# changelog

author: Alasdair Kergon <agk@redhat.com> - 2.02.33-9
changelog:
  - Improve internal label caching performance while locks are held.
  - Fix mirror log name construction during lvconvert.


author: Alasdair Kergon <agk@redhat.com> - 2.02.32-8
changelog:
  - Fix pvs, vgs, lvs error exit status on some error paths.
  - Fix new parameter validation in vgsplit and test mode.
  - Fix internal metadata corruption in lvchange --resync.


author: Alasdair Kergon <agk@redhat.com> - 2.02.31-7
changelog:
  - Avoid readahead error message when using default setting of lvcreate -M1.
  - Fix lvcreate --nosync not to wait for non-happening sync.
  - Add very_verbose lvconvert messages.


author: Alasdair Kergon <agk@redhat.com> - 2.02.30-6
changelog:
  - Remove static libraries and binaries and move most binaries out of /usr.
  - Fix a segfault if using pvs with --all argument.
  - Fix vgreduce PV list processing not to process every PV in the VG.
  - Reinstate VG extent size and stripe size defaults (halved).
  - Set default readahead to twice maximium stripe size.
  - Detect non-orphans without MDAs correctly.
  - Prevent pvcreate from overwriting MDA-less PVs belonging to active VGs.
  - Don't use block_on_error with mirror targets version 1.12 and above.
  - Change vgsplit -l (for unimplemented --list) into --maxlogicalvolumes.
  - Update vgsplit to accept vgcreate options when new VG is destination.
  - Update vgsplit to accept existing VG as destination.
  - Major restructuring of pvmove and lvconvert code, adding stacking support.
  - Add new convert_lv field to lvs output.
  - Permit LV segment fields with PV segment reports.
  - Extend lvconvert to use polldaemon and wait for completion of initial sync.
  - Add seg_start_pe and seg_pe_ranges to reports.
  - Add fsadm interface to filesystem resizing tools.
  - Update --uuid argument description in man pages.
  - Print warning when lvm tools are running as non-root.


author: Alasdair Kergon <agk@redhat.com> - 2.02.29-1
changelog:
  - Make clvmd backup vg metadata on remote nodes.
  - Decode cluster locking state in log message.
  - Change file locking state messages from debug to very verbose.
  - Fix --addtag to drop @ prefix from name.
  - Stop clvmd going haywire if a pre_function fails.
  - Avoid nested vg_reads when processing PVs in VGs and fix associated locking.
  - Attempt to remove incomplete LVs with lvcreate zeroing/activation problems.
  - Add full read_ahead support.
  - Add lv_read_ahead and lv_kernel_read_ahead fields to reports and lvdisplay.
  - Prevent lvconvert -s from using same LV as origin and snapshot.
  - Fix human-readable output of odd numbers of sectors.
  - Add pv_mda_free and vg_mda_free fields to reports for raw text format.
  - Add LVM2 version to 'Generated by' comment in metadata.
  - Show 'not usable' space when PV is too large for device in pvdisplay.
  - Ignore and fix up any excessive device size found in metadata.
  - Fix error message when fixing up PV size in lvm2 metadata (2.02.11).
  - Fix orphan-related locking in pvdisplay and pvs.
  - Fix missing VG unlocks in some pvchange error paths.
  - Add some missing validation of VG names.
  - Detect md superblocks version 1.0, 1.1 and 1.2.
  - Add some pv-related error paths.
  - Handle future sysfs subsystem/block/devices directory structure.
  - Fix a bug in lvm_dump.sh checks for lvm/dmsetup binaries.
  - Fix underquotations in lvm_dump.sh.
  - Print --help output to stdout, not stderr.
  - After a cmdline processing error, don't print help text but suggest --help.
  - Add %PVS extents option to lvresize, lvextend, and lvcreate.
  - Remove no-longer-correct restrictions on PV arg count with stripes/mirrors.
  - Fix strdup memory leak in str_list_dup().
  - Link with -lpthread when static SELinux libraries require that.
  - Detect command line PE values that exceed their 32-bit range.
  - Include strerror string in dev_open_flags' stat failure message.
  - Avoid error when --corelog is provided without --mirrorlog. (2.02.28)
  - Correct --mirrorlog argument name in man pages (not --log).
  - Clear MIRROR_NOTSYNCED LV flag when converting from mirror to linear.
  - Modify lvremove to prompt for removal if LV active on other cluster nodes.
  - Add '-f' to vgremove to force removal of VG even if LVs exist.


author: Alasdair Kergon <agk@redhat.com> - 2.02.28-1
changelog:
  - vgscan and pvscan now trigger clvmd -R, which should now work.
  - Fix clvmd logging so you can get lvm-level debugging out of it.
  - Allow clvmd debug to be turned on in a running daemon using clvmd -d [-C].
  - Add more cluster info to lvmdump.
  - Fix lvdisplay man page to say LV size is reported in sectors, not KB.
  - Fix loading of persistent cache if cache_dir is used.
  - Only permit --force, --verbose and --debug arguments to be repeated.
  - Add support for renaming mirrored LVs.
  - Add --mirrorlog argument to specify log type for mirrors.
  - Don't leak a file descriptor if flock or fcntl fails.
  - Detect stream write failure reliably.
  - Reduce severity of lstat error messages to very_verbose.
  - Update to use autoconf 2.61, while still supporting 2.57.


author: Alasdair Kergon <agk@redhat.com> - 2.02.27-1
changelog:
  - Add -f to vgcfgrestore to list metadata backup files.
  - Add pvdisplay --maps implementation.
  - Add devices/preferred_names config regex list for displayed device names.
  - Add vg_mda_count and pv_mda_count columns to reports.
  - Change cling alloc policy attribute character from 'C' to l'.
  - Print warnings to stderr instead of stdout.
  - Fix snapshot cow area deactivation if origin is not active.
  - Reinitialise internal lvmdiskscan variables when called repeatedly.
  - Allow keyboard interrupt during user prompts when appropriate.
  - Fix deactivation code to follow dependencies and remove symlinks.
  - Fix a segfault in device_is_usable() if a device has no table.
  - Fix creation and conversion of mirrors with tags.
  - Add command stub for pvck.
  - Handle vgsplit of an entire VG as a vgrename.
  - Fix vgsplit for lvm1 format (set and validate VG name in PVs metadata).
  - Split metadata areas in vgsplit properly.
  - Fix and clarify vgsplit error messages.
  - Update lists of attribute characters in man pages.
  - Remove unsupported LVM1 options from vgcfgrestore man page.
  - Update vgcfgrestore man page to show mandatory VG name.
  - Update vgrename man page to include UUID and be consistent with lvrename.
  - Add some more debug messages to clvmd startup.
  - Fix thread race in clvmd.
  - Make clvmd cope with quorum devices.
  - Add extra internal error checking to clvmd.
  - Fix missing lvm_shell symbol in lvm2cmd library.
  - Move regex functions into libdevmapper.
  - Add kernel and device-mapper targets versions to lvmdump.
  - Add /sys/block listings to lvmdump.
  - Make lvmdump list /dev recursively.
  - Mark /etc/lvm subdirectories as directories in spec file.


author: Alasdair Kergon <agk@redhat.com> - 2.02.24-1
changelog:
  - Add BuildRequires readline-static until makefiles get fixed.
  - Fix processing of exit status in init scripts
  - Fix vgremove to require at least one vg argument.
  - Fix reading of striped LVs in LVM1 format.
  - Flag nolocking as clustered so clvmd startup sees clustered LVs.
  - Add a few missing pieces of vgname command line validation.
  - Support the /dev/mapper prefix on most command lines.


author: Alasdair Kergon <agk@redhat.com> - 2.02.23-1
changelog:
  - Fix vgrename active LV check to ignore differing vgids.
  - Fix two more segfaults if an empty config file section encountered.
  - Fix a leak in a reporting error path.
  - Add devices/cache_dir & devices/cache_file_prefix, deprecating devices/cache.


author: Alasdair Kergon <agk@redhat.com> - 2.02.22-1
changelog:
  - Add ncurses-static BuildRequires after package split.
  - Fix loading of segment_libraries.
  - If a PV reappears after it was removed from its VG, make it an orphan.
  - Don't update metadata automatically if VGIDs don't match.
  - Fix some vgreduce --removemissing command line validation.
  - Trivial man page corrections (-b and -P).
  - Add global/units to example.conf.
  - Remove readline support from lvm.static.


author: Alasdair Kergon <agk@redhat.com> - 2.02.21-1
changelog:
  - Fix vgsplit to handle mirrors.
  - Reorder fields in reporting field definitions.
  - Fix vgs to treat args as VGs even when PV fields are displayed.
  - Fix md signature check to handle both endiannesses.


author: Alasdair Kergon <agk@redhat.com> - 2.02.20-1
changelog:
  - Fix exit statuses of reporting tools.
  - Add some missing close() and fclose() return code checks.
  - Add devices/ignore_suspended_devices to ignore suspended dm devices.
  - Fix refresh_toolcontext() always to wipe persistent device filter cache.
  - Long-lived processes write out persistent dev cache in refresh_toolcontext().
  - Streamline dm_report_field_* interface.
  - Update reporting man pages.
  - Add --clustered to man pages.
  - Add field definitions to report help text.


author: Alasdair Kergon <agk@redhat.com> - 2.02.19-1
changelog:
  - Fix a segfault if an empty config file section encountered.
  - Fix partition table processing after sparc changes.
  - Fix cmdline PE range processing segfault.
  - Move basic reporting functions into libdevmapper.


author: Alasdair Kergon <agk@redhat.com> - 2.02.18-1
changelog:
  - Use CFLAGS when linking so mixed sparc builds can supply -m64.
  - Prevent permission changes on active mirrors.
  - Print warning instead of error message if lvconvert cannot zero volume.
  - Add snapshot options to lvconvert man page.
  - dumpconfig accepts a list of configuration variables to display.
  - Change dumpconfig to use --file to redirect output to a file.
  - Avoid vgreduce error when mirror code removes the log LV.
  - Fix ambiguous vgsplit error message for split LV.
  - Fix lvextend man page typo.
  - Use no flush suspending for mirrors.
  - Fix create mirror with name longer than 22 chars.


author: Alasdair Kergon <agk@redhat.com> - 2.02.17-1
changelog:
  - Add missing pvremove error message when device doesn't exist.
  - When lvconvert allocates a mirror log, respect parallel area constraints.
  - Check for failure to allocate just the mirror log.
  - Support mirror log allocation when there is only one PV: area_count now 0.
  - Fix detection of smallest area in _alloc_parallel_area() for cling policy.
  - Add manpage entry for clvmd -T
  - Fix hang in clvmd if a pre-command failed.


author: Alasdair Kergon <agk@redhat.com> - 2.02.16-1
changelog:
  - Fix VG clustered read locks to use PR not CR.
  - Adjust some alignments for ia64/sparc.
  - Fix mirror segment removal to use temporary error segment.
  - Always compile debug logging into clvmd.
  - Add startup timeout to clvmd startup script.
  - Add -T (startup timeout) switch to clvmd.
  - Improve lvm_dump.sh robustness.


author: Alasdair Kergon <agk@redhat.com> - 2.02.12-2
changelog:
  - Remove no-longer-used ldconfig from lvm2-cluster and fix lvmconf
    to cope without the shared library.


author: Alasdair Kergon <agk@redhat.com> - 2.02.11-1.0
changelog:
  - New upstream with numerous fixes and small enhancements.
    (See the WHATS_NEW documentation file for complete upstream changelog.)


author: Alasdair Kergon <agk@redhat.com> - 2.01.08-2.0
changelog:
  - No longer abort read operations if archive/backup directories aren't there.
  - Add runtime directories and file to the package.


author: Alasdair Kergon <agk@redhat.com> - 2.01.08-1.0
changelog:
  - Improve detection of external changes affecting internal cache.
  - Add clustered VG attribute.
  - Suppress rmdir opendir error message.


author: Alasdair Kergon <agk@redhat.com> - 2.01.07-1.0
changelog:
  - Remove build directory from built-in path.
  - Extra /dev scanning required for clustered operation.


author: Alasdair Kergon <agk@redhat.com> - 2.00.24-1
changelog:
  - More upstream fixes.  (Always check WHATS_NEW file for details.)
  - Add requested BuildRequires. [bz 124916, 132408]


author: Jeremy Katz <katzj@redhat.com> - 2.00.20-2
changelog:
  - add patch for iSeries viodasd support
  - add patch to check file type using stat(2) if d_type == DT_UNKNOWN (#129674)


author: Alasdair Kergon <agk@redhat.com> 2.00.12-1
changelog:
  - Install default /etc/lvm/lvm.conf.
  - Move non-static binaries to /usr/sbin.
  - Add temporary links in /sbin to lvm.static until rc.sysinit gets updated.


author: Alasdair Kergon <agk@redhat.com> 2.00.10-1
changelog:
  - Update to version 2.00.10, which incorporates the RH-specific patches
    and includes various fixes and enhancements detailed in WHATS_NEW.


author: Jeremy Katz <katzj@redhat.com> 2.00.08-5
changelog:
  - Fix sysfs patch to find sysfs
  - Take patch from dwalsh and tweak a little for setting SELinux contexts on
    device node creation and also do it on the symlink creation.  
    Part of this should probably be pushed down to device-mapper instead


author: Florian Festi <ffesti@redhat.com> - 9.0.3-43
changelog:
  - Adjust location of kabi-whitelists
  - Resolves: #842761
  - Be stricter with she bang lines in find-requires
  - Resolves: #1179521


author: Florian Festi <ffesti@redhat.com> - 9.0.3-40
changelog:
  - Fix verrel in kmodtool when used with variants
  - Resolves: #795577
  - Add %_smp_ncpus_max macro to allow adjusting the number of processors used
  - Resolves: #669638
  - Fix brp-java-repack-jars for jar files that contain non-standard permissions
  - Resolves: #822073


author: Jon Masters <jcm@redhat.com> - 9.0.3-25
changelog:
  - Update the kmodtool and correct kmod removal to delete package-specific files
  - Resolves: #622618.


author: Jon Masters <jcm@redhat.com> - 9.0.3-24
changelog:
  - Update the kmodtool and the percent kernel_module_package macro in
    accordance with the upstream packaging standard.
  - Resolves: #618518.


author: Paul Howarth <paul@city-fan.org> 9.0.3-17
changelog:
  - redhat-rpm-config-9.0.3-filtering-macros.patch: Rediff so we don't ship a .orig file
  - add (empty) %build section
  - fix unescaped macros in changelog


author: Adam Jackson <ajax@redhat.com> 9.0.3-15
changelog:
  - redhat-rpm-config-9.0.4-brpssa-speedup.patch: When looking for static
    archives, only run file(1) on files named *.a. (#517101)


author: Adam Jackson <ajax@redhat.com> 9.0.3-14
changelog:
  - redhat-rpm-config-9.0.3-jars-with-spaces.patch: Handle repacking jars
    whose filenames contain spaces. (#461854)


author: Dennis Gilmore <dennis@ausil.us> - 9.0.3-5
changelog:
  - apply fedora 11 default buildflags
  - set 32 bit intel build arch to i586 on compatiable hardware
  - set 32 bit sparc build arch to sparcv9 on compatiable hardware


author: Jon Masters <jcm@redhat.com> - 9.0.3-1
changelog:
  - Ensure Java Jar files have readable files within.
  - Remove overwritten config.guess|sub files (testing).
  - Fix Fortran flags for building using _fmoddir.
  - Pull in objdump fix to upstream find-requires.


author: Jon Masters <jcm@redhat.com> - 9.0.2-1
changelog:
  - Remove smp dependencies
  - Update config.guess|sub files
  - Don't call find-requires.ksyms for kmod packages (kernel kABI scripts).


author: Jesse Keating <jkeating@redhat.com> - 9.0.1-1
changelog:
  - Remove dist defines, fedora-release does that now
  - Enable post-build buildroot checking by default


author: Jeremy Katz <katzj@redhat.com> - 9.0.0-1
changelog:
  - use stock find-lang.sh (#213041)
  - arm fixes (Lennert Buytenhek, #243523)
  - allow jar repacking to be disabled (#219731)
  - fix running dist.sh --fc (#223651)
  - hardlink identical .pyc and .pyo files to save space (Ville Skyttä)
  - fix TMPDIR usage (Matthew Miller, #235614)


author: Jeremy Katz <katzj@redhat.com> - 8.1.0-1
changelog:
  - add modalias tags to kmod packages and other kmod changes (jcm)
  - recompress jars to avoid multilib conflicts (bkonrath)


author: Jon Masters <jcm@redhat.com> 8.0.45-15
changelog:
  - Add modalias tags to kernel module packages (kmods) for tracking.
  - Further information is available at http://www.kerneldrivers.org/.


author: Jon Masters <jcm@redhat.com> 8.0.45-14
changelog:
  - Rebased all previous patches (since java fix introduced offset).
  - Added Fedora per-release macros to platforms section of macros.
    Further debate may see these move elsewhere in the ordering.


author: Elliot Lee <sopwith@redhat.com> 8.0.33-1
changelog:
  - Change -D to -Wp,-D to make java happy
  - Add -D_FORTIFY_SOURCE=2 to global cflags (as per Jakub & Arjan's request)


author: Jens Petersen <petersen@redhat.com> - 8.0.26-1
changelog:
  - preserve the vendor field when VENDOR not set
  - put VENDOR in the final i386-libc line, not the tentative one


author: Jens Petersen <petersen@redhat.com> - 8.0.25-1
changelog:
  - update config.{guess,sub} to 2003-06-17
  - define VENDOR to be redhat only when /etc/redhat-release present
    [suggested by jbj]
  - put VENDOR in vendor field in our config.guess file for
    ia64, ppc, ppc64, s390, s390x, x86_64 and elf32-i386 Linux
  - drop the --host, --build, --target and --program-prefix configure options
    from %configure, since this causes far too many problems


author: Jens Petersen <petersen@redhat.com> - 8.0.22-2
changelog:
  - add config.guess and config.sub (2003-02-22) with s390 patch on config.sub
  - make %configure use them


author: Jens Petersen <petersen@redhat.com> 7.3.92-4
changelog:
  - fix %configure targeting for autoconf-2.5x (#58468)
  - include ~/.rpmmacros in macrofiles file path again


author: Mike A. Harris <mharris@redhat.com> 0.3-5
changelog:
  - Replace "makeinstall" with "make install DESTDIR=..."
  - Added "Requires: xorg-x11-proto-devel >= 7.0-10, libXfixes-devel to devel
    subpackage needed by xcomposite.pc
  - Remove package ownership of mandir/libdir/etc.


author: Mike A. Harris <mharris@redhat.com> 0.2.2.1-1
changelog:
  - Updated libXcomposite to version 0.2.2.1 from X11R7 RC3
  - Added "Requires(pre): xorg-x11-filesystem >= 0.99.2-3", to ensure
    that /usr/lib/X11 and /usr/include/X11 pre-exist.
  - Removed 'x' suffix from manpage directories to match RC3 upstream.


author: Mike A. Harris <mharris@redhat.com> 0.2.2-1
changelog:
  - Updated libXcomposite to version 0.2.2 from X11R7 RC2
  - Changed 'Conflicts: XFree86-devel, xorg-x11-devel' to 'Obsoletes'
  - Changed 'Conflicts: XFree86-libs, xorg-x11-libs' to 'Obsoletes'


author: Petr Lautrbach <plautrba@redhat.com> - 2.1.23-13.el6_3.1
changelog:
  - release the GSSAPI server credential handle immediately after the
    GSSAPI security context is established (#825863)


author: Tomas Mraz <tmraz@redhat.com> - 2.1.22-19
changelog:
  - always use the current external db4 when linking,
    thanks to Dan Horak for the original patch (#464098)


author: Tomas Mraz <tmraz@redhat.com> - 2.1.22-15
changelog:
  - drop reload from initscript help (#448154)
  - fix hang in rimap auth method (#438533)
  - build the krb4 plugin (#154675)


author: Steve Conklin <sconklin@redhat.com> - 2.1.22-11
changelog:
  - Cleanup after merge review bz #225673
  - no longer mark /etc/rc.d/init.d/saslauthd as config file
  - removed -x permissions on include files
  - added devel package dependency on cyrus-sasl
  - removed some remaining .la files that were being delivered


author: Nalin Dahyabhai <nalin@redhat.com> 2.1.22-6
changelog:
  - install config files and init scripts using -p
  - pull in patch to build with current automake (#229010, Jacek Konieczny
    and Robert Scheck)
  - remove prereq on ldconfig, RPM should pick it up based on the -libs
    scriptlets
  - pull in patch to correctly detect gsskrb5_register_acceptor_identity
    (#200892, Mirko Streckenbach)
  - move sasldb auxprop modules into the -lib subpackage, so that we'll pick
    it up for multilib systems


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - remove static build, which is no longer a useful option because not all of
    our dependencies are available as static libraries
  - drop patches which were needed to keep static builds going
  - drop gssapi-generic patch due to lack of interest
  - update the bundled copy of db to 4.5.20 (#229012)
  - drop dbconverter-2, as we haven't bundled v1 libraries since FC4


author: Nalin Dahyabhai <nalin@redhat.com> 2.1.22-5
changelog:
  - rebuild
  - add 'authentication' or 'auxprop' to summaries for plugin packages to
    better indicate what the plugin provides
  - switch from automake 1.9 to automake 1.7


author: Nalin Dahyabhai <nalin@redhat.com> 2.1.21-12
changelog:
  - add conditionalized build dependency on openldap-devel (#191855)
  - patch md5global.h to be the same on all architectures


author: Nalin Dahyabhai <nalin@redhat.com> 2.1.21-11
changelog:
  - add unapplied patch which makes the DIGEST-MD5 plugin omit the realm
    argument when the environment has $CYRUS_SASL_DIGEST_MD5_OMIT_REALM set to a
    non-zero value, for testing purposes
  - add missing buildrequires on zlib-devel (#190113)


author: Nalin Dahyabhai <nalin@redhat.com> 2.1.21-9
changelog:
  - use --as-needed to avoid linking dbconverter-2 with SQL libraries, which
    it doesn't use because it manipulates files directly (#173321)


author: Nalin Dahyabhai <nalin@redhat.com> 2.1.21-8
changelog:
  - rebuild with new OpenLDAP, overriding the version checks to assume that
    2.3.11 is acceptable
  - remove a lingering patch for 1.x which we no longer use


author: Nalin Dahyabhai <nalin@redhat.com> 2.1.21-4
changelog:
  - move the ldapdb auxprop support into a subpackage (#167300)
    (note: the ldap password check support in saslauthd doesn't use auxprop)


author: Nalin Dahyabhai <nalin@redhat.com> 2.1.21-2
changelog:
  - move the ANONYMOUS mech plugin to the -lib subpackage so that multilib
    systems can use it without installing the main package
  - build the static libraries without sql auxprop support


author: Nalin Dahyabhai <nalin@redhat.com> 2.1.21-1
changelog:
  - update to 2.1.21
  - turn off compilation of libsasl v1 (finally)
  - explicitly disable sqlite to avoid the build warning
  - change the default mechanism which is set for saslauthd from "shadow" to
    "pam" (#159194)
  - split the shared library up from saslauthd so that multilib systems don't
    have to pull in every dependency of saslauthd for the compat arch (#166749)


author: Nalin Dahyabhai <nalin@redhat.com> 2.1.19-1
changelog:
  - rebuild (the 2.1.19 changelog for fixing a buffer overflow referred to a CVS
    revision between 2.1.18 and 2.1.19)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add a saslauthd_version option to libsasl's saslauthd client and teach it to
    do the right thing
  - enable the saslauthd client code in libsasl version 1 (it's still going away!)
  - add saslauthd1-checkpass/saslauthd2-checkpass for testing the above change


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.1.17, forcing the gssapi plugin to be shared now, as before
  - use a bundled libdb (#112215)
  - build static-with-all-plugins and normal-shared libsasl versions
  - add sasl2-{shared,static}-mechlist for very basic sanity checking
  - make inclusion of sasl1 stuffs conditional, because it's so going away


author: Nalin Dahyabhai <nalin@redhat.com> 2.1.15-6
changelog:
  - use /dev/urandom instead of /dev/random for SASL2 (docs indicate that this is
    safe if you aren't using OTP or SRP, and we build neither); SASL1 appears to
    use it to seed the libc RNG only (#103378)


author: Nalin Dahyabhai <nalin@redhat.com> 2.1.15-5
changelog:
  - install saslauthd's mdoc page instead of the pre-formatted man page, which
    would get formatted again


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - include testsaslauthd
  - note in the README that the saslauthd protocol is different for v1 and v2,
    so v1's clients can't talk to the v2 server


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - consider either des_cbc_encrypt or DES_cbc_encrypt to be sufficient when
    searching for a DES implementation in libcrypto
  - pull in CPPFLAGS and LDFLAGS from openssl's pkg-config data, if it exists


author: Nalin Dahyabhai <nalin@redhat.com> 2.1.7-3
changelog:
  - rebuild, overriding sasldir when running make so that on multilib systems
    applications will be able to load modules for the right arch


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.1.0, which is designed to be installed in parallel with cyrus sasl
    1.x, so fork the package and rename it to cyrus-sasl2
  - add the sasldb auxprop plugin to the main package
  - add disabled-by-default saslauthd init script
  - move the .la files for plugins into their respective packages -- they're
    needed by the library


author: Nalin Dahyabhai <nalin@redhat.com> 1.5.24-21
changelog:
  - include sample programs in the -devel subpackage, prefixing their names
    with "sasl-" to reduce future potential naming conflicts


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add gdbm-devel as a build dependency (#44990)
  - split off CRAM-MD5 and DIGEST-MD5 into a subpackage of their own (#43079,
    and dialogs with David L. Parsley)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - split out the PLAIN and LOGIN mechanisms into their own package (this allows
    an administrator to disable them by simply removing the package)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - move .so files for modules to their respective packages -- they're not -devel
    links meant for use by ld anyway


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - force use of gdbm for database files to avoid DB migration weirdness
  - enable login mechanism
  - disable gssapi until it can coexist peacefully with non-gssapi setups
  - actually do a make in the build section (#15410)


author: Mads Kiilerich <mads@kiilerich.com>
changelog:
  - updated to sasl 1.5.11
  - configure --disable-krb4 --without-rc4 --disable-cram 
    because of missing libraries and pine having cram as default...
  - handle changing libsasl.so versions


author: Jens Petersen <petersen@redhat.com> - 0.17-16
changelog:
  - fix FTBFS by removing openmp.m4 which conflicts with recent autoconf (#539211)
  - cleanup gettext-0.17-rpathFix.patch
    - separate gl_AC_TYPE_LONG_LONG replacement to another patch
    - use trailing ':' for tests LD_LIBRARY_PATH
  - run autogen.sh with --quick and --skip-gnulib


author: Jens Petersen <petersen@redhat.com> - 0.17-15
changelog:
  - bring back autopoint requires cvs (#517361)
  - requires info rather than /sbin/install-info
  - drop install_info and remove_install_info macros


author: Jens Petersen <petersen@redhat.com> - 0.17-9
changelog:
  - add buildjava switch to allow turning off the java bits completely
  - add buildcheck to allow turning off make check
  - drop cvs requires for autopoint (Karl Lattimer, #469555)
  - add upstream gettext-xgettext-python-unicode-surrogate-473946.patch by
    Bruno Haible to fix xgettext handling of utf16 surrogates in python (#473946)


author: Ding-Yi Chen <dchen at redhat dot com> - 0.17-7
changelog:
  - Remove the gettext-libs docs, as they are talking about autoconf, libtool, 
    which are not directly related to the gettext-libs.
  - Remove unused definition and trailing space.
  - Fix the build failure with mock .


author: Ding-Yi Chen <dchen at redhat dot com> - 0.17-6
changelog:
  - Fixed Bug 456666 msghack doesn't check for mandatory cmd line params 
    by adding checking statements and display usage (msghack.py modified)
  - rpath patch for binary-or-shlib-defines-rpath in x86_64.


author: Jens Petersen <petersen@redhat.com> - 0.17-1
changelog:
  - update to 0.17 release
    - update License field to GPLv3
    - add gettext-0.17-open-args.patch to fix build from upstream
    - gettext-tools-tests-lang-gawk-fail.patch, gettext-php-headers.patch,
      gettext-php-prinf-output-237241.patch, and
      gettext-xglade-define-xml-major-version-285701.patch are no longer needed
  - drop superfluous po-mode-init.el source
  - no need to run autoconf and autoheader when building
  - pass -findirect-dispatch to gcj to make java binaries ABI independent
    (jakub,#427796)
  - move autopoint, gettextize, and {_datadir}/{name}/ to main package
  - force removal of emacs/ so install does not fail when no emacs


author: Jens Petersen <petersen@redhat.com> - 0.16.1-12
changelog:
  - add a libs subpackage (suggested by Dwayne Bailey, #294891)
  - move preloadable_libintl.so to the devel subpackage


author: Nils Philippsen <nphilipp@redhat.com> - 0.16.1-11
changelog:
  - remove gettext-xglade-include-expat-285701.patch, add
    gettext-xglade-define-xml-major-version-285701.patch to determine
    XML_MAJOR_VERSION from expat.h and define it in config.h (#285701)


author: Jens Petersen <petersen@redhat.com> - 0.16.1-10
changelog:
  - buildrequire expat-devel
  - add gettext-xglade-include-expat-285701.patch to include expat.h
    to get xgettext to dl the right libexpat (Nils Philippsen, #285701)


author: Jens Petersen <petersen@redhat.com> - 0.16.1-8
changelog:
  - add gettext-php-prinf-output-237241.patch to workaround php test failure
    (#237241)
  - add gettext-php-headers.patch to correct php test headers
    (Robert Scheck, #232832)


author: Jens Petersen <petersen@redhat.com> - 0.16.1-7
changelog:
  - set preloadable_libintl.so executable in %install so it gets stripped
  - force removal of infodir/dir since it is not there when /sbin is not in path


author: Jens Petersen <petersen@redhat.com> - 0.16.1-6
changelog:
  - add buildjar switch for building of libintl.jar
  - lots of spec file cleanup (Mamoru Tasaka, #225791):
  - preserve timestamps of installed files
  - disable building of static library
  - use %find_lang for .mo files
  - remove examples from -devel package
  - do not own en@*quot locale dirs
  - set preloadable_libintl.so executable
  - add ChangeLog to -devel package
  - add %check to run make check
  - add gettext-tools-tests-lang-gawk-fail.patch to work around gawk test failure


author: Jens Petersen <petersen@redhat.com> - 0.16.1-4
changelog:
  - protect install-info in devel %post and %preun too (Ville Skyttä, #223689)
  - forward port fix to reset of timestamp of examples ChangeLog for
    brp-java-repack-jars libintl.jar multilib conflict (#205207)


author: Jens Petersen <petersen@redhat.com> - 0.14.6-1
changelog:
  - update to 0.14.6
  - include preloadable_libintl.so again (Roozbeh Pournader, #149809)
  - remove .la files (Kjartan Maraas, #172624)
  - cleanup spec file


author: Leon Ho <llch@redhat.com>
changelog:
  - updated to 0.14.3
  - fixed compiling problem on gcc4 (#150992)
  - fixed Group for -devel (#138303)
  - moved gettextize and autopoint to -devel (#137542, #145768)
  - moved some of the man pages


author: Leon Ho <llch@redhat.com>
changelog:
  - move java stuff to gettext-devel (#132239)
  - add BuildRequires: gcc-c++ (#132518)
  - add some missing install-info and ldconfig (#131272)
  - fix dir ownership (#133696)
  - run autotools for 1.9


author: Leon Ho <llch@redhat.com>
changelog:
  - use --without-included-gettext to avoid the need of libintl.so (#125497)
  - remove preloadable_libintl.so


author: Leon Ho <llch@redhat.com>
changelog:
  - packaged lib files for devel
  - moved some of the files to different sub-pkg
  - fix problem on x86_64 build


author: Trond Eivind Glomsrød <teg@redhat.com> 0.10.40-1
changelog:
  - 0.10.40 - libintl is now LGPLed (it was GPLed). Note that RHL
    uses the glibc version, and don't include libintl from gettext.
  - include new man pages
  - don't include the elisp mode - bundle it into the main emacs package,
    like we do for XEmacs.
  - README-alpha no longer exists, so don't list it as a doc file


author: Trond Eivind Glomsrød <teg@redhat.com> 0.10.38-6
changelog:
  - Fix handling of multiline entries (rest of #50065)
  - don't use the references of the last entry in a po file
  - remove duplicates when inverting
  - Own the en@quot and en@boldquot locale dirs (#52164)
  - Handle entries with a first line of "" as identical to those
    without


author: Tomas Mraz <tmraz@redhat.com> 1.1.1-18
changelog:
  - pam_cracklib: improve documentation (#889233)
  - unbreak authentication if ld.so.preload is not empty
  - correct off by one error in account expiration calculation (#947011)
  - pam_console_apply: do not print error if console.perms.d is empty
  - properly handle all cases where crypt() might return NULL (#1026203)
  - pam_limits: clarify documentation of maxsyslogins limit (#1028490)
  - pam_access: call DNS resolution only when necessary and cache
    results (#1029817)
  - pam_limits: nofile applies to file descriptors not files (#1040664)
  - pam_limits: check whether the utmp login entry is valid (#1054936)
  - correct URLs in spec file (#1071770)
  - pam_userdb: correct the example in man page (#1078779)
  - pam_selinux: canonicalize username for getseuser() (#1083981)
  - pam_access: fix netgroup matching and @user@@netgroup parsing (#740233)


author: Tomas Mraz <tmraz@redhat.com> 1.1.1-12
changelog:
  - add character sequence test to pam_cracklib
  - drop unused difignore option from pam_cracklib (#811243)
  - add enforce_for_root option to pam_cracklib (#588893)
  - mention limits.d in the limits.conf(5) manpage (#723297)
  - add ability to lock out inactive accounts to pam_lastlog
  - fix require_selinux option in pam_namespace (#750601)
  - add mntopts flag for tmpfs polyinstantiation method
  - preserve authtok_type in pam_get_authtok() (#811168)
  - fix username mismatch in pam_unix remember feature (#815516)
  - relax restriction of root in pam_pwhistory
  - relax soft nproc limit for root in 90-nproc.conf


author: Tomas Mraz <tmraz@redhat.com> 1.1.1-7
changelog:
  - fix a few memory leaks in error paths and other mistakes
    found by a code review
  - add rhost and tty to auditing data in modules (#677664)


author: Tomas Mraz <tmraz@redhat.com> 1.1.1-6
changelog:
  - do not overwrite /var/log/tallylog on package update (#614766)
  - add support for uid and gid ranges in limits.conf (#622847)
  - add new pam_faillock module (#644971)


author: Tomas Mraz <tmraz@redhat.com> 1.1.1-5
changelog:
  - fix insecure dropping of priviledges in pam_xauth, pam_env,
    and pam_mail - CVE-2010-3316 (#637898), CVE-2010-3435 (#641335)
  - fix insecure executing of scripts with user supplied environment
    variables in pam_namespace - CVE-2010-3853 (#643043)


author: Tomas Mraz <tmraz@redhat.com> 1.1.0-7
changelog:
  - pam_console: fix memory corruption when executing handlers (patch by
    Stas Sergeev) and a few more fixes in the handler execution code (#532302)


author: Tomas Mraz <tmraz@redhat.com> 1.1.0-5
changelog:
  - do not change permissions with pam_console_apply
  - drop obsolete pam_tally module and the faillog file (#461258)


author: Tomas Mraz <tmraz@redhat.com> 1.0.91-6
changelog:
  - add password-auth, fingerprint-auth, and smartcard-auth
    for applications which can use them namely gdm (#494874)
    patch by Ray Strode


author: Tomas Mraz <tmraz@redhat.com> 1.0.90-4
changelog:
  - fix parsing of config files containing non-ASCII characters
  - fix CVE-2009-0579 (mininimum days for password change ignored) (#487216)
  - pam_access: improve handling of hostname resolution


author: Tomas Mraz <tmraz@redhat.com> 1.0.2-2
changelog:
  - new password quality checks in pam_cracklib
  - report failed logins from btmp in pam_lastlog
  - allow larger groups in modutil functions
  - fix leaked file descriptor in pam_tally


author: Tomas Mraz <tmraz@redhat.com> 1.0.2-1
changelog:
  - pam_loginuid: uids are unsigned (#460241)
  - new minor upstream release
  - use external db4
  - drop tests for not pulling in libpthread (as NPTL should
    be safe)


author: Tomas Mraz <tmraz@redhat.com> 1.0.1-4
changelog:
  - pam_namespace: allow safe creation of directories owned by user (#437116)
  - pam_unix: fix multiple error prompts on password change (#443872)


author: Tomas Mraz <tmraz@redhat.com> 0.99.10.0-4
changelog:
  - pam_namespace: fix problem with level polyinst (#438264)
  - pam_namespace: improve override checking for umount
  - pam_selinux: fix syslogging a context after free() (#438338)


author: Tomas Mraz <tmraz@redhat.com> 0.99.10.0-2
changelog:
  - if shadow is readable for an user do not prevent him from
    authenticating any user with unix_chkpwd (#433459)
  - call audit from unix_chkpwd when appropriate


author: Tomas Mraz <tmraz@redhat.com> 0.99.10.0-1
changelog:
  - new upstream release
  - add default soft limit for nproc of 1024 to prevent
    accidental fork bombs (#432903)


author: Tomas Mraz <tmraz@redhat.com> 0.99.8.1-17
changelog:
  - test for setkeycreatecon correctly
  - add exclusive login mode of operation to pam_selinux_permit (original
    patch by Dan Walsh)


author: Tomas Mraz <tmraz@redhat.com> 0.99.8.1-9
changelog:
  - do not preserve contexts when copying skel and other namespace.init
    fixes (#298941)
  - do not free memory sent to putenv (#231698)


author: Tomas Mraz <tmraz@redhat.com> 0.99.8.1-6
changelog:
  - do not ask for blank password when SELinux confined (#254044)
  - initialize homedirs in namespace init script (original patch by dwalsh)


author: Tomas Mraz <tmraz@redhat.com> 0.99.8.1-5
changelog:
  - most devices are now handled by HAL and not pam_console (patch by davidz)
  - license tag fix
  - multifunction scanner device support (#251468)


author: Tomas Mraz <tmraz@redhat.com> 0.99.8.1-3
changelog:
  - updated db4 to 4.6.18 (#249740)
  - added user and new instance parameters to namespace init
  - document the new features of pam_namespace
  - do not log an audit error when uid != 0 (#249870)


author: Tomas Mraz <tmraz@redhat.com> 0.99.7.1-6
changelog:
  - pam_namespace: better document behavior on failure (#237249)
  - pam_unix: split out passwd change to a new helper binary (#236316)
  - pam_namespace: add support for temporary logons (#241226)


author: Tomas Mraz <tmraz@redhat.com> 0.99.7.1-5
changelog:
  - pam_selinux: improve context change auditing (#234781)
  - pam_namespace: fix parsing config file with unknown users (#234513)


author: Tomas Mraz <tmraz@redhat.com> 0.99.7.1-4
changelog:
  - pam_console: always decrement use count (#230823)
  - pam_namespace: use raw context for poly dir name (#227345)
  - pam_namespace: truncate long poly dir name (append hash) (#230120)
  - we don't patch any po files anymore


author: Tomas Mraz <tmraz@redhat.com> 0.99.7.1-3
changelog:
  - correctly relabel tty in the default case (#229542)
  - pam_unix: cleanup of bigcrypt support
  - pam_unix: allow modification of '*' passwords to root


author: Tomas Mraz <tmraz@redhat.com> 0.99.7.1-1
changelog:
  - upgrade to new upstream version resolving CVE-2007-0003
  - pam_namespace: unmount poly dir for override users


author: Tomas Mraz <tmraz@redhat.com> 0.99.7.0-1
changelog:
  - upgrade to new upstream version
  - drop pam_stack module as it is obsolete
  - some changes to silence rpmlint


author: Tomas Mraz <tmraz@redhat.com> 0.99.6.2-8
changelog:
  - properly include /var/log/faillog and tallylog as ghosts
    and create them in post script (#209646)
  - update gmo files as we patch some po files (#218271)
  - add use_current_range option to pam_selinux (#220487)
  - improve the role selection in pam_selinux
  - remove shortcut on Password: in ja locale (#218271)
  - revert to old euid and not ruid when setting euid in pam_keyinit (#219486)
  - rename selinux-namespace patch to namespace-level


author: Tomas Mraz <tmraz@redhat.com> 0.99.6.2-5
changelog:
  - add select-context option to pam_selinux (#213812)
  - autoreconf won't work with autoconf-2.61 as configure.in is not yet adjusted
    for it


author: Tomas Mraz <tmraz@redhat.com> 0.99.6.2-4
changelog:
  - update internal db4 to 4.5.20 version
  - move setgid before setuid in pam_keyinit (#212329)
  - make username check in pam_unix consistent with useradd (#212153)


author: Tomas Mraz <tmraz@redhat.com> 0.99.6.2-3.1
changelog:
  - preserve effective uid in namespace.init script (LSPP for newrole)
  - include /var/log/faillog and tallylog to filelist (#209646)
  - add ids to .xml docs so the generated html is always the same (#210569)


author: Tomas Mraz <tmraz@redhat.com> 0.99.6.2-2
changelog:
  - silence pam_succeed_if in default system-auth (#205067)
  - round the pam_timestamp_check sleep up to wake up at the start of the
    wallclock second (#205068)


author: Tomas Mraz <tmraz@redhat.com> 0.99.6.2-1
changelog:
  - upgrade to new upstream version, as there are mostly bugfixes except
    improved documentation
  - add support for session and password service for pam_access and
    pam_succeed_if
  - system-auth: skip session pam_unix for crond service


author: Tomas Mraz <tmraz@redhat.com> 0.99.5.0-7
changelog:
  - revoke keyrings properly when pam_keyinit called as root (#201048)
  - pam_succeed_if should return PAM_USER_UNKNOWN when getpwnam fails (#197748)


author: Tomas Mraz <tmraz@redhat.com> 0.99.5.0-6
changelog:
  - revoke keyrings properly when pam_keyinit called more than once (#201048)
    patch by David Howells


author: Tomas Mraz <tmraz@redhat.com> 0.99.5.0-3
changelog:
  - don't report error in pam_selinux for nonexistent tty (#188722)
  - add pam_keyinit to the default system-auth file (#198623)


author: Tomas Mraz <tmraz@redhat.com> 0.99.5.0-1
changelog:
  - updated to a new upstream release
  - added service as value to be matched and list matching to
    pam_succeed_if
  - namespace.init was missing from EXTRA_DIST


author: Tomas Mraz <tmraz@redhat.com> 0.99.4.0-5
changelog:
  - updated pam_namespace with latest patch by Janak Desai
  - merged pam_namespace patches
  - added buildrequires libtool
  - fixed a few rpmlint warnings


author: Tomas Mraz <tmraz@redhat.com> 0.99.4.0-3
changelog:
  - use md5 implementation from pam_unix in pam_namespace
  - pam_namespace should call setexeccon only when selinux is enabled


author: Tomas Mraz <tmraz@redhat.com> 0.99.4.0-2
changelog:
  - pam_console_apply shouldn't access /var when called with -r (#191401)
  - actually apply the large-uid patch
  - don't build hmactest in pam_timestamp so openssl-devel is not required
  - add missing buildrequires (#191915)


author: Tomas Mraz <tmraz@redhat.com> 0.99.4.0-1
changelog:
  - upgrade to new upstream version
  - make pam_console_apply not dependent on glib
  - support large uids in pam_tally, pam_tally2


author: Tomas Mraz <tmraz@redhat.com> 0.99.3.0-5
changelog:
  - the namespace instance init script is now in /etc/security (#190148)
  - pam_namespace: added missing braces (#190026)
  - pam_tally(2): never call fclose twice on the same FILE (from upstream)


author: Tomas Mraz <tmraz@redhat.com> 0.99.3.0-4
changelog:
  - fixed console device class for irda (#189966)
  - make pam_console_apply fail gracefully when a class is missing


author: Tomas Mraz <tmraz@redhat.com> 0.99.3.0-3
changelog:
  - added pam_namespace module written by Janak Desai (per-user /tmp
  support)
  - new pam-redhat modules version


author: Tomas Mraz <tmraz@redhat.com> 0.99.3.0-2
changelog:
  - added try_first_pass option to pam_cracklib
  - use try_first_pass for pam_unix and pam_cracklib in
    system-auth (#182350)


author: Tomas Mraz <tmraz@redhat.com> 0.99.3.0-1
changelog:
  - new upstream version
  - updated db4 to 4.3.29
  - added module pam_tally2 with auditing support
  - added manual pages for system-auth and config-util (#179584)


author: Tomas Mraz <tmraz@redhat.com> 0.99.2.1-2
changelog:
  - fix dangling symlinks in -devel (#175929)
  - link libaudit only where necessary
  - actually compile in audit support


author: Tomas Mraz <tmraz@redhat.com> 0.99.2.1-1
changelog:
  - support netgroup matching in pam_succeed_if
  - upgrade to new release
  - drop pam_pwdb as it was obsolete long ago
  - we don't build static libraries anymore


author: Tomas Mraz <tmraz@redhat.com> 0.80-13
changelog:
  - fixed CAN-2005-2977 unix_chkpwd should skip user verification only if
    run as root (#168181)
  - link pam_loginuid to libaudit
  - support no tty in pam_access (#170467)
  - updated audit patch (by Steve Grubb)
  - the previous pam_selinux change was not applied properly
  - pam_xauth: look for the xauth binary in multiple directories (#171164)


author: Tomas Mraz <tmraz@redhat.com> 0.80-9
changelog:
  - don't include ps and pdf docs (#168823)
  - new common config file for configuration utilities
  - remove glib2 dependency (#166979)


author: Tomas Mraz <tmraz@redhat.com> 0.80-8
changelog:
  - process limit values other than RLIMIT_NICE correctly (#168790)
  - pam_unix: always honor nis flag on password change (by Aaron Hope)


author: Tomas Mraz <tmraz@redhat.com> 0.80-2
changelog:
  - fixed module tests so the pam doesn't require itself to build (#163502)
  - added buildprereq for building the documentation (#163503)
  - relaxed permissions of binaries (u+w)


author: Tomas Mraz <tmraz@redhat.com> 0.80-1
changelog:
  - upgrade to new upstream sources
  - removed obsolete patches
  - pam_selinux module shouldn't fail on broken configs unless
    policy is set to enforcing (Dan Walsh)


author: Tomas Mraz <tmraz@redhat.com> 0.79-10
changelog:
  - add the Requires dependency on audit-libs (#159885)
  - pam_loginuid shouldn't report error when /proc/self/loginuid
    is missing (#159974)


author: Tomas Mraz <tmraz@redhat.com> 0.79-9
changelog:
  - update the pam audit patch to support newest audit library,
    audit also pam_setcred calls (Steve Grubb)
  - don't use the audit_fd as global static variable
  - don't unset the XAUTHORITY when target user is root


author: Tomas Mraz <tmraz@redhat.com> 0.79-7
changelog:
  - pam_xauth: unset the XAUTHORITY variable on error, fix
    potential memory leaks
  - modify path to IDE floppy devices in console.perms (#155560)


author: Tomas Mraz <tmraz@redhat.com> 0.79-5
changelog:
  - added auditing patch by Steve Grubb
  - added cleanup patches for bugs found by Steve Grubb
  - don't clear the shadow option of pam_unix if nis option used


author: Tomas Mraz <tmraz@redhat.com> 0.79-3
changelog:
  - make pam_unix LSB 2.0 compliant even when SELinux enabled
  - #88127 - change both local and NIS passwords to keep them in sync,
    also fix a regression in passwd functionality on NIS master server


author: Tomas Mraz <tmraz@redhat.com> 0.78-9
changelog:
  - fix wrong logging in pam_console handlers
  - add executing ainit handler for alsa sound dmix
  - #147879, #112777 - change permissions for dri devices


author: Tomas Mraz <tmraz@redhat.com> 0.78-8
changelog:
  - remove ownership and permissions handling from pam_console call
    pam_console_apply as a handler instead


author: Tomas Mraz <tmraz@redhat.com> 0.78-6
changelog:
  - add functionality for running handler executables from pam_console
    when console lock was obtained/lost
  - removed patches merged to pam-redhat


author: Tomas Mraz <tmraz@redhat.com> 0.78-5
changelog:
  - echo why tests failed when rebuilding
  - fixed some warnings and errors in pam_console for gcc4 build
  - improved parsing pam_console config file


author: Tomas Mraz <tmraz@redhat.com> 0.78-1
changelog:
  - update to Linux-PAM-0.78
  - #140451 parse passwd entries correctly and test for failure
  - #137802 allow using pam_console for authentication


author: Tomas Mraz <tmraz@redhat.com> 0.77-66
changelog:
  - #77646 log failures when renaming the files when changing password
  - Log failure on missing /etc/security/opasswd when remember option is present


author: Tomas Mraz <tmraz@redhat.com>
changelog:
  - #87628 pam_timestamp remembers authorization after logout
  - #116956 fixed memory leaks in pam_stack


author: Tomas Mraz <tmraz@redhat.com> 0.77-63
changelog:
  - Fix checking of group %group syntax in pam_limits
  - Drop fencepost patch as it was already fixed 
    by upstream change from 0.75 to 0.77
  - Fix brokenshadow patch


author: Tomas Mraz <tmraz@redhat.com> 0.77-61
changelog:
  - #129328 pam_env shouldn't abort on missing /etc/environment
  - #126985 pam_stack should always copy the conversation function 
  - #127524 add /etc/security/opasswd to files


author: Tomas Mraz <tmraz@redhat.com> 0.77-56
changelog:
  - #75454 fixed locking when changing password
  - #127054 
  - #125653 removed unnecessary getgrouplist call
  - #124979 added quiet option to pam_succeed_if


author: Dan Walsh <dwalsh@redhat.com> 0.77-19.sel
changelog:
  - Change unix_chkpwd to handle unix_passwd and unix_acct
  - This eliminates the need for pam modules to have read/write access to /etc/shadow.


author: Nalin Dahyabhai <nalin@redhat.com> 0.77-15
changelog:
  - don't install _pam_aconf.h -- apps don't use it, other PAM headers which
    are installed don't use it, and its contents may be different for arches
    on a multilib system
  - check for linkage problems in modules at %install-time (kill #107093 dead)
  - add buildprereq on flex (#101563)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - make pam_pwdb.so link with libnsl again so that it loads (#107093)
  - remove now-bogus buildprereq on db4-devel (we use a bundled copy for
    pam_userdb to avoid symbol collisions with other db libraries in apps)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_succeed_if: fix thinko in argument parsing which would walk past the
    end of the argument list


author: Nalin Dahyabhai <nalin@redhat.com> 0.77-0
changelog:
  - update to 0.77 upstream release
    - pam_limits: limits now affect root as well
    - pam_nologin: returns PAM_IGNORE instead of PAM_SUCCESS unless "successok"
      is given as an argument
    - pam_userdb: correctly return PAM_AUTH_ERR instead of PAM_USER_UNKNOWN when
      invoked with the "key_only" argument and the database has an entry of the
      form "user-<wrongpassword>"
  - use a bundled libdb for pam_userdb.so because the system copy uses threads,
    and demand-loading a shared library which uses threads into an application
    which doesn't is a Very Bad Idea


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-49
changelog:
  - modify calls to getlogin() to check the directory of the current TTY before
    searching for an entry in the utmp/utmpx file (#98020, #98826, CAN-2003-0388)


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-46
changelog:
  - pam_xauth: reintroduce ACL support, per the original white paper
  - pam_xauth: default root's export ACL to none instead of everyone


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-45
changelog:
  - create /lib/security, even if it isn't /%{_lib}/security, because we
    can't locate /lib/security/$ISA without it (noted by Arnd Bergmann)
  - clear out the duplicate docs directory created during %install


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-44
changelog:
  - fix syntax errors in pam_console's yacc parser which newer bison chokes on
  - forcibly set FAKEROOT at make install time


author: Elliot Lee <sopwith@redhat.com> 0.75-42
changelog:
  - Since cracklib-dicts location will not be correctly detected without 
    that package being installed, add buildreq for cracklib-dicts.
  - Add patch57: makes configure use $LIBNAME when searching for cracklib 
    dicts, and error out if not found.


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-40
changelog:
  - pam_timestamp_check: check that stdio descriptors are open before we're
    invoked
  - add missing chroot.conf


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-36
changelog:
  - pam_timestamp: chown intermediate directories when creating them
  - pam_timestamp_check: add -d flag to poll


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-31
changelog:
  - libpam_misc: fix possible infinite loop in misc_conv (#62195)
  - pam_xauth: fix cases where DISPLAY is "localhost:screen" and the xauth
    key is actually stored using the system's hostname (#61524)


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-20
changelog:
  - pam_stack: fix some memory leaks (reported by Fernando Trias)
  - pam_chroot: integrate Owl patch to report the more common causes of failures


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-19
changelog:
  - fix a bug in the getpwnam_r wrapper which sometimes resulted in false
    positives for non-existent users


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-16
changelog:
  - pam_xauth: always return PAM_SUCCESS or PAM_SESSION_ERR instead of PAM_IGNORE,
    matching the previous behavior (libpam treats PAM_IGNORE from a single module
    in a stack as a session error, leading to false error messages if we just
    return PAM_IGNORE for all cases)


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-15
changelog:
  - reorder patches so that the reentrancy patch is applied last -- we never
    came to a consensus on how to guard against the bugs in calling applications
    which this sort of change addresses, and having them last allows for dropping
    in a better strategy for addressing this later on


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_rhosts: allow "+hostname" as a synonym for "hostname" to jive better
    with the hosts.equiv(5) man page
  - use the automake install-sh instead of the autoconf install-sh, which
    disappeared somewhere between 2.50 and now


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_tally: don't try to read past the end of faillog -- it probably contains
    garbage, which if written into the file later on will confuse /usr/bin/faillog


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_limits: don't just return if the user is root -- we'll want to set the
    priority (it could be negative to elevate root's sessions)
  - pam_issue: fix off-by-one error allocating space for the prompt string


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_mkhomedir: recurse into subdirectories properly
  - pam_mkhomedir: handle symlinks
  - pam_mkhomedir: skip over special items in the skeleton directory


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add cracklib as a buildprereq
  - pam_wheel: don't ignore out if the user is attempting to switch to a
    unprivileged user (this lets pam_wheel do its thing when users attempt
    to get to system accounts or accounts of other unprivileged users)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_xauth: close a possible DoS due to use of dotlock-style locking in
    world-writable directories by relocating the temporary file to the target
    user's home directory
  - general: include headers local to this tree using relative paths so that
    system headers for PAM won't be pulled in, in case include paths don't
    take care of it


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_xauth: rewrite to skip refcounting and just use a temporary file
    created using mkstemp() in /tmp


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_userdb: fix the key_only flag so that the null-terminator of the
    user-password string isn't expected to be part of the key in the db file,
    matching the behavior of db_load 3.2.9


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_unix: use crypt() instead of bigcrypt() when salted field is less than
    the critical size which lets us know it was generated with bigcrypt()
  - use a wrapper to handle ERANGE errors when calling get....._r functions:
    defining PAM_GETPWNAM_R and such (for getpwnam, getpwuid, getgrnam,
    getgrgid, and getspnam) before including _pam_macros.h will cause them
    to be implemented as static functions, similar to how defining PAM_SM_xxx
    is used to control whether or not PAM declares prototypes for certain
    functions


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-12
changelog:
  - noreplace configuration files in /etc/security
  - pam_console: update pam_console_apply and man pages to reflect
    /var/lock -> /var/run move


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - modules: use getpwnam_r and friends instead of non-reentrant versions
  - pam_console: clear generated .c and .h files in "clean" makefile target


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_stack: perform deep copy of conversation structures
  - include the static libpam in the -devel subpackage (#52321)
  - move development .so and .a files to %{_libdir}
  - pam_unix: don't barf on empty passwords (#51846)
  - pam_unix: redo compatibility with "hash,age" data wrt bigcrypt (#42394)
  - console.perms: add usb camera, scanner, and rio devices (#15528)
  - pam_cracklib: initialize all options properly (#49613)


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-10
changelog:
  - pam_xauth: fix errors due to uninitialized data structure (fix from Tse Huong
    Choo)
  - pam_xauth: random cleanups
  - pam_console: use /var/run/console instead of /var/lock/console at install-time
  - pam_unix: fix preserving of permissions on files which are manipulated


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_console: use /var/run/console instead of /var/lock/console for lock files
  - pam_issue: read the right number of bytes from the file


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_wheel: don't error out if the group has no members, but is the user's
    primary GID (reported by David Vos)
  - pam_unix: preserve permissions on files which are manipulated (#43706)
  - pam_securetty: check if the user is the superuser before checking the tty,
    thereby allowing regular users access to services which don't set the
    PAM_TTY item (#39247)
  - pam_access: define NIS and link with libnsl (#36864)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_console: fix logic bug when changing permissions on single
    file and/or lists of files
  - pam_console: return the proper error code (reported and patches
    for both from Frederic Crozat)
  - change deprecated Copyright: tag in .spec file to License:


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - console.perms: change js* to js[0-9]*
  - include pam_aconf.h in more modules (patches from Harald Welte)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - console.perms: add apm_bios to the list of devices the console owner can use
  - console.perms: add beep to the list of sound devices


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_access: compare IP addresses with the terminating ".", as documented
    (patch from Carlo Marcelo Arenas Belon, I think) (#16505)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - merge up to 0.75
  - pam_unix: temporarily ignore SIGCHLD while running the helper
  - pam_pwdb: temporarily ignore SIGCHLD while running the helper
  - pam_dispatch: default to uncached behavior if the cached chain is empty


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - remove /dev/dri from console.perms -- XFree86 munges it, so it's outside of
    our control (reminder from Daryll Strauss)
  - add /dev/3dfx to console.perms


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_wheel: make 'trust' and 'deny' work together correctly
  - pam_wheel: also check the user's primary gid
  - pam_group: also initialize groups when called with PAM_REINITIALIZE_CRED


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_console: error out on undefined classes in pam_console config file
  - console.perms: actually change the permissions on the new device classes
  - pam_console: add an fstab= argument, and -f and -c flags to pam_console_apply
  - pam_console: use g_log instead of g_critical when bailing out
  - console.perms: logins on /dev/vc/* are also console logins, from Douglas
    Gilbert via Tim Waugh


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add pam_console_apply
  - /dev/pilot's usually a serial port (or a USB serial port), so revert its
    group to 'uucp' instead of 'tty' in console.perms
  - change pam_console's behavior wrt directories -- directories which are
    mount points according to /etc/fstab are taken to be synonymous with
    their device special nodes, and directories which are not mount points
    are ignored


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - own /etc/security
  - be more descriptive when logging messages from pam_limits
  - pam_listfile: remove some debugging code (#28346)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_limits: change the documented default config file to reflect the defaults
  - pam_limits: you should be able to log in a total of maxlogins times, not
    (maxlogins - 1)
  - handle group limits on maxlogins correctly (#25690)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - actually time out when attempting to lckpwdf() (#25889)
  - include time.h in pam_issue (#25923)
  - update the default system-auth to the one generated by authconfig 4.1.1
  - handle getpw??? and getgr??? failures more gracefully (#26115)
  - get rid of some extraneous {set,end}{pw,gr}ent() calls


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - merge to 0.74
  - make console.perms match perms set by MAKEDEV, and add some devfs device names
  - add 'sed' to the buildprereq list (#24666)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix handling of "nis" when changing passwords by adding the checks for the
    data source to the password-updating module in pam_unix
  - add the original copyright for pam_access (fix from Michael Gerdts)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix similar() function in pam_cracklib (#14740)
  - fix example in access.conf (#21467)
  - add conditional compilation for building for 6.2 (for pam_userdb)
  - tweak post to not use USESHADOW any more


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add RLIMIT_LOCKS to pam_limits (patch from Jes Sorensen) (#20542)
  - link pam_userdb to Berkeley DB 2.x to match 6.2's setup correctly


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - tweak pre script to be called in all upgrade cases
  - get pam_unix to only care about the significant pieces of passwords it checks
  - add /usr/include/db1/db.h as a build prereq to pull in the right include
    files, no matter whether they're in glibc-devel or db1-devel
  - pam_userdb.c: include db1/db.h instead of db.h


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - patch from Dmitry V. Levin to have pam_stack propagate the PAM fail_delay
  - roll back the README for pam_xauth to actually be the right one
  - tweak pam_stack to use the parent's service name when calling the substack


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - modify the files list to make sure #16456 stays fixed
  - make pam_stack track PAM_AUTHTOK and PAM_OLDAUTHTOK items
  - add pam_chroot module
  - self-hosting fixes from the -devel split
  - update generated docs in the tree


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix problems when looking for headers in /usr/include (#17236)
  - clean up a couple of compile warnings


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - give users /dev/cdrom* instead of /dev/cdrom in console.perms (#16768)
  - add nvidia control files to console.perms


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - move pam_filter modules to /lib/security/pam_filter (#16111)
  - add pam_tally's application to allow counts to be reset (#16456)
  - move README files to the txts subdirectory


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add a broken_shadow option to pam_unix
  - add all module README files to the documentation list (#16456)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - need to make pam_console's checking a little stronger
  - only pass data up from pam_stack if the parent didn't already define it


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - make pam_console's extra checks disableable
  - simplify extra check to just check if the device owner is root
  - add a debug log when pam_stack comes across a NULL item
  - have pam_stack hand items up to the parent from the child


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix installation of pam_xauth man pages (#12417)
  - forcibly strip helpers (#12430)
  - try to make pam_console a little more discriminating


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - symlink libpam.so to libpam.so.%{version}, and likewise for libpam_misc
  - reverse order of checks in _unix_getpwnam for pam_unix


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add account management wrappers for pam_listfile, pam_nologin, pam_securetty,
    pam_shells, and pam_wheel


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add system-auth control file
  - let gethostname() call in pam_access.c be implicitly declared to avoid
    conflicting types if unistd.c declares it


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Add new pam_stack module.
  - Install pwdb_chkpwd and unix_chkpwd as the current user for non-root builds


author: Elliot Lee <sopwith@redhat.com>
changelog:
  - Add a patch to accept 'pts/N' in /etc/securetty as a match for tty '5'
    (which is what other pieces of the system think it is). Fixes bug #7641.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 0.72
  - fix pam_unix password-changing bug
  - fix pam_unix's cracklib support
  - change package URL


author: Michael K. Johnson <johnsonm@redhat.com>
changelog:
  - many bug fixes in pam_xauth
  - pam_console can now handle broken applications that do not set
    the PAM_TTY item.


author: Michael K. Johnson <johnsonm@redhat.com>
changelog:
  - fixed glob/regexp confusion in pam_console, added kbd and fixed fb devices
  - added pam_xauth module


author: Michael K. Johnson <johnsonm@redhat.com>
changelog:
  - changed /dev/cdrom default user permissions back to 0600 in console.perms
    because some cdrom players open O_RDWR.


author: Jiri Moskovcak <jmoskovc@redhat.com> - 1.11.23.5
changelog:
  - added support for passing arguments thru stdin (patch from arozansk@redhat.com)
  - Resolves: #501942


author: Jiri Moskovcak <jmoskovc@redhat.com> 1.11.23.1
changelog:
  - updated to new version 1.11.23
  - fixed build on x86_64
  - rewritten sanity.sh patch to match current version
  - Resolves: #449424


author: Stepan Kasal <skasal@redhat.com> - 1.11.22-10
changelog:
  - make sccs2rcs non-executable, so that find-requires does not add
    dependency on /bin/csh when /bin/csh is available
  - add CSH=/bin/csh to configure, so that sccs2rcs #! line is not
    corrupted  when /bin/csh is not available
  - replace the deprecated %makeinstall (see Packaging Guidelines)


author: Martin Stransky <stransky@redhat.com> - 1.11.21-4
changelog:
  - fix for #189858 - /etc/profile.d/cvs.sh overwrite personal settings
  - fix for #190009 - rcs2log uses obsolete sort option


author: Martin Stransky <stransky@redhat.com> 1.11.21-2
changelog:
  - fix for cvs diff with two -r switches (#18161)
  - pam patch (#48937)
  - CVS_RSH is set to ssh (#58699)


author: Nalin Dahyabhai <nalin@redhat.com> 1.11.2-7
changelog:
  - don't error out in %install if the info dir file we remove from the build
    root isn't there (depends on the version of texinfo installed, reported by
    Arnd Bergmann)


author: Tim Waugh <twaugh@redhat.com 1.11.2-5
changelog:
  - Fix mktemp patch (bug #66669)
  - Incorporate patch to fix verifymsg behaviour on empty logs (bug #66022)


author: Nalin Dahyabhai <nalin@redhat.com> 1.11.2-3
changelog:
  - incorporate patch to fix incorrect socket descriptor usage (#65225)
  - incorporate patches to not choke on empty commit messages and to always
    send them (#66017)
  - incorporate patch to not infinitely recurse on assertion failures (#66019)


author: Bernhard Rosenkraenzer <bero@redhat.com> 1.11.1p1-3
changelog:
  - Fix up initial cvs login (#47457)
  - Bring back the leading newline at the beginning of commit messages
    "a" is one key less than "O". ;)
  - Fix build in the current build system


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 1.11.1p1
  - drop no-longer-necessary patches
  - use bundled zlib, because it's apparently not the same as the system zlib
  - run the test suite in the build phase
  - drop explicit Requires: on perl (RPM will catch the interpreter req)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix cvs-1.11-security.patch, which had CR-LF line terminators (#25090)
  - check for and ignore ENOENT errors when attempting to remove symlinks (#25173)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - reverse sense of conditional kerberos dependency
  - add kerberos IV patch from Ken Raeburn
  - switch to using the system's zlib instead of built-in
  - default to unstripped binaries


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - build with gssapi auth (--with-gssapi, --with-encryption)
  - apply patch to update libs to krb5 1.1.1


author: Cristian Gafton <gafton@redhat.com>
changelog:
  - fix the damn info pages too while we're at it.
  - fix description
  - man pages are compressed
  - make sure %post and %preun work okay


author: Elio Maldonado <emaldona@redhat.com> - 3.16.1-2
changelog:
  - Remove two unused patches and apply a needed one that was missed
  - Resolves: Bug 1112136 - Rebase nss in RHEL 6.5.Z to NSS 3.16.1


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-6
changelog:
  - Make pem's derEncodingsMatch function work with encrypted keys
  - Resolves: Bug 1048713 - [PEM] active FTPS with encrypted client key ends up with SSL_ERROR_TOKEN_INSERTION_REMOVAL


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-4
changelog:
  - Resolves: Bug 1048713 - [PEM] active FTPS with encrypted client key ends up with SSL_ERROR_TOKEN_INSERTION_REMOVAL


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-3
changelog:
  - Revoke trust in one mis-issued anssi certificate
  - Resolves: Bug 1042685 - nss: Mis-issued ANSSI/DCSSI certificate (MFSA 2013-117) [rhel-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-2
changelog:
  - Enable patch with fix for deadlock in trust domain lock and object lock
  - Resolves: Bug 1036477 - deadlock in trust domain lock and object lock
  - Disable hw gcm on rhel-5 based build environments where OS lacks support
  - Rollback changes to build nss without softokn until Bug 689919 is approved
  - Cipher suite was run as part of the nss-softokn build


author: Elio Maldonado <emaldona@redhat.com> - 4.10.8-2
changelog:
  - Resolves: Bug 1269360 - CVE-2015-7183
  - nspr: heap-buffer overflow in PL_ARENA_ALLOCATE can lead to crash (under ASAN), potential memory corruption


author: Carlo Wood <carlo@gnu.org>
changelog:
  - There should not be a reason anymore to include README.alias in the rpm docs.
  - Don't install as root.root in RPM_BUILD_ROOT, in order to allow to build
    rpm as non-root.
  - Bug fix
  - Added /etc/profile.d for automatic alias inclusion.


author: Carlo Wood <carlo@gnu.org>
changelog:
  - Typo in appended changelog.
  - Appended the old change log of `which-2.0.spec' to (this) changelog,
    which is generated from the CVS log of `which-2.0.spec.in'.
  - Generate which-2.spec from which-2.spec.in with automatic VERSION
    and CHANGELOG substitution.


author: Carlo Wood <carlo@gnu.org>
changelog:
  - Moved assignment of CFLAGS to the configure line, using RPM_OPT_FLAGS now.
  - Corrected Source: line to point to ftp.gnu.org.


author: Anton Arapov <anton@redhat.com> - 1:2.11-7
changelog:
  - Add "PXE" to HP OEM Type 209 record output
  - Properly print the hexadecimal value of invalid string characters


author: Anton Arapov <anton@redhat.com> - 1:2.11-5
changelog:
  - Fix the wrong call of the dmi_chassis_type function call. Thus fix
    an issue on the systems with the chassis lock available, application
    doesn't fall out with the out of spec error anymore.


author: Dave Jones <davej@redhat.com>
changelog:
  - Don't try to modify areas mmap'd read-only.
  - Don't build on ia64 any more.
    (It breaks on some boxes very badly, and works on very few).


author: Havoc Pennington <hp@redhat.com>
changelog:
  - Version 0.7
  - add explicit check for required glib2 version before we do the build,
    so we don't end up with bad RPMs on --nodeps builds


author: Marek Kasik <mkasik@redhat.com> - 2.3.11-15.el6_6.1
changelog:
  - Fixes CVE-2014-9657
     - Check minimum size of `record_size'.
  - Fixes CVE-2014-9658
     - Use correct value for minimum table length test.
  - Fixes CVE-2014-9675
     - New macro that checks one character more than `strncmp'.
  - Fixes CVE-2014-9660
     - Check `_BDF_GLYPH_BITS'.
  - Fixes CVE-2014-9661
     - Initialize `face->ttf_size'.
     - Always set `face->ttf_size' directly.
     - Exclusively use the `truetype' font driver for loading
       the font contained in the `sfnts' array.
  - Fixes CVE-2014-9663
     - Fix order of validity tests.
  - Fixes CVE-2014-9664
     - Add another boundary testing.
     - Fix boundary testing.
  - Fixes CVE-2014-9667
     - Protect against addition overflow.
  - Fixes CVE-2014-9669
     - Protect against overflow in additions and multiplications.
  - Fixes CVE-2014-9670
     - Add sanity checks for row and column values.
  - Fixes CVE-2014-9671
     - Check `size' and `offset' values.
  - Fixes CVE-2014-9673
     - Fix integer overflow by a broken POST table in resource-fork.
  - Fixes CVE-2014-9674
     - Fix integer overflow by a broken POST table in resource-fork.
     - Additional overflow check in the summation of POST fragment lengths.
  - Work around behaviour of X11's `pcfWriteFont' and `pcfReadFont' functions
  - Resolves: #1197737


author: Marek Kasik <mkasik@redhat.com> 2.3.11-13
changelog:
  - Fix CVE-2012-{1126, 1127, 1130, 1131, 1132, 1134, 1136,
    1137, 1139, 1140, 1141, 1142, 1143, 1144}
  - Properly initialize array "result" in
    FT_Outline_Get_Orientation()
  - Check bytes per row for overflow in _bdf_parse_glyphs()
  - Resolves: #806269


author: Marek Kasik <mkasik@redhat.com> 2.3.11-8
changelog:
  - Add freetype-2.3.11-CVE-2011-0226.patch
      (Add better argument check for `callothersubr'.)
      - based on patches by Werner Lemberg,
        Alexei Podtelezhnikov and Matthias Drochner
  - Resolves: #723468


author: Marek Kasik <mkasik@redhat.com> 2.3.11-7
changelog:
  - Add freetype-2.3.11-CVE-2010-3855.patch
      (Protect against invalid `runcnt' values.)
  - Resolves: #651762


author: Marek Kasik <mkasik@redhat.com> 2.3.11-6
changelog:
  - Add freetype-2.3.11-CVE-2010-2805.patch
      (Fix comparison.)
  - Add freetype-2.3.11-CVE-2010-2806.patch
      (Protect against negative string_size. Fix comparison.)
  - Add freetype-2.3.11-CVE-2010-2808.patch
      (Check the total length of collected POST segments.)
  - Add freetype-2.3.11-CVE-2010-3311.patch
      (Don't seek behind end of stream.)
  - Resolves: #638839


author: Marek Kasik <mkasik@redhat.com> 2.3.11-5
changelog:
  - Add freetype-2.3.11-CVE-2010-1797.patch
      (Check stack after execution of operations too.
       Skip the evaluations of the values in decoder, if
       cff_decoder_parse_charstrings() returns any error.)
  - Resolves: #621624


author: Marek Kasik <mkasik@redhat.com> 2.3.11-4
changelog:
  - Add freetype-2.3.11-CVE-2010-2498.patch
      (Assure that `end_point' is not larger than `glyph->num_points')
  - Add freetype-2.3.11-CVE-2010-2499.patch
      (Check the buffer size during gathering PFB fragments)
  - Add freetype-2.3.11-CVE-2010-2500.patch
      (Use smaller threshold values for `width' and `height')
  - Add freetype-2.3.11-CVE-2010-2519.patch
      (Check `rlen' the length of fragment declared in the POST fragment header)
  - Add freetype-2.3.11-CVE-2010-2520.patch
      (Fix bounds check)
  - Add freetype-2.3.11-CVE-2010-2527.patch
      (Use precision for `%s' where appropriate to avoid buffer overflows)
  - Add freetype-2.3.11-axis-name-overflow.patch
      (Avoid overflow when dealing with names of axes)
  - Resolves: #613298


author: Behdad Esfahbod <besfahbo@redhat.com> 2.3.9-2
changelog:
  - Add Provides: freetype-bytecode and freetype-subpixel if built
    with those options.
  - Resolves: #155210


author: Behdad Esfahbod <besfahbo@redhat.com> 2.3.7-3
changelog:
  - Add full source URL to Source lines.
  - Add docs to main and devel package.
  - rpmlint is happy now.
  - Resolves: #225770


author: Behdad Esfahbod <besfahbo@redhat.com> 2.3.5-2
changelog:
  - Change spec file to permit enabling bytecode-interpreter and
    subpixel-rendering without editing spec file.
  - Resolves: 249986


author: Behdad Esfahbod <besfahbo@redhat.com> 2.3.0-1
changelog:
  - Update to 2.3.0.
  - Drop upstream patches.
  - Drop -fno-strict-aliasing, it should just work.
  - Fix typo in ftconfig.h generation.


author: Behdad Esfahbod <besfahbo@redhat.com> 2.2.1-16
changelog:
  - Backport binary-search fixes from HEAD
  - Add freetype-2.2.1-ttcmap.patch
  - Resolves: #208734

  - Fix rendering issue with some Asian fonts.
  - Add freetype-2.2.1-fix-get-orientation.patch
  - Resolves: #207261

  - Copy non-X demos even if not compiling with_xfree86.

  - Add freetype-2.2.1-zero-item-size.patch, to fix crasher.
  - Resolves #214048

  - Add X11_PATH=/usr to "make"s, to find modern X.
  - Resolves #212199


author: Behdad Esfahbod <besfahbo@redhat.com> 2.2.1-10
changelog:
  - Fix crasher https://bugs.freedesktop.org/show_bug.cgi?id=6841
  - Add freetype-2.2.1-memcpy-fix.patch


author: Behdad Esfahbod <besfahbo@redhat.com> 2.2.1-1
changelog:
  - Update to 2.2.1
  - Remove FreeType 1, to move to extras
  - Install new demos ftbench, ftchkwd, ftgamma, and ftvalid
  - Enable modules gxvalid and otvalid


author: Owen Taylor <otaylor@redhat.com> - 2.1.9-1
changelog:
  - Upgrade to 2.1.9
  - Since we are just using automake for aclocal, use it unversioned,
    instead of specifying 1.4.


author: Owen Taylor <otaylor@redhat.com> 2.1.7-4
changelog:
  - Add patch from freetype CVS to fix problem with eexec (#117743)
  - Add freetype-devel to buildrequires and -devel requires
    (Maxim Dzumanenko, #111108)


author: Mike A. Harris <mharris@redhat.com> 2.1.7-3
changelog:
  - Added -fno-strict-aliasing to CFLAGS and CXXFLAGS to try to fix SEGV and
    SIGILL crashes in mkfontscale which have been traced into freetype and seem
    to be caused by aliasing issues in freetype macros (#118021)


author: Florian La Roche <Florian.LaRoche@redhat.de>
changelog:
  - allow compiling without the demos as that requires XFree86
    (this allows bootstrapping XFree86 on new archs)


author: Owen Taylor <otaylor@redhat.com> 2.1.4-1
changelog:
  - Version 2.1.4
  - Relibtoolize to get deplibs right for x86_64
  - Use autoconf-2.5x for freetype-1.4 to fix libtool-1.5 compat problem (#91781)
  - Relativize absolute symlinks to fix the -debuginfo package 
    (#83521, Mike Harris)


author: Elliot Lee <sopwith@redhat.com> 2.1.3-7
changelog:
  - Run libtoolize/aclocal/autoconf so that libtool knows to generate shared libraries 
    on ppc64.
  - Use _smp_mflags (for freetype 2.x only)


author: Owen Taylor <otaylor@redhat.com> 2.1.3-4
changelog:
  - Make FreeType robust against corrupt fonts with recursive composite 
    glyphs (#74782, James Antill)


author: Mike A. Harris <mharris@redhat.com> 2.1.3-2
changelog:
  - Update to freetype 2.1.3
  - Removed ttmkfdir sources and patches, as they have been moved from the
    freetype packaging to XFree86 packaging, and now to the ttmkfdir package
  - Removed patches that are now included in 2.1.3:
    freetype-2.1.1-primaryhints.patch, freetype-2.1.2-slighthint.patch,
    freetype-2.1.2-bluefuzz.patch, freetype-2.1.2-stdw.patch,
    freetype-2.1.2-transform.patch, freetype-2.1.2-autohint.patch,
    freetype-2.1.2-leftright.patch
  - Conditionalized inclusion of freetype 1.4 library.


author: Mike A. Harris <mharris@redhat.com> 2.1.2-10
changelog:
  - Attempted to fix lib64 issue in freetype-demos build with X11_LINKLIBS
  - Cleaned up various _foodir macros throughtout specfile
  - Removed with_ttmkfdir build option as it is way obsolete


author: Mike A. Harris <mharris@redhat.com> 2.0.8-2
changelog:
  - Updated to freetype 2.0.8, however docs and demos are stuck at 2.0.7
    on the freetype website.  Munged specfile to deal with the problem by using
    {oldversion} instead of version where appropriate.  <sigh>


author: Tim Powers <timp@redhat.com> 2.0.6-3
changelog:
  - bumping release so that we don't collide with another build of
    freetype, make sure to change the release requirement in the XFree86
    package


author: Mike A. Harris <mharris@redhat.com> 2.0.6-2
changelog:
  - Made ttmkfdir inclusion conditional, and set up a define to include
    ttmkfdir in RHL 7.x builds, since ttmkfdir is now moving to the new
    XFree86-font-utils package.


author: Elliot Lee <sopwith@redhat.com> 2.0.5-3
changelog:
  - Fix bug #56901 (ttmkfdir needed to list Unicode encoding when generating
    font list). (ttmkfdir-iso10646.patch)
  - Use _smp_mflags macro everywhere relevant. (freetype-pre1.4-make.patch)
  - Undo fix for #24253, assume compiler was fixed.


author: Mike A. Harris <mharris@redhat.com> 2.0.4-2
changelog:
  - Added new subpackage freetype-demos, added demos to build
  - Disabled ftdump, ftlint in utils package favoring the newer utils in
    demos package.


author: Bernhard Rosenkraenzer <bero@redhat.com> 2.0.3-4
changelog:
  - Add ft2build.h to -devel package, since it's included by all other
    freetype headers, the package is useless without it


author: Nalin Dahyabhai <nalin@redhat.com> 2.0.3-3
changelog:
  - Change "Requires: freetype = name/ver" to "freetype = version/release",
    and move the requirements to the subpackages.


author: Mike A. Harris <mharris@redhat.com> 2.0.3-1
changelog:
  - Updated to Freetype 2.0.3, minor specfile tweaks.
  - Freetype2 docs are is in a separate tarball now. Integrated it.
  - Built in new environment.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - libtool is used to build libttf, so use libtool to link ttmkfdir with it
  - fixup a paths for a couple of missing docs


author: Preston Brown <pbrown@redhat.com>
changelog:
  - newer ttmkfdir that works better, moved ttmkfdir to /usr/bin from /usr/sbin
  - freetype utilities moved to subpkg, X dependency removed from main pkg
  - libttf.so symlink moved to devel pkg


author: Cristian Gafton <gafton@redhat.com>
changelog:
  - call libtoolize to sanitize config.sub and get ARM support
  - dispoze of the patch (not necessary anymore)


author: Kamil Dudka <kdudka@redhat.com> 2.4.44-5
changelog:
  - encode NULs properly with getfattr --encoding=text (#651119)
  - return non-zero exit code on failure of getfattr (#665050)
  - document supported encodings of values (#674870)
  - update project URL in package specification (#702639)


author: Karsten Hopp <karsten@redhat.com> 2.4.32-2
changelog:
  - add disttag
  - remove trailing dot from summary
  - fix buildroot
  - -devel package requires same libattr version
  - change prereq to Requires(post)
  - escape macro in changelog
  - replace absolute link with relative link (libattr.so)
  - use %doc macro


author: Stephen C. Tweedie <sct@redhat.com> 2.4.1-3
changelog:
  - Add /usr/include/attr to files manifest
  - Fix location of doc files, add main doc dir to files manifest


author: Michael K. Johnson <johnsonm@redhat.com> 2.0.8-1
changelog:
  - Initial Red Hat package
    Made as few changes as possible relative to upstream packaging to
    make it easier to maintain long-term.  This means that some of
    the techniques used here are definitely not standard Red Hat
    techniques.  If you are looking for an example package to fit
    into Red Hat Linux transparently, this would not be the one to
    pick.
  - attr-devel -> libattr-devel


author: Miroslav Lichvar <mlichvar@redhat.com> - 14:4.0.0-1.20090818git832d2c
changelog:
  - update to post 4.0.0 git snapshot 20090818git832d2c
  - print retrans and reachable times in ICMPv6 as milliseconds (#474264)


author: Miroslav Lichvar <mlichvar@redhat.com> - 14:3.9.8-5
changelog:
  - update config.{guess,sub} when building tcpslice
  - remove -D_GNU_SOURCE from CFLAGS
  - disable libsmi check in configure


author: Miroslav Lichvar <mlichvar@redhat.com> - 14:3.9.7-1
changelog:
  - update to 3.9.7
  - with -C option, drop root privileges before opening first savefile (#244860)
  - update tcpslice to 1.2a3
  - include time patch from Debian to fix tcpslice on 64-bit architectures


author: Miroslav Lichvar <mlichvar@redhat.com> - 14:3.9.4-9
changelog:
  - fix processing of Prism and AVS headers (#206686)
  - fix arp2ethers script
  - update ethercodes.dat
  - move pcap man page to devel package


author: Martin Stransky <stransky@redhat.com> - 14:3.9.3-1
changelog:
  - New upstream version - 3.9.3
  - fix for #164227 (buffer overflow)
  - fix for #164230 (missing debug info)


author: Ivana Varekova <varekova@redhat.com> - 14:3.8.2-9
changelog:
  - added arpsnmp options to specify sender and recipient 
    and corrected arpwatch and arpsnmp man pages (#70386)


author: Harald Hoyer <harald@redhat.com> - 14:3.8.2-1
changelog:
  - update to tcpdump-3.8.2, libpcap-0.8.2, arpwatch-2.1a13
  - patched tcpdump configure for gcc34 optimizations
  - removed obsolete patches


author: Harald Hoyer <harald@redhat.de> 12:3.6.2-10
changelog:
  - took old purge patch for filters
  - fixed #54225,#58346
  - drop root by default #49635
  - fixed #54593
  - fixed #57711


author: Pekka Savola <pekkas@netcore.fi>
changelog:
  - fix building of tcpslice on glibc 2.2.2 (time.h)
  - disable /etc/init.d requirement and fix %post scripts in arpwatch


author: Harald Hoyer <harald@redhat.com>
changelog:
  - fixed EINTR stopping for e.g. SIGSTOP. (#22008)
  - added -u option for tcpdump (#20231)
  - new arpwatch version (#23172)
  - added "all" and "one" interface for -i (#20907)
  - added arpwatch sysconfig (#23172)


author: Pekka Savola <pekkas@netcore.fi>
changelog:
  - use --enable-ipv6
  - Add two patches from CVS to enhance 802.2 printing, and more importantly,
    to be able to specify 'no stp'


author: Pekka Savola <pekkas@netcore.fi>
changelog:
  - Make SMB printing output a lot more quiet unless in verbose mode.
  - Make -n resolve port/protocol numbers but not hostnames, -nn for no
    resolving at all
  - Separate droproot patch from a more generic man/usage fix one
  - Add non-promiscuous mode -by default patch, but don't apply it by default


author: Pekka Savola <pekkas@netcore.fi>
changelog:
  - Update to 20010108 CVS, disable some upstreamed patches.
  - Change some additional .1 pages to .8.
  - Add droproot patch, some --usage and man page fixes.


author: Pekka Savola <pekkas@netcore.fi>
changelog:
  - Initial packaging with latest tcpdump.org CVS tcpdump-3.6 and libpcap-0.6.
  - add earlier print-domain.c, the latest is segfaulting
  - don't unnecesessarily include snprintf.o, it didn't compile with gcc 2.96 anyway
  - don't use savestr, require openssl, tweak tweak tweak
  - add tcpslice, patch it a bit for egcs detection


author: Pekka Savola <pekkas@netcore.fi>
changelog:
  - tcpdump: spice up the manpage about interfaces
  - tcpdump: add 'all' and 'any' keywords to -i, saner default behaviour.
  - upgrade arpwatch to 2.1a10


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - eliminate more buffer overflows (from FreeBSD) (#20069).
  - 802.1q ether type incorrect (#19850).
  - add -u flag to drop arpwatch privs (#19696).


author: Matt Wilson <msw@redhat.com>
changelog:
  - source /etc/init.d/functions
  - back out /etc/init.d/arpwatch, place file in /etc/rc.d
  - move initscript to /etc/init.d
  - changed initscript to use start() and stop() functions
  - added condrestart to init script
  - added %post %preun %postun scripts to register arpwatch script
  - added Prereq: for all things needed in post/preun/postun


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - remove sparc64 SIOCGIFNAME hack, not needed with (at least) kernel 2.2.12-40.
  - upgrade to ANK ss991030 snapshot with pcap magic fix (#6773).
  - add getprotobyname lookup (#6725).
  - getservbyname port lookup appears functional (#7569).
  - remove uid 2090 backdoor (sorry Dave) (#7116).


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - include A. Kuznetsov's patches to libpcap/tcpdump.
  - added arpsnmp to package (#3258).
  - arp2ethers written for different of awk (#4326).


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - separate package for libpcap.
  - update tcpdump to 3.4, libpcap to 0.4.
  - added arpwatch (but disabled for now)


author: Jie Li <jie.l.li@oracle.com> - 4.3.0-55.el6.186.195
changelog:
  - From 7d8b5dd98463524686bdee8b973b53c00c232122 Mon Sep 17 00:00:00 2001
    From: Liu Jinsong <jinsong.liu@intel.com>
    Date: Mon, 25 Nov 2013 11:19:04 +0100
    Subject: [PATCH v2 6/6] x86/xsave: fix nonlazy state handling
    Nonlazy xstates should be xsaved each time when vcpu_save_fpu.
    Operation to nonlazy xstates will not trigger #NM exception, so
    whenever vcpu scheduled in it got restored and whenever scheduled
    out it should get saved.
    Currently this bug affects AMD LWP feature, and later Intel MPX
    feature. With the bugfix both LWP and MPX will work fine.
    Signed-off-by: Liu Jinsong <jinsong.liu@intel.com>
    Furthermore, during restore we also need to set nonlazy_xstate_used
    according to the incoming accumulated XCR0.
    Also adjust the changes to i387.c such that there won't be a pointless
    clts()/stts() pair.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Based on commit from OVM3.4.5
    (cherry picked from commit 7d8b5dd98463524686bdee8b973b53c00c232122)
    Backported-by: Jie Li <jie.l.li@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com>
    Reviewed-by: Darren Kenny <darren.kenny@oracle.com> [bug 28555335] {CVE-2018-3665}


author: Jie Li <jie.l.li@oracle.com> - 4.3.0-55.el6.186.194
changelog:
  - From 32df6a92ef8065da5ab471f86ab9c67df29fcafa Mon Sep 17 00:00:00 2001
    From: Jan Beulich <jbeulich@suse.com>
    Date: Mon, 30 Jul 2018 14:17:45 +0200
    Subject: [PATCH v2 5/6] x86/spec-ctrl: command line handling adjustments
    For one, "no-xen" should not imply "no-eager-fpu", as "eager FPU" mode
    is to guard guests, not Xen itself, which is also expressed so by
    print_details().
    And then opt_ssbd, despite being off by default, should also be cleared
    by the "no" and "no-xen" sub-options.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    master commit: ac3f9a72141a48d40fabfff561d5a7dc0e1b810d
    master date: 2018-07-10 12:22:31 +0200
    Cherry-picked from: 2d69b6d00d6ac04bda01e7323bcd006f0f88ceb7
    These are followup fixes for Lazy FPU/XSA-267
    Orabug: 28696347
    Signed-off-by: Ross Philipson <ross.philipson@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovksy@oracle.com>
    Based on commit from OVM3.4.5
    (Cherry-picked from: 32df6a92ef8065da5ab471f86ab9c67df29fcafa)
    Backported-by: Jie Li <jie.l.li@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com>
    Reviewed-by: Darren Kenny <darren.kenny@oracle.com> [bug 28555335] {CVE-2018-3665}


author: Jie Li <jie.l.li@oracle.com> - 4.3.0-55.el6.186.193
changelog:
  - From f9f5f0bb3188437559ca74021b24b83fe52947d4 Mon Sep 17 00:00:00 2001
    From: Jan Beulich <jbeulich@suse.com>
    Date: Thu, 28 Jun 2018 12:28:21 +0200
    Subject: [PATCH v2 4/6] x86/HVM: don't cause #NM to be raised in Xen
    The changes for XSA-267 did not touch management of CR0.TS for HVM
    guests. In fully eager mode this bit should never be set when
    respective vCPU-s are active, or else hvmemul_get_fpu() might leave it
    wrongly set, leading to #NM in hypervisor context.
    {svm,vmx}_enter() and {svm,vmx}_fpu_dirty_intercept() become unreachable
    this way. Explicit {svm,vmx}_fpu_leave() invocations need to be guarded
    now.
    With no CR0.TS management necessary in fully eager mode, there's also no
    need anymore to intercept #NM.
    Reported-by: Charles Arnold <carnold@suse.com>
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Cherry-picked from: 598a375f5230d91ac88e76a9f4b4dde4a62a4c5b
    These are followup fixes for Lazy FPU/XSA-267
    Orabug: 28696347
    Signed-off-by: Ross Philipson <ross.philipson@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovksy@oracle.com>
    Based on commit from OVM3.4.5
    (Cherry-picked from: f9f5f0bb3188437559ca74021b24b83fe52947d4)
    Conflicts:
    - context difference only
    Backported-by: Jie Li <jie.l.li@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com>
    Reviewed-by: Darren Kenny <darren.kenny@oracle.com> [bug 28555335] {CVE-2018-3665}


author: Jie Li <jie.l.li@oracle.com> - 4.3.0-55.el6.186.192
changelog:
  - From fccf5221ce4a55268e31a6c069b4889ee35416e6 Mon Sep 17 00:00:00 2001
    From: Jan Beulich <jbeulich@suse.com>
    Date: Thu, 28 Jun 2018 12:27:56 +0200
    Subject: [PATCH v2 3/6] x86/EFI: further correct FPU state handling around runtime calls
    We must not leave a vCPU with CR0.TS clear when it is not in fully eager
    mode and has not touched non-lazy state. Instead of adding a 3rd
    invocation of stts() to vcpu_restore_fpu_eager(), consolidate all of
    them into a single one done at the end of the function.
    Rename the function at the same time to better reflect its purpose, as
    the patches touches all of its occurences anyway.
    The new function parameter is not really well named, but
    "need_stts_if_not_fully_eager" seemed excessive to me.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Paul Durrant <paul.durrant@citrix.com>
    Cherry-picked from: b7b7c4df2d251b1feba217939ea0b618094a48c2
    These are followup fixes for Lazy FPU/XSA-267
    Signed-off-by: Ross Philipson <ross.philipson@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovksy@oracle.com>
    The previous version of this patch was reverted. This second version
    of this patch fixes a crash in xrstor due to idle domain threads not
    having an xsave area which leads to a NULL ptr deref. When Xen is
    booted as an EFI boot loader, it calls run time services at early
    boot time where this occurs on an idle domain vcpu. The fix is to check
    for a NULL xsave_area in xsave() and xrstor().
    Orabug: 28746888
    Signed-off-by: Ross Philipson <ross.philipson@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovksy@oracle.com>
    Based on commit from OVM3.4.5
    (Cherry-picked from: fccf5221ce4a55268e31a6c069b4889ee35416e6)
    Conflicts:
    - context differences
    - is_hvm_vcpu() is used instead of is_pv_vcpu() due to 3.3 doesn't
    have the latter
    Backported-by: Jie Li <jie.l.li@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com>
    Reviewed-by: Darren Kenny <darren.kenny@oracle.com> [bug 28555335] {CVE-2018-3665}


author: Jie Li <jie.l.li@oracle.com> - 4.3.0-55.el6.186.191
changelog:
  - From 8b43dba27c8ea017aae4908bb380693263624e10 Mon Sep 17 00:00:00 2001
    From: Jan Beulich <jbeulich@suse.com>
    Date: Thu, 28 Jun 2018 12:27:34 +0200
    Subject: [PATCH v2 2/6] x86/EFI: fix FPU state handling around runtime calls
    There are two issues.  First, the nonlazy xstates were never restored
    after returning from the runtime call.
    Secondly, with the fully_eager_fpu mitigation for XSA-267 / LazyFPU, the
    unilateral stts() is no longer correct, and hits an assertion later when
    a lazy state restore tries to occur for a fully eager vcpu.
    Fix both of these issues by calling vcpu_restore_fpu_eager().  As EFI
    runtime services can be used in the idle context, the idle assertion
    needs to move until after the fully_eager_fpu check.
    Introduce a "curr" local variable and replace other uses of "current"
    at the same time.
    Reported-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Tested-by: Juergen Gross <jgross@suse.com>
    Cherry-picked from: ba7d0117ab535280e2b6821aa6d323053ac6b266
    These are followup fixes for Lazy FPU/XSA-267
    Signed-off-by: Ross Philipson <ross.philipson@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovksy@oracle.com>
    The previous version of this patch was reverted. This second version
    of this patch fixes a crash in xrstor due to idle domain threads not
    having an xsave area which leads to a NULL ptr deref. When Xen is
    booted as an EFI boot loader, it calls run time services at early
    boot time where this occurs on an idle domain vcpu. The fix is to check
    for a NULL xsave_area in xsave() and xrstor().
    Orabug: 28746888
    Signed-off-by: Ross Philipson <ross.philipson@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovksy@oracle.com>
    Based on commit from OVM3.4.5
    (Cherry-picked from: 8b43dba27c8ea017aae4908bb380693263624e10)
    Conflicts:
    - context differences
    - is_hvm_vcpu() is used instead of is_pv_vcpu() due to 3.3 doesn't
    have the latter
    Backported-by: Jie Li <jie.l.li@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com>
    Reviewed-by: Darren Kenny <darren.kenny@oracle.com> [bug 28555335] {CVE-2018-3665}


author: Jie Li <jie.l.li@oracle.com> - 4.3.0-55.el6.186.190
changelog:
  - From 3ed5db85b82cb67e669fdddffa205187a6343a9c Mon Sep 17 00:00:00 2001
    From: Jan Beulich <jbeulich@suse.com>
    Date: Tue, 24 Jun 2014 09:42:49 +0200
    Subject: [PATCH v2 1/6] x86/EFI: allow FPU/XMM use in runtime service functions
    UEFI spec update 2.4B developed a requirement to enter runtime service
    functions with CR0.TS (and CR0.EM) clear, thus making feasible the
    already previously stated permission for these functions to use some of
    the XMM registers. Enforce this requirement (along with the connected
    ones on FPU control word and MXCSR) by going through a full FPU save
    cycle (if the FPU was dirty) in efi_rs_enter() (along with loading  the
    specified values into the other two registers).
    Note that the UEFI spec mandates that extension registers other than
    XMM ones (for our purposes all that get restored eagerly) are preserved
    across runtime function calls, hence there's nothing we need to restore
    in efi_rs_leave() (they do get saved, but just for simplicity's sake).
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    master commit: e0fe297dabc96d8161d568f19a99722c4739b9f9
    master date: 2014-06-18 15:53:27 +0200
    Based on commit from OVM3.4.5.
    This is a prerequisite for XSA-267
    (Cherry-picked from: 3ed5db85b82cb67e669fdddffa205187a6343a9c)
    Conflicts:
    - context difference only
    Backported-by: Jie Li <jie.l.li@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com>
    Reviewed-by: Darren Kenny <darren.kenny@oracle.com> [bug 28555335] {CVE-2018-3665}


author: Jie Li <jie.l.li@oracle.com> - 4.3.0-55.el6.186.189
changelog:
  - From: Julien Grall <julien.grall@linaro.org>
    Signed-off-by: Julien Grall <julien.grall@linaro.org>
    Acked-by: Keir Fraser <keir@xen.org>
    CC: Jan Beulich <jbeulich@suse.com>
    This is a prerequisite for XSA-273
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com> [bug 28574332] {CVE-2018-3620}


author: Jie Li <jie.l.li@oracle.com> - 4.3.0-55.el6.186.188
changelog:
  - From: Ross Philipson <ross.philipson@oracle.com>
    This utility can offline all SMT siblings. It can be used to skip CPUs
    dedicated to dom0. For symmetry with other tools, it can also be used
    to online SMT siblings.
    This is part of XSA-273
    Orabug: 28487050
    Signed-off-by: Ross Philipson <ross.philipson@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com> [bug 28574332] {CVE-2018-3646} {CVE-2018-3620}


author: Jie Li <jie.l.li@oracle.com> - 4.3.0-55.el6.186.187
changelog:
  - From: Andrew Cooper <andrew.cooper3@citrix.com>
    This mitigation requires up-to-date microcode, and is enabled by default on
    affected hardware if available.
    The default for SMT/Hyperthreading is far more complicated to reason about,
    not least because we don't know if the user is going to want to run any HVM
    guests to begin with.  If a explicit default isn't given, nag the user to
    perform a risk assessment and choose an explicit default, and leave other
    configuration to the toolstack.
    This is part of XSA-273 / CVE-2018-3620.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Orabug: 28487050
    This version differs from the upstream version in that it does the
    L1D flush from the tail end of vmx_vmenter_helper(). Having the flush
    done during the VMCS restore causes a platform hang in our version of
    Xen. This issue will be investigated separately. The rest
    are just some minor context and offset diffs.
    Signed-off-by: Ross Philipson <ross.philipson@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com> [bug 28574332] {CVE-2018-3646} {CVE-2018-3620}


author: Jie Li <jie.l.li@oracle.com> - 4.3.0-55.el6.186.186
changelog:
  - From: Andrew Cooper <andrew.cooper3@citrix.com>
    Guests (outside of the nested virt case, which isn't supported yet) don't need
    L1D_FLUSH for their L1TF mitigations, but offering/emulating MSR_FLUSH_CMD is
    easy and doesn't pose an issue for Xen.
    The MSR is offered to HVM guests only.  PV guests attempting to use it would
    trap for emulation, and the L1D cache would fill long before the return to
    guest context.  As such, PV guests can't make any use of the L1D_FLUSH
    functionality.
    This is part of XSA-273 / CVE-2018-3646.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Orabug: 28487050
    This patch differs a fair amount from the upstream version. The CPUID policy
    in this version of Xen is a partial implementation of what is upstream so the
    management of it is different. The end result is the same functionality
    though.
    Signed-off-by: Ross Philipson <ross.philipson@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com> [bug 28574332] {CVE-2018-3646} {CVE-2018-3620}


author: Jie Li <jie.l.li@oracle.com> - 4.3.0-55.el6.186.185
changelog:
  - From: Andrew Cooper <andrew.cooper3@citrix.com>
    This is part of XSA-273 / CVE-2018-3646.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    Orabug: 28487050
    Mostly the same. The file tools/misc/xen-cpuid.c does not exist
    so those changes did not apply. Also the CPUIDs are specified differenly
    in this version of Xen. The rest were just context and offset diffs.
    Signed-off-by: Ross Philipson <ross.philipson@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com> [bug 28574332] {CVE-2018-3646} {CVE-2018-3620}


author: Jie Li <jie.l.li@oracle.com> - 4.3.0-55.el6.186.184
changelog:
  - From: Andrew Cooper <andrew.cooper3@citrix.com>
    Safe PTE addresses for L1TF mitigations are ones which are within the L1D
    address width (may be wider than reported in CPUID), and above the highest
    cacheable RAM/NVDIMM/BAR/etc.
    All logic here is best-effort heuristics, which should in practice be fine for
    most hardware.  Future work will see about disentangling and feeding SRAT
    information into the heuristics, as well as having L0 pass this information
    down to lower levels when virtualised.
    This is part of XSA-273 / CVE-2018-3620.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Orabug: 28487050
    Patch mostly the same, some context differences and offset mismatches.
    There are some bits of the PV support in this patch also but they were
    left there to keep the patch similar to its upstream cousin.
    Also we are not picking up original patch's EFI code changes because they
    are related to PV only.
    Signed-off-by: Ross Philipson <ross.philipson@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com> [bug 28574332] {CVE-2018-3646} {CVE-2018-3620}


author: Jie Li <jie.l.li@oracle.com> - 4.3.0-55.el6.186.183
changelog:
  - From: Jan Beulich <JBeulich@suse.com>
    Shared resources (L1 cache and TLB in particular) present a risk of
    information leak via side channels. Provide a means to avoid use of
    hyperthreads in such cases.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Roger Pau Monn?195?169 <roger.pau@citrix.com>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    This is a prerequisite for XSA-273
    Orabug: 28487050
    (cherry picked from commit d8f974f1a646c0200b97ebcabb808324b288fadb)
    Mostly the same. Slight difference in logic in the setup CPU online/offline
    code. Also use BAD_APICID instead of INVALID_CUID.
    Signed-off-by: Ross Philipson <ross.philipson@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Reviewed-by: Joao Martins <joao.m.martins@oracle.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com> [bug 28574332] {CVE-2018-3646} {CVE-2018-3620}


author: Jie Li <jie.l.li@oracle.com> - 4.3.0-55.el6.186.182
changelog:
  - From: Jan Beulich <jbeulich@suse.com>
    While I've run into the issue with further patches in place which no
    longer guarantee the per-CPU area to start out as all zeros, the
    CPU_DOWN_FAILED processing looks to have the same issue: By not zapping
    the per-CPU cpupool pointer, cpupool_cpu_add()'s (indirect) invocation
    of schedule_cpu_switch() will trigger the "c != old_pool" assertion
    there.
    Clearing the field during CPU_DOWN_PREPARE is too early (afaict this
    should not happen before cpu_disable_scheduler()). Clearing it in
    CPU_DEAD and CPU_DOWN_FAILED would be an option, but would take the same
    piece of code twice. Since the field's value shouldn't matter while the
    CPU is offline, simply clear it (implicitly) for CPU_ONLINE and
    CPU_DOWN_FAILED, but only for other than the suspend/resume case (which
    gets specially handled in cpupool_cpu_remove()).
    By adjusting the conditional in cpupool_cpu_add() CPU_DOWN_FAILED
    handling in the suspend case should now also be handled better.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Juergen Gross <jgross@suse.com>
    This is a prerequisite for XSA-273
    Orabug: 28487050
    (cherry picked from commit cb1ae9a27819cea0c5008773c68a7be6f37eb0e5)
    Applied cleanly.
    Signed-off-by: Ross Philipson <ross.philipson@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com> [bug 28574332] {CVE-2018-3646} {CVE-2018-3620}


author: Jie Li <jie.l.li@oracle.com> - 4.3.0-55.el6.186.181
changelog:
  - From: Dario Faggioli <dario.faggioli@citrix.com>
    in fact, before this change, shutting down or suspending the
    system with some CPUs not assigned to any cpupool, would
    crash as follows:
    (XEN) Xen call trace:
    (XEN)    [<ffff82d080101757>] disable_nonboot_cpus+0xb5/0x138
    (XEN)    [<ffff82d0801a8824>] enter_state_helper+0xbd/0x369
    (XEN)    [<ffff82d08010614a>] continue_hypercall_tasklet_handler+0x4a/0xb1
    (XEN)    [<ffff82d0801320bd>] do_tasklet_work+0x78/0xab
    (XEN)    [<ffff82d0801323f3>] do_tasklet+0x5e/0x8a
    (XEN)    [<ffff82d080163cb6>] idle_loop+0x56/0x6b
    (XEN)
    (XEN)
    (XEN) ****************************************
    (XEN) Panic on CPU 0:
    (XEN) Xen BUG at cpu.c:191
    (XEN) ****************************************
    This is because, for free CPUs, -EBUSY were being returned
    when trying to tear them down, making cpu_down() unhappy.
    It is certainly unpractical to forbid shutting down or
    suspenging if there are unassigned CPUs, so this change
    fixes the above by just avoiding returning -EBUSY for those
    CPUs. If shutting off, that does not matter much anyway. If
    suspending, we make sure that the CPUs remain unassigned
    when resuming.
    While there, take the chance to:
    - fix the doc comment of cpupool_cpu_remove() (it was
    wrong);
    - improve comments in general around and in cpupool_cpu_remove()
    and cpupool_cpu_add();
    - add a couple of ASSERT()-s for checking consistency.
    Signed-off-by: Dario Faggioli <dario.faggioli@citrix.com>
    Reviewed-by: Juergen Gross <jgross@suse.com>
    Tested-by: Juergen Gross <jgross@suse.com>
    This is a prerequisite for XSA-273
    For OVM3.3 only and OVM3.4 already has the commit.
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com> [bug 28574332] {CVE-2018-3620}


author: Jie Li <jie.l.li@oracle.com> - 4.3.0-55.el6.186.180
changelog:
  - From: Juergen Gross <jgross@suse.com>
    When shutting down the machine while there are cpus in a cpupool other than
    Pool-0 a crash is triggered due to cpupool handling rejecting offlining the
    non-boot cpus in other cpupools.
    It is easy to detect this case and allow offlining those cpus.
    Reported-by: Stefan Bader <stefan.bader@canonical.com>
    Signed-off-by: Juergen Gross <jgross@suse.com>
    Tested-by: Stefan Bader <stefan.bader@canonical.com>
    master commit: 05377dede434c746e6708f055858378d20f619db
    master date: 2014-07-23 18:03:19 +0200
    This is a prerequisite for XSA-273
    For OVM3.3 only and OVM3.4 already has the commit.
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com> [bug 28574332] {CVE-2018-3620}


author: Jie Li <jie.l.li@oracle.com> - 4.3.0-55.el6.186.179
changelog:
  - From: Dario Faggioli <dario.faggioli@citrix.com>
    which means such an event must be handled at the call sites
    of cpupool_assign_cpu_locked(), and the error, if occurring,
    properly propagated.
    Signed-off-by: Dario Faggioli <dario.faggioli@citrix.com>
    Reviewed-by: Juergen Gross <jgross@suse.com>
    This is a prerequisite for XSA-273
    For OVM3.3 only and OVM3.4 already has the commit.
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com> [bug 28574332] {CVE-2018-3620}


author: Jie Li <jie.l.li@oracle.com> - 4.3.0-55.el6.186.178
changelog:
  - From: Andrew Cooper <andrew.cooper3@citrix.com>
    Intel Core processors since at least Nehalem speculate past #NM, which is the
    mechanism by which lazy FPU context switching is implemented.
    On affected processors, Xen must use fully eager FPU context switching to
    prevent guests from being able to read FPU state (SSE/AVX/etc) from previously
    scheduled vcpus.
    This is part of XSA-267
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    Taken from the xsa267-4.6-2.patch posted with the XSA
    Conflicts:
    Context differences only
    Orabug: 28135175
    Signed-off-by: Ross Philipson <ross.philipson@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Acked-by: Adnan Misherfi <adnan.misherfi@oracle.con>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com> [bug 28555335] {CVE-2018-3665} {CVE-2018-3665}


author: Jie Li <jie.l.li@oracle.com> - 4.3.0-55.el6.186.177
changelog:
  - From: Andrew Cooper <andrew.cooper3@citrix.com>
    This is controlled on a per-vcpu bases for flexibility.
    This is part of XSA-267
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    Taken from the xsa267-4.6-1.patch posted with the XSA
    Conflicts:
    Context differences only
    Orabug: 28135175
    Signed-off-by: Ross Philipson <ross.philipson@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Acked-by: Adnan Misherfi <adnan.misherfi@oracle.con>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com> [bug 28555335] {CVE-2018-3665} {CVE-2018-3665}


author: Jie Li <jie.l.li@oracle.com> - 4.3.0-55.el6.186.176
changelog:
  - From 2b1ac3ced59e3d0309572c146d74e90a2e861965 Mon Sep 17 00:00:00 2001
    From: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Date: Wed, 29 Aug 2018 03:12:24 +0800
    Subject: [PATCH OVM3.3.x v2 18/18] x86/spectre: Fix SPEC_CTRL_ENTRY_FROM_INTR_IST macro
    SPEC_CTRL_ENTRY_FROM_INTR_IST is trying to follow upstream implementation and
    is using STACK_CPUINFO_FIELD macro to access cpuinfo's xen_spec_ctrl field.
    Unfortunately, OVM's definition of this field is obsolete, we have not updated
    to commit 4f6aea06 ("x86: reduce code size of struct cpu_info member accesses").
    We are calculating end of stack as
    movq $STACK_SIZE-1, %r14;
    orq  %rsp, %r14;
    which is open-coded implemetation of GET_STACK_END from the above commit and then
    using older definition of STACK_CPUINFO_FIELD. This results in %eax getting
    garbage, causing #GP when writing MSR 0x48.
    Instead of backporting 4f6aea06 we should simply open-code STACK_CPUINFO_FIELD
    as defined in that commit, especially since we do it elsewhere in this file.
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Reviewed-by: Bhavesh Davda <bhavesh.davda@oracle.com>
    Backported from OVM3.4 commit 37c139ca51ded61f1aa064d0718643054cdb852a
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com> [bug 28061097] {CVE-2018-3639}


author: Jie Li <jie.l.li@oracle.com> - 4.3.0-55.el6.186.175
changelog:
  - From cf1d101056f5ac447d09dd3cefb5a560bfd8af8a Mon Sep 17 00:00:00 2001
    From: Jan Beulich <jbeulich@suse.com>
    Date: Tue, 29 May 2018 12:38:52 +0200
    Subject: [PATCH OVM3.3.x v2 17/18] x86: correct default_xen_spec_ctrl calculation
    Even with opt_msr_sc_{pv,hvm} both false we should set up the variable
    as usual, to ensure proper one-time setup during boot and CPU bringup.
    This then also brings the code in line with the comment immediately
    ahead of the printk() being modified saying "irrespective of guests".
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Release-acked-by: Juergen Gross <jgross@suse.com>
    (cherry picked from commit d6239f64713df819278bf048446d3187c6ac4734)
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Reviewed-by: Patrick Colp <patrick.colp@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com> [bug 28061097] {CVE-2018-3639}


author: Jie Li <jie.l.li@oracle.com> - 4.3.0-55.el6.186.174
changelog:
  - From 5ce626add58bbe7b2d7463942d9c97e50aff97fb Mon Sep 17 00:00:00 2001
    From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Fri, 13 Apr 2018 15:42:34 +0000
    Subject: [PATCH OVM3.3.x v2 16/18] x86/msr: Virtualise MSR_SPEC_CTRL.SSBD for guests to use
    Almost all infrastructure is already in place.  Update the reserved bits
    calculation in guest_wrmsr(), and offer SSBD to guests by default.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    (cherry picked from commit cd53023df952cf0084be9ee3d15a90f8837049c2)
    This is XSA-263.
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com>
    Acked-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Conflicts:
    - no MSR_INTEL_MISC_FEATURES_ENABLES in guest_wrmsr
    - no cpufeatureset.h, set X86_FEATURE_SSBD in libxc
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com> [bug 28061097] {CVE-2018-3639}


author: Jie Li <jie.l.li@oracle.com> - 4.3.0-55.el6.186.173
changelog:
  - From b031a8b6e42f8ff595b7896c147056fc9fbea88c Mon Sep 17 00:00:00 2001
    From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Wed, 28 Mar 2018 15:21:39 +0100
    Subject: [PATCH OVM3.3.x v2 15/18] x86/Intel: Mitigations for GPZ SP4 - Speculative Store Bypass
    To combat GPZ SP4 "Speculative Store Bypass", Intel have extended their
    speculative sidechannel mitigations specification as follows:
    * A feature bit to indicate that Speculative Store Bypass Disable is
    supported.
    * A new bit in MSR_SPEC_CTRL which, when set, disables memory disambiguation
    in the pipeline.
    * A new bit in MSR_ARCH_CAPABILITIES, which will be set in future hardware,
    indicating that the hardware is not susceptible to Speculative Store Bypass
    sidechannels.
    For contemporary processors, this interface will be implemented via a
    microcode update.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    (cherry picked from commit 9df52a25e0e95a0b9971aa2fc26c5c6a5cbdf4ef)
    This is XSA-263.
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com>
    Acked-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Conflicts:
    - No upstream's CPUID framework, we have our own. Implement
    proper CPUID support for SSBD, OVM-specific.
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com> [bug 28061097] {CVE-2018-3639}


author: Jie Li <jie.l.li@oracle.com> - 4.3.0-55.el6.186.172
changelog:
  - From 1c4bde7d9761d63cf9564a02f349351ccc9fdcd8 Mon Sep 17 00:00:00 2001
    From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Thu, 26 Apr 2018 10:56:28 +0100
    Subject: [PATCH OVM3.3.x v2 14/18] x86/AMD: Mitigations for GPZ SP4 - Speculative Store Bypass
    AMD processors will execute loads and stores with the same base register in
    program order, which is typically how a compiler emits code.
    Therefore, by default no mitigating actions are taken, despite there being
    corner cases which are vulnerable to the issue.
    For performance testing, or for users with particularly sensitive workloads,
    the `spec-ctrl=ssbd` command line option is available to force Xen to disable
    Memory Disambiguation on applicable hardware.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    (cherry picked from commit 8c0e338086f060eba31d37b83fbdb883928aa085)
    This is XSA-263.
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com>
    Acked-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Conflicts:
    tools/libxl/libxl_cpuid.c
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com> [bug 28061097] {CVE-2018-3639}


author: Jie Li <jie.l.li@oracle.com> - 4.3.0-55.el6.186.171
changelog:
  - From 86eac18feb0c1cbaa350e627176a99e9bd73297a Mon Sep 17 00:00:00 2001
    From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Thu, 26 Apr 2018 10:52:55 +0100
    Subject: [PATCH OVM3.3.x v2 13/18] x86/spec_ctrl: Introduce a new `spec-ctrl=` command line argument to replace `bti=`
    In hindsight, the options for `bti=` aren't as flexible or useful as expected
    (including several options which don't appear to behave as intended).
    Changing the behaviour of an existing option is problematic for compatibility,
    so introduce a new `spec-ctrl=` in the hopes that we can do better.
    One common way of deploying Xen is with a single PV dom0 and all domUs being
    HVM domains.  In such a setup, an administrator who has weighed up the risks
    may wish to forgo protection against malicious PV domains, to reduce the
    overall performance hit.  To cater for this usecase, `spec-ctrl=no-pv` will
    disable all speculative protection for PV domains, while leaving all
    speculative protection for HVM domains intact.
    For coding clarity as much as anything else, the suboptions are grouped by
    logical area; those which affect the alternatives blocks, and those which
    affect Xen's in-hypervisor settings.  See the xen-command-line.markdown for
    full details of the new options.
    While changing the command line options, take the time to change how the data
    is reported to the user.  The three DEBUG printks are upgraded to unilateral,
    as they are all relevant pieces of information, and the old "mitigations:"
    line is split in the two logical areas described above.
    Sample output from booting with `spec-ctrl=no-pv` looks like:
    (XEN) Speculative mitigation facilities:
    (XEN)   Hardware features: IBRS/IBPB STIBP IBPB
    (XEN)   Compiled-in support: INDIRECT_THUNK
    (XEN)   Xen settings: BTI-Thunk RETPOLINE, SPEC_CTRL: IBRS-, Other: IBPB
    (XEN)   Support for VMs: PV: None, HVM: MSR_SPEC_CTRL RSB
    (XEN)   XPTI (64-bit PV only): Dom0 enabled, DomU enabled
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Wei Liu <wei.liu2@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    Release-acked-by: Juergen Gross <jgross@suse.com>
    (cherry picked from commit 3352afc26c497d26ecb70527db3cb29daf7b1422)
    This is a prerequisite for XSA-263
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com>
    Acked-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Conflicts:
    xen/arch/x86/spec_ctrl.c - context conflicts
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com> [bug 28061097] {CVE-2018-3639}


author: Jie Li <jie.l.li@oracle.com> - 4.3.0-55.el6.186.170
changelog:
  - From f76070cd46469b905d27c28308f95641f0414c2e Mon Sep 17 00:00:00 2001
    From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Tue, 1 May 2018 11:59:03 +0100
    Subject: [PATCH OVM3.3.x v2 12/18] x86/cpuid: Improvements to guest policies for speculative sidechannel features
    If Xen isn't virtualising MSR_SPEC_CTRL for guests, IBRSB shouldn't be
    advertised.  It is not currently possible to express this via the existing
    command line options, but such an ability will be introduced.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Wei Liu <wei.liu2@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    Release-acked-by: Juergen Gross <jgross@suse.com>
    (cherry picked from commit cb06b308ec71b23f37a44f5e2351fe2cae0306e9)
    This is a prerequisite for XSA-263
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com>
    Acked-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Based on 4.6 patch
    Conflicts:
    - No changes to xen/arch/x86/traps.c since we don't really
    support PV mitigations
    - Make changes to update_domain_cpuid_info() to tie X86_FEATURE_SC_MSR_HVM
    to cp->feat.ibrsb
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com> [bug 28061097] {CVE-2018-3639}


author: Jie Li <jie.l.li@oracle.com> - 4.3.0-55.el6.186.169
changelog:
  - From 6fb449d31503913d6187ccb9203f7d00094fa715 Mon Sep 17 00:00:00 2001
    From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Mon, 21 May 2018 15:07:13 -0400
    Subject: [PATCH OVM3.3.x v2 11/18] x86/spec_ctrl: Explicitly set Xen's default MSR_SPEC_CTRL value
    With the impending ability to disable MSR_SPEC_CTRL handling on a
    per-guest-type basis, the first exit-from-guest may not have the side effect
    of loading Xen's choice of value.  Explicitly set Xen's default during the BSP
    and AP boot paths.
    For the BSP however, delay setting a non-zero MSR_SPEC_CTRL default until
    after dom0 has been constructed when safe to do so.  Oracle report that this
    speeds up boots of some hardware by 50s.
    "when safe to do so" is based on whether we are virtualised.  A native boot
    won't have any other code running in a position to mount an attack.
    Reported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Wei Liu <wei.liu2@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    Release-acked-by: Juergen Gross <jgross@suse.com>
    From upstream commit cb8c12020307b39a89273d7699e89000451987ab
    Mostly the same. Signigicant context differences in __start_xen
    and start_secondary. Also had to add cpu_has_hypervisor.
    This is a prerequisite for XSA-263
    Signed-off-by: Ross Philipson <ross.philipson@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Acked-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com> [bug 28061097] {CVE-2018-3639}


author: Jie Li <jie.l.li@oracle.com> - 4.3.0-55.el6.186.168
changelog:
  - From b3f576f2dc8fa64ddf05348463e1e6578f6050d8 Mon Sep 17 00:00:00 2001
    From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Mon, 21 May 2018 14:45:14 -0400
    Subject: [PATCH OVM3.3.x v2 10/18] x86/spec_ctrl: Split X86_FEATURE_SC_MSR into PV and HVM variants
    In order to separately control whether MSR_SPEC_CTRL is virtualised for PV and
    HVM guests, split the feature used to control runtime alternatives into two.
    Xen will use MSR_SPEC_CTRL itself if either of these features are active.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Wei Liu <wei.liu2@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    Release-acked-by: Juergen Gross <jgross@suse.com>
    From upstream commit fa9eb09d446a1279f5e861e6b84fa8675dabf148
    Mostly the same, context differences.
    This is a prerequisite for XSA-263
    Signed-off-by: Ross Philipson <ross.philipson@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Acked-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com> [bug 28061097] {CVE-2018-3639}


author: Jie Li <jie.l.li@oracle.com> - 4.3.0-55.el6.186.167
changelog:
  - From 6fe58f4b6cddf7f0f7b7fc311073b15f6af316e0 Mon Sep 17 00:00:00 2001
    From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Mon, 21 May 2018 14:32:02 -0400
    Subject: [PATCH OVM3.3.x v2 09/18] x86/spec_ctrl: Elide MSR_SPEC_CTRL handling in idle context when possible
    If Xen is virtualising MSR_SPEC_CTRL handling for guests, but using 0 as its
    own MSR_SPEC_CTRL value, spec_ctrl_{enter,exit}_idle() need not write to the
    MSR.
    Requested-by: Jan Beulich <JBeulich@suse.com>
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Wei Liu <wei.liu2@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    Release-acked-by: Juergen Gross <jgross@suse.com>
    From upstream commit 94df6e8588e35cc2028ccb3fd2921c6e6360605e
    Mostly the same, context differences.
    This is a prerequisite for XSA-263
    Signed-off-by: Ross Philipson <ross.philipson@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Acked-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com> [bug 28061097] {CVE-2018-3639}


author: Jie Li <jie.l.li@oracle.com> - 4.3.0-55.el6.186.166
changelog:
  - From ba52881d66d2fea15388b7cfff6376d66000c5d6 Mon Sep 17 00:00:00 2001
    From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Mon, 21 May 2018 13:45:48 -0400
    Subject: [PATCH OVM3.3.x v2 08/18] x86/spec_ctrl: Rename bits of infrastructure to avoid NATIVE and VMEXIT
    In hindsight, using NATIVE and VMEXIT as naming terminology was not clever.
    A future change wants to split SPEC_CTRL_EXIT_TO_GUEST into PV and HVM
    specific implementations, and using VMEXIT as a term is completely wrong.
    Take the opportunity to fix some stale documentation in spec_ctrl_asm.h.  The
    IST helpers were missing from the large comment block, and since
    SPEC_CTRL_ENTRY_FROM_INTR_IST was introduced, we've gained a new piece of
    functionality which currently depends on the fine grain control, which exists
    in lieu of livepatching.  Note this in the comment.
    No functional change.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Wei Liu <wei.liu2@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    Release-acked-by: Juergen Gross <jgross@suse.com>
    From upstream commit d9822b8a38114e96e4516dc998f4055249364d5d
    Mostly the same, context differences. Had to add NOP40 to the new
    SPEC_CTRL_EXIT_TO_HVM macro.
    This is a prerequisite for XSA-263
    Signed-off-by: Ross Philipson <ross.philipson@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Acked-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com> [bug 28061097] {CVE-2018-3639}


author: Jie Li <jie.l.li@oracle.com> - 4.3.0-55.el6.186.165
changelog:
  - From f1044f946c51be916e5eb0a2dd145994da006a55 Mon Sep 17 00:00:00 2001
    From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Mon, 21 May 2018 12:46:33 -0400
    Subject: [PATCH OVM3.3.x v2 07/18] x86/spec_ctrl: Fold the XEN_IBRS_{SET,CLEAR} ALTERNATIVES together
    Currently, the SPEC_CTRL_{ENTRY,EXIT}_* macros encode Xen's choice of
    MSR_SPEC_CTRL as an immediate constant, and chooses between IBRS or not by
    doubling up the entire alternative block.
    There is now a variable holding Xen's choice of value, so use that and
    simplify the alternatives.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Wei Liu <wei.liu2@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    Release-acked-by: Juergen Gross <jgross@suse.com>
    From upstream commit af949407eaba7af71067f23d5866cd0bf1f1144d
    Backport is mostly the same. The assembly in DO_SPEC_CTRL_ENTRY had to be done
    differently to accomodate the code flow in our version.  Also had to
    add NOP40 to a number of the SPEC_CTRL_* macros.
    This is a prerequisite for XSA-263
    Signed-off-by: Ross Philipson <ross.philipson@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Acked-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com> [bug 28061097] {CVE-2018-3639}


author: Jie Li <jie.l.li@oracle.com> - 4.3.0-55.el6.186.164
changelog:
  - From 77992b0cb8994714bca172870b9b8718b6610cf8 Mon Sep 17 00:00:00 2001
    From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Mon, 21 May 2018 11:53:26 -0400
    Subject: [PATCH OVM3.3.x v2 06/18] x86/spec_ctrl: Merge bti_ist_info and use_shadow_spec_ctrl into spec_ctrl_flags
    All 3 bits of information here are control flags for the entry/exit code
    behaviour.  Treat them as such, rather than having two different variables.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Wei Liu <wei.liu2@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    Release-acked-by: Juergen Gross <jgross@suse.com>
    From upstream commit 5262ba2e7799001402dfe139ff944e035dfff928
    Most of the backport is the same. There were some trickly differences in
    logic in spec_ctrl_asm.h that had to be handled carefully. The changes
    in acpi/power.c were not use.
    This is a prerequisite for XSA-263
    Signed-off-by: Ross Philipson <ross.philipson@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Acked-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com> [bug 28061097] {CVE-2018-3639}


author: Jie Li <jie.l.li@oracle.com> - 4.3.0-55.el6.186.163
changelog:
  - From 113e2c9fcff229fe762a3013b64239becb573c59 Mon Sep 17 00:00:00 2001
    From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Mon, 21 May 2018 11:52:30 -0400
    Subject: [PATCH OVM3.3.x v2 05/18] x86/spec_ctrl: Express Xen's choice of MSR_SPEC_CTRL value as a variable
    At the moment, we have two different encodings of Xen's MSR_SPEC_CTRL value,
    which is a side effect of how the Spectre series developed.  One encoding is
    via an alias with the bottom bit of bti_ist_info, and can encode IBRS or not,
    but not other configurations such as STIBP.
    Break Xen's value out into a separate variable (in the top of stack block for
    XPTI reasons) and use this instead of bti_ist_info in the IST path.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Wei Liu <wei.liu2@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    Release-acked-by: Juergen Gross <jgross@suse.com>
    From upstream commit 66dfae0f32bfbc899c2f3446d5ee57068cb7f957
    No differences from original.
    This is a prerequisite for XSA-263
    Signed-off-by: Ross Philipson <ross.philipson@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com> [bug 28061097] {CVE-2018-3639}


author: Jie Li <jie.l.li@oracle.com> - 4.3.0-55.el6.186.162
changelog:
  - From 3a41113ed77ca29b464ff873c6b09993c33c9f99 Mon Sep 17 00:00:00 2001
    From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Mon, 21 May 2018 11:51:56 -0400
    Subject: [PATCH OVM3.3.x v2 04/18] x86/spec_ctrl: Read MSR_ARCH_CAPABILITIES only once
    Make it available from the beginning of init_speculation_mitigations(), and
    pass it into appropriate functions.  Fix an RSBA typo while moving the
    affected comment.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Reviewed-by: Wei Liu <wei.liu2@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    Release-acked-by: Juergen Gross <jgross@suse.com>
    From upstream commit d6c65187252a6c1810fd24c4d46f812840de8d3c
    No differences from original.
    This is a prerequisite for XSA-263
    Signed-off-by: Ross Philipson <ross.philipson@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Acked-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com> [bug 28061097] {CVE-2018-3639}


author: Jie Li <jie.l.li@oracle.com> - 4.3.0-55.el6.186.161
changelog:
  - From 94f998645d996baa2a60519ce8eab7e492a38a21 Mon Sep 17 00:00:00 2001
    From: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Date: Mon, 21 May 2018 11:27:50 -0400
    Subject: [PATCH OVM3.3.x v2 03/18] x86/spec_ctrl: Assume that STIBP feature is always available

    To simplify MSR_SPEC_CTRL handling always present the guest
    with STIBP feature as available if IBRS is present.

    (See upstream commit d297b56682e7 ("x86/cpuid: Handling of IBRS/IBPB,
    STIBP and IBRS for guests")

    This is a prerequisite for XSA-263

    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com>
    Acked-by: Adnan Misherfi <adnan.misherfi@oracle.com>

    patch_name:0003-x86-spec_ctrl-Assume-that-STIBP-feature-is-always-av.patch
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com> [bug 28061097] {CVE-2018-3639}


author: Jie Li <jie.l.li@oracle.com> - 4.3.0-55.el6.186.160
changelog:
  - From 1d5367b2ac72d8a40b28fba05fa4ebefac02e43b Mon Sep 17 00:00:00 2001
    From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Mon, 21 May 2018 11:26:56 -0400
    Subject: [PATCH OVM3.3.x v2 02/18] x86/spec_ctrl: Updates to retpoline-safety decision making
    All of this is as recommended by the Intel whitepaper:
    https://software.intel.com/sites/default/files/managed/1d/46/Retpoline-A-Branch-Target-Injection-Mitigation.pdf
    The 'RSB Alternative' bit in MSR_ARCH_CAPABILITIES may be set by a hypervisor
    to indicate that the virtual machine may migrate to a processor which isn't
    retpoline-safe.  Introduce a shortened name (to reduce code volume), treat it
    as authorative in retpoline_safe(), and print its value along with the other
    ARCH_CAPS bits.
    The exact processor models which do have RSB semantics which fall back to BTB
    predictions are enumerated, and include Kabylake and Coffeelake.  Leave a
    printk() in the default case to help identify cases which aren't covered.
    The exact microcode versions from Broadwell RSB-safety are taken from the
    referenced microcode update file (adjusting for the known-bad microcode
    versions).  Despite the exact wording of the text, it is only Broadwell
    processors which need a microcode check.
    In practice, this means that all Broadwell hardware with up-to-date microcode
    will use retpoline in preference to IBRS, which will be a performance
    improvement for desktop and server systems which would previously always opt
    for IBRS over retpoline.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    Release-acked-by: Juergen Gross <jgross@suse.com>
    From upstream commit 1232378bd2fef45f613db049b33852fdf84d7ddf
    No significant differences from original. Had to add some
    MSR register defines.
    This is a prerequisite for XSA-263
    Signed-off-by: Ross Philipson <ross.philipson@oracle.com>
    Also include backport of upstream's 27170adb54a5 ("x86/spec_ctrl:
    Fix typo in ARCH_CAPS decode")
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com>
    Acked-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com> [bug 28061097] {CVE-2018-3639}


author: Jie Li <jie.l.li@oracle.com> - 4.3.0-55.el6.186.159
changelog:
  - From 20dfaeaed8391e17da89f2930c3b8a43bae08fba Mon Sep 17 00:00:00 2001
    From: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Date: Wed, 23 May 2018 14:28:03 -0400
    Subject: [PATCH OVM3.3.x v2 01/18] Revert "x86/boot: Disable IBRS in intr/nmi exit path at bootup stage"
    This reverts commit bd3938aea66e9fd7e569e18f3333a7430e2690bf.
    The subsequent series will provide the same functionality (see
    introduction of bsp_delay_spec_ctrl variable in "x86/spec_ctrl:
    Explicitly set Xen's default MSR_SPEC_CTRL value" patch)
    This is a prerequisite for XSA-263
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Acked-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com> [bug 28061097] {CVE-2018-3639}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.158
changelog:
  - From: Andrew Cooper <andrew.cooper3@citrix.com>
    Subject: x86/traps: Fix handling of #DB exceptions in hypervisor context
    The WARN_ON() can be triggered by guest activities, and emits a full stack
    trace without rate limiting.  Swap it out for a ratelimited printk with just
    enough information to work out what is going on.
    Not all #DB exceptions are traps, so blindly continuing is not a safe action
    to take.  We don't let PV guests select these settings in the real %dr7 to
    begin with, but for added safety against unexpected situations, detect the
    fault cases and crash in an obvious manner.
    This is part of XSA-260 / CVE-2018-8897.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com> [bug 27989661] {CVE-2018-8897}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.157
changelog:
  - From: Andrew Cooper <andrew.cooper2@citrix.com>
    Subject: x86/traps: Use an Interrupt Stack Table for #DB
    PV guests can use architectural corner cases to cause #DB to be raised after
    transitioning into supervisor mode.
    Use an interrupt stack table for #DB to prevent the exception being taken with
    a guest controlled stack pointer.
    This is part of XSA-260 / CVE-2018-8897.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    Conflict:
    xen/arch/x86/cpu/common.c
    xen/arch/x86/x86_64/traps.c
    Changes for xen/arch/x86/cpu/common.c moved to xen/arch/x86/x86_64/traps.c for
    OVM3.3.
    There are no get_stack_trace_bottom() and get_stack_dump_bottom() in OVM3.3,
    the related chunks for xen/arch/x86/traps.c are ignored.
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com> [bug 27989661] {CVE-2018-8897}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.156
changelog:
  - From: Andrew Cooper <andrew.cooper3@citrix.com>
    Subject: x86/pv: Move exception injection into {,compat_}test_all_events()
    This allows paths to jump straight to {,compat_}test_all_events() and have
    injection of pending exceptions happen automatically, rather than requiring
    all calling paths to handle exceptions themselves.
    The normal exception path is simplified as a result, and
    compat_post_handle_exception() is removed entirely.
    This is part of XSA-260 / CVE-2018-8897.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    Conflicts:
    xen/arch/x86/x86_64/compat/entry.S
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com> [bug 27989661] {CVE-2018-8897}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.155
changelog:
  - From: Andrew Cooper <andrew.cooper3@citrix.com>
    Subject: x86/traps: Fix %dr6 handing in #DB handler
    Most bits in %dr6 accumulate, rather than being set directly based on the
    current source of #DB.  Have the handler follow the manuals guidance, which
    avoids leaking hypervisor debugging activities into guest context.
    This is part of XSA-260 / CVE-2018-8897.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com> [bug 27989661] {CVE-2018-8897}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.154
changelog:
  - From 2313478dc93085d2a9bf407d76c34f6bf50e85a8 Mon Sep 17 00:00:00 2001
    From: Jan Beulich <jbeulich@suse.com>
    Date: Thu, 26 Mar 2015 11:08:28 +0100
    Subject: [PATCH] introduce gprintk()
    ... and convert several gdprintk()-s to it, as the next patch will make
    them no-ops in non-debug builds.
    Note that as a non-debug facility this does not print file name and
    line number of the origin, to people are expected to use meaningful and
    easily distinguishable messages (i.e. just like with plain printk()).
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Acked-by: Ian Campbell <ian.campbell@citrix.com>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    This is a partial port of upstream commit, define gprintk()
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com> [bug 27989661] {CVE-2018-8897}


author: Dongli Zhang <dongli.zhang@oracle.com> - 4.3.0-55.el6.186.153
changelog:
  - x86/HVM: Restart ioreq processing state machine
    XSA-262 (commit 0c1b2f70 ("x86/HVM: guard against emulator
    driving ioreq state in weird ways") introduced a check on ioreq state to
    make sure the state's numerical value never goes back. This was done to
    prevent malicious qemu from triggering an infinite loop in the
    hypervisor.
    However, there is, in fact, a case when the state may be reset back to
    STATE_IOREQ_READY after STATE_IORESP_READY, and that is when hvm_io_assist()
    queues another request. This will cause another iteration of the loop,
    resulting in "Weird HVM ioreq state transition" warning followed by
    domain termination.
    To avoid this, reset prev_state back to STATE_IOREQ_NONE.
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com>
    Acked-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    This patch is backported from OVS345.
    OVS345 commit: 67e64eec4bfe342ca6c2ff0858ae7f5c39041013
    This patch is used to fix an error in previous OVS345 backport.
    Backported-by: Dongli Zhang <dongli.zhang@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com> [bug 27989755] {CVE-2018-10981}


author: Dongli Zhang <dongli.zhang@oracle.com> - 4.3.0-55.el6.186.152
changelog:
  - x86/HVM: guard against emulator driving ioreq state in weird ways
    In the case where hvm_wait_for_io() calls wait_on_xen_event_channel(),
    p->state ends up being read twice in succession: once to determine that
    state != p->state, and then again at the top of the loop.  This gives a
    compromised emulator a chance to change the state back between the two
    reads, potentially keeping Xen in a loop indefinitely.
    Instead:
    * Read p->state once in each of the wait_on_xen_event_channel() tests,
    * re-use that value the next time around,
    * and insist that the states continue to transition "forward" (with the
    exception of the transition to STATE_IOREQ_NONE).
    This is XSA-262.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: George Dunlap <george.dunlap@citrix.com>
    Conflicts:
    - hvm_wait_for_io() does not exist, we have the loop in hvm_do_resume();
    - struct vcpu does not have 'pending' member;
    - we dont check for STATE_IOREQ_NONE in the loop;
    Signed-off-by: Elena Ufimtseva <elena.ugfimtseva@oracle.com>
    Acked-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com>
    Reviewed-by: Patrick Colp <patrick.colp@oracle.com>
    This patch is backported from OVS345.
    upstream commit: 92938e5d149669033aecdfb3d1396948d49d1887
    OVS345 commit: 0c1b2f70b50bab700bf317050569b741b1ef07d3
    Backported-by: Dongli Zhang <dongli.zhang@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com> [bug 27989755] {CVE-2018-10981}


author: Dongli Zhang <dongli.zhang@oracle.com> - 4.3.0-55.el6.186.151
changelog:
  - x86/vpt: add support for IO-APIC routed interrupts
    And modify the HPET code to make use of it. Currently HPET interrupts
    are always treated as ISA and thus injected through the vPIC. This is
    wrong because HPET interrupts when not in legacy mode should be
    injected from the IO-APIC.
    To make things worse, the supported interrupt routing values are set
    to [20..23], which clearly falls outside of the ISA range, thus
    leading to an ASSERT in debug builds or memory corruption in non-debug
    builds because the interrupt injection code will write out of the
    bounds of the arch.hvm_domain.vpic array.
    Since the HPET interrupt source can change between ISA and IO-APIC
    always destroy the timer before changing the mode, or else Xen risks
    changing it while the timer is active.
    Note that vpt interrupt injection is racy in the sense that the
    vIO-APIC RTE entry can be written by the guest in between the call to
    pt_irq_masked and hvm_ioapic_assert, or the call to pt_update_irq and
    pt_intr_post. Those are not deemed to be security issues, but rather
    quirks of the current implementation. In the worse case the guest
    might lose interrupts or get multiple interrupt vectors injected for
    the same timer source.
    This is part of XSA-261.
    Address actual and potential compiler warnings. Fix formatting.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Signed-off-by: Elena Ufimtseva <elena.ufimtseva@oracle.com>
    Acked-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com>
    Reviewed-by: Patrick Colp <patrick.colp@oracle.com>
    This patch is backported from OVS345.
    upstream commit: 14c3f68a57361f20be33ec3848f83d8636a0d34e
    OVS345 commit: 8f36ff7f3ab2d929d46acba5abdcb5a986c2d1fb
    Backported-by: Dongli Zhang <dongli.zhang@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com> [bug 27989686] {CVE-2018-10982}


author: Dongli Zhang <dongli.zhang@oracle.com> - 4.3.0-55.el6.186.150
changelog:
  - x86/hvm/rtc: always deassert the IRQ line when clearing REG_C.IRQF
    Even in no-ack mode, there's no reason to leave the line asserted
    after an explicit ack of the interrupt.
    Furthermore, rtc_update_irq() is an unconditional noop having just cleared
    REG_C.
    Signed-off-by: Tim Deegan <tim@xen.org>
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    upstream commit: 6d27a537727ca933bfef8ba01bc65847dc97cee1
    This is prerequisite patch for XSA-261.
    Backported-by: Dongli Zhang <dongli.zhang@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com> [bug 27989686] {CVE-2018-10982}


author: Dongli Zhang <dongli.zhang@oracle.com> - 4.3.0-55.el6.186.149
changelog:
  - x86/hvm/rtc: inject RTC periodic interupts from the vpt code
    Let the vpt code drive the RTC's timer interrupts directly, as it does
    for other periodic time sources, and fix up the register state in a
    vpt callback when the interrupt is injected.
    This fixes a hang seen on Windows 2003 in no-missed-ticks mode, where
    when a tick was pending, the early callback from the VPT code would
    always set REG_C.PF on every VMENTER; meanwhile the guest was in its
    interrupt handler reading REG_C in a loop and waiting to see it clear.
    One drawback is that a guest that attempts to suppress RTC periodic
    interrupts by failing to read REG_C will receive up to 10 spurious
    interrupts, even in 'strict' mode.  However:
    - since all previous RTC models have had this property (including
    the current one, since 'no-ack' mode is hard-coded on) we're
    pretty sure that all guests can handle this; and
    - we're already playing some other interesting games with this
    interrupt in the vpt code.
    One other corner case: a guest that enables the PF timer interrupt,
    masks the interupt in the APIC and then polls REG_C looking for PF
    will not see PF getting set.  The more likely case of enabling the
    timers and masking the interrupt with REG_B.PIE is already handled
    correctly.
    Signed-off-by: Tim Deegan <tim@xen.org>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    upstream commit: c7e35c6ec705d777c0a11124ec28876f1468f2c5
    This is prerequisite patch for XSA-261.
    Backported-by: Dongli Zhang <dongli.zhang@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com> [bug 27989686] {CVE-2018-10982}


author: Dongli Zhang <dongli.zhang@oracle.com> - 4.3.0-55.el6.186.148
changelog:
  - x86/hvm/rtc: don't run the vpt timer when !REG_B.PIE
    If the guest has not asked for interrupts, don't run the vpt timer
    to generate them.  This is a prerequisite for a patch to simplify how
    the vpt interacts with the RTC, and also gets rid of a timer series in
    Xen in a case where it's unlikely to be needed.
    Instead, calculate the correct value for REG_C.PF whenever REG_C is
    read or PIE is enabled.  This allow a guest to poll for the PF bit
    while not asking for actual timer interrupts.  Such a guest would no
    longer get the benefit of the vpt's timer modes.
    Signed-off-by: Tim Deegan <tim@xen.org>
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    upstream commit: 4c15a82f034c9c2213a18b6320834f3906d00ba9
    This is prerequisite patch for XSA-261.
    Backported-by: Dongli Zhang <dongli.zhang@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com> [bug 27989686] {CVE-2018-10982}


author: Dongli Zhang <dongli.zhang@oracle.com> - 4.3.0-55.el6.186.147
changelog:
  - x86/hvm: fix restart of RTC periodic timer with vpt_align=1
    The commit 58afa7ef "x86/hvm: Run the RTC periodic timer on a
    consistent time series" aligns the RTC periodic timer to the VM's boot time.
    However, it's aligned later again to the system time in create_periodic_time()
    with vpt_align=1. The next tick might be skipped.
    Signed-off-by: Kouya Shimura <kouya@jp.fujitsu.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    Acked-by: Tim Deegan <tim@xen.org>
    upstream commit: 48535f5798e3e237d9920a74c1ce3802958136c0
    This is prerequisite patch for XSA-261.
    Backported-by: Dongli Zhang <dongli.zhang@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com> [bug 27989686] {CVE-2018-10982}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.146
changelog:
  - From: Jan Beulich <jbeulich@suse.com>
    Subject: gnttab: don't blindly free status pages upon version change
    There may still be active mappings, which would trigger the respective
    BUG_ON(). Split the loop into one dealing with the page attributes and
    the second (when the first fully passed) freeing the pages. Return an
    error if any pages still have pending references.
    This is part of XSA-255.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Conflict:
    xen/common/grant_table.c
    xsa255-4.6-1.patch and ARM related chunks are ignored.
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com> [bug 27827705] {CVE-2018-7541}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.145
changelog:
  - From 177bd5fb7b991e6ac461ede4d2b70c0ec5bfc294 Mon Sep 17 00:00:00 2001
    From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Fri, 5 Jun 2015 12:10:33 +0200
    Subject: [PATCH] mem: expose typesafe mfns/gfns/pfns to common code
    As the first step of memory management cleanup, introduce the common code to
    mfn_t, gfn_t and pfn_t.
    The typesafe construction moves to its own header file, while the declarations
    and sentinal values are moved to being common.
    No functional change.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Acked-by: Tim Deegan <tim@xen.org>
    Conflict:
    xen/include/xen/mm.h
    Prerequisite patch for XSA-255, add gfn_t
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com> [bug 27827710] {CVE-2018-7541}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.144
changelog:
  - From: Jan Beulich <jbeulich@suse.com>
    Subject: memory: don't implicitly unpin for decrease-reservation
    It very likely was a mistake (copy-and-paste from domain cleanup code)
    to implicitly unpin here: The caller should really unpin itself before
    (or after, if they so wish) requesting the page to be removed.
    This is XSA-252.
    Reported-by: Jann Horn <jannh@google.com>
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Ross Philipson <ross.philipson@oracle.com> [bug 27835053] {CVE-2018-7540}


author: Robbie Harwood <rharwood@redhat.com> - 1.10.3-42z1
changelog:
  - Fix CVE-2015-8629 and CVE-2015-8631
  - Also fix a spec trigger issue that prevents building
  - Resolves: #1306973


author: Roland Mainz <rmainz@redhat.com> - 1.10.3-42
changelog:
  - fix for RH bug #1210704 ("Remove stray include in krb5's
    localauth_plugin.h"). This unnecessary #include statement
    was causing build failures on some systems by making libkrb5
    sources depend on gssapi.h (and as result to libcom_err,
    too).


author: Roland Mainz <rmainz@redhat.com> - 1.10.3-40
changelog:
  - fix for CVE-2014-5355 (#1193939) "krb5: unauthenticated
    denial of service in recvauth_common() and others"


author: - Roland Mainz <rmainz@redhat.com> - 1.10.3-39
changelog:
  - Backout patch #137 for krbdev #7996 ("Simplify and improve
    ksu cred verification" - see 1.10.3-36) for now until we
    figure out how to get this working.


author: Roland Mainz <rmainz@redhat.com> - 1.10.3-38
changelog:
  - Backported krbdev #7868 ("Use preauth options when changing
    password") from krb-1.13 to fix RH bug #1075656 ("krb5
    client ignores FAST settings for changepw requests"):
    If we try to change the password in
    |rb5_get_init_creds_password()|, we must use all
    application-specified gic options which affect
    preauthentication when getting the kadmin/changepw ticket.
    Create a helper function |make_chpw_options()| which copies
    the application's options, unsets the options we don't want,
    and sets options appropriate for a temporary ticket.


author: Roland Mainz <rmainz@redhat.com> - 1.10.3-37
changelog:
  - Backported krb5-1.12.2 changes for |getclhoststr()|
    to fix RH bug #1154130 ("kadmind (Error): iprop_full_resync_1:
    getclhoststr failed").


author: Roland Mainz <rmainz@redhat.com> - 1.10.3-36
changelog:
  - Backported krbdev #7996 ("Simplify and improve ksu cred
    verification"; cherry-picked from upstream
    bbfe19f03bdeca7b05b542dbae4c1692c9800c70) to fix RH bug
      less than 5 mins"): When verifying the user's initial
    credentials, don't compute a server name and preemptively
    obtain creds for it. This change allows
    |krb5_verify_init_creds()| to use any host key in the
    keytab, and not just the one for the canonicalized local
    hostname.


author: Roland Mainz <rmainz@redhat.com> - 1.10.3-35
changelog:
  - fix for CVE-2014-5352 (#1179856) "gss_process_context_token()
    incorrectly frees context (MITKRB5-SA-2015-001)"
  - fix for CVE-2014-9421 (#1179857) "kadmind doubly frees partial
    deserialization results (MITKRB5-SA-2015-001)"
  - fix for CVE-2014-9422 (#1179861) "kadmind incorrectly
    validates server principal name (MITKRB5-SA-2015-001)"


author: Roland Mainz <roland.mainz@nrubsig.org> 1.10.3-34
changelog:
  - Backport of krb1.12 localauth plugin support
    See krb5-1.10-localauth_backport.patch for porting comments.


author: Nalin Dahyabhai <nalin@redhat.com> 1.10.3-31
changelog:
  - ksu: when evaluating .k5users, don't throw away data from .k5users when we're
    not passed a command to run, which implicitly means we're attempting to run
    the target user's shell (#1026721, revised)


author: Nalin Dahyabhai <nalin@redhat.com> 1.10.3-30
changelog:
  - ksu: when evaluating .k5users, treat lines with just a principal name as if
    they contained the principal name followed by '*', and don't throw away data
    from .k5users when we're not passed a command to run, which implicitly means
    we're attempting to run the target user's shell (#1026721, revised)


author: Nalin Dahyabhai <nalin@redhat.com> 1.10.3-29
changelog:
  - gssapi: pull in upstream fix for a possible NULL dereference in spnego
    (CVE-2014-4344, #1121510)
  - gssapi: pull in proposed-and-accepted fix for a double free in initiators
    (David Woodhouse, CVE-2014-4343, #1121510)


author: Nalin Dahyabhai <nalin@redhat.com> 1.10.3-27
changelog:
  - pull in backported fix for denial of service by injection of malformed
    GSSAPI tokens (CVE-2014-4341, CVE-2014-4342, #1121510)
  - incorporate backported patch for remote crash of KDCs which serve multiple
    realms simultaneously (RT#7756, CVE-2013-1418/CVE-2013-6800, more of


author: Nalin Dahyabhai <nalin@redhat.com> 1.10.3-26
changelog:
  - pull in backport of patch to not subsequently always require that responses
    come from master KDCs if we get one from a master somewhere along the way
    while chasing referrals (RT#7650, #1113652)


author: Nalin Dahyabhai <nalin@redhat.com> 1.10.3-25
changelog:
  - ksu: if the -e flag isn't used, use the target user's shell when checking
    for authorization via the target user's .k5users file (#1026721)


author: Nalin Dahyabhai <nalin@redhat.com> 1.10.3-23
changelog:
  - spnego: pull in patch from master to restore preserving the OID of the
    mechanism the initiator requested when we have multiple OIDs for the same
    mechanism, so that we reply using the same mechanism OID and the initiator
    doesn't get confused (#1087068, RT#7858)


author: Nalin Dahyabhai <nalin@redhat.com> 1.10.3-22
changelog:
  - add patch from Jatin Nansi to avoid attempting to clear memory at the
    NULL address if krb5_encrypt_helper() returns an error when called
    from encrypt_credencpart() (#1055329, pull #158)


author: Nalin Dahyabhai <nalin@redhat.com> 1.10.3-21
changelog:
  - drop patch to add additional access() checks to ksu - they shouldn't be
    resulting in any benefit


author: Nalin Dahyabhai <nalin@redhat.com> 1.10.3-20
changelog:
  - apply patch from Nikolai Kondrashov to pass a default realm set in
    /etc/sysconfig/krb5kdc to the kdb_check_weak helper, so that it doesn't
    produce an error if there isn't one set in krb5.conf (#1009389)


author: Nalin Dahyabhai <nalin@redhat.com> 1.10.3-19
changelog:
  - packaging: don't Obsoletes: older versions of krb5-pkinit-openssl and
    virtual Provide: krb5-pkinit-openssl on EL6, where we don't need to
    bother with any of that (#1001961)


author: Nalin Dahyabhai <nalin@redhat.com> 1.10.3-18
changelog:
  - pkinit: backport tweaks to avoid trying to call the prompter callback
    when one isn't set (part of #965721)
  - pkinit: backport the ability to use a prompter callback to prompt for
    a password when reading private keys (the rest of #965721)


author: Nalin Dahyabhai <nalin@redhat.com> 1.10.3-17
changelog:
  - backport fix to not spin on a short read when reading the length of a
    response over TCP (RT#7508, #922884)


author: Nalin Dahyabhai <nalin@redhat.com> 1.10.3-16
changelog:
  - backport fix for trying all compatible keys when not being strict about
    acceptor names while reading AP-REQs (RT#7883, #1070244)


author: Nalin Dahyabhai <nalin@redhat.com> 1.10.3-15
changelog:
  - backport fix for not being able to verify the list of transited realms
    in GSS acceptors (RT#7639, #959685)


author: Nalin Dahyabhai <nalin@redhat.com> 1.10.3-14
changelog:
  - pull fix for keeping track of the message type when parsing FAST requests in
    the KDC (RT#7605, #951965)


author: Nalin Dahyabhai <nalin@redhat.com> 1.10.3-13
changelog:
  - incorporate upstream patch to fix a NULL pointer dereference while processing
    certain TGS requests (CVE-2013-1416, #950343)
  - incorporate upstream patch to fix a NULL pointer dereference when the client
    supplies an otherwise-normal-looking PKINIT request (CVE-2013-1415, #917910)
  - add patch to avoid dereferencing a NULL pointer in the KDC when handling a
    draft9 PKINIT request (#917910, CVE-2012-1016)


author: Nalin Dahyabhai <nalin@redhat.com> 1.10.3-11
changelog:
  - don't leak the memory used to hold the previous entry when walking a keytab
    to figure out which kinds of keys we have (#911147)


author: Jingdong Lu <jingdong.lu@oracle.com> - 3.9-21.0.1.el6_4
changelog:
  - Treat builtin modules as already loaded (John Haxby) [orabug 13851649]
    And don't create modules.builtin.bin if there is no modules.builtin


author: Martin Sivak <msivak@redhat.com> - 3.9-18
changelog:
  - Fix a segfault when overrides line was incomplete
    Resolves: rhbz#673100
  - Added backports directory to depmod search path
    Resolves: rhbz#761511


author: Jon Masters <jcm@redhat.com> - 3.7-7 (pre9)
changelog:
  - Rebuild with stock vendor conf files called "dist.conf" not "fedora.conf".
  - Re-add glibc-static dependency because of zlib_flags requiring static.


author: Jon Masters <jcm@redhat.com> - 3.4-7
changelog:
  - Update weak-modules, remove obsoletes on "modules", remove "blacklist-compat".
  - Add "alias gre0 ip_gre" to /etc/modprobe.conf by default.
  - Resolves: #207653, #242080, #241595, #229783.


author: Jon Masters <jcm@redhat.com> - 3.3-0.pre3.1.6
changelog:
  - Revert out fixes to mptbase. Need to work around mkinitrd problem parsing
    output from module-init-tools - will then respin with new fix.


author: Jon Masters <jcm@redhat.com> - 3.3-0.pre3.1.3
changelog:
  - Updated to upstream with some miscellaneous fixes from contrib.
  - Rebuilt allconf patch since retabbed upstream source.


author: Jon Masters <jcm@redhat.com> - 3.3-0.pre2.1.3
changelog:
  - Updated to upstream with new module priority/override features.
  - Documentation updates and other miscellaneous fixes.


author: Jon Masters <jcm@redhat.com> - 3.3-0.pre1.4.6
changelog:
  - Don't call depmod on removing a kernel.
  - Warn rather than exit if we can't process weak-updates on new kernel
  - Handle duplicate modules by picking the latter version of the two.


author: Steve Dickson <SteveD@RedHat.com>
changelog:
  - Added the mounting of /proc/fs/nfsd to modprobe.conf.dist
    so it gets mounted when nfsd is loaded.


author: Bill Nottingham <notting@redhat.com> 2.4.26-9
changelog:
  - add nfsv4 aliases to modprobe.conf.dist
  - clean out upstreamed aliases in modprobe.conf.dist
  - mount rpc_pipefs when sunrpc is loaded


author: Bill Nottingham <notting@redhat.com> 2.4.26-6
changelog:
  - update module-init-tools to 3.0pre10
  - fix modinfo (#116305)
  - always include /etc/modprobe.conf.dist (don't require the line in modprobe.conf)
  - ship a static modprobe.conf.dist, don't generate it at build time
  - clean up modprobe.conf.dist a little (#113772, #113768)


author: Bill Nottingham <notting@redhat.com> 2.4.26-1
changelog:
  - update to 2.4.26
  - switch around man pages; the module-init-tools man pages are now
    the default
  - add backwards compat usb aliases for the simple case
  - add some commentary to modules.conf/modprobe.conf on conversion
  - modutils-devel goes away


author: Bill Nottingham <notting@redhat.com> 2.4.25-8
changelog:
  - fix leak in module-init-tools-depmod (<arjanv@redhat.com>)
  - look in /lib/modules/`uname -r`/updates for modules


author: Bill Nottingham <notting@redhat.com> 2.4.25-2
changelog:
  - add joystick alias (#91309)
  - add alias for af_key for IPSEC
  - update module-init-tools to 0.9.12
  - ship a modprobe.conf.dist with the aliases that are built into 2.4
    modutils
  - generate a modprobe.conf if needed on install


author: Bill Nottingham <notting@redhat.com> 2.4.22-7
changelog:
  - make sure we don't use diet anywhere but x86, even if it's lying around
  - fix zlib linkage, for real
  - switch ftape alias (#7674)


author: Matt Wilson <msw@redhat.com>
changelog:
  - added a -devel subpackage that contains libraries that apps can use
    to implement insmod and rmmod


author: Bill Nottingham <notting@redhat.com>
changelog:
  - update to 2.4.6
  - alias binfmt-0000 off (#9709)
  - turn off 'modules.conf is more recent than modules.dep' message (#14276,
    others)
  - return nonzero from depmod if there are errors (#40935)
  - fix manpage typo (#33123)


author: Elliot Lee <sopwith@redhat.com> 2.4.5-3
changelog:
  - Add modutils-2.4.5-stblocal.patch from Jakub. See the e-mail message
    inside the patch file for details.
  - Use smp_mflags macro


author: Bill Nottingham <notting@redhat.com>
changelog:
  - update to 2.4.0
  - tweak irda aliases
  - remove vixie-cron dependency (it's not *required*)
  - add missing %build
  LANG=C
  export LANG
  unset DISPLAY
   (where did that go?)


author: Jakub Jelinek <jakub@redhat.com>
changelog:
  - update to 2.3.9.
  - port RH patches from 2.1.121 to 2.3.9 where needed.
  - disable warning about conf.modules for now, in 7.0
    we should move to modules.conf.


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - pick up ultrapenguin patches (not applied for now).
  - pre-generate keyword.c so gperf doesn't have to be present (not applied).
  - util/sys_cm.c: fix create_module syscall (signed return on sparc too)


author: Jakub Jelinek <jj@ultra.linux.cz>
changelog:
  - Handle EM_SPARCV9, kludge to support both 32bit and 64bit kernels
    from the same package on sparc/sparc64.


author: Daniel Kiper <daniel.kiper@oracle.com> - 2.0.4-1.100.5
changelog:
  - OVM do not use selinux so disable it for kdump too,
  - properly check that /mnt/selinux is mounted.


author: Daniel Kiper <daniel.kiper@oracle.com> - 2.0.4-1.100.3
changelog:
  - apply some Xen specific patches to kexec-tools-2.0.4, makedumpfile-1.5.4 and kdump scripts
    (fixes for 15844134, 15938733, 15959955, 17719441 and bugs not discovered earlier),
  - spec script does not add Kdump_not_supported_on_Xen_domU_guest flag to /etc/kdump.conf anymore.


author: Daniel Kiper <daniel.kiper@oracle.com> - 2.0.4-1.100.1
changelog:
  - use stable kexec-tools-2.0.4 and makedumpfile-1.5.4,
  - apply some generic and Xen specific patches to makedumpfile-1.5.4.


author: Vaughan Cao <vaughan.cao@oracle.com> 2.0.3-3.0.6.el6
changelog:
  - export DM_DISABLE_UDEV=1 to tell device mapper and lvm that there is no udev support in kdump initrd, and modify lvm.conf as well. [Orabug: 16561795]


author: Maxim Uvarov <maxim.uvarov@oracle.com> - 2.0.3-3.0.1.el6
changelog:
  - use mkdumprd;
  - update scripts and settings;
  - use stable kexec-tools-2.0.3 and makedumpfile-1.4.3;
  - add kdump.init check if it's 2.6.18, then we add --args-linux  argument to kexec tools. (This is required for old kernels.).;
  - added both nr_cpus=1 and maxcpus=1;
  - added mce=off for x86_64.


author: Kevin Lyons <kevin.x.lyons@oracle.com> - 2.0.0-209.0.1.el6
changelog:
  - Make sure "--allow-missing" is effective by adding to MKDUMPRD_ARGS in
    kdump.sysconfig, kdump.sysconfig.i386, and kdump.sysconfig.x86_64 [12590865] [11678808]


author: Amerigo Wang <amwang@redhat.com> - 2.0.0-197
changelog:
  - Add coordination between kdump and cluster fencing for long
    kernel panic dumps, resolve bug 585332. From Ryan O'Hara.


author: Amerigo Wang <amwang@redhat.com> - 2.0.0-107
changelog:
  - Include the patch from Cai, adding missed options to --help
    of makedumpfile. Resolves bug 606704.


author: Amerigo Wang <amwang@redhat.com> - 2.0.0-102
changelog:
  - If a symlink with the same name exists, remove it first before
    copying, so that extra_bins will be copied correctly.
    Resolves bug 611699.


author: Amerigo Wang <amwang@redhat.com> - 2.0.0-99
changelog:
  - Support btrfs, and move fs type check earlier so that
    mkdumprd will fail soon with unsupported fs type.
    Resolves bug 607515 and bug 607131.


author: Amerigo Wang <amwang@redhat.com> - 2.0.0-95
changelog:
  - Move modules from /lib into /lib/modules/`uname -r`, and
    regenerate modules.dep for them. Resolves bug 602033.


author: Amerigo Wang <amwang@redhat.com> - 2.0.0-92
changelog:
  - When there are multiple net dump targets, let the last one
    overwrite the previous ones, stop showing errors in this case.
    See comment #4 in bug 600607.


author: Amerigo Wang <amwang@redhat.com> - 2.0.0-87
changelog:
  - We don't need to escape '#' with "\#", otherwise '#' will be
    executed as a command before aliased. See comment #4 of bug 600896.


author: Amerigo Wang <amwang@redhat.com> - 2.0.0-86
changelog:
  - When there are double quotes in LABEL= in kdump.conf, findfs
    will not be able to find the correct label, we should allow
    quotes in LABEL= in kdump.conf because a label name may contain
    spaces. See comment #4 of bug 600611.


author: Amerigo Wang <amwang@redhat.com> - 2.0.0-78
changelog:
  - Forward patches from RHEL5, Resolves: bz 592312  600566
    600571  600572 600574 600575 600577 600578 600579 600581 600583
    600584  600585 600586 600588 600590 600591 600593 600594 600595
    600596 600597  600598 600599 600600 600601 600602 600604 600605
    600606 600607 600610 600611 600613 600896 602785  602905.


author: Neil Horman <nhorman@redhat.com> -2.0.0-56
changelog:
  - Added utsname support to makedumpfile for 2.6.32 (bz 556356)
  - Cleaned up some syntax in the changelog


author: Neil Horman <nhorman@redhat.com> 2.0.0-18
changelog:
  - Updated initscript to use mkdumprd2 if manifest is present
  - Updated spec to require dash
  - Updated sample manifest to point to correct initscript
  - Updated populate_std_files helper to fix sh symlink


author: Neil Horman <nhorman@redhat.com> - 1.102pre-6
changelog:
  - Bringing rawhide up to date with bugfixes from RHEL5
  - Adding patch to prevent kexec buffer overflow on ppc (bz 428684)


author: Neil Horman <nhorman@redhat.com> - 1.102pre-3
changelog:
  - Fix ARCH placement in kdump init script (bz 427201)
  - Fix BuildRequires
  - Fix Makedumpfile to build with new libelf


author: Neil Horman <nhorman@redhat.com> - 1.102pre-1
changelog:
  - Bumping kexec version to latest horms tree (bz 257201)
  - Adding trigger to remove initrds when a kernel is removed


author: Neil Horman <nhorman@redhat.com> - 1.101-58
changelog:
  - Updating kdump.init and mkdumprd with most recent RHEL5 fixes
  - Fixing BuildReq to require elfutils-devel-static


author: Jarod Wilson <jwilson@redhat.com> - 1.101-46
changelog:
  - ppc64 fixups:
    - actually build ppc64 binaries (bug 203407)
    - correct usage output
    - avoid segfault in command-line parsing
  - install kexec man page
  - use regulation Fedora BuildRoot


author: Neil Horman <nhorman@redhat.com> - 1.101-45
changelog:
  - fixed typo in mkdumprd for bz 202983
  - fixed typo in mkdumprd for bz 203053
  - clarified docs in kdump.conf with examples per bz 203015


author: Thomas Graf <tgraf@redhat.com> - 1.101-15
changelog:
  - Don't add kdump service by default, let the user manually add it to
    avoid everyone seeing a warning.


author: Thomas Graf <tgraf@redhat.com> - 1.101-10
changelog:
  - kdump7.patch
     o Remove elf32 core headers support for x86_64
     o Fix x86 prepare elf core header routine
     o Fix ppc64 kexec -p failure for gcc 4.10
     o Fix few warnings for gcc 4.10
     o Add the missing --initrd option for ppc64
     o Fix ppc64 persistent root device bug
  - Remove --elf32-core-headers from default configuration, users
    may re-add it via KEXEC_ARGS.
  - Remove obsolete KEXEC_HEADERS


author: Jeff Moyer <jmoyer@redhat.com> - 1.101-8
changelog:
  - Fix the service stop case.  It was previously unloading the wrong kernel.
  - Implement the "restart" function.
  - Add the "irqpoll" option as a default kdump kernel commandline parameter.
  - Create a default kernel command line in the sysconfig file upon rpm install.


author: Jeff Moyer <jmoyer@redhat.com> - 1.101-4
changelog:
  - Build for x86_64 as well.  Kdump support doesn't work there, but users
    should be able to use kexec.


author: Kai Engert <kaie@redhat.com> - 3.18.0-5.1
changelog:
  - Require softokn build 22 to ensure runtime compatibility.
  - Update to CKBI 2.4 from NSS 3.18.1 (the only change in NSS 3.18.1)


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-5
changelog:
  - Update and reeneable nss-646045.patch on account of the rebase
  - Resolves: Bug 1207052 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL7.1]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-4
changelog:
  - Fix shell syntax error in nss/tests/all.sh
  - Resolves: Bug 1207052 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-3
changelog:
  - Restore a patch that had been mistakenly disabled
  - Resolves: Bug 1207052 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-2
changelog:
  - Replace expired PayPal test certificate that breaks the build
  - Resolves: Bug 1207052 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-1
changelog:
  - Rebase to NSS 3.18
  - Resolves: Bug 1200900 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-6.6]
  - Keep the same cipher suite order as we had in NSS_3_15_3_RTM
  - Resolves: Bug 1202488 - openldap-2.4.23-34.el6_5.1.i686 fails after updating nss to nss-3.16.1-4.el6_5.i686
  - Resolves: Bug 1182902 - rhel65 ns-slapd crash, segfault error 4 in libnss3.so in PK11_DoesMechanism at pk11slot.c:1824


author: Bastien Nocera <bnocera@redhat.com> 0.10.25.1-2
changelog:
  - Fix theoradec bug with timestamps for Empathy video calls (#537170)
  - Fix text subtitle display regression (#537559)


author: Bastien Nocera <bnocera@redhat.com> 0.10.25.1-1
changelog:
  - Update to snapshot
  - Fix text subtitles causing hangs on startup
  - Fix missing plugins installation requiring a restart
  - Queue2 element moved to gstreamer core


author: - Bastien Nocera <bnocera@redhat.com> - 0.10.21-2
changelog:
  - Update the gstreamer requirement
  - Add a gtk2-devel BR, so that the test-colorkey program will be built


author: Jeremy Katz <katzj@redhat.com> - 0.10.20-6
changelog:
  - gst-visualize is just a test program that we don't really need to include 
    and having it means that perl gets pulled into small images (#462620)


author: - Bastien Nocera <bnocera@redhat.com> - 0.10.19-2
changelog:
  - Add patch to avoid sync problems in the ALSA sink when a specific
    track has both playback and record flags


author: Adam Jackson <ajax@redhat.com> 0.10.17.2-3
changelog:
  - gstpb-0.10.15-cd-speed.patch: Set default CD read speed to something
    sensible. (#431178)
  - s/Fedora Core/Fedora/
  - Don't even bother building static libs.


author: - Bastien Nocera <bnocera@redhat.com> - 0.10.14-5
changelog:
  - Add patch to avoid critical warning when getting information about
    missing codecs
  - Up liboil requirement


author: - Bastien Nocera <bnocera@redhat.com> - 0.10.12-2
changelog:
  - Remove the patch to disable docs, install the docs by hand instead
    Add libgstpbutils to the files


author: John (J5) Palmieri <johnp@redhat.com> - 0.10.2-1
changelog:
  - Upgrade to 0.10.2
  - Require gstreamer-0.10.2
  - Add libgstcdda and libcdparanoia to the %files section


author: Thomas Vander Stichele <thomas at apestaart dot org>
changelog:
  - 0.9.7-0.gst.1
  - new release with 0.10 majorminor
  - remove sinesrc
  - replace ximage with ximagesink
  - update libs


author: Pavel Zhukov <pzhukov@redhat.com> - 12:4.1.1-53.P1.3
changelog:
  - Resolves: #1550085 - CVE-2018-5733 Avoid reference overflow

  <* Wed Feb 28 2018 Pavel Zhukov <pzhukov@redhat.com> - 12:4.1.1-53.P1.2
  - Resolves: #1550083 - CVE-2018-5732 Avoid options buffer overflow


author: Jiri Popelka <jpopelka@redhat.com> - 12:4.1.1-50.P1
changelog:
  - Lease table overflow crash. (#1133917)
  - Add ignore-client-uids option. (#1196768)
  - dhclient-script: it's OK if the arping reply comes from our system. (#1204095)
  - VLAN ID is only bottom 12-bits of TCI. (#1259552)
  - dhclient: Make sure link-local address is ready in stateless mode. (#1263466)
  - dhclient-script: make_resolv_conf(): Keep old nameservers
    if server sends domain-name/search, but no nameservers. (#1269595)


author: Jiri Popelka <jpopelka@redhat.com> - 12:4.1.1-44.P1
changelog:
  - option 97 - pxe-client-id (#1058674)
  - dhclient-script: PREINIT6: make sure link-local address is available (#1130804)
  - dhcpd generates spurious responses when seeing requests
    from vlans on plain interface (#1150587)


author: Jaromír Končický <jkoncick@redhat.com> - 12:4.1.1-41.P1
changelog:
  - Fix dhcpd.leases reverting to root:root on every dhcpd start (#1067142)
    New patch "paranoia" merged with older "paranoia-pid" patch
  - Add init script for dhcrelay IPv6 version (#1053155)


author: Jaromír Končický <jkoncick@redhat.com> - 12:4.1.1-40.P1
changelog:
  - Fix handling of UDP packets with checksum 0xffff. (#1015997)
  - Add GUIDs in the DHCP logs for IPoIB. (#1064416)


author: Jiri Popelka - 12:4.1.1-35.P1
changelog:
  - various memory leaks in omapi (#978420)
  - Modify the reply handling in the server code to send to a specified port
    rather than to the source port for the incoming message. (#952126)
  - Multiple key statements in zone definition causes inappropriate error (#919221)
  - Make sure range6 is correct for subnet6 where it's declared (#902966)
  - Relay no longer crashes, when DHCP packet is received over interface
    without any IPv4 address assigned. (#863936)
  - Expose next-server DHCPv4 option to dhclient script. (#658855)


author: Chris Lumens <clumens@redhat.com> - 1.74.12-1
changelog:
  - Add cipher option for encrypted autopart. (dlehman)
  - Add support for fcoe --autovlan option (#813998) (rvykydal)
  - add unsupported_hardware command (#824963) (bcl)


author: Chris Lumens <clumens@redhat.com> - 1.74.11-1
changelog:
  - Deprecated options that required a value should still accept one (jbastian).
    Resolves: rhbz#815573
  - Don't error out if volgroup --useexisting is given with no members. (clumens)
    Resolves: rhbz#823856, rhbz#837440
  - Add an argument for specifying the luks algorithm. (clumens)
    Resolves: rhbz#843174
  - bonding support: add network --bondslaves --bondopts options (rvykydal)
    Resolves: rhbz#662007
  - vlan support: add network --vlanid option. (rvykydal)
    Resolves: rhbz#668065
  - Add swap --hibernation to logvol command (vpodzime)
    Resolves: rhbz#848818


author: Chris Lumens <clumens@redhat.com> - 1.74.8-1
changelog:
  - Add support for reserved space in volume group. (dlehman)
  - Add --same-as-ram option for swap size specification (#744129) (vpodzime)


author: Chris Lumens <clumens@redhat.com> 1.74.5-1
changelog:
  - Don't set new attrs on the RHEL6_Network object. (clumens)
  - Add kickstart network --nodefroute option (#668417) (rvykydal)
  - Add support for network --bootproto ibft option (#668417) (rvykydal)
  - Add network --activate option (#668417) (rvykydal)


author: Chris Lumens <clumens@redhat.com> - 1.74.2-1
changelog:
  - Add the documentation from the website to this package. (clumens)
  - F14 TestCase classes won't work on rhel6-branch, use RHEL6. (akozumpl)
  - support noverifyssl on the rhel6-branch (method, repo) (#660340). (akozumpl)
  - method: new parameter '--noverifyssl' after --url. (akozumpl)
  - repo: new parameter '--noverifyssl'. (akozumpl)
  - Add bootloader --iscrypted (#554870). (clumens)


author: Chris Lumens <clumens@redhat.com> - 1.74-1
changelog:
  - If an option is deprecated, do not care if it takes a value (#602303). (clumens)
  - Don't compare the dest ("telnet") with the option string ("--telnet"). (clumens)
  - The --connect= parameter wasn't really deprecated in FC6. (clumens)


author: Chris Lumens <clumens@redhat.com> - 1.71-1
changelog:
  - Don't overwrite the excluded group list after every %packages line (#577334). (clumens)
  - Add a bunch of test cases for the packages section. (clumens)


author: Chris Lumens <clumens@redhat.com> - 1.69-1
changelog:
  - Add driverdisk --biospart= (#570437). (clumens)
  - Fix IOError catching in ksflatten (jgregusk, #558650).


author: Chris Lumens <clumens@redhat.com> - 1.68-1
changelog:
  - Support removing groups that were included by a glob (#554717). (clumens)
  - Make sure that everything in version.versionMap has a handler. (clumens)
  - Add support for RHEL6 (#552230). (clumens)
  - Don't consider RHEL versions as developmental even if they're latest. (clumens)
  - Add lineno to BaseData and derived classes (version 2) (hdegoede)
  - Give the non mandatory iscsi --port argument a sane default (hdegoede)
  - Change python_sitelib macro to use %global for new rpm (hdegoede)
  - Fix typo in iscsi parsing error message (hdegoede)


author: Chris Lumens <clumens@redhat.com> - 1.67-1
changelog:
  - Don't use action="append_const" in firewall.py.
  - Make "make archive" depend on test and check passing again.
  - versionToString now works in all cases we test for.
  - Fix the few pychecker errors outstanding in options.py.
  - Fix make docs to make docs dir before trying to download files there (hdegoede)


author: Hans de Goede <hdgoede@redhat.com> - 1.66-1
changelog:
  - Add --dcb option to fcoe command (#513011)
  - Remove rhpl from tests
  - Port bootloader --hvargs option added in rhel5
  - Ignore comments when looking for %ksappend lines (#525676)
  - Use python 2.x exception syntax


author: Chris Lumens <clumens@redhat.com> - 1.65-1
changelog:
  - Add additional arguments to BaseHandler.__init__ for better map control.
  - Return the KickstartCommand/KickstartData object from dispatcher.
  - Add an "sshpw" command for changing the passwords in anaconda's env.
  - Add --proxy support to the url and repo commands.
  - Add support for F13.  Is it really that time already?


author: Chris Lumens <clumens@redhat.com> - 1.63-1
changelog:
  - Add encryption key escrow support (mitr, #508963).
  - Fix the repo test cases to expect quotes around the repo's name.


author: Chris Lumens <clumens@redhat.com> - 1.62-1
changelog:
  - Support translated help text in optparse (#479519).
  - If the input kickstart file cannot be read, raise IOError (#519477).


author: Chris Lumens <clumens@redhat.com> - 1.60-1
changelog:
  - Put quotes around the repo's name (Marc.Herbert@gmail.com).
  - Make duplicate entries warnings, not errors (#516338).


author: Chris Lumens <clumens@redhat.com> - 1.59-1
changelog:
  - Handle a few more places where a urlgrabber error could happen (#512951).
  - Error out if the same partition/repo/network is defined twice (#512956).
  - Call parent class tests first. (jlaska)
  - Add KSOptionParser to FC3 upgrade command. (jlaska)
  - Correct missing return stmt in _getArgsAsStr() (jlaska)


author: Chris Lumens <clumens@redhat.com> - 1.58-1
changelog:
  - Adjust writePriority to fix lvm-on-raid0 test cases (jlaska).
  - Add F12 to the version number tests. (clumens)
  - F12_User test case. (dcantrell)
  - Add --gecos argument to the 'user' command (dcantrell)
  - Convert user.py to use _getArgsAsStr() (dcantrell)


author: Chris Lumens <clumens@redhat.com> - 1.56-1
changelog:
  - Make sure to import the gettext stuff in fcoe. (clumens)
  - Correctly deprecate bootloader --lba32 (jlaska).
  - pykickstart: fix zfcp command writepriority (hdegoede)
  - pykickstart: Add fcoe command (take 2) (hdegoede)
  - Add a test case for RAID (jlaska).


author: Chris Lumens <clumens@redhat.com> - 1.55-1
changelog:
  - Add support for the group command to F12 (#509119).
  - RHEL5 now supports RAID 10.
  - The f12 hander class should be called F12Handler. (jgranado)
  - Remove bootloader --lba32.
  - Add a new version of the driverdisk command without --type=.
  - Add initial support for F12.
  - Fetch the programmers-guide from the wiki now.


author: Chris Lumens <clumens@redhat.com> - 1.53-1
changelog:
  - Move lineno= from KSOptionParser.__init__ to parse_args (#497149). (clumens)
  - Use the F11 version of the partition command. (clumens)
  - Remove the --start and --end options since anaconda no longer uses them. (clumens)
  - Remove a broken test case. (clumens)


author: Chris Lumens <clumens@redhat.com> - 1.52-1
changelog:
  - Add lots more test cases (alindebe, mgracik, stickster).
  - Add a skip attribute on key to shut up pychecker.
  - Only show autostep command when requested (jlaska)
  - Strip spaces from service names, and require an option to be provided.
  - Surround services lists in double quotes.
  - Remove the extra space from the services __str__ method.
  - Fix output formatting bugs in firewall, partition, and repo (mgracik).
  - Specifying both or neither of --drives and --only-use should be an error.
  - Corrected newline char in return value of FC6_Method. (mgracik)
  - Make --drives a required option for FC3, and catch no args on F8.
  - Fix final printing of the rescue command (mgracik).
  - Surround output strings in double quotes.
  - Fix a typo in the deviceprobe command.
  - Revert the more strict option processing on displaymode.
  - Properly handle erroring on extra args, not just extra options.
  - Don't use the logging class since it interferes with the logging test.
  - port without host should raise KickstartParseError, not kickstartValueError.
  - Add the --key option to option processing, since it's a valid argument.
  - Fix test cases that were failing due to the new use of KSOptionParser.
  - Teach driverdisk.py command to reject extra partitions (stickster).
  - Add KSOptionParser to all commands ... enables more strick option checking (jlaska).
  - Use KSOptionParser so we can catch bad command options (jlaska).


author: Chris Lumens <clumens@redhat.com> - 1.51-1
changelog:
  - Make a couple changes to how the logging command is handled.
  - Add a lot of test cases (clumens, alindebe, jlaska, fcami, adamwill, pfrields).
  - Fix output formatting for the rootpw command.
  - For commands that take exactly one argument, check and error correctly.
  - Surround module options in quotes on the output side (jlaska).
  - Set module opts in the FC3 handler correctly.
  - Fix newlines on the device command output (jlaska).
  - If --autoscreenshot is not specified, still output "autostep".
  - Move the currentCmd and currentLine into getParser(). (jlaska)
  - Write out an selinux line if set to disabled, but not if None.
  - F9_LogVolData should inherit from FC4_LogVolData, not FC3_LogVolData (jlaska).
  - Add unittest framework along with logvol and vnc unittests. (jlaska)
  - Don't set the KSOption.required attribute in the constructor (jlaska).


author: Chris Lumens <clumens@redhat.com> - 1.50-1
changelog:
  - Add a script to diff two versions of kickstart syntax.
  - Add an option to ksvalidator to list all available syntax versions.
  - Remove a couple extra newlines in output formatting.
  - Add documentation for the new %include representation.
  - Add support %include to the pykickstart data objects.


author: Chris Lumens <clumens@redhat.com> - 1.49-1
changelog:
  - Add upgrade --root-device (atodorov, #471232).
  - Use python's builtin set rather than the Sets module (#477836, dcantrell).


author: Chris Lumens <clumens@redhat.com> - 1.48-1
changelog:
  - Allow ignoring group metadata from repos, using a '--ignoregroups'
    boolean. (notting)
  - Add initial support for F11.
  - Specify the command versions in the handlers instead of making copies.
  - Remove empty and pointless __init__ methods.
  - Pass arguments to superclasses via *args and **kwargs, all the way up.
  - Add removedKeywords and removedAttrs lists on Commands and Data.
  - Fix version regexes to handle double digits and minor releases (jlaska).


author: Chris Lumens <clumens@redhat.com> - 1.43-1
changelog:
  - Revert "Do not include passphrases for encrypted block devices in
    anaconda-ks.cfg." (dlehman)
  - yum doesn't like when mirrorlist is "". (clumens)


author: Chris Lumens <clumens@redhat.com> - 1.42-1
changelog:
  - Add rescue command to pykickstart (atodorov)
  - Sort %packages output (katzj)
  - Fix a typo (atodorov).


author: Chris Lumens <clumens@redhat.com> - 1.41-1
changelog:
  - RHEL5 supports ignoredisk --only-use now too. (clumens)
  - Do not include passphrases for encrypted block devices in
    anaconda-ks.cfg. (dlehman)
  - Fix F9,F10,RHEL5 "part" commands to use the same class as
    "partition". (dlehman)
  - Add an apply method() for commands and implement for lang (katzj)


author: Chris Lumens <clumens@redhat.com> - 1.40-1
changelog:
  - RHEL5_LogVolData should inherit from FC4, not FC3.
    Also fix FC9->F9 typo. (dlehman)
  - Support creation of encrypted block devices in RHEL5. (#449830) (dlehman)
  - Use the right LogVolData objects for RHEL3 and 4 (jlaska). (clumens)
  - We no longer use rhpl for translations. (clumens)
  - All the base classes should derive from object. (clumens)


author: Chris Lumens <clumens@redhat.com> - 1.35-1
changelog:
  - Bring driverdisk command in line with the docs. (clumens)
  - Change RAID command print priorities (jlaska).
  - According to docs, physvols are space delimited. (jlaska)
  - Don't write the label out twice (jlaska).
  - Deprecate monitor and xconfig commands. (clumens)


author: Chris Lumens <clumens@redhat.com> - 1.34-1
changelog:
  - Load the handler module automatically. (clumens)
  - Add support for F10. (clumens)
  - Initialize cmd.handler earlier; fixes repo.methodToRepo() (markmc)
  - Don't shadow builtin function names. (clumens)
  - Running check is now required before pykickstart can be packaged. (clumens)
  - Reorganize code a little bit to pass pychecker. (clumens)


author: Chris Lumens <clumens@redhat.com> - 1.33-1
changelog:
  - Fix whitespace when printing out the bootloader command (pmeyers).
  - Fix the type on bootloader --timeout processing. (clumens)


author: Chris Lumens <clumens@redhat.com> - 1.32-1
changelog:
  - Make the string reader act like the file reader upon EOF. (clumens)
  - Add syntax for encrypted logical volumes. (clumens)


author: Chris Lumens <clumens@redhat.com> - 1.30-1
changelog:
  - Reverse writePriorities of iscsi and iscsname (#434965, jlaska).
  - Fix printing of iscsiname command (#434945, jlaska).
  - Don't traceback on ENOENT. (pnasrat)
  - Store the mouse name as a string, not a list. (clumens)
  - Update translations.


author: Chris Lumens <clumens@redhat.com> - 1.25-1
changelog:
  - Add the version to the output ks file. (clumens)
  - Add syntax for encrypted partitions and raid devices. (clumens)


author: Chris Lumens <clumens@redhat.com> - 1.24-1
changelog:
  - Make inheritance and overriding of %packages work (#427768). (clumens)
  - Add an option for which languages should be installed. (katzj)
  - Use the right name for the iscsi --target variable (#418781). (clumens)


author: Chris Lumens <clumens@redhat.com> - 1.23-1
changelog:
  - Take Makefile improvements from anaconda.
  - Fix a traceback on F9 zerombr command (#395431).
  - Update to handle new Python eggs packaging.


author: Chris Lumens <clumens@redhat.com> 1.22-1
changelog:
  - Don't process or write out vnc --enabled (jlaska AT redhat DOT com).
  - Fix a traceback in the clearpart command.


author: Chris Lumens <clumens@redhat.com> 1.20-1
changelog:
  - Pull wiki docs from the new location.
  - Fix error messages for options that have been removed after having been
    previously deprecated.
  - zerombr no longer takes any arguments.
  - %packages --ignoredeps --resolvedeps have been removed.
  - firewall --high --medium have been removed.
  - vnc --connect has been removed.
  - xconfig options from monitor have now been removed.
  - --bytes-per-inode has been marked as deprecated.
  - Fix typos.
  - Add --fsprofile option to disk commands (pjones).
  - Add F9 support (pjones).
  - Lots of internal fixes (clumens, pjones).


author: Chris Lumens <clumens@redhat.com> 1.18-1
changelog:
  - Don't write out %end to packages and scripts if the syntax version doesn't
    support it.
  - Remove obsolete translation (#332221).


author: Chris Lumens <clumens@redhat.com> 1.16-1
changelog:
  - Undeprecate %packages --excludedocs.
  - Fix a traceback in the device command handling.
  - Add bootloader --timeout (katzj).


author: Chris Lumens <clumens@redhat.com> 1.14-1
changelog:
  - Fix output formatting for packages section header (#310211).
  - Add a script to flatten kickstart files containing includes (katzj).


author: Chris Lumens <clumens@redhat.com> 1.13-1
changelog:
  - Add a function to convert URL method strings into repo objects
    (jkeating).
  - Writer formatting fixes.
  - Add kickstart documentation from the Fedora Wiki.


author: Chris Lumens <clumens@redhat.com> 1.12-1
changelog:
  - Fix lots of problems in processing the bootloader, device, network, and
    raid commands.
  - Add %end when writing out scripts and packages.
  - Add a makefile target to run pychecker to cut down on errors in
    releases.


author: Chris Lumens <clumens@redhat.com> 1.9-1
changelog:
  - Add support for the %end directive to be placed at the end of scripts
    and packages sections.  Deprecate old syntax.
  - Clean up after ksvalidator if pykickstart issues a traceback.
  - Add support for repo --priority --includepkgs --excludepkgs.
  - Fix newline at end of reboot --eject output (#253562).


author: Chris Lumens <clumens@redhat.com> 1.7-1
changelog:
  - Clarify license in spec file and all source files.
  - Check string values to options to make sure they're not other options
    (#251318).


author: Chris Lumens <clumens@redhat.com> - 1.2-1
changelog:
  - Fix harddrive install method error checking (#232492).
  - Set authentication information from the input line to preserve quoting
    (#241657).
  - Allow included files to be given by URL.
  - Fix typo in user --iscrypted option.


author: Chris Lumens <clumens@redhat.com> - 1.1-1
changelog:
  - Better regexes for splitting version strings into family and version.
  - Add basic support for RHEL3.
  - Update translations.


author: Chris Lumens <clumens@redhat.com> - 0.100-1
changelog:
  - bootloader should be written out after upgrade/install.
  - Treat class names as unicode strings (#231053).


author: Chris Lumens <clumens@redhat.com> - 0.99-1
changelog:
  - The timezone command didn't recognize --isUtc before FC6 (#231189).
  - Recognize %ksappend lines in ksvalidator.
  - Don't set default values in some command __init__ methods.
  - Added an updates command.
  - Add support for RAID10.


author: Chris Lumens <clumens@redhat.com> - 0.96-1
changelog:
  - Fix __str__ methods for langsupport and reboot commands.
  - Renamed BaseHandler.empty to BaseHandler.maskAllExcept.
  - Split command objects out into their own files in commands/.
  - Rename command objects to start with Version_.
  - Support extended group selection syntax.


author: Chris Lumens <clumens@redhat.com> - 0.95-1
changelog:
  - KickstartParser no longer takes a version argument.
  - Be more lenient in what strings stringToVersion accepts.
  - Allow setting state on one data object from multiple files.


author: Chris Lumens <clumens@redhat.com> - 0.94-1
changelog:
  - Add a newline to the end of the key command output.
  - Use network bootproto constants (#197694).
  - Fix tracebacks in subclass __str__ methods (#226734).


author: Chris Lumens <clumens@redhat.com> - 0.93-1
changelog:
  - Add support for FC3, RHEL4, and RHEL5.
  - The key command was not supported until after FC6.
  - Accept more strings in stringToVersion.


author: Chris Lumens <clumens@redhat.com> - 0.92-1
changelog:
  - Fix KickstartVersionError reporting.
  - Add a version attribute to handler objects.
  - Fix line number reporting on lots of commands.
  - Add initial support for Fedora 7 and remove deprecated commands.
  - Accept a --default argument to the %packages header (#221305).


author: Chris Lumens <clumens@redhat.com> - 0.90-1
changelog:
  - Support multiple versions of kickstart syntax from one code base
    (#189348).
  - Fix inconsistency between Script parser and writer (#222877).


author: Chris Lumens <clumens@redhat.com> 0.31-1
changelog:
  - Handle nfs --opts (katzj).
  - RAID devices should be integers instead of strings (#176537).
  - Add initial support for iscsi (katzj).


author: Chris Lumens <clumens@redhat.com> 0.30-2
changelog:
  - Add BuildRequires to fix building under mock (#194156,  Joost Soeterbroek
    <fedora AT soeterbroek.com>).


author: Chris Lumens <clumens@redhat.com> 0.30-1
changelog:
  - Change order of LVM-related writing functions (#193073).
  - Require urlgrabber.
  - Return a more useful error message on unknown commands.
  - Fix logvol writing typo.
  - Make ksvalidator validate from a URL in addition to a file.
  - Don't write out an empty packages section (#192851).


author: Chris Lumens <clumens@redhat.com> 0.26-1
changelog:
  - Ignore spaces before group names (#188095).
  - Added some translations.
  - Add options for repo command.
  - Reorder %packages section output.
  - Output %packages header options.
  - Initialize RAID and volume group members to empty lists.


author: Chris Lumens <clumens@redhat.com> 0.24-1
changelog:
  - Don't write out a blank xconfig line.
  - Reorder output handlers to group like commands together.
  - Mark strings for translation.


author: Chris Lumens <clumens@redhat.com> 0.21-1
changelog:
  - Provide an option to not traceback on missing include files (#181760).
  - Update programming documentation.


author: Chris Lumens <clumens@redhat.com> 0.18-1
changelog:
  - Fix some errors pychecker caught.
  - Allow exceptions to not be fatal so ksvalidator can spot more errors in
    a single pass (#179894).


author: Chris Lumens <clumens@redhat.com> 0.13-1
changelog:
  - Recognize the --eject parameter to shutdown/halt.
  - Store the exact post-installation action in ksdata.


author: Chris Lumens <clumens@redhat.com> 0.8-1
changelog:
  - Default to SELINUX_ENFORCING.
  - Default partition sizes to None for anaconda (#172378).
  - Don't call shlex.split on anything inside a script (#172313).


author: Chris Lumens <clumens@redhat.com> 0.7-1
changelog:
  - Fix clearpart --all.
  - vnc command does not require --connect option (#172192).
  - network --onboot does not take any option.
  - Remove extra spaces from firewall --ports and --trust.
  - Write out network --<service> options.


author: Chris Lumens <clumens@redhat.com> 0.3-1
changelog:
  - Add a deprecated attribute to options.
  - Add --card option back to xconfig and mark as deprecated.
  - Throw a deprecation warning on mouse and langsupport commands.
  - Rename Writer to KickstartWriter for consistency.
  - Collapse scripts into a single list and add an attribute on Script to
    differentiate.


author: Chris Lumens <clumens@redhat.com> 0.2-1
changelog:
  - Rename module to pykickstart to avoid conflicts in anaconda.
  - Rename data classes for consistency.
  - Add default bytesPerInode settings.


author: Guangyu Sun <guangyu.sun@oracle.com> [3.8.13-55.1.8.el6uek]
changelog:
  - kvm: fix excessive pages un-pinning in kvm_iommu_map error path. (Quentin Casasnovas)  [Orabug: 20687313]  {CVE-2014-3601} {CVE-2014-8369} {CVE-2014-3601}


author: Guangyu Sun <guangyu.sun@oracle.com> [3.8.13-55.1.7.el6uek]
changelog:
  - ttusb-dec: buffer overflow in ioctl (Dan Carpenter)  [Orabug: 20673376]  {CVE-2014-8884} 
  - mm: Fix NULL pointer dereference in madvise(MADV_WILLNEED) support (Kirill A. Shutemov)  [Orabug: 20673281]  {CVE-2014-8173} 
  - netfilter: conntrack: disable generic tracking for known protocols (Florian Westphal)  [Orabug: 20673239]  {CVE-2014-8160} 
  - tracing/syscalls: Ignore numbers outside NR_syscalls' range (Rabin Vincent)  [Orabug: 20673163]  {CVE-2014-7826}


author: Guangyu Sun <guangyu.sun@oracle.com> [3.8.13-55.1.4.el6uek]
changelog:
  - net: sctp: fix NULL pointer dereference in af->from_addr_param on malformed packet (Daniel Borkmann)  [Orabug: 20425332]  {CVE-2014-7841}


author: Guangyu Sun <guangyu.sun@oracle.com> [3.8.13-55.1.3.el6uek]
changelog:
  - ACPI: x2apic entry ignored (Cathy Avery)  [Orabug: 19475776]  
  - i40e: relax the firmware API version check (Shannon Nelson)  [Orabug: 20216831]  
  - x86, fpu: remove the logic of non-eager fpu mem allocation at the first usage (Annie Li)  [Orabug: 20232585]  
  - iommu/{vt-d,amd}: Remove multifunction assumption around grouping (Alex Williamson)  [Orabug: 20192796]


author: Guangyu Sun <guangyu.sun@oracle.com> [3.8.13-55.1.2.el6uek]
changelog:
  - isofs: Fix unbounded recursion when processing relocated directories (Jan Kara)  [Orabug: 20224059]  {CVE-2014-5471} {CVE-2014-5472} 
  - x86_64, traps: Stop using IST for #SS (Andy Lutomirski)  [Orabug: 20224027]  {CVE-2014-9090} {CVE-2014-9322}


author: Guangyu Sun <guangyu.sun@oracle.com> [3.8.13-55.1.1.el6uek]
changelog:
  - ALSA: control: Protect user controls against concurrent access (Lars-Peter Clausen)  [Orabug: 20192540]  {CVE-2014-4652} 
  - target/rd: Refactor rd_build_device_space + rd_release_device_space (Nicholas Bellinger)  [Orabug: 20192516]  {CVE-2014-4027} 
  - HID: logitech: perform bounds checking on device_id early enough (Jiri Kosina)  [Orabug: 20192477]  {CVE-2014-3182} 
  - udf: Avoid infinite loop when processing indirect ICBs (Jan Kara)  [Orabug: 20192448]  {CVE-2014-6410} 
  - ALSA: control: Make sure that id->index does not overflow (Lars-Peter Clausen)  [Orabug: 20192416]  {CVE-2014-4656} 
  - ALSA: control: Handle numid overflow (Lars-Peter Clausen)  [Orabug: 20192367]  {CVE-2014-4656} 
  - HID: picolcd: sanity check report size in raw_event() callback (Jiri Kosina)  [Orabug: 20192208]  {CVE-2014-3186} 
  - net: sctp: fix remote memory pressure from excessive queueing (Daniel Borkmann)  [Orabug: 20192058]  {CVE-2014-3688}


author: Jindrich Novy <jnovy@redhat.com> 4.7.25-15
changelog:
  - apply backported patch from 4.8.26 to fix dbverify (#563610, #472131)
    (patch backported by Noriko Hosoi)


author: Jindrich Novy <jnovy@redhat.com> 4.7.25-12
changelog:
  - fix for Java API __repmgr_send crash where eid=SELF_EID,
    don't update master_id so soon after election (upstream bz#16299)


author: Jindrich Novy <jnovy@redhat.com> 4.7.25-8
changelog:
  - DB_ENV->lock_get may self deadlock if user defined locks
    are used and there is only one lock partition defined
    (upstream bz#16415)
  - fix for dd segfaults (upstream bz#16541)
  - reorder patches


author: Jindrich Novy <jnovy@redhat.com> 4.7.25-7
changelog:
  - remove s390 and s390x from java_arches (#474061)
  - BR: tcl-devel for the tclConfig.sh change (#474062)


author: Jindrich Novy <jnovy@redhat.com> 4.7.25-1
changelog:
  - update to 4.7.25 (#449735)
  - package static java library only if listed in java_arches
  - move to java-1.6.0-openjdk
  - fix tcl library path
  - drop glibc patch, no more needed


author: Jindrich Novy <jnovy@redhat.com> 4.6.21-5
changelog:
  - add upstream patch to fix a race condition between checkpoint
    and DB->close which can result in the checkpoint thread self-deadlocking


author: Jindrich Novy <jnovy@redhat.com> 4.6.18-1
changelog:
  - update to 4.6.18
  - drop upstream patches for 4.5.20 and gcj patch
  - remove nptl-abi-note.S, useless as we are definitely
    running kernel >= 2.4.20 (#245416)
  - move C++ stuff to subpackages to reduce dependency bloat (#220484)
  - package db_codegen
  - correct open() calls so that new db4 compiles with the new glibc


author: Jindrich Novy <jnovy@redhat.com> 4.5.20-2
changelog:
  - sync db4 and compat-db licenses to BSD-style as the result of
    consultation with legal department
  - fix some rpmlint warnings


author: Jindrich Novy <jnovy@redhat.com> 4.5.20-1
changelog:
  - update to db-4.5.20 (#198038)
  - fix BuildRoot
  - drop .64bit patch
  - patch/source URLs now point to correct location


author: Jindrich Novy <jnovy@redhat.com> 4.3.29-7.fc6
changelog:
  - fix memleak caused by SET_TXN macro in xa_db.c, when opening
    database created with DB_XA_CREATE flag (#204920)


author: Jindrich Novy <jnovy@redhat.com> 4.3.29-2
changelog:
  - don't package /usr/share/doc/images in the main db4 package
    and move it to db4-devel (#33328)
  - make db4 LFS capable (#33849)
  - move db4-devel, db4-tcl, db4-java to Development/Libraries
    group instead of System Environment/Libraries (#54320)
  - BuildPrereq -> BuildRequires
  - don't use RPM_SOURCE_DIR
  - Obsoletes db3, db2


author: Nalin Dahyabhai <nalin@redhat.com> 4.2.52-6
changelog:
  - on %{ix86} systems, make the availability of an NPTL-requiring libdb match
    the availability of an NPTL libpthread in glibc > 2.3.3-48
  - run ldconfig in db4-java's %post/%postun
  - when building java support, assume that libgcj is equivalent enough to 1.3


author: Jeff Johnson <jbj@jbj.org> 4.2.52-4
changelog:
  - remove dangling symlinks (#123721 et al).
  - remove db_cxx.so and db_tcl.so symlinks, versioned equivs exist.
  - apply 2 patches from sleepycat.
  - resurrect db4-java using sun jvm-1.4.2.
  - cripple autoconf sufficiently to build db4-java with gcj, without jvm.
  - check javac first, gcj34 next, then gcj-ssa, finally gcj.
  - add ed build dependency (#125180).


author: Nalin Dahyabhai <nalin@redhat.com> 4.1.25-14
changelog:
  - symlink from %{_libdir}/tls/libdb-4.1.so to the copy in /%{_lib}/tls, so
    that the run-time linker can find the right copy for of apps which use an
    RPATH to point at %{_libdir}/libdb-4.1.so


author: Nalin Dahyabhai <nalin@redhat.com> 4.1.25-13
changelog:
  - add another section to the ABI note for the TLS libdb so that it's marked as
    not needing an executable stack (from Arjan Van de Ven)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - build both with and without support for shared mutex locks, which require NPTL
  - make behavior wrt where we put libdb the same for all OSs
  - revert changes making tcl optional - nesting %if tcl and %ifarch nptl
    doesn't work
  - fix dangling HREFs in utility docs (pointed to main docs dir, while they're
    actually in the -utils docs dir)
  - run ldconfig when installing/removing the -utils subpackage, as it contains
    shared libraries


author: Jeff Johnson <jbj@jbj.org> 4.2.42-0.1
changelog:
  - update to 4.2.42.
  - build in build_unix subdir.
  - eliminate --enable-dump185, db_dump185.c no longer compiles for libdb*.
  - create db4-tcl sub-pkg to isolate libtcl dependencies.


author: Jeff Johnson <jbj@redhat.com> 4.1.25-6
changelog:
  - build with libtool-1.5, which can't recognize the .so in libfoo*.so atm.
  - whack out libtool predep_objects wonkiness.


author: Nalin Dahyabhai <nalin@redhat.com> 4.1.25-2
changelog:
  - change configure to only warn if JNI includes aren't found, assuming that
    the C compiler can find them
  - remove build requirement on jdkgcj -- gcj is sufficient


author: Nalin Dahyabhai <nalin@redhat.com> 4.0.14-20
changelog:
  - add dynamic libdb-4.0.so link back to %{_libdir} so that dynamically
    linking with -ldb-4.0 will work again


author: Nalin Dahyabhai <nalin@redhat.com> 4.0.14-19
changelog:
  - rebuild to use link the shared object with the same libraries we use
    for the bundled utils, should pull in libpthread when needed
  - move libdb.so from /%{_lib} to %{_libdir} where the linker can find it


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - re-enable db.h symlink creation, db_util names, and db[23]-devel obsoletes.
  - make sure that -ldb is functional.


author: Nalin Dahyabhai <nalin@redhat.com> 4.0.14-3
changelog:
  - remove relocatability stuffs
  - swallow a local copy of db1 and build db185_dump statically with it, to
    remove the build dependency and simplify bootstrapping new arches


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix dangling docs symlinks
  - fix dangling doc HREFs (#33328)
  - apply the two patches listed at http://www.sleepycat.com/update/3.2.9/patch.3.2.9.html


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - don't build with --enable-diagnostic.
  - add build prereq on tcl.
  - default value for %_lib macro if not found.


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - rather than hack *.la (see below), create /usr/lib/libdb-3.1.so symlink.
  - turn off --enable-diagnostic for performance.


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - remove redundant strip of libnss_db* that is nuking symbols.
  - change location in /usr/lib/libdb-3.1.la to point to /lib (#16776).


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - summaries from specspo.
  - all of libdb_tcl* (including symlinks) in db3-utils, should be db3->tcl?


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - upgrade to 3.1.14.
  - create db3-utils sub-package to hide tcl dependency, enable tcl Yet Again.
  - FHS packaging.


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - disable --enable-test --enable-debug_rop --enable-debug_wop.
  - disable --enable-posixmutexes --enable-tcl as well, to avoid glibc-2.1.3
    problems.


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - add 3.0.55.1 alignment patch.
  - add --enable-posixmutexes (linux threads has not pthread_*attr_setpshared).
  - add --enable-tcl (needed -lpthreads).


author: Junxiao Bi <junxiao.bi@oracle.com> - 1.8.6-2.el6
changelog:
  - tools: up to 1.8.6-2 (Junxiao Bi)  
  - ocfs2-tools: mount not showing fully resolved path (Srinivas Eeda)


author: Junxiao Bi <junxiao.bi@oracle.com> - 1.8.6-1
changelog:
  - mkfs.ocfs2: fix default slots number in man doc [Orabug 20443780]
  - o2cb: fix systemd o2cb.service failure [Orabug 21071245]


author: Junxiao Bi <junxiao.bi@oracle.com> - 1.8.5
changelog:
  - ocfs2-tools: support trigger build from git
  - fsck.ocfs2: fix corruption when truncate reflink file
  - vendor: rhel7: add build/install dep pkg
  - ocfs2-tools: support powerpath dev as heartbeat dev
  - mounted.ocfs2: fix error checking
  - o2cb: mount debugfs when load config
  - o2cb: don't write sysconfig if status not changed
  - ocfs2-tools: add systemd support
  - ocfs2-tools: add build scripts for rhel7
  - fsck.ocfs2: abort if fs is mounted
  - fsck.ocfs2: fix journal tail wrapper
  - Add check to compare journal size and cluster size
  - fsck.ocfs2: do not remove the chain when verifying global bitmap chain alloc
  - debugfs.ocfs2: Fix a bug in process_open_args()
  - libo2dlm: Close file description after use
  - debugfs.ocfs2: Fix memory leak problem in process_open_args() & main()


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.12-1.166.3
changelog:
  - Check for NULL arena pointer in _int_pvalloc (#1256890).
  - Don't change no_dyn_threshold on mallopt failure (#1256891).


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.12-1.166.2
changelog:
  - Unlock main arena after allocation in calloc (#1256812).
  - Enable robust malloc change again (#1256812).
  - Fix perturbing in malloc on free and simply perturb_byte (#1256812).
  - Don't fall back to mmap prematurely (#1256812).


author: Carlos O'Donell <carlos@redhat.com> -2.12-1.166.1
changelog:
  - The malloc deadlock avoidance support has been temporarily removed since it
    triggers deadlocks in certain applications (#1244002).


author: Dave Airlie <airlied@redhat.com> 2.4.0-0.19
changelog:
  - add back modesetting support - this is a snapshot from modesetting-gem
  - any bugs are in the other packages that fail to build


author: Kristian Høgsberg <krh@redhat.com> - 2.4.0-0.15
changelog:
  - Avoid shared-core when doing make install so we don't install kernel
    header files.  Drop kernel header files from -devel pkg files list.


author: Adam Jackson <ajax@redhat.com> 2.4.0-0.11
changelog:
  - libdrm-2.4.0-no-bc.patch: Delete the /proc/dri BC code.  It's not needed,
    and the kernel implementation is sufficiently broken that we should avoid
    ever touching it.


author: Adam Jackson <ajax@redhat.com> 2.4.0-0.1
changelog:
  - libdrm-2.4.0-no-freaking-mknod.patch: Don't magically mknod the device
    file, that's what udev is for.


author: Mike A. Harris <mharris@redhat.com> 2.0.1-4
changelog:
  - Added "Exclusivearch: ix86, x86_64, ia64, ppc, alpha, sparc, sparc64" to
    restrict build to DRI-enabled architectures.


author: Mike A. Harris <mharris@redhat.com> 2.0-2
changelog:
  - Replaced the temporary tongue-in-cheek humourous package summary and
    description with the proper package descriptions, as many people didn't get
    the joke, while others felt it was getting old.  Ah well, I had my fun for
    a while anyway.  ;o)


author: Mike A. Harris <mharris@redhat.com> 2.0-1
changelog:
  - Updated libdrm to version 2.0 from dri.sf.net.  This is an ABI incompatible
    release, meaning everything linked to it needs to be recompiled.


author: Mike A. Harris <mharris@redhat.com> 1.0.5-1
changelog:
  - Updated libdrm to version 1.0.5 from dri.sf.net upstream to work around
    mesa unichrome dri driver compile failure.


author: Mike A. Harris <mharris@redhat.com> 1.0.4-1
changelog:
  - Updated libdrm to version 1.0.4 from X11R7 RC1
  - Remove i915_drv.h, imagine_drv.h, mach64_drv.h, mga_drv.h, mga_ucode.h,
    r128_drv.h, radeon_drv.h, savage_drv.h, sis_drv.h, sis_ds.h, tdfx_drv.h,
    via_drv.h, via_ds.h, via_mm.h, via_verifier.h from file manifest.


author: Mike A. Harris <mharris@redhat.com> 1.0.3-3
changelog:
  - Update BuildRoot to use Fedora Packaging Guidelines.
  - Add missing "BuildRequires: libX11-devel, pkgconfig"


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.6.3-2
changelog:
  - Added dfa-optimize-period patch (speedup for . patterns in UTF-8)
  - Added glibc-matcher-fallback patch (speedup for [a-z] patterns in UTF-8)
  - Added mmap-option-fix patch
  - Added dfa-convert-to-wide-char patch (speedup for -m and remove quadratic
    complexity when going to glibc)
  - Added dfa-speedup-digit-xdigit patch (speedup for [[:digit:]] [:xdigit:]])


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.6-1
changelog:
  - New version: grep-2.6
  - Added sigsegv patch (after release patch from upstream)
  - Dropped obsoleted patches: fedora-tests, pcrewrap, case, egf-speedup,
    bz460641, utf8, dfa-optional, w


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.5.4-1
changelog:
  - New version: grep-2.5.4
  - Fixed typos in %description
  - Updated utf-8 patch
  - Added dfa-optional patch (#538423)


author: Lubomir Rintel <lkundrak@v3.sk> 2.5.3-1
changelog:
  - Update to latest upstream version
  - Drop upstreamed patches
  - Add a couple of regression tests
  - Temporarily disable tests
  - Minor cleanup


author: Lubomir Rintel <lkundrak@v3.sk> 2.5.1a-61
changelog:
  - Fix pcre-mode (-P) line wrapping (bug #324781)
  - Match the version with upstream
  - Recode AUTHORS to utf8


author: Stepan Kasal <skasal@redhat.com> - 2.5.1-58
changelog:
  - Adhere to packaging guidelines.
  - Resolves: #225857
  - Use CPPFLAGS= argument to configure to add an -I option.
  - Do not set LDFLAGS=-s for "make install".


author: Tim Waugh <twaugh@redhat.com> 2.5.1-47
changelog:
  - Run 'make check'.
  - Fixed -w handling for EGexecute.  Now 'make check' passes.
  - Cache MB_CUR_MAX value in egf-speedup patch.
  - Fixed variable shadowing in egf-speedup patch.
  - Removed redundant (and incorrect) code in prline.


author: Tim Waugh <twaugh@redhat.com> 2.5.1-45
changelog:
  - More tests (Jakub Jelinek).
  - Jakub Jelinek's much improved -Fi algorithm.
  - Removed bogus part of grep-2.5.1-fgrep patch.


author: Tim Waugh <twaugh@redhat.com> 2.5.1-42
changelog:
  - Further UTF-8 processing avoided since a '\n' byte is always an
    end-of-line character in that encoding.


author: Tim Waugh <twaugh@redhat.com> 2.5.1-38
changelog:
  - Applied patch from Karsten Hopp to fix background colour problems with
    --color output (bug #138913).


author: Tim Waugh <twaugh@redhat.com> 2.5.1-36
changelog:
  - Automatically disable DFA when processing multibyte input.  GREP_USE_DFA
    environment variable overrides.


author: Tim Waugh <twaugh@redhat.com> 2.5.1-35
changelog:
  - Fixes to egf-speedup patch: now it does not change any functionality,
    as intended.
  - GREP_NO_DFA now turns off the DFA engine, for performance testing.


author: Tim Waugh <twaugh@redhat.com> 2.5.1-32
changelog:
  - Remove mb-caching hack.
  - Better multibyte handling in EGexecute() and Fexecute().
  - Don't need regex.c changes in grep-2.5-i18n.patch.


author: Tim Waugh <twaugh@redhat.com> 2.5.1-31
changelog:
  - Make 'grep -F' avoid UTF-8 processing if the pattern contains no
    multibyte characters (bug #133932).


author: Tim Waugh <twaugh@redhat.com> 2.5.1-27
changelog:
  - Fix dfa multibyte character class matching when -i is used (bug #123363).
  - Use bracket patch before i18n patch to make it clear that the bug exists
    upstream.


author: Tim Waugh <twaugh@redhat.com> 2.5.1-24
changelog:
  - Work around glibc bug #112869 (segfault in re_compile_pattern).
  - Avoid patching Makefile.am, to avoid automake/autoconf weirdness.


author: Bernhard Rosenkraenzer <bero@redhat.com> 2.4.2-7
changelog:
  - Fix up the i18n patch - it used to break "grep '[]a]'" (#49003)
  - revert to 2.4.2 (latest official release) for now


author: Bernhard Rosenkraenzer <bero@redhat.com> 2.5e-2
changelog:
  - Fix up the --color option to behave like the one from ls (--color=auto)
    Sooner or later, some people will alias grep="grep --color" and wonder why
    their scripts break.
  - Update docs accordingly
  - Get rid of the annoying blinking in grep --color


author: Miroslav Lichvar <mlichvar@redhat.com> 5.6-18.20080628
changelog:
  - update to patch 20080628
  - move mlterm and screen.* entries to -base
  - change kbs to ^? in rxvt and screen entries


author: Miroslav Lichvar <mlichvar@redhat.com> 5.6-16.20080301
changelog:
  - update to patch 20080301
  - provide libtermcap.so (#428898)
  - move all headers to /usr/include
  - move libncursesw out of /usr
  - make examples in documentation compilable (#436355)


author: Miroslav Lichvar <mlichvar@redhat.com> 5.6-13.20080112
changelog:
  - update to patch 20080112
  - make -libs, -base, -term subpackages
  - obsolete termcap and libtermcap
  - update urxvt entry


author: Miroslav Lichvar <mlichvar@redhat.com> 5.6-10.20070812
changelog:
  - fix comp_hash string output
  - avoid comparing padding in cchar_t structure
  - remove gawk from buildrequires


author: Miroslav Lichvar <mlichvar@redhat.com> 5.6-6.20070303
changelog:
  - update to patch 20070303
  - use one libtinfo for both libncurses and libncursesw
  - shorten -devel description


author: Miroslav Lichvar <mlichvar@redhat.com> 5.6-4.20070210
changelog:
  - update to patch 20070210
  - generate separate terminfo library
  - move static libraries to -static subpackage
  - avoid unnecessary linking with libdl


author: Miroslav Lichvar <mlichvar@redhat.com> 5.6-2.20070120
changelog:
  - update to patch 20070120
  - don't depend on bash, drop resetall script
  - include rxvt-unicode description


author: Miroslav Lichvar <mlichvar@redhat.com> 5.5-27.20061209
changelog:
  - update to patch 20061209
  - strip large tables from shared libraries, reduce number of relocations
  - package utils linked with libncurses instead of libncursesw
  - package only wide-character headers


author: Miroslav Lichvar <mlichvar@redhat.com> 5.5-25.20060715
changelog:
  - move libncurses and some terminfo entries out of /usr
  - drop console symlink and sparc terminfo entries


author: Miroslav Lichvar <mlichvar@redhat.com> 5.5-24.20060715
changelog:
  - modify tgetstr to make screen happy (#202480)
  - use CFLAGS when linking (#199369)
  - change BuildRoot tag to comply with Fedora packaging guidelines


author: Miroslav Lichvar <mlichvar@redhat.com> 5.5-20
changelog:
  - update to patch 20060701
  - don't strip libraries, chmod +x them
  - move .so links to devel package
  - add gpm-devel to buildrequires
  - spec cleanup


author: Petr Raszyk <praszyk@redhat.com> 5.5-11
changelog:
  - According Henrik Nordstrom (hno@squid-cache.org)
    Diff between the two versions of curses.h on x86_64
    Patch ncurses-5.5-chtypeaslong2.patch
    See #178824


author: Petr Raszyk <praszyk@redhat.com> 5.4-21
changelog:
  - Clear window after: filter()+'terminal-resizing'+endwin()
    doupdate()+endwin()
    See bug #174498, patch ncurses-5.4-endwinfilter.patch


author: 5.4-19 <praszyk@redhat.com> 5.4-19
changelog:
  - Clear window after: filter()+initscr()+endwin()+refresh()
    See bug #2966, patch ncurses-5.4-filter.patch


author: Petr Rockai <prockai@redhat.com> - 5.4-17
changelog:
  - apply patch from Hans de Goede, fixing BR142659 [The
    terminfo data for kbs changed from \177 to ^H]


author: Adrian Havill <havill@redhat.com> 5.4-11
changelog:
  - add latest rollup patches and weekly patches
  - remove home/end patch, which is now included in latest
    terminfo.src and termcap.src
  - add term.sh to /etc/profile.d, reference in /etc/bashrc
  - modify term.sh to support rxvt (#122815 comment 93)


author: Adrian Havill <havill@redhat.com> 5.4-9
changelog:
  - remove terminfo try-to-please-all xterm hackery; it's now ptty
    and profile's job to point to the correct terminal. (#122815)


author: Adrian Havill <havill@redhat.com> 5.4-5
changelog:
  - remove --with-gpm from configure, as it adds a pkg
    dependency (#122336) and causes too many problems vs its benefits


author: Adrian Havill <havill@redhat.com> 5.4-3
changelog:
  - link "xterm" to "xterm-color" as temp fix for escape problem (#115448)
  - remove old zcat for PATCH1


author: Adrian Havill <havill@redhat.com> 5.3-9
changelog:
  - remove not-so safe-sprintf configure option because the code does
    not appear to be stable enough for some apps. (#103790)


author: Adrian Havill <havill@redhat.com> 5.3-7
changelog:
  - fixed the safe sprintf code that was enabled in the previous release
    by the configure parameter. (#101486)


author: Adrian Havill <havill@redhat.com> 5.3-5
changelog:
  - added latest rollup patch with widec/UTF8 centric weekly (20030517)
  - added --enable-widec to configure (#86311)
    original work done by Mr. Sam <sam@email-scan.com>
  - require sharutils (#86605)
  - add gpm, xmc support
  - add debug syms back into package
  - updated autoconf/configure patch


author: Adrian Havill <havill@redhat.com> 5.3-3
changelog:
  - remunged xterm changes from 5.2 patch for 5.3
  - updated screen entry (#82951)
  - fixed ka3, kb2 and kf0 entries (#77506)


author: Adrian Havill <havill@redhat.com> 5.3-1
changelog:
  - upgrade to 5.3 for sake of utf-8, wide chars (#77585 ...)
  - spec file summary/desc grammar (#73583)
  - add Requires: for c++ devel subpkg (#74002)
  - terminfo.src patches no longer needed
  - adjust autoconf patch


author: Bernhard Rosenkraenzer <bero@redhat.com> 5.2-26
changelog:
  - Remove duplicated files (#62752)
  - Don't strip libraries (#60398)
  - Remove cbt capability from xterm description (#61077)


author: Bernhard Rosenkraenzer <bero@redhat.com> 5.2-17
changelog:
  - Patchlevel 20020209
  - Fix zero-substitution of cf_cv_type_of_bool (#59450)
  - Fix rebuilding of configure script with autoconf 2.5x


author: Bernhard Rosenkraenzer <bero@redhat.com>
changelog:
  - 5.2
  - Fix typo in man page (Bug #20205)
  - update the "screen" terminfo entries to the version supplied with
    screen 3.9.8


author: Bernhard Rosenkränzer <bero@redhat.com>
changelog:
  - Add xterm patch from Hans de Goede <hans@highrise.nl>
  - Patch 20000108, this fixes a problem with a header file.


author: Cristian Gafton <gafton@redhat.com>
changelog:
  - revert to the old major number - because the ABI is not changed (and we
    should be handling the changes via symbol versioning anyway)


author: Bernhard Rosenkraenzer <bero@redhat.com>
changelog:
  - Fix a typo in spec
  - Add the 19991006 patch, fixing some C++ STL compatibility problems.
  - get rid of profiling and debugging versions - we need to save space...


author: Bernhard Rosenkraenzer <bero@redhat.com>
changelog:
  - 5.0
  - some spec cleanups to make updating easier
  - add links *.so.5 to *.so.4 - they are fully binary compatible.
    (Why did they change the invocation number???)


author: Cristian Gafton <gafton@redhat.com>
changelog:
  - don't build the C++ demo code
  - update patch set to the current as of today (redid all the individual
    patches in a single one)


author: Cristian Gafton <gafton@redhat.com>
changelog:
  - added terminfo entry for the poor guys using lat1 and/or lat-2 on their
    consoles... Enjoy linux-lat ! Thanks, Erik !


author: Cristian Gafton <gafton@redhat.com>
changelog:
  - new patch to get xterm-color and nxterm terminfo entries
  - aliased them to rxvt, as that seems to satisfy everybody


author: Bill Nottingham <notting@redhat.com> 1.3.49.1-1
changelog:
  - backport LSB fixes from head
  - fixes: #693202/#771455, #649227/#771452, #750446/#771454, #701573/#771741, #696305 (<jbastian@redhat.com>)


author: Bill Nottingham <notting@redhat.com> 1.3.45-1
changelog:
  - add support for Should-Start, Should-Stop (#98470, <iarnell@gmail.com>)
  - ntsysv: don't drop initscripts with '.' in the name (#556751)
  - translation updates: el, id


author: Bill Nottingham <notting@redhat.com> 1.3.44-1
changelog:
  - alternatives: update symlinks if they exist on installation (#104940)
  - alternatives: clarify error messages with more context (#441443)
  - alternatives: fix removal of manual links (#525021, <dtardon@redhat.com>)
  - translation updates: ml, mr, pl, ta, uk


author: Bill Nottingham <notting@redhat.com> 1.3.42-1
changelog:
  - further LSB fixes (#474223)
  - throw errors on various malformed init scripts (#481198)
  - man page updates re: LSB (#487979)
  - translation updates: mai, gu, pt_BR, ro, ca, pa, sr, fr, hu


author: Bill Nottingham <notting@redhat.com> 1.3.40-1
changelog:
  - fix some overflows. (#176944)
  - add --type parameter to specify either xinetd or sysv services.
    (#467863, <mschmidt@redhat.com>
  - do a permissions check before add/remove/on/off/resetpriorities. (#450254)
  - parse Short-Description correctly (#441813, <peter_e@gmx.net>)


author: Bill Nottingham <notting@redhat.com> 1.3.34-1
changelog:
  - translation updates: as, bg, bn_IN, bs, ca, de, fr, hi, hu, id, ja,
    ka, ml, ms, nb, or, sk, sl
  - add resetpriorities to the man page (#197399)


author: Bill Nottingham <notting@redhat.com> 1.3.33-1
changelog:
  - various changes from review - support alternate %{_sbindir}, fix
    summaries, add version to requires, assorted other bits


author: Bill Nottingham <notting@redhat.com> 1.3.31-1
changelog:
  - fix man page (#220558, <esr@thyrus.com>)
  - add some more verbiage in alternatives man page (#221089)
  - don't print usage message on a nonexstent service (#226804)


author: Bill Nottingham <notting@redhat.com>
changelog:
  - for LSB scripts, use any chkconfig: priorities as a basis,
    instead of 50/50 (#172599)
  - fix LSB script dependency setting when no chkconfig: line
    is present (#161870, <jean-francois.larvoire@hp.com>)
  - fix LSB script dependency setting when one of Required-Stop
    or Required-Start: is missing (#168457)


author: Bill Nottingham <notting@redhat.com>
changelog:
  - fix segfault on directories in /etc/xinetd.d (#166385)
  - don't needlessly rewrite xinetd files (#81008)


author: Bill Nottingham <notting@redhat.com> 1.3.14-1
changelog:
  - resize reasonably with larger screens (#74156)
  - don't error out completely on bad symlink (#74324)
  - use ngettext (#106176)
  - error out on invalid start/stop values (#109858)
  - some man page updates
  - fix return code of chkconfig for xinetd services (#63123)
  - sort chkconfig --list display (#61576, <shishz@alum.rpi.edu>)


author: Dan Walsh <dwalsh@redhat.com> 1.3.8-2
changelog:
  - Fix readXinetdServiceInfo to return error on not regular files
  - Fix chkconfig to not write messages if readXinetdServiceInfo gets an error


author: Bill Nottingham <notting@redhat.com> 1.3.4-1
changelog:
  - don't apply the dependency logic to things that already have
    start/stop priorities
  - fix silly display bug in --config


author: Bill Nottingham <notting@redhat.com>
changelog:
  - alternatives: handle initscripts too; --initscript command-line option
  - chkconfig/ntsysv (and serviceconf, indirectly): services with
     *no* links in /etc/rc*.d are no longer displayed with --list, or
     available for configuration except via chkconfig command-line options
  - alternatives: fix trying to enable disable a null service


author: Bill Nottingham <notting@redhat.com>
changelog:
  - actually, put the alternatives stuff back in /usr/sbin
  - ship /etc/alternatives dir
  - random alternatives fixes


author: Matt Wilson <msw@redhat.com>
changelog:
  - changed Prereq: initscripts >= 5.18 to Conflicts: initscripts < 5.18
  - fixed sumary and description where a global string replace nuked them


author: Matt Wilson <msw@redhat.com>
changelog:
  - added support for a "hide: true" tag in initscripts that will make
    services not appear in ntsysv when run with the "--hide" flag


author: Arnaldo Carvalho de Melo <acme@conectiva.com.br>
changelog:
  - added pt_BR translations
  - added more translatable strings
  - support for i18n init.d scripts description


author: Thomas Woerner <twoerner@redhat.com> 1.2.27-4
changelog:
  - fixed possible privilege escalation flaw via use of python pickle
    (CVE-2011-2520), replaced pickle by json (rhbz#717985, rhbz#719871)
  - stop D-BUS firewall mechanism on update


author: Thomas Woerner <twoerner@redhat.com> 1.2.27-1
changelog:
  - updated translations: bn_IN, de, fi, fr, gu, hi, it, ja, kn, ko, ml, mr, or,
                          pt_BR, ru, ta, te, zh_CN, zh_TW


author: Thomas Woerner <twoerner@redhat.com> 1.2.26-1
changelog:
  - added libvirt services (rhbz#565625)
  - added Bakula service (rhbz#588377)
  - fixed DBUS mechanism to report complete syslog message (rhbz#604623)
  - fixed crash because of missing /etc/services file (rhbz#604726)
  - updated translations: ar, as, bn_IN, da, de, es, fi, fr, gu, he, hi, is, it,
                          ja, kn, ko, ml, mr, nl, or, pa, pl, pt, ru, ta, te, 
                          zh_CN


author: Thomas Woerner <twoerner@redhat.com> 1.2.25-1
changelog:
  - fixed lokkit: do not create or alter firewall in selinux only mode
    (rhbz#583986)
  - use new icons (rhbz#583715)
  - fixed treeviewtooltips to not show the tooltip if an overlapping window has
    the focus
  - updated translations: bn_IN, de, es, gu, it, kn, ml, mr, nl, or, pa, pl, pt,
                          pt_BR, ru, sk, sr, sr@latin, te


author: Thomas Woerner <twoerner@redhat.com> 1.2.24-1
changelog:
  - DBUS-mechanism: report errors to syslog and print traceback (rhbz#563354)
  - fixed minor misspellings (rhbz#566468)
  - msgmerged po files
  - added missing default values for ip*tables-config content (rhbz#566869)
  - autofoo utils update
  - fixed max length of user defined interface name in interfaceDialog
  - added missing range check to port_entry_changed_cb
  - fixed sensitiveness of protocol label in portDialog
  - fixed misuse of MARK extension in nat table, now in mangle table
  - port forwarding dialog usability fixes (rhbz#507638)
  - use new fw_functions.checkInterface function in tui and gui
  - new function to check interface names in fw_functions
  - use new checkInterface function in parser for trust, masq and forward-port
  - add wlan standard device
  - fixed build (fw_nm.py not packaged)
  - updated translations: bn_IN, cs, da, de, el, en_GB, es, fi, fr, hu, is, it,
                          ja, nb, nl, or, pl, pt, pt_BR, ru, sr, sr@latin, sv,
                          te, uk


author: Thomas Woerner <twoerner@redhat.com> 1.2.22-1
changelog:
  - using NetworkManager DBUS interface to replace NCDeviceList from
    system-config-network
  - not opening orig port for local port forwarding, only new port is open
  - added isakmp support for IPsec (rhbz#504446)
  - added amanda client support (rhbz#541679)
  - fixed requirement for setenforce: libselinux-utils instead of libselinux
  - removed unused import socket
  - added download url to Source tag in spec file
  - fixed wrong license header in src/fw_tui.py (LGPL instead of GPL)
  - update cluster-suite service: disable rgmanager and cssd
  - removed separator at the end of the Options menu (rhbz#531635)
  - removed 2049/udp from NFS4 service (rhbz#532491)


author: Thomas Woerner <twoerner@redhat.com> 1.2.21-1
changelog:
  - fixed Policykit v0 compatibility for Fedora version 10 and 11: python-slip
    for PolicyKit v0 does not provide dbus
  - updated translations: bn_IN, uk, zh_CN


author: Thomas Woerner <twoerner@redhat.com> 1.2.19-1
changelog:
  - enhanced build environment to support usermode and policykit switches, new
    options for configure and spec file
  - make toplevel invisible to not show half initialized window while policykit
    dialog is shown
  - system-config-firewall.desktop.in moved to config subdir
  - disable dbus usage if gui is used as root (needed for policykit v0)
  - do not report dbus error if there is no firewall configuration (empty or
    missing /etc/sysconfig/system-config-firewall)
  - resize main window to comfortably fit in a 800x600 gnome desktop
  - moved all config files into config subdir: sysconfig, dekstop, pam and console
  - new infrastructure to enable policy translations
  - print exception if polkit authorization failes to console
  - show dbus error dialog if dbus conection can not be established
  - set title to APP_NAME for dialogs if there is no title
  - center dialogs on screen if there is no parent
  - make main app invisible at first to prevent to show an empty app while
    PolicyKit password dialog is visible
  - updated translations: as, bn_IN, ca, da, de, ca, cs, es, fi, fr, gu, hi, it,
                          ja, kn, ko, ml, mr, nl, or, pa, pl, pt, pt_BR, ru, sk,
                          sr, sr@latin, sv, ta, te, uk, zh_TW


author: Thomas Woerner <twoerner@redhat.com> 1.2.18-1
changelog:
  - added support for PolicyKit
  - removed unused inconsistent flag from CellRendererToggle in serviceView (rhbz#521144)
  - made "Port/Protocol" cell resizable in "Trusted Services"-view
  - fixed hidden one line label after resize caused by fix for bgo#315462
  - fixed startup busy loops if assistive technologies is enabled (rhbz#515048)
    by moving set_model after adding the columns to a TreeView
  - fixed tui to create valid empty self.config object (rhbz#518210)
  - failing to load the icon in fw_gui.setupScreen should not be fatal
    (rhbz#508186)
  - made description column in settings dialog resizable
  - removed rhpl usage (rhbz#508991)
  - fixed not reappearing TreeViewTooltips if mouse moved in the tooltip popup
  - hide TreeViewTooltips while scrolling
  - code cleanup
  - sort ports in fw_services by protocol, id
  - updated translations: as, bn_IN, ca, da, de, es, fi, fr, gu, hi, kn, hu, it, 
                          ja, ko, ml, mr, nl, or, pa, pl, pt, pt_BR, ru, sk, sr,
  			sr@latin, ta, te, uk, zh_CN, zh_TW


author: Thomas Woerner <twoerner@redhat.com> 1.2.17-1
changelog:
  - Added Red Hat Cluster Suite to trusted services (rhbz#493668)
  - Fixed wrong patch for system-config-firewall-tui (rhbz#461046)
  - Fixed sysctl parser to also support ';' for comments
  - Fixed port range check for service names containing '-'
  - New column in serviceView for conntrack helper, removed from tooltip
  - New column in icmpView for protocol types, removed from tooltip
  - Added TFTP and TFTP client support (rhbz#494417)
  - Fixed sensitiveness of OK button in portDialog if editing an Port
    (rhbz#500380)
  - Added missing tooltips for buttons in mainNotebook tabs. (rhbz#493872)
  - updated po files


author: Thomas Woerner <twoerner@redhat.com> 1.2.16-1
changelog:
  - fixed build system to update desktop file from desktop.in
    fixes icon reference in desktop file (rhbz#493674)
  - updated translations: fr


author: Thomas Woerner <twoerner@redhat.com> 1.2.15-1
changelog:
  - fixed icon reference in desktop file (rhbz#493674)
  - fixed po/POTFILES.in
  - updated translations: as, bn_IN, el, fi, gu, hi, hu, it, kn, ko, mai, ml, mr, or, pa, pt, ru, sk, sv, ta, te, zh_TW


author: Thomas Woerner <twoerner@redhat.com> 1.2.14-1
changelog:
  - new build environment using configure, autofoo and intltool
  - fixed typo in router-solicitation description (rhbz#490979)
  - new themable application icon: preferences-system-firewall (rhbz#454402)
  - make backup copies before overwriting files (rhbz#437374)
  - updated translations:


author: Thomas Woerner <twoerner@redhat.com> 1.2.13-1
changelog:
  - fixed two typos in fw_icmp (rhbz#467334)
  - added ability to sort custom rules files (rhbz#467696)
  - fixed modified test in sysctl writer: fixes rhbz#462325
    also removed quotes around values for new keys
  - some build fixes
  - updated translations for: as, de, fi, fr, he, hi, ko, hu, it, ja, ko, ml,
                              pl, pt_BR, ru, sk, sr, sr@latin, sv, ta, te, 
                              zh_CN, zh_TW


author: Thomas Woerner <twoerner@redhat.com> 1.2.12-1
changelog:
  - only provide lang files in tui sub-package (rhbz#465572)
  - updated translations for: as, bn_IN, ca, cs, es, fr, gu, it, ja, kn, mr, nl,
                              pa, or, pl, pt_BR, sk, zh_CN, zh_TW


author: Thomas Woerner <twoerner@redhat.com> 1.2.11-1
changelog:
  - use dialogs for parser errors in tui (rhbz#457485)
  - enable to add protocol specific (IPv4, IPv6) icmp types for ICMP filtering
  - updated translations for he, ja, ko and zh_CN


author: Thomas Woerner <twoerner@redhat.com> 1.2.10-1
changelog:
  - lokkit: fixed path for system-config-firewall-tui (rhbz#454108)
  - updated translations for: it, fr, nl, ru, sr, sr@latin


author: Thomas Woerner <twoerner@redhat.com> 1.2.9-1
changelog:
  - fixed format string to silence inttool
  - new remider to check if the ip*tables services are enabled
  - use proper dialog functions in the tui
  - updated translations: cs, de, es, gu, pl


author: Thomas Woerner <twoerner@redhat.com> 1.2.8-1
changelog:
  - new tui interface
  - new system-config-firewall-tui
  - new client services for ipp and samba
  - lokkit: fixed disabling of firewall in force mode (rhbz#443411)
  - disabled port forwarding for IPv6
  - some minor fixes and enhancements


author: Thomas Woerner <twoerner@redhat.com> 1.2.7-1
changelog:
  - fixed crash if encoding is not UTF-8 (rhbz#439902)
  - updated translations: bn_IN, cs, de, es, fi, fr, gu, hi, it, kn, ko, ml,
                          mr, pa, pl, pt_BR, ru, sr, sr@latin, ta, te, zh_CN


author: Thomas Woerner <twoerner@redhat.com> 1.2.6-1
changelog:
  - new ICMP filter to block specified ICMP types
  - fixed minor problem in lokkit (initialize old_config)
  - set starting diretory for custom rules files to /etc/sysconfig
  - more build environment changes for git
  - use gtk.CellRendererToggle instead of own CellRendererCheck
  - several parser changes for transparent error handling and output
  - some minor enhancements
  - translation updates


author: Thomas Woerner <twoerner@redhat.com> 1.2.4-1
changelog:
  - fixed overwrite problem if IPTABLES_SAVE_ON_RESTART is set (rhbz#431961)
  - use SELECTION_NONE for trustedView


author: Thomas Woerner <twoerner@redhat.com> 1.2.3-1
changelog:
  - fixed traceback for empty configuration use in life installer (rhbz#430963)
  - use config-util for userhelper configuration (rhbz#428392)
  - mark dirty after applying new default configuration
  - do not overwrite attributes filename and converted in config
  - use new shared ChooserButton
  - fixed forward dialog and labels to use current dialog width
  - use tempfile.mkdtemp for better security
  - updated translations: fi, fr, it, ja, nl, pt_BR, sr and sr@latin


author: Thomas Woerner <twoerner@redhat.com> 1.2.2-1
changelog:
  - fixed icmp handling for ip6tables in FORWARD chain
  - do state established, related test early in FORWARD chain
  - fixed typo in address for port-forwarding
  - added IPv4 only message to masquerading and port-forwarding for lokkit
  - updated translations: es, pl


author: Thomas Woerner <twoerner@redhat.com> 1.2.1-1
changelog:
  - fixed traceback for clean selinux configuration (rhbz#430963)
  - fixed icmp handling for ip6tables
  - updated translations: as, de, it, ja, pl, pt_BR, zh_CN


author: Thomas Woerner <twoerner@redhat.com> 1.2.0-1
changelog:
  - added port forwarding
  - using INPUT chain in table filter instead of RH-Firewall-1-INPUT
  - fixed masquerading
  - rewrite of firewall generation code
  - trusted hosts now also allowed for FORWARD
  - lots of bug fixes
  - gui enhancements


author: Thomas Woerner <twoerner@redhat.com> 1.1.3-1
changelog:
  - new fw_compat, used in config-convert and fw_sysconfig to automatically 
    convert old system-config-securitylevel configurations
  - new wizard look
  - fixed range check for user defined ports
  - some code cleanup
  - updated translations for fi, fr and ja


author: Thomas Woerner <twoerner@redhat.com> 1.1.2-1
changelog:
  - fw_gui: fixed row activation for masquerading
  - fw_gui: fixed _setInterfaces to use internal functions to correctly set
    toggles
  - fw_gui: show info dialog if no config exists and firewall gets enabled: new
    function enableFirewall
  - fw_gui, fw_tui: disable firewall if no config exists
  - fw_gui, fw_tui: do not print traceback if NCDeviceList.getDeviceList raises
    and exception
  - forward masqueraded connections
  - gtk_cellrenderercheck: fixed size calculations
  - fw_sysconfig: set config.filename to None for merged configuration in
    read_sysconfig_config if no configuration exists
  - new translations


author: Thomas Woerner <twoerner@redhat.com> 1.1.1-1
changelog:
  - use radio buttons for skill menu entries to show active level
  - fixed convert-config problem if there is no configuration to convert
    (rhbz#426477)
  - minor string changes
  - new it and pt_BR translations


author: Thomas Woerner <twoerner@redhat.com> 1.1.0-1
changelog:
  - new default configurations: server, desktop
  - cleanup of wizard: dropped network connection tab
  - new option in wizard to keep configuration or load a default configuration
  - new menu entry and dialog to configure iptables and ip6tables service settings
  - some enhancements to the gtk_cellrenderercheck for better look and feel


author: Thomas Woerner <twoerner@redhat.com> 1.1.0-0
changelog:
  - ports are ports and services are services: there is a new service tag to
    enable services; a port is not enabling a service anymore
  - new conversion tool for 1.0.X to 1.1.X configuration
  - new version option for lokkit
  - wizard
    - dropped network connection selection tab
    - using keep configuration check instead of clear configuration check
    - added default configuration selection
  - gui: new menu for skill level and load default configuration
  - use choices in optparse, removed obsolete check functions


author: Thomas Woerner <twoerner@redhat.com> 1.0.12-1
changelog:
  - allow to activate checkboxes by row activation in treeviews
  - code cleanup in view_toggle_cb
  - fixed port display for IPSec
  - use system icons where possible, new wizard icons
  - added fallback for CellRendererCheck if icons are missing, size fixes
  - added tooltips for toolbar and menu entries (if needed)
  - improved more english texts (rhbz#395801)
    thanks to Paul W. Frields for the initial patch


author: Thomas Woerner <twoerner@redhat.com> 1.0.11-1
changelog:
  - fixed crash on startup for network device aliases (rhbz#384891)
    thanks to Loran Freval for the patch
  - added port entry max length in other ports dialog (rhbz#385931)
  - added version number to about dialog (rhbz#387891)
  - improved some english texts (rhbz#383741)
    thanks to Paul W. Frields for the initial patch
  - code cleanup with start speedup
  - do not allow to add custm rules for ipv6:nat
  - also translate parser error messages


author: Thomas Woerner <twoerner@redhat.com> 1.0.10-1
changelog:
  - fixed problem with network devices (rhbz#331671)
  - dropped obsolete translation no.po (rhbz#332331)


author: Thomas Woerner <twoerner@redhat.com> 1.0.9-1
changelog:
  - do not report configuration failed if ipv6 is disabled (rhbz#355561)
  - print messages if lokkit failed
  - lokkit be more verbose on restarting ipXtables in verbose mode


author: Thomas Woerner <twoerner@redhat.com> 1.0.8-2
changelog:
  - lokkit: write new config with nostart option (rhbz#353961)
  - translation fixes for de, it, nb, sr@latin


author: Thomas Woerner <twoerner@redhat.com> 1.0.8-1
changelog:
  - use extension match for protocols (rhbz#229879)
  - use ipv6-icmp instead of icmpv6 (rhbz#291001)
  - use ':' in tui as port/proto delimiter for other ports (rhbz#292171)
  - some translation fixes


author: Thomas Woerner <twoerner@redhat.com> 1.0.7-1
changelog:
  - new translations
  - added openvpn to services (rhbz#)
  - fixed typo in description text for ipsec
  - using port numbers instead of port names for services
  - renamed some variables to be consistent
  - make tolltip better: bigger text, helper modules
  - dropped unused code: inconsistent handling
  - make port check button inactive in add_port_cb
  - new function _addDevice: code cleanup
  - allow to set variables in ipXtablesConfig, which were not set before
  - fixed os.system calls in ipXtablesClass to return proper return values
  - fixed status funciton in ipXtablesClass
  - new _append_unique function in fw_parser to prevent duplicates
  - added warning dialog for missing or unusable /etc/sysconfig/ip*tables files
  - fixed expand of the warning label in the startup dialog


author: Thomas Woerner <twoerner@redhat.com> 1.0.6-1
changelog:
  - dropped --stop option from fw_gui::genArgs
  - new translations
  - sysctl support for masquerading (net.ipv4.ip_forward will be set)
  - glade file: fixed spacings, dropped not needed containers


author: Thomas Woerner <twoerner@redhat.com> 1.0.5-4
changelog:
  - fixed problem if /etc/sysconfig/system-config-securtylevel and 
    /etc/sysconfig/system-config-firewall are not readable


author: Thomas Woerner <twoerner@redhat.com> 1.0.4-1
changelog:
  - more translations
  - build environment changes
  - dropped build stage, because it is not needed at all


author: Thomas Woerner <twoerner@redhat.com> 1.0.3-1
changelog:
  - added missing system-config-securitylevel compatibility files
  - string and documentation fixes
  - fixed typos reported by Alain Portal
  - more translations
  - fixed buildroot
  - cleanup and changes according to review (rhbz#253232)
  - moved doc to tui sub package


author: Thomas Woerner <twoerner@redhat.com> 1.0.2-1
changelog:
  - obsolete and provide system-config-securitylevel package
  - added compat files for anaconda, firstboot and system-config-kickstart
  - lokkit fixes for nostart option:
    - only write config for iptables and ip6tables if enabled
    - stop iptables and ip6tables if disabled
    - unlink iptables and ip6tables rule files if disabled
  - lokkit: new option --update to regenerate firewall configuration if not 
    disabled
  - check for include files only when writing firewall configuration
  - clean buildroot in install
  - made system-config-securitylevel a synonym for system-config-firewall
  - ip6tables: reject with icmp6-adm-prohibited instead of icmp6-port-unreachable
    (rhbz#250915)
  - moved config files from /etc/sysconfig into tui sub package
  - removed x bit from import files


author: Thomas Woerner <twoerner@redhat.com> 1.0.1-2
changelog:
  - fixed disabled string in fw_gui
  - set mode after copying of ip*tables-config to 0600
  - fixed categories in desktop file


author: Thomas Woerner <twoerner@redhat.com> 1.0.1-1
changelog:
  - fixed startup and description texts
  - added missing requirement for system-config-network-tui
  - moved base python files into tui sub package
  - fixed requirements
  - made package noarch


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-3
changelog:
  - Ensure pem uses system freebl as with this update freebl brings in new API's
  - Resolves: rhbz#927157 - [RFE][RHEL6] Rebase to nss-3.14.3 to fix the lucky-13 issue


author: Elio Maldonado - 3.14.3-2
changelog:
  - Install sechash.h and secmodt.h which are now provided by nss-devel
  - Resolves: rhbz#927157 - [RFE][RHEL6] Rebase to nss-3.14.3 to fix the lucky-13 issue
  - Remove unsafe -r option from commands that remove headers already shipped by nss-util and nss-softoken


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-1
changelog:
  - Update to NSS_3.14.3_RTM
  - Resolves: rhbz#927157 - [RFE][RHEL6] Rebase to nss-3.14.3 to fix the lucky-13 issue
  - Update expired test certificates (fixed in upstream bug 852781)
  - Sync up pem module's rsawrapr.c with softoken's upstream changes for nss-3.14.3
  - Reactivate the aia tests


author: Thomas Woerner <twoerner@redhat.com> - 2.0.9-5
changelog:
  - added -fno-strict-aliasing to the compiler flags (rhbz#596158)
  - cleaned up description (rhbz#596158)
  - fixed install of /etc/ethertypes in running system (rhbz#596778)


author: Thomas Woerner <twoerner@redhat.com> - 2.0.9-3
changelog:
  - fixed init script to be lsb conform
    Resolves: rhbz#536828
  - fixed download link according to package review
    Related: rhbz#543948


author: Tom "spot" Callaway <tcallawa@redhat.com> 2.0.8-4
changelog:
  - bump to 2.0.8-2 from upstream
  - keep _libdir/ebtables, even though upstream just moved away from it.


author: Tom "spot" Callaway <tcallawa@redhat.com> 2.0.8-3
changelog:
  - use _libdir/ebtables to match upstream RPATH (bugzilla 248865)
  - correct license tag
  - use upstream init script
  - enable build-id
  - use cflags for all compiles
  - be sane with DESTDIR


author: Tom "spot" Callaway <tcallawa@redhat.com> 2.0.6-4
changelog:
  - remove INSTALL file
  - add some text to description, correct typos
  - fix %postun
  - add PreReqs
  - add %ghost config files


author: Milan Broz <mbroz@redhat.com> - 1.2.0-7
changelog:
  - Fix device lookup function.
  - Fix duplicate directories displayed in status output.
    Resolves: #755478 #746648


author: Milan Broz <mbroz@redhat.com> - 1.2.0-3
changelog:
  - Require updated device mapper library (secure flag).
  - Use FIPS RNG for keyslot salt in FIPS mode.
    Resolves: #692512 #693371


author: Milan Broz <mbroz@redhat.com> - 1.2.0-2
changelog:
  - Require libgcrypt and device-mapper versions supporting FIPS extensions.
  - Request buffer wipe for dm-ioctl when sending key data.
    Resolves: #674825


author: Milan Broz <mbroz@redhat.com> - 1.2.0-1
changelog:
  - Update to cryptsetup 1.2.0
  - Use generic crypto backend interface.
  - Add fipscheck compile option.
  - Use gcrypt RNG in FIPS mode for key generation.
  - Add FAQ to documentation.
    Resolves: #658817 #663870 #663869


author: Milan Broz <mbroz@redhat.com> - 1.1.2-1
changelog:
  - Fix handling of newline with keyfile on standard input.
  - Fix alignment ioctl use.
  - Fix API activation calls to handle NULL device name.
    Resolves: #598523 #569949 #599617


author: Milan Broz <mbroz@redhat.com> - 1.1.1-0.2
changelog:
  - Update to cryptsetup 1.1.1-rc2.
  - Align device using topology info if available.
    Resolves: #569949


author: Milan Broz <mbroz@redhat.com> - 1.1.0-0.6
changelog:
  - Update to cryptsetup 1.1.0-rc4
  - Fix gcrypt initialisation.
  - Fix backward compatibility for hash algorithm (uppercase).


author: Milan Broz <mbroz@redhat.com> - 1.1.0-0.1
changelog:
  - Update to new upstream testing version with new API interface.
  - Add luksSuspend and luksResume commands.
  - Introduce pkgconfig.


author: Milan Broz <mbroz@redhat.com> - 1.0.7-1
changelog:
  - Update to upstream final release.
  - Split libs subpackage.
  - Remove rpath setting from cryptsetup binary.


author: Milan Broz <mbroz@redhat.com> - 1.0.6-5
changelog:
  - Change new project home page.
  - Print more descriptive messages for initialization errors.
  - Refresh patches to versions commited upstream.


author: Till Maas <opensource till name> - 1.0.6-3
changelog:
  - remove a duplicate sentence from the manpage (RH #448705)
  - add patch metadata about upstream status


author: Till Maas <opensource till name> - 1.0.6-0.1.pre2
changelog:
  - Update to new version with several bugfixes
  - remove patches that have been merged upstream
  - add patch from cryptsetup newsgroup
  - fix typo / missing luksRemoveKey in manpage (patch)


author: Till Maas <opensource till name> - 1.0.5-6
changelog:
  - cleanup BuildRequires:
  - removed versions, packages in Fedora are new enough
  - changed popt to popt-devel


author: Till Maas <opensource till name> - 1.0.5-5
changelog:
  - fix devel subpackage requires
  - remove empty NEWS README
  - remove uneeded INSTALL
  - remove uneeded ldconfig requires
  - add readonly detection patch


author: Till Maas <opensource till name> - 1.0.5-4
changelog:
  - disable patch2, libsepol is now detected by configure
  - move libcryptsetup.so to %{_libdir} instead of /%{_lib}


author: Till Maas <opensource till name> - 1.0.5-2
changelog:
  - Use /lib as libdir (#243228)
  - sync header and library (#215349)
  - do not use %makeinstall (recommended by PackageGuidelines)
  - select sbindir with %configure instead with make
  - add TODO


author: Alasdair Kergon <agk@redhat.com> - 1.0.3-4
changelog:
  - Add build dependency on new device-mapper-devel package.
  - Add preun and post ldconfig requirements.
  - Update BuildRoot.


author: Adam Jackson <ajax@redhat.com> 10.2-3
changelog:
  - cdparanoia-10.2-endian.patch: Backport a crash fix for host/drive
    endianness mismatch. (#466659)


author: Adam Jackson <ajax@redhat.com> alpha9.8-30
changelog:
  - Add -Werror-implicit-function-declarations.
  - cdparanoia-III-alpha9.8-headers.patch: Fix the resulting errors.


author: Adam Jackson <ajax@redhat.com> alpha9.8-29
changelog:
  - cdparanoia-III-alpha9.8.scsi-setspeed.patch: Allow setting the speed of
    SCSI CD drives. (#431178)


author: Peter Jones <pjones@redhat.com> alpha9.8-23
changelog:
  - "This time, with a meaningful changelog" release.  Just like -22.
  - new SG_IO code in rawhide.  This means ripping will no longer use the 
    "cooked ioctl" mode that it has since we moved to 2.6, instead utilizing
    the real scsi-based command set to talk to most drives.  This should
    result in better error correction handling, and usage of much more
    commonly used kernel features.
  - environment variable "CDDA_TRANSPORT" added.  If you set this to "cooked",
    cdparanoia will try to use the "cooked ioctl" mode instead of SCSI/SG_IO
    based modes first, and then fall back to SG_IO.
  - It'd be good if this got some testing.  A prior version of the SG_IO code
    was known to fail on some USB drives.  This version should mitigate that
    quite a bit, but I lack the hardware to test it for sure.


author: Peter Jones <pjones@redhat.com> alpha9.8-5
changelog:
  - make a -libs package which contains the .so files
  - make the cdparanoia dependancy towards that, not -devel


author: Trond Eivind Glomsrød <teg@redhat.com>
changelog:
  - Switched spec file from the one used in Red Hat Linux 6.2, which
    also changes the name
  - gzip man page


author: Peter Jones <pjones@redhat.com>
changelog:
  - update package to provide cdparanoia-alpha9.7-2.*.rpm and 
    cdparanoia-devel-alpha9.7-2.*.rpm.  Also, URLs point at xiph.org
    like they should.


author: Peter Jones <pjones@redhat.com>
changelog:
  - updated package for alpha9.7, based on input from:
    Monty <xiphmont@xiph.org> 
    David Philippi <david@torangan.saar.de>


author: Marek Kasik <mkasik@redhat.com> - 0.12.4-3.el6.1
changelog:
  - Add poppler-0.12.4-CVE-2010-3702.patch
      (Properly initialize parser)
  - Add poppler-0.12.4-CVE-2010-3703.patch
      (Properly initialize stack)
  - Add poppler-0.12.4-CVE-2010-3704.patch
      (Fix crash in broken pdf (code < 0))
  - Resolves: #639859


author: Marek Kasik <mkasik@redhat.com> - 0.12.3-4
changelog:
  - Fix text selection
  - Add patch poppler-0.12.3-text-selection.patch by Brian Ewins
  - Add patch poppler-0.12.3-text-selection-tables.patch by Marek Kasik
  - Make Provides/Obsoletes versioned
  - Add requirement of poppler-data
  - Resolves: #557812


author: Marek Kasik <mkasik@redhat.com> - 0.12.3-3
changelog:
  - Correct %changelog
  - Correct permissions of goo/GooTimer.h
  - Convert pdftohtml.1 to utf8
  - Related: #543948


author: Adam Jackson <ajax@redhat.com> 0.8.0-3
changelog:
  - poppler-0.8.0-ocg-crash.patch: Fix a crash when no optional content
    groups are defined.
  - Mangle configure to account for the new directory for qt3 libs.
  - Fix grammar in %description.


author: Adnan Misherfi <adnan.misherfi@oracle.com> - 1.0-69.el6.15
changelog:
  - OVMWATCH now calls vm_event_callout twice once on xm start event, and once on OVMAPI event.
    On xm start it send "DOMAIN UUID START". On OVMAPI it sends "DOMAIN UUID BOOTED". [bug 20087455]


author: Qing Lin <qing.lin@oracle.com> 1.4.2-2.0.1.el6_7.1
changelog:
  - [Orabug: 29909723] Added patch CVE-2019-3862.
    Added Additional length checks to prevent out-of-bounds (CVE-2019-3862)


author: Tim Waugh <twaugh@redhat.com> 2.6-2
changelog:
  - Applied upstream patch to prevent incorrect filename being chosen
    when adding a new file (bug #550319).


author: Tim Waugh <twaugh@redhat.com> 2.6-1
changelog:
  - 2.6.  No longer need stderr, suffix, stripcr, parse, allow-spaces,
    ifdef, program_name, or posix-backup patches.


author: Tim Waugh <twaugh@redhat.com> 2.5.4-35
changelog:
  - Don't fail if setfilecon() returns EPERM (bug #453365), although the
    setfilecon man page suggests that ENOTSUP will be returned in this
    case.


author: Tim Waugh <twaugh@redhat.com> 2.5.4-31
changelog:
  - Convert spec file to UTF-8 (bug #226233).
  - Use _bindir macro in %files (bug #226233).
  - Parallel make (bug #226233).
  - Better defattr declaration (bug #226233).


author: Tim Waugh <twaugh@redhat.com>
changelog:
  - use .orig as default suffix, as per man page and previous behaviour
    (bug #20202).
  - use better patch for this, from maintainer.


author: Alan Cox <alan@redhat.com>
changelog:
  - Fix the case where stderr isnt flushed for ask(). Now the 'no such file'
    appears before the skip patch question, not at the very end, Doh!


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.21.1.el6uek]
changelog:
  - media: imon: Fix null-ptr-deref in imon_probe (Arvind Yadav)  [Orabug: 27208380]  {CVE-2017-16537} 
  - Input: gtco - fix potential out-of-bound access (Dmitry Torokhov)  [Orabug: 27215090]  {CVE-2017-16643} 
  - usb: usbtest: fix NULL pointer dereference (Alan Stern)  [Orabug: 27602324]  {CVE-2017-16532} 
  - x86/spectre_v2: Fix cpu offlining with IPBP. (Konrad Rzeszutek Wilk)   
  - fuse: fix deadlock caused by wrong locking order (Junxiao Bi)  [Orabug: 27760268]  
  - jbd: don't wait (forever) for stale tid caused by wraparound (Jan Kara)  [Orabug: 27842289]  
  - netfilter: ebtables: CONFIG_COMPAT: don't trust userland offsets (Florian Westphal)  [Orabug: 27774015]  {CVE-2018-1068} 
  - RDS: IB: Fix null pointer issue (hui.han)  [Orabug: 27843171]  
  - ext4: add validity checks for bitmap block numbers (Theodore Ts'o)  [Orabug: 27854376]  {CVE-2018-1093} {CVE-2018-1093} 
  - USB: core: prevent malicious bNumInterfaces overflow (Alan Stern)  [Orabug: 27898074]  {CVE-2017-17558} 
  - netfilter: nfnetlink_cthelper: Add missing permission checks (Kevin Cernekee)  [Orabug: 27898167]  {CVE-2017-17448} 
  - KEYS: don't let add_key() update an uninstantiated key (David Howells)  [Orabug: 27913332]  {CVE-2017-15299} 
  - RDS: Heap OOB write in rds_message_alloc_sgs() (Mohamed Ghannam)  [Orabug: 27934073]  {CVE-2018-5332} 
  - x86/entry/64: Dont use IST entry for #BP stack (Andy Lutomirski)   {CVE-2018-8897} 
  - perf/hwbp: Simplify the perf-hwbp code, fix documentation (Linus Torvalds)  [Orabug: 27947608]  {CVE-2018-100199} 
  - x86/microcode: probe CPU features on microcode update (Ankur Arora)  [Orabug: 27806667]  
  - x86/microcode: microcode_write() should not reference boot_cpu_data (Ankur Arora)  [Orabug: 27806667]  
  - x86/cpufeatures: use cpu_data in init_scattered_cpuid_flags() (Ankur Arora)  [Orabug: 27806667]  
  - Drivers: hv: fcopy: set .owner reference for file operations (Joe Jin)  [Orabug: 21191022]  
  - ALSA: usb-audio: Kill stray URB at exiting (Takashi Iwai)  [Orabug: 27148281]  {CVE-2017-16527} 
  - HID: usbhid: fix out-of-bounds bug (Jaejoong Kim)  [Orabug: 27207929]  {CVE-2017-16533} 
  - [media] cx231xx-cards: fix NULL-deref on missing association descriptor (Johan Hovold)  [Orabug: 27208072]  {CVE-2017-16536} 
  - net: cdc_ether: fix divide by 0 on bad descriptors (Bjørn Mork)  [Orabug: 27215201]  {CVE-2017-16649} 
  - x86/microcode/intel: Extend BDW late-loading with a revision check (Jia Zhang)  [Orabug: 27343577]  
  - x86/microcode/intel: Disable late loading on model 79 (Borislav Petkov)  [Orabug: 27343577]  
  - Bluetooth: bnep: bnep_add_connection() should verify that it's dealing with l2cap socket (Al Viro)  [Orabug: 27344793]  {CVE-2017-15868} 
  - Bluetooth: hidp: verify l2cap sockets (David Herrmann)  [Orabug: 27344793]  {CVE-2017-15868} 
  - ALSA: pcm: prevent UAF in snd_pcm_info (Robb Glasser)  [Orabug: 27344843]  {CVE-2017-0861} {CVE-2017-0861} 
  - ptrace: use fsuid, fsgid, effective creds for fs access checks (Jann Horn)  [Orabug: 27364691]  {CVE-2017-14140} 
  - sctp: do not peel off an assoc from one netns to another one (Xin Long)  [Orabug: 27387001]  {CVE-2017-15115} 
  - Revert "x86/spec_ctrl: Add 'nolfence' knob to disable fallback for spectre_v2 mitigation" (Ankur Arora)  [Orabug: 27601787]  {CVE-2017-5715} 
  - Revert "x86/spec: Add 'lfence_enabled' in sysfs" (Ankur Arora)  [Orabug: 27601787]  {CVE-2017-5715} 
  - Revert "x86/mitigation/spectre_v2: Add reporting of 'lfence'" (Ankur Arora)  [Orabug: 27601787]  {CVE-2017-5715} 
  - x86/mitigation/spectre_v2: Add reporting of 'lfence' (Konrad Rzeszutek Wilk)   {CVE-2017-5715} 
  - x86/spec: Add 'lfence_enabled' in sysfs (Konrad Rzeszutek Wilk)   {CVE-2017-5715} 
  - x86/spec_ctrl: Add 'nolfence' knob to disable fallback for spectre_v2 mitigation (Konrad Rzeszutek Wilk)   {CVE-2017-5715} 
  - x86/spectre: bring spec_ctrl management logic closer to UEK4 (Ankur Arora)  [Orabug: 27516512]  {CVE-2017-5715} 
  - x86/cpufeatures: Clean up Spectre v2 related CPUID flags (David Woodhouse)  [Orabug: 27516357]  {CVE-2017-5715} 
  - x86/spectre_v2: Remove 0xc2 from spectre_bad_microcodes (Darren Kenny)  [Orabug: 27516419]  {CVE-2017-5715} 
  - x86/cpufeature: Blacklist SPEC_CTRL/PRED_CMD on early Spectre v2 microcodes (David Woodhouse)  [Orabug: 27516419]  {CVE-2017-5715} 
  - x86: intel-family.h: Add GEMINI_LAKE SOC (Len Brown)  [Orabug: 27516419]  
  - x86/cpu/intel: Introduce macros for Intel family numbers (Dave Hansen)  [Orabug: 27516419]  
  - x86/spectre: expose 'stibp' (Konrad Rzeszutek Wilk)  [Orabug: 27516419]  {CVE-2017-5715} 
  - x86/speculation: Add basic IBPB (Indirect Branch Prediction Barrier) support (David Woodhouse)  [Orabug: 27516379]  {CVE-2017-5715} 
  - x86/speculation: Use Indirect Branch Prediction Barrier in context switch (Tim Chen)  [Orabug: 27516379]  {CVE-2017-5715} 
  - x86/spectre: fix spectre_v1 mitigation indicators (Ankur Arora)  [Orabug: 27509932]  {CVE-2017-5715} 
  - x86/ia32/syscall: Clear extended registers %r8-%r15 (Ankur Arora)  [Orabug: 27452028]  {CVE-2017-5715} 
  - x86/ia32/syscall: Save full stack frame throughout the entry code (Ankur Arora)  [Orabug: 27452028]  {CVE-2017-5715} 
  - x86/ia32/syscall: cleanup trailing whitespace (Ankur Arora)  [Orabug: 27452028]  {CVE-2017-5715} 
  - x86/syscall: Clear callee saved registers (%r12-%r15, %rbp, %rbx) (Ankur Arora)  [Orabug: 27452028]  {CVE-2017-5715} 
  - x86/syscall: Save callee saved registers on syscall entrance (Ankur Arora)  [Orabug: 27452028]  {CVE-2017-5715} 
  - gre: fix a possible skb leak (Eric Dumazet)  [Orabug: 26403972]  {CVE-2017-9074} 
  - ipv6: Fix leak in ipv6_gso_segment(). (David S. Miller)  [Orabug: 26403972]  {CVE-2017-9074} 
  - ipv6: xfrm: Handle errors reported by xfrm6_find_1stfragopt() (Ben Hutchings)  [Orabug: 26403972]  {CVE-2017-9074} 
  - ipv6: Check ip6_find_1stfragopt() return value properly. (David S. Miller)  [Orabug: 26403972]  {CVE-2017-9074} 
  - ipv6: Prevent overrun when parsing v6 header options (Craig Gallek)  [Orabug: 26403972]  {CVE-2017-9074} 
  - tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0 (Wei Wang)  [Orabug: 26813390]  {CVE-2017-14106} 
  - rxrpc: Fix several cases where a padded len isn't checked in ticket decode (David Howells)  [Orabug: 26880517]  {CVE-2017-7482} {CVE-2017-7482} 
  - xen/mmu: Call xen_cleanhighmap() with 4MB aligned for page tables mapping (Zhenzhong Duan)  [Orabug: 26883322]  
  - KVM: x86: fix deadlock in clock-in-progress request handling (Marcelo Tosatti)  [Orabug: 27065995]  
  - ocfs2: fstrim: Fix start offset of first cluster group during fstrim (Ashish Samant)  [Orabug: 27099835]  
  - USB: serial: console: fix use-after-free after failed setup (Johan Hovold)  [Orabug: 27206837]  {CVE-2017-16525} 
  - uwb: properly check kthread_run return value (Andrey Konovalov)  [Orabug: 27206897]  {CVE-2017-16526} 
  - ALSA: usb-audio: Check out-of-bounds access by corrupted buffer descriptor (Takashi Iwai)  [Orabug: 27206928]  {CVE-2017-16529} 
  - USB: fix out-of-bounds in usb_set_configuration (Greg Kroah-Hartman)  [Orabug: 27207240]  {CVE-2017-16531} 
  - USB: core: fix out-of-bounds access bug in usb_get_bos_descriptor() (Alan Stern)  [Orabug: 27207983]  {CVE-2017-16535} 
  - dccp: CVE-2017-8824: use-after-free in DCCP code (Mohamed Ghannam)  [Orabug: 27290301]  {CVE-2017-8824} 
  - x86: Add another set of MSR accessor functions (Borislav Petkov)  [Orabug: 27444923]  {CVE-2017-5753} 
  - userns: prevent speculative execution (Elena Reshetova)  [Orabug: 27444923]  {CVE-2017-5753} 
  - udf: prevent speculative execution (Elena Reshetova)  [Orabug: 27444923]  {CVE-2017-5753} 
  - fs: prevent speculative execution (Elena Reshetova)  [Orabug: 27444923]  {CVE-2017-5753} 
  - qla2xxx: prevent speculative execution (Elena Reshetova)  [Orabug: 27444923]  {CVE-2017-5753} 
  - p54: prevent speculative execution (Elena Reshetova)  [Orabug: 27444923]  {CVE-2017-5753} 
  - carl9170: prevent speculative execution (Elena Reshetova)  [Orabug: 27444923]  {CVE-2017-5753} 
  - uvcvideo: prevent speculative execution (Elena Reshetova)  [Orabug: 27444923]  {CVE-2017-5753} 
  - locking/barriers: introduce new observable speculation barrier (Elena Reshetova)  [Orabug: 27444923]  {CVE-2017-5753} 
  - x86/cpu/AMD: Remove now unused definition of MFENCE_RDTSC feature (Elena Reshetova)  [Orabug: 27444923]  {CVE-2017-5753} 
  - x86/cpu/AMD: Make the LFENCE instruction serialized (Elena Reshetova)  [Orabug: 27444923]  {CVE-2017-5753} 
  - x86/rsb: add comment specifying why we skip STUFF_RSB (Ankur Arora)  [Orabug: 27451658]  {CVE-2017-5715} 
  - x86/rsb: make STUFF_RSB jmp labels more robust (Ankur Arora)  [Orabug: 27451658]  {CVE-2017-5715} 
  - x86/spec: Also print IBRS if IBPB is disabled. (Konrad Rzeszutek Wilk)   {CVE-2017-5715} 
  - x86/spectre: Drop the warning about ibrs being obsolete. (Konrad Rzeszutek Wilk)   {CVE-2017-5715} 
  - Add set_ibrs_disabled and set_ibpb_disabled (Konrad Rzeszutek Wilk)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/spec: Don't print the Missing arguments for option spectre_v2 (Konrad Rzeszutek Wilk)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/boot: Add early cmdline parsing for options with arguments (Tom Lendacky)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86, boot: Carve out early cmdline parsing function (Borislav Petkov)  [Orabug: 27376697]  
  - x86: Add command-line options 'spectre_v2' and 'nospectre_v2' (Kanth Ghatraju)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86: Fix kABI build breakage (Konrad Rzeszutek Wilk)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/mm: Only set IBPB when the new thread cannot ptrace current thread (Konrad Rzeszutek Wilk)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86: Use PRED_CMD MSR when ibpb is enabled (Konrad Rzeszutek Wilk)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/mm: Set IBPB upon context switch (Brian Maly)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86: Display correct settings for the SPECTRE_V[12] bug (Kanth Ghatraju)  [Orabug: 27376697]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86/cpu: Implement CPU vulnerabilites sysfs functions (Thomas Gleixner)  [Orabug: 27376697]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86/IBRS/IBPB: Set sysctl_ibrs/ibpb_enabled properly (Boris Ostrovsky)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/spec_ctrl: Disable if running as Xen PV guest (Konrad Rzeszutek Wilk)  [Orabug: 27376697]  {CVE-2017-5715} 
  - sysfs/cpu: Add vulnerability folder (Thomas Gleixner)  [Orabug: 27376697]  {CVE-2017-5715} {CVE-2017-5754} 
  - x86, cpu: Expand cpufeature facility to include cpu bugs (Borislav Petkov)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/cpufeatures: Add X86_BUG_SPECTRE_V[12] (Kanth Ghatraju)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/cpufeatures: Add X86_BUG_CPU_MELTDOWN (Kanth Ghatraju)  [Orabug: 27376697]  {CVE-2017-5754} 
  - x86/entry: STUFF_RSB only after switching to kernel CR3 (Ankur Arora)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/entry: Stuff RSB for entry to kernel for non-SMEP platform (Tim Chen)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/IBRS: Make sure we restore MSR_IA32_SPEC_CTRL to a valid value (Boris Ostrovsky)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86: Use IBRS for firmware update path (David Woodhouse)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/microcode: Recheck IBRS features on microcode reload (Tim Chen)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/idle: Disable IBRS entering idle and enable it on wakeup (Tim Chen)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/spec_ctrl: Add sysctl knobs to enable/disable SPEC_CTRL feature (Tim Chen)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/enter: Use IBRS on syscall and interrupts (Tim Chen)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/enter: MACROS to set/clear IBRS (Tim Chen)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/feature: Detect the x86 IBRS feature to control Speculation (Tim Chen)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/pti/efi: broken conversion from efi to kernel page table (Pavel Tatashin)  [Orabug: 27333764]  {CVE-2017-5754} 
  - PTI: unbreak EFI old_memmap (Jiri Kosina)  [Orabug: 27333764] [Orabug: 27333760]  {CVE-2017-5754} {CVE-2017-5754} 
  - kaiser: Set _PAGE_NX only if supported (Lepton Wu)  [Orabug: 27333764]  {CVE-2017-5754} 
  - kaiser: rename X86_FEATURE_KAISER to X86_FEATURE_PTI (Mike Kravetz)  [Orabug: 27333764]  {CVE-2017-5754} 
  - KPTI: Rename to PAGE_TABLE_ISOLATION (Kees Cook)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/kaiser: Check boottime cmdline params (Mike Kravetz)  [Orabug: 27333764]  {CVE-2017-5754} 
  - kaiser: x86: Fix NMI handling (Jiri Kosina)  [Orabug: 27333764]  {CVE-2017-5754} 
  - kaiser: move paravirt clock vsyscall mapping out of kaiser_init (Mike Kravetz)  [Orabug: 27333764]  {CVE-2017-5754} 
  - kaiser: disable if xen PARAVIRT (Mike Kravetz)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/kaiser: Reenable PARAVIRT (Borislav Petkov)  [Orabug: 27333764]  {CVE-2017-5754} 
  - kaiser: kaiser_flush_tlb_on_return_to_user() check PCID (Hugh Dickins)  [Orabug: 27333764]  {CVE-2017-5754} 
  - kaiser: asm/tlbflush.h handle noPGE at lower level (Hugh Dickins)  [Orabug: 27333764]  {CVE-2017-5754} 
  - kaiser: use ALTERNATIVE instead of x86_cr3_pcid_noflush (Hugh Dickins)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/kaiser: Rename and simplify X86_FEATURE_KAISER handling (Borislav Petkov)  [Orabug: 27333764]  {CVE-2017-5754} 
  - kaiser: add "nokaiser" boot option, using ALTERNATIVE (Hugh Dickins)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/alternatives: add asm ALTERNATIVE macro (Mike Kravetz)  [Orabug: 27333764]  {CVE-2017-5754} 
  - kaiser: alloc_ldt_struct() use get_zeroed_page() (Hugh Dickins)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86: kvmclock: Disable use from vDSO if KPTI is enabled (Ben Hutchings)  [Orabug: 27333764]  {CVE-2017-5754} 
  - kaiser: Fix build with CONFIG_FUNCTION_GRAPH_TRACER (Kees Cook)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm/kaiser: re-enable vsyscalls (Andrea Arcangeli)  [Orabug: 27333764]  {CVE-2017-5754} 
  - KAISER: Kernel Address Isolation (Richard Fellner)  [Orabug: 27333764]  {CVE-2017-5754} 
  - kprobes: Prohibit probing on .entry.text code (Masami Hiramatsu)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm/64: Fix reboot interaction with CR4.PCIDE (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm: Enable CR4.PCIDE on supported systems (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm: Add the 'nopcid' boot option to turn off PCID (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm: Disable PCID on 32-bit kernels (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm: Remove the UP asm/tlbflush.h code, always use the (formerly) SMP code (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm: Fix flush_tlb_page() on Xen (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm: Disable preemption during CR3 read+write (Sebastian Andrzej Siewior)  [Orabug: 27333764]  {CVE-2017-5754} 
  - sched/core: Idle_task_exit() shouldn't use switch_mm_irqs_off() (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm, sched/core: Turn off IRQs in switch_mm() (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm, sched/core: Uninline switch_mm() (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm: Build arch/x86/mm/tlb.c even on !SMP (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - sched/core: Add switch_mm_irqs_off() and use it in the scheduler (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - mm/mmu_context, sched/core: Fix mmu_context.h assumption (Ingo Molnar)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm: If INVPCID is available, use it to flush global mappings (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm: Add a 'noinvpcid' boot option to turn off INVPCID (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm: Fix INVPCID asm constraint (Borislav Petkov)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm: Add INVPCID helpers (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86: Clean up cr4 manipulation (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/paravirt: Dont patch flush_tlb_single (Thomas Gleixner)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/ldt: Make modify_ldt synchronous (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} {CVE-2015-5157}


author: Karsten Hopp <karsten@redhat.com> 1.7-29
changelog:
  - remove trailing dot from summary
  - replace tabs with spaces
  - replace PreReq with Requires(post)/Requires(preun)
  - include license file in %doc
  - add smp flags
  - use make install DESTDIR=


author: Elliot Lee <sopwith@redhat.com>
changelog:
  - Remove HAVE_WAIT3 hack, tried to replace it with a requirement for an 
  autoconf with the fixed test, didn't work, put in another less-bad hack 
  instead.


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.9.1-9.100.2
changelog:
  - Solaris build and package support
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>


author: Srinivas Maturi <srinivas.maturi@oracle.com> 147-2.51.0.1
changelog:
  - Add multi-volume btrfs detection. (John Haxby) [orabug 13443447]
  - use oom_score_adj() in place of deprecated oom_adj() (Chuck Anderson) [orabug 13712009]


author: Ondrej Vasik <ovasik@redhat.com> - 3.4-7
changelog:
  - Merge review #226235: do ship doc files,
    do comment patches, use better buildroot and
    defaults for attributes, allow parallel builds


author: Radek Brich <rbrich@redhat.com> - 3.4-2
changelog:
  - applied patch for #239000 (pax fails creation of ustar
    if an absolute name is exactly 100 characters long)


author: Matt Wilson <msw@redhat.com>
changelog:
  - pull PAX source tarball from the SuSE package (which is based off
    this one yet claims copyright on the spec file)


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.20-2
changelog:
  - Fixed invalid UTF-8 byte sequence error in PCRE mode
    (by pcre-backported-fixes patch)
    Resolves: rhbz#1193030
  - Fixed buffer overrun for grep -F
    Resolves: CVE-2015-1345
  - Fixed bogus date in the changelog


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.20-1
changelog:
  - New version
    Resolves: rhbz#1064668
    Resolves: rhbz#982215
    Resolves: rhbz#1126757
    Resolves: rhbz#1167766
    Resolves: rhbz#1171806
  - Fixed \w and \W behaviour in multibyte locales
    Resolves: rhbz#799863
  - Documented --fixed-regexp option
    Resolves: rhbz#1103270


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.6.3-4
changelog:
  - Fixed crash on grep -Fif /dev/null (fif-null-fix patch)
    Resolves: rhbz#797934
  - Fixed heap overrun on specific REs (dfa-heap-overrun-fix patch)
    Resolves: rhbz#715295
  - Fixed -i (case insensitive matching)
    Resolves: rhbz#826997


author: Caolan McNamara <caolanm@redhat.com> - 4.2.1-9
changelog:
  - Resolves: rhbz#596171 drop icu.icu6284.strictalias.patch and use
    -fno-strict-aliasig as upstream has added a pile more and doesn't look
    interested in proposed patchs


author: Caolan McNamara <caolanm@redhat.com> - 4.2-0.1.d03
changelog:
  - 4.2 release candidate
  - drop resolved icu.icu6008.arm.padding.patch
  - drop resolved icu.icu6439.bare.elif.patch


author: Caolan McNamara <caolanm@redhat.com> - 4.0-2
changelog:
  - Resolves: rhbz#459698 drop Malayalam patches. Note test with Rachana/Meera
    instead of Lohit Malayalam before filing bugs against icu wrt.
    Malayalam rendering


author: Caolan McNamara <caolanm@redhat.com> - 3.8.1-5
changelog:
  - Resolves: rhbz#431401 split syllables on 1st 0d4d of a 0d4d + 
    (>= 0d15 && <= 0d39) + 0d4d + 0d30 sequence


author: Caolan McNamara <caolanm@redhat.com> - 3.8.1-3
changelog:
  - CVE-2007-4770 CVE-2007-4771 add icu.regexp.patch
  - Resolves: rhbz#423211 fix malalayam stuff in light of syllable
    changes


author: Caolan McNamara <caolanm@redhat.com> - 3.8.1-2
changelog:
  - remove icu.icu5365.dependantvowels.patch and cleanup
    icu.icu5506.multiplevowels.patch as they patch and unpatch 
    eachother (thanks George Rhoten for pointing out that madness)


author: Caolan McNamara <caolanm@redhat.com> - 3.8-0.1.d01
changelog:
  - 3.8 release candidate
  - drop integrated icu.icu5433.oriya.patch
  - drop integrated icu.icu5488.assamese.patch
  - drop integrated icu.icu5500.devicetablecrash.patch
  - drop integrated icu.icu5501.sinhala.biggerexpand.patch
  - drop integrated icu.icu5594.gujarati.patch
  - drop integrated icu.icu5465.telegu.patch


author: Caolan McNamara <caolanm@redhat.com> - 3.6-20
changelog:
  - Resolves: rhbz#243984 change the icu group as it is libicu 
    which is "System Environment/Libraries" not icu


author: Caolan McNamara <caolanm@redhat.com> - 3.6-5
changelog:
  - rh#208705# add pkg-config Require for -devel package
  - add icu.icu5431.malayam.patch for rh#208551#/rh#209084#
  - add icu.icu5433.oriya.patch for rh#208559#/rh#209083#


author: Caolan McNamara <caolanm@redhat.com> - 3.6-2
changelog:
  - fix rh#205252#/icu#5365 (gnome#121882#/#icu#4026#) to make icu 
    like pango for multiple dependant vowels


author: Caolan McNamara <caolanm@redhat.com> - 3.6-0.1.d01
changelog:
  - rh#200728# update to prelease 3.6d01 to pick up on sinhala fixes
  - drop integrated rh190879.patch
  - drop integrated icu-3.4-sinhala1.patch


author: Ville Skyttä <ville.skytta at iki.fi> - 3.2-3
changelog:
  - Apply upstream case mapping mutex lock removal patch.
  - Build with gcc 3.2 as a temporary workaround for #152495.


author: Ville Skyttä <ville.skytta at iki.fi> - 0:3.0-0.fdr.1
changelog:
  - Update to 3.0, datadirs patch no longer needed.
  - Package data in shared libs, drop -locales subpackage.
  - Rename -docs subpackage to libicu-doc, and generate graphs with graphviz.


author: Ville Skyttä <ville.skytta at iki.fi> - 0:2.6.1-0.fdr.3
changelog:
  - Partial fix for bad datadirs returned by icu-config (works as long as
    data packaging mode is not "common" or "dll").


author: Karsten Hopp <karsten@redhat.com> 7.2.411-1.7
changelog:
  - fix syntax highlighting of httpd config files (663753)
  - fix vimexplorer directory listings, i.e. vim .. (652610)
  - don't print an additional 'e' in zh_CN.gbk vimexplorer (594997)
  - fix macro usage in specfile template (634902)


author: Karsten Hopp <karsten@redhat.com> 7.2.411-1.1
changelog:
  - augroup "fedora" in /etc/vimrc renamed to "redhat"
  - Resolves: #578785
  - fix vim.csh  'tcsh -e' scripts
  - Resolves: #578795


author: Karsten Hopp <karsten@redhat.com> 7.2.025-1
changelog:
  - patchlevel 25
  - add Categories tag to desktop file (#226526)
  - add requirement on hicolor-icon-theme to vim-X11 (#226526)
  - drop Amiga info files (#226526)
  - remove non-utf8 man pages (#226526)
  - drop Application from categories (#226526)


author: Chuck Anderson <chuck.anderson@oracle.com> - 3.2.23.0-1.0.1
changelog:
  - update to 3.2.23.0 (Oracle version 3.2.23.0-1.0.1 due to file renaming for spec file requirements (Sudarsana Kalluru) [Orabug: 18552423]


author: Karsten Hopp <karsten@redhat.de> 1.10-24
changelog:
  - added development manpages
  - as there are no manpages for the executables available, added at least
    a FAQ (#172324)


author: Mike A. Harris <mharris@redhat.com> 1.10-13
changelog:
  - Removed %name macro sillyness from package Summary, description text, etc.
  - Removed archaic Prefix: tag
  - lib64 fixes everywhere to use _lib, _libdir, etc
  - Removed deletion of RPM_BUILD_DIR from %clean section
  - Added -q flag to setup macro
  - Severely cleaned up spec file, and removed usage of perl


author: Jakub Jelinek <jakub@redhat.com> 1.10-12
changelog:
  - CFLAGS was using COPTFLAG variable, not COPTFLAGS
  - build with -fpic
  - apply the IA-64 patch everywhere, use capget/capset from glibc,
    not directly as _syscall (as it is broken on IA-32 with -fpic)
  - reenable alpha


author: Bernhard Rosenkraenzer <bero@redhat.com> 1.10-6
changelog:
  - Fix sys/capabilities.h header (#55727)
  - Move to /lib, some applications seem to be using this rather early
    (#55733)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-52
changelog:
  - Fixed snmptrapd crash when '-OQ' parameter is used and invalid trap is
    received (#CVE-2014-3565)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-51
changelog:
  - added faster caching into IP-MIB::ipNetToMediaTable (#789500)
  - fixed compilation with "-Werror=format-security" (#1181994)
  - added clear error message when port specified in 'clientaddrr' config
    option cannot be bound (#886468)
  - fixed error check in IP-MIB::ipAddressTable (#1012430)
  - fixed agentx client crash on failed response (#1023570)
  - fixed dashes in net-snmp-config.h (#1034441)
  - fixed crash on monitor trigger (#1050970)
  - fixed 'netsnmp_assert 1 == new_val->high failed' message in system log
    (#1065210)
  - fixed parsing of 64bit counters from SMUX subagents (#1069046)
  - Fixed HOST-RESOURCES-MIB::hrProcessorTable on machines with >100 CPUs
    (#1070075)
  - fixed net-snmp-create-v3-user to have the same content on 32 and 64bit
    installations (#1073544)
  - fixed IPADDRESS value length in Python bindings (#1100099)
  - fixed hrStorageTable to contain 31 bits integers (#1104293)
  - fixed links to developer man pages (#1119567)
  - fixed storageUseNFS functionality in hrStorageTable (#1125793)
  - fixed netsnmp_set Python bindings call truncating at the first '\000'
    character (#1126914)
  - fixed log level of SMUX messages (#1140234)
  - use python/README to net-snmp-python subpackage (#1157373)
  - fixed forwarding of traps with RequestID=0 in snmptrapd (#1146948)
  - fixed typos in NET-SNMP-PASS-MIB and SMUX-MIB (#1162040)
  - fixed close() overhead of extend commands (#1188295)
  - fixed lmSensorsTable not reporting sensors with duplicate names (#967871)
  - fixed hrDeviceTable with interfaces with large ifIndex (#1195547)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-50
changelog:
  - added 'diskio' option to snmpd.conf, it's possible to monitor only selected
    devices in diskIOTable (#990674)
  - fixed CVE-2014-2284: denial of service flaw in Linux implementation of
    ICMP-MIB (#1073223)
  - added cache to hrSWRunTable to provide consistent results (#1007634)
  - skip 'mvfs' (ClearCase) when skipNFSInHostResources is enabled (#1073237)
  - fixed snmptrapd crashing on forwarding SNMPv3 traps (#1131844)
  - fixed HOST-RESOURCES-MIB::hrSystemProcesses (#1134335)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-49
changelog:
  - fixed snmp daemons and utilities crashing in FIPS mode (#1001830)
  - added support of btrfs filesystem in hrStorageTable (#1006706)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-46
changelog:
  - fixed parsing of bulk responses (#983116)
  - added support of vzfs filesystem in hrStorageTable (#989498)
  - fixed endless loop when parsing sendmail configuration file with
    queue groups (#991213)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-45
changelog:
  - fixed potential memory leak on realloc failure when processing 'extend'
    option (#893119)
  - added precise enumeration of configuration files searched to
    snmp_config(5) man page (#907571)
  - set permissions of snmpd.conf and snmptrapd conf to 0600 (#919239)
  - fixed kernel threads in hrSWRunTable (#919952)
  - fixed various error codes in Python module (#955771)
  - fixed snmpd crashing in the middle of agentx request processing when
    a subagent disconnects (#955511)
  - allow 'includeFile' and 'includeDir' options in configuration files
    (#917816)
  - fixed netlink message size (#927474)
  - fixed IF-MIB::ifSpeedHi on systems with non-standard interface speeds
    (#947973)
  - fixed BRIDGE-MIB::dot1dBasePortTable not to include the bridge itself
    as a port (#960568)
  - fixed snmpd segfault when 'agentaddress' configuration options is used
    and too many SIGHUP signals are received (#968898)
  - updated UCD-SNMP-MIB::dskTable to dynamically add/remove disks
    if 'includeAllDisks' is specified in snmpd.conf (#922691)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-43
changelog:
  - fixed value of UCD-SNMP-MIB::extCommand to contain full command
    line (#842279)
  - fixed rpath to perl.so (#848319)
  - added support for port numbers in 'clientaddr' configuration
    option (#833013)
  - fixed rare snmptrapd crash on SIGHTERM handling when embedded perl
    is used (#824402)
  - fixed engineID of outgoing traps if 'trapsess -e <engineID>' is used in
    snmpd.conf (#800671)
  - updated documentation of '-c' option of snmptrapd (#784502)
  - fixed endless loop when SIGTEM arrives in middle of internal query
    processing (#851637)
  - fixed UCD-DISKIO-MIB::diskIOLA values (#848155)
  - removed various error log messages related to counte64 expansions
    (#846906)
  - removed various error log messages when IPv6 is disabled (#845157)
  - added support of cvfs filesystem in hrStorageTable (#846532)
  - fixed rare race condintion when populating UCD-SNMP-MIB::prTable,
    which could result in some entries missing in the table (#846436)
  - added support of simfs filesystem in hrStorageTable (#861152)
  - fixed responding to requests on a multihost machine (#825889)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-38
changelog:
  - fixed snmpd crashing with many AgentX subagent (#749227)
  - fixed SNMPv2-MIB::sysObjectID value when "sysObjectID" config file
    option with long OID was used (#786931)
  - fixed value of BRIDGE-MIB::dot1dBasePortIfIndex.1 (#740172)
  - fixed parsing of "proxy" snmpd.conf option not to enable
    verbose logging by default (#746903)
  - added new "realStorageUnits" config file option to support
    disks > 16 TB in hrStorageTable (#741789)
  - added vxfs, reiserfs and ocfs2 filesystem support to hrStorageTable
    (#746903)
  - fixed snmpd sigsegv when embedded perl script registers one handler
    twice (#748907)
  - fixed setting of SNMP-TARGET-MIB::snmpTargetAddrRowStatus via
    SNMP-SET request on 64-bit platforms (#754275)
  - fixed crash when /var/lib/net-snmp/mib_indexes/ files have wrong
    SELinux context (#754971)
  - fixed memory leak when agentx subagent disconnects in the middle
    of request processing (#736580)
  - fixed slow (re-)loads of TCP-MIB::tcpConnectionTable (#789909)
  - removed 'error finding row index in _ifXTable_container_row_restore'
    error message (#788954)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-32
changelog:
  - fixed varbind parsing in python netsnmp module (#711481)
  - fixed session initialization in python netsnmp module (#710667)
  - fixed crash when getting out-of-memory in inetNetToMediaTable (#708947)
  - added xfs and jfs filesystem support to hrStorageTable (#707912)
  - fixed snmpd to purge zombies resulted from pass_persist process exit
    (#703682)
  - added a log message when snmpd detects two interfaces with the same
    IP address and thus having only one ipTable entry for both (#702171)
  - added new snmpd.conf options 'interface_fadeout' and
    'interface_replace_old' to controll snmpd behavior when more
    interfaces get the same name (#702165)
  - fixed snmptrapd leaking memory when processing traps in embedded perl
    (#678314)
  - fixed hrSystemDate timezone sign (#683680)
  - fixed snmp logging 'truncating integer value > 32 bits' for
    UCD-SNMP-MIB::systemStats (#681949)
  - fixed rare race condition in hrSWRunTable (#683563)
  - recompiled with relro for better security (#725657)
  - snmpd should not change request-id when sending multiple SMUX messages
    (#708370)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-31
changelog:
  - fixed BRIDGE-MIB implementation in /usr/bin/snmp-bridge-mib,
    now it supports embedded perl and answers GETNEXT requests correctly
    (#630157).


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-28
changelog:
  - fixed recompilation of the package on machine without IPv6 (#657835)
  - fixed SMUX getting stuck on big-endian platforms (#665053)
  - fixed OID comparsion in snmpwalk, now the output does not include
    objects outside requested subtree (#636890)
  - fixed IPv4 address creation in ipAddressTable (#616764)
  - added IPv6 address creation to ipAddressTable (#616336)
  - fixed value of ipAddressPrefixAutonomousFlag OID (#625262)
  - fixed ipv6IfTable - new interfaces were not added there (#627564)
  - extended BRIDGE-MIB implementation to cover RFC 4363 (#630157)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-27.1
changelog:
  - fixed truncation of sysObjectID (#641113)
  - fixed assertions in calculating of statistics in IF-MIB (#621664)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-23
changelog:
  - fixed segfault when parsing snmpd.conf with disman entries (#607080)
  - fixed value of IP-MIB::ipv6InterfaceForwarding (#607074)
  - fixed output of snmptranslate tool when displaying ranges of UNSIGNED
    type (#606874)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-22
changelog:
  - fixed value of ipIfStatsTable.Ip6ReasmReqds (#597265)
  - added missing include files from util_funcs directory (#604636)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-21
changelog:
  - fixed hrFSTable and hrStorageTable to provide persistent table indexes
    according to RFS 2790 (#595325)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-19
changelog:
  - fixed exit code of snmp utilities when wrong argument to '-A' option
    is specified (#574061)
  - fixed BER parsing of incoming packets - siletnly discard the invalid ones
    according to RFC (#568651)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-15
changelog:
  - remove net-snmp-gui subpackage, perl-Tk is being removed from
    distro (#568786)
  - fix IF-MIB::ifSpeed of inactive interfaces (#561884)
  - correct the package license


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-14
changelog:
  - store temporary files in /var/run/net-snmp instead of /tmp (SELinux does
    not allow writing /tmp) (#560081)
  - fix filedescriptor leak in RMON-MIB and Etherlike-MIB (#562108)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-7
changelog:
  - fix invalid access to memory in tcpListenerTable (#551030)
  - fix crash with interfaces without broadcast addresses (like OpenVPN's tun0)
    (#549390)
  - fix responding to broadcast SNMP requests (#549390)
  - port patches from RHEL-5 to avoid regressions


author: Jan Safranek <jsafrane@redhat.com> 1:5.5-4
changelog:
  - fix udpTable indexes on big-endian systems (#543352)
  - fix snmptrapd init script to survive with empty /etc/sysconfig/snmptrapd
  - lower the default log level of snmpd to get rid of the debug messages


author: Jan Safranek <jsafrane@redhat.com> 1:5.5-3
changelog:
  - prepare the .spec file for review
  - run automatic regression suite after the compilation of the package
    to check for obvious regressions
  - remove unnecessary package dependencies


author: Jan Safranek <jsafrane@redhat.com> 1:5.5-2
changelog:
  - introduce /etc/sysconfig/snmptrapd. Use it to specify snmptrapd command
    line options.  /etc/snmp/snmptrapd.options is not used anymore (#540799)
  - build-in ipAddressPrefixTable, ipDefaultRouterTable, ipv6ScopeZoneIndexTable,
    ipIfStatsTable, SCTP-MIB, RMON-MIB and Etherlike-MIBs
  - remove ucd5820stat helper script, it depends on get5820stats, which is not
    available in Fedora
  - move sample services ipf-mod.pl to documentation
  - remove logrotate config, snmpd logs into syslog


author: Jan Safranek <jsafranek@redhat.com> 5.4.2.1-13
changelog:
  - package cleanup, remove unnecessary patches
  - move local state file from /var/net-snmp/ to /var/lib/net-snmp


author: Jan Safranek <jsafranek@redhat.com> 5.4.2.1-12
changelog:
  - make the default configuration less noisy, i.e. do not print "Connection from
    UDP:" and "Received SNMP packet(s) from UDP:" messages on each connection.
    (#509055)


author: Jan Safranek <jsafranek@redhat.com> 5.4.2.1-1
changelog:
  - explicitly require the right version and release of net-snmp and
    net-snmp-libs
  - update to net-snmp-5.4.2.1 to fix CVE-2008-4309


author: Jan Safranek <jsafranek@redhat.com> 5.4.2-2
changelog:
  - redistribute the perl scripts to the net-snmp package,
    net-snmp-utils doesn't depend on perl now (#462484)


author: Jan Safranek <jsafranek@redhat.com> 5.4.1-15
changelog:
  - explicitly require lm_sensor > 3 for build (#442718)
  - create multilib net-snmp-config on multilib architectures only


author: Jan Safranek <jsafranek@redhat.com> 5.4.1-9
changelog:
  - introduce /etc/sysconfig/snmpd. Use it to specify snmpd command line options.
    /etc/snmp/snmpd.options is not used anymore (#431391)


author: Jan Safranek <jsafranek@redhat.com> 5.4.1-6
changelog:
  - add support of lm_sensors v3
  - added procps to build dependencies (#380321)
  - removed beecrypt from dependencies
  - fixed crash on reading xen interfaces (#386611)


author: Jan Safranek <jsafranek@redhat.com> 5.4.1-5
changelog:
  - move mib2c-update from net-snmp-utils to net-snmp-perl, where
    mib2c is located
  - add tkmib to net-snmp-gui package (#167933)


author: Jan Safranek <jsafranek@redhat.com> 5.4.1-3
changelog:
  - include these tables: ip-mib/ipv4InterfaceTable
    ip-mib/ipv6InterfaceTable, ip-mib/ipAddressPrefixTable
  - fix Requires of net-snmp-devel to include lmsensors-devel on supported
    architectures


author: Jan Safranek <jsafranek@redhat.com> 5.4-16
changelog:
  - supported lm_sensors on ppc64 (#249255)
  - snmpconf generates config files with proper selinux context
    (#247462)
  - fix leak  in udp transport (#247771)
  - add alpha to supported archs in net-snmp-config (#246825)
  - fix hrSWInst (#250237)


author: Jan Safranek <jsafranek@redhat.com> 5.4-14
changelog:
  - fix snmptrapd hostname logging (#238587)
  - fix udpEndpointProcess remote IP address (#236551)
  - fix -M option of net-snmp-utils (#244784)
  - default snmptrapd.conf added (#243536)
  - fix crash when multiple exec statements have the same name
    (#243536)
  - fix ugly error message when more interfaces share
    one IP address (#209861)


author: Radek Vokál <rvokal@redhat.com> - 1:5.4-13
changelog:
  - fix overly verbose log message (#221911)
  - few minor tweaks for review - still not perfect
  - fix linking with lcrypto (#231805)


author: Radek Vokal <rvokal@redhat.com> 5.3.1.0-5
changelog:
  - SMUX support is still needed .. will disappear later!
  - static libs should be in devel not libs (#203571)
  - fix lm_sensors issues


author: Radek Vokal <rvokal@redhat.com> 5.3.1.pre2-1
changelog:
  - update to 5.3.1.pre2
  - fix multilib issues (#192736)
    On system with /usr/lib64 use net-snmp-config64 and net-snmp-config64.h


author: Radek Vokál <rvokal@redhat.com> 5.3-7
changelog:
  - fix parsing of /proc/diskstats
  - fix disman monitor crash
  - fix perl vendor name
  - fix OID lookup fail


author: Radek Vokal <rvokal@redhat.com> 5.3-2
changelog:
  -  Security fix. Bug granting write access to read-only users 
     or communities which were configured  using the "rocommunity" 
     or "rouser" snmpd.conf tokens fixed


author: Radek Vokal <rvokal@redhat.com> - 5.2.2-4
changelog:
  - check for header files in configure
  - patch for SNMPv3 traps / session user creation (net-snmp bz#1374087)


author: Radek Vokal <rvokal@redhat.com> - 5.2.2-0.rc6.1
changelog:
  - update to rc6, snmpnetstat changes due to license problems
  - persistent files in directory defined by snmp.conf persistentDir are 
    loaded at startup


author: Radek Vokal <rvokal@redhat.com> - 5.2.1-12
changelog:
  - session free fixed, agentx modules build fine (#157851)
  - fixed dependency for net-snmp libs (#156932)


author: Radek Vokal <rvokal@redhat.com> - 5.2.1-5
changelog:
  - 64bit needed some changes, was causing timeouts on 64bit archs!? 
  - affects bugs #125432 and #132058


author: Radek Vokal <rvokal@redhat.com> - 5.1.2-3
changelog:
  - patch from CVS - kill extra carriage return (#144917)
  - removed patch for interface indexing - doesn't show virtual interfaces


author: Radek Vokal <rvokal@redhat.com> 5.1.2-12
changelog:
  - snmpd crash with 'interfaces' directives in snmpd.conf fixed #139010
  - rather dirty patch fixing conf directory for net-snmp-config


author: Phil Knirsch <pknirsch@redhat.com> 5.1.2-9
changelog:
  - Droped obsolete lm-sensors patch and enabled lmSensors module
  - Marked several patches to be removed for 5.1.3


author: Radek Vokal <rvokal@redhat.com> 5.1.2-4
changelog:
  - New prereq for net-snmp-devel
  - lelf check removed from configure.in (#128748)
  - fixed snmpd coredump when sent SIGHUP (#127314)


author: Phil Knirsch <pknirsch@redhat.com> 5.1.1-2
changelog:
  - Added Kaj J. Niemi that fixes ipAdEntIfIndex problem (#119106)
  - Added Kaj J. Niemi to shut up memshared message for 2.6 kernel (#119203)


author: Phil Knirsch <pknirsch@redhat.com> 5.1-12
changelog:
  - Hacked an ugly perl hack to get rid of perl RPATH problems.
  - Fixed 64bit patch and applied it. ;-)


author: Phil Knirsch <pknirsch@redhat.com> 5.1-9
changelog:
  - Reverted removal of _includir redefiniton due to php-snmp dependancy.
  - Remove SO_BSDCOMPAT setsockopt() call, deprecated.


author: Phil Knirsch <pknirsch@redhat.com> 5.1-3
changelog:
  - Removed snmpcheck again, needs perl(Tk) which we don't ship (#111194).
  - Fixed getopt definition in include file (#111209).
  - Included Kaj J. Niemi's patch for broken perl module (#111319).
  - Included Kaj J. Niemi's patch for broken async getnext perl call (#111479).
  - Included Kaj J. Niemi's patch for broken hr_storage (#111502).


author: Phil Knirsch <pknirsch@redhat.com> 5.1-2
changelog:
  - Included BuildPrereq on lm_sensors-devel on x86 archs (#110616).
  - Fixed deprecated initscript options (#110618).


author: Phil Knirsch <pknirsch@redhat.com> 5.1-1
changelog:
  - Updated to latest net-snmp-5.1 upstream version.
  - Tons of specfile and patch cleanup.
  - Cleaned up perl stuff (mib2c etc, see #107707).
  - Added lm_sensors support patch for x86 archs from Kaj J. Niemi (#107618).
  - Added support for custom mib paths and mibs to snmptrapd initscript (#102762)


author: Phil Knirsch <pknirsch@redhat.com> 5.0.9-1
changelog:
  - Updated to latest upstream version net-snmp-5.0.9
  - Added patch to fix net-snmp-perl problems (#105842).


author: Phil Knirsch <pknirsch@redhat.com> 5.0.8-2
changelog:
  - Hack to make it build on 64bit platforms with /usr/lib64 correctly.
  - Fixed bug #85071 (leak of open descriptors for ipv6).


author: Phil Knirsch <pknirsch@redhat.com> 5.0.1-5
changelog:
  - Added --enable-ucd-snmp-compatibility for compatibility with older version
    and fixed installation thereof.
  - Got rid of the perl(Tk) dependancy by removing snmpcheck.
  - Include /usr/include/ucd-snmp in the filelist.
  - Fixed a problem with the ucd-snmp/version.h file.


author: Phil Knirsch <pknirsch@redhat.com> 4.2.3-4
changelog:
  - Added the snmptrapd init script as per request (#49205)
  - Fixed the again broken rpm query stuff (#57444)
  - Removed all old and none-used db related stuff (libs and header checks/files)


author: Phil Knirsch <phil@redhat.de> 4.2.3-1
changelog:
  - Update to 4.2.3 final.
  - Fixed libtool/rpath buildroot pollution problem.
  - Fixed library naming problem.


author: Philipp Knirsch <pknirsch@redhat.de>
changelog:
  - Fixed a server segfault for snmpset operation (#53640). Thanks to Josh Giles
    and Wes Hardaker for the patch.


author: Philipp Knirsch <pknirsch@redhat.de>
changelog:
  - Final bcm5820 fix. Last one was broken.
  - Fixed bugzilla bug (#51960) where the binaries contained rpath references.


author: Philipp Knirsch <pknirsch@redhat.de>
changelog:
  - Fixed a couple of security issues:
    o /tmp race and setgroups() privilege problem
    o Various buffer overflow and format string issues.
    o One signedness problem in ASN handling.
  - Fixed an important RFE to support bcm5820 cards. (#51125)


author: Philipp Knirsch <pknirsch@redhat.de>
changelog:
  - Removed tkmib from the package once again as we don't ship the Tk.pm CPAN
    perl module required to run it (#49363)
  - Added missing Provides for the .so.0 libraries as rpm doesn't seem to find
    those during the build anymore (it used to) (#46388)


author: Philipp Knirsch <pknirsch@redhat.de>
changelog:
  - Enabled IPv6 support (RFE #47764)
  - Hopefully final fix of snmpwalk problem (#42153). Thanks to Douglas Warzecha
    for the patch and Matt Domsch for reporting the problem.


author: Philipp Knirsch <pknirsch@redhat.de>
changelog:
  - Updated to 4.2.1. Removed 2 obsolete patches (fromcvs and #18153)
  - Include /usr/share/snmp/snmpconf in %files


author: Matt Wilson <msw@redhat.com>
changelog:
  - configure with --enable-reentrant and added "smux" and "agentx" to
    --with-mib-modules= argument (#29626)


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - don't depend on /etc/init.d so that package will work with 6.2.
  - perl path fiddles no longer needed.
  - rely on brp-compress frpm rpm to compress man pages.
  - patch from ucd-snmp CVS (Wes Hardaker).
  - configure.in needs to check for rpm libraries correctly (#23033).
  - add simple logrotate script (#21399).
  - add options to create pidfile and log with syslog with addresses (#23476).


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - tkmib doco had #!/usr/bin/perl55
  - include snmpcheck and tkmib again (still needs some CPAN module, however).


author: Adam Jackson <ajax@redhat.com> 1:7.2-3
changelog:
  - Move bdftruncate (and its perl dependency) to a subpackage.
  - %doc for the non-empty READMEs and non-stub COPYINGs.


author: Mike A. Harris <mharris@redhat.com> 1:7.1-1
changelog:
  - Update to font-util-1.0.1 from X11R7.1
  - Set package version to X11 release the tarballs are based from.


author: Mike A. Harris <mharris@redhat.com> 1:1.0.1-3
changelog:
  - Remove "Obsoletes: xorg-x11-font-utils" as the package should not obsolete
    itself.  Leftover from the original package template it seems.  (#182439)


author: Mike A. Harris <mharris@redhat.com> 1:1.0.1-2
changelog:
  - Added with_X11R6_compat macro to conditionalize inclusion of mkfontdir and
    mkfontscale symlinks in the old X11R6 locations, pointing to the X11R7
    binaries.  This will provide backward compatibilty for Fedora Core 5, however
    3rd party developers and rpm package maintainers should update to using the
    new X11R7 locations immediately, as these compatibility links are temporary,
    and will be removed from a future OS release.
  - Remove system directories from file manifest to appease the banshees.


author: Mike A. Harris <mharris@redhat.com> 1:1.0.0-1
changelog:
  - Updated all utilities to version 1.0.0 from X11R7 RC4.
  - Updated font-util-1.0.0-mapdir-use-datadir-fix.patch to work with RC4.
  - Added font-util-1.0.0-autoconf-add-with-fontdir-option.patch to add a new
    variable "fontdir" to the fontutil.pc file which all of the font packages
    can autodetect and use instead of having to put manual fontdir overrides
    in every single rpm package.


author: Mike A. Harris <mharris@redhat.com> 1:0.99.2-1
changelog:
  - Updated bdftopcf, fonttosfnt to version 0.99.3, and mkfontdir, mkfontscale,
    and font-util to version 0.99.2 from X11R7 RC3.
  - Changed manpage dir from man1x back to man1 due to another upstream change.
  - Added fontutil.m4 to file manifest.


author: Mike A. Harris <mharris@redhat.com> 1:0.99.1-1
changelog:
  - Changed package version to 0.99.1 to match the upstream font-util tarball
    version, and added "Epoch: 1" to the package for upgrades.
  - Added font-util-0.99.1-mapdir-use-datadir-fix.patch to fix the font-util
    mapfiles data to install into datadir instead of libdir (#173943)
  - Added "Requires(pre): libfontenc >= 0.99.2-2" to force a version of
    libfontenc to be installed that fixes bug #173453, and to also force it
    to be installed before xorg-x11-font-utils in a multi-package rpm
    transaction, which will ensure that when font packages get installed
    during upgrades via anaconda or yum, that the right libfontenc is being
    used by mkfontscale/mkfontdir.
  - Added ">= 0.99.2-2" to BuildRequires for libfontenc, as a convenience to
    people rebuilding xorg-x11-font-utils, as they'll need to install the new
    libfontenc now anyway before they can install the font-utils package.


author: Mike A. Harris <mharris@redhat.com> 6.99.99.901-3
changelog:
  - Glob util/map-* files in file manifest.
  - Added missing "Obsoletes: xorg-x11-font-utils".
  - Added "BuildRequires: pkgconfig".


author: Mike A. Harris <mharris@redhat.com> 6.99.99.901-1
changelog:
  - Updated bdftopcf, fonttosfnt, mkfontdir, mkfontscale to version 0.99.1 from
    X11R7 RC1.
  - Bumped package version to 6.99.99.901, the X11R7 RC1 release version tag.
  - Updated file manifest to to find the manpages in "man1x".


author: Vojtech Vitek (V-Teq) <vvitek@redhat.com> - 4.2.1-8
changelog:
  - fix `--copy' option behaviour to unlink sedXXX temp files,
    clean-up the copy-option patch and merge it with the
    `-i/--in-place' docs/manpage patch (#709956)


author: Ondrej Vasik <ovasik@redhat.com> - 4.2.1-7
changelog:
  - improve man/usage documentation of the -i/--in-place option
    in the case of symlinks/hardlinks(#679921)


author: Jiri Moskovcak <jmoskovc@redhat.com> 4.2.1-4
changelog:
  - added libselinux-devel to buildrequires rhbz#514182
  - fixed problem with --excludedocs rhbz#515913


author: Jiri Moskovcak <jmoskovc@redhat.com> - 4.2.1-1
changelog:
  - new version
  - obsoletes previous patches
  - added patch to maintain backwards compatibility for scripts using -c/--copy
  - Resolves: #502934


author: Petr Machata <pmachata@redhat.com> - 4.1.5-8
changelog:
  - tidy up the specfile per rpmlint comments
  - use utf-8 and fix national characters in contributor's names


author: Petr Machata <pmachata@redhat.com> - 4.1.5-4
changelog:
  - remove superfluous multibyte processing in str_append for UTF-8
    encoding (thanks Paolo Bonzini, #177246)


author: Petr Machata <pmachata@redhat.com> - 4.1.5-2
changelog:
  - #185374:
    - Follow symlinks before rename (avoid symlink overwrite)
    - Add -c flag for copy instead of rename (avoid ownership change)


author: Jakub Jelinek <jakub@redhat.com> 4.0.8-3
changelog:
  - if not -n, print current buffer after N command on the last line
    unless POSIXLY_CORRECT (#112952)
  - adjust XFAIL_TESTS for the improved glibc regex implementation
    (#112642)


author: Florian La Roche <Florian.LaRoche@redhat.de>
changelog:
  - update to 4.0.7
  - use "--without-included-regex"
  - do not gzip info pages in spec file, "TODO" is not present anymore


author: Petr Šabata <contyk@redhat.com> - 0.9.45-6
changelog:
  - Willing SUT retains PFC operational state from peer after peer
    stops transmitting TLV (#870578)
  - Unable to query configured PFC priorities under IEEE DCBX (#870576)


author: Petr Šabata <contyk@redhat.com> - 0.9.45-4
changelog:
  - The devel subpackage now properly requires the base package to avoid
    multilib conflicts (#869633)


author: Petr Sabata <contyk@redhat.com> - 0.9.43-12
changelog:
  - lldpad: fix core dump (#749943)
  - Support for multiple filter info formats (#731407)
  - Updating documentation for previous commit (#749057)


author: Petr Sabata <psabata@redhat.com> - 0.9.41-4
changelog:
  - Upstream sync up to 4bf0f2db41be0b282e63646fb6b31f0a938d3865
  - Resolves: rhbz#694671
  - Resolves: rhbz#694323
  - Resolves: rhbz#694925


author: Petr Sabata <psabata@redhat.com> - 0.9.38-4
changelog:
  - patch to resolve hang observed during FCoE boot due to dcbx failing to initiate PFC and FCoE app priority negotiations
  - Resolves: rhbz#631587


author: Jan Zeleny <jzeleny@redhat.com> - 0.9.38-1
changelog:
  - rebased to 0.9.38 (various enhancements and bugfixes, see 
    lldpad-0.9.38-relnotes.txt on http://e1000.sf.net for complete list)


author: Jan Zeleny <jzeleny@redhat.com> - 0.9.32-1
changelog:
  - rebased to 0.9.32 (various enhancements and bugfixes, see 
    lldpad-0.9.32-relnotes.txt on http://e1000.sf.net for complete list)


author: Jan Zeleny <jzeleny@redhat.com> - 0.9.26-1
changelog:
  - rebased to 0.9.26
  - package renamed to lldpad
  - enahanced functionality (LLDP supported as well as DCBX)


author: Karsten Hopp <karsten@redhat.com> 0.9.15-4
changelog:
  - buildrequire libconfig-devel >= 1.3.2, it doesn't build with 1.3.1 due to
    the different config_lookup_string api


author: Jan Zeleny <jzeleny@redhat.com> - 0.9.7-3
changelog:
  - added devel files again to support fcoe-utils package
  - added kernel >= 2.6.29 to Requires, deleted dcbnl.h, since it is
    aviable in kernel 2.6.29-rc7
  - changed config dir from /etc/sysconfig/dcbd to /etc/dcbd
  - updated init script: added mandatory Short description tag,
    deleted default runlevels, which should start the script


author: Chris Leech <christopher.leech@intel.com> - 0.9.7-1
changelog:
  - Updated to 0.9.7
  - Added a private copy of dcbnl.h until kernel-headers includes it.
    Export patch is making it's way to the upstream kernel via net-2.6,
    expected in 2.6.29-rc7


author: Jan Zeleny <jzeleny@redhat.com> - 2.2-3
changelog:
  - minor changes in spec file - filenames change, removal of
    duplicate patch files (included in build source tarball)


author: Benjamin Tissoires <benjamin.tissoires@redhat.com> 1.4.5-5
changelog:
  - CVE-2015-1802: missing range check in bdfReadProperties (bug 1258892)
  - CVE-2015-1803: crash on invalid read in bdfReadCharacters (bug 1258892)
  - CVE-2015-1804: out-of-bounds memory access in bdfReadCharacters (bug 1258892)


author: Shelly Ma <shelly.ma@oracle.com> - 0.1-17.el6.1
changelog:
  - Preventive checkin for later socat/ovm-soncoled vulnerability that accepts any remote connection [bug 24822122]


author: Tomáš Mráz <tmraz@redhat.com> - 2.0.14-8
changelog:
  - fix aborts and default algorithms when running in FIPS mode (#1078957, #966493)
  - add missing initialization of libgcrypt in gpgv
  - properly encode s2k iteration count in gpg-agent (#638635)


author: Tomas Mraz <tmraz@redhat.com> - 2.0.14-5
changelog:
  - fix CVE-2012-6085 GnuPG: read_block() corrupt key input validation
  - fix CVE-2013-4402 GnuPG: infinite recursion in the compressed packet parser


author: Adam Jackson <ajax@redhat.com> 1.2-3
changelog:
  - libxcb-1.2-to-git-6e2e87d.patch: Various updates from git, XID generation
    being the most important.


author: Adam Jackson <ajax@redhat.com> 1.1.91-3
changelog:
  - libxcb-1.1-xreply-leak.patch: Plug a memory leak in _XReply when the
    caller has a non-fatal error handler. (mclasen, fdo #17616)


author: Adam Jackson <ajax@redhat.com> 1.1-4
changelog:
  - libxcb-1.1-sloppy-lock.patch: Turn sloppy locking on all the time.  I'm
    tired of fighting it. (#390261)


author: Adam Jackson <ajax@redhat.com> 1.0-3
changelog:
  - libxcb-1.0-abstract-socket.patch: When connecting to the X server, prefer
    abstract-namespace unix sockets to filesystem-bound sockets.


author: Marcela Mašláňová <mmaslano@redhat.com> - 3.1.10-43
changelog:
  - 630019 set correct (f)pie build flags
  - 615104 fix double echo in initscript
  - 589099 Wrong file permissions for atd configuration
  - Resolves: rhbz#630019, rhbz#615104, rhbz#589099


author: Marcela Mašláňová <mmaslano@redhat.com> - 3.1.10-30
changelog:
  - 435765 and 486844 in some cases could be used bash for at commands
   even if user sets different default shell. Also bash4.0 fix Here Documents
   which breaks previous patch at-3.1.10-shell.patch.


author: Marcela Maslanova <mmaslano@redhat.com> - 3.1.10-20
changelog:
  - used PIE instead of pie (with pie wasn't build on 64b successful)
  - rewrite PAM fail check
  - fix checking of settings setuid(s)


author: Jason Vas Dias <jvdias@redhat.com> - 3.1.8-81
changelog:
  - rebuild for new gcc, glibc, glibc-kernheaders
  - workaround new refusal of /usr/bin/install to chown


author: Jason Vas Dias <jvdias@redhat.com> 3.1.8-78
changelog:
  - fix bug 159220: add pam_loginuid to pam session stack in /etc/pam.d/atd 
  - fix bug 102341: add '-r' synonym for '-d' / atrm for POSIX / SuS conformance


author: Jason Vas Dias <jvdias@redhat.com> 3.1.8-68
changelog:
  - Put PAM authentication check in 'check_permissions()', so
  - user can know when using at(1) if PAM permission is denied.


author: Jason Vas Dias <jvdias@redhat.com> 3.1.8-60
changelog:
  - fix bug 131510: no_export env. var. blacklisting should not
  - remove 'SHELL' when only 'SHELLOPTS' is blacklisted.
  - at(1) man-page should not say 'commands are run with /bin/sh'
  - and should explain usage of SHELL environement variable and
  - details of blacklisted variables.


author: Jason Vas Dias <jvdias@redhat.com>
changelog:
  - Had to disable the 'make test' for the build BEFORE
  - any changes were made (building on FC2 - perl issue?)
  - test.pl generates these 'errors' for what looks like
  - valid output to me:
  - $ ./test.pl 2>&1 | egrep -v '(^ok$)|(time_only)'
  - 1..3656
  - not ok
  - 'Monday - 1 month': 'Fri Jul  2 18:29:00 2004' =? 'Sat Jul  3 18:29:00 2004'
  - not ok
  - 'Monday - 10 months': 'Thu Oct  2 18:29:00 2003' =? 'Fri Oct  3 18:29:00 2003'
  - not ok
  - 'next week - 1 month': 'Mon Jul  5 18:29:00 2004' =? 'Tue Jul  6 18:29:00 2004'
  - not ok
  - 'next week - 10 months': 'Sun Oct  5 18:29:00 2003' =? 'Mon Oct  6 18:29:00 2003'
  - will investigate and fix for next release.


author: Jens Petersen <petersen@redhat.com> - 3.1.8-49
changelog:
  - replace at-3.1.8-SHELL-91233.patch by at-3.1.8-SHELL-111386.patch which
    now executes $SHELL directly in the at shell script after all the variables
    have been setup with /bin/sh (#91233) [suggested by Göran Uddeborg]
  - this changelog is now in utf-8


author: Dan Walsh <dwalsh@redhat.com> - 3.1.8-47.sel
changelog:
  * Fri Jun 20 2003 Jens Petersen <petersen@redhat.com> - 3.1.8-46
  - add at-3.1.8-atrun.8-typo-97697.patch to fix typo in atrun.8 (#97697)
  - update at.1 description of shell behaviour (#91233)


author: Jens Petersen <petersen@redhat.com> - 3.1.8-41
changelog:
  - update source to at_3.1.8-11 from debian upstream
    - update source url
    - at-debian.patch no longer needed
    - at-3.1.7-paths.patch: the patch to "at.1.in" no longer needed
    - replace at-3.1.8-lexer.patch with at-3.1.8-11-lexer-parser.diff
    - at-3.1.8-dst.patch no longer needed
    - at-3.1.8-lsbdoc.patch no longer needed
    - at-3.1.8-o_excl.patch no longer needed
    - bump release number
  - at-3.1.8-test.patch: move out test.pl to a separate source file
    - apply at-3.1.8-test-fix.patch to it and drop patch
  - at-3.1.8-shell.patch: drop (#22216,#91233)
  - run "make test" after building
  - add "--without check" rpmbuild option
  - fix autoconf comment to point to right patch
  - use _sysconfdir, _sbindir, _bindir, and _localstatedir


author: Bill Huang <bhuang@redhat.com>
changelog:
  - Fixed delaying job execution and missing starting jobs..(bug#69595)
    (Thanks Bujor D Silaghi <bujor@cs.umd.edu> for his patch.)


author: Bill Huang <bhuang@redhat.com>
changelog:
  - Fixed cleaning atq and  multiple atd daemon.(bug#67414)
    (Thanks Bujor D Silaghi <bujor@cs.umd.edu> for his patch.)


author: Adrian Havill <havill@redhat.com> 3.1.8-21
changelog:
  - fix man page (#51253)
  - fix env prop problem (#49491)
  - .SEQ should not be executable (#52626)
  - beefed up file creation perms against symlink exploits (O_EXCL)


author: Crutcher Dunnavant <crutcher@redhat.com>
changelog:
  - applied enrico.scholz@informatik.tu-chemnitz.de's change to the env patch to 
  - address bug #46546


author: Crutcher Dunnavant <crutcher@redhat.com>
changelog:
  - changed atd.init to start at 95, stop at 5, closing #15915
  - applied mailto:wp@supermedia.pl's environment patch


author: Crutcher Dunnavant <crutcher@redhat.com>
changelog:
  - much love to David Kilzer <ddkilzer@lubricants-oil.com>
  - who nailed UTC, Leap year, DST, and some other edge cases down
  - he also wrote a test harness in perl
  - bug #28448


author: Crutcher Dunnavant <crutcher@redhat.com>
changelog:
  - Well, we will likely never really close the UTC issues,
  - because of 1) fractional timezones, and 2) daylight savigns time.
  - but there is a slight tweak to the handling of dst in the UTC patch.


author: Preston Brown <pbrown@redhat.com>
changelog:
  - move init script
  - add condrestart directive
  - fix post/preun/postun scripts
  - prereq initscripts >= 5.20


author: Michael K. Johnson <johnsonm@redhat.com>
changelog:
  - updated to at version 3.1.7
  - updated lock and sequence file handling with ghost
  - Use chkconfig and atd, now conflicts with old crontabs packages


author: Tim Waugh <twaugh@redhat.com> 5.50-22
changelog:
  - Further changes from package review (bug #225794):
    - Don't use umask in scriptlet.
    - Don't use 'which' in scriptlet.


author: Tim Waugh <twaugh@redhat.com> 5.50-21
changelog:
  - Changes from package review (bug #225794):
    - Requires xorg-x11-font-utils, not mkfontscale/mkfontdir.
    - Use macro for /etc.
    - Don't own catalogue directory.


author: Tim Waugh <twaugh@redhat.com> 5.50-16
changelog:
  - Fixed URL again (bug #225794).
  - Fixed requires tags (bug #225794).
  - Preserve timestamps on installed files (bug #225794).
  - Added empty %build section (bug #225794).
  - Use FHS macros for file manifest (bug #225794).
  - Fixed summary (bug #225794).
  - Fixed description (bug #225794).
  - Fixed license (bug #225794).


author: Tim Waugh <twaugh@redhat.com> 5.50-15
changelog:
  - Fixed URL (bug #225794).
  - Fixed build root tag (bug #225794).
  - This package does not require ghostscript (bug #225794).


author: Tim Waugh <twaugh@redhat.com> 5.50-10
changelog:
  - Rebuilt. (The 8.11 package which briefly appeared in rawhide should
    not be used.)  Bug #99323, bug #113866.


author: Peter Hutterer <peter.hutterer@redhat.com> 1.4.3-3
changelog:
  - Fix 0001-Handle-unknown-device-classes.patch: missing prototype change for
    copy_classes in XIQueryDevice caused parameter corruption (#744960)


author: Peter Hutterer <peter.hutterer@redhat.com> 1.4.3-2
changelog:
  - 0001-Handle-unknown-device-classes.patch: don't corrupt memory when a
    server sends unknown device classes.


author: parag <paragn@fedoraproject.org> 1.1.3-2
changelog:
  - Merge-review #226076
  - Removed BR:pkgconfig
  - Removed XFree86-libs, xorg-x11-libs XFree86-devel, xorg-x11-devel as Obsoletes
  - Removed zero-length AUTHORS README file


author: Mike A. Harris <mharris@redhat.com> 1.0.1-3
changelog:
  - Added "Requires: xorg-x11-proto-devel" to devel package for xi.pc
  - Remove package ownership of mandir/libdir/etc.


author: Mike A. Harris <mharris@redhat.com> 1.0.1-2
changelog:
  - Replace "makeinstall" with "make install DESTDIR=..." for (#192721)
  - Remove package ownership of mandir/libdir/etc.


author: Mike A. Harris <mharris@redhat.com> 0.99.2-1
changelog:
  - Updated libXi to version 0.99.2 from X11R7 RC3
  - Added "Requires(pre): xorg-x11-filesystem >= 0.99.2-3", to ensure
    that /usr/lib/X11 and /usr/include/X11 pre-exist.
  - Removed 'x' suffix from manpage directories to match RC3 upstream.


author: Mike A. Harris <mharris@redhat.com> 0.99.1-3
changelog:
  - Added "BuildRequires: libXau-devel", as build fails without it, but does
    not check for it with ./configure.  Bug (fdo#5065)


author: Mike A. Harris <mharris@redhat.com> 0.99.1-1
changelog:
  - Updated libXi to version 0.99.1 from X11R7 RC1
  - Updated file manifest to find manpages in "man3x"


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-29
changelog:
  - fix: invalid order of TLS shutdown operations (#818572)
  - fix: TLS error messages overwriting in tlsm_verify_cert() (#828787)
  - fix: reading pin from file can make all TLS connections hang (#829319)
  - fix: replication with TLS does not work (#707599)
  - fix: some TLS ciphers cannot be enabled (#852339)
  - fix: connection hangs after fallback to second server when certificate hostname verification fails (#843056)
  - fix: not all certificates in OpenSSL compatible CA certificate directory format are loaded (#811468)
  - fix: MozNSS certificate database in SQL format cannot be used (#857390)
  - fix: libldap does not load PEM certificate if certdb is used as TLS_CACERTDIR (#859858)
  - fix: do not send IPv6 DNS queries when IPv6 is disabled on the host (#835012)
  - fix: modification of olcSyncrepl attribute takes server out of MirrorMode (#821848)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-28
changelog:
  - CVE-2012-2668 (#825875)
    + cipher suite selection by name can be ignored
    + default cipher suite is always selected


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-26
changelog:
  - fix: MozNSS CA cert dir does not work together with PEM CA cert file (#818844)
  - fix: memory leak: def_urlpre is not freed (#816168)
  - fix update: Default SSL certificate bundle is not found by openldap library (#742023)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-24
changelog:
  - fix update: Default SSL certificate bundle is not found by openldap library (#742023)
  - fix: memberof overlay on the frontend database causes server segfault (#730745)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-23
changelog:
  - security fix: CVE-2012-1164: assertion failure by processing search queries
    requesting only attributes for particular entry (#813162)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-21
changelog:
  - fix: ldapsearch crashes with invalid parameters (#743781)
  - fix: replication (syncrepl) with TLS causes segfault (#783445)
  - fix: openldap server in MirrorMode sometimes fails to resync via syncrepl (#784211)
  - use portreserve to reserve LDAPS port (636/tcp+udp) (#790687)
  - fix: missing options in manual pages of client tools (#745470)
  - fix: SASL_NOCANON option missing in ldap.conf manual page (#732916)
  - fix: slapd segfaults when certificate key cannot be loaded (#796808)
  - Jan Synáček <jsynacek@redhat.com>
    + fix: overlay constraint with count option work bad with modify operation (#742163)
    + fix: Default SSL certificate bundle is not found by openldap library (#742023)
    + fix: Duplicate close() calls in OpenLDAP (#784203)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-20
changelog:
  - new feature update: honor priority/weight with ldap_domain2hostlist (#730311)
  - fix regression: openldap built without tcp_wrappers (#742592)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-18
changelog:
  - fix: overlay refint option refint_nothing doesn't function correctly (#725479)
  - fix: Unwanted slash printed when installing openldap-servers (#732001)
  - manpage fix: TLS options in documentation are not valid for MozNSS (#684810)
  - fix: NSS_Init* functions are not thread safe (#731168)
  - manpage fix: errors in manual page slapo-unique (#723521) 
  - new feature: honor priority/weight with ldap_domain2hostlist (#730311)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-17
changelog:
  - fix: strict aliasing warnings during package build (#723487)
  - add partial RELRO support for libraries (#723999)
  - fix: incorrect behavior of allow/try options of VerifyCert and TLS_REQCERT (#729095)
  - fix: memleak - free the return of tlsm_find_and_verify_cert_key (#729087)
  - fix: TLS_REQCERT=never ignored when the certificate is expired (#722959)
  - fix: matching wildcard hostnames in certificate Subject field does not work (#726984)
  - fix: OpenLDAP server segfaults when using back-sql (#727533)
  - fix: conversion of constraint overlay settings to cn=config is incorrect (#722923)
  - fix: DDS overlay tolerance parametr doesn't function and breakes default TTL (#723514)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-16
changelog:
  - fix: memleak in tlsm_auth_cert_handler (#717738)
  - fix: segmentation fault of client tool when LDIF input file is not terminated
    by a new line character (#698921)
  - fix: segmentation fault of client tool when input line in LDIF file
    is splitted but indented incorrectly (#701227)
  - fix: server scriptlets require initscripts package (#712358)
  - enable ldapi:/// interface by default
  - set cn=config management ACLs for root user, SASL external schema (#712494)
  - fix: ldapsearch fails if no CA certificate is available (#713525)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-15
changelog:
  - fix: rpm -V fail when upgrading with openldap-devel installed (#693716)
    (remove devel *.so symlinks from /lib and leave them in /usr/lib)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-14
changelog:
  - fix update: openldap startup script ignores ulimit settings (#679356)
  - fix update: openldap-servers upgrade hangs or do not upgrade the database (#685119)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-13
changelog:
  - fix update: openldap can't use TLS after a fork() (#671553)
  - fix: possible NULL pointer dereferences in NSS non-blocking patch (#684035)
  - fix: move libldif to /lib for consistency (#548475)
  - fix: openldap-servers upgrade hangs or do not upgrade the database (#685119)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-11
changelog:
  - fix: CVE-2011-1024 ppolicy forwarded bind failure messages cause success
  - fix: CVE-2011-1025 rootpw is not verified for ndb backend
  - fix: openldap startup script ignores ulimit settings (#679356)
  - fix: add symlinks into /usr/lib*/ (#680139)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-10
changelog:
  - fix: add symlinks for libraries moved in 2.4.23-5 to allow building
    packages which require these libraries in the old location (#678105)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-7
changelog:
  - fix: some server certificates refused with inadequate type error (#669846)
  - fix: default encryption strength dropped in switch to using NSS (#669845)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-5
changelog:
  - initscript: slaptest with '-u' to skip database opening (#613966)
  - removed slurpd options from sysconfig/ldap
  - fix: verification of self issued certificates (#667795)
  - fix: move libraries from /usr/lib to /lib (#548475)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-4
changelog:
  - rebase to 2.4.23 (Fedora 14) (#644077)
  - uses Mozilla NSS instead of OpenSSL for TLS/SSL
  - added LDIF (ldif.h) to the public API
  - removed embeded Berkeley DB
  - removed autofs schema (use up-to-date version from autofs package instead)
  - removed compat-openldap subpackage (use separate package instead)
  - fixes: ldapsearch -Z hangs server if starttls fails (#652823)
  - fixes: improve SSL/TLS log messages (#652819)
  - fixes: crash when TLS_CACERTDIR contains a subdirectory (#652817)
  - fixes: TLS_CACERTDIR takes precedence over TLS_CACERT (#652816)
  - fixes: openldap should ignore files not in the openssl c_hash format in cacertdir (#652814)
  - fixes: slapd init script gets stuck in an infinite loop (#644399)
  - fixes: Remove lastmod.la from default slapd.conf.bak (#630637)
  - fixes: Mozilla NSS - delay token auth until needed (#616558)
  - fixes: Mozilla NSS - support use of self signed CA certs as server certs (#616554)


author: Jan Zeleny <jzeleny@redhat.com> - 2.4.19-12
changelog:
  - updated man pages - only slaptest can convert configuration schema
    (#584787)
  - openldap compiled with -fno-strict-aliasing (#596193)


author: Jan Zeleny <jzeleny@redhat.com> - 2.4.19-10
changelog:
  - updated overlay list in config file (#586143)
  - config dir slapd.d added to package payload (#585276)
  - init script now creates only symlink, not harldink, in /var/run (#584870)


author: Jan Zeleny <jzeleny@redhat.com> - 2.4.19-9
changelog:
  - fixed broken link /usr/sbin/slapschema (#583568)
  - removed some static libraries from openldap-devel (#583575)


author: Jan Zeleny <jzeleny@redhat.com> - 2.4.19-7
changelog:
  - updated usage line in init script
  - changed return code when calling init script with bad arguments


author: Jan Zeleny <jzeleny@redhat.com> - 2.4.19-1
changelog:
  - fixed tls connection accepting when TLSVerifyClient = allow
  - /etc/openldap/ldap.conf removed from files owned by openldap-servers
  - minor changes in spec file to supress warnings
  - some changes in init script, so it would be possible to use it when
    using old configuration style
  - rebased openldap to 2.4.19
  - rebased bdb to 4.8.24


author: Jan Zeleny <jzeleny@redhat.com> 2.4.18-4
changelog:
  - buffer overflow patch from upstream
  - added /etc/openldap/slapd.d and /etc/openldap/slapd.conf.bak
    to files owned by openldap-servers


author: Jan Zeleny <jzeleny@redhat.com> 2.4.18-2
changelog:
  - changed configuration approach. Instead od slapd.conf slapd
    is using slapd.d directory now
  - fix of some issues caused by renaming of init script
  - fix of buffer overflow issue in ldif.c pointed out by new glibc


author: Jan Zeleny <jzeleny@redhat.com> 2.4.16-1
changelog:
  - rebase of openldap to 2.4.16
  - fixed minor issue in spec file (output looking interactive
    when installing servers)


author: Jan Zeleny <jzeleny@redhat.com> 2.4.15-3
changelog:
  - extended previous patch (#481310) to remove options cfMP
    from some client tools
  - correction of patch setugid (#494330)


author: Jan Safranek <jsafranek@redhat.com> 2.4.11-3
changelog:
  - add SLAPD_SHUTDOWN_TIMEOUT to /etc/sysconfig/ldap, allowing admins
    to set non-default slapd shutdown timeout
  - add checkpoint to default slapd.conf file (#458679)


author: Jan Safranek <jsafranek@redhat.com> 2.4.8-4
changelog:
  - bdb upgraded to 4.6.21
  - reworked upgrade logic again to run db_upgrade when bdb version
    changes


author: Jan Safranek <jsafranek@redhat.com> 2.4.8-3
changelog:
  - reworked the upgrade logic, slapcat/slapadd of the whole database
    is needed only if minor version changes (2.3.x -> 2.4.y)
  - do not try to save database in LDIF format, if openldap-servers package 
    is  being removed (it's up to the admin to do so manually)


author: Jan Safranek <jsafranek@redhat.com> 2.4.7-4
changelog:
  - fixed rpmlint warnings and errors
    - /etc/openldap/schema/README moved to /usr/share/doc/openldap


author: Jan Safranek <jsafranek@redhat.com> 2.3.38-2
changelog:
  - skeleton /etc/sysconfig/ldap added
  - new SLAPD_LDAP option to turn off listening on ldap:/// (#292591)
  - fixed checking of SSL (#292611)
  - fixed upgrade with empty database


author: Jan Safranek <jsafranek@redhat.com> 2.3.37-2
changelog:
  - do not use specific automake and autoconf
  - do not distinguish between NPTL and non-NPTL platforms, we have NPTL
    everywhere
  - db-4.6.18 integrated
  - updated openldap-servers License: field to reference BDB license


author: Jan Safranek <jsafranek@redhat.com> 2.3.34-6
changelog:
  - fix compat-slapcat compilation. Now it can be found in 
    /usr/lib/compat-openldap/slapcat, because the tool checks argv[0]
    (#246581)


author: Jan Safranek <jsafranek@redhat.com> 2.3.34-4
changelog:
  - Fix initscript return codes (#242667)
  - Provide overlays (as modules; #246036, #245896)
  - Add available modules to config file


author: Jan Safranek <jsafranek@redhat.com> 2.3.34-3
changelog:
  - do not create script in /tmp on startup (bz#188298)
  - add compat-slapcat to openldap-compat (bz#179378)
  - do not import ddp services with migrate_services.pl
    (bz#201183)
  - sort the hosts by adders, preventing duplicities
    in migrate*nis*.pl (bz#201540)
  - start slupd for each replicated database (bz#210155)
  - add ldconfig to devel post/postun (bz#240253)
  - include misc.schema in default slapd.conf (bz#147805)


author: Jan Safranek <jsafranek@redhat.com> 2.3.34-2
changelog:
  - slapadd during package update is now quiet (bz#224581)
  - use _localstatedir instead of var/ during build (bz#220970)
  - bind-libbind-devel removed from BuildRequires (bz#216851)
  - slaptest is now quiet during service ldap start, if
    there is no error/warning (bz#143697)
  - libldap_r.so now links with pthread (bz#198226)
  - do not strip binaries to produce correct .debuginfo packages
    (bz#152516)


author: Jay Fenlason <fenlason<redhat.com> 2.3.34-1
changelog:
  - New upstream release
  - Upgrade the scripts for migrating the database so that they might
    actually work.
  - change bind-libbind-devel to bind-devel in BuildPreReq


author: Thomas Woerner <twoerner@redhat.com> 2.3.30-1.1
changelog:
  - tcp_wrappers has a new devel and libs sub package, therefore changing build
    requirement for tcp_wrappers to tcp_wrappers-devel


author: Jay Fenlason <fenlason@redhat.com> 2.3.27-3
changelog:
  - Include --enable-multimaster to close
    bz#185821: adding slapd_multimaster to the configure options
  - Upgade guide.html to the correct one for openladp-2.3.27, closing
    bz#190383: openldap 2.3 packages contain the administrator's guide for 2.2
  - Remove the quotes from around the slaptestflags in ldap.init
    This closes one part of
    bz#204593: service ldap fails after having added entries to ldap
  - include __db.* in the list of files to check ownership of in
    ldap.init, as suggested in
    bz#199322: RFE: perform cleanup in ldap.init


author: Jay Fenlason <fenlason@redhat.com> 2.3.27-2
changelog:
  - New upstream release
  - Include the gethostbyname_r patch so that nss_ldap won't hang
    on recursive attemts to ldap_initialize.


author: Jay Fenlason <fenlason@redhat.com> 2.3.19-2
changelog:
  - Upgrade to 2.3.19, which upstream now considers stable
  - Modify the -config.patch, ldap.init, and this spec file to put the
    pid file and args file in an ldap-owned openldap subdirectory under
    /var/run.
  - Move back_sql* out of _sbindir/openldap , which requires
    hand-moving slapd and slurpd to _sbindir, and recreating symlinks
    by hand.
  - Retire openldap-2.3.11-ads.patch, which went upstream.
  - Update the ldap.init script to run slaptest as the ldap user rather
    than as root.  This solves
    bz#150172 Startup failure after database problem
  - Add to the servers post and preun scriptlets so that on preun, the
    database is slapcatted to /var/lib/ldap/upgrade.ldif and the
    database files are saved to /var/lib/ldap/rpmorig.  On post, if
    /var/lib/ldap/upgrade.ldif exists, it is slapadded.  This means that
    on upgrades from 2.3.16-2 to higher versions, the database files may
    be automatically upgraded.  Unfortunatly, because of the changes to
    the preun scriptlet, users have to do the slapcat, etc by hand when
    upgrading to 2.3.16-2.  Also note that the /var/lib/ldap/rpmorig
    files need to be removed by hand because automatically removing your
    emergency fallback files is a bad idea.
  - Upgrade internal bdb to db-4.4.20.  For a clean upgrade, this will
    require that users slapcat their databases into a temp file, move
    /var/lib/ldap someplace safe, upgrade the openldap rpms, then
    slapadd the temp file.


author: Jay Fenlason <fenlason@redhat.com> 2.3.11-3
changelog:
  - Remove Requires: cyrus-sasl and cyrus-sasl-md5 from openldap- and
    compat-openldap- to close
    bz#173313 Remove exlicit 'Requires: cyrus-sasl" + 'Requires: cyrus-sasl-md5'


author: Jay Fenlason <fenlason@redhat.com> 2.3.11-2
changelog:
  - Upgrade to 2.3.11, which upstream now considers stable.
  - Switch compat-openldap to 2.2.29
  - remove references to nss_ldap_build from the spec file
  - remove references to 2.0 and 2.1 from the spec file.
  - reorganize the build() function slightly in the spec file to limit the
    number of redundant and conflicting options passedto configure.
  - Remove the attempt to hardlink ldapmodify and ldapadd together, since
    the current make install make ldapadd a symlink to ldapmodify.
  - Include the -ads patches to allow SASL binds to an Active Directory
    server to work.  Nalin <nalin@redhat.com> wrote the patch, based on my
    broken first attempt.


author: Jay Fenlason <fenlason@redhat.com> 2.2.26-2
changelog:
  - Move the slapd.pem file to /etc/pki/tls/certs
    and edit the -config patch to match to close
    bz#143393  Creates certificates + keys at an insecure/bad place
  - also use _sysconfdir instead of hard-coding /etc


author: Jay Fenlason <fenlason@redhat.com>
changelog:
  - Add the tls-fix-connection-test patch to close
    bz#161991 openldap password disclosure issue
  - add the hop patches to prevent infinite looping when chasing referrals.
    OpenLDAP ITS #3578


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.26-1
changelog:
  - run slaptest with the -u flag if no id2entry db files are found, because
    you can't check for read-write access to a non-existent database (#156787)
  - add _sysconfdir/openldap/cacerts, which authconfig sets as the
    TLS_CACERTDIR path in /etc/openldap/ldap.conf now
  - use a temporary wrapper script to launch slapd, in case we have arguments
    with embedded whitespace (#158111)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.2.26 (stable 20050429)
  - enable the lmpasswd scheme
  - print a warning if slaptest fails, slaptest -u succeeds, and one of the
    directories listed as the storage location for a given suffix in slapd.conf
    contains a readable file named __db.001 (#118678)


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.24-1
changelog:
  - update to 2.2.24 (stable 20050318)
  - export KRB5_KTNAME in the init script, in case it was set in the sysconfig
    file but not exported


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.23-1
changelog:
  - update to 2.2.23 (stable-20050125)
  - update notes on upgrading from earlier versions
  - drop slapcat variations for 2.0/2.1, which choke on 2.2's config files


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.20-1
changelog:
  - update to 2.2.20 (stable-20050103)
  - warn about unreadable krb5 keytab files containing "ldap" keys
  - warn about unreadable TLS-related files
  - own a ref to subdirectories which we create under _libdir/tls


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.2.17 (stable-20040923) (#135188)
  - move nptl libraries into arch-specific subdirectories on x86 boxes
  - require a newer glibc which can provide nptl libpthread on i486/i586


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - move slapd startup to earlier in the boot sequence (#103160)
  - update to 2.2.15 (stable-20040822)
  - change version number on compat-openldap to include the non-compat version
    from which it's compiled, otherwise would have to start 2.2.15 at release 3
    so that it upgrades correctly


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.13-2
changelog:
  - build a separate, static set of libraries for openldap-devel with the
    non-standard ntlm bind patch applied, for use by the evolution-connector
    package (#125579), and installing them under
    evolution_connector_prefix)
  - provide openldap-evolution-devel = version-release in openldap-devel
    so that evolution-connector's source package can require a version of
    openldap-devel which provides what it wants


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.13-1
changelog:
  - add compat-openldap subpackage
  - default to bdb, as upstream does, gambling that we're only going to be
    on systems with nptl now


author: Thomas Woerner <twoerner@redhat.com> 2.1.29-3
changelog:
  - removed rpath
  - added pie patch: slapd and slurpd are now pie
  - requires libtool >= 1.5.6-2 (PIC libltdl.a)


author: Nalin Dahyabhai <nalin@redhat.com> 2.1.25-2
changelog:
  - fix incorrect use of find when attempting to detect a common permissions
    error in the init script (#114866)


author: Nalin Dahyabhai <nalin@redhat.com> 2.1.25-1
changelog:
  - change logging facility used from daemon to local4 (#112730, reversing #11047)
    BEHAVIOR CHANGE - SHOULD BE MENTIONED IN THE RELEASE NOTES.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - build bundled libdb for slapd dynamically to make the package smaller,
    among other things
  - on tls-capable arches, build libdb both with and without shared posix
    mutexes, otherwise just without
  - disable posix mutexes unconditionally for db 4.0, which shouldn't need
    them for the migration cases where it's used
  - update to MigrationTools 45


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - actually require newer libtool, as was intended back in 2.1.22-0, noted as
    missed by Jim Richardson


author: Nalin Dahyabhai <nalin@redhat.com> 2.1.22-0
changelog:
  - 2.1.22 now badged stable
  - be more aggressive in what we index by default
  - use/require libtool 1.5


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - install the db utils for the bundled libdb as %{_sbindir}/slapd_db_*
  - install slapcat/slapadd from 2.0.x for migration purposes


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.1.17
  - disable the shell backend, not expected to work well with threads
  - drop the kerberosSecurityObject schema, the krbName attribute it
    contains is only used if slapd is built with v2 kbind support


author: Nalin Dahyabhai <nalin@redhat.com> 2.0.27-8
changelog:
  - back down to db 4.0.x, which 2.0.x can compile with in ldbm-over-db setups
  - tweak SuSE patch to fix a few copy-paste errors and a NULL dereference


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - incorporate fixes from SuSE's security audit, except for fixes to ITS 1963,
    1936, 2007, 2009, which were included in 2.0.26.
  - add two more patches for db 4.1.24 from sleepycat's updates page
  - use openssl pkgconfig data, if any is available


author: Nalin Dahyabhai <nalin@redhat.com> 2.0.25-2
changelog:
  - change LD_FLAGS to refer to /usr/kerberos/_libdir instead of
    /usr/kerberos/lib, which might not be right on some arches


author: Nalin Dahyabhai <nalin@redhat.com> 2.0.25-1
changelog:
  - update to 2.0.25 "stable", ldbm-over-gdbm (putting off migration of LDBM
    slapd databases until we move to 2.1.x)
  - use %{_smp_mflags} when running make
  - update to MigrationTools 44
  - enable dynamic module support in slapd


author: Nalin Dahyabhai <nalin@redhat.com> 2.0.22-2
changelog:
  - switch to an internalized Berkeley DB as the ldbm back-end  (NOTE: this breaks
    access to existing on-disk directory data)
  - add slapcat/slapadd with gdbm for migration purposes
  - remove Kerberos dependency in client libs (the direct Kerberos dependency
    is used by the server for checking {kerberos} passwords)


author: Nalin Dahyabhai <nalin@redhat.com> 2.0.20-2
changelog:
  - temporarily disable optimizations for ia64 arches
  - specify pthreads at configure-time instead of letting configure guess


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - disable kbind support (deprecated, and I suspect unused)
  - configure with --with-kerberos=k5only instead of --with-kerberos=k5
  - build slapd with threads


author: Nalin Dahyabhai <nalin@redhat.com> 2.0.12-1
changelog:
  - update to 2.0.12 to pull in fixes for setting of default TLS options, among
    other things
  - update to migration tools 39
  - drop tls patch, which was fixed better in this release


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add a build-time requirement on pam-devel
  - add a build-time requirement on a sufficiently-new libtool to link
    shared libraries to other shared libraries (which is needed in order
    for prelinking to work)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - require cyrus-sasl-md5 (support for DIGEST-MD5 is required for RFC
    compliance) by name (follows from #43079, which split cyrus-sasl's
    cram-md5 and digest-md5 modules out into cyrus-sasl-md5)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - move shared libraries to /lib
  - redo init script for better internationalization (#26154)
  - don't use ldaprc files in the current directory (#38402) (patch from
    hps@intermeta.de)
  - add BuildPrereq on tcp wrappers since we configure with
    --enable-wrappers (#43707)
  - don't overflow debug buffer in mail500 (#41751)
  - don't call krb5_free_creds instead of krb5_free_cred_contents any
    more (#43159)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - build dummy certificate in %post, use it in default config
  - configure-time shenanigans to help a confused configure script


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - back out pidfile patches, which interact weirdly with Linux threads
  - mark non-standard schema as such by moving them to a different directory


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add support for additional OPTIONS, SLAPD_OPTIONS, and SLURPD_OPTIONS in
    a /etc/sysconfig/ldap file (#23549)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - change automount object OID from 1.3.6.1.1.1.2.9 to 1.3.6.1.1.1.2.13,
    per mail from the ldap-nis mailing list


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add Norbert Klasen's patch (via Del) to fix searches using ldaps URLs
    (OpenLDAP ITS #889)
  - add "-h ldaps:///" to server init when TLS is enabled, in order to support
    ldaps in addition to the regular STARTTLS (suggested by Del)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - reorganize the patch list to separate MigrationTools and OpenLDAP patches
  - switch to Luke Howard's rfc822MailMember schema instead of the aliases.schema
  - configure slapd to run as the non-root user "ldap" (#19370)
  - chdir() before chroot() (we don't use chroot, though) (#19369)
  - disable saving of the pid file because the parent thread which saves it and
    the child thread which listens have different pids


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add missing required attributes to conversion scripts to comply with schema
  - add schema for mail aliases, autofs, and kerberosSecurityObject rooted in
    our own OID tree to define attributes and classes migration scripts expect
  - tweak automounter migration script


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - try adding the suffix first when doing online migrations
  - force ldapadd to use simple authentication in migration scripts
  - add indexing of a few attributes to the default configuration
  - add commented-out section on using TLS to default configuration


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.0.6
  - add buildprereq on cyrus-sasl-devel, krb5-devel, openssl-devel
  - take the -s flag off of slapadd invocations in migration tools
  - add the cosine.schema to the default server config, needed by inetorgperson


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add the nis.schema and inetorgperson.schema to the default server config
  - make ldapadd a hard link to ldapmodify because they're identical binaries


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - build a semistatic slurpd with threads, everything else without
  - disable reverse lookups, per email on OpenLDAP mailing lists
  - make sure the execute bits are set on the shared libraries


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - split off clients and servers to shrink down the package and remove the
    base package's dependency on Perl
  - make certain that the binaries have sane permissions


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - switch to gdbm; I'm getting off the db merry-go-round
  - tweak the init script some more
  - add instdir to @INC in migration scripts


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - tweak init script to return error codes properly
  - change initscripts dependency to one on /etc/init.d


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 1.2.11
  - add condrestart logic to init script
  - munge migration scripts so that you don't have to be 
    /usr/share/openldap/migration to run them
  - add code to create pid files in /var/run


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - more minimalistic fix for bug #11111 after consultation with OpenLDAP team
  - backport replacement for the ldapuser patch


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 1.2.10
  - add revamped version of patch from kos@bastard.net to allow execution as
    any non-root user
  - remove test suite from %build because of weirdness in the build system


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - move the defaults for databases and whatnot to /var/lib/ldap (bug #10714)
  - fix some possible string-handling problems


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add -D_REENTRANT to make threaded stuff more stable, even though it looks
    like the sources define it, too
  - mark *.ph files in migration tools as config files


author: Bill Nottingham <notting@redhat.com>
changelog:
  - update to 1.2.7
  - fix some bugs from bugzilla (#4885, #4887, #4888, #4967)
  - take include files out of base package


author: Jiri Popelka <jpopelka@redhat.com> - 4.0.4-5
changelog:
  - Also consider back tick and semicolon as illegal shell escape characters.
  - CVE-2015-8327, CVE-2015-8560


author: Tim Waugh <twaugh@redhat.com> - 4.0.4-3
changelog:
  - Too few arguments for format in a debugging string (bug #726385).
  - Fixed perl installation locations for build (bug #661770).


author: Tim Waugh <twaugh@redhat.com> - 4.0.4-2
changelog:
  - Applied patch to fix improper sanitization of command line options
    (CVE-2011-2964, bug #727016).


author: Tim Waugh <twaugh@redhat.com> - 4.0.4-1
changelog:
  - Updated to 4.0.4 (bug #570234).  No longer buildrequires
    ghostscript-devel (but requires ghostscript) or
    foomatic-filters-int-options patch.


author: Tim Waugh <twaugh@redhat.com> - 4.0.3-10
changelog:
  - Removed old explicit provides for perl(Foomatic::GrovePath).
  - Fixed macro in changelog.
  - Avoid mixed spaces and tabs.
  - Ship COPYING files.
  - Added comments for sources.
  - Use Requires not PreReq (bug #225768).


author: Tim Waugh <twaugh@redhat.com> 4.0.2-5
changelog:
  - Use stcolor driver for Epson Stylus Color 200 (bug #513676).
  - Don't ship 3-distribution symlink as CUPS already searches
    /usr/share/ppd (bug #514244).
  - Remove non-PPD files from PPD directory (bug #514242).


author: Tim Waugh <twaugh@redhat.com> 4.0.2-1
changelog:
  - Updated db-engine to 4.0.2 (bug #503188).
  - Updated foomatic-filters to 4.0.2 (bug #496521).
  - Updated db-hpijs to 20090701.
  - Updated db to 4.0-20090702.
  - This package obsoletes oki4linux (bug #491489).
  - Don't ship ChangeLog/README/USAGE for each of the 4 packages as it
    comes to more than 1MB (bug #492449).
  - Don't use mktemp in foomatic-rip.


author: Tim Waugh <twaugh@redhat.com> 3.0.2-69
changelog:
  - Updated db-hpijs to 20090110.
  - Updated db to 20090110.
  - Updated filters to 3.0-20090110.
  - Updated db-engine to 3.0-20090110.


author: Tim Waugh <twaugh@redhat.com> 3.0.2-68
changelog:
  - Updated db-hpijs to 20081124.
  - Updated db to 20081124.
  - Updated filters to 3.0-20081124.
  - Updated db-engine to 3.0-20081124.
  - Better build root.
  - Fixed summary.


author: Tim Waugh <twaugh@redhat.com> 3.0.2-65
changelog:
  - Removed ampathxml and xml-cflags patches.
  - Updated db-hpijs to 20080904.
  - Updated db to 20080904.
  - Updated filters to 3.0-20080904.
  - Updated db-engine to 3.0-20080904.


author: Tim Waugh <twaugh@redhat.com> 3.0.2-61
changelog:
  - Updated db-hpijs to 20080710.
  - Updated db to 20080710.
  - Updated filters to 3.0-20080710.
  - Updated db-engine to 3.0-20080710.
  - Ship a defaultspooler file to avoid the need for spooler
    auto-detection (bug #454684).


author: Tim Waugh <twaugh@redhat.com> 3.0.2-56
changelog:
  - Updated filters to 3.0-20080211.
  - Updated db-hpijs to 20080211.
  - Updated db-engine to 3.0-20080211.
  - Updated db to 3.0-20080211.


author: Tim Waugh <twaugh@redhat.com> 3.0.2-53
changelog:
  - Updated db-hpijs to 20071218.
  - Updated db to 3.0-20071218.
  - Updated db-engine to 3.0-20071218.
  - Updated filters to 3.0-20071218 (bug #416881).


author: Tim Waugh <twaugh@redhat.com> 3.0.2-51
changelog:
  - Build requires perl(ExtUtils::MakeMaker).
  - Updated filters to 3.0-20070919.
  - Updated db to 20070919.


author: Tim Waugh <twaugh@redhat.com> 3.0.2-50
changelog:
  - Removed references to unshipped drivers:
    * drv_x125
    * ml85p
    * pbm2lxwl
    * pbmtozjs
    * bjc800j


author: Tim Waugh <twaugh@redhat.com> 3.0.2-49
changelog:
  - Safe default margins for PPDs (bug #244161).
  - Added missing IEEE 1284 ID for HP Photosmart 380 (bug #241352).


author: Tim Waugh <twaugh@redhat.com> 3.0.2-48
changelog:
  - Updated db to 3.0-20070614.
  - Updated db-engine to 3.0-20070614.
  - Updated db-hpijs to 20070614.
  - Updated filters to 3.0-20070614.


author: Tim Waugh <twaugh@redhat.com> 3.0.2-43
changelog:
  - Updated db to 3.0-20070105 (bug #214037, bug #191661, bug #198999,
    bug #191504, bug #187387, bug #188762, bug #170373, bug #221121,
    bug #214801).


author: Tim Waugh <twaugh@redhat.com> 3.0.2-39
changelog:
  - Updated db-engine to 3.0-20061031.
  - Updated db to 3.0-20061031.
  - Remove references to foo2zjs and foo2oak (bug #208851).


author: Tim Waugh <twaugh@redhat.com> 3.0.2-38
changelog:
  - Change a2ps requirement to mpage.
  - Make CUPS driver work with drivers containing '-' in their names
    (bug #201398).


author: Tim Waugh <twaugh@redhat.com> 3.0.2-32
changelog:
  - Fix foomatic-cleanupdrivers.
  - Updated db-engine to 3.0-20060117.
  - Handle PPDs with default option values of '0'.


author: Tim Waugh <twaugh@redhat.com> 3.0.2-29
changelog:
  - Updated db-engine to 3.0-20051209.
  - Updated db-hpijs to 1.5-20051209.
  - Updated filters to 3.0-20051209.  No longer need rip-cvs patch.
  - Updated db to 3.0-20051209.


author: Tim Waugh <twaugh@redhat.com> 3.0.2-28
changelog:
  - Remove explicit perl module package dependencies.  These should be
    picked up by the RPM during the build process automatically anyway.
    Fixes bug #167997.


author: Tim Waugh <twaugh@redhat.com> 3.0.2-25
changelog:
  - Add IEEE 1284 ID for HP LaserJet 4200 (bug #166638).
  - Add IEEE 1284 ID for HP LaserJet 5000 (bug #167154).


author: Tim Waugh <twaugh@redhat.com> 3.0.2-24
changelog:
  - Updated db to 3.0-20050804.
  - No longer need hplj5 patch.
  - Conflicts with system-config-printer before the parser bug was fixed.


author: Tim Waugh <twaugh@redhat.com>
changelog:
  - Add IEEE 1284 ID for Epson Stylus Photo 915 (bug #160030).
  - Add IEEE 1284 ID for Ricoh Aficio 2228C PS (bug #160036).


author: Tim Waugh <twaugh@redhat.com>
changelog:
  - Fix Postscript driver (bug #151645).
  - Add IEEE 1284 ID for HP DeskJet 5150 (bug #154518).
  - Add IEEE 1284 ID for HP LaserJet 2420 (bug #114191).


author: Tim Waugh <twaugh@redhat.com>
changelog:
  - Corrected IEEE 1284 information for HP DeskJet 6540 (bug #147288).
  - Added IEEE 1284 information for Epson Stylus C82 (bug #147230).


author: Tim Waugh <twaugh@redhat.com>
changelog:
  - Added IEEE 1284 information for Okidata Okipage 6ex (bug #143964).
  - Added IEEE 1284 information for Epson Stylus Photo R300 (bug #143939).


author: Tim Waugh <twaugh@redhat.com> 3.0.2-10
changelog:
  - Added IEEE 1284 information for HP-Color_Inkjet_Printer_CP1700 (bug #141594).
  - Added IEEE 1284 information for Samsung-ML-1710 (bug #141163).
  - Added IEEE 1284 information for HP-OfficeJet_G95 (bug #141057).


author: Tim Waugh <twaugh@redhat.com> 3.0.2-9
changelog:
  - Updated db to 20041124.
  - Updated hpijs-db to 1.5-20041124.
  - No longer need HP DJ 6122 patch.
  - No longer need ieee1284 patch.
  - Updated Omni-printers to 0.9.2.


author: Tim Waugh <twaugh@redhat.com> 3.0.2-6
changelog:
  - Add autodetect information for HP LaserJet 8150 (bug #139683).
  - Add autodetect information for Epson Stylus Color 777 (bug #139629).


author: Tim Waugh <twaugh@redhat.com> 3.0.2-5
changelog:
  - Ship data as non-executable (bug #139271).
  - Corrected autodetect information for HP Business InkJet 1100 (bug #139258).


author: Tim Waugh <twaugh@redhat.com> 3.0.2-4
changelog:
  - Add autodetect information for HP Business InkJet 1100 (bug #139258).
  - Add autodetect information for Epson Stylus Photo 790 (bug #139266).
  - Add autodetect information for HP DJ 3820 (bug #139271).


author: Tim Waugh <twaugh@redhat.com> 3.0.2-2
changelog:
  - Use gimp-print driver for HP 2000C (bug #133647).
  - Add autodetect information for Lexmark Z52 (bug #135178).


author: Tim Waugh <twaugh@redhat.com> 3.0.2-1
changelog:
  - Updated filters to 3.0.2.
  - Updated db-engine to 3.0.2.
  - No longer need Omni PageSize patch or lvalue patch.


author: Tim Waugh <twaugh@redhat.com> 3.0.1-1
changelog:
  - Upgrade db to 20040219.
  - Upgrade hpijs to 1.5-20040219.
  - Upgrade engine to 3.0.1.
  - Upgrade filters to 3.0.1.


author: Tim Waugh <twaugh@redhat.com> 3.0.0-23
changelog:
  - Fix up HP Color Inkjet CP1700 support.
  - Remove PrintoutMode option from gimp-print driver to avoid breaking it.
  - Update filters to 3.0.1rc3.
  - Update engine to 3.0.1rc2
  - No long need symlink patch.


author: Tim Waugh <twaugh@redhat.com> 3.0.0-21
changelog:
  - Build for Fedora Core 1 printer drivers update.
  - Revert Omni update temporarily.
  - Downgrade engine to 20031217 to stick to the stable branch.


author: Tim Waugh <twaugh@redhat.com> 3.0.0-19
changelog:
  - Build for Fedora Core 1 printer drivers update.
  - No longer need symlink patch.
  - Updated fontpath patch.
  - Updated engine to 20040112.
  - Updated db to 20040112.
  - Updated gimp-print data to 4.2.6.


author: Tim Waugh <twaugh@redhat.com> 3.0.0-18
changelog:
  - Build for Fedora Core 1 printer drivers update.
  - Explicitly state conflict with hpijs < 1.5.
  - Make foomatic-ppdfile accept '-t type' like foomatic-datafile used to.


author: Tim Waugh <twaugh@redhat.com> 3.0.0-14
changelog:
  - Updated db to 20031217.
  - Updated engine to 20031217.
  - Updated hpijs to 1.5-20031217.
  - Use relative symlinks.


author: Tim Waugh <twaugh@redhat.com> 3.0.0-12
changelog:
  - Undo over-zealous percent escaping in PostScript.xml
  - Build requires libxml2-devel (bug #110589).
  - Use relative, not absolute, symlink for CUPS filter.


author: Tim Waugh <twaugh@redhat.com> 3.0.0-10
changelog:
  - Updated db to 20031105.
  - Drop filters path patch.
  - Updated fontpath patch, both libdir patches.
  - Updated engine and filters to 3.0-20031105.
  - Updated hpijs db to 1.4-1.


author: Tim Waugh <twaugh@redhat.com> 3.0.0-5
changelog:
  - Add some Dell printers.
  - Updated foomatic-db to 20030603.
  - Updated missing UPP list for ghostscript 7.07.


author: Tim Waugh <twaugh@redhat.com> 3.0.0-0.beta2.1
changelog:
  - 3.0.0beta2.
  - Updated path patch.
  - No longer need FOOMATIC_LIBDIR, generic PS, ids, postscript-duplex,
    hpijs13, psc2210, duplex184 patches.
  - Add hpijs support back in.
  - Fix up references to old printer IDs.


author: Tim Waugh <twaugh@redhat.com> 2.0.2-11
changelog:
  - Add autodetect info for HP DeskJet 656C.  It doesn't really do
    IEEE 1284 IDs, but since it's a USB device we can figure out its
    manufacturer and model anyway.


author: Tim Waugh <twaugh@redhat.com> 2.0.2-1
changelog:
  - 2.0.2.
  - No longer need 67973, 970c patches.
  - Remove cups-drivers-* packages (no longer needed).
  - Remove files not shipped.  Ship filter.conf.
  - Conditionally restart cups.
  - Use libdir.
  - Don't put things in site_perl; use vendor_perl instead (bug #73528).


author: Tim Waugh <twaugh@redhat.com> 1.9-0.20020517.3
changelog:
  - Remove explicit perl-Storable dependency; it should be perl(Storable),
    and that is picked up automatically.


author: Tim Waugh <twaugh@redhat.com> 1.9-0.20020517.2
changelog:
  - Fix release number.
  - Drop gen-ppds from the file manifest---use foomatic-compiledb instead
    (bug #63622).


author: Tim Waugh <twaugh@redhat.com> 1.9-0.20020517.0.1
changelog:
  - Update to CVS.
  - Updated requirements.
  - Updated path and libdir patches.
  - Drop hpijs 1.0.2 patch.
  - foomatic-datafile has moved to %{_bindir}.
  - Update gimp-print data to 4.2.1.
  - Update Omni printer data to 0.6.1.


author: Tim Waugh <twaugh@redhat.com> 1.1-0.20020130.1
changelog:
  - Update to CVS.
  - No longer need the cachedir patch.
  - Fix config file path.
  - Look in /usr/local/bin last, not first, in lpdomatic (bug #57915).


author: Tim Waugh <twaugh@redhat.com> 1.1-0.20020129.1
changelog:
  - Update to CVS.
  - Patches no longer needed: prepend, fd3.
  - Use RPM_OPT_FLAGS.
  - Allow non-root users to use foomatic-datafile (bug #58956).


author: Tim Waugh <twaugh@redhat.com> 1.1-0.20020124.1
changelog:
  - Update to CVS.
  - Updated Omni printers to those in Omni 0.5.1.
  - Updated patches: prepend, fd3.
  - Patches no longer needed: utf8, lpdomatic.
  - Added gimp-print (formerly stp) foomatic db info, and removed the old
    stp.xml file.
  - Conflict with ghostscript if it doesn't have gimp-print-4.2.0 yet.


author: Tim Waugh <twaugh@redhat.com> 1.1-0.20011218.2
changelog:
  - REALLY fix PCL fixup code (bug #55909, others).
  - PreReq fileutils, initscripts (bug #56984).
  - Fix prepends in lpdomatic (bug #57371).
  - Run foomatic-cleanupdrivers during install, to remove driver entries
    with no command line.
  - Put lpdomatic in /usr/sbin again.
  - Fix foomatic-gswrapper's file descriptor manipulations (bug #56871).


author: Crutcher Dunnavant <crutcher@redhat.com> 1.1-0.20011217.2
changelog:
  - fix the rest of the quoting issues with foomatic-combo-xml with the patch
  - foomatic-1.1-20011217-quotes.patch. This has been sent upstream.


author: Crutcher Dunnavant <crutcher@redhat.com> 1.1-0.20011217.1
changelog:
  - respin to pull in latest foomatic database, fixes:
    - properly use the cache in relation to foomatic-combo-xml's output
    - fix _some_ of the quoting issues with calling foomatic-combo-xml


author: Crutcher Dunnavant <crutcher@redhat.com> 1.1-0.20011205.1
changelog:
  - respin to pull in latest foomatic database, fixes:
    - droping half of a large job
    - -Mutf8 added to the upstream filters
    - miscelaneous printer db updates


author: Crutcher Dunnavant <crutcher@redhat.com> 1.1-0.20011018.5
changelog:
  - changed the patch to use the -Mutf8 command line option,
  - and to restart the printserver, after rebuilding the settings.


author: Crutcher Dunnavant <crutcher@redhat.com> 1.1-0.20011018.4
changelog:
  - grumble. Some drivers use inline perl scripts, and need the 'use utf8;'
  - pragma. Without it, they break on _some_ of their options.


author: Crutcher Dunnavant <crutcher@redhat.com> 1.1-0.20010905.1
changelog:
  - upgraded to latest foomatic, we now have fast overview generation!
  - this means that there is no prebuilt overview file.


author: Crutcher Dunnavant <crutcher@redhat.com> 1.1-0.20010828.1
changelog:
  - WOW! The latest foomatic uses Till Kamppeter's C based combo compiler.
  - It is now fast enough that there is no real benifit to precompiling.
  - NOTE: this forces the package to stop being noarched.


author: Crutcher Dunnavant <crutcher@redhat.com> 1.1-0.20010825.1
changelog:
  - did a fresh database pull, which contains the old japanese printers as well.
  - removed japanese hack.


author: Till Kamppeter <till@mandrakesoft.com> 1.1-0.20010717mdk
changelog:
  - Added job listing/removal/manipulation and queue control to
    foomatic-printjob
  - Support for printing multiple copies with PDQ


author: Till Kamppeter <till@mandrakesoft.com> 1.1-0.20010714mdk
changelog:
  - Included the cupsomatic filter script
  - When a queue is set up, default options can be set now
  - Help messages of foomatic-configure and foomatic-printjob cleaned up.


author: Till Kamppeter <till@mandrakesoft.com> 1.1-0.20010713mdk
changelog:
  - Many bugfixes in "foomatic-printjob".
  - "foomatic-configure" adds the Foomatic config file directory automatically
    to the search paths of PDQ.
  - Printing a help page under PDQ was broken.


author: Till Kamppeter <till@mandrakesoft.com> 1.1-0.20010711mdk
changelog:
  - initial release.
  - Deleted the obsolete drivers "stp", "cZ11", and "hpdj".
  - Patch applied which flushes the memory cache regularly, otherwise
    foomatic-configure would hang when the Foomatic data of GIMP-Print is
    installed.


author: Parag <paragn@fedoraproject.org> - 4.0.3-9
changelog:
  - Merge-Review #226071
  - Removed XFree86-libs, xorg-x11-libs, XFree86-devel, xorg-x11-devel as Obsoletes
  - Removed BR:pkgconfig
  - spec cleanups


author: Mike A. Harris <mharris@redhat.com> 4.0.1-2
changelog:
  - Added "BuildRequires: xorg-x11-proto-devel >= 7.0-7" for "fixesproto >= 4.0"
  - Added "Requires: xorg-x11-proto-devel >= 7.0-7" for "fixesproto >= 4.0"
    to devel package, needed by xfixes.pc
  - Replace "makeinstall" with "make install DESTDIR=..."
  - Remove package ownership of mandir/libdir/etc.


author: Mike A. Harris <mharris@redhat.com> 3.0.1.1-1
changelog:
  - Updated libXfixes to version 3.0.1.1 from X11R7 RC3
  - Added "Requires(pre): xorg-x11-filesystem >= 0.99.2-3", to ensure
    that /usr/lib/X11 and /usr/include/X11 pre-exist.
  - Removed 'x' suffix from manpage directories to match RC3 upstream.


author: Mike A. Harris <mharris@redhat.com> 3.0.1-1
changelog:
  - Updated libXfixes to version 3.0.1 from X11R7 RC2
  - Changed 'Conflicts: XFree86-devel, xorg-x11-devel' to 'Obsoletes'
  - Changed 'Conflicts: XFree86-libs, xorg-x11-libs' to 'Obsoletes'


author: Robert Scheck <robert@fedoraproject.org> 1.13-1
changelog:
  - Upgrade to 1.13 (#290531, #332201, #425803)
  - Solved multilib problems at doxygen generated files (#342921)


author: Robert Scheck <robert@fedoraproject.org> 1.12-3
changelog:
  - Added buildrequirement to graphviz (#249352)
  - Backported bugfixes from CVS (#102254, #135428 and #178413)


author: Robert Scheck <robert@fedoraproject.org> 1.12-2
changelog:
  - Move libpopt to /lib[64] (#249814)
  - Generate API documentation, added buildrequirement to doxygen


author: Šimon Lukašík <slukasik@redhat.com> - 1.2.7-1
changelog:
  - upgrade to the latest upstream release (#1259037)
  - Introduced '--verbose' mode (#1287295)
  - Detailed OVAL results present in HTML report (#1140240)
  - fixed issues in scap-as-rpm tool (#1226398, #1258958)
  - introduced support for non-decimal OVAL vetsions (#1248378)
  - 'oscap oval eval --report' command (#1258958)
  - 'oscap xccdf generate --profile <custom-profile> guide' (#1139822)


author: Šimon Lukašík <slukasik@redhat.com> - 1.0.0-2
changelog:
  - dlopen libopenscap_sce.so.{current-age} explicitly
    That allows for SCE to work without openscap-engine-sce-devel


author: Ondrej Vasik <ovasik@redhat.com> - 4.0-6
changelog:
  - fix the split-core stuff to allow benefits from it, use
    versioned/arched requirements for the subpackages
  - file /etc/lsb-release should be present on the system
  - Resolves: Bug 833058


author: Lawrence Lim <llim@redhat.com> - 4.0-3
changelog:
  - apply redhat-lsb.spec.diff-stewb <Stew Benedict - stewb@linuxfoundation.org>
  - Resolved: Bug 585947


author: Hao Liu <hliu@redhat.com> 3.2-1
changelog:
  - Port forward to LSB 3.2
  - Remove symlink for mailx if user is upgrading from the redhat-lsb of older version 
  - Since F10 put mailx under /usr/bin, change the corresponding requires


author: Hao Liu <hliu@redhat.com> - 3.1-22
changelog:
  - Remove 2 requires which provided by redhat-lsb
  - Add comments explaining why hard-coded path is kept
  - Resolve some hard-coded path problems
  - Add comments explaining why importing '-static' option while compiling redhat_lsb_trigger
  - Replace /usr/lib/lsb with /usr/lib/lsb
  - Replace /lib/* with /lib/*so*
  - Replace /lib/lsb with /lib/lsb*


author: Lawrence Lim <llim@redhat.com> - 3.1-16
changelog:
  - update spec file in accordance to feedback provided through merge review - merge-review.patch - #226363


author: Lawrence Lim <llim@redhat.com> - 3.1-15.f8
changelog:
  - Resolved: #239842 - /lib/lsb/init-functions shall use aliases but not functions
  - forward port the patch from 3.1-12.3.EL which fix #217566, #233530, #240916


author: Lawrence Lim <llim@redhat.com> - 3.1-12.3.EL
changelog:
  - Resolves: #217566 - rewrite /lib/lsb/init-functions file needs to define the commands as true shell functions rather than aliases.
  - Resolves: #233530 - LSB pidofproc misspelled as pidofprof.
  - Resolves: #240916 - "log_warning_message" replaced with "log_warning_msg" per the LSB 3.1 spec


author: Lawrence Lim <llim@redhat.com> - 3.1-10.2
changelog:
  - for some strange reason, ld-lsb-x86-64.so need to be ld-lsb-x86-64.so.3 (LSB3.0) rather than ld-lsb-x86-64.so.3.1 (LSB3.1)


author: Lawrence Lim <llim@redhat.com> - 3.1-10.1
changelog:
  - generate spec file on RHEL5-Alpha system
  - fix vsw4 test suite setup by creating symlink for X11 SecurityPolicy and XFontPath


author: Lawrence Lim <llim@redhat.com> - 3.0-10
changelog:
  - Rewrite most part of the mkredhat-lsb to obtain information directly via specdb 
    rather than sniffing through sgml
  - remove redundent script and bump up tarball version


author: Leon Ho <llch@redhat.com> 3.0-7.EL
changelog:
  - Fixed multilib problem on lsb_release not to read /etc/lsb-release and solely
    depends on /etc/lsb-release.d/ (Advised by LSB committee)
  - Removed /etc/lsb-release (Advised by LSB committee)


author: Leon Ho <llch@redhat.com> 3.0-6.EL
changelog:
  - Made the /etc/lsb-release useful (RH#154605)
  - Added redhat_lsb_trigger to fix RH#160585 (Jakub Jelinek)
  - Fixed AMD64 base libraries requirement parsing (RH#154605)


author: Leon Ho <llch@redhat.com> 1.3-9
changelog:
  - Sync what we have changed on the branches
    Wed Nov 24 2004 Harald Hoyer <harald@redhat.com>
    - added post section to recreate the softlink in emul mode (bug 140739)
    Mon Nov 15 2004 Phil Knirsch <pknirsch@redhat.com>
    Tiny correction of bug in new triggers


author: Jakub Jelen <jjelen@redhat.com> - 5.3p1-122
changelog:
  - Allow to use ibmca crypto hardware (#1397547)
  - CVE-2015-8325: privilege escalation via user's PAM environment and UseLogin=yes (1405374)


author: Jakub Jelen <jjelen@redhat.com> - 5.3p1-120
changelog:
  - Prevent infinite loop when Ctrl+Z pressed at password prompt (#1218424)
  - Remove RC4 cipher and MD5 based MAC from the default client proposal (#1373836)


author: Jakub Jelen <jjelen@redhat.com> - 5.3p1-119
changelog:
  - Resolve sftp force permission colision with umask (#1341747)
  - Relax bits needed check to allow hmac-sha2-512 with gss-group1-sha1- (#1353359)
  - close ControlPersist background process stderr when not in debug mode (#1335539)
  - Do not add a message "The agent has no identities." in ~/.ssh/authorized_keys (#1353410)


author: Kamil Dudka <kdudka@redhat.com> 2.2.49-6
changelog:
  - add function acl_extended_file_nofollow() (#720318)
  - build with partial RELRO support as a security enhancement (#723998)


author: Kamil Dudka <kdudka@redhat.com> 2.2.49-5
changelog:
  - clarify that removing a non-existent acl entry is not an error (#674883)
  - update project URL in package specification (#702638)


author: Kamil Dudka <kdudka@redhat.com> 2.2.49-3
changelog:
  - prevent setfacl --restore from SIGSEGV on malformed restore file (#576512)
  - run the test-suite if possible


author: Karsten Hopp <karsten@redhat.com> 2.2.39-3
changelog:
  - fix buildroot
  - remove trailing dot from summary
  - -devel requires same version of libacl
  - escape macro in changelog
  - make .so symlink relative


author: Thomas Woerner <twoerner@redhat.com> 2.2.39-1
changelog:
  - new version 2.2.39
  - fixed usage of long UTF-8 filenames (#183181)
    Thanks to Andrey for the initial patch.


author: Stephen C. Tweedie <sct@redhat.com> 2.2.7-3
changelog:
  - Add /usr/include/acl to files manifest
  - Fix location of doc files, add main doc dir to files manifest


author: Michael K. Johnson <johnsonm@redhat.com> 2.0.11-1
changelog:
  - Initial Red Hat package
    Made as few changes as possible relative to upstream packaging to
    make it easier to maintain long-term.  This means that some of
    the techniques used here are definitely not standard Red Hat
    techniques.  If you are looking for an example package to fit
    into Red Hat Linux transparently, this would not be the one to
    pick.
  - acl-devel -> libacl-devel


author: Shelly Ma <shelly.ma@oracle.com> - 3.3.1-17.el6.6.2
changelog:
  - Revert change that disables lldpad package by default for 3.3.5 release
    foce depends on lldpad; impact to be evaluated for future release
    Acknowledged by Adnan Misherfi <adnan.misherfi@oracle.com> [bug 25254085]


author: Shelly Ma <shelly.ma@oracle.com> - 3.3.1-17.el6.6.1
changelog:
  - Diable lldpad by default
    Acknoledged by Adnan Misherfi<adnan.misherfi@oracle.com> [bug 25254085]


author: Joe Jin <joe.jin@oracle.com> - 3.3.1-17.el6.6
changelog:
  - If dom0 has less than 8 CPUs, xen_netback max_queues in
    /etc/modproble.d/ovs.conf should match dom0 CPU number
    for best performance.
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Joe Jin <joe.jin@oracle.com> [bug 22817196]


author: Patsy Franklin <pfrankli@redhat.com> - 2.12.1.107.3
changelog:
  - Consistantly MANGLE/DEMANGLE function pointers and
      fix use after free in dcigettext.c (#989558).


author: Jeff Law <law@redhat.com> - 2.12-1.107
changelog:
  - Simplify test for magic file to change memcpy behaviour
      and correctly handle encoded return value from inlined
      syscall (#846342, #874642)
    -


author: Jeff Law <law@redhat.com> - 2.12-1.104
changelog:
  - Change from magic environment variable to existance of
      magic file /etc/sysconfig/32bit_ssse3_mempy_via_32bit_ssse3_memmove
      to trigger change in memcpy behavior. (#846342, #865375)
    - Fix IPTOS_CLASS #define. (#864322)


author: Jeff Law <law@redhat.com> - 2.12-1.99
changelog:
  - Allow broken code to avoid the 32 bit SSSE3 memcpy implementations
      by setting the environment variable
      32BIT_SSSE3_MEMCPY_VIA_32BIT_SSSE3_MEMMOVE to any value (#846342)


author: Patsy Franklin <pfrankli@redhat.com> - 2.12-1.98
changelog:
  - Backport upstream glibc 4f031072a5055abd83717820b59efdaa463d5853
      locale/findlocale.c (_nl_find_locale): Return right away if
      _nl_explode_name failed.
      locale/programs/locarchive.c (add_locale_to_archive): Likewise. (#848082)


author: Jeff Law <law@redhat.com> - 2.12-1.97
changelog:
  - Fix handling of variable length characters in recent fseek
      fseek changes.  Fix testcase to include string.h which
      avoids failures on s390[x] and ppc (#827362).


author: Jeff Law <law@redhat.com> - 2.12-1.96
changelog:
  - Increase size of temporary buffers to avoid unnecessary DNS
      lookups (#837695)
    - Properly handle case where server rejects query (#804686)


author: Patsy Franklin <pfrankli@redhat.com> - 2.12-1.92
changelog:
  - Mark /etc/rpc as a configuration file in glibc.spec. (#829222)
    - Fix for unpredictable results with some non-default 
      floating point rounding modes.. (#837918)


author: Patsy Franklin <pfrankli@redhat.com> - 2.12-1.89
changelog:
  - Delay setting file->decided until we have successfully loaded the file's data. (#832516)
    - FIX vfprintf() to return EOVERFLOW (not ERANGE) when the (INT_MAX/4)th or larger argument 
      is specified in the format string. (#830127)


author: Jeff Law <law@redhat.com> - 2.12-1.86
changelog:
  - Pack IPv4 servers at the start of nsaddr_list and
      only track the number of IPV4 servers in EXT(statp)->nscount
      Thanks to Michael Chapman (#841787)


author: Patsy Franklin <pfrankli@redhat.com> - 2.12-1.84
changelog:
  - Fix fnmatch() failure when '*' wildcard was applied on a file name 
      containing multi-byte character(s) (#826149)


author: Patsy Franklin <pfrankli@redhat.com> - 2.12-1.83
changelog:
  - Fix for iconv() segfault when the invalid multibyte character 0xffff is input while 
      converting from IBM930 (#823909).


author: Jeff Law <law@redhat.com> - 2.12-1.78
changelog:
  - Fix option rotate with single IPV6 server (#804630)
    - Fix loading first object along a path when tracing (#808337)
    - Don't free non-malloced memory.  (#809602)


author: Jeff Law <law@redhat.com> - 2.12-1.74
changelog:
  - Correctly handle large response to AF_UNSPEC dns lookup (#795498)
    - Always use another area after a failed allocation in the
     main arena (#795328)


author: Jeff Law <law@redhat.com> - 2.12-1.68
changelog:
  - Disable 552960 changes again, they're still not right.
    - Fix locking on malloc family retry paths (#789238)


author: Jeff Law <law@redhat.com> - 2.12-1.66
changelog:
  - Fix lost wakeups in pthread_cond_*, reenable 552960 patch (#552960)
    - Fix resolv.conf parsing for ipv6 (#789189)
    - Fix nscd crash when group has many members (#788959)
    - Fix Ukrainian currency symbol (#789209)


author: Kyle VanderBeek <kylev@kylev.com> - 2.0.9-1
changelog:
  - Update to 2.0.9
  - Make sure to require gcc to the speedups get compiled
  - Fix description since we're not "pure" python
  - Change to pypi instead of cheesehop


author: Adnan Misherfi <adnan.misherfi@oracle.com> - 1.0-48
changelog:
  - Since bond interfaces do not have hardware sensing of their own , use IFF_UP and IFF_RUNNING
    to determine its status. [bug 17952899]


author: Adnan Misherfi <adnan.misherfi@oracle.com> - 1.0-28
changelog:
  - re-write the link state detection code to handle virtual nics link state correctly  (enics). [bug 14402887]


author: Adnan Misherfi <adnan.misherfi@oracle.com> - 1.0-22
changelog:
  - Changed devmon to use the interface flags (IFF_UP,IFF_DOWN) to determine
    bond link change instead of ethtool/or MII, as bond interfaces are logical
    and their link state can not be detected. [bug 12904169]


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 1.0-20
changelog:
  - change license to gplv2
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Kurt Hackel <kurt.hackel@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com> [bug 12737215]


author: Adnan Misherfi <adnan.misherfi@oracle.com> - 1.0-17
changelog:
  - Remove code that handle a case of REM_DM processing which is not applicable to OVS.
    It causes extra empty REM_DM messages be sent while they where already handled [bug 12426402]


author: Adnan Misherfi <adnan.misherfi@oracle.com> - 1.0-16
changelog:
  - I used iscsiadm -m node -p 10.196.210.25 --login/logout over 50 times to present/un-present
    10 ISCSI LUNs. The result was good every time. If you still see a missing ADD_SD,
    then I will needed your test environment for a few hours. [bug 12573959]


author: Adnan Misherfi <adnan.misherfi@oracle.com> - 1.0-13
changelog:
  - give multipathd a chance to catch up first fefore sending ADD SD otherwise we 
  may miss the event. [bug 12573959]


author: Adnan Misherfi <adnan.misherfi@oracle.com> - 1.0-12
changelog:
  - Devmon does not fork python processes to storage_discover any more. This should
    reduce the amount of memory consumed during LUN present/un-present.
    The test should be repeated to see how much was gained.
    OraclBug:12418855


author: Adnan Misherfi <adnan.misherfi@oracle.com> - 1.0-11
changelog:
  - A connection time is a result of a bad connection to the target, which caused devmon
    to exit at start up time. I changed the logic so that devmon will not exit and tries
    again during its main loop. [bug 11878958]


author: Adnan Misherfi <adnan.misherfi@oracle.com> - 1.0-7
changelog:
  - Stop the reaper thread from running, it is removing the DMs after all the SDs under it are gone.
    This is not needed for this product.


author: Adnan Misherfi <adnan.misherfi@oracle.com> - 1.0-6
changelog:
  - Fix xenstored hang which made xend appears to be hanging. The problem was caused by
    devmon excessive access to xenstored that left many xenstored handle open.
    orabug:10155532


author: Adnan Misherfi <adnan.misherfi@oracle.com> - 1.0-4
changelog:
  - Redirect PyErr_Print output to a string to catch agent_notify exception
    start devmon automatically at boot time.


author: Cathy Avery <cathy.avery@oracle.com> - 1.0-2
changelog:
  - devmon was routing udev events to udev2multipathd daemon so it would not see
  the storage or iscsi events.


author: Joe Orton <jorton@redhat.com> 0.6.14-5
changelog:
  - fix DT_RPATH in /usr/bin/idn
  - convert libidn.iconv to UTF-8 (Jon Ciesla, #226029)
  - fix BuildRoot tag (Jon Ciesla, #226029)


author: Sergio Durigan Junior <sergiodj@redhat.com> - 7.2-83.el6
changelog:
  - Fix 'gdb internal error' [Threaded program calls clone, which
    crashes GDB] (Pedro Alves, RH BZ 1099929).


author: Sergio Durigan Junior <sergiodj@redhat.com> - 7.2-82.el6
changelog:
  - Fix 'gdb/linux-nat.c:1411: internal-error:
   linux_nat_post_attach_wait: Assertion `pid == new_pid' failed.'
   (Pedro Alves, RH BZ 1162264).


author: Sergio Durigan Junior <sergiodj@redhat.com> - 7.2-81.el6
changelog:
  - Fix 'backport GDB 7.4 fix to RHEL 6.6 GDB' [Original Sourceware bug
    description: 'C++ (and objc): Internal error on unqualified name
    re-set', PR 11657] (RH BZ 1186476).


author: Sergio Durigan Junior <sergiodj@redhat.com> - 7.2-79.el6
changelog:
  - Fix 'gdb has a bug that prevents it from breaking in anonymous
    namespace functions.' (Keith Seitz, RH BZ 1139405).


author: Sergio Durigan Junior <sergiodj@redhat.com> - 7.2-78.el6
changelog:
  - Fix '`catch syscall' doesn't work for parent after `fork' is called'
    (Philippe Waroquiers, RH BZ 1149205).


author: Sergio Durigan Junior <sergiodj@redhat.com> - 7.2-75.el6
changelog:
  - Additional fixes needed by 'gdb crashes while thread apply all bt is
    run on the core file' (Jan Kratochvil, Tom Tromey, Paul Pluzhnikov,
    RH BZ 1104587).


author: Sergio Durigan Junior <sergiodj@redhat.com> - 7.2-74.el6
changelog:
  - Improve fix for 'gdb crashes while thread apply all bt is run on the core
    file' (RH BZ 1104587).


author: Sergio Durigan Junior <sergiodj@redhat.com> - 7.2-73.el6
changelog:
  - Fix 'gdb crashes while thread apply all bt is run on the core file'
    (Jan Kratochvil, RH BZ 1104587).


author: Sergio Durigan Junior <sergiodj@redhat.com> - 7.2-72.el6
changelog:
  - Fix '[RHEL6] Can't access TLS variables in statically linked binaries'
    (Jan Kratochvil, RH BZ 1080656).


author: Sergio Durigan Junior <sergiodj@redhat.com> - 7.2-71.el6
changelog:
  - Improve fix for 'gdb deadlock due to gdb calling calloc() in signal
    handler.', because it was failing on i686.  (Pedro Alves, RH BZ 913146).


author: Sergio Durigan Junior <sergiodj@redhat.com> - 7.2-70.el6
changelog:
  - Fix 'gdb deadlock due to gdb calling calloc() in signal handler.'
    (Jan Kratochvil, RH BZ 913146).


author: Sergio Durigan Junior <sergiodj@redhat.com> - 7.2-68.el6
changelog:
  - Fix 'gdb gives highly misleading error when debuginfo pkg is present,
    but not corresponding binary pkg' (Jan Kratochvil, backported from Fedora,
    RH BZ 981154).


author: Sergio Durigan Junior <sergiodj@redhat.com> - 7.2-66.el6
changelog:
  - Fix 'Add $_signo convenience variable'.  It is worth mentioning that the
    variable was finally named $_exitsignal instead of $_signo (RH BZ 971849).


author: Sergio Durigan Junior <sergiodj@redhat.com> - 7.2-64.el6
changelog:
  - Fix `gdb/findvar.c:417: internal-error: read_var_value: Assertion `frame'
    failed.' (Tom Tromey, RH BZ 947564).


author: Sergio Durigan Junior <sergiodj@redhat.com> - 7.2-60.el6
changelog:
  - Fix `GDB cannot access struct member whose offset is larger than 256MB'
    (Siddhesh Poyarekar, RH BZ 795424).


author: Sergio Durigan Junior <sergiodj@redhat.com> - 7.2-59.el6
changelog:
  - Fix `CVE-2011-4355 gdb: arbitrary code execution via .debug_gdb_scripts'
    (Jan Kratochvil, RH BZ 756116).


author: Sergio Durigan Junior <sergiodj@redhat.com> - 7.2-58.el6
changelog:
  - Fix `Cannot find new threads: generic error' (RH BZ 811648).
  - Delete gdb-core-threads-5of5.patch; rename gdb-core-threads-Nof5.patch to gdb-core-threads-Nof4.patch.


author: Sergio Durigan Junior <sergiodj@redhat.com> - 7.2-57.el6
changelog:
  - Fix `Backport gdb fix to handle identical binaries via additional build-id
    symlinks' (RH BZ 836966).


author: Jan Kratochvil <jan.kratochvil@redhat.com> - 7.2-51.el6
changelog:
  - Fix threading internal error on corrupted memory (BZ 739685).
  - Fix cp_scan_for_anonymous_namespace crash (Aleksandar Ristovski, BZ 750341).
  - testsuite: Fix break-interp.exp expections for updated glibc (BZ 752834).


author: Jan Kratochvil <jan.kratochvil@redhat.com> - 7.2-50.el6
changelog:
  - Fix dlopen of libpthread.so, updated glibc required (Gary Benson, BZ 669432).
    - SystemTap probes support (Sergio Durigan Junior, for BZ 669432).
  - Improve GDB performance on inferior dlopen calls (Gary Benson, BZ 698001).
  - Fix runtime evaluation of strings, for gdb -write (Tom Tromey, BZ 730475).
  - Fix dw2-simple-locdesc.S for better arch compatibility  (for BZ 702427).
  - Fix dw2-case-insensitive.exp compatibility with ppc64 (for BZ 669434).
  - Fix backport of core files PID also for s390x (for BZ 697900).


author: Jan Kratochvil <jan.kratochvil@redhat.com> - 7.2-49.el6
changelog:
  - Support -gdwarf-4 -fdebug-types-section debug info (Tom Tromey, BZ 718141).
  - doc: make gdb's help a bit clearer re: ptype & whatis (BZ 704010).
  - Fix printing of memory statistics (Tom Tromey, BZ 692386).
  - Fix `info sources' output regression (BZ 712117).
  - Support DW_AT_data_member_location even for DWARF <4 (Tom Tromey, BZ 702427).
  - Core files should use linux-thread-db.c also on ppc and s390x (BZ 697900).
  - Fix case insensitive symbols for Fortran by iFort (BZ 669434).
  - Test GDB opcodes/ disassembly of Intel Ivy Bridge instructions (BZ 696890).


author: Jan Kratochvil <jan.kratochvil@redhat.com> - 7.2-47.el6
changelog:
  - [ifunc] Fix ppc64 function descriptors compatibility.
  - detach-as-stopped kernel workaround is now always active, not just on RHEL-5.


author: Jan Kratochvil <jan.kratochvil@redhat.com> - 7.2-45.el6
changelog:
  - [vla] Disable the unfinished types garbage collector (BZ 682891).
  - [vla] New testcase for the unfinished types garbage collector (for BZ 682891).


author: Jan Kratochvil <jan.kratochvil@redhat.com> - 7.2-42.fc14
changelog:
  - Fix occasionall unfound source lines (affecting at least glibc debugging).
  - Fix const/volatile qualifiers of C++ types (PR c++/12328).


author: Jan Kratochvil <jan.kratochvil@redhat.com> - 7.2-32.fc14
changelog:
  - [delayed-symfile] Test a backtrace regression on CFIs without DIE (BZ 614604).
  - [archer-tromey-delayed-symfile] New test gdb.dwarf2/dw2-aranges.exp.
  - [archer-keiths-expr-cumulative+upstream] Import C++ testcases.


author: Jan Kratochvil <jan.kratochvil@redhat.com> - 7.2-31.fc14
changelog:
  - Provide /usr/bingdb-add-index even on RHEL-5.
  - Provide again libstdc++ pretty printers for any RHEL.


author: Jan Kratochvil <jan.kratochvil@redhat.com> - 7.2-29.fc14
changelog:
  - Backport support of template parameters (Tom Tromey, BZ 562758).
  - New test gdb.base/gnu-ifunc.exp:"static gnu_ifunc" (BZ 632259).


author: Jan Kratochvil <jan.kratochvil@redhat.com> - 7.2-28.fc14
changelog:
  - Backport gdb.base/break-interp.exp test (+prelink fix) on PPC (BZ 663449).
  - Backport gdb.cp/infcall-dlopen.exp test (BZ 639645).
  - New testcase py-prettyprint.exp:print hint_error (for BZ 611569, BZ 629236).
  - New test gdb.arch/x86_64-pid0-core.exp for kernel PID 0 cores (BZ 611435).


author: Jan Kratochvil <jan.kratochvil@redhat.com> - 7.2-27.fc14
changelog:
  - Fix ppc* compilation of PRPSINFO in the core files (BZ 662995, for BZ 254229).
  - Fix (disable) non-x86* compilation of libinproctrace.so (for BZ 662995).


author: Jan Kratochvil <jan.kratochvil@redhat.com> - 7.2-23.fc14
changelog:
  - Workaround librpm BZ 643031 due to its unexpected exit() calls (BZ 642879).
  - Fix crash on CTRL-C while reading an ELF symbol file (BZ 642879).


author: Jan Kratochvil <jan.kratochvil@redhat.com> - 7.2-21.fc14
changelog:
  - Fix python stale error state, also fix its save/restore (BZ 639089).
  - Fix inferior exec of new PIE x86_64 (BZ 638979).


author: Jan Kratochvil <jan.kratochvil@redhat.com> - 7.2-15.fc14
changelog:
  - Revert the -O0 switch formerly to workaround GCC BZ 634757 (cmove bug).
  - Remove no longer used BuildRequires: libstdc++.
  - Remove commented out python libstdc++ .spec code.


author: Jan Kratochvil <jan.kratochvil@redhat.com> - 7.2-7.fc14
changelog:
  - python: load *-gdb.py for shlibs during attach (BZ 634660).
  - Fix double free crash during overload resolution (PR 12028, Sami Wagiaalla).


author: Jan Kratochvil <jan.kratochvil@redhat.com> - 7.2-6.fc14
changelog:
  - Fix python gdb.solib_address (BZ 634108, fix by Phil Muldoon).
  - Temporarily build with -O0 to workaround GCC BZ 634757 (cmove bug).


author: Jan Kratochvil <jan.kratochvil@redhat.com> - 7.2-4.fc14
changelog:
  - Fix symbol lookup misses methods of current class (BZ 631158, Sami Wagiaalla).
  - Fix python gdb.execute-to_string redirection (BZ 627506, with Paul Bolle).


author: Jan Kratochvil <jan.kratochvil@redhat.com> - 7.1.90.20100806-10.fc14
changelog:
  - Fix /usr/bin/gdb-add-index missing -nx for gdb.
  - New option --with profile (disabled by default - missing workload, BZ 615603).


author: Jan Kratochvil <jan.kratochvil@redhat.com> - 7.1.90.20100806-7.fc14
changelog:
  - Fix gcore from very small terminal windows (BZ 555076).
  - Fix false `filesystem' debuginfo rpm request (BZ 599598).


author: Jan Kratochvil <jan.kratochvil@redhat.com> - 7.1.90.20100721-4.fc14
changelog:
  - Import archer-tromey-python.
  - Import archer-tromey-optional-psymtab (as present in FSF GDB post-7.2).
    - Provide /usr/bin/gdb-add-index for rpm-build (Tom Tromey).


author: Jan Kratochvil <jan.kratochvil@redhat.com> - 7.1-27.fc13
changelog:
  - Fix obstack corruptions on C++ (BZ 606185, Chris Moller, Jan Kratochvil).
  - Improve support for typedefs in classes (BZ 602314).
  - Fix `set print object on' for some non-dynamic classes (BZ 606660).


