# changelog

author: Fedora Kernel Team <kernel-team@fedoraproject.org> [6.0.0-0.rc1.3cc40a443a04.13]
changelog:
  - redhat/Makefile: Clean linux tarballs (Prarit Bhargava)
  - redhat/configs: Cleanup CONFIG_ACPI_AGDI (Prarit Bhargava)
  - spec: add cpupower daemon reload on install/upgrade (Jarod Wilson)
  - redhat: properly handle binary files in patches (Ondrej Mosnacek)


author: Fedora Kernel Team <kernel-team@fedoraproject.org> [6.0.0-0.rc1.50cd95ac4654.17]
changelog:
  - redhat/docs: Add dist-brew BUILD_FLAGS information (Prarit Bhargava)
  - redhat: change the changelog item for upstream merges (Herton R. Krzesinski)
  - redhat: fix dist-release build number test (Herton R. Krzesinski)
  - redhat: fix release number bump when dist-release-changed runs (Herton R. Krzesinski)
  - redhat: use new genlog.sh script to detect changes for dist-release (Herton R. Krzesinski)
  - redhat: move changelog addition to the spec file back into genspec.sh (Herton R. Krzesinski)
  - redhat: always add a rebase entry when ark merges from upstream (Herton R. Krzesinski)
  - redhat: drop merge ark patches hack (Herton R. Krzesinski)
  - redhat: don't hardcode temporary changelog file (Herton R. Krzesinski)
  - redhat: split changelog generation from genspec.sh (Herton R. Krzesinski)
  - Linux v6.0.0-0.rc1.50cd95ac4654


author: Fedora Kernel Team <kernel-team@fedoraproject.org> [6.2.0-0.rc8.f6feea56f66d.57]
changelog:
  - redhat/configs: update scripts and docs for ark -> rhel rename (Clark Williams)
  - redhat/configs: rename ark configs dir to rhel (Clark Williams)
  - Turn off CONFIG_DEBUG_INFO_COMPRESSED_ZLIB for ppc64le (Justin M. Forbes)
  - kernel.spec: package unstripped kselftests/bpf/test_progs (Jan Stancek)
  - kernel.spec: allow to package some binaries as unstripped (Jan Stancek)
  - redhat/configs: Make merge.py portable for older python (Desnes Nunes)
  - Linux v6.2.0-0.rc8.f6feea56f66d


author: Fedora Kernel Team <kernel-team@fedoraproject.org> [6.2.0-0.rc8.e1c04510f521.58]
changelog:
  - Consolidate common configs for 6.2 (Justin M. Forbes)
  - aarch64: enable zboot (Gerd Hoffmann)
  - redhat: remove duplicate pending-rhel config items (Patrick Talbert)
  - Disable frame pointers (Justin M. Forbes)
  - Linux v6.2.0-0.rc8.e1c04510f521


author: Fedora Kernel Team <kernel-team@fedoraproject.org> [6.2.0-0.rc8.033c40a89f55.59]
changelog:
  - Fix underline mark-up after text change (Justin M. Forbes)
  - Turn on CONFIG_XFS_RT for Fedora (Justin M. Forbes)
  - Linux v6.2.0-0.rc8.033c40a89f55


author: Justin M. Forbes <jforbes@fedoraproject.org> [6.2.1-0]
changelog:
  - Add UKI revert patch to allow builds on F36 and F37 (Justin M. Forbes)
  - Turn E1000 back on (Justin M. Forbes)
  - More files for stable Fedora (Justin M. Forbes)
  - Update Makefile.variables for stable releases (Justin M. Forbes)
  - drivers/firmware: skip simpledrm if nvidia-drm.modeset=1 is set (Javier Martinez Canillas)
  - enable efifb for Nvidia (Justin M. Forbes)
  - Fix up configs for dropped patches (Justin M. Forbes)
  - Reset RHEL_RELEASE to 0 for the 6.3 cycle (Justin M. Forbes)
  - redhat/configs: Enable CONFIG_V4L_TEST_DRIVERS related drivers (Enric Balletbo i Serra)
  - Linux v6.2.1


author: Justin M. Forbes <jforbes@fedoraproject.org> [6.2.2-1]
changelog:
  - Bump for rebuild (Justin M. Forbes)
  - iommu/amd: Do not identity map v2 capable device when snp is enabled (Vasant Hegde)
  - iommu: Attach device group to old domain in error path (Vasant Hegde)
  - iommu/amd: Improve page fault error reporting (Vasant Hegde)
  - iommu/amd: Skip attach device domain is same as new domain (Vasant Hegde)
  - iommu/amd: Fix error handling for pdev_pri_ats_enable() (Vasant Hegde)
  - redhat/kernel.spec.template: Fix RHEL systemd-boot-unsigned dependency (Prarit Bhargava)


author: Justin M. Forbes <jforbes@fedoraproject.org> [6.2.3-0]
changelog:
  - Add new config option for 6.2.3 (Justin M. Forbes)
  - Only build the efiuki for F37 and newer (Justin M. Forbes)
  - Reset release (Justin M. Forbes)
  - Linux v6.2.3


author: Justin M. Forbes <jforbes@fedoraproject.org> [6.2.5-0]
changelog:
  - Revert "wifi: cfg80211: Fix use after free for wext" (Justin M. Forbes)
  - Fix up buildReqs for UKI (Justin M. Forbes)
  - Linux v6.2.5


author: Justin M. Forbes <jforbes@fedoraproject.org> [6.2.6-0]
changelog:
  - Add Fedora 37 and 36 to release targets (Justin M. Forbes)
  - wifi: cfg80211: Fix use after free for wext (Alexander Wetzel)
  - Drop the applypatches for f37 (Justin M. Forbes)
  - Linux v6.2.6


author: Justin M. Forbes <jforbes@fedoraproject.org> [6.2.7-0]
changelog:
  - NFS: Correct timing for assigning access cache timestamp (Chengen Du)
  - usb: ucsi: Fix ucsi->connector race (Hans de Goede)
  - usb: ucsi_acpi: Increase the command completion timeout (Hans de Goede)
  - usb: ucsi: Fix NULL pointer deref in ucsi_connector_change() (Hans de Goede)
  - Enable CONFIG_NET_SCH_FQ_PIE for Fedora (Justin M. Forbes)
  - Fix build issue with efiuki conditional (Justin M. Forbes)
  - Move endif to correct location for efiuki conditional (Justin M. Forbes)
  - EFI UKI revert now conditionalized in spec. Drop revert (Justin M. Forbes)
  - Linux v6.2.7


author: Augusto Caringi <acaringi@redhat.com> [6.2.8-0]
changelog:
  - Add new config option for 6.2.8 (Augusto Caringi)
  - Revert "usb: xhci-pci: Set PROBE_PREFER_ASYNCHRONOUS" (Kate Hsuan)
  - Linux v6.2.8


author: Augusto Caringi <acaringi@redhat.com> [6.2.9-0]
changelog:
  - Add bug numbers from recent MRs (Justin M. Forbes)
  - net: wwan: iosm: fixes 7560 modem crash (M Chetan Kumar)
  - Input: alps - fix compatibility with -funsigned-char (msizanoen)
  - Input: focaltech - use explicitly signed char type (Jason A. Donenfeld)
  - drm/nouveau/kms: Fix backlight registration (Hans de Goede)
  - Add bugs addressed so far for the 6.2.9 build (Justin M. Forbes)
  - btrfs: fix race between quota disable and quota assign ioctls (Filipe Manana)
  - redhat/configs: Enable CONFIG_SND_SOC_CS42L83 (Neal Gompa)
  - Add patch to turn off EFI_ZBOOT for Fedora 36 (Justin M. Forbes)
  - Linux v6.2.9


author: Augusto Caringi <acaringi@redhat.com> [6.2.10-0]
changelog:
  - fedora: arm: Enable DRM_PANEL_HIMAX_HX8394 (Peter Robinson)
  - arm64: dts: rk3399-pinephone-pro: Add touchscreen support (Martijn Braam)
  - arm64: dts: rk3399-pinephone-pro: Add internal display support (Martijn Braam)
  - drm: panel: Add Himax HX8394 panel controller driver (Kamil Trzciński)
  - dt-bindings: display: Add Himax HX8394 panel controller (Javier Martinez Canillas)
  - Fix up revert patch for F36 zboot (Justin M. Forbes)
  - Linux v6.2.10


author: Augusto Caringi <acaringi@redhat.com> [6.2.12-0]
changelog:
  - Add bugs fixed by 6.2.12 (Justin M. Forbes)
  - Use RHJOBS for create-tarball (Don Zickus)
  - Linux v6.2.12


author: Justin M. Forbes <jforbes@fedoraproject.org> [6.2.15-0]
changelog:
  - redhat: configs: generic: x86: Disable CONFIG_VIDEO_OV2740 for x86 platform (Kate Hsuan)
  - Add Bugs to be fixed in 6.2.15 (Justin M. Forbes)
  - xfs: verify buffer contents when we skip log replay (Darrick J. Wong)
  - Linux v6.2.15


author: Justin M. Forbes <jforbes@fedoraproject.org> [6.3.2-0]
changelog:
  - redhat: configs: generic: x86: Disable CONFIG_VIDEO_OV2740 for x86 platform (Kate Hsuan)
  - Add BugsFixed for 6.3 (Justin M. Forbes)
  - xfs: verify buffer contents when we skip log replay (Darrick J. Wong)
  - Fix up buildReqs for UKI (Justin M. Forbes)
  - Linux v6.3.2


author: Justin M. Forbes <jforbes@fedoraproject.org> [6.3.3-0]
changelog:
  - [PATCH] ALSA: hda/realtek: Add quirk for ThinkPad P1 Gen 6 (Mark Pearson) [2203317]
  - Linux v6.3.3


author: Justin M. Forbes <jforbes@fedoraproject.org> [6.3.4-0]
changelog:
  - Revert "Turn off DEBUG_VM for non debug Fedora kernels" (Justin M. Forbes)
  - Turn off DEBUG_VM for non debug Fedora kernels (Justin M. Forbes)
  - Fix up some Fedora config items (Justin M. Forbes)
  - enable efifb for Nvidia (Justin M. Forbes)
  - Turn on NFT_CONNLIMIT for Fedora (Justin M. Forbes)
  - Linux v6.3.4


author: Justin M. Forbes <jforbes@fedoraproject.org> [6.3.4-1]
changelog:
  - Bump rhelver for build with xfs fix (Justin M. Forbes)
  - xfs: fix livelock in delayed allocation at ENOSPC (Dave Chinner)
  - Turn off some debug options found to impact performance (Justin M. Forbes)


author: Augusto Caringi <acaringi@redhat.com> [6.3.6-0]
changelog:
  - Add the nvidia bug to BugsFixed (Justin M. Forbes)
  - drivers/firmware: skip simpledrm if nvidia-drm.modeset=1 is set (Javier Martinez Canillas)
  - Linux v6.3.6


author: Justin M. Forbes <jforbes@fedoraproject.org> [6.3.7-0]
changelog:
  - redhat/configs: Enable CONFIG_SC_GPUCC_8280XP for fedora (Andrew Halaney)
  - redhat/configs: Enable CONFIG_QCOM_IPCC for fedora (Andrew Halaney)
  - Linux v6.3.7


author: Augusto Caringi <acaringi@redhat.com> [6.3.8-0]
changelog:
  - usb: typec: ucsi: Fix command cancellation (Heikki Krogerus)
  - Add a CVE to BugsFixed (Justin M. Forbes)
  - Linux v6.3.8


author: Augusto Caringi <acaringi@redhat.com> [6.3.9-0]
changelog:
  - Turn on CONFIG_RMNET for Fedora (Justin M. Forbes)
  - redhat/config: common: Enable CONFIG_GPIO_SIM for software development (Kate Hsuan)
  - Add the MT7922 Bluetooth bug to BugsFixed (Augusto Caringi)
  - Bluetooth: Add VID/PID 0489/e0e4 for MediaTek MT7922 (Meng Tang)
  - Linux v6.3.9


author: Justin M. Forbes <jforbes@fedoraproject.org> [6.3.1-0]
changelog:
  - Set up variables and scripts for Fedora stable (Justin M. Forbes)
  - remove invalid rhel io_uring config (Justin M. Forbes)
  - Turn E1000 back on (Justin M. Forbes)
  - Reset RHEL_RELEASE for the 6.4 cycle (Justin M. Forbes)
  - Fix up the RHEL configs for xtables and ipset (Justin M. Forbes)
  - ark: enable wifi on aarch64 (Íñigo Huguet)
  - fedora: wifi: hermes: disable 802.11b driver (Peter Robinson)
  - fedora: wifi: libertas: use the LIBERTAS_THINFIRM driver (Peter Robinson)
  - fedora: wifi: disable Zydas vendor (Peter Robinson)
  - redhat: fix python ValueError in error path of merge.py (Clark Williams)
  - fedora: arm: minor updates (Peter Robinson)
  - Linux v6.3.1


author: Fedora Kernel Team <kernel-team@fedoraproject.org> [6.4.0-59]
changelog:
  - redhat/kernel.spec.template: Disable 'extracting debug info' messages (Prarit Bhargava)
  - kernel/rh_messages.c: Another gcc12 warning on redundant NULL test (Florian Weimer) [2216678]
  - redhat: fix signing for realtime and arm64_64k non-debug variants (Jan Stancek)
  - redhat: treat with_up consistently (Jan Stancek)
  - redhat: make with_realtime opt-in (Jan Stancek)
  - Linux v6.4.0


author: Justin M. Forbes <jforbes@fedoraproject.org> [6.4.1-0]
changelog:
  - drivers/firmware: skip simpledrm if nvidia-drm.modeset=1 is set (Javier Martinez Canillas)
  - Turn E1000 back on (Justin M. Forbes)
  - Set up variables and scripts for Fedora stable (Justin M. Forbes)
  - Linux v6.4.1


author: Justin M. Forbes <jforbes@fedoraproject.org> [6.4.3-0]
changelog:
  - drm/amd: Don't try to enable secure display TA multiple times (Mario Limonciello)
  - drm/amdgpu: fix number of fence calculations (Christian König)
  - drm/amdgpu: check RAS irq existence for VCN/JPEG (Tao Zhou)
  - drm/amd/pm: add abnormal fan detection for smu 13.0.0 (Kenneth Feng)
  - drm/amdgpu/sdma4: set align mask to 255 (Alex Deucher)
  - drm/amd/pm: revise the ASPM settings for thunderbolt attached scenario (Evan Quan)
  - drm/amdgpu: Skip mark offset for high priority rings (Jiadong Zhu)
  - drm/amdgpu: make sure that BOs have a backing store (Christian König)
  - drm/amdgpu: make sure BOs are locked in amdgpu_vm_get_memory (Christian König)
  - Linux 6.4.3 (Greg Kroah-Hartman)
  - fork: lock VMAs of the parent process when forking (Suren Baghdasaryan)
  - bootmem: remove the vmemmap pages from kmemleak in free_bootmem_page (Liu Shixin)
  - mm: call arch_swap_restore() from do_swap_page() (Peter Collingbourne)
  - mm: lock newly mapped VMA with corrected ordering (Hugh Dickins)
  - mm: lock newly mapped VMA which can be modified after it becomes visible (Suren Baghdasaryan)
  - mm: lock a vma before stack expansion (Suren Baghdasaryan)
  - fedora: arm: some minor updates (Peter Robinson)
  - fedora: bluetooth: enable AOSP extensions (Peter Robinson)
  - Fix up buildReqs for UKI (Justin M. Forbes)
  - mm: disable CONFIG_PER_VMA_LOCK until its fixed (Suren Baghdasaryan)
  - fork: lock VMAs of the parent process when forking (Suren Baghdasaryan)
  - Turn on NET_VENDOR_QUALCOMM so that rmnet builds (Justin M. Forbes)
  - Fix missing rhel config (Justin M. Forbes)
  - Linux v6.4.3


author: Justin M. Forbes <jforbes@fedoraproject.org> [6.4.4-0]
changelog:
  - move ownership of /lib/modules/<ver>/ to kernel-core (Thorsten Leemhuis)
  - Let kernel-modules-core own the files depmod generates. (Thorsten Leemhuis)
  - Add more bugs fixed in 6.4.4 (Justin M. Forbes)
  - Add some bugs to be fixed in 6.4.4 (Justin M. Forbes)
  - Add kunit configs for 6.4.4 (Justin M. Forbes)
  - Add hid-uclogic-test to mod-internal.list (Thorsten Leemhuis)
  - Add input_test to mod-intenal.list (Thorsten Leemhuis)
  - fedora: wifi: tweak ZYDAS WiFI config options (Peter Robinson)
  - Fix module filters for aarch64 and ppc (Justin M. Forbes)
  - Fix up some config mismatches (Justin M. Forbes)
  - Linux v6.4.4


author: Augusto Caringi <acaringi@redhat.com> [6.4.6-0]
changelog:
  - Change pathfix.py to %py3_shebang_fix (Justin M. Forbes)
  - Add config option coming to a stable update soon (Justin M. Forbes)
  - Linux v6.4.6


author: Augusto Caringi <acaringi@redhat.com> [6.4.8-0]
changelog:
  - redhat: configs: Disable CONFIG_CRYPTO_STATS since performance issue for storage (Kate Hsuan) [2227793]
  - Linux v6.4.8


author: Justin M. Forbes <jforbes@fedoraproject.org> [6.4.9-0]
changelog:
  - Config updates for 6.4.9 (Justin M. Forbes)
  - Update BugsFixed for 6.4.9 (Justin M. Forbes)
  - Add some BugsFixed for the 6.4.9 update (Justin M. Forbes)
  - ACPI: resource: revert "Remove "Zen" specific match and quirks" (Hans de Goede)
  - arm: i.MX: Some minor NXP i.MX cleanups (Peter Robinson)
  - Linux v6.4.9


author: Justin M. Forbes <jforbes@fedoraproject.org> [6.4.10-0]
changelog:
  - More security bug fixes for 6.4.10 (Justin M. Forbes)
  - KVM: SEV: remove ghcb variable declarations (Paolo Bonzini)
  - KVM: SEV: only access GHCB fields once (Paolo Bonzini)
  - KVM: SEV: snapshot the GHCB before accessing it (Paolo Bonzini)
  - Add another bug fixed by the 6.4.10 release (Justin M. Forbes)
  - drm/amd/display: Fix a regression on Polaris cards (Mario Limonciello)
  - redhat/configs: Remove `CONFIG_HZ_1000 is not set` for aarch64 (Enric Balletbo i Serra)
  - Add new CVEs fixed in 6.4.9 to BugsFixed (Justin M. Forbes)
  - Linux v6.4.10


author: Justin M. Forbes <jforbes@fedoraproject.org> [6.4.11-0]
changelog:
  - Add more bugfixes for 6.4.11 (Justin M. Forbes)
  - Turn off DMABUF_SYSFS_STATS (Justin M. Forbes)
  - Revert "KVM: SEV: remove ghcb variable declarations" (Justin M. Forbes)
  - Add bug fixed for 6.4.11 (Justin M. Forbes)
  - redhat: Add arm64-16k kernel flavor scaffold for 16K page-size'd AArch64 (Neal Gompa)
  - Linux v6.4.11


author: Justin M. Forbes <jforbes@fedoraproject.org> [6.4.12-0]
changelog:
  - ASoC: SOF: intel: hda: Clean up link DMA for IPC3 during stop (Ranjani Sridharan)
  - Make sure posttrans script doesn't fail if restorecon is not installed (Daan De Meyer)
  - Linux v6.4.12


author: Justin M. Forbes <jforbes@fedoraproject.org> [6.4.14-0]
changelog:
  - Add bug fixed by 6.4.14 (Justin M. Forbes)
  - erofs: ensure that the post-EOF tails are all zeroed (Gao Xiang)
  - Linux v6.4.14


author: Augusto Caringi <acaringi@redhat.com> [6.4.15-0]
changelog:
  - Add TPM bug to BugsFixed (Justin M. Forbes)
  - tpm: Enable hwrng only for Pluton on AMD CPUs (Jarkko Sakkinen)
  - Linux v6.4.15


author: Fedora Kernel Team <kernel-team@fedoraproject.org> [6.4.0-0.rc7.e660abd551f1.55]
changelog:
  - redhat/configs: enable CONFIG_MANA_INFINIBAND=m for ARK (Vitaly Kuznetsov)
  - redhat/config: common: Enable CONFIG_GPIO_SIM for software development (Kate Hsuan)
  - redhat: fix problem with RT kvm modules listed twice in rpm generation (Clark Williams)
  - redhat: turn off 64k kernel builds with rtonly (Clark Williams)
  - redhat: turn off zfcpdump for rtonly (Clark Williams)
  - redhat: don't allow with_rtonly to turn on unsupported arches (Clark Williams)
  - redhat: update self-test data for addition of RT and 64k-page variants (Clark Williams)
  - redhat: fix realtime and efiuki build conflict (Jan Stancek)
  - arm64-64k: Add new kernel variant to RHEL9/CS9 for 64K page-size'd ARM64 (Donald Dutile) [2153073]
  - redhat: TEMPORARY set configs to deal with PREEMPT_RT not available (Clark Williams)
  - redhat: TEMPORARY default realtime to off (Clark Williams)
  - redhat: moved ARM errata configs to arm dir (Clark Williams)
  - redhat: RT packaging changes (Clark Williams)
  - redhat: miscellaneous commits needed due to CONFIG_EXPERT (Clark Williams)
  - redhat: realtime config entries (Clark Williams)
  - Linux v6.4.0-0.rc7.e660abd551f1


author: Fedora Kernel Team <kernel-team@fedoraproject.org> [6.4.0-0.rc7.dad9774deaf1.56]
changelog:
  - kernel.spec: drop obsolete ldconfig (Jan Stancek)
  - Consolidate config items to common for 6.4 cycle (Justin M. Forbes)
  - Turn on CO?NFIg_RMNET for Fedora (Justin M. Forbes)
  - Linux v6.4.0-0.rc7.dad9774deaf1


author: Fedora Kernel Team <kernel-team@fedoraproject.org> [6.4.0-0.rc7.8a28a0b6f1a1.57]
changelog:
  - redhat/configs: Disable qcom armv7 drippings in the aarch64 tree (Jeremy Linton)
  - Linux v6.4.0-0.rc7.8a28a0b6f1a1


author: Justin M. Forbes <jforbes@fedoraproject.org> [6.5.1-0]
changelog:
  - erofs: ensure that the post-EOF tails are all zeroed (Gao Xiang)
  - Add bug to BugsFixed (Justin M. Forbes)
  - Turn off CONFIG_MEMORY_HOTPLUG_DEFAULT_ONLINE for Fedora s390x (Justin M. Forbes)
  - drm/msm/a690: Switch to a660_gmu.bin (Rob Clark)
  - drivers/firmware: skip simpledrm if nvidia-drm.modeset=1 is set (Javier Martinez Canillas)
  - Turn E1000 back on (Justin M. Forbes)
  - Set up variables and scripts for Fedora stable (Justin M. Forbes)
  - Update self-test data (Justin M. Forbes)
  - all: x86: move wayward x86 specific config home (Peter Robinson)
  - all: de-dupe non standard config options (Peter Robinson)
  - all: x86: clean up microcode loading options (Peter Robinson)
  - common: remove unnessary CONFIG_SND_MESON_AXG* (Peter Robinson)
  - Linux v6.5.1


author: Justin M. Forbes <jforbes@fedoraproject.org> [6.5.2-0]
changelog:
  - Move squashfs to kernel-modules-core (Justin M. Forbes)
  - Add TPM bug to BugsFixed (Justin M. Forbes)
  - tpm: Enable hwrng only for Pluton on AMD CPUs (Jarkko Sakkinen)
  - Linux v6.5.2


author: Justin M. Forbes <jforbes@fedoraproject.org> [6.5.3-0]
changelog:
  - Revert "misc: rtsx: judge ASPM Mode to set PETXCFG Reg" (Justin M. Forbes)
  - Config updates for 6.5.3 (Justin M. Forbes)
  - Fix up buildReqs for UKI (Justin M. Forbes)
  - Linux v6.5.3


author: Justin M. Forbes <jforbes@fedoraproject.org> [6.5.4-0]
changelog:
  - Add F38 and F37 as release targets (Justin M. Forbes)
  - Add NFS bug fix for 6.5.4 (Justin M. Forbes)
  - selinux: fix handling of empty opts in selinux_fs_context_submount() (Ondrej Mosnacek)
  - Turn off appletalk for fedora (Justin M. Forbes)
  - Linux v6.5.4


author: Justin M. Forbes <jforbes@fedoraproject.org> [6.5.5-0]
changelog:
  - iommu/apple-dart: Handle DMA_FQ domains in attach_dev() (Hector Martin)
  - Note fix for atomic locking in BugsFixed (Justin M. Forbes)
  - locking/atomic: scripts: fix fallback ifdeffery (Mark Rutland)
  - redhat: spec: Fix typo for kernel_variant_preun for 16k-debug flavor (Neal Gompa)
  - Fix installreq for UKI (Justin M. Forbes)
  - Add btrfs bug to BugsFixed for 6.5.5 (Justin M. Forbes)
  - btrfs: adjust overcommit logic when very close to full (Josef Bacik)
  - btrfs: properly report 0 avail for very full file systems (Josef Bacik)
  - Linux v6.5.5


author: Augusto Caringi <acaringi@redhat.com> [6.5.6-0]
changelog:
  - power: supply: core: Use blocking_notifier_call_chain to avoid RCU complaint (Kai-Heng Feng)
  - Revert "Add linux-next specific files for 20231004" (Justin M. Forbes)
  - redhat/configs: enable missing Kconfig options for Qualcomm RideSX4 (Brian Masney)
  - add a couple of CVEs to BugsFixed (Justin M. Forbes)
  - Add another F39 FE bug to BugsFixed (Justin M. Forbes)
  - Add linux-next specific files for 20231004 (Stephen Rothwell)
  - common: aarch64: enable NXP Flex SPI (Peter Robinson)
  - fedora: Switch TI_SCI_CLK and TI_SCI_PM_DOMAINS symbols to built-in (Javier Martinez Canillas)
  - Add bug for amdgpu to BugsFixed for 6.5.6 (Justin M. Forbes)
  - drm/amdgpu: set completion status as preempted for the resubmission (Jiadong Zhu)
  - Add CVE-2023-42756 to BugsFixed for 6.5.6 (Justin M. Forbes)
  - Linux v6.5.6


author: Augusto Caringi <acaringi@redhat.com> [6.5.9-0]
changelog:
  - Updated Fedora configs (Justin M. Forbes)
  - Add UFSHCD bug to BugsFixed (Justin M. Forbes)
  - Turn on UFSHCD for Fedora x86 (Justin M. Forbes)
  - redhat: configs: generic: x86: Disable CONFIG_VIDEO_OV01A10 for x86 platform (Hans de Goede)
  - Linux v6.5.9


author: Augusto Caringi <acaringi@redhat.com> [6.5.12-0]
changelog:
  - Add bug for AMD ACPI alarm (Justin M. Forbes)
  - rtc: cmos: Use ACPI alarm for non-Intel x86 systems too (Mario Limonciello)
  - Linux v6.5.12


author: Fedora Kernel Team <kernel-team@fedoraproject.org> [6.5.0-0.rc7.f7757129e3de.51.eln130]
changelog:
  - redhat/configs: Enable CONFIG_DEVICE_PRIVATE on aarch64 (David Hildenbrand) [2231407]
  - redhat/configs: disable CONFIG_ROCKCHIP_ERRATUM_3588001 for RHEL (Mark Salter)
  - redhat: shellcheck fixes (Prarit Bhargava)


author: Fedora Kernel Team <kernel-team@fedoraproject.org> [6.5.0-0.rc7.89bf6209cad6.52.eln130]
changelog:
  - redhat/self-test: Remove rpmlint test (Prarit Bhargava)
  - Remove the armv7 config directory from Fedora again (Justin M. Forbes)
  - Enable CONFIG_EXPERT for both RHEL and Fedora (Justin M. Forbes)
  - Linux v6.5.0-0.rc7.89bf6209cad6


author: Fedora Kernel Team <kernel-team@fedoraproject.org> [6.5.0-0.rc7.93f5de5f648d.53.eln130]
changelog:
  - Consolidate configs to common for 6.5 (Justin M. Forbes)
  - Remove unused config entry for Fedora (Justin M. Forbes)
  - Linux v6.5.0-0.rc7.93f5de5f648d


author: Fedora Kernel Team <kernel-team@fedoraproject.org> [6.5.0-0.rc7.7d2f353b2682.55.eln130]
changelog:
  - redhat/kernel.spec.template: update compression variables to support zstd (Brian Masney)
  - Linux v6.5.0-0.rc7.7d2f353b2682


author: Fedora Kernel Team <kernel-team@fedoraproject.org> [6.5.0-58.eln130]
changelog:
  - redhat: Fix UKI install with systemd >= 254 (Vitaly Kuznetsov)
  - redhat: Use named parameters for kernel_variant_posttrans()/kernel_variant_preun() (Vitaly Kuznetsov)


author: Justin M. Forbes <jforbes@fedoraproject.org> [6.5.2-301]
changelog:
  - Revert "misc: rtsx: judge ASPM Mode to set PETXCFG Reg" (Justin M. Forbes)
  - Config updates for 6.5.3 (Justin M. Forbes)
  - Fix up buildReqs for UKI (Justin M. Forbes)


author: Justin M. Forbes <jforbes@fedoraproject.org> [6.6.2-0]
changelog:
  - Add bug for AMD ACPI alarm (Justin M. Forbes)
  - rtc: cmos: Use ACPI alarm for non-Intel x86 systems too (Mario Limonciello)
  - Add bluetooth fixes to BugsFixed (Justin M. Forbes)
  - Drop F37 from release targets as it will not rebase to 6.6 (Justin M. Forbes)
  - Linux v6.6.2


author: Justin M. Forbes <jforbes@fedoraproject.org> [6.6.3-0]
changelog:
  - Add BugsFixed for 6.6.3 (Justin M. Forbes)
  - Update BugsFixed (Justin M. Forbes)
  - Turn on USB_DWC3 for Fedora (rhbz 2250955) (Justin M. Forbes)
  - Revert "netfilter: nf_tables: remove catchall element in GC sync path" (Justin M. Forbes)
  - More BugsFixed (Justin M. Forbes)
  - netfilter: nf_tables: remove catchall element in GC sync path (Pablo Neira Ayuso)
  - frop the build number back to 200 for fedora-srpm.sh (Justin M. Forbes)
  - ACPI: video: Use acpi_device_fix_up_power_children() (Hans de Goede)
  - ACPI: PM: Add acpi_device_fix_up_power_children() function (Hans de Goede)
  - Linux v6.6.3


author: Justin M. Forbes <jforbes@fedoraproject.org> [6.6.4-0]
changelog:
  - redhat: Fix macro for kernel-uki-virt flavor (Neal Gompa)
  - Change the uki reqs for Fedora (Justin M. Forbes)
  - Linux v6.6.4


author: Augusto Caringi <acaringi@redhat.com> [6.6.7-0]
changelog:
  - Add rhbz#2253632 rhbz#2253633 to BugsFixed (Justin M. Forbes)
  - Turn on DRM_ACCEL drivers for Fedora (Justin M. Forbes)
  - Linux v6.6.7


author: Augusto Caringi <acaringi@redhat.com> [6.6.8-0]
changelog:
  - Add BugsFixed entries for rhbz#2254797 and #rhbz2254704 (Justin M. Forbes)
  - Add support for various laptops using CS35L41 HDA without _DSD (Stefan Binding)
  - fedora: arm64: Enable required AllWinner pinctrl drivers (Peter Robinson)
  - fedora: arm64: cleanup Allwinner Pinctrl drivers (Peter Robinson)
  - fedora: aarch64: Enable some DW drivers (Peter Robinson)
  - Basic scaffolding to create a kernel-headers package (Justin M. Forbes)
  - Linux v6.6.8


author: Justin M. Forbes <jforbes@fedoraproject.org> [6.6.9-0]
changelog:
  - ALSA: hda: cs35l41: Add notification support into component binding (Stefan Binding)
  - ALSA: hda: cs35l41: Support mute notifications for CS35L41 HDA (Stefan Binding)
  - Linux v6.6.9


author: Augusto Caringi <acaringi@redhat.com> [6.6.12-0]
changelog:
  - Add CVE Fixes to BugsFixed for 6.6.12 (Justin M. Forbes)
  - ida: Fix crash in ida_free when the bitmap is empty (Matthew Wilcox (Oracle))
  - wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() (Xingyuan Mo)
  - Linux v6.6.12


author: Fedora Kernel Team <kernel-team@fedoraproject.org> [6.6.0-0.rc7.d88520ad73b7.55]
changelog:
  - redhat: remove pending-rhel CONFIG_XFS_ASSERT_FATAL file (Patrick Talbert)
  - New configs in fs/xfs (Fedora Kernel Team)
  - crypto: rng - Override drivers/char/random in FIPS mode (Herbert Xu)
  - random: Add hook to override device reads and getrandom(2) (Herbert Xu)
  - Linux v6.6.0-0.rc7.d88520ad73b7


author: Fedora Kernel Team <kernel-team@fedoraproject.org> [6.6.0-0.rc7.4f82870119a4.56]
changelog:
  - redhat: configs: generic: x86: Disable CONFIG_VIDEO_OV01A10 for x86 platform (Hans de Goede)
  - Linux v6.6.0-0.rc7.4f82870119a4


author: Fedora Kernel Team <kernel-team@fedoraproject.org> [6.6.0-0.rc7.611da07b89fd.57]
changelog:
  - Updated Fedora configs (Justin M. Forbes)
  - Turn on UFSHCD for Fedora x86 (Justin M. Forbes)
  - Linux v6.6.0-0.rc7.611da07b89fd


author: Justin M. Forbes <jforbes@fedoraproject.org> [6.6.1-0]
changelog:
  - drivers/firmware: skip simpledrm if nvidia-drm.modeset=1 is set (Javier Martinez Canillas)
  - Added required files for rebase (Augusto Caringi)
  - Reset RHEL_RELEASE for rebase (Justin M. Forbes)
  - [Scheduled job] Catch config mismatches early during upstream merge (Don Zickus)
  - redhat/self-test: Update data for KABI xz change (Prarit Bhargava)
  - redhat/scripts: Switch KABI tarballs to xz (Prarit Bhargava)
  - redhat/kernel.spec.template: Switch KABI compression to xz (Prarit Bhargava)
  - redhat: self-test: Use a more complete SRPM file suffix (Andrew Halaney)
  - redhat: makefile: remove stray rpmbuild --without (Eric Chanudet)
  - Linux v6.6.1


author: Justin M. Forbes <jforbes@fedoraproject.org> [6.6.2-201]
changelog:
  - Turn on USB_DWC3 for Fedora (rhbz 2250955) (Justin M. Forbes)
  - Revert "netfilter: nf_tables: remove catchall element in GC sync path" (Justin M. Forbes)
  - More BugsFixed (Justin M. Forbes)
  - netfilter: nf_tables: remove catchall element in GC sync path (Pablo Neira Ayuso)
  - frop the build number back to 200 for fedora-srpm.sh (Justin M. Forbes)
  - ACPI: video: Use acpi_device_fix_up_power_children() (Hans de Goede)
  - ACPI: PM: Add acpi_device_fix_up_power_children() function (Hans de Goede)


author: Justin M. Forbes <jforbes@fedoraproject.org> [6.6.8-200]
changelog:
  - ALSA: hda: cs35l41: Add notification support into component binding (Stefan Binding)
  - ALSA: hda: cs35l41: Support mute notifications for CS35L41 HDA (Stefan Binding)


author: Fedora Kernel Team <kernel-team@fedoraproject.org> [6.8.0-0.rc0.9f8413c4a66f.1]
changelog:
  - Reset RHEL_RELEASE for 6.8 series (Justin M. Forbes)
  - common: cleanup MX3_IPU (Peter Robinson)
  - all: The Octeon MDIO driver is aarch64/mips (Peter Robinson)
  - common: rtc: remove bq4802 config (Peter Robinson)
  - common: de-dupe MARVELL_GTI_WDT (Peter Robinson)
  - all: Remove CAN_BXCAN (Peter Robinson)
  - common: cleanup SND_SOC_ROCKCHIP (Peter Robinson)
  - common: move RHEL DP83867_PHY to common (Peter Robinson)
  - common: Make ASYMMETRIC_KEY_TYPE enable explicit (Peter Robinson)
  - common: Disable aarch64 ARCH_MA35 universally (Peter Robinson)
  - common: arm64: enable Tegra234 pinctrl driver (Peter Robinson)
  - rhel: arm64: Enable qoriq thermal driver (Peter Robinson)
  - common: aarch64: Cleanup some i.MX8 config options (Peter Robinson)
  - all: EEPROM_LEGACY has been removed (Peter Robinson)
  - all: rmeove AppleTalk hardware configs (Peter Robinson)
  - all: cleanup: remove references to SLOB (Peter Robinson)
  - all: cleanup: Drop unnessary BRCMSTB configs (Peter Robinson)
  - all: net: remove retired network schedulers (Peter Robinson)
  - all: cleanup removed CONFIG_IMA_TRUSTED_KEYRING (Peter Robinson)
  - BuildRequires: lld for build with selftests for x86 (Jan Stancek)
  - spec: add keyutils to selftest-internal subpackage requirements (Artem Savkov) [2166911]
  - redhat/spec: exclude liburandom_read.so from requires (Artem Savkov) [2120968]
  - rtla: sync summary text with upstream and update Requires (Jan Stancek)
  - uki-virt: add systemd-sysext dracut module (Gerd Hoffmann)
  - uki-virt: add virtiofs dracut module (Gerd Hoffmann)
  - common: disable the FB device creation (Peter Robinson)
  - s390x: There's no FB on Z-series (Peter Robinson)
  - Linux v6.8.0-0.rc0.9f8413c4a66f


author: Fedora Kernel Team <kernel-team@fedoraproject.org> [6.8.0-0.rc0.ab27740f7665.3]
changelog:
  - Flip CONFIG_INTEL_PMC_CORE to m for Fedora (Justin M. Forbes)
  - Add CONFIG_ZRAM_TRACK_ENTRY_ACTIME=y to avoid a mismatch (Justin M. Forbes)
  - Linux v6.8.0-0.rc0.ab27740f7665


author: Fedora Kernel Team <kernel-team@fedoraproject.org> [6.8.0-0.rc0.de927f6c0b07.4]
changelog:
  - Fix up ZRAM_TRACK_ENTRY_ACTIME in pending (Justin M. Forbes)
  - random: replace import_single_range() with import_ubuf() (Justin M. Forbes)
  - Linux v6.8.0-0.rc0.de927f6c0b07


author: Fedora Kernel Team <kernel-team@fedoraproject.org> [6.8.0-0.rc0.70d201a40823.5]
changelog:
  - redhat: kABI: add missing RH_KABI_SIZE_ALIGN_CHECKS Kconfig option (Sabrina Dubroca)
  - redhat: rh_kabi: introduce RH_KABI_EXCLUDE_WITH_SIZE (Sabrina Dubroca)
  - redhat: rh_kabi: move semicolon inside __RH_KABI_CHECK_SIZE (Sabrina Dubroca)
  - Linux v6.8.0-0.rc0.70d201a40823


author: Coiby <coxu@redhat.com> - 2.0.25-3
changelog:
  - kdumpctl: Optimize _find_kernel_path_by_release regex string
  - unit tests: adapt check_config to gen-kdump-conf.sh
  - kdump.conf: use a simple generator script to maintain
  - Don't run kdump_check_setup_iscsi in a subshell in order to collect needed network interfaces
  - Simplify setup_znet by copying connection profile to initrd
  - Wait for the network to be truly ready before dumping vmcore
  - Address the cases where a NIC has a different name in kdump kernel
  - Reduce kdump memory consumption by only installing needed NIC drivers
  - Reduce kdump memory consumption by not letting NetworkManager manage unneeded network interfaces
  - Set up kdump network by directly copying NM connection profile to initrd
  - Stop dracut 35network-manager from running nm-initrd-generator
  - Apply the timeout configuration of nm-initrd-generator
  - Determine whether IPv4 or IPv6 is needed
  - Add functions to copy NetworkManage connection profiles to the initramfs
  - Fix error for vlan over team network interface
  - Skip reset_crashkernel_after_update during package install
  - Don't check fs modified when dump target is lvm2 thinp
  - tests: use .nmconnection to set up test network
  - fadump: preserve file modification time to help with hardlinking
  - fadump: do not use squash to reduce image size
  - selftest: Add lvm2 thin provision for kdump test
  - selftest: Only iterate the .sh files for test execution
  - Add dependency of dracut lvmthinpool-monitor module
  - lvm.conf should be check modified if lvm2 thinp enabled
  - Add lvm2 thin provision dump target checker


author: Coiby <coxu@redhat.com> - 2.0.25-4
changelog:
  - dracut-module-setup.sh: stop overwriting dracut's trap handler
  - fadump: avoid status check while starting in fadump mode
  - fadump: add a kernel install hook to clean up fadump initramfs
  - fadump: fix default initrd backup and restore logic
  - fadump: use 'zstd' as the default compression method


author: Coiby <coxu@redhat.com> - 2.0.26-1
changelog:
  - Update kexec-tools to 2.0.25
  - Don't try to update crashkernel when bootloader is not installed
  - dracut-module-setup.sh: also install the driver of physical NIC for Hyper-V VM with accelerated networking
  - dracut-module-setup.sh: skip installing driver for the loopback interface


author: Coiby <coxu@redhat.com> - 2.0.26-3
changelog:
  - kdumpctl: make do_estimate more robust
  - kdumpctl: refractor check_rebuild
  - kdumpctl: cleanup 'stop'
  - kdumpctl: cleanup 'start'
  - kdump-lib: fix prepare_cmdline
  - kdumpctl: move aws workaround to kdump-lib
  - unit tests: add tests for prepare_cmdline
  - kdump-lib: always specify version in is_squash_available
  - mkfadumprd: drop unset globals from debug output
  - kdumpctl: merge check_current_{kdump,fadump}_status
  - dracut-early-kdump: explicitly use bash
  - dracut-early-kdump: fix shellcheck findings
  - kdumpctl: simplify check_failure_action_config
  - makedumpfile: Fix wrong exclusion of slab pages on Linux 6.2-rc1


author: Coiby <coxu@redhat.com> - 2.0.26-4
changelog:
  - kdumpctl: Add support for systemd-boot paths
  - mkdumprd: add --aggressive-strip as default dracut args
  - kdumpctl: Add basic UKI support
  - kdumpctl: Move temp file in get_kernel_size to global temp dir
  - kdumpctl: Move get_kernel_size to kdumpctl
  - kdumpctl: fix is_dracut_mod_omitted
  - kdump-lib: move is_dracut_mod_omitted to kdumpctl
  - kdump-lib: remove get_nmcli_connection_apath_by_ifname
  - kdump-lib: remove get_nmcli_field_by_conpath
  - dracut-module-setup: remove dead source_ifcfg_file
  - kdump-lib-initramfs: remove is_fs_dump_target
  - kdump-lib-initramfs: harden is_mounted
  - Show how much time kdump has waited for the network to be ready
  - Tell nmcli to not escape colon when getting the path of connection profile
  - kdumpctl: lower the log level in reset_crashkernel_for_installed_kernel
  - Install nfsv4-related drivers when users specify nfs dumping via dracut_args
  - sysconfig: add zfcp.allow_lun_scan to KDUMP_COMMANDLINE_REMOVE on s390
  - Use the correct command to get architecture


author: Coiby <coxu@redhat.com> - 2.0.26-5
changelog:
  - Simplify the management of the kernel parameter crashkernel
  - Let _update_kernel_cmdline return the correct return code
  - mkdumprd: call dracut with --add-device to install the drivers needed by /boot partition automatically for FIPS
  - kdump-lib: fix the matching pattern for debug-kernel


author: Coiby <coxu@redhat.com> - 2.0.26-7
changelog:
  - kdumpctl: Fix the matching of plus symbol by grep's EREs
  - kdump-lib: Evaluate the memory consumption by smmu and mlx5 separately
  - kdump-lib: add support for 64K aarch64
  - kdump-lib: Introduce parse_kver_from_path() to get kernel version from its path name
  - kdump-lib: Introduce a help function _crashkernel_add()


author: Coiby Xu <coxu@redhat.com> - 2.0.27-4
changelog:
  - update to makedumpfile-1.7.4
  - kdump-lib.sh: add extra 64M to default crashkernel if sme/sev is active
  - Allow _crashkernel_add to address larger memory ranges


author: Coiby Xu <coxu@redhat.com> - 2.0.28-1
changelog:
  - kexec-tools 2.0.28 (Simon Horman)
  - Use the same /etc/resolve.conf in kdump initrd if it's managed manually
  - dracut-module-setup: consolidate s390 network device config


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 29-5
changelog:
  - kmod.spec: enable debug
  - weak-modules: compare_initramfs_modules: exit on pushd/popd failures
  - weak-modules: split modules into array with read -a
  - Add default config file, /etc/depmod.d/dist.conf


author: Andreas Schneider <asn@redhat.com> - 1.19.2-12
changelog:
  - Use baserelease to set the release number
  - Do not define netlib, but use autoconf detection for res_* functions
  - Add missing BR for resolv_wrapper to run t_discover_uri.py


author: Julien Rische <jrische@redhat.com> - 1.20.1-1
changelog:
  - New upstream version (1.20.1)
  - Resolves: rhbz#2124463
  - Restore "supportedCMSTypes" attribute in PKINIT preauth requests
  - Set SHA-512 or SHA-256 with RSA as preferred CMS signature algorithms
  - Resolves: rhbz#2114766
  - Update error checking for OpenSSL CMS_verify
  - Resolves: rhbz#2119704
  - Remove invalid password expiry warning
  - Resolves: rhbz#2129113


author: Julien Rische <jrische@redhat.com> - 1.20.1-6
changelog:
  - Set aes256-cts-hmac-sha384-192 as EXAMLE.COM master key in kdc.conf
  - Add AES SHA-2 HMAC family as EXAMPLE.COM supported etypes in kdc.conf
  - Resolves: rhbz#2114771


author: Julien Rische <jrische@redhat.com> - 1.20.1-8
changelog:
  - Bypass FIPS restrictions to use KRB5KDF in case AES SHA-1 HMAC is enabled
  - Lazily load MD4/5 from OpenSSL if using RADIUS or RC4 enctype in FIPS mode


author: Julien Rische <jrische@redhat.com> - 1.20.1-6
changelog:
  - Set aes256-cts-hmac-sha384-192 as EXAMLE.COM master key in kdc.conf
  - Add AES SHA-2 HMAC family as EXAMPLE.COM supported etypes in kdc.conf
    Resolves: rhbz#2114771


author: Julien Rische <jrische@redhat.com> - 1.21-1
changelog:
  - New upstream version (1.21)
  - Do not disable PKINIT if some of the well-known DH groups are unavailable
    Resolves: rhbz#2214297
  - Make PKINIT CMS SHA-1 signature verification available in FIPS mode
    Resolves: rhbz#2214300
  - Allow to set PAC ticket signature as optional
    Resolves: rhbz#2181311
  - Add support for MS-PAC extended KDC signature (CVE-2022-37967)
    Resolves: rhbz#2166001
  - Fix syntax error in aclocal.m4
    Resolves: rhbz#2143306


author: Julien Rische <jrische@redhat.com> - 1.21.2-1
changelog:
  - New upstream version (1.21.2)
  - Fix double-free in KDC TGS processing (CVE-2023-39975)
    Resolves: rhbz#2229113
  - Make tests compatible with Python 3.12
    Resolves: rhbz#2224013


author: Julien Rische <jrische@redhat.com> - 1.21.2-3
changelog:
  - Fix double free in klist's show_ccache()
    Resolves: rhbz#2257301
  - Store krb5-tests files in architecture-specific directories
    Resolves: rhbz#2244601


author: Zuzana Miklankova <zmiklank@redhat.com> - 3.42.0-1
changelog:
  - Updated to version 3.42.0 (https://sqlite.org/releaselog/3_42_0.html)
  - Use %patch -P N instead of deprecated %patchN


author: Zuzana Miklankova <zmiklank@redhat.com> - 3.45.0-1
changelog:
  - Updated to version 3.45.0 (https://sqlite.org/releaselog/3_45_0.html)
  - List versioned soname in files, preventing unnoticed soname bumps
  - Disable func4 tests for i686 arch due to failing float<->int conversions


author: Karel Zak <kzak@redhat.com> - 2.38-1
changelog:
  - upgrade to v2.38
  - don't (re)generate build-system
  - modernize spec file style (thanks to Zbigniew)


author: Karel Zak <kzak@redhat.com> - 2.39-1
changelog:
  - upgrade to v2.39
  - remove dependence on libuser
  - remove util-linux-user subpackage
  - enable translated man pages
  - add util-linux-i18n subpackage


author: Karel Zak <kzak@redhat.com> - 2.39.2-1
changelog:
  - fix libmount atime regression
  - upgrade to v2.39.2
    https://kernel.org/pub/linux/utils/util-linux/v2.39/v2.39.2-ReleaseNotes


author: Colin Walters <walters@verbum.org> - 2.40-0.9.rc1
changelog:
  - Backport https://github.com/util-linux/util-
    linux/commit/211a9da0b4e9704eea210d7944b723fa78272c79


author: Jay W <git.jaydobuleu@gmail.com> - 2:0.7.0-2
changelog:
  - Ensure PREFIX=/usr INCLUDEDIR=/usr/include are set so that flatpak is
    able to build libbpf as dependency.


author: Steve Grubb <sgrubb@redhat.com> 0.8.4-1
changelog:
  - New upstream bugfix release
  - Drop libcap-ng-0.8.3-apply-disable.patch since things should be fixed


author: Gary Buhrmaster <gary.buhrmaster@gmail.com> - 0.7.0-8
changelog:
  - Update license to SPDX format
  - spec file tidy/modernization
    - use modern cmake build and install
    - properly own include directories in the devel package
    - de-glob some files to follow packaging guidelines


author: Gary Buhrmaster <gary.buhrmaster@gmail.com> - 0.10.2-1
changelog:
  - Update to version 0.10.2 ( resolves: rhbz#1880885 )
  - Revise specs per packaging guidelines for globs of soname


author: Filip Janus <fjanus@redhat.com> - 5.3.25-57
changelog:
  - Add convert-util subpackage
  - It allowes to convert BerkeleyDB database format to GDBM/LMDB format
  - Disable shiping libdb for rhel except convert-tool


author: Carlos O'Donell <carlos@redhat.com> - 3.4.4-8
changelog:
  - Analyze libffi-3.4.4-7.fc40 sources for license information
  - Migrate License field to SPDX identifiers for
    https://docs.fedoraproject.org/en-US/legal/allowed-licenses/
    https://docs.fedoraproject.org/en-US/legal/update-existing-packages
    (#2222084)


author: Pavel Březina <pbrezina@redhat.com> - 2.9.4-1
changelog:
  - Rebase to SSSD 2.9.4
  - Files provider suport remove (rhbz#2253183)
  - i686 support removed (rhbz#2069738)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-3
changelog:
  - Disable enumeration support for IPA and AD providers.
    Deprecation was announced in F39 release notes:
    https://docs.fedoraproject.org/en-US/fedora/latest/release-notes/sysadmin/Security/#_support_for_the_enumeration_feature_has_been_deprecated_for_ad_and_ipa_backends
    This is a backport of upstream patch:
    https://github.com/SSSD/sssd/commit/9240bca7dcc28371ae5dce31c01e85d28409cd04


author: Richard Hughes <richard@hughsie.com> 0.1.6-1
changelog:
  - New upstream release
  - Fall back to the AliasId for validation
  - Fix jcat_context_verify_blob() to use self verify for checksums


author: Richard Hughes <richard@hughsie.com> 0.1.9-1
changelog:
  - New upstream release
  - Return an error if we try to self-sign no bytes of data
  - Set which backends are supported in the pkgconfig file


author: Richard Hughes <richard@hughsie.com> 0.1.10-1
changelog:
  - New upstream release
  - Add ED25519 support
  - Define three more types used for the firmware transparency log


author: Richard Hughes <richard@hughsie.com> 0.1.12-1
changelog:
  - New upstream release
  - Correctly export the AliasIds in all cases
  - Install all files to fix the installed-tests


author: Petr Pisar <ppisar@redhat.com> - 2.13.0-3
changelog:
  - Accept an invalid buildorder 18446744073709551615 found in RHEL 8 repositories
    (https://pagure.io/koji/issue/3025)


author: Jiri Pirko <jiri@nvidia.com> - 1.8-1
changelog:
  - 1.8 release
  - libndp,ndptool: use poll() instead of select()
  - libndp: avoid static buffer for debug string in ndp_sock_recv()
  - ndptool: avoid static buffer for string in ndptool
  - libndp: use thread local variables for static return arguments
  - ndptool: don't use static variable for local context in msgrcv_handler_func()
  - ndptool: fix printing dnssl lifetime in ndptool
  - ndptool: fix potential memory leak caused by strdup
  - ndptool: add -D dest support
  - libndp: fix nd_msg typo when setting target address
  - libndp: close sockfd after using to avoid handle leak
  - ndptool: fix target parameter typo
  - ndptool: add -T target support


author: Peter Fordham <peter.fordham@gmail.com> - 1.0.8-6
changelog:
  - Port autoconf script to C99 and enable autoreconf for this package.
    https://bugzilla.netfilter.org/show_bug.cgi?id=1654


author: Steve Dickson <steved@redhat.com> 2.6.2-2.rc4
changelog:
  - Updated to the latest RC release: nfs-utils-2-6-3-rc4 (bz 2144605)
  - Remove old nfsconvert dependencies (bz 2144179)


author: Steve Dickson <steved@redhat.com> 2.6.3-1.rc3
changelog:
  - Updated to the latest RC release: nfs-utils-2-6-4-rc3
  - Fixed a regression in the junction code (bz 2213669)


author: Christian Glombek <cglombek@redhat.com> 2.6.3-2.rc3
changelog:
  - Rely on presets and use standard macros for systemd unit handling (bz 2218006)
  - Cleanup is moved to %posttrans


author: Phil Sutter <psutter@redhat.com> - 1.2.6-1
changelog:
  - Drop outdated libnftables provides, it might clash with the new
    nftables-provided libnftables at some point in future
  - Backport one late fix from upstream
  - new version 1.2.6


author: Jan Macku <jamacku@redhat.com> 1.60.0-1
changelog:
  - update to the latest upstream release
  - update PGP key from https://keyserver.ubuntu.com/pks/lookup?op=vindex&search=0x7e8403d5d673c366


author: Björn Esser <besser82@fedoraproject.org> - 2.0.0-2
changelog:
  - Add logic for closing the loop hole on soname bumps
  - Explicitly force manual intervention for soname bumps


author: Lukáš Zaoral <lzaoral@redhat.com> - 0.21.2-5
changelog:
  - migrate to SPDX license format
    - the old and new license tags are identical, this changelog entry just
      indicates that it was checked to be correct


author: Paul Wouters <paul.wouters@aiven.io> - 1.4.4-6
changelog:
  - Resolves: rhbz#1992607 libpwquality: regression in minimal image size because of hard dependency on cracklib-dicts


author: Paul Wouters <paul.wouters@aiven.io - 1.4.5-1
changelog:
  - Resolves: rhbz#2154991 libpwquality fails to build with Python 3.12: ModuleNotFoundError: No module named 'distutils'
  - Resolves: rhbz#2006063 RFE: Support running without cracklib-dicts installed
  - Cleanup and remove python2/3 conditional macros


author: Jaroslav Rohel <jrohel@redhat.com> - 1.14.4-1
changelog:
  - Update to 1.14.4
  - Use nanosec precision for timestamp of checksum cache (RhBug:2077864)
  - Fix alloc/free mismatches and memory leaks


author: Jaroslav Rohel <jrohel@redhat.com> - 1.15.1-1
changelog:
  - Update to 1.15.1
  - Adds API support for waiting on network in an event driven manner (new API function lr_handle_network_wait)
  - OpenPGP API extension and fixes (new API functions lr_gpg_*)
  - Update license format to "LGPL-2.1-or-later"


author: Jan Kolarik <jkolarik@redhat.com> - 1.15.2-1
changelog:
  - Update to 1.15.2
  - Fixes and optimizations in header files
  - Fix lr_gpg_list_keys function when keys are empty
  - Update PGP test vectors
  - Fix CMake warnings
  - Bump glib version


author: Jan Kolarik <jkolarik@redhat.com> - 1.17.0-1
changelog:
  - Update to 1.17.0
  - lr_gpg_check_signature: Forward PGP error messages from RPM
  - PGP: fix: Support importing binary public keys in librpm backend
  - PGP: Enable creating a UID directory for GnuGP agent socket in /run/gnupg/user
  - PGP: Set a default creation SELinux labels on GnuPG directories


author: Packit <hello@packit.dev> - 2.17.3-1
changelog:
  - Release version 2.17.3 (Michal Fabik)
  - Update changelog (Michal Fabik)
  - Run autoupdate to get rid of obsolete/deprecated macros (Michal Fabik)
  - Makefile: Move README.md to EXTRA_DIST (Michal Fabik)
  - Don't build rhel-bugzilla --without-bugzilla (Michal Fabik)
  - doc: Make anaconda_event.conf depend on BZ (Michal Fabik)
  - Fix build --without-bugzilla (Michal Fabik)
  - spec: Don't list files twice (Michal Fabik)
  - Update translations (mgrabovsky)


author: Packit <hello@packit.dev> - 2.17.4-1
changelog:
  - Release version 2.17.4 (Michal Fabik)
  - Update changelog (Michal Fabik)
  - reporter_bugzilla.py: Don't ask for API key if we already have it (Michal Srb)
  - internal/bz_connection.py: Fix "TypeError: 'builtin_function_or_method' object is not subscriptable" (Michal Srb)
  - reporter_bugzilla.py: Fix condition (Michal Srb)
  - internal/reported_to.py: Prevent possible ValueError if the line is for example empty (Michal Srb)
  - reporter_bugzilla.py: Prevent possible KeyError exception (Michal Srb)
  - reporter_bugzilla.py: Default value for `b_create_private` is False (Michal Srb)
  - reporter_bugzilla.py: Prevent possible KeyError exception (Michal Srb)


author: Packit <hello@packit.dev> - 2.17.5-1
changelog:
  - Release version 2.17.5 (Michal Srb)
  - Update changelog (Michal Srb)
  - dump_dir.py: check that the filename doesn't start with "/" (Michal Srb)
  - dump_dir.py: Don't pass libreport flags to open() (Michal Srb)
  - reporter-bugzilla: Fix exceptions (Michal Srb)
  - Update translations (mgrabovsky)


author: Packit <hello@packit.dev> - 2.17.6-1
changelog:
  - Release version 2.17.6 (Michal Srb)
  - Update translations (mgrabovsky)
  - Update changelog (Michal Srb)
  - reporter-bugzilla: Fix TypeError (Michal Srb)


author: Packit <hello@packit.dev> - 2.17.7-1
changelog:
  - Release version 2.17.7 (Michal Srb)
  - spec: Add disttag (Michal Srb)
  - Update changelog (Michal Srb)
  - Fix rpm -V issue with missing reporter-bugzilla-python in f38 (Michal Srb)
  - Fix TypeError (Michal Srb)
  - Update pot file (Matěj Grabovský)
  - readme: Add diagram of related projects (Matěj Grabovský)
  - Update translations (mgrabovsky)
  - Use SPDX format for license field (Matěj Grabovský)
  - ignored_words: Add KeyboardInterrupt (Michal Fabik)
  - packit: Add dependencies for SRPM build (Matěj Grabovský)
  - Update translations (mgrabovsky)


author: Packit <hello@packit.dev> - 2.17.8-1
changelog:
  - Release version 2.17.8 (Michal Srb)
  - Update changelog (Michal Srb)
  - reporter-bugzilla: Fix KeyError when HOME env var is not set (Michal Srb)
  - Update changelog (Michal Srb)
  - reporter-bugzilla: Fix password prompt in client/server mode (Michal Srb)


author: Packit <hello@packit.dev> - 2.17.9-1
changelog:
  - Release version 2.17.9 (Michal Srb)
  - reporter-bugzilla: Fix string interpolation (Matěj Grabovský)
  - reporter-bugzilla: Replace flags with just keyword arg (Michal Srb)
  - reporter-bugzilla: Make sure that the creator of a bug is always in CC (Michal Srb)
  - reporter-bugzilla: Don't fail if reported_to file doesn't exist (Michal Srb)
  - reporter-bugzilla: Fix reporting when the bug already exists (Michal Srb)
  - use $XDG_CONFIG_HOME to access user's configuration files (Yann Droneaud)
  - Update translations (mgrabovsky)


author: Packit <hello@packit.dev> - 2.17.10-1
changelog:
  - Release version 2.17.10 (Matěj Grabovský)
  - reporter-upload: Fix a use-after-free error in string handling (Matěj Grabovský)
  - Update translations (mgrabovsky)
  - Update translations (mgrabovsky)


author: Packit <hello@packit.dev> - 2.17.11-1
changelog:
  - Release version 2.17.11 (Michal Srb)
  - spec: Add missing requires for python3-libreport (Michal Srb)
  - Build URL with urllib.parse.urljoin() (Michal Srb)
  - Add XDG_ACTIVATION_TOKEN to the list of ignored words (Michal Srb)
  - Attachments are minor updates in Bugzilla (Michal Srb)
  - Retry Bugzilla search queries with delays (Michal Srb)
  - Fix "NameError: name 'ticket' is not defined" exception (Michal Srb)
  - Update translations (mgrabovsky)


author: Packit <hello@packit.dev> - 2.17.14-1
changelog:
  - Release version 2.17.14 (Michal Srb)
  - reporter-bugzilla: Reduce number of duplicate bug reports (Michal Srb)
  - reporter-bugzilla: Fix config loading (Michal Srb)
  - reporter-bugzilla: API key must consist of latin-1 characters (Michal Srb)
  - reporter-bugzilla: Fix typo (Michal Srb)
  - reporter-bugzilla: Fix creating binary attachments (Michal Srb)
  - Update translations (mgrabovsky)


author: Packit <hello@packit.dev> - 2.17.15-1
changelog:
  - Release version 2.17.15 (Michal Srb)
  - reporter-bugzilla: Make the supplementary bugs easily identifiable (Michal Srb)
  - reporter-bugzilla: Fix formatting in the supplementary bugs (Michal Srb)
  - reporter-bugzilla: Fix code comment (Michal Srb)


author: Packit <hello@packit.dev> - 2.17.2-1
changelog:
  - Release version 2.17.2 (Michal Fabik)
  - reporter_bugzilla.py: Build, install (Michal Fabik)
  - reporter_bugzilla.py: Add tests (Michal Fabik)
  - reporter_bugzilla.py: Initial commit (Michal Fabik)
  - Update translations (mgrabovsky)
  - abrt_xmlrpc: Don't warn about discarded const (Michal Fabik)
  - Update translations (mgrabovsky)
  - Update translations (mgrabovsky)
  - Use conventional lseek arg order (Michal Fabik)
  - Update translations (mgrabovsky)
  - ignored_words: Ignore more debuginfod URLs (Matěj Grabovský)


author: Jiri Pirko <jiri@resnulli.us> - 1.32-1
changelog:
  teamd: Add option to change evaluation logic of multiple link-watchers
  Revert: teamd: lacp: make sure that lacp_port_agg_update() works with correct unselectable state
  teamd: lacp: don't move the port state from disabled when admin state is down
  teamd: lacp: set port to disabled state during removal
  teamd: lacp: make sure that lacp_port_agg_update() works with correct unselectable state
  libteam: clear changed bits in case of TEAM_IFINFO_CHANGE
  misc: fix possible strncpy truncation bug
  teamd: stop iterating callbacks when a loop restart is requested
  teamd: do no remove the ports on shutdown with -N
  binding/python: ifindex 0 is invalid so do not process it
  teamd: Include missing headers for strrchr and memcmp
  libteamdctl: validate the bus name before using it
  options: move option temporary check after the err check
  teamd: lacp: increase "min_ports" upper limit to 1024
  fix build on OpenWRT/musl-libc
  teamd: increase the waitting time for daemon killing
  Revert "teamd: Disregard current state when considering port enablement"


author: Frederic Berat <fberat@redhat.com> - 2.4.6-48
changelog:
  - Add support for "-fsanitize", rhbz#2024647
  - Add support for "-fuse-ld", rhbz#2024647
  - Use make macros (based on Tom Stellard work for f33 and Timm Bäder)
    https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
  - Disable non-PIC test for ARM as this is not supported on this arch
  - Use autosetup
  - Use plain %configure


author: Mike FABIAN <mfabian@redhat.com> - 0.9.10-12
changelog:
  - Fix memory leak in vasnprint. Resolves: rhbz#1938800
    (Backported from upstream: https://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=4d288a80bf7ebe29334b9805cdcc70eacb6059c1)
  - Fix spelling in license GPLV2+ -> GPLv2+


author: Kate Hsuan <hpa@redhat.com> - 1.0.27-1
changelog:
  - Update to 1.0.27
  - Update to 1.0.27
  - Add tests, including init_context, set_option, and stress_mt


author: Björn Esser <besser82@fedoraproject.org> - 4.4.31-4
changelog:
  - Add BR for perl modules to run the skip-if-exec-format-error script
  - Move the BR for minimum Perl version to perl-interpreter


author: Björn Esser <besser82@fedoraproject.org> - 4.4.33-3
changelog:
  - Convert License to SPDX expression
  - Add upstream patch to improve performance on some type-cast operations


author: Björn Esser <besser82@fedoraproject.org> - 4.4.33-5
changelog:
  - Simplify transitional Requires and Obsoletes for legacy packages
  - Drop versioned BR on perl-interpreter
  - Fix README.posix file, as the fcrypt function is still available


author: Frantisek Sumsal <frantisek@sumsal.cz> - 2.5.1-32
changelog:
  - Disable zntune, since the respective driver was dropped in kernel 5.19
  - Bring back autotools to make the new and previous patches actually work


author: Jan Staněk <jstanek@redhat.com> - 0.9.29-7
changelog:
  - Fix source file definition and handling
  - Use archive name expected by GitLab, then the archive does not contain
    whole commit reference.
  - Use standard %forgemeta macros, although some detail neede to be fill in
    – GitLab handling is not detected from URL.
  - Fix upstream URL.


author: Kamil Dudka <kdudka@redhat.com> - 3.20.1-1
changelog:
  - new upstream version 3.20.1, which fixes the following security issue:
      CVE-2022-1348 - potential DoS from unprivileged users via the state file


author: Tom Callaway <spot@fedoraproject.org> - 5.4.3-4
changelog:
  - apply upstream fix for CVE-2021-44647
  - apply upstream fixes for known lua bugs 4-10 (11 assumes other changes beyond 5.4.3)


author: Tom Callaway <spot@fedoraproject.org> - 5.4.4-1
changelog:
  - update to 5.4.4, update bootstrap code to 5.3.6
  - 5.4.4 contains the fix for 5.4.3 bug7, which is also CVE-2021-43519
    This fix was also in 5.4.3-4, so you do not need to update solely for that.


author: Tom Callaway <spot@fedoraproject.org> - 5.4.6-3
changelog:
  - disable "corrupted binary dump" test that has issues on big-endian architectures
  - apply upstream fix for 5.4.6 bug 1


author: Lukas Javorsky <ljavorsk@redhat.com> - 1.2.11-32
changelog:
  - Apply IBM patch for compressBound() function
  - Source from https://github.com/madler/zlib/issues/410#issuecomment-947212824
  - Resolves: #2057484


author: Lukas Javorsky <ljavorsk@redhat.com> - 1.2.12-5
changelog:
  - Fix heap-based buffer over-read or buffer overflow in inflate in inflate.c
  - Resolves: CVE-2022-37434


author: Michal Ruprich <mruprich@redhat.com> - 2.0-0.63.20160912git
changelog:
  - Resolves: #2114821 - The output of `route -A inet6` does not display properly when the 'Use' column output is over 6 digits


author: Michal Ruprich <mruprich@redhat.com> - 2.0-0.64.20160912git
changelog:
  - Resolves: #2077846 - net-tools utilities display incorrect statistics for interfaces with 15-character names


author: Kevin Fenzi <kevin@scrye.com> - 1.0.7-1
changelog:
  - Update to 1.0.7. Fixes rhbz#2155658
  - Build the package with setuptools instead of distutils. Fixes: rhbz#2154872


author: Phil Sutter <psutter@redhat.com> - 1:1.0.9-1
changelog:
  - Fix devel sub-package description
  - Utilize pyproject-rpm-macros for the python sub-package
  - new version 1.0.9


author: Michael J Gruber <mjg@fedoraproject.org> - 1.7-1
changelog:
  - update to upstream release 1.7 (rhbz#2265629)
  - use pkgconf/npth.c instead of npth-config
  - new functions npth_poll and npth_ppoll


author: Jan Pazdziora <jpazdziora@redhat.com> - 2.23.0-1
changelog:
  - Rebase to 2.23.0 (fedora#2036375)
  - Change upstream to https://github.com/flatcar/nss-altfiles
  - Enable all maps (fedora#2036375)


author: Timothée Ravier <tim@siosm.fr> - 2.23.0-4
changelog:
  - Fix macro expansion in description
  - Use make macros: https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
  - Use SPDX identifiers for license: https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_3


author: Mamoru TASAKA <mtasaka@fedoraproject.org> - 6.9.8-2.D20220919gitb041f6d
changelog:
  - Update to the latest git, expecially:
    - Update to Unicode 15.0 (upstream #272)
    - [[:punct:]] behavoir change (upsteam #268)


author: Simon Pichugin <spichugi@redhat.com> - 2.6.1-1
changelog:
  - Update to new major release OpenLDAP 2.6.1 (#1955293)
    + rediff all patches and remove patches now upstream
    + use upstream source location for check password module
    + and rediff patch due to this
    + add patch to fix build issue in 2.5.4 (from upstream)
    + clean and sort buildreqs
    + remove various refs to bdb
    + remove now default -DLDAP_USE_NON_BLOCKING_TLS
    + add new modules and enable load balancer as module
    + disable wiredtired backend due to missing build deps
    + don't remove files that don't exist
    + let check-config work on *.mdb over legacy files
    + remove refs to old-style config
    + new soname names
    + remove libldap_r link as the library was merged with libldap
    + refactor openldap-compat package to support the transition from 2.4
    + add UPGRADE_INSTRUCTIONS for openldap-server upgrade
  - The original patch was submitted by Fedora user - terjeros
    https://src.fedoraproject.org/rpms/openldap/pull-request/6


author: Simon Pichugin <spichugi@redhat.com> - 2.6.7-1
changelog:
  - Rebase to version 2.6.7 (rhbz#2261163)
  - Use systemd-sysusers for ldap user and group (rhbz#2173965)
  - Fix compiler errors (rhbz#2261427)
  - Replace License with SPDX identifier


author: Dusty Mabe <dusty@dustymabe.com> - 9.0p1-11
changelog:
  - Provide a systemd unit for restoring default host key permissions (rhbz#2172956)
  - Co-Authored by Timothée Ravier <tim@siosm.fr>


author: Dusty Mabe <dusty@dustymabe.com> - 9.0p1-12
changelog:
  - Mark /var/lib/.ssh-host-keys-migration as %ghost file
  - Make ssh-host key migration less conditional


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.3p1-8
changelog:
  - Split including crypto-policies to a separate config (rhbz#1970566)
  - Disable forking of ssh-agent on startup (rhbz#2148555)
  - Remove sshd.socket unit (rhbz#2025716)
  - Minor optimization of ssh_krb5_kuserok (rhbz#2112501)


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.3p1-10
changelog:
  - Forbid shell metasymbols in username/hostname
    Resolves: CVE-2023-51385
  - Fix Terrapin attack
    Resolves: CVE-2023-48795
  - Apply destination constraints to all PKCS#11 keys
    Resolves: CVE-2023-51384


author: Norbert Pocs <npocs@redhat.com> - 9.0p1-18
changelog:
  - Fix pkcs11 issue with the recent changes
  - Clarify HostKeyAlgorithms relation with crypto-policies


author: Norbert Pocs <npocs@redhat.com> - 9.3p1-9
changelog:
  - pkcs11: Add support for 'serial' in PKCS#11 URI
  - Apply the upstream MR related to the previous pkcs11 issue
  - https://github.com/openssh/openssh-portable/pull/406


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 9.3p1-13
changelog:
  - Fix issue with read-only ssh buffer during gssapi key exchange (rhbz#1938224)
  - https://github.com/openssh-gsskex/openssh-gsskex/pull/19


author: Daniel Milnes <daniel@daniel-milnes.uk> - 9.6p1-1
changelog:
  - Update to OpenSSH 9.6
    Original patches from https://src.fedoraproject.org/rpms/openssh/pull-request/63
    Tuned by Dmitry Belyavskiy for GSS and PKCS#11 URI processing


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.6p1-1.3
changelog:
  - Build OpenSSH without engine support
  - Make tests run at build phase (using parallel run mechanism by Alexander Sosedkin)


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.5-6
changelog:
  - CVE-2022-3602: X.509 Email Address Buffer Overflow
  - CVE-2022-3786: X.509 Email Address Buffer Overflow
    Resolves: CVE-2022-3602
    Resolves: CVE-2022-3786


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.7-1
changelog:
  - Rebase to upstream version 3.0.7
  - C99 compatibility in downstream-only 0032-Force-fips.patch
    Resolves: rhbz#2152504
  - Adjusting include for the FIPS_mode macro
    Resolves: rhbz#2083876


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.8-1
changelog:
  - Rebase to upstream version 3.0.8
    Resolves: CVE-2022-4203
    Resolves: CVE-2022-4304
    Resolves: CVE-2022-4450
    Resolves: CVE-2023-0215
    Resolves: CVE-2023-0216
    Resolves: CVE-2023-0217
    Resolves: CVE-2023-0286
    Resolves: CVE-2023-0401


author: Sahana Prasad <sahana@redhat.com> - 1:3.0.8-2
changelog:
  - Upload new upstream sources without manually hobbling them.
  - Remove the hobbling script as it is redundant. It is now allowed to ship
    the sources of patented EC curves, however it is still made unavailable to use
    by compiling with the 'no-ec2m' Configure option. The additional forbidden
    curves such as P-160, P-192, wap-tls curves are manually removed by updating
    0011-Remove-EC-curves.patch.
  - Enable Brainpool curves.
  - Apply the changes to ec_curve.c and  ectest.c as a new patch
    0010-Add-changes-to-ectest-and-eccurve.patch instead of replacing them.
  - Modify 0011-Remove-EC-curves.patch to allow Brainpool curves.
  - Modify 0011-Remove-EC-curves.patch to allow code under macro OPENSSL_NO_EC2M.
    Resolves: rhbz#2130618, rhbz#2141672


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.9-1
changelog:
  - Rebase to upstream version 3.0.9
    Resolves: CVE-2023-0464
    Resolves: CVE-2023-0465
    Resolves: CVE-2023-0466
    Resolves: CVE-2023-1255
    Resolves: CVE-2023-2650


author: Sahana Prasad <sahana@redhat.com> - 1:3.1.1-1
changelog:
  - Rebase to upstream version 3.1.1
    Resolves: CVE-2023-0464
    Resolves: CVE-2023-0465
    Resolves: CVE-2023-0466
    Resolves: CVE-2023-1255
    Resolves: CVE-2023-2650


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.2.1-3
changelog:
  - Minimize skipping tests
  - Allow ignoring unknown signature algorithms and groups (upstream #23050)
  - Allow specifying provider algorithms in SignatureAlgorithms (upstream #22779)


author: Hedayat Vatankhah <hedayat.fwd+rpmchlog@gmail.com> - 1.81-1
changelog:
  - Update to latest upstream version with better support for latest OSes,
    closes rhbz#2090942
  - Remove 'which' dependency, closes rhbz#2111531
  - Add support for detecting EFI shell binary (shell.efi), closes rhbz#2101953
  - Add support for Win 11 on ARM 64 systems


author: Dusty Mabe <dusty@dustymabe.com> - 2023.3-3
changelog:
  - Backport log message fix in https://github.com/ostreedev/ostree/pull/2870
  - Backport fallocate fix in https://github.com/ostreedev/ostree/pull/2871


author: Colin Walters <walters@verbum.org> - 2023.6-2
changelog:
  - Cherry pick
    https://github.com/ostreedev/ostree/pull/3060/commits/3b2fd6e9ff0a3a91a2b72f524492e4f198069dec


author: Colin Walters <walters@verbum.org> - 2023.7-3
changelog:
  - Add a composefs requirement; this is not actually a requirement
    right now, but will be in the near future, so let's prepare for it.


author: Colin Walters <walters@verbum.org> - 2023.7-4
changelog:
  - Enable composefs only on fedora/rhel10 to fix COPR builds
    which pull from this dist-git
  - Exclude x86 on FedoraELN since composefs is
  - Always disable soup to re-sync with ostree upstream logic


author: Colin Walters <walters@verbum.org> - 2023.8-4
changelog:
  - Backport https://github.com/ostreedev/ostree/pull/3129/commits/a1c1c0b500
    d23ff129adbfe9486a067788b24969 To aid https://github.com/coreos/fedora-
    coreos-config/pull/2783


author: Packit Service <user-cont-team+packit-service@redhat.com> - 0.24.1-1
changelog:
  - Release 0.24.1 (Daiki Ueno)
  - common: Support copying attribute array recursively (Daiki Ueno)
  - common: Add assert_ptr_cmp (Daiki Ueno)
  - gtkdoc: remove dependencies on custom target files (Eli Schwartz)
  - doc: Replace occurrence of black list with blocklist (Daiki Ueno)
  - build: Suppress cppcheck false-positive on array bounds (Daiki Ueno)
  - ci: Use Docker image from the same repository (Daiki Ueno)
  - ci: Integrate Docker image building to GitHub workflow (Daiki Ueno)
  - rpc: Fallback to version 0 if server does not support negotiation (Daiki Ueno)
  - build: Port e850e03be65ed573d0b69ee0408e776c08fad8a3 to meson (Daiki Ueno)
  - Link libp11-kit so that it cannot unload (Emmanuel Dreyfus)
  - trust: Use dngettext for plurals (Daiki Ueno)
  - rpc: Support protocol version negotiation (Daiki Ueno)
  - rpc: Separate authentication step from transaction (Daiki Ueno)
  - Meson: p11_system_config_modules instead of p11_package_config_modules (Issam E. Maghni)
  - shell: test -a|o is not POSIX (Issam E. Maghni)
  - Meson: Add libtasn1 to trust programs (Issam E. Maghni)
  - meson: optionalise glib's development files for gtk_doc (Đoàn Trần Công Danh)


author: Pavel Březina <pbrezina@redhat.com> - 1.5.2-8
changelog:
  - systemd-auth, smartcard-auth, fingerprint-auth, password-auth and postlogin are now owned by authselect (#2023738)


author: Björn Esser <besser82@fedoraproject.org> - 1.5.3-1
changelog:
  - Rebase to release 1.5.3
    Resolves: #2196709
  - Drop pam-1.5.2-pwhistory-config.patch and pam-1.5.2-configure-c99.patch,
    as those patches are implemented upstream
  - Realign left-over patches
  - Update build requirements for documentation (docbook5)
  - Remove --enable-vendordir from configuration
  - Enable (deprecated) pam_lastlog module


author: Mikel Olasagasti Uranga <mikel@olasagasti.info> - 0.1.1-2
changelog:
  - Misc changes
  - Move meson_test to check section
  - Reorder BuildRequires alphabetically
  - Reorder install files
  - Use %%{buildroot} instead of RPM_BUILD_ROOT
  - Use %%autorelease for Release tag


author: Stefano Brivio <sbrivio@redhat.com> - 0^20230310.g70c0765-1
changelog:
  - Install SELinux interface files to shared include directory
  - Upstream changes: https://passt.top/passt/log/?qt=range&q=2023_03_09.7c7625d..2023_03_10.70c0765


author: Stefano Brivio <sbrivio@redhat.com> - 0^20230317.gdd23496-1
changelog:
  - Refresh SELinux labels in scriptlets, require -selinux package
  - Upstream changes: https://passt.top/passt/log/?qt=range&q=2023_03_10.70c0765..2023_03_17.dd23496


author: Stefano Brivio <sbrivio@redhat.com> - 0^20230329.gb10b983-1
changelog:
  - Adjust path for SELinux policy and interface file to latest guidelines
  - Don't install useless SELinux interface file for pasta
  - Upstream changes: https://passt.top/passt/log/?qt=range&q=2023_03_21.1ee2f7c..2023_03_29.b10b983


author: Stefano Brivio <sbrivio@redhat.com> - 0^20230509.g96f8d55-1
changelog:
  - Relicense to GPL 2.0, or any later version
  - Upstream changes: https://passt.top/passt/log/?qt=range&q=2023_03_29.b10b983..2023_05_09.96f8d55


author: Stefano Brivio <sbrivio@redhat.com> - 0^20230818.g0af928e-1
changelog:
  - Install pasta as hard link to ensure SELinux file context match
  - Upstream changes: https://passt.top/passt/log/?qt=range&q=2023_06_27.289301b..2023_08_18.0af928e


author: Stefano Brivio <sbrivio@redhat.com> - 0^20230907.gee58f37-1
changelog:
  - Replace pasta hard links by separate builds
  - Upstream changes: https://passt.top/passt/log/?qt=range&q=2023_08_23.a7e4bfb..2023_09_07.ee58f37


author: Stefano Brivio <sbrivio@redhat.com> - 0^20231107.g56d9f6d-1
changelog:
  - Upstream changes: https://passt.top/passt/log/?qt=range&q=2023_10_04.f851084..2023_11_07.56d9f6d
  - SELinux: allow passt_t to use unconfined_t UNIX domain sockets for
    --fd option (https://bugzilla.redhat.com/show_bug.cgi?id=2247221)


author: Stefano Brivio <sbrivio@redhat.com> - 0^20240318.g615d370-1
changelog:
  - Switch license identifier to SPDX (Dan Čermák)
  - Upstream changes: https://passt.top/passt/log/?qt=range&q=2024_02_20.1e6f92b..2024_03_18.615d370


author: Lukas Javorsky <ljavorsk@redhat.com> - 10.37-3
changelog:
  - Revert of copying the old posix library - After rebuilding all
  - dependend packages we don't need to backport the old library


author: Lukas Javorsky <ljavorsk@redhat.com> - 10.42-1
changelog:
  - Rebase to version 10.42
  - RISC-V is JIT enabled according to the https://github.com/PCRE2Project/pcre2/issues/14


author: Ed Santiago <santiago@redhat.com> - 5:4.9.1-2
changelog:
  - Much-belated cleanup
  - remove all references to cgroups v1. That code never worked, and "cgroups
    v2" in test names was misleading because it implied an alternative.
    Remove it.
  - refactor podman remote and local tests
  - clean up docs
  - Ansible bitrot cleanup ("this is deprecated, use that")


author: Petr Lautrbach <plautrba@redhat.com> - 3.4-5
changelog:
  - gettext: handle unsupported languages properly (#2100378)
  - semodule: rename --rebuild-if-modules-changed to --refresh
  - python: Split "semanage import" into two transactions (#2063353)
  - selinux-autorelabel: Do not force reboot (#2093133)


author: Petr Lautrbach <plautrba@redhat.com> - 3.4-6
changelog:
  - Run autorelabel in parallel by default
    https://fedoraproject.org/wiki/Changes/SELinux_Parallel_Autorelabel


author: Petr Lautrbach <lautrbach@redhat.com> - 3.4-7.1
changelog:
  - Rebase on upstream f56a72ac9e86
  - sepolicy: fix sepolicy manpage -w
  - sandbox: add -R option to alternate XDG_RUNTIME_DIR
  - Remove dependency on the Python module distutils


author: Vit Mojzis <vmojzis@redhat.com> - 3.5-5
changelog:
  - python/sepolicy: Fix spec file dependencies
  - python/sepolicy: Fix template for confined user policy modules
  - Improve man pages and add examples


author: Petr Lautrbach <lautrbach@redhat.com> - 3.5-7
changelog:
  - python: improve format strings for proper localization
  - python: Drop hard formating from localized strings
  - sepolicy: port to dnf4 python API (rhbz#2209404)


author: Jan Rybar <jrybar@redhat.com> - 122-4
changelog:
  - Switch 'polkitd' to static UID/GID (fpc#1189) (on behalf of lucab)
  - Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2104615


author: Christian Glombek <cglombek@redhat.com> - 123-2
changelog:
  - Provide a sysusers.d file to get user() and group() provides
    (see https://fedoraproject.org/wiki/Changes/Adopting_sysusers.d_format).


author: Jan Rybar <jrybar@redhat.com> - 124-3
changelog:
  - pkexec: no session for cookie error fixed
  - pkttyagent: fix of generation of coredump if EOF (Ctrl+D) sent to password prompt


author: Jan Rybar <jrybar@redhat.com> - 0.1-26
changelog:
  - use build macros, on behalf of original author Tom Stellard (tstellar)
  - Pagure doesn't allow one-click rebase, AFAIK


author: Panu Matilainen <pmatilai@redhat.com> - 1.19~rc1-1
changelog:
  - Rebase to 1.19-rc1 (https://github.com/rpm-software-management/popt/releases/tag/popt-1.19-rc1)
  - Remove manual .la cleanup, it's automatic nowadays
  - Add a guard against accidental soname changes


author: Than Ngo <than@redhat.com> - 1.3.11-4
changelog:
  - Fix negative values seen while running lpar
  - Fix lparstat error with mixed SMT state
  - Fix negative values seen while running lparstat with -E option


author: Panu Matilainen <pmatilai@redhat.com> - 4.18.0-2
changelog:
  - Drop the temporary build-dependency on pandoc before it grows a beard
  - Start utilizing %patchlist, finally


author: Panu Matilainen <pmatilai@redhat.com> - 4.18.0-11
changelog:
  - Disable debuginfod lookups in rpmbuild scripts
  - Exclude kernel modules from ELF dependency generation


author: Miro Hrončok <mhroncok@redhat.com> - 4.18.1-3
changelog:
  - Explicitly require rpm-sequoia >= 1.4.0 on runtime to avoid
    rpm: symbol lookup error: /lib64/librpmio.so.9: undefined symbol: _pgpVerifySignature2


author: Panu Matilainen <pmatilai@redhat.com> - 4.18.92-3
changelog:
  - Fix regression on uncompressing 7zip compressed sources (#2229984)
  - Fix a conflict with pre-existing scl-utils %_root_prefix macro (#2233454)


author: Panu Matilainen <pmatilai@redhat.com> - 4.19.0-2
changelog:
  - Ensure central package ops log via rpm-plugin-audit recommends (#1476926)
  - Own our Python module directory (#2248555)
  - Fix sysusers.d generator barfing on legit content (#2246236)


author: Richard W.M. Jones <rjones@redhat.com> - 7.2.0-7
changelog:
  - Fix virtio-blk-pci detect-zeroes=unmap (RHBZ#2173357)
  - Fix build with glib2 2.75.3 (RHBZ#2173639)
  - Disable the tests on i686


author: Cole Robinson <crobinso@redhat.com> - 8.2.0-7
changelog:
  - Enable PIE for qemu-user-static builds
  - Replace PVH build fix patch with version that should work on centos


author: Colin Walters <walters@verbum.org> - 2023.1-4
changelog:
  - Cherry pick
    https://github.com/coreos/rpm-ostree/pull/4308/commits/476afb1d08513cb74cd1d28490c5e028c70f67c2


author: Michal Ruprich <mruprich@redhat.com> - 3.2.5-1
changelog:
  - New version 3.2.5
  - Resolves: #2115430 - remote arbitrary files write inside the directories of connecting peers
  - Fix for CVE-2022-37434


author: Michal Ruprich <mruprich@redhat.com> - 3.2.6-2
changelog:
  - Resolves: #2128682 - rsync fail with "ERROR: rejecting unrequested file-list name..." depend of parameters order


author: Lokesh Mandvekar <lsm5@fedoraproject.org> - 2:1.1.1-1
changelog:
  - Bump to v1.1.1
  - add hardening flags
  - remove unused packages
  - update license and bundled provides


author: Maxwell G <gotmax@e.email> - 2:1.1.2-1
changelog:
  - Update to 1.1.2. Fixes rhbz#2069648.
  - Mitigate CVE-2022-29162 / GHSA-f3fp-gc8g-vw66.
  - Don't pull in git unnecessarily


author: Luca BRUNO <lucab@lucabruno.net> - 0.0.24-6
changelog:
  - Add explicit service unit ordering, after multi-user.target
    Backports: https://github.com/coreos/zincati/pull/831


author: Paolo Bonzini <pbonzini@redhat.com> - 4.9-1
changelog:
  - Rebase to 4.9
  - Update downstream patches
  - Resolves: rhbz#2140486
  - Remove change to gnulib tests, they pass anyway
  - Install valgrind and langpacks to increase test coverage


author: Zdenek Pytela <zpytela@redhat.com> - 37.7-1
changelog:
  - Update winbind_rpcd_t
  - Allow some domains use sd_notify()
  - Revert "Allow rabbitmq to use systemd notify"
  - fix(sedoctool.py): Fix syntax warning: "is not" with a literal
  - Allow nm-dispatcher console plugin manage etc files
  - Allow networkmanager_dispatcher_plugin list NetworkManager_etc_t dirs
  - Allow nm-dispatcher console plugin setfscreate
  - Support using systemd-update-helper in rpm scriptlets
  - Allow nm-dispatcher winbind plugin read samba config files
  - Allow domain use userfaultfd over all domains
  - Allow cups-lpd read network sysctls


author: Zdenek Pytela <zpytela@redhat.com> - 37.8-1
changelog:
  - Allow sa-update to get init status and start systemd files
  - Use insights_client_filetrans_named_content
  - Make default file context match with named transitions
  - Allow nm-dispatcher tlp plugin send system log messages
  - Allow nm-dispatcher tlp plugin create and use unix_dgram_socket
  - Add permissions to manage lnk_files into gnome_manage_home_config
  - Allow rhsmcertd to read insights config files
  - Label /etc/insights-client/machine-id
  - fix(devices.fc): Replace single quote in comment to solve parsing issues
  - Make NetworkManager_dispatcher_custom_t an unconfined domain


author: Zdenek Pytela <zpytela@redhat.com> - 37.9-1
changelog:
  - Allow nm-dispatcher custom plugin dbus chat with nm
  - Allow nm-dispatcher sendmail plugin get status of systemd services
  - Allow xdm read the kernel key ring
  - Allow login_userdomain check status of mount units
  - Allow postfix/smtp and postfix/virtual read kerberos key table
  - Allow services execute systemd-notify
  - Do not allow login_userdomain use sd_notify()
  - Allow launch-xenstored read filesystem sysctls
  - Allow systemd-modules-load write to /dev/kmsg and send a message to syslogd
  - Allow openvswitch fsetid capability
  - Allow openvswitch use its private tmpfs files and dirs
  - Allow openvswitch search tracefs dirs
  - Allow pmdalinux read files on an nfsd filesystem
  - Allow winbind-rpcd write to winbind pid files
  - Allow networkmanager to signal unconfined process
  - Allow systemd_hostnamed label /run/systemd/* as hostnamed_etc_t
  - Allow samba-bgqd get a printer list
  - fix(init.fc): Fix section description
  - Allow fedora-third-party read the passwords file
  - Remove permissive domain for rhcd_t
  - Allow pmie read network state information and network sysctls
  - Revert "Dontaudit domain the fowner capability"
  - Allow sysadm_t to run bpftool on the userdomain attribute
  - Add the userdom_prog_run_bpf_userdomain() interface
  - Allow insights-client rpm named file transitions
  - Add /var/tmp/insights-archive to insights_client_filetrans_named_content


author: Zdenek Pytela <zpytela@redhat.com> - 37.10-1
changelog:
  - Allow ipsec_t read/write tpm devices
  - Allow rhcd execute all executables
  - Update rhcd policy for executing additional commands 2
  - Update insights-client policy for additional commands execution 2
  - Allow sysadm_t read raw memory devices
  - Allow chronyd send and receive chronyd/ntp client packets
  - Allow ssh client read kerberos homedir config files
  - Label /var/log/rhc-worker-playbook with rhcd_var_log_t
  - Update insights-client policy (auditctl, gpg, journal)
  - Allow system_cronjob_t domtrans to rpm_script_t
  - Allow smbd_t process noatsecure permission for winbind_rpcd_t
  - Update tor_bind_all_unreserved_ports interface
  - Allow chronyd bind UDP sockets to ptp_event ports.
  - Allow unconfined and sysadm users transition for /root/.gnupg
  - Add gpg_filetrans_admin_home_content() interface
  - Update rhcd policy for executing additional commands
  - Update insights-client policy for additional commands execution
  - Add userdom_view_all_users_keys() interface
  - Allow gpg read and write generic pty type
  - Allow chronyc read and write generic pty type
  - Allow system_dbusd ioctl kernel with a unix stream sockets
  - Allow samba-bgqd to read a printer list
  - Allow stalld get and set scheduling policy of all domains.
  - Allow unconfined_t transition to targetclid_home_t


author: Zdenek Pytela <zpytela@redhat.com> - 37.11-1
changelog:
  - Allow tor get filesystem attributes
  - Allow utempter append to login_userdomain stream
  - Allow login_userdomain accept a stream connection to XDM
  - Allow login_userdomain write to boltd named pipes
  - Allow staff_u and user_u users write to bolt pipe
  - Allow login_userdomain watch various directories
  - Update rhcd policy for executing additional commands 5
  - Update rhcd policy for executing additional commands 4
  - Allow rhcd create rpm hawkey logs with correct label
  - Allow systemd-gpt-auto-generator to check for empty dirs
  - Update rhcd policy for executing additional commands 3
  - Allow journalctl read rhcd fifo files
  - Update insights-client policy for additional commands execution 5
  - Allow init remount all file_type filesystems
  - Confine insights-client systemd unit
  - Update insights-client policy for additional commands execution 4
  - Allow pcp pmcd search tracefs and acct_data dirs
  - Allow httpd read network sysctls
  - Dontaudit domain map permission on directories
  - Revert "Allow X userdomains to mmap user_fonts_cache_t dirs"
  - Revert "Allow xdm_t domain to mmap /var/lib/gdm/.cache/fontconfig BZ(1725509)"
  - Update insights-client policy for additional commands execution 3
  - Allow systemd permissions needed for sandboxed services
  - Add rhcd module
  - Make dependency on rpm-plugin-selinux unordered


author: Zdenek Pytela <zpytela@redhat.com> - 37.12-1
changelog:
  - nut-upsd: kernel_read_system_state, fs_getattr_cgroup
  - Add numad the ipc_owner capability
  - Allow gst-plugin-scanner read virtual memory sysctls
  - Allow init read/write inherited user fifo files
  - Update dnssec-trigger policy: setsched, module_request
  - added policy for systemd-socket-proxyd
  - Add the new 'cmd' permission to the 'io_uring' class
  - Allow winbind-rpcd read and write its key ring
  - Label /run/NetworkManager/no-stub-resolv.conf net_conf_t
  - blueman-mechanism can read ~/.local/lib/python*/site-packages directory
  - pidof executed by abrt can readlink /proc/*/exe
  - Fix typo in comment
  - Do not run restorecon /etc/NetworkManager/dispatcher.d in mls and minimum


author: Zdenek Pytela <zpytela@redhat.com> - 37.13-1
changelog:
  - Remove the ipa module
  - Allow sss daemons read/write unnamed pipes of cloud-init
  - Allow postfix_mailqueue create and use unix dgram sockets
  - Allow xdm watch user home directories
  - Allow nm-dispatcher ddclient plugin load a kernel module
  - Stop ignoring standalone interface files
  - Drop cockpit module
  - Allow init map its private tmp files
  - Allow xenstored change its hard resource limits
  - Allow system_mail-t read network sysctls
  - Add bgpd sys_chroot capability


author: Zdenek Pytela <zpytela@redhat.com> - 37.14-1
changelog:
  - Allow rotatelogs read httpd_log_t symlinks
  - Add winbind-rpcd to samba_enable_home_dirs boolean
  - Allow system cronjobs dbus chat with setroubleshoot
  - Allow setroubleshootd read device sysctls
  - Allow virt_domain read device sysctls
  - Allow rhcd compute selinux access vector
  - Allow insights-client manage samba var dirs
  - Label ports 10161-10162 tcp/udp with snmp
  - Allow aide to connect to systemd_machined with a unix socket.
  - Allow samba-dcerpcd use NSCD services over a unix stream socket
  - Allow vlock search the contents of the /dev/pts directory
  - Allow insights-client send null signal to rpm and system cronjob
  - Label port 15354/tcp and 15354/udp with opendnssec
  - Allow ftpd map ftpd_var_run files
  - Allow targetclid to manage tmp files
  - Allow insights-client connect to postgresql with a unix socket
  - Allow insights-client domtrans on unix_chkpwd execution
  - Add file context entries for insights-client and rhc
  - Allow pulseaudio create gnome content (~/.config)
  - Allow login_userdomain dbus chat with rhsmcertd
  - Allow sbd the sys_ptrace capability
  - Allow ptp4l_t name_bind ptp_event_port_t


author: Zdenek Pytela <zpytela@redhat.com> - 38.1-1
changelog:
  - Revert "Allow sysadm_t read raw memory devices"
  - Allow systemd-socket-proxyd get attributes of cgroup filesystems
  - Allow rpc.gssd read network sysctls
  - Allow winbind-rpcd get attributes of device and pty filesystems
  - Allow insights-client domain transition on semanage execution
  - Allow insights-client create gluster log dir with a transition
  - Allow insights-client manage generic locks
  - Allow insights-client unix_read all domain semaphores
  - Add domain_unix_read_all_semaphores() interface
  - Allow winbind-rpcd use the terminal multiplexor
  - Allow mrtg send mails
  - Allow systemd-hostnamed dbus chat with init scripts
  - Allow sssd dbus chat with system cronjobs
  - Add interface to watch all filesystems
  - Add watch_sb interfaces
  - Add watch interfaces
  - Allow dhcpd bpf capability to run bpf programs
  - Allow netutils and traceroute bpf capability to run bpf programs
  - Allow pkcs_slotd_t bpf capability to run bpf programs
  - Allow xdm bpf capability to run bpf programs
  - Allow pcscd bpf capability to run bpf programs
  - Allow lldpad bpf capability to run bpf programs
  - Allow keepalived bpf capability to run bpf programs
  - Allow ipsec bpf capability to run bpf programs
  - Allow fprintd bpf capability to run bpf programs
  - Allow systemd-socket-proxyd get filesystems attributes
  - Allow dirsrv_snmp_t to manage dirsrv_config_t & dirsrv_var_run_t files


author: Zdenek Pytela <zpytela@redhat.com> - 38.3-1
changelog:
  - Allow insights-client dbus chat with various services
  - Allow insights-client tcp connect to various ports
  - Allow insights-client run lpr and allow the proper role
  - Allow insights-client work with pcp and manage user config files
  - Allow redis get user names
  - Allow kernel threads to use fds from all domains
  - Allow systemd-modules-load load kernel modules
  - Allow login_userdomain watch systemd-passwd pid dirs
  - Allow insights-client dbus chat with abrt
  - Grant kernel_t certain permissions in the system class
  - Allow systemd-resolved watch tmpfs directories
  - Allow systemd-timedated watch init runtime dir
  - Make `bootc` be `install_exec_t`
  - Allow systemd-coredump create user_namespace
  - Allow syslog the setpcap capability
  - donaudit virtlogd and dnsmasq execmem


author: Zdenek Pytela <zpytela@redhat.com> - 38.4-1
changelog:
  - Allow NetworkManager and wpa_supplicant the bpf capability
  - Allow systemd-rfkill the bpf capability
  - Allow winbind-rpcd manage samba_share_t files and dirs
  - Label /var/lib/httpd/md(/.*)? with httpd_sys_rw_content_t
  - Allow gpsd the sys_ptrace userns capability
  - Introduce gpsd_tmp_t for sockfiles managed by gpsd_t
  - Allow load_policy_t write to unallocated ttys
  - Allow ndc read hardware state information
  - Allow system mail service read inherited certmonger runtime files
  - Add lpr_roles  to system_r roles
  - Revert "Allow insights-client run lpr and allow the proper role"
  - Allow stalld to read /sys/kernel/security/lockdown file
  - Allow keepalived to set resource limits
  - Add policy for mptcpd
  - Add policy for rshim
  - Allow admin users to create user namespaces
  - Allow journalctl relabel with var_log_t and syslogd_var_run_t files
  - Do not run restorecon /etc/NetworkManager/dispatcher.d in targeted
  - Trim changelog so that it starts at F35 time
  - Add mptcpd and rshim modules


author: Zdenek Pytela <zpytela@redhat.com> - 38.5-1
changelog:
  - Allow insights client work with gluster and pcp
  - Add insights additional capabilities
  - Add interfaces in domain, files, and unconfined modules
  - Label fwupdoffline and fwupd-detect-cet with fwupd_exec_t
  - Allow sudodomain use sudo.log as a logfile
  - Allow pdns server map its library files and bind to unreserved ports
  - Allow sysadm_t read/write ipmi devices
  - Allow prosody manage its runtime socket files
  - Allow kernel threads manage kernel keys
  - Allow systemd-userdbd the sys_resource capability
  - Allow systemd-journal list cgroup directories
  - Allow apcupsd dbus chat with systemd-logind
  - Allow nut_domain manage also files and sock_files in /var/run
  - Allow winbind-rpcd make a TCP connection to the ldap port
  - Label /usr/lib/rpm/rpmdb_migrate with rpmdb_exec_t
  - Allow tlp read generic SSL certificates
  - Allow systemd-resolved watch tmpfs directories
  - Revert "Allow systemd-resolved watch tmpfs directories"


author: Zdenek Pytela <zpytela@redhat.com> - 38.6-1
changelog:
  - Boolean: allow qemu-ga read ssh home directory
  - Allow kernel_t to read/write all sockets
  - Allow kernel_t to UNIX-stream connect to all domains
  - Allow systemd-resolved send a datagram to journald
  - Allow kernel_t to manage and have "execute" access to all files
  - Fix the files_manage_all_files() interface
  - Allow rshim bpf cap2 and read sssd public files
  - Allow insights-client work with su and lpstat
  - Allow insights-client tcp connect to all ports
  - Allow nm-cloud-setup dispatcher plugin restart nm services
  - Allow unconfined user filetransition for sudo log files
  - Allow modemmanager create hardware state information files
  - Allow ModemManager all permissions for netlink route socket
  - Allow wg to send msg to kernel, write to syslog and dbus connections
  - Allow hostname_t to read network sysctls.
  - Dontaudit ftpd the execmem permission
  - Allow svirt request the kernel to load a module
  - Allow icecast rename its log files
  - Allow upsd to send signal to itself
  - Allow wireguard to create udp sockets and read net_conf
  - Use '
  %setup       -q


  ' instead of '%setup'
  - Pass -p 1 to '
  %setup       -q


  '


author: Zdenek Pytela <zpytela@redhat.com> - 38.7-1
changelog:
  - Allowing snapper to create snapshots of /home/ subvolume/partition
  - Add boolean qemu-ga to run unconfined script
  - Label systemd-journald feature LogNamespace
  - Add none file context for polyinstantiated tmp dirs
  - Allow certmonger read the contents of the sysfs filesystem
  - Add journalctl the sys_resource capability
  - Allow nm-dispatcher plugins read generic files in /proc
  - Add initial policy for the /usr/sbin/request-key helper
  - Additional support for rpmdb_migrate
  - Add the keyutils module


author: Zdenek Pytela <zpytela@redhat.com> - 38.8-1
changelog:
  - Confine gnome-initial-setup
  - Allow qemu-guest-agent create and use vsock socket
  - Allow login_pgm setcap permission
  - Allow chronyc read network sysctls
  - Enhancement of the /usr/sbin/request-key helper policy
  - Fix opencryptoki file names in /dev/shm
  - Allow system_cronjob_t transition to rpm_script_t
  - Revert "Allow system_cronjob_t domtrans to rpm_script_t"
  - Add tunable to allow squid bind snmp port
  - Allow staff_t getattr init pid chr & blk files and read krb5
  - Allow firewalld to rw z90crypt device
  - Allow httpd work with tokens in /dev/shm
  - Allow svirt to map svirt_image_t char files
  - Allow sysadm_t run initrc_t script and sysadm_r role access
  - Allow insights-client manage fsadm pid files


author: Zdenek Pytela <zpytela@redhat.com> - 38.9-1
changelog:
  - Allow sssd read accountsd fifo files
  - Add support for the passt_t domain
  - Allow virtd_t and svirt_t work with passt
  - Add new interfaces in the virt module
  - Add passt interfaces defined conditionally
  - Allow tshark the setsched capability
  - Allow poweroff create connections to system dbus
  - Allow wg load kernel modules, search debugfs dir
  - Boolean: allow qemu-ga manage ssh home directory
  - Label smtpd with sendmail_exec_t
  - Label msmtp and msmtpd with sendmail_exec_t
  - Allow dovecot to map files in /var/spool/dovecot


author: Zdenek Pytela <zpytela@redhat.com> - 38.10-1
changelog:
  - Allow certmonger dbus chat with the cron system domain
  - Allow geoclue read network sysctls
  - Allow geoclue watch the /etc directory
  - Allow logwatch_mail_t read network sysctls
  - Allow insights-client read all sysctls
  - Allow passt manage qemu pid sock files


author: Zdenek Pytela <zpytela@redhat.com> - 38.11-1
changelog:
  - Allow dovecot-deliver write to the main process runtime fifo files
  - Allow dmidecode write to cloud-init tmp files
  - Allow chronyd send a message to cloud-init over a datagram socket
  - Allow cloud-init domain transition to insights-client domain
  - Allow mongodb read filesystem sysctls
  - Allow mongodb read network sysctls
  - Allow accounts-daemon read generic systemd unit lnk files
  - Allow blueman watch generic device dirs
  - Allow nm-dispatcher tlp plugin create tlp dirs
  - Allow systemd-coredump mounton /usr
  - Allow rabbitmq to read network sysctls


author: Zdenek Pytela <zpytela@redhat.com> - 38.12-1
changelog:
  - Allow telnetd read network sysctls
  - Allow munin system plugin read generic SSL certificates
  - Allow munin system plugin create and use netlink generic socket
  - Allow login_userdomain create user namespaces
  - Allow request-key to send syslog messages
  - Allow request-key to read/view any key
  - Add fs_delete_pstore_files() interface
  - Allow insights-client work with teamdctl
  - Allow insights-client read unconfined service semaphores
  - Allow insights-client get quotas of all filesystems
  - Add fs_read_pstore_files() interface
  - Allow generic kernel helper to read inherited kernel pipes


author: Zdenek Pytela <zpytela@redhat.com> - 38.13-1
changelog:
  - Add initial policy for cifs-helper
  - Label key.dns_resolver with keyutils_dns_resolver_exec_t
  - Allow unconfined_service_t to create .gnupg labeled as gpg_secret_t
  - Allow some systemd services write to cgroup files
  - Allow NetworkManager_dispatcher_dhclient_t to read the DHCP configuration files
  - Allow systemd resolved to bind to arbitrary nodes
  - Allow plymouthd_t bpf capability to run bpf programs
  - Allow cupsd to create samba_var_t files
  - Allow rhsmcert request the kernel to load a module
  - Allow virsh name_connect virt_port_t
  - Allow certmonger manage cluster library files
  - Allow plymouthd read init process state
  - Add chromium_sandbox_t setcap capability
  - Allow snmpd read raw disk data
  - Allow samba-rpcd work with passwords
  - Allow unconfined service inherit signal state from init
  - Allow cloud-init manage gpg admin home content
  - Allow cluster_t dbus chat with various services
  - Allow nfsidmapd work with systemd-userdbd and sssd
  - Allow unconfined_domain_type use IORING_OP_URING_CMD on all device nodes
  - Allow plymouthd map dri and framebuffer devices
  - Allow rpmdb_migrate execute rpmdb
  - Allow logrotate dbus chat with systemd-hostnamed
  - Allow icecast connect to kernel using a unix stream socket
  - Allow lldpad connect to systemd-userdbd over a unix socket
  - Allow journalctl open user domain ptys and ttys
  - Allow keepalived to manage its tmp files
  - Allow ftpd read network sysctls
  - Label /run/bgpd with zebra_var_run_t
  - Allow gssproxy read network sysctls
  - Add the cifsutils module


author: Zdenek Pytela <zpytela@redhat.com> - 38.14-1
changelog:
  - Remove permissive domain for cifs_helper_t
  - Update the cifs-helper policy
  - Replace cifsutils_helper_domtrans() with keyutils_request_domtrans_to()
  - Update pkcsslotd policy for sandboxing
  - Allow abrt_t read kernel persistent storage files
  - Dontaudit targetd search httpd config dirs
  - Allow init_t nnp domain transition to policykit_t
  - Allow rpcd_lsad setcap and use generic ptys
  - Allow samba-dcerpcd connect to systemd_machined over a unix socket
  - Allow wireguard to rw network sysctls
  - Add policy for boothd
  - Allow kernel to manage its own BPF objects
  - Label /usr/lib/systemd/system/proftpd.* & vsftpd.* with ftpd_unit_file_t


author: Zdenek Pytela <zpytela@redhat.com> - 38.15-1
changelog:
  - Update policy for systemd-sleep
  - Remove permissive domain for rshim_t
  - Remove permissive domain for mptcpd_t
  - Allow systemd-bootchartd the sys_ptrace userns capability
  - Allow sysadm_t read nsfs files
  - Allow sysadm_t run kernel bpf programs
  - Update ssh_role_template for ssh-agent
  - Update ssh_role_template to allow read/write unallocated ttys
  - Add the booth module to modules.conf
  - Allow firewalld rw ica_tmpfs_t files


author: Zdenek Pytela <zpytela@redhat.com> - 38.16-1
changelog:
  - Add support for the systemd-pstore service
  - Allow kdumpctl_t to execmem
  - Update sendmail policy module for opensmtpd
  - Allow nagios-mail-plugin exec postfix master
  - Allow subscription-manager execute ip
  - Allow ssh client connect with a user dbus instance
  - Add support for ksshaskpass
  - Allow rhsmcertd file transition in /run also for socket files
  - Allow keyutils_dns_resolver_t execute keyutils_dns_resolver_exec_t
  - Allow plymouthd read/write X server miscellaneous devices
  - Allow systemd-sleep read udev pid files
  - Allow exim read network sysctls
  - Allow sendmail request load module
  - Allow named map its conf files
  - Allow squid map its cache files
  - Allow NetworkManager_dispatcher_dhclient_t to execute shells without a domain transition


author: Zdenek Pytela <zpytela@redhat.com> - 38.17-1
changelog:
  - Label /dev/userfaultfd with userfaultfd_t
  - Allow blueman send general signals to unprivileged user domains
  - Allow dkim-milter domain transition to sendmail
  - Label /usr/sbin/cifs.idmap with cifs_helper_exec_t
  - Allow cifs-helper read sssd kerberos configuration files
  - Allow rpm_t sys_admin capability
  - Allow dovecot_deliver_t create/map dovecot_spool_t dir/file
  - Allow collectd_t read proc_net link files
  - Allow insights-client getsession process permission
  - Allow insights-client work with pipe and socket tmp files
  - Allow insights-client map generic log files
  - Update cyrus_stream_connect() to use sockets in /run
  - Allow keyutils-dns-resolver read/view kernel key ring
  - Label /var/log/kdump.log with kdump_log_t


author: Zdenek Pytela <zpytela@redhat.com> - 38.18-1
changelog:
  - Add support for kafs-dns requested by keyutils
  - Allow insights-client execmem
  - Add support for chronyd-restricted
  - Add init_explicit_domain() interface
  - Allow fsadm_t to get attributes of cgroup filesystems
  - Add list_dir_perms to kerberos_read_keytab
  - Label /var/run/tmpfiles.d/static-nodes.conf with kmod_var_run_t
  - Allow sendmail manage its runtime files
  - Allow keyutils_dns_resolver_exec_t be an entrypoint
  - Allow collectd_t read network state symlinks
  - Revert "Allow collectd_t read proc_net link files"
  - Allow nfsd_t to list exports_t dirs
  - Allow cupsd dbus chat with xdm
  - Allow haproxy read hardware state information
  - Add the kafs module


author: Zdenek Pytela <zpytela@redhat.com> - 38.19-1
changelog:
  - Change init_audit_control default value to true
  - Allow nfsidmapd connect to systemd-userdbd with a unix socket
  - Add the qatlib  module
  - Add the fdo module
  - Add the bootupd module
  - Set default ports for keylime policy
  - Create policy for qatlib
  - Add policy for FIDO Device Onboard
  - Add policy for bootupd
  - Add the qatlib module
  - Add the fdo module
  - Add the bootupd module


author: Zdenek Pytela <zpytela@redhat.com> - 38.20-1
changelog:
  - Allow httpd tcp connect to redis port conditionally
  - Label only /usr/sbin/ripd and ripngd with zebra_exec_t
  - Dontaudit aide the execmem permission
  - Remove permissive from fdo
  - Allow sa-update manage spamc home files
  - Allow sa-update connect to systemlog services
  - Label /usr/lib/systemd/system/mimedefang.service with antivirus_unit_file_t
  - Allow nsd_crond_t write nsd_var_run_t & connectto nsd_t
  - Allow bootupd search EFI directory


author: Zdenek Pytela <zpytela@redhat.com> - 38.21-1
changelog:
  - Make systemd_tmpfiles_t MLS trusted for lowering the level of files
  - Revert "Allow insights client map cache_home_t"
  - Allow nfsidmapd connect to systemd-machined over a unix socket
  - Allow snapperd connect to kernel over a unix domain stream socket
  - Allow virt_qemu_ga_t create .ssh dir with correct label
  - Allow targetd read network sysctls
  - Set the abrt_handle_event boolean to on
  - Permit kernel_t to change the user identity in object contexts
  - Allow insights client map cache_home_t
  - Label /usr/sbin/mariadbd with mysqld_exec_t
  - Trim changelog so that it starts at F37 time
  - Define equivalency for /run/systemd/generator.early


author: Zdenek Pytela <zpytela@redhat.com> - 38.22-1
changelog:
  - Allow systemd-network-generator send system log messages
  - Dontaudit the execute permission on sock_file globally
  - Allow fsadm_t the file mounton permission
  - Allow named and ndc the io_uring sqpoll permission
  - Allow sssd io_uring sqpoll permission
  - Fix location for /run/nsd
  - Allow qemu-ga get fixed disk devices attributes
  - Update bitlbee policy
  - Label /usr/sbin/sos with sosreport_exec_t
  - Update policy for the sblim-sfcb service
  - Add the files_getattr_non_auth_dirs() interface
  - Fix the CI to work with DNF5


author: Zdenek Pytela <zpytela@redhat.com> - 38.23-1
changelog:
  - Revert "Allow winbind-rpcd use its private tmp files"
  - Allow upsmon execute upsmon via a helper script
  - Allow openconnect vpn read/write inherited vhost net device
  - Allow winbind-rpcd use its private tmp files
  - Update samba-dcerpc policy for printing
  - Allow gpsd,oddjob,oddjob_mkhomedir rw user domain pty
  - Allow nscd watch system db dirs
  - Allow qatlib to read sssd public files
  - Allow fedora-third-party read /sys and proc
  - Allow systemd-gpt-generator mount a tmpfs filesystem
  - Allow journald write to cgroup files
  - Allow rpc.mountd read network sysctls
  - Allow blueman read the contents of the sysfs filesystem
  - Allow logrotate_t to map generic files in /etc
  - Boolean: Allow virt_qemu_ga create ssh directory


author: Zdenek Pytela <zpytela@redhat.com> - 38.24-1
changelog:
  - Allow rhsmcertd dbus chat with policykit
  - Allow polkitd execute pkla-check-authorization with nnp transition
  - Allow user_u and staff_u get attributes of non-security dirs
  - Allow unconfined user filetrans chrome_sandbox_home_t
  - Allow svnserve execute postdrop with a transition
  - Do not make postfix_postdrop_t type an MTA executable file
  - Allow samba-dcerpc service manage samba tmp files
  - Add use_nfs_home_dirs boolean for mozilla_plugin
  - Fix labeling for no-stub-resolv.conf


author: Zdenek Pytela <zpytela@redhat.com> - 38.25-1
changelog:
  - ci: Move srpm/rpm build to packit
  - .copr: Avoid subshell and changing directory
  - Allow gpsd, oddjob and oddjob_mkhomedir_t write user_tty_device_t chr_file
  - Label /usr/libexec/openssh/ssh-pkcs11-helper with ssh_agent_exec_t
  - Make insights_client_t an unconfined domain
  - Allow insights-client manage user temporary files
  - Allow insights-client create all rpm logs with a correct label
  - Allow insights-client manage generic logs
  - Allow cloud_init create dhclient var files and init_t manage net_conf_t
  - Allow insights-client read and write cluster tmpfs files
  - Allow ipsec read nsfs files
  - Make tuned work with mls policy
  - Remove nsplugin_role from mozilla.if
  - allow mon_procd_t self:cap_userns sys_ptrace
  - Allow pdns name_bind and name_connect all ports
  - Set the MLS range of fsdaemon_t to s0 - mls_systemhigh
  - ci: Move to actions/checkout@v3 version
  - .copr: Replace chown call with standard workflow safe.directory setting
  - .copr: Enable `set -u` for robustness
  - .copr: Simplify root directory variable


author: Zdenek Pytela <zpytela@redhat.com> - 38.26-1
changelog:
  - Change file transition for systemd-network-generator
  - Additional support for gnome-initial-setup
  - Update gnome-initial-setup policy for geoclue
  - Allow openconnect vpn open vhost net device
  - Allow cifs.upcall to connect to SSSD also through the /var/run socket
  - Grant cifs.upcall more required capabilities
  - Allow xenstored map xenfs files
  - Update policy for fdo
  - Allow keepalived watch var_run dirs
  - Allow svirt to rw /dev/udmabuf
  - Allow qatlib  to modify hardware state information.
  - Allow key.dns_resolve connect to avahi over a unix stream socket
  - Allow key.dns_resolve create and use unix datagram socket
  - Use quay.io as the container image source for CI


author: Zdenek Pytela <zpytela@redhat.com> - 38.27-1
changelog:
  - Allow fedora-third-party get generic filesystem attributes
  - Allow sssd use usb devices conditionally
  - Update policy for qatlib
  - Allow ssh_agent_type manage generic cache home files


author: Zdenek Pytela <zpytela@redhat.com> - 38.27-1
changelog:
  - Allow fedora-third-party get generic filesystem attributes
  - Allow sssd use usb devices conditionally
  - Update policy for qatlib
  - Allow ssh_agent_type manage generic cache home files
  - Update make-rhat-patches.sh file to use the f39 dist-git branch in F39


author: Zdenek Pytela <zpytela@redhat.com> - 38.28-1
changelog:
  - Allow sssd domain transition on passkey_child execution conditionally
  - Allow login_userdomain watch lnk_files in /usr
  - Allow login_userdomain watch video4linux devices
  - Change systemd-network-generator transition to include class file
  - Revert "Change file transition for systemd-network-generator"
  - Allow nm-dispatcher winbind plugin read/write samba var files
  - Allow systemd-networkd write to cgroup files
  - Allow kdump create and use its memfd: objects


author: Zdenek Pytela <zpytela@redhat.com> - 38.29-1
changelog:
  - Allow sssd send SIGKILL to passkey_child running in ipa_otpd_t
  - Allow systemd-localed create Xserver config dirs
  - Allow sssd read symlinks in /etc/sssd
  - Label /dev/gnss[0-9] with gnss_device_t
  - Allow systemd-sleep read/write efivarfs variables
  - ci: Fix version number of packit generated srpms
  - Dontaudit rhsmcertd write memory device
  - Allow ssh_agent_type create a sockfile in /run/user/USERID
  - Set default file context of /var/lib/authselect/backups to <<none>>
  - Allow prosody read network sysctls
  - Allow cupsd_t to use bpf capability


author: Zdenek Pytela <zpytela@redhat.com> - 38.30-1
changelog:
  - Support using systemd containers
  - Allow kernel_t to manage and relabel all files
  - Add missing optional_policy() to files_relabel_all_files()
  - Allow apcupsd cgi scripts read /sys
  - Improve default file context(None) of /var/lib/authselect/backups
  - Allow targetd write to the syslog pid sock_file
  - Add ipa_pki_retrieve_key_exec() interface
  - Allow kdumpctl_t to list all directories with a filesystem type
  - Allow udev additional permissions
  - Allow udev load kernel module
  - Allow sysadm_t to mmap modules_object_t files
  - Add the unconfined_read_files() and unconfined_list_dirs() interfaces
  - Set default file context of HOME_DIR/tmp/.* to <<none>>
  - Allow kernel_generic_helper_t to execute mount(1)


author: Zdenek Pytela <zpytela@redhat.com> - 38.2-1
changelog:
  - Don't make kernel_t an unconfined domain
  - Don't allow kernel_t to execute bin_t/usr_t binaries without a transition
  - Allow kernel_t to execute systemctl to do a poweroff/reboot
  - Grant basic permissions to the domain created by systemd_systemctl_domain()
  - Allow kernel_t to request module loading
  - Allow kernel_t to do compute_create
  - Allow kernel_t to manage perf events
  - Grant almost all capabilities to kernel_t
  - Allow kernel_t to fully manage all devices
  - Revert "In domain_transition_pattern there is no permission allowing caller domain to execu_no_trans on entrypoint, this patch fixing this issue"
  - Allow pulseaudio to write to session_dbusd tmp socket files
  - Allow systemd and unconfined_domain_type create user_namespace
  - Add the user_namespace security class
  - Reuse tmpfs_t also for the ramfs filesystem
  - Label udf tools with fsadm_exec_t
  - Allow networkmanager_dispatcher_plugin work with nscd
  - Watch_sb all file type directories.
  - Allow spamc read hardware state information files
  - Allow sysadm read ipmi devices
  - Allow insights client communicate with cupsd, mysqld, openvswitch, redis
  - Allow insights client read raw memory devices
  - Allow the spamd_update_t domain get generic filesystem attributes
  - Dontaudit systemd-gpt-generator the sys_admin capability
  - Allow ipsec_t only read tpm devices
  - Allow cups-pdf connect to the system log service
  - Allow postfix/smtpd read kerberos key table
  - Allow syslogd read network sysctls
  - Allow cdcc mmap dcc-client-map files
  - Add watch and watch_sb dosfs interface


author: Zdenek Pytela <zpytela@redhat.com> - 38.6-1
changelog:
  - Boolean: allow qemu-ga read ssh home directory
  - Allow kernel_t to read/write all sockets
  - Allow kernel_t to UNIX-stream connect to all domains
  - Allow systemd-resolved send a datagram to journald
  - Allow kernel_t to manage and have "execute" access to all files
  - Fix the files_manage_all_files() interface
  - Allow rshim bpf cap2 and read sssd public files
  - Allow insights-client work with su and lpstat
  - Allow insights-client tcp connect to all ports
  - Allow nm-cloud-setup dispatcher plugin restart nm services
  - Allow unconfined user filetransition for sudo log files
  - Allow modemmanager create hardware state information files
  - Allow ModemManager all permissions for netlink route socket
  - Allow wg to send msg to kernel, write to syslog and dbus connections
  - Allow hostname_t to read network sysctls.
  - Dontaudit ftpd the execmem permission
  - Allow svirt request the kernel to load a module
  - Allow icecast rename its log files
  - Allow upsd to send signal to itself
  - Allow wireguard to create udp sockets and read net_conf
  - Use 
  %setup       -q



  - Pass -p 1 to 
  %setup       -q


author: Zdenek Pytela <zpytela@redhat.com> - 39.1-1
changelog:
  - Support using systemd containers
  - Allow kernel_t to manage and relabel all files
  - Add missing optional_policy() to files_relabel_all_files()
  - Improve default file context(None) of /var/lib/authselect/backups
  - Allow targetd write to the syslog pid sock_file
  - Add ipa_pki_retrieve_key_exec() interface
  - Allow kdumpctl_t to list all directories with a filesystem type
  - Allow udev additional permissions
  - Allow udev load kernel module
  - Allow sysadm_t to mmap modules_object_t files
  - Add the unconfined_read_files() and unconfined_list_dirs() interfaces
  - Set default file context of HOME_DIR/tmp/.* to <<none>>
  - Allow kernel_generic_helper_t to execute mount(1)


author: Zdenek Pytela <zpytela@redhat.com> - 39.2-1
changelog:
  - Allow graphical applications work in Wayland
  - Allow map xserver_tmpfs_t files when xserver_clients_write_xshm is on
  - Allow kdump work with PrivateTmp
  - Allow dovecot-auth work with PrivateTmp
  - Allow nfsd get attributes of all filesystems
  - Allow fido-device-onboard (FDO) read the crack database
  - Allow  winbind_rpcd_t processes access when samba_export_all_* is on
  - Allow ntp to bind and connect to ntske port.
  - Allow apcupsd cgi scripts read /sys
  - Allow rpcbind read network sysctls


author: Zdenek Pytela <zpytela@redhat.com> - 39.3-1
changelog:
  - Allow init create and use vsock sockets
  - Allow ddclient send e-mail notifications
  - Allow postfix_master_t map postfix data files
  - Allow thumb_t append to init unix domain stream sockets
  - Allow spamd_update_t read hardware state information
  - Allow systemd-sleep create efivarfs files


author: Zdenek Pytela <zpytela@redhat.com> - 39.4-1
changelog:
  - Allow collectd read raw fixed disk device
  - Allow collectd read udev pid files
  - Allow httpd work with PrivateTmp
  - Allow certmonger read network sysctls
  - Allow systemd-sleep set attributes of efivarfs files
  - Allow spamd_update_t the sys_ptrace capability in user namespace
  - Allow alsa get attributes filesystems with extended attributes
  - Allow systemd-sleep send a message to syslog over a unix dgram socket


author: Zdenek Pytela <zpytela@redhat.com> - 39.5-1
changelog:
  - Allow userdomain get attributes of files on an nsfs filesystem
  - Allow login_userdomain map files in /var
  - Update ssh_role_template() for user ssh-agent type
  - Dontaudit getty and plymouth the checkpoint_restore capability
  - Allow sendmail MTA connect to sendmail LDA
  - Allow system_mail_t manage exim spool files and dirs


author: Zdenek Pytela <zpytela@redhat.com> - 40.5-1
changelog:
  - Allow map xserver_tmpfs_t files when xserver_clients_write_xshm is on
  - Allow graphical applications work in Wayland
  - Allow kdump work with PrivateTmp
  - Allow dovecot-auth work with PrivateTmp
  - Allow nfsd get attributes of all filesystems
  - Allow unconfined_domain_type use io_uring cmd on domain
  - ci: Only run Rawhide revdeps tests on the rawhide branch
  - Label /var/run/auditd.state as auditd_var_run_t
  - Allow fido-device-onboard (FDO) read the crack database
  - Allow ip an explicit domain transition to other domains
  - Label /usr/libexec/selinux/selinux-autorelabel with semanage_exec_t
  - Allow  winbind_rpcd_t processes access when samba_export_all_* is on
  - Enable NetworkManager and dhclient to use initramfs-configured DHCP connection
  - Allow ntp to bind and connect to ntske port.
  - Allow system_mail_t manage exim spool files and dirs
  - Dontaudit keepalived setattr on keepalived_unconfined_script_exec_t
  - Label /run/pcsd.socket with cluster_var_run_t
  - ci: Run cockpit tests in PRs


author: Zdenek Pytela <zpytela@redhat.com> - 40.6-1
changelog:
  - Add afterburn to modules-targeted-contrib.conf
  - Update cifs interfaces to include fs_search_auto_mountpoints()
  - Allow sudodomain read var auth files
  - Allow spamd_update_t read hardware state information
  - Allow virtnetworkd domain transition on tc command execution
  - Allow sendmail MTA connect to sendmail LDA
  - Allow auditd read all domains process state
  - Allow rsync read network sysctls
  - Add dhcpcd bpf capability to run bpf programs
  - Dontaudit systemd-hwdb dac_override capability
  - Allow systemd-sleep create efivarfs files


author: Zdenek Pytela <zpytela@redhat.com> - 40.7-1
changelog:
  - Make named_zone_t and named_var_run_t a part of the mountpoint attribute
  - Allow sysadm execute traceroute in sysadm_t domain using sudo
  - Allow sysadm execute tcpdump in sysadm_t domain using sudo
  - Allow opafm search nfs directories
  - Add support for syslogd unconfined scripts
  - Allow gpsd use /dev/gnss devices
  - Allow gpg read rpm cache
  - Allow virtqemud additional permissions
  - Allow virtqemud manage its private lock files
  - Allow virtqemud use the io_uring api
  - Allow ddclient send e-mail notifications
  - Allow postfix_master_t map postfix data files
  - Allow init create and use vsock sockets
  - Allow thumb_t append to init unix domain stream sockets
  - Label /dev/vas with vas_device_t
  - Change domain_kernel_load_modules boolean to true
  - Create interface selinux_watch_config and add it to SELinux users


author: Zdenek Pytela <zpytela@redhat.com> - 40.8-1
changelog:
  - Allow hypervkvp_t write access to NetworkManager_etc_rw_t
  - Add interface for write-only access to NetworkManager rw conf
  - Allow systemd-sleep send a message to syslog over a unix dgram socket
  - Allow init create and use netlink netfilter socket
  - Allow qatlib load kernel modules
  - Allow qatlib run lspci
  - Allow qatlib manage its private runtime socket files
  - Allow qatlib read/write vfio devices
  - Label /etc/redis.conf with redis_conf_t
  - Remove the lockdown-class rules from the policy
  - Allow init read all non-security socket files
  - Replace redundant dnsmasq pattern macros
  - Remove unneeded symlink perms in dnsmasq.if
  - Add additions to dnsmasq interface
  - Allow nvme_stas_t create and use netlink kobject uevent socket
  - Allow collectd connect to statsd port
  - Allow keepalived_t to use sys_ptrace of cap_userns
  - Allow dovecot_auth_t connect to postgresql using UNIX socket


author: Zdenek Pytela <zpytela@redhat.com> - 40.9-1
changelog:
  - Allow systemd-sleep set attributes of efivarfs files
  - Allow samba-dcerpcd read public files
  - Allow spamd_update_t the sys_ptrace capability in user namespace
  - Allow bluetooth devices work with alsa
  - Allow alsa get attributes filesystems with extended attributes


author: Zdenek Pytela <zpytela@redhat.com> - 40.10-1
changelog:
  - Allow chronyd-restricted read chronyd key files
  - Allow conntrackd_t to use bpf capability2
  - Allow systemd-networkd manage its runtime socket files
  - Allow init_t nnp domain transition to colord_t
  - Allow polkit status systemd services
  - nova: Fix duplicate declarations
  - Allow httpd work with PrivateTmp
  - Add interfaces for watching and reading ifconfig_var_run_t
  - Allow collectd read raw fixed disk device
  - Allow collectd read udev pid files
  - Set correct label on /etc/pki/pki-tomcat/kra
  - Allow systemd domains watch system dbus pid socket files
  - Allow certmonger read network sysctls
  - Allow mdadm list stratisd data directories
  - Allow syslog to run unconfined scripts conditionally
  - Allow syslogd_t nnp_transition to syslogd_unconfined_script_t
  - Allow qatlib set attributes of vfio device files


author: Zdenek Pytela <zpytela@redhat.com> - 40.11-1
changelog:
  - Replace init domtrans rule for confined users to allow exec init
  - Update dbus_role_template() to allow user service status
  - Allow polkit status all systemd services
  - Allow setroubleshootd create and use inherited io_uring
  - Allow load_policy read and write generic ptys
  - Allow gpg manage rpm cache
  - Allow login_userdomain name_bind to howl and xmsg udp ports
  - Allow rules for confined users logged in plasma
  - Label /dev/iommu with iommu_device_t
  - Remove duplicate file context entries in /run
  - Dontaudit getty and plymouth the checkpoint_restore capability
  - Allow su domains write login records
  - Revert "Allow su domains write login records"
  - Allow login_userdomain delete session dbusd tmp socket files
  - Allow unix dgram sendto between exim processes
  - Allow su domains write login records
  - Allow smbd_t to watch user_home_dir_t if samba_enable_home_dirs is on


author: Zdenek Pytela <zpytela@redhat.com> - 40.12-1
changelog:
  - Rename all /var/lock file context entries to /run/lock
  - Rename all /var/run file context entries to /run
  - Invert the "/var/run = /run" equivalency


author: Zdenek Pytela <zpytela@redhat.com> - 40.13-1
changelog:
  - Only allow confined user domains to login locally without unconfined_login
  - Add userdom_spec_domtrans_confined_admin_users interface
  - Only allow admindomain to execute shell via ssh with ssh_sysadm_login
  - Add userdom_spec_domtrans_admin_users interface
  - Move ssh dyntrans to unconfined inside unconfined_login tunable policy
  - Update ssh_role_template() for user ssh-agent type
  - Allow init to inherit system DBus file descriptors
  - Allow init to inherit fds from syslogd
  - Allow any domain to inherit fds from rpm-ostree
  - Update afterburn policy
  - Allow init_t nnp domain transition to abrtd_t


author: Zdenek Pytela <zpytela@redhat.com> - 40.14-1
changelog:
  - Allow userdomain get attributes of files on an nsfs filesystem
  - Allow opafm create NFS files and directories
  - Allow virtqemud create and unlink files in /etc/libvirt/
  - Allow virtqemud domain transition on swtpm execution
  - Add the swtpm.if interface file for interactions with other domains
  - Allow samba to have dac_override capability
  - systemd: allow sys_admin capability for systemd_notify_t
  - systemd: allow systemd_notify_t to send data to kernel_t datagram sockets
  - Allow thumb_t to watch and watch_reads mount_var_run_t
  - Allow krb5kdc_t map krb5kdc_principal_t files
  - Allow unprivileged confined user dbus chat with setroubleshoot
  - Allow login_userdomain map files in /var
  - Allow wireguard work with firewall-cmd
  - Differentiate between staff and sysadm when executing crontab with sudo
  - Add crontab_admin_domtrans interface
  - Allow abrt_t nnp domain transition to abrt_handle_event_t
  - Allow xdm_t to watch and watch_reads mount_var_run_t
  - Dontaudit subscription manager setfscreate and read file contexts
  - Don't audit crontab_domain write attempts to user home
  - Transition from sudodomains to crontab_t when executing crontab_exec_t
  - Add crontab_domtrans interface
  - Fix label of pseudoterminals created from sudodomain
  - Allow utempter_t use ptmx
  - Dontaudit rpmdb attempts to connect to sssd over a unix stream socket
  - Allow admin user read/write on fixed_disk_device_t


author: Zdenek Pytela <zpytela@redhat.com> - 40.15-1
changelog:
  - Update mmap_rw_file_perms to include the lock permission
  - Allow plymouthd log during shutdown
  - Add logging_watch_all_log_dirs() and logging_watch_all_log_files()
  - Allow journalctl_t read filesystem sysctls
  - Allow cgred_t to get attributes of cgroup filesystems
  - Allow wdmd read hardware state information
  - Allow wdmd list the contents of the sysfs directories
  - Allow linuxptp configure phc2sys and chronyd over a unix domain socket
  - Allow sulogin relabel tty1
  - Dontaudit sulogin the checkpoint_restore capability
  - Modify sudo_role_template() to allow getpgid
  - Remove incorrect "local" usage in varrun-convert.sh


author: Zdenek Pytela <zpytela@redhat.com> - 40.1-1
changelog:
  - Allow named and ndc use the io_uring api
  - Deprecate common_anon_inode_perms usage
  - Improve default file context(None) of /var/lib/authselect/backups
  - Allow udev_t to search all directories with a filesystem type
  - Implement proper anon_inode support
  - Allow targetd write to the syslog pid sock_file
  - Add ipa_pki_retrieve_key_exec() interface
  - Allow kdumpctl_t to list all directories with a filesystem type
  - Allow udev additional permissions
  - Allow udev load kernel module
  - Allow sysadm_t to mmap modules_object_t files
  - Add the unconfined_read_files() and unconfined_list_dirs() interfaces
  - Set default file context of HOME_DIR/tmp/.* to <<none>>
  - Allow kernel_generic_helper_t to execute mount(1)


author: Zdenek Pytela <zpytela@redhat.com> - 40.2-1
changelog:
  - Add the virt_supplementary module to modules-targeted-contrib.conf
  - Make new virt drivers permissive
  - Split virt policy, introduce virt_supplementary module
  - Allow apcupsd cgi scripts read /sys
  - Merge pull request #1893 from WOnder93/more-early-boot-overlay-fixes
  - Allow kernel_t to manage and relabel all files
  - Add missing optional_policy() to files_relabel_all_files()


author: Zdenek Pytela <zpytela@redhat.com> - 40.3-1
changelog:
  - Add policy for nvme-stas
  - Confine systemd fstab,sysv,rc-local
  - Label /etc/aliases.lmdb with etc_aliases_t
  - Create policy for afterburn
  - Add nvme_stas to modules-targeted-contrib.conf
  - Add plans/tests.fmf


author: Zdenek Pytela <zpytela@redhat.com> - 40.4-1
changelog:
  - Add map_read map_write to kernel_prog_run_bpf
  - Allow systemd-fstab-generator read all symlinks
  - Allow systemd-fstab-generator the dac_override capability
  - Allow rpcbind read network sysctls
  - Support using systemd containers
  - Allow sysadm_t to connect to iscsid using a unix domain stream socket
  - Add policy for coreos installer
  - Add coreos_installer to modules-targeted-contrib.conf


author: Martin Osvald <mosvald@redhat.com> - 2.13.10-1
changelog:
  - Move /var/log/lastlog ownership to systemd (#1798685)
  - tcsh sets variable p to /usr/sbin from /etc/csh.login (#2019874)
  - 'history -a' doesn't belong in /etc/bashrc (#1871744)
  - localhost.localdomain in wrong order /etc/hosts (#1724539)


author: Martin Osvald <mosvald@redhat.com> - 2.14.1-1
changelog:
  - bashrc sets hardcoded umask (#1902166)
  - bashrc: clean up unused references to VTE
  - uidgid: simplify table format and other format enhancements
  - uidgid: fix news and lock entries, move basic groups to systemd


author: Martin Osvald <mosvald@redhat.com> - 2.14.2-1
changelog:
  - sysusers.d: add script and configuration fragments for groups
  - passwd: align 'nologin' shell path with systemd defaults
  - uidgid: assign GID 101 for 'ssh_keys' group
  - uidgid: assign UID/GID 114 for 'polkitd'
  - passwd: update GECOS field for 'root' user
  - services: remove commas from aliases for ircu-3
  - setup.spec: throw away newaliases output again


author: Martin Osvald <mosvald@redhat.com> - 2.14.3-1
changelog:
  - sysusers.d: add script and generate configuration fragment for users
  - Add fallback to hostname determination for csh.login (rhbz#2079768)
  - Remove ancient Conflicts
  - files: mark /run/motd as an ephemeral ghost entry


author: Martin Osvald <mosvald@redhat.com> - 2.14.4-1
changelog:
  - protocols: add mptcp (262)
  - setup.spec: make setup protected package (rhbz#2155547)
  - setup.spec: don't report rpm -Va error on /run/motd (rhbz#2160954)
  - services: replace hostmon with llmnr for port 5355 (rhbz#2216914)


author: Martin Osvald <mosvald@redhat.com> - 2.14.5-1
changelog:
  - bashrc: switch PROMPT_COMMAND to be an array (rhbz#2097525)
  - profile: don't overwrite the HISTSIZE environment variable
  - hosts: use "example.org" as example domain (rhbz#2246220)
  - csh.login: source csh.local (RHEL-17226)


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.14.0-5
changelog:
  - passwd: Provide binary from this package. Enable libpam and
    disable account-tools-setuid. Provide passwd PAM service file.
    Resolves: #2233275
  - passwd: provide --stdin option


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.15.1-1
changelog:
  - Wrong versioning for 4.15.0 RC releases makes the oficial release look lower than them.
    Fix it by bumping the minor release to 4.15.1. Resolves: #2268690


author: Bruno Wolff III <bruno@wolff.to> - 4.5-24.20220308git8b6ee89
changelog:
  - Continue testing upstream patches prior to 4.5.1 release.
  - Minor fixes
  - Man page tweaks
  - Tentative 4.5.1 change log


author: Bruno Wolff III <bruno@wolff.to> - 4.6-1
changelog:
  - 4.6 release
  - PR #231 was merged
  - See https://github.com/plougher/squashfs-tools/blob/master/CHANGES


author: Bruno Wolff III <bruno@wolff.to> - 4.6.1-1
changelog:
  - Phillip is now doing two tags per release and we can
  - use the one that works better with forgemeta
  - There are a few fixes after the 4.6 release. I think only
  - one applies to Fedora because of the build options we use.
  - It was not something that affects image builds.


author: Clark Williams <williams@redhat.com> - 1.10-1
changelog:
  - utils: Fix bounds check on cpu and end_cpu variables
  - stalld: Support denylisting of tasks in stalld
  - src/utils: use right argument for warning printf


author: Clark Williams <williams@redhat.com> - 1.11-1
changelog:
  - redhat/stalld.spec: pick up gating test version for changelog
  - utils.c: set daemon umask to restrict global write/execute (1934586)
  - hardening fixes from coverity scan (1934590)


author: Fernando Pacheco <fpacheco@redhat.com> - 1.12-1
changelog:
  - stalld.8: fix diff cruft left in manpage source
  - stalld.c: clean up handling of nr_running
  - stalld.c: remove duplicate parameter to fill_waiting_task()
  - stalld: Add error handling in get_cpu_idle_time()
  - stalld.service: Run stalld as sched_fifo via systemd
  - packaging: clean up Makefiles and rpm specfile
  - stalld: Always print current function for info messages
  - stalld: Always print current function for warn messages
  - stalld: Always print current function for die messages
  - utils: change PATHMAX to 4096


author: Fernando Pacheco <fpacheco@redhat.com> - 1.13-1
changelog:
  - stalld: Fix log message on boost_cpu_starving_vector()
  - stalld: Add the overload control to the single-threaded mode
  - stalld: Add the adaptive mode option
  - stalld: Use the last mode set in the cmdline
  - stalld: Fallback to the adaptive mode if force_fifo is selected
  - stalld: Make single-threaded mode the default one
  - stalld.service: Always restart stalld on exit
  - utils.c: Fail if user is not root
  - utils.c: Make the path to sched_debug path dynamic


author: Fernando Pacheco <fpacheco@redhat.com> - 1.14.1-1
changelog:
  - stalld: Coding style cleanup
  - stalld: spaces in place of <TAB>
  - throttling: Use RT_RUNTIME_PATH in rt_throttling_is_off()
  - throttling: Check open() on turn_off_rt_throttling
  - throttling: Adjust variables in restore_rt_throttling()
  - stalld.c: utils.c: Remove complex assignments from variable declarations
  - stalld.h: Define MAX_PATH/DIR_PATH/FILE_NAME and use them
  - stalld: Adjust variables in parse_old_task_format()
  - utils.c: Use MAX_PATH for pidfile
  - stalld.c: Remove variable declaration from the middle of  the function
  - stalld: Respect -l option in single threaded mode
  - utils: s/try_to_open_file/check_file_exists/
  - utils: use check_file_exists in setup_hr_tick()
  - utils: Check for the new sched_features path


author: Fernando Pacheco <fpacheco@redhat.com> - 1.15-1
changelog:
  - stalld: Fix incorrect open() return value checks
  - stalld: Pass errno to strerror() on sig*set() failures
  - throttling: Always null terminate sched_rt_runtime_us output
  - stalld: Remove unreachable statement in detect_task_format()
  - tests: Fix uninitialized value action.sa_mask
  - utils: Bail if malloc() returns null in parse_cpu_list()
  - stalld: Use correct format specifier for long types


author: Fernando Pacheco <fpacheco@redhat.com> - 1.16-1
changelog:
  - stald/utils: Space, lines and voids clenaups
  - stalld: Add an option to easily set stalld as SCHED_DEADLINE
  - stalld: Comments cleanup
  - src/utils: Comments cleanup
  - src/throttling: Comments cleanup
  - src/stalld.h Comments cleanup


author: Clark Williams <williams@redhat.com> - 1.17.1
changelog:
  - stalld: Fix memory leak in print_boosted_info()
  - utils: Check if the system is in lockdown mode
  - stalld: print process comm and cpu when boosting
  - stalld: Detect runnable dying tasks
  - stalld: Fix nr_periods calculation in do_fifo_boost()
  - stalld.conf: Lower threshold to 20
  - utils.c: Exit early if enabling HRTICK fails when using SCHED_DEADLINE
  - Add support for loongarch


author: Clark Williams <williams@redhat.com> - 1.18.1
changelog:
  - queue_track: Use LIBBPF_MAJOR/MINOR_VERSION to detect deprecated functions
  - utils: Close file descriptor
  - stalld: Fix function name of daemonize()
  - docs: Fix typo in the manual
  - queue_track: Use bpf_map__resize on older libbpf versions
  - utils: Let tgid to arrive at the fill proccess comm
  - stalld: Fix log message on idle detection
  - stalld: Add -b/--backend option
  - stalld: Add queue track eBPF based backend
  - stalld: Add fill_process_comm helper
  - stalld: Include regex.h on stalld.h
  - stalld: Get nr of cpus only once
  - stalld: Add the backend abstraction
  - sched_debug: Move sched debug functions to an specific file


author: Clark Williams <williams@redhat.com> - 1.19.1
changelog:
  - Conditionalize BPF and queue_track build per architecture
  - clean up Makefile install logic and add .bz2 to .gitignore
  - modify Makefiles so install works with relative paths
  - rename 'redhat' to 'systemd' and remove redhat packaging logic
  - update SPDX tags to non-deprecated values
  - stalld: Add -a/--affinity option
  - Adding SPDX license info to each file
  - man/stalld.8:  change starving threshold to match code
  - utils: Fix freeing of invalid pointer
  - add bpftool as BuildRequires


author: Radovan Sroka <rsroka@redhat.com> - 1.9.12-1.p2
changelog:
  - Rebase to sudo 1.9.12p2
  - sudo-1.9.12p2 is available Resolves: rhbz#2137775
  - sudo: arbitrary file write with privileges of the RunAs user Resolves:
    CVE-2023-22809


author: Radovan Sroka <rsroka@redhat.com> - 1.9.13-1.p2
changelog:
  - Rebase to sudo 1.9.13p2
  - sudo-1.9.13p2 is available Resolves: rhbz#2169840
  - sudo: double free with per-command chroot sudoers rules Resolves:
    CVE-2023-27320


author: Yaakov Selkowitz <yselkowi@redhat.com> - 1.9.14-1.p3
changelog:
  - Rebase to 1.9.14p3
  - sudo-1_9_14p2 is available Resolves: rhbz#2175672
  - sudo fails to build with Python 3.12: FAILED: testcase
    check_example_group_plugin_is_able_to_debug() Resolves: rhbz#2186412


author: Radovan Sroka <rsroka@redhat.com> - 1.9.15-1
changelog:
  - Rabase to 1.9.15p5
  - sudo-1_9_15p5 is available Resolves: rhbz#2248505
  - TRIAGE CVE-2023-42465 sudo: Targeted Corruption of Register and Stack
    Variables Resolves: rhbz#2255569


author: Neal Gompa <ngompa@fedoraproject.org> - 251.4-53
changelog:
  - Set compile-time fallback hostname to "localhost"
    https://fedoraproject.org/wiki/Changes/FallbackHostname


author: Anita Zhang <the.anitazha@gmail.com>
changelog:
  - Update systemd-oomd defaults to friendlier values
  - Remove swap policy. Default amount of swap (8GB?) is a lot lower than
    what we use internally with the swap policy. Which frequently leads to
    GNOME getting killed (e.g.
    https://bugzilla.redhat.com/show_bug.cgi?id=1941170, and other BZs not
    linked here). Internally we use 0.5x-1x size of physical memory for swap
    via swapfiles (this will be documented in systemd upstream). In simple
    cases of using more memory than is available (but without memory
    pressure), the Kernel OOM killer can handle killing the offending
    process.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 252.4-1
changelog:
  - Version 252.4
  - Fixes a few different issues (systemd-timesyncd connectivity problems,
    broken emoji output on the console, crashes in pid1 unit dependency
    logic)
  - CVE-2022-4415: systemd: coredump not respecting fs.suid_dumpable kernel
    setting


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 253~rc3-1
changelog:
  - Version 253-rc3
  - A bunch of bugfixes for regressions, some documentation and bug fixes
    too.
  - Really fix rhbz#2165692 (previous build carried an unapplied patch).


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 253-6
changelog:
  - Set TimeoutStopFailureMode=abort for services (see
    https://fedoraproject.org/wiki/Changes/Shorter_Shutdown_Timer)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 253.12-1
changelog:
  - Version 253.12
  - Just some documentation patches, a hwdb update, and fix for udev on
    systemd with too much hardware devices, and some fixes for networkd.
  - Fixes rhbz#2242759 by virtue of rebuild.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 254~rc3-1
changelog:
  - Version 254~rc3
  - A bunch of fixes, e.g. rhbz#2223795. Also a bunch of reverts of commits
    which were found to cause problems.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 254-1
changelog:
  - Version 254 (just a bunch of bugfixes, mostly for unusual architectures,
    since rc3)
  - rhbz#2226908
  - See https://raw.githubusercontent.com/systemd/systemd/v254-rc1/NEWS for
    the full changeset.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 254.7-1
changelog:
  - Version 254.7
  - A bunch of fixes: systemd, systemctl device argument parsing,
    improvements in systemd-analyze, systemd-networkd, systemd-journal-
    upload, systemd-repart, systemd-logind, systemd-nspawn, systemd-
    cryptsetup, systemd-udevd, udevadm, and udev rules, coredumpctl, systemd-
    xdg-autostart-generator, sd-journal code for entry lookup, systemd-sleep,
    portablectl, resolvectl, systemd-boot, bootctl, systemd-stub, kernel-
    install, various systemd units, memory access correctness, D-Bus
    interfaces, documentation, soft-reboot, systemd-firstboot, utmp, systemd-
    homed, systemd-stdio-bridge, systemd-resolved.
  - Includes an update of the hardware database (rhbz#2252022)
  - Includes an updated list of syscalls for kernels 6.6 and 6.7


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 254.8-1
changelog:
  - Version 254.8
  - A bunch of fixes for various components: systemd, systemctl, systemd-
    firstboot, systemd-repart, bootctl, systemd-networkd, systemd-network-
    generator, systemd-analyze, systemd-dissect, ukify, man pages.
  - Also has a patch for CVE-2023-7008 (rhbz#2222260)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 254.9-1
changelog:
  - Version 254.9
  - Fixes kernel-install on /boot on btrfs (rhbz#2251262)
  - Various small fixes for systemd itself, systemd-resolved, bootctl,
    systemd-networkd, udev, systemd-repart, systemd-homed, libsystemd,
    virtualization detection, systemd-analyze, systemd-dissect, systemd-
    journal-remote, documentation.
  - Hardware database update.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 254.2-1
changelog:
  - Version 254.2
  - A bunch of fixes in various areas: manager, coredump, sysupdate,
    hibernation, journal.
  - Should fix rhbz#2234653.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 255-1
changelog:
  - Version 255
  - Just a few bugfixes since 255-rc4: seccomp filters, logging,
    documentation, systemd-repart
  - Includes a hardware database update.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 255-3
changelog:
  - Move config files to /usr/lib/systemd (e.g. /etc/systemd/system.conf →
    /usr/lib/systemd/systemd.conf). Both config file locations were already
    supported, and the files installed in /etc/ were "empty" (i.e. they had
    only comments and section headers). The move does not change the
    configuration, but just makes /etc more empty by default. See
    https://github.com/systemd/systemd/commit/6495361c7d for more discussion
    and details.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 255.2-1
changelog:
  - Version 255.2
  - Fixes missing DNSSEC validity check in SOA DNS packets (CVE-2023-7008)
  - systemd-resolved and systemd-networkd are restarted after an upgrade.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 255.3-1
changelog:
  - Version 255.3
  - A bunch of various fixes for memory and behaviour, in many different
    components (bootctl, systemd, udev, systemd-networkd, systemd-homed,
    systemd-logind, systemd-resolve, systemd-repart, systemd-analyze,
    systemd-dissect, systemd-boot, pam modules, systemd-storagetm, systemd-
    journal-remote, kernel-install)
  - Improved detection of virtualization (Google Compute Engine, Apple Virt)
  - Updates for shell completions and docs
  - An update for hardware database


author: Patsy Griffin <patsy@redhat.com> - 2022b-1
changelog:
  - Rebase to tzdata-2022b
    - Chile transitions to DST on 2022-09-11, not 2022-09-04
    - 'make install' now defaults LOCALTIME to Factory rather than GMT
    - More zones that are the same since 1970 have been moved to backzone.
    - Include patch for awk workaround.


author: Patsy Griffin <patsy@redhat.com> - 2022c-1
changelog:
  - Rebase to tzdata-2022c - supersedes tzdata-2022b
    - Add a work-around for an awk bug in FreeBSD, macOS, etc.
    - Improve tzselect with respect to intercontinental Zones.


author: Patsy Griffin <patsy@redhat.com> - 2022d-1
changelog:
  - Rebase to tzdata-2022d
    - Palestine DST transition will be on October 29, 2022, 
      not October 28, 2022.
    - Europe/Uzhgorod and Europe/Zaporozhye are moved to 'backzone'.


author: Patsy Griffin <patsy@redhat.com> - 2022e-1
changelog:
  - Rebase to tzdata-2022e
    - Jordan and Syria cancelled the DST transition planned
      for 2022-10-28, remaining at +03 permanently.


author: Patsy Griffin <patsy@redhat.com> - 2022f-1
changelog:
  - Rebase to tzdata-2022f
    - Mexico will stop observing DST except near the US border.
    - Chihuahua moved to -06 year round starting on 2022-10-30.
    - Fiji no longer observes DST.


author: Patsy Griffin <patsy@redhat.com> - 2022g-1
changelog:
  - Rebase to tzdata-2022g
    - The northern edge of the Mexican state of Chihuahua will
      change time zone to agree with nearby US locations on
      2022-11-30.
    - Added a new Zone America/Ciudad_Juarez that splits from
      America/Ojinaga.


author: Patsy Griffin <patsy@redhat.com> - 2023a-1
changelog:
  - Rebase to tzdata-2023a
   - Egypt reintroduced DST, from April through October.
   - Morocco springs forward April 23, not April 30.
   - Palestine delayed the start of DST this year.


author: Patsy Griffin <patsy@redhat.com> - 2023d-1
changelog:
  - Rebase to tzdata-2023d
    - Include time zone changes for Ittoqqortoormiit, Greenland
      and Vostok, Antarctica.
    - Update the expiration date for the leap-seconds.list file.
      No new leap seconds were added.
  - Use the new syntax for the %patch macro.


author: Patsy Griffin <patsy@redhat.com> - 2023d-1
changelog:
  - Rebase to tzdata-2023d
    - Include time zone changes for Ittoqqortoormiit, Greenland
      and Vostok, Antarctica.
    - Update the expiration date for the leap-seconds.list file.
      No new leap seconds were added.


author: Patsy Griffin <patsy@redhat.com> - 2023d-2
changelog:
  - Migrate License field to SPDX identifiers for
    https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_2


author: Patsy Griffin <patsy@redhat.com> - 2024a-1
changelog:
  - Rebase to tzdata-2024a
    - Kazakhstan will transition from UTC+6 to UTC+5 on 2024-03-01.
    - Palestine will spring forward a week later than previously
      predicted.


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:9.1.076-2
changelog:
  - enable building without GPM support - build with GPM in Fedora
  - 2262371 - gvim: symbol lookup error: gvim: undefined symbol: g_once_init_enter_pointer


author: Joe Doss <joe@solidadmin.com> - 1.0.20210223-1
changelog:
  - wg-quick: android: do not free iterated pointer
  - wg-quick: openbsd: no use for userspace support
  - embeddable-wg-library: sync latest from netlink.h
  - wincompat: recent mingw has inet_ntop/inet_pton
  - wincompat: add resource and manifest and enable lto
  - wincompat: do not elevate by default
  - completion: add help and syncconf completions
  - sticky-sockets: do not use SO_REUSEADDR
  - man: LOG_LEVEL variables changed name
  - ipc: do not use fscanf with trailing \n
  - ipc: read trailing responses after set operation


author: Joe Doss <joe@solidadmin.com> - 1.0.20210315-1
changelog:
  - Makefile: fix version indicator
  - wireguard-tools: const correctness
  - wireguard-tools: drag in headers for prototypes
  - ipc: uniformly ignore preshared keys that are zero
  - wg-quick: freebsd: add kernel support
  - ipc: freebsd: add initial FreeBSD support
  - wg-quick: freebsd: avoid writing private keys to /tmp


author: Joe Doss <joe@solidadmin.com> - 1.0.20210424-1
changelog:
  - wg-quick: freebsd: check for socket using -S, not -f
  - wg-quick: freebsd: do not assume point-to-point interface flag
  - wg-quick: freebsd: use ifconfig for determining if interface is up
  - wg-quick: kill route monitor when loop terminates


author: Joe Doss <joe@solidadmin.com> - 1.0.20210914-1
changelog:
  - contrib/launchd: fix xml syntax error
  - wg-quick: darwin: account for "link#XX" gateways
  - ipc: add wireguard-nt support
  - ipc: cache windows lookups to avoid O(n^2) with nested lookups
  - ipc: remove windows elevation
  - ipc: windows: don't display disabled adapters
  - ipc: windows: use devpkey instead of nci for name
  - wg-quick: android: adjust for android 12
  - wg-quick: openbsd: set DNS with resolvd(8)


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 0.8.1-1
changelog:
  - Update to version 0.8.1
  - Drop patch xxhash-pkgconfig-version.patch (accepted upstream)
  - Fix compilation on RHEL 7 ppc64le (gcc 4.8)
  - The x86 dispatch code now enables sse2 and avx2 separately, it can now use
    sse2 on EPEL 7 without trying to use avx2 which is not supported by gcc 4.8
  - Add documentation package - doxygen mark-up was added


author: Todd Zullinger <tmz@pobox.com> - 5.2.5-9
changelog:
  - verify upstream GPG signature
  - xzgrep: arbitrary-file-write vulnerability (#2073310, CVE-2022-1271)


author: Daniel P. Berrangé <berrange@redhat.com> - 2.1.0-21
changelog:
  - Switch to using git for managing patches
  - Fix potential buffer overread (CVE-2017-16516)
  - Fix integer overflow leading to heap corruption (CVE-2022-24795)
  - Fix multiple memory leaks (CVE-2023-33460)


author: Jonathan Dieter <jdieter@gmail.com> - 1.2.0-1
changelog:
  - Add `--uncompressed` option to zck, allowing for embedding of uncompressed
    digests in the header
  - Various small bug fixes


author: Jonathan Dieter <jdieter@gmail.com> - 1.2.1-1
changelog:
  - Fixed bug that limited size of file that could be compressed using zchunk to 2GB
  - Fixed memory leak


author: Jonathan Dieter <jdieter@gmail.com> - 1.3.0-1
changelog:
  - Add option to generate a zchunk header from an uncompressed file without
    actually creating a zchunk file


author: Jonathan Dieter <jdieter@gmail.com> - 1.3.1-1
changelog:
  - Fix a few low severity security bugs including
    - An off-by-one overflow when reading compressed integers from a
      malicious zchunk file
    - Error handling being skipped when the number of bytes read doesn't
      match what's expected
    - Not freeing memory when attempting to reallocate to size 0


author: Jonathan Dieter <jdieter@gmail.com> - 1.4.0-1
changelog:
  - Add native OpenSSL 3 compatibility
  - Add new function for getting zchunk context from chunk
  - Fix bug when assembling from multiple sources


