# changelog

author: Hans de Goede <hdegoede@redhat.com> 7.7.1-1
changelog:
  - Update to latest git, this is the equivalent of 7.7.1 + fixes for use
    with xserver-1.19 (rhbz#1325613)
  - Rebuild against xserver-1.19


author: Wim Taymans <wtaymans@redhat.com> - 6.0-4
changelog:
  - Add more Requires to avoid testing multiple versions
  - enable hardened build
  - Fix missing %endif
  - Resolves: #1174548


author: Rex Dieter <rdieter@fedoraproject.org> - 6.0-7
changelog:
  - better autostart.patch, handle case were autospawn is disabled
    (or otherwise doesn't work, like for root user)
  - Resolves: #1269104


author: Robert Kuska <rkuska@redhat.com> - 2.7.5-32
changelog:
  - Backport SSLSocket.version function
  - Temporary disable test_gdb on ppc64le rhbz#1260558
  Resolves: rhbz#1259421


author: Tomas Orsava <torsava@redhat.com> - 2.7.5-36
changelog:
  - Fix for CVE-2016-0772 python: smtplib StartTLS stripping attack (rhbz#1303647)
    Raise an error when STARTTLS fails (upstream patch)
  - Fix for CVE-2016-5699 python: http protocol steam injection attack (rhbz#1303699)
    Disabled HTTP header injections in httplib (upstream patch)
  Resolves: rhbz#1346356


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-39
changelog:
  - Fix hashlib algorithms breaking by initializing OpenSSL_add_all_digests
  function in _hashlib library
  Resolves: rhbz#1371132


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-54.4
changelog:
  - NovaEvacuate: invoke off action
  - galera: add custom host/port support

    Resolves: rhbz#1304019
    Resolves: rhbz#1304711


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-54.6
changelog:
  - nfsserver: fix systemd status detection
  - Replace NovaCompute with nova-compute-wait which lets systemd
    manage the nova-compute process

    Resolves: rhbz#1304370
    Resolves: rhbz#1304811


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.4-12
changelog:
  - Apply additional required patch to fix buffer overrun using long device
    names
  - Resolves rhbz#1369891


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.4-13
changelog:
  - Make udev-md-array-arrays.rules more resilient to races if arrays are
    assembled and stopped and reassembled quick after each other.
  - Resolves rhbz#1331709


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.4-14
changelog:
  - The fix for 1331709 caused a problem with container arrays (IMSM) as
    these can show up with a valid size of 0. Work around this to only
    exit for non container arrays.
  - Resolves rhbz#1379194


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.4-15
changelog:
  - Resolve case where a reshape could hang if started right after the
    completion of a resync.
  - Resolves rhbz#1386700


author: Xiao Ni <xni@redhat.com> - 4.0-4
changelog:
  - Imsm should not allow combing 512 and 4096 sector size disks in 
    one volume and Wrong array size shown for array built on 4096 
    sector size disks
  - Resolves rhbz#1454390 and rhbz#1454379


author: Tim Waugh <twaugh@redhat.com> - 1:1.6.3-7
changelog:
  - Reverted upstream change to FINAL_CONTENT_TYPE in order to fix
    printing to remote CUPS servers (bug #1013040).


author: Tim Waugh <twaugh@redhat.com> - 1:1.6.3-12
changelog:
  - Return jobs in rank order when handling IPP-Get-Jobs (bug #1046841).
  - dbus notifier: call _exit when handling SIGTERM (STR #4314, bug #1030666).
  - Use '-f' when using rm in %setup section (bug #1046374).


author: Debarshi Ray <rishi@fedoraproject.org> - 3.22.2-3
changelog:
  - Disable the print button in the selection toolbar when printing isn't
    supported
    Resolves: #1438362


author: Jakub Hrozek <jhrozek@redhat.com> - 1.1.17-2
changelog:
  - Fix the minimal required tdb version
  - Related: rhbz#1133914 - Rebase libldb to version 1.1.17 or newer


author: Jakub Hrozek <jhrozek@redhat.com> - 1.1.20-2
changelog:
  - Resolves: rhbz#1290715 - CVE-2015-5330 libldb: samba: Remote memory read
                             in Samba LDAP server [rhel-7.3]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.1.20-3
changelog:
  - Resolves: rhbz#1290715 - CVE-2015-5330 libldb: samba: Remote memory read
                             in Samba LDAP server [rhel-7.3]
  - Remove the patch from the previous commit, it doesn't fix a remotely
    eploitable issue. Add patches from upstream #11636 instead.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.1.29-1
changelog:
  - Resolves: rhbz#1393810 - Rebase libldb to enable samba rebase to
                             version 4.6.x


author: Jakub Hrozek <jhrozek@redhat.com> - 1.2.2-1
changelog:
  - Resolves: rhbz#1470056 - Rebase libldb to enable samba rebase to
                             version 4.7.x


author: Ade Lee <alee@redhat.com> - 1.0.1-10
changelog:
  - Resolves: rhbz#1117072 -  ppc64le is missing from ExcludeArch
  - reverted the previous change.  ppc64le now removed from ExcludeArch


author: Martin Preisler <mpreisle@redhat.com> - 1.2.12-1
changelog:
  - Upgrade to the latest upstream release
  - improved HTML report by referencing links
  - fixed validity errors in ARF files
  - fixed CVE parsing
  - fixed injecting xccdf:check-content-ref references in ARF results
  - fixed oscap-docker incompliance reporting (#1387248)
  - fixed oscap-docker man page (#1387166)


author: Martin Preisler <mpreisle@redhat.com> - 1.2.13-1
changelog:
  - Upgrade to the latest upstream release
  - Added --thin-results CLI override to oscap xccdf eval
  - Added --without-syschar CLI override to oscap xccdf eval
  - Remediations are not filtered by applicability
  - Fixed segmentation faults in XCCDF and OVAL processing
  - Added a warning on generating an ARF from XCCDF 1.1


author: Jan Černý <jcerny@redhat.com> - 1.2.14-1
changelog:
  - Upgrade to the latest upstream release
  - Detailed information about ARF files in 'oscap info'
  - Generating remediation scripts from ARF
  - HTML report UX improvements
  - Fixed CPE dictionary to identify RHEVH as RHEL7 (#1420038)
  - Fixed systemd probes crashes inside containers (#1431186)
  - Fixed output on terminals with white background (#1365911)
  - Error handling in oscap-vm (#1391754)
  - Fixed SCE stderr stalling (#1420811)
  - Fixed absolute filepath parsing in OVAL (#1312831, #1312824)
  - Fixed segmentation faults in RPM probes (#1414303, #1414312)
  - Fixed missing header in result-oriented Ansible remediations


author: Martin Preisler <mpreisle@redhat.com> - 1.2.14-2
changelog:
  - RPM probes to return not applicable on non-rpm systems (#1447629)
  - fixed sysctl tests on s390x architecture (#1447649)
  - Revert warning by default in oscap tool, our message categories are not ready for it (#1447341)


author: Steve Dickson <steved@redhat.com> - 0.2.0-18
changelog:
  - Fixed typo causing rpcbind to run as root (bz 734598)
  - Added /etc/sysconfig/rpcbind config file (bz 861025)


author: Steve Dickson <steved@redhat.com> - 0.2.0-25
changelog:
  - Fixed some warnings in in6_fillscopeid() (bz 884165)
  - Fixed typo in rpcinfo manpage (bz 963512)
  - Removed unnecessary targets from rpcbind.service  (bz 1036791)


author: Thomas Haller <thaller@redhat.com> - 1:1.10.2-6
changelog:
  - core: use distinct route-metric to keep connectivity on first activated device (rh #1505893)
  - core: fix enabling connectivity-check-enabled via D-Bus (rh #1534477)
  - core: fix invalid assertion deleting volatile connection (rh #1506552)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.10.2-7
changelog:
  - po: import translations (rh #1481186)
  - device: increase carrier wait time to 6 seconds (rh #1520826)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.10.2-10
changelog:
  - device: skip IP configuration phase for external devices (rh #1530288)
  - platform: fix crash during route-get call (rh #1534721)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.10.2-11
changelog:
  - ovs-interface: avoid starting ip configuration twice (rh #1540063)
  - libnm-core: ensure alignment of team.config and other team properties (rh #1533830)
  - nmcli: clear link-watchers before adding the new ones (rh #1533926)
  - libnm-core: update team.runner description (rh #1533799)
  - libnm-core: team: fix runner sys_prio default value (rh #1533810)
  - libnm: avoid a symbol clash with json-glib (rh #1535905)
  - libnm-core: team: add support to runner "random" (rh #1538699)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.10.2-12
changelog:
  - ppp: don't start IPv6 configuration on the device (rh #1515829)
  - device: avoid setting the IPv4 rp_filter (rh #1492472)
  - nmcli: team: clear runner-tx-hash before adding new hashes (rh #1541922)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.10.2-14
changelog:
  - manager: retry activating devices when the parent becomes managed (rh #1553595)
  - manager: allow autoconnect-slaves to reconnect the same connection (rh #1548265)
  - manager: fix starting teamd after service restart  (rh #1551958)


author: Paul Howarth <paul@city-fan.org> - 2.5-1
changelog:
  - Update to 2.5
    - Added PKCS#1 encryption schemes (v1.5 and OAEP); we now have a decent,
      easy-to-use non-textbook RSA implementation
    - Added PKCS#1 signature schemes (v1.5 and PSS); v1.5 required some
      extensive changes to Hash modules to contain the algorithm-specific ASN.1
      OID, and to that end we now always have a (thin) Python module to hide the
      one in pure C
    - Added 2 standard Key Derivation Functions (PBKDF1 and PBKDF2)
    - Added export/import of RSA keys in OpenSSH and PKCS#8 formats
    - Added password-protected export/import of RSA keys (one old method for
      PKCS#8 PEM only)
    - Added ability to generate RSA key pairs with configurable public
      exponent e
    - Added ability to construct an RSA key pair even if only the private
      exponent d is known, and not p and q
    - Added SHA-2 C source code (fully from Lorenz Quack)
    - Unit tests for all the above
    - Updates to documentation (both inline and in Doc/pycrypt.rst)
    - Minor bug fixes (setup.py and tests)
  - Upstream no longer ships python-3-changes.txt


author: Paul Howarth <paul@city-fan.org> - 2.5-2
changelog:
  - Add upstream fixes for issues found by Dave Malcolm's experimental static
    analysis tool (#790584)


author: Paul Howarth <paul@city-fan.org> - 2.6-1
changelog:
  - Update to 2.6
    - Fix insecure ElGamal key generation (launchpad bug #985164, CVE-2012-2417)
    - Huge documentation cleanup
    - Added more tests, including test vectors from NIST 800-38A
    - Remove broken MODE_PGP, which never actually worked properly
    - A new mode, MODE_OPENPGP, has been added for people wishing to write
      OpenPGP implementations (see also launchpad bug #996814)
    - Fix: getPrime with invalid input causes Python to abort with fatal error
      (launchpad bug #988431)
    - Fix: Segfaults within error-handling paths (launchpad bug #934294)
    - Fix: Block ciphers allow empty string as IV (launchpad bug #997464)
    - Fix DevURandomRNG to work with Python3's new I/O stack
    - Remove automagic dependencies on libgmp and libmpir; let the caller
      disable them using args
    - Many other minor bug fixes and improvements
  - Drop upstream patches


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.12-1
changelog:
  - Upgrade to upstream v3.0.12 release.
    See upstream ChangeLog for details (in freeradius-doc subpackage).
    Related:  Bug#1202751 Rebase FreeRADIUS to 3.0.7 or later minor release
    Resolves: Bug#1358989 FreeRADIUS stops reading the accounting packets from the
                          detail file
    Resolves: Bug#1269217 FreeRADIUS triggers mprotect with large radius reply
    Resolves: Bug#1344183 radiusd crashed in rbtree_find() after receiving a packet
    Resolves: Bug#1370431 FreeRADIUS fails to establish LDAP connections under
                          load
    Resolves: Bug#1397981 [abrt] freeradius: radiusd killed by SIGSEGV


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.12-2
changelog:
  - Do not fail logrotate if radiusd is not running.
    Resolves: Bug#1365226 error running non-shared postrotate script for
                          /var/log/radius/radius.log of
                          '/var/log/radius/radius.log '
  - Fix output to log file specified with -l option.
    Resolves: Bug#1421207 radiusd does not work with log file specified by -l
                          option
  - Fix long hostnames interpreted as IP addresses.
    Resolves: Bug#1420359 radclient does not detect 4. level and higher domain
                          name as a domain name
  - Avoid clashes with libtool library symbols.
    Resolves: Bug#1391960 undefined symbol: get_vtable in
                          /usr/lib64/libtdsodbc.so.0 with freeradius-unixODBC
  - Remove mentions of Auth-Type = System from docs.
    Resolves: Bug#1420293 Freeradius does not know Auth-Type = System
  - Improve ip/v4/v6/addr documentation.
    Resolves: Bug#1179736 add description for ipaddr = hostname from DNS with A
                          and AAAA entries


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-1
changelog:
  - Upgrade to upstream v3.0.13 release.
    See upstream ChangeLog for details (in freeradius-doc subpackage).
    Related:  Bug#1202751 Rebase FreeRADIUS to 3.0.12 or later minor release
    Resolves: Bug#1329181 freeradius-python fix libpython2.7.so dependency at
                          compile time
    Resolves: Bug#1425869 Radiusd does not trigger modules.sql.fail trap if it
                          can't connect to mysql server
    Resolves: Bug#1427829 Stack overflow when passing bare IPv6 to radclient


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-2
changelog:
  - Fix some issues found with static analyzers.
    Resolves: Bug#1432103 FreeRADIUS fails covscan checks
  - Revert rlm_eap_tnc removal, because the tncfhh package is still in RHEL.
    Related:  Bug#1202751 Rebase FreeRADIUS to 3.0.12 or later minor release


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-3
changelog:
  - Explicitly disable rlm_cache_memcached to avoid error when the module's
    dependencies are installed, and it is built, but not packaged.
    Related:  Bug#1202751 Rebase FreeRADIUS to 3.0.12 or later minor release
  - Prevent segfaults by adding a missing handling of connection errors in
    rlm_ldap.
    Resolves: Bug#1437409 [abrt] freeradius: radiusd killed by SIGSEGV
  - Make radtest use Cleartext-Password for EAP, fixing its support for eap-md5.
    Resolves: Bug#1436619 radtest does not work with eap-md5


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-4
changelog:
  - Disable internal OpenSSL cache.
    Resolves: Bug#1458746 CVE-2017-9148 freeradius: TLS resumption
                          authentication bypass
  - Check sizeof(*packet), not sizeof(packet) in EAP-PWD
    Resolves: Bug#1459073 Potential buffer overflow in FreeRADIUS EAP-PWD
  - Parse port as well as address for dhcpclient destination
    Resolves: Bug#1457825 dhcpclient does no accept IP:PORT


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-5
changelog:
  - Refer to correct package version in configuration comments for Bug#1458746
    (CVE-2017-9148) fix.
    Related: Bug#1458746  CVE-2017-9148 freeradius: TLS resumption
                          authentication bypass


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-6
changelog:
  - Avoid race condition when creating session cache file
    Resolves: Bug#1458746 CVE-2017-9148 freeradius: TLS resumption
                          authentication bypass


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-7
changelog:
  - Resolves: Bug#1469409 CVE-2017-10978 freeradius: Out-of-bounds read/write due
                          to improper output buffer size check in make_secret()
  - Resolves: Bug#1469413 CVE-2017-10983 freeradius: Out-of-bounds read in
                          fr_dhcp_decode() when decoding option 63
  - Resolves: Bug#1469414 CVE-2017-10984 freeradius: Out-of-bounds write in
                          data2vp_wimax()
  - Resolves: Bug#1469417 CVE-2017-10985 freeradius: Infinite loop and memory
                          exhaustion with 'concat' attributes
  - Resolves: Bug#1469418 CVE-2017-10986 freeradius: Infinite read in
                          dhcp_attr2vp()
  - Resolves: Bug#1469421 CVE-2017-10987 freeradius: Buffer over-read in
                          fr_dhcp_decode_suboptions()


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-8
changelog:
  - Avoid misinterpreting zero-size malloc in data2vp_extended() fix.
  - Related: Bug#1469414 CVE-2017-10984 freeradius: Out-of-bounds write in
                         data2vp_wimax()


author: Akira TAGOH <tagoh@redhat.com> - 1.34.1-2
changelog:
  - Fix duplicate file list for modules.cache
  - s/%define/%global/g
  - Fix bogus date in %changelog
  - Do not suppress the detailed build log.


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.111-2.6.7.1
changelog:
  - Bump to 2.6.7 and u111b00.
  - Update SystemTap bundle with fix for PR3091/RH1204159
  - Drop patches (PR2938, PR2939, PR3012, PR3013 and PR1437) applied upstream.
  - Resolves: rhbz#1350042


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.111-2.6.7.2
changelog:
  - Reset permissions of resources.jar to avoid it only being readable by root (PR1437).
  - Resolves: rhbz#1350042


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.111-2.6.7.3
changelog:
  - Add additional changes to 8162344 to fix issues which only show up on a full build.
  - Resolves: rhbz#1350042


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.111-2.6.7.4
changelog:
  - Require a version of java-1.7.0-openjdk-devel with a working jar uf
  - Use readlink rather than a wildcard to resolve the system JDK directory
  - Resolves: rhbz#1350042


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.111-2.6.7.5
changelog:
  - Change to disable RC4 did not add MD5 checksum of previous java.security file from 2016/01
  - Resolves: rhbz#1350042


author: Jiri Vanek <jvanek@redhat.com> - 1:1.7.0.111-2.6.7.6
changelog:
  - declared check_sum_presented_in_spec and used in prep and check
  - it is checking that latest packed java.security is mentioned in listing
  - Resolves: rhbz#1350042


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.111-2.6.7.7
changelog:
  - Rebuild java-1.7.0-openjdk for GCC aarch64 stack epilogue code generation fix (RH1372747)
  - Resolves: rhbz#1350042


author: Jakub Jelen <jjelen@redhat.com> 2.1.26-18
changelog:
  - Revert updated GSSAPI flags as in RFC 4752 to restore backward compatibility (#1154566)
  - Add and document ability to run saslauth as non-root user (#1188065)
  - Support AIX SASL GSSAPI (#1174322)
  - Update client library to be thread safe (#1147659)
  - Fix problem, that parsing short prefix matches the whole mechanism name (#1089267)
  - Don't use unnecessary quotes around user description (#1082564)
  - Fix confusing message when config file has typo (#1022479)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-44
changelog:
  - fix CVE-2015-0209 - potential use after free in d2i_ECPrivateKey()
  - fix CVE-2015-0286 - improper handling of ASN.1 boolean comparison
  - fix CVE-2015-0287 - ASN.1 structure reuse decoding memory corruption
  - fix CVE-2015-0288 - X509_to_X509_REQ NULL pointer dereference
  - fix CVE-2015-0289 - NULL dereference decoding invalid PKCS#7 data
  - fix CVE-2015-0292 - integer underflow in base64 decoder
  - fix CVE-2015-0293 - triggerable assert in SSLv2 server


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-46
changelog:
  - drop the AES-GCM restriction of 2^32 operations because the IV is
    always 96 bits (32 bit fixed field + 64 bit invocation field)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-47
changelog:
  - fix CVE-2015-4000 - prevent the logjam attack on client - restrict
    the DH key size to at least 768 bits (limit will be increased in future)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-48
changelog:
  - fix CVE-2015-3216 - regression in RAND locking that can cause segfaults on
    read in multithreaded applications


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-49
changelog:
  - fix CVE-2014-8176 - invalid free in DTLS buffering code
  - fix CVE-2015-1789 - out-of-bounds read in X509_cmp_time
  - fix CVE-2015-1790 - PKCS7 crash with missing EncryptedContent
  - fix CVE-2015-1791 - race condition handling NewSessionTicket
  - fix CVE-2015-1792 - CMS verify infinite loop with unknown hash function


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-50
changelog:
  - improved fix for CVE-2015-1791
  - add missing parts of CVE-2015-0209 fix for corectness although unexploitable


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-51.1
changelog:
  - fix CVE-2015-3194 - certificate verify crash with missing PSS parameter
  - fix CVE-2015-3195 - X509_ATTRIBUTE memory leak
  - fix CVE-2015-3196 - race condition when handling PSK identity hint


author: Mark Langsdorf <mlangsdo@redhat.com> [4.2.0-0.19.el7]
changelog:
  - [redhat] rebase to 4.2.0 (Mark Langsdorf)
  - phylib: fix device deletion order in mdiobus_unregister() (Mark Langsdorf)
  - net: sunrpc: fix tracepoint Warning: unknown op '->' (Pratyush Anand) [1252439]
  - drivers: net: xgene: fix: Oops in linkwatch_fire_event (Dean Nelson) [1240785]
  - tools lib traceevent: Add checks for returned EVENT_ERROR type (Dean Nelson) [1237310]
  - pci: fix gicv2m MSI support (Mark Salter) [1185078]
  - [redhat] disable 842 crypto accellerator emulation for ARM64 (Mark Langsdorf) [1254782]
  - [redhat] kernel-4.2.0-0.rc5.18.el7 (Mark Langsdorf)
  - net, thunder, bgx: Add support to get MAC address from ACPI. (David Daney) [1252569]
  - arm64/pci/acpi: Call pcibios_assign_resources later. (David Daney) [1250263]
  - [redhat] kernel-4.2.0-0.rc5.17.el7 (Mark Langsdorf)
  - DO NOT UPSTREAM: pci, cavium: Fix thunder_pci_requester_id() (David Daney) [1250227]
  - arm64:ftrace: add save_stack_trace_regs() (Pratyush Anand) [1247190]
  - [redhat] Rebase to 4.2-rc5 (Mark Langsdorf)
  - [redhat] kernel-4.2.0-0.rc3.16.el7 (Mark Langsdorf)
  - [redhat] add Cavium ThunderX networking to configs (Mark Langsdorf)
  - net: cavium: thunder_bgx/nic: Factor out DT specific code (Robert Richter) [1242981]
  - net: thunderx: Add receive error stats reporting via ethtool (Robert Richter) [1242981]
  - net: thunderx: Receive hashing HW offload support (Robert Richter) [1242981]
  - net: thunderx: Fixes for nicvf_set_rxfh() (Robert Richter) [1242981]
  - [redhat] DO NOT UPSTREAM: pci, cavium: Disable PEM support (Mark Langsdorf)
  - Add Cavium Thunder PCI driver configs. (David Daney) [1242680]
  - PCI: Add host drivers for Cavium ThunderX processors. (David Daney) [1242680]
  - gic-its: Allow pci_requester_id to be overridden. (David Daney) [1242680]
  - ARM64, ACPI, PCI, MSI: I/O Remapping Table (IORT) initial support. (David Daney) [1242995]
  - irqchip: gicv3: its: probe ITS in ACPI way (David Daney) [1242995]
  - irqchip/GICv3/ITS: refator ITS dt init code to prepare for ACPI (David Daney) [1242995]
  - irqchip / GICv3 / ITS: mark its_init() as __init (David Daney) [1242995]
  - irqchip / GICv3: remove gic root node in ITS (David Daney) [1242995]
  - ACPI, GICV3+: Add support for GICv3+ initialization. (David Daney) [1242995]
  - GICv3: Refactor gic_of_init() of GICv3 driver to allow for FDT and ACPI initialization. (David Daney) [1242995]
  - arm64, acpi: Implement new "GIC version" field of MADT GIC entry. (David Daney) [1242995]
  - arm64: gicv3: its: Add range check for number of allocated pages (David Daney) [1242984]
  - irqchip, gicv3-its: Implement Cavium ThunderX errata 22375, 24313 (David Daney) [1242984]
  - irqchip, gicv3: Implement Cavium ThunderX erratum 23154 (David Daney) [1242984]
  - irqchip, gicv3: Add HW revision detection and configuration (David Daney) [1242984]
  - irqchip, gicv3-its: Read typer register outside the loop (David Daney) [1242984]
  - DO NOT UPSTREAM PCI: pci: xgene: Use default irq domain for MSI (Iyappan Subramanian) [1247716]
  - arm64: Make all entry code as non-kprobe-able (Pratyush Anand) [1234589]
  - arm64: Blacklist _mcount for kprobing (Pratyush Anand) [1234589]
  - arm64: Add trampoline code for kretprobes (Pratyush Anand) [1234589]
  - [redhat] kernel-4.2.0-0.rc3.15.el7 (Mark Langsdorf)
  - arm64: Align regs name with latest upstream uapi headers (Pratyush Anand) [1243663]
  - arm64: support initrd outside kernel linear map (Mark Salter) [1230869]
  - mm: add utility for early copy from unmapped ram (Mark Salter) [1230869]
  - arm64: don't panic on crash kernel alloc failure (Mark Salter) [1240381]
  - arm64: select uprobe only if kprobe is selected (Pratyush Anand) [1210154]
  - [redhat] kernel-4.2.0-0.rc3.14.el7 (Mark Langsdorf)
  - crypto: ccp - Provide support to autoload CCP driver (Kim Naru)
  - arm64: put cpu_reset in idmap (Mark Salter) [1243150]
  - [redhat] rebase to 4.2-rc3 (Mark Langsdorf)
  - arm64: perf fixes for 4.1 and 4.2 kernels (Mark Salter) [1243583]
  - amd-xgbe-a0: Unify coherency checking logic (Mark Salter) [1243551]
  - amd-xgbe-a0: add back CONFIG_AMD_XGBE_PHY (Mark Salter) [1243551]
  - sata/xgene: support acpi probing (Mark Salter) [1144036, 1243551]
  - [redhat] kernel-4.2.0-0.rc2.13.el7 (Mark Langsdorf)
  - [redhat] Rebase to 4.2-rc1 (Mark Langsdorf)
  - DO NOT UPSTREAM: move PL011 SBSA init later (Mark Salter)
  - [redhat] kernel-4.1.0-0.12.el7 (Mark Langsdorf)
  - [redhat] rebase to 4.1 (Mark Langsdorf)
  - [redhat] set build targets to rhelsa-7.2-candidate (Mark Langsdorf)
  - [redhat] don't build kernel docs - REMOVE ME IF ASKED (Mark Langsdorf)
  - Update dynamic ftrace configs (Pratyush Anand) [1186517]
  - KVM: Update RHMAINTAINERS (Andrew Jones)
  - redhat: Update RHMAINTAINERS for APM (Iyappan Subramanian) [1230887]
  - ahci_xgene: set ATA_HORKAGE_NOLPM for all attached disks (Kyle McMartin) [1229454]
  - KVM: fix vgic_v2_acpi_probe (Andrew Jones) [1226348]
  - crashkernel: Allocate 2G memory for auto reservation (Pratyush Anand)
  - DONOTUPSTREAM: arm64: smp_send_stop: increase CPU stop IPI timeout to 60 seconds (Jon Masters) [1218374]
  - arm64: move kdump memory init into arm64_memblock_init() (Mark Salter) [1219838]
  - arm64: support ACPI tables outside of kernel RAM (Mark Salter) [1219838]
  - tty/console: use SPCR table to define console (Torez Smith)
  - Add CONFIG_KEXEC_AUTO_RESERVE into generic config (Pratyush Anand) [https://bugzilla.redhat.com/show_bug.cgi?id=1216287]
  - crashkernel auto reservation code for ARM64 (Pratyush Anand) [https://bugzilla.redhat.com/show_bug.cgi?id=1216287]
  - forward port crashkernel auto reservation code (Dave Young) [https://bugzilla.redhat.com/show_bug.cgi?id=1216287]
  - arm64: KVM: Add CPU hyp mode re-initialization to complement KVM CPU reset (Wei Huang) [1169828]
  - config: increase CONFIG_CMA_SIZE_MBYTES from 16 to 64MB (Jon Masters) [1201885]
  - DO NOT UPSTREAM PCI: X-Gene1: Add ACPI MSI support (Jon Masters) [1201885]
  - arm64: kexec: Fix relocate_new_kernel when CONFIG_DEBUG_RODATA is enabled (Pratyush Anand) [1215041]
  - arm64: kexec: Remove arm64_kexec_dtb_addr refrences (Pratyush Anand) [1215036]
  - arm64: default CPUMASK_OFFSTACK for SMP (Don Dutile)
  - arm64: topology: Correct core_id calculation (Don Dutile)
  - 	drivers: net: xgene: Add shutdown function (Mark Salter) [1203109]
  - arm64: add smp spin-table cpu hotplug support for X-Gene platform (Mark Salter) [1209589]
  - Add CRASH_DUMP into generic config (Pratyush Anand)
  - arm64: use ioremap_cache in copy_oldmem_page (Pratyush Anand)
  - arm64/kdump: Find free area for crash kernel memory (Pratyush Anand)
  - arm: kvm: add stub implementation for kvm_cpu_reset() (Pratyush Anand)
  - arm64: kvm: add cpu reset at module exit (Pratyush Anand)
  - arm64: kvm: add cpu reset hook for cpu hotplug (Pratyush Anand)
  - arm64: kvm: allow EL2 context to be reset on shutdown (Pratyush Anand)
  - arm64: kvm: add a cpu tear-down function (Pratyush Anand)
  - arm64: kdump: do not go into EL2 before starting a crash dump kernel (Pratyush Anand)
  - arm64: add kdump support (Pratyush Anand)
  - arm64: kdump: implement machine_crash_shutdown() (Pratyush Anand)
  - arm64: kdump: reserve memory for crash dump kernel (Pratyush Anand)
  - arm64/kexec: Add pr_devel output (Pratyush Anand)
  - arm64/kexec: Add core kexec support (Pratyush Anand)
  - arm64: Add EL2 switch to soft_restart (Pratyush Anand)
  - arm64: Add new hcall HVC_CALL_FUNC (Pratyush Anand)
  - arm64: Convert hcalls to use HVC immediate value (Pratyush Anand)
  - arm64: Fold proc-macros.S into assembler.h (Pratyush Anand)
  - [redhat] kernel-3.19.0-0.69.aa7a (Mark Langsdorf)
  - Increase NR_CPUS from 8 to 4096 for RHELSA (Don Dutile) [1189951]
  - uprobe: Add uprobe_pre/post_sstep_notifier to NOKPROBE_SYMBOL (Pratyush Anand) [963432]
  - ARM64: Add symbols in NOKPROBE_SYMBOL (Pratyush Anand) [963432]
  - ARM64: Add uprobe support (Pratyush Anand) [963432]
  - ARM64: rename enum debug_el to enum debug_elx to fix "wrong kind of tag" (Pratyush Anand) [963432]
  - ARM64: Handle TRAP_BRKPT for user mode as well (Pratyush Anand) [963432]
  - ARM64: Handle TRAP_HWBRKPT for user mode as well (Pratyush Anand) [963432]
  - ARM64: Re-factor flush_ptrace_access (Pratyush Anand) [963432]
  - ARM64: Add helper for link pointer (Pratyush Anand) [963432]
  - ARM64: include asm-generic/ptrace.h in asm/ptrace.h (Pratyush Anand) [963432]
  - ARM64: fix kgdb_step_brk_fn to ignore other's exception (Pratyush Anand) [963432]
  - ARM64: kprobe: Make prepare and handler function struct kprobe independent (Pratyush Anand) [963432]
  - kprobes: Add arm64 case in kprobe example module (Pratyush Anand) [963432]
  - arm64: Add kernel return probes support (kretprobes) (Pratyush Anand) [963432]
  - arm64: Kprobes instruction simulation support (Pratyush Anand) [963432]
  - arm64: Kprobes with single stepping support (Pratyush Anand) [963432]
  - arm64: Add more test functions to insn.c (Pratyush Anand) [963432]
  - arm64: Add HAVE_REGS_AND_STACK_ACCESS_API feature (Pratyush Anand) [963432]
  - arm64: don't state topo is unsupported if !acpi (Don Dutile) [1186788]
  - arm64: Change 'Call trace' to 'Call Trace' for dump tools (Don Dutile) [1189098]
  - ARM64: gic: Do not allow bypass FIQ signals to reach to processor (Pratyush Anand) [1179954]
  - kernel-aarch64.spec: disable noarch kernel-doc (Kyle McMartin)
  - remove all uses of {name} in kernel-aarch64.spec.template (Mark Langsdorf) [1195790]
  - [redhat] kernel-3.19.0-0.68.aa7a (Mark Langsdorf)
  - update to 3.19 (Mark Langsdorf)
  - kernel-aarch64.spec: implement seperate binary and src rpm names (Mark Langsdorf)
  - Rename kernel.spec.template to kernel-aarch64.spec.template (Mark Langsdorf)
  - Change extension to aa7a (Mark Langsdorf)
  - remove legacy/non-server compile options for arm64 (Mark Langsdorf)
  - [redhat] Add and modify redhat configs for 3.19 (Don Dutile)
  - amd-xgbe-phy-a0: Add support for XGBE PHY on A0 (Tom Lendacky)
  - amd-xgbe-a0: Add support for XGBE on A0 (Tom Lendacky)
  - arm64: add smp parking protocol cpu hotplug support for X-Gene platform (Mark Langsdorf) [1175864]
  - arm64: remove wfe in arm64 spinlock to workaround Xgene Ax silicon bug (Don Dutile) [1081562]
  - xgene: add support for ACPI-probed serial port (Donald Dutile) [1144036]
  - Change POWER_RESET_XGENE to POWER_RESET_SYSCON (Don Dutile) [1065469]
  - arm64: Select reboot driver for X-Gene platform (Don Dutile) [1065469]
  - power: reset: Add generic SYSCON register mapped reset (Mark Langsdorf) [1065469]
  - virtio-mmio: add ACPI probing (Don Dutile) [1093352]
  - net: smc91x: add ACPI probing support (Mark Langsdorf) [1093352]
  - add support for ACPI identification to xhci-platform (Mark Langsdorf) [1080659]
  - make xhci platform driver use 64 bit or 32 bit DMA (Mark Langsdorf) [1080659]
  - DO NOT UPSTREAM: redhat: arm64: topology: Adjust sysfs topology (Don Dutile) [1056268 1127292]
  - arm64: add sev to parking protocol (Mark Salter)
  - arm64: add parking protocol support (Mark Salter)
  - KVM/ACPI: Enable ACPI support for virt arch timer (Wei Huang) [1144036]
  - Revert "arm64: kill flush_cache_all()" (Mark Langsdorf)
  - arm/arm64: DT: Fix GICv2 CPU interface size (Don Dutile)
  - arm: amba: of_platform_populate try deferred devices again (Andrew Jones) [963483]
  - arm64: don't set READ_IMPLIES_EXEC for EM_AARCH64 ELF objects (Kyle McMartin) [1085528]
  - pci: add support for setting DMA ops from ACPI info (Mark Salter)
  - DO NOT UPSTREAM - pci/xgene: Provide fixup for ACPI MCFG support (Mark Salter) [1185078]
  - DO NOT UPSTREAM - provide hook for MCFG fixups (Mark Salter) [1185078]
  - arm64/pci/acpi: initial support for ACPI probing of PCI (Mark Salter) [1185078]
  - pci, acpi: Share ACPI PCI config space accessors. (Mark Salter) [1185078]
  - x86, acpi, pci: mmconfig_64.c becomes default implementation for arch agnostic low-level direct PCI config space accessors via MMCONFIG. (Mark Salter) [1185078]
  - x86, acpi, pci: mmconfig_{32, 64}.c code refactoring - remove code duplication. (Mark Salter) [1185078]
  - x86, acpi, pci: Move PCI config space accessors. (Mark Salter) [1185078]
  - x86, acpi, pci: Move arch-agnostic MMCFG code out of arch/x86/ directory (Mark Langsdorf) [1185078]
  - x86, acpi, pci: Reorder logic of pci_mmconfig_insert() function (Mark Salter) [1185078]
  - DO NOT UPSTREAM YET: Clean up GIC irq domain for ACPI (Mark Langsdorf)
  - DO NOT UPSTREAM YET: Introducing ACPI support for GICv2m (Mark Salter) [1185078]
  - PCI/MSI: Drop domain field from msi_controller (Mark Salter) [1185078]
  - PCI/MSI, xgene: Remove references to mchip.domain in pci-xgene-msi (Mark Langsdorf)
  - irqchip: gicv3-its: Get rid of struct msi_controller (Marc Zyngier)
  - irqchip: GICv2m: Get rid of struct msi_controller (Mark Salter) [1185078]
  - PCI/MSI: Let pci_msi_get_domain use struct device's msi_domain (Mark Salter) [1185078]
  - PCI/MSI: of: Allow msi_domain lookup using the PHB node (Mark Salter) [1185078]
  - PCI/MSI: of: Add support for OF-provided msi_domain (Mark Salter) [1185078]
  - PCI/MSI: Add hooks to populate the msi_domain field (Mark Salter) [1185078]
  - device core: Introduce per-device MSI domain pointer (Mark Salter) [1185078]
  - arm64/perf: add ACPI support (Mark Salter) [1152120]
  - acpi: add utility to test for device dma coherency (Mark Salter) [1144036]
  - crash: enable /dev/crash driver (Mark Langsdorf) [1077329]
  - arm64/acpi: DO NOT UPSTREAM set ACPI enabled by default (Mark Langsdorf)
  - acpi/arm64: remove EXPERT dependency (Mark Salter) [1163947]
  - [debuginfo] enable generation (Donald Dutile)
  - [redhat] Import redhat/ subdirectory (Mark Langsdorf)


author: Tomas Heinrich <theinric@redhat.com> 7.4.7-1
changelog:
  - rebase to 7.4.7
    add requirement on libestr >= 0.1.9
    resolves: #836485
    resolves: #1020854
    resolves: #1040036
  - drop patch 4; not needed anymore
    rsyslog-7.4.2-imuxsock-rfc3339.patch
  - install the rsyslog-recover-qi.pl tool
  - fix a typo in a package description
  - add missing defattr directives
  - add a patch to remove references to Google ads in the html docs
    rsyslog-7.4.7-bz1030044-remove-ads.patch
    Resolves: #1030043
  - add a patch to allow numeric specification of UIDs/GUIDs
    rsyslog-7.4.7-numeric-uid.patch
    resolves: #1032198
  - change the installation prefix to "/usr"
    resolves: #1032223
  - fix a bad date in the changelog
    resolves: #1043622
  - resolve a build issue with missing mysql_config by adding
    additional BuildRequires for the mysql package
  - add a patch to resolve build issue on ppc
    rsyslog-7.4.7-omelasticsearch-atomic-inst.patch


author: Tomas Heinrich <theinric@redhat.com> 7.4.7-3
changelog:
  - replace rsyslog-7.3.15-imuxsock-warning.patch
    with rsyslog-7.4.7-bz1053669-imuxsock-wrn.patch
    resolves: #1053669
  - add rsyslog-7.4.7-bz1052266-dont-link-libee.patch to prevent
    linking the main binary with libee
    resolves: #1052266
  - add rsyslog-7.4.7-bz1054171-omjournal-warning.patch to fix
    a condition for issuing a warning in omjournal
    resolves: #1054171
  - drop the "v5" string from the conf file as it's misleading
    resolves: #1040036


author: Tomas Heinrich <theinric@redhat.com> 7.4.7-5
changelog:
  - move the rscryutil man page to the crypto subpackage
    resolves: #1056565
  - add a patch to prevent message loss in imjournal
    rsyslog-7.4.7-bz1038136-imjournal-message-loss.patch
    resolves: #1038136


author: Tomas Heinrich <theinric@redhat.com> 7.4.7-6
changelog:
  - disable the imklog plugin by default
    the patch for rhbz#1038136 caused duplication of kernel messages since the
    messages read by the imklog plugin were now also pulled in from journald
    resolves: #1078654


author: Josh Stone <jistone@redhat.com> 8.1.1-1
changelog:
  - Update to release 8.1.1.
  - Drop the backported dyninst-test2_4-kill-init.patch.
  - Drop the now-upstreamed dyninst-unused_vars.patch.
  - Update other patches for context.
  - Patch the installed symlinks to be relative, not $(DEST) filled.


author: Josh Stone <jistone@redhat.com> 8.1.2-6
changelog:
  - rhbz1063447: squash testsuite g++ optimization
  - rhbz1030969: backported additional patch to silence new warnings


author: Stephen Gallagher <sgallagh@redhat.com> - 2:2.12.1-15
changelog:
  - Generate SSL certificates with x509v3 and CA:FALSE
  - Automatically import self-signed certificates into local trust-store
  - Move SSL certificate generation into the systemd service file
  - Resolves: #1041555


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2:2.14.1-1
changelog:
  - Fix packaging of tmpfiles
    Resolves: #1180993
  - Add install Platform_LINUX_XSCALE_GNU.h, Linkage.h and CIMListener.h to -devel
    because of lmiwbem (CIMListener class), add symlink to libpeglistener.so.1
    Resolves: #1120701
  - Update to upstream version 2.14.1
    Resolves: #1097187, #1039050, #1007386
  - Fix sending of SNMPv3 traps
    Resolves: #1218954


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2:2.14.1-2
changelog:
  - Remove files created in %check
    Resolves: #1232341
  - Fix setupSDK in -devel
    Resolves: #1127399
  - Add snmp tests to the -test rpm and enable them, configure snmptrapd
    in test setup phase
    Related: #1218954


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2:2.14.1-4
changelog:
  - Fix ppc64le SDK
    Resolves: #1266235
  - Move SSL certificates to more convenient place, update related scripts
    and README.RedHat.SSL
    Resolves: #1308809
  - Change repository update to get rid of warning messages during cleanup
    Resolves: #1257085
  - Remove TESTID environment variable which breaks automatic testing in Beaker
    Resolves: #1266655
  - Add CIMEnumerationContext.h and UintArgs.h to -devel
    Resolves: #1335873
  - Fix wrong formatting in cimconfig man page
    Resolves: #1263895
  - Add missing description of httpSessionTimeout to cimconfig man page
    Resolves: #1263894


author: Remi Collet <rcollet@redhat.com> - 5.4.16-23
changelog:
  - fileinfo: cdf_unpack_summary_info() excessive looping
    DoS. CVE-2014-0237
  - fileinfo: CDF property info parsing nelements infinite
    loop. CVE-2014-0238
  - fileinfo: cdf_check_stream_offset insufficient boundary
    check. CVE-2014-3479
  - fileinfo: cdf_count_chain insufficient boundary check
    CVE-2014-3480
  - fileinfo: cdf_read_short_sector insufficient boundary
    check. CVE-2014-0207
  - fileinfo: cdf_read_property_info insufficient boundary
    check. CVE-2014-3487
  - fileinfo: fix extensive backtracking CVE-2013-7345
  - core: type confusion issue in phpinfo(). CVE-2014-4721
  - core: fix heap-based buffer overflow in DNS TXT record
    parsing. CVE-2014-4049
  - core: unserialize() SPL ArrayObject / SPLObjectStorage
    type confusion flaw. CVE-2014-3515


author: Remi Collet <rcollet@redhat.com> - 5.4.16-27
changelog:
  - gd: fix NULL pointer dereference in gdImageCreateFromXpm().
    CVE-2014-2497
  - gd: fix NUL byte injection in file names. CVE-2014-5120
  - fileinfo: fix extensive backtracking in regular expression
    (incomplete fix for CVE-2013-7345). CVE-2014-3538
  - fileinfo: fix mconvert incorrect handling of truncated
    pascal string size. CVE-2014-3478
  - fileinfo: fix cdf_read_property_info
    (incomplete fix for CVE-2012-1571). CVE-2014-3587
  - spl: fix use-after-free in ArrayIterator due to object
    change during sorting. CVE-2014-4698
  - spl: fix use-after-free in SPL Iterators. CVE-2014-4670
  - network: fix segfault in dns_get_record
    (incomplete fix for CVE-2014-4049). CVE-2014-3597


author: Remi Collet <rcollet@redhat.com> - 5.4.16-29
changelog:
  - xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
  - core: fix integer overflow in unserialize() CVE-2014-3669
  - exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670


author: Remi Collet <rcollet@redhat.com> - 5.4.16-33
changelog:
  - core: use after free vulnerability in unserialize()
    CVE-2014-8142 and CVE-2015-0231
  - core: fix use-after-free in unserialize CVE-2015-2787
  - core: fix NUL byte injection in file name argument of
    move_uploaded_file() CVE-2015-2348
  - date: use after free vulnerability in unserialize CVE-2015-0273
  - enchant: fix heap buffer overflow in enchant_broker_request_dict
    CVE-2014-9705
  - exif: free called on unitialized pointer CVE-2015-0232
  - fileinfo: fix out of bounds read in mconvert CVE-2014-9652
  - gd: fix buffer read overflow in gd_gif_in.c CVE-2014-9709
  - phar: use after free in phar_object.c CVE-2015-2301
  - soap: fix type confusion through unserialize


author: Remi Collet <rcollet@redhat.com> - 5.4.16-34
changelog:
  - fix memory corruption in fileinfo module on big endian
    machines #1082624
  - fix segfault in pdo_odbc on x86_64 #1159892
  - fix segfault in gmp allocator #1154760


author: Remi Collet <rcollet@redhat.com> - 5.4.16-35
changelog:
  - core: fix multipart/form-data request can use excessive
    amount of CPU usage CVE-2015-4024
  - fix various functions accept paths with NUL character
    CVE-2015-4025, CVE-2015-4026, #1213407
  - fileinfo: fix denial of service when processing a crafted
    file #1213442
  - ftp: fix integer overflow leading to heap overflow when
    reading FTP file listing CVE-2015-4022
  - phar: fix buffer over-read in metadata parsing CVE-2015-2783
  - phar: invalid pointer free() in phar_tar_process_metadata()
    CVE-2015-3307
  - phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
  - phar: fix memory corruption in phar_parse_tarfile caused by
    empty entry file name CVE-2015-4021
  - soap: fix type confusion through unserialize #1222538
  - apache2handler: fix pipelined request executed in deinitialized
    interpreter under httpd 2.4 CVE-2015-3330


author: Christine Caulfield <ccaulfie@redhat.com> - 0.17.1-2.1
changelog:
  Increase size of the buffer where we make the socket name to allow for longer PIDs
    Resolves bz#1114852


author: Christine Caulfield <ccaulfie@redhat.com> - 1.0.1-2
changelog:
  Detect IPC Shared memory corruption in peek as well as read. Prevents
    the mainloop from spinning if multithreaded IPC (which is currently 
    not supported) is attempted without locking.
    Resolves: rhbz#1422454


author: Christine Caulfield <ccaulfie@redhat.com> - 1.0.1-3
changelog:
  Allow IPC system to use filesystem sockets instead of abstract
    sockets if a configuration file exists.
    Resolves: rhbz#1446254


author: Christine Caulfield <ccaulfie@redhat.com> - 1.0.1-4
changelog:
  Revert git patch 189ca28 which caused problems with pacemaker CIB
    closing down.
    Resolves: rhbz#1459276


author: Christine Caulfield <ccaulfie@redhat.com> - 1.0.1-5
changelog:
  Put backpatch 189ca28 as it's not the culprit
    
    Don't truncate IPC files in the client as it can cause servers to crash.
    I've also had to (for this release) disable one of the tests as it checks
    for truncated files.
    Resolves: rhbz#1459276


author: Jaromir Capik <jcapik@redhat.com> - 3.3.9-5
changelog:
  - Support for timestamps & wide diskstat (#1053428, #1025833)
  - Fixing fd leak in watch
  - Fixing format-security build issues
  - Skipping trailing zeros in read_unvectored (#1057600)
  - Resolves: rhbz#1053428, Related: rhbz#1025833


author: Jaroslav Škarvada <jskarvad@redhat.com> - 1.1.0-1
changelog:
  - New version
  - Dropped office_scen patch (upstreamed)
  - Dropped hdparm patch (upstream added support for LVM)
  - Reworked rm_sudo patch


author: Christophe Fergeau <cfergeau@redhat.com> 0.3.1-2
changelog:
  - Requires a new enough librest as we use symbols not available in older
    librest
    Related: rhbz#1116844


author: Christophe Fergeau <cfergeau@redhat.com> - 0.3.3-1.3
changelog:
  - Add upstream patch fixing unwanted authentication dialog for foreign menu
    when using remote-viewer ovirt://
    Related: rhbz#1344633


author: Christophe Fergeau <cfergeau@redhat.com> - 0.3.3-1.4
changelog:
  - Add upstream patch forcing use of the older v3 REST API as we don't support
    yet the v4 API
    Resolves: rhbz#1346215


author: Frantisek Kluknavsky <fkluknav@redhat.com> - 1:5.1.0-1
changelog:
  - rebase to 5.1.0, de-ansi patch no longer applicable
  - upstream dropped libmp.so (bsdmp-like interface)
  - silenced bogus date in changelog


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-10
changelog:
  - storage: util: Properly ignore errors when backing volume is inaccessible (rhbz#1540022)
  - util: json: Add helper to return string or number properties as string (rhbz#1540290)
  - util: storage: Parse 'lun' for iSCSI protocol from JSON as string or number (rhbz#1540290)
  - util: Introduce virFormatIntPretty (rhbz#1289368)
  - util: Make prefix optional in virBitampString (rhbz#1289368)
  - util: Rename virBitmapString to virBitmapToString (rhbz#1289368)
  - util: Rename virBitmapDataToString to virBitmapDataFormat (rhbz#1289368)
  - util: Don't output too many zeros from virBitmapToString (rhbz#1289368)
  - util: Introduce virBitmapNewString (rhbz#1289368)
  - util: Reintroduce virBitmapSubtract (rhbz#1289368)
  - util: Introduce virBitmapShrink (rhbz#1289368)
  - conf: Sort cache banks in capabilities XML (rhbz#1289368)
  - conf: Format cache banks in capabilities with virFormatIntPretty (rhbz#1289368)
  - tests: Remove executable bits on plain data files (rhbz#1289368)
  - tests: Minor adjustments for test data (rhbz#1289368)
  - tests: Add resctrl-skx-twocaches test case to vircaps2xmltest (rhbz#1289368)
  - util: Fix leak in virStringTrimOptionalNewline (rhbz#1289368)
  - Rename virResctrlInfo to virResctrlInfoPerCache (rhbz#1289368)
  - util: Add virResctrlInfo (rhbz#1289368)
  - conf: Use virResctrlInfo in capabilities (rhbz#1289368)
  - util: Remove now-unneeded resctrl functions (rhbz#1289368)
  - fixup_resctrlinfo (rhbz#1289368)
  - resctrl: Add functions to work with resctrl allocations (rhbz#1289368)
  - conf: Add support for cputune/cachetune (rhbz#1289368)
  - tests: Add virresctrltest (rhbz#1289368)
  - qemu: Add support for resctrl (rhbz#1289368)
  - tests: Clean up and modify some vircaps2xmldata (rhbz#1289368)
  - resctl: stub out functions with Linux-only APIs used (rhbz#1289368)
  - util: Check for empty allocation instead of just NULL pointer (rhbz#1289368)
  - util: Use "resctrl" instead of "resctrlfs" spelling (rhbz#1289368)
  - util: Make it possible for virResctrlAllocSetMask to replace existing mask (rhbz#1289368)
  - util: Remove unused variable in virResctrlGetInfo (rhbz#1289368)
  - util: Don't check if entries under /sys/fs/resctrl/(info/) are directories (rhbz#1289368)
  - util: Add helpers for getting resctrl group allocs (rhbz#1289368)
  - util: Use default group's mask for unspecified resctrl allocations (rhbz#1289368)
  - util: Don't overwrite mask in virResctrlAllocFindUnused (rhbz#1289368)
  - qemu: Restore machinename even without cgroups (rhbz#1289368)
  - util: Extract path formatting into virResctrlAllocDeterminePath (rhbz#1289368)
  - qemu: Restore resctrl alloc data after restart (rhbz#1289368)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-11
changelog:
  - qemu: migration: Refresh device information after transferring state (rhbz#1463168)
  - qemuDomainRemoveMemoryDevice: unlink() memory backing file (rhbz#1461214)
  - util: Fix possible leak in virResctrlAllocMasksAssign (rhbz#1540817)
  - util: Clear unused part of the map in virBitmapShrink (rhbz#1540817)
  - tests: Add test for properly removing cachetune entries (rhbz#1540817)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-12
changelog:
  - util: Check if kernel-provided info is consistent with itself (rhbz#1540780)
  - qemu: Refresh capabilities when creating resctrl allocation (rhbz#1540780)
  - qemu: Expose rx/tx_queue_size in qemu.conf too (rhbz#1541960)
  - util: bitmap: Fix value of 'map_alloc' when shrinking bitmap (rhbz#1540817)
  - qemu: driver: Extract vcpu halted state directly (rhbz#1534585)
  - qemu: Remove unused 'cpuhalted' argument from qemuDomainHelperGetVcpus (rhbz#1534585)
  - qemu: domain: Store vcpu halted state as a tristate (rhbz#1534585)
  - qemu: Limit refresh of CPU halted state to s390 (rhbz#1534585)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-14.el7_5.1
changelog:
  - virDomainDeviceValidateAliasForHotplug: Use correct domain defintion (rhbz#1554928)
  - conf: Check for user aliases duplicates only (rhbz#1554962)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-14.el7_5.3
changelog:
  - qemu_cgroup: Fix 'rc' argument on virDomainAuditCgroupPath() calls (rhbz#1564996)
  - util: Introduce virStringListMerge (rhbz#1564996)
  - util: Introduce virDevMapperGetTargets (rhbz#1564996)
  - qemu_cgroup: Handle device mapper targets properly (rhbz#1564996)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-14.el7_5.4
changelog:
  - lxc: Drop useless check in live device update (rhbz#1557922)
  - Pass oldDev to virDomainDefCompatibleDevice on device update (rhbz#1557922)
  - qemu: Fix updating device with boot order (rhbz#1557922)
  - conf: Fix crash in virDomainDefCompatibleDevice (rhbz#1557922)
  - vmx: check for present/enabled devices earlier (rhbz#1566524)
  - vmx: allocate space for network interfaces if needed (rhbz#1566524)
  - internal: add STRCASEPREFIX (rhbz#1566524)
  - vmx: convert any amount of NICs (rhbz#1566524)
  - qemu: Use dynamic buffer for storing PTY aliases (rhbz#1566525)
  - qemu: avoid denial of service reading from QEMU monitor (CVE-2018-5748) (CVE-2018-5748)
  - qemu: avoid denial of service reading from QEMU guest agent (CVE-2018-1064) (CVE-2018-1064)


author: Honza Horak <hhorak@redhat.com> - 2.0.35-19
changelog:
  - Spec file cleanup
  - Compile and run test suite during build
  - Using chrpath to get rid of --rpath in gd-progs


author: Jan Synáček <jsynacek@redhat.com> - 20160308-7
changelog:
  - ping hung when it cannot receive echo reply (#1362463)
  - arping documentation inconsistency (#1351704)


author: Jan Synáček <jsynacek@redhat.com> - 20160308-9
changelog:
  - IPv4 vs IPv6 inconsistency on return value of ping (#1362388)
  - ping6 does not use device specified with -I parameter (#1371824, #1424965)
  - double cap_free call in ping_common.c (#1410114)
  - ping assumes EACCESS errors are due to broadcast addresses (#1387315)
  - ping -t with multicast address without effect on ppc64 (#1373333)
  - arping -c <n> does not exit when the device is deleted (#1387542)


author: Peter Rajnoha <prajnoha@redhat.com> - 0.6.2-2
changelog:
  - Improve documentation and messages on output file preallocation
    when using thin_repair and thin_restore.


author: Peter Rajnoha <prajnoha@redhat.com> - 0.7.0-0.1-rc3
changelog:
  - Update to latest upstream release including various bug fixes and new features.
  - New thin_show_duplicates command.
  - Add '--skip-mappings' and '--format custom' options to thin_dump.


author: Peter Rajnoha <prajnoha@redhat.com> - 0.7.0-0.1-rc6
changelog:
  - Don't open devices as writeable if --clear-needs-check-flag is not set.
  - Fix cache metadata format version 2 superblock packing.


author: Honza Horak <hhorak@redhat.com> - 2.31-4
changelog:
  - Remove systemd-units and systemd-sysv requirements
  - Clean-up SysV init conversion code
  - Clean-up systemd preset macros compatibility code
  - Remove fedora-releated stuff for maps upgrading


author: Matej Mužila <mmuzila@redhat.com> - 2.31-9
changelog:
  - Do not update NIS map when master's version is older
  - Open correct _temporary_ db with tokyocabinet
  - Resolves #1305137, #1331882


author: Petr Holasek <pholasek@redhat.com> - 2:1.0.7-2
changelog:
  - fixed unused variable revealed by covscan
  - fixed ignored pid argument (#1155632)
  - warning when irqbalance started under non-root (#1155799)
  - more robust signal handling (#1158937)
  - fixed hostname in manpage (#1162251)


author: Petr Stodulka <pstodulk@redhat.com> - 1.5-8
changelog:
  - Gzip overwrite existing files when user choose "no" on yes/no question.
    It's due to wrong dupicit declaration of yesno() function in gzip.h
    which is compiled wrong with -O2 option.
    Resolves: rhbz#1201689


author: Jakub Martisko <jamartis@redhat.com> - 1.5-10
changelog:
  - doc change: missing grep options are now mentioned in the zgrep 
    man pages/help message
    Resolves: #1437002


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-2
changelog:
  - sepolgen: Add support for TYPEBOUNDS statement in INTERFACE policy
    files (#1319338)
  - Add documentation for MCS separated domains
  - Move svirt man page out of libvirt into its own


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-3
changelog:
  - Update sandbox types in sandbox manual
  - Fix typos in semanage manpages
  - Fix the documentation of -l,--list for semodule
  - Minor fix in a French translation
  - Fix the extract example in semodule.8
  - Update sandbox.8 man page
  - Remove typos from chcat --help
  - Fix multiple spelling errors
  - hll/pp: Warn if module name different than output filename


author: Petr Lautrbach <plautrba@redhat.com> 2.5-6.2
changelog:
  - open_init_pty: Do not error on EINTR
  - Fix [-s STORE] typos in semanage
  - Don't use subprocess.getstatusoutput() in Python 2 code


author: Petr Lautrbach <plautrba@redhat.com> 2.5-7
changelog:
  - fixfiles: Pass -n to restorecon for fixfiles check
  - sepolicy: Check get_rpm_nvr_list() return value
  - Don't use subprocess.getstatusoutput() in Python 2 code
  - semanage: Add auditing of changes in records
  - Remove unused 'q' from semodule getopt string


author: Petr Lautrbach <plautrba@redhat.com> 2.5-8
changelog:
  - audit2allow: tests should use local copy not system
  - audit2allow: remove audit2why so that it gets symlinked
  - semanage: fix man page and help message for import option
  - semanage: fix error message for fcontext -m
  - semanage: Fix semanage fcontext -D
  - semanage: Correct fcontext auditing
  - semanage: Default serange to "s0" for port modify
  - semanage: Use socket.getprotobyname for protocol
  - semanage: fix modify action in node and interface


author: Tomas Hozza <thozza@redhat.com> - 32:9.9.4-33
changelog:
  - Fix excessive queries caused by DS chasing with stub zones when DNSSEC is not used (#1291185)
  - Fix error in internal test suite (#1259514)
  - Fix named-checkconf call in *-chroot.service files (#1278082)
  - Fix incorrect path in BIND sample configuration and added comment to default configuration (#1247502)


author: Tomas Hozza <thozza@redhat.com> - 32:9.9.4-34
changelog:
  - Added support for CAA records (#1306610)
  - Use HTTPS URL instead of FTP for upstream sources (#1319280)


author: Tomas Hozza <thozza@redhat.com> - 32:9.9.4-36
changelog:
  - Added automatic interface scan functionality (#1294506)
  - Removed NetworkManager dispatcher script since it is not needed any more (#1294506)


author: Petr Menšík <pemensik@redhat.com> - 32:9.9.4-38.1
changelog:
  - Fix CVE-2016-9131 (ISC change 4508)
  - Fix CVE-2016-9147 (ISC change 4510)
  - Fix regression introduced by CVE-2016-8864 (ISC change 4530)
  - Fix CVE-2016-9444 (ISC change 4517)


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 20-12
changelog:
  - weak-modules: fix coverity introduced by latest changes
  - weak-modules: fix "permission denied" on some upgrades.
    Resolves: rhbz#1416566


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 20-17
changelog:
  - libkmod-elf: resolve CRC if module is built with MODULE_REL_CRCS.
  - weak-modules: process only weak-updates related depmod output.
    Resolves: rhbz#1468305
  - weak-modules: implement dry run by symlink restoration.
    Resolves: rhbz#1477073


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 20-18
changelog:
  - depmod: external directories support.
    Resolves: rhbz#1361857
  - BuildRequires automake autoconf libtool.


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 20-20
changelog:
  - weak-modules: use function to generate weak_updates_dir
  - weak-modules: implement dry-run on the tempdir
    Resolves: rhbz#1510058


author: Davide Caratti <dcaratti@redhat.com> - 1:2.6-5
changelog:
  - macsec: Fix segmentation fault in case macsec.ko is not loaded (rh #1440646)
  - nl80211: Fix race condition in detecting MAC change (rh #1447073)


author: Davide Caratti <dcaratti@redhat.com> - 1:2.6-7
changelog:
  - avoid key reinstallation (CVE-2017-13077, CVE-2017-13078, CVE-2017-13079,
    CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13086,
    CVE-2017-13087, CVE-2017-13088)


author: Jan Kaluza <jkaluza@redhat.com> - 3.8.6-5
changelog:
  - mention copy/copytruncate/renamecopy influence to olddir option (#1175292)
  - delete last log when dateformat cannot be sorted alphabetically (#1174208)
  - mark cron.daily/logrotate as config file (#1174207)
  - create olddir diectory if it does not exist (#1187161)


author: Avesh Agarwal <avagarwa@redhat.com> - 0.8.3-8
changelog:
  - Fix build failure in fedora rawhide. It was caused due to 
    removal of CMAKE_INSTALL_LIBDIR macro from /etc/rpm/cmake.macros 
    that was present in previous fedora releases.


author: Avesh Agarwal <avagarwa@redhat.com> - 0.8.3-12
changelog:
  - Fixes for rhbz #985785 to fix crash issue in Filecert manager
    in platidimv.
  - Fixed crashing of attestation imv so while loading due to
    wrong static initialization order in attestation imv.
  - Fixes some coverity scan errors.
  - Fixed comilation when sysconf dir variable is not defined on a
    local system. Added some messaging outputs during compilations.
  - Fixed erroneous data type conversion issues causing wrong outputs
    and with potential for data corruption.
  - Fixes tncutil build issue from upstream commit
  - Fixes typo in assignment in platidimv from upstream commit
  - Fixes Fix typo in variable declaraction in hostscannerimv
    from upstream commit
  - Fixes imcv shared library build issue from upstream commit


author: Avesh Agarwal <avagarwa@redhat.com> - 0.8.3-13
changelog:
  - Implemented support for dlopen
  - Removed libtool support
  - Fixed imv and imc build issues arising from a
    previous upstream patch
  - Fixed a few coverity scan error issues


author: Richard W.M. Jones <rjones@redhat.com> - 1.12-13.1.el7
changelog:
  - Add patch to fix multilib conflicts in dnet-config
    resolves: rhbz#1059593
  - Remove RPM cruft from the spec file.


author: Petr Pisar <ppisar@redhat.com> - 4.13.3-2
changelog:
  - Fix decoding from positional argument while overriding output file
    (bug #901895)
  - Fix decoding to standard output when output file is - or /dev/stdout
    (bug #901895)


author: Ondrej Vasik <ovasik@redhat.com> - 1.61-2
changelog:
  - Merge review cleanup (#226546), comment patches, license
    to LGPLv2+, specify names in files section...


author: Ray Strode <rstrode@redhat.com> 3.14.2-6
changelog:
  - Add more goo to the compat desktop file to prevent it
    from getting exposed in control-center
    Related: #1259292


author: Rex Dieter <rdieter@fedoraproject.org> 2.3.3.4-6
changelog:
  - contribs-lib is not built and installed even with config (#794795, upstream ID: 3392466)
  - pkgconfig file is missing clucene-shared (upstream ID: 3461512)
  - non-descriptive descripton (#757319)


author: Miloslav Trmač <mitr@redhat.com> - 0.21.1-10
changelog:
  - Replace expired certificates in the test suite
  - Fix running the test suite against recent OpenSSL versions


author: Miloslav Trmač <mitr@redhat.com> - 0.21.1-12
changelog:
  - Fix occasional spurious failures in test_makefile_timeout_fires
    Resolves: #969077
  - Fix incorrect exception handling of SSL_CTX_new (manifesting in FIPS mode)
    Resolves: #879043
  - Add minimal SNI support, based on a patch by Sander Steffann
    <sander@steffann.nl>
    Resolves: #1038795
  - Use only ECC curves available in Fedora in the test suite
    Related: #1038813
  - Fix terminating test suite helper processes when running in Koji
    Related: #1038813
  - Run test suite in %check, don't ship it in the package.  Based on a patch by
    Matěj Cepl <mcepl@redhat.com>.
    Resolves: #1038813


author: Miloslav Trmač <mitr@redhat.com> - 0.21.1-14
changelog:
  - Don't assume that export ciphers are enabled in the test suite
    Resolves: #1048887
  - Let the kernel allocate free ports for use by the test suite
    Resolves: #1048887


author: Marek Kasik <mkasik@redhat.com> - 2.4.11-3
changelog:
  - Fix emboldening:
      - split out MSB function
      - fix integer overflows
      - fix broken emboldening at small sizes
  - Resolves: #891457


author: Marek Kasik <mkasik@redhat.com> - 2.4.11-10.el7_1.1
changelog:
  - Fixes CVE-2014-9657
     - Check minimum size of `record_size'.
  - Fixes CVE-2014-9658
     - Use correct value for minimum table length test.
  - Fixes CVE-2014-9675
     - New macro that checks one character more than `strncmp'.
  - Fixes CVE-2014-9660
     - Check `_BDF_GLYPH_BITS'.
  - Fixes CVE-2014-9661
     - Initialize `face->ttf_size'.
     - Always set `face->ttf_size' directly.
     - Exclusively use the `truetype' font driver for loading
       the font contained in the `sfnts' array.
  - Fixes CVE-2014-9663
     - Fix order of validity tests.
  - Fixes CVE-2014-9664
     - Add another boundary testing.
     - Fix boundary testing.
  - Fixes CVE-2014-9667
     - Protect against addition overflow.
  - Fixes CVE-2014-9669
     - Protect against overflow in additions and multiplications.
  - Fixes CVE-2014-9670
     - Add sanity checks for row and column values.
  - Fixes CVE-2014-9671
     - Check `size' and `offset' values.
  - Fixes CVE-2014-9673
     - Fix integer overflow by a broken POST table in resource-fork.
  - Fixes CVE-2014-9674
     - Fix integer overflow by a broken POST table in resource-fork.
     - Additional overflow check in the summation of POST fragment lengths.
  - Work around behaviour of X11's `pcfWriteFont' and `pcfReadFont' functions
  - Resolves: #1197739


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-11
changelog:
  - release 1.3.3.1-11
  - Resolves: bug 1080186 - During delete operation do not refresh cache entry if it is a tombstone (DS 47750)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-12
changelog:
  - release 1.3.3.1-12
  - Resolves: bug 1182477 - Windows Sync accidentally cleared raw_entry (DS 47989)
  - Resolves: bug 1180325 - upgrade script fails if /etc and /var are on different file systems (DS 47991 )
  - Resolves: bug 1183655 - Schema learning mechanism, in replication, unable to extend an existing definition (DS 47988)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-14
changelog:
  - release 1.3.3.1-14
  - Resolves: bug 1189154 - DNS errors after IPA upgrade due to broken ReplSync (DS 48030)
              Fixes spec file to make sure all the server instances are stopped before upgrade
  - Resolves: bug 1186548 - ns-slapd crash in shutdown phase (DS 48005)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-16
changelog:
  - release 1.3.3.1-16
  - Resolves: bug 1212894 - CVE-2015-1854 389ds-base: access control bypass with modrdn


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-17
changelog:
  - release 1.3.3.1-17
  - Resolves: bug 1230038 - idm/ipa 389-ds-base entry cache converges to 500 KB in dblayer_is_cachesize_sane (DS 48190)
  - Resolves: bug 1230037 - async simple paged results issue (DS 48146, DS 48192)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-18
changelog:
  - release 1.3.3.1-18
  - Resolves: bug 1232100 - CVE-2015-3230 389-ds-base: nsSSL3Ciphers preference not enforced server side (DS 48194)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-20
changelog:
  - release 1.3.3.1-20
  - Resolves: bug 1243718 - Winsync fails when AD users have multiple spaces (two)inside the value of the rdn attribute (DS 48223)


author: Josh Boyer <jwboyer@fedoraproject.org> - 4.0.0-0.rc6.git1.1
changelog:
  - Linux v4.0-rc6-31-gd4039314d0b1
  - CVE-2015-2150 xen: NMIs triggerable by guests (rhbz 1196266 1200397)


author: Harald Hoyer <harald@redhat.com> 033-237
changelog:
  - add support for multiple autoconf options ip=eth0:auto6,dhcp
  Resolves: rhbz#1069270
  - fixed team implementation
  Resolves: rhbz#1147521


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-123.el7
changelog:
  - kvm-Fix-backport-of-target-i386-add-feature-flags-for-CP.patch [bz#1371619]
  - kvm-Add-skip_dump-flag-to-ignore-memory-region-during-du.patch [bz#1373088]
  - Resolves: bz#1371619
    (Flags xsaveopt xsavec xgetbv1 are missing on qemu-kvm)
  - Resolves: bz#1373088
    ([FJ7.3 Bug]: virsh dump with both --memory-only and --format option fails)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-124.el7
changelog:
  - kvm-target-i386-Add-support-for-FEAT_7_0_ECX.patch [bz#1372459]
  - kvm-target-i386-Add-more-Intel-AVX-512-instructions-supp.patch [bz#1372459]
  - Resolves: bz#1372459
    ([Intel 7.3 Bug] SKL-SP Guest cpu doesn't support avx512 instruction sets(avx512bw, avx512dq and avx512vl) (qemu-kvm))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-125.el7
changelog:
  - kvm-nbd-server-Set-O_NONBLOCK-on-client-fd.patch [bz#1285453]
  - Resolves: bz#1285453
    (An NBD client can cause QEMU main loop to block when connecting to built-in NBD server)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7
changelog:
  - kvm-virtio-recalculate-vq-inuse-after-migration.patch [bz#1376542]
  - Resolves: bz#1376542
    (RHSA-2016-1756 breaks migration of instances)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.1
changelog:
  - kvm-ide-fix-halted-IO-segfault-at-reset.patch [bz#1393042]
  - kvm-hw-i386-regenerate-checked-in-AML-payload-RHEL-only.patch [bz#1392027]
  - kvm-SPEC-file-flip-the-build-from-IASL-to-checked-in-AML.patch [bz#1392027]
  - Resolves: bz#1392027
    (shutdown rhel 5.11 guest failed and stop at "system halted")
  - Resolves: bz#1393042
    (system_reset should clear pending request for error (IDE))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.2
changelog:
  - kvm-virtio-introduce-virtqueue_unmap_sg.patch [bz#1393484]
  - kvm-virtio-introduce-virtqueue_discard.patch [bz#1393484]
  - kvm-virtio-decrement-vq-inuse-in-virtqueue_discard.patch [bz#1393484]
  - kvm-balloon-fix-segfault-and-harden-the-stats-queue.patch [bz#1393484]
  - kvm-virtio-balloon-discard-virtqueue-element-on-reset.patch [bz#1393484]
  - kvm-virtio-zero-vq-inuse-in-virtio_reset.patch [bz#1393484]
  - kvm-virtio-add-virtqueue_rewind.patch [bz#1393484]
  - kvm-virtio-balloon-fix-stats-vq-migration.patch [bz#1393484]
  - Resolves: bz#1393484
    ([RHEL7.3] KVM guest shuts itself down after 128th reboot)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.3
changelog:
  - kvm-net-check-packet-payload-length.patch [bz#1398217]
  - Resolves: bz#1398217
    (CVE-2016-2857 qemu-kvm: Qemu: net: out of bounds read in net_checksum_calculate() [rhel-7.3.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.4
changelog:
  - kvm-virtio-blk-Release-s-rq-queue-at-system_reset.patch [bz#1420049]
  - kvm-cirrus_vga-fix-off-by-one-in-blit_region_is_unsafe.patch [bz#1418232]
  - kvm-display-cirrus-check-vga-bits-per-pixel-bpp-value.patch [bz#1418232]
  - kvm-display-cirrus-ignore-source-pitch-value-as-needed-i.patch [bz#1418232]
  - kvm-cirrus-handle-negative-pitch-in-cirrus_invalidate_re.patch [bz#1418232]
  - kvm-cirrus-allow-zero-source-pitch-in-pattern-fill-rops.patch [bz#1418232]
  - kvm-cirrus-fix-blit-address-mask-handling.patch [bz#1418232]
  - kvm-cirrus-fix-oob-access-issue-CVE-2017-2615.patch [bz#1418232]
  - Resolves: bz#1418232
    (CVE-2017-2615 qemu-kvm: Qemu: display: cirrus: oob access while doing bitblt copy backward mode [rhel-7.3.z])
  - Resolves: bz#1420049
    (system_reset should clear pending request for error (virtio-blk))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.5
changelog:
  - kvm-cirrus-fix-patterncopy-checks.patch [bz#1420490]
  - kvm-Revert-cirrus-allow-zero-source-pitch-in-pattern-fil.patch [bz#1420490]
  - kvm-cirrus-add-blit_is_unsafe-call-to-cirrus_bitblt_cput.patch [bz#1420490]
  - Resolves: bz#1420490
    (EMBARGOED CVE-2017-2620 qemu-kvm: Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo [rhel-7.3.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.6
changelog:
  - kvm-fix-cirrus_vga-fix-OOB-read-case-qemu-Segmentation-f.patch [bz#1430059]
  - kvm-cirrus-vnc-zap-bitblit-support-from-console-code.patch [bz#1430059]
  - kvm-cirrus-add-option-to-disable-blitter.patch [bz#1430059]
  - kvm-cirrus-fix-cirrus_invalidate_region.patch [bz#1430059]
  - kvm-cirrus-stop-passing-around-dst-pointers-in-the-blitt.patch [bz#1430059]
  - kvm-cirrus-stop-passing-around-src-pointers-in-the-blitt.patch [bz#1430059]
  - kvm-cirrus-fix-off-by-one-in-cirrus_bitblt_rop_bkwd_tran.patch [bz#1430059]
  - Resolves: bz#1430059
    (CVE-2016-9603 qemu-kvm: Qemu: cirrus: heap buffer overflow via vnc connection [rhel-7.3.z])


author: Jakub Filak <jfilak@redhat.com> - 2.1.11-31
changelog:
  - save all files changed by the reporter in the reporting GUI
  - Fixes CVE-2015-5302
  - Related: #1266853


author: Matej Habrnal <mhabrnal@redhat.com> - 2.1.11-32
changelog:
  - Save remote name in reported_to
  - Add a function for compressing dumpdirs
  - Introduce global configuration + option for excluded elements
  - attach the URL of the uploaded problem to the relevant report
  - Resolves: #1300780


author: Matej Habrnal <mhabrnal@redhat.com> - 2.1.11-33
changelog:
  - lib: allow report SELinux denial from sealert under common user
  - mailx: stop creating dead.letter on mailx failures
  - mailx: introduce debug parameter -D
  - mailx: mail formatting: add comment right after %oneline
  - mailx: use problem report api to define an emais' content
  - lib: remove unused function make_description_bz
  - rhtsupport: attach all dump dir's element to a new case
  - rhtsupport: add pkg_vendor, reproducer and reproducible to description
  - rhtsupport: use problem report API to create description
  - lib: add Problem Format API
  - augeas: trim spaces before key value
  - rhtsupport: Discourage users from reporting in non Red Hat stuff
  - rhtsupport: Discourage users from opening one-shot crashes
  - report-gtk: Require Reproducer for RHTSupport
  - Add workflow for RHEL anonymous report
  - bugzilla: don't report private problem as comment
  - lib: move CREATE_PRIVATE_TICKET to the global configuration
  - event config: add support for 'restricted access'
  - report-gtk: offer users to create private ticket
  - bugzilla: make the event configurable
  - uploader: /etc/libreport/plugins/upload.conf as default conf file
  - dd: make function uid_in_group() public
  - uploader: add possibility to set SSH keyfiles
  - uploader: move username and password to the advanced options
  - uploader: allow empty username and password
  - curl: add possibility to configure SSH keys
  - Resolves #1289513, #1277849, #1289513, #1279453, #1258482, #1236613, #1261358, #1281312, #1309317, #1264921


author: Matej Habrnal <mhabrnal@redhat.com> - 2.1.11-35
changelog:
  * Thu Sep  1 2016 Matej Habrnal <mhabrnal@redhat.com> - 2.1.11-35.el7.centos
  - Translation updates
  - Related: #1304240


author: Matej Habrnal <mhabrnal@redhat.com> - 2.1.11-36
changelog:
  - introduce 'stop_on_not_reportable' option
  - fix a double free of config at exit in reporter-rhtsupport
  - Related: #1373094, #1257159


author: Ryan McCabe <rmccabe@redhat.com> - 0.3.2-4
changelog:
  - fence-virt: Enable the TCP listener plugin
    Resolves: rhbz#1334170
  - Allow fence_virtd to run as non-root
    Fix use of undefined define
    Resolves: rhbz#1334170


author: Ryan McCabe <rmccabe@redhat.com> - 0.3.2-13
changelog:
  - fence_virtd: Make the libvirt backend survive libvirtd restarts
    Resolves: rhbz#1384181
  - fence_xvm/fence_virt: Add support for the validate-all status
    Resolves: rhbz#1447700


author: Lokesh Mandvekar <lsm5@redhat.com> - 2:1.12.6-60.git85d7426
changelog:
  - Resolves: #1475768
  - built docker @projectatomic/docker-1.12.6 commit 85d7426
  - built docker-novolume-plugin commit 385ec70
  - built rhel-push-plugin commit af9107b
  - built docker-lvm-plugin commit 8647404
  - built docker-runc @projectatomic/docker-1.12.6 commit c5d3116
  - built docker-containerd @projectatomic/docker-1.12.6 commit fa8fb3d


author: Lokesh Mandvekar <lsm5@redhat.com> - 2:1.12.6-63.git6f58874
changelog:
  - built docker @projectatomic/docker-1.12.6 commit 6f58874
  - built docker-novolume-plugin commit 385ec70
  - built rhel-push-plugin commit af9107b
  - built docker-lvm-plugin commit 8647404
  - built docker-runc @projectatomic/docker-1.12.6 commit c5d3116
  - built docker-containerd @projectatomic/docker-1.12.6 commit fa8fb3d


author: Lokesh Mandvekar <lsm5@redhat.com> - 2:1.12.6-64.git61aa37c
changelog:
  - Resolves: #1498553
  - built docker @projectatomic/docker-1.12.6 commit 61aa37c
  - built docker-novolume-plugin commit 385ec70
  - built rhel-push-plugin commit af9107b
  - built docker-lvm-plugin commit 8647404
  - built docker-runc @projectatomic/docker-1.12.6 commit c5d3116
  - built docker-containerd @projectatomic/docker-1.12.6 commit fa8fb3d


author: Lokesh Mandvekar <lsm5@redhat.com> - 2:1.12.6-66.gitd6f7b83
changelog:
  - built docker @projectatomic/docker-1.12.6 commit d6f7b83
  - built docker-novolume-plugin commit 385ec70
  - built rhel-push-plugin commit af9107b
  - built docker-lvm-plugin commit 8647404
  - built docker-runc @projectatomic/docker-1.12.6 commit c5d3116
  - built docker-containerd @projectatomic/docker-1.12.6 commit fa8fb3d


author: Lokesh Mandvekar <lsm5@redhat.com> - 2:1.12.6-67.gitec8512b
changelog:
  - built docker @projectatomic/docker-1.12.6 commit ec8512b
  - built docker-novolume-plugin commit 385ec70
  - built rhel-push-plugin commit af9107b
  - built docker-lvm-plugin commit 8647404
  - built docker-runc @projectatomic/docker-1.12.6 commit c5d3116
  - built docker-containerd @projectatomic/docker-1.12.6 commit fa8fb3d


author: Alex Wood <awood@redhat.com> 1.13.6-1
changelog:
  - 1153375: Support TLSv1.2 and v1.1 by default. (alikins@redhat.com)
  - Set CA PEM files permissions to 644. (awood@redhat.com)


author: William Poteat <wpoteat@redhat.com> 1.13.10-1
changelog:
  - Add custom JSON encoding for set objects. (awood@redhat.com)
  - Update SSL context options to follow the M2Crypto standard idiom.
    (awood@redhat.com)


author: Jakub Čajka <jcajka@redhat.com> - 2.4.2-1
changelog:
  - Resolves: #1088562 - [7.1 FEAT] iprutils package update - ppc64
  - Resolves: #1044679 - iprutils should use systemd
  - Resolves: #1092519 - iprutils - PIE and RELRO check


author: Jiri Pirko <jpirko@redhat.com> - 1.2-1
changelog:
  - Update to 1.2
  - libndp: silently ignore packets with optlen 0 [1016064]
  - libndp: fix processing for larger options [1016064]
  - libndp: do not fail on receiving non-ndp packets [1016078]


author: Jiri Pirko <jpirko@redhat.com> - 1.2-3
changelog:
  - libndp: fix [cppcheck] Undefined behavior: Variable 'buf' is used as parameter and destination in s[n]printf() [1044084]


author: Petr Hracek <phracek> - 4.1.0-0.20.20120314git3c2946
changelog:
  - Multiple packages are installing files under /etc/tmpfiles.d
  - comply http://fedoraproject.org/wiki/Packaging:Guidelines#Tmpfiles.d
  - Resolves: rhbz#1121958


author: Kamil Dudka <kdudka@redhat.com> 7.29.0-37
changelog:
  - fix tight loop in non-blocking TLS handhsake over proxy (#1388162)
  - handle cookies with numerical IPv6 address (#1341503)
  - make libcurl recognize chacha20-poly1305 and SHA384 cipher-suites (#1374740)
  - curl -E: allow to escape ':' in cert nickname (#1376062)
  - run automake in %prep to avoid patching Makefile.in files from now on


author: Kamil Dudka <kdudka@redhat.com> 7.29.0-43
changelog:
  - curl --socks5-{basic,gssapi}: control socks5 auth (#1409208)
  - nss: fix a memory leak when CURLOPT_CRLFILE is used (#1427883)
  - nss: do not leak PKCS #11 slot while loading a key (#1444860)
  - nss: fix a possible use-after-free in SelectClientCert() (#1473158)


author: Petr Oros <poros@redhat.com> - 1:2.12-6
changelog:
  - Add preliminary support for SMBIOS 64-bit entry point (Mark Salter)
  - Add support for DDR4 memmory


author: Petr Oros <poros@redhat.com> - 1:2.12-9
changelog:
  - dmioem: Decode Acer-specific DMI type 170
  - dmioem: Decode HP-specific DMI types 212 and 219
  - dmioem: Decode HP-specific DMI type 233, and refactored 209 and 221 to use a common function
  - Resolves: #1232501


author: Ales Ledvinka <aledvink@redhat.com> - 1.2.5-1
changelog:
  - Updated to freeipmi-1.2.5:
   - Support Supermicro X9SPU-F-O OEM sensors and events.
   - Support Supermicro X9DRI-LN4F+ OEM intepretations (previously
     forgotten).


author: Ales Ledvinka <aledvink@redhat.com> - 1.2.6-1
changelog:
  - Updated to freeipmi-1.2.6
   - Support HP Proliant DL160 G8 OEM sensors.
   - Support Supermicro X9SCM-iiF OEM sensors and events.
   - Support output of temperature sampling period to ipmi-dcmi.
   - Clarify error message when SOL session cannot be stolen in
     ipmiconsole/libipmiconsole.
   - Fix dcmi rolling average time period output error
   - Fix ipmi-dcmi output errors with --get-dcmi-sensor-info.
   - Fix corner case in calculation of confidentiality pad length with
     AES-CBC-128 encryption.  Incorrect pad effects some vendor firmware
     implementations.
   - Send IPMI 2.0 packets differently than IPMI 1.5 packets, as the
     former does not require legacy pad data to be appended to payloads.
   - Fix Intel OEM SEL buffer overflow.
   - Fix out of trunk source build.
   - Support new ipmi_rmcpplus_sendto() and ipmi_rmcpplus_recvfrom()
     functions.
   - Support new HP Proliant DL160 G8 OEM sensor events.


author: Ales Ledvinka <aledvink@redhat.com> - 1.2.6-2
changelog:
  - spec update by Christopher Meng <rpm@cicku.me>
   - hardened build flags should include PIE also for bmc-watchdog.


author: Ales Ledvinka <aledvink@redhat.com> - 1.2.9-1
changelog:
  - Updated to upstream freeipmi-1.2.9
   - Fix threshold output corner case in ipmi-sensors.
   - Fix invalid declaration in libipmimonitoring header.
   - Fix older compiler build problems.
   -
   - Fix portability build bug on ARM systems.
   - Add 'internal IPMI error' troubleshooting to manpages.
   - Fix bmc-info corner case on Bull 510 systems.


author: David Tardon <dtardon@redhat.com> - 0.3.1-5
changelog:
  - Resolves: rhbz#918079 libcmis::sha1() can return digests with fewer
    than 40 hexadecimal digits
  - Resolves: rhbz#918080 restrict redirection protocols


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-0.b12
changelog:
  - Update SystemTap tapsets to version in IcedTea 3.6.0pre02 to fix RH1492139.
  - Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-0.b12
changelog:
  - Correct fix to RH1191652 root patch so existing COMMON_CCXXFLAGS_JDK is not lost.
  - Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-0.b12
changelog:
  - 8188030 is not yet upstream, so it should be listed under upstreamable fixes.
  - 8181055, 8181419, 8145913, 8168318, 8170328 & 8181810 all now in 8u162.
  - Resolves: rhbz#1499207


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.151-1.b12
changelog:
  - repack policies adapted to new counts and paths
  - note that also c-j-c is needed to make this apply in next update
  - Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-1.b12
changelog:
  - Reverting to java-1.7.0-openjdk on AArch64 as rhel-7.4-z-java-unsafe-candidate using wrong suffix.
  - Resolves: rhbz#1499207


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.151-5.b12
changelog:
  - Backport "8180048: Interned string and symbol table leak memory during parallel unlinking" (gnu_andrew)
  - Resolves: rhbz#1515212


author: Ondrej Kozina <okozina@redhat.com> - 1.6.3-1
changelog:
  - Update to cryptsetup 1.6.3.
  - various fixes related to block devices with 4KiB sectors
  - enable reencryption using specific keyslot (dracut module)
  - fix failure in reading last keyslot from external LUKS header
  - update FIPS POST to be complaint with actual requirements
  - fix hash limiting if parameter is not numeric
  - Resolves: #1028362 #1029032 #1029406 #1030288 #1034388 #1038097


author: Ondrej Kozina <okozina@redhat.com> - 1.6.7-1
changelog:
  - Update to cryptsetup 1.6.7.
  - patch: avoid use of kernel crypto API socket which is known
    to be broken in RHEL7.0 kernel (7.1+ is fine).
  - Resolves: #1206170


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-21
changelog:
  - release 1.3.4.0-21
  - Resolves: bug 1278730 - SimplePagedResults -- abandon could happen between the abandon check and sending results -- Fixing a regression introduced in 1.3.4.0-20 (DS 48338)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-22
changelog:
  - release 1.3.4.0-22
  - Resolves: bug 1290725 - SimplePagedResults -- in the search error case, simple paged results slot was not released. (DS 48375)
  - Resolves: bug 1290726 - The 'eq' index does not get updated properly when deleting and re-adding attributes in the same modify operation (DS 48370)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-23
changelog:
  - release 1.3.4.0-23
  - Resolves: bug 1295684 - many attrlist_replace errors in connection with cleanallruv (DS 48283)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-24
changelog:
  - release 1.3.4.0-24
  - Resolves: bug 1298105 - 389-ds hanging after a few minutes of operation (DS 48406)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-25
changelog:
  - release 1.3.4.0-25
  - Resolves: bug 1299757 - CVE-2016-0741 389-ds-base: Worker threads do not detect abnormally closed connections causing DoS


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-27
changelog:
  - release 1.3.4.0-27
  - Resolves: bug 1309963 - keep alive entries can break replication (DS 48445)
  - Resolves: bug 1309964 - Crash in slapi_get_object_extension (DS 48536)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-28
changelog:
  - release 1.3.4.0-28
  - Resolves: bug 1315181 - change severity of some messages related to "keep alive" entries (DS 48420)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-29
changelog:
  - release 1.3.4.0-29
  - Resolves: bug 1316552 - License tag does not match actual license of code (DS 48757)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.4.0-30
changelog:
  - release 1.3.4.0-30
  - Resolves: bug 1321891 - DES to AES password conversion fails if a backend is empty (DS 48777)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-19
changelog:
  - don't generate weak control key for resolver (CVE-2014-9293)
  - don't generate weak MD5 keys in ntp-keygen (CVE-2014-9294)
  - fix buffer overflows via specially-crafted packets (CVE-2014-9295)
  - don't mobilize passive association when authentication fails (CVE-2014-9296)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-20
changelog:
  - validate lengths of values in extension fields (CVE-2014-9297)
  - drop packets with spoofed source address ::1 (CVE-2014-9298)
  - reject packets without MAC when authentication is enabled (CVE-2015-1798)
  - protect symmetric associations with symmetric key against DoS attack (CVE-2015-1799)
  - fix generation of MD5 keys with ntp-keygen on big-endian systems (CVE-2015-3405)
  - add option to set Differentiated Services Code Point (DSCP) (#1202828)
  - add nanosecond support to SHM refclock (#1117702)
  - allow creating all SHM segments with owner-only access (#1122012)
  - allow different thresholds for forward and backward step (#1193154)
  - allow symmetric keys up to 32 bytes again (#1191111)
  - don't step clock for leap second with -x option (#1191122)
  - don't drop packets with source port below 123 (#1171640)
  - retry joining multicast groups (#1207014)
  - increase memlock limit again (#1053569)
  - warn when monitor can't be disabled due to limited restrict (#1191108)
  - use larger RSA exponent in ntp-keygen (#1191116)
  - fix crash in ntpq mreadvar command (#1180721)
  - move sntp kod database to allow SELinux labeling (#1082934)
  - fix typos in ntpd man page (#1195211)
  - improve documentation of restrict command (#1213953)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-22
changelog:
  - check origin timestamp before accepting KoD RATE packet (CVE-2015-7704)
  - allow only one step larger than panic threshold with -g (CVE-2015-5300)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-24
changelog:
  - fix crash with invalid logconfig command (CVE-2015-5194)
  - fix crash when referencing disabled statistic type (CVE-2015-5195)
  - don't hang in sntp with crafted reply (CVE-2015-5219)
  - don't crash with crafted autokey packet (CVE-2015-7691, CVE-2015-7692,
    CVE-2015-7702)
  - fix memory leak with autokey (CVE-2015-7701)
  - don't allow setting driftfile and pidfile remotely (CVE-2015-7703)
  - don't crash in ntpq with crafted packet (CVE-2015-7852)
  - check key ID in packets authenticated with symmetric key (CVE-2015-7974)
  - fix crash with reslist command (CVE-2015-7977, CVE-2015-7978)
  - don't allow spoofed packets to demobilize associations (CVE-2015-7979,
    CVE-2016-1547)
  - don't accept server/peer packets with zero origin timestamp (CVE-2015-8138)
  - fix infinite loop in ntpq/ntpdc (CVE-2015-8158)
  - fix resetting of leap status (#1242553)
  - extend rawstats log (#1242877)
  - report clock state changes related to leap seconds (#1242935)
  - allow -4/-6 on restrict lines with mask (#1304492)
  - explain synchronised state in ntpstat man page (#1309594)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-25
changelog:
  - don't allow spoofed packet to enable symmetric interleaved mode
    (CVE-2016-1548)
  - check mode of new source in config command (CVE-2016-2518)
  - make MAC check resilient against timing attack (CVE-2016-1550)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-25.el7_3.1
changelog:
  - don't limit rate of packets from sources (CVE-2016-7426)
  - don't change interface from received packets (CVE-2016-7429)
  - fix calculation of root distance again (CVE-2016-7433)
  - require authentication for trap commands (CVE-2016-9310)
  - fix crash when reporting peer event to trappers (CVE-2016-9311)


author: Jon Ciesla <limburgher@gmail.com> - 4.5-5
changelog:
  - Add systemd unit file, BZ 916628.
  - Drop spurious post scripts.
  - Move eveything but man pages and license files top -docs.


author: Petr Menšík <pemensik@redhat.com> - 32:9.9.4-59
changelog:
  - Support for additional signing algorithms in rndc (#1501531)
  - New autogenerated rndc keys will use hmac-sha256 algorithm


author: Jiri Popelka <jpopelka@redhat.com> - 2.0-0.13.20131004git
changelog:
  - latest snapshot (#1013530)
  - remove %ifarch alpha condition from %prep
  - improve sctp-statistics.patch (#982638#c10)


author: Michal Ruprich <mruprich@redhat.com> - 2.0-0.18.20131004git
changelog:
  - Resolves: #1063913 - netstat doesn't list sctp servers in -A mode
  - Resolves: #1257549 - netstat tool does not throw correct exit code on wrong parameter
  - Resolves: #1392910 - ifconfig inaccurately rounds exabytes


author: Daiki Ueno <dueno@redhat.com> - 3.28.2-1.0
changelog:
  - Rebase to NSS 3.28.2
  - Remove NSS_ENABLE_ECC and NSS_ECC_MORE_THAN_SUITE_B setting, which
    is no-op now
  - Enable gtests when requested
  - Remove nss-646045.patch and fix-nss-test-filtering.patch, which are
    not necessary
  - Remove sslauth-no-v2.patch and
    nss-sslstress-txt-ssl3-lower-value-in-range.patch, as SSLv2 is
    already disabled in upstream
  - Remove ssl-server-min-key-sizes.patch, as we decided to support DH
    key size greater than 1023 bits
  - Remove local patches for SHA384 cipher suites (now supported in
    upstream): dhe-sha384-dss-support.patch,
    client_auth_for_sha384_prf_support.patch,
    nss-fix-client-auth-init-hashes.patch, nss-map-oid-to-hashalg.patch,
    nss-enable-384-cipher-tests.patch, nss-fix-signature-and-hash.patch,
    fix-allowed-sig-alg.patch, tests-extra.patch
  - Remove upstreamed patches: rh1238290.patch,
    fix-reuse-of-session-cache-entry.patch, flexible-certverify.patch,
    call-restartmodules-in-nssinit.patch


author: Daiki Ueno <dueno@redhat.com> - 3.28.2-1.2
changelog:
  - Reorder cipher suites for compatibility
  - Re-enable BUILD_OPT, mistakenly disabled in the previous build


author: Daiki Ueno <dueno@redhat.com> - 3.28.2-1.4
changelog:
  - Add patch to fix bash syntax error in tests/ssl.sh
  - Build with support for SSLKEYLOGFILE
  - Disable the use of RSA-PSS with SSL/TLS


author: Daiki Ueno <dueno@redhat.com> - 3.28.2-1.6
changelog:
  - Restore ssl-server-min-key-sizes.patch
  - Disable TLS_ECDHE_{RSA,ECDSA}_WITH_AES_128_CBC_SHA256 by default
  - Enable 4 AES_256_GCM_SHA384 ciphersuites, enabled by the downstream
    patch in the previous release
  - Fix crash with tstclnt -W


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.54-6
changelog:
  - delay sending responses from compat tree after map cache search
  - Resolves: #1273587
  - fix processing of ID views
  - Resolves: #1277576, #1265465


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.56.0-1
changelog:
  - New upstream release:
    - support updating passwords for the users from the primary tree
    - populate map cache in a separate thread to avoid blocking the DS
  - Resolves: #1292148


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.56.0-2
changelog:
  - Fix reported coverity issues
  - Make sure slapi-nis continue to work with SSSD 1.14 when default domain is defined
  - Resolves: #1292148


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.56.0-4
changelog:
  - Fixed: UPN-based search for AD users does not match an entry in slapi-nis map cache
  - Resolves: #1361123
  - Fixed: slapi-nis plugin modifies DS data
  - Resolves: #1360245


author: Tom Lane <tgl@redhat.com> 09.01.0200-1
changelog:
  - Update to version 09.01.0200
  - Minor specfile cleanup per suggestions from Tom Callaway
  Related: #845110


author: Stef Walter <stefw@redhat.com> - 0.77-1
changelog:
  - Work better with multipath storage
  - Deletion of kubernetes objects
  - Cleaner URLs in the bookmark bar
  - Show a warning when adding too many machines
  - Make authentication work when embedding Cockpit
  - Complete componentizing Cockpit


author: Duc Dang <dhdang@apm.com> [4.5.0-17.el7]
changelog:
  - Integrate upstream fix to make X-Gene HWmon access mailbox as RAM and avoid eror when built as module
  - Integrated posted patch to support SMBus block read/write for Designware I2C
  - Integrate upstream fix for GIC default PCI IRQ polarity
  - Integrate upstream updates for X-Gene Enet driver
  - Avoid dma_buffer overrun for SlimPRO I2C driver 
  - Add X-Gene SoC PMU support
  - Add X-Gene HWMon support
  - mailbox: PCC: Fix return value of pcc_mbox_request_channel
  - Add cpufreq CPPC bug fixes


author: Duc Dang <dhdang@apm.com> [4.5.0-18.el7]
changelog:
  - Integrate upstream fix for a lockdep warning when request PCC channel
  - Backport upstream patches to support fwupdate
  - Integrate upstream patch to add interrupt support for X-Gene Standby GPIO


author: Jim Perrin <jperrin@centos.org> [4.5.0-21.el7]
changelog:
  - Fix Cavium retrain link patch
  - Apply APM patches 1029, 1030
  - Add CONFIG_LEDS_PCA955X and CONFIG_LEDS_PCA963X


author: Lubos Kardos <lkardos@redhat.com> - 20130529-10
changelog:
  - Allow to use vendor prefix in packages names
  - Include %nfsmountable macro into scl's rpm macros file


author: Jan Zeleny <jzeleny@redhat.com> - 20130529-13
changelog:
  - bump the version to get in sync with 7.1 branch
  - Reflect the state of %nfsmountable macro in collections' rpm macro files
  - escape all the % chars in changelog


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-49
changelog:
  - Fix ssl module's parsing of GEN_RID subject alternative name fields in X.509 certs
  Resolves: rhbz#1364444


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-52
changelog:
  - Workaround Python's threading library issue with non returning wait, for signals with timeout
  Resolves: rhbz#1368076


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-57
changelog:
  - Fix implicit declaration warnings of functions added by patches 147 and 265
  Resolves: rhbz#1441237


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-102
changelog:
  - Add 0207-UP-add-libmpathcmd.patch
    * New shared library, libmpathcmd, that sends and receives messages from
      multipathd. device-mapper-multipath now uses this library internally.
  - Add 0208-UPBZ-1430097-multipathd-IPC-changes.patch
    * validation that modifying commands are coming from root.
  - Add 0209-UPBZ-1430097-multipath-C-API.patch
    * New shared library. libdmmp, that presents the information from multipathd
      in a structured manner to make it easier for callers to use
  - Add 0210-RH-fix-uninstall.patch
    * Minor compilation fixes
  - Make 3 new subpackages
    * device-mapper-multipath-devel, libdmmp, and libdmmp-devel. libmpathcmd
      and libmpathprio are in device-mapper-multipath-libs and
      device-mapper-multipath-devel. libdmmp is in its own subpackages
  - Move libmpathprio devel files to device-mapper-multipath-devel
  - Resolves: bz #1430097


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-104
changelog:
  - Change _pkgconfdir from /usr/share/pkgconfig to /usr/lib/pkgconfig
  - Modify 0209-UPBZ-1430097-multipath-C-API.patch
    * change _pkgconfdir and fixed double-closing fd
  - Add 0211-RH-strlen-fix.patch
    * checks that variables are not NULL before passing them to strlen
  - Related: bz #1430097


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-107
changelog:
  - Modify 0197-RHBZ-1394059-max-sectors-kb.patch
    * Make multipath only change max_sectors_kb on creates. On reloads, it
      just makes sure the new path matches the multipath device.
  - Refresh 0198-RHBZ-1372032-detect-path-checker.patch
  - Refresh 0201-RHBZ-1403552-silence-warning.patch
  - Refresh 0206-RHBZ-1239173-pt2-no-paths.patch
  - Refresh 0207-UP-add-libmpathcmd.patch
  - Refresh 0212-RHBZ-1431562-for-read-only.patch
  - Resolves: bz #1394059


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-109
changelog:
  - Add 0214-RHBZ-1392115-set-paths-not-ready.patch
    * Set ENV{SYSTEMD_READY}="0" on multipath path devices
  - Resolves: bz #1392115


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-110
changelog:
  - Add 0215-RHBZ-1444194-fix-check-partitions.patch
    * make sure kpartx partions match the correct device
  - Add 0216-RHBZ-1448562-fix-reserve.patch
    * don't join threads that haven't been created
  - Add 0217-RHBZ-1437329-blacklist-oracle-devs.patch
    * blacklist db2.* devices
  - Add 0218-RHBZ-1448576-3PAR-config.patch
  - Resolves: bz #1444194, #1448562, #1437329, #1448576


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-111
changelog:
  - Remove 0217-RHBZ-1437329-blacklist-oracle-devs.patch
    * Incorrect change, and the bug is already fixed.
  - Move 0218-RHBZ-1448576-3PAR-config.patch to
    0217-RHBZ-1448576-3PAR-config.patch
  - Resolves: bz #1448576


author: James Antill <james@fedoraproject.org> - 5.0.2-7
changelog:
  - Remove unneeded build require on tetex.
  - Resolves: rhbz#1037828
  - Depend on hostname package instead of /bin/hostname.


author: Miroslav Lichvar <mlichvar@redhat.com> - 1.2-0.17.rc1
changelog:
  - update config.guess and config.sub for aarch64 (#926562)
  - make some dependencies arch-specific
  - remove obsolete macros


author: Dan Walsh <dwalsh@redhat.com> - 2:2.2.0-2.git0a4dcd6
changelog:
  * Thu Sep 21 2017 Dan Walsh <dwalsh@redhat.com> - 2:2.2.0-2.git0a4dcd6
  - Add support for multiple configuration files.
    oci-umount will still read config file /etc/oci-umount.conf if it
    exists, but will also read config files in /usr/share/oci-umount/oci-umount.d
    and config files in /etc/oci-umount/oci-umount.d.  If the same file name exists
    in both directories, then oci-umount will only use the content in /ect/oci-umount/oci-umount.d.
  - Make Logs less noisy
  - Improve logs output, adding containier id, and needed file information
  - Add support for specifying submounts PATH/* will unmount all mountpoints 
    under PATH in a container
  - Support for oci configuration files to specify when to run the plugin


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.77-0.b03
changelog:
  - Remove what remains of the SunEC sources in the remove-intree-libraries script.
  - Resolves: rhbz#1320664


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-0.b14
changelog:
  - Enable a full bootstrap on JIT archs. Full build held back by Zero archs anyway.
  - Resolves: rhbz#1325422


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-0.b14
changelog:
  - Add 8132051 port to Zero.
  - Turn on bootstrap build for all to ensure we are now good to go.
  - Resolves: rhbz#1325422


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-0.b14
changelog:
  - Add additional fix to Zero patch to properly handle result on 64-bit big-endian
  - Resolves: rhbz#1325422


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2:2.10.0-2
changelog:
  - Fixed systemd error message regarding chroot-update, patch provided
    by John Heidemann <johnh@isi.edu>
    Resolves: rhbz#917463


author: Petr Lautrbach <plautrba@redhat.com> - 3.2.28-1
changelog:
  - Fix sealert message for capability2
  - Spelling fixes
  - sealert - provide a better error message when SELinux is disabled (#1420084)
  - Fix report problem summary string (#1343397)
  - Update setroubleshootd.8 (#1348140)


author: Vit Mojzis <vmojzis@redhat.com> - 3.2.29-1
changelog:
  - Fix sealert message for process2 (#1507909)
  - Remove additional "If " string from plugin messages (#1177347)
  - Fix semi-translated messages (#1332126)
  - Make labels on GtkButtons translatable
  - Set translation domain for Gtk.Builder() object to have strings correctly translated (#1370100)
  - Do not split If sentences to framework and plugins (#1177347)
  - Don't stop when the plugin directory is empty
  - Change "check_for_man" return value upon failure
  - Fix "plugin details" message content
  - Add "init_args" function to Plugin 
  - Fix sealert crash when setroubleshootd fails to start (#1405003)


author: Fabiano Fidêncio <fidencio@redhat.com> - 2.0-4
changelog:
  - set keepAlive on libvirt connection
    Resolves: rhbz#1164052
  - Rebase to 2.0: Add a missing bug
    Resolves: rhbz#1228759


author: Fabiano Fidêncio <fidencio@redhat.com> - 2.0-5
changelog:
  - Allow to resize window to any size
    Resolves: rhbz#1242509
  - Upate virt-viewer-events.c to match libvirt-glib's event file
    Resolves: rhbz#1243228


author: Pavel Grunt <pgrunt@redhat.com> - 2.0-7
changelog:
  - Fix for extra monitors on start up
    Resolves: rhbz#1153372
  - Add support for proxy-url libgovirt property
    Resolves: rhbz#1292761
  - Show correct name and uuid for vnc guests
    Resolves: rhbz#1293879
  - Stop polling after reconnecting to libvirtd
    Resolves: rhbz#1271519
  - Fix crash when disabling the last display
    Resolves: rhbz#1294938
  - Fix monitor mapping
    Resolves: rhbz#1267184
  - Fix for usb-filter ignored by the vv-file
    Resolves: rhbz#1309634
  - Show only attached CDs in the foreign menu
    Resolves: rhbz#1313371
  - Set useful dimensions of virt-viewer window
    Resolves: rhbz#1297260


author: Pavel Grunt <pgrunt@redhat.com> - 2.0-8
changelog:
  - Utilize SSO to authenticate against oVirt engine for foreign menu support
    Resolves: rhbz#1286696
  - monitor-config: do it all or nothing
    Resolves: rhbz#1339493
  - Return early on empty monitor mapping
    Resolves: rhbz#1339491
  - Disable default vnc grab sequence
    Resolves: rhbz#1339575
  - Avoid crashing when using invalid video config
    Resolves: rhbz#1250820
  - Add missing access keys
    Resolves: rhbz#1332545
  - Add progress bar for file transfer
    Resolves: rhbz#1324521
  - Improve logs when parsing hotkeys
    Resolves: rhbz#1339572


author: Pavel Grunt <pgrunt@redhat.com> - 2.0-10
changelog:
  - Avoid crashing when using invalid video config
    Resolves: rhbz#1250820
  - Add mnemonics for remote-viewer connection dialog
    Resolves: rhbz#1351487


author: Lubomir Rintel <lrintel@redhat.com> - 1.2-5
changelog:
  - libndp: validate the IPv6 hop limit [CVE-2016-3698]
  - libndb: reject redirect and router advertisements from non-link-local [CVE-2016-3698]


author: Robert Scheck <robert@fedoraproject.org> 0.46-1
changelog:
  - Upgrade to 0.46 (#525933, #628893)
  - Fixed race in populating builtin timezone components (#637150)
  - Fixed wrong ICAL_ERRORS_ARE_FATAL preprocessor check (#575715)


author: Dave Anderson <anderson@redhat.com> - 2.0-3
changelog:
  - Replace obsolete _init() and _fini() functions.
  - Fix possible segmentation violation on calloc() failure.
  - Initialize trace_dat to avoid compiler warning.


author: Dave Anderson <anderson@redhat.com> - 2.0.12
changelog:
  - Differentiate ppc64 .ring_buffer_read text symbol from ring_buffer_read data symbol
  - Fix for ring_buffer_per_cpu.nr_pages size change on big-endian systems 
  - Fix for Linux 4.7 change to the TRACE_EVENT_FL_TRACEPOINT flag
    Resolves: rhbz#1441914
    Resolves: rhbz#1440726


author: Dave Anderson <anderson@redhat.com> - 2.0.13
changelog:
  - Build requires crash-devel-7.2.0-2 and usage requires crash-7.2.0-2
    because of load_module structure change.
    Resolves: rhbz#1520825


author: Jiri Popelka <jpopelka@redhat.com> - 3.13.6-1
changelog:
  - 3.13.6
  - hplip-ipp-accessors.patch merged upstream
  - /etc/cron.daily/hplip_cron -> /usr/share/hplip/hplip_clean.sh


author: Tim Waugh <twaugh@redhat.com> - 3.13.7-2
changelog:
  - Applied patch to avoid unix-process authorization subject when using
    polkit as it is racy (CVE-2013-4325).


author: Rob Crittenden <rcritten@redhat.com> - 1.0.14-6
changelog:
  - Check the NSS certificate database directory for read permissions
    by the Apache user. (#1312583)


author: Rob Crittenden <rcritten@redhat.com> - 1.0.14-8
changelog:
  - Fail start start when there are invalid Protocols defined (#1389114)
  - Handle group membership when testing NSS database filesystem
    permissions (#1395300)
  - Add OCSP cache tuning directives (#1392582) 
  - Don't share mod_nss NSS database with nss_pcache (#1382102)


author: Rob Crittenden <rcritten@redhat.com> - 1.0.14-9
changelog:
  - Update nss_pcache.8 to drop directory and prefix options (#1382102)

  - Don't share mod_nss NSS database with nss_pcache (#1382102)


author: Rob Crittenden <rcritten@redhat.com> - 1.0.14-12
changelog:
  - Correct URL and Source entries to point to pagure.io (#1502362)
  - Remove deprecated NSSSessionCacheTimeout from default config (#1257662)


author: Lokesh Mandvekar <lsm5@redhat.com> - 2:1.13.1-55.rhel75.git774336d
changelog:
  - Re: #1540540
  - built docker @projectatomic/docker-1.13.1-rhel commit 774336d
  - built docker-novolume-plugin commit 385ec70
  - built rhel-push-plugin commit af9107b
  - built docker-lvm-plugin commit 8647404
  - built docker-runc @projectatomic/docker-1.13.1-rhel commit e9c345b
  - built docker-containerd @projectatomic/docker-1.13.1-rhel commit 296f1f8
  - built docker-init commit 5b117de
  - built libnetwork commit 14db3c4


author: Lokesh Mandvekar <lsm5@redhat.com> - 2:1.13.1-57.gitaacbc4b
changelog:
  - Resolves: #1489517
  - built docker @projectatomic/docker-1.13.1-rhel commit aacbc4b
  - built docker-novolume-plugin commit 385ec70
  - built rhel-push-plugin commit af9107b
  - built docker-lvm-plugin commit 8647404
  - built docker-runc @projectatomic/docker-1.13.1-rhel commit e9c345b
  - built docker-containerd @projectatomic/docker-1.13.1-rhel commit 296f1f8
  - built docker-init commit 5b117de
  - built libnetwork commit 8892d75


author: Lokesh Mandvekar <lsm5@redhat.com> - 2:1.13.1-58.git87f2fab
changelog:
  - built docker @projectatomic/docker-1.13.1-rhel commit 87f2fab
  - built docker-novolume-plugin commit 385ec70
  - built rhel-push-plugin commit af9107b
  - built docker-lvm-plugin commit 8647404
  - built docker-runc @projectatomic/docker-1.13.1-rhel commit e9c345b
  - built docker-containerd @projectatomic/docker-1.13.1-rhel commit 296f1f8
  - built oci-umount commit 
  - built docker-init commit 5b117de
  - built libnetwork commit 2bf6330


author: Daniel J Walsh <dwalsh@redhat.com> - 2:1.13.1-59.git2d99c6f
changelog:
  - built docker @projectatomic/docker-1.13.1-rhel commit 2d99c6f
  - built docker-novolume-plugin commit 385ec70
  - built rhel-push-plugin commit af9107b
  - built docker-lvm-plugin commit 8647404
  - built docker-runc @projectatomic/docker-1.13.1-rhel commit e9c345b
  - built docker-containerd @projectatomic/docker-1.13.1-rhel commit 296f1f8
  - built oci-umount commit 
  - built docker-init commit 5b117de
  - built libnetwork commit 2bf6330


author: Lokesh Mandvekar <lsm5@redhat.com> - 2:1.13.1-62.gitc6c9b51
changelog:
  - built docker @projectatomic/docker-1.13.1-rhel commit c6c9b51
  - built docker-novolume-plugin commit 385ec70
  - built rhel-push-plugin commit af9107b
  - built docker-lvm-plugin commit 04caa55
  - built docker-runc @projectatomic/docker-1.13.1-rhel commit e9c345b
  - built docker-containerd @projectatomic/docker-1.13.1-rhel commit 296f1f8
  - built oci-umount commit 
  - built docker-init commit 5b117de
  - built libnetwork commit 5c1218c


author: Jeff Layton <jlayton@redhat.com> 6.2-3
changelog:
  - fixes for bugs reported by coverity:
  - update bad bit shift patch with one that patches getcifsacl.c too
  - remove some dead code from getcifsacl.c, asn1.c, and data_blob.c
  - fix bad handling of allocated memory in del_mtab in mount.cifs.c


author: Sachin Prabhu <sprabhu@redhat.com> - 6.2-8
changelog:
  - Prevent unnecessary linking of libwbclient
  - Uppercase orig_dev on 2nd try at mounting
  - Include paths.h in mtab.c
  - Clarify use of backupuid/backupgid in manpage
  - Ignore x-* mount options


author: Sachin Prabhu <sprabhu@redhat.com> - 6.2-10
changelog:
  - aclocal: fix typo in idmap.m4
  - mount.cifs: Removed extra comma in front of domain
  - mount.cifs: Accept empty domains on the command line
  - mount.cifs: Fixed command line parsing and aligned with kernel
  - mount.cifs: Remove unneeded stdbool header include
  - manpage: document mfsymlinks in the mount.cifs man page


author: Dan Walsh <dwalsh@redhat.com> 0.14-1
changelog:
  - If commonOpts do not exist, we should return rather then segfault
  - Display full error string instead of just status
  - Implement --volume and --shm-size for bud and from
  - Fix secrets patch for buildah bud
  - Fixes the naming issue of blobs and config for the dir transport by removing the .tar extension


author: Dan Walsh <dwalsh@redhat.com> 0.16-1
changelog:
  -   Add support for shell
  -   Vendor in latest containers/image
  -    	 docker-archive generates docker legacy compatible images
  -	 Do not create $DiffID subdirectories for layers with no configs
  - 	 Ensure the layer IDs in legacy docker/tarfile metadata are unique
  -	 docker-archive: repeated layers are symlinked in the tar file
  -	 sysregistries: remove all trailing slashes
  -	 Improve docker/* error messages
  -	 Fix failure to make auth directory
  -	 Create a new slice in Schema1.UpdateLayerInfos
  -	 Drop unused storageImageDestination.{image,systemContext}
  -	 Load a *storage.Image only once in storageImageSource
  -	 Support gzip for docker-archive files
  -	 Remove .tar extension from blob and config file names
  -	 ostree, src: support copy of compressed layers
  -	 ostree: re-pull layer if it misses uncompressed_digest|uncompressed_size
  -	 image: fix docker schema v1 -> OCI conversion
  -	 Add /etc/containers/certs.d as default certs directory
  -  Change image time to locale, add troubleshooting.md, add logo to other mds
  -   Allow --cmd parameter to have commands as values
  -   Document the mounts.conf file
  -   Fix man pages to format correctly
  -   buildah from now supports pulling images using the following transports:
  -   docker-archive, oci-archive, and dir.
  -   If the user overrides the storage driver, the options should be dropped
  -   Show Config/Manifest as JSON string in inspect when format is not set
  -   Adds feature to pull compressed docker-archive files


author: Dan Walsh <dwalsh@redhat.com> 1.0-1
changelog:
  - Remove buildah run cmd and entrypoint execution
  - Add Files section with registries.conf to pertinent man pages
  - Force "localhost" as a default registry
  - Add --compress, --rm, --squash flags as a noop for bud
  - Add FIPS mode secret to buildah run and bud
  - Add config --comment/--domainname/--history-comment/--hostname
  - Add support for --iidfile to bud and commit
  - Add /bin/sh -c to entrypoint in config
  - buildah images and podman images are listing different sizes
  - Remove tarball as an option from buildah push --help
  - Update entrypoint behaviour to match docker
  - Display imageId after commit
  - config: add support for StopSignal
  - Allow referencing stages as index and names
  - Add multi-stage builds support
  - Vendor in latest imagebuilder, to get mixed case AS support
  - Allow umount to have multi-containers
  - Update buildah push doc
  - buildah bud walks symlinks
  - Imagename is required for commit atm, update manpage


author: Dan Walsh <dwalsh@redhat.com> 1.1-1
changelog:
  - Drop capabilities if running container processes as non root
  - Print Warning message if cmd will not be used based on entrypoint
  - Update 01-intro.md
  - Shouldn't add insecure registries to list of search registries
  - Report errors on bad transports specification when pushing images
  - Move parsing code out of common for namespaces and into pkg/parse.go
  - Add disable-content-trust noop flag to bud
  - Change freenode chan to buildah
  - runCopyStdio(): don't close stdin unless we saw POLLHUP
  - Add registry errors for pull
  - runCollectOutput(): just read until the pipes are closed on us
  - Run(): provide redirection for stdio
  - rmi, rm: add test
  - add mount test
  - Add parameter judgment for commands that do not require parameters
  - Add context dir to bud command in baseline test
  - run.bats: check that we can run with symlinks in the bundle path
  - Give better messages to users when image can not be found
  - use absolute path for bundlePath
  - Add environment variable to buildah --format
  - rm: add validation to args and all option
  - Accept json array input for config entrypoint
  - Run(): process RunOptions.Mounts, and its flags
  - Run(): only collect error output from stdio pipes if we created some
  - Add OnBuild support for Dockerfiles
  - Quick fix on demo readme
  - run: fix validate flags
  - buildah bud should require a context directory or URL
  - Touchup tutorial for run changes
  - Validate common bud and from flags
  - images: Error if the specified imagename does not exist
  - inspect: Increase err judgments to avoid panic
  - add test to inspect
  - buildah bud picks up ENV from base image
  - Extend the amount of time travis_wait should wait
  - Add a make target for Installing CNI plugins
  - Add tests for namespace control flags
  - copy.bats: check ownerships in the container
  - Fix SELinux test errors when SELinux is enabled
  - Add example CNI configurations
  - Run: set supplemental group IDs
  - Run: use a temporary mount namespace
  - Use CNI to configure container networks
  - add/secrets/commit: Use mappings when setting permissions on added content
  - Add CLI options for specifying namespace and cgroup setup
  - Always set mappings when using user namespaces
  - Run(): break out creation of stdio pipe descriptors
  - Read UID/GID mapping information from containers and images
  - Additional bud CI tests
  - Run integration tests under travis_wait in Travis
  - build-using-dockerfile: add --annotation
  - Implement --squash for build-using-dockerfile and commit
  - Vendor in latest container/storage for devicemapper support
  - add test to inspect
  - Vendor github.com/onsi/ginkgo and github.com/onsi/gomega
  - Test with Go 1.10, too
  - Add console syntax highlighting to troubleshooting page
  - bud.bats: print "$output" before checking its contents
  - Manage "Run" containers more closely
  - Break Builder.Run()'s "run runc" bits out
  - util.ResolveName(): handle completion for tagged/digested image names
  - Handle /etc/hosts and /etc/resolv.conf properly in container
  - Documentation fixes
  - Make it easier to parse our temporary directory as an image name
  - Makefile: list new pkg/ subdirectoris as dependencies for buildah
  - containerImageSource: return more-correct errors
  - API cleanup: PullPolicy and TerminalPolicy should be types
  - Make "run --terminal" and "run -t" aliases for "run --tty"
  - Vendor github.com/containernetworking/cni v0.6.0
  - Update github.com/containers/storage
  - Update github.com/projectatomic/libpod
  - Add support for buildah bud --label
  - buildah push/from can push and pull images with no reference
  - Vendor in latest containers/image
  - Update gometalinter to fix install.tools error
  - Update troubleshooting with new run workaround
  - Added a bud demo and tidied up
  - Attempt to download file from url, if fails assume Dockerfile
  - Add buildah bud CI tests for ENV variables
  - Re-enable rpm .spec version check and new commit test
  - Update buildah scratch demo to support el7
  - Added Docker compatibility demo
  - Update to F28 and new run format in baseline test
  - Touchup man page short options across man pages
  - Added demo dir and a demo. chged distrorlease
  - builder-inspect: fix format option
  - Add cpu-shares short flag (-c) and cpu-shares CI tests
  - Minor fixes to formatting in rpm spec changelog
  - Fix rpm .spec changelog formatting
  - CI tests and minor fix for cache related noop flags
  - buildah-from: add effective value to mount propagation


author: Matej Habrnal <mhabrnal@redhat.com> - 2.1.11-46
changelog:
  - remove not implemented option AttemptHardlink in vmcore.conf
  - introduce unsafe reporting for not-reporable problems
  - rewrite skip_pfx() function to work with journal msgs
  - don't expect kernel's version '2.6.*' or '3.*.*'
  - Related: #1416586, #1257159, #1328264, #1378469


author: Martin Kutlak <mkutlak@redhat.com> - 2.1.11-49
changelog:
  - Translation updates
  - Stop creating uReports for unpackaged executables
  - koops: add detailed taint flag description for kernel oopses
  - koops: fix kernel oops and fatal MCE recognition
  - python: provide more information about Python exceptions
  - vmcore: fix replication of vmcore files
  - Related: #1271213, #1460224, #1374648, #1361116, #1228344,
  - Related: #1395285, #1214730, #1446410, #1319828, #1501718


author: CentOS Sources <bugs@centos.org> - 2.1.11-50.el7.centos
changelog:
  - Drop RHTS hint
  -  Change by David Mansfield <david@orthanc.cobite.com>
  -  Per http://bugs.centos.org/view.php?id=7192
  - Remove cli suggestion text patch
  - set URL to retrace server
  - update to not run sosreport
  -  Per http://bugs.centos.org/view.php?id=7913


author: Ray Strode <rstrode@redhat.com> - 3.22.3-4
changelog:
  - Drop reference to wayland in config file
  - use autosetup to simplify spec maintenance
    Related: #1386862


author: Ray Strode <rstrode@redhat.com> 3.22.3-8
changelog:
  - Reap transient login screens when they are no longer needed
  - Jump to login screen if we end up on a blank VT
    Resolves: #1301028


author: Ray Strode <rstrode@redhat.com> - 3.22.3-10
changelog:
  - Add patches to try to maintain some semblance of compatibility
    when live upgrading between 7.3 and 7.4
    Related: #1448786


author: Jan Safranek <jsafrane@redhat.com> - 1:5.7.2-17
changelog:
  - fixed various error codes in Python module (#1064338)
  - fixed net-snmp-config.h header file (#1064437)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.7.2-19
changelog:
  - Fixed not-increasing OIDs in IP-FORWARD-MIB::ipCidrRouteTable (#1172013)
  - Fixed HOST-RESOURCES-MIB::hrProcessorTable on machines with >100 CPUs
    (#1070076)
  - skip 'mvfs' (ClearCase) when skipNFSInHostResources is enabled (#1086606)
  - Added clear error message when port specified in 'clientaddrr' config
    option cannot be bound (#1086925)
  - fixed proxying of out-of-tree GETNEXT requests (#1087801)
  - use python/README to net-snmp-python subpackage (#1158391)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.7.2-21
changelog:
  - Fixed crash on reloading 'exec' configuration options (#1228893)
  - Fixed CVE-2014-3565, snmptrapd died when parsing certain traps (#1209361)
  - Fixed storageUseNFS functionality in hrStorageTable (#1193006)
  - Fixed forwarding of traps with RequestID=0 in snmptrapd (#1192511)
  - Fixed hrStorageTable to contain 31 bits integers (#1192221)
  - Fixed 'clientaddr' option for UDPv6 client messages (#1190679)
  - Fixed log level of SMUX messages (#1189393)
  - Fixed UDP-MIB::udpTable index on big-endian platforms (#1184433)
  - Fixed client utilities reporting 'read_config_store open failure on
    /var/lib/net-snmp/snmpapp.conf' (#1151310)
  - Fixed snmpd crash when failed to parse SMUX message headers (#1140236)
  - Added 'diskio' option to snmpd.conf, it's possible to monitor only
    selected devices in diskIOTable (#1092308)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.7.2-23
changelog:
  - Fixed parsing of invalid variables in incoming packets (#1248414)
  - Fixed HOST-RESOURCES-MIB::hrFSAccess flag when read-only filesystem
    becomes writable (#1241897)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.7.2-24
changelog:
  - Fixed lmSensorsTable not reporting sensors with duplicate names
    (#1252053)
  - Fixed close() overhead of extend commands (#1252048)
  - Fixed out-of-bounds write in python code (#1252034)


author: David Vossel <dvossel@redhat.com> - 3.9.5-17
changelog:
  - Split send_ua utility out of IPv6addr.c source so it can be
    re-used in IPaddr2 without requiring cluster-glue.
  - Fixes issue with pgsql and SAPInstance not setting transient
    attributes correctly when local corosync node name is not
    equal to 'uname -n'
  - High: ocft: Fedora supported test cases

    Resolves: rhbz#917681


author: David Vossel <dvossel@redhat.com> - 3.9.5-18
changelog:
  - Remove support for (nginx, mysql-proxy, rsyslog). nginx and
    mysql-proxy are not a supported projects. Rsyslog is not an
    agent we will be supporting in an HA environment.

    Resolves: rhbz#917681


author: David Vossel <dvossel@redhat.com> - 3.9.5-20
changelog:
  - tomcat agent updates for pacemaker support
  - slapd agent updates for pacemaker support
  - Fixes missing etab file required for nfsserver

    Resolves: rhbz#1033016
    Resolves: rhbz#917681


author: David Vossel <dvossel@redhat.com> - 3.9.5-24
changelog:
  - Addition of the clvmd resource-agent
  - Support monitoring qemu based VirtualDomain resources without
    requiring libvirtd to be running.

    Resolves: rhbz#1064512
    Resolves: rhbz#1060367


author: David Vossel <dvossel@redhat.com> - 3.9.5-25
changelog:
  - Rename clvmd agent to clvm to avoid problems associated
    with having a resource-agent named the same exact name
    as the binary the agent manages.

    Resolves: rhbz#1064512


author: David Vossel <dvossel@redhat.com> - 3.9.5-26
changelog:
  - Handle monitor qemu based VirtualDomain resources without
    requiring libvirtd even if configuration file does not
    contain an 'emulator' value pointing to the emulator binary.

    Resolves: rhbz#1060367


author: Miloslav Trmač <mitr@redhat.com> - 0.58-2
changelog:
  - Always use secure_getenv() or __secure_getenv(), fail build if neither is
    available.  Patch by Viktor Hercinger <vhercing@redhat.com>.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.1.20-1.1
changelog:
  - Resolves: rhbz#1290714 - CVE-2015-5330 libldb: samba: Remote memory read
                             in Samba LDAP server [rhel-7.2.z]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.1.20-1.2
changelog:
  - Resolves: rhbz#1290714 - CVE-2015-5330 libldb: samba: Remote memory read
                             in Samba LDAP server [rhel-7.2.z]
  - Remove the patch from the previous commit, it doesn't fix a remotely
    eploitable issue. Add patches from upstream #11636 instead.


author: Jay Fenlason <fenlason@redhat.com> - 1.7-1.2
changelog:
  - Split out lstopo into a -gui subpackage, so the hwloc base package
    does not pull in all of X.
    Resolves: rhbz910165


author: Don Zickus <dzickus@redhat.com> - 1.7-4
changelog:
  - Fix dangling symlink for hwloc-ls manpage
    Resolves: rhbz1081236
    Add desktop entry for lstopo
    Resolves: rhbz1229313


author: Michal Schmidt <mschmidt@redhat.com> - 1.11.8-4
changelog:
  - Rebase to 1.11.8.
  - Deal with rpaths using the method from Packaging Guidelines.
  - BuildRequire rdma-core-devel on s390(x).
  - Fix scriptlets related to hwloc-dump-hwdata.service.
  - Configure with /run as runstatedir.
  - Spec file cleanup.
  - Related: rhbz1482585


author: Tomas Jelinek <tojeline@redhat.com> - 0.9.137-7
changelog:
  - When a role is removed in the GUI the user is now automatically deleted
    if they aren't members of another role
  - Resolves: rhbz#1054491


author: Chris Feist <cfeist@redhat.cmo> 0.9.137-8
changelog:
  - Configuration of resource-discovery is now available on advanced location
    constraint rules
  - Resolves: rhbz#1054491


author: Tomas Jelinek <tojeline@redhat.com> - 0.9.137-9
changelog:
  - Added acl enable and disable commands
  - Display whether acls are enabled in the 'pcs acl' output
  - Resolves: rhbz#1054491


author: Tomas Jelinek <tojeline@redhat.com> - 0.9.137-11
changelog:
  - Stop cluster nodes in parallel and keep cluster quorate during pacemaker
    shutdown
  - Resolves: rhbz#1180506


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-7
changelog:
  - conf: Add infrastructure for disk source private data XML (rhbz#1523261)
  - util: storage: Add helpers to parse and format relPath into privateData (rhbz#1523261)
  - qemu: domain: Parse and format relPath into disk source private data (rhbz#1523261)
  - qemu: remove input device after receiving the event (rhbz#1524837)
  - conf: honor maxnames in nodeListDevices API (rhbz#1528572)
  - storage: Fixing missing 'backingStore' tag from volume XML dumps. (rhbz#1529663)
  - util: add virFileReadHeaderQuiet wrapper around virFileReadHeaderFD (CVE-2017-5715)
  - util: introduce virHostCPUGetMicrocodeVersion (CVE-2017-5715)
  - cpu_x86: Rename virCPUx86MapInitialize (CVE-2017-5715)
  - conf: include x86 microcode version in virsh capabiltiies (CVE-2017-5715)
  - qemu: capabilities: force update if the microcode version does not match (CVE-2017-5715)
  - cpu: add CPU features and model for indirect branch prediction protection (CVE-2017-5715)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-8
changelog:
  - qemuDomainAttachDeviceMknodHelper: Remove symlink before creating it (rhbz#1528502)
  - RHEL: cpu: Fix EPYC-IBRS CPU model (CVE-2017-5715)
  - cpu_x86: Copy CPU signature from ancestor (rhbz#1533125)
  - qemu: Ignore fallback CPU attribute on reconnect (rhbz#1532980)
  - qemu: Fix type of a completed job (rhbz#1523036)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-9
changelog:
  - qemu: Fix crash in offline migration (rhbz#1536351)
  - Revert "qemu: monitor: do not report error on shutdown" (rhbz#1536461)
  - qemu: Refresh caps cache after booting a different kernel (rhbz#1525182)
  - qemu: Don't initialize struct utsname (rhbz#1525182)


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.15.5-1
changelog:
  - Update to kbd-1.15.5 (removed kbd-1.15-resizecon-x86_64.patch,
    kbd-1.15-defkeymap.patch, kbd-1.15.3-fix-es-translation.patch,
    kbd-1.15.3-loadkeys-d.patch)


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.15.5-3
changelog:
  - Include xkb layouts from xkeyboard-config converted to console keymaps
  - Add version to vlock provides
    Resolves: #902564


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.15.5-8
changelog:
  - Fix vlock doesn't perform PAM account management or credential reinitialization
    Resolves: #1032140


author: Peter Hatina <phatina@redhat.com> - 2.1.0-3
changelog:
  - Changes for EPEL-7
    - Lower systemd required version to 208
    - Rewrite BuildRequires for systemd-devel


author: Vratislav Podzimek <vpodzime@redhat.com> - 2.5.2-4
changelog:
  - Fix seg fault in udiskslvmhelper
    Resolves: rhbz#1436914
  - lvm2daemonutil.c: Close FD for spawned process
    Resolves: rhbz#1463843


author: Ray Strode <rstrode@redhat.com> 3.8.5-2
changelog:
  - Fix kerberos crash when user manually erases stored credentials with seahorse
    Resolves: #1027413


author: Peter Hutterer <peter.hutterer@redhat.com> 1.7.1-3
changelog:
  - fix sequence number copy - the cookie already had (a potentially
    different) sequence number copied (#965347)


author: d.marlin <dmarlin@redhat.com>
changelog:
  - Only set RPM_OPT_FLAGS if undefined to avoid overwriting 
    the platform defaults.
    Resolves: rhbz#1023793


author: Peter Jones <pjones@redhat.com> - 8.28-8
changelog:
  - Fix crash when config file doesn't match command line.
    Related: rhbz#1070646
  - Make crashes work with abrt better.
    Resolves: rhbz#1070646


author: Peter Jones <pjones@redhat.com> - 8.28-10
changelog:
  - Use the correct load commands for aarch64 efi.
    Resolves: rhbz#1081269
  - Support "devicetree" directive in grub2.
    Resolves: rhbz#1063534
  - Explain the default bootloaders and configuration paths slightly better
    in the manual.
    Resolves: rhbz#1001664
  - Conditionally create debug entries when installing kernels.
    Resolves: rhbz#957681
  - Make sure --banner from the command line is used correctly.
    Resolves: rhbz#1032048


author: Peter Jones <pjones@redhat.com> - 8.28-11
changelog:
  - Fix a memory corruption issue we're hitting on s390/s390x
    Resolves: rhbz#1152152
  - Don't use spaces on zipl platforms to describe debugging entries
    Related: rhbz#1152152


author: Roland Mainz <rmainz@redhat.com> 0.4.1-6
changelog:
  - Remove extra whitespaces from #1208640/#1194299 patches
  - spec file cleanup
  related: #1208640 #1194299


author: Jan Synáček <jsynacek@redhat.com> - 0.17-58
changelog:
  - Extend the input line buffer and the argument storage buffer
  - Prettify spec some more and remove trailing space


author: Mark Langsdorf <mlangsdo@redhat.com> [4.5.0-12.el7]
changelog:
  - arm64: Call numa_store_cpu_info() earlier. (David Daney) [1377488]
  - redhat: config: arm64: Turn off DMA driver (Iyappan Subramanian) [1376872]
  - copy x509.genkey to certs/ directory (Jeffrey Bastian) [1377468]
  - PCI: Vulcan: AHCI PCI bar fix for Broadcom Vulcan early silicon (Ashok Kumar Sekar) [1376499]


author: Mark Langsdorf <mlangsdo@redhat.com> [4.5.0-13.el7]
changelog:
  - dm mpath: delay the requeue of blk-mq requests while all paths down (Mike Snitzer) [1376926]
  - dm mpath: use dm_mq_kick_requeue_list() (Mike Snitzer) [1376926]
  - dm rq: introduce dm_mq_kick_requeue_list() (Mike Snitzer) [1376926]
  - dm rq: reduce arguments passed to map_request() and dm_requeue_original_request() (Mike Snitzer) [1376926]
  - dm rq: add DM_MAPIO_DELAY_REQUEUE to delay requeue of blk-mq requests (Mike Snitzer) [1376926]
  - blk-mq: introduce blk_mq_delay_kick_requeue_list() (Mike Snitzer) [1376926]
  - dm: convert wait loops to use autoremove_wake_function() (Mike Snitzer) [1376926]
  - dm: use signal_pending_state() in dm_wait_for_completion() (Mike Snitzer) [1376926]
  - dm: rename task state function arguments (Mike Snitzer) [1376926]
  - dm: add two lockdep_assert_held() statements (Mike Snitzer) [1376926]
  - dm rq: simplify dm_old_stop_queue() (Mike Snitzer) [1376926]
  - dm mpath: check if path's request_queue is dying in activate_path() (Mike Snitzer) [1376926]
  - dm rq: take request_queue lock while clearing QUEUE_FLAG_STOPPED (Mike Snitzer) [1376926]
  - dm rq: factor out dm_mq_stop_queue() (Mike Snitzer) [1376926]
  - dm: mark request_queue dead before destroying the DM device (Mike Snitzer) [1376926]
  - dm: return correct error code in dm_resume()'s retry loop (Mike Snitzer) [1376926]
  - dm flakey: fix reads to be issued if drop_writes configured (Mike Snitzer) [1376926]
  - dm crypt: increase mempool reserve to better support swappin (Mike Snitzer) [1376926]
  - dm round robin: do not use this_cpu_ptr() without having preemption disabled (Mike Snitzer) [1376926]
  - dm: set DMF_SUSPENDED* _before_ clearing DMF_NOFLUSH_SUSPENDING (Mike Snitzer) [1376926]
  - dm rq: fix the starting and stopping of blk-mq queues (Mike Snitzer) [1376926]
  - dm mpath: add locking to multipath_resume and must_push_back (Mike Snitzer) [1376926]
  - dm flakey: error READ bios during the down_interval (Mike Snitzer) [1376926]
  - dm btree: fix a bug in dm_btree_find_next_single() (Mike Snitzer) [1376926]
  - dm: call PR reserve_unreserve on each underlying device (Mike Snitzer) [1376926]
  - dm: fix second blk_delay_queue() parameter to be in msec units not jiffies (Mike Snitzer) [1376926]
  - dm rq: check kthread_run return for .request_fn request-based DM (Mike Snitzer) [1376926]
  - dm verity fec: fix block calculation (Mike Snitzer) [1376926]
  - dm ioctl: Simplify parameter buffer management code (Mike Snitzer) [1376926]
  - dm crypt: Fix sparse complaints (Mike Snitzer) [1376926]
  - dm mpath: add optional "queue_mode" feature (Mike Snitzer) [1376926]
  - dm mpath: remove bio-based bloat from struct dm_mpath_io (Mike Snitzer) [1376926]
  - dm mpath: reinstate bio-based support (Mike Snitzer) [1376926]
  - dm: move request-based code out to dm-rq.[hc] (Mike Snitzer) [1376926]
  - dm raid: make sure no feature flags are set in metadata (Mike Snitzer) [1376926]
  - dm ioctl: drop use of __GFP_REPEAT in copy_params()'s __vmalloc() call (Mike Snitzer) [1376926]
  - dm stats: fix spelling mistake in Documentation (Mike Snitzer) [1376926]
  - dm cache: update cache-policies.txt now that mq is an alias for smq (Mike Snitzer) [1376926]
  - dm mpath: eliminate use of spinlock in IO fast-paths (Mike Snitzer) [1376926]
  - dm mpath: move trigger_event member to the end of 'struct multipath' (Mike Snitzer) [1376926]
  - dm mpath: use atomic_t for counting members of 'struct multipath' (Mike Snitzer) [1376926]
  - dm mpath: switch to using bitops for state flags (Mike Snitzer) [1376926]
  - dm thin: Remove return statement from void function (Mike Snitzer) [1376926]
  - dm: remove unused mapped_device argument from free_tio() (Mike Snitzer) [1376926]
  - dm cache metadata: fix cmd_read_lock() acquiring write lock (Mike Snitzer) [1376926]
  - dm cache metadata: fix READ_LOCK macros and cleanup WRITE_LOCK macros (Mike Snitzer) [1376926]
  - dm: fix dm_target_io leak if clone_bio() returns an error (Mike Snitzer) [1376926]
  - dm: fix rq_end_stats() NULL pointer in dm_requeue_original_request() (Mike Snitzer) [1376926]
  - dm thin: consistently return -ENOSPC if pool has run out of data space (Mike Snitzer) [1376926]
  - dm cache: bump the target version (Mike Snitzer) [1376926]
  - dm cache: make sure every metadata function checks fail_io (Mike Snitzer) [1376926]
  - dm: add missing newline between DM_DEBUG_BLOCK_STACK_TRACING and DM_BUFIO (Mike Snitzer) [1376926]
  - dm cache policy smq: clarify that mq registration failure was for 'mq' (Mike Snitzer) [1376926]
  - dm: return error if bio_integrity_clone() fails in clone_bio() (Mike Snitzer) [1376926]
  - dm thin metadata: don't issue prefetches if a transaction abort has failed (Mike Snitzer) [1376926]
  - dm snapshot: disallow the COW and origin devices from being identical (Mike Snitzer) [1376926]
  - dm cache: make the 'mq' policy an alias for 'smq' (Mike Snitzer) [1376926]
  - dm: drop unnecessary assignment of md->queue (Mike Snitzer) [1376926]
  - dm: reorder 'struct mapped_device' members to fix alignment and holes (Mike Snitzer) [1376926]
  - dm: remove dummy definition of 'struct dm_table' (Mike Snitzer) [1376926]
  - dm: add 'dm_numa_node' module parameter (Mike Snitzer) [1376926]
  - dm thin metadata: remove needless newline from subtree_dec() DMERR message (Mike Snitzer) [1376926]
  - dm mpath: cleanup reinstate_path() et al based on code review (Mike Snitzer) [1376926]
  - dm mpath: remove __pgpath_busy forward declaration, rename to pgpath_busy (Mike Snitzer) [1376926]
  - dm mpath: switch from 'unsigned' to 'bool' for flags where appropriate (Mike Snitzer) [1376926]
  - dm round robin: use percpu 'repeat_count' and 'current_path' (Mike Snitzer) [1376926]
  - dm path selector: remove 'repeat_count' return from .select_path hook (Mike Snitzer) [1376926]
  - dm mpath: push path selector locking down to path selectors (Mike Snitzer) [1376926]
  - dm mpath: remove repeat_count support from multipath core (Mike Snitzer) [1376926]
  - dm mpath: remove unnecessary casts in front of ti->private (Mike Snitzer) [1376926]
  - dm mpath: use blk_mq_alloc_request() and blk_mq_free_request() directly (Mike Snitzer) [1376926]
  - dm mpath: cleanup 'struct dm_mpath_io' management code (Mike Snitzer) [1376926]
  - dm mpath: use blk-mq pdu for per-request 'struct dm_mpath_io' (Mike Snitzer) [1376926]
  - dm: allow immutable request-based targets to use blk-mq pdu (Mike Snitzer) [1376926]
  - dm: rename target's per_bio_data_size to per_io_data_size (Mike Snitzer) [1376926]
  - dm: distinquish old .request_fn (dm-old) vs dm-mq request-based DM (Mike Snitzer) [1376926]
  - dm: remove support for stacking dm-mq on .request_fn device(s) (Mike Snitzer) [1376926]
  - dm: fix a couple locking issues with use of block interfaces (Mike Snitzer) [1376926]
  - dm: allocate blk_mq_tag_set rather than embed in mapped_device (Mike Snitzer) [1376926]
  - dm: add 'dm_mq_nr_hw_queues' and 'dm_mq_queue_depth' module params (Mike Snitzer) [1376926]
  - dm: optimize dm_request_fn() (Mike Snitzer) [1376926]
  - dm: optimize dm_mq_queue_rq() (Mike Snitzer) [1376926]
  - dm: set DM_TARGET_WILDCARD feature on "error" target (Mike Snitzer) [1376926]
  - dm: cleanup dm_any_congested() (Mike Snitzer) [1376926]
  - dm: remove unused dm_get_rq_mapinfo() (Mike Snitzer) [1376926]
  - dm: fix excessive dm-mq context switching (Mike Snitzer) [1376926]
  - dm: fix sparse "unexpected unlock" warnings in ioctl code (Mike Snitzer) [1376926]
  - dm: do not return target from dm_get_live_table_for_ioctl() (Mike Snitzer) [1376926]


author: Mark Langsdorf <mlangsdo@redhat.com> [4.5.0-14.el7]
changelog:
  - DO NOT UPSTREAM: cputopo: support multiple sockets (Andrew Jones) [1378244]
  - xfs: quiesce the filesystem after recovery on readonly mount (Eric Sandeen) [1365979]
  - xfs: log recovery tracepoints to track current lsn and buffer submission (Jeffrey Bastian) [1379821]
  - xfs: update metadata LSN in buffers during log recovery (Jeffrey Bastian) [1379821]
  - xfs: don't warn on buffers not being recovered due to LSN (Jeffrey Bastian) [1379821]
  - xfs: pass current lsn to log recovery buffer validation (Jeffrey Bastian) [1379821]
  - xfs: rework log recovery to submit buffers on LSN boundaries (Jeffrey Bastian) [1379821]


author: Tomas Smetana <tsmetana@redhat.com> - 2.8.0-6
changelog:
  - fix #831336: fix broken menus; patch backported from upstream SVN revision
    1375 by Manfred Spraul


author: Chris Leech <cleech@redhat.com> - 0.93-4
changelog:
  - set hardened build flag, required for long running processes (isnsd)
  - patch makefile to actually use LDFLAGS


author: Sumit Bose <sbose@redhat.com> - 2.1-1
changelog:
  - Update to ctdb version  2.1
  - added fix for tevent configure check
  - make sure autogen.sh is called before configure
    Resolves: rhbz#925204


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-3
changelog:
  - Add export NSS_ENABLE_ECC=1 rto the %build and %check sections
  - Resolves: rhbz#752980 - [7.0 FEAT] Support ECDSA algorithm in the nss packag


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-1
changelog:
  - Rebase to nss-softoken from nss-3.15.2
  - Resolves: rhbz#1012679 - pick up NSS-SOFTOKN 3.15.2 (required for bug 1012656)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-3
changelog:
  - Fix to allow level 1 fips mode if the db has no password
  - Resolves: Bug 852023 - FIPS mode detection does not work


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-4
changelog:
  - Rebase to nss-3.15.4
  - Resolves: Bug 1054457 - CVE-2013-1740
  - Update softokn splitting script to oparate on the upstream pristine source
  - Using the .gz archives directly, not repackaging as .bz2 ones
  - Avoid unneeded manual steps that could introduce errors
  - Update the iquote and build softoken only patches on account of the rebase


author: Matej Habrnal <mhabrnal@redhat.com> - 2.1.11-39
changelog:
  - python: fix check for absolute path
  - console-notifications: add timeout
  - vmcore: generate 'reason' file in all cases
  - Fix memory leaks in abrt-dbus
  - Resolves: #1250337, #1166633, #1249101, #1319704


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.75-2.5.4.5
changelog:
  - Fix hsbootstrap option on ppc64le where JDK_TO_BUILD_WITH is changed.
  - Print uname to feedback to upstream OpenJDK.
  - Resolves: rhbz#1191652


author: Richard Hughes <rhughes@redhat.com> - 0.9.19-1
changelog:
  - New upstream release
  - Add a Documentation tag to the service file
  - Add support for Logitech Unifying devices
  - Do not continue to poll if /proc/timer_stats is not readable
  - Fix device matching for recent kernels
  - Resolves: #848521


author: Richard Hughes <rhughes@redhat.com> - 0.9.20-1
changelog:
  - New upstream release
  - Factor out the Logitech Unifying support to support other devices
  - Fix batteries which report current energy but full charge
  - Fix several small memory leaks


author: Richard Hughes <rhughes@redhat.com> - 0.9.20-7
changelog:
  - Mark the devel-docs subpackage as noarch to silence a rpmdiff false positive.
  - Resolves: #1070661


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-81
changelog:
  - Modify 0128-RHBZ-1222123-mpathconf-allow.patch
    * Fix up covscan complaints.
  - Related: bz #1222123


author: Benjmain Marzinski <bmarzins@redhat.com> 0.4.9-82
changelog:
  - Add 0129-UPBZ-1254292-iscsi-targetname.patch
    * check for targetname iscsi sysfs value
  - Resolves: bz #1254292


author: Benjmain Marzinski <bmarzins@redhat.com> 0.4.9-83
changelog:
  - Add 0130-RHBZ-1259523-host_name_len.patch
    * increase size of host string
  - Resolves: bz# 1259523


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-84
changelog:
  - 0131-UPBZ-1259831-lock-retry.patch
    * retry locking when creating multipath devices
  - Resolves: bz# 1259831


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-85.1
changelog:
  - Add 0132-RHBZ-1296979-fix-define.patch
    * look for the correct libudev function to set define
  - Resolves: bz #1303623


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-85.2
changelog:
  - Add 0133-RHBZ-1321019-wait-for-map-add.patch
    * wait for the device to finish being added before reloading it.
  - Resolves: bz #1321019


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-85.3
changelog:
  - Add 0134-UPBZ-1328515-dont-fail-discovery.patch
    * don't fail discovery because individual paths failed.
  - Resolves: bz #1328515


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-85.4
changelog:
  - Add 0135-RHBZ-1330480-kpartx-sync.patch
    * default to using udev sync mode
  - Resolves: bz #1330480


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-85.5
changelog:
  - Add 0136-RHBZ-1335746-clear-chkr-msg.patch
    * clear old checker message for offline paths.
  - Resolves: bz #1335746


author: Than Ngo <than@redhat.com> - 3.11-1
changelog:
  - 3.11
  - bz#540763, add IP allocation by pppd ability to pppoe-server
  - bz#808676, add missing % symbol for triggerun


author: Will Cohen <wcohen@redhat.com> - 0.9.9-5
changelog:
  - Update Intel Haswell events.
  - Add support for Intel Silvermont (Avoton).
  - Add support for Intel Broadwell.
  - Add support for aarch64.
  - Update IBM power8 events.


author: Hans de Goede <hdegoede@redhat.com> - 1.3.2-14
changelog:
  - Xclients: only try to start gnome classic session if installed
  - Resolves: rhbz#1078948
  - startx: Only specify vt argument automatically when run from a vt
  - Resolves: rhbz#1083188


author: Hans de Goede <hdegoede@redhat.com> - 1.3.4-1
changelog:
  - xinit 1.3.4
  - Drop xorg-x11-xinit-1.3.2-systemd-logind.patch (included upstream in 1.3.4)
  - Add patches from Fedora to fix automatically finding a free display-number
  - Resolves: rhbz#1194894


author: Miroslav Lichvar <mlichvar@redhat.com> 1.29.1-1
changelog:
  - update to 1.29.1 (#1053022, CVE-2014-0021)
  - fix selecting of sources with prefer option (#1061048)
  - fix potential bug in writing of drift files (#1061106)
  - replace hardening build flags with _hardened_build (#1061036)


author: Miroslav Lichvar <mlichvar@redhat.com> 2.1-1
changelog:
  - update to 2.1 (#1117882 #1169353 #1206504 #1209568 CVE-2015-1821
    CVE-2015-1822 CVE-2015-1853)
  - extend chrony-helper to allow using servers from DNS SRV records (#1211600)
  - add servers from DHCP with iburst option by default (#1219492)
  - execute test suite


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-37
changelog:
  - add support for RFC 5649 (#1119738)
  - do not pass the FIPS integrity check if the .hmac files are empty (#1128849)
  - add ECC TLS extensions to DTLS (#1119803)
  - do not send ECC ciphersuites in SSLv2 client hello (#1090955)
  - properly propagate encryption failure in BIO_f_cipher (#1072439)
  - fix CVE-2014-0224 fix that broke EAP-FAST session resumption support
  - improve documentation of ciphersuites - patch by Hubert Kario (#1108026)
  - use case insensitive comparison for servername in s_server (#1081163)
  - add support for automatic ECDH curve selection on server (#1080128)
  - FIPS mode: make the limitations on DSA, DH, and RSA keygen
    length enforced only if OPENSSL_ENFORCE_MODULUS_BITS environment
    variable is set


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-39
changelog:
  - fix CVE-2014-3567 - memory leak when handling session tickets
  - fix CVE-2014-3513 - memory leak in srtp support
  - add support for fallback SCSV to partially mitigate CVE-2014-3566
    (padding attack on SSL3)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-40
changelog:
  - use FIPS approved method for computation of d in RSA
  - copy digest algorithm when handling SNI context switch


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-41
changelog:
  - fix CVE-2014-3570 - incorrect computation in BN_sqr()
  - fix CVE-2014-3571 - possible crash in dtls1_get_record()
  - fix CVE-2014-3572 - possible downgrade of ECDH ciphersuite to non-PFS state
  - fix CVE-2014-8275 - various certificate fingerprint issues
  - fix CVE-2015-0204 - remove support for RSA ephemeral keys for non-export
    ciphersuites and on server
  - fix CVE-2015-0205 - do not allow unauthenticated client DH certificate
  - fix CVE-2015-0206 - possible memory leak when buffering DTLS records


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-42
changelog:
  - test in the non-FIPS RSA keygen for minimal distance of p and q
    similarly to the FIPS RSA keygen


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-42.3
changelog:
  - fix CVE-2015-0209 - potential use after free in d2i_ECPrivateKey()
  - fix CVE-2015-0286 - improper handling of ASN.1 boolean comparison
  - fix CVE-2015-0287 - ASN.1 structure reuse decoding memory corruption
  - fix CVE-2015-0289 - NULL dereference decoding invalid PKCS#7 data
  - fix CVE-2015-0292 - integer underflow in base64 decoder
  - fix CVE-2015-0293 - triggerable assert in SSLv2 server


author: Kalev Lember <kalev@smartlink.ee> - 3.1.1-1
changelog:
  - Update to 3.1.1
  - Dropped CVE-2009-1885 patch.
  - Use dos2unix -k instead of unrecognized option -U
  - Removed the multilib conflict workaround as Xerces_autoconf_config.hpp
    no longer contains the conflicting XERCES_SIZEOF_LONG define.


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.91-2.6.2.1
changelog:
  - Bump to 2.6.2 and u91b00.
  - Disable system LCMS 2 for now until security of it can be verified.
  - Drop patches for PR2560/RH1245855 as now applied upstream.
  - Sync minor changes from RHEL 6 spec file.
  - Resolves: rhbz#1271923


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.95-2.6.4.0
changelog:
  - Bump to 2.6.4 and u95b00.
  - Backport tarball creation script from OpenJDK 8 RPMs and update fsg.sh to work with it.
  - Drop 8072932or8074489 patch as applied upstream in u91b01.
  - Add MD5 checksums for last two version of the java.security file.
  - Resolves: rhbz#1295768


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2-1
changelog:
  - Update to nss-3.16.2
  - Resolves: Bug 1124659 - Rebase RHEL 7.1 to at least NSS-SOFTOKN 3.16.1 (FF 31)


author: Colin Walters <walters@redhat.com> - 2018.1-2
changelog:
  - New upstream version for 7.5.0
  - https://github.com/ostreedev/ostree/releases/tag/v2018.1
  - https://github.com/ostreedev/ostree/releases/tag/v2017.15


author: Daniel Veillard <veillard@redhat.com> - 2.9.1-1
changelog:
  - upstream release of 2.9.1
  - a couple more API entry point
  - compatibility with python3
  - a lot of bug fixes


author: Daniel Veillard <veillard@redhat.com> - 2.9.1-6
changelog:
  - Fix missing entities after CVE-2014-3660 fix
  - CVE-2014-0191 Do not fetch external parameter entities (rhbz#1195650)
  - Fix regressions introduced by CVE-2014-0191 patch


author: Daniel Veillard <veillard@redhat.com> - 2.9.1-6.2
changelog:
  - Fix a series of CVEs (rhbz#1286496)
  - CVE-2015-7941 Stop parsing on entities boundaries errors
  - CVE-2015-7941 Cleanup conditional section error handling
  - CVE-2015-8317 Fail parsing early on if encoding conversion failed
  - CVE-2015-7942 Another variation of overflow in Conditional sections
  - CVE-2015-7942 Fix an error in previous Conditional section patch
  - Fix parsing short unclosed comment uninitialized access
  - CVE-2015-7498 Avoid processing entities after encoding conversion failures
  - CVE-2015-7497 Avoid an heap buffer overflow in xmlDictComputeFastQKey
  - CVE-2015-5312 Another entity expansion issue
  - CVE-2015-7499 Add xmlHaltParser() to stop the parser
  - CVE-2015-7499 Detect incoherency on GROW
  - CVE-2015-7500 Fix memory access error due to incorrect entities boundaries
  - CVE-2015-8242 Buffer overead with HTML parser in push mode
  - CVE-2015-1819 Enforce the reader to run in constant memory


author: Daniel Veillard <veillard@redhat.com> - libxml2-2.9.1-6.3
changelog:
  - Heap-based buffer overread in xmlNextChar (CVE-2016-1762)
  - Bug 763071: Heap-buffer-overflow in xmlStrncat <https://bugzilla.gnome.org/show_bug.cgi?id=763071> (CVE-2016-1834)
  - Bug 757711: Heap-buffer-overflow in xmlFAParsePosCharGroup <https://bugzilla.gnome.org/show_bug.cgi?id=757711> (CVE-2016-1840)
  - Bug 758588: Heap-based buffer overread in xmlParserPrintFileContextInternal <https://bugzilla.gnome.org/show_bug.cgi?id=758588> (CVE-2016-1838)
  - Bug 758605: Heap-based buffer overread in xmlDictAddString <https://bugzilla.gnome.org/show_bug.cgi?id=758605> (CVE-2016-1839)
  - Bug 759398: Heap use-after-free in xmlDictComputeFastKey <https://bugzilla.gnome.org/show_bug.cgi?id=759398> (CVE-2016-1836)
  - Fix inappropriate fetch of entities content (CVE-2016-4449)
  - Heap use-after-free in htmlParsePubidLiteral and htmlParseSystemiteral (CVE-2016-1837)
  - Heap use-after-free in xmlSAX2AttributeNs (CVE-2016-1835)
  - Heap-based buffer-underreads due to xmlParseName (CVE-2016-4447)
  - Heap-based buffer overread in htmlCurrentChar (CVE-2016-1833)
  - Add missing increments of recursion depth counter to XML parser. (CVE-2016-3705)
  - Avoid building recursive entities (CVE-2016-3627)
  - Fix some format string warnings with possible format string vulnerability (CVE-2016-4448)
  - More format string warnings with possible format string vulnerability (CVE-2016-4448)


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-17.el7
changelog:
  - Resolve: #1455946 Provide a tooling automating the configuration 
    of Smart Card authentication on a FreeIPA master
    - server certinstall: update KDC master entry
    - pkinit manage: introduce ipa-pkinit-manage
    - server upgrade: do not enable PKINIT by default
    - Extend the advice printing code by some useful abstractions
    - Prepare advise plugin for smart card auth configuration
  - Resolve: #1461053 allow to modify list of UPNs of a trusted forest
    - trust-mod: allow modifying list of UPNs of a trusted forest
    - WebUI: add support for changing trust UPN suffixes


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-18.el7
changelog:
  - Resolves: #1449189 ipa-kra-install timeouts on replica
    - kra: promote: Get ticket before calling custodia


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-19.el7
changelog:
  - Resolves: #1462112 ipaserver installation fails in FIPS mode: OpenSSL
    internal error, assertion failed: Digest MD4 forbidden in FIPS mode!
    - ipa-sam: replace encode_nt_key() with E_md4hash() 
    - ipa_pwd_extop: do not generate NT hashes in FIPS mode
  - Resolves: #1377973 ipa-server-install fails when the provided or resolved
    IP address is not found on local interfaces 
    - Fix local IP address validation 
    - ipa-dns-install: remove check for local ip address
    - refactor CheckedIPAddress class
    - CheckedIPAddress: remove match_local param
    - Remove ip_netmask from option parser
    - replica install: add missing check for non-local IP address
    - Remove network and broadcast address warnings


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-20.el7
changelog:
  - Resolves: #1452216 Replica installation grants HTTP principal
    access in WebUI
    - Make sure we check ccaches in all rpcserver paths


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-21.el7
changelog:
  - Resolves: #1470125 Replica install fails to configure IPA-specific
    temporary files/directories
    - replica install: drop-in IPA specific config to tmpfiles.d
  - Resolves: #1469978 bind package is not automatically updated during
    ipa-server upgrade process
    - Bumped Required version of bind-dyndb-ldap and bind package


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-21.el7.1
changelog:
  - Resolves: #1473272 Provide a tooling automating the configuration
    of Smart Card authentication on a FreeIPA master
    - smart-card advises: configure systemwide NSS DB also on master
    - smart-card advises: add steps to store smart card signing CA cert
    - Allow to pass in multiple CA cert paths to the smart card advises
    - add a class that tracks the indentation in the generated advises
    - delegate the indentation handling in advises to dedicated class
    - advise: add an infrastructure for formatting Bash compound statements
    - delegate formatting of compound Bash statements to dedicated classes
    - Fix indentation of statements in Smart card advises
    - Use the compound statement formatting API for configuring PKINIT
    - smart card advises: use a wrapper around Bash `for` loops
    - smart card advise: use password when changing trust flags on HTTP cert
    - smart-card-advises: ensure that krb5-pkinit is installed on client
  - Resolves: #1477046 Use CommonNameToSANDefault in default profile 
    (new installs only)
    - Add CommonNameToSANDefault to default cert profile
  - Resolves: #1475664 NULL LDAP context in call to ldap_search_ext_s
    during search in cn=ad,cn=trusts,dc=example,dc=com
    - NULL LDAP context in call to ldap_search_ext_s during search


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-21.el7.1.1
changelog:
  - Resolves: #1477046 Use CommonNameToSANDefault in default profile
    (new installs only)
    - Restore old version of caIPAserviceCert for upgrade only


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-1
changelog:
  - Require "nss >= 3.28.3" as a build and runtime requirement
  - Require "jss >= 4.4.0-4" as a build and runtime requirement
  - Require "tomcatjss >= 7.2.1-3" as a build and runtime requirement
  - dogtagpki Pagure Issue #2612 - Unable to clone due to pki pkcs12-cert-find
    failure (edewata)
  - ############################################################################
  - Bugzilla Bug #1394309 - Rebase pki-core to 10.4.x in RHEL-7.4
  - Bugzilla Bug #1394315 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.4.x
  - ############################################################################
  - RHEL 7.4:
  - ############################################################################
  - ############################################################################
  - RHCS 9.2:
  - ############################################################################
  - ############################################################################
  - Common Criteria
  - ############################################################################
  - Bugzilla Bug #1419734 - CC: CMC: id-cmc-identityProofV2 feature
    implementation (cfu)
  - Bugzilla Bug #1419742 - CC: CMC: provide Proof of Possession for encryption
    cert requests (cfu)
  - Bugzilla Bug #1404080 - CC: add audit event: various SSL/TLS failures
    (edewata)
  - Bugzilla Bug #1428020 - CC: CMC feature support: provided issuance
    protection cert mechanism (cfu)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-2
changelog:
  - ############################################################################
  - RHEL 7.4:
  - ############################################################################
  - Bugzilla Bug #1282504 - Installing pki-server in container reports
    scriptlet failed, exit status 1 (jpazdziora)
  - Bugzilla Bug #1400149 - pkispawn fails to create CA subsystem on FIPS
    enabled system (edewata)
  - Bugzilla Bug #1410650 - [RFE] Add SCP03 support
    for sc 7 g & d cards (RHEL) (jmagne)
  - Bugzilla Bug #1437591 - cli authentication using expired cert throws an
    exception (edewata)
  - Bugzilla Bug #1437602 - non-CA cli looks for CA in the instance during a
    request (edewata)
  - ############################################################################
  - RHCS 9.2:
  - ############################################################################
  - Bugzilla Bug #1274086 - [RFE] Add SCP03 support
    for sc 7 g & d cards (RHCS) (jmagne)
  - ############################################################################
  - Common Criteria
  - ############################################################################
  - Bugzilla Bug #1404080 - CC: add audit event: various SSL/TLS failures
    (edewata)
  - Bugzilla Bug #1417307 - CC: Audit Review /Searches (edewata)
  - Bugzilla Bug #1419737 - CC: CMC: id-cmc-popLinkWitnessV2 feature
    implementation (cfu)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-3
changelog:
  - ############################################################################
  - RHEL 7.4:
  - ############################################################################
  - Bugzilla Bug #1303683 - dogtag should support GSSAPI based auth in
    conjuction with FreeIPA (ftweedal)
  - Bugzilla Bug #1385208 - RHCS 9.1 RC5 CA in the certificate profiles the
    startTime parameter is not working as expected. (jmagne)
  - Bugzilla Bug #1419756 - CC: allow CA to process pre-signed CMC non-signing
    certificate requests (cfu)
  - Bugzilla Bug #1426754 - PKCS12: upgrade to at least AES and SHA2 (ftweedal)
  - Bugzilla Bug #1445088 - profile modification cannot remove existing config
    parameters (ftweedal)
  - Bugzilla Bug #1445535 - CC: Crypto Operation (AES Encryption/Decryption)
    (RHEL) (alee)
  - Bugzilla Bug #1446874 - Missing ClientIP and ServerIP in audit log when
    pki CLI terminates SSL connection (edewata)
  - Bugzilla Bug #1446875 - Session timeout for PKI console (RHEL) (edewata)
  - ############################################################################
  - RHCS 9.2:
  - ############################################################################
  - Bugzilla Bug #1404480 - CC: Crypto Operation (AES Encryption/Decryption)
    (RHCS) (alee)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-4
changelog:
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1386303 - cannot extract generated private key from KRA when
    HSM is used. (alee)
  - Bugzilla Bug #1446364 - pkispawn returns before tomcat is ready (cheimes)
  - Bugzilla Bug #1447145 - CMC: cmc.popLinkWitnessRequired=false would cause
    error (cfu)
  - Bugzilla Bug #1448203 - CAInfoService: retrieve KRA-related values from
    the KRA (ftweedal)
  - Bugzilla Bug #1448204 - pkispawn of clone install fails with
    InvalidBERException (ftweedal)
  - Bugzilla Bug #1448521 - kra unable to extract symmetric keys generated on
    thales hsm (alee)
  - Updated "jss" build and runtime requirements (mharmsen)
  - ##########################################################################
  - RHCS 9.2:
  - ##########################################################################
  - Bugzilla Bug #1274086 - [RFE] Add SCP03 support (RHCS) (jmagne)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-5
changelog:
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1419761 - CC: allow CA to process pre-signed CMC renewal
    non-signing cert requests (cfu)
  - Bugzilla Bug #1447080 - CC: CMC: allow enrollment key signed (self-signed)
    CMC with identity proof (cfu)
  - Bugzilla Bug #1447144 - CA brought down during separate KRA instance
    creation (mharmsen)
  - Bugzilla Bug #1448903 - exception Invalid module "--ignore-banner" when
    defined in ~/.dogtag/pki.conf and run pki pkcs12-import --help (edewata)
  - Bugzilla Bug #1450143 - CA installation with HSM in FIPS mode fails (jmagne)
  - Bugzilla Bug #1452123 - CA CS.cfg shows default port (mharmsen)
  - Bugzilla Bug #1452250 - Inconsistent CERT_REQUEST_PROCESSED event in
    ConnectorServlet. (edewata)
  - Bugzilla Bug #1452340 - Ensuring common audit log correctness (edewata)
  - Bugzilla Bug #1452344 - Adding serial number into CERT_REQUEST_PROCESSED
    audit event. (edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-7
changelog:
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1393633 - Creating symmetric key (sharedSecret)
    using tkstool is failing when RHEL 7.3 is in FIPS mode. (jmagne)
  - Bugzilla Bug #1445519 - CA Server installation with HSM fails
    (jmagne)
  - Bugzilla Bug #1452617 - Unable to create IPA Sub CA
    (ftweedal)
  - Bugzilla Bug #1454471 - Enabling all subsystems on startup
    (edewata)
  - Bugzilla Bug #1455617 - Key recovery on token fails because
    key record is not marked encrypted (alee)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-8
changelog:
  - Require "selinux-policy-targeted >= 3.13.1-159" as a runtime requirement
  - Require "tomcatjss >= 7.2.1-4" as a build and runtime requirement
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1400149 - pkispawn fails to create CA subsystem on FIPS
    enabled system (edewata)
  - Bugzilla Bug #1447144 - CA brought down during separate KRA instance
    creation (edewata)
  - Bugzilla Bug #1447762 - pkispawn fails occasionally with this failure
    ACCESS_SESSION_ESTABLISH_FAILURE (edewata)
  - Bugzilla Bug #1454450 - SubCA installation failure with 2 step
    installation in fips enabled mode (edewata)
  - Bugzilla Bug #1456597 - Certificate import using pki client-cert-import
    is asking for password when already provided (edewata)
  - Bugzilla Bug #1456940 - Build failure due to Pylint issues (cheimes)
  - Bugzilla Bug #1458043 - Key recovery using externalReg fails
    with java null pointer exception on KRA (alee)
  - Bugzilla Bug #1458379 - Upgrade script for keepAliveTimeout parameter
    (edewata)
  - Bugzilla Bug #1458429 - client-cert-import --ca-cert should
    import CA cert with trust bits "CT,C,C" (edewata)
  - ##########################################################################
  - RHCS 9.2:
  - ##########################################################################
  - Bugzilla Bug #1274086 - [RFE] Add SCP03 support (RHCS) (jmagne)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-9
changelog:
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1393633 - Creating symmetric key (sharedSecret)
    using tkstool is failing when RHEL 7.3 is in FIPS mode. (jmagne)
  - Bugzilla Bug #1419756 - CC: allow CA to process pre-signed CMC
    non-signing certificate requests (cfu)
  - Bugzilla Bug #1419777 - CC: allow CA to process pre-signed CMC
     revocation non-signing cert requests (cfu)
  - Bugzilla Bug #1458047 - change the way aes clients refer to
    aes keysets (alee)
  - Bugzilla Bug #1458055 - dont reuse IVs in the CMC code
    (alee)
  - Bugzilla Bug #1460028 - In keywrap mode, key recovery on
    KRA with HSM causes KRA to crash (ftweedal)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-10
changelog:
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1458043 - Key recovery on token fails with
    invalid public key error on KRA (alee)
  - Bugzilla Bug #1460764 - CC: CMC: check HTTPS client
    authentication cert against CMC signer (cfu)
  - Bugzilla Bug #1461533 - Unable to find keys in the p12 file after
    deleting the any of the subsystem certs from it (ftweedal)


author: Miloslav Trmač <mitr@redhat.com> - 0.110-4
changelog:
  - Shut up rpmlint about Summary:
  - Build with V=1
  - Use %{_unitdir} instead of hard-coding the path
  - Use the new systemd macros, primarily to run (systemctl daemon-reload)
    Resolves: #857382


author: Miloslav Trmač <mitr@redhat.com> - 0.111-1
changelog:
  - Update to polkit-0.111
    Resolves: #917888
  - Use SpiderMonkey from mozjs17 instead of js
  - Ship the signature in the srpm
  - Try to preserve timestamps in (make install)


author: Miloslav Trmač <mitr@redhat.com> - 0.112-2
changelog:
  - Workaround pam_systemd setting broken XDG_RUNTIME_DIR
    Resolves: #1033774
  - Always use mozjs-17.0 even if js-devel is installed


author: Mahaveer Darade <mah.darade@gmail.com> - 0.3.5-1
changelog:
  - upgrade to upstream version 0.3.5
  - drop patch0, merged upstream
    liblognorm-0.3.4-rename-to-lognormalizer.patch
  - remove trailing whitespace


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-79
changelog:
  - Add 0124-RHBZ-1209275-retrigger-uevents.patch
    * Make multipathd retrigger uevents when paths haven't successfully had
      their udev_attribute environment variable set by udev and add
      "retrigger_ties" and "retrigger_delay" to control this
  - Add 0125-RHBZ-1153832-kpartx-delete.patch
    * Delete all partition devices with -d (not just the ones in the partition
      table)
  - Add 0126-RHBZ-1211383-alias-collision.patch
    * make multipathd use the old alias, if rename failed and add
      "new_bindings_in_boot" to determine if new bindings can be added to
      the bindings file in the initramfs
  - Resolves: bz #1153832, #1209275, #1211383


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-80
changelog:
  - Add 0127-RHBZ-1201030-use-blk-availability.patch
    * Make multipath use blk-availability.service
  - Add 0128-RHBZ-1222123-mpathconf-allow.patch
    * Add mpathconf --allow for creating specialized config files.
  - Resolves: bz #1201030, #1222123


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-12
changelog:
  - Support TLS > 1.0 by support while still allowing to connect to SSL3 only servers
  - Enable ECDSA cipher suites by default, a subset of the ones requested


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-13
changelog:
  - Reorder the cipher suites and enable two more by default
  - Fix some of the ssauth sni and ocsp stapling tests


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-14
changelog:
  - Update the required_softokn_build_version to -14
  - Add references to bugs filed upstream for new patches
  - Merge ocsp stapling and sslauth sni tests patches into one


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-16
changelog:
  - Fix check for public key size of DSA certificates
  - Use size of prime P not the size of dsa.publicValue


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-17
changelog:
  - Change the required_softokn_build_version back to -13
  - Ensure we use nss-softokn-3.16.2.3-13.el7_1


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-19
changelog:
  - Prevent TLS 1.2 Transcript Collision attacks against MD5 in key exchange protocol
  - Resolves: Bug 1289883


author: Daniel Walsh <dwalsh@redhat.com> - 0-5.13.git
changelog:
  - Disable this hook by default.
  - Not many people are using it, and it is causing some issues with Docker.


author: Paul Wouters <pwouters@redhat.com> - 3.22-2
changelog:
  - Resolves: rhbz#1471763 RFE: libreswan MOBIKE support (RFC-4555)
  - Resolves: rhbz#1372050 RFE: Support IKE and ESP over TCP: RFC 8229


author: Paul Wouters <pwouters@redhat.com> - 3.22-3
changelog:
  - Resolves: rhbz#1475434 Add support for AES-GMAC for ESP (RFC-4543) to libreswan
  - Resolves: rhbz#1300759 Implement RFC-7427 Digital Signature authentication


author: Paul Wouters <pwouters@redhat.com> - 3.22-5
changelog:
  - Resolves: rhbz#1471763 RFE: libreswan MOBIKE support (RFC-4555) [updated]
  - Resolves: rhbz#1471553 libreswan postquantum preshared key (PPK) support
  - Resolves: rhbz#1375776 [IKEv2 Conformance] Test IKEv2.EN.R.1.2.2.1: Receipt of retransmitted CREATE_CHILD_SA reques failed
  - Resolves: rhbz#1375750 SECCOMP support for libreswan [updated for libunbound syscalls]
  - Resolves: rhbz#1300763 Implement draft-ietf-ipsecme-split-dns for libreswan


author: Paul Wouters <pwouters@redhat.com> - 3.23-0.1.rc4
changelog:
  - Resolves: rhbz#1471763 RFE: libreswan MOBIKE support (RFC-4555) [client support]
  - Resolves: rhbz#1457904 rebase libreswan to 3.23 [updated]
  - Resolves: rhbz#1471553 libreswan postquantum preshared key (PPK) support
  - Resolves: rhbz#1492501 Reboot or 'systemctl stop ipsec' brings down _ethernet_ interfaces on _both_ ends of ipv4 ipsec tunnel
  - Resolves: rhbz#1324421 libreswan works not well when setting leftid field to be email address
  - Resolves: rhbz#1136076 After IKE rekeying Pluto sends DPD even if there is active SA


author: Paul Wouters <pwouters@redhat.com> - 3.23-2
changelog:
  - Resolves: rhbz#1457904 rebase libreswan to 3.23 [updated]
  - Resolves: rhbz#1375750 SECCOMP support for libreswan [updated]


author: Paul Wouters <pwouters@redhat.com> - 3.23-4
changelog:
  - Resolves: rhbz#1573949 ipsec newhostkey fails in FIPS mode when RSA key is generated
  - Resolves: rhbz#1574456 Shared IKE SA leads to rekey interop issues
  - Resolves: rhbz#1574457 IKEv2 liveness false positive on IKEv2 idle connections causes tunnel to be restarted


author: Richard W.M. Jones <rjones@redhat.com> - 5.13-2
changelog:
  - Enable /etc/watchdog.d directory for storing test binaries
    (RHBZ#657750, RHBZ#831190).
  - Missing BR systemd-units.
  - Update .gitignore.
  - Drop Group line, not required by modern RPM.


author: Ales Ledvinka <aledvink@redhat.com> - 5.13-9
changelog:
  - SELinux: Add /usr/libexec/watchdog/scripts/ for test-bin and repair-bin to inherit from.
  - systemd: service with network available dependency
  - systemd: correct cgroup for realtime settings
  - Document SELinux and systemd.


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.80-2.6.0.0
changelog:
  - Add GConf2-devel dependency for native proxy fallback support.
  - Remove libxslt dependency pulled in from IcedTea builds.
  - Reduce redhat-lsb dependency to redhat-lsb-core (lsb_release)
  - Resolves: rhbz#1235158


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.80-2.6.0.1
changelog:
  - Pass SYSTEM_GSETTINGS="true" to the OpenJDK build to explicitly enable the GSettings API.
  - Resolves: rhbz#1235158


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.91-2.6.2.0
changelog:
  - Bump to 2.6.2 and u91b00.
  - Disable system LCMS 2 for now until security of it can be verified.
  - Sync minor changes from RHEL 6 spec file.
  - Resolves: rhbz#1271921


author: Paul Howarth <paul@city-fan.org> - 2.055-1
changelog:
  - Update to 2.055
    - Fix misuse of magic in API (CPAN RT#78080)
  - Drop redundant explicit requires for perl(Exporter) and perl(File::Temp)


author: Paul Howarth <paul@city-fan.org> - 2.058-1
changelog:
  - Update to 2.058
    - Compress::Raw::Bzip2 needs to use PERL_NO_GET_CONTEXT (CPAN RT#80318)
    - Install to 'site' instead of 'perl' when perl version is 5.11+
      (CPAN RT#79811)
    - Update to ppport.h that includes SvPV_nomg_nolen (CPAN RT#78080)


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.45-7.b13
changelog:
  - Re-add %{name} prefix to patches to avoid conflicts with OpenJDK 7 versions.
  - Remove ppc64le test case now fix has been verified.
  - Resolves: rhbz#1194378


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.51-0.b16
changelog:
  - July 2015 security update to u51b16.
  - Add script for generating OpenJDK tarballs from a local Mercurial tree.
  - Add %{name} prefix to patches to avoid conflicts with OpenJDK 7 versions.
  - Add patches for RH issues fixed in IcedTea 2.x and/or the upcoming u60.
  - Use 'openjdk' as directory prefix to allow patch interchange with IcedTea.
  - Re-generate EC disablement patch following CPU DH changes.
  - Resolves: rhbz#1235162


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.51-1.b16
changelog:
  - Add md5sum for January 2015 java.security update so it gets updated this time.
  - Resolves: rhbz#1235162


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.65-0.b17
changelog:
  - October 2015 security update to u65b17.
  - Add script for generating OpenJDK tarballs from a local Mercurial tree.
  - Update RH1191652 patch to build against current AArch64 tree.
  - Use appropriate source ID to avoid unpacking both tarballs on AArch64.
  - Add MD5 checksums for java.security from 8u51 and 8u60 RPMs.
  - Resolves: rhbz#1257656


author: Parag Nemade <paragn AT fedoraproject DOT org> - 1.2.0-2
changelog:
  - revert the wrongly committed f18 spec to f19
  - spec file cleanup
  - thanks to jnovy for finding me minimum texlive BR
  - partial multilib fix for manual.html


author: Parag Nemade <paragn AT fedoraproject DOT org> - 1.2.0-4
changelog:
  - Drop refman.pdf as its same as manual.html
  - patch install path for cmake files as they are arch dependent


author: Miroslav Lichvar <mlichvar@redhat.com> 1.4-1.20140718gitbdb6a3
changelog:
  - update to 20140718gitbdb6a3 (#1108795, #1059039)
  - fix PIE linking (#1092537)
  - replace hardening build flags with _hardened_build
  - include simulation test suite


author: Miroslav Lichvar <mlichvar@redhat.com> 1.4-2.20140718gitbdb6a3
changelog:
  - add timemaster (#1085580)
  - send peer messages to correct address
  - make NTP SHM segment number configurable
  - update UDS handling to allow running multiple ptp4l/phc2sys instances
  - fix warnings from static analysis


author: Miroslav Lichvar <mlichvar@redhat.com> 1.4-3.20140718gitbdb6a3
changelog:
  - fix resetting of linreg servo (#1165045)
  - fix phc2sys automatic mode with multiple interfaces (#1108795)


author: Miroslav Lichvar <mlichvar@redhat.com> 1.8-5
changelog:
  - add support for active-backup bonding (#1002657)
  - add support for IP over InfiniBand (#1472880)
  - fix handling of unknown/invalid management TLVs in pmc (#1459446 #1459449)


author: Gris Ge <fge@redhat.com> 1.4.0-1
changelog:
  - Add Python3 support.
  - New sub rpm package python3-libstoragemgmt.
  - Add support of lmiwbem.
  - Allow plugin test to be run concurrently.
  - Bug fixes:
      * Fix megaraid plugin for dell PERC.
      * Fix local disk rotation speed query on NVMe disk.
      * Fix lsmcli incorrect try-expect on local disk query.
      * Fix all the gcc compile warnings.
      * Fix the obsolete usage of AC_OUTPUT in configure.ac.
  - Library adds:
      * Query serial of local disk:
          lsm_local_disk_serial_num_get()/lsm.LocalDisk.serial_num_get()
      * Query LED status of local disk:
          lsm_local_disk_led_status_get()/lsm.LocalDisk.led_status_get()
      * Query link speed of local disk:
          lsm_local_disk_link_speed_get()/lsm.LocalDisk.link_speed_get()


author: Honza Horak <hhorak@redhat.com> - 3:1.37.1-5
changelog:
  - Remove SysV init conversion and systemd macros compatible code
  - Require systemd instead systemd-units
  - Remove systemd-sysv


author: Petr Kubat <pkubat@redhat.com> - 3:1.37.1-8
changelog:
  - Do not restart ypbind when domain is unchanged (#1301708)
  - Load ypbind.service before nss-user-lookup.target (#1217435)


author: Jakub Jelinek <jakub@redhat.com> 4.8.2-18
changelog:
  - update from the 4.8 branch
    - PRs c++/60367, c++/60628, c++/60689, c++/60708, c++/60713, debug/60603,
  	driver/61106, libfortran/56919, libfortran/60810, libstdc++/60497,
  	libstdc++/60594, libstdc++/61117, middle-end/36282, middle-end/55022,
  	middle-end/60635, middle-end/60729, middle-end/60750,
  	middle-end/60849, middle-end/60895, rtl-optimization/60769,
  	target/57589, target/58595, target/59952, target/60516, target/60609,
  	target/60672, target/60693, target/60839, target/60909, target/60941,
  	target/60991, target/61026, target/61055, tree-optimization/57864,
  	tree-optimization/59817, tree-optimization/60453,
  	tree-optimization/60502, tree-optimization/60740,
  	tree-optimization/60766, tree-optimization/60836,
  	tree-optimization/60903, tree-optimization/60930,
  	tree-optimization/60960
  - backport OpenMP 4.0 support to libgomp (library only; PR libgomp/58691)


author: Jakub Jelinek <jakub@redhat.com> 4.8.3-1
changelog:
  - update from the 4.8 branch
    - GCC 4.8.3 release
    - PRs c++/60605, c++/60731, c++/61134, fortran/45187, ipa/61393,
  	libfortran/61187, libfortran/61310, libstdc++/60734, libstdc++/60966,
  	rtl-optimization/60866, rtl-optimization/60901, rtl-optimization/61094,
  	rtl-optimization/61446, target/61044, target/61193, target/61202,
  	target/61208, target/61231, target/61239, target/61249, target/61300,
  	target/61415, target/61423, target/61431, target/61443, target/61483,
  	target/61545, target/61570, tree-optimization/61383


author: Jakub Jelinek <jakub@redhat.com> 4.8.3-2
changelog:
  - update from the 4.8 branch
    - PRs c++/61500, c++/61539, c++/61647, fortran/58883, fortran/61459,
  	middle-end/53590, rtl-optimization/61801, target/61542, target/61586,
  	tree-optimization/61306, tree-optimization/61684
  - for rhel 7.1 keep the old 4.8.2 pathnames and use 4.8.3 symlinks
  - merge in aarch64 support (#1070290)
  - small improvements on s390x for z196 and later (#1088542)
  - make sure OpenMP outlined artificial functions have DW_AT_name (#844959)


author: Jakub Jelinek <jakub@redhat.com> 4.8.3-4
changelog:
  - update from the 4.8 branch
    - PRs fortran/61780, libobjc/61920, target/47230, tree-optimization/61375,
  	tree-optimization/61964
    - fix libgfortran overflows on allocation (CVE-2014-5044)
  - backport ibm-ldouble performance improvements (#1090620)


author: Jakub Jelinek <jakub@redhat.com> 4.8.3-6
changelog:
  - update from the 4.8 branch (#1140019)
    - PRs c++/58714, c++/59823, c++/59956, c++/60241, c++/60361, c++/61959,
  	c/61271, debug/55794, debug/60655, debug/61923, fortran/61999,
  	fortran/62214, fortran/62270, ipa/61986, ipa/62015, libgfortran/62188,
  	libstdc++/58962, libstdc++/61946, middle-end/61010, middle-end/61045,
  	middle-end/62103, rtl-optimization/62004, rtl-optimization/62030,
  	target/61996, target/62038, target/62195, testsuite/56194,
  	tree-optimization/60196, tree-optimization/60707,
  	tree-optimization/61452, tree-optimization/62073,
  	tree-optimization/62075, tree-optimization/63189


author: Jakub Jelinek <jakub@redhat.com> 4.8.3-8
changelog:
  - fix PowerPC unaligned vectorization bug (#1146871,
    PR tree-optimization/63341)
  - fix another -fcompare-debug issue (PR debug/63284)


author: Petr Šabata <contyk@redhat.com> - 1.05-26.2
changelog:
  - Fix the package for el7
  - Modernize the spec
  - Correct a bogus date in changelog
  - Unify spec whitespace


author: Richard Hughes <rhughes@redhat.com> - 3.8.2-2
changelog:
  - Ignore package progress updates when the transaction is being simulated which
    fixes the 100% CPU issue when trying to update a large number of packages.
  - Resolves: #969852


author: Richard Hughes <rhughes@redhat.com> - 3.8.2-3
changelog:
  - Show the update and installer items in a KDE desktop as RHEL does not
    ship Apper.
  - Resolves: #1033672


author: Brian C. Lane <bcl@redhat.com> 3.1-21
changelog:
  - Backport fix for 1 sector logical partition separation from start of extended
    Resolves: rhbz#1212323


author: Brian C. Lane <bcl@redhat.com> 3.1-22
changelog:
  - Use 512b sector size when communicating with device-mapper
    Resolves: rhbz#1188431
  - Add a test to make sure partitions are the correct size on device-mapper
    Related: rhbz#1188431


author: Brian C. Lane <bcl@redhat.com> 3.1-23
changelog:
  - libparted: Use read only when probing devices on linux
    Resolves: rhbz#1245144
  - tests: Use wait_for_dev_to_ functions
    Related: rhbz#1245144


author: Brian C. Lane <bcl@redhat.com> 3.1-24
changelog:
  - tests: Add udevadm settle to wait_for_ loop
    Related: rhbz#1260664
  - tests: Add-wait-to-t9042
    Resolves: rhbz#1257415
  - tests: Fix t1700 failing on a host with a 4k xfs file
    Related: rhbz#1260664


author: Brian C. Lane <bcl@redhat.com> 3.1-25
changelog:
  - docs: Add list of filesystems for fs-type
    Resolves: rhbz#1311596
  - libparted: Remove fdasd geometry code from alloc_metadata
    Resolves: rhbz#1244833


author: Brian C. Lane <bcl@redhat.com> - 3.1-29
changelog:
  - Add support for NVMe devices
    Resolves: rhbz#1316239
  - Backport partition resize command
    Resolves: rhbz#1423357


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.54-2
changelog:
  - Complete ID views support to BIND operation
  - Ignore ID views outside schema-compat subtrees
  - Use 389-ds API compatible with RHEL 7.0
  - Resolves: #1151436


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.54-6
changelog:
  - delay sending responses from compat tree after map cache search
  - Resolves: #1281748
  - fix processing of ID views
  - Resolves: #1281750, #1281752


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.171-2.6.13.1
changelog:
  - Fix missing return statement in hotspot/src/os_cpu/linux_aarch64/vm/os_linux_aarch64.cpp
  - Temporarily add -Wno-error=return-type so we can catch them all.
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.171-2.6.13.1
changelog:
  - Extend pr3393-rh1273760.patch so Token.getMechanismInfo can handle CK_MECHANISM
  - Fix missing return statement in hotspot/src/cpu/aarch64/vm/vm_version_aarch64.cpp
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.171-2.6.13.1
changelog:
  - Update to new tarball with AArch64 return value fixes, dropping local patch.
  - Drop -Wno-error=return-type now they appear to be fixed.
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.171-2.6.13.1
changelog:
  - Spoke too soon... fix missing return statement in src/os_cpu/linux_zero/vm/os_linux_zero.cpp (non-LP64 only)
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.171-2.6.13.2
changelog:
  - Rebuild with RPM optimisation flags disabled due to issues on x86 multilib
  - Resolves: rhbz#1528233


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-12
changelog:
  - workaround failing autogen
  - move files from /lib
  - don't own ntp-units.d directory
  - drop old systemd scriptlets
  - fix dates in changelog


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-13
changelog:
  - ignore duplicate servers from dhclient
  - don't use -Wstrict-overflow with -fno-strict-overflow
  - buildrequire systemd-units
  - remove pie test


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-16
changelog:
  - refresh peers on routing updates (#1048132)
  - fix calculation of root dispersion (#1045377)
  - remove unnecessary IPv6 restrict line from default ntp.conf (#1048255)
  - remove kod from default restrict in ntp.conf (#1048255)
  - update logconfig documentation for patched default (#1048252)


author: Pavel Zhukov <pzhukov@redhat.com> - 12:4.2.5-55
changelog:
  - Resolves: #1349044 - Add disclamer for chaging /etc/dhcp permission for scripts
  - Fix syntax error in attr


author: Martin Pitt <mpitt@redhat.com> 159-1
changelog:
  - Update to 159 release
  - Configure data deduplication with VDO devices on Storage page
  - Add serial console to virtual Machines page and redesign the Consoles tab
  - Show more error message details for failures on virtual Machines page


author: Martin Pitt <mpitt@redhat.com> 160-2
changelog:
  - Add kubevirt Virtual Machines overview
  - Redesign package list on Software Updates page and show RHEL Errata


author: Martin Pitt <mpitt@redhat.com> 165-1
changelog:
  - Update to 165 release
  - New VMs can be created on Machines page
  - Improve LVM volume resizing
  - Hide Docker storage pool reset button when it cannot work properly
  - Move NFS management into new details page
  - Show more details of sessions and services that keep NFS busy
  - Machines page now shows proper error notifications
  - Show virtual machines that are being created
  - Detect if libvirtd is not running and offer to start and/or enable it
  - Enable building of cockpit-machines-ovirt rhbz#1515796


author: Martin Pitt <mpitt@redhat.com> 169-1
changelog:
  - Update to 169 release
  - Storage: Offer installation of NFS client support on demand
  - Containers: Don't try to manage "overlay2" storage without a volume group
  - Machines: Fix "Start VM" checkbox layout
  - Software Updates: Fix security update icon rhbz#1582570
  - Drop obsolete cockpit-bashboard SELinux %post hack rhbz#1570833


author: Martin Pitt <mpitt@redhat.com> 170-1
changelog:
  - Update to 170 release
  - Software Updates: Layout rework
  - oVirt: Use authenticated libvirt connection by default rhbz#1297037


author: Martin Pitt <mpitt@redhat.com> 172-2
changelog:
  - Update to 172 release
  - Software Updates: Layout rework
  - Machines: Add virtual CPU configuration
  - Docker: Show container volumes


author: Martin Preisler <mpreisle@redhat.com> 1.1.1-1
changelog:
  - Require English fonts (bz#1134418)
  - Updated with latest upstream URLs
  - Reorganized the spec a little
  - Removed SCL related parts from the spec
  - Updated to new upstream release 1.1.1


author: Watson Sato <wsato@redhat.com> 1.1.4-1
changelog:
  - Updated to new upstream release 1.1.4 (rhbz#1404394)
  - UX improvements
  - Fixed fetch remote resources warning (rhbz#1367923)
  - Improved error message when scanning a remote machine in which openscap-scanner
    is not installed (rhbz#1368463)
  - Fixed search on disabled item (rhbz#1368493)
  - Fixed multi benchmark tailoring use case
  - Fixed a bug that caused tailored profiles to have titles duplicated (rhbz#1320197)
  - Fixed path of tailoring file in dry run output (rhbz#1368516)
  - Now Workbench doesn't allow edit of values with prohibitedChanges attribute
  - Added --version and --help command line options (rhbz#1368527)
  - Improved workflow of dry run execution (rhbz#1385549)
  - Check capabilities of oscap with propper arguments (rhbz#1368463)
  - Show number of selected rules in profile listing


author: Martin Preisler <mpreisle@redhat.com> 1.1.6-1
changelog:
  - Updated to new upstream release 1.1.6
  - Tri-state checkboxes for tailoring
  - Fixed remote host and port being cleared when scan starts
  - Fiixed formating of Profile html description in Tailoring Window
  - Fixed oscap message "Downloading ... ok" appearing as an error
  - Fixed tab order of widgets in main window
  - Load Content as the default button of the SSG integration dialog
  - New validation of the customization file name
  - Generate bash and Ansible remediation roles from profiles
  - Generate bash and Ansible remediation roles from results after scanning
  - Fixed a short integer overflow when using ssh port numbers higher than 32k
  - Fixed long loading times on OSX
  - Open tailoring file directly via command line


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-43
changelog:
  - Resolves: rhbz#1440132 - fiter_users and filter_groups stop working
                             properly in v 1.15


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-44
changelog:
  - Resolves: rhbz#1457927 - getent failed to fetch netgroup information
                             after changing default_domain_suffix to
                             ADdomin in /etc/sssd/sssd.conf


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-47
changelog:
  - Resolves: rhbz#1430415 - ldap_purge_cache_timeout in RHEL7.3 invalidate
                             most of the entries once the cleanup task kicks in


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-48
changelog:
  - Resolves: rhbz#1459846 - krb5: properly handle 'password expired'
                             information retured by the KDC during
                             PKINIT/Smartcard authentication


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-49
changelog:
  - Resolves: rhbz#1450107 - SSSD doesn't handle conflicts between users
                             from trusted domains with the same name when
                             shortname user resolution is enabled


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-50
changelog:
  - Resolves: rhbz#1457926 - Wrong search base used when SSSD is directly
                             connected to AD child domain


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-50.1
changelog:
  - Resolves: rhbz#1478250 - Idle nss file descriptors should be closed
                             [rhel-7.4.z]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-50.2
changelog:
  - Resolves: rhbz#1478252 - Querying the AD domain for external domain's
                             ID can mark the AD domain offline [rhel-7.4.z]


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-100.el7
changelog:
  - kvm-block-update-test-070-for-vhdx.patch [bz#1171576]
  - kvm-block-coverity-fix-check-return-value-for-fcntl-in-g.patch [bz#1219217]
  - Resolves: bz#1171576
    (test case 064 and 070 of qemu-iotests fail for vhdx with qemu-kvm-1.5.3-83.el7)
  - Resolves: bz#1219217
    (Coverity-detected defect: call to fcntl without checking return value)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-101.el7
changelog:
  - kvm-serial-reset-state-at-startup.patch [bz#922014]
  - kvm-ide-Check-validity-of-logical-block-size.patch [bz#1134670]
  - Resolves: bz#1134670
    (fail to specify the physical_block_size/logical_block_size value not 512 for IDE disk)
  - Resolves: bz#922014
    (RFE: support hotplugging chardev & serial ports (Windows guests))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-102.el7
changelog:
  - kvm-mc146818rtc-add-rtc-reset-reinjection-QMP-command.patch [bz#1191226]
  - Resolves: bz#1191226
    (libvirt requires rtc-reset-reinjection command, backport it to RHEL7.1)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-103.el7
changelog:
  - kvm-Drop-superfluous-conditionals-around-g_strdup.patch [bz#1218919]
  - kvm-util-Drop-superfluous-conditionals-around-g_free.patch [bz#1218919]
  - kvm-util-Fuse-g_malloc-memset-into-g_new0.patch [bz#1218919]
  - kvm-util-uri-uri_new-can-t-fail-drop-dead-error-handling.patch [bz#1218919]
  - kvm-util-uri-realloc2n-can-t-fail-drop-dead-error-handli.patch [bz#1218919]
  - kvm-util-uri-URI-member-path-can-be-null-compare-more-ca.patch [bz#1218919]
  - kvm-util-uri-Add-overflow-check-to-rfc3986_parse_port.patch [bz#1218919]
  - Resolves: bz#1218919
    (Coverity-detected defect: buffer overrun at uri.c:2035)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-104.el7
changelog:
  - kvm-qemu-iotests-Filter-qemu-io-output-in-025.patch [bz#1170974]
  - Resolves: bz#1170974
    (test case 025 of qemu-iotests fail for raw with qemu-kvm-1.5.3-83.el7.x86_64)


author: Jeff E. Nelson <jen@redhat.com> - 1.5.3-105.el7
changelog:
  - kvm-qtest-ide-test-disable-flush-test.patch [bz#1270341]
  - Resolves: bz#1270341
    (qemu-kvm build failure race condition in tests/ide-test)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-105.el7_2.1
changelog:
  - kvm-rbd-make-qemu-s-cache-setting-override-any-ceph-sett.patch [bz#1279389]
  - kvm-rbd-fix-ceph-settings-precedence.patch [bz#1279389]
  - Resolves: bz#1279389
    (ceph.conf properties override qemu's command-line properties)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-105.el7_2.2
changelog:
  - kvm-raw-posix-Fix-.bdrv_co_get_block_status-for-unaligne.patch [bz#1298828]
  - Resolves: bz#1298828
    ([abrt] qemu-img: get_block_status(): qemu-img killed by SIGABRT)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-105.el7_2.3
changelog:
  - kvm-fw_cfg-add-check-to-validate-current-entry-value-CVE.patch [bz#1298047]
  - Resolves: bz#1298047
    (CVE-2016-1714 qemu-kvm: Qemu: nvram: OOB r/w access in processing firmware configurations [rhel-7.2.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-105.el7_2.4
changelog:
  - kvm-vga-Remove-some-should-be-done-in-BIOS-comments.patch [bz#1331412]
  - kvm-vga-fix-banked-access-bounds-checking-CVE-2016-3710.patch [bz#1331412]
  - kvm-vga-add-vbe_enabled-helper.patch [bz#1331412]
  - kvm-vga-factor-out-vga-register-setup.patch [bz#1331412]
  - kvm-vga-update-vga-register-setup-on-vbe-changes.patch [bz#1331412]
  - kvm-vga-make-sure-vga-register-setup-for-vbe-stays-intac.patch [bz#1331412]
  - Resolves: bz#1331412
    (EMBARGOED CVE-2016-3710 qemu-kvm: qemu: incorrect banked access bounds checking in vga module [rhel-7.2.z])


author: Andrew Price <anprice@redhat.com> - 3.1.8-4
changelog:
  - fsck.gfs2: Change duptree structure to have generic flags
  - fsck.gfs2: Detect, fix and clone duplicate block refs within a dinode
    Resolves: rhbz#1236669


author: Andrew Price <anprice@redhat.com> - 3.1.8-5
changelog:
  - gfs2-utils: Fix hang on withdraw (4 patches)
  - Include new withdraw helper scripts in files section
    Resolves: rhbz#1225634


author: Andrew Price <anprice@redhat.com> - 3.1.9-1
changelog:
  - Rebase to new upstream release 3.1.9
    Resolves: rhbz#1271674
    Resolves: rhbz#1162819
    Resolves: rhbz#1196321
    Resolves: rhbz#1202814
    Resolves: rhbz#1251036
    Resolves: rhbz#1257625
    Resolves: rhbz#1268045
    Resolves: rhbz#1283866
    Resolves: rhbz#1332728


author: Andrew Price <anprice@redhat.com> - 3.1.9-2
changelog:
  - fsck.gfs2: "undo" functions can stop too early on duplicates
    Resolves: rhbz#1348703
  - fsck.gfs2: link count checking wrong inode's formal inode number
    Resolves: rhbz#1350597
  - fsck.gfs2: check formal inode number when links go from 1 to 2
    Resolves: rhbz#1350600


author: Andrew Price <anprice@redhat.com> - 3.1.10-1
changelog:
  - Rebase to new upstream version 3.1.10
    Resolves: rhbz#1348601
    Resolves: rhbz#1356685
    Resolves: rhbz#1382087
    Resolves: rhbz#1405163
    Resolves: rhbz#1430399
  - Make dependency on libuuid explicit


author: Andrew Price <anprice@redhat.com> - 3.1.10-3
changelog:
  - libgfs2: Issue one write per rgrp when creating them
  - mkfs.gfs2: Fix resource group alignment issue
  - mkfs.gfs2: Free unnecessary cached pages, disable readahead
    Resolves: rhbz#1440269


author: dwalsh <dwalsh@redhat.com> - 0.1.25-2.git2e8377a7
changelog:
  -  Add manifest type conversion to skopeo copy
  -  User can select from 3 manifest types: oci, v2s1, or v2s2
  -   e.g skopeo copy --format v2s1 --compress-blobs docker-archive:alp.tar dir:my-directory


author: dwalsh <dwalsh@redhat.com> - 0.1.29-2.git
changelog:
  - bump to 0.1.29-1
  - Updated containers/image
      docker-archive generates docker legacy compatible images
      Do not create $DiffID subdirectories for layers with no configs
      Ensure the layer IDs in legacy docker/tarfile metadata are unique
      docker-archive: repeated layers are symlinked in the tar file
      sysregistries: remove all trailing slashes
      Improve docker/* error messages
      Fix failure to make auth directory
      Create a new slice in Schema1.UpdateLayerInfos
      Drop unused storageImageDestination.{image,systemContext}
      Load a *storage.Image only once in storageImageSource
      Support gzip for docker-archive files
      Remove .tar extension from blob and config file names
      ostree, src: support copy of compressed layers
      ostree: re-pull layer if it misses uncompressed_digest|uncompressed_size
      image: fix docker schema v1 -> OCI conversion
      Add /etc/containers/certs.d as default certs directory


author: Denys Vlasenko <dvlasenk@redhat.com> - 0.2.7-4
changelog:
  - Forward-porting fixes from RHEL6.
  - Enlarge buffer used for formatting date in a string format.
  - Resolves: rhbz#891938.
  - Allow configuration of the maximum number of open files.
  - Resolves: rhbz#738967.


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-12.el7
changelog:
  - Resolves: #1447284 Upgrade from ipa-4.1 fails when enabling KDC proxy
    - python2-ipalib: add missing python dependency
    - installer service: fix typo in service entry
    - upgrade: add missing suffix to http instance
  - Resolves: #1444791 Update man page of ipa-kra-install 
    - ipa-kra-install manpage: document domain-level 1
  - Resolves: #1441493 ipa cert-show raises stack traces when
    --certificate-out=/tmp 
    - cert-show: writable files does not mean dirs 
  - Resolves: #1441192 Add the name of URL parameter which will be check for
    username during cert login
    - Bump version of ipa.conf file
  - Resolves: #1378797 Web UI must check OCSP and CRL during smartcard login
    - Turn on NSSOCSP check in mod_nss conf
  - Resolves: #1322963 Errors from AD when trying to sign ipa.csr, conflicting
    template on
    - renew agent: respect CA renewal master setting
    - server upgrade: always fix certmonger tracking request
    - cainstance: use correct profile for lightweight CA certificates
    - renew agent: allow reusing existing certs
    - renew agent: always export CSR on IPA CA certificate renewal
    - renew agent: get rid of virtual profiles
    - ipa-cacert-manage: add --external-ca-type
  - Resolves: #1441593 error adding authenticator indicators to host 
    - Fixing adding authenticator indicators to host
  - Resolves: #1449525 Set directory ownership in spec file 
    - Added plugins directory to ipaclient subpackages
    - ipaclient: fix missing RPM ownership
  - Resolves: #1451279 otptoken-add-yubikey KeyError: 'ipatokenotpdigits'
    - otptoken-add-yubikey: When --digits not provided use default value


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-13.el7
changelog:
  - Resolves: #1451804 "AttributeError: 'tuple' object has no attribute 'append'"
    error observed during ipa upgrade with latest package. 
    - ipa-server-install: fix uninstall
  - Resolves: #1445390 ipa-[ca|kra]-install with invalid DM password break
    replica 
    - ca install: merge duplicated code for DM password
    - installutils: add DM password validator
    - ca, kra install: validate DM password


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-14.el7
changelog:
  - Resolves: #1438731 Extend ipa-server-certinstall and ipa-certupdate to 
    handle PKINIT certificates/anchors
    - certdb: add named trust flag constants
    - certdb, certs: make trust flags argument mandatory
    - certdb: use custom object for trust flags
    - install: trust IPA CA for PKINIT
    - client install: fix client PKINIT configuration
    - install: introduce generic Kerberos Augeas lens
    - server install: fix KDC PKINIT configuration
    - ipapython.ipautil.run: Add option to set umask before executing command
    - certs: do not export keys world-readable in install_key_from_p12
    - certs: do not export CA certs in install_pem_from_p12
    - server install: fix KDC certificate validation in CA-less
    - replica install: respect --pkinit-cert-file
    - cacert manage: support PKINIT
    - server certinstall: support PKINIT
  - Resolves: #1444432 CA-less pkinit not installable with --pkinit-cert-file
    option
    - certs: do not export CA certs in install_pem_from_p12
    - server install: fix KDC certificate validation in CA-less
  - Resolves: #1451228 ipa-kra-install fails when primary KRA server has been
    decommissioned
    - ipa-kra-install: fix pkispawn setting for pki_security_domain_hostname 
  - Resolves: #1451712 KRA installation fails on server that was originally
    installed as CA-less
    - ipa-ca-install: append CA cert chain into /etc/ipa/ca.crt
  - Resolves: #1441499 ipa cert-show does not raise error if no file name
    specified
    - ca/cert-show: check certificate_out in options
  - Resolves: #1449522 Deprecate `ipa pkinit-anonymous` command in FreeIPA 4.5+
    - Remove pkinit-anonymous command
  - Resolves: #1449523 Provide an API command to retrieve PKINIT status
    in the FreeIPA topology
    - Allow for multivalued server attributes
    - Refactor the role/attribute member reporting code
    - Add an attribute reporting client PKINIT-capable servers
    - Add the list of PKINIT servers as a virtual attribute to global config
    - Add `pkinit-status` command
    - test_serverroles: Get rid of MockLDAP and use ldap2 instead
  - Resolves: #1452216 Replica installation grants HTTP principal access in WebUI
    - Fix rare race condition with missing ccache file
  - Resolves: #1455045 Simple service uninstallers must be able to handle
    missing service files gracefully
    - only stop/disable simple service if it is installed
  - Resolves: #1455541 after upgrade login from web ui breaks
    - krb5: make sure KDC certificate is readable
  - Resolves: #1455862 "ipa: ERROR: an internal error has occurred" on executing
    command "ipa cert-request --add" after upgrade
    - Change python-cryptography to python2-cryptography


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-15.el7
changelog:
  - Resolves: #1442233 IPA client commands fail when pointing to replica 
    - httpinstance: wait until the service entry is replicated
  - Resolves: #1456769 ipaAnchorUUID index incorrectly configured and then
    not indexed
    - Fix index definition for ipaAnchorUUID
  - Resolves: #1438016 gssapi errors after IPA server upgrade
    - Avoid possible endless recursion in RPC call
    - rpc: preparations for recursion fix
    - rpc: avoid possible recursion in create_connection
  - Resolves: #1446087 services entries missing krbCanonicalName attribute.
    - Changing cert-find to do not use only primary key to search in LDAP.
  - Resolves: #1452763 ipa certmaprule change not reflected in krb5kdc workers
    - ipa-kdb: reload certificate mapping rules periodically
  - Resolves: #1455541 after upgrade login from web ui breaks
    - kdc.key should not be visible to all 
  - Resolves: #1435606 Add pkinit_indicator option to KDC configuration
    - ipa-kdb: add pkinit authentication indicator in case of a successful
      certauth
  - Resolves: #1455945 Enabling OCSP checks in mod_nss breaks certificate
    issuance when ipa-ca records are not resolvable
    - Turn off OCSP check
  - Resolves: #1454483 rhel73 ipa ui - cannot del server - IPA Error 903 -
    server_del - TypeError: 'NoneType' object is not iterable
    - fix incorrect suffix handling in topology checks


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-16.el7
changelog:
  - Resolves: #1377973 ipa-server-install fails when the provided or resolved
    IP address is not found on local interfaces
    - Only warn when specified server IP addresses don't match intf
  - Resolves: #1438016 gssapi errors after IPA server upgrade
    - Bump version of python-gssapi
  - Resolves: #1457942 certauth: use canonical principal for lookups
    - ipa-kdb: use canonical principal in certauth plugin
  - Resolves: #1459153 Do not send Max-Age in ipa_session cookie to avoid
    breaking older clients
    - Add code to be able to set default kinit lifetime
    - Revert setting sessionMaxAge for old clients


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-15.7
changelog:
  - Resolves: #1304333 In IPA-AD trust environment some secondary IPA based Posix
    groups are missing
    - ipa-kdb: map_groups() consider all results


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-15.8
changelog:
  - Resolves: #1303052 install fails when locale is "fr_FR.UTF-8"
    - Do not decode HTTP reason phrase from Dogtag
  - Resolves: #1303059 --setup-dns and other options is forgotten for using an
    external PKI
    - installer: Propagate option values from components instead of copying them.
    - installer: Fix logic of reading option values from cache.
  - Resolves: #1309362 User should be notified for wrong password in password
    reset page
    - Fixed login error message box in LoginScreen page
  - Resolves: #1309382 issues with migration from RHEL 6 self-signed to RHEL 7 CA
    IPA setup
    - ipa-ca-install: print more specific errors when CA is already installed
    - cert renewal: import all external CA certs on IPA CA cert renewal
    - CA install: explicitly set dogtag_version to 10
    - fix standalone installation of externally signed CA on IPA master
    - replica install: validate DS and HTTP server certificates


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-15.9
changelog:
  - Resolves: #1311468 shared certificateProfiles container is missing on a
    freshly installed RHEL7.2 system
    - upgrade: unconditional import of certificate profiles into LDAP
  - Resolves: #1311470 ipa trust-add succeded but after that ipa trust-find
    returns "0 trusts matched"
    - upgrade: fix config of sidgen and extdom plugins
    - trusts: use ipaNTTrustPartner attribute to detect trust entries
    - Warn user if trust is broken
    - fix upgrade: wait for proper DS socket after DS restart
  - Resolves: #1311502 [RFE] compat tree: show AD members of IPA groups
    - slapi-nis: update configuration to allow external members of IPA groups


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-15.10
changelog:
  - Resolves: #1311470 ipa trust-add succeded but after that ipa trust-find
    returns "0 trusts matched"
    - Insure the admin_conn is disconnected on stop
    - Fix connections to DS during installation
  - Renamed patch 1011 to 0196, as it was merged upstream


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-15.11
changelog:
  - Resolves: #1311470 ipa trust-add succeded but after that ipa trust-find
    returns "0 trusts matched"
    - Fix broken trust warnings


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-15.12
changelog:
  - Resolves: #1309382 issues with migration from RHEL 6 self-signed to RHEL 7 CA
    IPA setup
    - replica install: improvements in the handling of CA-related IPA config
      entries


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-15.13
changelog:
  - Resolves: #1324060 Installers fail when there are multiple versions of the
    same certificate
    - certdb: never use the -r option of certutil


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-15.15
changelog:
  - Related: #1327197 Crash during IPA upgrade due to slapd
    - spec file: update minimum required version of slapi-nis


author: Dan Horák <dhorak@redhat.com> - 3.7.0-1
changelog:
  - rebased to 3.7.0 (#1507619)
  - fix test-suite run under root (#1267928)
  - Resolves: #1507619, #1267928


author: Jakub Jelinek <jakub@redhat.com> 4.8.5-8
changelog:
  - fix a bug in C++ ref-to-ptr conversion (#1344807)
  - fix combiner handling of jumps on aarch64 (#1344672,
    PR rtl-optimization/52714)


author: Jakub Jelinek <jakub@redhat.com> 4.8.5-9
changelog:
  - backport OpenMP 4.5 support to libgomp (library only; #1357060,
    PRs libgomp/68579, libgomp/64625)


author: Jakub Jelinek <jakub@redhat.com> 4.8.5-11
changelog:
  - on aarch64 emit scheduling barriers before stack deallocation in
    function epilogues (#1362635, PR target/63293)


author: Jakub Jelinek <jakub@redhat.com> 4.8.5-12
changelog:
  - fix up std::rethrow_exception (#1375711, PR libstdc++/62258)
  - use _Unwind_GetIPInfo in __gcc_personality_v0 (#1387402, PR libgcc/78064)
  - fix vec_vsx_ld/st on ppc64le (#1389801, PR target/72863, PR target/78084)
  - fix ICE in gfc_compare_derived_types (#1369183)
  - fix EH from C++ thunks (#1427412, PR ipa/68184)
  - on ppc64{,le} emit nop after recursive call if the current function
    is replaceable (#1420723, PR target/79439)
  - on aarch64 with -frounding-math use fnmul only with -(a*b) and not
    with (-a)*b (#1418446, PR target/66731)
  - constrain std::valarray functions and operators (#1416214,
    PR libstdc++/69116)
  - fix gimplification of aggregate assignments when lhs is used
    (#1396298, PR middle-end/72747, PR c/78408)
  - fix aarch64 TLS with -mcmodel=large (#1389276, PR target/78796)
  - fix aarch64 reloading of floating point constants into general purpose
    registers (#1349067, PR target/70549)
  - fix DW_AT_decl_line on DW_TAG_enumeration_type for C enumeration
    definitions following forward declarations (#1423460, PR c/79969)


author: Jakub Jelinek <jakub@redhat.com> 4.8.5-13
changelog:
  - add -mstack-protector-guard={tls,global}, -mstack-protector-guard-reg=
    and -mstack-protector-guard-offset= options on ppc* (#1415952,
    PR target/78875)


author: Ralf Corsépius <corsepiu@fedoraproject.org> - 1.08-1
changelog:
  - Upstream update.
  - Update patch.
  - Update BRs.
  - Add %bcond --with network.
  - Fix up %changelog dates.


author: Carlos O'Donell <carlos@redhat.com> - 2.17-157.1
changelog:
  - Do not set initgroups in default nsswitch.conf (#1388638)
  - nss_db: Request larger buffers for long group entries (#1388637)
  - nss_db: Fix get*ent crash without preceding set*ent (#1388635)
  - nss_db: Fix endless loop in services database processing (#1388639)


author: Jack Magne <jmagne@redhat.com> - 1.1.0-33
changelog:
  - Resolves: Bug #1163479 Errata 18562 TPS tests fails - esc rebuild failure because of xulrunner updates.


author: Jack Magne <jmagne@redhat.com> - 1.1.0-34
changelog:
  - Resolves: Bug #1173774 - ESC Client does list 
  - the encryption and signing certs under the "Your Certificates" tab when an enrolled card is inserted.


author: Jack Magne <jmagne@redhat.com> - 1.1.0-35
changelog:
  - Resolves: Bug #1176241 -  .redhat dir does not have the same permissions during manual and auto launch of ESC Client


author: Jack Magne <jmagne@redhat.com> - 1.1.0-36
changelog:
  - Resolves: Bug #1176241 -  .redhat dir does not have the same permissions during manual and auto launch of ESC Client
  - Minor additional fix.


author: Jack Magne <jmagne@redhat.com> - 1.1.0-37
changelog:
  - Resolves: Bug #885898 - ESC incorrectly display Issuer information for a CAC smart card
  - Resolves: Bug 1070802 - missing -fstack-protector-strong


author: Jack Magne <jmagne@redhat.com> - 1.1.0-40
changelog:
  - Resolves: Bug #1466949, Relate: Bug #1523946 - [ppc64] ld switch to relro breaks GDB. This caused an rpmdiff failure.


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.1-6
changelog:
  - Fix CVE-2014-2015 "freeradius: stack-based buffer overflow flaw in rlm_pap
    module"
  - resolves: bug#1066984 (fedora 1066763)


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.4-0.1.rc2
changelog:
  - Upgrade to upstream 3.0.4-rc2 release.
    See upstream ChangeLog for details (in freeradius-doc subpackage).
  - Add installation of SNMP MIB files.
  - Resolves: Bug#1036562 Missing doc page for kerberos module
  - Resolves: Bug#1099625 Default message digest defaults to sha1
  - Resolves: Bug#1109159 missing mib files in freeradius package
  - Resolves: Bug#1113010 radiusd doesn't send snmp trap when max_threads value
                          is reached
  - Resolves: Bug#1114669 Missing -P option in radtest manpage
  - Resolves: Bug#1115128 radisud can't start if proto = udp is specified
  - Resolves: Bug#1115134 radiusd aborts after 'Access-Request' when listens on
                          TCP port
  - Resolves: Bug#1115137 radiusd listens on udp port even if proto = tcp is
                          specified
  - Resolves: Bug#1126725 radiusd silently fails when start_servers is higher
                          than max_servers
  - Resolves: Bug#1135446 Radeapclient is not available


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.4-1
changelog:
  - Upgrade to upstream 3.0.4 release.
    See upstream ChangeLog for details (in freeradius-doc subpackage).


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.4-2
changelog:
  - Fix abort on home server triggers.
    Resolves: Bug#1113509 radiusd aborts when it has no proxy response with active
                          snmp traps
  - Fix segfault upon example.pl read failure.
    Resolves: Bug#1146403 radiusd segfaults when file for perl module has
                          wrong permissions
  - Fix example.pl permissions.
    Resolves: Bug#1146406 /etc/raddb/mods-config/perl/example.pl has wrong
                          permissions and radiusd fails to start
  - Fix integer handling in various cases.
    Resolves: Bug#1146441 upstream test suite fails
  - Fix dhcpclient's dictionary.dhcp loading.
    Resolves: Bug#1146939 dhcpclient lookups dictionary.dhcp file in wrong
                          location


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.4-3
changelog:
  - Fix a number of trigger issues.
    Resolves: Bug#1110407 radiusd doesn't send snmp trap after "radmin -e 'hup
                          files'"
    Resolves: Bug#1110414 radiusd doesn't send snmp trap when sql connection is
                          opened,closed or fail
    Resolves: Bug#1110186 radiusd doesn't send snmp trap when ldap connection
                          fails/opens/closes
    Resolves: Bug#1109164 snmp trap messages send by radiusd are inconsistent
                          and incomplete
  - Fix two omissions from radtest manpage.
    Resolves: Bug#1146898 'eap-md5' value is missing in -t option in SYNOPSIS
                          of radtest man page
    Resolves: Bug#1114669 Missing -P option in radtest manpage
  - Disable OpenSSL version checking to avoid the need to edit radiusd.conf to
    confirm heartbleed is fixed.
    Resolves: Bug#1155070 FreeRADIUS doesn't start after upgrade due to failing
                          OpenSSL version check


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.4-4
changelog:
  - Fix possible group info corruption/segfault in rlm_unix' fr_getgrnam.
  - Fix file configuration item parsing.


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.4-5
changelog:
  - Disable rlm_rest building explicitly to avoid unintended builds on some
    architectures breaking RPM build.
    Resolves: Bug#1162156
  - Add -D option support to dhcpclient.
    Related: Bug#1146939
  - Don't install rbmonkey - a test tool only useful to developers.
    Related: Bug#1146966
  - Update clients(5) man page
    Resolves: Bug#1147464


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.4-6
changelog:
  - Don't remove backslash from unknown escape sequences in LDAP values.
    Resolves: Bug#1173526
  - Improve dhcpclient and rad_counter online help.
    Resolves: Bug#1146966
  - raddb: Move trigger.conf INCLUDE before modules, making it easier to refer
    to trigger variables from module configurations.
    Resolves: Bug#1155961
  - Fix ipaddr option fallback onto ipv6.
    Resolves: Bug#1168868
  - raddb: Comment on ipaddr/ipv4addr/ipv6addr use.
    Resolves: Bug#1168247


author: Jan Kaluza <jkaluza@redhat.com> - 3:2.1.15-8
changelog:
  - fix #838580 - check if directories are 0755, there is no need to need
    02775 on all Mailman directories


author: Jan Kaluza <jkaluza@redhat.com> - 3:2.1.15-10
changelog:
  - fix #921421 - fix /var/spool/mailman/ permissions
  - fix #921423 - move mm_cfg.py to /etc/mailman
  - move templates from /usr/lib/mailman to /etc/mailman


author: Steve Dickson <steved@redhat.com> 0.2.4-0.7
changelog:
  - Backported upstream debugging (bz 1273159)
  - Fixed memory leak in svc_vc_create (bz 1276685)
  - Fixed memory leaks in server-side GSS authenticator (bz 1282488)


author: Doug Ledford <dledford@redhat.com> - 1.1.6-5
changelog:
  - Correct the Url and Source tags now that the openfabrics server no longer
    responds if you don't include the www in the link


author: Doug Ledford <dledford@redhat.com> - 1.1.7-6
changelog:
  - Add in support for flow steering and IP addressing of UD RoCE QPs
  - Resolves: bz1058537, bz1062281


author: Herton R. Krzesinski <herton@redhat.com> [4.14.0-41.el7a]
changelog:
  - [netdrv] ibmvnic: queue reset when CRQ gets closed during reset (Steve Best) [1543729]
  - [kernel] modules: add rhelversion MODULE_INFO tag (Prarit Bhargava) [1542796]
  - [kernel] put RHEL info into generated headers (Prarit Bhargava) [1542796]
  - [netdrv] ibmvnic: Ensure that buffers are NULL after free (Steve Best) [1543713]
  - [netdrv] ibmvnic: fix empty firmware version and errors cleanup (Steve Best) [1543713]
  - [powerpc] powerpc/64s: Allow control of RFI flush via debugfs (Mauricio Oliveira) [1543083]
  - [powerpc] powerpc/64s: Improve RFI L1-D cache flush fallback (Mauricio Oliveira) [1543083]
  - [powerpc] powerpc/xmon: Add RFI flush related fields to paca dump (Mauricio Oliveira) [1543083]
  - [powerpc] powerpc/64s: Wire up cpu_show_meltdown() (Mauricio Oliveira) [1543083]
  - [base] sysfs/cpu: Add vulnerability folder (Mauricio Oliveira) [1543083]
  - [scsi] aacraid: Fix udev inquiry race condition (Gustavo Duarte) [1541141]
  - [scsi] aacraid: Do not attempt abort when Fw panicked (Gustavo Duarte) [1541141]
  - [scsi] aacraid: Fix hang in kdump (Gustavo Duarte) [1541141]
  - [scsi] aacraid: Do not remove offlined devices (Gustavo Duarte) [1541141]
  - [scsi] aacraid: Fix ioctl reset hang (Gustavo Duarte) [1541141]
  - [redhat] configs: enable CONFIG_USERFAULTFD on s390x (David Hildenbrand) [1540679]
  - [pci] PCI/AER: Skip recovery callbacks for correctable errors from ACPI APEI (Steve Ulrich) [1495258]


author: Herton R. Krzesinski <herton@redhat.com> [4.14.0-42.el7a]
changelog:
  - [net] sched: cbq: create block for q->link.block (Davide Caratti) [1544314]
  - [net] cls_u32: fix use after free in u32_destroy_key() (Paolo Abeni) [1516696]
  - [net] netfilter: xt_osf: Add missing permission checks (Florian Westphal) [1539229] {CVE-2017-17448}
  - [net] netfilter: nfnetlink_cthelper: Add missing permission checks (Florian Westphal) [1539229] {CVE-2017-17448}


author: Herton R. Krzesinski <herton@redhat.com> [4.14.0-43.el7a]
changelog:
  - [netdrv] sfc: don't warn on successful change of MAC (Jarod Wilson) [1448760]
  - [netdrv] ibmvnic: Remove skb->protocol checks in ibmvnic_xmit (Steve Best) [1544017]
  - [netdrv] ibmvnic: Reset long term map ID counter (Steve Best) [1544017]
  - [scsi] qla2xxx: Update driver version to 10.00.00.01.07.5a-k1 (Himanshu Madhani) [1542778]
  - [scsi] qla2xxx: Fix memory corruption during hba reset test (Himanshu Madhani) [1542778]
  - [scsi] qla2xxx: Fix logo flag for qlt_free_session_done() (Himanshu Madhani) [1542778]
  - [scsi] qla2xxx: Fix NULL pointer crash due to probe failure (Himanshu Madhani) [1542778]
  - [scsi] qla2xxx: Defer processing of GS IOCB calls (Himanshu Madhani) [1542778]
  - [nvme] nvme-pci: allocate device queues storage space at probe (Ming Lei) [1523270]
  - [kernel] include/linux/slab.h: add kmalloc_array_node() and kcalloc_node() (Ming Lei) [1523270]
  - [nvme] nvme-pci: serialize pci resets (Ming Lei) [1523494]
  - [block] blk-mq: fix race between updating nr_hw_queues and switching io sched (Ming Lei) [1523270]
  - [block] blk-mq: avoid to map CPU into stale hw queue (Ming Lei) [1523270]
  - [block] blk-mq: quiesce queue during switching io sched and updating nr_requests (Ming Lei) [1523270]
  - [block] blk-mq: quiesce queue before freeing queue (Ming Lei) [1523270]
  - [block] blk-mq: only run the hardware queue if IO is pending (Ming Lei) [1523270]
  - [block] Fix a race between blk_cleanup_queue() and timeout handling (Ming Lei) [1538482]


author: Herton R. Krzesinski <herton@redhat.com> [4.14.0-44.el7a]
changelog:
  - [powerpc] powerpc/mm: Flush radix process translations when setting MMU type (Laurent Vivier) [1533718]
  - [powerpc] powerpc/mm/radix: Split linear mapping on hot-unplug (Suraj Jitindar Singh) [1516201]
  - [powerpc] KVM: PPC: Book3S: Add MMIO emulation for VMX instructions (Laurent Vivier) [1537935]
  - [powerpc] KVM: PPC: Book3S HV: Make HPT resizing work on POWER9 (Laurent Vivier) [1535789]
  - [powerpc] KVM: PPC: Book3S HV: Fix handling of secondary HPTEG in HPT resizing code (Laurent Vivier) [1535789]
  - [powerpc] KVM: PPC: Book3S HV: Drop locks before reading guest memory (Laurent Vivier) [1540077]
  - [powerpc] powerpc/64s/radix: Boot-time NULL pointer protection using a guard-PID (Mauricio Oliveira) [1539109]
  - [block] blk-mq-debugfs: don't allow write on attributes with seq_operations set (Ming Lei) [1543463]
  - [fs] dcache: Revert manually unpoison dname after allocation to shut up kasan's reports (Joe Lawrence) [1539609]
  - [fs] fs/dcache: Use read_word_at_a_time() in dentry_string_cmp() (Joe Lawrence) [1539609]
  - [lib] lib/strscpy: Shut up KASAN false-positives in strscpy() (Joe Lawrence) [1539609]
  - [kernel] compiler.h: Add read_word_at_a_time() function (Joe Lawrence) [1539609]
  - [kernel] compiler.h, kasan: Avoid duplicating __read_once_size_nocheck() (Joe Lawrence) [1539609]
  - [redhat] update handling for our additional certificates ("Herton R. Krzesinski") [1539015]
  - [redhat] make CONFIG_MODULE_SIG_SHA* common through all architectures ("Herton R. Krzesinski") [1539015]
  - [redhat] remove extra_certificates file ("Herton R. Krzesinski") [1539015]
  - [fs] xfs: truncate pagecache before writeback in xfs_setattr_size() (Bill O'Donnell) [1518553]
  - [fs] autofs: revert autofs: take more care to not update last_used on path walk (Ian Kent) [1535760]


author: Herton R. Krzesinski <herton@redhat.com> [4.14.0-45.el7a]
changelog:
  - [netdrv] tg3: APE heartbeat changes (Jonathan Toppins) [1545870]
  - [redhat] fix rh_get_maintainer.pl (Andrew Jones)
  - [scsi] lpfc Fix SCSI io host reset causing kernel crash (Dick Kennedy) [1540693]


author: Herton R. Krzesinski <herton@redhat.com> [4.14.0-46.el7a]
changelog:
  - [powerpc] ppc needs macro for spectre v1 mitigation (Christoph von Recklinghausen) [1538186]
  - [arm64] Add missing Falkor part number for branch predictor hardening (Spectre/Meltdown) (Steve Ulrich) [1545916]
  - [s390] kernel: fix rwlock implementation (Hendrik Brueckner) [1547423]
  - [redhat] s390/configs: enable KERNEL_NOBP for s390 (Hendrik Brueckner) [1532726]
  - [s390] spinlock: add __nospec_barrier memory barrier (Hendrik Brueckner) [1532726]
  - [s390] Replace IS_ENABLED(EXPOLINE_*) with IS_ENABLED(CONFIG_EXPOLINE_*) (Hendrik Brueckner) [1532726]
  - [s390] introduce execute-trampolines for branches (Hendrik Brueckner) [1532726]
  - [s390] run user space and KVM guests with modified branch prediction (Hendrik Brueckner) [1532726]
  - [s390] add options to change branch prediction behaviour for the kernel (Hendrik Brueckner) [1532726]
  - [s390] s390/alternative: use a copy of the facility bit mask (Hendrik Brueckner) [1532726]
  - [s390] add optimized array_index_mask_nospec (Hendrik Brueckner) [1532726]
  - [s390] scrub registers on kernel entry and KVM exit (Hendrik Brueckner) [1532726]
  - [s390] enable CPU alternatives unconditionally (Hendrik Brueckner) [1532726]
  - [s390] introduce CPU alternatives (Hendrik Brueckner) [1532726]
  - [security] KEYS: Use individual pages in big_key for crypto buffers (David Howells) [1510601]
  - [powerpc] powerpc/eeh: Fix crashes in eeh_report_resume() (Gustavo Duarte) [1546028]
  - [redhat] switch secureboot kernel image signing to release keys ("Herton R. Krzesinski")
  - [redhat] RHMAINTAINERS: update power management sections (Al Stone)
  - [fs] xfs: validate sb_logsunit is a multiple of the fs blocksize (Bill O'Donnell) [1538496]
  - [kernel] bpf: prevent out-of-bounds speculation (Mark Langsdorf) [1536036]
  - [arm64] kpti: Fix the interaction between ASID switching and software PAN (Mark Langsdorf) [1536036]
  - [arm64] SW PAN: Point saved ttbr0 at the zero page when switching to init_mm (Mark Langsdorf) [1536036]
  - [arm64] Re-order reserved_ttbr0 in linker script (Mark Langsdorf) [1536036]
  - [arm64] capabilities: Handle duplicate entries for a capability (Mark Langsdorf) [1536036]


author: Herton R. Krzesinski <herton@redhat.com> [4.14.0-47.el7a]
changelog:
  - [kernel] futex: Prevent overflow by strengthen input validation (Joe Lawrence) [1547583] {CVE-2018-6927}


author: Herton R. Krzesinski <herton@redhat.com> [4.14.0-49.el7a]
changelog:
  - [netdrv] tg3: prevent scheduling while atomic splat (Jonathan Toppins) [1555032]
  - [powerpc] KVM: PPC: Book3S HV: Fix guest time accounting with VIRT_CPU_ACCOUNTING_GEN (Laurent Vivier) [1541614]
  - [powerpc] KVM: PPC: Book3S HV: Improve handling of debug-trigger HMIs on POWER9 (Gustavo Duarte) [1548423]


author: Peter Jones <pjones@redhat.com> - 8.28-14
changelog:
  - Handle "set variable" commands separately from other parsing in grubby's
    GetNextLine()
    Resolves: rhbz#1152550


author: Peter Jones <pjones@redhat.com> - 8.28-17
changelog:
  - Fix the ordering of creating the debug entries, so they don't get picked
    when we're choosing kernel command line defaults on upgrades.
    Related: rhbz#1212128


author: rmarshall@redhat.com - 8.28-18
changelog:
  - Patched new-kernel-pkg so that kernel installations when MAKEDEBUG is
    set would put the debugging entries after the non-debugging entries.
    Resolves: #1285601
  - Re-numbered the last set of patches to go with the flow. No actual
    changes to the patches; just a git mv to rename.
  - Re-organized and updated the grubby man page contents to include some
    features that were not documented as well as correct typos and
    re-write some entries for better clarity.
    Resolves: #1232168


author: rmarshall@redhat.com - 8.28-21
changelog:
  - Resolve issues with the recent grubby logic patches that
    appeared on the ppc platform. Fix a problem that occurred
    on systems where no kernel update had ever been installed.
    Resolves: rhbz#1285601
  - Specify the actual prune_debug file in sources.
    Resolves: rhbz#1285601


author: rmarshall@redhat.com - 8.28-23
changelog:
  - Fixes --info flag on s390/s390x.
    Related: rhbz#1285601
  - Fixes --set-default-index on s390/s390x.
    Related: rhbz#1285601
  - Allows prune_debug to run on s390/s390x.
    Resolves: rhbz#1285601


author: Frantisek Hrbata <fhrbata@hrbata.com> [4.14.0-49.2.1.el7a]
changelog:
  - [pci] PCI: Remove redundant probes for device reset support (Robert Richter) [1564026 1553226]
  - [pci] PCI: Probe for device reset support during enumeration (Robert Richter) [1564026 1553226]


author: Frantisek Hrbata <fhrbata@hrbata.com> [4.14.0-49.3.1.el7a]
changelog:
  - [misc] cxl: Fix possible deadlock when processing page faults from cxllib (Gustavo Duarte) [1564420 1562957]


author: Frantisek Hrbata <fhrbata@hrbata.com> [4.14.0-49.4.1.el7a]
changelog:
  - [powerpc] watchdog: remove arch_trigger_cpumask_backtrace (Gustavo Duarte) [1566995 1562287]
  - [powerpc] 64s: return more carefully from sreset NMI (Gustavo Duarte) [1566995 1562287]
  - [perf] hwbp: Simplify the perf-hwbp code, fix documentation (Eugene Syromiatnikov) [1569877 1569875] {CVE-2018-1000199}


author: Frantisek Hrbata <fhrbata@hrbata.com> [4.14.0-49.5.1.el7a]
changelog:
  - [powerpc] powerpc/powernv/npu: Do a PID GPU TLB flush when invalidating a large address range (Mauricio Oliveira) [1576515 1571167]
  - [powerpc] powernv/npu: Prevent overwriting of pnv_npu2_init_contex() callback parameters (Mauricio Oliveira) [1577757 1568164]
  - [powerpc] powernv/npu: Add lock to prevent race in concurrent context init/destroy (Mauricio Oliveira) [1577757 1568164]
  - [powerpc] powernv/memtrace: Let the arch hotunplug code flush cache (Mauricio Oliveira) [1575528 1571156]
  - [powerpc] mm: Flush cache on memory hot(un)plug (Mauricio Oliveira) [1575528 1571156]


author: Frantisek Hrbata <fhrbata@hrbata.com> [4.14.0-49.6.1.el7a]
changelog:
  - [fs] dcache: fix quadratic behavior with parallel shrinkers (Miklos Szeredi) [1577768 1565210]
  - [powerpc] revert "powernv: Increase memory block size to 1GB on radix" (Mauricio Oliveira) [1577766 1574524]


author: Frantisek Hrbata <fhrbata@hrbata.com> [4.14.0-49.7.1.el7a]
changelog:
  - [scsi] csiostor: add support for 32 bit port capabilities (Arjun Vynipadath) [1580276 1547715]
  - [md] dm btree: fix serious bug in btree_split_beneath() (Mike Snitzer) [1576514 1559487]
  - [arm64] Kill PSCI_GET_VERSION as a variant-2 workaround (Mark Langsdorf) [1574842 1543628] {CVE-2017-5715}
  - [arm64] Add ARM_SMCCC_ARCH_WORKAROUND_1 BP hardening support (Mark Langsdorf) [1574842 1543628] {CVE-2017-5715}
  - [firmware] firmware/psci: Expose SMCCC version through psci_ops (Mark Langsdorf) [1574842 1543628] {CVE-2017-5715}
  - [firmware] firmware/psci: Expose PSCI conduit (Mark Langsdorf) [1574842 1543628] {CVE-2017-5715}
  - [arm64] KVM: Add SMCCC_ARCH_WORKAROUND_1 fast handling (Mark Langsdorf) [1574842 1543628] {CVE-2017-5715}
  - [arm64] KVM: Report SMCCC_ARCH_WORKAROUND_1 BP hardening support (Mark Langsdorf) [1574842 1543628] {CVE-2017-5715}
  - [arm64] arm/arm64: KVM: Consolidate the PSCI include files (Mark Langsdorf) [1574842 1543628] {CVE-2017-5715}
  - [arm64] KVM: Increment PC after handling an SMC trap (Mark Langsdorf) [1574842 1543628] {CVE-2017-5715}
  - [arm64] entry: Apply BP hardening for suspicious interrupts from EL0 (Mark Langsdorf) [1574842 1543628] {CVE-2017-5715}
  - [fs] ovl: update ctx->pos on impure dir iteration (Thomas Huth) [1570546 1561534]
  - [scsi] megaraid_sas: driver version 07.702.06.00-rh2 (Tomas Henzl) [1569396 1553228]
  - [scsi] megaraid_sas: Do not use 32-bit atomic request descriptor for Ventura controllers (Tomas Henzl) [1569396 1553228]
  - [scsi] mpt3sas: Bump mpt3sas driver version to v15.100.01.00 (Tomas Henzl) [1569396 1553228]
  - [scsi] mpt3sas: Do not use 32-bit atomic request descriptor for Ventura controllers (Tomas Henzl) [1569396 1553228]
  - [powerpc] pseries: Restore default security feature flags on setup (Mauricio Oliveira) [1566998 1561784]
  - [powerpc] Move default security feature flags (Mauricio Oliveira) [1566998 1561784]
  - [powerpc] pseries: Fix clearing of security feature flags (Mauricio Oliveira) [1566998 1561784]
  - [powerpc] 64s: Wire up cpu_show_spectre_v2() (Mauricio Oliveira) [1566998 1561784]
  - [powerpc] 64s: Wire up cpu_show_spectre_v1() (Mauricio Oliveira) [1566998 1561784]
  - [powerpc] pseries: Use the security flags in pseries_setup_rfi_flush() (Mauricio Oliveira) [1566998 1561784]
  - [powerpc] powernv: Use the security flags in pnv_setup_rfi_flush() (Mauricio Oliveira) [1566998 1561784]
  - [powerpc] 64s: Enhance the information in cpu_show_meltdown() (Mauricio Oliveira) [1566998 1561784]
  - [powerpc] 64s: Move cpu_show_meltdown() (Mauricio Oliveira) [1566998 1561784]
  - [powerpc] powernv: Set or clear security feature flags (Mauricio Oliveira) [1566998 1561784]
  - [powerpc] pseries: Set or clear security feature flags (Mauricio Oliveira) [1566998 1561784]
  - [powerpc] Add security feature flags for Spectre/Meltdown (Mauricio Oliveira) [1566998 1561784]
  - [powerpc] pseries: Add new H_GET_CPU_CHARACTERISTICS flags (Mauricio Oliveira) [1566998 1561784]
  - [powerpc] rfi-flush: Call setup_rfi_flush() after LPM migration (Mauricio Oliveira) [1567002 1561783]
  - [powerpc] rfi-flush: Differentiate enabled and patched flush types (Mauricio Oliveira) [1567002 1561783]
  - [powerpc] rfi-flush: Always enable fallback flush on pseries (Mauricio Oliveira) [1567002 1561783]
  - [powerpc] rfi-flush: Make it possible to call setup_rfi_flush() again (Mauricio Oliveira) [1567002 1561783]
  - [powerpc] rfi-flush: Move the logic to avoid a redo into the debugfs code (Mauricio Oliveira) [1567002 1561783]


author: Frantisek Hrbata <fhrbata@hrbata.com> [4.14.0-49.8.1.el7a]
changelog:
  - [powerpc] powerpc/64s: Add support for a store forwarding barrier at kernel entry/exit (Mauricio Oliveira) [1566912 1566913] {CVE-2018-3639}


author: Frantisek Hrbata <fhrbata@hrbata.com> [4.14.0-49.9.1.el7a]
changelog:
  - [powerpc] mm/radix: Change pte relax sequence to handle nest MMU hang (Desnes Augusto Nunes do Rosario) [1592769 1582537]
  - [powerpc] mm: Change function prototype (Desnes Augusto Nunes do Rosario) [1592769 1582537]
  - [powerpc] mm/radix: Move function from radix.h to pgtable-radix.c (Desnes Augusto Nunes do Rosario) [1592769 1582537]
  - [powerpc] mm/hugetlb: Update huge_ptep_set_access_flags to call __ptep_set_access_flags directly (Desnes Augusto Nunes do Rosario) [1592769 1582537]


author: Frantisek Hrbata <fhrbata@hrbata.com> [4.14.0-49.10.1.el7a]
changelog:
  - [powerpc] rtc: opal: Fix OPAL RTC driver OPAL_BUSY loops (Steve Best) [1596614 1593301]
  - [powerpc] rtc-opal: Fix handling of firmware error codes, prevent busy loops (Steve Best) [1596614 1593301]
  - [powerpc] powernv: define a standard delay for OPAL_BUSY type retry loops (Steve Best) [1596614 1593301]
  - [powerpc] stf-barrier: update (static) rfi_flush_enable as in upstream (Gustavo Duarte) [1596287 1585298]
  - [powerpc] stf-barrier: update (rfi_)enabled_flush_types as in upstream (Gustavo Duarte) [1596287 1585298]
  - [powerpc] stf-barrier: update debugfs as in upstream (Gustavo Duarte) [1596287 1585298]
  - [powerpc] stf-barrier: update handle_ssbd() as in upstream (Gustavo Duarte) [1596287 1585298]
  - [powerpc] stf-barrier: update stf_barrier_enable() as in upstream (Gustavo Duarte) [1596287 1585298]
  - [powerpc] stf-barrier: add cpu_show_spec_store_bypass() as in upstream (Gustavo Duarte) [1596287 1585298]
  - [powerpc] stf-barrier: add comment as in upstream (Gustavo Duarte) [1596287 1585298]
  - [powerpc] stf-barrier: move code from setup_64.c to security.c as in upstream (Gustavo Duarte) [1596287 1585298]
  - [powerpc] stf-barrier: move code from setup.h to security_features.h as in upstream (Gustavo Duarte) [1596287 1585298]
  - [powerpc] stf-barrier: update entry barrier slot as in upstream (Gustavo Duarte) [1596287 1585298]
  - [netdrv] ixgbevf: Free IRQ when PCI error recovery removes the device (Ken Cox) [1595738 1586016]
  - [cpufreq] powernv: Fix hardlockup due to synchronous smp_call in timer interrupt (Gustavo Duarte) [1593278 1574857]
  - [powerpc] mce: Fix a bug where mce loops on memory UE (Desnes Augusto Nunes do Rosario) [1583071 1571178]
  - [scsi] cxlflash: Handle spurious interrupts (Steve Best) [1579687 1520410]
  - [scsi] cxlflash: Remove commmands from pending list on timeout (Steve Best) [1579687 1520410]
  - [scsi] cxlflash: Synchronize reset and remove ops (Steve Best) [1579687 1520410]
  - [scsi] cxlflash: Reset command ioasc (Steve Best) [1579687 1520410]
  - [i2c] ipmi_ssif: Fix kernel panic at msg_done_handler (Robert Richter) [1563569 1555339]
  - [i2c] xlp9xx: Handle NACK on DATA properly (Robert Richter) [1563569 1555339]
  - [i2c] xlp9xx: Check for Bus state before every transfer (Robert Richter) [1563569 1555339]
  - [i2c] revert "xlp9xx: Check for Bus state after every transfer" (Robert Richter) [1563569 1555339]


author: Johnny Hughes <johnny@centos.org> [4.14.0-49.10.1.el7a]
changelog:
  - Rolled in CentOS certificates and signed modules with a CentOS certificate.
  - Turned off CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND and turned on CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE
  - added git as buildrequirement to do patches (if/when required)


author: Nils Philippsen <nils@redhat.com> - 1.0.23-18
changelog:
  - build against libusb-1.0 on Fedora >= 18 (#1003193)
  - require libusbx-devel instead of libusb1-devel which is obsolete


author: Nils Philippsen <nils@redhat.com> - 1.0.24-1
changelog:
  - version 1.0.24
  - use (hopefully stable) Alioth download URL
  - update udev patch, remove obsolete patches
  - use udev hwdb instead of huge rulesets


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.21-2
changelog:
  - Allow building with RHEL-7.0 libtalloc
  - Resolves: rhbz#1133919 - Rebase libtevent to version 0.9.21 or newer


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.21-3
changelog:
  - BuildRequire the minimal applicable libtalloc version
  - Resolves: rhbz#1133919 - Rebase libtevent to version 0.9.21 or newer


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.31-2
changelog:
  - Resolves: #1513984 - tevent can cause a Samba file corruption bug under
                         heavy threaded load [rhel-7.4.z]


author: Jaroslav Škarvada <jskarvad@redhat.com> - 1.4.8-1
changelog:
  - New version
    Resolves: rhbz#966639
  - Updated and defuzzified patches
  - Still use lua-5.1 (fedoras < f20)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-40
changelog:
  - Resolves: rhbz#1270827 - local overrides: don't contact server with
                             overridden name/id


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-40.1
changelog:
  - Resolves: rhbz#1284814  - sssd: [sysdb_add_user] (0x0400): Error: 17
                             (File exists)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-40.2
changelog:
  - Resolves: rhbz#1311569 - [RFE] IPA: resolve external group memberships
                             of IPA groups during getgrnam and getgrgid


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-40.4
changelog:
  - Resolves: rhbz#1324442 - sssd be memory leak in sssd's memberof plugin
  - More patches from upstream related to the memory leak


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-40.5
changelog:
  - Resolves: rhbz#1336836 - IPA provider crashes if a netgroup from a
                             trusted domain is requested


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-40.6
changelog:
  - Resolves: rhbz#1337292 - In IPA-AD trust environment access is granted
                             to AD user even if the user is disabled on AD.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-40.7
changelog:
  - Resolves: rhbz#1339207 - sssd_nss memory usage keeps growing when trying
                             to retrieve non-existing netgroups


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-40.8
changelog:
  - Resolves: rhbz#1339258 - [sssd] Trusted (AD) user's info stays in sssd
                             cache for much more than expected.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-40.9
changelog:
  - Resolves: rhbz#1339509 - sssd tries to resolve global catalog servers
                             from AD forest sub-domains in AD-IPA trust setup


author: Fabiano Fidêncio <fidencio@redhat.com> - 2.7.1-5
changelog:
  - Bump http-parser release number to avoid people pulling EPEL package instead
    of RHEL package
    Resolves: rhbz#1480321


author: Miroslav Lichvar <mlichvar@redhat.com> - 5:2.0.9-3
changelog:
  - drop renaming to guile2
  - fix multilib conflicts
  - fix post scriptlet to not remove files on upgrade
  - remove obsolete code from slib trigger
  - fix weekdays in changelog


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.4-8
changelog:
  - Disable internal OpenSSL cache and fix session cache file permissions.
    Resolves: Bug#1459131 CVE-2017-9148 freeradius: TLS resumption
                          authentication bypass


author: Brian Pepple <bpepple@fedoraproject.org> - 1:5.14.1-1
changelog:
  - Update to 5.14.1.
  - Drop defattr. No longer needed.
  - Drop ignore gnome keyring patch. Fixed upstream.


author: Debarshi Ray <rishi@fedoraproject.org> - 1:5.14.1-5
changelog:
  - Add %check to run the upstream test suite on each build (Red Hat #1000705)
  - Resort to using chrpath for removing rpaths instead of hacking libtool


author: Kamil Dudka <kdudka@redhat.com> - 1:3.2.5d-11
changelog:
  - install man pages using the correct file name suffix
  - provide the fig2ps2tex.sh man page as a symlink


author: Peter Hutterer <peter.hutterer@redhat.com> 7.7-4
changelog:
  - xkbcomp: Fix generation of XKB directory listing, missing reset on file
    handler caused parse errors and incomplete directory listings


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.32.7-3
changelog:
  - Rebase to libguestfs 1.32 in RHEL 7.3
    resolves: rhbz#1218766
  - The full tests are now run after the package has been built.
  - New tool and subpackage: virt-dib (safe diskimage-builder replacement).
  - New subpackage libguestfs-inspect-icons to reduce dependencies of main pkg
    (see https://bugzilla.redhat.com/1194158).
  - New tool: virt-get-kernel.
  - Depend on java-headless instead of full java.
  - New tool: virt-v2v-copy-to-local.
  - Disable virt-v2v subpackage on ppc64 etc
    resolves: rhbz#1287826
  - v2v: Remove VirtualBox Additions correctly
    resolves: rhbz#1296606
  - Add clearer warnings sections to all man pages
    resolves: rhbz#1293527
  - v2v: Disable the --in-place option.
  - v2v: Support conversion of Windows > 7
    resolves: rhbz#1190669
  - Add code to verify tarball signatures.
  - General performance improvements.
  - v2v: Prevent duplicate -b, -n, -oa options
    resolves: rhbz#1326266
    resolves: rhbz#1325825
  - v2v: Unquote UUID and LABEL in fstab (util-linux 1335671)
  - v2v: Fix alignment issues in treeviews in conversion dialog
    resolves: rhbz#1340407
  - p2v: spinner should be hidden when it stops spinning
    resolves: rhbz#1341564
  - p2v: ethtool command is not supported on p2v client
    resolves: rhbz#1341608
  - p2v: Add ifconfig command to ISO
    resolves: rhbz#1342447
  - p2v: Warn if virt-p2v-make-disk used on a partition
    resolves: rhbz#1342337
  - Build using OCaml with fix for CVE-2015-8869.
    resolves: rhbz#1343101
  - customize: Add --uninstall option (upstream 1343375)
  - p2v: Document permissions on id_rsa file
    resolves: rhbz#1343414
  - p2v: Print full curl error message
    resolves: rhbz#1343423
  - get-kernel: Fix --format auto
    resolves: rhbz#1341984
  - v2v: Provide better <Origin/> information to RHEV-M
    resolves: rhbz#1342398
  - customize: Give an error if --truncate-recursive path does not exist
    resolves: rhbz#1345809
  - sysprep: Add --network option so that --install option can be used
    resolves: rhbz#1345813
  - p2v: Print proper error if incorrect password is given
    resolves: rhbz#1227599
  - p2v: Print ssh error if incorrect hostname is given
    resolves: rhbz#1167916
  - p2v: Display progress of operation in non-GUI mode
    resolves: rhbz#1229386
  - p2v: Add a dialog confirming the user really means to cancel
    resolves: rhbz#1340464
  - p2v: log window should process colour escapes and backspaces
    resolves: rhbz#1314244
  - v2v: Fix installation of virtio drivers with *.dll files
    resolves: rhbz#1311373
  - p2v: Improve error message when ssh login to conversion server fails
    resolves: rhbz#1348900
  - v2v: Remove --dcpath parameter from manual
    resolves: rhbz#1315237
  - v2v: Fix conversion of guests with floppy drives
    resolves: rhbz#1309706
  - p2v: Better error when sudo requires a password
    resolves: rhbz#1340809
  - v2v: Refuse to convert if there is < 1GB free in temporary directory
    resolves: rhbz#1316479
  - inspection: Get Windows drive letters for GPT disks
    resolves: rhbz#1349237
  - p2v: Add disk utils and display serial number of disks
    resolves: rhbz#855058
  - p2v: Fix timeout error when connecting to unresponsive ssh server
    resolves: rhbz#1350363
  - Remove external dependency generator.  Use supermin RPM deps instead.
    related: rhbz#1309796
  - p2v: Flush messages to the journal immediately
    resolves: rhbz#1229386
  - customize: Fix --install on ppc64le
    resolves: rhbz#1264835
  - lib: Fix finding icons in Windows 7 64 bit guests
    resolevs: rhbz#1352761
  - v2v: Add virsh --quiet flag when running virt-v2v --quiet
    resolves: rhbz#1358142
  - lib: Fix inspection of ISOs with latest libosinfo
    resolves: rhbz#1359652
  - dib: Fix run_command exit handlers on failure
    resolves: rhbz#1362357
  - dib: Rework run of extra-data.d hooks
    resolves: rhbz#1362354
  - Miscellaneous fixes to man pages and --help output
    resolves: rhbz#1362668
  - lib: Specify backing format for read-only files
    resolves: rhbz#1354335
  - Fix --selinux-relabel option
    resolves: rhbz#1362669
  - sparsify: Fix --in-place option with UEFI guest
    resolves: rhbz#1364347
  - p2v: Use latest linux-firmware in ISO
    resolves: rhbz#1364419
  - v2v: Fix guest name when using -i disk
    resolves: rhbz#1365005
  - p2v: Fix GUI message.
  - v2v: Make fstrim message clearer
    resolves: rhbz#1366456
  - v2v: Fix conversion of UEFI guests when Secure Boot OVMF installed
    resolves: rhbz#1367615
  - lib: Fix assert-fail if port is missing in libvirt XML
    resolves: rhbz#1370424


author: Pino Toscano <ptoscano@redhat.com> - 1:1.36.3-6
changelog:
  - Rebase to libguestfs 1.36 in RHEL 7.4.
    resolves: rhbz#1359086
  - v2v: always use names for libvirt pools
    resolves: rhbz#1141631
  - v2v: correctly find GRUB in RHEL UEFI guests
  - v2v: uninstall VMware tools packages from guests
    resolves: rhbz#1155150
  - v2v: install RHEV-APT only when using -o rhev/-o vdsm
    resolves: rhbz#1161019
  - New API: btrfs-filesystem-show
    resolves: rhbz#1164765
  - p2v: always enable debugging when running virt-v2v
    resolves: rhbz#1167623
  - libguestfs prefers virtio-pci on aarch64
    resolves: rhbz#1237250
  - v2v: make sure to copy all the driver files on Windows
    resolves: rhbz#1255610
  - Better tolerate corrupted Windows hivex; bump the hivex BuildRequires and
    Requires to >= 1.3.10-5.8.el7
    resolves: rhbz#1311890
  - v2v: ignore all the environment variables for proxy when exporting from
    vCenter
    resolves: rhbz#1354507
  - virt-sysprep can deal with full-LUKS encrypted guests
    resolves: rhbz#1362649
  - All the tools have bash completion scripts.
    resolves: rhbz#1367738
  - v2v: do not remove Processor and Intelppm nodes in Windows guests
    resolves: rhbz#1372668
  - Fix SELinux relabelling in old RHEL 6 guests, by adjusting a broken
    regular expression in file_contexts file
    resolves: rhbz#1374232
  - v2v: set all the properties on creation when exporting to Glance
    resolves: rhbz#1374405
  - v2v: set hw_video_model when exporting to Glance
    resolves: rhbz#1374651
  - v2v: fix OVA conversion as root using the libvirt backend
    resolves: rhbz#1375157
  - Various improvements and fixes to the documentation
    resolves: rhbz#1377081
    resolves: rhbz#1390876
    resolves: rhbz#1398070
    resolves: rhbz#1425306
  - v2v: support <listen type='socket'> and <listen type='none'>
    resolves: rhbz#1378022
  - v2v: allow libvirt >= 2.1.0 for vCenter conversions
    resolves: rhbz#1379240
  - p2v: enable mnemonics in the GUI
    resolves: rhbz#1379289
  - Split virt-p2v, and the tools for it, in an own package: virt-p2v-maker
    resolves: rhbz#1382275
  - Correctly parse mount options in btrfs entries in /etc/fstab.
    resolves: rhbz#1383517
  - Read secrets from libvirt domains, when inspecting them
    resolves: rhbz#1392798
  - v2v: add --vdsm-compat=1.1 flag for VDSM
    resolves: rhbz#1400205
  - Fix inspection with UsrMove and /usr in a separate partition
    resolves: rhbz#1401474
  - v2v: improve import compatibility with OVAs produced by AWS
    resolves: rhbz#1402301
  - resize: allow URIs for the output disk
    resolves: rhbz#1404182
  - Disable EDD when launching the appliance
    resolves: rhbz#1404287
  - v2v: increase the memory allocated to the appliance
    resolves: rhbz#1418283
  - p2v: switch from GTK+ 2 to GTK+ 3
  - p2v: add dbus-devel as BuildRequires to disable suspension during the
    conversion
  - libguestfs-java: bump the java-headless Require to >= 1.7.0, matching the
    Build-Require, and the generated bytecode
    resolves: rhbz#1364518
  - Do not try to use/write to /var/cache/yum & /var/log/yum.log
  - Bump ocaml-findlib-devel BuildRequires to >= 1.3.3-7.el7, because of
    RHBZ#1403897
  - v2v: remove --dcpath & --dcPath from --help output too
    resolves: rhbz#1429430
  - v2v: force VNC as display for -i disk, as SDL is not supported
    resolves: rhbz#1372671
  - v2v, p2v: rename rhvm network to ovirtmgmt
    resolves: rhbz#1429491
  - v2v: when exporting to local disk, check that UEFI firmware is installed
    before conversion
    resolves: rhbz#1429506
  - dib: actually generate SHA256 checksums when using --checksum
    resolves: rhbz#1430184
  - v2v: do not mention SUSE Xen hosts as supported
    resolves: rhbz#1430203
  - v2v: depend on OVMF/AAVMF, for converting EFI guests
    resolves: rhbz#1429643
  - v2v: use absolute path when using an OVA as backing file
    resolves: rhbz#1430680
  - v2v: support Debian/Ubuntu guests
    resolves: rhbz#1387213
  - sysprep: remove DHCP_HOSTNAME entries
    resolves: rhbz#1427529
  - v2v: avoid repeated "run virt-v2v -v -x" message on error
    resolves: rhbz#1167623
  - bash-completion: add script for virt-v2v-copy-to-local
    resolves: rhbz#1367738
  - v2v: fix virtio block driver installation for Windows 10 and Windows 2016
    resolves: rhbz#1434737
  - Replace the libosinfo dependency with osinfo-db, since we are only using
    the osinfo database.
  - v2v: fix virtio driver installation for Windows 8 UEFI
    resolves: rhbz#1431579
  - v2v: new 'vmx' import method
    resolves: rhbz#1441197
  - v2v: properly identify Windows 2016 guests when exporting them to RHV-M
    resolves: rhbz#1447202
  - Run pvresize in non-interactive mode
    resolves: rhbz#1460692
  - resize: make sure the input disk is read-only
    resolves: rhbz#1463714
  - Switch qemu-kvm-rhev dependency to qemu-kvm on aarch64
    resolves: rhbz#1463646


author: Pino Toscano <ptoscano@redhat.com> - 1:1.36.10-6
changelog:
  - Rebase to libguestfs 1.36.10 in RHEL 7.5.
    resolves: rhbz#1472272
  - Build against OCaml 4.05
    resolves: rhbz#1447981
  - Enable the copyonread flag when running the appliance using libvirt.
    resolves: rhbz#1466563
  - Make sure kernel-rt is never used as Requires.
    resolves: rhbz#1471651
  - v2v: disable unconfiguration of manually installed VMware tools.
    resolves: rhbz#1477905
  - v2v: prefer pigz or pxz for uncompressing OVA files, if available
    resolves: rhbz#1448739
  - resize: handle empty UUIDs for swap partitions
    resolves: rhbz#1482737
  - v2v: remove mention of --dcpath in an error message
    resolves: rhbz#1486197
  - Disables the QEMU image file locking when opening disks as read-only
    resolves: rhbz#1417306
    resolves: rhbz#1503497
  - Briefly document the format used for URIs
    resolves: rhbz#1450325
  - v2v: deal with grub2 configurations without a default set
    resolves: rhbz#1472288
  - v2v: warn when a guest has passthrough devices
    resolves: rhbz#1472719
  - v2v: fix three regular expressions
    resolves: rhbz#1494555
  - v2v: enable conversion of full-disk LUKS-encrypted Linux guests
    resolves: rhbz#1451665
  - v2v: new 'vddk' import method
    resolves: rhbz#1477912
    resolves: rhbz#1513884
  - Enable libguestfs to work on z Systems
    resolves: rhbz#1479526
  - p2v: fx check for sudo requiring a password
    resolves: rhbz#1500673
  - v2v: handle disks with snapshots in vCenter
    resolves: rhbz#1172425
  - rescue: backport improved version
    resolves: rhbz#1438710
  - v2v: improve bootloader detection
    resolves: rhbz#1508299
  - v2v: parse MAC address of network interfaces in OVF files
    resolves: rhbz#1506572
  - Unconditionally depend on libvirt-daemon-kvm >= 3.9.0-1, which will always
    pull the right qemu-kvm too, and thus remove the unversioned dependencies
    on it
    resolves: rhbz#1500870
  - v2v: fix RPM file owned test
    resolves: rhbz#1503958
  - Do not open read-only disks using <shareable/> in the libvirt backend
    resolves: rhbz#1518517
  - v2v: handle better when grubby does not report any default kernel
    resolves: rhbz#1519204
  - v2v: enhance vmx import method to access via SSH
    resolves: rhbz#1523767
  - builder: fix caching of templates when using --cache-all-templates
    resolves: rhbz#1523650


author: William Cohen <wcohen@redhat.com> - 5.2.0-15
changelog:
  - Update papi L1 cache events on POWER7
  - Prevent papi-testsuite segfaults
  - Identify kernels that support rdpmc
  - Correct papi-testsuite byte_profile and sprofile tests on ppc64le
  - Update PAPI_L1_TCM event on Haswells


author: Radovan Sroka <rsroka@redhat.com> - 8.24.0-8
changelog:
  RHEL 7.4 ERRATUM
  - added dependency automake autoconf libtool due to yum-builddep
  - reenable omruleset module
    resolves: rhbz#1431615
    resolves: rhbz#1428403
    resolves: rhbz#1427821(fix regression, failed QA)
    resolves: rhbz#1432069
  - resolves: rhbz#1165236
    resolves: rhbz#1419228
    resolves: rhbz#1431616 
    resolves: rhbz#1196230(failed QA)


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-9
changelog:
  RHEL 7.4 ERRATUM
  - added autoreconf call
  - added patch to replace gethostbyname with getaddrinfo call
    resolves: rhbz#1056548(failed QA)


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-10
changelog:
  RHEL 7.4 ERRATUM
  - edited patches Patch19 and Patch21
    resolves: rhbz#1419228(coverity scan problems)
    resolves: rhbz#1056548(failed QA, coverity scan problems)


author: Radovan Sroka <rsroka@redhat.com> - 8.24.0-11
changelog:
  RHEL 7.4 ERRATUM
  - added new patch that backports num2ipv4 due to rhbz#1427821
    resolves: rhbz#1427821
  - enable pmrfc3164sd module
    resolves: rhbz#1431616


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-13
changelog:
  RHEL 7.5 ERRATUM
  - added patch to properly resolve FQDN
    resolves: rhbz#1401456
  - added documentation patch correcting qeues default values
    resolves: rhbz#1459896
  - added patch adjusting log level of journal reloaded msg
    resolves: rhbz#1497985 
  - added patch to prevent crash with invalid set statement
    this also obsoletes patch2 (for 1188503) 
    resolves: rhbz#1462160
  - added patch with nullptr check to prevent ABRT
    resolves: rhbz#1488186


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-14
changelog:
  RHEL 7.5 ERRATUM
  - renamed patch for undocumented recover_qi script to correct bz number
    resolves: rhbz#1507028
  - added patch ensuring relp conneciton is active before closing it
    resolves: rhbz#1505103


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-15
changelog:
  RHEL 7.5 ERRATUM
  - made rsyslog-doc noarch and fixed search on doc regeneration
    resolves: rhbz#1507028


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-16
changelog:
  RHEL 7.5 ERRATUM
  - edited the patch to conform to latest upstream doc
    resolves: rhbz#1459896 (failedQA)
  - disabled 32-bit builds on all arches as they are not shipped
    anymore in RHEL7


author: Tomáš Mráz <tmraz@redhat.com> - 6.2.6-1
changelog:
  - add use_first_pass to pam_sss in password stack
  - more robust initialization of sssdConfig
  - check whether base DN value is a real base DN
  - use non-deprecated pam_pwquality option authtok_type= instead of type=
  - update lastlog for su


author: Tomáš Mráz <tmraz@redhat.com> - 6.2.7-1
changelog:
  - samba-winbind-clients package contains the nsswitch and pam modules (#919117)
  - do not drop sss from nsswitch.conf on --update (#980861)
  - writing out smartcard/fingerprint auth policy to dconf (original patch by
    Ray Strode) (#990625)
  - document other possible return codes from authconfig invocation (#991804)
  - print error message if config file save fails (#994596)
  - never stop rpcbind (#990788)
  - do not disable sssd.service when --enablesssd is used (#953851)
  - revert use_first_pass addition to pam_sss in password stack (#953116)


author: Tomáš Mráz <tmraz@redhat.com> - 6.2.8-1
changelog:
  - detect invalid LDAP uri and report error
  - fix handling of IPA domain join errors and uninstall
  - add support for winbind authentication over Kerberos 5
  - set umask=077 by default for pam_mkhomedir and pam_oddjob_mkhomedir
  - better error checking for password quality options


author: Tomáš Mráz <tmraz@redhat.com> - 6.2.8-2
changelog:
  - updated translations
  - make pam_pkcs11 not ignore the wait_for_card option
  - gnome-screensaver does not exist anymore


author: Tomáš Mráz <tmraz@redhat.com> - 6.2.8-7
changelog:
  - check nslcd for restart when --enableforcelegacy is used
  - call restorecon on newly created configuration files


author: Tomáš Mráz <tmraz@redhat.com> - 6.2.8-8
changelog:
  - enable/start sssd only when config exists or enabled
    for both pam and nsswitch.conf
  - updated translations


author: Tomáš Mráz <tmraz@redhat.com> - 6.2.8-9
changelog:
  - do not overwrite special ldap base values
  - display error message if winbind or IPA domain join fails
  - fix invocation of IPA domain join from GUI
  - keep altfiles in nsswitch.conf if present (#1134084)
  - the winbind client is now in samba-winbind package (#1084997)
  - correct handling of SSSD enablement during IPA domain joins
  - do not bail out if multiple LDAP URIs are specified (#1142830)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-19.2
changelog:
  - device: rework how we enter tentative state (#1283579)
  - core: Do not bind a mount unit to a device, if it was from mountinfo (#1283579)
  - logind: set RemoveIPC=no by default (#1284588)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-19.3
changelog:
  - sysv-generator: follow symlinks in /etc/rc.d/init.d (#1288005)
  - man: RemoveIPC is set to no on rhel (#1284588)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-19.7
changelog:
  - Revert "udev: fibre channel: fix NPIV support" (#1266934)
  - udev: path-id: fibre channel NPIV - use fc_vport's port_name (#1266934)
  - rules: set SYSTEMD_READY=0 on DM_UDEV_DISABLE_OTHER_RULES_FLAG=1 only with ADD event (#1312011)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-19.9
changelog:
  - journal: fix error handling when compressing journal objects (#1292447)
  - journal: irrelevant coding style fixes (#1292447)


author: Jan Rybar <jrybar@redhat.com> - 3.3.10-7
changelog:
  - Fixing sysinfo - devices with length exceeding 15 chars are not displayed in vmstat -d
  - Resolves: #1169349


author: Jan Rybar <jrybar@redhat.com> - 3.3.10-9
changelog:
  - Fixes showing same cgroups for threads under process by adding format option
  - Resolves: rhbz#1284087


author: Jan Rybar <jrybar@redhat.com> - 3.3.10-10
changelog:
  - Fixes sysinfo - devices with name longer than 20 chars are mistaken for partitions
  - Resolves: rhbz#1169349


author: Radek Vykydal <rvykydal@redhat.com> - 21.48.22.114-1
changelog:
  - Show the text of completions in the datetime spoke. (vponcova)
    Related: rhbz#1447984
  - Look higher for the combobox associated with an entry (dshea)
    Resolves: rhbz#1447984
  - Fix the addon handlers for the checkbox (vponcova)
    Resolves: rhbz#1448187


author: Radek Vykydal <rvykydal@redhat.com> - 21.48.22.115-1
changelog:
  - Show a no network warning for network installation source. (vponcova)
    Related: rhbz#1418604
  - Show warnings about enabling the network time (vponcova)
    Resolves: rhbz#1418604
  - Fix generating UUID even for pre snapshots (jkonecny)
    Related: rhbz#1113207


author: Radek Vykydal <rvykydal@redhat.com> - 21.48.22.116-1
changelog:
  - Allow nonstrict behaviour for all passwords in tui (vponcova)
    Resolves: rhbz#1450326
  - Fix setting errors and warnings in the StorageCheckHandler (vponcova)
    Resolves: rhbz#1453130
  - Mark post inst tools as disabled only if firstboot --disable is used
    (mkolman)
    Resolves: rhbz#1448940
  - Set the default filesystem type from a kickstart file (vponcova)
    Resolves: rhbz#1449099


author: Radek Vykydal <rvykydal@redhat.com> - 21.48.22.117-1
changelog:
  - Root checking fixes password for password from kickstart (mkolman)
    Related: rhbz#1356966
  - Improve the GUI password checker (mkolman)
    Related: rhbz#1356966
  - Respect changesok policy on root password spoke (mkolman)
    Resolves: rhbz#1356966
  - Update translations of password checking strings (rvykydal)
    Resolves: rhbz#1383911


author: Radek Vykydal <rvykydal@redhat.com> - 21.48.22.118-1
changelog:
  - rpmostreepayload: [rhel7only] Move tmpfiles to after mount setup (walters)
    Resolves: rhbz#1459623
  - rpmostreepayload: Handle /var as a user-specified mountpoint (walters)
    Resolves: rhbz#1459623


author: Radek Vykydal <rvykydal@redhat.com> - 21.48.22.121-1
changelog:
  - rpmostreepayload: Stub out payload methods which use `import rpm` (walters)
    Related: rhbz#1462979


author: CentOS Sources <bugs@centos.org> - 21.48.22.121-1.el7.centos
changelog:
  - Add CentOS install class as default
  - use the right path for the EULA string (issue 7165,  bstinson)
  - use efi_dir = centos
  - disable the mirrorlist options
  - make boot part fs default to xfs


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-85.6
changelog:
  - Add 0137-RHBZ-1364905-ordering.patch
    * force multipathd.service to start after systemd-udev-trigger.service
  - Resolves: bz #1364905


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-34
changelog:
  - mod_proxy_fcgi: honor Timeout / ProxyTimeout (#1222328)
  - do not show all vhosts twice in httpd -D DUMP_VHOSTS output (#1225820)
  - fix -D[efined] or <Define>[d] variables lifetime accross restarts (#1227219)
  - mod_ssl: do not send NPN extension with not configured (#1226015)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-35
changelog:
  - mod_remoteip: correct the trusted proxy match test (#1179306)
  - mod_dav: send complete response when resource is created (#1235383)
  - apachectl: correct the apachectl status man page (#1231924)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-36
changelog:
  - Revert fix for #1162152, it is not needed in RHEL7
  - mod_proxy_ajp: fix settings ProxyPass parameters for AJP backends (#1242416)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-37
changelog:
  - core: fix chunk header parsing defect (CVE-2015-3183)
  - core: replace of ap_some_auth_required with ap_some_authn_required
    and ap_force_authn hook (CVE-2015-3185)


author: CentOS Sources <bugs@centos.org> - 2.4.6-40.el7.centos.1
changelog:
  - Remove index.html, add centos-noindex.tar.gz
  - change vstring
  - change symlink for poweredby.png
  - update welcome.conf with proper aliases


author: Akira TAGOH <tagoh@redhat.com> - 2.3-1
changelog:
  - New upstream release. (Paul Williams, #599281)
    - drop upstreamed patch.
    - correct man page location.
  - Update the spec file to keep consistensy of usage in the macro as far as possible.


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.111-4.b18
changelog:
  - Use java-1.7.0-openjdk to bootstrap on RHEL to allow us to use main build target
  - Resolves: rhbz#1410612


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.112-0.b16
changelog:
  - Update to aarch64-jdk8u112-b16.
  - Drop upstreamed patches for 8044762, 8049226, 8154210, 8158260 and 8160122.
  - Re-generate size_t and key size (RH1163501) patches against u112.
  - Resolves: rhbz#1410612


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.121-0.b13
changelog:
  - Update to aarch64-jdk8u121-b13.
  - Add MD5 checksum for the new java.security file (EC < 224, DSA < 1024 restricted)
  - Update PR1834/RH1022017 fix to reduce curves reported by SSL to apply against u121.
  - Resolves: rhbz#1410612


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.121-1.b13
changelog:
  - Add backports from 8u131 and 8u152 ahead of April CPU.
  - Apply backports before local RPM fixes so they will be the same as when applied upstream
  - Adjust RH1022017 following application of 8173783
  - Resolves: rhbz#1438751


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-1.b11
changelog:
  - Update to aarch64-jdk8u131-b11.
  - Drop upstreamed patches for 8147910, 8161993, 8170888 and 8173783.
  - Update generate_source_tarball.sh to remove patch remnants.
  - Cleanup tarball creation documentation to avoid duplication.
  - Add MD5 checksum for the new java.security file (MD5 disabled for JAR signing)
  - Resolves: rhbz#1438751


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-2.b13
changelog:
  - Backport "S8153711: [REDO] JDWP: Memory Leak: GlobalRefs never deleted when processing invokeMethod command"
  - Resolves: rhbz#1442162


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-3.b12
changelog:
  - Update to aarch64-jdk8u131-b12 and aarch64-shenandoah-jdk8u131-b12 for AArch64 8168699 fix
  - Resolves: rhbz#1449258


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-4.b12
changelog:
  - Add backports from 8u152 (8179084/RH1455694, 8181419/RH1463144, 8175887) ahead of July CPU.
  - Resolves: rhbz#1466509


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.141-0.b15
changelog:
  - Update to aarch64-jdk8u141-b15.
  - Update location of OpenJDK system library source code in remove-intree-libraries.sh
  - Drop upstreamed patches for 6515172, 8144566, 8155049, 8165231, 8174164, 8174729 and 8175097.
  - Update PR1983, PR2899 and PR2934 (SunEC + system NSS) to accomodate 8175110.
  - Add MD5 checksum for the new java.security file (SHA1 disabled for server-side certificates in jdkCA)
  - Resolves: rhbz#1466509


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.141-1.b16
changelog:
  - Update to aarch64-jdk8u141-b16.
  - Revert change to remove-intree-libraries.sh following backout of 8173207
  - Resolves: rhbz#1466509


author: Lokesh Mandvekar <lsm5@redhat.com> - 1:0.1.24-2.dev.git28d4e08
changelog:
  - Update container/storage.conf and containers-storage.conf man page
  - Default override to true so it is consistent with RHEL.


author: Lokesh Mandvekar <lsm5@redhat.com> - 1:0.1.24-3.dev.git28d4e08
changelog:
  - add rhel subscription secrets date to skopeo-containers
  - skopeo-containers conflicts with docker >= 2:1.13.1-61


author: dwalsh <dwalsh@redhat.com> - 0.1.25-1.git7fd6f66b
changelog:
  -   Fix CVE in tar-split
  -   copy: add shared blob directory support for OCI sources/destinations
  -   Aligning Docker version between containers/image and skopeo
  -   Update image-tools, and remove the duplicate Sirupsen/logrus vendor
  -   makefile: use -buildmode=pie


author: Tom Lane <tgl@redhat.com> 2.3.1-1
changelog:
  - Update to version 2.3.1.  The main externally-visible change is that the
    GUI programs are not part of the unixODBC tarball anymore, so they are no
    longer in this package, and the unixODBC-kde sub-RPM has disappeared.
    There is a separate package unixODBC-gui-qt that now provides those programs.


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-9
changelog:
  - fixed missing system hang at shutdown if root device is network based
    (RHBZ#1007934)
  - Fixed iptables-save man page completely wrong (RHBZ#1054871)
  - Fixed missing reload action for iptables service (RHBZ#1066007)
  - Fixed regressions from RHEL-6 iptables services (RHBZ#1067670)


author: Hans de Goede <hdegoede@redhat.com> - 0.6-3
changelog:
  - Fix usbredirserver not listening for ipv6 connections (rhbz#957470)
  - Fix a few (harmless) coverity warnings


author: Hans de Goede <hdegoede@redhat.com> - 0.6-5
changelog:
  - Use the new libusb autodetach kernel driver functionality
  - Fix a usbredirparser bug which causes tcp/ip redir to not work (rhbz#1005015)


author: Victor Toso <victortoso@redhat.com> - 0.6-8
changelog:
  - Fix migration due lack of capabilities from source host
    Resolves: rhbz#1185167
  - New callback to drop isoc packets in order to avoid high memory
    consumption in the client
    Resolves: rhbz#1312913


author: Herton R. Krzesinski <herton@redhat.com> [4.11.0-42.el7a]
changelog:
  - [kernel] sched,wake: simplify wake_affine (Rik van Riel) [1388460]
  - [kernel] sched, numa: scale scan period with tasks in group and shared/private (Rik van Riel) [1388460]
  - [kernel] numa, sched: slow down scan rate if shared faults dominate (Rik van Riel) [1388460]
  - [kernel] sched/fair: Fix wake_affine_llc() balancing rules (Rik van Riel) [1388460]
  - [kernel] sched/fair: Fix wake_affine() for !NUMA_BALANCING (Rik van Riel) [1388460]
  - [kernel] sched/numa: Hide numa_wake_affine() from UP build (Rik van Riel) [1388460]
  - [kernel] sched,fair: remove effective_load (Rik van Riel) [1388460]
  - [kernel] sched, numa: implement numa node level wake_affine (Rik van Riel) [1388460]
  - [kernel] sched: simplify wake_affine for single socket case (Rik van Riel) [1388460]
  - [kernel] sched/numa: Override part of migrate_degrades_locality() when idle balancing (Rik van Riel) [1388460]


author: Herton R. Krzesinski <herton@redhat.com> [4.11.0-43.el7a]
changelog:
  - [kernel] cgroup: Reinit cgroup_taskset structure before cgroup_migrate_execute() returns (Waiman Long) [1496999]
  - [fs] ext4: fix off-by-one on max nr_pages in ext4_find_unwritten_pgoff() (Bill O'Donnell) [1500586]
  - [fs] fs/locks: Remove fl_nspid and use fs-specific l_pid for remote locks (Benjamin Coddington) [1493427]
  - [powerpc] KVM: PPC: Book3S HV: Don't access XIVE PIPR register using byte accesses (Suraj Jitindar Singh) [1496875]
  - [powerpc] KVM: PPC: Book3S HV: Workaround POWER9 DD1.0 bug causing IPB bit loss (Suraj Jitindar Singh) [1496875]
  - [arm64] mm: Use READ_ONCE when dereferencing pointer to pte table (Mark Langsdorf) [1475855]


author: Frantisek Hrbata <fhrbata@hrbata.com> [4.11.0-44.1.1.el7a]
changelog:
  - [netdrv] ib/mlx5: set UMR wqe fence according to HCA cap (Honggang Li) [1508606 1494261]
  - [netdrv] ib/mlx5: Define interface bits for fencing UMR wqe (Honggang Li) [1508606 1494261]
  - [scsi] aacraid: Fix controller initialization failure (Mauricio Oliveira) [1508580 1502892]
  - [powerpc] KVM: PPC: Book3S HV: Add more barriers in XIVE load/unload code (Suraj Jitindar Singh) [1508526 1497013]
  - [powerpc] xive: Fix the size of the cpumask used in xive_find_target_in_mask() (Steve Best) [1507413 1501747]
  - [redhat] hardcode .el7a dist tag (Frantisek Hrbata)


author: Frantisek Hrbata <fhrbata@hrbata.com> [4.11.0-44.2.1.el7a]
changelog:
  - [powerpc] perf: Fix core-imc hotplug callback failure during imc initialization (Jiri Olsa) [1510165 1507609]
  - [misc] cxl: Set the valid bit in PE for dedicated mode (Waiman Long) [1510152 1498927]
  - [misc] cxl: Enable global TLBIs for cxl contexts (Waiman Long) [1510152 1498927]
  - [powerpc] powerpc/mm: Export flush_all_mm() (Waiman Long) [1510152 1498927]
  - [misc] cxl: Fix memory page not handled (Waiman Long) [1510152 1498927]
  - [misc] cxl: Fix driver use count (Waiman Long) [1510152 1498927]
  - [powerpc] powerpc/mm: Optimize detection of thread local mm's (Waiman Long) [1510152 1498927]
  - [powerpc] powerpc/mm: Ensure cpumask update is ordered (Waiman Long) [1510152 1498927]
  - [powerpc] perf: Fix for core/nest imc call trace on cpuhotplug (Jiri Olsa) [1508905 1493444]
  - [powerpc] perf: Fix IMC initialization crash (Jiri Olsa) [1508527 1500707]
  - [sched] core: Address more wake_affine() regressions (Lauro Ramos Venancio) [1508368 1465041]
  - [sched] core: Fix wake_affine() performance regression (Lauro Ramos Venancio) [1508368 1465041]
  - [kernel] revert "sched,wake: simplify wake_affine" (Lauro Ramos Venancio) [1508368 1465041]


author: Frantisek Hrbata <fhrbata@hrbata.com> [4.11.0-44.3.1.el7a]
changelog:
  - [block] blk-mq-tag: check for NULL rq when iterating tags (Ming Lei) [1518433 1498563]
  - [scsi] sd: Do not override max_sectors_kb sysfs setting (Steve Best) [1518432 1514951]
  - [net] i40e: Use smp_rmb rather than read_barrier_depends (Mauricio Oliveira) [1518412 1513182]
  - [net] ixgbe: Fix skb list corruption on Power systems (Mauricio Oliveira) [1518412 1513182]


author: Frantisek Hrbata <fhrbata@hrbata.com> [4.11.0-44.4.1.el7a]
changelog:
  - [mm] kernel: pmd can become dirty without going through a COW cycle (Chris von Recklinghausen) [1518611 1518612] {CVE-2017-1000405}
  - [powerpc] powernv: Fix missing attr initialisation in (Frantisek Hrbata) [1522845 1513834]
  - [powerpc] powernv: Add OPAL exports attributes to sysfs (Frantisek Hrbata) [1522845 1513834]
  - [cpufreq] stats: Handle the case when trans_table goes beyond PAGE_SIZE (Desnes Augusto Nunes do Rosario) [1522844 1499411]
  - [netdrv] i40e: avoid NVM acquire deadlock during NVM update (Frantisek Hrbata) [1522843 1511691]
  - [netdrv] i40e: point wb_desc at the nvm_wb_desc during (Frantisek Hrbata) [1522843 1511691]
  - [block] drain queue before waiting for q_usage_counter becoming zero (Ming Lei) [1522645 1513036]
  - [block] wake up all tasks blocked in get_request() (Ming Lei) [1522645 1513036]
  - [block] Make q_usage_counter also track legacy requests (Ming Lei) [1522645 1513036]
  - [powerpc] kvm: Tie KVM_CAP_PPC_HTM to the user-visible TM feature (Waiman Long) [1509974 1498555]
  - [powerpc] tm: P9 disable transactionally suspended sigcontexts (Waiman Long) [1509974 1498555]
  - [powerpc] powernv: Enable TM without suspend if possible (Waiman Long) [1509974 1498555]
  - [powerpc] Add PPC_FEATURE2_HTM_NO_SUSPEND (Waiman Long) [1509974 1498555]
  - [powerpc] tm: Add commandline option to disable hardware transactional memory (Waiman Long) [1509974 1498555]


author: Frantisek Hrbata <fhrbata@hrbata.com> [4.11.0-44.5.1.el7a]
changelog:
  - [powerpc] spinlock: add gmb memory barrier (Mauricio Oliveira) [1527484 1527483] {CVE-2017-5754}
  - [powerpc] Prevent Meltdown attack with L1-D$ flush (Mauricio Oliveira) [1527484 1527483] {CVE-2017-5754}


author: Frantisek Hrbata <fhrbata@hrbata.com> [4.11.0-44.6.1.el7a]
changelog:
  - [powerpc] perf: Dereference BHRB entries safely (Gustavo Duarte) [1538031 1525101]
  - [fs] debugfs: fix debugfs_real_fops() build error (Gustavo Duarte) [1538030 1533827]
  - [fs] debugfs: defer debugfs_fsdata allocation to first usage (Gustavo Duarte) [1538030 1533827]
  - [fs] debugfs: call debugfs_real_fops() only after debugfs_file_get() (Gustavo Duarte) [1538030 1533827]
  - [fs] debugfs: purge obsolete SRCU based removal protection (Gustavo Duarte) [1538030 1533827]
  - [infiniband] ib/hfi1: convert to debugfs_file_get() and -put() (Gustavo Duarte) [1538030 1533827]
  - [fs] debugfs: convert to debugfs_file_get() and -put() (Gustavo Duarte) [1538030 1533827]
  - [fs] debugfs: debugfs_real_fops(): drop __must_hold sparse annotation (Gustavo Duarte) [1538030 1533827]
  - [fs] debugfs: implement per-file removal protection (Gustavo Duarte) [1538030 1533827]
  - [fs] debugfs: add support for more elaborate ->d_fsdata (Gustavo Duarte) [1538030 1533827]
  - [tools] perf vendor events: Use more flexible pattern matching for CPU identification for mapfile.csv (Jiri Olsa) [1536567 1513805]
  - [tools] perf pmu: Extract function to get JSON alias map (Jiri Olsa) [1536567 1513805]
  - [tools] perf pmu: Add helper function is_pmu_core to detect PMU CORE devices (Jiri Olsa) [1536567 1513805]
  - [netdrv] tg3: Fix rx hang on MTU change with 5717/5719 (Mauricio Oliveira) [1533478 1526319]
  - [powerpc] powerpc/64s/radix: Boot-time NULL pointer protection using a guard-PID (Mauricio Oliveira) [1546950 1539109]
  - [powerpc] powerpc/64s: Initialize ISAv3 MMU registers before setting partition table (Steve Best) [1533476 1523226]
  - [net] ipv4: fix for a race condition in raw_sendmsg (Stefano Brivio) [1527028 1527027] {CVE-2017-17712}
  - [mm] pagewalk.c:walk_hugetlb_range function mishandles holes in hugetlb ranges causing information leak [rhel-alt-7.4.z] (Chris von Recklinghausen) [1520394 1520395] {CVE-2017-16994}


author: Johnny Hughes <johnny@centos.org> [4.11.0-45.6.1.el7a]
changelog:
  - Rolled in CentOS certificates and signed modules with a CentOS certificates.
  - add backported patches from APM, 8001, and 8002
  - updated with patch from QCOM for network functionality


author: Soren Sandmann <ssp@redhat.com> - 1.0.2-3
changelog:
  - Man page fixes
    - Document that multiple connections don't work (988294)
    - Document the list of plugins (988307, 988308)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-43.4
changelog:
  - Revert the fix for ignoring sudoUser case as it breaks processing
    of rules that completely lack a sudoUser attribute
  - Related: rhbz#1392946 - sudo: ignore case on case insensitive domains


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-43.6
changelog:
  - Related: rhbz#1396486 - bz - ldap group names don't resolve after
                            upgrading sssd to 1.14.0 if ldap_nesting_level
                            is set to 0


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-43.7
changelog:
  - Resolves: rhbz#1393730 - No supplementary groups are resolved for users
                             in nested OUs when domain stanza differs from AD
                             domain


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-43.11
changelog:
  - Resolves: rhbz#1404340 - Use-after free in resolver in case the fd is
                             writeable and readable at the same time


author: Petr Machata <pmachata@redhat.com> - 1.9.20111219-1
changelog:
  - Rebase to 20111219
    - add "-s" option
    - Resolves: #769237
  - Revert default stack size to 10000
    - Related: #743343


author: Jim Perrin <jperrin@centos.org> [4.5.0-21.el7]
changelog:
  - Fix Cavium retrain link patch
  - Apply APM patches 1029, 1030 
  - Add CONFIG_LEDS_PCA955X and CONFIG_LEDS_PCA963X


author: Marcela Mašláňová <mmaslano@redhat.com> - 3.1.13-8
changelog:
  - at-3.1.13-mailwithhostname.patch in email mention also hostname address
  - at-3.1.13-usePOSIXtimers.patch use POSIX timers, so we won't need
    pm-utils hack anymore
  - at-3.1.13-help.patch update usage
  - systemd-user-sessions.service is used in unit file, so the atd should be
    started after almost all services are up and running
  - 812682 pam support work with new systemd defaults


author: Marcela Mašláňová <mmaslano@redhat.com> - 3.1.13-10
changelog:
  - fix license field
  - fix systemd macros in scriptlets part of the specfile
  - fix selinux patch to apply without fuzz=2


author: Marcela Mašláňová <mmaslano@redhat.com> - 3.1.13-16
changelog:
  - the correct solution is remove smp_flags, they don't work properly on ppc with
    the option mpower7
  - Related: rhbz#1048745


author: Ryan Rix <ry@n.rix.si> - 0.3.1-3
changelog:
  - Update the category to adhere to new SC 4.5 systemsettings layout. Will now
    appear under the "input devices" section.


author: Kevin Kofler <Kevin@tigcc.ticalc.org> - 0.3.1-6
changelog:
  - Merge bugfixes from Kubuntu, fixes circular scrolling and more (#633353)
  - Drop default kcmtouchpadrc, use driver defaults (#611611)
  - Make the Scrolling tab use a vertical scrollbar if needed (#600121)


author: Peter Schiffer <pschiffe@redhat.com> - 12.5-7
changelog:
  - cleaned .spec file
  - resolves: #805410
    fixed SIGSEGV crash in which_protocol() function
  - updated get-upstream-tarball.sh script and added it as additional source


author: Peter Schiffer <pschiffe@redhat.com> - 12.5-9
changelog:
  - related: #912785
    used -D_FILE_OFFSET_BITS=64 flag at the compile time
  - return error code when TMPDIR is set to an invalid path while sending email
  - added missing -v option to the usage message


author: Frantisek Kluknavsky <fkluknav@redhat.com> - 1.0.0-24.rc4.dev.gitc6e4a1e.1
changelog:
  - rebase to c6e4a1ebeb1a72b529c6f1b6ee2b1ae5b868b14f
  - https://github.com/opencontainers/runc/pull/1651


author: Lokesh Mandvekar <lsm5@redhat.com> - 2:1.0.0-52.dev.git70ca035
changelog:
  - built commit 70ca035 with additional patches to change default root and
  to revert apply cgroups earlier


author: Paul Wouters <paul@nohats.ca> - 1.7.2.0-1
changelog:
  - Upgraded to 1.7.2.0 which allows tun/tap interfaces without IP address
    and introduces options openssl-compress and max-children.


author: Paul Wouters <pwouters@redhat.com> - 1.7.2.1-1
changelog:
  - Updated to 1.7.2.1 for CVE-2012-0219, rhbz#821553, rhbz#821688
  - Remove patch merged upstream
  - Remove --disable-fips from configure


author: Paul Wouters <pwouters@redhat.com> - 1.7.2.2-2
changelog:
  - Resolves: rhel#1017015 Use readline, not compat-readline5-devel
  - Added two patches fixing -Wformat issues
  - Enable hardened build
  - Cleanup obsolete spec file lines


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.0.11-44
changelog:
  - fence_mpath: update info to say unique key per node instead of per
    node/device
    Resolves: rhbz#1280151


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-3
changelog:
  - PKI TRAC Ticket #691  - [MAN] pki-server man pages (mharmsen)
  - PKI TRAC Ticket #1114 - [MAN] Generting Symmetric key fails with
    key-generate when --usages verify is passed (jmagne)
  - PKI TRAC Ticket #1306 - [RFE] Add granularity to token termination in TPS
    (cfu)
  - PKI TRAC Ticket #1308 - [RFE] Provide ability to perform off-card key
    generation for non-encryption token keys (cfu)
  - PKI TRAC Ticket #1405 - [MAN] Add additional HSM details to
    'pki_default.cfg' & 'pkispawn' man pages (mharmsen)
  - PKI TRAC Ticket #1607 - [MAN] man pkispawn has inadequate description for
    shared vs non shared tomcat instance installation (mharmsen)
  - PKI TRAC Ticket #1664 - [BUG] Add ability to disallow TPS to enroll a single
    user on multiple tokens. (jmagne)
  - PKI TRAC Ticket #1711 - CLI :: pki-server ca-cert-request-find throws
    IOError (edewata, ftweedal)
  - PKI TRAC Ticket #2285 - freeipa fails to start correctly after pki-core
    update on upgraded system (ftweedal)
  - PKI TRAC Ticket #2311 - When pki_token_name=Internal, consider normalizing
    it to "internal" (mharmsen)
  - PKI TRAC Ticket #2349 - Separated TPS does not automatically receive shared
    secret from remote TKS (jmagne)
  - PKI TRAC Ticket #2364 - CLI :: pki-server ca-cert-request-show throws
    attribute error (ftweedal)
  - PKI TRAC Ticket #2368 - pki-server subsystem subcommands throws error with
    --help option (edewata)
  - PKI TRAC Ticket #2374 - KRA cloning overwrites CA signing certificate trust
    flags (edewata)
  - PKI TRAC Ticket #2380 - Pki-server instance commands throws exception while
    specifying invalid parameters. (edewata)
  - PKI TRAC Ticket #2384 - CA installation with HSM prompts for HSM password
    during silent installation (edewata)
  - PKI TRAC Ticket #2385 - Upgraded CA lacks ca.sslserver.certreq in CS.cfg
    (ftweedal)
  - PKI TRAC Ticket #2387 - Add config for default OCSP URI if none given
    (ftweedal)
  - PKI TRAC Ticket #2388 - CA creation responds 500 if certificate issuance
    fails (ftweedal)
  - PKI TRAC Ticket #2389 - Installation: subsystem certs could have notAfter
    beyond CA signing cert in case of external or existing CA (cfu)
  - PKI TRAC Ticket #2390 - Dogtag 10.3.4: Miscellaneous Enhancements
    (akasurde, edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-5
changelog:
  - PKI TRAC Ticket #978  - TPS connector man page: add revocation routing
    info (cfu)
  - PKI TRAC Ticket #1285 - [MAN] Apply 'generateCRMFRequest() removed from
    Firefox' workarounds to appropriate 'pki' man page (jmagne)
  - PKI TRAC Ticket #2246 - [MAN] Man Page: AuditVerify (cfu)
  - PKI TRAC Ticket #2381 - Throws exception while providing invalid module.
    (edewata)
  - PKI TRAC Ticket #2383 - CLI :: pki client-cert-request --extractable
    should accept only boolean value (edewata)
  - PKI TRAC Ticket #2389 - Installation: subsystem certs could have notAfter
    beyond CA signing cert in case of external or existing CA (cfu)
  - PKI TRAC Ticket #2399 - Dogtag 10.3.5: Miscellaneous Enhancements
    (akasurde, alee, cheimes, edewata, jmagne, mharmsen)
  - PKI TRAC Ticket #2401 - pkispawn calls dnsdomainname even if it does not
    rpm-require hostname (mharmsen)
  - PKI TRAC Ticket #2402 - Conflict in file ownership in pki-base and
    pki-server (cheimes)
  - PKI TRAC Ticket #2403 - Deployment problem with RESTEasy 3.0.17 (edewata)
  - PKI TRAC Ticket #2406 - Make starting CRL Number configurable (jmagne)
  - PKI TRAC Ticket #2412 - pki client-cert-import --trust option does not
    apply the specified trust bits (alee)
  - PKI TRAC Ticket #2418 - [TPS] Some template substitution didn't happen
    during installation (alee)
  - PKI TRAC Ticket #2420 - CA subsystem OSCP responder fails when LWCAs are
    not used (ftweedal)
  - PKI TRAC Ticket #2421 - Incorrect SELinux contexts
    Installation/Configuration (edewata)
  - PKI TRAC Ticket #2424 - ipa-ca-install fails on replica when IPA server
    is converted from CA-less to CA-full (edewata)
  - PKI TRAC Ticket #2428 - broken request links for CA's system certs in
    agent request viewing (cfu)
  - PKI TRAC Ticket #2430 - CA Agent certificate list is not sorted by serial
    number in migration case (jmagne)
  - PKI TRAC Ticket #2431 - Errors noticed during ipa server upgrade.
    (mharmsen)
  - PKI TRAC Ticket #2433 - Lightweight CA GET <id>/chain returns bogus PEM
    data (ftweedal)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-7
changelog:
  - PKI TRAC Ticket #690 - [MAN] pki-tools man pages (mharmsen)
    - CMCEnroll
  - PKI TRAC Ticket #833 - pki user-mod fullName="" gives an error message
    "PKIException: LDAP error (21): error result" (edewata)
  - PKI TRAC Ticket #2431 - Errors noticed during ipa server upgrade.
    (cheimes, edewata, mharmsen)
  - PKI TRAC Ticket #2432 - Kra-selftest behavior is not as expected (edewata)
  - PKI TRAC Ticket #2436 - Dogtag 10.3.6: Miscellaneous Enhancements
    (edewata, mharmsen)
  - PKI TRAC Ticket #2437 - TPS UI: while adding certs for users from TPSUI pem
    format with/without header works while pkcs7 with header is not allowed
    (edewata)
  - PKI TRAC Ticket #2440 - Optional CA signing CSR for migration (edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-8
changelog:
  - PKI TRAC Ticket #1578 - Authentication Instance Id PinDirEnrollment with authType value as SslclientAuth is not working (jmagne)
  - PKI TRAC TIcket #2414 - pki pkcs12-cert-del shows a successfully deleted message when a wrong nickname is provided (gkapoor)
  - PKI TRAC Ticket #2423 - pki_ca_signing_token when not specified does not fallback to pki_token_name value (edewata)
  - PKI TRAC Ticket #2436 - Dogtag 10.3.6: Miscellaneous Enhancements (akasurde) - ticket remains open
  - PKI TRAC Ticket #2439 - Outdated deployment descriptors in upgraded server(edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-9
changelog:
  - PKI TRAC Ticket #1638 - Lightweight CAs: revoke certificate on CA deletion
    (ftweedal)
  - PKI TRAC Ticket #2436 - Dogtag 10.3.6: Miscellaneous Enhancements
    (edewata)
  - PKI TRAC Ticket #2443 - Prevent deletion of host CA's keys if LWCA entry
    deleted (ftweedal)
  - PKI TRAC Ticket #2444 - Authority entry without entryUSN is skipped even if
    USN plugin enabled (ftweedal)
  - PKI TRAC Ticket #2446 - pkispawn: make subject_dn defaults unique per
    instance name (for shared HSM) (cfu)
  - PKI TRAC Ticket #2447 - CertRequestInfo has incorrect URLs (vakwetu)
  - PKI TRAC Ticket #2449 - Unable to create system certificates in different
    tokens (edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-10
changelog:
  - Revert Patch:  PKI TRAC Ticket #2449 - Unable to create system certificates
    in different tokens (edewata)
  - Removes from Errata:  rhbz #1372041 - Unable to create system certificates
    in different tokens


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-35
changelog:
  - Resolves: rhbz#1250135 - Detect re-established trusts in the IPA
                             subdomain code


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-36
changelog:
  - Resolves: rhbz#1266107 - AD: Conditional jump or move depends on
                             uninitialised value


author: Jindrich Novy <jnovy@redhat.com> 4.8.6-2
changelog:
  - sanitize of MC_EXT_SELECTED variable when viewing
    multiple files, CVE-2012-4463 (#862814)
    https://www.midnight-commander.org/ticket/2913


author: Jindrich Novy <jnovy@redhat.com> 4.8.7-3
changelog:
  - attempt to fix segfault while passing messages to widgets (#907045, #912033)
  - fix possible segfault when freeing a VFS (#923415)


author: Jan Grulich <jgrulich@redhat.com> - 6:4.14.8-6
changelog:
  - KAuth: verify that whoever is calling us is actually who he says he is (CVE-2017-8422)
    Resolves: CVE-2017-8422


author: Joe Orton <jorton@redhat.com> - 3.4-3
changelog:
  - use a NULL c->sbh pointer with httpd 2.4 (possible fix for #867276)
  - add logging for unexpected daemon process loss


author: Jan Kaluza <jkaluza@redhat.com> - 3.4-7
changelog:
  - compile with -fno-strict-aliasing to workaround Python
    bug http://www.python.org/dev/peps/pep-3123/


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-2
changelog:
  - Release 1.3.5.10-2
  - Resolves: bug 1353714 - If a cipher is disabled do not attempt to look it up (DS 48743)
  - Resolves: bug 1353592 - Setup-ds.pl --update fails - regression (DS 48755)
  - Resolves: bug 1353544 - db2bak.pl task enters infinitive loop when bak fs is almost full (DS 48914)
  - Resolves: bug 1354374 - Upgrade to 389-ds-base >= 1.3.5.5 doesn't install 389-ds-base-snmp (DS 48918)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-4
changelog:
  - Release 1.3.5.10-4
  - Resolves: bug 1209128 - [RFE] Add a utility to get the status of Directory Server instances (DS 48144)
  - Resolves: bug 1333184 - (389-ds-base-1.3.5) Fixing coverity issues. (DS 48919)
  - Resolves: bug 1350799 - CVE-2016-4992 389-ds-base: Information disclosure via repeat
  - Resolves: bug 1354660 - flow control in replication also blocks receiving results (DS 48767)
  - Resolves: bug 1356261 - Fixup tombstone task needs to set proper flag when updating (DS 48924)
  - Resolves: bug 1355760 - ns-slapd crashes during the deletion of backend (DS 48922)
  - Resolves: bug 1353629 - DS shuts down automatically if dnaThreshold is set to 0 in a MMR setup (DS 48916)
  - Resolves: bug 1355879 - nunc-stans: ns-slapd crashes during startup with SIGILL on AMD Opteron 280 (DS 48925)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-5
changelog:
  - Release 1.3.5.10-5
  - Resolves: bug 1333184 - (389-ds-base-1.3.5) Fixing coverity issues. (DS 48919)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-6
changelog:
  - Release 1.3.5.10-6
  - Resolves: bug 1326077 - Page result search should return empty cookie if there is no returned entry (DS 48928)
  - Resolves: bug 1360447 - nsslapd-workingdir is empty when ns-slapd is started by systemd (DS 48939)
  - Resolves: bug 1360327 - remove-ds.pl deletes an instance even if wrong prefix was specified (DS 48934)
  - Resolves: bug 1349815 - DS logs have warning:ancestorid not indexed for all CS subsystems (DS 48940)
  - Resolves: bug 1329061 - 389-ds-base-1.3.4.0-29.el7_2 "hang" (DS 48882)
  - Resolves: bug 1360976 - EMBARGOED CVE-2016-5405 389-ds-base: Password verification vulnerable to timing attack
  - Resolves: bug 1361134 - When fine-grained policy is applied, a sub-tree has a priority over a user while changing password (DS 48943) 
  - Resolves: bug 1361321 - Duplicate collation entries (DS 48936)
  - Resolves: bug 1316580 - dirsrv service doesn't ask for pin when pin.txt is missing (DS 48450)
  - Resolves: bug 1350799 - CVE-2016-4992 389-ds-base: Information disclosure via repeat


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-7
changelog:
  - Release 1.3.5.10-7
  - Resolves: bug 1316580 - dirsrv service doesn't ask for pin when pin.txt is missing (DS 48450)
  - Resolves: bug 1360976 - fixing a compiler warning


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-8
changelog:
  - Release 1.3.5.10-8
  - Resolves: bug 1321124 - Replication changelog can incorrectly skip over updates (DS 48954)
  - Resolves: bug 1364190 - Change example in /etc/sysconfig/dirsrv to use tcmalloc (DS 48950)
  - Resolves: bug 1366561 - ns-accountstatus.pl giving error even "No such object (32)" (DS 48956)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-9
changelog:
  - Release 1.3.5.10-9
  - Resolves: bug 1364190 - Change example in /etc/sysconfig/dirsrv to use tcmalloc (DS 48950)
  - Resolves: bug 1366828 - audit on failure doesn't work if attribute nsslapd-auditlog-logging-enabled is NOT enabled (DS 48958)
  - Resolves: bug 1368520 - Crash in import_wait_for_space_in_fifo() (DS 48960)
  - Resolves: bug 1368956 - man page of ns-accountstatus.pl shows redundant entries for -p port option
  - Resolves: bug 1369537 - passwordMinAge attribute doesn't limit the minimum age of the password (DS 48967)
  - Resolves: bug 1369570 - cleanallruv changelog cleaning incorrectly impacts all backends (DS 48964)
  - Resolves: bug 1369425 - ACI behaves erratically (DS 48972)
  - Resolves: bug 1370300 - set proper update status to replication agreement in case of failure (DS 48957)
  - Resolves: bug 1209094 - Allow logging of rejected changes (DS 48969)
  - Resolves: bug 1371283 - Server Side Sorting crashes the server. (DS 48970)
  - Resolves: bug 1371284 - Disabling CLEAR password storage scheme will crash server when setting a password (DS 48975)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-10
changelog:
  - Release 1.3.5.10-10
  - Resolves: bug 1370300 - set proper update status to replication agreement in case of failure (DS 48957)
  - Resolves: bug 1209094 - Allow logging of rejected changes (DS 48969)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-11
changelog:
  - Release 1.3.5.10-11
  - Resolves: bug 1321124 - Replication changelog can incorrectly skip over updates


author: Zdenek Dohnal <zdohnal@redhat.com> - 12:4.2.5-44
changelog:
  - 1269596 - dhclient-script doesn't keep old nameservers
  - 1193586 - DHCP renewal does not update lifetimes if MTU has changed
  - 1306608 - Add ignore-client-uids option to dhcpd
  - 1267489 - dhclient-script does not respect DEFROUTE/GATEWAYDEV


author: Omair Majid <omajid@redhat.com> - 1:1.8.0.20-10.b26
changelog:
  - Remove LIBDIR and funny definition of _libdir.
  - Fix rpmlint warnings about macros in comments.
  - Resolves: rhbz#1125260


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.25-3.b17
changelog:
  - added patch12,removeSunEcProvider-RH1154143
  - xdump excluded from ppc64le (rh1156151)
  - Add check for src.zip completeness. See RH1130490 (by sgehwolf@redhat.com)
  - Resolves: rhbz#1125260


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 20-15.el7_4.2
changelog:
  - libkmod-elf: resolve CRC if module is built with MODULE_REL_CRCS.
  - weak-modules: process only weak-updates related depmod output.
    Resolves: rhbz#1482385


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 20-15.el7_4.3
changelog:
  - weak-modules: implement dry run by symlink restoration.
  - weak-modules: fix dry-run for non-lib-modules installation.
    Resolves: rhbz#1489696.


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 20-15.el7_4.5
changelog:
  - weak-modules: use function to generate weak_updates_dir
  - weak-modules: implement dry-run on the tempdir
    Resolves: rhbz#1511943.


author: Nalin Dahyabhai <nalin@redhat.com> - 1.11.3-40
changelog:
  - pull in fix from master to make reporting of errors encountered by
    the SPNEGO mechanism work better (RT#7045, part of #1043962)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.11.3-42
changelog:
  - add proposed patch to fix the GSSAPI library's checks for expired
    client creds in gss_init_sec_context() so that they work with keyring
    caches (RT#7820, #1030607)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.11.3-44
changelog:
  - pull in and backport multiple changes to allow replay caches to be added to
    a GSS credential store as "rcache"-type credentials (RT#7818/#7819/#7836,


author: Nalin Dahyabhai <nalin@redhat.com> - 1.11.3-46
changelog:
  - pull in patch from master to move the default directory which the KDC uses
    when computing the socket path for a local OTP daemon from the database
    directory (/var/kerberos/krb5kdc) to the newly-added run directory
    (/run/krb5kdc), in line with what we're expecting in 1.13 (RT#7859, more
    of #1040056 as #1063905)
  - add a tmpfiles.d configuration file to have /run/krb5kdc created at
    boot-time
  - own /var/run/krb5kdc


author: Nalin Dahyabhai <nalin@redhat.com> - 1.11.3-47
changelog:
  - spnego: pull in patch from master to restore preserving the OID of the
    mechanism the initiator requested when we have multiple OIDs for the same
    mechanism, so that we reply using the same mechanism OID and the initiator
    doesn't get confused (#1066002, RT#7858)


author: Nathaniel McCallum <npmccallum@redhat.com> - 1.11.3-48
changelog:
  - add Nathaniel's backported fix for to make password changes work properly
    when performed while obtaining creds over FAST (RT#7868, #1072579)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.11.3-49
changelog:
  - mark the pkinit module "nodelete" so that applications which cause it
    to be loaded and unloaded repeatedly don't suffer from memory loss when
    libcrypto is initialized, allocating memory in the process, and then
    unloaded along with the module (most of #1063732)
  - when copying creds from one ccache to another, if we single out one
    server for which creds shouldn't be copied, don't leak the memory
    that those creds use (a bit more of #1063732)
  - fix an uninitialized variable warning that could, rarely, cause a
    service-unavailable error to be reported when a server was merely
    unreachable (spotted while chasing #1063732)
  - don't leak the per-request context allocated by preauth modules (a
    bit more of #1063732)


author: Jakub Jelen <jjelen@redhat.com> 6.6.1p1-17 + 0.9.3-9
changelog:
  - Security fixes released with openssh-6.9 (CVE-2015-5352) (#1247864)
   - XSECURITY restrictions bypass under certain conditions in ssh(1) (#1238231)
   - weakness of agent locking (ssh-add -x) to password guessing (#1238238)


author: Jakub Jelen <jjelen@redhat.com> 6.6.1p1-20 + 0.9.3-9
changelog:
  - Fix vulnerabilities published with openssh-7.0 (#1265807)
   - Privilege separation weakness related to PAM support
   - Use-after-free bug related to PAM support


author: Jakub Jelen <jjelen@redhat.com> 6.6.1p1-23 + 0.9.3-9
changelog:
  - Disable undocumented feauture Roaming for good (#1298218)
  - prevents CVE-2016-0777 and CVE-2016-0778


author: Rex Dieter <rdieter@fedoraproject.org> 0.99.0-3
changelog:
  - patch to bring polkit auth dialog to front
  - patch restart polkit-kde on crash 
  - patch to remove unimplimented 'remember authorization' checkbox


author: Petr Pisar <ppisar@redhat.com> - 0.9.9-10
changelog:
  - Fix CVE-2014-6051 (integer overflow in screen size handling) (bug #1157671)
  - Fix CVE-2014-6052 (NULL pointer dereference in framebuffer setup)
    (bug #1157671)
  - Fix CVE-2014-6053 (NULL pointer dereference in ClientCutText message
    handling) (bug #1157671)
  - Fix CVE-2014-6054 (server divide-by-zero in scaling factor handling)
    (bug #1157671)
  - Fix CVE-2014-6055 (server stacked-based buffer overflow in file transfer
    handling) (bug #1157671)


author: Petr Pisar <ppisar@redhat.com> - 0.9.9-11
changelog:
  - Fix a crash in the VNC server library on connecting an IPv4 client if the
    server could not start listening on an IPv6 socket (bug #1314814)


author: John Dennis <jdennis@redhat.com> - 0.10.0-1
changelog:
  - Rebase to upstream 0.10.0 release
  - Apply upstream commits post 0.10.0 release
  - Apply ECP pending patches
  - Resolves: #1205345


author: John Dennis <jdennis@redhat.com> - 0.10.0-2
changelog:
  - Rebase to upstream 0.10.0 release
  - Apply upstream commits post 0.10.0 release
  - Apply revised ECP pending patches
  - Resolves: #1205345


author: John Dennis <jdennis@redhat.com> - 0.10.0-3
changelog:
  - Rebase to upstream 0.10.0 release
  - Apply upstream commits post 0.10.0 release
  - Apply revised ECP pending patches,
    fix patch to pickup change in configure script that causes
    HAVE_ECP to be defined
  - Resolves: #1205345


author: John Dennis <jdennis@redhat.com> - 0.11.0-1
changelog:
  - Upgrade to upstream 0.11.0 release.
  - Includes ECP support, see NEWS for all changes.
  - Update mellon_create_metadata.sh to match internally generated metadata,
    includes AssertionConsumerService for postResponse, artifactResponse &
    paosResponse.
  - Add lasso 2.5.0 version dependency
  - Resolves: #1205345


author: John Dennis <jdennis@redhat.com> - 0.11.0-2
changelog:
  - Resolves: bug #1296286
    mod_auth_mellon emits CRITICAL warning message in Apache log when doing ECP
  - Resolves: bug #1324536
    Installing mod_auth_mellon causes working Kerberos authentication
    to start failing
  - Add ECP.rst documentation file that was erroneously omitted


author: John Dennis <jdennis@redhat.com> - 0.11.0-4
changelog:
  - Resolves: rhbz#1414021 - Incorrect Content-Type header in ECP PAOS
    Rebuilding due to missing comment in Changelog


author: John Dennis <jdennis@redhat.com> - 0.13.1-1
changelog:
  - Resolves: rhbz#1481332 Upgrade to current upstream 0.13.1
  - Adds the following upstream bug fixes on top of 0.13.1:
    * ee97812 Add Mellon User Guide
    * daa5d1e If no IdP's are defined explicitly log that fact
    * c291232 Make MellonUser case-insensitive.
    * 2c2e19d Fix incorrect error check for many `lasso_*`-functions.
    * 5c5ed1d Fix segmentation fault with POST field without a value.
    * 4c924d9 Fix some log message typos
    * 93faba4 Update log msg for Invalid Destination and Invalid Audience to
      show both the expected and received values.
  - Add new mellon user guide to installed docdir


author: John Dennis <jdennis@redhat.com> - 0.13.1-2
changelog:
  - Resolves: rhbz#1553854 Add diagnostic logging
  - Add MellonSignatureMethod config option to set signature method used
    to sign SAML messages sent by Mellon. Defaults to original sha1.


author: John Dennis <jdennis@redhat.com> - 0.13.1-3
changelog:
  - Resolves: rhbz#1553854 Add diagnostic logging
  - Add README.redhat.rst doc, explains how to enable diagnostic logging


author: Frantisek Hrbata <fhrbata@hrbata.com> [4.14.0-49.1.1.el7a]
changelog:
  - [watchdog] sbsa: use 32-bit read for WCV (Robert Richter) [1564025 1553237]
  - [nvme] nvme-pci: Fix EEH failure on ppc (David Milburn) [1563570 1554747]
  - [nvme] nvme-pci: Fix queue double allocations (David Milburn) [1561916 1555296]
  - [powerpc] mm: Fixup tlbie vs store ordering issue on POWER9 (Mauricio Oliveira) [1561915 1559636]
  - [powerpc] mm/radix: Move the functions that does the actual tlbie closer (Mauricio Oliveira) [1561915 1559636]
  - [powerpc] mm/radix: Remove unused code (Mauricio Oliveira) [1561915 1559636]
  - [powerpc] powernv: Fix kexec crashes caused by tlbie tracing (Mauricio Oliveira) [1561915 1559636]
  - [powerpc] 64s/radix: Optimize TLB range flush barriers (Mauricio Oliveira) [1561915 1559636]
  - [powerpc] npu-dma.c: Fix crash after __mmu_notifier_register failure (Mauricio Oliveira) [1561915 1559636]
  - [powerpc] powernv/npu: Fix deadlock in mmio_invalidate() (Mauricio Oliveira) [1561915 1559636]
  - [powerpc] mm: Workaround Nest MMU bug with TLB invalidations (Mauricio Oliveira) [1561915 1559636]
  - [powerpc] mm: Add tracking of the number of coprocessors using a context (Mauricio Oliveira) [1561915 1559636]
  - [powerpc] powernv/npu: Don't explicitly flush nmmu tlb (Mauricio Oliveira) [1561915 1559636]
  - [powerpc] powernv/npu: Use flush_all_mm() instead of flush_tlb_mm() (Mauricio Oliveira) [1561915 1559636]
  - [powerpc] kvm: ppc: book3s hv: Fix duplication of host SLB entries (Gustavo Duarte) [1561914 1559812]
  - [powerpc] 64s: Fix lost pending interrupt due to race causing lost update to irq_happened (Steve Best) [1561913 1558661]
  - [redhat] fix NVMe hotplug failure on some platforms (Steve Ulrich) [1561464 1557004]
  - [powerpc] powerpc/powernv: Support firmware disable of RFI flush (Mauricio Oliveira) [1561463 1554920]
  - [powerpc] powerpc/pseries: Support firmware disable of RFI flush (Mauricio Oliveira) [1561463 1554920]
  - [powerpc] cxl: read PHB indications from the device tree (Steve Best) [1560901 1563111 1558675 1553205]
  - [powerpc] powerpc/powernv: Enable tunneled operations (Steve Best) [1560901 1563111 1558675 1553205]
  - [misc] cxl: Fix timebase synchronization status on P9 (Steve Best) [1560901 1558675]
  - [powerpc] Fix DABR match on hash based systems (Steve Best) [1560900 1552080]
  - [powerpc] KVM: PPC: Book3S HV: Fix handling of large pages in radix page fault handler (Laurent Vivier) [1560899 1549933]
  - [powerpc] powerpc/64s: Fix NULL AT_BASE_PLATFORM when using DT CPU features (Steve Best) [1560897 1555236]
  - [powerpc] KVM: PPC: Book3S HV: Fix VRMA initialization with 2MB or 1GB memory backing (Laurent Vivier) [1559874 1552768]
  - [s390] KVM: s390: take care of clock-comparator sign control (Thomas Huth) [1559871 1555263]
  - [s390] KVM: s390: consider epoch index on hotplugged CPUs (Thomas Huth) [1559871 1555263]
  - [s390] KVM: s390: consider epoch index on TOD clock syncs (Thomas Huth) [1559871 1555263]
  - [s390] KVM: s390: provide only a single function for setting the tod (fix SCK) (Thomas Huth) [1559871 1555263]
  - [powerpc] KVM: PPC: Book3S HV: Fix trap number return from __kvmppc_vcore_entry (Laurent Vivier) [1559870 1555068]
  - [fs] NFS: Fix unstable write completion (Scott Mayhew) [1559869 1552471]
  - [redhat] hardcode .el7a dist tag (Frantisek Hrbata)


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.247-17
changelog:
  - Heap overflow in floating point parsing (CVE-2013-4164).
    * ruby-2.0.0-p353-CVE-2013-4164-ignore-too-long-fraction-part.patch
    - Resolves: rhbz#1033503
  - Allow MD5 in OpenSSL tests.


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.247-18
changelog:
  - Fix FTBFS due to expired certificate for IMAP test case.
  - Fix test_aes_gcm_wrong_tag random failures.
    - Resolves: rhbz#1048899


author: Josef Stribny <jstribny@redhat.com> - 2.0.0.353-22
changelog:
  - Fix FTBFS with new tzdata
    Resolves: rhbz#1144023
  - Fix FTBFS due to a support for RFC 5649 in OpenSSL
    Resolves: rhbz#1145692


author: Josef Stribny <jstribny@redhat.com> - 2.0.0.353-23
changelog:
  - Add missing patch for new tzdata
    Related: rhbz#1144023
  - Add missing patch for RFC 5649 in OpenSSL
    Related: rhbz#1145692


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.598-24
changelog:
  - Rebased to Ruby 2.0.0-p598.
    * Remove Patch19: ruby-2.0.0-p247-Make-stable-Gem-Specification.files-in-
        default-.gems.patch; subsumed
    * Remove Patch20: ruby-2.1.1-fix-test-failures-due-to-expired-certs.patch;
        subsumed
    * Remove Patch21: ruby-2.1.0-test_aes_gcm_wrong_tag-Dont-use-String
        -succ.patch; subsumed
    * Remove Patch22: ruby-2.2.0-fix-error-with-tzdata.patch; subsumed
    Resolves: rhbz#1071187
  - Incorporates fixes for CVE-2014-8080 and CVE-2015-8090.
    Resolves: rhbz#1164000
  - Fix for Proxy Realm feature.
    Resolves: rhbz#1122140
  - Fix off-by-one stack-based buffer overflow in the encodes() function
    (CVE-2014-4975).
    Related: rhbz#1164000


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.8.0-0.4.rc3
changelog:
  - Update to third Release Candidate of NetworkManager 1.8
  - device: fix regressions in assuming devices on carryover from initrd (rh #1443878)
  - device: add support for SRIOV num_vfs (rh #1398934)
  - device: leave device up when setting it as unmanaged by user (rh #1371433)
  - core: properly track manager, route manager and default route manager references (rh #1440089)
  - route: properly deal with routes with non-empty host parts (rh #1439376)
  - vpn: fix a crash on disconnect (rh #1442064)
  - cli: fix hang on connection down (rh #1422786)
  - cli: fix interactive edit of bond slaves (rh #1440957)
  - vpn: fix early error handling on failed activations (rh #1440077)
  - core: only persist explicit managed state in device's state file (rh #1440171)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-1
changelog:
  - Update to upstream release 1.8.0
  - device: support dummy devices (rh#1398932)
  - core: support attaching user-data to connection profiles (rh#1421429)
  - core: fix allowing FQDN in dhcp-hostname setting (rh#1443437)
  - core: fix configuring firewall while device is activating (rh#1445242)
  - core: don't block activation without carrier for IPv6 DAD (rh#1446367)
  - tui: force writing master key to ifcfg file when editing connection (rh#1425409)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-2
changelog:
  - core: fix persisting managed state of device (rh #1440171)
  - proxy: fix use-after-free (rh #1450459)
  - device: don't wrongly delay startup complete waiting for carrier (rh #1450444)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-3
changelog:
  - dhcp: don't add route to DHCP4 server (rh #1448987)
  - libnm: fix NUL termination of device's description (rh #1443114)
  - libnm, core: ensure valid UTF-8 in device properties (rh #1443114)
  - core: fix device's UDI property on D-Bus (rh #1443114)
  - ifcfg-rh: omit empty next hop for routes in legacy format (rh #1452648)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.8.0-4
changelog:
  - device: update external configuration before commit (rh #1449873)
  - bluetooth: fix crash on connecting to a NAP (rh #1454385)
  - device: release removed devices from master on cleanup (rh #1448907)
  - core: activate slaves using ifindex order by default (rh #1452585)
  - nmcli: fix crash when setting 802-1x.password-raw (rh #1456362)
  - po: update translations (rh #1382625)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-5
changelog:
  - ifcfg-rh: fix writing legacy NETMASK value (rh #1445414)
  - tui: fix crash during connect (rh #1456826)
  - libnm: fix libnm rejecting VLAN ID 4095 (rh #1456911)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-6
changelog:
  - connectivity: fix periodic connectivity check (rh #1458399)
  - bond: improve option matching on daemon restart (rh #1457909)
  - device: fix touching device after external activation (rh #1457242)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-7
changelog:
  - bond: fix crash comparing mode while generating bond connection (rh #1459580)
  - connectivity: fix route penalty if WWAN and BT device using ip-ifindex (rh #1459932)
  - device: persist nm-owned in run state (rh #1376199)
  - device: fix assuming master device on restart (rh #1452062)
  - device: apply route metric penality only when the default route exists (rh #1459604)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.8.0-8
changelog:
  - cli: fix output of iface in overview output (rh#1460219)
  - ppp: unexport NMPPPManager instance on dispose (rh#1459579)
  - cli: remove spurious device names from wifi subcommands output (rh#1460527)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-9
changelog:
  - device: don't change MTU unless explicitly configured (rh #1460760)
  - core: don't remove external IPv4 addresses (rh #1459813)


author: Steve Dickson <steved@redhat.com> 1.3.0-0.18
changelog:
  - Stop gssd from silenty reaps cache (bz 1256469)
  - Remove errant echo call from spec file (bz 1257144)
  - Add more symlinks to make systemd scripts backwards compatible (bz 1159183)


author: Steve Dickson <steved@redhat.com> 1.3.0-0.21
changelog:
  - Stop gssd from flooding the KDC with TGT fetches (bz 1264999)
  - Decouple the start/stop of rpcbind with nfs-server and rpc-statd (bz 1266993)


author: Steve Dickson <steved@redhat.com> 1.3.0-0.21_2
changelog:
  - exportfs: Restore the EAI_NONAME check in host_pton() (bz 1288435)
  - gssd: Don't assume the machine account will be in uppercase (bz 1288433)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-34.3
changelog:
  - fix CVE-2010-5298 - possible use of memory after free
  - fix CVE-2014-0195 - buffer overflow via invalid DTLS fragment
  - fix CVE-2014-0198 - possible NULL pointer dereference
  - fix CVE-2014-0221 - DoS from invalid DTLS handshake packet
  - fix CVE-2014-0224 - SSL/TLS MITM vulnerability
  - fix CVE-2014-3470 - client-side DoS when using anonymous ECDH


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-35
changelog:
  - fix CVE-2014-3505 - doublefree in DTLS packet processing
  - fix CVE-2014-3506 - avoid memory exhaustion in DTLS
  - fix CVE-2014-3507 - avoid memory leak in DTLS
  - fix CVE-2014-3508 - fix OID handling to avoid information leak
  - fix CVE-2014-3509 - fix race condition when parsing server hello
  - fix CVE-2014-3510 - fix DoS in anonymous (EC)DH handling in DTLS
  - fix CVE-2014-3511 - disallow protocol downgrade via fragmentation


author: Jan Pokorný <jpokorny+rpm-clufter@redhat.com> - 0.70.0-2
changelog:
  - split -bin and -common packages, the former becoming the only arch-specific
  - also move python-specific (entry points, main files) back from -cli package
  - also add virtual provides for python-clufter as python2-clufter
  - bump upstream package (version rolling the above changes out)
  - build for ppc64le
    [rhbz#1402565]


author: Jan Pokorný <jpokorny+rpm-clufter@redhat.com> - 0.75.0-1
changelog:
  - move nano fallback editor dependency to -cli package [PGissue#1]
  - bump upstream package, see https://pagure.io/clufter/releases


author: Jan Pokorný <jpokorny+rpm-clufter@redhat.com> - 0.76.0-1
changelog:
  - factor "borrow validation schemas from pacemaker" out to a separate script
  - bump upstream package, see https://pagure.io/clufter/releases


author: Jan Pokorný <jpokorny+rpm-clufter@redhat.com> - 0.77.0-2
changelog:
  - fix nodelist.node.name configuration option (originaly devised by pacemaker)
    not supported in corosync.conf with the built-in validation schema
    [rhbz#1517834]


author: Fabian Arrotin <arrfab@centos.org> - 0.77.0-2
changelog:
  - Added armv3l armv4b armv4l armv4tl armv5tel armv5tejl armv6l armv7l armv7hl armv7hnl to supported arches to allow building for c7 armhfp


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-10
changelog:
  - Bump version to 1.3.6.1-10
  - Resolves: Bug 1444938 - nsslapd-allowed-sasl-mechanisms doesn't reset to default val 
  - Resolves: Bug 1111400 - logconv.pl lists sasl binds with no dn as anonymous 
  - Resolves: Bug 1377452 - Integer overflow in performance counters
  - Resolves: Bug 1441790 - ldapserch for nsslapd-errorlog-level returns incorrect values
  - Resolves: Bug 1444431 - ERR - symload_report_error - Netscape Portable Runtime error -5975
  - Resolves: Bug 1447015 - Adjust db2bak.pl help and man page to reflect changes introduced to the script


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-11
changelog:
  - Bump version to 1.3.6.1-11
  - Resolves: Bug 1410207 - Utility command had better use INFO log level for the output
  - Resolves: Bug 1049190 - Better input argument validation and error messages for db2index and db2index.pl


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-13
changelog:
  - Bump version to 1.3.6.1-13
  - Resolves: Bug 1444938 - Fix backport issue from build 1.3.6.1-10 (part 2)


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-14
changelog:
  - Bump version to 1.3.6.1-14
  - Resolves: Bug 1450910 - Modifying "nsslapd-cache-autosize" parameter using ldapmodify command is failing.
  - Resolves: Bug 1450893 - When nsslapd-cache-autosize is not set in dse.ldif, ldapsearch does not show the default value
  - Resolves: Bug 1449098 - ns-slapd crashes in role cache creation
  - Resolves: Bug 1441522 - AddressSanitizer: heap-use-after-free in libreplication-plugin.so
  - Resolves: Bug 1437492 - "ERR - cos-plugin - cos_cache_query_attr - cos attribute krbPwdPolicyReference failed schema check" in error log
  - Resolves: Bug 1429770 - ds-logpipe.py crashes for non-existing users
  - Resolves: Bug 1451657 - -v option is not working for db2ldif.pl


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-15
changelog:
  - Bump version to 1.3.6.1-15
  - Resolves: Bug 1429770 - ds-logpipe.py crashes for non-existing users
  - Resolves: Bug 1444938 - nsslapd-allowed-sasl-mechanisms doesn't reset to default values without a restart
  - Resolves: Bug 1450896 - Manual resetting of nsslapd-dbcachesize using ldapmodify 
  - Resolves: Bug 1357682 - RHDS fails to start with message: "Failed to delete old semaphore for stats file"
  - Resolves: Bug 1452739 - Zero value of nsslapd-cache-autosize-split makes dbcache to be equal 0


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-16
changelog:
  - Bump version to 1.3.6.1-16
  - Resolves: Bug 1444938 - nsslapd-allowed-sasl-mechanisms doesn't reset to default values without a restart
  - Resolves: Bug 1447015 - Adjust db2bak.pl help and man page to reflect changes introduced to the script
  - Resolves: Bug 1450896 - Manual resetting of nsslapd-dbcachesize using ldapmodify
  - Resolves: Bug 1454921 - Fixup memberof task throws error "memberof_fix_memberof_callback: Weird
  - Resolves: Bug 1456774 - ipa-replica server fails to upgrade


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-17
changelog:
  - Bump version to 1.3.6.1-17
  - Resolves: Bug 1476161 - replication halt - pending list first CSN not committed, pending list increasing
  - Resolves: Bug 1476162 - Change the retrochangelog default cache size


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-18
changelog:
  - Bump version to 1.3.6.1-18
  - Require srvcore 4.1.3
  - Resolves: Bug 1479757 - dse.ldif and fsync
  - Resolves: Bug 1479755 - backup fails if changelog is enabled
  - Resolves: Bug 1479756 - Locked account provides different return code if password is correct


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.19-1
changelog:
  - Bump version to 1.3.6.19-1
  - Remove old mozldap and db4 requirements
  - Resolves: Bug 1483865 - Crash while binding to a server during replication online init


author: Haïkel Guémar <hguemar@fedoraproject.org> - 1.9.8-1
changelog:
  - upstream 1.9.8
  - fix issues with f15/rawhide (RHBZ #676878)
  - drop gtk-doc dependency (RHBZ #604169)


author: Kalev Lember <kalevlember@gmail.com> - 1.10.0-1
changelog:
  - Update to 1.10.0
  - Have the -doc subpackage depend on the base package
  - Modernize the spec file
  - Really own /usr/share/devhelp directory


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-73
changelog:
  - portblock: fix tickle_tcp bug
  - nfsserver: use rpcpipefs_dir variable
  - mysql: use replication_port variable
  - oracle: inform user that monprofile must start with C## for
    container databases

    Resolves: rhbz#1337109
    Resolves: rhbz#1337615
    Resolves: rhbz#1337124
    Resolves: rhbz#1328386


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-78
changelog:
  - nfsserver: fix monitor issues causing NFS to start on
    "debug-monitor" and "resource cleanup"
  - nfsserver: remove "up to 10 tries" on start to avoid issues with
    some services taking longer to start
  - nfsserver: stop rpc-gssd to allow unmounting of "rpcpipefs_dir"

    Resolves: rhbz#1356866
    Resolves: rhbz#1126073
    Resolves: rhbz#1346733


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-81
changelog:
  - oracle: fix issue with C## in monprofile and inform user that
    monuser must start with C## as well for container databases

    Resolves: rhbz#1328386


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-82
changelog:
  - portblock: create tickle_dir if it doesn't exist
  - tomcat: use systemd if available

    Resolves: rhbz#1303037
    Resolves: rhbz#1249430


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-11
changelog:
  - avoid rereading /etc/services (#768804)
  - remove ntp-wait dependency from ntpd service (#906753)
  - add missing and remove unrecognized options in documentation
  - update comments in some config files


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-10
changelog:
  - Revert Patch:  PKI TRAC Ticket #2449 - Unable to create system certificates
    in different tokens (edewata)
  - Resolves:  rhbz #1374054 - ipa-replica-install fails setting up certificate
  - Restores:  rhbz #1319557 - pkispawn KRA instance is failing server
  - Removes from Errata:  rhbz #1372041 - Unable to create system certificates
    in different tokens


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-11
changelog:
  - PKI TRAC Ticket #1527 - TPS Enrollment always goes to "ca1" (cfu)
  - PKI TRAC Ticket #1664 - [BUG] Add ability to disallow TPS to enroll a single
    user on multiple tokens. (jmagne)
  - PKI TRAC Ticket #2478 - pkispawn fails as it is not able to find openssl as a
    dependency package (mharmsen)
  - PKI TRAC Ticket #2483 - Unable to read an encrypted email using renewed
    tokens (jmagne)
  - PKI TRAC Ticket #2496 - Cert/Key recovery is successful when the cert serial
    number and key id on the ldap user mismatches (cfu)
  - PKI TRAC Ticket #2505 - Fix packaging duplicates of classes in multiple jar
    files (edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-12
changelog:
  - ## RHEL 7.3.z Batch Update 1
  - Bugzilla Bug #1390318 - CA EE: Submit caUserCert request without uid does
    not show proper error message (alee)
  - Bugzilla Bug #1390319 - Failed to start pki-tomcatd Service
    ("ipa-cacert-manage renew" failed?) (edewata)
  - Bugzilla Bug #1390320 - pkispawn fails as it is not able to find openssl as
    a dependency package (mharmsen)
  - Bugzilla Bug #1390321 - two-step externally-signed CA installation fails due
    to missing AuthorityID (ftweedal)
  - Bugzilla Bug #1390322 - Spurious host authority entries created (ftweedal)
  - Bugzilla Bug #1390324 - KRA installation failed against externally-signed CA
    with partial certificate chain (edewata)
  - Bugzilla Bug #1389757 - Problems with FIPS mode (edewata)
  - Bugzilla Bug #1390311 - Fix packaging duplicates of classes in multiple jar
    files (edewata)
  - Bugzilla Bug #1390325 - Typo in comment line of UserPwdDirAuthentication.java
    (edewata)
  - ## RHCS 9.1.z Batch Update 1
  - Bugzilla Bug #1248553 - TPS Enrollment always goes to "ca1" (cfu)
  - Bugzilla Bug #1274096 -  [BUG] Add ability to disallow TPS to enroll a
    single user on multiple tokens. (jmagne)
  - Bugzilla Bug #1379379 - Unable to read an encrypted email using renewed
    tokens (jmagne)
  - Bugzilla Bug #1379749 - Automatic recovery of encryption cert is not working
    when a token is physically damaged and a temporary token is issued (jmagne)
  - Bugzilla Bug #1381375 - Cert/Key recovery is successful when the cert serial
    number and key id on the ldap user mismatches
  - Bugzilla Bug #1381635 - Token format with external reg fails when
    op.format.externalRegAddToToken.revokeCert=true (cfu)
  - Bugzilla Bug #1382762 - PIN_RESET policy is not giving expected results when
    set on a token (jmagne)
  - Bugzilla Bug #1382862 - TPS token enrollment fails to setupSecureChannel
    when TPS and TKS security db is on fips mode. (jmagne)
  - Bugzilla Bug #1386257 - Changes to target.agent.approve.list parameter is
    not reflected in the TPS Web UI (edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-13
changelog:
  - ## RHEL 7.3.z Batch Update 1
  - Bugzilla Bug #1389757 - Problems with FIPS mode (edewata)
    (added KRA key recovery via CLI in FIPS mode)
  - ## RHCS 9.1.z Batch Update 1
  - Reverted patches associated with
    Bugzilla Bug #1386257 - Changes to target.agent.approve.list parameter is
    not reflected in the TPS Web UI (edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-14
changelog:
  - Marked the following RHCS 9.1.z bug:
    Bugzilla Bug #1382862 - TPS token enrollment fails to setupSecureChannel
    when TPS and TKS security db is on fips mode. (jmagne)
    as a duplicate of RHEL 7.3.z bug:
    Bugzilla Bug #1389757 - Problems with FIPS mode (edewata)
    and moved the patch from the RHCS 9.1.z bug to the RHEL 7.3.z bug.


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-15
changelog:
  - ## RHEL 7.3.z Batch Update 2
  - Bugzilla Bug #1404173 - user-cert-add --serial CLI request to secure port
    with remote CA shows authentication failure (edewata)
  - Bugzilla Bug #1404175 -  pki ca-cert-request-submit fails presumably because
    of missing authentication even if it should not require any (edewata)
  - Bugzilla Bug #1404178 - Changes to target.agent.approve.list parameter is
    not reflected in the TPS Web UI [pki-base] (edewata)
  - Bugzilla Bug #1404172 - Unable to install subordinate CA with HSM in FIPS
    mode (edewata)
  - Bugzilla Bug #1403689 - pkispawn does not change default ecc key size from
    nistp256 when nistp384 is specified in spawn config (jmagne)
  - Bugzilla Bug #1404176 - logging properties and man pages (edewata)
  - ## RHCS 9.1.z Batch Update 2
  - Bugzilla Bug #1386257 - Changes to target.agent.approve.list parameter is
    not reflected in the TPS Web UI [pki-tps] (edewata)
  - Bugzilla Bug #1391207 - Automatic recovery of encryption cert - CA and TPS
    tokendb shows different certificate status (cfu)
  - Bugzilla Bug #1395479 -  TPS throws "err=6" when attempting to format and
    enroll G&D Cards (jmagne)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-16
changelog:
  - Separate original patches into RHEL and RHCS portions
  - ## RHEL 7.3.z Batch Update 2
  - Bugzilla Bug #1404176 - logging properties and man pages (edewata)
  - Bugzilla Bug #1405328 - TPS throws "err=6" when attempting to format and
    enroll G&D Cards (jmagne)
  - ## RHCS 9.1.z Batch Update 2
  - Bugzilla Bug #1395479 - TPS throws "err=6" when attempting to format and
    enroll G&D Cards (jmagne)
  - Bugzilla Bug #1404900 - RHCS logging properties (edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-17
changelog:
  - ## RHCS 9.1.z Batch Update 3
  - Bugzilla Bug #1391207 - Automatic recovery of encryption cert - CA and TPS
    tokendb shows different certificate status (cfu)
  - ## RHEL 7.3.z Batch Update 3
  - Bugzilla Bug #1417063 - ECDSA Certificates Generated by Certificate System
    8.1 fail NIST validation test with parameter field. (cfu)
  - Bugzilla Bug #1417064 - Unable to search certificate requests using the
    latest request ID (edewata)
  - Bugzilla Bug #1417065 - CA Certificate Issuance Date displayed on CA website
    incorrect (alee)
  - Bugzilla Bug #1417066 - update to 7.3 IPA with otpd bugfixes, tomcat will
    not finish start, hangs (ftweedal)
  - Bugzilla Bug #1417067 - pki-tomcat for 10+ minutes before generating cert
    (edewata)
  - Bugzilla Bug #1417190 - Problem with default AJP hostname in IPv6
    environment. (edewata)


author: Peter Jones <pjones@redhat.com> - 0.7-8
changelog:
  - out-of-bounds memory read flaw in DHCPv6 packet processing
    Resolves: CVE-2014-3675
  - heap-based buffer overflow flaw in IPv6 address parsing
    Resolves: CVE-2014-3676
  - memory corruption flaw when processing Machine Owner Keys (MOKs)
    Resolves: CVE-2014-3677


author: Nalin Dahyabhai <nalin@redhat.com> 0.75.14-1
changelog:
  - make pathname canonicalization slightly smarter, to handle ".." in
    locations (#1131758)
  - updates to self-tests (#1144082)


author: Jan Cholasta <jcholast@redhat.com> - 0.75.14-2
changelog:
  - backport dogtag-submit: accept additional options to pass to the server when
    approving requests using agent creds (#1165155)


author: Jan Cholasta <jcholast@redhat.com> - 0.75.14-3
changelog:
  - backport change from git to correctly retrieve string values from DBus
    property interface replies (#1181022)


author: Jan Cholasta <jcholast@redhat.com> - 0.78.1-1
changelog:
  - Resolves: #1140241 RFE: Add SCEP support to certmonger
  - Resolves: #1148001 ipa-getcert killed by SIGABRT
  - Resolves: #1205756 Rebase certmonger to 0.77 or later
    - Update to upstream 0.78.1


author: Jan Cholasta <jcholast@redhat.com> - 0.78.3-1
changelog:
  - Resolves: #1244914 scep ca helper does not parse command line options
    correctly
  - Related:  #1205756 Rebase certmonger to 0.77 or later
    - Update to upstream 0.78.3


author: Jan Cholasta <jcholast@redhat.com> - 0.78.4-1
changelog:
  - Resolves: #1249753 challenge password not added in csr using start-tracking
  - Resolves: #1250397 Remove certmonger rekey feature in 7.2
    - Remove rekey feature
  - Related:  #1205756 Rebase certmonger to 0.77 or later
    - Update to upstream 0.78.4


author: Jan Cholasta <jcholast@redhat.com> - 0.78.4-2
changelog:
  - Resolves: #1345755 Support for specifying IPA lightweight CA
    - Add 'issuer' request option for specifying issuer
    - Documentation: mark $CERTMONGER_CA_ISSUER as 0.79
    - Comment/whitespace fixup
    - ipa-submit: Retry without "ca" on OptionError
    - getcert: fix a potential out-of-bounds
    - Document the -X option in the ipa-submit man page
  - Resolves: #1351052 certmonger build for RHEL 7.3 failure
    - Stop assuming RSA 512 works
    - Stop assuming RSA 512 works, part two
    - Fix a flakiness in the 028-dbus test


author: Jan Cholasta <jcholast@redhat.com> - 0.78.4-3
changelog:
  - Resolves: #1367683 getcert request command fails to use Sub CA using -X
    argument
    - Fix CA option name for ipa cert-request


author: Radovan Sroka <rsroka@redhat.com> - 1.8.19p2-5
changelog:
  - RHEL 7.4 erratum
  - added doc patch about sudo lookup issue
    Resolves: rhbz#1293306
  - added test suite patch
    Resolves: rhbz#1360687
  - fixed use after free fqdn problem
    Resolves: rhbz#1360687


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.19p2-7
changelog:
  - RHEL 7.4 erratum
  - added patch to fix output truncation (in some cases) when log_output
    option is enabled
    Resolves: rhbz#1454571


author: Jakub Jelen <jjelen@redhat.com> - 1.8.19p2-8
changelog:
  - RHEL 7.4 erratum
  - Fixes CVE-2017-1000367: Privilege escalation in via improper get_process_ttyname() parsing
    Resolves: rhbz#1455402


author: Radovan Sroka <rsroka@redhat.com> - 1.8.19p2-9
changelog:
  - RHEL 7.4 erratum
  - removed patch for output truncation (1454571) which introduced regression
    Resolves: rhbz#1360687


author: Radovan Sroka <rsroka@redhat.com> 1.8.19p2-12
changelog:
  - RHEL 7.5 erratum
  - Fixed exit codes for `sudo -l -U <user>`
  - Fixed truncated output when log_output is enabled
  - Updated use_pty and IO logging manpage

    Resolves: rhbz#1458696
    Resolves: rhbz#1454571
    Resolves: rhbz#1490358

  - Fixed second pass LDAP filter expression in the sudoers ldap backend
    - inclomplete patch for rhbz#1485397


author: Radovan Sroka <rsroka@redhat.com> 1.8.19p2-13
changelog:
  - RHEL 7.5 erratum
  - Fixed sudo -l checking results whether user should be authenticated
  - Enabled LDAP filter patch
  - Fixed double free in sssd

    Resolves: rhbz#1505409
    Resolves: rhbz#1511850
    Resolves: rhbz#1518104


author: Rex Dieter <rdieter@fedoraproject.org> - 1.1.1-3
changelog:
  - python3-dbus subpkg (#892474)
  - (main) Provides: python-dbus
  - BR: python-docutils
  - .spec cosmetics
  - skip failed tests on rawhide (#913936)


author: Colin Walters <walters@redhat.com> - 1.1.1-9
changelog:
  - Move modules to libdir to avoid multilib conflicts
  - And comment out test suite, since we were not actually
    failing if it failed, but it trips up an rpmdiff check
    on the output of the suite.
  - Resolves: #1076411


author: Patsy Franklin <pfrankli@redhat.com> - 2.23.52.0.1-21.9
changelog:
  - This fixes a problem seen on powerpc64le ELFv2 when creating a
    function symbol alias with ld --defsym.  st_other needs to be copied
    from the source symbol to the alias in order to set up the local entry
    offset for the alias.


author: Patsy Franklin <pfrankli@redhat.com> - 2.23.52.0.1-22.9
changelog:
  - Reduce the size of aarch64 .debug_line; fix cfi encoding of fp registers;
    add register names to dumping of aarch64 cfi data. Patch provided by rth.
    Resolves: #1132641


author: Jeff Law <law@redhat.com> - 2.23.52.0.1-25.9
changelog:
  Revert this change (handled elsewhere): 
  - Additional patch from Alan to fix problems with ld --defsym.
    (#1132732)


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-112
changelog:
  - Modify 0191-RHBZ-1169168-disable-changed-paths.patch
    * man page fixup
  - Modfiy 0197-RHBZ-1394059-max-sectors-kb.patch
    * man page fixup
  - Modify 0205-RHBZ-1416569-reset-stats.patch
    * man page fixup
  - Add 0218-RHBZ-1459370-add-feature-fix.patch
    * handle null feature string
  - Add 0219-RHBZ-1448970-fix-resize.patch
    * if the resize fails, try to resume again with the old table.
  - Add 0220-RHBZ-1448223-fix-kpartx.patch
    * gracefully fail when run on something other than a file or block device
  - Add 0221-RH-harden-files.patch
    * change build parameters to use position independent code
  - Add 0222-RHBZ-1457288-fix-show-maps-json.patch
    * handle running "show maps json" with no multipath devices present
  - Add 0223-RHBZ-1452210-unpriv-sgio.patch
    * add unpriv_sgio configuration option to set unpriv_sgio on multipath device
      and paths
  - Add 0224-RHBZ-1452210-prkey.patch
    * allow setting reservation_key to "file" to set and read keys from
      prkey_file. Also add new multipathd commands to modify the prkey file.
  - Resolves: bz #1459370, #1448970, #1448223, #1457288, #1452210


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-113
changelog:
  - Modify 0224-RHBZ-1452210-prkey.patch
    * fix errow with telling multipathd to set prkeys
  - Add 0225-RH-udevdir.patch
    * fix rpmdiff complaint about udev rules installation
  - Resolves: bz #1452210


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-114
changelog:
  - Add 0226-RH-allow-overrides-section.patch
    * This is a dummy section that exists to help the transition to RHEL8
  - Add 0227-RHBZ-1465773-fix-path-delay-msg.patch
  - Add 0228-RHBZ-1464634-hauwei-config-update.patch
  - Add 0229-RHBZ-1467987-poll-on-udev-monitor.patch
    * Do poll first, so udev_monitor_receive_device doesn't return error when
      there is no uevent
  - Add 0230-UP-allow-invalid-creates.patch
    * Allow creation of devices with no valid paths.
  - Add 0231-RHBZ-1458852-delay-readying.patch
    * Add ghost_delay configuration option to delay device activation when only
      ghost paths exist.
  - Add 0232-RHBZ-1456955-property-blacklist.patch
    * Add the "property" blacklist type.
  - Resolves: bz #1456955, #1458852, #1464634, #1465773, #1467987


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-115
changelog:
  - Add 0233-RHBZ-1451852-1482629-nimble-config.patch
  - Add 0234-RHBZ-1500109-doc-typo.patch
  - Remove old triggerun scriptlet (bz1470384)
  - Resolves: bz #1451852, #1470384, #1482629, #1500109


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-116
changelog:
  - Add 0235-RHBZ-1480638-NVMe-support.patch
    * adds support for multipathing NVMe devices
  - Resolves: bz #1480638


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-117
changelog:
  - Modify 0235-RHBZ-1480638-NVMe-support.patch
    * remove overly-restrictive uevent filtering
  - Resolves: bz #1480638


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-118
changelog:
  - Modify 0224-RHBZ-1452210-prkey.patch
    * Improve error checking for mpathpersist
  - Resolves: bz #1452210


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-119.1
changelog:
  - Add 0237-RHBZ-1607749-add-transport-blacklist.patch
    * and new blacklist option, "protocol"
  - Resolves: bz #1607749


author: Akira TAGOH <tagoh@redhat.com> - 0.6.8-23
changelog:
  - the spec file cleanup
  - Fix the undefined symbol issue in libpaps.so.0
  - Correct FSF address in the COPYING.LIB


author: Miloslav Trmač <mitr@redhat.com> - 0.24-1
changelog:
  - Update to mlocate-0.24
    Resolves: #675189
  - Explicitly exclude fuse.sshfs.  Ideally we'd like to exclude all fuse.* file
    systems, sshfs is urgent because it it can hang updatedb.
    Resolves: #604145, #608094


author: Miloslav Trmač <mitr@redhat.com> - 0.26-1
changelog:
  - Update to mlocate-0.26
  - Drop no longer necessary %clean and %defattr commands.
  - Enable hardened build
    Resolves: #853189


author: Miloslav Trmač <mitr@redhat.com> - 0.26-3
changelog:
  - Update cron packaging for https://fedoraproject.org/wiki/Packaging:CronFiles
    Notably, the cron script (previously not %config) was renamed.


author: Frantisek Hrbata <fhrbata@hrbata.com> [4.14.0-49.11.1.el7a]
changelog:
  - [powerpc] powernv: Fix concurrency issue with npu->mmio_atsd_usage (Desnes Augusto Nunes do Rosario) [1614292 1611676]


author: Frantisek Hrbata <fhrbata@hrbata.com> [4.14.0-49.12.1.el7a]
changelog:
  - [arm64] aarch64: support meltdown/spectre status in sysfs (Mark Salter) [1609160 1555408]
  - [kernel] x86/bugs: Expose /sys/../spec_store_bypass (Gustavo Duarte) [1602340 1597392]
  - [scsi] aacraid: Correct hba_send to include iu_type (Raghava Aditya Renukunta) [1597190 1525240]
  - [mm] oom_reaper: gather each vma to prevent leaking TLB entry (Chris von Recklinghausen) [1554356 1554355] {CVE-2017-18202}


author: Frantisek Hrbata <fhrbata@hrbata.com> [4.14.0-49.13.1.el7a]
changelog:
  - [s390] use expoline thunks in the BPF JIT (Hendrik Brueckner) [1619667 1588933]
  - [s390] extend expoline to BC instructions (Hendrik Brueckner) [1619667 1588933]
  - [s390] move spectre sysfs attribute code (Hendrik Brueckner) [1619667 1588933]
  - [s390] kernel: use expoline for indirect branches (Hendrik Brueckner) [1619667 1588933]
  - [s390] ftrace: use expoline for indirect branches (Hendrik Brueckner) [1619667 1588933]
  - [s390] lib: use expoline for indirect branches (Hendrik Brueckner) [1619667 1588933]
  - [s390] crc32-vx: use expoline for indirect branches (Hendrik Brueckner) [1619667 1588933]
  - [s390] move expoline assembler macros to a header (Hendrik Brueckner) [1619667 1588933]
  - [s390] add assembler macros for CPU alternatives (Hendrik Brueckner) [1619667 1588933]
  - [redhat] spec: add gcc with expoline support (Hendrik Brueckner) [1619667 1578285]
  - [redhat] configs: enable s390 auto expoline support (Hendrik Brueckner) [1619667 1578285]
  - [s390] correct nospec auto detection init order (Hendrik Brueckner) [1619667 1578285]
  - [s390] add sysfs attributes for spectre (Hendrik Brueckner) [1619667 1578285]
  - [s390] report spectre mitigation via syslog (Hendrik Brueckner) [1619667 1578285]
  - [s390] add automatic detection of the spectre defense (Hendrik Brueckner) [1619667 1578285]
  - [s390] move nobp parameter functions to nospec-branch.c (Hendrik Brueckner) [1619667 1578285]
  - [s390] do not bypass BPENTER for interrupt system calls (Hendrik Brueckner) [1619667 1578285]


author: Johnny Hughes <johnny@centos.org> [4.14.0-49.13.1.el7a]
changelog:
  - Rolled in CentOS certificates and signed modules with a CentOS certificate.
  - Turned off CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND and turned on CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE on aarch64
  - added git as buildrequirement to do patches (if/when required)
  - added 46 MVPP2 patches
  - set CONFIG_ARCH_MVEBU=y, CONFIG_MVPP2=m, CONFIG_MARVELL_10G_PHY=m on aarch64


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-15
changelog:
  - fix argv rewrite (#1047507)
  - fix memory leak (#1048995)
  - standard error output could get misdirected (#1048272)


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-19
changelog:
  - reading a file via command substitution did not work when any of stdin,
    stdout or stderr were closed (#1070328)


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-20
changelog:
  - fix segfault in job list code (#1084406)
  - do not resend signal on termination (#1085385)
  - fix brace expansion on/off (#1099935)
  - fix incorrect rounding of numsers 0.5 < |x| <1.0 in printf (#1070871)
  - fix parser errors related to the end of the here-document marker (#1111120)
  - ksh hangs when command substitution fills out the pipe buffer (#1077090)
  - using typeset -l with a restricted variabled caused segmentation fault (#1121960)
  - monitor mode was documented incorrectly (#1100215)
  - do not crash when unsetting running function from another one (#1100215)
  - should report an error when trying to cd into directory without execution bit (#1109893)
  - job locking mechanism did not survive compiler optimization (#1116506)


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-21
changelog:
  - include symlink for restricted shell (#1146161)
  - ksh hangs when command substitution containing pipe fills out the pipe buffer (#1138751)
  - current directory could differ from PWD (#1135573)
  - cd builtin could break IO redirection (#1133585)
  - return code from a function could be wrong (#1116507)


author: Peter Hatina <phatina@redhat.com> - 1.10.14-7
changelog:
  - Rebase some tvbuff API from upstream to 1.10.14
  - Fixes crash when tvb_length_remaining() is used
  - Related: CVE-2015-6244


author: Martin Sehnoutka <msehnout@redhat.com> - 1.10.14-12
changelog:
  - Fix wrong snaplen in man pages and help
  - Make the capture buffer bigger to prevent dropping packages


author: Benjamin Tissoires <benjamin.tissoires@redhat.com>
changelog:
  - Resolves rhbz #1253829 - fix 3 CVEs:
   - CVE-2015-5198: libvdpau incorrect check for security transition
   - CVE-2015-5199: libvdpau directory traversal in dlopen
   - CVE-2015-5200: libvdpau vulnerability in trace functionality


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-33
changelog:
  - Resolves: rhbz#1261155 - nsupdate exits on first GSSAPI error instead
                             of processing other commands


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-34
changelog:
  - Fix a Coverity warning in dyndns code
  - Resolves: rhbz#1261155 - nsupdate exits on first GSSAPI error instead
                             of processing other commands


author: David Shea <dshea@redhat.com> - 0.8.9-1
changelog:
  - backup old product id certificates before installation of new ones (jdornak)
    Resolves: rhbz#1148783


author: Josh Boyer <jwboyer@fedoraproject.org>
changelog:
  - Add patch for HID i2c from Seth Forshee (rhbz 1188439)
  - CVE-2015-0275 ext4: fallocate zero range page size > block size BUG (rhbz 1193907 1195178)


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-39
changelog:
  - Removal of the '$Date$' placeholder on the python(1) man page footer,
  which does not expand during build
  Resolves: rhbz#1268310


author: Tomas Orsava <torsava@redhat.com> - 2.7.5-45
changelog:
  - Fix for CVE-2016-0772 python: smtplib StartTLS stripping attack (rhbz#1303647)
    Raise an error when STARTTLS fails (upstream patch)
  - Fix for CVE-2016-5699 python: http protocol steam injection attack (rhbz#1303699)
    Disabled HTTP header injections in httplib (upstream patch)
  Resolves: rhbz#1346357


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-46
changelog:
  - Drop patch 221 that backported sslwrap function since it was introducing regressions
  - Refactor patch 227
  Resolves: rhbz#1331425


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-47
changelog:
  - Fix for CVE-2016-5636: possible integer overflow and heap corruption in zipimporter.get_data()
  Resolves: rhbz#1356364


author: Josef Ridky <jridky@redhat.com> - 3.3.3-18
changelog:
  - Resolves: #1286330 - set non-blocking connection
  - Resolves: #1299761 - fix amindex: invalid service
  - Resolves: #1306980 - fix problem with handling compressed files


author: Samantha N. Bueno <sbueno+anaconda@redhat.com> - 21.48.22.86-1
changelog:
  - network: don't stumble upon new Device.Statistics NM dbus iface (rvykydal)
    Resolves: rhbz#1370099


author: Samantha N. Bueno <sbueno+anaconda@redhat.com> - 21.48.22.87-1
changelog:
  - Drop T from cp command flags when copying driver disk RPMs (mkolman)
    Resolves: rhbz#1269915
  - network: set onboot correctly for vlan on bond device in ks (rvykydal)
    Related: rhbz#1234849
  - network: don't show ibft configured devices in UI (rvykydal)
    Resolves: rhbz#1309661
  - Translate press-c-to-continue correctly in TUI (mkolman)
    Resolves: rhbz#1364539
  - network: don't set empty team slave config for NM (rvykydal)
    Related: rhbz#1254929


author: Samantha N. Bueno <sbueno+anaconda@redhat.com> - 21.48.22.88-1
changelog:
  - Revert "Show network spoke in the TUI reconfig mode (mkolman)"
    Resolves: rhbz#1302165
  - Improved driver disk copying (mkolman)
    Related: rhbz#1269915
  - network: adapt to ibft plugin being enabled by default in NM (rvykydal)
    Resolves: rhbz#1371188


author: Samantha N. Bueno <sbueno+anaconda@redhat.com> - 21.48.22.89-1
changelog:
  - Default policy should not allow empty passwords (mkolman)
    Related: rhbz#1365112
    Related: rhbz#1365032
  - Add unit tests for password quality checking (mkolman)
    Related: rhbz#1365112
    Related: rhbz#1365032
  - Fix password quality checking (mkolman)
    Resolves: rhbz#1365112
    Resolves: rhbz#1365032
  - dud: fix multiple inst.dd=http:// instances stalling in dracut (rvykydal)
    Related: rhbz#1268792


author: Samantha N. Bueno <sbueno+anaconda@redhat.com> - 21.48.22.91-1
changelog:
  - Fix password length in the password policy (mkolman)
    Related: rhbz#1365112
    Related: rhbz#1365032
  - network: avoid registering GTypes from multiple threads (lkundrak)
    Resolves: rhbz#1366271
  - Fix traceback when payload have None as url (jkonecny)
    Resolves: rhbz#1371494
  - Add new Dracut test and fix another ones (jkonecny)
    Related: rhbz#1101653
  - Fix bug when we add set to list (jkonecny)
    Related: rhbz#1101653
  - Add new helper script files to build system (jkonecny)
    Related: rhbz#1101653
  - Add new helper scripts to the README-dd documentation (jkonecny)
    Related: rhbz#1101653
  - Fix driver unload is disabling network settings (jkonecny)
    Related: rhbz#1101653


author: Samantha N. Bueno <sbueno+anaconda@redhat.com> - 21.48.22.93-1
changelog:
  - Accept any non-empty password in non-strict mode (mkolman)
    Resolves: rhbz#1379323
  - Disable the potfile check on the password quality tests (mkolman)
    Related: rhbz#1365112
    Related: rhbz#1365032
  - Fix two trivial typos in the password checking code (mkolman)
    Related: rhbz#1365112
    Related: rhbz#1365032
  - Tweak lambda use in Dracut test (jkonecny)
    Related: rhbz#1101653
  - Add Dracut test for reloading mod dependencies (jkonecny)
    Related: rhbz#1101653


author: Jan Horak <jhorak@redhat.com> - 60.1.0-8
changelog:
  - Fixed homepage and bookmarks (rhbz#1606778)
  - Fixed missing file associations in RHEL6 (rhbz#1613565)


author: Jan Horak <jhorak@redhat.com> - 60.1.0-9
changelog:
  - Do not set user agent (rhbz#1608065)
  - GTK dialogs are localized now (rhbz#1619373)
  - JNLP association works again (rhbz#1607457)


author: Richard W.M. Jones <rjones@redhat.com> - 0.3.7-1
changelog:
  - Update to new upstream version 0.3.7.
  - New URL.
  - Include upstream patches since 0.3.7 was released.
  - Rebuild for OCaml 4.05.0
  - ExcludeArch s390, but build for s390x.
    resolves: rhbz#1447987


author: Matthew Harmsen <mharmsen@redhat.com> - 1.0.8-24
changelog:
  - Add '--enable-ecc' option to %configure line under %build section of
    this spec file (mharmsen)
  - Bumped version build/runtime requirements for NSPR and NSS (mharmsen)
  - [mod_nss-PK11_ListCerts_2.patch]
  - Bugzilla Bug #1022295 - PK11_ListCerts called to retrieve all user
    certificates for every server (rcritten)
  - [mod_nss-array_overrun.patch]
  - Bugzilla Bug #1022298 - overrunning array when executing nss_pcache
    (rcritten)
  - [mod_nss-clientauth.patch]
  - Bugzilla Bug #1022921 - mod_nss: FakeBasicAuth authentication bypass
    [rhel-7.0] (rcritten)
  - [mod_nss-no_shutdown_if_not_init_2.patch]
  - Bugzilla Bug #1022303 - File descriptor leak after "service httpd reload"
    or httpd doesn't reload (rrelyea)
  - [mod_nss-proxyvariables.patch]
  - Bugzilla Bug #1022309 - mod_nss insists on Required value NSSCipherSuite
    not set. (mharmsen)
  - [mod_nss-tlsv1_1.patch]
  - Bugzilla Bug #1022310 - current nss support TLS 1.1 so mod_nss should pick
    it up (mharmsen)
  - [mod_nss-sslmultiproxy_2.patch]
  - Fixes Bugzilla Bug #1021458 - [RFE] Support ability to share mod_proxy with
    other SSL providers (jorton, mharmsen, nkinder, & rcritten)


author: Joe Orton <jorton@redhat.com> - 1.0.8-26
changelog:
  - [mod_nss-SSLEngine-off.patch]
  - Bugzilla Bug #1029042 - Implicit SSLEngine for 443 port breaks mod_nss
    configuration (jorton)
  - [mod_nss-unused-filter_ctx.patch]
  - Bugzilla Bug #1029665 - Remove unused variable 'filter_ctx' (mharmsen)


author: Rob Crittenden <rcritten@redhat.com> - 1.0.8-27
changelog:
  - Resolves: CVE-2013-4566
  - Bugzilla Bug #1024536 - mod_nss: incorrect handling of NSSVerifyClient in
    directory context [rhel-7.0] (rcritten)
  - Bugzilla Bug #1030845 - mod_nss: do not use %configure in %changelog
    (mharmsen)


author: Matthew Harmsen <mharmsen@redhat.com> - 1.0.8-28
changelog:
  - Resolves: rhbz #1030276
  - [mod_nss-usecases.patch]
  - Bugzilla Bug #1030276 - mod_nss not working in FIPS mode


author: Matthew Harmsen <mharmsen@redhat.com> - 1.0.8-30
changelog:
  - Resolves: rhbz #1029360
  - Bugzilla Bug #1029360 - ambiguous/invalid ENVR in httpd-mmn Provides/Requires


author: Matthew Harmsen <mharmsen@redhat.com> - 1.0.8-31
changelog:
  - Resolves: rhbz #1029360
  - Bugzilla Bug #1029360 - ambiguous/invalid ENVR in httpd-mmn Provides/Requires
  - corrected typo on date


author: Pavel Grunt <pgrunt@redhat.com> - 5.0-1
changelog:
  - Rebase to the latest upstream release
    Resolves: rhbz#1413982
  - Rebuild with spice-gtk 0.33
    Resolves: rbhz#1431995
  - Rebuild with correct hardening flags
    Resolves: rhbz#1420780
  - Fix display id inconsistencies in debug logs
    Resolves: rhbz#1368390
  - Provide a dialog for selecting ISOs
    Resolves: rhbz#1414016
  - Always display warning messages
    Resolves: rhbz#1386630
  - Do not print password in the logs
    Resolves: rhbz#1410030
  - Update qemu+ssh URL example
    Resolves: rhbz#1377283
  - Add cli options for precise VM selection in virt-viewer
    Resolves: rhbz#1399077


author: Pavel Grunt <pgrunt@redhat.com> - 5.0-2
changelog:
  - Really enable the hardened build
    Resolves: rhzb#1420780
  - Fixup for precise VM selection
    Resolves: rhbz#1399077


author: Pavel Grunt <pgrunt@redhat.com> - 5.0-3
changelog:
  - Handle initial zoom settings for vnc
    Resolves: rhbz#1436991
  - Allow to control zoom using numpad
    Resolves: rhbz#1337575
  - Support new elements in libvirt xml
    Resolves: rhbz#1411765


author: Pavel Grunt <pgrunt@redhat.com> - 5.0-4
changelog:
  - Fix seamless migration in virt-viewer
    Resolves: rhbz#1442929
  - Make file transfer progressbar smooth again
    Resolves: rhbz#1449572
  - Update translation from internal zanata
    Resolves: rhzb#1378279


author: Eduardo Lima (Etrunko) <etrunko@redhat.com> - 5.0-8
changelog:
  - Show authentication dialog if in kiosk mode and connecting to ovirt
    Resolves: rhbz#1459808
  - Keep the remove-viewer-connect dialog window on top
    Resolves: rhbz#1459800
  - Show overwrite confirmation when saving screenshot file
    Resolves: rhbz#1455832
  - Fix REST endpoint used to load the storagedomains
    Resolves: rhb#1427467


author: Eduardo Lima (Etrunko) <etrunko@redhat.com> - 5.0-9
changelog:
  - Drop downstream specific patch reverting string change
    Related: rhbz#1481243
  - Fix scope declaration of enable_autotools macro
    Resolves: rhbz#1504132
  - Fix wrong date in previous changelog entry
    Resolves: rhbz#1504132
  - Save oVirt uri after connecting to guest
    Resolves: rhbz#1459792
  - Adjust reference to spice-gtk man page
    Resolves: rhbz#1477966


author: Eduardo Lima (Etrunko) <etrunko@redhat.com> - 5.0-10
changelog:
  - Adjust reference to spice-gtk man page for remote-viewer
    Resolves: rhbz#1477966
  - Update translations
    Resolves: rhbz#1481243


author: Tim Niemueller <tim@niemueller.de> - 5.1.4-7
changelog:
  - Add patch to from lua.org with smaller bugfixes
  - sed -i -e 's/5\.1\.3/5.1.4/g' on autotoolize patch, bug #641144


author: Tomas Mraz <tmraz@redhat.com> 1.1.0-1
changelog:
  - fix leak when throwing PWQError exception
  - added pkgconfig file
  - call the simplicity checks before the cracklib check
  - add enforce_for_root option to the PAM module
  - updated translations from Transifex


author: Tomas Mraz <tmraz@redhat.com> 1.1.1-1
changelog:
  - use rpm built-in filtering of provides (rhbz#830153)
  - remove strain debug fprintf() (rhbz#831567)


author: Tomas Mraz <tmraz@redhat.com> 1.2.0-1
changelog:
  - add maxsequence check for too long monotonic character sequence.
  - clarified alternative licensing to GPLv2+.
  - add local_users_only option to skip the pwquality checks for
    non-locals. (thanks to Stef Walter)


author: Tomas Mraz <tmraz@redhat.com> 1.2.1-1
changelog:
  - properly free pwquality settings
  - add extern "C" to public header
  - updated translations from Transifex


author: Tomas Mraz <tmraz@redhat.com> 1.2.2-1
changelog:
  - manual page fixes
  - make it possible to set the maxsequence configuration value
  - updated translations from Transifex


author: Tomáš Mráz <tmraz@redhat.com> 1.2.3-1
changelog:
  - fix problem with parsing the pam_pwquality options
    patch by Vladimir Sorokin.
  - updated translations from Transifex
  - treat empty user or password as NULL
  - move the library to /usr


author: Tomáš Mráz <tmraz@redhat.com> 1.2.3-5
changelog:
  - fix brittle configuration settings (#1259633)
  - fix abort when generating large passwords on some architectures


author: Miroslav Rezanina <mrezanin@redhat.com> 2.4-2
changelog:
  - gperf-allow-customizing-trace-filename.patch [bz#1232702]
  - Resolves: bz#1232702
    (gperftools: tcmalloc debug version uses hard-coded path /tmp/google.alloc)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.4-8.el7
changelog:
  - gp-Use-initial-exec-tls-for-libunwind-s-recursion-flag.patch [bz#1339710]
  - Resolves: bz#1339710
    (initalization of 'recursive' tls variable in libunwind stack capturer occasionally triggers deadlock in ceph)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.4-8.el7
changelog:
  - Rebase to 2.6.1 [bz#1431240]
  - Removed libunwind usage [bz#1467203]
  - Resolves: bz#1431240 
    (gperftools fails to build on s390x, lacks s390x support)
  - Resolves: bz#1467203
    (Please, remove libunwind from the gperftools-libs (and 389-ds-base) requirements)


author: Petr Menšík <pemensik@redhat.com> - 1.6.6-1
changelog:
  - Rebase to 1.6.6
  - Enable RFC 8145 Trust Anchor Signaling to help the root zone get keytag statistics
  - Enable ipsecmod support


author: Jiri Pirko <jpirko@redhat.com> - 1.9-8
changelog:
  - teamd: fixed couple comments [1067851]
  - teamd: update hwaddr when changing team's macaddr [1067851]
  - redhat: fix boolean types in example 2 [1067851]


author: Jiri Pirko <jpirko@redhat.com> - 1.9-13
changelog:
  - teamdctl: add command for easy port presention checking [1081214]
  - initscripts: do not try to re-add port if it is already there [1081214]


author: Jiri Pirko <jpirko@redhat.com> - 1.9-14
changelog:
  - teamd_link_watch: allow to send ARP probes if no source_host is specified [1078993]
  - bond2team: do not guess source_host option [1079059]
  - teamd_link_watch: specify "missed_max" option default value [1079059]
  - man: correct type of "*_host" options [1078993]


author: Ondrej Holy <oholy@redhat.com> - 1.30.3-1
changelog:
  - Update to 1.30.3
  - Disable nfs support (#1387270)
  - Revert desktop database scriplets
  - Resolves: #1386993, #1399343, #1306146, #1259746, #1344317


author: Dan Horák <dan@danny.cz> - 1.37-5
changelog:
  - fix various man pages (#948463)
  - add man page for the rescan-scsi-bus.sh script (#948463)
  - Resolves: #948463


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 0.17-37
changelog:
  - Improve message with response directions to reflect new option
    for user names with dot character


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 0.17-42
changelog:
  - Add systemd support (thanks to Zbigniew Jędrzejewski-Szmek and Jóhann B. Guðmundsson)
    Resolves: #737219


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-18
changelog:
  - ## RHEL 7.3.z Batch Update 4
  - Bugzilla Bug #1429492 - Add profile component that copies CN to SAN
    (ftweedal)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-19
changelog:
  - ## RHEL 7.3.z Batch Update 6
  - Bugzilla Bug #1447095 - RHCS 9.1 RC5 CA in the certificate profiles the
    startTime parameter is not working as expected. (jmagne)


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-4
changelog:
  - Fix race condition
  - Resolves: Bug 1094468 - 389-ds-base server reported crash in stan_GetCERTCertificate
  - under the replication replay failure condition


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-5
changelog:
  - Reverse the sense of a test in patch to fix pk12util segfault
  - Resolves: Bug 1174527 - Segfault in pk12util when using -l option with certain .p12 files


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-1
changelog:
  - Resolves: Bug 1211371 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL7.1]
  - Fix shell syntax error on nss/tests/all.sh
  - Replace expired PayPal test certificate that breaks the build


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-2
changelog:
  - Update and reenable nss-646045.patch on account of the rebase
  - Resolves: Bug 1211371 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL7.1]


author: Jakub Hrozek <jhrozek@redhat.com> - 2.1.8-1
changelog:
  - Rebase to libtalloc 2.1.8
  - Resolves: rhbz#1393811 - Rebase libtalloc to enable samba rebase to
                             version 4.6.x


author: Jakub Hrozek <jhrozek@redhat.com> - 2.1.9-1
changelog:
  - Rebase to libtalloc 2.1.9
  - Resolves: rhbz#1393811 - Rebase libtalloc to enable samba rebase to
                             version 4.6.x


author: Jakub Hrozek <jhrozek@redhat.com> - 2.1.10-1
changelog:
  - Rebase to libtalloc 2.1.10
  - Resolves: rhbz#1470053 - Rebase libtalloc to enable samba rebase to
                             version 4.7.x


author: Jozef Mlich <jmlich@redhat.com> - 9.2.5-2
changelog:
  - Resolves: #1019762 
  - additionally fixes rpmdiff filelist problem with
    /usr/share/doc/postgresql-9.2.5/html/bookindex.html.orig


author: Jozef Mlich <jmlich@redhat.com> - 9.2.6-1
changelog:
  - Resolves #1038688
  - rebase to 9.2.6 see changes at
    http://www.postgresql.org/docs/9.2/static/release-9-2-6.html


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.7-1
changelog:
  - update to 9.2.7 per release notes (#1065845)
    http://www.postgresql.org/docs/9.2/static/release-9-2-7.html


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.3.16-3
changelog:
  - Fix indCIMXmlHandler crash in IndCIMXMLHandlerInvokeMethod with Embedded Instances 
    Resolves: #957747
  - Fix sfcb creates invalid XML with embedded object inside embedded object
    Resolves: #957742


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.3.16-11
changelog:
  - Fix connection fails to openwsman with sfcbLocal frontend
    Resolves: #1047781
  - Fix multilib issue with man page and config file
    Resolves: #1067842


author: Jakub Dorňák <jdornak@redhat.com> - 1:5.5.44-3
changelog:
  - MDEV-8827 Duplicate key with auto increment
    fix innodb auto-increment handling three bugs:
      1. innobase_next_autoinc treated the case of current<offset incorrectly
      2. ha_innobase::get_auto_increment didn't recalculate current when increment changed
      3. ha_innobase::get_auto_increment didn't pass offset down to innobase_next_autoinc
    Resolves: #1300621


author: Jakub Dorňák <jdornak@redhat.com> - 1:5.5.47-1
changelog:
  - Rebase to 5.5.47
    Also fixes: CVE-2015-4792 CVE-2015-4802 CVE-2015-4815 CVE-2015-4816
    CVE-2015-4819 CVE-2015-4826 CVE-2015-4830 CVE-2015-4836 CVE-2015-4858
    CVE-2015-4861 CVE-2015-4870 CVE-2015-4879 CVE-2015-4913 CVE-2015-7744
    CVE-2016-0505 CVE-2016-0546 CVE-2016-0596 CVE-2016-0597 CVE-2016-0598
    CVE-2016-0600 CVE-2016-0606 CVE-2016-0608 CVE-2016-0609 CVE-2016-0616
    CVE-2016-2047
    Resolves: #1300621


author: Jiri Popelka <jpopelka@redhat.com> - 3.11-3
changelog:
  - remove some rh-specific bits from rh.patch as they are no longer valid (#881913)
  - remove outdated de & pt man pages
  - /usr move: use _bindir macro


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-12
changelog:
  - Release 1.3.5.10-12
  - Resolves: bug 1384785 - Replica install fails with old IPA master sometimes during replication process (DS 48992)
  - Resolves: bug 1388501 - 389-ds-base is missing runtime dependency - bind-utils (DS 48328)
  - Resolves: bug 1388581 - Replication stops working only when fips mode is set to true (DS 48909)
  - Resolves: bug 1390342 - ns-accountstatus.pl shows wrong status for accounts inactivated by Account policy plugin (DS 49014)
  - Resolves: bug 1390343 - trace args debug logging must be more restrictive (DS 49009)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-13
changelog:
  - Release 1.3.5.10-13
  - Resolves: bug 1402030 - Non tombstone entry which dn starting with "nsuniqueid=...," cannot be deleted (DS 48133)
  - Resolves: bug 1402325 - do not treat missing csn as fatal (DS 49020)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-15
changelog:
  - Release 1.3.5.10-15
  - Resolves: bug 1402325 - do not treat missing csn as fatal (DS 48964)
  - Resolves: bug 1410080 - incompatible nsEncryptionConfig object definition prevents RHEL 7->6 schema replication (DS 49074)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-16
changelog:
  - Release 1.3.5.10-16
  - Resolves: bug 1414677 - (un)register/migration/remove may fail if there is no suffix (DS 49016)
  - Resolves: bug 1414678 - deadlock on cos cache rebuild (DS 49079)
  - Resolves: bug 1414679 - Release 1.3.5 may allow expired accounts access to systems (DS 49080, DS 49082)
  - Resolves: bug 1416368 - Aborted operation can leave RUV in incorrect state (DS 49008)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-17
changelog:
  - Release 1.3.5.10-17
  - Resolves: bug 1414677 - (un)register/migration/remove may fail if there is no suffix (DS 49016)


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.5.10-19
changelog:
  - Release 1.3.5.10-19
  - Resolves: bug 1429495 - ns-slapd dies under heavy load 
  - Resolves: bug 1429498 - A filtered nsrole that specifies an empty nsrole in its nsRoleFilter will result in a segfault


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.5.10-20
changelog:
  - Bump version to 1.3.5.10-20
  - Resolves: bug 1437005 - CVE-2017-2668 389-ds-base: Remote crash via crafted LDAP messages


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.5.10-21
changelog:
  - Bump verison to 1.3.5.10-21
  - Resolves: Bug 1440654 - Possible deadlock while installing an ipa replica
  - Resolves: Bug 1445178 - Silent install localhost issue
  - Resolves: Bug 1445177 - retrocl crash at shutdown
  - Resolves: Bug 1445176 - case sensitivity in acl


author: Peter Robinson <pbrobinson@fedoraproject.org> - 0.4.7-4
changelog:
  - Add upstream patches to use js rather than xulrunner
  - Add patch to fix FTBFS on gcc 4.7
  - Cleanup spec for latest updates and remove obsolete bits


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-41
changelog:
  - mod_cache: merge r->err_headers_out into r->headers when the response
    is cached for the first time (#1264989)
  - mod_ssl: Do not send SSL warning when SNI hostname is not found as per
    RFC 6066 (#1298148)
  - mod_proxy_fcgi: Ignore body data from backend for 304 responses (#1263038)
  - fix apache user creation when apache group already exists (#1299889)
  - fix apache user creation when USERGROUPS_ENAB is set to 'no' (#1288757)
  - mod_proxy: fix slow response time for reponses with error status code
    when using ProxyErrorOverride (#1283653)
  - mod_ldap: Respect LDAPConnectionPoolTTL for authn connections (#1300149)
  - mod_ssl: use "localhost" in the dummy SSL cert for long FQDNs (#1240495)
  - rotatelogs: improve support for localtime (#1244545)
  - ab: fix read failure when targeting SSL server (#1255331)
  - mod_log_debug: fix LogMessage example in documentation (#1279465)
  - mod_authz_dbd, mod_authn_dbd, mod_session_dbd, mod_rewrite: Fix lifetime
    of DB lookup entries independently of the selected DB engine (#1287844)
  - mod_ssl: fix hardware crypto support with custom DH parms (#1291865)
  - mod_proxy_fcgi: fix SCRIPT_FILENAME when a balancer is used (#1302797)


author: Kamil Dudka <kdudka@redhat.com> 1.4.2-3
changelog:
  - Fix basic functionality of libssh2 in FIPS mode
  - Skip SELinux-related quirks on recent distros to prevent a test-suite failure


author: Kamil Dudka <kdudka@redhat.com> 1.4.2-4
changelog:
  - examples: use stderr for messages, stdout for data (upstream commit b31e35ab)
  - Update libssh2_hostkey_hash(3) man page (upstream commit fe8f3deb)


author: Paul Howarth <paul@city-fan.org> 1.4.3-1
changelog:
  - Update to 1.4.3
    - compression: add support for zlib@openssh.com
    - sftp_read: return error if a too large package arrives
    - libssh2_hostkey_hash.3: update the description of return value
    - Fixed MSVC NMakefile
    - examples: use stderr for messages, stdout for data
    - openssl: do not leak memory when handling errors
    - improved handling of disabled MD5 algorithm in OpenSSL
    - known_hosts: Fail when parsing unknown keys in known_hosts file
    - configure: gcrypt doesn't come with pkg-config support
    - session_free: wrong variable used for keeping state
    - libssh2_userauth_publickey_fromfile_ex.3: mention publickey == NULL
    - comp_method_zlib_decomp: handle Z_BUF_ERROR when inflating
  - Drop upstreamed patches


author: Wim Taymans <wtaymans@redhat.com> - 1.23.8-3
changelog:
  - Remove pointless Enhances:
  - Fix splelling mistake
  - change package name from libs-devel to devel and add Obsolete:
  - see rhbz#1394147


author: Rex Dieter <rdieter@fedoraproject.org> - 1.0.3-3
changelog:
  - IlmBase.pc: +Requires.private: gl glu
  - -devel: drop hard-coded libGL/pkgconfig deps, let rpm autodetect now


author: Dominik Perpeet <dperpeet@redhat.com> 138-3
changelog:
  - Fix issues with connections between multiple hosts
  - Fix format string type mismatch on some architectures


author: Martin Pitt <mpitt@redhat.com> 154-1
changelog:
  - Rebase to version 154, drop all patches rhbz#1470780
  - This allows ssh keys to be loaded from arbitrary directories
    rhbz#1425887


author: Martin Pitt <mpitt@redhat.com> 154-3
changelog:
  - Update source po for Japanese translations rhbz#1512923
  - Adjust build system to avoid build failure for the above


author: Colin Walters <walters@verbum.org> 0.10.23-17
changelog:
  - Hack the gtk-doc to remove plugin docs that are not shipped
  - Drop mythtv, opencv sources that are no longer buildable


author: Jan Synáček <jsynacek@redhat.com> - 2.4.39-4
changelog:
  - support TLS 1.1 and later (#1160468)
  - fix: /etc/openldap/certs directory is empty after installation (#1064251)
  - fix: Typo in script to generate /usr/libexec/openldap/generate-server-cert.sh (#1087490)
  - fix: remove correct tmp file when generating server cert (#1103101)
  - fix: slapd.ldif olcFrontend missing important/required objectclass (#1132094)


author: Jan Synáček <jsynacek@redhat.com> - 2.4.39-5
changelog:
  - add documentation reference to service file (#1087288)
  - fix: tls_reqcert try has bad behavior (#1027613)


author: Paul Wouters <pwouters@redhat.com> - 2.0.0b1-2
changelog:
  - Change install directory to /usr/lib*/pkcs11/
  - Install pkcs11 module file
  - Use official upstream tar ball
  - Create ods user to own softhsm/token files
  - Enable migration tools (for epel6 softhsm-v1 installs)
  - Require p11-kit, nss-tools, for SoftHSM PKCS #11 Module file
  - Copy pk11install.c from coolkey package which is not built on all arches
  - Enable hardened build
  - Add upstream official source url
  - Add devel package
  - Excluding i686/ppc (make check fails and we are a leave package)
  - (thanks to Petr for jumping in for the initial build while I was too busy)


author: Paul Wouters <pwouters@redhat.com> - 2.0.0b1-3
changelog:
  - Fix softhsm2-pk11install buid and post call
  - Do not use --with-objectstore-backend-db (causes issues on i686)


author: Mark Wielaard <mjw@redhat.com> - 0.170-1
changelog:
  - New upstream release. Remove upstreamed patches.
  - Sync provide_yama_scope with fedora.
  - Add elfutils-0.170-x86_64-backtrace-test-override.patch.


author: Petr Šabata <contyk@redhat.com> - 0.9.46-1
changelog:
  - 0.9.46 bump
  - 802.1Qaz fixes to enable support on not CEE DCBX-enabled hardware
  - 802.1Qbg EVB module support
  - lldpad now supports bonded interfaces


author: Brian C. Lane <bcl@redhat.com> - 21.48.22.50-1
changelog:
  - Fix a pylint problem with the ostree patch. (clumens)
    Related: rhbz#1253527
  - Update storage config after running dasdfmt. (sbueno+anaconda)
    Resolves: rhbz#1264411
  - rpmostreepayload: Forcibly unmount everything in sysroot (walters)
    Resolves: rhbz#1253527


author: Brian C. Lane <bcl@redhat.com> - 21.48.22.54-1
changelog:
  - ibft: fix setting dracut boot args for static ibft nic configuration
    (rvykydal)
    Resolves: rhbz#1267526
  - dracut: accept inst.dd=[file:]/dd.iso (wwoods)
    Resolves: rhbz#1268792
  - Fix issues with the date&time not being updated on timezone changes
    (vpodzime)
    Resolves: rhbz#1267450


author: Brian C. Lane <bcl@redhat.com> - 21.48.22.55-1
changelog:
  - network: create ifcfg files in tui if needed (rvykydal)
    Resolves: rhbz#1268155
  - Do not limit ONBOOT default setting to url and nfs installation methods
    (rvykydal)
    Resolves: rhbz#1269264


author: Karanbir Singh <kbsingh@centos.org> - 21.48.22.56-5.el7.centos
changelog:
  - Forward port existing patch
  - discard efivar patch, rolled into install class
  - setup new help text 
  - rebase install class
  - ensure productName is available in the yumpayload
  - use our own stubs for help
  - remove the hard dep for anaconda-user-help ( since its far too upstream specific )
  - Skip repo md retry if we are not online ( try at most 2 times (


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 5.1-5
changelog:
  - Fix upstream test failure in Pod-Simple-Texinfo
    Resolves: #970986
  - Fix @enumerate does not support start numbers greater than nine
    Resolves: #1134160


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-5
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release
    (RHEL)
  - Bugzilla Bug #1466066 - CC: Secure removal of secret data storage
    (jmagne)
  - Bugzilla Bug #1518096 - ExternalCA: Failures in ExternalCA when tried to
    setup with CMC signed certificates (cfu)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-6
changelog:
  - Updated jss, nuxwdog, and openssl dependencies
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release
    (RHEL)
  - Bugzilla Bug #1402280 - CA Cloning: Failed to update number range in
    few cases (ftweedal)
  - Bugzilla Bug #1428021 - CC: shared token storage and retrieval
    mechanism (cfu)
  - Bugzilla Bug #1447145 - CMC: cmc.popLinkWitnessRequired=false
    would cause error (cfu)
  - Bugzilla Bug #1498957 - pkidestroy does not work with nuxwdog
     (alee)
  - Bugzilla Bug #1520277 - PR_FILE_NOT_FOUND_ERROR during
    pkispawn (alee)
  - Bugzilla Bug #1520526 - p12 admin certificate is missing when
    certificate is signed Externally (edewata)
  - Bugzilla Bug #1523410 - Unable to have non "pkiuser" owned CA
     instance (alee)
  - Bugzilla Bug #1523443 - HAProxy rejects OCSP responses due to
    missing nextupdate field (ftweedal)
  - Bugzilla Bug #1526881 - Not able to setup CA with ECC (mharmsen)
  - Bugzilla Bug #1532759 - pkispawn seems to be leaving our passwords
    in several different files after installation completes (alee)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-7
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - # Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release
    - Bugzilla Bug #1445532 - CC: Audit Events: Update the default audit event
    set (RHEL) (edewata)
  - Bugzilla Bug #1522938 - CC: Missing faillure resumption detection and
    audit event logging at startup (jmagne)
  - Bugzilla Bug #1523410 -  Unable to have non "pkiuser" owned CA instance
    (alee)
  - Bugzilla Bug #1525306 - CC: missing CMC request and response record
    (cfu)
  - Bugzilla Bug #1532933 - Installing subsystems with external CMC
    certificates in HSM environment shows import error (edewata)
  - Bugzilla Bug #1535797 - ExternalCA: Failures when installed with hsm
    (edewata)
  - Bugzilla Bug #1539125 - restrict default cipher suite to those ciphers
    permitted in fips mode (mharmsen)
  - Bugzilla Bug #1539198 - Inconsistent CERT_REQUEST_PROCESSED
    outcomes. (edewata)
  - Bugzilla Bug #1540440 - CMC: Audit Events needed for failures in
    SharedToken scenario's (cfu)
  - Bugzilla Bug #1541526 - CMC: Revocation works with an unknown
    revRequest.issuer (cfu)
  - Bugzilla Bug #1541853 - ProfileService: config values with
    backslashes have backslashes removed (ftweedal)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,
    - # Bugzilla Bug #1404075 - CC: Audit Events: Update the default audit
    - # Bugzilla Bug #1501436 - TPS CS.cfg should be reflected with the


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-8
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - # Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release
    - Bugzilla Bug #1542210 - pki console configurations that involves ldap
    passwords leave the plain text password in debug logs (jmagne)
  - Bugzilla Bug #1543242 - Regression in lightweight CA key replication
    (ftweedal)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-9
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - # Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release
    - Bugzilla Bug #1445532 - CC: Audit Events: Update the default audit event
    set (RHEL) (edewata)
  - Bugzilla Bug #1532867 - Inconsistent key ID encoding (edewata)
  - Bugzilla Bug #1540687 - CC: External OCSP Installation failure with HSM
    and FIPS (edewata)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,
    - # Bugzilla Bug #1404075 - CC: Audit Events: Update the default audit event


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-10
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1550581 - CMCAuth throws
    org.mozilla.jss.crypto.TokenException: Unable to insert certificate into
    temporary database [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1551067 - [MAN] Add --skip-configuration
    and --skip-installation into pkispawn man page. [rhel-7.5.z] (edewata)
  - Bugzilla Bug #1552241 - Make sslget aware of TLSv1_2 ciphers
    [rhel-7.5.z] (cheimes, mharmsen)
  - Bugzilla Bug #1553068 - Using a Netmask produces an odd entry
    in a certifcate [rhel-7.5.z] (ftweedal)
  - Bugzilla Bug #1554726 - Need ECC-specific Enrollment Profiles for
    standard conformance [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1554727 - Permit additional FIPS ciphers to be enabled
    by default for RSA . . . [rhel-7.5.z] (mharmsen, cfu)
  - Bugzilla Bug #1557880 - [MAN] Missing Man pages for tools
    CMCRequest, CMCResponse, CMCSharedToken [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1557883 - Console: Adding ACL from pki-console gives
    StringIndexOutOfBoundsException [rhel-7.5.z] (ftweedal)
  - Bugzilla Bug #1558919 - Not able to generate certificate request
    with ECC using pki client-cert-request [rhel-7.5.z] (akahat)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1560233 - libtps does not directly depend on libz


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-11
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1554726 - Need ECC-specific Enrollment Profiles for
    standard conformance [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1557880 - [MAN] Missing Man pages for tools
    CMCRequest, CMCResponse, CMCSharedToken [rhel-7.5.z] (cfu)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1560233 - libtps does not directly depend on libz


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-12
changelog:
  - Updated "jss" build and runtime requirements (mharmsen)
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1571582 - [MAN] Missing Man pages for tools CMCRequest,
    CMCResponse, CMCSharedToken (typos) [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1572548 - IPA install with external-CA is failing when
    FIPS mode enabled. [rhel-7.5.z] (edewata)
  - Bugzilla Bug #1574848 - servlet profileSubmitCMCSimple throws NPE
    [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1575521 - subsystem -> subsystem SSL handshake issue
    with TLS_ECDHE_RSA_* on Thales HSM [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1581134 - ECC installation for non CA subsystems needs
    improvement [rhel-7.5.z] (jmagne)
  - Bugzilla Bug #1581135 - SAN in internal SSL server certificate in
    pkispawn configuration step [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1581167 - CC: CMC profiles: Some CMC profiles have wrong
    input class_id [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1581382 - ECDSA Certificates Generated by Certificate System
    9.3 fail NIST validation test with parameter field. [rhel-7.5.z] (cfu)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-13
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1553068 - Using a Netmask produces an odd
    entry in a certifcate [rhel-7.5.z] (ftweedal)
  - Bugzilla Bug #1585945 - CMC CRMF requests result in
    InvalidKeyFormatException when signing algorithm is ECC
    [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1587826 - ExternalCA: Installation failed during
    csr generation with ecc [rhel-7.5.z] (rrelyea, gkapoor)
  - Bugzilla Bug #1588944 - Cert validation for installation with
    external CA cert [rhel-7.5.z] (edewata)
  - Bugzilla Bug #1588945 - CRMFPopClient tool - should allow
    option to do no key archival (cfu)
  - Bugzilla Bug #1589307 - CVE-2018-1080 pki-core: Mishandled
    ACL configuration in AAclAuthz.java reverses rules that allow
    and deny access [rhel-7.5.z] (ftweedal, cfu)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,


author: Herton R. Krzesinski <herton@redhat.com> [4.11.0-36.el7a]
changelog:
  - [base] driver core: platform: fix race condition with driver_override (Mark Salter) [1494199] {CVE-2017-12146}
  - [powerpc] KVM: PPC: Book3S HV: Check for updated HDSISR on P9 HDSI exception (Mauricio Oliveira) [1489479]
  - [vfio] Stall vfio_del_group_dev() for container group detach (David Gibson) [1493216]
  - [vfio] vfio/pci: Virtualize Maximum Payload Size (Auger Eric) [1483768]
  - [powerpc] powerpc/sstep: mullw should calculate a 64 bit signed result (Steve Best) [1493926]
  - [powerpc] powerpc/sstep: Fix issues with mcrf (Steve Best) [1493926]
  - [powerpc] powerpc/sstep: Fix issues with set_cr0() (Steve Best) [1493926]
  - [net] xfrm: policy: check policy direction value (Herbert Xu) [1479418] {CVE-2017-11600}
  - [net] packet: Don't write vnet header beyond end of buffer (Stefano Brivio) [1492602] {CVE-2017-14497}
  - [net] Bluetooth: Properly check L2CAP config option output buffer length (Neil Horman) [1489794] {CVE-2017-1000251}
  - [powerpc] powerpc/tm: Flush TM only if CPU has TM feature (Steve Best) [1490282]
  - [net] packet: hold bind lock when rebinding to fanout hook (Xin Long) [1490772]
  - [netdrv] vxlan: do not output confusing error message (Sabrina Dubroca) [1490811]
  - [netdrv] vxlan: correctly handle ipv6.disable module parameter (Sabrina Dubroca) [1490811]
  - [arm64] aarch64: topology: Fix CPU topology description on multi-socket platforms (Al Stone) [1461591]
  - [kernel] sched/topology: Fix memory leak in __sdt_alloc() (Lauro Ramos Venancio) [1481077]
  - [vhost] vhost_net: disable zerocopy by default (Jason Wang) [1395105]
  - [acpi] ACPICA: Dispatcher: Remove unnecessary call to debugger (Al Stone) [1488850]
  - [block] bsg-lib: fix kernel panic resulting from missing allocation of reply-buffer (Ming Lei) [1485447]
  - [block] Change argument type of scsi_req_init() (Ming Lei) [1485447]
  - [block] Make most scsi_req_init() calls implicit (Ming Lei) [1485447]
  - [block] Introduce request_queue.initialize_rq_fn() (Ming Lei) [1485447]
  - [powerpc] kernel: Initialize load_tm on task creation (Gustavo Duarte) [1481880]
  - [powerpc] kernel: Fix FP and vector register restoration (Gustavo Duarte) [1481880]
  - [netdrv] mlx4_core: Enable 4K UAR if SRIOV module parameter is not enabled (Kamal Heib) [1459983]
  - [block] blk-mq: map queues to all present CPUs (Scott Wood) [1466046]
  - [block] blk-mq: Include all present CPUs in the default queue mapping (Scott Wood) [1466046]
  - [nvme] Allocate queues for all possible CPUs (Scott Wood) [1466046]
  - [block] blk-mq: Create hctx for each present CPU (Scott Wood) [1466046]
  - [block] blk-mq: Register <dev>/queue/mq after having registered <dev>/queue (Scott Wood) [1466046]


author: Herton R. Krzesinski <herton@redhat.com> [4.11.0-37.el7a]
changelog:
  - [mm] ratelimit PFNs busy info message (Jonathan Toppins) [1496525]
  - [powerpc] powerpc/eeh: Create PHB PEs after EEH is initialized (Steve Best) [1493012]
  - [powerpc] Handle MCE on POWER9 with only DSISR bit 30 set (Steve Best) [1489480]
  - [powerpc] powerpc/powernv: Clear LPCR(PECE1) via stop-api only for deep state offline (Mauricio Oliveira) [1488412]
  - [sound] ALSA: timer: Use common error handling code in alsa_timer_init() (Jaroslav Kysela) [1466001] {CVE-2017-1000380}
  - [sound] ALSA: timer: Adjust a condition check in snd_timer_resolution() (Jaroslav Kysela) [1466001] {CVE-2017-1000380}
  - [sound] ALSA: timer: Follow standard EXPORT_SYMBOL() declarations (Jaroslav Kysela) [1466001] {CVE-2017-1000380}
  - [sound] ALSA: timer: Wrap with spinlock for queue access (Jaroslav Kysela) [1466001] {CVE-2017-1000380}
  - [sound] ALSA: timer: Improve user queue reallocation (Jaroslav Kysela) [1466001] {CVE-2017-1000380}
  - [sound] ALSA: timer: Fix missing queue indices reset at SNDRV_TIMER_IOCTL_SELECT (Jaroslav Kysela) [1466001] {CVE-2017-1000380}
  - [sound] ALSA: timer: Fix race between read and ioctl (Jaroslav Kysela) [1466001] {CVE-2017-1000380}
  - [sound] ALSA: timer: Info leak in snd_timer_user_tinterrupt() (Jaroslav Kysela) [1466001] {CVE-2017-1000380}
  - [sound] ALSA: timer: remove some dead code (Jaroslav Kysela) [1466001] {CVE-2017-1000380}
  - [crypto] scompress: defer allocation of scratch buffer to first use (Herbert Xu) [1487149]


author: Herton R. Krzesinski <herton@redhat.com> [4.11.0-38.el7a]
changelog:
  - [powerpc] powerpc/powernv: Rework EEH initialization on powernv (Steve Best) [1496734]
  - [powerpc] powerpc/eeh: Remove unnecessary config_addr from eeh_dev (Steve Best) [1496734]
  - [powerpc] powerpc/eeh: Remove unnecessary pointer to phb from eeh_dev (Steve Best) [1496734]
  - [powerpc] powerpc/eeh: Reduce to one the number of places where edev is allocated (Steve Best) [1496734]
  - [scsi] aacraid: Fix 2T+ drives on SmartIOC-2000 (Raghava Aditya Renukunta) [1496666]
  - [scsi] aacraid: Add a small delay after IOP reset (Mauricio Oliveira) [1494623]
  - [scsi] scsi_transport_iscsi: fix the issue that iscsi_if_rx doesn't parse nlmsg properly (Chris Leech) [1481997] {CVE-2017-14489}
  - [powerpc] Fix VSX enabling/flushing to also test MSR_FP and MSR_VEC (Steve Best) [1489477]
  - [powerpc] powerpc/64s: Add workaround for P9 vector CI load issue (Steve Best) [1489477]
  - [powerpc] powerpc/mce: Move 64-bit machine check code into mce.c (Steve Best) [1489477]
  - [powerpc] powerpc/book3s/mce: Move add_taint() later in virtual mode (Steve Best) [1489477]
  - [powerpc] powerpc/64s: Fix system reset vs general interrupt reentrancy (Steve Best) [1489477]
  - [scsi] scsi_transport_fc: fix NULL pointer dereference in fc_bsg_job_timeout (Ming Lei) [1495488]
  - [block] bsg-lib: don't free job in bsg_prepare_job (Ming Lei) [1495488]
  - [powerpc] powerpc/mm: Don't send IPI to all cpus on THP updates (David Gibson) [1493966]
  - [scsi] qla2xxx: Update driver version to 10.00.00.07.4a-k (Himanshu Madhani) [1490638]
  - [scsi] qla2xxx: Fix system crash while triggering FW dump (Himanshu Madhani) [1490638]
  - [scsi] Avoid that scsi_exit_rq() triggers a use-after-free (Ewan Milne) [1479753]
  - [scsi] qla2xxx: Fix an integer overflow in sysfs code ("Ewan D. Milne") [1487660] {CVE-2017-14051}


author: Herton R. Krzesinski <herton@redhat.com> [4.11.0-39.el7a]
changelog:
  - [powerpc] Fix workaround for spurious MCE on POWER9 (Steve Best) [1496591]
  - [net] netfilter: ipset: pernet ops must be unregistered last (Florian Westphal) [1495042]
  - [infiniband] IB/mlx5: Write combine mapping workaround for ThunderX2 (Vadim Lomovtsev) [1496554]
  - [pci] PCI: Avoid slot reset if bus reset is not possible (Robert Richter) [1439575]
  - [pci] PCI: Avoid bus reset for Cavium cn8xxx root ports (Robert Richter) [1439575]
  - [pci] PCI: Allow PCI_DEV_FLAGS_NO_BUS_RESET to be used on bus device (Robert Richter) [1439575]
  - [fs] ext4: fix off-by-in loop termination in ext4_find_unwritten_pgoff() (Bill O'Donnell) [1487528]
  - [fs] ext4: fix SEEK_HOLE (Bill O'Donnell) [1487528]
  - [fs] Reorder inode_owner_or_capable() to avoid needless (Bill O'Donnell) [1458832]
  - [netdrv] netdrivers: mark drivers unsupported (Jonathan Toppins) [1486939]
  - [redhat] config: re-enable bnx2 driver and mark unsupported (Jonathan Toppins) [1481788]
  - [kernel] rh_taint: add support for marking driver as unsupported (Jonathan Toppins) [1486929]


author: Herton R. Krzesinski <herton@redhat.com> [4.11.0-40.el7a]
changelog:
  - [of] drivers: of: increase MAX_RESERVED_REGIONS to 32 (Steve Best) [1494626]
  - [kernel] audit: fix memleak in auditd_send_unicast_skb (Jerome Marchand) [1479708]
  - [powerpc] KVM: PPC: Book3S: Fix server always zero from kvmppc_xive_get_xive() (Sam Bobroff) [1477391]
  - [vfio] vfio/spapr: Add cond_resched() for huge updates (Sam Bobroff) [1494122]
  - [drm] drm/vmwgfx: Make sure backup_handle is always valid (Rob Clark) [1462817] {CVE-2017-9605}
  - [drm] drm/vmwgfx: limit the number of mip levels in vmw_gb_surface_define_ioctl() (Rob Clark) [1437863] {CVE-2017-7346}
  - [net] l2tp: fix race condition in l2tp_tunnel_delete (Sabrina Dubroca) [1485209]
  - [net] l2tp: prevent creation of sessions on terminated tunnels (Sabrina Dubroca) [1485209]
  - [net] l2tp: hold tunnel used while creating sessions with netlink (Sabrina Dubroca) [1485209]
  - [net] l2tp: hold tunnel while handling genl TUNNEL_GET commands (Sabrina Dubroca) [1485209]
  - [net] l2tp: hold tunnel while handling genl tunnel updates (Sabrina Dubroca) [1485209]
  - [net] l2tp: hold tunnel while processing genl delete command (Sabrina Dubroca) [1485209]
  - [net] l2tp: hold tunnel while looking up sessions in l2tp_netlink (Sabrina Dubroca) [1485209]
  - [net] l2tp: initialise session's refcount before making it reachable (Sabrina Dubroca) [1485209]
  - [net] netfilter: ebtables: fix race condition in frame_filter_net_init() (Artem Savkov) [1497221]
  - [pci] quirks: update Cavium ThunderX ACS quirk implementation (Vadim Lomovtsev) [1479894]
  - [net] netfilter: xtables: add scheduling opportunity in get_counters (Florian Westphal) [1496169]
  - [redhat] configs: Disable buggy vmx driver on ppc (Herbert Xu) [1490972]
  - [net] ip6_tunnel: do not allow loading ip6_tunnel if ipv6 is disabled in cmdline (Xin Long) [1490799]
  - [scsi] scsi_transport_sas: select BLK_DEV_BSGLIB (Gustavo Duarte) [1488371]
  - [scsi] scsi_transport_sas: switch to bsg-lib for SMP passthrough (Gustavo Duarte) [1488371]
  - [scsi] smartpqi: remove the smp_handler stub (Gustavo Duarte) [1488371]
  - [scsi] hpsa: remove the smp_handler stub (Gustavo Duarte) [1488371]
  - [scsi] bsg-lib: pass the release callback through bsg_setup_queue (Gustavo Duarte) [1488371]
  - [net] netfilter: ipvs: do not create conn for ABORT packet in sctp_conn_schedule (Xin Long) [1479257]
  - [net] netfilter: ipvs: fix the issue that sctp_conn_schedule drops non-INIT packet (Xin Long) [1479257]
  - [net] netlink: fix an use-after-free issue for nlk groups (Xin Long) [1482463]
  - [net] ipv6: do not set sk_destruct in IPV6_ADDRFORM sockopt (Xin Long) [1483284]
  - [netdrv] i40e: use cpumask_copy instead of direct assignment (Stefano Brivio) [1483725]


author: Herton R. Krzesinski <herton@redhat.com> [4.11.0-41.el7a]
changelog:
  - [tty] amba-pl011: Fix spurious TX interrupts (Iyappan Subramanian) [1498582]
  - [mm] cma: Limit cma reserve support only to systems with >=2G RAM (Bhupesh Sharma) [1492799]
  - [arm64] kexec: Limit crash dump support only to systems with >=2G RAM (Bhupesh Sharma) [1492799]
  - [net] netfilter: nat: avoid use of nf_conn_nat extension (Florian Westphal) [1471714]
  - [net] netfilter: nat: Do not use ARRAY_SIZE() on spinlocks to fix zero div (Florian Westphal) [1471714]
  - [net] netfilter: nat: use keyed locks (Florian Westphal) [1471714]
  - [net] netfilter: nat: Revert netfilter: nat: convert nat bysrc hash to rhashtable (Florian Westphal) [1471714]
  - [net] netfilter: nat: use atomic bit op to clear the _SRC_NAT_DONE_BIT (Florian Westphal) [1471714]


author: Tomáš Mráz <tmraz@redhat.com> 1.1.8-7
changelog:
  - rename the 90-nproc.conf to 20-nproc.conf (#1071618)
  - canonicalize user name in pam_selinux (#1071010)


author: Tomáš Mráz <tmraz@redhat.com> 1.1.8-9
changelog:
  - fix CVE-2014-2583: potential path traversal issue in pam_timestamp
  - pam_pwhistory: call the helper if SELinux enabled


author: Tomáš Mráz <tmraz@redhat.com> 1.1.8-11
changelog:
  - be tolerant to corrupted opasswd file
  - audit the module names that granted access
  - pam_userdb: correct the example in man page (#1078784)
  - pam_limits: check whether the utmp login entry is valid (#1080023)
  - pam_console_apply: do not print error if console.perms.d is empty
  - pam_limits: nofile refers to open file descriptors (#1111220)
  - apply PIE and full RELRO to all binaries built


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-55
changelog:
  - Fix endianess bug in fill_id()
  - Related: rhbz#1109331 - [RFE] Allow SSSD to be used with smbd shares


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-57
changelog:
  - Run the restart in sssd-common posttrans
  - Explicitly require libwbclient
  - Resolves: rhbz#1187113 - sssd deamon was not running after RHEL 7.1 upgrade


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-58.2
changelog:
  - Resolves: rhbz#1199143 - With empty ipaselinuxusermapdefault security
                             context on client is staff_u


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-58.3
changelog:
  - Set a pointer in ldap_child to NULL to avoid warnings
  - Related: rhbz#1198759 - ccname_file_dummy is not unlinked on error


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-58.4
changelog:
  - Handle case where there is no default and no rules
  - Resolves: rhbz#1199143 - With empty ipaselinuxusermapdefault security
                             context on client is staff_u


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-58.5
changelog:
  - Resolves: rhbz#1203365 - sssd_be segfault on IPA(when auth with AD
                             trusted domain) client at
                             src/providers/ipa/ipa_s2n_exop.c:1605


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-58.6
changelog:
  - Initialize variable in the views code in one success and one failure path
  - Resolves: rhbz#1203365 - sssd_be segfault on IPA(when auth with AD
                             trusted domain) client at
                             src/providers/ipa/ipa_s2n_exop.c:1605


author: Paul Wouters <pwouters@redhat.com> - 1.4.2-8
changelog:
  - Resolves: rhbz#CVE-2015-6496
  - Fold in upstream patches since 1.4.2 release up to git 900d7e8
  - Fold in upstream patch set of 2015-08-18 for coverity issues


author: Paul Wouters <pwouters@redhat.com> - 1.4.4-3
changelog:
  - Resolves: rhbz#1425552 (explicitely Require: libnetfilter_conntrack >= 1.0.6 as it is same .so version)


author: David King <dking@redhat.com> - 0.8.4-2
changelog:
  - Sync bzip2 dependency with Fedora package
  - Make the libs subpackage depend on the base package for libostree
  - Fix multilib issues with XML-based documentation


author: Rex Dieter <rdieter@fedoraproject.org> - 6:4.10.3-2
changelog:
  - pull in a few upstream fixes, including a couple minor security issues
  - Crash in DialogShadows::Private::freeX11Pixmaps() (kde#319137)


author: Martin Briza <mbriza@redhat.com> - 4.10.5-3
changelog:
  - make kpac_dhcp_helper full relro
  - set the variables in the generated cmake files to contain both 64b and 32b paths
  - hide "command not found" for one pkg-config invocation in the spec
  - fix macro expansion in the spec changelog
  - Resolves: #884052


author: Martin Briza <mbriza@redhat.com> - 4.10.5-4
changelog:
  - use a better way to figure out if lib or lib64 should be used
  - use -fno-strict-aliasing for type punned source files
  - Resolves: #884052


author: Paul Wouters <pwouters@redhat.com> - 1.4.20-12
changelog:
  - Enable round-robin (with noths() patch)
  - Change cron and systemd service to use root.key, not root.anchor


author: Tomas Hozza <thozza@redhat.com> - 1.4.20-14
changelog:
  - remove missing unbound-rootkey.service from post/preun/postun sections
  - don't hardcode hardening flags, let hardened build macro handles it


author: Debarshi Ray <rishi@fedoraproject.org> - 3.22.2-6
changelog:
  - Adjust the LOKDocView detection to work with GJS 1.48.0
  - Suppress WARNINGs from GJS 1.50.0 by using var instead of let/const for
    exported symbols
    Resolves: #1517704


author: Debarshi Ray <rishi@fedoraproject.org> - 3.22.2-8
changelog:
  - Initialize the getting started PDF only when presenting a UI, and before any
    SPARQL has been submitted
  - Suppress WARNINGs from GJS 1.50.0 by using var instead of let/const for
    exported symbols
  - Use the standard dialect of String.prototype.replace
    Resolves: #1517770


author: Jeff Moyer <jmoyer@redhat.com> - 53.1-4
changelog:
  - Fix up duplicate "-v" documentation in man page
  - Fix bogus test in invalidate_namespace_options
  - Resolves: bz#1350404 bz#1271425


author: Jeff Moyer <jmoyer@redhat.com> - 56-1
changelog:
  - Rebase to upstream version 56
  - Default to 4k alignment for device dax
  - Resolves: bz#1384873 bz#1384642 bz#1349233 bz#1357451


author: Jeff Moyer <jmoyer@redhat.com> - 56-2
changelog:
  - Update documentation to reflect 4k alignment
  - Add support for the MSFT family of DSM functions
  - Resolves: bz#1440902 bz#1446689


author: Jeff Moyer <jmoyer@redhat.com> - 58.2-1
changelog:
  - rebase to v58.2
  - remove patches that were backported from later versions
  - we now support >4k faults, so remove rhel-only patches
  - add libpmem dependency, and gate it on x86_64
  - pull in static checker fix for uncheck sscanf result
  - fix up use of uninitialized variable
  - Related: bz#1457566 bz#1471807 bz#1456954


author: Daiki Ueno <dueno@redhat.com> - 3.36.0-0.1.beta
changelog:
  - Update to NSS 3.36 BETA
  - Remove upstreamed nss-softokn-3.16-add_encrypt_derive.patch
  - Remove upstreamed nss-softokn-3.28-fix-fips-login.patch
  - Remove upstreamed nss-softokn-fix-ecc-post.patch


author: Karel Zak <kzak@redhat.com> 2.23.2-29
changelog:
  - fix #1029385 - lack of non-ascii support
  - fix #1092520 - util-linux - PIE and RELRO check
  - fix #1153770 - backport lsipc
  - fix #1248003 - mount only parses <param>=<value> lines from fstab fs_spec field available from blkid block device
  - fix #1271850 - mount -a doesn't catch a typo in /etc/fstab and a typo in /etc/fstab can make a system not reboot properly
  - fix #1281839 - [RFE]Bind mounts should be handled gracefully by the operating system
  - fix #1290689 - util-linux: /bin/login does not retry getpwnam_r with larger buffers, leading to login failure
  - fix #1296366 - Bash completion for more(1) handles file names with spaces incorrectly
  - fix #1296521 - RHEL7: update audit event in hwclock
  - fix #1298384 - RFE: add SCHED_DEADLINE support to chrt
  - fix #1304246 - fdisk 'f' subcommand updates partition ranges wrongly
  - fix #1304426 - [rfe] /bin/su should be improved to reduce stack use
  - fix #1326615 - util-linux/lscpu: Fix model and model name on Power Systems
  - fix #1327886 - Backport blkdiscard's "-z" flag to RHEL
  - fix #1332084 - [RFE] Inclusion of lsns command in util-linux Package
  - fix #1335671 - extra quotes around UUID confuses findfs in RHEL (but not in Fedora)
  - fix #1344222 - logger port option in help is misleading
  - fix #1344482 - util-linux fails valid_pmbr() size checks if device is > 2.14TB, Device label type: dos instead of gpt
  - fix #587393 - [RFE] Make sure util-linux is ready for writable overlays


