} {CVE-2017-13673} {CVE-2017-13711} {CVE-2017-14167} {CVE-2017-15038} {CVE-2017-15119} {CVE-2017-15124} {CVE-2017-15268} {CVE-2017-15289} {CVE-2017-16845} {CVE-2017-17381} {CVE-2017-18030} {CVE-2017-2630} {CVE-2017-2633} {CVE-2017-5715} {CVE-2017-5753} {CVE-2017-5754} {CVE-2017-5931} {CVE-2017-6058} {CVE-2017-7471} {CVE-2017-7493} {CVE-2017-8112} {CVE-2017-8309} {CVE-2017-8379} {CVE-2017-8380} {CVE-2017-9503} {CVE-2017-9524} {CVE-2018-12126} {CVE-2018-12127} {CVE-2018-12130} {CVE-2018-16872} {CVE-2018-20123} {CVE-2018-20124} {CVE-2018-20125} {CVE-2018-20126} {CVE-2018-20191} {CVE-2018-20216} {CVE-2018-20815} {CVE-2019-11091} {CVE-2019-12155} {CVE-2019-14378} {CVE-2019-3812} {CVE-2019-5008} {CVE-2019-6501} {CVE-2019-6778} {CVE-2019-8934} {CVE-2019-9824}
  - qemu-kvm.spec: Add .spec file for OL8 (Karl Heubaum)  [Orabug: 30618035] 
  - qemu.spec: Add .spec file for OL7 (Karl Heubaum)  [Orabug: 30618035] 
  - qemu-submodule-init: Add Git submodule init script (Karl Heubaum)  [Orabug: 30618035] 
  - vhost.conf: Initial vhost.conf (Karl Heubaum)  [Orabug: 30618035] 
  - parfait: Add buildrpm/parfait-qemu.conf (Karl Heubaum)  [Orabug: 30618035] 
  - virtio: Set PCI subsystem vendor ID to Oracle (Karl Heubaum)  [Orabug: 30618035] 
  - qemu_regdump.py: Initial qemu_regdump.py (Karl Heubaum)  [Orabug: 30618035] 
  - qmp-regdump: Initial qmp-regdump (Karl Heubaum)  [Orabug: 30618035] 
  - bridge.conf: Initial bridge.conf (Karl Heubaum)  [Orabug: 30618035] 
  - kvm.conf: Initial kvm.conf (Karl Heubaum)  [Orabug: 30618035] 
  - 80-kvm.rules: Initial 80-kvm.rules (Karl Heubaum)  [Orabug: 30618035] 
  - exec: set map length to zero when returning NULL (Prasad J Pandit)  [Orabug: 31439733]  {CVE-2020-13659}
  - megasas: use unsigned type for reply_queue_head and check index (Prasad J Pandit)  [Orabug: 31414338]  {CVE-2020-13362}
  - memory: Revert "memory: accept mismatching sizes in memory_region_access_valid" (Michael S. Tsirkin)  [Orabug: 31439736] [Orabug: 31452202]  {CVE-2020-13754} {CVE-2020-13791}


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-2.el7
changelog:
  - hw/net/xgmac: Fix buffer overflow in xgmac_enet_send() (Mauro Matteo Cascella)  [Orabug: 31667649]  {CVE-2020-15863}
  - hw/net/net_tx_pkt: fix assertion failure in net_tx_pkt_add_raw_fragment() (Mauro Matteo Cascella)  [Orabug: 31737809]  {CVE-2020-16092}
  - migration: fix memory leak in qmp_migrate_set_parameters (Zheng Chuan)  [Orabug: 31806256] 
  - virtio-net: fix removal of failover device (Juan Quintela)  [Orabug: 31806255] 
  - pvpanic: implement crashloaded event handling (Zhenwei Pi)  [Orabug: 31677154] 
  - pvpanic: introduce crashloaded for pvpanic (Zhenwei Pi)  [Orabug: 31677154]


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-3.el7
changelog:
  - qemu-kvm.spec: Install block storage module RPMs by default (Karl Heubaum)  [Orabug: 31943789] 
  - qemu-kvm.spec: Enable block-ssh module RPM (Karl Heubaum)  [Orabug: 31943763] 
  - hw: usb: hcd-ohci: check for processed TD before retire (Prasad J Pandit)  [Orabug: 31901690]  {CVE-2020-25625}
  - hw: usb: hcd-ohci: check len and frame_number variables (Prasad J Pandit)  [Orabug: 31901690]  {CVE-2020-25625}
  - hw: ehci: check return value of 'usb_packet_map' (Li Qiang)  [Orabug: 31901649]  {CVE-2020-25084}
  - hw: xhci: check return value of 'usb_packet_map' (Li Qiang)  [Orabug: 31901649]  {CVE-2020-25084}
  - qemu.spec: Enable '-Werror' for OL7 builds (Mark Kanda)  [Orabug: 31922718] 
  - usb: fix setup_len init (CVE-2020-14364) (Gerd Hoffmann)  [Orabug: 31848849]  {CVE-2020-14364}
  - Document CVE-2020-12829 and CVE-2020-14415 as fixed (Mark Kanda)  [Orabug: 31855502] [Orabug: 31855427]  {CVE-2020-12829} {CVE-2020-14415}


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-4.el7
changelog:
  - Document CVE-2020-25723 as fixed (Mark Kanda)  [Orabug: 32222397]  {CVE-2020-25084} {CVE-2020-25723}
  - hw/net/e1000e: advance desc_offset in case of null descriptor (Prasad J Pandit)  [Orabug: 32217517]  {CVE-2020-28916}
  - i386: Add 2nd Generation AMD EPYC processors (Moger, Babu)  [Orabug: 32217570] 
  - libslirp: Update version to include CVE fixes (Mark Kanda)  [Orabug: 32208456] [Orabug: 32208462]  {CVE-2020-29129} {CVE-2020-29130}
  - Document CVE-2020-25624 as fixed (Mark Kanda)  [Orabug: 32212527]  {CVE-2020-25624} {CVE-2020-25625}
  - pvpanic: Advertise the PVPANIC_CRASHLOADED event support (Paolo Bonzini)  [Orabug: 32102853] 
  - ati: check x y display parameter values (Prasad J Pandit)  [Orabug: 32108251]  {CVE-2020-27616}
  - Add AArch64 support for QMP regdump tool and sosreport plugin (Mark Kanda)  [Orabug: 32080658] 
  - Add qemu_regdump sosreport plugin support for '-mon' QMP sockets (Mark Kanda)  
  - migration/dirtyrate: present dirty rate only when querying the rate has completed (Chuan Zheng)  
  - migration/dirtyrate: record start_time and calc_time while at the measuring state (Chuan Zheng)  
  - migration/dirtyrate: Add trace_calls to make it easier to debug (Chuan Zheng)  
  - migration/dirtyrate: Implement qmp_cal_dirty_rate()/qmp_get_dirty_rate() function (Chuan Zheng)  
  - migration/dirtyrate: Implement calculate_dirtyrate() function (Chuan Zheng)  
  - migration/dirtyrate: Implement set_sample_page_period() and is_sample_period_valid() (Chuan Zheng)  
  - migration/dirtyrate: skip sampling ramblock with size below MIN_RAMBLOCK_SIZE (Chuan Zheng)  
  - migration/dirtyrate: Compare page hash results for recorded sampled page (Chuan Zheng)  
  - migration/dirtyrate: Record hash results for each sampled page (Chuan Zheng)  
  - migration/dirtyrate: move RAMBLOCK_FOREACH_MIGRATABLE into ram.h (Chuan Zheng)  
  - migration/dirtyrate: Add dirtyrate statistics series functions (Chuan Zheng)  
  - migration/dirtyrate: Add RamblockDirtyInfo to store sampled page info (Chuan Zheng)  
  - migration/dirtyrate: add DirtyRateStatus to denote calculation status (Chuan Zheng)  
  - migration/dirtyrate: setup up query-dirtyrate framwork (Chuan Zheng)  
  - ram_addr: Split RAMBlock definition (Juan Quintela)


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-5.el7
changelog:
  - qemu.spec: use --tls-priority=NORMAL for OL7 (Elena Ufimtseva)  
  - hostmem: fix default "prealloc-threads" count (Mark Kanda)  [Orabug: 32472127] 
  - hostmem: introduce "prealloc-threads" property (Igor Mammedov)  
  - qom: introduce object_register_sugar_prop (Paolo Bonzini)  
  - migration/multifd: Do error_free after migrate_set_error to avoid memleaks (Pan Nengyuan)  
  - multifd/tls: fix memoryleak of the QIOChannelSocket object when cancelling migration (Chuan Zheng)  
  - migration/multifd: fix hangup with TLS-Multifd due to blocking handshake (Chuan Zheng)  
  - migration/tls: add trace points for multifd-tls (Chuan Zheng)  
  - migration/tls: add support for multifd tls-handshake (Chuan Zheng)  
  - migration/tls: extract cleanup function for common-use (Chuan Zheng)  
  - migration/multifd: fix memleaks in multifd_new_send_channel_async (Pan Nengyuan)  
  - migration/multifd: fix nullptr access in multifd_send_terminate_threads (Zhimin Feng)  
  - migration/tls: add tls_hostname into MultiFDSendParams (Chuan Zheng)  
  - migration/tls: extract migration_tls_client_create for common-use (Chuan Zheng)  
  - migration/tls: save hostname into MigrationState (Chuan Zheng)  
  - tests/qtest: add a test case for pvpanic-pci (Mihai Carabas)  
  - pvpanic : update pvpanic spec document (Mihai Carabas)  
  - hw/misc/pvpanic: add PCI interface support (Mihai Carabas)  
  - hw/misc/pvpanic: split-out generic and bus dependent code (Mihai Carabas)  
  - 9pfs: Fully restart unreclaim loop (CVE-2021-20181) (Greg Kurz)  [Orabug: 32441198]  {CVE-2021-20181}
  - ide: atapi: check logical block address and read size (CVE-2020-29443) (Prasad J Pandit)  [Orabug: 32393835]  {CVE-2020-29443}
  - Document CVE-2019-20808 as fixed (Mark Kanda)  [Orabug: 32339196]  {CVE-2019-20808}
  - block/iscsi:fix heap-buffer-overflow in iscsi_aio_ioctl_cb (Chen Qun)  [Orabug: 32339207]  {CVE-2020-11947}
  - net: remove an assert call in eth_get_gso_type (Prasad J Pandit)  [Orabug: 32102583]  {CVE-2020-27617}
  - nvdimm: honor -object memory-backend-file, readonly=on option (Stefan Hajnoczi)  [Orabug: 32265408] 
  - hostmem-file: add readonly=on|off option (Stefan Hajnoczi)  [Orabug: 32265408] 
  - memory: add readonly support to memory_region_init_ram_from_file() (Stefan Hajnoczi)  [Orabug: 32265408]


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-6.el7
changelog:
  - i386/pc: Keep PCI 64-bit hole within usable IOVA space (Joao Martins)  
  - pc/cmos: Adjust CMOS above 4G memory size according to 1Tb boundary (Joao Martins)  
  - i386/pc: Round up the hotpluggable memory within valid IOVA ranges (Joao Martins)  
  - i386/pc: Account IOVA reserved ranges above 4G boundary (Joao Martins)


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-7.el7
changelog:
  - arm/virt: Add memory hot remove support (Mihai Carabas)  [Orabug: 32643506] 
  - i386/pc: consolidate usable iova iteration (Joao Martins)  
  - i386/acpi: fix SRAT ranges in accordance to usable IOVA (Joao Martins)  
  - migration: increase listening socket backlog (Elena Ufimtseva)  [Orabug: 32792545] 
  - multifd: Make multifd_save_setup() get an Error parameter (Juan Quintela)  
  - multifd: Make multifd_load_setup() get an Error parameter (Juan Quintela)  
  - migration: fix maybe-uninitialized warning (Marc-André Lureau)  
  - migration: Fix the re-run check of the migrate-incoming command (Yury Kotov)  
  - multifd: Initialize local variable (Juan Quintela)  
  - multifd: Be consistent about using uint64_t (Juan Quintela)  
  - Bug #1829242 correction. (Alexey Romko)  
  - migration/multifd: fix destroyed mutex access in terminating multifd threads (Jiahui Cen)  
  - migration/multifd: fix nullptr access in terminating multifd threads (Jiahui Cen)  
  - migration/multifd: not use multifd during postcopy (Wei Yang)  
  - migration/multifd: clean pages after filling packet (Wei Yang)  
  - migration: Make sure that we don't call write() in case of error (Juan Quintela)  
  - migration: fix multifd_send_pages() next channel (Laurent Vivier)  
  - migration/multifd: bypass uuid check for initial packet (Elena Ufimtseva)  [Orabug: 32610480] 
  - migration/tls: add error handling in multifd_tls_handshake_thread (Hao Wang)  
  - migration/tls: fix inverted semantics in multifd_channel_connect (Hao Wang)  
  - migration/multifd: do not access uninitialized multifd_recv_state (Elena Ufimtseva)  [Orabug: 32795384] 
  - io/channel-tls.c: make qio_channel_tls_shutdown thread-safe (Lukas Straub)  
  - qemu.spec: Enable qemu-guest-agent RPM for OL7 (Karl Heubaum)  [Orabug: 32415543] 
  - virtio-net: Set mac address to hardware if the peer is vdpa (Cindy Lu)  
  - net: Add vhost-vdpa in show_netdevs() (Cindy Lu)  
  - vhost-vdpa: Add qemu_close in vhost_vdpa_cleanup (Cindy Lu)  
  - hw/virtio/vhost-vdpa: Fix Coverity CID 1432864 (Philippe Mathieu-Daudé)  
  - vhost-vdpa: negotiate VIRTIO_NET_F_STATUS with driver (Si-Wei Liu)  
  - configure: Fix build dependencies with vhost-vdpa. (Laurent Vivier)  
  - configure: simplify vhost condition with Kconfig (Marc-André Lureau)  
  - vhost-vdpa: add trace-events (Laurent Vivier)  
  - dma/pl330: Fix qemu_hexdump() usage in pl330.c (Mark Kanda)  
  - util/hexdump: introduce qemu_hexdump_line() (Laurent Vivier)  
  - util/hexdump: Reorder qemu_hexdump() arguments (Philippe Mathieu-Daudé)  
  - util/hexdump: Convert to take a void pointer argument (Philippe Mathieu-Daudé)  
  - net/colo-compare.c: Only hexdump packets if tracing is enabled (Lukas Straub)  
  - vhost-vdpa: batch updating IOTLB mappings (Jason Wang)  
  - vhost: switch to use IOTLB v2 format (Jason Wang)  
  - vhost-vdpa: remove useless variable (Laurent Vivier)  
  - virtio: vdpa: omit check return of g_malloc (Li Qiang)  
  - vhost-vdpa: fix indentation in vdpa_ops (Stefano Garzarella)  
  - virtio-net: check the existence of peer before accessing vDPA config (Jason Wang)  
  - virtio-pci: fix wrong index in virtio_pci_queue_enabled (Yuri Benditovich)  
  - virtio-pci: fix virtio_pci_queue_enabled() (Laurent Vivier)  
  - vhost-vdpa :Fix Coverity CID 1430270 / CID 1420267 (Cindy Lu)  
  - vhost-vdpa: fix the compile issue without kvm (Cindy Lu)  
  - vhost-vdpa: introduce vhost-vdpa net client (Cindy Lu)  
  - vhost-vdpa: introduce vhost-vdpa backend (Cindy Lu)  
  - linux headers: sync to 5.9-rc4 (Jason Wang)  
  - Linux headers: update (Cornelia Huck)  
  - virtio-net: fix rsc_ext compat handling (Cornelia Huck)  
  - linux-headers: update against Linux 5.7-rc3 (Cornelia Huck)  
  - virtiofsd: Pull in kernel's fuse.h (Dr. David Alan Gilbert)  
  - linux-headers: Update (Bharata B Rao)  
  - vhost_net: introduce set_config & get_config (Cindy Lu)  
  - vhost: implement vhost_force_iommu method (Cindy Lu)  
  - vhost: introduce new VhostOps vhost_force_iommu (Cindy Lu)  
  - vhost: implement vhost_vq_get_addr method (Cindy Lu)  
  - vhost: introduce new VhostOps vhost_vq_get_addr (Cindy Lu)  
  - vhost: implement vhost_dev_start method (Cindy Lu)  
  - vhost: introduce new VhostOps vhost_dev_start (Cindy Lu)  
  - vhost: check the existence of vhost_set_iotlb_callback (Jason Wang)  
  - virtio-pci: implement queue_enabled method (Jason Wang)  
  - virtio-bus: introduce queue_enabled method (Jason Wang)  
  - vhost_net: use the function qemu_get_peer (Cindy Lu)  
  - net: introduce qemu_get_peer (Cindy Lu)  
  - vhost: correctly turn on VIRTIO_F_IOMMU_PLATFORM (Jason Wang)  
  - imx7-ccm: add digprog mmio write method (Prasad J Pandit)  [Orabug: 31576552]  {CVE-2020-15469}
  - tz-ppc: add dummy read/write methods (Prasad J Pandit)  [Orabug: 31576552]  {CVE-2020-15469}
  - spapr_pci: add spapr msi read method (Prasad J Pandit)  [Orabug: 31576552]  {CVE-2020-15469}
  - nvram: add nrf51_soc flash read method (Prasad J Pandit)  [Orabug: 31576552]  {CVE-2020-15469}
  - prep: add ppc-parity write method (Prasad J Pandit)  [Orabug: 31576552]  {CVE-2020-15469}
  - vfio: add quirk device write method (Prasad J Pandit)  [Orabug: 31576552]  {CVE-2020-15469}
  - pci-host: designware: add pcie-msi read method (Prasad J Pandit)  [Orabug: 31576552]  {CVE-2020-15469}
  - hw/pci-host: add pci-intack write method (Prasad J Pandit)  [Orabug: 31576552]  {CVE-2020-15469}
  - oslib-posix: initialize backend memory objects in parallel (Mark Kanda)  [Orabug: 32555402] 
  - oslib-posix: refactor memory prealloc threads (Mark Kanda)  [Orabug: 32555402] 
  - oslib-posix: take lock before qemu_cond_broadcast (Bauerchen)  [Orabug: 32555402] 
  - oslib-posix: initialize mutex and condition variable (Paolo Bonzini)  [Orabug: 32555402] 
  - mem-prealloc: optimize large guest startup (bauerchen)  [Orabug: 32555402] 
  - i386: Add the support for AMD EPYC 3rd generation processors (Babu Moger)  
  - acpi: cpuhp: document CPHP_GET_CPU_ID_CMD command (Igor Mammedov)  
  - acpi: cpuhp: add CPHP_GET_CPU_ID_CMD command (Igor Mammedov)  
  - acpi: cpuhp: spec: add typical usecases (Igor Mammedov)  
  - acpi: cpuhp: spec: clarify store into 'Command data' when 'Command field' == 0 (Igor Mammedov)  
  - acpi: cpuhp: spec: fix 'Command data' description (Igor Mammedov)  
  - acpi: cpuhp: spec: clarify 'CPU selector' register usage and endianness (Igor Mammedov)  
  - acpi: cpuhp: introduce 'Command data 2' field (Igor Mammedov)  
  - x86: ich9: let firmware negotiate 'CPU hot-unplug with SMI' feature (Igor Mammedov)  
  - x86: ich9: factor out "guest_cpu_hotplug_features" (Igor Mammedov)  
  - x86: acpi: let the firmware handle pending "CPU remove" events in SMM (Igor Mammedov)  
  - x86: acpi: introduce AcpiPmInfo::smi_on_cpu_unplug (Igor Mammedov)  
  - acpi: cpuhp: introduce 'firmware performs eject' status/control bits (Igor Mammedov)  
  - x68: acpi: trigger SMI before sending hotplug Notify event to OSPM (Igor Mammedov)  
  - x86: acpi: introduce the PCI0.SMI0 ACPI device (Igor Mammedov)  
  - x86: acpi: introduce AcpiPmInfo::smi_on_cpuhp (Igor Mammedov)  
  - x86: ich9: expose "smi_negotiated_features" as a QOM property (Igor Mammedov)  
  - tests: acpi: mark to be changed tables in bios-tables-test-allowed-diff (Igor Mammedov)  
  - acpi: add aml_land() and aml_break() primitives (Igor Mammedov)  
  - x86: cpuhp: refuse cpu hot-unplug request earlier if not supported (Igor Mammedov)  
  - x86: cpuhp: prevent guest crash on CPU hotplug when broadcast SMI is in use (Igor Mammedov)  
  - x86: lpc9: let firmware negotiate 'CPU hotplug with SMI' features (Igor Mammedov)  
  - q35: implement 128K SMRAM at default SMBASE address (Igor Mammedov)  
  - hw/intc/arm_gic: Fix interrupt ID in GICD_SGIR register (Philippe Mathieu-Daudé)  [Orabug: 32470471]  {CVE-2021-20221}
  - memory: clamp cached translation in case it points to an MMIO region (Paolo Bonzini)  [Orabug: 32252673]  {CVE-2020-27821}
  - hw/sd/sdhci: Fix DMA Transfer Block Size field (Philippe Mathieu-Daudé)  [Orabug: 32613470]  {CVE-2021-3409}


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-9.el7
changelog:
  - Revert "oslib-posix: refactor memory prealloc threads" (Mark Kanda)  [Orabug: 32903662] 
  - Revert "oslib-posix: initialize backend memory objects in parallel" (Mark Kanda)  [Orabug: 32903662]


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-10.el7
changelog:
  - e1000: fail early for evil descriptor (Jason Wang)  [Orabug: 32560552]  {CVE-2021-20257}
  - Document CVE-2020-27661 as fixed (Mark Kanda)  [Orabug: 32960200]  {CVE-2020-27661}
  - block: Avoid stale pointer dereference in blk_get_aio_context() (Greg Kurz)  
  - block: Fix blk->in_flight during blk_wait_while_drained() (Kevin Wolf)  
  - block: Increase BB.in_flight for coroutine and sync interfaces (Kevin Wolf)  
  - block-backend: Reorder flush/pdiscard function definitions (Kevin Wolf)


author: Karl Heubaum <karl.heubaum@oracle.com> - 15:4.1.1-3.el7
changelog:
  - buildrpm/spec files: Don't package elf2dmp (Karl Heubaum)  [Orabug: 31657424] 
  - qemu-kvm.spec: Enable the block-curl package (Karl Heubaum)  [Orabug: 31657424] 
  - qemu.spec: enable have_curl in spec (Dongli Zhang)  [Orabug: 31657424]


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.3.0-2.el7
changelog:
  - synchronized with qemu-kvm-rhev-2.3.0-9.el7
  - qemuga-Change-fsreeze-hook-default-location.patch [bz#1210707]
  - qemuga-qga-commands-posix-Fix-bug-in-guest-fstrim.patch [bz#1211973]
  - Resolves: bz#1210707
    (The default path '/etc/qemu/fsfreeze-hook' for 'fsfreeze-hook' script doesn't exist)
  - Resolves: bz#1211973
    ('guest-fstrim' failed for guest with os on spapr-vscsi disk)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.3.0-3.el7
changelog:
  - qemuga-Do-not-stop-qemu-guest-agent-service-on-target-switc.patch [bz#1160930]
  - Resolves: bz#1160930
    (The guest agent service in rhel7 guest will be stopped after run the init command)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.5.0-2.el7
changelog:
  - qemuga-redhat-blacklist-guest-exec-commands.patch [bz#1340346]
  - Resolves: bz#1340346
    (blacklist guest-exec in newer version of qemu-guest-agent)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.5.0-3.el7
changelog:
  - qemuga-spec-add-qemu-ga-man-page.patch [bz#1101556]
  - Resolves: bz#1101556
    ([RFE] qemu-ga should have a config file)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.8.0-1.el7
changelog:
  - Rebase to 2.8.0 base [bz#1414676]
  - Resolves: bz#1414676
    (Rebase qemu-guest-agent to 2.8.0 base)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.8.0-2.el7
changelog:
  - qemuga-Remove-unnecessary-dependencies.patch [bz#1441999]
  - Resolves: bz#1441999
    (Clean qemu-ga dependencies)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.12.0-1.el7
changelog:
  - Rebase to 2.12.0 base [bz#1562218]
  - Resolves: bz#1562218
    (Rebase qemu-guest-agent for RHEL-7.6)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.12.0-2.el7
changelog:
  - qemuga-qemu-ga-make-get-fsinfo-work-over-pci-bridges.patch [bz#1567041]
  - qemuga-qga-fix-driver-leak-in-guest-get-fsinfo.patch [bz#1567041]
  - Resolves: bz#1567041
    (qemu-guest-agent does not parse PCI bridge links in "build_guest_fsinfo_for_real_device" (q35))


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.12.0-3.el7
changelog:
  - qemuga-qga-ignore-non-present-cpus-when-handling-qmp_guest_.patch [bz#1611062]
  - qemuga-qemu-guest-agent.spec-add-systemd-devel-dependency.patch [bz#1635571]
  - qemuga-configure-add-test-for-libudev.patch [bz#1635571]
  - qemuga-qga-linux-report-disk-serial-number.patch [bz#1635571]
  - qemuga-qga-linux-return-disk-device-in-guest-get-fsinfo.patch [bz#1635571]
  - Resolves: bz#1611062
    ("virsh vcpucount --guest" fails after hotunplug a vcpu with intermediate order by "setvcpu")
  - Resolves: bz#1635571
    ([RFE] Report disk device name and serial number (qemu-guest-agent on Linux))


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.1.0-2.el7
changelog:
  - Create separate qemu-guest-agent package based on qemu-kvm-rhev-2.1.0-1.el7 [bz#1117096]
  - Resolves: #bz1117096


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.1.0-3.el7
changelog:
  - Allow building qemu-guest-agent on ppc64le
  - Synchronize with qemu-kvm-rhev-2.1.0-3.el7
  - Resolves: bz#1132718
    (qemu-guest-agent fails to build for ppc64le)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.1.0-4.el7
changelog:
  - kvm-Mark-etc-sysconfig-qemu-ga-as-config-noreplace.patch [bz#1150924]
  - Resolves: bz#1150924
    (/etc/sysconfig/qemu-ga is replaced when updated)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.3.0-4.el7
changelog:
  - qemuga-qga-fail-early-for-invalid-time.patch [bz#1224023]
  - Resolves: bz#1224023
    (The hwclock and systemclock of guest should be ccoincident while set a invalid domtime with guest agent)


author: Wainer dos Santos Moschetta <wainersm@redhat.com> - 2.8.0-3.el7
changelog:
  - qemuga-qga-Add-guest-get-host-name-command.patch [bz#1598210]
  - qemuga-qga-Add-guest-get-users-command.patch [bz#1598210]
  - qemuga-qga-Add-guest-get-timezone-command.patch [bz#1598210]
  - qemuga-qemu-ga-check-if-utmpx.h-is-available-on-the-system.patch [bz#1598210]
  - qemuga-qemu-ga-add-guest-get-osinfo-command.patch [bz#1598210]
  - qemuga-test-qga-pass-environemnt-to-qemu-ga.patch [bz#1598210]
  - qemuga-test-qga-add-test-for-guest-get-osinfo.patch [bz#1598210]
  - Resolves: bz#1598210
    (Backport some features to 2.8 in RHEL 7.5 [rhel-7.5.z])


author: Wainer dos Santos Moschetta <wainersm@redhat.com> - 2.8.0-2.el7_5.1
changelog:
  - Corrected the package version from 2.8.0-3.el7 to 2.8.0-2.el7_5.1
  - Resolves: bz#1598210
    (Backport some features to 2.8 in RHEL 7.5 [rhel-7.5.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-96.el7
changelog:
  - kvm-ahci.c-mask-unused-flags-when-reading-size-PRDT-DBC.patch [bz#1205100]
  - kvm-ide-Correct-handling-of-malformed-short-PRDTs.patch [bz#1205100]
  - Resolves: bz#1205100
    (qemu-kvm: Qemu: PRDT overflow from guest to host [rhel-7.2])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-97.el7
changelog:
  - kvm-ide-Check-array-bounds-before-writing-to-io_buffer-C.patch [bz#1243690]
  - kvm-ide-atapi-Fix-START-STOP-UNIT-command-completion.patch [bz#1243690]
  - kvm-ide-Clear-DRQ-after-handling-all-expected-accesses.patch [bz#1243690]
  - Resolves: bz#1243690
    (EMBARGOED CVE-2015-5154 qemu-kvm: qemu: ide: atapi: heap overflow during I/O buffer memory access [rhel-7.2])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-98.el7
changelog:
  - kvm-block-curl-Don-t-lose-original-error-when-a-connecti.patch [bz#1235812]
  - kvm-vfio-pci-Add-pba_offset-PCI-quirk-for-Chelsio-T5-dev.patch [bz#1244347]
  - kvm-block-Print-its-file-name-if-backing-file-opening-fa.patch [bz#1238639]
  - kvm-block-Propagate-error-in-bdrv_img_create.patch [bz#1238639]
  - kvm-iotests-Add-test-for-non-existing-backing-file.patch [bz#1238639]
  - Resolves: bz#1235812
    (block/curl: Fix generic "Input/output error" on failure)
  - Resolves: bz#1238639
    (qemu-img shows error message for backing file twice)
  - Resolves: bz#1244347
    (Quirk for Chelsio T5 MSI-X PBA)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-99.el7
changelog:
  - kvm-usb-ccid-add-missing-wakeup-calls.patch [bz#1243731]
  - kvm-vpc-Handle-failure-for-potentially-large-allocations.patch [bz#1217349]
  - kvm-block-vpc-prevent-overflow-if-max_table_entries-0x40.patch [bz#1217349]
  - kvm-block-qemu-iotests-add-check-for-multiplication-over.patch [bz#1217349]
  - kvm-virtio-scsi-use-virtqueue_map_sg-when-loading-reques.patch [bz#1249718]
  - kvm-scsi-disk-fix-cmd.mode-field-typo.patch [bz#1249718]
  - kvm-rtl8139-avoid-nested-ifs-in-IP-header-parsing-CVE-20.patch [bz#1248766]
  - kvm-rtl8139-drop-tautologous-if-ip-.-statement-CVE-2015-.patch [bz#1248766]
  - kvm-rtl8139-skip-offload-on-short-Ethernet-IP-header-CVE.patch [bz#1248766]
  - kvm-rtl8139-check-IP-Header-Length-field-CVE-2015-5165.patch [bz#1248766]
  - kvm-rtl8139-check-IP-Total-Length-field-CVE-2015-5165.patch [bz#1248766]
  - kvm-rtl8139-skip-offload-on-short-TCP-header-CVE-2015-51.patch [bz#1248766]
  - kvm-rtl8139-check-TCP-Data-Offset-field-CVE-2015-5165.patch [bz#1248766]
  - Resolves: bz#1217349
    (qemu-img vpc driver segfault)
  - Resolves: bz#1243731
    (smart card emulation doesn't work with USB3 (nec-xhci) controller)
  - Resolves: bz#1248766
    (CVE-2015-5165 qemu-kvm: Qemu: rtl8139 uninitialized heap memory information leakage to guest [rhel-7.2])
  - Resolves: bz#1249718
    (Segfault occurred at Dst VM while completed migration upon ENOSPC)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-100.el7
changelog:
  - kvm-block-update-test-070-for-vhdx.patch [bz#1171576]
  - kvm-block-coverity-fix-check-return-value-for-fcntl-in-g.patch [bz#1219217]
  - Resolves: bz#1171576
    (test case 064 and 070 of qemu-iotests fail for vhdx with qemu-kvm-1.5.3-83.el7)
  - Resolves: bz#1219217
    (Coverity-detected defect: call to fcntl without checking return value)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-101.el7
changelog:
  - kvm-serial-reset-state-at-startup.patch [bz#922014]
  - kvm-ide-Check-validity-of-logical-block-size.patch [bz#1134670]
  - Resolves: bz#1134670
    (fail to specify the physical_block_size/logical_block_size value not 512 for IDE disk)
  - Resolves: bz#922014
    (RFE: support hotplugging chardev & serial ports (Windows guests))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-102.el7
changelog:
  - kvm-mc146818rtc-add-rtc-reset-reinjection-QMP-command.patch [bz#1191226]
  - Resolves: bz#1191226
    (libvirt requires rtc-reset-reinjection command, backport it to RHEL7.1)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-103.el7
changelog:
  - kvm-Drop-superfluous-conditionals-around-g_strdup.patch [bz#1218919]
  - kvm-util-Drop-superfluous-conditionals-around-g_free.patch [bz#1218919]
  - kvm-util-Fuse-g_malloc-memset-into-g_new0.patch [bz#1218919]
  - kvm-util-uri-uri_new-can-t-fail-drop-dead-error-handling.patch [bz#1218919]
  - kvm-util-uri-realloc2n-can-t-fail-drop-dead-error-handli.patch [bz#1218919]
  - kvm-util-uri-URI-member-path-can-be-null-compare-more-ca.patch [bz#1218919]
  - kvm-util-uri-Add-overflow-check-to-rfc3986_parse_port.patch [bz#1218919]
  - Resolves: bz#1218919
    (Coverity-detected defect: buffer overrun at uri.c:2035)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-104.el7
changelog:
  - kvm-qemu-iotests-Filter-qemu-io-output-in-025.patch [bz#1170974]
  - Resolves: bz#1170974
    (test case 025 of qemu-iotests fail for raw with qemu-kvm-1.5.3-83.el7.x86_64)


author: Jeff E. Nelson <jen@redhat.com> - 1.5.3-105.el7
changelog:
  - kvm-qtest-ide-test-disable-flush-test.patch [bz#1270341]
  - Resolves: bz#1270341
    (qemu-kvm build failure race condition in tests/ide-test)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-105.el7_2.1
changelog:
  - kvm-rbd-make-qemu-s-cache-setting-override-any-ceph-sett.patch [bz#1279389]
  - kvm-rbd-fix-ceph-settings-precedence.patch [bz#1279389]
  - Resolves: bz#1279389
    (ceph.conf properties override qemu's command-line properties)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-105.el7_2.2
changelog:
  - kvm-raw-posix-Fix-.bdrv_co_get_block_status-for-unaligne.patch [bz#1298828]
  - Resolves: bz#1298828
    ([abrt] qemu-img: get_block_status(): qemu-img killed by SIGABRT)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-105.el7_2.3
changelog:
  - kvm-fw_cfg-add-check-to-validate-current-entry-value-CVE.patch [bz#1298047]
  - Resolves: bz#1298047
    (CVE-2016-1714 qemu-kvm: Qemu: nvram: OOB r/w access in processing firmware configurations [rhel-7.2.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-105.el7_2.4
changelog:
  - kvm-vga-Remove-some-should-be-done-in-BIOS-comments.patch [bz#1331412]
  - kvm-vga-fix-banked-access-bounds-checking-CVE-2016-3710.patch [bz#1331412]
  - kvm-vga-add-vbe_enabled-helper.patch [bz#1331412]
  - kvm-vga-factor-out-vga-register-setup.patch [bz#1331412]
  - kvm-vga-update-vga-register-setup-on-vbe-changes.patch [bz#1331412]
  - kvm-vga-make-sure-vga-register-setup-for-vbe-stays-intac.patch [bz#1331412]
  - Resolves: bz#1331412
    (EMBARGOED CVE-2016-3710 qemu-kvm: qemu: incorrect banked access bounds checking in vga module [rhel-7.2.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-105.el7_2.5
changelog:
  - kvm-vga-add-sr_vbe-register-set.patch [bz#1347527]
  - Resolves: bz#1347527
    (Regression from CVE-2016-3712: windows installer fails to start)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-105.el7_2.6
changelog:
  - kvm-virtio-error-out-if-guest-exceeds-virtqueue-size.patch [bz#1359728]
  - Resolves: bz#1359728
    (EMBARGOED CVE-2016-5403 qemu-kvm: Qemu: virtio: unbounded memory allocation on host via guest leading to DoS [rhel-7.2.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-105.el7_2.7
changelog:
  - kvm-block-iscsi-avoid-potential-overflow-of-acb-task-cdb.patch [bz#1358996]
  - Resolves: bz#1358996
    (CVE-2016-5126 qemu-kvm: Qemu: block: iscsi: buffer overflow in iscsi_aio_ioctl [rhel-7.2.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-117.el7
changelog:
  - kvm-target-i386-add-feature-flags-for-CPUID-EAX-0xd-ECX-.patch [bz#1327599]
  - kvm-target-i386-add-Skylake-Client-cpu-model.patch [bz#1327599]
  - Resolves: bz#1327599
    (Add Skylake CPU model)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-118.el7
changelog:
  - kvm-util-introduce-MIN_NON_ZERO.patch [bz#1318199]
  - kvm-BlockLimits-introduce-max_transfer_length.patch [bz#1318199]
  - kvm-block-backend-expose-bs-bl.max_transfer_length.patch [bz#1318199]
  - kvm-scsi-generic-Merge-block-max-xfer-len-in-INQUIRY-res.patch [bz#1318199]
  - kvm-raw-posix-Fetch-max-sectors-for-host-block-device.patch [bz#1318199]
  - kvm-scsi-Advertise-limits-by-blocksize-not-512.patch [bz#1318199]
  - kvm-util-Fix-MIN_NON_ZERO.patch [bz#1318199]
  - Resolves: bz#1318199
    (expose host BLKSECTGET limit in scsi-block (qemu-kvm))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-119.el7
changelog:
  - kvm-qxl-factor-out-qxl_get_check_slot_offset.patch [bz#1355730]
  - kvm-qxl-store-memory-region-and-offset-instead-of-pointe.patch [bz#1355730]
  - kvm-qxl-fix-surface-migration.patch [bz#1355730]
  - kvm-qxl-fix-qxl_set_dirty-call-in-qxl_dirty_one_surface.patch [bz#1355730]
  - Resolves: bz#1355730
    (spice-gtk shows outdated screen state after migration [qemu-kvm])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-120.el7
changelog:
  - kvm-Add-install-dependency-to-newer-libusbx-version.patch [bz#1351106]
  - kvm-virtio-error-out-if-guest-exceeds-virtqueue-size.patch [bz#1359729]
  - Resolves: bz#1351106
    (symbol lookup error: /usr/libexec/qemu-kvm: undefined symbol: libusb_get_port_numbers)
  - Resolves: bz#1359729
    (CVE-2016-5403 qemu-kvm: Qemu: virtio: unbounded memory allocation on host via guest leading to DoS [rhel-7.3])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-121.el7
changelog:
  - kvm-json-parser-drop-superfluous-assignment-for-token-va.patch [bz#1276036]
  - kvm-qjson-Apply-nesting-limit-more-sanely.patch [bz#1276036]
  - kvm-qjson-Don-t-crash-when-input-exceeds-nesting-limit.patch [bz#1276036]
  - kvm-check-qjson-Add-test-for-JSON-nesting-depth-limit.patch [bz#1276036]
  - kvm-qjson-Spell-out-some-silent-assumptions.patch [bz#1276036]
  - kvm-qjson-Give-each-of-the-six-structural-chars-its-own-.patch [bz#1276036]
  - kvm-qjson-Inline-token_is_keyword-and-simplify.patch [bz#1276036]
  - kvm-qjson-Inline-token_is_escape-and-simplify.patch [bz#1276036]
  - kvm-qjson-replace-QString-in-JSONLexer-with-GString.patch [bz#1276036]
  - kvm-qjson-Convert-to-parser-to-recursive-descent.patch [bz#1276036]
  - kvm-qjson-store-tokens-in-a-GQueue.patch [bz#1276036]
  - kvm-qjson-surprise-allocating-6-QObjects-per-token-is-ex.patch [bz#1276036]
  - kvm-qjson-Limit-number-of-tokens-in-addition-to-total-si.patch [bz#1276036]
  - kvm-json-streamer-Don-t-leak-tokens-on-incomplete-parse.patch [bz#1276036]
  - kvm-json-streamer-fix-double-free-on-exiting-during-a-pa.patch [bz#1276036]
  - kvm-trace-remove-malloc-tracing.patch [bz#1360137]
  - Resolves: bz#1276036
    (Crash on QMP input exceeding limits)
  - Resolves: bz#1360137
    (GLib-WARNING **: gmem.c:482: custom memory allocation vtable not supported)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-122.el7
changelog:
  - kvm-virtio-validate-the-existence-of-handle_output-befor.patch [bz#1367040]
  - Resolves: bz#1367040
    (QEMU crash when guest notifies non-existent virtqueue)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-123.el7
changelog:
  - kvm-Fix-backport-of-target-i386-add-feature-flags-for-CP.patch [bz#1371619]
  - kvm-Add-skip_dump-flag-to-ignore-memory-region-during-du.patch [bz#1373088]
  - Resolves: bz#1371619
    (Flags xsaveopt xsavec xgetbv1 are missing on qemu-kvm)
  - Resolves: bz#1373088
    ([FJ7.3 Bug]: virsh dump with both --memory-only and --format option fails)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-124.el7
changelog:
  - kvm-target-i386-Add-support-for-FEAT_7_0_ECX.patch [bz#1372459]
  - kvm-target-i386-Add-more-Intel-AVX-512-instructions-supp.patch [bz#1372459]
  - Resolves: bz#1372459
    ([Intel 7.3 Bug] SKL-SP Guest cpu doesn't support avx512 instruction sets(avx512bw, avx512dq and avx512vl) (qemu-kvm))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-125.el7
changelog:
  - kvm-nbd-server-Set-O_NONBLOCK-on-client-fd.patch [bz#1285453]
  - Resolves: bz#1285453
    (An NBD client can cause QEMU main loop to block when connecting to built-in NBD server)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7
changelog:
  - kvm-virtio-recalculate-vq-inuse-after-migration.patch [bz#1376542]
  - Resolves: bz#1376542
    (RHSA-2016-1756 breaks migration of instances)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.1
changelog:
  - kvm-ide-fix-halted-IO-segfault-at-reset.patch [bz#1393042]
  - kvm-hw-i386-regenerate-checked-in-AML-payload-RHEL-only.patch [bz#1392027]
  - kvm-SPEC-file-flip-the-build-from-IASL-to-checked-in-AML.patch [bz#1392027]
  - Resolves: bz#1392027
    (shutdown rhel 5.11 guest failed and stop at "system halted")
  - Resolves: bz#1393042
    (system_reset should clear pending request for error (IDE))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.2
changelog:
  - kvm-virtio-introduce-virtqueue_unmap_sg.patch [bz#1393484]
  - kvm-virtio-introduce-virtqueue_discard.patch [bz#1393484]
  - kvm-virtio-decrement-vq-inuse-in-virtqueue_discard.patch [bz#1393484]
  - kvm-balloon-fix-segfault-and-harden-the-stats-queue.patch [bz#1393484]
  - kvm-virtio-balloon-discard-virtqueue-element-on-reset.patch [bz#1393484]
  - kvm-virtio-zero-vq-inuse-in-virtio_reset.patch [bz#1393484]
  - kvm-virtio-add-virtqueue_rewind.patch [bz#1393484]
  - kvm-virtio-balloon-fix-stats-vq-migration.patch [bz#1393484]
  - Resolves: bz#1393484
    ([RHEL7.3] KVM guest shuts itself down after 128th reboot)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.3
changelog:
  - kvm-net-check-packet-payload-length.patch [bz#1398217]
  - Resolves: bz#1398217
    (CVE-2016-2857 qemu-kvm: Qemu: net: out of bounds read in net_checksum_calculate() [rhel-7.3.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.4
changelog:
  - kvm-virtio-blk-Release-s-rq-queue-at-system_reset.patch [bz#1420049]
  - kvm-cirrus_vga-fix-off-by-one-in-blit_region_is_unsafe.patch [bz#1418232]
  - kvm-display-cirrus-check-vga-bits-per-pixel-bpp-value.patch [bz#1418232]
  - kvm-display-cirrus-ignore-source-pitch-value-as-needed-i.patch [bz#1418232]
  - kvm-cirrus-handle-negative-pitch-in-cirrus_invalidate_re.patch [bz#1418232]
  - kvm-cirrus-allow-zero-source-pitch-in-pattern-fill-rops.patch [bz#1418232]
  - kvm-cirrus-fix-blit-address-mask-handling.patch [bz#1418232]
  - kvm-cirrus-fix-oob-access-issue-CVE-2017-2615.patch [bz#1418232]
  - Resolves: bz#1418232
    (CVE-2017-2615 qemu-kvm: Qemu: display: cirrus: oob access while doing bitblt copy backward mode [rhel-7.3.z])
  - Resolves: bz#1420049
    (system_reset should clear pending request for error (virtio-blk))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.5
changelog:
  - kvm-cirrus-fix-patterncopy-checks.patch [bz#1420490]
  - kvm-Revert-cirrus-allow-zero-source-pitch-in-pattern-fil.patch [bz#1420490]
  - kvm-cirrus-add-blit_is_unsafe-call-to-cirrus_bitblt_cput.patch [bz#1420490]
  - Resolves: bz#1420490
    (EMBARGOED CVE-2017-2620 qemu-kvm: Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo [rhel-7.3.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.6
changelog:
  - kvm-fix-cirrus_vga-fix-OOB-read-case-qemu-Segmentation-f.patch [bz#1430059]
  - kvm-cirrus-vnc-zap-bitblit-support-from-console-code.patch [bz#1430059]
  - kvm-cirrus-add-option-to-disable-blitter.patch [bz#1430059]
  - kvm-cirrus-fix-cirrus_invalidate_region.patch [bz#1430059]
  - kvm-cirrus-stop-passing-around-dst-pointers-in-the-blitt.patch [bz#1430059]
  - kvm-cirrus-stop-passing-around-src-pointers-in-the-blitt.patch [bz#1430059]
  - kvm-cirrus-fix-off-by-one-in-cirrus_bitblt_rop_bkwd_tran.patch [bz#1430059]
  - Resolves: bz#1430059
    (CVE-2016-9603 qemu-kvm: Qemu: cirrus: heap buffer overflow via vnc connection [rhel-7.3.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.7
changelog:
  - kvm-char-serial-cosmetic-fixes.patch [bz#1452332]
  - kvm-char-serial-Use-generic-Fifo8.patch [bz#1452332]
  - kvm-char-serial-serial_ioport_write-Factor-out-common-co.patch [bz#1452332]
  - kvm-char-serial-fix-copy-paste-error-fifo8_is_full-vs-em.patch [bz#1452332]
  - kvm-char-serial-Fix-emptyness-check.patch [bz#1452332]
  - kvm-char-serial-Fix-emptyness-handling.patch [bz#1452332]
  - kvm-serial-poll-the-serial-console-with-G_IO_HUP.patch [bz#1452332]
  - kvm-serial-change-retry-logic-to-avoid-concurrency.patch [bz#1452332]
  - kvm-qemu-char-ignore-flow-control-if-a-PTY-s-slave-is-no.patch [bz#1452332]
  - kvm-serial-check-if-backed-by-a-physical-serial-port-at-.patch [bz#1452332]
  - kvm-serial-reset-thri_pending-on-IER-writes-with-THRI-0.patch [bz#1452332]
  - kvm-serial-clean-up-THRE-TEMT-handling.patch [bz#1452332]
  - kvm-serial-update-LSR-on-enabling-disabling-FIFOs.patch [bz#1452332]
  - kvm-serial-only-resample-THR-interrupt-on-rising-edge-of.patch [bz#1452332]
  - kvm-serial-make-tsr_retry-unsigned.patch [bz#1452332]
  - kvm-serial-simplify-tsr_retry-reset.patch [bz#1452332]
  - kvm-serial-separate-serial_xmit-and-serial_watch_cb.patch [bz#1452332]
  - kvm-serial-remove-watch-on-reset.patch [bz#1452332]
  - Resolves: bz#1452332
    (RHEL 7.2 based VM (Virtual Machine) hung for several hours apparently waiting for lock held by main_loop)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.8
changelog:
  - kvm-char-change-qemu_chr_fe_add_watch-to-return-unsigned.patch [bz#1452332]
  - Resolves: bz#1452332
    (RHEL 7.2 based VM (Virtual Machine) hung for several hours apparently waiting for lock held by main_loop)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.9
changelog:
  - kvm-spice-fix-spice_chr_add_watch-pre-condition.patch [bz#1452332]
  - Resolves: bz#1452332
    (RHEL 7.2 based VM (Virtual Machine) hung for several hours apparently waiting for lock held by main_loop)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.10
changelog:
  - kvm-nbd-Fully-initialize-client-in-case-of-failed-negoti.patch [bz#1460179]
  - kvm-nbd-Fix-regression-on-resiliency-to-port-scan.patch [bz#1460179]
  - Resolves: bz#1460179
    (CVE-2017-9524 qemu-kvm: Qemu: nbd: segmentation fault due to client non-negotiation [rhel-7.3.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-132.el7
changelog:
  - kvm-cirrus-fix-patterncopy-checks.patch [bz#1420492]
  - kvm-Revert-cirrus-allow-zero-source-pitch-in-pattern-fil.patch [bz#1420492]
  - kvm-cirrus-add-blit_is_unsafe-call-to-cirrus_bitblt_cput.patch [bz#1420492]
  - Resolves: bz#1420492
    (EMBARGOED CVE-2017-2620 qemu-kvm: Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo [rhel-7.4])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-133.el7
changelog:
  - kvm-target-i386-add-Ivy-Bridge-CPU-model.patch [bz#1368375]
  - kvm-x86-add-AVX512_4VNNIW-and-AVX512_4FMAPS-features.patch [bz#1382122]
  - kvm-target-i386-kvm_cpu_fill_host-Kill-unused-code.patch [bz#1382122]
  - kvm-target-i386-kvm_cpu_fill_host-No-need-to-check-level.patch [bz#1382122]
  - kvm-target-i386-kvm_cpu_fill_host-No-need-to-check-CPU-v.patch [bz#1382122]
  - kvm-target-i386-kvm_cpu_fill_host-No-need-to-check-xleve.patch [bz#1382122]
  - kvm-target-i386-kvm_cpu_fill_host-Set-all-feature-words-.patch [bz#1382122]
  - kvm-target-i386-kvm_cpu_fill_host-Fill-feature-words-in-.patch [bz#1382122]
  - kvm-target-i386-kvm_check_features_against_host-Kill-fea.patch [bz#1382122]
  - kvm-target-i386-Make-TCG-feature-filtering-more-readable.patch [bz#1382122]
  - kvm-target-i386-Filter-FEAT_7_0_EBX-TCG-features-too.patch [bz#1382122]
  - kvm-target-i386-Filter-KVM-and-0xC0000001-features-on-TC.patch [bz#1382122]
  - kvm-target-i386-Define-TCG_-_FEATURES-earlier-in-cpu.c.patch [bz#1382122]
  - kvm-target-i386-Loop-based-copying-and-setting-unsetting.patch [bz#1382122]
  - kvm-target-i386-Loop-based-feature-word-filtering-in-TCG.patch [bz#1382122]
  - kvm-spice-remove-spice-experimental.h-include.patch [bz#1430606]
  - kvm-spice-replace-use-of-deprecated-API.patch [bz#1430606]
  - Resolves: bz#1368375
    ([Intel 7.4 Bug] qemu-kvm does not support “-cpu IvyBridge”)
  - Resolves: bz#1382122
    ([Intel 7.4 FEAT] KVM Enable the avx512_4vnniw, avx512_4fmaps instructions in qemu)
  - Resolves: bz#1430606
    (Can't build qemu-kvm with newer spice packages)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-134.el7
changelog:
  - kvm-ui-vnc-introduce-VNC_DIRTY_PIXELS_PER_BIT-macro.patch [bz#1377977]
  - kvm-ui-vnc-derive-cmp_bytes-from-VNC_DIRTY_PIXELS_PER_BI.patch [bz#1377977]
  - kvm-ui-vnc-optimize-dirty-bitmap-tracking.patch [bz#1377977]
  - kvm-ui-vnc-optimize-setting-in-vnc_dpy_update.patch [bz#1377977]
  - kvm-ui-vnc-fix-vmware-VGA-incompatiblities.patch [bz#1377977]
  - kvm-ui-vnc-fix-potential-memory-corruption-issues.patch [bz#1377977]
  - kvm-vnc-fix-memory-corruption-CVE-2015-5225.patch [bz#1377977]
  - kvm-vnc-fix-overflow-in-vnc_update_stats.patch [bz#1377977]
  - kvm-i386-kvmvapic-initialise-imm32-variable.patch [bz#1335751]
  - kvm-qemu-iotests-Filter-out-actual-image-size-in-067.patch [bz#1427176]
  - vm-qcow2-Don-t-rely-on-free_cluster_index-in-alloc_ref2.patch [bz#1427176]
  - kvm-qemu-iotests-Fix-core-dump-suppression-in-test-039.patch [bz#1427176]
  - kvm-qemu-io-Add-sigraise-command.patch [bz#1427176]
  - kvm-iotests-Filter-for-Killed-in-qemu-io-output.patch [bz#1427176]
  - kvm-iotests-Fix-test-039.patch [bz#1427176]
  - kvm-blkdebug-Add-bdrv_truncate.patch [bz#1427176]
  - kvm-vhdx-Fix-zero-fill-iov-length.patch [bz#1427176]
  - kvm-qemu-iotests-Disable-030-040-041.patch [bz#1427176]
  - kvm-x86-add-AVX512_VPOPCNTDQ-features.patch [bz#1415830]
  - kvm-usb-ccid-check-ccid-apdu-length.patch [bz#1419818]
  - kvm-usb-ccid-better-bulk_out-error-handling.patch [bz#1419818]
  - kvm-usb-ccid-move-header-size-check.patch [bz#1419818]
  - kvm-usb-ccid-add-check-message-size-checks.patch [bz#1419818]
  - kvm-spec-Update-rdma-build-dependency.patch [bz#1433920]
  - Resolves: bz#1335751
    (CVE-2016-4020 qemu-kvm: Qemu: i386: leakage of stack memory to guest in kvmvapic.c [rhel-7.4])
  - Resolves: bz#1377977
    (qemu-kvm coredump in vnc_raw_send_framebuffer_update [rhel-7.4])
  - Resolves: bz#1415830
    ([Intel 7.4 FEAT] Enable vpopcntdq for KNM - qemu/kvm)
  - Resolves: bz#1419818
    (CVE-2017-5898 qemu-kvm: Qemu: usb: integer overflow in emulated_apdu_from_guest [rhel-7.4])
  - Resolves: bz#1427176
    (test cases of qemu-iotests failed)
  - Resolves: bz#1433920
    (Switch from librdmacm-devel to rdma-core-devel)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-135.el7
changelog:
  - kvm-fix-cirrus_vga-fix-OOB-read-case-qemu-Segmentation-f.patch [bz#1430060]
  - kvm-cirrus-vnc-zap-bitblit-support-from-console-code.patch [bz#1430060]
  - kvm-cirrus-add-option-to-disable-blitter.patch [bz#1430060]
  - kvm-cirrus-fix-cirrus_invalidate_region.patch [bz#1430060]
  - kvm-cirrus-stop-passing-around-dst-pointers-in-the-blitt.patch [bz#1430060]
  - kvm-cirrus-stop-passing-around-src-pointers-in-the-blitt.patch [bz#1430060]
  - kvm-cirrus-fix-off-by-one-in-cirrus_bitblt_rop_bkwd_tran.patch [bz#1430060]
  - Resolves: bz#1430060
    (CVE-2016-9603 qemu-kvm: Qemu: cirrus: heap buffer overflow via vnc connection [rhel-7.4])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-136.el7
changelog:
  - kvm-target-i386-get-set-migrate-XSAVES-state.patch [bz#1327593]
  - kvm-Removing-texi2html-from-build-requirements.patch [bz#1440987]
  - kvm-Disable-build-of-32bit-packages.patch [bz#1441778]
  - kvm-Add-sample-images-to-srpm.patch [bz#1436280]
  - Resolves: bz#1327593
    ([Intel 7.4 FEAT] KVM Enable the XSAVEC, XSAVES and XRSTORS instructions)
  - Resolves: bz#1436280
    (sample images  for qemu-iotests are missing in the SRPM)
  - Resolves: bz#1440987
    (Remove texi2html build dependancy from RPM)
  - Resolves: bz#1441778
    (Stop building qemu-img for 32bit architectures.)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-137.el7
changelog:
  - kvm-ide-fix-halted-IO-segfault-at-reset.patch [bz#1299875]
  - Resolves: bz#1299875
    (system_reset should clear pending request for error (IDE))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-138.el7
changelog:
  - kvm-char-serial-cosmetic-fixes.patch [bz#1451470]
  - kvm-char-serial-Use-generic-Fifo8.patch [bz#1451470]
  - kvm-char-serial-serial_ioport_write-Factor-out-common-co.patch [bz#1451470]
  - kvm-char-serial-fix-copy-paste-error-fifo8_is_full-vs-em.patch [bz#1451470]
  - kvm-char-serial-Fix-emptyness-check.patch [bz#1451470]
  - kvm-char-serial-Fix-emptyness-handling.patch [bz#1451470]
  - kvm-serial-poll-the-serial-console-with-G_IO_HUP.patch [bz#1451470]
  - kvm-serial-change-retry-logic-to-avoid-concurrency.patch [bz#1451470]
  - kvm-qemu-char-ignore-flow-control-if-a-PTY-s-slave-is-no.patch [bz#1451470]
  - kvm-serial-check-if-backed-by-a-physical-serial-port-at-.patch [bz#1451470]
  - kvm-serial-reset-thri_pending-on-IER-writes-with-THRI-0.patch [bz#1451470]
  - kvm-serial-clean-up-THRE-TEMT-handling.patch [bz#1451470]
  - kvm-serial-update-LSR-on-enabling-disabling-FIFOs.patch [bz#1451470]
  - kvm-serial-only-resample-THR-interrupt-on-rising-edge-of.patch [bz#1451470]
  - kvm-serial-make-tsr_retry-unsigned.patch [bz#1451470]
  - kvm-serial-simplify-tsr_retry-reset.patch [bz#1451470]
  - kvm-serial-separate-serial_xmit-and-serial_watch_cb.patch [bz#1451470]
  - kvm-serial-remove-watch-on-reset.patch [bz#1451470]
  - Resolves: bz#1451470
    (RHEL 7.2 based VM (Virtual Machine) hung for several hours apparently waiting for lock held by main_loop)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-139.el7
changelog:
  - kvm-char-change-qemu_chr_fe_add_watch-to-return-unsigned.patch [bz#1451470]
  - Resolves: bz#1451470
    (RHEL 7.2 based VM (Virtual Machine) hung for several hours apparently waiting for lock held by main_loop)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-140.el7
changelog:
  - kvm-spice-fix-spice_chr_add_watch-pre-condition.patch [bz#1456983]
  - Resolves: bz#1456983
    (Character device regression due to missing patch)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-141.el7
changelog:
  - kvm-Fix-memory-slot-page-alignment-logic-bug-1455745.patch [bz#1455745]
  - kvm-Do-not-hang-on-full-PTY.patch [bz#1452067]
  - kvm-serial-fixing-vmstate-for-save-restore.patch [bz#1452067]
  - kvm-serial-reinstate-watch-after-migration.patch [bz#1452067]
  - kvm-nbd-Fully-initialize-client-in-case-of-failed-negoti.patch [bz#1451614]
  - kvm-nbd-Fix-regression-on-resiliency-to-port-scan.patch [bz#1451614]
  - Resolves: bz#1451614
    (CVE-2017-9524 qemu-kvm: segment fault when private user nmap qemu-nbd server [rhel-7.4])
  - Resolves: bz#1452067
    (migration can confuse serial port user)
  - Resolves: bz#1455745
    (Backport fix for broken logic that's supposed to ensure memory slots are page aligned)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-141.el7_4.1
changelog:
  - kvm-qemu-nbd-Ignore-SIGPIPE.patch [bz#1468107]
  - Resolves: bz#1468107
    (CVE-2017-10664 qemu-kvm: Qemu: qemu-nbd: server breaks with SIGPIPE upon client abort [rhel-7.4.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-141.el7_4.2
changelog:
  - kvm-virtio-net-dynamic-network-offloads-configuration.patch [bz#1482468]
  - kvm-Workaround-rhel6-ctrl_guest_offloads-machine-type-mi.patch [bz#1482468]
  - Resolves: bz#1482468
    (KVM: windows guest migration from EL6 to EL7 fails. [rhel-7.4.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-141.el7_4.3
changelog:
  - kvm-bswap.h-Remove-cpu_to_32wu.patch [bz#1501294]
  - kvm-hw-use-ld_p-st_p-instead-of-ld_raw-st_raw.patch [bz#1501294]
  - kvm-vga-Start-cutting-out-non-32bpp-conversion-support.patch [bz#1501294]
  - kvm-vga-Remove-remainder-of-old-conversion-cruft.patch [bz#1501294]
  - kvm-vga-Separate-LE-and-BE-conversion-functions.patch [bz#1501294]
  - kvm-vga-Rename-vga_template.h-to-vga-helpers.h.patch [bz#1501294]
  - kvm-vga-stop-passing-pointers-to-vga_draw_line-functions.patch [bz#1501294]
  - kvm-vga-drop-line_offset-variable.patch [bz#1501294]
  - kvm-vga-Add-mechanism-to-force-the-use-of-a-shadow-surfa.patch [bz#1501294]
  - kvm-vga-handle-cirrus-vbe-mode-wraparounds.patch [bz#1501294]
  - kvm-cirrus-fix-oob-access-in-mode4and5-write-functions.patch [bz#1501294]
  - Resolves: bz#1501294
    (CVE-2017-15289 qemu-kvm: Qemu: cirrus: OOB access issue in  mode4and5 write functions [rhel-7.4.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-141.el7_4.4
changelog:
  - kvm-multiboot-validate-multiboot-header-address-values.patch [bz#1501120]
  - Resolves: bz#1501120
    (CVE-2017-14167 qemu-kvm: Qemu: i386: multiboot OOB access while loading kernel image [rhel-7.4.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-141.el7_4.5
changelog:
  - kvm-vfio-pci-Only-mmap-TARGET_PAGE_SIZE-regions.patch [bz#1515110]
  - Resolves: bz#1515110
    (Regression in QEMU handling for sub-page MMIO BARs for vfio-pci devices [rhel-7.4.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-147.el7
changelog:
  - kvm-vga-drop-line_offset-variable.patch [bz#1501295]
  - kvm-vga-Add-mechanism-to-force-the-use-of-a-shadow-surfa.patch [bz#1501295]
  - kvm-vga-handle-cirrus-vbe-mode-wraparounds.patch [bz#1501295]
  - kvm-cirrus-fix-oob-access-in-mode4and5-write-functions.patch [bz#1501295]
  - kvm-i6300esb-Fix-signed-integer-overflow.patch [bz#1470244]
  - kvm-i6300esb-fix-timer-overflow.patch [bz#1470244]
  - kvm-i6300esb-remove-muldiv64.patch [bz#1470244]
  - Resolves: bz#1470244
    (reboot leads to shutoff of qemu-kvm-vm if i6300esb-watchdog set to poweroff)
  - Resolves: bz#1501295
    (CVE-2017-15289 qemu-kvm: Qemu: cirrus: OOB access issue in  mode4and5 write functions [rhel-7.5])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-148.el7
changelog:
  - kvm-multiboot-validate-multiboot-header-address-values.patch [bz#1501121]
  - kvm-qemu-option-reject-empty-number-value.patch [bz#1417864]
  - Resolves: bz#1417864
    (Qemu-kvm starts with unspecified port)
  - Resolves: bz#1501121
    (CVE-2017-14167 qemu-kvm: Qemu: i386: multiboot OOB access while loading kernel image [rhel-7.5])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-149.el7
changelog:
  - kvm-block-linux-aio-fix-memory-and-fd-leak.patch [bz#1491434]
  - kvm-linux-aio-Fix-laio-resource-leak.patch [bz#1491434]
  - kvm-slirp-cleanup-leftovers-from-misc.h.patch [bz#1508745]
  - kvm-Avoid-embedding-struct-mbuf-in-other-structures.patch [bz#1508745]
  - kvm-slirp-Fix-access-to-freed-memory.patch [bz#1508745]
  - kvm-slirp-fix-clearing-ifq_so-from-pending-packets.patch [bz#1508745]
  - kvm-qcow2-Prevent-backing-file-names-longer-than-1023.patch [bz#1459714]
  - kvm-qemu-img-Use-strerror-for-generic-resize-error.patch [bz#1459725]
  - kvm-qcow2-Avoid-making-the-L1-table-too-big.patch [bz#1459725]
  - Resolves: bz#1459714
    (Throw error if qemu-img rebasing backing file is too long or provide way to fix a "too long" backing file.)
  - Resolves: bz#1459725
    (Prevent qemu-img resize from causing "Active L1 table too large")
  - Resolves: bz#1491434
    (KVM leaks file descriptors when attaching and detaching virtio-scsi block devices)
  - Resolves: bz#1508745
    (CVE-2017-13711 qemu-kvm: Qemu: Slirp: use-after-free when sending response [rhel-7.5])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-150.el7
changelog:
  - kvm-Build-only-x86_64-packages.patch [bz#1520793]
  - Resolves: bz#1520793
    (Do not build non-x86_64 subpackages)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-151.el7
changelog:
  - kvm-fw_cfg-remove-support-for-guest-side-data-writes.patch [bz#1411490]
  - kvm-fw_cfg-prevent-selector-key-conflict.patch [bz#1411490]
  - kvm-fw_cfg-prohibit-insertion-of-duplicate-fw_cfg-file-n.patch [bz#1411490]
  - kvm-fw_cfg-factor-out-initialization-of-FW_CFG_ID-rev.-n.patch [bz#1411490]
  - kvm-Implement-fw_cfg-DMA-interface.patch [bz#1411490]
  - kvm-fw_cfg-avoid-calculating-invalid-current-entry-point.patch [bz#1411490]
  - kvm-fw-cfg-support-writeable-blobs.patch [bz#1411490]
  - kvm-Enable-fw_cfg-DMA-interface-for-x86.patch [bz#1411490]
  - kvm-fw_cfg-unbreak-migration-compatibility.patch [bz#1411490]
  - kvm-i386-expose-fw_cfg-QEMU0002-in-SSDT.patch [bz#1411490]
  - kvm-fw_cfg-add-write-callback.patch [bz#1411490]
  - kvm-hw-misc-add-vmcoreinfo-device.patch [bz#1411490]
  - kvm-vmcoreinfo-put-it-in-the-misc-device-category.patch [bz#1411490]
  - kvm-fw_cfg-enable-DMA-if-device-vmcoreinfo.patch [bz#1411490]
  - kvm-build-sys-restrict-vmcoreinfo-to-fw_cfg-dma-capable-.patch [bz#1411490]
  - kvm-dump-Make-DumpState-and-endian-conversion-routines-a.patch [bz#1411490]
  - kvm-dump.c-Fix-memory-leak-issue-in-cleanup-processing-f.patch [bz#1411490]
  - kvm-dump-Propagate-errors-into-qmp_dump_guest_memory.patch [bz#1411490]
  - kvm-dump-Turn-some-functions-to-void-to-make-code-cleane.patch [bz#1411490]
  - kvm-dump-Fix-dump-guest-memory-termination-and-use-after.patch [bz#1411490]
  - kvm-dump-allow-target-to-set-the-page-size.patch [bz#1411490]
  - kvm-dump-allow-target-to-set-the-physical-base.patch [bz#1411490]
  - kvm-dump-guest-memory-cleanup-removing-dump_-error-clean.patch [bz#1411490]
  - kvm-dump-guest-memory-using-static-DumpState-add-DumpSta.patch [bz#1411490]
  - kvm-dump-guest-memory-add-dump_in_progress-helper-functi.patch [bz#1411490]
  - kvm-dump-guest-memory-introduce-dump_process-helper-func.patch [bz#1411490]
  - kvm-dump-guest-memory-disable-dump-when-in-INMIGRATE-sta.patch [bz#1411490]
  - kvm-DumpState-adding-total_size-and-written_size-fields.patch [bz#1411490]
  - kvm-dump-do-not-dump-non-existent-guest-memory.patch [bz#1411490]
  - kvm-dump-add-guest-ELF-note.patch [bz#1411490]
  - kvm-dump-update-phys_base-header-field-based-on-VMCOREIN.patch [bz#1411490]
  - kvm-kdump-set-vmcoreinfo-location.patch [bz#1411490]
  - kvm-scripts-dump-guest-memory.py-Move-constants-to-the-t.patch [bz#1411490]
  - kvm-scripts-dump-guest-memory.py-Make-methods-functions.patch [bz#1411490]
  - kvm-scripts-dump-guest-memory.py-Improve-python-3-compat.patch [bz#1411490]
  - kvm-scripts-dump-guest-memory.py-Cleanup-functions.patch [bz#1411490]
  - kvm-scripts-dump-guest-memory.py-Introduce-multi-arch-su.patch [bz#1411490]
  - kvm-Fix-typo-in-variable-name-found-and-fixed-by-codespe.patch [bz#1411490]
  - kvm-scripts-dump-guest-memory.py-add-vmcoreinfo.patch [bz#1411490]
  - kvm-dump-guest-memory.py-fix-No-symbol-vmcoreinfo_find.patch [bz#1411490]
  - kvm-dump-guest-memory.py-fix-You-can-t-do-that-without-a.patch [bz#1411490]
  - Resolves: bz#1411490
    ([RFE] Kernel address space layout randomization [KASLR] support (qemu-kvm))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-152.el7
changelog:
  - kvm-target-i386-cpu-add-new-CPUID-bits-for-indirect-bran.patch [CVE-2017-5715]
  - kvm-target-i386-add-support-for-SPEC_CTRL-MSR.patch [CVE-2017-5715]
  - kvm-target-i386-cpu-add-new-CPU-models-for-indirect-bran.patch [CVE-2017-5715]


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-153.el7
changelog:
  - kvm-i386-update-ssdt-misc.hex.generated.patch [bz#1411490]
  - kvm-main-loop-Acquire-main_context-lock-around-os_host_m.patch [bz#1435432 bz#1473536]
  - Resolves: bz#1411490
    ([RFE] Kernel address space layout randomization [KASLR] support (qemu-kvm))
  - Resolves: bz#1435432
    (Emulated ISA serial port hangs randomly when sending lots of data from guest -> host)
  - Resolves: bz#1473536
    (Hangs in serial console under qemu)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-154.el7
changelog:
  - kvm-virtio-net-validate-backend-queue-numbers-against-bu.patch [bz#1460872]
  - kvm-dump-guest-memory.py-fix-python-2-support.patch [bz#1411490]
  - kvm-qxl-add-migration-blocker-to-avoid-pre-save-assert.patch [bz#1536883]
  - Resolves: bz#1411490
    ([RFE] Kernel address space layout randomization [KASLR] support (qemu-kvm))
  - Resolves: bz#1460872
    (Aborted(core dumped) when booting guest with "-netdev tap....vhost=on,queues=32")
  - Resolves: bz#1536883
    ([abrt] [faf] qemu-kvm: unknown function(): /usr/libexec/qemu-kvm killed by 6)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-155.el7
changelog:
  - kvm-qdev-Fix-assert-in-PCI-address-property-when-used-by.patch [bz#1538866]
  - kvm-vga-check-the-validation-of-memory-addr-when-draw-te.patch [bz#1534691]
  - kvm-savevm-Improve-error-message-for-blocked-migration.patch [bz#1536883]
  - kvm-savevm-fail-if-migration-blockers-are-present.patch [bz#1536883]
  - Resolves: bz#1534691
    (CVE-2018-5683 qemu-kvm: Qemu: Out-of-bounds read in vga_draw_text routine [rhel-7.5])
  - Resolves: bz#1536883
    ([abrt] [faf] qemu-kvm: unknown function(): /usr/libexec/qemu-kvm killed by 6)
  - Resolves: bz#1538866
    (qemu will coredump after executing info qtree)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-156.el7
changelog:
  - kvm-vnc-Fix-qemu-crashed-when-vnc-client-disconnect-sudd.patch [bz#1527405]
  - kvm-fix-full-frame-updates-for-VNC-clients.patch [bz#1527405]
  - kvm-vnc-update-fix.patch [bz#1527405]
  - kvm-vnc-return-directly-if-no-vnc-client-connected.patch [bz#1527405]
  - kvm-buffer-add-buffer_move_empty.patch [bz#1527405]
  - kvm-buffer-add-buffer_move.patch [bz#1527405]
  - kvm-vnc-kill-jobs-queue-buffer.patch [bz#1527405]
  - kvm-vnc-jobs-move-buffer-reset-use-new-buffer-move.patch [bz#1527405]
  - kvm-vnc-zap-dead-code.patch [bz#1527405]
  - kvm-vnc-add-vnc_width-vnc_height-helpers.patch [bz#1527405]
  - kvm-vnc-factor-out-vnc_update_server_surface.patch [bz#1527405]
  - kvm-vnc-use-vnc_-width-height-in-vnc_set_area_dirty.patch [bz#1527405]
  - kvm-vnc-only-alloc-server-surface-with-clients-connected.patch [bz#1527405]
  - kvm-ui-fix-refresh-of-VNC-server-surface.patch [bz#1527405]
  - kvm-ui-move-disconnecting-check-to-start-of-vnc_update_c.patch [bz#1527405]
  - kvm-ui-remove-redundant-indentation-in-vnc_client_update.patch [bz#1527405]
  - kvm-ui-avoid-pointless-VNC-updates-if-framebuffer-isn-t-.patch [bz#1527405]
  - kvm-ui-track-how-much-decoded-data-we-consumed-when-doin.patch [bz#1527405]
  - kvm-ui-introduce-enum-to-track-VNC-client-framebuffer-up.patch [bz#1527405]
  - kvm-ui-correctly-reset-framebuffer-update-state-after-pr.patch [bz#1527405]
  - kvm-ui-refactor-code-for-determining-if-an-update-should.patch [bz#1527405]
  - kvm-ui-fix-VNC-client-throttling-when-audio-capture-is-a.patch [bz#1527405]
  - kvm-ui-fix-VNC-client-throttling-when-forced-update-is-r.patch [bz#1527405]
  - kvm-ui-place-a-hard-cap-on-VNC-server-output-buffer-size.patch [bz#1527405]
  - kvm-ui-avoid-sign-extension-using-client-width-height.patch [bz#1527405]
  - kvm-ui-correctly-advance-output-buffer-when-writing-SASL.patch [bz#1527405]
  - kvm-io-skip-updates-to-client-if-websocket-output-buffer.patch [bz#1518711]
  - Resolves: bz#1518711
    (CVE-2017-15268 qemu-kvm: Qemu: I/O: potential memory exhaustion via websock connection to VNC [rhel-7.5])
  - Resolves: bz#1527405
    (CVE-2017-15124 qemu-kvm: Qemu: memory exhaustion through framebuffer update request message in VNC server [rhel-7.5])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-156.el7_5.1
changelog:
  - kvm-vga-add-ram_addr_t-cast.patch [bz#1567913]
  - kvm-vga-fix-region-calculation.patch [bz#1567913]
  - Resolves: bz#1567913
    (CVE-2018-7858 qemu-kvm: Qemu: cirrus: OOB access when updating vga display [rhel-7] [rhel-7.5.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-156.el7_5.2
changelog:
  - kvm-i386-define-the-ssbd-CPUID-feature-bit-CVE-2018-3639.patch [bz#1574075]
  - Resolves: bz#1574075
    (EMBARGOED CVE-2018-3639 qemu-kvm: Kernel: omega-4 [rhel-7.5.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-156.el7_5.3
changelog:
  - kvm-i386-Define-the-Virt-SSBD-MSR-and-handling-of-it-CVE.patch [bz#1584363]
  - kvm-i386-define-the-AMD-virt-ssbd-CPUID-feature-bit-CVE-.patch [bz#1584363]
  - Resolves: bz#1584363
    (CVE-2018-3639 qemu-kvm: hw: cpu: AMD: speculative store bypass [rhel-7.5.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-156.el7_5.4
changelog:
  - kvm-target-i386-introduce-kvm_put_one_msr.patch [bz#1596302]
  - kvm-apic-fix-2.2-2.1-migration.patch [bz#1596302]
  - kvm-x86-lapic-Load-LAPIC-state-at-post_load.patch [bz#1596302]
  - kvm-apic-drop-debugging.patch [bz#1596302]
  - kvm-apic-set-APIC-base-as-part-of-kvm_apic_put.patch [bz#1596302]
  - Resolves: bz#1596302
    (Windows 2012 Guest hangs after live migration with RTC clock stopped. [rhel-7.5.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-156.el7_5.5
changelog:
  - kvm-multiboot-bss_end_addr-can-be-zero.patch [bz#1549824]
  - kvm-multiboot-Remove-unused-variables-from-multiboot.c.patch [bz#1549824]
  - kvm-multiboot-Use-header-names-when-displaying-fields.patch [bz#1549824]
  - kvm-multiboot-fprintf-stderr.-error_report.patch [bz#1549824]
  - kvm-multiboot-Reject-kernels-exceeding-the-address-space.patch [bz#1549824]
  - kvm-multiboot-Check-validity-of-mh_header_addr.patch [bz#1549824]
  - kvm-slirp-remove-mbuf-m_hdr-m_dat-indirection.patch [bz#1586248]
  - kvm-slirp-correct-size-computation-while-concatenating-m.patch [bz#1586248]
  - Resolves: bz#1549824
    (CVE-2018-7550 qemu-kvm: Qemu: i386:  multiboot OOB access while loading kernel image [rhel-7.5.z])
  - Resolves: bz#1586248
    (CVE-2018-11806 qemu-kvm: QEMU: slirp: heap buffer overflow while reassembling fragmented datagrams [rhel-7.5.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-157.el7
changelog:
  - kvm-vga-add-ram_addr_t-cast.patch [bz#1553670]
  - kvm-vga-fix-region-calculation.patch [bz#1553670]
  - kvm-i386-define-the-ssbd-CPUID-feature-bit-CVE-2018-3639.patch [bz#1574082]
  - kvm-target-i386-introduce-kvm_put_one_msr.patch [bz#1577680]
  - kvm-apic-fix-2.2-2.1-migration.patch [bz#1577680]
  - kvm-x86-lapic-Load-LAPIC-state-at-post_load.patch [bz#1577680]
  - kvm-apic-drop-debugging.patch [bz#1577680]
  - kvm-apic-set-APIC-base-as-part-of-kvm_apic_put.patch [bz#1577680]
  - kvm-spec-Change-License-line.patch [bz#1549108]
  - kvm-spec-Use-hardening-flags-for-ksmctl-build.patch [bz#1558895]
  - Resolves: bz#1549108
    (Incorrect License information in RPM specfile)
  - Resolves: bz#1553670
    (CVE-2018-7858 qemu-kvm: Qemu: cirrus: OOB access when updating vga display [rhel-7])
  - Resolves: bz#1558895
    (ksmctl is built without any hardening flags set [rhel-7.6])
  - Resolves: bz#1574082
    (CVE-2018-3639 qemu-kvm: hw: cpu: speculative store bypass [rhel-7.6])
  - Resolves: bz#1577680
    (Windows 2012 Guest hangs after live migration with RTC clock stopped.)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-158.el7
changelog:
  - kvm-x86-cpu-Enable-new-SSE-AVX-AVX512-cpu-features.patch [bz#1513686]
  - kvm-target-i386-Add-support-for-UMIP-and-RDPID-CPUID-bit.patch [bz#1526638]
  - kvm-i386-Define-the-Virt-SSBD-MSR-and-handling-of-it-CVE.patch [bz#1584583]
  - kvm-i386-define-the-AMD-virt-ssbd-CPUID-feature-bit-CVE-.patch [bz#1584583]
  - kvm-qcow2-Repair-OFLAG_COPIED-when-fixing-leaks.patch [bz#1527122]
  - kvm-iotests-Repairing-error-during-snapshot-deletion.patch [bz#1527122]
  - kvm-headers-add-drm_fourcc.h.patch [bz#1555246]
  - kvm-spice-fix-simple-display-on-bigendian-hosts.patch [bz#1555246]
  - kvm-ui-pixman-add-qemu_drm_format_to_pixman.patch [bz#1555246]
  - kvm-console-nicer-initial-screen.patch [bz#1555246]
  - kvm-console-minimal-hotplug-suport.patch [bz#1555246]
  - kvm-vfio-common-cleanup-in-vfio_region_finalize.patch [bz#1555246]
  - kvm-linux-headers-Update-to-include-region-based-display.patch [bz#1555246]
  - kvm-qdev-New-DEFINE_PROP_ON_OFF_AUTO.patch [bz#1555246]
  - kvm-vfio-display-core-wireup.patch [bz#1555246]
  - kvm-vfio-display-adding-region-support.patch [bz#1555246]
  - kvm-vfio-pci-Default-display-option-to-off.patch [bz#1555246]
  - Resolves: bz#1513686
    ([Intel 7.6 Feat] qemu-kvm Enabling Icelake new NIs)
  - Resolves: bz#1526638
    ([Intel 7.6 FEAT] KVM User Mode Instruction Prevention (UMIP) - qemu-kvm)
  - Resolves: bz#1527122
    (The copied flag should be updated during  '-r leaks')
  - Resolves: bz#1555246
    ([RFE] Support console VNC on Nvidia vGPU - qemu)
  - Resolves: bz#1584583
    (CVE-2018-3639 qemu-kvm: hw: cpu: speculative store bypass [rhel-7.6])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-159.el7
changelog:
  - kvm-multiboot-bss_end_addr-can-be-zero.patch [bz#1549822]
  - kvm-multiboot-Remove-unused-variables-from-multiboot.c.patch [bz#1549822]
  - kvm-multiboot-Use-header-names-when-displaying-fields.patch [bz#1549822]
  - kvm-multiboot-fprintf-stderr.-error_report.patch [bz#1549822]
  - kvm-multiboot-Reject-kernels-exceeding-the-address-space.patch [bz#1549822]
  - kvm-multiboot-Check-validity-of-mh_header_addr.patch [bz#1549822]
  - kvm-slirp-remove-mbuf-m_hdr-m_dat-indirection.patch [bz#1586253]
  - kvm-slirp-correct-size-computation-while-concatenating-m.patch [bz#1586253]
  - Resolves: bz#1549822
    (CVE-2018-7550 qemu-kvm: Qemu: i386:  multiboot OOB access while loading kernel image [rhel-7.6])
  - Resolves: bz#1586253
    (CVE-2018-11806 qemu-kvm: QEMU: slirp: heap buffer overflow while reassembling fragmented datagrams [rhel-7.6])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-160.el7
changelog:
  - kvm-scsi-disk-support-reporting-of-rotation-rate.patch [bz#1583807]
  - kvm-ide-support-reporting-of-rotation-rate.patch [bz#1583807]
  - kvm-ide-avoid-referencing-NULL-dev-in-rotational-rate-se.patch [bz#1583807]
  - kvm-slirp-Correct-size-check-in-m_inc.patch [bz#1586253]
  - Resolves: bz#1583807
    ([DELL EMC 7.6 FEAT] option to mark virtual block device as rotational/non-rotational)
  - Resolves: bz#1586253
    (CVE-2018-11806 qemu-kvm: QEMU: slirp: heap buffer overflow while reassembling fragmented datagrams [rhel-7.6])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-160.el7_6.1
changelog:
  - kvm-i386-Deprecate-arch-facilities-and-make-it-block-liv.patch [bz#1664792]
  - Resolves: bz#1664792
    (mode="host-model" VMs include broken "arch-facilities" flag name [qemu-kvm] [rhel-7.6.z])


author: Danilo C. L. de Paula <ddepaula@redhat.com> - 1.5.3-160.el7_6.2
changelog:
  - kvm-target-i386-define-md-clear-bit-rhel.patch
  - Resolves: bz#1693216
    (qemu-kvm: hardware: Microarchitectural Store Buffer Data Sampling)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-160.el7_6.3
changelog:
  - kvm-slirp-check-sscanf-result-when-emulating-ident.patch [bz#1669067]
  - kvm-slirp-fix-big-little-endian-conversion-in-ident-prot.patch [bz#1669067]
  - kvm-slirp-ensure-there-is-enough-space-in-mbuf-to-null-t.patch [bz#1669067]
  - kvm-slirp-don-t-manipulate-so_rcv-in-tcp_emu.patch [bz#1669067]
  - Resolves: bz#1669067
    (CVE-2019-6778 qemu-kvm: QEMU: slirp: heap buffer overflow in tcp_emu() [rhel-7.6.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-161.el7
changelog:
  - kvm-Inhibit-ballooning-during-postcopy.patch [bz#1659229]
  - kvm-balloon-Allow-multiple-inhibit-users.patch [bz#1659229]
  - kvm-check-KVM_CAP_SYNC_MMU-with-kvm_vm_check_extensi.patch [bz#1659229]
  - kvm-Use-inhibit-to-prevent-ballooning-without-synchr.patch [bz#1659229]
  - kvm-vfio-Inhibit-ballooning-based-on-group-attachment-to.patch [bz#1659229]
  - Resolves: bz#1659229
    (Ballooning is incompatible with vfio assigned devices, but not prevented)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-162.el7
changelog:
  - kvm-i386-Deprecate-arch-facilities-and-make-it-block-liv.patch [bz#1658407]
  - kvm-Do-not-build-bluetooth-support.patch [bz#1654627]
  - Resolves: bz#1654627
    (Qemu: hw: bt: keep bt/* objects from building [rhel-7.7])
  - Resolves: bz#1658407
    (mode="host-model" VMs include broken "arch-facilities" flag name [qemu-kvm])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-163.el7
changelog:
  - kvm-x86-cpu-Enable-CLDEMOTE-Demote-Cache-Line-cpu-featur.patch [bz#1537773]
  - kvm-vfio-pci-Lazy-PBA-emulation.patch [bz#1459077]
  - kvm-slirp-check-sscanf-result-when-emulating-ident.patch [bz#1689791]
  - Resolves: bz#1459077
    ([Intel 7.7 Bug] QEMU version in RHEL7.4 beta does not support KVM passthrough with WFR card)
  - Resolves: bz#1537773
    ([Intel 7.7 Feat] KVM Enabling SnowRidge new NIs - qemu-kvm)
  - Resolves: bz#1689791
    (CVE-2019-9824 qemu-kvm: QEMU: Slirp: information leakage in tcp_emu() due to uninitialized stack variables [rhel-7])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-164.el7
changelog:
  - kvm-target-i386-define-md-clear-bit-rhel.patch [bz#1693217]
  - Resolves: bz#1693217
    (CVE-2018-12126 qemu-kvm: hardware: Microarchitectural Store Buffer Data Sampling [rhel-7.7] )


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-165.el7
changelog:
  - kvm-Fix-eax-for-cpuid-leaf-0x40000000.patch [bz#1709495]
  - kvm-slirp-fix-big-little-endian-conversion-in-ident-prot.patch [bz#1669068]
  - kvm-slirp-ensure-there-is-enough-space-in-mbuf-to-null-t.patch [bz#1669068]
  - kvm-slirp-don-t-manipulate-so_rcv-in-tcp_emu.patch [bz#1669068]
  - Resolves: bz#1669068
    (CVE-2019-6778 qemu-kvm: QEMU: slirp: heap buffer overflow in tcp_emu() [rhel-7.7])
  - Resolves: bz#1709495
    (Change CPUID[0x40000000].EAX from 0 to KVM_CPUID_FE...ATURES (0x40000001))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-166.el7
changelog:
  - kvm-seccomp-set-the-seccomp-filter-to-all-threads.patch [bz#1618503]
  - Resolves: bz#1618503
    (qemu-kvm: Qemu: seccomp: blacklist is not applied to all threads [rhel-7])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-167.el7
changelog:
  - Reverting kvm-seccomp-set-the-seccomp-filter-to-all-threads.patch [bz#1618503]
  - Resolves: bz#1618503
    (qemu-kvm: Qemu: seccomp: blacklist is not applied to all threads [rhel-7])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-167.el7_7.1
changelog:
  - kvm-qxl-check-release-info-object.patch [bz#1732337]
  - kvm-Fix-heap-overflow-in-ip_reass-on-big-packet-input.patch [bz#1734748]
  - Resolves: bz#1732337
    (CVE-2019-12155 qemu-kvm: QEMU: qxl: null pointer dereference while releasing spice resources [rhel-7] [rhel-7.7.z])
  - Resolves: bz#1734748
    (CVE-2019-14378 qemu-kvm: QEMU: slirp: heap buffer overflow during packet reassembly [rhel-7.7.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-167.el7_7.2
changelog:
  - kvm-target-i386-Merge-feature-filtering-checking-functio.patch [bz#1730606]
  - kvm-target-i386-Isolate-KVM-specific-code-on-CPU-feature.patch [bz#1730606]
  - kvm-i386-Add-new-MSR-indices-for-IA32_PRED_CMD-and-IA32_.patch [bz#1730606]
  - kvm-i386-Add-CPUID-bit-and-feature-words-for-IA32_ARCH_C.patch [bz#1730606]
  - kvm-Add-support-to-KVM_GET_MSR_FEATURE_INDEX_LIST-an.patch [bz#1730606]
  - kvm-x86-Data-structure-changes-to-support-MSR-based-feat.patch [bz#1730606]
  - kvm-x86-define-a-new-MSR-based-feature-word-FEATURE_WORD.patch [bz#1730606]
  - kvm-Use-KVM_GET_MSR_INDEX_LIST-for-MSR_IA32_ARCH_CAP.patch [bz#1730606]
  - kvm-i386-kvm-Disable-arch_capabilities-if-MSR-can-t-be-s.patch [bz#1730606]
  - kvm-Remove-arch-capabilities-deprecation.patch [bz#1730606]
  - Resolves: bz#1730606
    ([Intel 7.8 Bug] [KVM][CLX] CPUID_7_0_EDX_ARCH_CAPABILITIES is not enabled in VM qemu-kvm [rhel-7.7.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-167.el7_7.3
changelog:
  - kvm-target-i386-Export-TAA_NO-bit-to-guests.patch [bz#1771960]
  - kvm-target-i386-add-support-for-MSR_IA32_TSX_CTRL.patch [bz#1771960]
  - Resolves: bz#1771960
    (CVE-2019-11135 qemu-kvm: hw: TSX Transaction Asynchronous Abort (TAA) [rhel-7.7.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-167.el7_7.4
changelog:
  - kvm-target-i386-add-MDS-NO-feature.patch [bz#1755333]
  - Resolves: bz#1755333
    ([Intel 7.8 FEAT] MDS_NO exposure to guest - qemu-kvm [rhel-7.7.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-168.el7
changelog:
  - kvm-qxl-check-release-info-object.patch [bz#1712703]
  - kvm-bswap.h-Remove-cpu_to_be16wu.patch [bz#1270166]
  - kvm-net-Transmit-zero-UDP-checksum-as-0xFFFF.patch [bz#1270166]
  - kvm-Fix-heap-overflow-in-ip_reass-on-big-packet-input.patch [bz#1734749]
  - Resolves: bz#1270166
    (UDP packet checksum is not converted from 0x0000 to 0xffff with Qemu e1000 emulation.)
  - Resolves: bz#1712703
    (CVE-2019-12155 qemu-kvm: QEMU: qxl: null pointer dereference while releasing spice resources [rhel-7])
  - Resolves: bz#1734749
    (CVE-2019-14378 qemu-kvm: QEMU: slirp: heap buffer overflow during packet reassembly [rhel-7.8])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-169.el7
changelog:
  - kvm-target-i386-Support-invariant-tsc-flag.patch [bz#1626871]
  - kvm-target-i386-block-migration-and-savevm-if-invariant-.patch [bz#1626871]
  - kvm-i386-Don-t-copy-host-virtual-address-limit.patch [bz#1706658]
  - Resolves: bz#1626871
    ([RFE] request for using TscInvariant feature with qemu-kvm.)
  - Resolves: bz#1706658
    ([Intel 7.8 Bug] qemu-kvm fail with "err:kvm_init_vcpu() invalidate argumant" on ICX platform)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-170.el7
changelog:
  - kvm-Using-ip_deq-after-m_free-might-read-pointers-from-a.patch [bz#1749735]
  - kvm-target-i386-Merge-feature-filtering-checking-functio.patch [bz#1709971]
  - kvm-target-i386-Isolate-KVM-specific-code-on-CPU-feature.patch [bz#1709971]
  - kvm-i386-Add-new-MSR-indices-for-IA32_PRED_CMD-and-IA32_.patch [bz#1709971]
  - kvm-i386-Add-CPUID-bit-and-feature-words-for-IA32_ARCH_C.patch [bz#1709971]
  - kvm-Add-support-to-KVM_GET_MSR_FEATURE_INDEX_LIST-an.patch [bz#1709971]
  - kvm-x86-Data-structure-changes-to-support-MSR-based-feat.patch [bz#1709971]
  - kvm-x86-define-a-new-MSR-based-feature-word-FEATURE_WORD.patch [bz#1709971]
  - kvm-Use-KVM_GET_MSR_INDEX_LIST-for-MSR_IA32_ARCH_CAP.patch [bz#1709971]
  - kvm-i386-kvm-Disable-arch_capabilities-if-MSR-can-t-be-s.patch [bz#1709971]
  - kvm-Remove-arch-capabilities-deprecation.patch [bz#1709971]
  - kvm-target-i386-add-MDS-NO-feature.patch [bz#1714791]
  - Resolves: bz#1709971
    ([Intel 7.8 Bug] [KVM][CLX] CPUID_7_0_EDX_ARCH_CAPABILITIES is not enabled in VM qemu-kvm)
  - Resolves: bz#1714791
    ([Intel 7.8 FEAT] MDS_NO exposure to guest - qemu-kvm)
  - Resolves: bz#1749735
    (CVE-2019-15890 qemu-kvm: QEMU: Slirp: use-after-free during packet reassembly [rhel-7])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-171.el7
changelog:
  - kvm-i386-Add-new-model-of-Cascadelake-Server.patch [bz#1638471]
  - kvm-i386-Disable-OSPKE-on-Cascadelake-Server.patch [bz#1638471]
  - kvm-i386-remove-the-INTEL_PT-CPUID-bit-from-Cascadelake-.patch [bz#1638471]
  - kvm-Add-missing-brackets-to-CPUID-0x80000008-code.patch [bz#1760607]
  - Resolves: bz#1638471
    ([Intel 7.8 Feat] qemu-kvm Introduce Cascade Lake (CLX) cpu model)
  - Resolves: bz#1760607
    (Corrupted EAX values due to missing brackets at CPUID[0x800000008] code)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-172.el7
changelog:
  - kvm-target-i386-Export-TAA_NO-bit-to-guests.patch [bz#1771961]
  - kvm-target-i386-add-support-for-MSR_IA32_TSX_CTRL.patch [bz#1771961]
  - Resolves: bz#1771961
    (CVE-2019-11135 qemu-kvm: hw: TSX Transaction Asynchronous Abort (TAA) [rhel-7.8])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-173.el7
changelog:
  - kvm-tcp_emu-Fix-oob-access.patch [bz#1791560]
  - kvm-slirp-use-correct-size-while-emulating-IRC-commands.patch [bz#1791560]
  - kvm-slirp-use-correct-size-while-emulating-commands.patch [bz#1791560]
  - Resolves: bz#1791560
    (CVE-2020-7039 qemu-kvm: QEMU: slirp: OOB buffer access while emulating tcp protocols in tcp_emu() [rhel-7.8])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-173.el7_8.1
changelog:
  - kvm-util-add-slirp_fmt-helpers.patch [bz#1798970]
  - kvm-tcp_emu-fix-unsafe-snprintf-usages.patch [bz#1798970]
  - Resolves: bz#1798970
    (CVE-2020-8608 qemu-kvm: QEMU: Slirp: potential OOB access due to unsafe snprintf() usages [rhel-7.8.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-173.el7_8.3
changelog:
  - kvm-gluster-Handle-changed-glfs_ftruncate-signature.patch [bz#1822235]
  - kvm-gluster-the-glfs_io_cbk-callback-function-pointer-ad.patch [bz#1822235]
  - Resolves: bz#1822235
    (Add support for newer glusterfs [rhel-7.8.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-174.el7
changelog:
  - kvm-util-add-slirp_fmt-helpers2.patch [bz#1800515]
  - kvm-tcp_emu-fix-unsafe-snprintf-usages2.patch [bz#1800515]
  - kvm-slirp-disable-tcp_emu.patch [bz#1791679]
  - kvm-gluster-Handle-changed-glfs_ftruncate-signature.patch [bz#1802215]
  - kvm-gluster-the-glfs_io_cbk-callback-function-pointer-ad.patch [bz#1802215]
  - kvm-seccomp-set-the-seccomp-filter-to-all-threads.patch [bz#1618503]
  - Resolves: bz#1618503
    (qemu-kvm: Qemu: seccomp: blacklist is not applied to all threads [rhel-7])
  - Resolves: bz#1791679
    (QEMU: Slirp: disable emulation of tcp programs like ftp IRC etc. [rhel-7])
  - Resolves: bz#1800515
    (CVE-2020-8608 qemu-kvm: QEMU: Slirp: potential OOB access due to unsafe snprintf() usages [rhel-7.9])
  - Resolves: bz#1802215
    (Add support for newer glusterfs)


author: Jon Maloy <jmaloy@redhat.com> - 1.5.3-175.el7
changelog:
  - kvm-vnc-fix-memory-leak-when-vnc-disconnect.patch [bz#1810408]
  - Resolves: bz#1810408
    (CVE-2019-20382 qemu-kvm: QEMU: vnc: memory leakage upon disconnect [rhel-7])


author: Jon Maloy <jmaloy@redhat.com> - 1.5.3-175.el7
changelog:
  - kvm-Fix-use-afte-free-in-ip_reass-CVE-2020-1983.patch [bz#1837565]
  - kvm-usb-check-RNDIS-message-length.patch [bz#1869693]
  - kvm-usb-fix-setup_len-init-CVE-2020-14364.patch [bz#1869693]
  - Resolves: bz#1837565
    (CVE-2020-1983 qemu-kvm: QEMU: slirp: use-after-free in ip_reass() function in ip_input.c [rhel-7])
  - Resolves: bz#1869693
    (CVE-2020-14364 qemu-kvm: QEMU: usb: out-of-bounds r/w access issue while processing usb packets [rhel-7.9.z])


author: Jon Maloy <jmaloy@redhat.com> - 1.5.3-175.el7_9.2
changelog:
  - kvm-hw-net-vmxnet_tx_pkt-fix-assertion-failure-in-vmxnet.patch [bz#1860960]
  - kvm-hw-core-loader-Fix-possible-crash-in-rom_copy.patch [bz#1842923]
  - Resolves: bz#1842923
    (CVE-2020-13765 qemu-kvm: QEMU: loader: OOB access while loading registered ROM may lead to code execution [rhel-7.9.z])
  - Resolves: bz#1860960
    (CVE-2020-16092 qemu-kvm: QEMU: reachable assertion failure in net_tx_pkt_add_raw_fragment() in hw/net/net_tx_pkt.c [rhel-7.9.z])


author: Jon Maloy <jmaloy@redhat.com> - 1.5.3-175.el7_9.3
changelog:
  - kvm-Suppress-prototype-warning-for-nss-headers.patch [bz#1884997]
  - Resolves: bz#1884997
    (qemu-kvm FTBFS on rhel7.9)


author: Jon Maloy <jmaloy@redhat.com> - 1.5.3-175.el7_9.4
changelog:
  - kvm-ide-atapi-check-logical-block-address-and-read-size-.patch [bz#1917449]
  - Resolves: bz#1917449
    (CVE-2020-29443 qemu-kvm: QEMU: ide: atapi: OOB access while processing read commands [rhel-7.9.z])


author: Jon Maloy <jmaloy@redhat.com> - 1.5.3-175.el7_9.5
changelog:
  - kvm-dma-helpers-Initialize-DMAAIOCB-in_cancel-flag.patch [bz#2007036]
  - Resolves: bz#2007036
    (Memory leak when using dma_read/write with virtio-scsi)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-51.el7
changelog:
  - kvm-qmp-access-the-local-QemuOptsLists-for-drive-option.patch [bz#1026184]
  - kvm-qxl-add-sanity-check.patch [bz#751937]
  - kvm-Fix-two-XBZRLE-corruption-issues.patch [bz#1063417]
  - kvm-qdev-monitor-set-DeviceState-opts-before-calling-rea.patch [bz#1037956]
  - kvm-vfio-blacklist-loading-of-unstable-roms.patch [bz#1037956]
  - kvm-block-Set-block-filename-sizes-to-PATH_MAX-instead-o.patch [bz#1072339]
  - Resolves: bz#1026184
    (QMP: querying -drive option returns a NULL parameter list)
  - Resolves: bz#1037956
    (bnx2x: boot one guest to do vfio-pci with all PFs assigned in same group meet QEMU segmentation fault (Broadcom BCM57810 card))
  - Resolves: bz#1063417
    (google stressapptest vs Migration)
  - Resolves: bz#1072339
    (RHEV: Cannot start VMs that have more than 23 snapshots.)
  - Resolves: bz#751937
    (qxl triggers assert during iofuzz test)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-52.el7
changelog:
  - kvm-target-i386-Move-hyperv_-static-globals-to-X86CPU.patch [bz#1004773]
  - kvm-Fix-uninitialized-cpuid_data.patch [bz#1057173]
  - kvm-fix-coexistence-of-KVM-and-Hyper-V-leaves.patch [bz#1004773]
  - kvm-make-availability-of-Hyper-V-enlightenments-depe.patch [bz#1004773]
  - kvm-make-hyperv-hypercall-and-guest-os-id-MSRs-migra.patch [bz#1004773]
  - kvm-make-hyperv-vapic-assist-page-migratable.patch [bz#1004773]
  - kvm-target-i386-Convert-hv_relaxed-to-static-property.patch [bz#1057173]
  - kvm-target-i386-Convert-hv_vapic-to-static-property.patch [bz#1057173]
  - kvm-target-i386-Convert-hv_spinlocks-to-static-property.patch [bz#1057173]
  - kvm-target-i386-Convert-check-and-enforce-to-static-prop.patch [bz#1004773]
  - kvm-target-i386-Cleanup-foo-feature-handling.patch [bz#1057173]
  - kvm-add-support-for-hyper-v-timers.patch [bz#1057173]
  - Resolves: bz#1004773
    (Hyper-V guest OS id and hypercall MSRs not migrated)
  - Resolves: bz#1057173
    (KVM Hyper-V Enlightenment - New feature - hv-time (QEMU))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-53.el7
changelog:
  - kvm-dataplane-Fix-startup-race.patch [bz#1069541]
  - kvm-QMP-Relax-__com.redhat_drive_add-parameter-checking.patch [bz#1057471]
  - kvm-all-exit-in-case-max-vcpus-exceeded.patch [bz#993429]
  - kvm-block-gluster-code-movements-state-storage-changes.patch [bz#1031526]
  - kvm-block-gluster-add-reopen-support.patch [bz#1031526]
  - kvm-virtio-net-add-feature-bit-for-any-header-s-g.patch [bz#990989]
  - kvm-spec-Add-README.rhel6-gpxe-source.patch [bz#1073774]
  - kvm-pc-Add-RHEL6-e1000-gPXE-image.patch [bz#1073774]
  - kvm-loader-rename-in_ram-has_mr.patch [bz#1064018]
  - kvm-pc-avoid-duplicate-names-for-ROM-MRs.patch [bz#1064018]
  - kvm-qemu-img-convert-Fix-progress-output.patch [bz#1073728]
  - kvm-qemu-iotests-Test-progress-output-for-conversion.patch [bz#1073728]
  - kvm-iscsi-Use-bs-sg-for-everything-else-than-disks.patch [bz#1067784]
  - kvm-block-Fix-bs-request_alignment-assertion-for-bs-sg-1.patch [bz#1067784]
  - kvm-qemu_file-use-fwrite-correctly.patch [bz#1005103]
  - kvm-qemu_file-Fix-mismerge-of-use-fwrite-correctly.patch [bz#1005103]
  - Resolves: bz#1005103
    (Migration should fail when migrate guest offline to a file which is specified to a readonly directory.)
  - Resolves: bz#1031526
    (Can not commit snapshot when disk is using glusterfs:native backend)
  - Resolves: bz#1057471
    (fail to do hot-plug with "discard = on" with "Invalid parameter 'discard'" error)
  - Resolves: bz#1064018
    (abort from conflicting genroms)
  - Resolves: bz#1067784
    (qemu-kvm: block.c:850: bdrv_open_common: Assertion `bs->request_alignment != 0' failed. Aborted (core dumped))
  - Resolves: bz#1069541
    (Segmentation fault when boot guest with dataplane=on)
  - Resolves: bz#1073728
    (progress bar doesn't display when converting with -p)
  - Resolves: bz#1073774
    (e1000 ROM cause migrate fail  from RHEL6.5 host to RHEL7.0 host)
  - Resolves: bz#990989
    (backport inline header virtio-net optimization)
  - Resolves: bz#993429
    (kvm: test maximum number of vcpus supported (rhel7))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-54.el7
changelog:
  - kvm-qdev-monitor-Set-properties-after-parent-is-assigned.patch [bz#1046248]
  - kvm-block-Update-image-size-in-bdrv_invalidate_cache.patch [bz#1048575]
  - kvm-qcow2-Keep-option-in-qcow2_invalidate_cache.patch [bz#1048575]
  - kvm-qcow2-Check-bs-drv-in-copy_sectors.patch [bz#1048575]
  - kvm-block-bs-drv-may-be-NULL-in-bdrv_debug_resume.patch [bz#1048575]
  - kvm-iotests-Test-corruption-during-COW-request.patch [bz#1048575]
  - Resolves: bz#1046248
    (qemu-kvm crash when send "info qtree" after hot plug a device with invalid addr)
  - Resolves: bz#1048575
    (Segmentation fault occurs after migrate guest(use scsi disk and add stress) to des machine)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-55.el7
changelog:
  - kvm-scsi-Change-scsi-sense-buf-size-to-252.patch [bz#1058173]
  - kvm-scsi-Fix-migration-of-scsi-sense-data.patch [bz#1058173]
  - Resolves: bz#1058173
    (qemu-kvm core dump booting guest with scsi-generic disk attached when using built-in iscsi driver)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-56.el7
changelog:
  - kvm-configure-Fix-bugs-preventing-Ceph-inclusion.patch [bz#1078809]
  - Resolves: bz#1078809
    (can not boot qemu-kvm-rhev with rbd image)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-57.el7
changelog:
  - kvm-virtio-net-fix-guest-triggerable-buffer-overrun.patch [bz#1078308]
  - Resolves: bz#1078308
    (EMBARGOED CVE-2014-0150 qemu: virtio-net: fix guest-triggerable buffer overrun [rhel-7.0])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-58.el7
changelog:
  - kvm-pc-Use-cpu64-rhel6-CPU-model-by-default-on-rhel6-mac.patch [bz#1080170]
  - kvm-target-i386-Copy-cpu64-rhel6-definition-into-qemu64.patch [bz#1078607 bz#1080170]
  - Resolves: bz#1080170
    (intel 82576 VF not work in windows 2008 x86 - Code 12 [TestOnly])
  - Resolves: bz#1080170
    (Default CPU model for rhel6.* machine-types is different from RHEL-6)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-59.el7
changelog:
  - kvm-qemu-iotests-add-.-check-cloop-support.patch [bz#1066691]
  - kvm-qemu-iotests-add-cloop-input-validation-tests.patch [bz#1066691]
  - kvm-block-cloop-validate-block_size-header-field-CVE-201.patch [bz#1079455]
  - kvm-block-cloop-prevent-offsets_size-integer-overflow-CV.patch [bz#1079320]
  - kvm-block-cloop-refuse-images-with-huge-offsets-arrays-C.patch [bz#1079455]
  - kvm-block-cloop-refuse-images-with-bogus-offsets-CVE-201.patch [bz#1079455]
  - kvm-size-off-by-one.patch [bz#1066691]
  - kvm-qemu-iotests-Support-for-bochs-format.patch [bz#1066691]
  - kvm-bochs-Unify-header-structs-and-make-them-QEMU_PACKED.patch [bz#1066691]
  - kvm-bochs-Use-unsigned-variables-for-offsets-and-sizes-C.patch [bz#1079339]
  - kvm-bochs-Check-catalog_size-header-field-CVE-2014-0143.patch [bz#1079320]
  - kvm-bochs-Check-extent_size-header-field-CVE-2014-0142.patch [bz#1079315]
  - kvm-bochs-Fix-bitmap-offset-calculation.patch [bz#1066691]
  - kvm-vpc-vhd-add-bounds-check-for-max_table_entries-and-b.patch [bz#1079455]
  - kvm-vpc-Validate-block-size-CVE-2014-0142.patch [bz#1079315]
  - kvm-vdi-add-bounds-checks-for-blocks_in_image-and-disk_s.patch [bz#1079455]
  - kvm-vhdx-Bounds-checking-for-block_size-and-logical_sect.patch [bz#1079346]
  - kvm-curl-check-data-size-before-memcpy-to-local-buffer.-.patch [bz#1079455]
  - kvm-qcow2-Check-header_length-CVE-2014-0144.patch [bz#1079455]
  - kvm-qcow2-Check-backing_file_offset-CVE-2014-0144.patch [bz#1079455]
  - kvm-qcow2-Check-refcount-table-size-CVE-2014-0144.patch [bz#1079455]
  - kvm-qcow2-Validate-refcount-table-offset.patch [bz#1066691]
  - kvm-qcow2-Validate-snapshot-table-offset-size-CVE-2014-0.patch [bz#1079455]
  - kvm-qcow2-Validate-active-L1-table-offset-and-size-CVE-2.patch [bz#1079455]
  - kvm-qcow2-Fix-backing-file-name-length-check.patch [bz#1066691]
  - kvm-qcow2-Don-t-rely-on-free_cluster_index-in-alloc_refc.patch [bz#1079339]
  - kvm-qcow2-Avoid-integer-overflow-in-get_refcount-CVE-201.patch [bz#1079320]
  - kvm-qcow2-Check-new-refcount-table-size-on-growth.patch [bz#1066691]
  - kvm-qcow2-Fix-types-in-qcow2_alloc_clusters-and-alloc_cl.patch [bz#1066691]
  - kvm-qcow2-Protect-against-some-integer-overflows-in-bdrv.patch [bz#1066691]
  - kvm-qcow2-Fix-new-L1-table-size-check-CVE-2014-0143.patch [bz#1079320]
  - kvm-dmg-coding-style-and-indentation-cleanup.patch [bz#1066691]
  - kvm-dmg-prevent-out-of-bounds-array-access-on-terminator.patch [bz#1066691]
  - kvm-dmg-drop-broken-bdrv_pread-loop.patch [bz#1066691]
  - kvm-dmg-use-appropriate-types-when-reading-chunks.patch [bz#1066691]
  - kvm-dmg-sanitize-chunk-length-and-sectorcount-CVE-2014-0.patch [bz#1079325]
  - kvm-dmg-use-uint64_t-consistently-for-sectors-and-length.patch [bz#1066691]
  - kvm-dmg-prevent-chunk-buffer-overflow-CVE-2014-0145.patch [bz#1079325]
  - kvm-block-vdi-bounds-check-qemu-io-tests.patch [bz#1066691]
  - kvm-block-Limit-request-size-CVE-2014-0143.patch [bz#1079320]
  - kvm-qcow2-Fix-copy_sectors-with-VM-state.patch [bz#1066691]
  - kvm-qcow2-Fix-NULL-dereference-in-qcow2_open-error-path-.patch [bz#1079333]
  - kvm-qcow2-Fix-L1-allocation-size-in-qcow2_snapshot_load_.patch [bz#1079325]
  - kvm-qcow2-Check-maximum-L1-size-in-qcow2_snapshot_load_t.patch [bz#1079320]
  - kvm-qcow2-Limit-snapshot-table-size.patch [bz#1066691]
  - kvm-parallels-Fix-catalog-size-integer-overflow-CVE-2014.patch [bz#1079320]
  - kvm-parallels-Sanity-check-for-s-tracks-CVE-2014-0142.patch [bz#1079315]
  - kvm-fix-machine-check-propagation.patch [bz#740107]
  - Resolves: bz#1066691
    (qemu-kvm: include leftover patches from block layer security audit)
  - Resolves: bz#1079315
    (CVE-2014-0142 qemu-kvm: qemu: crash by possible division by zero [rhel-7.0])
  - Resolves: bz#1079320
    (CVE-2014-0143 qemu-kvm: Qemu: block: multiple integer overflow flaws [rhel-7.0])
  - Resolves: bz#1079325
    (CVE-2014-0145 qemu-kvm: Qemu: prevent possible buffer overflows [rhel-7.0])
  - Resolves: bz#1079333
    (CVE-2014-0146 qemu-kvm: Qemu: qcow2: NULL dereference in qcow2_open() error path [rhel-7.0])
  - Resolves: bz#1079339
    (CVE-2014-0147 qemu-kvm: Qemu: block: possible crash due signed types or logic error [rhel-7.0])
  - Resolves: bz#1079346
    (CVE-2014-0148 qemu-kvm: Qemu: vhdx: bounds checking for block_size and logical_sector_size [rhel-7.0])
  - Resolves: bz#1079455
    (CVE-2014-0144 qemu-kvm: Qemu: block: missing input validation [rhel-7.0])
  - Resolves: bz#740107
    ([Hitachi 7.0 FEAT]  KVM: MCA Recovery for KVM guest OS memory)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-60.el7
changelog:
  - kvm-qcow2-fix-dangling-refcount-table-entry.patch [bz#1081793]
  - kvm-qcow2-link-all-L2-meta-updates-in-preallocate.patch [bz#1081393]
  - Resolves: bz#1081393
    (qemu-img will prompt that 'leaked clusters were found' while creating images with '-o preallocation=metadata,cluster_size<=1024')
  - Resolves: bz#1081793
    (qemu-img core dumped when creating a qcow2 image base on block device(iscsi or libiscsi))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-60.el7_0.1
changelog:
  - kvm-iscsi-fix-indentation.patch [bz#1090978]
  - kvm-iscsi-correctly-propagate-errors-in-iscsi_open.patch [bz#1090978]
  - kvm-block-iscsi-query-for-supported-VPD-pages.patch [bz#1090978]
  - kvm-block-iscsi-fix-segfault-if-writesame-fails.patch [bz#1090978]
  - kvm-iscsi-recognize-invalid-field-ASCQ-from-WRITE-SAME-c.patch [bz#1090978]
  - kvm-iscsi-ignore-flushes-on-scsi-generic-devices.patch [bz#1090978]
  - kvm-iscsi-always-query-max-WRITE-SAME-length.patch [bz#1090978]
  - kvm-iscsi-Don-t-set-error-if-already-set-in-iscsi_do_inq.patch [bz#1090978]
  - kvm-iscsi-Remember-to-set-ret-for-iscsi_open-in-error-ca.patch [bz#1090978]
  - kvm-qemu_loadvm_state-shadow-SeaBIOS-for-VM-incoming-fro.patch [1091322]
  - kvm-uhci-UNfix-irq-routing-for-RHEL-6-machtypes-RHEL-onl.patch [bz#1090981]
  - kvm-ide-Correct-improper-smart-self-test-counter-reset-i.patch [bz#1093612]
  - Resolves: bz#1091322
    (fail to reboot guest after migration from RHEL6.5 host to RHEL7.0 host)
  - Resolves: bz#1090981
    (Guest hits call trace migrate from RHEL6.5 to RHEL7.0 host with -M 6.1 & balloon & uhci device)
  - Resolves: bz#1090978
    (qemu-kvm: iSCSI: Failure. SENSE KEY:ILLEGAL_REQUEST(5) ASCQ:INVALID_FIELD_IN_CDB(0x2400))
  - Resolves: bz#1093612
    (CVE-2014-2894 qemu-kvm: QEMU: out of bounds buffer accesses, guest triggerable via IDE SMART [rhel-7.0.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-60.el7_0.2
changelog:
  - kvm-pc-add-hot_add_cpu-callback-to-all-machine-types.patch [bz#1094820]
  - Resolves: bz#1094820
    (Hot plug CPU not working with RHEL6  machine types running on RHEL7 host.)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-60.el7_0.3
changelog:
  - kvm-virtio-net-fix-buffer-overflow-on-invalid-state-load.patch [bz#1095677]
  - kvm-virtio-net-out-of-bounds-buffer-write-on-load.patch [bz#1095684]
  - kvm-virtio-net-out-of-bounds-buffer-write-on-invalid-sta.patch [bz#1095689]
  - kvm-virtio-out-of-bounds-buffer-write-on-invalid-state-l.patch [bz#1095694]
  - kvm-virtio-avoid-buffer-overrun-on-incoming-migration.patch [bz#1095737]
  - kvm-virtio-scsi-fix-buffer-overrun-on-invalid-state-load.patch [bz#1095741]
  - kvm-virtio-validate-config_len-on-load.patch [bz#1095782]
  - kvm-virtio-validate-num_sg-when-mapping.patch [bz#1095765]
  - kvm-virtio-allow-mapping-up-to-max-queue-size.patch [bz#1095765]
  - kvm-vmstate-add-VMS_MUST_EXIST.patch [bz#1095706]
  - kvm-vmstate-add-VMSTATE_VALIDATE.patch [bz#1095706]
  - kvm-hpet-fix-buffer-overrun-on-invalid-state-load.patch [bz#1095706]
  - kvm-hw-pci-pcie_aer.c-fix-buffer-overruns-on-invalid-sta.patch [bz#1095714]
  - kvm-usb-sanity-check-setup_index-setup_len-in-post_load.patch [bz#1095746]
  - kvm-usb-sanity-check-setup_index-setup_len-in-post_l2.patch [bz#1095746]
  - kvm-usb-fix-up-post-load-checks.patch [bz#1096828]
  - kvm-XBZRLE-Fix-qemu-crash-when-resize-the-xbzrle-cache.patch [bz#1110191]
  - kvm-Provide-init-function-for-ram-migration.patch [bz#1110191]
  - kvm-Init-the-XBZRLE.lock-in-ram_mig_init.patch [bz#1110191]
  - kvm-XBZRLE-Fix-one-XBZRLE-corruption-issues.patch [bz#1110191]
  - kvm-Count-used-RAMBlock-pages-for-migration_dirty_pages.patch [bz#1110189]
  - kvm-qcow-correctly-propagate-errors.patch [bz#1097229]
  - kvm-qcow1-Make-padding-in-the-header-explicit.patch [bz#1097229]
  - kvm-qcow1-Check-maximum-cluster-size.patch [bz#1097229]
  - kvm-qcow1-Validate-L2-table-size-CVE-2014-0222.patch [bz#1097229]
  - kvm-qcow1-Validate-image-size-CVE-2014-0223.patch [bz#1097236]
  - kvm-qcow1-Stricter-backing-file-length-check.patch [bz#1097236]
  - kvm-char-restore-read-callback-on-a-reattached-hotplug-c.patch [bz#1110219]
  - kvm-qcow2-Free-preallocated-zero-clusters.patch [bz#1110188]
  - kvm-qemu-iotests-Discard-preallocated-zero-clusters.patch [bz#1110188]
  - Resolves: bz#1095677
    (CVE-2013-4148 qemu-kvm: qemu: virtio-net: buffer overflow on invalid state load [rhel-7.0.z])
  - Resolves: bz#1095684
    (CVE-2013-4149 qemu-kvm: qemu: virtio-net: out-of-bounds buffer write on load [rhel-7.0.z])
  - Resolves: bz#1095689
    (CVE-2013-4150 qemu-kvm: qemu: virtio-net: out-of-bounds buffer write on invalid state load [rhel-7.0.z])
  - Resolves: bz#1095694
    (CVE-2013-4151 qemu-kvm: qemu: virtio: out-of-bounds buffer write on invalid state load [rhel-7.0.z])
  - Resolves: bz#1095706
    (CVE-2013-4527 qemu-kvm: qemu: hpet: buffer overrun on invalid state load [rhel-7.0.z])
  - Resolves: bz#1095714
    (CVE-2013-4529 qemu-kvm: qemu: hw/pci/pcie_aer.c: buffer overrun on invalid state load [rhel-7.0.z])
  - Resolves: bz#1095737
    (CVE-2013-6399 qemu-kvm: qemu: virtio: buffer overrun on incoming migration [rhel-7.0.z])
  - Resolves: bz#1095741
    (CVE-2013-4542 qemu-kvm: qemu: virtio-scsi: buffer overrun on invalid state load [rhel-7.0.z])
  - Resolves: bz#1095746
    (CVE-2013-4541 qemu-kvm: qemu: usb: insufficient sanity checking of setup_index+setup_len in post_load [rhel-7.0.z])
  - Resolves: bz#1095765
    (CVE-2013-4535 CVE-2013-4536 qemu-kvm: qemu: virtio: insufficient validation of num_sg when mapping [rhel-7.0.z])
  - Resolves: bz#1095782
    (CVE-2014-0182 qemu-kvm: qemu: virtio: out-of-bounds buffer write on state load with invalid config_len [rhel-7.0.z])
  - Resolves: bz#1096828
    (CVE-2014-3461 qemu-kvm: Qemu: usb: fix up post load checks [rhel-7.0.z])
  - Resolves: bz#1097229
    (CVE-2014-0222 qemu-kvm: Qemu: qcow1: validate L2 table size to avoid integer overflows [rhel-7.0.z])
  - Resolves: bz#1097236
    (CVE-2014-0223 qemu-kvm: Qemu: qcow1: validate image size to avoid out-of-bounds memory access [rhel-7.0.z])
  - Resolves: bz#1110188
    (qcow2 corruptions (leaked clusters after installing a rhel7 guest using virtio_scsi))
  - Resolves: bz#1110189
    (migration can not finish with 1024k 'remaining ram' left after hotunplug 4 nics)
  - Resolves: bz#1110191
    (Reduce the migrate cache size during migration causes qemu segment fault)
  - Resolves: bz#1110219
    (Guest can't receive any character transmitted from host after hot unplugging virtserialport then hot plugging again)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-60.el7_0.4
changelog:
  - kvm-zero-initialize-KVM_SET_GSI_ROUTING-input.patch [bz#1110693]
  - kvm-skip-system-call-when-msi-route-is-unchanged.patch [bz#1110693]
  - Resolves: bz#1110693
    (2x RHEL 5.10 VM running on RHEL 7 KVM have low TCP_STREAM throughput)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-60.el7_0.5
changelog:
  - kvm-Allow-mismatched-virtio-config-len.patch [bz#1095782]
  - Resolves: bz#1095782
    (CVE-2014-0182 qemu-kvm: qemu: virtio: out-of-bounds buffer write on state load with invalid config_len [rhel-7.0.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-60.el7_0.6
changelog:
  - kvm-vmstate-reduce-code-duplication.patch [bz#1095706]
  - kvm-vfio-pci-Add-debug-config-options-to-disable-MSI-X-K.patch [bz#1110693 bz#1110695]
  - kvm-vfio-correct-debug-macro-typo.patch [bz#1110693 bz#1110695]
  - kvm-vfio-pci-Fix-MSI-X-debug-code.patch [bz#1110693 bz#1110695]
  - kvm-vfio-pci-Fix-MSI-X-masking-performance.patch [bz#1110693 bz#1110695]
  - kvm-vfio-Fix-MSI-X-vector-expansion.patch [bz#1110693 bz#1110695]
  - kvm-vfio-Don-t-cache-MSIMessage.patch [bz#1110693 bz#1110695]
  - kvm-virtio-net-Do-not-filter-VLANs-without-F_CTRL_VLAN.patch [bz#1130149]
  - kvm-virtio-net-add-vlan-receive-state-to-RxFilterInfo.patch [bz#1130149]
  - kvm-memory-Don-t-call-memory_region_update_coalesced_ran.patch [bz#1124660]
  - Resolves: bz#1110693
    (2x RHEL 5.10 VM running on RHEL 7 KVM have low TCP_STREAM throughput)
  - Resolves: bz#1110695
    (2x RHEL 5.10 VM running on RHEL 7 KVM have low TCP_STREAM throughput)
  - Resolves: bz#1124660
    ([FJ7.0 Bug] RHEL7.0 guest attaching 150 or more virtio-blk disks fails to start up)
  - Resolves: bz#1130149
    (rx filter incorrect when guest disables VLAN filtering)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-60.el7_0.7
changelog:
  - kvm-mirror-Fix-resource-leak-when-bdrv_getlength-fails.patch [bz#1132806]
  - kvm-blockjob-Add-block_job_yield.patch [bz#1132806]
  - kvm-mirror-Go-through-ready-complete-process-for-0-len-i.patch [bz#1132806]
  - kvm-qemu-iotests-Test-BLOCK_JOB_READY-event-for-0Kb-imag.patch [bz#1132806]
  - kvm-block-make-top-argument-to-block-commit-optional.patch [bz#1132806]
  - kvm-qemu-iotests-Test-0-length-image-for-mirror.patch [bz#1132806]
  - kvm-mirror-Fix-qiov-size-for-short-requests.patch [bz#1132806]
  - Resolves: bz#1132806
    (advertise active commit to libvirt)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-60.el7_0.8
changelog:
  - kvm-vmstate_xhci_event-fix-unterminated-field-list.patch [bz#1145055]
  - kvm-vmstate_xhci_event-bug-compat-with-RHEL-7.0-RHEL-onl.patch [bz#1145055]
  - kvm-vbe-make-bochs-dispi-interface-return-the-correct-me.patch [bz#1139117]
  - kvm-vbe-rework-sanity-checks.patch [bz#1139117]
  - kvm-spice-display-add-display-channel-id-to-the-debug-me.patch [bz#1139117]
  - kvm-spice-make-sure-we-don-t-overflow-ssd-buf.patch [bz#1139117]
  - Resolves: bz#1139117
    (CVE-2014-3615 qemu-kvm: Qemu: crash when guest sets high resolution [rhel-7.0.z])
  - Resolves: bz#1145055
    (vmstate_xhci_event: fix unterminated field list [rhel-7.0.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-60.el7_0.9
changelog:
  - kvm-scsi-disk-fix-bug-in-scsi_block_new_request-introduc.patch [bz#1141189]
  - Resolves: bz#1141189
    (bug in scsi_block_new_request() function introduced by upstream commit 137745c5c60f083ec982fe9e861e8c16ebca1ba8)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-60.el7_0.10
changelog:
  - kvm-block-add-helper-function-to-determine-if-a-BDS-is-i.patch [bz#1122925]
  - kvm-block-extend-block-commit-to-accept-a-string-for-the.patch [bz#1122925]
  - kvm-block-add-backing-file-option-to-block-stream.patch [bz#1122925]
  - kvm-block-add-__com.redhat_change-backing-file-qmp-comma.patch [bz#1122925]
  - Resolves: bz#1122925
    (Maintain relative path to backing file image during live merge (block-commit))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-60.el7_0.11
changelog:
  - kvm-block-raw-posix-Try-both-FIEMAP-and-SEEK_HOLE.patch [bz#1166605]
  - kvm-block-raw-posix-Fix-disk-corruption-in-try_fiemap.patch [bz#1166605]
  - kvm-block-raw-posix-use-seek_hole-ahead-of-fiemap.patch [bz#1166605]
  - kvm-raw-posix-Fix-raw_co_get_block_status-after-EOF.patch [bz#1166605]
  - kvm-raw-posix-raw_co_get_block_status-return-value.patch [bz#1166605]
  - kvm-raw-posix-SEEK_HOLE-suffices-get-rid-of-FIEMAP.patch [bz#1166605]
  - kvm-raw-posix-The-SEEK_HOLE-code-is-flawed-rewrite-it.patch [bz#1166605]
  - Resolves: bz#1166605
    (qemu-img convert intermittently corrupts output images)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-77.el7
changelog:
  - kvm-seccomp-add-semctl-to-the-syscall-whitelist.patch [bz#1026314]
  - kvm-Revert-kvmclock-Ensure-proper-env-tsc-value-for-kvmc.patch [bz#1098602 bz#1130428]
  - kvm-Revert-kvmclock-Ensure-time-in-migration-never-goes-.patch [bz#1098602 bz#1130428]
  - kvm-Introduce-cpu_clean_all_dirty.patch [bz#1098602 bz#1130428]
  - kvm-kvmclock-Ensure-proper-env-tsc-value-for-kvmclock.v2.patch [bz#1098602 bz#1130428]
  - kvm-kvmclock-Ensure-time-in-migration-never-goes-back.v2.patch [bz#1098602 bz#1130428]
  - Resolves: bz#1026314
    (BUG: qemu-kvm hang when use '-sandbox on'+'vnc'+'hda')
  - Resolves: bz#1098602
    (kvmclock: Ensure time in migration never goes backward (backport))
  - Resolves: bz#1130428
    (After migration of RHEL7.1 guest with "-vga qxl", GUI console is hang)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-78.el7
changelog:
  - kvm-slirp-udp-fix-NULL-pointer-dereference-because-of-un.patch [bz#1144820]
  - kvm-hw-pci-fix-error-flow-in-pci-multifunction-init.patch [bz#1049734]
  - kvm-rhel-Drop-machine-type-pc-q35-rhel7.0.0.patch [bz#1111107]
  - kvm-virtio-scsi-Plug-memory-leak-on-virtio_scsi_push_eve.patch [bz#1088822]
  - kvm-virtio-scsi-Report-error-if-num_queues-is-0-or-too-l.patch [bz#1089606]
  - kvm-virtio-scsi-Fix-memory-leak-when-realize-failed.patch [bz#1089606]
  - kvm-virtio-scsi-Fix-num_queue-input-validation.patch [bz#1089606]
  - kvm-Revert-linux-aio-use-event-notifiers.patch [bz#1104748]
  - kvm-specfile-Require-glusterfs-api-3.6.patch [bz#1155518]
  - Resolves: bz#1049734
    (PCI: QEMU crash on illegal operation: attaching a function to a non multi-function device)
  - Resolves: bz#1088822
    (hot-plug a virtio-scsi disk via 'blockdev-add' always cause QEMU quit)
  - Resolves: bz#1089606
    (QEMU will not reject invalid number of queues (num_queues = 0) specified for virtio-scsi)
  - Resolves: bz#1104748
    (48% reduction in IO performance for KVM guest, io=native)
  - Resolves: bz#1111107
    (Remove Q35 machine type from qemu-kvm)
  - Resolves: bz#1144820
    (CVE-2014-3640 qemu-kvm: qemu: slirp: NULL pointer deref in sosendto() [rhel-7.1])
  - Resolves: bz#1155518
    (qemu-kvm: undefined symbol: glfs_discard_async)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-79.el7
changelog:
  - kvm-libcacard-link-against-qemu-error.o-for-error_report.patch [bz#1088176]
  - kvm-error-Add-error_abort.patch [bz#1088176]
  - kvm-blockdev-Fail-blockdev-add-with-encrypted-images.patch [bz#1088176]
  - kvm-blockdev-Fix-NULL-pointer-dereference-in-blockdev-ad.patch [bz#1088176]
  - kvm-qemu-iotests-Test-a-few-blockdev-add-error-cases.patch [bz#1088176]
  - kvm-block-Add-errp-to-bdrv_new.patch [bz#1088176]
  - kvm-qemu-img-Avoid-duplicate-block-device-IDs.patch [bz#1088176]
  - kvm-block-Catch-duplicate-IDs-in-bdrv_new.patch [bz#1088176]
  - kvm-qemu-img-Allow-source-cache-mode-specification.patch [bz#1138691]
  - kvm-qemu-img-Allow-cache-mode-specification-for-amend.patch [bz#1138691]
  - kvm-qemu-img-clarify-src_cache-option-documentation.patch [bz#1138691]
  - kvm-qemu-img-fix-rebase-src_cache-option-documentation.patch [bz#1138691]
  - kvm-qemu-img-fix-img_compare-flags-error-path.patch [bz#1138691]
  - kvm-ac97-register-reset-via-qom.patch [bz#1141667]
  - kvm-virtio-blk-Factor-common-checks-out-of-virtio_blk_ha.patch [bz#1085232]
  - kvm-virtio-blk-Bypass-error-action-and-I-O-accounting-on.patch [bz#1085232]
  - kvm-virtio-blk-Treat-read-write-beyond-end-as-invalid.patch [bz#1085232]
  - kvm-ide-Treat-read-write-beyond-end-as-invalid.patch [bz#1085232]
  - kvm-ide-only-constrain-read-write-requests-to-drive-size.patch [bz#1085232]
  - Resolves: bz#1085232
    (Ilegal guest requests on block devices pause the VM)
  - Resolves: bz#1088176
    (QEMU fail to check whether duplicate ID for block device drive using 'blockdev-add' to hotplug)
  - Resolves: bz#1138691
    (Allow qemu-img to bypass the host cache (check, compare, convert, rebase, amend))
  - Resolves: bz#1141667
    (Qemu crashed if reboot guest after hot remove AC97 sound device)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-80.el7
changelog:
  - kvm-dump-RHEL-specific-fix-for-CPUState-bug-introduced-b.patch [bz#1161563]
  - kvm-dump-guest-memory-Check-for-the-correct-return-value.patch [bz#1157798]
  - kvm-dump-const-qualify-the-buf-of-WriteCoreDumpFunction.patch [bz#1157798]
  - kvm-dump-add-argument-to-write_elfxx_notes.patch [bz#1157798]
  - kvm-dump-add-API-to-write-header-of-flatten-format.patch [bz#1157798]
  - kvm-dump-add-API-to-write-vmcore.patch [bz#1157798]
  - kvm-dump-add-API-to-write-elf-notes-to-buffer.patch [bz#1157798]
  - kvm-dump-add-support-for-lzo-snappy.patch [bz#1157798]
  - kvm-RPM-spec-build-qemu-kvm-with-lzo-and-snappy-enabled-.patch [bz#1157798]
  - kvm-dump-add-members-to-DumpState-and-init-some-of-them.patch [bz#1157798]
  - kvm-dump-add-API-to-write-dump-header.patch [bz#1157798]
  - kvm-dump-add-API-to-write-dump_bitmap.patch [bz#1157798]
  - kvm-dump-add-APIs-to-operate-DataCache.patch [bz#1157798]
  - kvm-dump-add-API-to-write-dump-pages.patch [bz#1157798]
  - kvm-dump-Drop-qmp_dump_guest_memory-stub-and-build-for-a.patch [bz#1157798]
  - kvm-dump-make-kdump-compressed-format-available-for-dump.patch [bz#1157798]
  - kvm-Define-the-architecture-for-compressed-dump-format.patch [bz#1157798]
  - kvm-dump-add-query-dump-guest-memory-capability-command.patch [bz#1157798]
  - kvm-dump-Drop-pointless-error_is_set-DumpState-member-er.patch [bz#1157798]
  - kvm-dump-fill-in-the-flat-header-signature-more-pleasing.patch [bz#1157798]
  - kvm-dump-simplify-write_start_flat_header.patch [bz#1157798]
  - kvm-dump-eliminate-DumpState.page_shift-guest-s-page-shi.patch [bz#1157798]
  - kvm-dump-eliminate-DumpState.page_size-guest-s-page-size.patch [bz#1157798]
  - kvm-dump-select-header-bitness-based-on-ELF-class-not-EL.patch [bz#1157798]
  - kvm-dump-hoist-lzo_init-from-get_len_buf_out-to-dump_ini.patch [bz#1157798]
  - kvm-dump-simplify-get_len_buf_out.patch [bz#1157798]
  - kvm-rename-parse_enum_option-to-qapi_enum_parse-and-make.patch [bz#1087724]
  - kvm-qapi-introduce-PreallocMode-and-new-PreallocModes-fu.patch [bz#1087724]
  - kvm-raw-posix-Add-falloc-and-full-preallocation-option.patch [bz#1087724]
  - kvm-qcow2-Add-falloc-and-full-preallocation-option.patch [bz#1087724]
  - kvm-vga-fix-invalid-read-after-free.patch [bz#1161890]
  - kvm-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch [bz#1140618]
  - kvm-vnc-sanitize-bits_per_pixel-from-the-client.patch [bz#1157645]
  - kvm-spice-call-qemu_spice_set_passwd-during-init.patch [bz#1138639]
  - kvm-block-raw-posix-Try-both-FIEMAP-and-SEEK_HOLE.patch [bz#1160237]
  - kvm-block-raw-posix-Fix-disk-corruption-in-try_fiemap.patch [bz#1160237]
  - kvm-block-raw-posix-use-seek_hole-ahead-of-fiemap.patch [bz#1160237]
  - kvm-raw-posix-Fix-raw_co_get_block_status-after-EOF.patch [bz#1160237]
  - kvm-raw-posix-raw_co_get_block_status-return-value.patch [bz#1160237]
  - kvm-raw-posix-SEEK_HOLE-suffices-get-rid-of-FIEMAP.patch [bz#1160237]
  - kvm-raw-posix-The-SEEK_HOLE-code-is-flawed-rewrite-it.patch [bz#1160237]
  - Resolves: bz#1087724
    ([Fujitsu 7.1 FEAT]: qemu-img should use fallocate() system call for "preallocation=full" option)
  - Resolves: bz#1138639
    (fail to login spice session with password + expire time)
  - Resolves: bz#1140618
    (Should replace "qemu-system-i386" by "/usr/libexec/qemu-kvm" in manpage of qemu-kvm for our official qemu-kvm build)
  - Resolves: bz#1157645
    (CVE-2014-7815 qemu-kvm: qemu: vnc: insufficient bits_per_pixel from the client sanitization [rhel-7.1])
  - Resolves: bz#1157798
    ([FEAT RHEL7.1]: qemu: Support compression for dump-guest-memory command)
  - Resolves: bz#1160237
    (qemu-img convert intermittently corrupts output images)
  - Resolves: bz#1161563
    (invalid QEMU NOTEs in vmcore that is dumped for multi-VCPU guests)
  - Resolves: bz#1161890
    ([abrt] qemu-kvm: pixman_image_get_data(): qemu-kvm killed by SIGSEGV)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-81.el7
changelog:
  - kvm-migration-static-variables-will-not-be-reset-at-seco.patch [bz#1071776]
  - kvm-vfio-pci-Add-debug-config-options-to-disable-MSI-X-K.patch [bz#1098976]
  - kvm-vfio-correct-debug-macro-typo.patch [bz#1098976]
  - kvm-vfio-pci-Fix-MSI-X-debug-code.patch [bz#1098976]
  - kvm-vfio-pci-Fix-MSI-X-masking-performance.patch [bz#1098976]
  - kvm-vfio-Fix-MSI-X-vector-expansion.patch [bz#1098976]
  - kvm-vfio-Don-t-cache-MSIMessage.patch [bz#1098976]
  - Resolves: bz#1071776
    (Migration "expected downtime" does not refresh after reset to a new value)
  - Resolves: bz#1098976
    (2x RHEL 5.10 VM running on RHEL 7 KVM have low TCP_STREAM throughput)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-82.el7
changelog:
  - kvm-hw-pci-fixed-error-flow-in-pci_qdev_init.patch [bz#1046007]
  - kvm-hw-pci-fixed-hotplug-crash-when-using-rombar-0-with-.patch [bz#1046007]
  - Resolves: bz#1046007
    (qemu-kvm aborted when hot plug PCI device to guest with romfile and rombar=0)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-83.el7
changelog:
  - kvm-xhci-add-sanity-checks-to-xhci_lookup_uport.patch [bz#1074219]
  - kvm-Revert-Build-ceph-rbd-only-for-rhev.patch [bz#1140742]
  - kvm-Revert-rbd-Only-look-for-qemu-specific-copy-of-librb.patch [bz#1140742]
  - kvm-Revert-rbd-link-and-load-librbd-dynamically.patch [bz#1140742]
  - kvm-spec-Enable-rbd-driver-add-dependency.patch [bz#1140742]
  - Resolves: bz#1074219
    (qemu core dump when install a RHEL.7 guest(xhci) with migration)
  - Resolves: bz#1140742
    (Enable native support for Ceph)


author: Jeff E. Nelson <jen@redhat.com> - 1.5.3-84.el7
changelog:
  - kvm-qemu-iotests-Test-case-for-backing-file-deletion.patch [bz#1002493]
  - kvm-qemu-iotests-Add-sample-image-and-test-for-VMDK-vers.patch [bz#1134237]
  - kvm-vmdk-Check-VMFS-extent-line-field-number.patch [bz#1134237]
  - kvm-qemu-iotests-Introduce-_unsupported_imgopts.patch [bz#1002493]
  - kvm-qemu-iotests-Add-_unsupported_imgopts-for-vmdk-subfo.patch [bz#1002493]
  - kvm-vmdk-Fix-big-flat-extent-IO.patch [bz#1134241]
  - kvm-vmdk-Check-for-overhead-when-opening.patch [bz#1134251]
  - kvm-block-vmdk-add-basic-.bdrv_check-support.patch [bz#1134251]
  - kvm-qemu-iotest-Make-077-raw-only.patch [bz#1134237]
  - kvm-qemu-iotests-Don-t-run-005-on-vmdk-split-formats.patch [bz#1002493]
  - kvm-vmdk-extract-vmdk_read_desc.patch [bz#1134251]
  - kvm-vmdk-push-vmdk_read_desc-up-to-caller.patch [bz#1134251]
  - kvm-vmdk-do-not-try-opening-a-file-as-both-image-and-des.patch [bz#1134251]
  - kvm-vmdk-correctly-propagate-errors.patch [bz#1134251]
  - kvm-block-vmdk-do-not-report-file-offset-for-compressed-.patch [bz#1134251]
  - kvm-vmdk-Fix-d-and-lld-to-PRI-in-format-strings.patch [bz#1134251]
  - kvm-vmdk-Fix-x-to-PRIx32-in-format-strings-for-cid.patch [bz#1134251]
  - kvm-qemu-img-Convert-by-cluster-size-if-target-is-compre.patch [bz#1134283]
  - kvm-vmdk-Implement-.bdrv_write_compressed.patch [bz#1134283]
  - kvm-vmdk-Implement-.bdrv_get_info.patch [bz#1134283]
  - kvm-qemu-iotests-Test-converting-to-streamOptimized-from.patch [bz#1134283]
  - kvm-vmdk-Fix-local_err-in-vmdk_create.patch [bz#1134283]
  - kvm-fpu-softfloat-drop-INLINE-macro.patch [bz#1002493]
  - kvm-block-New-bdrv_nb_sectors.patch [bz#1002493]
  - kvm-vmdk-Optimize-cluster-allocation.patch [bz#1002493]
  - kvm-vmdk-Handle-failure-for-potentially-large-allocation.patch [bz#1002493]
  - kvm-vmdk-Use-bdrv_nb_sectors-where-sectors-not-bytes-are.patch [bz#1002493]
  - kvm-vmdk-fix-vmdk_parse_extents-extent_file-leaks.patch [bz#1002493]
  - kvm-vmdk-fix-buf-leak-in-vmdk_parse_extents.patch [bz#1002493]
  - kvm-vmdk-Fix-integer-overflow-in-offset-calculation.patch [bz#1002493]
  - kvm-migration-fix-parameter-validation-on-ram-load-CVE-2.patch [bz#1163078]
  - Resolves: bz#1002493
    (qemu-img convert rate about 100k/second from qcow2/raw to vmdk format on nfs system file)
  - Resolves: bz#1134237
    (Opening malformed VMDK description file should fail)
  - Resolves: bz#1134241
    (QEMU fails to correctly read/write on VMDK with big flat extent)
  - Resolves: bz#1134251
    (Opening an obviously truncated VMDK image should fail)
  - Resolves: bz#1134283
    (qemu-img convert from ISO to streamOptimized fails)
  - Resolves: bz#1163078
    (CVE-2014-7840 qemu-kvm: qemu: insufficient parameter validation during ram load [rhel-7.1])


author: Jeff E. Nelson <jen@redhat.com> - 1.5.3-85.el7
changelog:
  - kvm-block-delete-cow-block-driver.patch [bz#1175325]
  - Resolves: bz#1175325
    (Delete cow block driver)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-86.el7
changelog:
  - kvm-vfio-pci-Fix-interrupt-disabling.patch [bz#1180942]
  - kvm-cirrus-fix-blit-region-check.patch [bz#1169456]
  - kvm-cirrus-don-t-overflow-CirrusVGAState-cirrus_bltbuf.patch [bz#1169456]
  - Resolves: bz#1169456
    (CVE-2014-8106 qemu-kvm: qemu: cirrus: insufficient blit region checks [rhel-7.1])
  - Resolves: bz#1180942
    (qemu core dumped when unhotplug gpu card assigned to guest)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-86.el7_1.1
changelog:
  - kvm-pc-add-rhel6.6.0-machine-type.patch [bz#1198958]
  - Resolves: bz#1198958
    (Add rhel-6.6.0 machine type to RHEL 7.1.z to support RHEL 6.6 to RHEL 7.1 live migration)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-86.el7_1.2
changelog:
  - kvm-fdc-force-the-fifo-access-to-be-in-bounds-of-the-all.patch [bz#1219269]
  - Resolves: bz#1219269
    (EMBARGOED CVE-2015-3456 qemu-kvm: qemu: floppy disk controller flaw [rhel-7.1.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-86.el7_1.3
changelog:
  - kvm-atomics-add-explicit-compiler-fence-in-__atomic-memo.patch [bz#1233643]
  - Resolves: bz#1233643
    ([abrt] qemu-kvm: bdrv_error_action(): qemu-kvm killed by SIGABRT)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-86.el7_1.4
changelog:
  - kvm-ide-Check-array-bounds-before-writing-to-io_buffer-C.patch [bz#1243689]
  - kvm-ide-atapi-Fix-START-STOP-UNIT-command-completion.patch [bz#1243689]
  - kvm-ide-Clear-DRQ-after-handling-all-expected-accesses.patch [bz#1243689]
  - Resolves: bz#1243689
    (EMBARGOED CVE-2015-5154 qemu-kvm: qemu: ide: atapi: heap overflow during I/O buffer memory access [rhel-7.1.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-86.el7_1.5
changelog:
  - kvm-i8254-fix-out-of-bounds-memory-access-in-pit_ioport_.patch [bz#1243726]
  - Resolves: bz#1243726
    (CVE-2015-3214 qemu-kvm: qemu: i8254: out-of-bounds memory access in pit_ioport_read function [rhel-7.1.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-86.el7_1.6
changelog:
  - kvm-rtl8139-avoid-nested-ifs-in-IP-header-parsing-CVE-20.patch [bz#1248764]
  - kvm-rtl8139-drop-tautologous-if-ip-.-statement-CVE-2015-.patch [bz#1248764]
  - kvm-rtl8139-skip-offload-on-short-Ethernet-IP-header-CVE.patch [bz#1248764]
  - kvm-rtl8139-check-IP-Header-Length-field-CVE-2015-5165.patch [bz#1248764]
  - kvm-rtl8139-check-IP-Total-Length-field-CVE-2015-5165.patch [bz#1248764]
  - kvm-rtl8139-skip-offload-on-short-TCP-header-CVE-2015-51.patch [bz#1248764]
  - kvm-rtl8139-check-TCP-Data-Offset-field-CVE-2015-5165.patch [bz#1248764]
  - Resolves: bz#1248764
    (CVE-2015-5165 qemu-kvm: Qemu: rtl8139 uninitialized heap memory information leakage to guest [rhel-7.1.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-86.el7_1.7
changelog:
  - kvm-CVE-2015-1779-incrementally-decode-websocket-frames.patch [bz#1205050]
  - kvm-CVE-2015-1779-limit-size-of-HTTP-headers-from-websoc.patch [bz#1205050]
  - Resolves: bz#1205050
    (CVE-2015-1779 qemu-kvm: qemu: vnc: insufficient resource limiting in VNC websockets decoder [rhel-7.1.z])


author: Jeff E. Nelson <jen@redhat.com> - 1.5.3-86.el7_1.8
changelog:
  - kvm-qtest-ide-test-disable-flush-test.patch [bz#1273098]
  - Resolves: bz#1273098
    (qemu-kvm build failure race condition in tests/ide-test)


author: Rex Dieter <rdieter@fedoraproject.org> - 0.0.4-2
changelog:
  - update summary/description/Source_url
  - %files: track soname
  - cleaner cmake-fu
  - upstream noexecstack patch


author: Kevin Kofler <Kevin@tigcc.ticalc.org> - 0.0.4-3
changelog:
  - require the main package with exact version-release in -examples
  - remove explicit Requires: qt4-devel pkgconfig from -devel, now autodetected


author: Rex Dieter <rdieter@fedoraproject.org> - 0.7.1-8
changelog:
  - skip stripping some compiler flags (undocumented)
  - %files: track files closer (lib soname in particular)
  - -devel: avoid dep on cmake 
  - %check: +make test, pkgconfig check


author: Doug Ledford <dledford@redhat.com> - 0.4.6-6
changelog:
  - Fix the fact that qperf was using the wrong PF_RDS define now that RDS
    is integrated upstream and its assigned number is no longer temporary


author: Matthieu Saulnier <fantom@fedoraproject.org> - 3.2.0-1
changelog:
  - update to 3.2.0
  - remove BuildRoot tag in spec file
  - remove "rm -rf $RPM_BUILD_ROOT" at the beginning of %install section
  - remove %clean section
  - remove %defattr lines
  - add a joker for libqrencode.so.* files


author: Peter Gordon <peter@thecodergeek.com> - 3.2.0-2
changelog:
  - Add patch to fix improper LIBPTHREAD macro in the pkgconfig file:
    + fix-LIBPTHREAD-macro.patch
  - Resolves: #795582 (qrencode-devel: Malformed pkgconfig file causes build to
    fail ("@LIBPTHREAD@: No such file or directory"))


author: Matthieu Saulnier <fantom@fedoraproject.org> - 3.3.1-1
changelog:
  - update to 3.3.1
  - remove "Group" tag in spec file
  - fix manfile suffix
  - remove patch to fix improper LIBPTHREAD macro in the pkgconfig file:
    - upstream issue


author: Jan Grulich <jgrulich@redhat.com> - 1:4.8.5-12
changelog:
  - Revert upstream fix for QTBUG-15319
    Resolves: bz#1259675
  - Do not use nonstandard linux-g++-aarch64
    Resolves: bz#1291461


author: Jan Grulich <jgrulich@redhat.com> - 1:4.8.7-4
changelog:
  - Bump build version for RPM to not consider z-stream build as newer
    Revert fix for font cache check in QFontEngineFT::recalcAdvances()
    Resolves: bz#1684167


author: Jan Grulich <jgrulich@redhat.com> - 1:4.8.7-8
changelog:
  - Fix QImage allocation failure in qgifhandler
    Resolves: bz#1667863

  - Fix QTgaFile CPU exhaustion
    Resolves: bz#1667879

  - Fix QBmpHandler segmentation fault on malformed BMP file
    Resolves: bz#1667862


author: Rex Dieter <rdieter@fedoraproject.org> - 5.6.0-8
changelog:
  - make 10-qt5-check-opengl2.sh xinit script more robust
  - enable journald support for el7+ (#1315239)


author: Jan Grulich <jgrulich@redhat.com> - 5.9.7-3
changelog:
  - Fix multilib issue with qtcore-config.h header file
    Resolves: bz#1534528

  - Move libQt5EglFSDeviceIntegration lib into correct subpackage
    Resolves: bz#1792680


author: Jan Grulich <jgrulich@redhat.com> - 5.9.7-4
changelog:
  - Fix: Files placed by attacker can influence the working directory and lead to malicious code execution
    Resolves: bz#1814740
    Resolves: bz#1814685


author: Rex Dieter <rdieter@fedoraproject.org> - 5.6.0-4
changelog:
  - backport upstream fixes
  - drop -fno-delete-null-pointer-checks hack (included in qt5-rpm-macros as needed now)


author: Jan Grulich <jgrulich@redhat.com> - 5.9.7-2
changelog:
  - libwebp security fixes:
    Resolves: bz#1961742
    Resolves: bz#1961743
    Resolves: bz#1961744
    Resolves: bz#1961745


author: Michal Sekletar <msekleta@redhat.com> - 0.99.22.1-6
changelog:
  - obsolete quagga-sysvinit subpackage
  - use macro to specify location where to install tmpfiles configuration file
  - fix rpm scripts handling documentation in info format


author: Michal Sekletar <msekleta@redhat.com> - 0.99.22.1-7
changelog:
  - quagga is service which might implement networking, thus it should not have
    WantedBy=network.target in its systemd configuration
  - resolves: #976883


author: Michal Sekletar <msekleta@redhat.com> - 0.99.22.3-1
changelog:
  - update to 0.99.22.3
  - disable ospfapi and ospfclient
  - fix bogus dates in changelog
  - resolves : #984532


author: Michal Sekletar <msekleta@redhat.com> - 0.99.22.4-4
changelog:
  - fix link to upstream tarball (#1059219)
  - reference pidfiles of quagga daemons in service files (#842309)


author: Ondřej Lysoněk <olysonek@redhat.com> - 0.99.22.4-5
changelog:
  - Fixed CVE-2018-5379 - Double free vulnerability in bgpd when processing
    certain forms of UPDATE message allowing to crash or potentially execute
    arbitrary code
  - Resolves: rhbz#1546015


author: Petr Pisar <ppisar@redhat.com> - 1:4.01-4
changelog:
  - Do not fiddle with quota files on XFS and GFS (bug #846296)
  - Make sure option -d at quotacheck provides at least as much information as
    option -v (SF#3602777)


author: Petr Pisar <ppisar@redhat.com> - 1:4.01-6
changelog:
  - Add LGPLv2+ and GPLv2 to license declaration
  - Correct changelog dates
  - Package additional LDAP scripts as a documentation
  - Package XFS-specific tools


author: Petr Pisar <ppisar@redhat.com> - 1:4.01-9
changelog:
  - Move /sbin/* files under /usr (bug #983179)
  - Harden executables due to rpc.rquotad and quota_nld daemons (bug #983179)
  - Document quotagrpadmins(5), quotatab(5), warnquota.conf(5), rcp.rquota(8)
    (bug #983179)


author: Petr Pisar <ppisar@redhat.com> - 1:4.01-11.1
changelog:
  - Add rpc-rquotad.service file which was known as nfs-rquotad.service
    in nfs-utils (bug #1316440)
  - Add nfs-rquotad.service alias for backward compatibility (bug #1316440)
  - Start rpc-rquotad.service when starting nfs-server.service (bug #1316440)


author: Petr Pisar <ppisar@redhat.com> - 1:4.01-12
changelog:
  - Do not warn if rquotad RPC service is not registered (bug #1155584)
  - Query kernel for next quota on XFS or file system with hidden quota files
    (bug #1305968)
  - Add rpc-rquotad.service file which was known as nfs-rquotad.service
    in nfs-utils (bug #1207239)


author: Petr Pisar <ppisar@redhat.com> - 1:4.01-14
changelog:
  - Add nfs-rquotad.service alias for backward compatibility (bug #1207239)
  - Start rpc-rquotad.service when starting nfs-server.service (bug #1207239)


author: Petr Pisar <ppisar@redhat.com> - 1:4.01-18
changelog:
  - Distinguish between none quota limits and no allocated resources in quota(1)
    tool (bug #1601109)


author: Prarit Bhargava <prarit@redhat.com>
changelog:
  - Initial import from https://github.com/andikleen/mce-inject.git
  - Initial import from git://git.kernel.org/pub/scm/linux/kernel/git/gong.chen/aer-inject.git


author: Prarit Bhargava <prarit@redhat.com>
changelog:
  - Initial import from git://git.kernel.org/pub/scm/utils/cpu/mce/mce-test.git
  - updated mce-inject to commit 4cbe4632


author: Aristeu Rozanski <aris@redhat.com> 0.4.1-8.el7
changelog:
  - Revert patch in 0.4.1-7.el7, replaced by a better patch
  - Fix sizeof() usage on pointer [1035742]
  - Added macro to build the package with stack protector [1092558]
  - Handle failures of snprintf() [1035741]
  - Fix range checking on signed char variables [1035746]
  - Added aarch64 as architecture [1070973]
  - Start recording by default [1117366] [1117367]


author: William Roche <william.roche@oracle.com> 0.4.1-37.0.1.el7
changelog:
  - ipmitool to be used with AER on Ampere Altra platforms [Orabug: 32744936]
  - Add error handling for Ampere-specific errors. [Orabug: 32744936]
  - Add code to decode Ampere specific error
  - rasdaemon: fix memory leak in parse_ras_data
  - rasdaemon: Fix error print
  - rasdaemon: Modify non-standard error decoding interface using linked list
  - rasdaemon: add closure and cleanups for the database
  - rasdaemon: fix memory leak in ras-events.c:add_event_handler()
  - rasdaemon: fix missing fclose in ras-events.c:select_tracing_timestamp()
  - rasdaemon: update iteration logic for the non-standard error decoding functions
  - parse_ras_data: flush trace buffer immediately, not on next call
  - rasdaemon:print non-standard error data if not decoded
  - libtrace: Fix get_field_str() for dynamic strings
  - rasdaemon: use separate string array for error status
  - rasdaemon: fix PCIe AER error type


author: Honza Horak <hhorak@redhat.com> - 5.8.1-2
changelog:
  - Provides: bundled(gnulib) added, as per #821786
  - minor spec file clean up
  - install-info run in postin/postun


author: Jarod Wilson <jarod@redhat.com> 13-6
changelog:
  - Clean up htonll/ntohll handling for opa-ff/infiniband-diags compile
  - Add necessary Provides/Obsoletes for old -static packages
  - Remove ibverbs providers that we aren't currently able to support
  - Resolves: rhbz#1453096, rhbz#1451607


author: Jarod Wilson <jarod@redhat.com> 15-2
changelog:
  - Fix ibacm segfault and improper multicast handling
  - Resolves: rhbz#1502745
  - Resolves: rhbz#1502759


author: Honggang Li <honli@redhat.com> 15-3
changelog:
  - srp_daemon: Don't create async_ev_thread if only run once
  - srp_daemon: Remove unsupported systemd configurations
  - srp_daemon: Start srp_daemon service after network target
  - Resolves: bz1525193
  - Resolves: bz1528671


author: Jarod Wilson <jarod@redhat.com> 15-4
changelog:
  - Add support for extended join multicast API in librdmacm
  - Add support for striding RQ on mlx5
  - Resolves: rhbz#1515487, rhbz#1516571


author: Jarod Wilson <jarod@redhat.com> 15-5
changelog:
  - libmlx4: report RSS caps for improved DPDK support
  - Fix double mutex unlock in iwpmd
  - Resolves: rhbz#1527350
  - Resolves: rhbz#1542362


author: Jarod Wilson <jarod@redhat.com> 15-7
changelog:
  - i40iw: revoke systemd udev rules auto-load on i40e hardware, due to
    causing problems with suspend and resume, and fall back to load via
    systemd rdma initscript.
  - Resolves: rhbz#1568325


author: Jarod Wilson <jarod@redhat.com> 15-7
changelog:
  - i40iw: revoke systemd udev rules auto-load on i40e hardware, due to
    causing problems with suspend and resume, and fall back to load via
    systemd rdma initscript.
  - Resolves: rhbz#1561566


author: Jarod Wilson <jarod@redhat.com> 17.1-1
changelog:
  - Rebase to upstream rdma-core v17.1 stable release
  - No more libibcm or ib sysv initscripts
  - Resolves: rhbz#1515647
  - Resolves: rhbz#1517208
  - Resolves: rhbz#1523201
  - Resolves: rhbz#1541751


author: Jarod Wilson <jarod@redhat.com> 17.1-3
changelog:
  - Grab latest stable-v17 fixes from upstream
  - Fix Provides/Obsoletes on removed libibcm
  - Fix Provides/Obsoletes on removed libehca
  - Straighten out SW parsing feature support for DPDK
  - Fix mlx5 rate-limiting support
  - Resolves: rhbz#1588096
  - Resovles: rhbz#1534856
  - Resolves: rhbz#1589525


author: Jarod Wilson <jarod@redhat.com> 17.2-2
changelog:
  - Restore SysV Initscripts ib ifup and ifdown helpers
  - Adjust MTU limit for IPoIB in datagram mode via ifup-ib
  - Resolves: rhbz#1593426
  - Resolves: rhbz#1593334


author: Jarod Wilson <jarod@redhat.com> 22-1
changelog:
  - Rebase to upstream rdma-core v22
  - Resolves: rhbz#1641921
  - Add mlx5 IB Device Memory support (MEMIC)
  - Resolves: rhbz#1644697
  - Add mlx5 Tunnel protocol RX decap/encap offload
  - Resolves: rhbz#1644709
  - Add mlx5 Tunnel protocol TX decap/encap offload
  - Resolves: rhbz#1644778
  - Add support for mlx5 infiniband flow counters
  - Resolves: rhbz#1644714
  - Add mlx5 DEVX interface
  - Resolves: rhbz#1644722
  - Add libbnxt_re support for SRQ
  - Resolves: rhbz#1570393


author: Jarod Wilson <jarod@redhat.com> 22.1-1
changelog:
  - Update to upstream v22.1 release with stable-v22 branch fixes
  - Add support for Broadcom 57500 RoCE adapter
  - Resolves: rhbz#1678274


author: Jarod Wilson <jarod@redhat.com> 22.4-1
changelog:
  - Update to v22.4 stable release
  - Support mlx5 scatter to CQE over DCT QP
  - Fix ibacm segfault on non-IB hardware
  - Resolves: rhbz#1715489
  - Resolves: rhbz#1712296


author: Aron Silverton <aron.silverton@oracle.com> - 2.1.1-1
changelog:
  - rds-stress: Continue sending for other tasks when one task fails (Avinash Repaka) [Orabug: 23093216]
  - rds-stress: SW fence for RDMA Rd when HW fence is disabled (Shamir Rabinovitch) [Orabug: 27154692]


author: Aron Silverton <aron.silverton@oracle.com> - 0:2.1.1-2
changelog:
  - BUILDINFO: commit=80ba96d56f6c781132ddc53eeac974f08d9ff003
  - Add "vos" to RPM release number (Aron Silverton) [Orabug 28550856]


author: Stef Walter <stefw@redhat.com> - 0.14.3-1
changelog:
  - Update to upstream 0.14.3 point release
  - Populate LoginFormats correctly [#967011]
  - Documentation clarifications [#985773] [#967565]
  - Set sssd.conf default_shell per domain [#967569]
  - Notify in terminal output when installing packages [#984960]
  - If joined via adcli, delete computer with adcli too [#967008]
  - If input is not a tty, then read from stdin without getpass()
  - Configure pam_winbind.conf appropriately [#985819]
  - Refer to FreeIPA as IPA [#967019]
  - Support use of kerberos ccache to join when winbind [#985817]


author: Stef Walter <stefw@redhot.com> - 0.14.4-1
changelog:
  - Update to upstream 0.14.4 point release
  - Fix up the [sssd] section in sssd.conf if it's screwed up [#987491]
  - Add an --unattended argument to realm command line client [#976593]
  - Clearer 'realm permit' manual page example [#985800]


author: Stef Walter <stefw@redhat.com> - 0.14.5-1
changelog:
  - Update to upstream 0.14.5 point release
  - Fix regression conflicting --unattended and -U as in --user args [#996223]
  - Pass discovered server address to adcli tool [#996995]


author: Stef Walter <stefw@redhat.com> - 0.14.6-1
changelog:
  - Update to upstream 0.14.6 point release
  - Set 'kerberos method = system keytab' in smb.conf properly [#997580]
  - Limit Netbios name to 15 chars when joining AD domain [#1001667]


author: Stef Walter <stefw@redhat.com> - 0.14.6-5
changelog:
  - Don't crash when full_name_format is not in sssd.conf [#1051033]
    This is a regression from a prior update.


author: Sumit Bose <sbose@redhat.com> - 0.16.1-6
changelog:
  - Resolves: rhbz#1258745
  - Resolves: rhbz#1258488
  - Resolves: rhbz#1267563
  - Resolves: rhbz#1293390
  - Resolves: rhbz#1273924
  - Resolves: rhbz#1274368
  - Resolves: rhbz#1291924


author: Sumit Bose <sbose@redhat.com> - 0.16.1-10
changelog:
  Use current Samba options and read NetBIOS name from keytab
  - Resolves: rhbz#1484072
  - Resolves: rhbz#1370457


author: Sumit Bose <sbose@redhat.com> - 0.16.1-12
changelog:
  Fixes for RHEL-7.9
  - Resolves: rhbz#1625001
  - Resolves: rhbz#1625005
  - Resolves: rhbz#1638396
  - Resolves: rhbz#1714223
  - Resolves: rhbz#1832134


author: Stef Walter <stefw@redhat.com> - 0.16.0-1
changelog:
  - Updated to upstream 0.16.0
  - Resolves: rhbz#1174911
  - Resolves: rhbz#1142191
  - Resolves: rhbz#1142148


author: Petr Hracek <phracek@redhat.com> - 1.17.2-2
changelog:
  - rear does not require syslinux
  - changing to arch package so that syslinux is installed
  - Resolves: #1283927


author: Pavel Cahyna <pcahyna@redhat.com> - 2.00-4
changelog:
  - cd to the correct directory before md5sum to fix BACKUP_INTEGRITY_CHECK.
    Upstream PR#1685, bz1532676


author: Pavel Cahyna <pcahyna@redhat.com> - 2.00-5
changelog:
  - Ensure that NetBackup is started automatically upon recovery (PR#1544)
    Also do not kill daemons spawned by sysinit.service at the service's end
    (PR#1610, applies to NetBackup and also to dhclient)
    Resolves #1506231


author: Pavel Cahyna <pcahyna@redhat.com> - 2.00-6
changelog:
  - Ensure that NetBackup is started automatically upon recovery (PR#1544)
    Also do not kill daemons spawned by sysinit.service at the service's end
    (PR#1610, applies to NetBackup and also to dhclient)
    Resolves #1506231
  - Print a warning if grub2-mkimage is about to fail and suggest what to do.
    bz#1492177
  - Update the patch for #1388653 to the one actually merged upstream (PR1418)


author: Pavel Cahyna <pcahyna@redhat.com> - 2.00-7
changelog:
  - Backport upstream PR1383: Allow backup to be stored in ISO for ppc64/ppc64le
    Includes also commit 30099a98fdc1eab6373bc3682929bc4b9c09b54b.
    Resolves: #1596182


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-1
changelog:
  - Rebase to version 2.4, drop patches integrated upstream
    Resolves #1534646 #1484051 #1498828 #1571266 #1496518


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-3
changelog:
  - Backport fixes for upstream bugs 1974 and 1975
  - Apply upstream PR1954 (record permanent MAC address for bond members)
  - Apply upstream PR2004 (support for custom network interface naming)
  - Backport fix for upstream bug 1926 (support for LACP bonding and teaming)


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-7
changelog:
  - Backport fix for upstream bug 1913 (backup succeeds in case of tar error)
    Resolves: rhbz1631183
  - Apply upstream patch PR1885
    Partition information recorded is unexpected when disk has 4K block size
    Resolves: rhbz1610638
  - Apply upstream patch PR1887
    LPAR/PPC64 bootlist is incorrectly set when having multiple 'prep' partitions
    Resolves: rhbz1610647
  - Apply upstream patch PR1993
    Automatically exclude $BUILD_DIR from the backup
    Resolves: rhbz1655956
  - Require xorriso instead of genisoimage, it is now the preferred method
    and supports files over 4GB in size.
    Resolves: rhbz1462189


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-8
changelog:
  - Backport fix for upstream issue 2187 (disklayout.conf file contains
    duplicate lines, breaking recovery in migration mode or when
    thin pools are used). PR2194, 2196.
    Resolves: rhbz1732328


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-9
changelog:
  - Apply upstream PR2173 - Cannot restore using Bacula method
    due to "bconsole" not showing its prompt
    Resolves: rhbz1726982


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-10
changelog:
  - Apply upstream PR2122: add additional NBU library path to fix support for
    NetBackup 8.
    Resolves: rhbz1700807


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-11
changelog:
  - Apply upstream PR2122: add additional NBU library path to fix support for
    NetBackup 8.
    Resolves: rhbz1700807
  - Apply upstream PR212: Be safe against empty docker_root_dir (issue 1989)
    Resolves: rhbz1711123, where ReaR can not create a backup in rescue mode,
    because it thinks that the Docker daemon is running and hits the problem
    with empty docker_root_dir.
  - Apply upstream PR2223 and commit 36cf20e to avoid an empty string in the
    list of users to clone, which can lead to bash overflow with lots of users
    and groups per user and to wrong passwd/group files in the rescue system.
    Resolves: rhbz1692575
  - Backport of Upstream fix for issue 2035: /run is not mounted in the rescue
    chroot, which causes LVM to hang, especially if rebuilding initramfs.
    Resolves: rhbz1697815
  - Backport upstream PR 2218: avoid keeping build dir on errors
    by default when used noninteractively
    Resolves: rhbz1693608


author: Zoltan Kota <z.kota[AT]gmx.net> 3.6-29
changelog:
  - Fix build on x86_64. Run autoreconf to update config files.
    autoconf >= 2.64 needs to patch the flex.m4 file.
    Fixing FTBFS bug #564601.


author: Ondrej Vasik <ovasik@redhat.com> - 4.1-16
changelog:
  - add provides/obsoletes for redhat-lsb-compat to better
    deal with possible upgrade RHEL-6->RHEL-7 (#976792)


author: Ondrej Vasik <ovasik@redhat.com> - 4.1-18
changelog:
  - Require sil-abyssinica-fonts in supplemental(#994341)
  - Fully specify requirements on subpackages(#971386)


author: David Shea <dshea@redhat.com> - 0.8.9-1
changelog:
  - backup old product id certificates before installation of new ones (jdornak)
    Resolves: rhbz#1148783


author: David Vossel <dvossel@redhat.com> - 3.9.5-17
changelog:
  - Split send_ua utility out of IPv6addr.c source so it can be
    re-used in IPaddr2 without requiring cluster-glue.
  - Fixes issue with pgsql and SAPInstance not setting transient
    attributes correctly when local corosync node name is not
    equal to 'uname -n'
  - High: ocft: Fedora supported test cases

    Resolves: rhbz#917681


author: David Vossel <dvossel@redhat.com> - 3.9.5-18
changelog:
  - Remove support for (nginx, mysql-proxy, rsyslog). nginx and
    mysql-proxy are not a supported projects. Rsyslog is not an
    agent we will be supporting in an HA environment.

    Resolves: rhbz#917681


author: David Vossel <dvossel@redhat.com> - 3.9.5-20
changelog:
  - tomcat agent updates for pacemaker support
  - slapd agent updates for pacemaker support
  - Fixes missing etab file required for nfsserver

    Resolves: rhbz#1033016
    Resolves: rhbz#917681


author: David Vossel <dvossel@redhat.com> - 3.9.5-24
changelog:
  - Addition of the clvmd resource-agent
  - Support monitoring qemu based VirtualDomain resources without
    requiring libvirtd to be running.

    Resolves: rhbz#1064512
    Resolves: rhbz#1060367


author: David Vossel <dvossel@redhat.com> - 3.9.5-25
changelog:
  - Rename clvmd agent to clvm to avoid problems associated
    with having a resource-agent named the same exact name
    as the binary the agent manages.

    Resolves: rhbz#1064512


author: David Vossel <dvossel@redhat.com> - 3.9.5-26
changelog:
  - Handle monitor qemu based VirtualDomain resources without
    requiring libvirtd even if configuration file does not
    contain an 'emulator' value pointing to the emulator binary.

    Resolves: rhbz#1060367


author: David Vossel <dvossel@redhat.com> - 3.9.5-45
changelog:
  - Fix clvmd usage of daemon_options
  - Use better default nfsserver start timeouts
  - Make nfsserver preserve options in /etc/sysconfig/nfs
  - Add link_status_only option to ethmonitor agent
  - Add support for nginx agent
  - Add support for db2 agent
  - CTDB agent updates

    Resolves: rhbz#1171162
    Resolves: rhbz#1173193
    Resolves: rhbz#1182787
    Resolves: rhbz#1213971
    Resolves: rhbz#1183136
    Resolves: rhbz#1059988
    Resolves: rhbz#1077888


author: David Vossel <dvossel@redhat.com> - 3.9.5-46
changelog:
  - iface-vlan agent
  - Allow partial activation when physical volumes are missing.
  - Properly handle 'includes' during apache config parsing
  - Support for NovaCompute resource-agent

    Resolves: rhbz#1160365
    Resolves: rhbz#1214781
    Resolves: rhbz#1223615
    Resolves: rhbz#1214360


author: David Vossel <dvossel@redhat.com> - 3.9.5-47
changelog:
  - NovaCompute and NovaEvacuate updates
  - dhcpd chroot fix
  - redis 0byte error fix

    Resolves: rhbz#1214360
    Resolves: rhbz#1227293
    Resolves: rhbz#1231032


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-73
changelog:
  - portblock: fix tickle_tcp bug
  - nfsserver: use rpcpipefs_dir variable
  - mysql: use replication_port variable
  - oracle: inform user that monprofile must start with C## for
    container databases

    Resolves: rhbz#1337109
    Resolves: rhbz#1337615
    Resolves: rhbz#1337124
    Resolves: rhbz#1328386


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-78
changelog:
  - nfsserver: fix monitor issues causing NFS to start on
    "debug-monitor" and "resource cleanup"
  - nfsserver: remove "up to 10 tries" on start to avoid issues with
    some services taking longer to start
  - nfsserver: stop rpc-gssd to allow unmounting of "rpcpipefs_dir"

    Resolves: rhbz#1356866
    Resolves: rhbz#1126073
    Resolves: rhbz#1346733


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-81
changelog:
  - oracle: fix issue with C## in monprofile and inform user that
    monuser must start with C## as well for container databases

    Resolves: rhbz#1328386


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-82
changelog:
  - portblock: create tickle_dir if it doesn't exist
  - tomcat: use systemd if available

    Resolves: rhbz#1303037
    Resolves: rhbz#1249430


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-1
changelog:
  - rebase to v4.1.1
  - IPaddr2: add "monitor_retries" parameter

    Resolves: rhbz#1596139
    Resolves: rhbz#1484920


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-3
changelog:
  - gcp-vpc-move-vip: new resource agent for Google Cloud
  - vdo-vol: new resource agent
  - LVM-activate: fix issue with dashes
  - dont use attribute_target for metadata

    Resolves: rhbz#1568588
    Resolves: rhbz#1538689
    Resolves: rhbz#1513957
    Resolves: rhbz#1602783


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-8
changelog:
  - lvmlockd: add cmirrord support
  - LVM-activate: warn about incorrect vg_access_mode

    Resolves: rhbz#1606316
    Resolves: rhbz#1619428


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-10
changelog:
  - aws-vpc-move-ip: avoid false positive monitor result on initial probe
  - timeout/interval add "s"-suffix

    Resolves: rhbz#1624741
    Resolves: rhbz#1523318


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-12.5
changelog:
  - rabbitmq-cluster: get cluster status from mnesia during monitor
  - rabbitmq-cluster: fail monitor when node is in minority partition

    Resolves: rhbz#1641944
    Resolves: rhbz#1641946


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-12.10
changelog:
  - ocf_log: do not log debug messages when HA_debug unset
  - tomcat: use systemd when catalina.sh is unavailable

    Resolves: rhbz#1655655
    Resolves: rhbz#1646770


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-12.13
changelog:
  - aws-vpc-move-ip: use "--query" to avoid a possible race condition
  - aws-vpc-move-ip: add multi route-table support and fix issue
    w/multiple NICs

    Resolves: rhbz#1711165
    Resolves: rhbz#1711925


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-18
changelog:
  - SAPInstance: add reload-action
  - LVM-activate: support LVs from same VG
  - Remove grpc from bundle

    Resolves: rhbz#1642069
    Resolves: rhbz#1667413
    Resolves: rhbz#1683629


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-20
changelog:
  - IPsrcaddr: add proto and table parameters
  - iSCSILogicalUnit: only create iqn when it doesnt exist

    Resolves: rhbz#1504055
    Resolves: rhbz#1598969


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-22
changelog:
  - IPsrcaddr: make proto optional to fix regression when used without
    NetworkManager

    Resolves: rhbz#1504055


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-23
changelog:
  - aws-vpc-move-ip: add multi route-table support and fix issue
    w/multiple NICs

    Resolves: rhbz#1697558


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-30.1
changelog:
  - dhcpd: keep SELinux context in chroot
  - CTDB: add support for v4.9+

    Resolves: rhbz#1731426
    Resolves: rhbz#1731427


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-30.5
changelog:
  - exportfs: allow multiple exports with same fsid
  - rabbitmq-cluster: delete nodename when stop fails
  - oralsnr: allow using same tns_admin directory for listeners


    Resolves: rhbz#1803800
    Resolves: rhbz#1803798
    Resolves: rhbz#1803024


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-53
changelog:
  - redis: fix validate-all action and run it during start-action
  - ocf-shellfuncs: ocf_is_clone(): fix to return true when clone-max
    is set to 0
  - Filesystem: add symlink support
  - azure-events: new resource agent for Azure
  - pgsql: get correct status during start-action, and set initial
    score for primary and hot standby

    Resolves: rhbz#1792241
    Resolves: rhbz#1818035
    Resolves: rhbz#1624203
    Resolves: rhbz#1640575
    Resolves: rhbz#1744431


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-54
changelog:
  - aws-vpc-route53: new resource agent for AWS
  - aws-vpc-move-ip: add "routing_table_role" parameter
  - aws-vpc-move-ip: delete remaining route entries

    Resolves: rhbz#1759113
    Resolves: rhbz#1810466
    Resolves: rhbz#1828895


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-56
changelog:
  - sap-hana-scaleout: set default timeouts based on recommendations
    and a couple of bugfixes

    Resolves: rhbz#1829081


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-61.1
changelog:
  - gcp-vpc-move-vip: add support for multiple alias IPs
  - sybaseASE: run verify action during start action only
  - azure-events: handle exceptions in urlopen

    Resolves: rhbz#1846732
    Resolves: rhbz#1848673
    Resolves: rhbz#1862121


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-61.8
changelog:
  - gcp-vpc-move-route, gcp-vpc-move-vip: add project parameter and
    make vpc_network parameter optional

    Resolves: rhbz#1913936


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-61.13
changelog:
  - SAPHana: use actual_mode from global.ini and fallback to mode when
    it's not set

    Resolves: rhbz#1855888


author: Tom Lane <tgl@redhat.com> 9.0.0-1
changelog:
  - Update pg_filedump to version 9.0.0, to support PostgreSQL 9.0.
  - Relabel license as PostgreSQL now that that's separately recognized by OSI.


author: Tom Lane <tgl@redhat.com> 9.1.0-1
changelog:
  - Update pg_filedump to version 9.1.0, to support PostgreSQL 9.1.
  - Point to new upstream home at pgfoundry.org.


author: Gennadii Altukhov <galt@redhat.com> 2.0.2-16
changelog:
  - Resolves: #1415742 - rhn-search traceback - immediateTrigger-server exists
    with certain identification1415742 - rhn-search traceback - immediateTrigger-
    server exists with certain identification (eherget@redhat.com)


author: Tomas Lestach <tlestach@redhat.com> 2.0.2-17
changelog:
  - Reverts: bz 1415742 - rhn-search traceback - immediateTrigger-server exists with certain identification" (michael.mraka@redhat.com)


author: Tomas Kasparek <tkasparek@redhat.com> 2.0.2-18
changelog:
  - Resolves: #1430298 - rhnreg_ks man page missing documentation for some
    options (ogajduse@redhat.com)


author: Tomas Kasparek <tkasparek@redhat.com> 2.0.2-19
changelog:
  - Related: #1494389 - detect if action has been picked up for 2nd time
    (tkasparek@redhat.com)
  - Resolves: #1494389 - revert previous reboot loop changes
    (tkasparek@redhat.com)


author: Natalya Naumova <natalya.naumova@oracle.com> 2.0.2-24.0.1
changelog:
  - Fix Empty UUID Workaround
  - Obsolete subscription-manager-plugin-container and subscription-manager-initial-setup-addon
  - Updated public-yum-ol7.repo [ OraBug 26241827 ] (Keshav Sharma)
  - Missing fixes for bug 24659077 [OraBug 24659077]
  - Update ULN-CA-CERT [OraBug 24825502]
  - update public-yum-ol7.repo file [Orabug 24659077]
  - added ceph repository to public-yum-ol7.repo file [Orabug 24910502]
  - enable UEKR4 repository in public-yum-ol7.repo file [Orabug 25031255]
  - Replace Redhat string with ULN
  - do not move repo files [orabug 22230790]
  - added repo entry for 7.2  base  in public-yum repo file.
  - replace up2date.png in tarball [bug 20542844]
  - fix public-yum-ol7.repo [orabug 20281779]
  - fix indentation error in rhnreg_ks/ulnreg_ks [bug 20369398]
  - remove --use-eus-channel option from rhnreg_ks/ulnreg_ks [bug 20369398]
  - Enable rhnreg_ks register to spacewalk server, BZ14791
  - Fixes for RHEL-> ULN Migration
  - Fixed public-yum-ol7.repo file [OraBug 19176214]
  - Added 7.1 entries to public-yum-ol7.repo file [OraBug 20281779]
  - Merge ksplice firstboot plugin from 1.0.0.1-17.0.3.el6
  - Fixed text in rh_register.glade [Orabug 19192726] (Keshav Sharma)
  - Fixed error text in rhnregGui.py [Orabug 19167535] (Keshav Sharma)
  - Added MySQL repositories to public-yum-ol7.repo file. (Keshav Sharma)
  - Fix text in up2date.config file [Orabug 18892489] (Keshav Sharma)
  - Fix url in public-yum.ol7.repo file (Keshav Sharma)
  - Fix firstboot issue [Orabug 18851116] (Keshav Sharma)
  - Fix display text [Orabug 19051197] (Keshav Sharma)
  - Fix public-yum.repo file [Orabug 18380583] (Keshav Sharma)
  - Fix bug 18910928 (Leon Wang)
  - Add ULN-specific changes (Jared Greenwald)
  - Updated public-yum-ol7.repo [Orabug 27696955]
  - Updated public-yum-ol7.repo file for aarch64 [OraBug 27029619] (keshav.sharma@oracle.com)
  - Updated public-yum-ol7.repo
  - Updated public-yum-ol7.repo [Orabug 28375712]
  - Updated replacement ULN-CA-CERT
  - updated public-yum-ol7.repo for 7.6 beta [Orabug 28624952]
  - updated public-yum-ol7.repo for 7.6


author: Jan Pazdziora 5.0.7-1
changelog:
  - Only run chkconfig if we are in the SysV world.
  - rhnsd needs to be marked as forking.
  - When talking to systemctl, we need to say .service.


author: Milan Zazrivec <mzazrivec@redhat.com> 5.0.9-1
changelog:
  - Update .po and .pot files for rhnsd.
  - New translations from Transifex for rhnsd.
  - Download translations from Transifex for rhnsd.


author: Michael Mraka <michael.mraka@redhat.com> 5.0.10-1
changelog:
  - let rhnsd.service be enabled after installation
  - Purging %changelog entries preceding Spacewalk 1.0, in active packages.


author: Grant Gainey 5.0.13-5
changelog:
  - Bump release to get past weirdness in brew-tags (ggainey@redhat.com)
  - Related: #1138939 - up2date and systemid files are managed by rhnsd itself,
    no need to break init script if they do not exist (jdobes@redhat.com)
  - Related: #1092518 - PIE+RELRO for rhnsd (mkollar@redhat.com)
  - Revert changes in order to clean up tagging issues with brew
    (ggainey@redhat.com)
  - Automatic commit of package [rhnsd] minor release [5.0.13-4-el7].
    (ggainey@redhat.com)
  - Bump release to get past weirdness in brew-tags (ggainey@redhat.com)
  - Automatic commit of package [rhnsd] minor release [5.0.13-2-el7].
    (ggainey@redhat.com)
  - Resolves: #1138939 - up2date and systemid files are managed by rhnsd itself,
    no need to break init script if they do not exist (jdobes@redhat.com)
  - Resolves: #1092518 - PIE+RELRO for rhnsd (mkollar@redhat.com)


author: Gennadii Altukhov <galt@redhat.com> 5.0.13-6
changelog:
  - 1409562 - RHEL7 rhnsd reload doesn't work (jdostal@redhat.com)
  - 1409562 - Reboot loop - rhn_check, rhnsd (jdostal@redhat.com)


author: Tomas Kasparek <tkasparek@redhat.com> 5.0.13-7.2
changelog:
  - Resolves: #1506911 - close and reopen syslog when redirecting child output
    (martin.matuska@axelspringer.de)


author: Than Ngo <than@redhat.com> - 3.11-1
changelog:
  - 3.11
  - bz#540763, add IP allocation by pppd ability to pppoe-server
  - bz#808676, add missing % symbol for triggerun


author: Steve Dickson <steved@redhat.com> - 0.2.0-18
changelog:
  - Fixed typo causing rpcbind to run as root (bz 734598)
  - Added /etc/sysconfig/rpcbind config file (bz 861025)


author: Steve Dickson <steved@redhat.com> - 0.2.0-25
changelog:
  - Fixed some warnings in in6_fillscopeid() (bz 884165)
  - Fixed typo in rpcinfo manpage (bz 963512)
  - Removed unnecessary targets from rpcbind.service  (bz 1036791)


author: Steve Dickson <steved@redhat.com> - 0.2.0-27
changelog:
  - Add nss-altfiles to rpcbind user lookup path (bz 1171291)
  - Add support for systemd socket activation (bz 1203820)
  - Added a tmpfiles.d configuration (bz 1181779)
  - Shutdown cleanly (bz 1174653)


author: Steve Dickson <steved@redhat.com> - 0.2.0-29
changelog:
  - Change RPCBDIR to be /run since that will exist after a
    reboot and bindings wil be perserved during upgrades
    but not reboots. (bz 1240817)


author: Steve Dickson <steved@redhat.com> - 0.2.0-35
changelog:
  - Restart rpcbind.socket on restarts (bz 1303751)
  - Added localhost:111 to rpcbind socket activation (bz 1293430)
  - Soft static allocate rpc uid/gid (bz 1321279)


author: Steve Dickson <steved@redhat.com> - 0.2.0-39
changelog:
  - Added libtirpc dependency (bz 1396291)
  - Removed xlog warning (bz 1377531)
  - Removed an 'i' warning (bz 1377560)


author: Panu Matilainen <pmatilai@redhat.com> - 4.11.1-7
changelog:
  - Fix relocation regression wrt unowned directories (#1001553)
  - Fix build-time double-free wrt %caps() on wildcard file entry (#1002089)
  - Fix source URL in spec


author: Panu Matilainen <pmatilai@redhat.com> - 4.11.1-8
changelog:
  - Fix segfault on empty -p <lua> scriptlet body (#1004062)
  - Add missing dependency on tar to rpm-build (#986539)


author: Florian Festi <ffesti@redhat.com> - 4.11.1-9
changelog:
  - Fix byteorder for 64 bit tags on big endian machines (#1012946)
   - Better RPMSIGTAG_SIZE vs PMSIGTAG_LONGSIZE detection (#1012595)


author: Florian Festi <ffesti@redhat.com> - 4.11.1-17
changelog:
  - Fix race condidition where unchecked data is exposed in the file system
    (#1163060)
  - Fixes CVE-2013-6435


author: Florian Festi <ffesti@redhat.com> - 4.11.3-14
changelog:
  - Enable plugin system but disable collection plugins. Needed for
    systemd-inhibit plugin (#1160401)
  - Move systemd-inhibit plugin into its own sub packge


author: Florian Festi <ffesti@redhat.com> - 4.11.3-18
changelog:
  - Fixed failing upstream test 257 on big endian systems (#1264463)
  - Fixed problems with perl.req script (#1320214, #1275551)
  - Fixed race condition in rpm file deployment when updating an existing file
    (#1320181)
  - Move bdb warnings from stdin to stdout (#1297793)
  - Add --justdb to the erase section of the man page, too (#1310561)
  - Backport support for multi threaded xz compression (#1278924)
  - Update config.guess (#1291377)
  - Add --noplugins option (#1264031)
  - Overwrite a file if it is not marked as config any more (#1290463)
  - Add man page for systemd-inhibit plugin (#1265578)


author: Florian Festi <ffesti@redhat.com> - 4.11.3-28
changelog:
  - Make sure files in /usr/src/debug are not world writable (RHBZ #1441098)
  - Increase maximal header size (RHBZ #1434656)
  - Increase buffer to be able to render Korean dates (RHBZ #1425231)
  - Add --noconfig option (RHBZ #1406611)


author: Panu Matilainen <pmatilai@redhat.com> - 4.11.3-31
changelog:
  - Backport missing infra for --noconfig option (#1406611)
  - As a side-effect, this also makes --noghost work as intended


author: Pavlina Moravcova Varekova <pmoravco@redhat.com> - 4.11.3-33
changelog:
  - Repair of --noghost option implementation (#1395818)
  - Backport fix rpmSign() return value in case of failure (#1419590)
  - Backport passing _find_debuginfo_opts -g to eu-strip for executables
    (#1540653)


author: Pavlina Moravcova Varekova <pmoravco@redhat.com> - 4.11.3-34
changelog:
  - Adjust --noghost documentation (#1395818)
  - Provide audit events on update verification (#1555326)


author: Pavlina Moravcova Varekova <pmoravco@redhat.com> - 4.11.3-36
changelog:
  - Add popt-based options --setcaps and --restore (#1550745)
  - Improve hardlink handling in disk space calculation (#1491786)
  - Remove perl dependencies that are provided in the same file (#1570181)


author: Jaroslav Škarvada <jskarvad@redhat.com> - 1.4.8-1
changelog:
  - New version
    Resolves: rhbz#966639
  - Updated and defuzzified patches
  - Still use lua-5.1 (fedoras < f20)


author: Michal Sekletar <msekleta@redhat.com> - 0.17-71
changelog:
  - resolves: RHBZ #737244 #896583 #947213
  - migrate from xinetd to systemd configuration
  - close pam session correctly when client does not ask for separate error channel
  - fix pty handling which was broken by changes in /bin/login


author: Michal Sekletar <msekleta@redhat.com> - 0.17-72
changelog:
  - unit files must not be marked as config files
  - fix handling of non-native IPv6 connections via AF_INET6 socket


author: Michal Ruprich <mruprich@redhat.com> - 0.17-78
changelog:
  - Resolves: #1502657 - Copying remote file to local dir fails with "rcp: protocol screwup: expected control record"
  - Resolves: #1338037 - rsh/rlogin sessions ignore SIGPIPE due to systemd
  - Resolves: #1477207 - rlogin killed when changing run level
  - Resolves: #1503112 - rexecd Could not allocate space for cmdbuf
  - Resolves: #1505226 - have a proposed patch for rsh-0.17-76.el7_1.1


author: Pavel Šimerda <psimerda@redhat.com> - 3.0.9-14
changelog:
  - Resolves: #1052814 - rsync command is terminated with SIGSEGV
  - Resolves: #1052814 - add missing patch file


author: Luboš Uhliarik <luhliari@redhat.com> - 3.0.9-17
changelog:
  - Resolves: #1082496 - socket activation for rsync doesn't work (added missing
    rsyncd@.service file)


author: Michal Ruprich - 3.1.2-4
changelog:
  - Related: #1432899 - removing dependencies on perl
  - using the bundled zlib.h(#1491582)
  - turning on upstream tests


author: Tomas Heinrich <theinric@redhat.com> 7.4.7-5
changelog:
  - move the rscryutil man page to the crypto subpackage
    resolves: #1056565
  - add a patch to prevent message loss in imjournal
    rsyslog-7.4.7-bz1038136-imjournal-message-loss.patch
    resolves: #1038136


author: Tomas Heinrich <theinric@redhat.com> 7.4.7-6
changelog:
  - disable the imklog plugin by default
    the patch for rhbz#1038136 caused duplication of kernel messages since the
    messages read by the imklog plugin were now also pulled in from journald
    resolves: #1078654


author: Tomas Heinrich <theinric@redhat.com> 7.4.7-8
changelog:
  - modify the service file to automatically restart rsyslog on failure
    resolves: rhbz#1061322
  - add explicitly versioned dependencies on libraries which do not have
    correctly versioned sonames
    resolves: rhbz#1107839
  - make logrotate tolerate missing log files
    resolves: rhbz#1144465
  - backport the mmcount plugin
    resolves: rhbz#1151037
  - set the default service umask to 0066
    resolves: rhbz#1228192
  - add a patch to make imjournal sanitize messages as imuxsock does it
    resolves: rhbz#743890
  - add a patch to fix a bug preventing certain imuxsock directives from
    taking effect
    resolves: rhbz#1184410
  - add a patch to fix a race condition in directory creation
    resolves: rhbz#1202489


author: Tomas Heinrich <theinric@redhat.com> 7.4.7-9
changelog:
  - update the patch fixing a race condition in directory creation
    resolves: rhbz#1202489
  - improve provided documentation
    - move documentation from all subpackages under a single directory
    - add missing images
    - remove doc files without content
    - add a patch making various corrections to the HTML documentation
    resolves: rhbz#1238713
  - add a patch to prevent division-by-zero errors
    resolves: rhbz#1078878
  - add a patch to clarify usage of the SysSock.Use option
    resolves: rhbz#1143846
  - add a patch to support arbitrary number of listeners in imuxsock
    - drop patch for rhbz#1053669 as it has been merged into this one
    resolves: rhbz#1151041


author: Tomas Heinrich <theinric@redhat.com> 7.4.7-10
changelog:
  - add a patch to prevent field truncation in imjournal
    resolves: rhbz#1101602
  - add a patch to enable setting a default TAG
    resolves: rhbz#1188503
  - add a patch to fix a nonfunction hostname setting in imuxsock
    resolves: rhbz#1184402


author: Radovan Sroka <rsroka@redhat.com> 7.4.7-11
changelog:
  - add patch that resolves config.guess system-recognition on ppc64le architecture
    resolves: rhbz:1254511


author: Tomas Heinrich <theinric@redhat.com> 7.4.7-3
changelog:
  - replace rsyslog-7.3.15-imuxsock-warning.patch
    with rsyslog-7.4.7-bz1053669-imuxsock-wrn.patch
    resolves: #1053669
  - add rsyslog-7.4.7-bz1052266-dont-link-libee.patch to prevent
    linking the main binary with libee
    resolves: #1052266
  - add rsyslog-7.4.7-bz1054171-omjournal-warning.patch to fix
    a condition for issuing a warning in omjournal
    resolves: #1054171
  - drop the "v5" string from the conf file as it's misleading
    resolves: #1040036


author: Tomas Heinrich <theinric@redhat.com> 7.4.7-13
changelog:
  - add a patch to prevent crashes when using multiple rulesets
    resolves: rhbz#1224336
  - add a patch to keep the imjournal state file updated
    resolves: rhbz#1216957
  - add a patch to fix an undefined behavior caused by the maxMessageSize directive
    resolves: rhbz#1214257
  - add a patch to prevent crashes when using rulesets with a parser
    resolves: rhbz#1282687


author: Tomas Heinrich <theinric@redhat.com> 7.4.7-14
changelog:
  - add a patch to prevent loss of partial messages
    resolves: rhbz#1312459
  - add a patch to allow multiple rulesets in imrelp
    resolves: rhbz#1223566
  - add a patch to fix a race condition during shutdown
    resolves: rhbz#1295798
  - add a patch to backport the mmutf8fix plugin
    resolves: rhbz#1146237
  - add a patch to order service startup after the network
    resolves: rhbz#1263853


author: Tomas Heinrich <theinric@redhat.com> 7.4.7-15
changelog:
  - add a patch to make state file handling in imjournal more robust
    resolves: rhbz#1245194
  - add a patch to support wildcards in imfile
    resolves: rhbz#1303617


author: Tomas Heinrich <theinric@redhat.com> 7.4.7-1
changelog:
  - rebase to 7.4.7
    add requirement on libestr >= 0.1.9
    resolves: #836485
    resolves: #1020854
    resolves: #1040036
  - drop patch 4; not needed anymore
    rsyslog-7.4.2-imuxsock-rfc3339.patch
  - install the rsyslog-recover-qi.pl tool
  - fix a typo in a package description
  - add missing defattr directives
  - add a patch to remove references to Google ads in the html docs
    rsyslog-7.4.7-bz1030044-remove-ads.patch
    Resolves: #1030043
  - add a patch to allow numeric specification of UIDs/GUIDs
    rsyslog-7.4.7-numeric-uid.patch
    resolves: #1032198
  - change the installation prefix to "/usr"
    resolves: #1032223
  - fix a bad date in the changelog
    resolves: #1043622
  - resolve a build issue with missing mysql_config by adding
    additional BuildRequires for the mysql package
  - add a patch to resolve build issue on ppc
    rsyslog-7.4.7-omelasticsearch-atomic-inst.patch


author: Radovan Sroka <rsroka@redhat.com> - 8.24.0-8
changelog:
  RHEL 7.4 ERRATUM
  - added dependency automake autoconf libtool due to yum-builddep
  - reenable omruleset module
    resolves: rhbz#1431615
    resolves: rhbz#1428403
    resolves: rhbz#1427821(fix regression, failed QA)
    resolves: rhbz#1432069
  - resolves: rhbz#1165236
    resolves: rhbz#1419228
    resolves: rhbz#1431616 
    resolves: rhbz#1196230(failed QA)


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-9
changelog:
  RHEL 7.4 ERRATUM
  - added autoreconf call
  - added patch to replace gethostbyname with getaddrinfo call
    resolves: rhbz#1056548(failed QA)


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-10
changelog:
  RHEL 7.4 ERRATUM
  - edited patches Patch19 and Patch21
    resolves: rhbz#1419228(coverity scan problems)
    resolves: rhbz#1056548(failed QA, coverity scan problems)


author: Radovan Sroka <rsroka@redhat.com> - 8.24.0-11
changelog:
  RHEL 7.4 ERRATUM
  - added new patch that backports num2ipv4 due to rhbz#1427821
    resolves: rhbz#1427821
  - enable pmrfc3164sd module
    resolves: rhbz#1431616


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-13
changelog:
  RHEL 7.5 ERRATUM
  - added patch to properly resolve FQDN
    resolves: rhbz#1401456
  - added documentation patch correcting qeues default values
    resolves: rhbz#1459896
  - added patch adjusting log level of journal reloaded msg
    resolves: rhbz#1497985 
  - added patch to prevent crash with invalid set statement
    this also obsoletes patch2 (for 1188503) 
    resolves: rhbz#1462160
  - added patch with nullptr check to prevent ABRT
    resolves: rhbz#1488186


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-14
changelog:
  RHEL 7.5 ERRATUM
  - renamed patch for undocumented recover_qi script to correct bz number
    resolves: rhbz#1507028
  - added patch ensuring relp conneciton is active before closing it
    resolves: rhbz#1505103


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-15
changelog:
  RHEL 7.5 ERRATUM
  - made rsyslog-doc noarch and fixed search on doc regeneration
    resolves: rhbz#1507028


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-16
changelog:
  RHEL 7.5 ERRATUM
  - edited the patch to conform to latest upstream doc
    resolves: rhbz#1459896 (failedQA)
  - disabled 32-bit builds on all arches as they are not shipped
    anymore in RHEL7


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-16.5
changelog:
  RHEL 7.5.z ERRATUM
  - fixed imjournal duplicating msgs under some conditions
    resolves: rhbz#1545582


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-24
changelog:
  RHEL 7.6 ERRATUM
  - updated imfile rewrite patch with fixes from covscan
    resolves: rhbz#1531295
  - updated mmkubernetes patch with fixes from covscan
    resolves: rhbz#1539193
  - updated imjournal duplicates patch with fixes from covscan
    resolves: rhbz#1538372
  - updated omelastic enhancement patch with fixes from covscan
    resolves: rhbz#1565214


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-26
changelog:
  RHEL 7.6 ERRATUM
  - updated imfile rewrite patch according to early testing
    resolves: rhbz#1531295
  - added patch fixing pid file name in manpage
    resolves: rhbz#1597264
  - updated json-parsing patch with one more bugfix
    resolves: rhbz#1565219


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-27
changelog:
  RHEL 7.6 ERRATUM
  - updated imfile rewrite patch fixing last update regressions
    resolves: rhbz#1531295
  - added patch fixing deadlock in async logging
    resolves: rhbz#1559408
  - added patch fixing NULL access in worktable create
    resolves: rhbz#1600462
  - now putting release number into configure to have it present
    in error messages


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-28
changelog:
  RHEL 7.6 ERRATUM
  - updated imfile rewrite patch fixing next round of regressions
    resolves: rhbz#1531295
    resolves: rhbz#1602156
  - updated mmkubernetes patch with NULL ret-check
    resolves: rhbz#1539193


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-30
changelog:
  RHEL 7.6 ERRATUM
  - updated imfile rewrite patch with next bugfix
    resolves: rhbz#1531295
  - updated imjournal duplicates patch making slower code optional
    and added corresponding doc patch
    resolves: rhbz#1538372


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-31
changelog:
  RHEL 7.6 ERRATUM
  - added new patch fixing ompipe dropping messages when pipe full
    resolves: rhbz#1591819
  - updated mmkubernetes patch to accept non-kubernetes containers
    resolves: rhbz#1539193
    resolves: rhbz#1609023
  - removed json-parsing patches as the bug is now fixed in liblognorm


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-32
changelog:
  RHEL 7.6 ERRATUM
  - updated imfile rewrite patch with no log on EACCES
    resolves: rhbz#1531295
  - removed now needless build-deps


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-33
changelog:
  RHEL 7.6 ERRATUM
  - updated imfile rewrite patch with extended symlink watching
    resolves: rhbz#1531295
  - updated mmkubernetes patch to accept dots in pod name
    resolves: rhbz#1539193


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-35
changelog:
  RHEL 7.7 ERRATUM
  - added patch fixing memory corruption in omfwd module
    resolves: rhbz#1632659
  - added patch fixing imfile sopping monitor after rotation
    resolves: rhbz#1649250
  - added patch addressing imptcp CVE-2018-16881
    resolves: rhbz#1658288


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-36
changelog:
  RHEL 7.7 ERRATUM
  - added patch fixing mmkubernetes halt after pod deletition
    resolves: rhbz#1622767


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-37
changelog:
  RHEL 7.7 ERRATUM
  - edited patch fixing mmkubernetes halt after pod deletition
    (covscan found an issue in previous version)
    resolves: rhbz#1622767
  - added patch stopping flooding logs with journald errors
    resolves: rhbz#1632211
  - added patch stopping flooding logs with symlink false-positives
    resolves: rhbz#1685901
  - added patch stopping memory leak when processing internal msgs
    resolves: rhbz#1666365
  - added documentation patch with info about CRI-O to mmkubernetes
    resolves: rhbz#1625935


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-38
changelog:
  RHEL 7.7 ERRATUM
  - added patch increasing max path size preventing buffer overflow
    with too long paths
    resolves: rhbz#1656860


author: EL Errata <el-errata_ww@oracle.com> - 8.24.0-38.0.2
changelog:
  - Newer gcc complains about implicit declaration of prctl. Added header file to quiesce the compiler


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-41.1
changelog:
  RHEL 7.7.z ERRATUM
  - added patch resolving possible segfault in core-ratelimiter
    resolves: rhbz#1746497


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-41.2
changelog:
  RHEL 7.7.z ERRATUM
  - edited imjournal memleaks patch to fix introduced regression
    resolves: rhbz#1752424


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-41.3
changelog:
  RHEL 7.7.z ERRATUM
  - added patch fixing hash file_id feature to properly monitor files
    after rotation
    resolves: rhbz#1805675


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-41.4
changelog:
  RHEL 7.7.z ERRATUM
  - edited patch fixing hashed file_ids for imfile statefiles
    resolves: rhbz#1805675


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-41
changelog:
  RHEL 7.8 ERRATUM
  - added patch and doc-patch with new "fsync" imjournal option
    resolves: rhbz#1696686
  - added patch resolving omelasticsearch crash on "nothing" reply
    resolves: rhbz#1684236


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-44
changelog:
  RHEL 7.8 ERRATUM
  - added patch and doc-patch for new caseSensitive imUDP/TCP option
    resolves: rhbz#1309698


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-46
changelog:
  RHEL 7.8 ERRATUM
  - Support Intermediate Certificate Chains in rsyslog
    resolves: rhbz#1627799
  - fixed WorAroundJournalBug patch to not cause leaks
    resolves: rhbz#1744617
  - added patch fixing possible segfault in rate-limiter
    resolves: rhbz#1744682


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-47
changelog:
  RHEL 7.8 ERRATUM
  - edited imfile truncation detection patch with reression fix
    resolves: rhbz#1744856


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-48
changelog:
  RHEL 7.8 ERRATUM
  - added patch resolving crash on wrong MsgProperty
    resolves: rhbz#1549706
  - added patch resolving CVE in pmaixforward module
    resolves: rhbz#1768320
  - added patch resolving CVE in pmcisconames module
    resolves: rhbz#1768323
  - added patch implementing file ID for imfile
    resolves: rhbz#1763746
  - added patch fixing omelasticsearch with ES 6.X
    resolves: rhbz#1600171


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-49
changelog:
  RHEL 7.8 ERRATUM
  - fixed fsync patch to actually revognize the new option
    resolves: rhbz#1696686 (failedQA)


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-52
changelog:
  RHEL 7.8 ERRATUM
  - edited patch file ID for imfile to not log useless errors
    also improved file-id behavior to adress newly found problems
    resolves: rhbz#1763746


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-53
changelog:
  RHEL 7.9 ERRATUM
  - one more fix for file ID patch to extend to offline behavior
    resolves: rhbz#1806493
  - added patch resoving race in serialization resulting in crash
    resolves: rhbz#1778841


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-55
changelog:
  RHEL 7.9 ERRATUM
  - edited imfile file-id patch to not segfault on selinux block
    resolves: rhbz#1843992


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-57
changelog:
  RHEL 7.9 ERRATUM
  - added patch resolving buffer overflows in select() function
    resolves: rhbz#1858297


author: Tianyue Lan <tianyue.lan@oracle.com> - 8.24.0-57.0.1.el7_9.1
changelog:
  - added patch to flush the journal state file [Orabug: 32583987] (venu.busireddy@oracle.com)
  - Reviewed-by: Laurence Rochfort <laurence.rochfort@oracle.com>


author: EL Errata <el-errata_ww@oracle.com> - 8.24.0-57.0.4.el7_9.1
changelog:
  - Newer gcc complains about implicit declaration of prctl. Added header file to quiesce the compiler
  - added patch to flush the journal state file [Orabug: 32583987] (venu.busireddy@oracle.com)
  - Reviewed-by: Laurence Rochfort <laurence.rochfort@oracle.com>


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.247-13
changelog:
  - Fixes multilib conlicts of .gemspec files.
  - Make symlinks for psych gem to ruby stdlib dirs (rhbz#979133).
  - Use system-wide cert.pem.


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.247-14
changelog:
  - Add forgotten psych.rb link into rubygem-psych to fix "private method `load'
    called for Psych:Moduler" error (rhbz#979133).


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.247-15
changelog:
  - Fix version regex algorithmic complexity vulnerability (CVE-2013-4287).
    - Resolves: rhbz#1006429


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.247-16
changelog:
  - Fix version regex algorithmic complexity vulnerability (CVE for incomplete
    fix for CVE-2013-4287) (CVE-2013-4363).
    - Related: rhbz#1006429


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.247-17
changelog:
  - Heap overflow in floating point parsing (CVE-2013-4164).
    * ruby-2.0.0-p353-CVE-2013-4164-ignore-too-long-fraction-part.patch
    - Resolves: rhbz#1033503
  - Allow MD5 in OpenSSL tests.


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.247-18
changelog:
  - Fix FTBFS due to expired certificate for IMAP test case.
  - Fix test_aes_gcm_wrong_tag random failures.
    - Resolves: rhbz#1048899


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.353-21
changelog:
  - Fix off-by-one stack-based buffer overflow in the encodes() function
    (CVE-2014-4975)
    Resolves: rhbz#1163998


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.353-22
changelog:
  - Fix REXML billion laughs attack via parameter entity expansion
    (CVE-2014-8080).
    Resolves: rhbz#1163998
  - REXML incomplete fix for CVE-2014-8080 (CVE-2014-8090).
    Resolves: rhbz#1163998


