# changelog

author: Coiby <coxu@redhat.com> - 2.0.23-4
changelog:
  - fix broken kdump_get_arch_recommend_size
  - remove the upper bound of 102400T for the range in default crashkernel
  - fix the error of parsing the container environ variable for osbuild
  - s390: handle R_390_PLT32DBL reloc entries in machine_apply_elf_rel()
  - Revert "Remove trace_buf_size and trace_event from the kernel bootparameters of the kdump kernel"
  - spec: only install mkfadumprd for ppc
  - selftest: Add early kdump test
  - selftest: run-test.sh: wait for subprocess instead of kill it


author: Coiby <coxu@redhat.com> - 2.0.23-5
changelog:
  - fix incorrect usage of _get_all_kernels_from_grubby
  - fix the mistake of swapping function parameters of read_proc_environ_var


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 29-5
changelog:
  - kmod.spec: enable debug
  - weak-modules: compare_initramfs_modules: exit on pushd/popd failures
  - weak-modules: split modules into array with read -a
  - Add default config file, /etc/depmod.d/dist.conf


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.19.2-6
changelog:
  - Drop old trigger scriplet
  - Reenable package notes and strip LDFLAGS from krb5-config (rhbz#2048909)


author: Andreas Schneider <asn@redhat.com> - 2.3.0-2
changelog:
  - Fix tests on aarch64
  - Verify signature in prep state
  - resolves: rhbz#1794307 - Build with lmbd support on ppc64le again


author: Ondrej Dubaj <odubaj@redhat.com> - 3.34.0-1
changelog:
  - Updated to version 3.34.0 (https://sqlite.org/releaselog/3_34_0.html)
  - Enabled fts3conf.test on s390x and ppc64 architectures


author: Paolo Bonzini <pbonzini@redhat.com> - 0.3.111-5
changelog:
  - Pass in the distro-provided CFLAGS and LFLAGS. (Jeff Moyer)
  - Get rid of -nostartfiles -nostdlib (Jeff Moyer)
  - Resolves: rhbz#1630578


author: Karel Zak <kzak@redhat.com> - 2.36.1-2
changelog:
  - remove unused patches
  - remove versions and seq.numbers from patch names
  - fix mount "symfollow" issue (upstream patch)


author: Karel Zak <kzak@redhat.com> - 2.36.2-1
changelog:
  - upgrade to stable upstream 2.36.2
    https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/v2.36/v2.36.2-ReleaseNotes


author: Karel Zak <kzak@redhat.com> - 2.37-4
changelog:
  - disable raw(8) - no more supported since Linux v5.14 (commit 03e4922f1c81fc2ed3a87b4f91a8d3aafc7e093)
  - remove dependence on deprecated pcre2posix.h
  - fix #1981729 - close_range() 3rd argument


author: Jeff Law <law@redhat.com> - 0.10.0-5
changelog:
  - Use symver attribute for symbol versioning
    Fix configure test compromised by LTO
    Fix nlist test compromised by LTO
    Re-enable LTO


author: Nicola Sella <nsella@redhat.com> - 0.58.0-1
changelog:
  - Update to 0.58.0
  - Option: Add reset() method
  - Add OptionBinds::getOption() method
  - [context] Add dnf_repo_conf_from_gkeyfile() and dnf_repo_conf_reset()
  - [context] Add support for options: minrate, throttle, bandwidth, timeout
  - [context] Remove g_key_file_get_string() from dnf_repo_set_keyfile_data()
  - Allow loading ext metadata even if only cache (solv) is present
  - Add ASAN_OPTIONS for test_libdnf_main
  - [context,API] Functions for accessing main/global configuration options
  - [context,API] Function for adding setopt
  - Add getter for modular obsoletes from ModuleMetadata
  - Add ModulePackage.getStaticContext() and getRequires()
  - Add compatible layer for MdDocuments v2
  - Fix modular queries with the new solver
  - Improve formatting of error string for modules
  - Change mechanism of module conflicts
  - Fix load/update FailSafe


author: Nicola Sella <nsella@redhat.com> - 0.60.0-1
changelog:
  - Fix repo.fresh() implementation
  - build-sys: Add ENABLE_STATIC option
  - Fix: Fully set ssl in newHandle function
  - [conf] Add options for working with certificates used with proxy
  - Apply proxy certificate options
  - lock: Switch return-if-fail to assert to quiet gcc -fanalyzer
  - build-sys: Clean up message about Python bindings
  - Modify module NSVCA parsing - context definition (RhBug:1926771)
  - [context] Fix: dnf_package_is_installonly (RhBug:1928056)
  - Fix problematic language
  - Add getApplicablePackages to advisory and isApplicable to advisorymodule
  - Keep isAdvisoryApplicable to preserve API
  - Run ModulePackageContainerTest tests in tmpdir, merge interdependent
  - [context] Support config file option "proxy_auth_method", defaults "any"
  - Support main config file option "installonlypkgs".
  - Support main config file option "protected_packages".
  - Properly handle multiple collections in updateinfo.xml (RhBug:1804234)


author: Nicola Sella <nsella@redhat.com> - 0.62.0-1
changelog:
  - Fix: Fully set ssl in newHandle function
  - [conf] Add options for working with certificates used with proxy
  - lock: Switch return-if-fail to assert to quiet gcc -fanalyzer
  - Modify module NSVCA parsing - context definition (RhBug:1926771)
  - libdnf.h: Remove overall extern "C"
  - [context] Fix: dnf_package_is_installonly (RhBug:1928056)
  - Fix problematic language
  - Add getApplicablePackages to advisory and isApplicable to advisorymodule
  - Keep isAdvisoryApplicable to preserve API
  - Run ModulePackageContainerTest tests in tmpdir, merge interdependent
  - [context] Support config file option "proxy_auth_method", defaults "any"
  - Hardening: add signature check with rpmcliVerifySignatures (RhBug:1932079)
  - do not allow 1 as installonly_limit value (RhBug:1926261)
  - Add a config option to check TLS certificate revocation status (using OCSP stapling), defaults to false (RhBug:1814383)


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.63.1-1
changelog:
  - Update to 0.63.1
  - ModuleProfile: add isDefault()
  - ModulePackage: add getDefaultProfile()
  - Add new dnf_context_module_install() C API
  - Fix a crash when [media] section in .treeinfo is missing for bootable media (RhBug:1946024)
  - Add hy_query_get_advisory_pkgs to C API (RhBug:1960561)
  - Add dnf_advisorypkg_get_advisory()
  - DNF does not fail on non UTF-8 file names in a package (RhBug:1893176)
  - Improve error-reporting for modular functions


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.64.0-1
changelog:
  - Update to 0.64.0
  - Implement logic for demodularization of modular rpms (RhBug:1805260)
  - DnfContext: fix handling of default module profiles
  - ModuleMetadata: gracefully handle modules with no defaults
  - Remove failovermethod config option (RhBug:1961083)


author: Richard Hughes <richard@hughsie.com> 0.3.2-1
changelog:
  - New upstream version
  - Do not use deprecated libusb API
  - Use a 1ms timeout in the Windows event thread


author: Richard Hughes <richard@hughsie.com> 0.3.3-1
changelog:
  - New upstream version
  - Add a thin glib wrapper around libusb_endpoint_descriptor
  - Fix high number of wakeups when checking the GUsbContext


author: Richard Hughes <richard@hughsie.com> 0.3.4-1
changelog:
  - New upstream version
  - Include the USB bus in the generated platform_id
  - Validate the exported symbol list during check


author: Richard Hughes <richard@hughsie.com> 0.3.5-1
changelog:
  - New upstream version
  - Add a way to get iConfiguration
  - Allow building GtkDoc when building as a subproject


author: Richard Hughes <richard@hughsie.com> 0.3.6-1
changelog:
  - New upstream version
  - Add g_usb_device_get_string_descriptor_bytes()
  - Fix cancellation if cancellable is already cancelled


author: Richard Hughes <richard@hughsie.com> 0.3.8-1
changelog:
  - New upstream version
  - Add new API requested by fwupd
  - Add the GUsbEndpoint methods to the docs
  - Fix hotplug handling and signal emission during enumerate


author: Pavel Březina <pbrezina@redhat.com> - 2.5.0-2
changelog:
  - Fix regression in sssd-kcm when upgrading from 2.4.0 directly to 2.5.0
  - Return correct error code for unknown/unsupported operations in sssd-kcm


author: Pavel Březina <pbrezina@redhat.com> - 2.5.1-2
changelog:
  - Multiple small fixes to reduce size of log files with debug_backtrace on
  - Fix a corner case bug in KCM renewals that makes user lookup in the daemon fail


author: Pavel Březina <pbrezina@redhat.com> - 2.6.0-2
changelog:
  - Add additional patches on top of 2.6.0
  - Fix KCM upgrade from older releases
  - Enable subid ranges


author: Richard Hughes <richard@hughsie.com> 0.1.6-1
changelog:
  - New upstream release
  - Fall back to the AliasId for validation
  - Fix jcat_context_verify_blob() to use self verify for checksums


author: Richard Hughes <richard@hughsie.com> 0.1.9-1
changelog:
  - New upstream release
  - Return an error if we try to self-sign no bytes of data
  - Set which backends are supported in the pkgconfig file


author: Richard Hughes <richard@hughsie.com> 0.1.10-1
changelog:
  - New upstream release
  - Add ED25519 support
  - Define three more types used for the firmware transparency log


author: Sahana Prasad <sahana@redhat.com> - 1.1.5-3
changelog:
  - Disables kcapi-enc tests until the kernel bug bz 1826022 is fixed.
  - Produce also the fipscheck replacement package


author: Ondrej Mosnáček <omosnace@redhat.com> - 1.1.5-5
changelog:
  - Fix the CI test failures
  - Enable building on old kernels
  - Avoid conflicts between different versions of packages


author: Sahana Prasad <omosnace@redhat.com> - 1.2.0-1
changelog:
  - Update to upstream version 1.2.0 tracked by BZ 1839592.
  - Enable kcapi-enc tests as libkcapi BZ 1826022 is fixed.
  - Remove 110-fipshmac-compat.patch as the changes are merged upstream.
  - Remove 100-workaround-cppcheck-bug.patch as the changes are merged upstream.


author: Sahana Prasad <sahana@redhat.com> - 1.2.1-1
changelog:
  - Update to upstream version 1.2.1
  - Remove patch fix MSG_MORE uasge as it is added upstream
  - Remove cppcheck dependency for rhel bz#1931518
  - Add a patch to fix fuzz tests


author: Sergio Correia <scorreia@redhat.com> - 9-6
changelog:
  - Define log callback function to use with libcryptsetup
    Logs from libcryptsetup now go to stderr and this prevents issues like
    the one reported in https://bugzilla.redhat.com/show_bug.cgi?id=1770395


author: Michal Ruprich <mruprich@redhat.com> - 1.4.3-1
changelog:
  - Update to 1.4.3
  - Resolves: #1758843 - libmaxminddb-devel i686 can't be installed in parallel to x86_64
  - Fix for CVE-2020-28241


author: Stephen Gallagher <sgallagh@redhat.com> - 2.11.1-1
changelog:
  - Release 2.11.1
  - Ignore Packager documents when running ModuleIndex.update_from_*()
  - Add python overrides for XMD in PackagerV3
  - Add python override to ignore the GType return when reading packager files
  - Add PackagerV3.get_mdversion()


author: Stephen Gallagher <sgallagh@redhat.com> - 2.11.2-1
changelog:
  - Release 2.11.2
  - Extend read_packager_[file|string]() to support overriding the module name
    and stream.


author: Stephen Gallagher <sgallagh@redhat.com> - 2.11.2-2
changelog:
  - Fix issue with ModuleIndex when input contains only Obsoletes documents
  - Fix import issue when built with Python 2 support


author: Petr Pisar <ppisar@redhat.com> - 2.13.0-2
changelog:
  - Accept an invalid buildorder 18446744073709551615 found in RHEL 8 repositories
    (https://pagure.io/koji/issue/3025)


author: Jiri Pirko <jiri@nvidia.com> - 1.8-1
changelog:
  - 1.8 release
  - libndp,ndptool: use poll() instead of select()
  - libndp: avoid static buffer for debug string in ndp_sock_recv()
  - ndptool: avoid static buffer for string in ndptool
  - libndp: use thread local variables for static return arguments
  - ndptool: don't use static variable for local context in msgrcv_handler_func()
  - ndptool: fix printing dnssl lifetime in ndptool
  - ndptool: fix potential memory leak caused by strdup
  - ndptool: add -D dest support
  - libndp: fix nd_msg typo when setting target address
  - libndp: close sockfd after using to avoid handle leak
  - ndptool: fix target parameter typo
  - ndptool: add -T target support


author: Steve Dickson <steved@redhat.com> 2.5.2-4.rc4
changelog:
  - rpc.idmapd: Do not free config variables (bz 1873965)
  - nfsiostat: Drop autofs entries before calling compare_iostats()


author: Björn Esser <besser82@fedoraproject.org> - 2.0.0-2
changelog:
  - Add logic for closing the loop hole on soname bumps
  - Explicitly force manual intervention for soname bumps


author: Michal Ruprich <mruprich@redhat.com> - 14:1.9.1-1
changelog:
  - New version 1.9.1
  - Fix for CVE-2018-16301, CVE-2019-15161, CVE-2019-15162, CVE-2019-15163, CVE-2019-15164, CVE-2019-15165


author: Tomáš Mráz <tmraz@redhat.com> 1.4.1-1
changelog:
  - Disable python2 bindings in Fedora 31 and above
  - Add conditionals for Python2 and Python3
  - pam_pwquality: Abort the retry loop if user requests it
  - Allow setting retry, enforce_for_root, and local_users_only options
    in the pwquality.conf config file


author: Tomáš Mráz <tmraz@redhat.com> 1.4.2-1
changelog:
  - Fix previous release regression in handling retry, enforce_for_root,
    and local_users_only options


author: Tomáš Mráz <tmraz@redhat.com> 1.4.3-1
changelog:
  - Multiple translation updates
  - Add usersubstr check for substrings of N characters from the username
    patch by Danny Sauer


author: Paul Wouters <pwouters@redhat.com> - 1.4.4-2
changelog:
  - Resolves rhbz#1919026 libpwquaily rpm requires cracklib-dict to function but RPM missing requirement


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1.4.4-3
changelog:
  - Resolves: rhbz#1919026 libpwquaily rpm requires cracklib to function but RPM missing requirement [updated]


author: Paul Wouters <paul.wouters@aiven.io> - 1.4.4-6
changelog:
  - Resolves: rhbz#1992607 libpwquality: regression in minimal image size because of hard dependency on cracklib-dicts


author: Nicola Sella <nsella@redhat.com> - 1.12.0-1
changelog:
  - Update to 1.12.0
  - Decode package URL when using for local filename (RhBug:1817130)
  - Fix memory leak in lr_download_metadata() and lr_yum_download_remote()
  - Download sources work when at least one of specified is working (RhBug:1775184)
  - Enable building on OSX


author: Nicola Sella <nsella@redhat.com> - 1.13.0-1
changelog:
  - Update to 1.13.0
  - Add support for working with certificates used with proxy
  - Drop Python 2 support
  - Fix: lr_perform() - Avoid 100% CPU usage
  - Add support for pkcs11 certificate and key for repository authorization
  - Fix default value for LRO_SSLVERIFYSTATUS
  - Don't use max_ranges to determine if we expect zchunk callback
  - Prefer HTTP over FTP mirrors when zchunk is enabled
  - Fixed mem leaks and typos


author: Pavla Kratochvilova <pkratoch@redhat.com> - 1.14.0-1
changelog:
  - Update to 1.14.0
  - Fix: memory leaks
  - Support multiple checksums in xattr (RhBz:1931904)
  - Use macros to access extended attributes
  - Remove problematic language
  - CMake: Set minimum version for curl to 7.52.0


author: Pavla Kratochvilova <pkratoch@redhat.com> - 1.14.1-1
changelog:
  - Update to 1.14.1
  - Recover from fsync fail on read-only filesystem (RhBug:1956361)
  - Reduce time to load metadata
  - Fix resource leaks


author: Matěj Grabovský <mgrabovs@redhat.com> - 2.14.0-10
changelog:
  - Add fix for https://bugzilla.redhat.com/show_bug.cgi?id=1883337
  - Add fix for https://bugzilla.redhat.com/show_bug.cgi?id=1883410


author: Packit Service <user-cont-team+packit-service@redhat.com> - 2.15.1-1
changelog:
  - Release version 2.15.1-1 (Michal Fabik)
  - ureport: Strange usage of tmp variable (Michal Židek)
  - steal_directory: Silence a warning (Michal Židek)
  - dump_dir: Use g_free and re-init to NULL (Michal Židek)
  - dump_dir: Use g_free instead of free (Michal Židek)
  - dirsize: No need to check for NULL (Michal Židek)
  - dirsize: Bad checks for NULL (Michal Židek)
  - gui-wizard-gtk: Possible double free (Michal Židek)
  - gui-wizard-gtk: Check if EXCLUDE_FROM_REPORT is set (Michal Židek)
  - gui-wizard-gtk: Improve docs and add missing free (Michal Židek)
  - cli: Address of local auto-variable assigned to a function parameter (Michal Židek)
  - gtk-helpers: Add missing g_strfreev() (Michal Židek)
  - cli: Add missing g_free call (Michal Židek)
  - gitignore: Drop misleading comment (Michal Fabik)
  - spec: Sync upstream with distgit (Michal Fabik)
  - changelog: Add missing link to changes in 2.15.0 (Matěj Grabovský)
  - spec: Make plugin-mailx depend on /usr/bin/mailx (Matěj Grabovský)
  - Add support for excluding whole elements from search for sensitive words (Michal Srb)
  - ignored_words: add more "key" variations (Michal Srb)


author: Packit Service <user-cont-team+packit-service@redhat.com> - 2.15.2-1
changelog:
  - Release version 2.15.2-1 (Michal Fabik)
  - binhex: Remove unused API (Matěj Grabovský)
  - lib: Use GLib for computing SHA-1 digests (Matěj Grabovský)
  - run_event: Improve memory management (Matěj Grabovský)
  - gtk: Fix segfault (Matěj Grabovský)


author: Matěj Grabovský <mgrabovs@redhat.com> - 2.15.2-11
changelog:
  - Backport patch for building with Python 3.11
    (https://bugzilla.redhat.com/show_bug.cgi?id=2019402)


author: Matěj Grabovský <mgrabovs@redhat.com> - 2.16.0-1
changelog:
  - Bump satyr dependency to 0.38
  - Bump libreport library revision to 2:1:0
  - Drop build-time dependency on libproxy-devel
  - Drop last reference to global_uuid file
  - Don't use deprecated assertEquals() in tests
  - Add DEBUGINFOD_URLS environment variable to ignored_words
  - rhbz: Retry XML-RPC calls when uploading attachments
  - rhbz: Be a little bit more defensive when working with subcomponents
  - Update translations


author: Packit Service <user-cont-team+packit-service@redhat.com> - 2.17.1-1
changelog:
  - Release version 2.17.1 (Michal Srb)
  - reporter-bugzilla: send API key in HTTP header (Michal Srb)
  - tito: Use custom tagger that updates changelog (Matěj Grabovský)
  - changelog: Fix link to release diff (Matěj Grabovský)
  - reporter-bugzilla: Fix APIKey name (Michal Fabik)
  - Update translations (mgrabovsky)
  - Add missing va_end (Michal Židek)


author: Neal Gompa <ngompa13@gmail.com> - 2.4.2-2
changelog:
  - Modernize spec
  - Backport fix for missing __SNR_ppoll symbol (#1777889)
  - Refresh patch to build on aarch64 with upstream version


author: Tom Stellard <tstellar@redhat.com> - 3.1-2
changelog:
  - Use make macros
  - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
  - Use -fno-semantic-interposition and more make macros


author: Petr Lautrbach <plautrba@redhat.com> - 3.1-4
changelog:
  - Use libsepol.so.2
  - Convert matchpathcon to selabel_lookup()
  - Change userspace AVC setenforce and policy load messages to audit
    format
  - Remove trailing slash on selabel_file lookups
  - Use kernel status page by default


author: Petr Lautrbach <plautrba@redhat.com> - 3.1-4
changelog:
  - Drop deprecated functions and duplicated symbols
  - Change library version to libsemanage.so.2
  - Temporary ship -compat with libsemanage.so.1
  - Based on upstream db0f2f382e31
  - Re-enable lto flags


author: Petr Lautrbach <plautrba@redhat.com> - 3.1-6
changelog:
  - Drop "genhomedircon: check usepasswd" patch
  - genhomedircon to ignore
    /root;/bin;/boot;/dev;/etc;/lib;/lib64;/proc;/run;/sbin;/sys;/tmp;/usr;/var by default
  - Fix usepasswd=False explanation in semanage.conf


author: Tom Stellard <tstellar@redhat.com> - 3.1-2
changelog:
  - Use make macros
  - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
  - Use set_build_flags and -fno-semantic-interposition


author: Petr Lautrbach <plautrba@redhat.com> - 3.1-4
changelog:
  - Drop deprecated functions and duplicated symbols
  - Dange library version to libsepol.so.2
  - temporary ship -compat with libsepol.so.1
  - Re-enable LTO flags


author: Petr Lautrbach <plautrba@redhat.com> - 3.1-5
changelog:
  - Drop and obsolete libsepol-compat subpackage
  - cil: Give error for more than one true or false block


author: Marc-André Lureau <marcandre.lureau@redhat.com> - 4.3.1-3
changelog:
  - Fix CVE-2020-29129 CVE-2020-29130 out-of-bounds access while processing ARP/NCSI packets
    rhbz#1902232


author: Marc-André Lureau <marcandre.lureau@redhat.com> - 4.4.0-3
changelog:
  - Fix CVE-2021-3592 CVE-2021-3593 CVE-2021-3594 CVE-2021-3595 out-of-bounds access
    rhbz#1972249 rhbz#1972250 rhbz#1972252 rhbz#1972243


author: Andreas Schneider <asn@redhat.com> - 0.9.2-1
changelog:
  - Upate to version 0.9.2
  - resolves #1769370 - Remove the docs, they can be found on https://api.libssh.org/


author: Anderson Sasaki <ansasaki@redhat.com> - 0.9.4-1
changelog:
  - Update to version 0.9.4
    https://www.libssh.org/2020/04/09/libssh-0-9-4-and-libssh-0-8-9-security-release/
  - Removed inclusion of OpenSSH server configuration file from
    libssh_server.config
  - Added patch to re-enable algorithms using sha1 in sshd for testing
  - resolves: #1822529 - CVE-2020-1730


author: Anderson Sasaki <ansasaki@redhat.com> - 0.9.4-3
changelog:
  - Do not return error when server properly closed the channel (#1849069)
  - Add a test for CVE-2019-14889
  - Do not parse configuration file in torture_knownhosts test


author: Anderson Sasaki <ansasaki@redhat.com> - 0.9.5-1
changelog:
  - Update to version 0.9.5
    https://www.libssh.org/2020/09/10/libssh-0-9-5/
  - Removed patch to re-enable algorithms using sha1 in sshd for testing
  - The algorithms supported by sshd are now automatically detected for testing
  - Resolves: #1862457 - CVE-2020-16135


author: Norbert Pocs <npocs@redhat.com> - 0.9.6-1
changelog:
  - Fix CVE-CVE-2021-3634 libssh: possible heap-based buffer
    overflow when rekeying
  - Resolves: rhbz#1994600


author: Lukas Slebodnik <lslebodn@fedoraproject.org> - 2.2.0-1
changelog:
  - rhbz#1691297 - libtalloc-2.2.0 is available
  - rhbz#1737644 - libldb, libtalloc, libtevent, libtdb: Remove Python 2 subpackages from Fedora 31+


author: Lukas Slebodnik <lslebodn@fedoraproject.org> - 1.4.2-1
changelog:
  - rhbz#1691299 - libtdb-1.4.2 is available
  - rhbz#1737644 - libldb, libtalloc, libtevent, libtdb: Remove Python 2 subpackages from Fedora 31+


author: Jiri Pirko <jiri@resnulli.us> - 1.29-1
changelog:
  - 1.29 release
  - teamd: improve the error output for non-integer port prio
  - teamd: return 0 if tdport doesn't exist in teamd_config_port_set
  - teamd: add port_master_ifindex_changed for link_watch_port_watch_ops
  - initscripts: fix if/fi align
  - teamd: fix a json object memleak in get_port_obj()
  - libteam: set netlink event socket as non-blocking
  - libteam: double NETLINK_RCVBUF to fix -ENOMEM error
  - teamd: add a default value 1000 for link_watch.interval
  - teamd: use enabled option_changed to sync enabled to link_up for lb runner
  - teamd: tdport has to exist if item->per_port is set in __find_by_item_path
  - teamd: remove port if adding fails
  - teamd: lacp: update port state according to partner's sync bit
  - man: fix runner.min_ports default value
  - teamd: lw: nsna_ping: only send ns on enabled port
  - teamd: lw: arp_ping: only check arp reply message
  - teamd: config: update local prio to kernel
  - teamnl: update help message


author: Jiri Pirko <jiri@resnulli.us> - 1.30-1
changelog:
  - 1.30 release
  - teamd/lacp: fix segfault due to NULL pointer dereference
  - teamd: fix build error in expansion of macro teamd_log_dbgx
  - teamd: update ctx->hwaddr after setting team dev to new hwaddr
  - libteam: wapper teamd_log_dbg with teamd_log_dbgx
  - teamd: Disregard current state when considering port enablement
  - man teamd.conf: update some parameter default values


author: Jiri Pirko <jiri@resnulli.us> - 1.31-1
changelog:
  1.31 release
  utils/bond2team: remove TYPE in ifcfg file
  utils/bond2team: keep delivering config to file if stdout not supplied
  teamd/lacp: silence ignore none LACP frames
  teamd: fix ctx->hwaddr value assignment
  Send LACP PDU right after the Actor state has been changed
  Skip setting the same hwaddr to a lag port if not needed
  Make all netlink socket RCVBUF sizes configurable
  Don't return an error when timerfd socket return 0
  Fix ifinfo_link_with_port race condition with newlink
  teamd: fix possible race in master ifname callback


author: Lukas Slebodnik <lslebodn@fedoraproject.org> - 0.10.0-1
changelog:
  - rhbz#1691300 - libtevent-0.10.0 is available
  - rhbz#1737644 - libldb, libtalloc, libtevent, libtdb: Remove Python 2 subpackages from Fedora 31+


author: Tom Stellard <tstellar@redhat.com> - 1.2.6-2
changelog:
  - Add BuildRequires: gcc
  - https://docs.fedoraproject.org/en-US/packaging-guidelines/C_and_C++/#_packaging


author: Frederic Berat <fberat@redhat.com> - 2.4.6-48
changelog:
  - Add support for "-fsanitize", rhbz#2024647
  - Add support for "-fuse-ld", rhbz#2024647
  - Use make macros (based on Tom Stellard work for f33 and Timm Bäder)
    https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
  - Disable non-PIC test for ARM as this is not supported on this arch
  - Use autosetup
  - Use plain %configure


author: Mike FABIAN <mfabian@redhat.com> - 0.9.10-12
changelog:
  - Fix memory leak in vasnprint. Resolves: rhbz#1938800
    (Backported from upstream: https://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=4d288a80bf7ebe29334b9805cdcc70eacb6059c1)
  - Fix spelling in license GPLV2+ -> GPLv2+


author: Hans de Goede <hdegoede@redhat.com> - 1.0.22-3
changelog:
  - Add tests and examples to a new tests-examples subpackage, so that these
    can be used for the upcoming gating stuff
  - Add %check using some of the tests/examples


author: Miro Hrončok <mhroncok@redhat.com> - 0.62-23
changelog:
  - Subpackage python2-libuser has been removed
    See https://fedoraproject.org/wiki/Changes/Mass_Python_2_Package_Removal


author: Jakub Hrozek <jhrozek@redhat.com> - 0.62-26
changelog:
  - Temporarily disable tests, nothing changed since forever so this should be
    safe and would unblock FTBFS
  - Related: rhbz#1817666 - libuser fails to build with Python 3.9: FAIL: tests/fs_test


author: Stephen Gallagher <sgallagh@redhat.com> - 19-4
changelog:
  - Fix builds when git is present in the buildroot
  - Fixes https://github.com/varlink/libvarlink/issues/22


author: Harald Hoyer <harald@redhat.com> - 21-1
changelog:
  - ci: add .packit.yaml (Harald Hoyer)
  - version 21 (Harald Hoyer)
  - fix: use strtod_l (Harald Hoyer)
  - fix: return VARLINK_ERROR_PANIC on float Inf or NaN (Harald Hoyer)
  - tests: add test with de_DE.UTF-8 locale (Harald Hoyer)
  - ci: install de_DE.UTF-8 locale (Harald Hoyer)
  - fix: correct the float number parsing for some locales (Harald Hoyer)
  - tests: print error log on `make check` (Harald Hoyer)
  - docs: update README.md (Harald Hoyer)


author: Björn Esser <besser82@fedoraproject.org> - 4.4.27-2
changelog:
  - Update Obsoletes, Provides, and Requires to glibc 2.28 (or later),
    as this was the first upstream version of glibc with an option to
    be built without shipping libcrypt
  - Fix rhel version in conditional


author: Victor Stinner <vstinner@python.org> - 2.9.10-9
changelog:
  - Build the Python extension with the PY_SSIZE_T_CLEAN macro to make it
    compatible with Python 3.10.
  - Fixes: rhbz#1890878.


author: Richard Hughes <richard@hughsie.com> 0.1.12-1
changelog:
  - New upstream release
  - Add xb_node_transmogrify to allow changing XML format
  - Do not escape a single quote with &apos;
  - Don't invalidate the silo for a GIO temp file
  - Fix up two memory leaks if using libxmlb from an introspected binding


author: Richard Hughes <richard@hughsie.com> 0.1.13-1
changelog:
  - New upstream release
  - Export xb_silo_query_full()
  - Show the XPath that was used in the query in the error message


author: Richard Hughes <richard@hughsie.com> 0.1.14-1
changelog:
  - New upstream release
  - Do not use libuuid
  - Ignore adaptors added with xb_builder_source_add_converter()


author: Richard Hughes <richard@hughsie.com> 0.1.15-1
changelog:
  - New upstream release
  - Add xb_builder_source_add_simple_adapter()
  - Allow reversing the query results


author: Richard Hughes <richard@hughsie.com> 0.2.0-1
changelog:
  - New upstream release which breaks API and ABI
  - Add the missing TEXT:INTE XPath support
  - Add variant of xb_silo_query_with_root() avoiding XbNode creation
  - Add XB_BUILDER_SOURCE_FLAG_WATCH_DIRECTORY flag
  - Allow specifying the node cache behaviour for the query
  - Avoid recursion when setting flags if possible
  - Avoid using weak pointers when building the silo
  - Do not allocate opcodes individually
  - Do not show a critical warning for invalid XML
  - Do not unconditionally create GTimer objects
  - Do not use the node cache when building indexes
  - Lazy load more arrays to reduce RSS usage


author: Richard Hughes <richard@hughsie.com> 0.2.1-1
changelog:
  - New upstream release
  - Do not assume g_content_type_guess() always returns valid results
  - Fix getting translated results in gnome-software
  - Update the header location to reflect the new API


author: Richard Hughes <richard@hughsie.com> 0.3.0-1
changelog:
  - New upstream release
  - Add a new object to contain query context data
  - Allow collapsing empty XML tags if no children or text
  - Allow marking elements as tokenized from xb-tool
  - Allow optimized searching when comparing tokens
  - Cancel the GFileMonitor before unreffing it
  - Do not allocate a 128Mb buffer for each xb_builder_source_ctx_get_bytes()
  - Do not error when creating a query if the element doesn’t exist
  - Fix a parse failure for a double comment
  - Fix various errors or missing annotations in docs
  - Make handling of single-result queries more robust
  - Support mmap()ing the source file to get bytes
  - Support query caching with xb_silo_lookup_query()
  - Support UTF-8 for upper-case() and lower-case()
  - Use g_str_match_string() for non-ASCII search queries
  - Write search tokens into the built silo


author: Richard Hughes <richard@hughsie.com> 0.3.1-1
changelog:
  - New upstream release
  - Always run xb-tool queries with the optimizer
  - Ensure tokens handling works when XbOpcode is not zero-inited
  - Use stack-allocated XbStack instances for running a machine


author: Richard Hughes <richard@hughsie.com> 0.3.2-1
changelog:
  - New upstream release
  - Respect XB_BUILDER_NODE_FLAG_IGNORE when exporting
  - Use the chosen chunk size when reading from a stream
  - Use the correct pkgconfig export package name in the GIR file


author: Richard Hughes <richard@hughsie.com> 0.3.3-1
changelog:
  - New upstream release
  - Add locking for file monitors
  - Add support for LZMA decompression
  - Clarify GMainContext usage and signal emission


author: Richard Hughes <richard@hughsie.com> 0.3.4-1
changelog:
  - New upstream release
  - Add a flag to require the XbBuilderSource to have no siblings
  - Add iterator for XbNode attributes and children
  - Allow removing XbBuilderNode text
  - Allow stripping builder node inner text


author: Richard Hughes <richard@hughsie.com> 0.3.5-1
changelog:
  - New upstream release
  - Put tail after the node when exporting XbBuilderNode
  - Remove the G_ALIGNOF checks to fix compile with old GLib versions


author: Richard Hughes <richard@hughsie.com> 0.3.6-1
changelog:
  - New upstream release
  - Ensure _IS_TOKENIZED is set if tokens are added manually
  - Ensure we never add too many tokens to the silo


author: Richard Hughes <richard@hughsie.com> 0.3.7-1
changelog:
  - New upstream release
  - Ensure reproducible results when importing a node
  - Ignore all hidden files when using _WATCH_DIRECTORY
  - Show the value bindings when using XB_SILO_PROFILE_FLAG_XPATH


author: John Eckersberg <jeckersb@redhat.com> - 0.2.5-4
changelog:
  - Add BuildRequires for make
    (re: https://fedoraproject.org/wiki/Changes/Remove_make_from_BuildRoot)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.5.1-2
changelog:
  - Disable amd64 assembly on non-intel architectures (#2035802):
    this should avoid the issue where an executable stack is created.


author: Kamil Dudka <kdudka@redhat.com> - 3.18.0-3
changelog:
  - make `renamecopy` and `copytruncate` override each other (#1934601)
  - unify documentation of copy/copytruncate/renamecopy (#1934629)
  - fix resource leaks reported by Coverity


author: Jan Rybar <jrybar@redhat.com> - 4.93.2-1
changelog:
  - Rebase to lsof-4.93.2
  - Upstream moved to GitHub and tarball structure changed
  - Manpage patch needed to reflect the tarball changes


author: Tom Callaway <spot@fedoraproject.org> - 5.4.0-4
changelog:
  - apply upstream fix for CVE-2020-15889
  - apply upstream fix for CVE-2020-15945
  - apply upstream fixes for "known bugs"


author: Tom Callaway <spot@fedoraproject.org> - 5.4.3-4
changelog:
  - apply upstream fix for CVE-2021-44647
  - apply upstream fixes for known lua bugs 4-10 (11 assumes other changes beyond 5.4.3)


author: Tom Callaway <spot@fedoraproject.org> - 5.4.4-1
changelog:
  - update to 5.4.4, update bootstrap code to 5.3.6
  - 5.4.4 contains the fix for 5.4.3 bug7, which is also CVE-2021-43519
    This fix was also in 5.4.3-4, so you do not need to update solely for that.


author: Peter Robinson <pbrobinson@fedoraproject.org> 4.1-1
changelog:
  - Update to 4.1 GA
  - Spec cleanups and updates
  - Update mdadm.pid location (rhbz 1701114, rhbz 1557623, rhbz 1557623)


author: Ales Matej <amatej@redhat.com> - 3.4.0-1
changelog:
  - Add reinstall command
  - Add "--setopt=tsflags=test" support
  - Add "--setopt=reposdir=<path>" and "--setopt=varsdir=<path1>,<path2>,..." support
  - Add "--config=<path_to_config_file>" support
  - Add "--disableplugin", "--enableplugin" support (RhBug:1781126)
  - Add "--noplugins" support
  - Add "--setopt=cachedir=<path_to_cache_directory>" support
  - Add "--installroot=<path_to_installroot_directory>" support
  - Add "--refresh" support
  - Support "install_weak_deps" conf option and "--setopt=install_weak_deps=0/1"
  - Respect reposdir from conf file
  - Respect "metadata_expire" conf file opton (RhBug:1771147)
  - Fix: Don't print lines with (null) in transaction report (RhBug:1691353)
  - [repolist] Print padding spaces only if output is terminal


author: Nicola Sella <nsella@redhat.com> - 3.5.0-1
changelog:
  - Update to 3.5.0
  - Add module enable and disable commands
  - Add reports of module changes
  - Add "module enable" command
  - Add subcommands support
  - Print info about obsoleted packages before transaction (RhBug:1855542)


author: Nicola Sella <nsella@redhat.com> - 3.6.0-1
changelog:
  - Update to 3.6.0
  - spec: Sync summary and description from openSUSE
  - Add support for setting a platform module ID
  - Add dependency for DNF configurations skeleton
  - Add support for setting allow_vendor_change


author: Nicola Sella <nsella@redhat.com> - 3.7.1-1
changelog:
  - Update to 3.7.1
  - [download] fix: unwanted dependency on newer glib 
  - [download] Support for "--resolve" and "--alldeps" arguments 
  - [download] New get_packages_query function
  - Support "--setopt=keepcache=0/1"
  - [download] Support "--archlist=" argument
  - [download] Move package download code to "download_packages" function
  - [download] several optimizations
  - Don't set default value of "assumeyes" to TRUE 
  - Support for user confirmation and assumeyes, assumeno, defaultyes
  - Extend "--setopt" to support repository options 
  - Added alias "update" to "upgrade" command
  - Command "update" renamed to "upgrade"
  - Add support for command aliases
  - dnf-data requirement only for Fedora and future RHEL
  - Relicense to GPLv2+ [errata corrige: not in 3.5.1-1]
  - Sync summary and description from openSUSE [errata corrige: not in 3.6.0-1]


author: Nicola Sella <nsella@redhat.com> - 3.8.0-1
changelog:
  - Update to 3.8.0
  - distrosync: Fix style issues and plugin build with Meson 
  - Add distro-sync subcommand
  - Add "makecache" command


author: Ondrej Dubaj <odubaj@redhat.com> - 1.2.11-17
changelog:
  - IBM Z hardware-accelerated deflate for s390x architectures
  - IBM CRC32 optimalization for POWER 8+ architectures


author: Ondrej Dubaj <odubaj@redhat.com> - 1.2.11-19
changelog:
  - IBM CRC32 optimalization for POWER 8+ architectures re-add
  - fixed firefox crash duer to zlib (#1741266)
  - added test for crc32


author: Ondrej Dubaj <odubaj@redhat.com> - 1.2.11-20
changelog:
  - Added -DDFLTCC parameter to configure to enable 
  - Z hardware-accelerated deflate for s390x architectures (#1659433)


author: Ondrej Dubaj <odubaj@redhat.com> - 1.2.11-27
changelog:
  - Enabled Z hardware-accelerated deflate for compression levels 1 through 6 (#1972057)
  - IBM CRC32 optimalization rhbz#1959423


author: Olivier Lemasle <o.lemasle@gmail.com> - 20.10.5-1
changelog:
  - Update to latest upstream 20.10.5 - fixes #1903426
  - Upstream brings compatibility with cgroups v2 - fixes #1746355
  - Remove package moby-engine-vim (dockerfile.vim has been merged in upstream vim)
  - Remove firewalld docker zone, since dockerd can now communicate with firewalld - fixes #1852680
  - Build dockerd and docker-proxy from unbundled source packages
  - Remove fixed storage-driver (cf. https://src.fedoraproject.org/rpms/moby-engine/pull-request/6)


author: Olivier Lemasle <o.lemasle@gmail.com> - 20.10.6-1
changelog:
  - Update to upstream 20.10.6 (#1948605)
  - Re-bundle moby dependencies to fix gRPC issues with Swarm
    (https://github.com/coreos/fedora-coreos-tracker/issues/793)


author: Maxwell G <gotmax@e.email> - 20.10.9-1
changelog:
  - Update to 20.10.9 (fixes rhbz#2010508)
  - Patch seccomp policy to fix clone3() issue (fixes rhbz#2011523 and rhbz#1988199)


author: Maxwell G <gotmax@e.email> - 20.10.12-1
changelog:
  - Update to 20.10.12. Fixes rhbz#2032534.
  - Install zsh completions to the correct directory. Fixes rhbz#2038888.


author: Maxwell G <gotmax@e.email> - 20.10.12-3
changelog:
  - Fixes FTBFS. Closes rhbz#2046748.
  - Use %gobuild instead of Makefile to build binaries
  - Add explanatory comments.
  - Normalize install commands
  - Make compliant with SourceURL Guidelines
  - Remove no longer necessary `ExcludeArch: ppc64`.


author: Maxwell G <gotmax@e.email> - 20.10.15-1
changelog:
  - Update to 20.10.15 (rhbz#2082501).
  - Fix BUILDTAGS (rhbz#2082924).
  - Make non-binary subpackages noarch.


author: Olivier Lemasle <o.lemasle@gmail.com> - 19.03.8-2.ce.gitafacb8b
changelog:
  - Configure storage-driver explicitely (fixes #1832301)
  - Add firewalld zone: trust interface docker0, as firewalld now uses nftables
    by default and docker communicates with iptables (fixes #1817022)


author: Frantisek Zatloukal <fzatlouk@redhat.com> - 78.9.0-1
changelog:
  - Update to 78.9.0
  - Rebase patches
  - Replace armv7_disable_WASM_EMULATE_ARM_UNALIGNED_FP_ACCESS with patch from Debian to include vfp defs


author: Frantisek Zatloukal <fzatlouk@redhat.com> - 78.1.0-2
changelog:
  - Add BR: python3-setuptools
  - Backport fix for https://bugzilla.mozilla.org/show_bug.cgi?id=1654696
  - Set CARGO_PROFILE_RELEASE_LTO=true


author: Jerry James <loganjerry@gmail.com> - 4.0.2-1
changelog:
  - Update to MPFR version 4.0.2 plus patch01
  - Make mpfr3 and mpfr3-devel subpackages for version 3.1.6
  - Add a -doc subpackage to hold the GFDL-licensed content
  - The main package license is LGPLv3+; the GPLv3+ content is not packaged
  - Drop unnecessary autoconf and libtool BRs
  - Drop explicit R on gmp; it is autogenerated
  - Drop info scriptlets; this version can never appear in Fedora < 32 or RHEL < 9
  - Drop ldconfig_scriptlets for the same reason
  - Make sure there are no rpaths and that -Wl,--as-needed takes effect
  - Do not use the %doc macro; the files have already been copied


author: Miroslav Lichvar <mlichvar@redhat.com> 6.1-13.20191026
changelog:
  - update to 6.1-20191026 (CVE-2019-17594 CVE-2019-17595)
  - restore rxvt-unicode-256color terminfo (Robbie Harwood) (#1430935)
  - conflict/obsolete rxvt-unicode (sub)packages with terminfo (#1430935)
  - drop old obsoletes and conflicts


author: Miroslav Lichvar <mlichvar@redhat.com> 6.1-14.20191109
changelog:
  - update to 6.1-20191109
  - remove LDFLAGS from pkgconfig files and ncurses-config scripts (#1771137)


author: Fedora Release Engineering <releng@fedoraproject.org> - 6.2-4.20200222
changelog:
  - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
  - Use make macros
  - Remove MIT definition
  - Add BuildRequires: make


author: luto@kernel.org - 1.9-1
changelog:
  - Update to 1.9
  - Certain fabric functionality may not work yet due to missing dracut
    support and missing hostid and hostnqn configuration.


author: Mamoru TASAKA <mtasaka@fedoraproject.org> - 6.9.6-0.3.rc3
changelog:
  - Apply upstream patch for upstream bug 221
    - Revert change for false CVE-2020-26159 issue
      https://github.com/kkos/oniguruma/issues/221


author: Simon Pichugin <spichugi@redhat.com> - 2.4.57-6
changelog:
  - Fix tiny typo (single omitted letter in summary for compat) (#1997502)
  - Backport TLS SNI feature from OpenLDAP 2.5 (#1938829)


author: Fedora Release Engineering <releng@fedoraproject.org> - 2.4.59-3
changelog:
  - Fix tiny typo (single omitted letter in summary for compat) (#2009532)
  - Backport TLS SNI feature from OpenLDAP 2.5 (#2009533)


author: Simon Pichugin <spichugi@redhat.com> - 2.6.1-1
changelog:
  - Update to new major release OpenLDAP 2.6.1 (#1955293)
    + rediff all patches and remove patches now upstream
    + use upstream source location for check password module
    + and rediff patch due to this
    + add patch to fix build issue in 2.5.4 (from upstream)
    + clean and sort buildreqs
    + remove various refs to bdb
    + remove now default -DLDAP_USE_NON_BLOCKING_TLS
    + add new modules and enable load balancer as module
    + disable wiredtired backend due to missing build deps
    + don't remove files that don't exist
    + let check-config work on *.mdb over legacy files
    + remove refs to old-style config
    + new soname names
    + remove libldap_r link as the library was merged with libldap
    + refactor openldap-compat package to support the transition from 2.4
    + add UPGRADE_INSTRUCTIONS for openldap-server upgrade
  - The original patch was submitted by Fedora user - terjeros
    https://src.fedoraproject.org/rpms/openldap/pull-request/6


author: Jakub Jelen <jjelen@redhat.com> - 8.3p1-4 + 0.10.3-10
changelog:
  - Remove openssh-ldap subpackage (#1871025)
  - pkcs11: Do not crash with invalid paths in ssh-agent (#1868996)
  - Clarify documentation about sftp-server -m (#1862504)


author: Jakub Jelen <jjelen@redhat.com> - 8.4p1-3 + 0.10.4-1
changelog:
  - Unbreak seccomp filter on arm (#1897712)
  - Add a workaround for Debian's broken OpenSSH (#1881301)


author: Jakub Jelen <jjelen@redhat.com> - 8.4p1-4 + 0.10.4-1
changelog:
  - Remove "PasswordAuthentication yes" from vendor configuration as it is
    already default and it might be hard to override.
  - Fix broken obsoletes for openssh-ldap (#1902084)


author: Jakub Jelen <jjelen@redhat.com> - 8.4p1-5 + 0.10.4-1
changelog:
  - Use /usr/share/empty.sshd instead of /var/empty/sshd
  - Allow emptu labels in PKCS#11 tokens (#1919007)
  - Drop openssh-cavs subpackage


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.6p1-1 + 0.10.4-3
changelog:
  - New upstream release (#1950819)
  - ssh-keygen printing fingerprint issue with Windows keys (#1901518)
  - sshd provides PAM an incorrect error code (#1879503)


author: Clemens Lang <cllang@redhat.com> - 1:3.0.2-2
changelog:
  - Allow disabling SHA1 signature creation and verification.
    Set rh-allow-sha1-signatures = no to disable.
    Allow SHA1 in TLS in SECLEVEL 1 if rh-allow-sha1-signatures = yes. This will
    support SHA1 in TLS in the LEGACY crypto-policy.
    Resolves: rhbz#2070977, rhbz#2071615
    Related: rhbz#2031742, rhbz#2062640


author: Clemens Lang <cllang@redhat.com> - 1:3.0.2-4
changelog:
  - Fix regression in evp_pkey_name2type caused by tr_TR locale fix
  - Support rsa_pkcs1_md5_sha1 in TLS 1.0/1.1 with rh-allow-sha1-signatures = yes
    to restore TLS 1.0 and 1.1 support in LEGACY crypto-policy.
    Resolves: rhbz#2069239


author: Jonathan Lebon <jonathan@jlebon.com> - 2020.6-3
changelog:
  - Revert support for devicetrees
    https://github.com/ostreedev/ostree/issues/2154
    https://bugzilla.redhat.com/show_bug.cgi?id=1880499


author: Jonathan Lebon <jonathan@jlebon.com> - 2020.6-5
changelog:
  - Backport https://github.com/ostreedev/ostree/pull/2211 for
    https://bugzilla.redhat.com/show_bug.cgi?id=1886149


author: Jonathan Lebon <jonathan@jlebon.com> - 2020.7-3
changelog:
  - Backport https://github.com/ostreedev/ostree/pull/2219 for
    https://bugzilla.redhat.com/show_bug.cgi?id=1888436


author: Daiki Ueno <dueno@redhat.com> - 0.23.19-1
changelog:
  - Update to upstream 0.23.19 release
  - Check archive signature in %prep
  - Switch to using Meson as the build system


author: Packit Service <user-cont-team+packit-service@redhat.com> - 0.23.22-1
changelog:
  - Release 0.23.22 (Daiki Ueno)
  - Follow-up to arithmetic overflow fix (David Cook)
  - Check for arithmetic overflows before allocating (David Cook)
  - Check attribute length against buffer size (David Cook)
  - Fix bounds check in p11_rpc_buffer_get_byte_array (David Cook)
  - Fix buffer overflow in log_token_info (David Cook)
  - common: Don't assume __STDC_VERSION__ is always defined (Daiki Ueno)
  - compat: getauxval: correct compiler macro for FreeBSD (Daiki Ueno)
  - compat: fdwalk: add guard for Linux specific local variables (Daiki Ueno)
  - meson: Add missing libtasn1 dependency (Daiki Ueno)
  - travis: Add freebsd build (Daiki Ueno)
  - anchor: Prefer persistent format when storing anchor (Daiki Ueno)
  - travis: Run "make check" along with "make distcheck" for coverage (Daiki Ueno)
  - travis: Use python3 as the default Python interpreter (Daiki Ueno)
  - travis: Route to Ubuntu 20.04 base image (Daiki Ueno)
  - meson: Set -fstack-protector for MinGW64 cross build (Daiki Ueno)
  - meson: expand ternary operator in function call for compatibility (Daiki Ueno)
  - meson: Use custom_target for generating external XML entities (Daiki Ueno)
  - meson: Allow building manpages without gtk-doc (Jan Alexander Steffens (heftig))
  - Rename is_path_component to is_path_separator (Alexander Sosedkin)
  - Use is_path_component in one more place (Alexander Sosedkin)
  - Remove more duplicate separators in p11_path_build (Alexander Sosedkin)
  - common: Fix infloop in p11_path_build (Daiki Ueno)
  - proxy: C_CloseAllSessions: Make sure that calloc args are non-zero (Daiki Ueno)
  - build: Use calloc in a consistent manner (Daiki Ueno)
  - meson: Allow override of default bashcompdir. Fixes meson regression (issue #322).  Pass -Dbashcompdir=/xxx to meson. (John Hein)
  - common: Check for a NULL locale before freeing it (Tavian Barnes)
  - p11_test_copy_setgid: Skip setgid tests on nosuid filesystems (Anders Kaseorg)
  - unix-peer: replace incorrect include1 (Rosen Penev)
  - test-compat: Skip getprogname test if BUILDDIR contains a symlink (Daiki Ueno)
  - add trust-extract-compat into EXTRA-DIST (Xℹ Ruoyao)
  - meson: install trust-extract-compat (Xℹ Ruoyao)
  - rename trust-extract-compat.in to trust-extract-compat (Xℹ Ruoyao)


author: Packit Service <user-cont-team+packit-service@redhat.com> - 0.24.1-1
changelog:
  - Release 0.24.1 (Daiki Ueno)
  - common: Support copying attribute array recursively (Daiki Ueno)
  - common: Add assert_ptr_cmp (Daiki Ueno)
  - gtkdoc: remove dependencies on custom target files (Eli Schwartz)
  - doc: Replace occurrence of black list with blocklist (Daiki Ueno)
  - build: Suppress cppcheck false-positive on array bounds (Daiki Ueno)
  - ci: Use Docker image from the same repository (Daiki Ueno)
  - ci: Integrate Docker image building to GitHub workflow (Daiki Ueno)
  - rpc: Fallback to version 0 if server does not support negotiation (Daiki Ueno)
  - build: Port e850e03be65ed573d0b69ee0408e776c08fad8a3 to meson (Daiki Ueno)
  - Link libp11-kit so that it cannot unload (Emmanuel Dreyfus)
  - trust: Use dngettext for plurals (Daiki Ueno)
  - rpc: Support protocol version negotiation (Daiki Ueno)
  - rpc: Separate authentication step from transaction (Daiki Ueno)
  - Meson: p11_system_config_modules instead of p11_package_config_modules (Issam E. Maghni)
  - shell: test -a|o is not POSIX (Issam E. Maghni)
  - Meson: Add libtasn1 to trust programs (Issam E. Maghni)
  - meson: optionalise glib's development files for gtk_doc (Đoàn Trần Công Danh)


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.4.0-2
changelog:
  - Enable layered configuration with distribution configs in /usr/share/pam.d
  - Added new pam-redhat tarball to lookaside cache


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.4.0-5
changelog:
  - pam_motd: read motd files with target user credentials skipping unreadable ones (#1861640)
  - Clarify upstreamed patches


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.4.0-6
changelog:
  - pam_unix: fix missing initialization of daysleft  (#1887077)
  - pam_motd: change privilege message prompt to default (#1861640)


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.5.0-1
changelog:
  - Rebase to release 1.5.0
  - Rebase to pam-redhat-1.1.4
  - Remove pam_cracklib, pam_tally and pam_tally2
  - spec file cleanup


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.5.1-1
changelog:
  - Rebase to release 1.5.1
  - fix CVE-2020-27780: authentication bypass when the user doesn't exist
    and root password is blank (#1901173)


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.5.1-4
changelog:
  - Change fingerprint-auth.pamd to return PAM_AUTHINFO_UNAVAIL from pam_fprintd.so
  - Clean auto-generated message from pam stack files


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.5.2-4
changelog:
  - Remove the /etc/motd.d directory to exclude its ownership from pam (#1968131)
  - pam_timestamp: enable openssl hmac authentication on supported
    distributions (Fedora >= 36 and RHEL >= 9) (#1947294)
  - Clean spec file: organize dependencies and move URL location


author: Björn Esser <besser82@fedoraproject.org> - 1.5.2-5
changelog:
  - Rebase to pam-redhat-1.1.5
  - Drop explicit dependency on openssl, as auto-deps will pull it in
  - Conditionalize BR: openssl >= 3.0.0 to supported distributions


author: Björn Esser <besser82@fedoraproject.org> - 1.5.2-6
changelog:
  - Remove old cruft from spec file
  - Rename docs sub-package to doc
  - Replace $RPM_BUILD_ROOT with %{buildroot}
  - Move documentation to %{_pkgdocdir}
  - Constantly use spaces for indentation


author: Pavel Březina <pbrezina@redhat.com> - 1.5.2-8
changelog:
  - systemd-auth, smartcard-auth, fingerprint-auth, password-auth and postlogin are now owned by authselect (#2023738)


author: Björn Esser <besser82@fedoraproject.org> - 1.5.2-1
changelog:
  - Rebase to release 1.5.2
    Resolves: #2001208
  - Add so_ver macro to avoid accidental soname bumps
  - Add a patch to fix a missing header include in pam_console


author: Petr Pisar <ppisar@redhat.com> - 8.43-3
changelog:
  - Make erroroffset initializion in a POSIX wrapper thread-safe
    (upstream bug #2447)
  - Fix an integer overflow when parsing numbers after "(?C" (upstream bug #2463)
  - Fix shifting integer bits and a NULL pointer dereferce in pcretest tool
    (upstream bug #2380)


author: Petr Pisar <ppisar@redhat.com> - 10.35-6
changelog:
  - Fix escaping test data and only allow slash delimiter after perltest pragma
    (upstream bug #2641)
  - Fix a mismatch when caselessly searching in an invalid UTF-8 text and a start
    optimization is enabled (upstream bug #2642)


author: Petr Pisar <ppisar@redhat.com> - 10.35-7
changelog:
  - Fix matching a character set when JIT is enabled and both Unicode script and
    Unicode class are present (upstream bug #2644)


author: Petr Pisar <ppisar@redhat.com> - 10.36-3
changelog:
  - Fix misparsing long numbers as a backreference and a number without
    a closing bracket as a quantifier (upstream bug #2690)


author: Petr Pisar <ppisar@redhat.com> - 10.36-4
changelog:
  - Fix a mismatch if \K was involved in a recursion
  - Restore single character repetition optimization in JIT (upstream bug #2698)


author: Lukas Javorsky <ljavorsk@redhat.com> - 10.37-1
changelog:
  - Rebase to the 10.37
  - libpcre2-posix.so.2* SONAME bump to libpcre2-posix.so.3*
  - Enable JIT for s390x arch
  - Patches upstreamed: Patch 1,2,3,4
  - Resolves: rhbz#1970765, BZ#1965025


author: Lukas Javorsky <ljavorsk@redhat.com> - 10.37-3
changelog:
  - Revert of copying the old posix library - After rebuilding all
  - dependend packages we don't need to backport the old library


author: Lokesh Mandvekar <lsm5@fedoraproject.org> - 3:3.3.0-0.13.rc2
changelog:
  - Bump to v3.3.0-rc2
  - Include podman-gvproxy which provides
  /usr/libexecdir/podman/podman-gvproxy
  - Bump dnsname to v1.3.0 commit dc59f28


author: Lokesh Mandvekar <lsm5@fedoraproject.org> - 3:3.3.0-0.20.dev.git599b7d7
changelog:
  - remove /etc/sysconfdir/cni/net.d/87-podman-bridge.conflist
  - bodhi will not be ignored for this one so cut us some slack ;)


author: Lokesh Mandvekar <lsm5@fedoraproject.org> - 3:3.3.0-0.27.rc2
changelog:
  - Bump to v3.3.0-rc2
  - Include podman-gvproxy subpackage which provides
  /usr/libexecdir/podman/podman-gvproxy


author: Lokesh Mandvekar <lsm5@fedoraproject.org> - 3:3.4.7-1
changelog:
  - built v3.4.7
  - Resolves: #2070368, #2074164 - Security fix for CVE-2022-1227
  - Resolves: #2045880, #2067448 - Security fix for CVE-2022-21698
  - Resolves: #2064702, #2074267 - Security fix for CVE-2022-27191
  - Resolves: #2066568, #2070102 - Security fix for CVE-2022-27649


author: Lokesh Mandvekar <lsm5@fedoraproject.org> - 3:4.0.0
changelog:
  - bump to v4.0.0
  - autospec misbehaves if the git logs ever used an unescaped rpm macro
  - so adding a manual changelog entry (rhbz#2051542)


author: Lokesh Mandvekar <lsm5@fedoraproject.org> - 3:4.0.0
changelog:
  - bump to v4.0.0
  - autospec misbehaves if the git logs ever used an unescaped rpm macro
  - so adding a manual changelog entry


author: Petr Lautrbach <plautrba@redhat.com> - 3.1-5
changelog:
  - Build with libsepol.so.1 and libsemanage.so.2
  - Set X-GNOME-HiddenUnderSystemd=true in restorecond.desktop file
  - fixfiles: correctly restore context of mountpoints
  - sepolgen: print extended permissions in hexadecimal


author: Petr Lautrbach <plautrba@redhat.com> - 3.1-7
changelog:
  - python/sepolicy: allow to override manpage date
  - selinux_config(5): add a note that runtime disable is deprecated


author: Petr Lautrbach <plautrba@redhat.com> - 3.2-2
changelog:
  - Do not use Python slip
  - fixfiles: do not exclude /dev and /run in -C mode
  - dbus: use GLib.MainLoop


author: Petr Lautrbach <plautrba@redhat.com> - 3.3-2
changelog:
  - setfiles/restorecon: support parallel relabeling with -T <N> option
  - semodule: add -m | --checksum option


author: Jan Rybar <jrybar@redhat.com> - 3.3.16-2
changelog:
  - ps: new exe format option to show real path to exe
  - pidof: new -w option to show kernel worker threads
  - pkill: manpage to document -e option
  - Resolves: bz#1629413
  - Resolves: bz#1399206


author: Panu Matilainen <pmatilai@redhat.com> - 4.16.1.2-1
changelog:
  - Rebase to rpm 4.16.1.2 (http://rpm.org/wiki/Releases/4.16.1.2)
  - Add a spec safeguard for accidental soname bumps


author: Panu Matilainen <pmatilai@redhat.com> - 4.16.1.2-5
changelog:
  - Make with/without bdb build option actually work
  - Clean up unpackaged /var/tmp from the build root


author: Panu Matilainen <pmatilai@redhat.com> - 4.17.0-0.beta1.1
changelog:
  - Rebase to 4.17.0 beta1
  - Add back /usr/lib/rpm/find-debuginfo.sh as a compat symlink
  - Add temporary buildrequire on pandoc due to makefile bugs in beta1


author: Neal Gompa <ngompa@fedoraproject.org> - 4.17.0-7
changelog:
  - Migrate rpmdb to /usr/lib/sysimage/rpm (#2042099)
    https://fedoraproject.org/wiki/Changes/RelocateRPMToUsr


author: Colin Walters <walters@verbum.org> - 2021.10-2
changelog:
  - Backport
    https://github.com/coreos/rpm-ostree/pull/3095/commits/1d445170b97e8eaad6979b68f1c3ce3481c801ea


author: Jan Kratochvil <jan@jankratochvil.net> - 3.2.3-10
changelog:
  - Re-enable xxh128 xxh3 xxh64 disabled during 3.2.2 update.
  - Enforce openssl xxhash zstd lz4 ipv6 features by --enable-*.


author: Michal Ruprich <mruprich@redhat.com> - 3.2.3-4
changelog:
  - Resolves: #1894485 - rsync is unable to set permissions when chrooted
  - Getting rid of deprecated makeinstall macro


author: Lokesh Mandvekar <lsm5@fedoraproject.org> - 2:1.0.0-376.dev.git12644e6
changelog:
  - unversioned Provides: oci-runtime
  - runc package will also provide an unversioned Provides: oci-runtime.
  - user should pull in runc separately or else it will install crun by default
   (alphabetical order)
  - similar situation as caddy, httpd, lighttpd and nginx having Provides: webserver


author: Lokesh Mandvekar <lsm5@fedoraproject.org> - 2:1.1.1-1
changelog:
  - Bump to v1.1.1
  - add hardening flags
  - remove unused packages
  - update license and bundled provides


author: Luca BRUNO <lucab@lucabruno.net> - 0.0.20-1
changelog:
  - New upstream version
    https://github.com/coreos/zincati/releases/tag/v0.0.20
  - Temporarily use bundled crates from vendor tarball


author: Luca BRUNO <lucab@lucabruno.net> - 0.0.21-1
changelog:
  - New upstream version
    https://github.com/coreos/zincati/releases/tag/v0.0.21
  - Turn off the usage of bundled crates, all in Fedora now


author: Luca BRUNO <lucab@lucabruno.net> - 0.0.22-1
changelog:
  - New upstream version
    https://github.com/coreos/zincati/releases/tag/v0.0.22
  - Temporarily use bundled crates from vendor tarball


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.7-17
changelog:
  - Update .copr/make-srpm.sh to use rawhide as DISTGIT_BRANCH
  - Dontaudit setsched for rndc
  - Allow systemd-logind destroy entries in message queue
  - Add userdom_destroy_unpriv_user_msgq() interface
  - ci: Install build dependencies from koji
  - Dontaudit vhostmd to write in /var/lib/rpm/ dir and allow signull rpm
  - Add new cmadmin port for bfdd dameon
  - virtiofs supports Xattrs and SELinux
  - Allow domain write to systemd-resolved PID socket files
  - Label /var/run/pcsd-ruby.socket       socket with cluster_var_run_t type
  - Allow rhsmcertd_t domain transition to kpatch_t
  - Revert "Add kpatch_exec() interface"
  - Revert "Allow rhsmcertd execute kpatch"
  - Allow openvswitch create and use xfrm netlink sockets
  - Allow openvswitch_t perf_event write permission
  - Add kpatch_exec() interface
  - Allow rhsmcertd execute kpatch
  - Adds rule to allow glusterd to access RDMA socket
  - radius: Lexical sort of service-specific corenet rules by service name
  - VQP: Include IANA-assigned TCP/1589
  - radius: Allow binding to the VQP port (VMPS)
  - radius: Allow binding to the BDF Control and Echo ports
  - radius: Allow binding to the DHCP client port
  - radius: Allow net_raw; allow binding to the DHCP server ports
  - Add rsync_sys_admin tunable to allow rsync sys_admin capability
  - Allow staff_u run pam_console_apply
  - Allow openvswitch_t perf_event open permission
  - Allow sysadm read and write /dev/rfkill
  - Allow certmonger fsetid capability
  - Allow domain read usermodehelper state information


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.7-18
changelog:
  - Allow lockdown confidentiality for domains using perf_event
  - define lockdown class and access
  - Add perfmon capability for all domains using perf_event
  - Allow ptp4l_t bpf capability to run bpf programs
  - Revert "Allow ptp4l_t sys_admin capability to run bpf programs"
  - access_vectors: Add new capabilities to cap2
  - Allow systemd and systemd-resolved watch dbus pid objects
  - Add new watch interfaces in the base and userdomain policy
  - Add watch permissions for contrib packages
  - Allow xdm watch /usr directories
  - Allow getty watch its private runtime files
  - Add watch permissions for nscd and sssd
  - Add watch permissions for firewalld and NetworkManager
  - Add watch permissions for syslogd
  - Add watch permissions for systemd services
  - Allow restorecond watch /etc dirs
  - Add watch permissions for user domain types
  - Add watch permissions for init
  - Add basic watch interfaces for systemd
  - Add basic watch interfaces to the base module
  - Add additional watch object permissions sets and patterns
  - Allow init_t to watch localization symlinks
  - Allow init_t to watch mount directories
  - Allow init_t to watch cgroup files
  - Add basic watch patterns
  - Add new watch* permissions


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.7-19
changelog:
  - Bump version as Fedora 34 has been branched off rawhide
  - Allow xdm watch its private lib dirs, /etc, /usr
  - Allow systemd-importd create /run/systemd/machines.lock file
  - Allow rhsmcertd_t read kpatch lib files
  - Add integrity lockdown permission into dev_read_raw_memory()
  - Add confidentiality lockdown permission into fs_rw_tracefs_files()
  - Allow gpsd read and write ptp4l_t shared memory.
  - Allow colord watch its private lib files and /usr
  - Allow init watch_reads mount PID files
  - Allow IPsec and Certmonger to use opencryptoki services


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.7-20
changelog:
  - Allow userdomain watch various filesystem objects
  - Allow systemd-logind and systemd-sleep integrity lockdown permission
  - Allow unconfined_t and kprop_t to create krb5_0.rcache2 with the right context
  - Allow pulseaudio watch devices and systemd-logind session dirs
  - Allow abrt-dump-journal-* watch generic log dirs and /run/log/journal dir
  - Remove duplicate files_mounton_etc(init_t) call
  - Add watch permissions to manage_* object permissions sets
  - Allow journalctl watch generic log dirs and /run/log/journal dir
  - Label /etc/resolv.conf as net_conf_t even when it's a symlink
  - Allow SSSD to watch /var/run/NetworkManager
  - Allow dnsmasq_t to watch /etc
  - Remove unnecessary lines from the new watch interfaces
  - Fix docstring for init_watch_dir()
  - Allow xdm watch its private lib dirs, /etc, /usr


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.7-21
changelog:
  - Allow unconfined integrity lockdown permission
  - Relocate confidentiality lockdown rule from unconfined_domain_type to unconfined
  - Allow systemd-machined manage systemd-userdbd runtime sockets
  - Enable systemd-sysctl domtrans for udev
  - Introduce kernel_load_unsigned_module interface and use it for couple domains
  - Allow gpg watch user gpg secrets dirs
  - Build also the container module in CI
  - Remove duplicate code from kernel.te
  - Allow restorecond to watch all non-auth directories
  - Allow restorecond to watch its config file


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.7-22
changelog:
  - Allow systemd-sleep get attributes of fixed disk device nodes
  - Complete initial policy for systemd-coredump
  - Label SDC(scini) Dell Driver
  - Allow upowerd to send syslog messages
  - Remove the disk write permissions from tlp_t
  - Label NVMe devices as fixed_disk_device_t
  - Allow rhsmcertd bind tcp sockets to a generic node
  - Allow systemd-importd manage machines.lock file
  - Allow unconfined integrity lockdown permission
  - Relocate confidentiality lockdown rule from unconfined_domain_type to unconfined
  - Allow systemd-machined manage systemd-userdbd runtime sockets
  - Enable systemd-sysctl domtrans for udev
  - Introduce kernel_load_unsigned_module interface and use it for couple domains
  - Allow gpg watch user gpg secrets dirs
  - Build also the container module in CI
  - Remove duplicate code from kernel.te
  - Allow restorecond to watch all non-auth directories
  - Allow restorecond to watch its config file


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.7-23
changelog:
  - iptables.fc: Add missing legacy entries
  - iptables.fc: Remove some duplicate entries
  - iptables.fc: Remove duplicate file context entries
  - Allow libvirtd to create generic netlink sockets
  - Allow libvirtd the fsetid capability
  - Allow libvirtd to read /run/utmp
  - Dontaudit sys_ptrace capability when calling systemctl
  - Allow udisksd to read /dev/random
  - Allow udisksd to watch files under /run/mount
  - Allow udisksd to watch /etc
  - Allow crond to watch user_cron_spool_t directories
  - Allow accountsd watch xdm config directories
  - Label /etc/avahi with avahi_conf_t
  - Allow sssd get cgroup filesystems attributes and search cgroup dirs
  - Allow systemd-hostnamed read udev runtime data
  - Remove dev_getattr_sysfs_fs() interface calls for particular domains
  - Allow domain stat the /sys filesystem
  - Dontaudit NetworkManager write to initrc_tmp_t pipes
  - policykit.te: Clean up watch rule for policykit_auth_t
  - Revert further unnecessary watch rules
  - Revert "Allow getty watch its private runtime files"
  - Allow systemd watch generic /var directories
  - Allow init watch network config files and lnk_files


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.7-24
changelog:
  - Allow apmd watch generic device directories
  - Allow kdump load a new kernel
  - Add confidentiality lockdown permission to kernel_read_core_if()
  - Allow keepalived read nsfs files
  - Allow local_login_t get attributes of filesystems with ext attributes
  - Allow keepalived read/write its private memfd: objects
  - Add missing declaration in rpm_named_filetrans()
  - Change param description in cron interfaces to userdomain_prefix


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.7-25
changelog:
  - Allow polkit-agent-helper-1 read logind sessions files
  - Allow polkit-agent-helper read init state
  - Allow login_userdomain watch generic device dirs
  - Allow login_userdomain listen on bluetooth sockets
  - Allow user_t and staff_t bind netlink_generic_socket
  - Allow login_userdomain write inaccessible nodes
  - Allow transition from xdm domain to unconfined_t domain.
  - Add 'make validate' step to CI
  - Disallow user_t run su/sudo and staff_t run su
  - Fix typo in rsyncd.conf in rsync.if
  - Add an alias for nvme_device_t
  - Allow systemd watch and watch_reads unallocated ttys


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.7-26
changelog:
  - Allow xdm_t watch systemd-logind session dirs
  - Allow xdm_t transition to system_dbusd_t
  - Allow confined users login into graphic session
  - Allow login_userdomain watch systemd login session dirs
  - install_t: Allow NoNewPriv transition from systemd
  - Remove setuid/setgid capabilities from mysqld_t
  - Add context for new mariadbd executable files
  - Allow netutils_t create netlink generic socket
  - Allow systemd the audit_control capability conditionally


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.7-27
changelog:
  - Dontaudit domain the fowner capability
  - Extend fs_manage_nfsd_fs() to allow managing dirs as well
  - Allow spice-vdagentd watch systemd-logind session dirs


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.7-28
changelog:
  - Allow arpwatch_t create netlink generic socket
  - Allow postgrey read network state
  - Add watch_mount_dirs_pattern file pattern
  - Allow bluetooth_t dbus chat with fwupd_t
  - Allow xdm_t watch accountsd lib directories
  - Add additional interfaces for watching /boot
  - Allow sssd_t get attributes of tmpfs filesystems
  - Allow local_login_t get attributes of tmpfs filesystems


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.7-30
changelog:
  - Allow plymouthd_t exec generic program in bin directories
  - Allow dhcpc_t domain transition to chronyc_t
  - Allow login_userdomain bind xmsg port
  - Allow ibacm the net_raw and sys_rawio capabilities
  - Allow nsswitch_domain read cgroup files
  - Allow systemd-sleep create hardware state information files


author: Zdenek Pytela <zpytela@redhat.com> - 34.2-1
changelog:
  - Allow usbmuxd get attributes of cgroup filesystems
  - Allow accounts-daemon get attributes of cgroup filesystems
  - Allow pool-geoclue get attributes of cgroup filesystems
  - allow systemd-sleep to set timer for suspend-then-hibernate
  - Allow aide connect to systemd-userdbd with a unix socket
  - Add new interfaces with watch_mount and watch_with_perm permissions
  - Add file context specification for /usr/libexec/realmd
  - Allow /tmp file transition for dbus-daemon also for sock_file
  - Allow login_userdomain create cgroup files
  - Allow plymouthd_t exec generic program in bin directories


author: Zdenek Pytela <zpytela@redhat.com> - 34.3-1
changelog:
  - Label /etc/redis as redis_conf_t
  - Add brltty new permissions required by new upstream version
  - Allow cups-lpd read its private runtime socket files
  - Dontaudit daemon open and read init_t file
  - Add file context specification for /var/tmp/tmp-inst
  - Allow brltty create and use bluetooth_socket
  - Allow usbmuxd get attributes of cgroup filesystems


author: Zdenek Pytela <zpytela@redhat.com> - 34.4-1
changelog:
  - Allow domain create anonymous inodes
  - Add anon_inode class to the policy
  - Allow systemd-coredump getattr nsfs files and net_admin capability
  - Allow systemd-sleep transition to sysstat_t
  - Allow systemd-sleep transition to tlp_t
  - Allow systemd-sleep transition to unconfined_service_t on bin_t executables
  - Allow systemd-timedated watch runtime dir and its parent
  - Allow system dbusd read /var/lib symlinks
  - Allow unconfined_service_t confidentiality and integrity lockdown
  - Label /var/lib/brltty with brltty_var_lib_t
  - Allow domain and unconfined_domain_type watch /proc/PID dirs
  - Additional permission for confined users loging into graphic session
  - Make for screen fsetid/setuid/setgid permission conditional
  - Allow for confined users acces to wtmp and run utempter


author: Zdenek Pytela <zpytela@redhat.com> - 34.5-1
changelog:
  - Grant execmem to varnishlog_t
  - We no longer need signull for varnishlog_t
  - Add map permission to varnishd_read_lib_files
  - Allow systemd-sleep tlp_filetrans_named_content()
  - Allow systemd-sleep execute generic programs
  - Allow systemd-sleep execute shell
  - Allow to sendmail read/write kerberos host rcache files
  - Allow freshclam get attributes of cgroup filesystems
  - Fix context of /run/systemd/timesync
  - Allow udev create /run/gdm with proper type
  - Allow chronyc socket file transition in user temp directory
  - Allow virtlogd_t to create virt_var_lockd_t dir
  - Allow pluto IKEv2 / ESP over TCP


author: Zdenek Pytela <zpytela@redhat.com> - 34.6-1
changelog:
  - Make domains use kernel_write_perf_event() and kernel_manage_perf_event()
  - Add kernel_write_perf_event() and kernel_manage_perf_event()
  - Allow syslogd_t watch root and var directories
  - Allow unconfined_t read other processes perf_event records
  - Allow login_userdomain read and map /var/lib/systemd files
  - Allow NetworkManager watch its config dir
  - Allow NetworkManager read and write z90crypt device
  - Allow tgtd create and use rdma socket
  - Allow aide connect to init with a unix socket


author: Zdenek Pytela <zpytela@redhat.com> - 34.7-1
changelog:
  - Allow tgtd read and write infiniband devices
  - Add a comment on virt_sandbox booleans with empty content
  - Deprecate duplicate dev_write_generic_sock_files() interface
  - Allow vnstatd_t map vnstatd_var_lib_t files
  - Allow privoxy execmem
  - Allow pmdakvm read information from the debug filesystem
  - Add lockdown integrity into kernel_read_debugfs() and kernel_manage_debugfs()
  - Add permissions to delete lnk_files into gnome_delete_home_config()
  - Remove rules for inotifyfs
  - Remove rules for anon_inodefs
  - Allow systemd nnp_transition to login_userdomain
  - Allow unconfined_t write other processes perf_event records
  - Allow sysadm_t dbus chat with tuned
  - Allow tuned write profile files with file transition
  - Allow tuned manage perf_events
  - Make domains use kernel_write_perf_event() and kernel_manage_perf_event()


author: Zdenek Pytela <zpytela@redhat.com> - 34.8-1
changelog:
  - Allow local_login_t nnp_transition to login_userdomain
  - Allow asterisk watch localization symlinks
  - Allow NetworkManager_t to watch /etc
  - Label /var/lib/kdump with kdump_var_lib_t
  - Allow amanda get attributes of cgroup filesystems
  - Allow sysadm_t nnp_domtrans to systemd_tmpfiles_t
  - Allow install_t nnp_domtrans to setfiles_mac_t
  - Allow fcoemon create sysfs files


author: Zdenek Pytela <zpytela@redhat.com> - 34.9-1
changelog:
  - Add kerberos object filetrans for nsswitchdomain
  - Allow fail2ban watch various log files
  - Add logging_watch_audit_log_files() and logging_watch_audit_log_dirs()
  - Remove further modules recently removed from refpolicy
  - Remove modules not shipped and not present in refpolicy
  - Revert "Add permission open to files_read_inherited_tmp_files() interface"
  - Revert "Allow pcp_pmlogger_t to use setrlimit BZ(1708951)"
  - Revert "Dontaudit logrotate to setrlimit itself. rhbz#1309604"
  - Revert "Allow cockpit_ws_t domain to set limits BZ(1701703)"
  - Dontaudit setrlimit for domains that exec systemctl
  - Allow kdump_t net_admin capability
  - Allow nsswitch_domain read init pid lnk_files
  - Label /dev/trng with random_device_t
  - Label /run/systemd/default-hostname with hostname_etc_t
  - Add default file context specification for dnf log files
  - Label /dev/zram[0-9]+ block device files with fixed_disk_device_t
  - Label /dev/udmabuf character device with dma_device_t
  - Label /dev/dma_heap/* char devices with dma_device_t
  - Label /dev/acpi_thermal_rel char device with acpi_device_t


author: Zdenek Pytela <zpytela@redhat.com> - 34.10-1
changelog:
  - Allow using opencryptoki for ipsec
  - Allow using opencryptoki for certmonger
  - Label var.lib.opencryptoki.* files and create pkcs_tmpfs_filetrans()
  - Label /dev/dma_heap with dma_device_dir_t
  - Allow syslogd watch non security dirs conditionally
  - Introduce logging_syslogd_list_non_security_dirs tunable
  - Remove openhpi module
  - Allow udev to watch fixed disk devices
  - Allow httpd_sys_script_t read, write, and map hugetlbfs files
  - Allow apcupsd get attributes of cgroup filesystems


author: Zdenek Pytela <zpytela@redhat.com> - 34.11-1
changelog:
  - Allow sanlock get attributes of cgroup filesystems
  - Associate dma_device_dir_t with device filesystem
  - Set default file context for /var/run/systemd instead of /run/systemd
  - Allow nmap create and use rdma socket
  - Allow pkcs-slotd create and use netlink_kobject_uevent_socket


author: Zdenek Pytela <zpytela@redhat.com> - 34.12-1
changelog:
  - Label /dev/dma_heap/* char devices with dma_device_t
  - Revert "Label /dev/dma_heap/* char devices with dma_device_t"
  - Revert "Label /dev/dma_heap with dma_device_dir_t"
  - Revert "Associate dma_device_dir_t with device filesystem"
  - Add the lockdown integrity permission to dev_map_userio_dev()
  - Allow systemd-modules-load read/write tracefs files
  - Allow sssd watch /run/systemd
  - Label /usr/bin/arping plain file with netutils_exec_t
  - Label /run/fsck with fsadm_var_run_t
  - Label /usr/bin/Xwayland with xserver_exec_t
  - Allow systemd-timesyncd watch dbus runtime dir
  - Allow asterisk watch localization files
  - Allow iscsid read all process stat
  - iptables.fc: Add missing legacy-restore and legacy-save entries
  - Label /run/libvirt/common with virt_common_var_run_t
  - Label /.k5identity file allow read of this file to rpc.gssd
  - Make usbmuxd_t a daemon


author: Zdenek Pytela <zpytela@redhat.com> - 34.12-2
changelog:
  - Add a systemd service to check that SELinux is disabled properly
  - specfile: Add unowned dir to the macro
  - Relabel /dev/dma_heap explicitly


author: Zdenek Pytela <zpytela@redhat.com> - 34.13-1
changelog:
  - Allow radius map its library files
  - Allow nftables read NetworkManager unnamed pipes
  - Allow logrotate rotate container log files


author: Zdenek Pytela <zpytela@redhat.com> - 34.14-1
changelog:
  - Revert "update libs_filetrans_named_content() to have support for /usr/lib/debug directory"
  - Remove references to init_watch_path_type attribute
  - Remove all redundant watch permissions for systemd
  - Allow systemd watch non_security_file_type dirs, files, lnk_files
  - Removed adding to attribute unpriv_userdomain from userdom_unpriv_type template
  - Allow bacula get attributes of cgroup filesystems
  - Allow systemd-journal-upload watch logs and journal
  - Create a policy for systemd-journal-upload
  - Allow tcpdump and nmap get attributes of infiniband_device_t
  - Allow arpwatch get attributes of infiniband_device_t devices
  - Label /dev/wmi/dell-smbios as acpi_device_t


author: Zdenek Pytela <zpytela@redhat.com> - 34.15-1
changelog:
  - Disable seccomp on CI containers
  - Allow systemd-machined stop generic service units
  - Allow virtlogd_t read process state of user domains
  - Add "/" at the beginning of dev/shm/var\.lib\.opencryptoki.* regexp
  - Label /dev/crypto/nx-gzip with accelerator_device_t
  - Update the policy for systemd-journal-upload
  - Allow unconfined domains to bpf all other domains
  - Confine rhsm service and rhsm-facts service as rhsmcertd_t
  - Allow fcoemon talk with unconfined user over unix domain datagram socket
  - Allow abrt_domain read and write z90crypt device
  - Allow mdadm read iscsi pid files
  - Change dev_getattr_infiniband_dev() to use getattr_chr_files_pattern()
  - Label /usr/lib/pcs/pcs_snmp_agent with cluster_exec_t
  - Allow hostapd bind UDP sockets to the dhcpd port
  - Unconfined domains should not be confined


author: Zdenek Pytela <zpytela@redhat.com> - 34.16-1
changelog:
  - Allow systemd-timesyncd watch system dbus pid socket files
  - Allow firewalld drop capabilities
  - Allow rhsmcertd execute gpg
  - Allow lldpad send to kdump over a unix dgram socket
  - Allow systemd-gpt-auto-generator read udev pid files
  - Set default file context for /sys/firmware/efi/efivars
  - Allow tcpdump run as a systemd service
  - Allow nmap create and use netlink generic socket
  - Allow nscd watch system db files in /var/db
  - Allow cockpit_ws_t get attributes of fs_t filesystems
  - Allow sysadm acces to kernel module resources
  - Allow sysadm to read/write scsi files and manage shadow
  - Allow sysadm access to files_unconfined and bind rpc ports
  - Allow sysadm read and view kernel keyrings
  - Allow journal mmap and read var lib files
  - Allow tuned to read rhsmcertd config files
  - Allow bootloader to read tuned etc files
  - Label /usr/bin/qemu-storage-daemon with virtd_exec_t


author: Zdenek Pytela <zpytela@redhat.com> - 34.17-1
changelog:
  - Add support for at-spi
  - Add permissions for system dbus processes
  - Allow various domains work with ICA crypto accelerator
  - Add ica module
  - Revert "Support using ICA crypto accelerator on s390x arch"
  - Allow systemd to delete fwupd var cache files
  - Allow vmtools_unconfined_t domain transition to rpm_script_t
  - Allow dirsrv read slapd tmpfs files
  - Revert "Label /dev/shm/dirsrv/ with dirsrv_tmpfs_t label"
  - Rename samba_exec() to samba_exec_net()
  - Support using ICA crypto accelerator on s390x arch
  - Allow systemd delete /run/systemd/default-hostname
  - Allow tcpdump read system state information in /proc
  - Allow rhsmcertd to create cache file in /var/cache/cloud-what
  - Allow D-bus communication between avahi and sosreport
  - Label /usr/libexec/gdm-runtime-config with xdm_exec_t
  - Allow lldpad send to kdumpctl over a unix dgram socket
  - Revert "Allow lldpad send to kdump over a unix dgram socket"
  - Allow chronyc respond to a user chronyd instance
  - Allow ptp4l respond to pmc
  - Allow lldpad send to unconfined_t over a unix dgram socket
  - Allow sssd to set samba setting


author: Zdenek Pytela <zpytela@redhat.com> - 34.17-2
changelog:
  - Relabel /var/lib/rpm explicitly
  - Revert "Relabel /dev/dma_heap explicitly"
  - Add ica module to modules-targeted-contrib.conf


author: Zdenek Pytela <zpytela@redhat.com> - 34.18-1
changelog:
  - Allow ModemManager create a qipcrtr socket
  - Allow ModemManager request to load a kernel module
  - Label /usr/sbin/virtproxyd as virtd_exec_t
  - Allow communication between at-spi and gdm processes
  - Update ica_filetrans_named_content() with create_file_perms
  - Fix the gnome_atspi_domtrans() interface summary


author: Zdenek Pytela <zpytela@redhat.com> - 34.19-1
changelog:
  - Update the dhcp client local policy
  - Allow firewalld load kernel modules
  - Allow postfix_domain to sendto unix dgram sockets.
  - Allow systemd watch unallocated ttys


author: Zdenek Pytela <zpytela@redhat.com> - 34.20-1
changelog:
  - cleanup unused codes
  - Fix typo in the gnome_exec_atspi() interface summary
  - Allow xdm execute gnome-atspi services
  - Allow gnome at-spi processes execute dbus-daemon in caller domain
  - Allow xdm watch dbus configuration
  - Allow xdm execute dbus-daemon in the caller domain
  - Revert "Allow xdm_t transition to system_dbusd_t"
  - Allow at-spi-bus-launcher read and map xdm pid files
  - Allow dhcpcd set its resource limits
  - Allow systemd-sleep get removable devices attributes
  - Allow usbmuxd get attributes of fs_t filesystems


author: Zdenek Pytela <zpytela@redhat.com> - 34.21-1
changelog:
  - Add bluetooth-related permissions into a tunable block
  - Allow gnome at-spi processes create and use stream sockets
  - Allow usbmuxd get attributes of tmpfs_t filesystems
  - Allow fprintd install a sleep delay inhibitor
  - Allow collectd get attributes of infiniband devices
  - Allow collectd create and user netlink rdma socket
  - Allow collectd map packet_socket
  - Allow snort create and use blootooth socket
  - Allow systemd watch and watch_reads console devices
  - Allow snort create and use generic netlink socket
  - Allow NetworkManager dbus chat with fwupd
  - Allow unconfined domains read/write domain perf_events
  - Allow scripts to enter LUKS password
  - Update mount_manage_pid_files() to use manage_files_pattern
  - Support hitless reloads feature in haproxy
  - Allow haproxy list the sysfs directories content
  - Allow gnome at-spi processes get attributes of tmpfs filesystems
  - Allow unbound connectto unix_stream_socket
  - Allow rhsmcertd_t dbus chat with anaconda install_t


author: Zdenek Pytela <zpytela@redhat.com> - 34.22-1
changelog:
  - Add write permisson to userfaultfd_anon_inode_perms
  - Allow unconfined_t transition to mozilla_plugin_t with NoNewPrivileges
  - Add default file context for /run/gssproxy.default.sock
  - Allow xdm_t watch fonts directories
  - Allow xdm_t watch generic directories in /lib
  - Allow xdm_t watch generic pid directories


author: Zdenek Pytela <zpytela@redhat.com> - 35.1-1
changelog:
  - Add fedoratp module
  - Allow xdm_t domain transition to fedoratp_t
  - Allow ModemManager create and use netlink route socket
  - Add default file context for /run/gssproxy.default.sock
  - Allow xdm_t watch fonts directories
  - Allow xdm_t watch generic directories in /lib
  - Allow xdm_t watch generic pid directories


author: Zdenek Pytela <zpytela@redhat.com> - 35.2-1
changelog:
  - Allow fedora-third-party execute "flatpak remote-add"
  - Add files_manage_var_lib_files() interface
  - Add write permisson to userfaultfd_anon_inode_perms
  - Allow proper function sosreport via iotop
  - Allow proper function sosreport in sysadmin role
  - Allow fedora-third-party to connect to the system log service
  - Allow fedora-third-party dbus chat with policykit
  - Allow chrony-wait service start with DynamicUser=yes
  - Allow management of lnk_files if similar access to regular files
  - Allow unconfined_t transition to mozilla_plugin_t with NoNewPrivileges
  - Allow systemd-resolved watch /run/systemd
  - Allow fedora-third-party create and use unix_dgram_socket
  - Removing pkcs_tmpfs_filetrans interface and edit pkcs policy files
  - Allow login_userdomain named filetrans to pkcs_slotd_tmpfs_t domain


author: Zdenek Pytela <zpytela@redhat.com> - 35.3-1
changelog:
  - Allow fedora-third-party run flatpak post-install actions
  - Allow fedora-third-party set_setsched and sys_nice


author: Adam Williamson <awilliam@redhat.com> - 35.3-1.20211019git94970fc
changelog:
  - Allow fedora-third-party map generic cache files
  - Add gnome_map_generic_cache_files() interface
  - Add files_manage_var_lib_dirs() interface
  - Allow fedora-third party manage gpg keys
  - Allow fedora-third-party run "flatpak remote-add --from flathub"


author: Zdenek Pytela <zpytela@redhat.com> - 35.5-1
changelog:
  - Support sanlock VG automated recovery on storage access loss 2/2
  - Support sanlock VG automated recovery on storage access loss 1/2
  - Revert "Support sanlock VG automated recovery on storage access loss"
  - Allow tlp get service units status
  - Allow fedora-third-party manage 3rd party repos
  - Allow xdm_t nnp_transition to login_userdomain
  - Add the auth_read_passwd_file() interface
  - Allow redis-sentinel execute a notification script
  - Allow fetchmail search cgroup directories
  - Allow lvm_t to read/write devicekit disk semaphores
  - Allow devicekit_disk_t to use /dev/mapper/control
  - Allow devicekit_disk_t to get IPC info from the kernel
  - Allow devicekit_disk_t to read systemd-logind pid files
  - Allow devicekit_disk_t to mount filesystems on mnt_t directories
  - Allow devicekit_disk_t to manage mount_var_run_t files
  - Allow rasdaemon sys_admin capability to verify the CAP_SYS_ADMIN of the soft_offline_page function implemented in the kernel
  - Use $releasever in koji repo to reduce rawhide hardcoding
  - authlogin: add fcontext for tcb
  - Add erofs as a SELinux capable file system
  - Allow systemd execute user bin files
  - Support sanlock VG automated recovery on storage access loss
  - Support new PING_CHECK health checker in keepalived


author: Zdenek Pytela <zpytela@redhat.com> - 35.6-1
changelog:
  - Allow PID 1 and dbus-broker IPC with a systemd user session
  - Allow rpmdb read generic SSL certificates
  - Allow rpmdb read admin home config files
  - Report warning on duplicate definition of interface
  - Allow redis get attributes of filesystems with extended attributes
  - Allow sysadm_t dbus chat with realmd_t
  - Make cupsd_lpd_t a daemon
  - Allow tlp dbus-chat with NetworkManager
  - filesystem: add fs_use_trans for ramfs
  - Allow systemd-logind destroy unconfined user's IPC objects


author: Zdenek Pytela <zpytela@redhat.com> - 35.7-1
changelog:
  - Allow systemd read unlabeled symbolic links
  - Label abrt-action-generate-backtrace with abrt_handle_event_exec_t
  - Allow dnsmasq watch /etc/dnsmasq.d directories
  - Allow rhsmcertd get attributes of tmpfs_t filesystems
  - Allow lldpd use an snmp subagent over a tcp socket
  - Allow xdm watch generic directories in /var/lib
  - Allow login_userdomain open/read/map system journal
  - Allow sysadm_t connect to cluster domains over a unix stream socket
  - Allow sysadm_t read/write pkcs shared memory segments
  - Allow sysadm_t connect to sanlock over a unix stream socket
  - Allow sysadm_t dbus chat with sssd
  - Allow sysadm_t set attributes on character device nodes
  - Allow sysadm_t read and write watchdog devices
  - Allow smbcontrol use additional socket types
  - Allow cloud-init dbus chat with systemd-logind
  - Allow svnserve send mail from the system
  - Update userdom_exec_user_tmp_files() with an entrypoint rule
  - Allow sudodomain send a null signal to sshd processes


author: Zdenek Pytela <zpytela@redhat.com> - 35.8-1
changelog:
  - Allow haproxy get attributes of filesystems with extended attributes
  - Allow haproxy get attributes of cgroup filesystems
  - Allow sysadm execute sysadmctl in sysadm_t domain using sudo
  - Allow userdomains use pam_ssh_agent_auth for passwordless sudo
  - Allow sudodomains execute passwd in the passwd domain
  - Allow braille printing in selinux
  - Allow sandbox_xserver_t map sandbox_file_t
  - Label /dev/ngXnY and /dev/nvme-subsysX with fixed_disk_device_t
  - Add hwtracing_device_t type for hardware-level tracing and debugging
  - Label port 9528/tcp with openqa_liveview
  - Label /var/lib/shorewall6-lite with shorewall_var_lib_t
  - Document Security Flask model in the policy


author: Zdenek Pytela <zpytela@redhat.com> - 35.9-1
changelog:
  - Allow sshd read filesystem sysctl files
  - Revert "Allow sshd read sysctl files"
  - Allow tlp read its systemd unit
  - Allow gssproxy access to various system files.
  - Allow gssproxy read, write, and map ica tmpfs files
  - Allow gssproxy read and write z90crypt device
  - Allow sssd_kcm read and write z90crypt device
  - Allow smbcontrol read the network state information
  - Allow virt_domain map vhost devices
  - Allow fcoemon request the kernel to load a module
  - Allow sshd read sysctl files
  - Ensure that `/run/systemd/*` are properly labeled
  - Allow admin userdomains use socketpair()
  - Change /run/user/[0-9]+ to /run/user/%{USERID} for proper labeling
  - Allow lldpd connect to snmpd with a unix domain stream socket
  - Dontaudit pkcsslotd sys_admin capability


author: Zdenek Pytela <zpytela@redhat.com> - 35.10-1
changelog:
  - Allow login_userdomain watch systemd-machined PID directories
  - Allow login_userdomain watch systemd-logind PID directories
  - Allow login_userdomain watch accountsd lib directories
  - Allow login_userdomain watch localization directories
  - Allow login_userdomain watch various files and dirs
  - Allow login_userdomain watch generic directories in /tmp
  - Allow rhsm-service read/write its private memfd: objects
  - Allow radiusd connect to the radacct port
  - Allow systemd-io-bridge ioctl rpm_script_t
  - Allow systemd-coredump userns capabilities and root mounton
  - Allow systemd-coredump read and write usermodehelper state
  - Allow login_userdomain create session_dbusd tmp socket files
  - Allow gkeyringd_domain write to session_dbusd tmp socket files
  - Allow systemd-logind delete session_dbusd tmp socket files
  - Allow gdm-x-session write to session dbus tmp sock files
  - Label /etc/cockpit/ws-certs.d with cert_t
  - Allow kpropd get attributes of cgroup filesystems
  - Allow administrative users the bpf capability
  - Allow sysadm_t start and stop transient services
  - Connect triggerin to pcre2 instead of pcre


author: Zdenek Pytela <zpytela@redhat.com> - 35.11-1
changelog:
  - Revert "Label /etc/cockpit/ws-certs.d with cert_t"
  - Allow login_userdomain write to session_dbusd tmp socket files
  - Label /var/run/user/%{USERID}/dbus with session_dbusd_tmp_t


author: Patrik Koncity <pkoncity@redhat.com> - 35.12-1
changelog:
  - Fix badly indented used interfaces
  - Allow domain transition to sssd_t
  - Dontaudit sfcbd sys_ptrace cap_userns
  - Label /var/lib/plocate with locate_var_lib_t
  - Allow hostapd talk with unconfined user over unix domain dgram socket
  - Allow NetworkManager talk with unconfined user over unix domain dgram socket
  - Allow system_mail_t read inherited apache system content rw files
  - Add apache_read_inherited_sys_content_rw_files() interface
  - Allow rhsm-service execute its private memfd: objects
  - Allow dirsrv read configfs files and directories
  - Label /run/stratisd with stratisd_var_run_t
  - Allow tumblerd write to session_dbusd tmp socket files


author: Patrik Koncity <pkoncity@redhat.com> - 35.13-1
changelog:
  - Allow systemd services watch dbusd pid directory and its parents
  - Allow ModemManager connect to the unconfined user domain
  - Label /dev/wwan.+ with modem_manager_t
  - Allow alsactl set group Process ID of a process
  - Allow domtrans to sssd_t and role access to sssd
  - Creating interface sssd_run_sssd()
  - Label utilities for exFAT filesystems with fsadm_exec_t
  - Label /dev/nvme-fabrics with fixed_disk_device_t
  - Allow init delete generic tmp named pipes
  - Allow timedatex dbus chat with xdm


author: Zdenek Pytela <zpytela@redhat.com> - 35.14-1
changelog:
  - Allow sysadm_passwd_t to relabel passwd and group files
  - Allow confined sysadmin to use tool vipw
  - Allow login_userdomain map /var/lib/directories
  - Allow login_userdomain watch library and fonts dirs
  - Allow login_userdomain watch system configuration dirs
  - Allow login_userdomain read systemd runtime files
  - Fix koji repo URL pattern
  - Allow alsa bind mixer controls to led triggers
  - Add the map permission to common_anon_inode_perm permission set
  - Rename userfaultfd_anon_inode_perms to common_inode_perms
  - Allow sanlock get attributes of filesystems with extended attributes
  - Associate stratisd_data_t with device filesystem
  - Allow init read stratis data symlinks


author: Zdenek Pytela <zpytela@redhat.com> - 35.15-1
changelog:
  - Allow systemd-networkd create and use netlink netfilter socket
  - Allow sandbox_web_client_t watch various dirs
  - filesystem.te: add genfscon rule for ntfs3 filesystem


author: Zdenek Pytela <zpytela@redhat.com> - 35.16-1
changelog:
  - Add mctp_socket security class and access vectors
  - Add the io_uring class
  - Allow fprintd read and write hardware state information
  - Label /var/run/ecblp0 pipe with cupsd_var_run_t
  - Allow iptables list cgroup directories
  - Allow dhclient create /run/chrony-dhcp with chronyd_var_run_t
  - Allow chage domtrans to sssd


author: Zdenek Pytela <zpytela@redhat.com> - 35.17-1
changelog:
  - Allow pppd create a file in the locks directory
  - Add file map permission to lpd_manage_spool() interface
  - Allow system dbus daemon watch generic directories in /var/lib
  - Remove unused security socket classes from socket_class_set


author: Adam Williamson <awilliam@redhat.com> - 35.3-1.20211019git94970fc
changelog:
  - Allow fedora-third-party map generic cache files
  - Add gnome_map_generic_cache_files() interface
  - Add files_manage_var_lib_dirs() interface
  - Allow fedora-third party manage gpg keys
  - Allow fedora-third-party run "flatpak remote-add --from flathub"
  - Allow fedora-third-party run flatpak post-install actions


author: Zdenek Pytela <zpytela@redhat.com> - 36.1-1
changelog:
  - Label exFAT utilities at /usr/sbin
  - policy/modules/contrib: Support /usr/lib/sysimage/rpm as the rpmdb path
  - Enable genfs_seclabel_symlinks policy capability
  - Sync policy/policy_capabilities with refpolicy
  - refpolicy: drop unused socket security classes
  - Label new utility of NetworkManager nm-priv-helper
  - Label NetworkManager-dispatcher service with separate context
  - Allow sanlock get attributes of filesystems with extended attributes
  - Associate stratisd_data_t with device filesystem
  - Allow init read stratis data symlinks


author: Zdenek Pytela <zpytela@redhat.com> - 36.2-1
changelog:
  - Allow sysadm_passwd_t to relabel passwd and group files
  - Allow confined sysadmin to use tool vipw
  - Allow login_userdomain map /var/lib/directories
  - Allow login_userdomain watch library and fonts dirs
  - Allow login_userdomain watch system configuration dirs
  - Allow login_userdomain read systemd runtime files
  - Allow ctdb create cluster logs
  - Allow alsa bind mixer controls to led triggers
  - New policy for insight-client
  - Add mctp_socket security class and access vectors
  - Fix koji repo URL pattern
  - Update chronyd_pid_filetrans() to allow create dirs
  - Update NetworkManager-dispatcher policy
  - Allow unconfined to run virtd bpf
  - Allow nm-privhelper setsched permission and send system logs
  - Add the map permission to common_anon_inode_perm permission set
  - Rename userfaultfd_anon_inode_perms to common_inode_perms
  - Allow confined users to use kinit,klist and etc.
  - Allow rhsmcertd create rpm hawkey logs with correct label


author: Zdenek Pytela <zpytela@redhat.com> - 36.3-1
changelog:
  - Update NetworkManager-dispatcher policy to use scripts
  - Allow init mounton kernel messages device
  - Revert "Make dbus-broker service working on s390x arch"
  - Remove permissive domain for insights_client_t
  - Allow userdomain read symlinks in /var/lib
  - Allow iptables list cgroup directories
  - Dontaudit mdadm list dirsrv tmpfs dirs
  - Dontaudit dirsrv search filesystem sysctl directories
  - Allow chage domtrans to sssd
  - Allow postfix_domain read dovecot certificates
  - Allow systemd-networkd create and use netlink netfilter socket
  - Allow nm-dispatcher read nm-dispatcher-script symlinks
  - filesystem.te: add genfscon rule for ntfs3 filesystem
  - Allow rhsmcertd get attributes of cgroup filesystems
  - Allow sandbox_web_client_t watch various dirs
  - Exclude container.if from policy devel files
  - Run restorecon on /usr/lib/sysimage/rpm instead of /var/lib/rpm


author: Zdenek Pytela <zpytela@redhat.com> - 36.4-1
changelog:
  - Update NetworkManager-dispatcher cloud and chronyc policy
  - Update insights-client: fc pattern, motd, writing to etc
  - Allow systemd-sysctl read the security state information
  - Allow init create and mounton to support PrivateDevices
  - Allow sosreport dbus chat abrt systemd timedatex


author: Zdenek Pytela <zpytela@redhat.com> - 36.5-1
changelog:
  - Add support for nm-dispatcher console helper scripts
  - Allow nm-dispatcher plugins read its directory and sysfs
  - Do not let system_cronjob_t create redhat-access-insights.log with var_log_t
  - devices: Add a comment about cardmgr_dev_t
  - Add basic policy for BinderFS
  - Label /var/run/ecblp0 pipe with cupsd_var_run_t
  - Allow rpmdb create directory in /usr/lib/sysimage
  - Allow rngd drop privileges via setuid/setgid/setcap
  - Allow init watch and watch_reads user ttys
  - Allow systemd-logind dbus chat with sosreport
  - Allow chronyd send a message to sosreport over datagram socket
  - Remove unnecessary /etc file transitions for insights-client
  - Label all content in /var/lib/insights with insights_client_var_lib_t
  - Update insights-client policy


author: Zdenek Pytela <zpytela@redhat.com> - 36.6-1
changelog:
  - Add support for systemd-network-generator
  - Add the io_uring class
  - Allow nm-dispatcher dhclient plugin append to init stream sockets
  - Relax the naming pattern for systemd private shared libraries
  - Allow nm-dispatcher iscsid plugin append to init socket
  - Add the init_append_stream_sockets() interface
  - Allow nm-dispatcher dnssec-trigger script to execute pidof
  - Add support for nm-dispatcher dnssec-trigger scripts
  - Allow chronyd talk with unconfined user over unix domain dgram socket
  - Allow fenced read kerberos key tables
  - Add support for nm-dispatcher ddclient scripts
  - Add systemd_getattr_generic_unit_files() interface
  - Allow fprintd read and write hardware state information
  - Allow exim watch generic certificate directories
  - Remove duplicate fc entries for corosync and corosync-notifyd
  - Label corosync-cfgtool with cluster_exec_t
  - Allow qemu-kvm create and use netlink rdma sockets
  - Allow logrotate a domain transition to cluster administrative domain


author: Zdenek Pytela <zpytela@redhat.com> - 36.7-3
changelog:
  - Add support for nm-dispatcher tlp-rdw scripts
  - Update github actions to satisfy git 2.36 stricter rules
  - New policy for stalld
  - Allow colord read generic files in /var/lib
  - Allow xdm mounton user temporary socket files
  - Allow systemd-gpt-auto-generator create and use netlink_kobject_uevent_socket
  - Allow sssd domtrans to pkcs_slotd_t
  - Allow keepalived setsched and sys_nice
  - Allow xdm map generic files in /var/lib
  - Allow xdm read generic symbolic links in /var/lib
  - Allow pppd create a file in the locks directory
  - Add file map permission to lpd_manage_spool() interface
  - Allow system dbus daemon watch generic directories in /var/lib
  - Allow pcscd the sys_ptrace userns capability
  - Add the corecmd_watch_bin_dirs() interface


author: Zdenek Pytela <zpytela@redhat.com> - 36.8-1
changelog:
  - Allow nm-dispatcher chronyc plugin append to init stream sockets
  - Allow tmpreaper the sys_ptrace userns capability
  - Label /usr/libexec/vdsm/supervdsmd and vdsmd with virtd_exec_t
  - Allow nm-dispatcher tlp plugin read/write the wireless device
  - Allow nm-dispatcher tlp plugin append to init socket
  - Allow nm-dispatcher tlp plugin be client of a system bus
  - Allow nm-dispatcher list its configuration directory
  - Ecryptfs-private support
  - Allow colord map /var/lib directories
  - Allow ntlm_auth read the network state information
  - Allow insights-client search rhnsd configuration directory


author: Martin Osvald <mosvald@redhat.com> - 2.13.10-1
changelog:
  - Move /var/log/lastlog ownership to systemd (#1798685)
  - tcsh sets variable p to /usr/sbin from /etc/csh.login (#2019874)
  - 'history -a' doesn't belong in /etc/bashrc (#1871744)
  - localhost.localdomain in wrong order /etc/hosts (#1724539)


author: Ondrej Vasik <ovasik@redhat.com> - 2.13.1-1
changelog:
  - do not ship /etc/hosts.allow and /etc/hosts.deny (no need for them
    in default Fedora)
  - require systemd-rpm-macros instead of systemd


author: Martin Osvald <mosvald@redhat.com> - 2.13.6-1
changelog:
  - csh.login: set PATH again (if empty) to prevent interpreter error (#1744106)
  - aliases: add pcp user (#1744091)
  - lang.csh: fix several variable substitution bugs and typos (#1746749)
  - don't set LANG as a per-shell variable
  - fix lang.csh script so it doesn't break tcsh -e scripts II (#1620004)
  - use full path for non-builtins in csh.cshrc, csh.login, lang.csh, lang.sh and profile (#1747493)


author: Tomas Bzatek <tbzatek@redhat.com> - 1.44-1
changelog:
  - Rebase to 1.44 release
  - Enable supplemental udev rules
  - Fix sg_turs help invocation in an old mode (#1683343)
  - Fix sg_raw printing error about device not specified on version request (#1627657)
  - Fix coverity scan warnings (#1633235)


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-4
changelog:
  - login.defs: include HMAC_CRYPTO_ALGO key
  - Clean spec file: organize dependencies and move License location


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-8
changelog:
  - getsubids: provide system binary and man page (#1980780)
  - pwck: fix segfault when calling fprintf() (#2021339)
  - newgrp: fix segmentation fault (#2019553)
  - groupdel: fix SIGSEGV when passwd does not exist (#1986111)


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-9
changelog:
  - nss: get shadow_logfd with log_get_logfd() (#2038811)
  - lib: make shadow_logfd and Prog not extern
  - lib: rename Prog to shadow_progname
  - lib: provide default values for shadow_progname
  - libsubid: use log_set_progname in subid_init


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.11.1-1
changelog:
  - Rebase to version 4.11.1 (#2034038)
  - Fix release sources
  - Add explicit subid requirement for subid-devel


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.8.1-11
changelog:
  - libsubid: don't print error messages on stderr by default
  - libsubid: libsubid_init return false if out of memory
  - useradd: fix SUB_UID_COUNT=0
  - libsubid: don't return owner in list_owner_ranges API call
  - libsubid: libsubid_init don't print messages on error
  - libsubid: fix newusers when nss provides subids
  - man: clarify subid delegation
  - libsubid: make shadow_logfd not extern


author: Björn Esser <besser82@fedoraproject.org> - 2:4.8.1-12
changelog:
  - Backport support for yescrypt hash method
  - Add a patch to fix the parameter type of YESCRYPT_salt_cost()


author: Björn Esser <besser82@fedoraproject.org> - 2:4.8.1-14
changelog:
  - Add a patch to fix the used prefix for the bcrypt hash method
  - Add a patch to cleanup the code in libmisc/salt.c
  - Add a patch adding some clarifying comments in libmisc/salt.c
  - Add a patch to obtain random bytes from /dev/urandom


author: Björn Esser <besser82@fedoraproject.org> - 2:4.8.1-16
changelog:
  - Add a patch to obtain random bytes using getentropy()
  - Update shadow-4.8-crypt_h.patch with the upstreamed version
  - Add a patch to make use of crypt_gensalt() from libxcrypt


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.8.1-8
changelog:
  - man: include lastlog file caveat (#951564)
  - Upstream links to several patches
  - Spec file cleanup by Robert Scheck
  - Add BuildRequires: make by Tom Stellard


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-1
changelog:
  - Rebase to version 4.9
  - usermod: allow all group types with -G option (#1975327)
  - Clean spec file


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-5
changelog:
  - useradd: generate home and mail directories with selinux user attribute
  - Clean spec file: organize dependencies and move License location


author: Martin Gieseking <martin.gieseking@uos.de> - 1.1.8-1
changelog:
  - Updated to new release.
  - Dropped version-related patch which has been applied upstream (BZ #1527850).


author: Paul Wouters <pwouters@redhat.com> - 1.7.3.3-1
changelog:
  - Resolves: rhbz#1696931 socat-1.7.3.3 is available
  - Resolves: rhbz#1612274 Man page scan results for socat
  - Disabled --enable-fips as its requires fipsld which we don't have.


author: Bruno Wolff III <bruno@wolff.to> - 4.5-9.20220207gitbd186a7
changelog:
  - Continue testing upstream patches
  - The deprecated lzma support options are improved in the man page


author: Bruno Wolff III <bruno@wolff.to> - 4.5-10.20220208git9e46a75
changelog:
  - Continue testing upstream patches prior to 4.5.1 release.
  - Upstream man page for unsquashfs replaces out of date one froom Debian.


author: Bruno Wolff III <bruno@wolff.to> - 4.5-13.20220210gita8f61e2
changelog:
  - Continue testing upstream patches prior to 4.5.1 release.
  - Some code cleanups for stuff noted by gcc.


author: Bruno Wolff III <bruno@wolff.to> - 4.5-24.20220308git8b6ee89
changelog:
  - Continue testing upstream patches prior to 4.5.1 release.
  - Minor fixes
  - Man page tweaks
  - Tentative 4.5.1 change log


author: Clark Williams <williams@redhat.com> - 1.2-1
changelog:
  - utils.c: added info() functions
  - detect and correctly parse old-style /proc/sched_debug
  - src/stalld: Fix an retval check while reading sched_debug
  - src/throttling: Fix a compilation warning
  - ensure we only count task lines in old-format sched_debug info
  - Add comments, clean up trailing whitespace
  - src/utils: Fix runtime parameters check
  - stalld: Do not take actions if log_only is set
  - remove warning from parse_old_task_format


author: Clark Williams <williams@redhat.com> - 1.3-1
changelog:
  - Readme: Add information about repositories
  - Add version management and version option
  - create doc and scripts directory and add info on releases


author: Clark Williams <williams@redhat.com> - 1.4-1
changelog:
  - stalld: Set rt_runtime to -1 before trying the SCHED_DEADLINE
  - Fix incorrect recursion of specfile version field


author: Clark Williams <williams@redhat.com> - 1.7-1
changelog:
  - rework detect_task_format and buffer_size logic
  - make CFLAGS for local compile match rpmbuild CFLAGS


author: Clark Williams <williams@redhat.com> - 1.8-1
changelog:
  - Fix Readiness Protocol Mismatch with systemd
  - test01:  update to use buildin atomic operations
  - test01: add throttling check


author: Clark Williams <williams@redhat.com> - 1.9-1
changelog:
  - Set starvation threshold default to 30 seconds
  - rework read buffer allocation to properly find page size
  - Add the -g/--granularity option
  - Change the default granularity to five seconds
  - Implement idle detection
  - Implement the single-threaded mode
  - Add HRTICK_DL support


author: Clark Williams <williams@redhat.com> - 1.10-1
changelog:
  - utils: Fix bounds check on cpu and end_cpu variables
  - stalld: Support denylisting of tasks in stalld
  - src/utils: use right argument for warning printf


author: Clark Williams <williams@redhat.com> - 1.11-1
changelog:
  - redhat/stalld.spec: pick up gating test version for changelog
  - utils.c: set daemon umask to restrict global write/execute (1934586)
  - hardening fixes from coverity scan (1934590)


author: Fernando Pacheco <fpacheco@redhat.com> - 1.12-1
changelog:
  - stalld.8: fix diff cruft left in manpage source
  - stalld.c: clean up handling of nr_running
  - stalld.c: remove duplicate parameter to fill_waiting_task()
  - stalld: Add error handling in get_cpu_idle_time()
  - stalld.service: Run stalld as sched_fifo via systemd
  - packaging: clean up Makefiles and rpm specfile
  - stalld: Always print current function for info messages
  - stalld: Always print current function for warn messages
  - stalld: Always print current function for die messages
  - utils: change PATHMAX to 4096


author: Fernando Pacheco <fpacheco@redhat.com> - 1.13-1
changelog:
  - stalld: Fix log message on boost_cpu_starving_vector()
  - stalld: Add the overload control to the single-threaded mode
  - stalld: Add the adaptive mode option
  - stalld: Use the last mode set in the cmdline
  - stalld: Fallback to the adaptive mode if force_fifo is selected
  - stalld: Make single-threaded mode the default one
  - stalld.service: Always restart stalld on exit
  - utils.c: Fail if user is not root
  - utils.c: Make the path to sched_debug path dynamic


author: Fernando Pacheco <fpacheco@redhat.com> - 1.14.1-1
changelog:
  - stalld: Coding style cleanup
  - stalld: spaces in place of <TAB>
  - throttling: Use RT_RUNTIME_PATH in rt_throttling_is_off()
  - throttling: Check open() on turn_off_rt_throttling
  - throttling: Adjust variables in restore_rt_throttling()
  - stalld.c: utils.c: Remove complex assignments from variable declarations
  - stalld.h: Define MAX_PATH/DIR_PATH/FILE_NAME and use them
  - stalld: Adjust variables in parse_old_task_format()
  - utils.c: Use MAX_PATH for pidfile
  - stalld.c: Remove variable declaration from the middle of  the function
  - stalld: Respect -l option in single threaded mode
  - utils: s/try_to_open_file/check_file_exists/
  - utils: use check_file_exists in setup_hr_tick()
  - utils: Check for the new sched_features path


author: Fernando Pacheco <fpacheco@redhat.com> - 1.15-1
changelog:
  - stalld: Fix incorrect open() return value checks
  - stalld: Pass errno to strerror() on sig*set() failures
  - throttling: Always null terminate sched_rt_runtime_us output
  - stalld: Remove unreachable statement in detect_task_format()
  - tests: Fix uninitialized value action.sa_mask
  - utils: Bail if malloc() returns null in parse_cpu_list()
  - stalld: Use correct format specifier for long types


author: Clark Williams <williams@redhat.com> - 1.0-4
changelog:
  - Fix an option in README.md; consistency in user facing docs.
  - gitignore: ignore object files and the stalld executable
  - Makefile: add 'static' target to link stalld statically
  - use FIFO for boosting (v3)
  - stalld: update usage message to include --force_fifo/-F option
  - stalld.c: fix sched_debug parsing and modify waiting task parsing


author: Clark Williams <williams@redhat.com> - 1.1-1
changelog:
  - Fix an option in README.md; consistency in user facing docs.
  - Makefile: add 'static' target to link stalld statically
  - gitignore: ignore object files and the stalld executable
  - use FIFO for boosting (v3)
  - stalld.c: fix sched_debug parsing and modify waiting task parsing
  - redhat:  update release for features and bugfix
  - stalld: Do not die if sched_debug returns an invalid value
  - src/stalld: Do not die if the comm is too large
  - src/stalld: Do not die if cannot write a message to the log
  - src/stalld: Do not die if the main runs while a thread is monitoring the CPU
  - implement RT throttling management and refactor source files
  - more refactoring
  - src/stalld: Reuse already read nr_running nr_rt_running
  - src/stalld: Gracefully handle CPUs not found on sched_debug
  - src/stalld: Use dynamically allocated memory to read sched_debug
  - src/utils: Die with a divizion by zero if verbose
  - src/stalld: Add config_buffer_size variable
  - src/stalld: Increase the sched_debug read buffer if it gets too small
  - src/stalld: Fix an retval check while reading sched_debug
  - src/throttling: Fix a compilation warning


author: Attila Lakatos <alakatos@redhat.com> - 1.9.0-0.1.b1
changelog:
  - update to latest development version 1.9.0b1
  - added sudo_logsrvd and sudo_sendlog to files and their appropriate man pages
  Resolves: rhbz#1787823
  - Stack based buffer overflow in when pwfeedback is enabled
  Resolves: rhbz#1796945
  - fixes: CVE-2019-18634
  - By using ! character in the shadow file instead of a password hash can access to a run as all sudoer account
  Resolves: rhbz#1786709
  - fixes CVE-2019-19234
  - attacker with access to a Runas ALL sudoer account can impersonate a nonexistent user
  Resolves: rhbz#1786705
  - fixes CVE-2019-19232


author: Attila Lakatos <alakatos@redhat.com> - 1.9.0-0.1.b4
changelog:
  - update to latest development version 1.9.0b4
  Resolves: rhbz#1816593
  - setrlimit(RLIMIT_CORE): Operation not permitted warning message fix
  Resolves: rhbz#1773148


author: Radovan Sroka <rsroka@redhat.com> - 1.9.2-1
changelog:
  - rebase to 1.9.2
  Resolves: rhbz#1859577
  - added logsrvd subpackage
  - added openssl-devel buildrequires
  Resolves: rhbz#1860653
  - fixed sudo runstatedir path
  - it was generated as /sudo instead of /run/sudo
  Resolves: rhbz#1868215
  - added /var/lib/snapd/snap/bin to secure_path variable
  Resolves: rhbz#1691996


author: Radovan Sroka <rsroka@redhat.com> - 1.9.5p1-1
changelog:
  - rebase to 1.9.5p1
  Resolves: rhbz#1902758
  - fixed double free in sss_to_sudoers
  Resolves: rhbz#1885874
  - fixed CVE-2021-23239 sudo: possible directory existence test due to race condition in sudoedit
  Resolves: rhbz#1915055
  - fixed CVE-2021-23240 sudo: symbolic link attack in SELinux-enabled sudoedit
  Resolves: rhbz#1915054


author: Matthew Miller <mattdm@fedoraproject.org> - 1.9.5p2-1
changelog:
  - rebase to 1.9.5p2
  Resolves: rhbz#1920611
  - fixed CVE-2021-3156 sudo: Heap buffer overflow in argument parsing
  Resolves: rhbz#1920618


author: Peter Czanik <peter@czanik.hu> - 1.9.7p2-1
changelog:
  - update to 1.9.7p2
  - follow up path change in strip patch
  - added --enable-zlib=system configure parameter, so sudo uses system zlib,
    autoconf is no more needed


author: Matthew Miller <mattdm@fedoraproject.org> - 1.9.7p2-2
changelog:
  - drop obsolete requirement for post script that doesn't exist anymore 
    (thanks @scfc)
  - remove commented-out lines from prior PR


author: Yu Watanabe <yuwatana@redhat.com> - 248~rc4-1
changelog:
  - Latest upstream prelease, see
    https://github.com/systemd/systemd/blob/v248-rc4/NEWS.
  - A bunch of documentation updates, correctness fixes, and systemd-networkd
    features.
  - Resolves #1933137, #1935084, #1933873, #1931181, #1933335, #1935062, #1927148.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 248~rc4-3
changelog:
  - Fix hang when processing timers during DST switch in Europe/Dublin timezone (#1941335)
  - Fix returning combined IPv4/IPv6 responses from systemd-resolved cache (#1940715)
    (But note that the disablement of caching added previously is
    retained until we can do more testing.)
  - Minor fix to interface naming by udev
  - Fix for systemd-repart --size


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 248~rc4-4
changelog:
  - Revert patch that seems to cause problems with dns resolution
    (see comments on https://bodhi.fedoraproject.org/updates/FEDORA-2021-1c1a870ceb)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 248~rc4-5
changelog:
  - Do not preset systemd-networkd.service and systemd-networkd-wait-online.service
    on upgrades from before systemd-networkd was split out (#1943263)
  - In nsswitch.conf, move nss-myhostname to the front, before nss-mdns4 (#1943199)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 248-1
changelog:
  - Latest upstream release, see
    https://github.com/systemd/systemd/blob/v248/NEWS.
  - The changes since -rc4 are rather small, various fixes all over the place.
    A fix to how systemd-oomd selects a candidate to kill, and more debug logging
    to make this more transparent.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 248.1-1
changelog:
  - Latest stable version: a long list of minor correctness fixes all around
    (#1955475, #911766, #1958167, #1952919)
  - Enable tpm2-tss dependency (#1949505)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 248.2-1
changelog:
  - Pull in some more patches from upstream (#1944646, #1885090, #1941340)
  - Adjust modes of some %ghost files (#1956059)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 248.3-1
changelog:
  - A fix for resolved crashes (#1946386, #1960227, #1950241)
  - Some minor fixes for documentation, systemd-networkd, systemd-run, bootctl.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 248.4-1
changelog:
  - Assorted fixes (some systemd-resolved crashes, invalid
    systemd-tmpfiles assertion, etc.)
  - systemd-networkd workaround for TALOS-2020-1142, CVE-2020-13529.
  - A big update of hardware descriptions.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 248.5-1
changelog:
  - Various minor documentation and correctness fixes.
  - CVE-2021-33910, #1984020: an unchecked stack allocation could be used to
    crash systemd and cause the system to reboot by creating a very long
    fuse mountpoint path.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 248.6-1
changelog:
  - Create 'sgx' group (and also use soft-static uids for input and render,
    see https://pagure.io/setup/c/df3194a7295c2ca3cfa923981b046f4bd2754825
    and https://pagure.io/packaging-committee/issue/1078 (#1965815)
  - Various bugfixes (#1963428, #1975564)
  - Fix for a regression introduced in the previous release with
    sd-event abort (#1984651)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 248.7-1
changelog:
  - Latest bugfix release: improved compatibility with latest glibc,
    various small documentation fixes, and fixes for systemd-networkd bridging,
    other minor fixes.
  - systemctl set-property accepts glob patterns now (#1986258)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 248.8-1
changelog:
  - Latest bugfix release: fix for systemctl enable, documentation,
    systemd-networkd, -coredump, -timesyncd, -udev, -nspawn, -oomd,
    -repart, -resolved, systemd itself, seccomp filters, bootctl,
    journalctl, TPM2, sd-event, sd-journal, nss-systemd, compatibility
    with the latest kernels.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 249.5-1
changelog:
  - Latest bugfix release (various fixes in systemd-networkd,
    -timesyncd, -journald, -udev, homed, -resolved, -repart, -oomd,
    -coredump, systemd itself, seccomp filters, TPM2 handling,
    -documentation, sd-event, sd-journal, journalctl, and nss-systemd).
  - Fixes #1976445.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 249.6-2
changelog:
  - Latest bugfix release (networkd, coredumpctl, varlink, udev,
    systemctl, systemd itself, better detection of Hyper-V and
    Virtualbox virtualization, documentation updates)
  - Fix helper to restart user units


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 249.7-1
changelog:
  - Latest bugfix release (better erofs detection, sd-event memory
    corruption bugfix, logind, documentation)
  - Really fix helper to restart user units with older systemd (#2020415)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 249.8-1
changelog:
  - Create /etc/resolv.conf symlink if nothing is present yet (#2032085)
  - Add missing requirements for libfido2 and libtss2 (#1975827)
  - Allow mprotect(2), arch_prctl(2) in @default seccomp filter, bpf(2) and /proc
    for systemd-udev (#2027627)
  - Various documentation fixes (#1926323)
  - Introduce ExitType= service setting (#1956022)
  - Fix sysusers without /proc (#2036217)
  - Various fixes to condition handling (#1919538)
  - Bugfixes for the manager, systemd-networkd, systemd-journald and journalctl,
    systemd-analyze, systemd-resolved, systemd-homed, shell completions,
    systemd-detect-virt on MS Hyper-V, nss modules
  - Ordering of various units during early boot and shutdown is adjusted to fix
    some corner cases
  - Maximum numbers of files are bumped for /dev and /tmp
  - fstab-generator now ignores root-on-nfs/cifs/iscsi and live (#2037233)
  - CVE-2021-3997, #2039383: systemd-tmpfiles would exhaust the stack and crash
    during excessive recursion on a very deeply nested directory structure.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 249.9-1
changelog:
  - Revert the patches for  (#1956022), hopefully fixing (#2039888)
  - Some minor documentation fixes and a fix for journalctl
  - Make systemd-xdg-autostart-service ignore missing condition check binary
    (related to #2038750, but does not fix it)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 249.11-1
changelog:
  - Update to latest bugfix release (#2039854)
  - Create /etc/resolv.conf symlink if nothing is present yet (#2032085)
  - Drop scriptlet for handling nobody user upgrades from Fedora <28
  - Move part of %post scriptlet for resolved to %posttrans (#2072574)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 249.11-2
changelog:
  - Do not touch /etc/resolv.conf on upgrades (#2074122)
  - Undo the change to "create /etc/resolv.conf symlink if nothing is
    present yet" (#2074083)
  - Clean up modules.builtin.alias.bin on kernel upgrades (#2016630)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 249.12-1
changelog:
  - Make the scriptlet for /etc/resolv.conf more robust
  - Update to latest upstream bugfix release (#2016630, various memory access
    and correctness fixes)
  - User access via the uaccess attribute is extended to more devices
    (USB analyzers, rfkill devices, AV production controllers, TL866 EPROM readers)
  - hwdb is updated
  - clone3() returns ENOSYS when RestrictNamespaces=yes


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 249~rc2-1
changelog:
  - Latest upstream prerelease with various bugfixes, see
    https://github.com/systemd/systemd/blob/v249-rc2/NEWS.
  - Ignore FORCERENEW DHCP packets (TALOS-2020-1142, CVE-2020-13529, #1959398)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 249~rc3-1
changelog:
  - Latest upstream prerelease with various bugfixes, see
    https://github.com/systemd/systemd/blob/v249-rc3/NEWS.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 249-1
changelog:
  - Latest upstream release with minor bugfixes, see
    https://github.com/systemd/systemd/blob/v249/NEWS.
  - systemd-oomd cpu usage is reduced (#1944646)


author: Michael Catanzaro <mcatanzaro@redhat.com> - 249.2-1
changelog:
  - Build with -Ddefault-dns-over-tls=opportunistic
    (https://fedoraproject.org/wiki/Changes/DNS_Over_TLS, #1889901)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 249.2-1
changelog:
  - Latest bugfix release (a minor hwdb regression bugfix, and correction
    to kernel commandline handling when reexecuting PID 1 in a container)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 249.4-1
changelog:
  - Latest bugfix release: various fixes for systemd-networkd,
    systemd-resolved, systemd, systemd-boot.
  - Backport of macros to restart systemd user units (#1993244)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 249.5-1
changelog:
  - Latest bugfix release (various fixes in systemd-networkd,
    --timesyncd, -journald, -udev, homed, -resolved, -repart, -oomd,
    --coredump, systemd itself, seccomp filters, TPM2 handling,
    -documentation, sd-event, sd-journal, journalctl, and nss-systemd).
  - Fixes #1976445.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 250-1
changelog:
  - Version 250, only some very small changes since -rc3.
  - Switch unit status name format to 'combined' (#2028169)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 250-2
changelog:
  - Fix warning about systemd-boot-update.service not existing on
    non-uefi architectures
  - Enable all bpf features (#2035608)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 250.1-1
changelog:
  - First stable version after v250: various bugfixes, in particular for
    sd-boot, systemd-networkd, and various build issues.
  - Fixes #2036517, #2035608, #2036217.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 250.2-1
changelog:
  - Second stable release after v250: various bugfixes
    (systemd-resolved, systemd-journald, userdbctl, homed).
  - The manager should now gracefully handle the case where BPF LSM
    cannot be initialized (#2036145). The BPF filters are enabled again
    on all architectures, so *other* filter should also work on the
    affected architectures.
  - kernel-install now checks paths used by grub2 before sd-boot paths again
    (#2036199)
  - fstab-generator now ignores root-on-nfs/cifs/iscsi and live (#2037233)
  - CVE-2021-3997, #2024639: systemd-tmpfiles would exhaust the stack and crash
    during excessive recursion on a very deeply nested directory structure.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 250.3-1
changelog:
  - Third stable release after v250: fixes for sd-boot on fringe hardware (e.g. VirtualBox),
    various man page updates, sd-journal file verification is now stricter,
    systemd-networkd by default will not add routes for wireguard AllowedIPs=
    systemd nss modules shouldn't try to read kernel command line
  - Don't do sd-boot updates when not installed (#2038289)
  - xdg-autostart-service will ignore ExecCondition= when the helper binary is missing
  - kernel-install does cleanup better (#2016630)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 250.3-4
changelog:
  - Drop scriptlet for handling nobody user upgrades from Fedora <28
  - Specify owner of /var/log/journal as root in the rpm listing (#2018913)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 250.3-5
changelog:
  - Move part of %post scriptlet for resolved to %posttrans (#2018913)
  - Specify owner of utmp/wtmp/btmp/lastlog as root in the rpm listing


author: Pavel Raiskup <praiskup@redhat.com> - 1.32-1
changelog:
  - the latest upstream release, per release notes
    http://lists.gnu.org/archive/html/info-gnu/2019-02/msg00010.html
  - admit that we bundle paxutils project


author: Oliver Gutiérrez <ogutierrez@fedoraproject.org> - 0.0.99.2^4.git0bdfa53bb2ce-1
changelog:
  - Updated sources to 0.0.99.2^4.git0bdfa53bb2ce snapshot
  - Vendored required bats modules for gating tests


author: Oliver Gutiérrez <ogutierrez@fedoraproject.org> - 0.0.99.2-3
changelog:
  - Reverted sources to 0.0.99.2
  - Vendored required bats modules for gating tests
  - Added a patch for checking the XDG_RUNTIME_DIR


author: Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.2^3.git075b9a8d2779-3
changelog:
  - Ensure that binaries are run against their build-time ABI
  - Require containers-common for ownership of %{_sysconfdir}/containers


author: Patsy Griffin <patsy@redhat.com> - 2020a-1
changelog:
  - Rebase to tzdata-2020a
    - Morocco will spring forward on 2020-05-31 rather than
      previously predicted 2020-05-24.
    - Canada's Yukon region changed to year round UTC -07
      effective 2020-03-08.
    - America/Godthab was renamed to America/Nuuk.


author: Jiri Vanek <jvanek@redhat.com> - 2020a-2
changelog:
  - bumped  source/target to 1.6 for tzdata for jdk6/7
  - bumped  source/target to 1.8 for tzdata for jdk8


author: Patsy Griffin <patsy@redhat.com> - 2020b-1
changelog:
  - Rebase to tzdata-2020b
    - Yukon timezones represented by America/Whitehorse and
      America/Dawson will change time zone rules from -08/-07 to
      permanent -07 on 2020-11-01, not on 2020-03-08 as 2020a had it.
    - The most recent winter(+08)/summer(+11) transition for Casey Station,
      Antarctica was 2020-10-04 00:01.
    - Remove obsolete files pacificnew, systemv, and yearistype.sh
      from the distribution.


author: Patsy Griffin <patsy@redhat.com> - 2020d-1
changelog:
  - Rebase to tzdata-2020d including changes from tzdata-2020c
    - Palestine will end summer time on 2020-10-24 rather than the
      predicted 2020-10-31.
    - Fiji starts DST later than usual, on 2020-12-20.
    - Rearguard now provides an empty file pacificnew to support
      downstream software that expects it.


author: Patsy Griffin <patsy@redhat.com> - 2020f-1
changelog:
  - Rebase to tzdata-2020f including changes for tzdata-2020e
    - tzdata-2020f fixes a bug in tzdata-2020e that caused an
      invalid zi file in rearguard format
    - Volgograd changes time zone from UTC+04 to UTC+03 on 2020-12-27.
    - Australia/Currie is identical to Australia/Hobart for all
      timestamps since 1970 and was therefore created by mistake,
      now moved to the "backward" file.


author: Patsy Griffin <patsy@redhat.com> - 2021b-1
changelog:
  - Rebase to tzdata-2021b
    - Jordan now starts DST on February's last Thursday.
    - Samoa no longer observes DST.
    - Merge more location-based Zones whose timestamps agree since 1970.
    - Move some backward-compatibility links to 'backward'.
    - Rename Pacific/Enderbury to Pacific/Kanton.
    - Correct many pre-1993 transitions in Malawi, Portugal, etc.
    - zic now creates each output file or link atomically.
    - zic -L no longer omits the POSIX TZ string in its output.
    - zic fixes for truncation and leap second table expiration.
    - zic now follows POSIX for TZ strings using all-year DST.
    - Fix some localtime crashes and bugs in obscure cases.
    - zdump -v now outputs more-useful boundary cases.
    - tzfile.5 better matches a draft successor to RFC 8536.


author: Patsy Griffin <patsy@redhat.com> - 2021c-1
changelog:
  - Rebase to tzdata-2021c
    - Revert most 2021b changes to the 'backward' file.
    - Fix 'zic -b fat' bug in pre-1970 32-bit data reported in tzdata-2021b.
    - Fix two Link line typos from tzdata-2021b.
    - Distribute the new SECURITY file.


author: Patsy Griffin <patsy@redhat.com> - 2021e-1
changelog:
  - Rebase to tzdata-2021e - supersedes tzdata-2021d
    - Pacific/Fiji suspended DST for the 2021/2022 season.
    - 'zic -r' now marks unspecified timestamps with "-00".
    - Palestine will fall back 2021-10-29 at 01:00, rather
      than the predicted 2021-10-30.


author: Jiri Vanek <jvanek@redhat.com> - 2021e-3
changelog:
  - Rebuilt for java-17-openjdk as system jdk
  - to keep the legacy tzdata, now build requires both jdk8 and system.
  - I recomed to put legacy tz data to separate subpkg or to drop them all


author: Patsy Griffin <patsy@redhat.com> - 2022a-1
changelog:
  - Rebase to tzdata-2022a
    - Palestine springs forward on 2022-03-27, not 2022-03-26.
    - zdump -v now outputs better failure information.
    - bug fixes for code that reads corrupted TZif data.


author: Jiri Vanek <jvanek@redhat.com> - 2021e-3
changelog:
  - Rebuilt for java-17-openjdk as system jdk
  - to keep the legacy tzdata, now build requires both jdk8 and system jdk.
  - I recommend to put legacy tz data to separate subpkg or to drop them at all.
  - Also I would recomend to  rename legacy tzdat.to versioned ones (eg avazi-1.7) and to keep future, rolling tzdata unversioned, as javazi only


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.2.2465-2
changelog:
  - remove vim-wrappers, vim is a binary again, vi and view stay as wrappers
  - removed vim -> vi functionality, because it cannot be optional and work
    for all cases at the same time


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.2.3043-1
changelog:
  - patchlevel 3043
  - enable libsodium encryption in Fedora
  - require glibc-gconv-extra on F35 and later


author: Leigh Scott <leigh123linux@gmail.com> - 1.0.20200319-2
changelog:
  - Add missing config directory
  - Remove default buildroot BuildRequires
  - Simplify doc install
  - Remove commented lines
  - Use correct macro for bash-completion


author: Joe Doss <joe@solidadmin.com> - 1.0.20200510-1
changelog:
  - Update to 1.0.20200510
  - ipc: add support for openbsd kernel implementation
  - ipc: cleanup openbsd support
  - wg-quick: add support for openbsd kernel implementation
  - wg-quick: cleanup openbsd support
  - wg-quick: support dns search domains
  - Makefile: simplify silent cleaning
  - ipc: remove extra space
  - git: add gitattributes so tarball doesn't have gitignore files
  - terminal: specialize color_mode to stdout only
  - wg-quick: android: support application whitelist
  - systemd: add wg-quick.target


author: Joe Doss <joe@solidadmin.com> - 1.0.20200513-1
changelog:
  - Update to 1.0.20200513
  - Makefile: remember to install all systemd units
  - ipc: openbsd: switch to array ioctl interface


author: Joe Doss <joe@solidadmin.com> - 1.0.20200820-1
changelog:
  - Update to 1.0.20200820
  - ipc: split into separate files per-platform
  - wincompat: fold random into genkey
  - systemd: add reload target to systemd unit
  - man: wg-quick: use syncconf instead of addconf for strip example
  - pubkey: isblank is a subset of isspace
  - ctype: use non-locale-specific ctype.h
  - wg-quick: wait on process substitutions


author: Joe Doss <joe@solidadmin.com> - 1.0.20200827-1
changelog:
  - Update to 1.0.20200827
  - wg-quick: android: use iproute2 to bring up interface instead of ndc
  - wg-quick: Revert wait on process substitutions


author: Joe Doss <joe@solidadmin.com> - 1.0.20210223-1
changelog:
  - wg-quick: android: do not free iterated pointer
  - wg-quick: openbsd: no use for userspace support
  - embeddable-wg-library: sync latest from netlink.h
  - wincompat: recent mingw has inet_ntop/inet_pton
  - wincompat: add resource and manifest and enable lto
  - wincompat: do not elevate by default
  - completion: add help and syncconf completions
  - sticky-sockets: do not use SO_REUSEADDR
  - man: LOG_LEVEL variables changed name
  - ipc: do not use fscanf with trailing \n
  - ipc: read trailing responses after set operation


author: Joe Doss <joe@solidadmin.com> - 1.0.20210315-1
changelog:
  - Makefile: fix version indicator
  - wireguard-tools: const correctness
  - wireguard-tools: drag in headers for prototypes
  - ipc: uniformly ignore preshared keys that are zero
  - wg-quick: freebsd: add kernel support
  - ipc: freebsd: add initial FreeBSD support
  - wg-quick: freebsd: avoid writing private keys to /tmp


author: Joe Doss <joe@solidadmin.com> - 1.0.20210424-1
changelog:
  - wg-quick: freebsd: check for socket using -S, not -f
  - wg-quick: freebsd: do not assume point-to-point interface flag
  - wg-quick: freebsd: use ifconfig for determining if interface is up
  - wg-quick: kill route monitor when loop terminates


author: Joe Doss <joe@solidadmin.com> - 1.0.20210914-1
changelog:
  - contrib/launchd: fix xml syntax error
  - wg-quick: darwin: account for "link#XX" gateways
  - ipc: add wireguard-nt support
  - ipc: cache windows lookups to avoid O(n^2) with nested lookups
  - ipc: remove windows elevation
  - ipc: windows: don't display disabled adapters
  - ipc: windows: use devpkey instead of nci for name
  - wg-quick: android: adjust for android 12
  - wg-quick: openbsd: set DNS with resolvd(8)


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 0.7.4-1
changelog:
  - Update to version 0.7.4
  - Enable runtime detection of sse2/avx2/avx512 on intel architectures
  - Fix compiler warning for 32 bit architectures


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 0.8.0-1
changelog:
  - Update to version 0.8.0
  - Drop patches xxhash-compiler-warning-32-bit.patch (accepted upstream)
    and xxhash-pkgconfig.patch (issue fixed upstream)
  - Fix empty version in .pc file


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 0.8.1-1
changelog:
  - Update to version 0.8.1
  - Drop patch xxhash-pkgconfig-version.patch (accepted upstream)
  - Fix compilation on RHEL 7 ppc64le (gcc 4.8)
  - The x86 dispatch code now enables sse2 and avx2 separately, it can now use
    sse2 on EPEL 7 without trying to use avx2 which is not supported by gcc 4.8
  - Add documentation package - doxygen mark-up was added


author: Petr Kubat <pkubat@redhat.com> - 5.2.4-7
changelog:
  - Use relative path for COPYING files so that rpm moves them to correct place
    Related: rhbz#1741074


author: Todd Zullinger <tmz@pobox.com> - 5.2.5-9
changelog:
  - verify upstream GPG signature
  - xzgrep: arbitrary-file-write vulnerability (#2073310, CVE-2022-1271)


author: Jonathan Dieter <jdieter@gmail.com> - 1.1.2-2
changelog:
  - Fix multipart range handling to work with quotes, fixes #1706627
  - Fix file creation permissions so they respect umask
  - Actually push new sources


author: Jonathan Dieter <jdieter@gmail.com> - 1.1.1-2
changelog:
  - Fix compilation on GCC 4.4.7 so it builds on EL6
  - Add missing sources
  - Also, zchunk will now automatically do all your taxes


author: Jonathan Dieter <jdieter@gmail.com> - 1.2.0-1
changelog:
  - Add `--uncompressed` option to zck, allowing for embedding of uncompressed
    digests in the header
  - Various small bug fixes


author: Jonathan Dieter <jdieter@gmail.com> - 1.2.1-1
changelog:
  - Fixed bug that limited size of file that could be compressed using zchunk to 2GB
  - Fixed memory leak


