# changelog

author: Pablo Greco <pgreco@centosproject.org>
changelog:
  - Own yum vars
  - Generate yum vars at build time
  - Remove dist_suffix
  - Fix autorelabel preset
  - Fix tuned profile in system-release-cpe
  - Set aarch64 tuned profile to server
  - Update to 7.7


author: Pablo Greco <pgreco@centosproject.org>
changelog:
  - Add rootfs-expand to aarch64
  - Create generic kvariant in aarch64 if it doesn't exist (for new kernel repos)
  - Own kvariant var in armhfp and aarch64
  - Backport move of /etc/os-release to /usr/lib/os-release (ngompa)
  - Spec file cleanup (carlwgeorge)
  - Update to 7.8


author: Ondrej Vasik <ovasik@redhat.com> - 3.2-25
changelog:
  - own /usr/share/locale and /usr/lib/modules
  - improve filesystem content file to include symlinks and rootdir


author: Carlos O'Donell <carlos@redhat.com> - 2.17-321
changelog:
  - CVE-2020-10029: Prevent stack corruption from crafted input in cosl, sinl,
    sincosl, and tanl function. (#1812119)


author: Florian Weimer <fweimer@redhat.com> - 2.17-325
changelog:
  - Support /etc/sysconfig/strcasecmp-nonascii for enabling non-ASCII case
    conversion in strcasecmp, strncasecmp (#1993930)


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 5.1-5
changelog:
  - Fix upstream test failure in Pod-Simple-Texinfo
    Resolves: #970986
  - Fix @enumerate does not support start numbers greater than nine
    Resolves: #1134160


author: Marek Polacek <polacek@redhat.com> 4.8.5-38
changelog:
  - fix mode mismatch in prepare_cmp_insn (#1641329, PR target/63442)
  - allow libitm to use HTM (#1659698)
  - fix up memset handling in DSE (#1640805, PR rtl-optimization/69891)
  - fix bits/bytes confusion in set_noop_p (#1594975, PR rtl-optimization/68814)
  - enable initializing statics with COMPOUND_LITERAL_EXPR in C99
    (#1672652, PR c/63567)
  - fix PIC_OFFSET_TABLE_REGNUM (#1614326)
  - quash spurious -Wmissing-field-initializers warnings (#1633716, PR c/60784)
  - fix ICE with alias template (#1648161, PR c++/53658)


author: Marek Polacek <polacek@redhat.com> 4.8.5-43
changelog:
  - fix wrong code emitted for movv1qi on s390x (#1784759)
  - fix wrong code with EH due to a bug in LRA (#1800526)


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-10
changelog:
  - Add missing av_permission values (#1025931)
  - Set an appropriate errno in booleans.c (#1402140)
  - Change matchpathcon usage to match with matchpathcon manpage (#1412797)


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-3
changelog:
  - Correctly detect unknown classes in sepol_string_to_security_class
  - Sort object files for deterministic linking order
  - Fix neverallowxperm checking on attributes
  - Remove libsepol.map when cleaning
  - Add high-level language line marking support to CIL
  - Change logic of bounds checking to match change in kernel
  - Fix multiple spelling errors
  - Only apply bounds checking to source types in rules
  - Fix CIL and not add an attribute as a type in the attr_type_map
  - Build policy on systems not supporting DCCP protocol
  - Fix extended permissions neverallow checking
  - Fix CIL neverallow and bounds checking
  - Android.mk: Add -D_GNU_SOURCE to common_cflags


author: Petr Lautrbach <plautrba@redhat.com> 2.5-5
changelog:
  - Warn instead of fail if permission is not resolved
  - Ignore object_r when adding userrole mappings to policydb


author: Petr Lautrbach <plautrba@redhat.com> 2.5-6
changelog:
  - Fix memory leak in expand.c
  - Fix invalid read when policy file is corrupt
  - Fix possible use of uninitialized variables


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-7
changelog:
  - Define cgroup_seclabel policy capability (rhbz#1493517)
  - Fix unitialized jmp and invalid dereference


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-8.1
changelog:
  - Define nnp_nosuid_transition policy capability (rhbz#1480519)
  - use IN6ADDR_ANY_INIT to initialize IPv6 addresses
  - Allow runtime labeling of ibendports (rhbz#1464489)
  - Allow runtime labeling of Infiniband Pkeys (rhbz#1464489)
  - Add IB end port handling to CIL (rhbz#1464489)
  - Add ibendport ocontext handling (rhbz#1464489)
  - Add support for ibendportcon labels (rhbz#1464489)
  - Add Infiniband Pkey handling to CIL (rhbz#1464489)
  - Add ibpkey ocontext handling (rhbz#1464489)
  - Add support for ibpkeycon labels (rhbz#1464489)
  - Remove unused attribute on a used argument from avrule_read() (rhbz#1464489)
  - Add binary module support for xperms
  - Add support for converting extended permissions to CIL


author: Miroslav Lichvar <mlichvar@redhat.com> 5.9-8.20130126
changelog:
  - update to 20130126
  - clear scrollback buffer in clear (#815790)
  - make -base and -term subpackages noarch
  - make some dependencies arch-specific


author: Bob Relyea <rrelyea@redhat.com> - 3.53.1-3
changelog:
  - include patches for CVE-2020-6829, CVE-2020-12400,
    and CVE-2020-12401 from upstream (ECC constant time issues).
  - include patches for CVE-2020-12403 from upstream
    (CHACHA issues).
  - include self-tests for kdfs and cmac.


author: Bob Relyea <rrelyea@redhat.com> - 3.53.1-6
changelog:
  - turn off ALTIVEC instruction for powerpc because they require
    power8 and we need to support power7 on RHEL7 still.
  - Fix typo in measure.
  - Make sure only 2048 and greater primes are used in FIPS mode
    for dh.


author: Bob Relyea <rrelyea@redhat.com> - 3.67.0-3
changelog:
  - Include softoken specific patches required by the NSS 3.67
    release including:
  -  sdb timeout fixes.
  -  coverity patch.
  -  fixing private key macing


author: Petr Pisar <ppisar@redhat.com> - 8.32-13
changelog:
  - Disable unsupported JIT mode on little-endian 64-bit PowerPC platform
    (bug #1125642)
  - Raise optimization level to 3 on little-endian 64-bit PowerPC (bug #1123498)


author: Petr Pisar <ppisar@redhat.com> - 8.32-15
changelog:
  - Fix compiling expression where start-anchored character with more than one
    other case follows circumflex in multiline UTF mode (bug #1110621)
  - Fix character class with a literal quotation (bug #1111091)
  - Fix empty-matching possessive zero-repeat groups in interpreted mode
    (bug #1119320)
  - Fix compiler crash for zero-repeated groups with a recursive back reference
    (bug #1119356)
  - Reset non-matched groups within capturing group up to forced match
    (bug #1161597)
  - Fix static linking (bug #1217111)
  - Package pcredemo.c as a documentation for pcre-devel (bug #1217118)


author: Petr Pisar <ppisar@redhat.com> - 8.32-16
changelog:
  - Fix CVE-2015-2328 (infinite recursion compiling pattern with recursive
    reference in a group with indefinite repeat) (bug #1330509)
  - Fix CVE-2015-8385 (buffer overflow caused by named forward reference to
    duplicate group number) (bug #1330509)
  - Fix CVE-2015-8386 (buffer overflow caused by lookbehind assertion)
    (bug #1330509)
  - Fix CVE-2015-3217 (stack overflow caused by mishandled group empty match)
    (bug #1330509)
  - Fix CVE-2015-5073 and CVE-2015-8388 (buffer overflow for forward reference
    within backward assertion with excess closing parenthesis) (bug #1330509)
  - Fix CVE-2015-8391 (inefficient posix character class syntax check)
    (bug #1330509)
  - Fix CVE-2016-3191 (workspace overflow for (*ACCEPT) with deeply nested
    parentheses) (bug #1330509)


author: Petr Pisar <ppisar@redhat.com> - 8.32-17
changelog:
  - Let [:graph:], [:print:], and [:punct:] POSIX classes to handle Unicode
    characters in UCP mode to match Perl behavior (bug #1400267)
  - Fix matching Unicode ranges in JIT mode (bug #1402288)


author: Ondrej Vasik <ovasik@redhat.com> - 2.8.71-3
changelog:
  - add more securetty required for mainframes (#1067347)
  - set SHELL envvar to /bin/bash in bashrc (#1063552)


author: Ondrej Vasik <ovasik@redhat.com> - 2.8.71-5
changelog:
  - reserve uidgid pair 142:142 for activemq (#1086923)
  - add xfs to /etc/filesystems, fallback to /proc/filesystems
    (#1123832)


author: Ondrej Vasik <ovasik@redhat.com> - 2.8.71-6
changelog:
  - change reservation of 185:185 to jboss user (#1192413)
  - reserve uidgid pair 167:167 for ceph (#1221043)
  - reserve uidgid for systemd-network(192:192) (#1213820)
  - reserve uidgid for systemd-resolve(193:193) (#1213820)
  - mention systemd-jounal-gateway can be dynamic (#1213820)


author: Ondrej Vasik <ovasik@redhat.com> - 2.8.71-7
changelog:
  - add basic empty subuid/subgid files for docker (#1311278)
  - specify full path to utilities in /etc/profile and /etc/bashrc
    (#1331871)


author: Ondrej Vasik <ovasik@redhat.com> - 2.8.71-8
changelog:
  - fix group id for tape in /etc/group (should be 33) (#1433020)
  - provide a way how to override set envvars through sh.local file(#1344007)
  - provide a way how to override set ennvars through csh.local file


author: Ondrej Vasik <ovasik@redhat.com> - 2.8.71-10
changelog:
  - fix crudp name in /etc/protocols (#1566469)
  - do not list /sbin/nologin and /usr/sbin/nologin in /etc/shells
    (#1571104)


author: Patsy Griffin <patsy@redhat.com> - 2020d-1
changelog:
  - Rebase to tzdata-2020d
   - Palestine will end summer time on 2020-10-24 rather than the
     predicted 2020-10-31.


author: Patsy Griffin <patsy@redhat.com> - 2020f-1
changelog:
  - Rebase to tzdata-2020f including changes for tzdata-2020e
    - tzdata-2020f fixes a bug in tzdata-2020e that caused an
      invalid zi file in rearguard format
    - Volgograd changes time zone from UTC+04 to UTC+03 on 2020-12-27.
    - Australia/Currie is identical to Australia/Hobart for all
      timestamps since 1970 and was therefore created by mistake,
      now moved to the "backward" file.


author: Patsy Griffin <patsy@redhat.com> - 2021b-1
changelog:
  - Rebase to tzdata-2021b
    - Innclude patch for Mayen
    - Jordan now starts DST on February's last Thursday.
    - Samoa no longer observes DST.
    - Merge more location-based Zones whose timestamps agree since 1970.
    - Move some backward-compatibility links to 'backward'.
    - Rename Pacific/Enderbury to Pacific/Kanton.
    - Correct many pre-1993 transitions in Malawi, Portugal, etc.
    - zic now creates each output file or link atomically.
    - zic -L no longer omits the POSIX TZ string in its output.
    - zic fixes for truncation and leap second table expiration.
    - zic now follows POSIX for TZ strings using all-year DST.
    - Fix some localtime crashes and bugs in obscure cases.
    - zdump -v now outputs more-useful boundary cases.
    - tzfile.5 better matches a draft successor to RFC 8536.


author: Patsy Griffin <patsy@redhat.com> - 2021c-1
changelog:
  - Rebase to tzdata-2021c
    - Revert most of 2021b changes to 'backward'.
    - Fix 'zic -b fat' bug in pre-1970 32-bit data.
    - Fix two Link line typos.
    - Distribute SECURITY file.


author: Patsy Griffin <patsy@redhat.com> - 2021d-1
changelog:
  - Rebase to tzdata-2021d
    - Pacific/Fiji suspended DST for the 2021/2022 season.
    - 'zic -r' now marks unspecified timestamps with "-00".


author: Patsy Griffin <patsy@redhat.com> - 2021e-1
changelog:
  - Rebase to tzdata-2021e - supersedes tzdata-2021d
    - Pacific/Fiji suspended DST for the 2021/2022 season.
    - 'zic -r' now marks unspecified timestamps with "-00".
    - Palestine will fall back 2021-10-29 at 01:00, rather
      than the predicted 2021-10-30.


author: Patsy Griffin <patsy@redhat.com> - 2022a-1
changelog:
  - Rebase to tzdata-2022a
    - Palestine springs forward on 2022-03-27, not -03-26.
    - zdump -v now outputs better failure information
    - fixes for code that reads corrupted TZif data


author: Kamil Dudka <dkdudka@redhat.com> - 2.2.51-13
changelog:
  - avoid failure of %check when building as root (#1085389)
  - setfacl.1: document the meaning of '-' in perms (#1337039)


author: Steve Grubb <sgrubb@redhat.com> 2.8.4-1
changelog:
  resolves: #1559032 - Rebase audit package to 2.8.4 to pick up bug fixes
  resolves: #1573889 - auditd busy loop in rotate_logs() with num_logs < 2
  resolves: #1534748 - incorrect addr field when using IPv6 for remote logging
  resolves: #1515903 - ausearch-expression man page missing \timestamp_ex
  resolves: #1511606 - aureport AVC report header is incomplete
  resolves: #1504251 - make auditd dump internal state for log writing status


author: Steve Grubb <sgrubb@redhat.com> 2.8.5-1
changelog:
  resolves: #1651761 - Rebase audit package to 2.8.5 to pick up bug fixes
  resolves: #1462178 - audit rule arch changed from b32 to b64 on ppc64le
  resolves: #1614833 - audispd loops reloading config 
  resolves: #1622194 - audisp-remote memory leak when using krb5 
  resolves: #1625156 - audisp-remote wont connect if remote ending action not reconnect
  resolves: #1628626 - aureport -a --failed does not display user_avc events 
  resolves: #1648005 - tcp listener socket fails when ipv6.disable=1 boot command
  resolves: #1650670 - space left in auditd.conf expressed as a percentage 
  resolves: #1663285 - ausearch device/inode missing when using a single file 
  resolves: #1672287 - max_log_file_action "keep_logs" doesn't behave as described


author: Nick Clifton <nickc@redhat.com> 2.27-32.base
changelog:
  - Fix seg-fault parsing DWARF-1 information.  (#1569580)
  - Fix seg-fault parsing DWARF-2 information.  (#1569891)
  - Fix seg-fault parsing COFF files.  (#1571917)


author: Nick Clifton <nickc@redhat.com> 2.27-33.base
changelog:
  - Fix seg-fault parsing ELF files.  (#1578979)
  - Fix seg-fault parsing DWARF-2 information.  (#1579065)
  - Fix seg-fault parsing DWARF-2 information.  (#1579051)
  - Fix seg-fault parsing a PE format file.  (#1579019)


author: Nick Clifton <nickc@redhat.com> 2.27-34.base
changelog:
  - Fix seg-fault parsing corrupt AOUT format files.  (#1579799)
  - Fix seg-fault parsing corrupt DWARF2 debug information.  (#1579802)
  - Fix seg-fault parsing corrupt ELF format files.  (#1579801)


author: Nick Clifton <nickc@redhat.com> 2.27-42.base
changelog:
  - Stop the BFD library from complaining about sections with multiple sets of relocations.  (#1749085)


author: Nick Clifton <nickc@redhat.com> 2.27-44.base
changelog:
  - Allow the BFD library to handle the copying of files which contain secondary reloc sections.  (#1785294)
  - Implement assembler workaround for Intel JCC microcode bug.  (#1778892)


author: Bob Relyea <rrelyea@redhat.com> - 2020.2.41-79
changelog:
  - Update to CKBI 2.41 from NSS 3.53.0
  -    Removing:
  -     # Certificate "AddTrust Low-Value Services Root"
  -     # Certificate "AddTrust External Root"
  -     # Certificate "UTN USERFirst Email Root CA"
  -     # Certificate "Certplus Class 2 Primary CA"
  -     # Certificate "Deutsche Telekom Root CA 2"
  -     # Certificate "Staat der Nederlanden Root CA - G2"
  -     # Certificate "Swisscom Root CA 2"
  -     # Certificate "Certinomis - Root CA"
  -    Adding:
  -     # Certificate "Entrust Root Certification Authority - G4"
  - fix permissions on ghosted files.


author: Bob Relyea <rrelyea@redhat.com> - 2021.2.48-71
changelog:
  - Update to CKBI 2.48 from NSS 3.66
  -    Removing:
  -     # Certificate "Verisign Class 3 Public Primary Certification Authority - G3"
  -     # Certificate "GeoTrust Global CA"
  -     # Certificate "GeoTrust Universal CA"
  -     # Certificate "GeoTrust Universal CA 2"
  -     # Certificate "QuoVadis Root CA"
  -     # Certificate "Sonera Class 2 Root CA"
  -     # Certificate "Taiwan GRCA"
  -     # Certificate "GeoTrust Primary Certification Authority"
  -     # Certificate "thawte Primary Root CA"
  -     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G5"
  -     # Certificate "GeoTrust Primary Certification Authority - G3"
  -     # Certificate "thawte Primary Root CA - G2"
  -     # Certificate "thawte Primary Root CA - G3"
  -     # Certificate "GeoTrust Primary Certification Authority - G2"
  -     # Certificate "VeriSign Universal Root Certification Authority"
  -     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G4"
  -     # Certificate "Trustis FPS Root CA"
  -     # Certificate "EE Certification Centre Root CA"
  -     # Certificate "LuxTrust Global Root 2"
  -     # Certificate "Symantec Class 1 Public Primary Certification Authority - G4"
  -     # Certificate "Symantec Class 2 Public Primary Certification Authority - G4"
  -    Adding:
  -     # Certificate "Microsoft ECC Root Certificate Authority 2017"
  -     # Certificate "Microsoft RSA Root Certificate Authority 2017"
  -     # Certificate "e-Szigno Root CA 2017"
  -     # Certificate "certSIGN Root CA G2"
  -     # Certificate "Trustwave Global Certification Authority"
  -     # Certificate "Trustwave Global ECC P256 Certification Authority"
  -     # Certificate "Trustwave Global ECC P384 Certification Authority"
  -     # Certificate "NAVER Global Root Certification Authority"
  -     # Certificate "AC RAIZ FNMT-RCM SERVIDORES SEGUROS"
  -     # Certificate "GlobalSign Secure Mail Root R45"
  -     # Certificate "GlobalSign Secure Mail Root E45"
  -     # Certificate "GlobalSign Root R46"
  -     # Certificate "GlobalSign Root E46"
  -     # Certificate "GLOBALTRUST 2020"
  -     # Certificate "ANF Secure Server Root CA"
  -     # Certificate "Certum EC-384 CA"
  -     # Certificate "Certum Trusted Root CA"


author: Bob Relyea <rrelyea@redhat.com> - 2022.2.54-71
changelog:
  - Update to CKBI 2.54 from NSS 3.79
  -    Removing:
  -     # Certificate "GlobalSign Root CA - R2"
  -     # Certificate "Cybertrust Global Root"
  -     # Certificate "Explicitly Distrusted DigiNotar PKIoverheid G2"
  -    Adding:
  -     # Certificate "TunTrust Root CA"
  -     # Certificate "HARICA TLS RSA Root CA 2021"
  -     # Certificate "HARICA TLS ECC Root CA 2021"
  -     # Certificate "HARICA Client RSA Root CA 2021"
  -     # Certificate "HARICA Client ECC Root CA 2021"
  -     # Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068"
  -     # Certificate "vTrus ECC Root CA"
  -     # Certificate "vTrus Root CA"
  -     # Certificate "ISRG Root X2"
  -     # Certificate "HiPKI Root CA - G1"
  -     # Certificate "Telia Root CA v2"
  -     # Certificate "D-TRUST BR Root CA 1 2020"
  -     # Certificate "D-TRUST EV Root CA 1 2020"


author: Bob Relyea <rrelyea@redhat.com> - 2022.2.54-72
changelog:
  - Update to CKBI 2.54 from NSS 3.79
  -    Adding:
  -     # Certificate "CAEDICOM Root"
  -     # Certificate "I.CA Root CA/RSA"
  -     # Certificate "MULTICERT Root Certification Authority 01"
  -     # Certificate "Certification Authority of WoSign G2"
  -     # Certificate "CA WoSign ECC Root"
  -     # Certificate "CCA India 2015 SPL"
  -     # Certificate "Swedish Government Root Authority v3"
  -     # Certificate "Swedish Government Root Authority v2"
  -     # Certificate "Tunisian Root Certificate Authority - TunRootCA2"
  -     # Certificate "OpenTrust Root CA G1"
  -     # Certificate "OpenTrust Root CA G2"
  -     # Certificate "OpenTrust Root CA G3"
  -     # Certificate "Certplus Root CA G1"
  -     # Certificate "Certplus Root CA G2"
  -     # Certificate "Government Root Certification Authority"
  -     # Certificate "A-Trust-Qual-02"
  -     # Certificate "Thailand National Root Certification Authority - G1"
  -     # Certificate "TrustCor ECA-1"
  -     # Certificate "TrustCor RootCert CA-2"
  -     # Certificate "TrustCor RootCert CA-1"
  -     # Certificate "Certification Authority of WoSign"
  -     # Certificate "CA 沃通根证书"
  -     # Certificate "SSC GDL CA Root B"
  -     # Certificate "SAPO Class 2 Root CA"
  -     # Certificate "SAPO Class 3 Root CA"
  -     # Certificate "SAPO Class 4 Root CA"
  -     # Certificate "CA Disig Root R1"
  -     # Certificate "Autoridad Certificadora Raíz Nacional de Uruguay"
  -     # Certificate "ApplicationCA2 Root"
  -     # Certificate "GlobalSign"
  -     # Certificate "Symantec Class 3 Public Primary Certification Authority - G6"
  -     # Certificate "Symantec Class 3 Public Primary Certification Authority - G4"
  -     # Certificate "Halcom Root CA"
  -     # Certificate "Swisscom Root EV CA 2"
  -     # Certificate "CFCA GT CA"
  -     # Certificate "Digidentity L3 Root CA - G2"
  -     # Certificate "SITHS Root CA v1"
  -     # Certificate "Macao Post eSignTrust Root Certification Authority (G02)"
  -     # Certificate "Autoridade Certificadora Raiz Brasileira v2"
  -     # Certificate "Swisscom Root CA 2"
  -     # Certificate "IGC/A AC racine Etat francais"
  -     # Certificate "PersonalID Trustworthy RootCA 2011"
  -     # Certificate "Swedish Government Root Authority v1"
  -     # Certificate "Swiss Government Root CA II"
  -     # Certificate "Swiss Government Root CA I"
  -     # Certificate "Network Solutions Certificate Authority"
  -     # Certificate "COMODO Certification Authority"
  -     # Certificate "LuxTrust Global Root"
  -     # Certificate "AC1 RAIZ MTIN"
  -     # Certificate "Microsoft Root Certificate Authority 2011"
  -     # Certificate "CCA India 2011"
  -     # Certificate "ANCERT Certificados Notariales V2"
  -     # Certificate "ANCERT Certificados CGN V2"
  -     # Certificate "EE Certification Centre Root CA"
  -     # Certificate "DigiNotar Root CA G2"
  -     # Certificate "Federal Common Policy CA"
  -     # Certificate "Autoridad de Certificacion Raiz del Estado Venezolano"
  -     # Certificate "Autoridad de Certificacion Raiz del Estado Venezolano"
  -     # Certificate "China Internet Network Information Center EV Certificates Root"
  -     # Certificate "Verizon Global Root CA"
  -     # Certificate "SwissSign Silver Root CA - G3"
  -     # Certificate "SwissSign Platinum Root CA - G3"
  -     # Certificate "SwissSign Gold Root CA - G3"
  -     # Certificate "Microsec e-Szigno Root CA 2009"
  -     # Certificate "SITHS CA v3"
  -     # Certificate "Certinomis - Autorité Racine"
  -     # Certificate "ANF Server CA"
  -     # Certificate "Thawte Premium Server CA"
  -     # Certificate "Thawte Server CA"
  -     # Certificate "TC TrustCenter Universal CA III"
  -     # Certificate "KEYNECTIS ROOT CA"
  -     # Certificate "I.CA - Standard Certification Authority, 09/2009"
  -     # Certificate "I.CA - Qualified Certification Authority, 09/2009"
  -     # Certificate "VI Registru Centras RCSC (RootCA)"
  -     # Certificate "CCA India 2007"
  -     # Certificate "Autoridade Certificadora Raiz Brasileira v1"
  -     # Certificate "ipsCA Global CA Root"
  -     # Certificate "ipsCA Main CA Root"
  -     # Certificate "Actalis Authentication CA G1"
  -     # Certificate "A-Trust-Qual-03"
  -     # Certificate "AddTrust External CA Root"
  -     # Certificate "ECRaizEstado"
  -     # Certificate "Configuration"
  -     # Certificate "FNMT-RCM"
  -     # Certificate "StartCom Certification Authority"
  -     # Certificate "TWCA Root Certification Authority"
  -     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G4"
  -     # Certificate "thawte Primary Root CA - G2"
  -     # Certificate "GeoTrust Primary Certification Authority - G2"
  -     # Certificate "VeriSign Universal Root Certification Authority"
  -     # Certificate "thawte Primary Root CA - G3"
  -     # Certificate "GeoTrust Primary Certification Authority - G3"
  -     # Certificate "E-ME SSI (RCA)"
  -     # Certificate "ACEDICOM Root"
  -     # Certificate "Autoridad Certificadora Raiz de la Secretaria de Economia"
  -     # Certificate "Correo Uruguayo - Root CA"
  -     # Certificate "CNNIC ROOT"
  -     # Certificate "Common Policy"
  -     # Certificate "Macao Post eSignTrust Root Certification Authority"
  -     # Certificate "Staat der Nederlanden Root CA - G2"
  -     # Certificate "NetLock Platina (Class Platinum) Főtanúsítvány"
  -     # Certificate "AC Raíz Certicámara S.A."
  -     # Certificate "Cisco Root CA 2048"
  -     # Certificate "CA Disig"
  -     # Certificate "InfoNotary CSP Root"
  -     # Certificate "UCA Global Root"
  -     # Certificate "UCA Root"
  -     # Certificate "DigiNotar Root CA"
  -     # Certificate "Starfield Services Root Certificate Authority"
  -     # Certificate "I.CA - Qualified root certificate"
  -     # Certificate "I.CA - Standard root certificate"
  -     # Certificate "e-Guven Kok Elektronik Sertifika Hizmet Saglayicisi"
  -     # Certificate "Japanese Government"
  -     # Certificate "AdminCA-CD-T01"
  -     # Certificate "Admin-Root-CA"
  -     # Certificate "Izenpe.com"
  -     # Certificate "TÜBİTAK UEKAE Kök Sertifika Hizmet Sağlayıcısı - Sürüm 3"
  -     # Certificate "Halcom CA FO"
  -     # Certificate "Halcom CA PO 2"
  -     # Certificate "Root CA"
  -     # Certificate "GPKIRootCA"
  -     # Certificate "ACNLB"
  -     # Certificate "state-institutions"
  -     # Certificate "state-institutions"
  -     # Certificate "SECOM Trust Systems CO.,LTD."
  -     # Certificate "D-TRUST Qualified Root CA 1 2007:PN"
  -     # Certificate "D-TRUST Root Class 2 CA 2007"
  -     # Certificate "D-TRUST Root Class 3 CA 2007"
  -     # Certificate "SSC Root CA A"
  -     # Certificate "SSC Root CA B"
  -     # Certificate "SSC Root CA C"
  -     # Certificate "Autoridad de Certificacion de la Abogacia"
  -     # Certificate "Root CA Generalitat Valenciana"
  -     # Certificate "VAS Latvijas Pasts SSI(RCA)"
  -     # Certificate "ANCERT Certificados CGN"
  -     # Certificate "ANCERT Certificados Notariales"
  -     # Certificate "ANCERT Corporaciones de Derecho Publico"
  -     # Certificate "GLOBALTRUST"
  -     # Certificate "Certipost E-Trust TOP Root CA"
  -     # Certificate "Certipost E-Trust Primary Qualified CA"
  -     # Certificate "Certipost E-Trust Primary Normalised CA"
  -     # Certificate "Cybertrust Global Root"
  -     # Certificate "GlobalSign"
  -     # Certificate "IGC/A"
  -     # Certificate "S-TRUST Authentication and Encryption Root CA 2005:PN"
  -     # Certificate "TC TrustCenter Universal CA I"
  -     # Certificate "TC TrustCenter Universal CA II"
  -     # Certificate "TC TrustCenter Class 2 CA II"
  -     # Certificate "TC TrustCenter Class 4 CA II"
  -     # Certificate "Swisscom Root CA 1"
  -     # Certificate "Microsec e-Szigno Root CA"
  -     # Certificate "LGPKI"
  -     # Certificate "AC RAIZ DNIE"
  -     # Certificate "Common Policy"
  -     # Certificate "TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı"
  -     # Certificate "A-Trust-nQual-03"
  -     # Certificate "A-Trust-nQual-03"
  -     # Certificate "CertRSA01"
  -     # Certificate "KISA RootCA 1"
  -     # Certificate "KISA RootCA 3"
  -     # Certificate "NetLock Minositett Kozjegyzoi (Class QA) Tanusitvanykiado"
  -     # Certificate "A-CERT ADVANCED"
  -     # Certificate "A-Trust-Qual-01"
  -     # Certificate "A-Trust-nQual-01"
  -     # Certificate "A-Trust-Qual-02"
  -     # Certificate "Staat der Nederlanden Root CA"
  -     # Certificate "Serasa Certificate Authority II"
  -     # Certificate "TDC Internet"
  -     # Certificate "America Online Root Certification Authority 2"
  -     # Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068"
  -     # Certificate "Government Root Certification Authority"
  -     # Certificate "RSA Security Inc"
  -     # Certificate "Public Notary Root"
  -     # Certificate "GeoTrust Global CA"
  -     # Certificate "GeoTrust Global CA 2"
  -     # Certificate "GeoTrust Universal CA"
  -     # Certificate "GeoTrust Universal CA 2"
  -     # Certificate "QuoVadis Root Certification Authority"
  -     # Certificate "Autoridade Certificadora Raiz Brasileira"
  -     # Certificate "Post.Trust Root CA"
  -     # Certificate "Microsoft Root Authority"
  -     # Certificate "Microsoft Root Certificate Authority"
  -     # Certificate "Microsoft Root Certificate Authority 2010"
  -     # Certificate "Entrust.net Secure Server Certification Authority"
  -     # Certificate "UTN-USERFirst-Object"
  -     # Certificate "BYTE Root Certification Authority 001"
  -     # Certificate "CISRCA1"
  -     # Certificate "ePKI Root Certification Authority - G2"
  -     # Certificate "ePKI EV SSL Certification Authority - G1"
  -     # Certificate "AC Raíz Certicámara S.A."
  -     # Certificate "SSL.com EV Root Certification Authority RSA"
  -     # Certificate "LuxTrust Global Root 2"
  -     # Certificate "ACA ROOT"
  -     # Certificate "Security Communication ECC RootCA1"
  -     # Certificate "Security Communication RootCA3"
  -     # Certificate "CHAMBERS OF COMMERCE ROOT - 2016"
  -     # Certificate "Network Solutions RSA Certificate Authority"
  -     # Certificate "Network Solutions ECC Certificate Authority"
  -     # Certificate "Australian Defence Public Root CA"
  -     # Certificate "SI-TRUST Root"
  -     # Certificate "Halcom Root Certificate Authority"
  -     # Certificate "Application CA G3 Root"
  -     # Certificate "GLOBALTRUST 2015"
  -     # Certificate "Microsoft ECC Product Root Certificate Authority 2018"
  -     # Certificate "emSign Root CA - G2"
  -     # Certificate "emSign Root CA - C2"
  -     # Certificate "Microsoft ECC TS Root Certificate Authority 2018"
  -     # Certificate "DigiCert CS ECC P384 Root G5"
  -     # Certificate "DigiCert CS RSA4096 Root G5"
  -     # Certificate "DigiCert RSA4096 Root G5"
  -     # Certificate "DigiCert ECC P384 Root G5"
  -     # Certificate "HARICA Code Signing RSA Root CA 2021"
  -     # Certificate "HARICA Code Signing ECC Root CA 2021"
  -     # Certificate "Microsoft Identity Verification Root Certificate Authority 2020"


author: Bob Relyea <rrelyea@redhat.com> - 2022.2.54-74
changelog:
  - Update to CKBI 2.54 from NSS 3.79
  -    Removing:
  -     # Certificate "TrustCor ECA-1"
  -     # Certificate "TrustCor RootCert CA-2"
  -     # Certificate "TrustCor RootCert CA-1"
  -     # Certificate "Network Solutions Certificate Authority"
  -     # Certificate "COMODO Certification Authority"
  -     # Certificate "Autoridad de Certificacion Raiz del Estado Venezolano"
  -     # Certificate "Microsec e-Szigno Root CA 2009"
  -     # Certificate "TWCA Root Certification Authority"
  -     # Certificate "Izenpe.com"
  -     # Certificate "state-institutions"
  -     # Certificate "GlobalSign"
  -     # Certificate "Common Policy"
  -     # Certificate "A-Trust-nQual-03"
  -     # Certificate "A-Trust-Qual-02"
  -     # Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068"
  -     # Certificate "Government Root Certification Authority"
  -     # Certificate "AC Raíz Certicámara S.A."


author: Robert Relyea <rrelyea@redhat.com> - 2023.2.60_v7.0.306-71
changelog:
  - Update to CKBI 2.60_v7.0.306 from NSS 3.91
  -    Removing:
  -     # Certificate "Camerfirma Global Chambersign Root"
  -     # Certificate "Staat der Nederlanden EV Root CA"
  -     # Certificate "OpenTrust Root CA G1"
  -     # Certificate "Swedish Government Root Authority v1"
  -     # Certificate "DigiNotar Root CA G2"
  -     # Certificate "Federal Common Policy CA"
  -     # Certificate "TC TrustCenter Universal CA III"
  -     # Certificate "CCA India 2007"
  -     # Certificate "ipsCA Global CA Root"
  -     # Certificate "ipsCA Main CA Root"
  -     # Certificate "Macao Post eSignTrust Root Certification Authority"
  -     # Certificate "InfoNotary CSP Root"
  -     # Certificate "DigiNotar Root CA"
  -     # Certificate "Root CA"
  -     # Certificate "GPKIRootCA"
  -     # Certificate "D-TRUST Qualified Root CA 1 2007:PN"
  -     # Certificate "TC TrustCenter Universal CA I"
  -     # Certificate "TC TrustCenter Universal CA II"
  -     # Certificate "TC TrustCenter Class 2 CA II"
  -     # Certificate "TC TrustCenter Class 4 CA II"
  -     # Certificate "TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı"
  -     # Certificate "CertRSA01"
  -     # Certificate "KISA RootCA 3"
  -     # Certificate "A-CERT ADVANCED"
  -     # Certificate "A-Trust-Qual-01"
  -     # Certificate "A-Trust-nQual-01"
  -     # Certificate "Serasa Certificate Authority II"
  -     # Certificate "TDC Internet"
  -     # Certificate "America Online Root Certification Authority 2"
  -     # Certificate "RSA Security Inc"
  -     # Certificate "Public Notary Root"
  -     # Certificate "Autoridade Certificadora Raiz Brasileira"
  -     # Certificate "Post.Trust Root CA"
  -     # Certificate "Entrust.net Secure Server Certification Authority"
  -     # Certificate "ePKI EV SSL Certification Authority - G1"
  -    Adding:
  -     # Certificate "DigiCert TLS ECC P384 Root G5"
  -     # Certificate "DigiCert TLS RSA4096 Root G5"
  -     # Certificate "DigiCert SMIME ECC P384 Root G5"
  -     # Certificate "DigiCert SMIME RSA4096 Root G5"
  -     # Certificate "Certainly Root R1"
  -     # Certificate "Certainly Root E1"
  -     # Certificate "E-Tugra Global Root CA RSA v3"
  -     # Certificate "E-Tugra Global Root CA ECC v3"
  -     # Certificate "DIGITALSIGN GLOBAL ROOT RSA CA"
  -     # Certificate "DIGITALSIGN GLOBAL ROOT ECDSA CA"
  -     # Certificate "BJCA Global Root CA1"
  -     # Certificate "BJCA Global Root CA2"
  -     # Certificate "Symantec Enterprise Mobile Root for Microsoft"
  -     # Certificate "A-Trust-Root-05"
  -     # Certificate "ADOCA02"
  -     # Certificate "StartCom Certification Authority G2"
  -     # Certificate "ATHEX Root CA"
  -     # Certificate "EBG Elektronik Sertifika Hizmet Sağlayıcısı"
  -     # Certificate "GeoTrust Primary Certification Authority"
  -     # Certificate "thawte Primary Root CA"
  -     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G5"
  -     # Certificate "America Online Root Certification Authority 1"
  -     # Certificate "Juur-SK"
  -     # Certificate "ComSign CA"
  -     # Certificate "ComSign Secured CA"
  -     # Certificate "ComSign Advanced Security CA"
  -     # Certificate "Global Chambersign Root"
  -     # Certificate "Sonera Class2 CA"
  -     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G3"
  -     # Certificate "VeriSign, Inc."
  -     # Certificate "GTE CyberTrust Global Root"
  -     # Certificate "Equifax Secure Global eBusiness CA-1"
  -     # Certificate "Equifax"
  -     # Certificate "Class 1 Primary CA"
  -     # Certificate "Swiss Government Root CA III"
  -     # Certificate "Application CA G4 Root"
  -     # Certificate "SSC GDL CA Root A"
  -     # Certificate "GlobalSign Code Signing Root E45"
  -     # Certificate "GlobalSign Code Signing Root R45"
  -     # Certificate "Entrust Code Signing Root Certification Authority - CSBR1"


author: Robert Relyea <rrelyea@redhat.com> - 2023.2.60_v7.0.306-72
changelog:
  - hand merge the two 'GlobalSign ECC Root CA R4' certs together and the two 'AC RAIZ FNMT-RCM' certs together to keep p11kit from getting confused.


author: Lukáš Nykrýn <lnykryn@redhat.com> - 1.3.62-1
changelog:
  - use systemctl preset, not systemctl enable
  - fix typo in manpage
  - partly support socket activated services


author: Lukáš Nykrýn <lnykryn@redhat.com> - 1.4-1
changelog:
  - ntsysv: show systemd services and sockets
  - fix combination --type xinetd --list service
  - leveldb: restore selinux context for xinetd conf files
  - alternatives: remove unused variable
  - alternatives: warn if the target is not a symlink
  - spec: add link to git
  - lets simplify version


author: Lukáš Nykrýn <lnykryn@redhat.com> - 1.5-1
changelog:
  - add systemd-sysv-install alias
  - don't create symlinks if they already exist
  - fix wrongly behaving LDFLAGS


author: Lukáš Nykrýn <lnykryn@redhat.com> - 1.6-1
changelog:
  - systemd-sysv-install: don't play ping-pong with systemctl
  - ntsysv: add description to systemd services
  - ntsysv: skip templates
  - Makefile: fix typo


author: Lukáš Nykrýn <lnykryn@redhat.com> - 1.7.2-1
changelog:
  - alternatives: introduce --keep-missing
  - alternatives: allow family in --set and display it in --config


author: Jan Macku <jamacku@redhat.com> - 1.7.5-1
changelog:
  - Fix issues with extra backslashes in path string - (#1485304)
  - Add documentation for --keep-missing option - (#1371146)


author: Miroslav Lichvar <mlichvar@redhat.com> 2.1-1
changelog:
  - update to 2.1 (#1117882 #1169353 #1206504 #1209568 CVE-2015-1821
    CVE-2015-1822 CVE-2015-1853)
  - extend chrony-helper to allow using servers from DNS SRV records (#1211600)
  - add servers from DHCP with iburst option by default (#1219492)
  - execute test suite


author: Miroslav Lichvar <mlichvar@redhat.com> 3.1-1
changelog:
  - update to 3.1 (#1387223 #1274250 #1350669 #1406445)
  - don't start chronyd without capability to set system clock (#1306046)
  - fix chrony-helper to escape names of systemd units (#1418968)
  - package chronyd sysconfig file (#1396840)


author: Miroslav Lichvar <mlichvar@redhat.com> 3.2-1
changelog:
  - update to 3.2 (#1482565 #1462081 #1454765)
  - use ID from /etc/os-release to set pool.ntp.org vendor zone


author: Miroslav Lichvar <mlichvar@redhat.com> 3.4-1
changelog:
  - update to 3.4 (#1636117, #1565544, #1565548, #1596239, #1600882)
  - drop support for HW timestamping on kernels < 3.10.0-613


author: Ondrej Vasik <ovasik@redhat.com> - 8.22-13
changelog:
  - call utilities in colorls.* scripts with full path (#1222223)
  - tail: disable inotify in --follow for vxfs (#1109083)
  - remove circular dependency for util-linux (not relevant for RHEL 7 - #1155963)
  - sort: do not look at more than specified keys for mb locales (#1148347)
  - i18n patch: fix buffer overruns and compiler warnings (#1148347)
  - xfs: fix dd sparse false test failure on btrfs and xfs (#1223041)
  - dd: new status=progress level to print stats periodically (#1147701)
  - id/groups - print correct group for session (#1115430)
  - cp,install,mknod,mkfifo,mkdir: separate -Z and --context options
    in --help and manpage (#1084471)
  - ls: clarify --scontext/--context/--lcontext options behaviour
    in info documentation, mention deprecation (#1099508)
  - du: handle bindmount cycles more gracefully (#1238191)
  - mv: prevent possible race condition for hardlinks (#1166570)
  - df: improve filtering of NFS mounts and bind mounts
    (#1197463, #1100026, #1129661)


author: Ondrej Vasik <ovasik@redhat.com> - 8.22-18
changelog:
  - fix xfs build failure in chrooted environment (#1263341)
  - update filesystem lists for stat and tail from latest upstream
    (#1327881, #1280357) 
  - disable id/setgid.sh test(missing chroot feature), fix 
    cp-a-selinux test (#1266500,#1266501)
  - colorls.sh - change detection of interactive shell for ksh
    compatibility (#1321648)
  - fix date --date crash with empty or invalid TZ envvar (#1325786)
  - df -l: do not hang on a dead autofs mount point (#1309247)
  - sort -h: fix functionality of human readable numeric sort for other
    than first field (#1328360)


author: Kamil Dudka <kdudka@redhat.com> - 8.22-19
changelog:
  - timeout: fix race possibly terminating wrong process (#1439465)
  - ls: allow interruption when reading slow directories (#1421802)
  - fold: preserve new-lines in mutlibyte text (#1418505)


author: Kamil Dudka <kdudka@redhat.com> - 8.22-23
changelog:
  - update description of the -a/--all option in df.1 man page (#1553212)
  - sort -M: fix memory leak when using multibyte locale (#1540059)


author: Kamil Dudka <kdudka@redhat.com> - 8.22-24
changelog:
  - doc: improve description of the --kibibytes option of ls (#1527391)
  - doc: fix typo in date example (#1620624)
  - stat,tail: sync the list of file systems with coreutils-8.31 (#1659530)
  - df: avoid stat() for dummy file systems with -l (#1668137)
  - df: prioritize mounts nearer the device root (#1042840)


author: Pavel Raiskup <praiskup@redhat.com> - 2.11-20
changelog:
  - fix another bogus date in changelog
  - update config.guess/config.sub for aarm64 build (#925189)
  - run autoreconf instead of autoheader


author: Tomáš Mráz <tmraz@redhat.com> - 2.9.0-3
changelog:
  - fix the python module to work with compressed dictionaries (#972542)
  - fix various dictionary lookup errors (#986400, #986401)
  - make the library reentrant and fix compilation warnings


author: Tomáš Mráz <tmraz@redhat.com> - 2.9.0-5
changelog:
  - make the simplistic check and the purging of special characters much
    less aggressive (#1003624, #985378)


author: Ondrej Kozina <okozina@redhat.com> - 1.7.4-4
changelog:
  - patch: fix regression in blockwise functions
  - patch: avoid repeating error messages when device holders
    detected.
  - patch: add option to cryptsetup-reencrypt to print progress
    log sequentaly
  - patch: use --progress-frequency in reencryption dracut module
  - Resolves: #1480006 #1447632 #1479857


author: Ondrej Kozina <okozina@redhat.com> - 2.0.3-2
changelog:
  - patch: stop LUKS2 auto-recovery if device is no longer LUKS
    type
  - patch: update cryptsetup man page for --type option
  - patch: rephrase error message for invalid --type option in
    convert action
  - Resolves: #1599281 #1601477 #1601481


author: Ondrej Kozina <okozina@redhat.com> - 2.0.3-3
changelog:
  - Add expected permissions explicitly for locking directory.
  - Reinstate sed script removing library rpath from libtool
    script due to bug in upstream sources distribution.
  - Resolves: #1609847 #1610379


author: Ondrej Kozina <okozina@redhat.com> - 2.0.3-4
changelog:
  - patch: Fix broken LUKS2 api test.
  - patch: Allow cryptsetup to process all LUKS2 metadata variants
    according to LUKS2 specifiation.
  - Resolves: #1653388


author: Ondrej Kozina <okozina@redhat.com> - 2.0.3-5
changelog:
  - patch: calculate alignment offset correctly for LUKS2 devices.
  - patch: fix memory leak in LUKS2 validation.
  - Resolves: #1613953 #1693592


author: Kamil Dudka <kdudka@redhat.com> - 7.29.0-48
changelog:
  - fix RTSP bad headers buffer over-read (CVE-2018-1000301)
  - fix FTP path trickery leads to NIL byte out of bounds write (CVE-2018-1000120)
  - fix LDAP NULL pointer dereference (CVE-2018-1000121)
  - fix RTSP RTP buffer over-read (CVE-2018-1000122)
  - http: prevent custom Authorization headers in redirects (CVE-2018-1000007)
  - doc: --tlsauthtype works only if built with TLS-SRP support (#1542256)
  - update certificates in the test-suite because they expire soon (#1572723)


author: Kamil Dudka <kdudka@redhat.com> - 7.29.0-50
changelog:
  - remove dead code, detected by Coverity Analysis
  - remove unused variable, detected by GCC and Clang


author: Kamil Dudka <kdudka@redhat.com> - 7.29.0-52
changelog:
  - prevent curl --rate-limit from hanging on file URLs (#1281969)
  - fix NTLM password overflow via integer overflow (CVE-2018-14618)
  - fix bad arithmetic when outputting warnings to stderr (CVE-2018-16842)
  - backport options to force TLS 1.3 in curl and libcurl (#1672639)
  - prevent curl --rate-limit from crashing on https URLs (#1683292)


author: Jakub Jelen <jjelen@redhat.com> 2.1.26-18
changelog:
  - Revert updated GSSAPI flags as in RFC 4752 to restore backward compatibility (#1154566)
  - Add and document ability to run saslauth as non-root user (#1188065)
  - Support AIX SASL GSSAPI (#1174322)
  - Update client library to be thread safe (#1147659)
  - Fix problem, that parsing short prefix matches the whole mechanism name (#1089267)
  - Don't use unnecessary quotes around user description (#1082564)
  - Fix confusing message when config file has typo (#1022479)


author: Marian Csontos <mcsontos@redhat.com> - 7:2.02.187-6.el7_9.2
changelog:
  - Fix dmeventd crash with modified reserved_stack configuration option.
  - Fix lvm crashing when .cache file is changed by external tools.


author: Marian Csontos <mcsontos@redhat.com> - 7:2.02.187-6.el7_9.5
changelog:
  - Fix fsadm failure due to accessing unbound variable.
  - Fix segfault in vgextend when a PV is missing in the processed VG.


author: Lukas Nykryn <lnykryn@redhat.com> - 033-534
changelog:
  - base/dracut-lib.sh:dev_unit_name() guard against $dev beginning with "-"
  - base/dracut-lib.sh: remove bashism
  - Align dev_unit_name() with systemd's function.
  - dracut-lib.sh:dev_unit_name(): use systemd-escape, if available
  Resolves: #1306640
  - 90dmsquash-live-ntfs: fix depends()
  - 90dmsquash-live: we don't have find_binary inside initramdisk
  - dracut: Ajusting variables name for --include
  Resolves: #1489882


author: Lukas Nykryn <lnykryn@redhat.com> - 033-546
changelog:
  - fcoe: handle CNAs with DCB firmware support
  Resolves: #1442663
  - mdraid: wait for rd.md.uuid specified devices to be assembled
  Resolves: #1451660
  - dracut: Introduce --force-drivers parameter and force_drivers=+ config option
  Resolves: #1577626
  - Skip iscsi attachment if no info
  Resolves: #1513397
  - Fix loading of modules in modules-load.d
  Resolves: #1547730
  - 40network: introduce ip=either6 option
  Resolves: #1582398
  - dracut-functions.sh:check_vol_slaves() speedup LV -> VG name
  Resolves: #1531503
  - dracut-function.sh:check_block_and_slaves() check for block devices
  Resolves: #1549498
  - net-lib: bump carrier timeout to 15
  Resolves: #1401811
  - dracut.sh: workaround broken read from /proc/modules
  Resolves: #1578222


author: Lukas Nykryn <lnykryn@redhat.com> - 033-551
changelog:
  - Revert "add 90multipath-hostonly module"
  - Introduce tri-state hostonly mode
  Resolves: #1599592
  - Correct paths for firmware
  Resolves: #1608491
  - Record loaded kernel modules when hostonly mode is enabled
  Resolves: #1607744


author: Lukas Nykryn <lnykryn@redhat.com> - 033-560
changelog:
  - fips: removed false-positive 'FATAL: Module xxx not found' error message when kernel provides a generic algo for module
  - fips: ensure fs module for /boot is installed
  - iscsi: always popd, even if there is no iscsi device
  - Harden dracut against BASH_ENV environment variable
  - fips: check fips integrity just before mounting local filesystems in /sysroot


author: Lukas Nykryn <lnykryn@redhat.com> - 033-571
changelog:
  - Drop dependency on bridge-utils
  - dracut.sh: disable lsinitrd logging when quiet
  - netlib: fix botched backport


author: Mark Wielaard <mjw@redhat.com> - 0.171-1
changelog:
  - New upstream release.
    - DWARF5 and split dwarf, including GNU DebugFission, support.
    - readelf: Handle all new DWARF5 sections.
      --debug-dump=info+ will show split unit DIEs when found.
      --dwarf-skeleton can be used when inspecting a .dwo file.
      Recognizes GNU locviews with --debug-dump=loc.
    - libdw: New functions dwarf_die_addr_die, dwarf_get_units,
      dwarf_getabbrevattr_data and dwarf_cu_info.
      libdw will now try to resolve the alt file on first use
      when not set yet with dwarf_set_alt.
      dwarf_aggregate_size() now works with multi-dimensional arrays.
    - libdwfl: Use process_vm_readv when available instead of ptrace.
    - backends: Add a RISC-V backend.


author: Mark Wielaard <mjw@redhat.com> - 0.172-1
changelog:
  - New upstream release.
    - No functional changes compared to 0.171.
    - Various bug fixes in libdw and eu-readelf dealing with bad DWARF5
      data. Thanks to running the afl fuzzer on eu-readelf and various
      testcases.
    - eu-readelf -N is ~15% faster.


author: Mark Wielaard <mjw@redhat.com> - 0.176-1
changelog:
  - New upstream release (#1676504)
    CVE-2019-7146, CVE-2019-7148, CVE-2019-7149, CVE-2019-7150,
    CVE-2019-7664, CVE-2019-7665, CVE-2018-16062, CVE-2018-16402,
    CVE-2018-16403, CVE-2018-18310, CVE-2018-18521, CVE-2018-18520.


author: Tomas Korbar <tkorbar@redhat.com> - 2.1.0-13
changelog:
  - Fix multiple CVEs
  - CVE-2022-23852 expat: integer overflow in function XML_GetBuffer
  - CVE-2021-45960 expat: Large number of prefixed XML attributes on a single tag can crash libexpat
  - CVE-2021-46143 expat: Integer overflow in doProlog in xmlparse.c
  - CVE-2022-22827 Integer overflow in storeAtts in xmlparse.c
  - CVE-2022-22826 Integer overflow in nextScaffoldPart in xmlparse.c
  - CVE-2022-22825 Integer overflow in lookup in xmlparse.c
  - CVE-2022-22824 Integer overflow in defineAttribute in xmlparse.c
  - CVE-2022-22823 Integer overflow in build_model in xmlparse.c
  - CVE-2022-22822 Integer overflow in addBinding in xmlparse.c
  - Resolves: CVE-2022-23852
  - Resolves: CVE-2021-45960
  - Resolves: CVE-2021-46143
  - Resolves: CVE-2022-22827
  - Resolves: CVE-2022-22826
  - Resolves: CVE-2022-22825
  - Resolves: CVE-2022-22824
  - Resolves: CVE-2022-22823
  - Resolves: CVE-2022-22822


author: Tomas Korbar <tkorbar@redhat.com> - 2.1.0-14
changelog:
  - Fix multiple CVEs
  - CVE-2022-25236 expat: namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution
  - CVE-2022-25235 expat: malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution
  - CVE-2022-25315 expat: integer overflow in storeRawNames()
  - Resolves: CVE-2022-25236
  - Resolves: CVE-2022-25235
  - Resolves: CVE-2022-25315


author: Kamil Dudka <kdudka@redhat.com> - 1:4.5.10-7
changelog:
  - fix specfile issues reported by the fedora-review script
  - do not use the AM_C_PROTOTYPES macro (removed in Automake 1.12)
  - do not require gets() to be declared


author: Martin Bříza <mbriza@redhat.com> - 4.0.1-1
changelog:
  - Update to upstream 4.0.1 (#808005)
  - Corrected Source0 link to .tar.gz extension as not all releases are available as .tar.bz2
  - Resolves #724817 - gawk-4.0.0 regression in '\' escape handling in gsub()
  - Resolves #820550 - gawk: getline in BEGIN skips 2 lines


author: Florian Weimer <fweimer@redhat.com> - 2.17-326.2
changelog:
  - nscd: Do not use sendfile for the netgroup cache
  - nscd: Use-after-free in netgroup cache
  - CVE-2021-27645: nscd: double-free in netgroup cache
  - CVE-2024-33599: nscd: buffer overflow in netgroup cache (RHEL-34263)
  - CVE-2024-33600: nscd: null pointer dereferences in netgroup cache
  - CVE-2024-33601: nscd: crash on out-of-memory condition
  - CVE-2024-33602: nscd: memory corruption with NSS netgroup modules


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 1:6.0.0-13
changelog:
  - Explicitly added '-g' option into CFLAGS & CXXFLAGS to correctly build .debug_info for i386 (bug #1413034)
  - Added a workaround to correctly add hardening flags during build process (bug #1406689)


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.14-4
changelog:
  - Added group-separator, no-group-separator options decription
  - Aligned output of built-in help
  - Defuzzified gnulib-tests-rm-f patch


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.20-2
changelog:
  - Fixed invalid UTF-8 byte sequence error in PCRE mode
    (by pcre-backported-fixes patch)
    Resolves: rhbz#1217080
  - Fixed buffer overrun for grep -F
    Resolves: CVE-2015-1345
  - Fixed \w and \W behaviour in multibyte locales
    Resolves: rhbz#1159012
  - Documented --fixed-regexp option
    Resolves: rhbz#1103259
  - Updated pcre buildrequires to require pcre-devel >= 7.8-7
    Related: rhbz#1217080


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.20-3
changelog:
  - Speedup DFA for long patterns and fixed begline/endline matching
    Resolves: rhbz#1413029
  - Added support for GREP_LEGACY_EGREP_FGREP_PS environmental variable which
    controls how egrep, fgrep show in ps output
    Resolves: rhbz#1297441


author: Petr Stodulka <pstodulk@redhat.com> - 1.5-8
changelog:
  - Gzip overwrite existing files when user choose "no" on yes/no question.
    It's due to wrong dupicit declaration of yesno() function in gzip.h
    which is compiled wrong with -O2 option.
    Resolves: rhbz#1201689


author: Jakub Martisko <jamartis@redhat.com> - 1.5-10
changelog:
  - doc change: missing grep options are now mentioned in the zgrep 
    man pages/help message
    Resolves: #1437002


author: Jindrich Novy <jnovy@redhat.com> - 1:1.0-11
changelog:
  - don't use mmap(2) to avoid failures on i386 with 1GB files and larger (#672917)
  - fix package URL (#676962)


author: Jindrich Novy <jnovy@redhat.com> - 1:1.0-12
changelog:
  - fix possible buffer overflows, integer overflows (CVE-2011-3630 CVE-2011-3631 CVE-2011-3632)
  - update man page


author: Jindrich Novy <jnovy@redhat.com> - 1:1.0-14
changelog:
  - do not allow to hardlink files across filesystems by default (#786719)
    (use -f option to override)


author: David Howells <dhowells@redhat.com>
changelog:
  - Adjust the manual page for 'keyctl unlink' to show keyring is optional.
  - Add --version support for the keyutils version and build date.


author: David Howells <dhowells@redhat.com> - 1.5.4-1
changelog:
  - Fix the keyctl padd command and similar to handle binary input.
  - Make keyctl show able to take a keyring to dump.
  - Make keyctl show able to take a flag to request hex key IDs.
  - Make keyctl show print the real ID of the root keyring.


author: David Howells <dhowells@redhat.com> - 1.5.6-1
changelog:
  - Fix the request-key.conf.5 manpage.
  - Fix the max depth of key tree dump (keyctl show) [BZ 1002761].
  - The input buffer size for keyctl padd and pinstantiate should be larger [BZ 1002761].
  - Add keyctl_invalidate.3 manpage [BZ 1002761].


author: David Howells <dhowells@redhat.com> - 1.5.7-1
changelog:
  - Provide a utility function to find a key by type and name.
  - Allow keyctl commands to take a type+name arg instead of a key-id arg.
  - Add per-UID get_persistent keyring function [BZ 1014739].


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 20-17
changelog:
  - libkmod-elf: resolve CRC if module is built with MODULE_REL_CRCS.
  - weak-modules: process only weak-updates related depmod output.
    Resolves: rhbz#1468305
  - weak-modules: implement dry run by symlink restoration.
    Resolves: rhbz#1477073


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 20-18
changelog:
  - depmod: external directories support.
    Resolves: rhbz#1361857
  - BuildRequires automake autoconf libtool.


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 20-20
changelog:
  - weak-modules: use function to generate weak_updates_dir
  - weak-modules: implement dry-run on the tempdir
    Resolves: rhbz#1510058


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 20-23
changelog:
  - weak-modules: fix initial state creation for dry-run
  - weak-modules: check compatibility in a temporary directory
    Resolves: rhbz#1619889.


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 20-26
changelog:
  - weak-modules: handle independent modules in one run
  - weak-modules: use asterisk for kernel version in sandbox
    Resolves: rhbz#1695547


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 20-28
changelog:
  - weak-modules: update_modules_for_krel: always finish sandbox
  - weak-modules: groupping: use dependencies of extra/ provider
    Resolves: rhbz#1774925


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-114
changelog:
  - Add 0226-RH-allow-overrides-section.patch
    * This is a dummy section that exists to help the transition to RHEL8
  - Add 0227-RHBZ-1465773-fix-path-delay-msg.patch
  - Add 0228-RHBZ-1464634-hauwei-config-update.patch
  - Add 0229-RHBZ-1467987-poll-on-udev-monitor.patch
    * Do poll first, so udev_monitor_receive_device doesn't return error when
      there is no uevent
  - Add 0230-UP-allow-invalid-creates.patch
    * Allow creation of devices with no valid paths.
  - Add 0231-RHBZ-1458852-delay-readying.patch
    * Add ghost_delay configuration option to delay device activation when only
      ghost paths exist.
  - Add 0232-RHBZ-1456955-property-blacklist.patch
    * Add the "property" blacklist type.
  - Resolves: bz #1456955, #1458852, #1464634, #1465773, #1467987


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-115
changelog:
  - Add 0233-RHBZ-1451852-1482629-nimble-config.patch
  - Add 0234-RHBZ-1500109-doc-typo.patch
  - Remove old triggerun scriptlet (bz1470384)
  - Resolves: bz #1451852, #1470384, #1482629, #1500109


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-116
changelog:
  - Add 0235-RHBZ-1480638-NVMe-support.patch
    * adds support for multipathing NVMe devices
  - Resolves: bz #1480638


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-117
changelog:
  - Modify 0235-RHBZ-1480638-NVMe-support.patch
    * remove overly-restrictive uevent filtering
  - Resolves: bz #1480638


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-118
changelog:
  - Modify 0224-RHBZ-1452210-prkey.patch
    * Improve error checking for mpathpersist
  - Resolves: bz #1452210


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-120
changelog:
  - Add 0237-RHBZ-1526876-show-sysfs-state.patch
    * Correctly get sysfs state for multipath -l output
  - Add 0238-RHBZ-1508483-mpathconf-info.patch
  - Add 0239-RHBZ-1544958-client-timeout.patch
    * increase maximum multipathd client reply timeout to 60 seconds
  - Add 0240-UPBZ-1568902-id_size.patch
    * increase maximum size of product and revision strings to deal with nvme
  - Add 0241-RHBZ-1554516-show-path-failures.patch
    * add a path failures multipathd path format wildcard
  - Add 0242-RHBZ-1541116-all-tg-pt.patch
    * add all_tg_pt configuration option to make mpathpersist send only
      one registration per host
  - Add 0243-RHBZ-1498724-save-persist-options.patch
    * allow ":aptpl" to be added to the reservation_key to fix multipathd
      aptpl persistent reservation handling
  - Add 0244-RHBZ-1562247-remove-rbd.patch
    * remove multipath support for rbd
  - Resolves: bz #1498724, #1508483, #1526876, #1541116, #1544958, #1554516
  - Resolves: bz #1562247, #1568902


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-121
changelog:
  - Add 0245-RHBZ-1584228-fix-readsector0_size.patch
    * correctly figure IO size
  - Add 0246-RHBZ-1593459-add-transport-blacklist.patch
    * and new blacklist option, "protocol"
  - Add 0247-RHBZ-1585824-mpathconf-allow-doc.patch
  - Resolves: bz #1584228, #1585824, #1593459


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-123
changelog:
  - Add 0249-RHBZ-1610263-mpathpersist-max-fds.patch
    * make mpathpersist honor max_fds multipath.conf parameter
  - Resolves: bz #1610263


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-127
changelog:
  - Add 0256-RHBZ-1672175-retry-no-fd-paths.patch
    * retry adding paths if they couldn't be opened initially
  - Add 0257-RHBZ-1679556-dont-check-dm-devices.patch
    * don't check if dm devices are multipath paths
  - Add 0258-RHBZ-1634183-ANA-prioritizer.patch
    * Add NVMe ANA path prioritizer
  - Resolves: bz #1634183, #1672175, #1679556


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-128
changelog:
  - Modify 0258-RHBZ-1634183-ANA-prioritizer.patch
    * minor change
  - Add 0259-RHBZ-1701604-fix-nr-active.patch
    * recalculate the number of active paths whenever a path is checked
  - Add 0260-RHBZ-1634183-prio-fixes.patch
  - Add 0261-RHBZ-1714506-skip-blacklisted-paths.patch
    * ignore blacklisted paths in mpathpersist
  - Add 0262-RHBZ-1699486-reload-with-failed-paths.patch
    * allow forced reloads even if there are no reusable paths
  - Add 0263-RHBZ-1686708-nvme-hcil.patch
    * make nvme ids work like in upstream
  - Add 0264-RHBZ-1699441-de-series-config.patch
  - Resolves: bz #1686708, #1699441, #1699486, #1701604, #1714506


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-129
changelog:
  - Add 0265-RHBZ-1721855-mpathpersist-speedup.patch
    * only grab path information from necessary devices, and allow batch files.
  - Add 0266-RHBZ-1696817-fix-emc-checker.patch
    * fix detection of inactive snapshots
  - Add 0267-RHBZ-1661156-powermax-config.patch
  - Remove 0261-RHBZ-1714506-skip-blacklisted-paths.patch
    * This fix is superseded by 0265-RHBZ-1721855-mpathpersist-speedup.patch
  - Resolves: bz #1661156, #1696817, #1721855


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-130
changelog:
  - Add 0268-RHBZ-1721855-mpathpersist-fixes.patch
    * Fix issues in the mpathpersist speedup code
  - Resolves: bz #1721855


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-131
changelog:
  - Modify 0268-RHBZ-1721855-mpathpersist-fixes.patch
    * The fix for 1721855 broke 1714506.
  - Resolves: bz #1714506


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-132
changelog:
  - Add 0269-RHBZ-1804420-remove-kpartx-limit.patch
    * Remove the 256 device limit, when searching loop devices with kpartx
  - Resolves: bz #1804420


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-133
changelog:
  - Add 0270-RHBZ-1775481-segfault-fix.patch
    * Fix segfault related to missing dm device tables
  - 0271-RHBZ-1806197-mpathconf-typo.patch
  - Resolves: bz #1775481, #1806197


author: wanglixing <wanglixing@kylinos.cn> - 1.15.1-55.el7_9.ns7.01
changelog:
  - Type:compile
  - ID:NA
  - SUG:NA
  - Desc:Skip partial check to fix BUILDSTDERR: keyctl_join_session_keyring: Operation not permitted


author: Karel Zak <kzak@redhat.com> 2.23.2-59
changelog:
  - fix #1618711 - exec option in mount unable to override the implicit noexec in user option
  - fix #1616264 - Login to emergency shell failed


author: Karel Zak <kzak@redhat.com> 2.23.2-60
changelog:
  - fix #1664752 - Bull (Atos) server lands up in invalid stty settings on the serial console after boot preventing login


author: Karel Zak <kzak@redhat.com> 2.23.2-61
changelog:
  - #1203378 - Cannot use swapon with fallocated XFS swapfile
  - #1632944 - blkid/lsblk does not recognize exfat filesystem without a label
  - #1633657 - mount -a always tries to mount CIFS share subdir despite being already mounted
  - #1639465 - Bad formatting in agetty.8 man page
  - #1667942 - libsmartcols: scols_print_table_to_string() doesn't work
  - #1678451 - Unable to mount to a directory that matches a dm device under /dev


author: Karel Zak <kzak@redhat.com> 2.23.2-62
changelog:
  - fix #1734545 - blkid_get_dev() leak file descriptor to underlying block device
  - fix #1712768 - lsmem segfaults on ppc64 wih -o
  - fix #1690102 - setarch(8) does not check error return values properly.
  - fix #1734261 - lscpu not showing Physical socket, chips information


author: Karel Zak <kzak@redhat.com> 2.23.2-64
changelog:
  - fix #1788896 - Internal testsuite: libmount tests failed
  - fix #1802240 - systemd-udev segmentation fault in crc32() at lib/crc32.c (libblkid)
  - fix #1816183 - "mount -a" should ignore already mounted bind mounts.
  - fix #1747710 - please backport the "uid=forget" and "gid=forget" UDF mount options to libmount
  - fix #1784579 - RHEL-7: col struct char_str c_column field should be of unsigned type and/or larger than 16 bit


author: Karel Zak <kzak@redhat.com> 2.23.2-65
changelog:
  - fix #1826719 - mount -a tries to mount already mounted cifs shares when we cannot query up to root dir
  - fix #1745657 - mismatch between spec file and uuidd runtime directory


author: Karel Zak <kzak@redhat.com> 2.23.2-65.el7_9.1
changelog:
  - fix #1905956 - RHEL-7: chrt regression: unwanted 'nice' value reset on sched_setattr() [rhel-7.9.z]
  - fix #1905954 - RHEL-7: chrt regression: unexpected default scheduler [rhel-7.9.z]
  - fix #1883013 - RHEL-7: chrt command does not support the -R option [rhel-7.9.z]


author: Steve Grubb <sgrubb@redhat.com> 0.7.5-2
changelog:
  - resolves: #1185610 - libcap-ng: update caps table for newer kernels
  - Fix a leaked FD in upstream code


author: Lukas Czerner <lczerner@redhat.com> 1.42.9-10
changelog:
  - libext2fs: don't ignore fsync errors (#1405049)
  - Fix nroff macro issue in chattr man page (#1429213)


author: Lukas Czerner <lczerner@redhat.com> 1.42.9-11
changelog:
  - libext2fs: skip start_blk adjustment when stride and flex_bg is set (#1503969)
  - tune2fs: edit dire warning about check intervals (#1433233)


author: Lukas Czerner <lczerner@redhat.com> 1.42.9-13
changelog:
  - e2fsck: warn if checkinterval and broken_system_clock both set (#1365594)
  - e2fsprogs: fail to open 1k block size ext4 with bigalloc,meta_bg,^resize_inode (#1448019)


author: Lukas Czerner <lczerner@redhat.com> 1.42.9-14
changelog:
  - Various fixes and improvements (#1682935)
  - Automatically enable meta_bg to avoid failure when creating huge fs with small bs (#1608635)
  - don't ignore fsync errors in filefrag (#1451185)


author: Lukas Czerner <lczerner@redhat.com> 1.42.9-18
changelog:
  - fix out-of-bounds write on corrupted fs (#1797731)
  - fix out-of-bounds write on corrupted fs (#1768710)
  - fix e2fsprogs creating corrupted meta image (#1711880)
  - fix typo in ext4 man page (#1720130)
  - provide easy metod for creating compatible rhel6 fs (#1780277)
  - better handling of trivial dir link count problem (#1820048)


author: Matej Mužila <mmuzila@redhat.com> - 5.3.21-23
changelog:
  - Mention in man page that care should be taken when running db_hotbackup
    with -c option. Resolves: rhbz#1460077


author: Kamil Dudka <kdudka@redhat.com> 3.0-7.20120601cvs
changelog:
  - Update to 3.0 (20120601 snap)
  - fix crash of el_insertstr() on incomplete multi-byte sequence (#840598)


author: Dan Horák <dhorak@redhat.com> - 3.0.13-16
changelog:
  - Drop ppc64le from the multilib list
  - Use additional BR: only in ppc64le build
  - Resolves: RHBZ1116945


author: Tomáš Mráz <tmraz@redhat.com> 1.5.3-5
changelog:
  - add FIPS DRBG implementation
  - run the FIPS POST tests in shared library constructor
  - make it possible to run the test suite in the FIPS mode


author: Tomáš Mráz <tmraz@redhat.com> 1.5.3-13
changelog:
  - touch only urandom in the selftest and when /dev/random is
    unavailable for example by SELinux confinement
  - fix the RSA selftest key (p q swap)


author: Tomáš Mráz <tmraz@redhat.com> 1.5.3-14
changelog:
  - add DRBG CAVS driver and other necessary CAVS driver updates (#1172568)
  - allow ath reinitialization in FIPS mode
  - allow for auto-initialization of DRBG


author: Tomas Mraz <tmraz@redhat.com> 1.1.0-1
changelog:
  - fix leak when throwing PWQError exception
  - added pkgconfig file
  - call the simplicity checks before the cracklib check
  - add enforce_for_root option to the PAM module
  - updated translations from Transifex


author: Tomas Mraz <tmraz@redhat.com> 1.1.1-1
changelog:
  - use rpm built-in filtering of provides (rhbz#830153)
  - remove strain debug fprintf() (rhbz#831567)


author: Tomas Mraz <tmraz@redhat.com> 1.2.0-1
changelog:
  - add maxsequence check for too long monotonic character sequence.
  - clarified alternative licensing to GPLv2+.
  - add local_users_only option to skip the pwquality checks for
    non-locals. (thanks to Stef Walter)


author: Tomas Mraz <tmraz@redhat.com> 1.2.1-1
changelog:
  - properly free pwquality settings
  - add extern "C" to public header
  - updated translations from Transifex


author: Tomas Mraz <tmraz@redhat.com> 1.2.2-1
changelog:
  - manual page fixes
  - make it possible to set the maxsequence configuration value
  - updated translations from Transifex


author: Tomáš Mráz <tmraz@redhat.com> 1.2.3-1
changelog:
  - fix problem with parsing the pam_pwquality options
    patch by Vladimir Sorokin.
  - updated translations from Transifex
  - treat empty user or password as NULL
  - move the library to /usr


author: Tomáš Mráz <tmraz@redhat.com> 1.2.3-5
changelog:
  - fix brittle configuration settings (#1259633)
  - fix abort when generating large passwords on some architectures


author: Paul Moore <pmoore@redhat.com> - 2.2.1-1
changelog:
  - Removed '--disable-static' from the build to ensure that scmp_sys_resolver
    is self contained and resolve RPATH issues


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-8
changelog:
  - Save linked policy, skip re-link when possible
  - Replace access(,F_OK) checks to make setuid programs work (#1186431)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-9
changelog:
  - Update semanage to allow runtime labeling of Infiniband Pkeys (#1466274)
  - Update semanage to allow runtime labeling of ibendports (#1466274)
  - Keep copy of file_contexts.homedirs in policy store (#1409813)
  - Add support for listing fcontext.homedirs file (#1409813)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-12
changelog:
  - Do not change file mode of seusers and users_extra (#1512639)
  - Improve warning for installing disabled module (#1337199)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-14
changelog:
  - Include user name in ROLE_REMOVE audit events (#1622045)
  - Improve "reset umask before creating directories"


author: Kamil Dudka <kdudka@redhat.com> 1.4.3-9
changelog:
  - curl consumes too much memory during scp download (#1080459)
  - prevent a not-connected agent from closing STDIN (#1147717)


author: Kamil Dudka <kdudka@redhat.com> 1.4.3-12
changelog:
  - session: avoid printing misleading debug messages (#1503294)
  - scp: send valid commands for remote execution (#1489733)


author: Kamil Dudka <kdudka@redhat.com> 1.8.0-2
changelog:
  - fix integer overflow in keyboard interactive handling that allows out-of-bounds writes (CVE-2019-3863)
  - fix out-of-bounds memory comparison with specially crafted message channel request (CVE-2019-3862)
  - fix out-of-bounds reads with specially crafted SSH packets (CVE-2019-3861)
  - fix zero-byte allocation in SFTP packet processing resulting in out-of-bounds read (CVE-2019-3858)
  - fix integer overflow in SSH packet processing channel resulting in out of bounds write (CVE-2019-3857)
  - fix integer overflow in keyboard interactive handling resulting in out of bounds write (CVE-2019-3856)
  - fix integer overflow in transport read resulting in out of bounds write (CVE-2019-3855)


author: Daniel Veillard <veillard@redhat.com> - 2.9.1-6
changelog:
  - Fix missing entities after CVE-2014-3660 fix
  - CVE-2014-0191 Do not fetch external parameter entities (rhbz#1195650)
  - Fix regressions introduced by CVE-2014-0191 patch


author: Daniel Veillard <veillard@redhat.com> - 2.9.1-6.2
changelog:
  - Fix a series of CVEs (rhbz#1286496)
  - CVE-2015-7941 Stop parsing on entities boundaries errors
  - CVE-2015-7941 Cleanup conditional section error handling
  - CVE-2015-8317 Fail parsing early on if encoding conversion failed
  - CVE-2015-7942 Another variation of overflow in Conditional sections
  - CVE-2015-7942 Fix an error in previous Conditional section patch
  - Fix parsing short unclosed comment uninitialized access
  - CVE-2015-7498 Avoid processing entities after encoding conversion failures
  - CVE-2015-7497 Avoid an heap buffer overflow in xmlDictComputeFastQKey
  - CVE-2015-5312 Another entity expansion issue
  - CVE-2015-7499 Add xmlHaltParser() to stop the parser
  - CVE-2015-7499 Detect incoherency on GROW
  - CVE-2015-7500 Fix memory access error due to incorrect entities boundaries
  - CVE-2015-8242 Buffer overead with HTML parser in push mode
  - CVE-2015-1819 Enforce the reader to run in constant memory


author: Daniel Veillard <veillard@redhat.com> - libxml2-2.9.1-6.3
changelog:
  - Heap-based buffer overread in xmlNextChar (CVE-2016-1762)
  - Bug 763071: Heap-buffer-overflow in xmlStrncat <https://bugzilla.gnome.org/show_bug.cgi?id=763071> (CVE-2016-1834)
  - Bug 757711: Heap-buffer-overflow in xmlFAParsePosCharGroup <https://bugzilla.gnome.org/show_bug.cgi?id=757711> (CVE-2016-1840)
  - Bug 758588: Heap-based buffer overread in xmlParserPrintFileContextInternal <https://bugzilla.gnome.org/show_bug.cgi?id=758588> (CVE-2016-1838)
  - Bug 758605: Heap-based buffer overread in xmlDictAddString <https://bugzilla.gnome.org/show_bug.cgi?id=758605> (CVE-2016-1839)
  - Bug 759398: Heap use-after-free in xmlDictComputeFastKey <https://bugzilla.gnome.org/show_bug.cgi?id=759398> (CVE-2016-1836)
  - Fix inappropriate fetch of entities content (CVE-2016-4449)
  - Heap use-after-free in htmlParsePubidLiteral and htmlParseSystemiteral (CVE-2016-1837)
  - Heap use-after-free in xmlSAX2AttributeNs (CVE-2016-1835)
  - Heap-based buffer-underreads due to xmlParseName (CVE-2016-4447)
  - Heap-based buffer overread in htmlCurrentChar (CVE-2016-1833)
  - Add missing increments of recursion depth counter to XML parser. (CVE-2016-3705)
  - Avoid building recursive entities (CVE-2016-3627)
  - Fix some format string warnings with possible format string vulnerability (CVE-2016-4448)
  - More format string warnings with possible format string vulnerability (CVE-2016-4448)


author: David King <dking@redhat.com> - 2.9.1-6.4
changelog:
  - Fix CVE-2015-8035 (#1595697)
  - Fix CVE-2018-14404 (#1602817)
  - Fix CVE-2017-15412 (#1729857)
  - Fix CVE-2016-5131 (#1714050)
  - Fix CVE-2017-18258 (#1579211)
  - Fix CVE-2018-1456 (#1622715)


author: David King <dking@redhat.com> - 2.9.1-6.5
changelog:
  - Fix CVE-2019-19956 (#1793000)
  - Fix CVE-2019-20388 (#1810057)
  - Fix CVE-2020-7595 (#1810073)
  - Fix xsd:any schema validation (#1812145)


author: Tim Niemueller <tim@niemueller.de> - 5.1.4-7
changelog:
  - Add patch to from lua.org with smaller bugfixes
  - sed -i -e 's/5\.1\.3/5.1.4/g' on autotoolize patch, bug #641144


author: pjp <pjp@fedoraproject.org> - r129-1
changelog:
  - New LZ4_compress_fast() API.
  - New LZ4 CLI improved performance with multiple files.
  - Other bug fix and documentation updates.


author: pjp <pjp@fedoraproject.org> - r130-1
changelog:
  - Fixed: incompatibility sparse mode vs console.
  - Fixed: LZ4IO exits too early when frame crc not present.
  - Fixed: incompatibility sparse mode vs append mode.
  - Performance fix: big compression speed boost for clang(+30%).


author: pjp <pjp@fedoraproject.org> - r131-1
changelog:
  - New: Dos/DJGPP target #114.
  - Added: Example using lz4frame library #118.
  - Changed: liblz4.a no longer compiled with -fPIC by default.


author: Jakub Martisko <jamartis@rehat.com> - 1.8.3-1
changelog:
  - Rebase to 1.8.3
  - Drop the patch from 1.7.5-3. It is now part of the upstream archive
  - Resolves: #1813245


author: openEuler Buildteam <buildteam@openeuler.org> - 6.1-12
changelog:
  - Type:cves
  - ID:CVE-2019-17594  CVE-2019-17595
  - SUG:NA
  - DESC:fix CVE-2019-17594 and CVE-2019-17595


author: liutao <liutao1@kylinos.cn> - 6.1-14.el7.01
changelog:
  - Type:enhancement
  - ID:NA
  - SUG:NA
  - DESC:unpack static subpackage corresponding to version 5.9-14.20130511.el7_4


author: liutao <liutao1@kylinos.cn> - 6.1-14.el7.02
changelog:
  - Type:enhancement
  - ID:NA
  - SUG:NA
  - DESC:unpack static subpackage corresponding to version 5.9-14.20130511.el7_4
  - Add Obsoletes:     ncurses < 6.1-14.el7.02


author: Bob Relyea <rrelyea@redhat.com> - 3.67.0-3
changelog:
  - revert sql default language in man pages
  - fix SEC_PKCS12EnableCipher so python-nss tests will still work.


author: Like<like@kylinos.cn> - 3.90.0-2.ns7.01
changelog:
  - Type: bugfix
  - ID: NA
  - SUG: NA
  - DESC: modify at check ,fix failed:SSL_ERROR_BAD_CERT_ALERT: SSL peer cannot verify your certificate.


author: Bob Relyea <rrelyea@redhat.com> - 3.79.0-1
changelog:
  - Rebase to NSS 3.79.
  - add reader/writer lock on encrypted attribute access
  - skip attribute verification on attributes with default values
  - don't export trust objects if they are default trust objects from dbm


author: Daiki Ueno <dueno@redhat.com> - 3.43.0-7
changelog:
  - Don't override date in man-pages
  - Revert the change to use XDG basedirs (mozilla#818686)
  - Enable SSL2 compatible ClientHello by default
  - Disable SSL3 and RC4 by default


author: Daiki Ueno <dueno@redhat.com> - 3.44.0-1
changelog:
  - Rebase to NSS 3.44
  - Restore fix-min-library-version-in-SSLVersionRange.patch to keep
    SSL3 supported in the code level while it is disabled by policy
  - Skip TLS 1.3 tests under FIPS mode


author: Daiki Ueno <dueno@redhat.com> - 3.44.0-2
changelog:
  - Skip sysinit gtests properly
  - Fix shell syntax error in tests/ssl/ssl.sh
  - Regenerate manual pages


author: Daiki Ueno <dueno@redhat.com> - 3.44.0-3
changelog:
  - Disable TLS 1.3 under FIPS mode
  - Disable RSASSA-PKCS1-v1_5 in TLS 1.3
  - Fix post-handshake auth transcript calculation if
    SSL_ENABLE_SESSION_TICKETS is set


author: Bob Relyea <rrelyea@redhat.com> - 3.44.0-6
changelog:
  - back out out-of-bounds patch (patch for nss-softokn).
  - Fix segfault on empty or malformed ecdh keys (#1777712)


author: Bob Relyea <rrelyea@redhat.com> - 3.44.0-7
changelog:
  - Increase timeout on ssl_gtest so that slow platforms can complete when
     running on a busy system.


author: Matus Honek <mhonek@redhat.com> - 2.4.44-17
changelog:
  - MozNSS Compat. Layer: Fix memleaks reported by valgrind (#1575549)
  - Reset OPTIND in libexec/functions for getopts to work in subsequent calls (#1564382)
  - MozNSS Compat. Layer: Fix typos, and spelling in the README file header (#1543451)


author: Matus Honek <mhonek@redhat.com> - 2.4.44-18
changelog:
  - MozNSS Compat. Layer: Make log messages more clear (#1543955)
  - Build with LDAP_USE_NON_BLOCKING_TLS (#1471039)


author: Matus Honek <mhonek@redhat.com> - 2.4.44-22
changelog:
  - Fix CVE-2020-12243 openldap: denial of service via nested boolean expressions in LDAP search filters (#1838405)


author: Simon Pichugin <spichugi@redhat.com> - 2.4.44-23
changelog:
  - Fix CVE-2020-25692 openldap: NULL pointer dereference for unauthenticated packet in slapd (#1895328)


author: Simon Pichugin <spichugi@redhat.com> - 2.4.44-25
changelog:
  - Fix CVE-2020-25709 openldap: assertion failure in Certificate List syntax validation (#2040539)
  - Fix CVE-2020-25710 openldap: assertion failure in CSN normalization with invalid input (#2040538)


author: Sahana Prasad <sahana@redhat.com> 1.0.2k-22
changelog:
  - fix CVE-2021-23841 openssl: NULL pointer dereference
    in X509_issuer_and_serial_hash()
  - fix CVE-2021-23840 openssl: integer overflow in CipherUpdate
  - Resolves: rhbz#1932132, rhbz#1932126


author: Sahana Prasad <sahana@redhat.com> 1.0.2k-23
changelog:
  - fixes CVE-2021-3712 openssl: Read buffer overruns processing ASN.1 strings
  - Resolves: rhbz#1996054


author: Sahana Prasad <sahana@redhat.com> 1.0.2k-24
changelog:
  - Updates patch openssl-1.0.2k-cve-2021-3712.patch to only free on push failure.
  - Resolves: rhbz#2039993


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.0.2k-25
changelog:
  - Fixes CVE-2022-2078 Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  - Related: rhbz#2067160


author: liudingyao <liudingyao@kylinos.cn> 1.0.2k-26.ns7.01
changelog:
  - Type:update
  - ID:NA
  - SUG:NA
  - DESC: Add patch openssl-1.0.2k-neokylin-add-gmAlg.patch
    import patch1001 and modify spec from 1.0.2k-19.ns7.02:
    Add China cryptographic algorithm SM2 SM3 SMS4
    Add patch openssl-1.0.2k-neokylin-fix-CVE-2020-1968.patch
    Add patch Patch1003: CVE-2022-1292.patch
    Disabled test


author: Stef Walter <stefw@redhat.com> - 0.20.7-1
changelog:
  - Update to upstream stable 0.20.7 release
  - Expose pkcs11x.h header and defines for attached extensions rhbz#1142305


author: Daiki Ueno <dueno@redhat.com> - 0.23.5-3
changelog:
  - Avoid reference to thread-unsafe strerror rhbz#1378947
  - Fix PKCS#11 OAEP interface rhbz#1191209
  - Update documentation to follow RFC7512 rhbz#1165977


author: Tomáš Mráz <tmraz@redhat.com> 1.1.8-14
changelog:
  - pam_unix: add no_pass_expiry option for ignoring password
    expiration in crond and sshd with public key authentication
  - add manual page for environment(5) (#1110257)
  - pam_loginuid: log if auditd not detected
  - always ignore audit error when -EPERM is returned (#1287800)
  - pam_lastlog: fix possible NULL dereference when localtime fails (#1313537)


author: Tomáš Mráz <tmraz@redhat.com> 1.1.8-19
changelog:
  - pam_access: (group) match syntax is prioritized over network@netgroup
    match (#1358881), add support for additional /etc/security/access.d/*.conf
    files, improve documentation (#1421735)
  - pam_lastlog: fix pt_BR translation (#1185697)
  - pam_faillock: support admin_group with users equivalent to root in
    faillock handling (#1285550)


author: Tomáš Mráz <tmraz@redhat.com> 1.1.8-23
changelog:
  - pam_get_authtok_verify: ensure no double verification happens
  - manual page fixes for pam_tty_audit and pam_wheel
  - pam_unix: lower the excessive maximum number of closed fd descriptors
    when spawning handlers
  - pam_loginuid: do not prevent login in unprivileged containers


author: Panu Matilainen <pmatilai@redhat.com> - 1.13-12
changelog:
  - Hack poptBadOption() to return something semi-meaningful on exec alias
    failures (#697435, #710267)
  - Run internal test-suite on build, minimal as it might be


author: Jan Rybar <jrybar@redhat.com> - 3.3.10-28
changelog:
  - pgrep: uid/gid conversion overflow
  - vmstat: manpage line about I/O blocked procs unclear
  - Resolves: rhbz#1624514, rhbz#1796043


author: Matthieu Saulnier <fantom@fedoraproject.org> - 3.2.0-1
changelog:
  - update to 3.2.0
  - remove BuildRoot tag in spec file
  - remove "rm -rf $RPM_BUILD_ROOT" at the beginning of %install section
  - remove %clean section
  - remove %defattr lines
  - add a joker for libqrencode.so.* files


author: Peter Gordon <peter@thecodergeek.com> - 3.2.0-2
changelog:
  - Add patch to fix improper LIBPTHREAD macro in the pkgconfig file:
    + fix-LIBPTHREAD-macro.patch
  - Resolves: #795582 (qrencode-devel: Malformed pkgconfig file causes build to
    fail ("@LIBPTHREAD@: No such file or directory"))


author: Matthieu Saulnier <fantom@fedoraproject.org> - 3.3.1-1
changelog:
  - update to 3.3.1
  - remove "Group" tag in spec file
  - fix manfile suffix
  - remove patch to fix improper LIBPTHREAD macro in the pkgconfig file:
    - upstream issue


author: Pavlina Moravcova Varekova <pmoravco@redhat.com> - 4.11.3-34
changelog:
  - Adjust --noghost documentation (#1395818)
  - Provide audit events on update verification (#1555326)


author: Pavlina Moravcova Varekova <pmoravco@redhat.com> - 4.11.3-36
changelog:
  - Add popt-based options --setcaps and --restore (#1550745)
  - Improve hardlink handling in disk space calculation (#1491786)
  - Remove perl dependencies that are provided in the same file (#1570181)


author: wanglixing <wanglixing@kylinos.cn> - 4.11.3-48.01
changelog:
  - Type:updates
  - ID:NA
  - SUG:NA
  - DESC: modify spec, set configuer with-vendor from redhat to neokylin,and
    buildrequires redhat-rpm-config to neokylin-rpm-config and add
    patch507 for rebranding, Red Hat to CS2C


author: Martin Briza <mbriza@redhat.com> - 4.2.1-9
changelog:
  - Backported commit from upstream to fix treating "x26" as "&" character
  - Added virtual provide for gnulib according to http://fedoraproject.org/wiki/Packaging:No_Bundled_Libraries 
    Resolves: #812067 #821776


author: Martin Briza <mbriza@redhat.com> - 4.2.2-1
changelog:
  - New release
  - Dropping included patches: sed-4.2.1-data-loss.patch sed-4.2.1-fix-0x26-on-RHS.patch sed-4.2.1-makecheck.patch
  - Dropping unused patch sed-4.2.1-dummyparam.diff
  - Regenerated sed-4.2.{1,2}-copy.patch
  - Minor change to patching (creating backup files)


author: Jan Pacner <jpacner@redhat.com> - 4.2.2-5
changelog:
  - Related: #948598 (Man page scan results for sed; introduce -c argument, add
    help for -b --binary arguments, cleanup arguments & help)


author: Jakub Martisko <jamartis@redhat.com> - 4.2.2-7
changelog:
  - Fix: "in-place edits on FUSE filesystems create files with all-zero mode bits"
    Resolves: #1836317


author: Tomas Mraz <tmraz@redhat.com> - 2:4.1.5.1-14
changelog:
  - label the newly created home dir correctly (#1077809)
  - mention that chage -d 0 forces password change (#1135010)
  - improve date parsing and error detecting in chage
  - avoid full group database scanning in newgrp in most common case
  - report error if usermod asked for moving homedir and it does not exist


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.1.5.1-16
changelog:
  - update auditing to cover more events and fix some incorrect audit
    records - patch by Steve Grubb (#1151580)


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.1.5.1-19
changelog:
  - documentation fixes (#1292820)
  - usermod: make password unlocking compatible with passwd (#1185425)
  - usermod: disallow ':' in raw password setting (#1292815)
  - improve the gid and uid allocation mechanism (#1279321)
  - lastlog: add options to unexpire unused accounts (#1285547)


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.1.5.1-25
changelog:
  - prevent creating users ".." or "." or with all numeric usernames (#1373645)
  - raise limit for passwd and shadow entry length but also prevent
    writing longer entries (#1422497)
  - consider also supplementary group membership in newgrp (#1425078)


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.6-1
changelog:
  - rebase to current upstream release to bring newuidmap and newgidmap
  - re-allow all numeric usernames when SHADOW_ALLOW_ALL_NUMERIC_USER
    environment variable is set


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.6-2
changelog:
  - ignore LOGIN_PLAIN_PROMPT variable in login.defs
  - correct wrong SUB_UID/GID_COUNT default in manual page (#1690522)


author: Bastien Nocera <bnocera@redhat.com> - 1.8-3
changelog:
  + shared-mime-info-1.8-3
  - Remove triggers, they're not supported in RHEL 7.4's RPM
  Resolves: #1433916


author: Bastien Nocera <bnocera@redhat.com> - 1.8-4
changelog:
  + shared-mime-info-1.8-4
  - Fix CSV files being associated with LibreOffice Math instead
    of LibreOffice Calc
  - Resolves: #1438589


author: Lukas Nykryn <lnykryn@redhat.com> - 219-58
changelog:
  - tmpfiles: don't skip cleanup of read-only root owned files if TMPFILES_AGE_ALL is set (#1533638)
  - timer: we already got the trigger before, no need to call UNIT_TRIGGER again (#1549119)
  - doc: fix links to binfmt_misc kernel documentation (#1572244)
  - man/udevadm: remove superfluous --version from subcommand (#1553076)
  - man/udevadm: correctly show the short version of --exit (#1552712)
  - core/timer: downgrade message about random time addition (#5229) (#1587906)
  - fd-util: add new acquire_data_fd() API helper (#1446095)
  - systemd-analyze: make dump work for large # of units (#1446095)
  - use max. message size allowed by DBus spec (#8936) (#1446095)
  - cryptsetup: support LUKS2 on-disk format (#1573838)
  - units: don't put udev to its own mount namespace with slave propagation (#1432211)
  - rules: disable support for Lenovo IR cameras (#1540418)
  - core: make sure "systemctl reload-or-try-restart is actually a noop if a unit is not running (#1191920)
  - core: fix confusing logging of instantaneous jobs (#1506256)
  - core: correct return value from reload methods (#1506256)
  - core: always try harder to get unit status message format string (#1506256)
  - core: unit_get_status_message_format() never returns NULL (#1506256)
  - core: try harder to get job completion messages too (#1506256)
  - core: remove generic job completion messages from unit vtables (#1506256)
  - core: do not log done failed-condition jobs as if unit started (#1506256)
  - core: log completion of remaining job types (#1506256)
  - core: adjust job completion message log levels (#1506256)
  - mount: add new LazyUnmount= setting for mount units, mapping to umount(8)'s "-l" switch (#3827) (#1497264)
  - rules: Add MODEL_ID for NVMe device (#7037) (#1397264)
  - umount: always use MNT_FORCE in umount_all() (#7213) (#1571098)
  - core: Implement timeout based umount/remount limit (#1571098)
  - core: Implement sync_with_progress() (#1571098)
  - journal: forward messages from /dev/log unmodified to syslog.socket (#1409659)
  - tmpfiles: use safe_glob() (#1436004)
  - core: delay adding target dependencies until all units are loaded and aliases resolved (#8381) (#1368856)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-59
changelog:
  - man: correct the meaning of TimeoutStopSec= (#1305509)
  - rules: mark hotplugged memory as movable (#1563532)
  - udev: add ID_INPUT_SWITCH for devices with switch capability (#5057) (#1597240)
  - rules: disable support for Dell IR cameras (#1591316)
  - rpm: fix 
  if [ $1 -eq 1 ] ; then 
                  systemctl preset \--global  >/dev/null 2>&1 || : 
  fi 
  () macro. (#1582383)
  - rpm: remove confusing --user before --global (#1582383)
  - automount: handle state changes of the corresponding mount unit correctly (#1596241)
  - man: document that SIGCONT always follows SIGTERM (#1601794)
  - rules: add udev rule that automatically offline HW attached to ACPI container (#1597958)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-60
changelog:
  - Revert "rules: mark hotplugged memory as movable" (#1614686)
  - rules: implement new memory hotplug policy (#1614686)
  - Revert "rules: add udev rule that automatically offline HW attached to ACPI container" (#1597958)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-62
changelog:
  - cryptsetup-generator: introduce basic keydev support (#1619743)
  - cryptsetup-generator: don't return error if target directory already exists (#1619743)
  - cryptsetup-generator: allow whitespace characters in keydev specification (#1619743)
  - Make sure the mount units pulled by 'RequiresMountsFor=' are loaded (if they exist) (#1619743)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-63
changelog:
  - dhcp6: make sure we have enough space for the DHCP6 option header (CVE-2018-15688)
  - journald: do not store the iovec entry for process commandline on stack (#1657788)
  - journald: set a limit on the number of fields (1k) (#1657792)
  - journal-remote: set a limit on the number of fields in a message (#1657792)
  - journald: free cmdline buffers owned by iovec (#1666646)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-64
changelog:
  - detect-virt: do not try to read all of /proc/cpuinfo (#1631531)
  - core: disable the effect of Restart= if there's a stop job pending for a service (#6581) (#1626382)
  - networkd: respect DHCP UseRoutes option (#1663365)
  - networkd: fix dhcp4 link without routes not being considered ready (#8728) (#1663365)
  - networkd: dont crash when mtu changes (#6594) (#1663365)
  - tmpfiles: "e" takes globs (#1641764)
  - tmpfiles: 'e' is supposed to operate on directory only (#1641764)
  - tmpfiles: 'e' is supposed to accept shell-style globs (#1641764)
  - bus-message: do not crash on message with a string of zero length (#1643396)
  - Revert "bus: when dumping string property values escape the chars we use as end-of-line and end-of-item marks" (#1643172)
  - set automount state to waiting when the mount is stopped (#1651257)
  - core: when deserializing state always use read_line(…, LONG_LINE_MAX, …) (CVE-2018-15686)
  - shorten hostname before checking for trailing dot (#1631625)
  - journald: fixed assertion failure when system journal rotation fails (#9893) (#1619543)
  - local-addresses: handle gracefully if routes lack an RTA_OIF attribute (#1627750)
  - rules: fix memory hotplug rule so systemd-detect-virt does not run too often (#1666612)
  - 6647 - use path_startswith("/dev") in cryptsetup (#6732) (#1664695)
  - core: mount-setup: handle non-existing mountpoints gracefully (#1585411)
  - units/rescue.service.in: fix announcement message (#1660422)
  - systemctl: Allow 'edit' and 'cat' on unloaded units (#1649518)
  - main: improve RLIMIT_NOFILE handling (#5795) (#1585913)
  - shared/sleep-config: exclude zram devices from hibernation candidates (#1609816)
  - journalctl: allow --file/--directory with --boot or --list-boots (#1463678)
  - journalct: allow --boot=0 to DTRT with --file/--directory (#1463678)
  - journal-remote: show error message if output file name does not end with .journal (bz#1267552)
  - artificially serialize building of .policy files (#1272485)
  - cryptsetup: add support for sector-size= option (#9936) (#1571801)
  - cryptsetup: do not define arg_sector_size if libgcrypt is v1.x (#9990) (#1571801)
  - journal: fix syslog_parse_identifier() (#1657794)
  - journal: do not remove multiple spaces after identifier in syslog message (#1657794)
  - tmpfiles: change ownership of symlinks too (#1620110)
  - tmpfiles: fix check for figuring out whether to call chmod() (#1620110)
  - shared/install: allow "enable" on linked unit files (#1628575)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-65
changelog:
  - backport fd_is_fs_type (#1663143)
  - backport chase_symlinks (#1663143)
  - fs-util: add new CHASE_SAFE flag to chase_symlinks() (#1663143)
  - fs-util: add new chase_symlinks() flag CHASE_OPEN (#1663143)
  - sd-dameon: also sent ucred when our UID differs from EUID (#1663143)
  - notify: add new --uid= command (#1663143)
  - core: be stricter when handling PID files and MAINPID sd_notify() messages (#1663143)
  - journald: respect KeepFree= as well as MaxUse= values (#1361893)
  - shutdown: in_container was used before its definition (#1693716)
  - core: Fix edge case when processing /proc/self/mountinfo (#1691511)
  - sd-bus: deal with cookie overruns (#1693559)
  - Refuse dbus message paths longer than BUS_PATH_SIZE_MAX limit. (#1667871)
  - Allocate temporary strings to hold dbus paths on the heap (#1667871)
  - sd-bus: if we receive an invalid dbus message, ignore and proceeed (#1667871)
  - udev: check if the spawned PID didn't exit after reaping unexpected PID (#1697909)
  - udev: call poll() again after killing the spawned process (#1697909)
  - udev: check age against both timeouts to prevent integer wraparound (#1697909)
  - avoid possible hang if our child process hangs (#1697909)
  - missing: when adding syscall replacements, use different names (#1694605)
  - include sys/sysmacros.h in more places (#1694605)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-66
changelog:
  - sd-bus: unify three code-paths which free struct bus_container (#1643394)
  - hashmap: don't use mempool (#1609349)
  - man: be more explicit about thread safety of sd_journal (#1609349)
  - selinux: don't log SELINUX_INFO and SELINUX_WARNING messages to audit (#1240730)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-78.1
changelog:
  - device: make sure we emit PropertiesChanged signal once we set sysfs (#1793527)
  - device: don't emit PropetiesChanged needlessly (#1793527)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-78.2
changelog:
  - core: don't update unit description if it is already set to the same value (#1793527)
  - unit: don't emit PropertiesChanged signal if adding a dependency to a unit is a no-op (#1793527)
  - core: fix unnecessary fallback to the rescue mode caused by initrd-switch-root.service's exit status judgment error (#1825232)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-78.4
changelog:
  - test: add a test/reproducer for BZ#1989245 (#1989245)
  - strv: fix buffer size calculation in strv_join_quoted() (#1989245)
  - install: refactor find_symlinks() and don't search for symlinks recursively (#1828758)


author: dongqi <dongqi1@kylinos.cn> - 219-78.9.ns7.01
changelog:
  - Type: update
  - ID: [TASK#196626]
  - SUG: NA
  - DESC: migrate patch from 219-78.el7_9.7.ns7.02
          modify neokylin-release to kylin-release
          add patch:0665-systemd-219-init5-hang.patch


author: Tomas Repik <trepik@redhat.com> - 2:1.26-32
changelog:
  - restore incremental backups correctly, files were not being removed (rhbz#1184697)
  - fix the behavior of tar when --directory option is used together with
    --remove-files
  - repair the ignorance of --xattrs-exclude/include options (rhbz#1341786)
  - Intorduce new option '--keep-directory-symlink'


author: Pavel Raiskup <praiskup@redhat.com> - 1.26-33
changelog:
  - extract: deterministic archive type detection (rhbz#1437297)
  - avoid hang when extracting with --xattrs --skip-old-files (rhbz#1408168)
  - fix listing of large sparse members (rhbz#1347229)


author: Patsy Griffin <patsy@redhat.com> - 2022d-1
changelog:
  - Rebase to tzdata-2022d
    - Palestine's DST transition will be on October 29, 2022,
      not October 28, 2022.
    - Europe/Uzhgorod and Europe/Zaporozhye are moved to 'backzone'.


author: Patsy Griffin <patsy@redhat.com> - 2022e-1
changelog:
  - Rebase to tzdata-2022e
    - Jordan and Syria cancelled the DST transition planned
      for 2022-10-28, remaining at +03 permanently.


author: Patsy Griffin <patsy@redhat.com> - 2022f-1
changelog:
  - Rebase to tzdata-2022f
    - Mexico will stop observing DST except near the US border.
    - Chihuahua moved to -06 year round starting on 2022-10-30.
    - Fiji no longer observes DST.


author: Patsy Griffin <patsy@redhat.com> - 2022g-1
changelog:
  - Rebase to tzdata-2022g
    - The northern edge of the Mexican state of Chihuahua will
      change time zone to agree with nearby US locations on
      2022-11-30.
    - Added a new Zone America/Ciudad_Juarez that splits from
      America/Ojinaga.


author: Patsy Griffin <patsy@redhat.com> - 2023a-1
changelog:
  - Rebase to tzdata-2023a
    - Egypt reintroduced DST, from April through October.
    - Morocco springs forward April 23, not April 30.
    - Palestine delayed the start of DST this year.


author: Patsy Griffin <patsy@redhat.com> - 2023d-1
changelog:
  - Rebase to tzdata-2023d
    - Include time zone changes for Ittoqqortoormiit, Greenland
      and Vostok, Antarctica.
    - Update the expiration date for the leap-seconds.list file.
      No new leap seconds were added.


author: Patsy Griffin <patsy@redhat.com> - 2024a-1
changelog:
  - Rebase to tzdata-2024a
    - Kazakhstan will transition from UTC+6 to UTC+5 on 2024-03-01.
    - Palestine will spring forward a week later than previously
      predicted.


author: Pavel Raiskup <praiskup@redhat.com> - 5.1.2-5alpha
changelog:
  - fix manual page inconsistencies with help output (private #948533)
  - enable/fix the 'xzgrep -h' (private #850898)


author: Lukas Javorsky <ljavorsk@redhat.com> - 1.2.7-21
changelog:
  - Fix heap-based buffer over-read or buffer overflow in inflate in inflate.c
  - Resolves: CVE-2022-37434


author: Kai Engert <kaie@redhat.com> - 2017.2.16-71
changelog:
  - Update to CKBI 2.16 from NSS 3.32. In addition to removals/additions,
    Mozilla removed code signing trust from all CAs (rhbz#1472933)


author: Bob Relyea <rrelyea@redhat.com> - 2019.2.32-76
changelog:
  - Update to CKBI 2.32 from NSS 3.44
  -   Removing:
  -   # Certificate "Visa eCommerce Root"
  -   # Certificate "AC Raiz Certicamara S.A."
  -   # Certificate "TC TrustCenter Class 3 CA II"
  -   # Certificate "ComSign CA"
  -   # Certificate "S-TRUST Universal Root CA"
  -   # Certificate "TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı H5"
  -   # Certificate "Certplus Root CA G1"
  -   # Certificate "Certplus Root CA G2"
  -   # Certificate "OpenTrust Root CA G1"
  -   # Certificate "OpenTrust Root CA G2"
  -   # Certificate "OpenTrust Root CA G3"
  -  Adding:
  -   # Certificate "GlobalSign Root CA - R6"
  -   # Certificate "OISTE WISeKey Global Root GC CA"
  -   # Certificate "GTS Root R1"
  -   # Certificate "GTS Root R2"
  -   # Certificate "GTS Root R3"
  -   # Certificate "GTS Root R4"
  -   # Certificate "UCA Global G2 Root"
  -   # Certificate "UCA Extended Validation Root"
  -   # Certificate "Certigna Root CA"
  -   # Certificate "emSign Root CA - G1"
  -   # Certificate "emSign ECC Root CA - G3"
  -   # Certificate "emSign Root CA - C1"
  -   # Certificate "emSign ECC Root CA - C3"
  -   # Certificate "Hongkong Post Root CA 3"


author: Zdenek Pavlas <zpavlas@redhat.com> - 0.9.9-21
changelog:
  - update to latest HEAD
  - don't BuildRequire bash-completion in rhel
  - Fail for bad compress-type options to modifyrepo, like createrepo. BZ 886589
  - Fix options documentation. BZ 892657.
  - modifyrepo: fix --compress option bug. BZ 950724
  - modifyrepo: add --checksum and --{unique,simple}-md-filenames options


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 0.9.9-24
changelog:
  - mergerepo: merge package versions from multiple repos.
  - Related: bug#1178763
  - Close lock file before unlink().
  - Related: bug#1256216


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 0.9.9-26
changelog:
  - Make sure filename doesn't already contain a checksum.
  - Resolves: bug#1270784
  - Catch IOErrors when loading pkglist.
  - Resolves: bug#1083182
  - Add missing options to the manpage.
  - Resolves: bug#1285761


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 0.9.9-27
changelog:
  - Fix temporary files cleanup.
  - Resolves: bug#1406418
  - Fix --update for pkgs with same nevra.
  - Resolves: bug#1404239


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 0.9.9-28
changelog:
  - createrepo: allow xz and bz2 for xml files.
  - Resolves: bug#1125437
  - modifyrepo: fix handling of already compressed input.
  - Resolves: bug#1227782
  - modifyrepo: handle empty file with LZMA.
  - Resolves: bug#1287685
  - modifyrepo: docs: remove compat compress type.
  - Resolves: bug#1287714


author: Jonathan Dieter <jdieter@lesbg.com> - 3.6-0.13.20130520git
changelog:
  - Clearer error message when applydeltaiso fails (#825428) (Thanks, John!)
  - Add details to applydeltaiso and makedeltaiso man pages (#569499)
  - Add fragiso man page to deltaiso package (#569776)
  - Fix section for applydeltaiso (#548970)
  - Add arch-specific requires (#677060)


author: Jonathan Dieter <jdieter@lesbg.com> - 3.6-1
changelog:
  - Update to 3.6 which, among other things, fixes a bug when applying a deltarpm
    to create a gzip-compressed rpm using full compression


author: Jan Kaluza <jkaluza@redhat.com> 5.11-32
changelog:
  - fix #1278737 - add support for Java 1.7 and 1.8
  - fix #1281723 - show full executable name for core
  - fix #1271636 - add support for detection of Python 2.7 byte-compiled files
  - fix #1278768 - comment out too-sensitive Pascal magic


author: Honza Horak <hhorak@redhat.com> - 1.9.1-1
changelog:
  - Updated to new upstream release 1.9.1
  - Dropped -filestruct, -ndbmlock and -fhs patches, they are not 
    needed anymore and GDBM_NOLOCK is used always
  - Run testsuite


author: Honza Horak <hhorak@redhat.com> - 1.10-1
changelog:
  - Updated to new upstream release 1.10
  - Dropped -shortread patch, which has been already applied by upstream
  - Disable large file support, that is enabled by default since 1.9, 
    but not compatible with db files created using gdbm-1.8.3 and lower
  - License change to GPLv3+
  - Add doc files THANKS AUTHORS NOTE-WARNING
  - Changed text in NOTE-WARNING to correspond with build settings


author: Tomáš Mráz <tmraz@redhat.com> - 2.0.22-4
changelog:
  - allow import of RSA-E and RSA-S keys (patch by Marcel Kolaja) (#1233182)
  - do not abort when missing hash algorithm in FIPS mode (#1078962)


author: Simon Lukasik <slukasik@redhat.com> - 1.3.0-6
changelog:
  - Resolve multilib conflict of gpgme-config (#341351)
  - Resolve multilib conflict of gpgme.h (#341351)


author: Tomas Mraz <tmraz@redhat.com> - 1.3.2-1
changelog:
  - new upstream version
  - re-enable gpg tests (original patch by John Morris <john@zultron.com>)
  - quiet configure warning 'could not find g13'
  - there is no libgpgme-pth anymore


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-16
changelog:
  - fix CVE-2018-0495 - ROHNP - Key Extraction Side Channel on DSA, ECDSA
  - fix incorrect error message on FIPS DSA parameter generation (#1603597)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-17
changelog:
  - use SHA-256 in FIPS RSA pairwise key check
  - fix CVE-2018-5407 (and CVE-2018-0735) - EC signature local
    timing side-channel key extraction


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-18
changelog:
  - fix CVE-2018-0734 - DSA signature local timing side channel
  - fix CVE-2019-1559 - 0-byte record padding oracle
  - close the RSA decryption One & done EM side channel (#1619558)


author: Michael Schwendt <mschwendt@fedoraproject.org> - 2.0.7-19
changelog:
  - Build with -D_FILE_OFFSET_BITS=64 to get stat64 in pth_high.c
  - Guard the ARM CFLAGS sed substitution.


author: Toshio Kuratomi <toshio@fedoraproject.org> - 0.3-1
changelog:
  - New upstream release
  - Build a python3 subpackage
  - Run the test suite even though we ignore the output


author: Miloslav Trmač <mitr@redhat.com> - 0.3-5
changelog:
  - Disable -fstrict-aliasing (see http://www.python.org/dev/peps/pep-3123/ for
    rationale)
  - Don't ship .pyc files from the test suite in %doc, to avoid multilib
    conflicts


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-84
changelog:
  - Disallow control chars in http URLs
  - Fixes CVE-2019-9740 and CVE-2019-9947
  Resolves: rhbz#1704362 and rhbz#1703530


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-90
changelog:
  - Avoid infinite loop when reading specially crafted TAR files (CVE-2019-20907)
  Resolves: rhbz#1856481


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-91
changelog:
  - Security fixes for CVE-2020-26116, CVE-2020-26137 and CVE-2022-0391
  - Test fixes for the latest expat security release
  - Update the certificates utilized in the test suite
  Resolves: rhbz#1883014, rhbz#1883632, rhbz#2047376, rhbz#1896494


author: Kamil Dudka <kdudka@redhat.com> - 7.19.0-15
changelog:
  - allow to return -1 from the write callback (#857875) 
  - remove the patch for curl-config --static-libs no longer needed
  - run the tests against the just built pycurl, not the system one


author: Marcin Zajaczkowski <mszpak ATT wp DOTT pl> - 0.5.0-5
changelog:
  - remove prodive/obsolete of python-xattr (bug 781838)
  - fix problem with mixed use of tabs and spaces


author: Patsy Griffin <patsy@redhat.com> - 2022b-1
changelog:
  - Rebase to tzdata-2022b
    - Chile transitions to DST on 2022-09-11, not 2022-09-04
    - 'make install' now defaults LOCALTIME to Factory rather than GMT
    - More zones that are the same since 1970 have been moved to backzone.
    - Include patch for awk workaround.


author: Patsy Griffin <patsy@redhat.com> - 2022c-1
changelog:
  - Rebase to tzdata-2022c - supersedes tzdata-2022b
    - Add a work-around for an awk bug in FreeBSD, macOS, etc.
    - Improve tzselect with respect to intercontinental Zones.


author: Michal Domonkos <mdomonko@redhat.com> - 3.4.3-162
changelog:
  - downloadonly: unlink .tmp files on ctrl-c
  - Resolves: bug#1410234
  - Fix calculation of uncleaned disk space after "yum clean all"
  - Resolves: bug#1645173
  - Speed up depsolving in Anaconda for large transactions
  - Resolves: bug#1600383


author: Michal Domonkos <mdomonko@redhat.com> - 3.4.3-164
changelog:
  - Do not reinstall local installonly packages
  - Resolves: bug#1689025
  - Fix traceback when every provider conflicts with requiring package
  - Resolves: bug#1713649
  - Gracefully handle empty RPM error list during transaction test
  - Resolves: bug#1690376
  - Gracefully handle self-conflicts during reinstall
  - Resolves: bug#1564747
  - yumRepo: migrate more prints to logging
  - Resolves: bug#1510495


author: Michal Domonkos <mdomonko@redhat.com> - 3.4.3-166
changelog:
  - docs: yum command argument is not optional
  - Resolves: bug#1573154
  - updateinfo: suggest command for --verbose if bad duplicate
  - Resolves: bug#1645618


author: Pavla Kratochvilova <pkratoch@redhat.com> - 3.4.3-168
changelog:
  - Fix typo sig_typ -> sig_type
  - Resolves: bug#1778763
  - Check for revoked subkeys before checking the signature
  - Resolves: bug#1778784


author: CentOS Sources <bugs@centos.org> - 3.4.3-168.el7.centos
changelog:
  - CentOS yum config
  -  use the CentOS bug tracker url
  -  retain installonly limit of 5
  -  ensure distrover is always from centos-release
  - Make yum require yum-plugin-fastestmirror


author: Michal Domonkos <mdomonko@redhat.com> - 1.1.31-47
changelog:
  - repotrack: add --repofrompath option
  - Resolves: bug#1506205
  - reposync: check for .. in remote paths
  - Resolves: bug#1552328


author: Michal Domonkos <mdomonko@redhat.com> - 1.1.31-50
changelog:
  - yum-config-manager: additional fixes for --add-repo
  - Related: bug#1493489
  - repotrack: print error instead of traceback on unavailable --repofrompath
  - Related: bug#1506205
  - versionlock: note default value of show_hint in man page
  - Related: bug#1497351


author: Michal Domonkos <mdomonko@redhat.com> - 1.1.31-53
changelog:
  - repotrack: fix --repofrompath for non-root users
  - Related: bug#1659588
  - repotrack: copy local packages
  - Related: bug#1463723
  - needs-restarting: clarify exit code in help and man page
  - Related: bug#1630197


author: Jindrich Novy <jnovy@redhat.com> - 1:1.22.1-30.gitb507039
changelog:
  - temporary disable s390x arch due to #1773504 causing fuse-overlayfs
    failing to build - skopeo/contaners-common requires it


author: Jindrich Novy <jnovy@redhat.com> - 1:1.22.1-33.gitb507039
changelog:
  - /var/lib/atomic to be a symlink to /var/lib/containers
    provided by skopeo (containers-common subpackage)
  - Resolves: #1817605


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-3
changelog:
  - Fix typos in test/dispol
  - Set flex as default lexer
  - Fix checkmodule output message
  - Build policy on systems not supporting DCCP protocol
  - Fail if module name different than output base filename


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-6
changelog:
  - Add ibendport ocontext handling
  - Add support for ibendportcon labels
  - Add ibpkey ocontext handling
  - Add support for ibpkeycon labels
  - Add binary module support for xperms


author: Dan Walsh <dwalsh@fedoraproject.org> - 2.76-1
changelog:
  - Allow containers to use fuse file systems by default
  - Allow containers to sendto dgram socket of container runtimes
  - Needed to run container runtimes in notify socket unit files.


author: Dan Walsh <dwalsh@redhat.com> - 0.2.0-1
changelog:
  - Add License
  - Add compatibility mode flag to only do docker specific stuff if INPUTFILE
  not specified.
  - Minor Bug fixes for non docker use cases


author: Lokesh Mandvekar <lsm5@redhat.com> - 0.9.0-1.rhel75.gite0997c3
changelog:
  - Resolves: #1475625
  - bump to v0.9.0
  - built commit e0997c3
  - include 'rhel75' string in release field to differentiate from rhel 7.4


author: Jindrich Novy <jnovy@redhat.com> - 1:0.1.40-7
changelog:
  - fix "CVE-2020-8945 proglottis/gpgme: Use-after-free in GPGME bindings during container image pull"
  - Resolves: #1806944


author: Jindrich Novy <jnovy@redhat.com> - 1:0.1.40-10
changelog:
  - fix "CVE-2020-1702 skopeo: containers/image: Container images read entire image manifest into memory"
  - Resolves: #1810613


author: Rex Dieter <rdieter@fedoraproject.org> - 1.1.1-3
changelog:
  - python3-dbus subpkg (#892474)
  - (main) Provides: python-dbus
  - BR: python-docutils
  - .spec cosmetics
  - skip failed tests on rawhide (#913936)


author: Colin Walters <walters@redhat.com> - 1.1.1-9
changelog:
  - Move modules to libdir to avoid multilib conflicts
  - And comment out test suite, since we were not actually
    failing if it failed, but it trips up an rpmdiff check
    on the output of the suite.
  - Resolves: #1076411


author: Marian Csontos <mcsontos@redhat.com> - 0.7.3-1
changelog:
  - Update to latest bugfix and documentation update release.
  - *_restore tools wipe superblock as a last resort.
  - Add thin_check --override-mapping-root.


author: Lianbo Jiang <lijiang@redhat.com> - 1:3.2-4
changelog:
  - Fix System Slot Information for PCIe SSD
  - Resolves: rhbz#1793900
  - Sync with upstream(commit:62bce59fed1)
  - Resolves: rhbz#1767323


author: Lokesh Mandvekar <lsm5@redhat.com> - 2:1.13.1-101.git61c8524
changelog:
  - Resolves: #1492113, #1653292
  - built docker @projectatomic/docker-1.13.1-rhel commit 61c8524
  - built docker-containerd @projectatomic/docker-1.13.1-rhel commit 9c53e35


author: Lokesh Mandvekar <lsm5@redhat.com> - 2:1.13.1-104.git4ef4b30
changelog:
  - Resolves: #1653292, #1741718, #1739315, #1733941
  - built docker @projectatomic/docker-1.13.1-rhel commit 4ef4b30


author: Jindrich Novy <jnovy@redhat.com> - 2:1.13.1-106.git4ef4b30
changelog:
  - fix "libcontainerd: failed to receive event from containerd:" error (#1636244)
  - fix "Pods stuck in terminating state with rpc error: code = 2" (#1653292)
  - fix "Docker panics when performing `docker search` due to potential
    Search bug when using multiple registries" (#1732626)
  - fix race condition in kubelet cgroup destroy process (#1766665)


author: Jindrich Novy <jnovy@redhat.com> - 2:1.13.1-109.gitcccb291
changelog:
  - use runc sources off 66aedde7 commit in docker-1.13.1-rhel branch (#1793486)
  - use docker sources off cccb291 commit in docker-1.13.1-rhel branch
  - do not use CollectMode systemd property in RHEL7
  - whitelist statx(2) syscall in docker (#1784228)
  - assure thread safety for gpgme library (#1792243)


author: Jindrich Novy <jnovy@redhat.com> - 2:1.13.1-203.git0be3e21
changelog:
  - do not enable CollectMode support yet because it is not still present in
    7.6-ALT
  - Related: #1766665


author: Jindrich Novy <jnovy@redhat.com> - 2:1.13.1-205.git7d71120
changelog:
  - fix mounting volume with incorrect permission
  - fix dockerd leaking SELinux MCS labels
  - Resolves: #1734482
  - Resolves: #1896883


author: Jindrich Novy <jnovy@redhat.com> - 2:1.13.1-208.git7d71120
changelog:
  - propagate mounts to the host - fix regression introduced by fix of CVE-2021-30465
  - Resolves: #1966968


author: Jindrich Novy <jnovy@redhat.com> - 2:1.13.1-209.git7d71120
changelog:
  - update to runc-8891bca22c049cd2dcf13ba2438c0bac8d7f3343
  - update to containerd-46b69ea4c3d2d965e2116ef47e20e5584a3c2741
  - apply https://github.com/projectatomic/runc/pull/56
  - drop applied patches
  - Related: #2000782


author: Jindrich Novy <jnovy@redhat.com> - 0.4.1-3
changelog:
  - temporarily remove s390x arch from supported arches due to
    missing renameat2 syscall
  - Related: #1721151


author: Jindrich Novy <jnovy@redhat.com> - 0.7.2-5
changelog:
  - upstream patch when applied to the 0.7.2 source code is applied to the wrong function,
    new patch fixes it
  - Resolves: #1805013


author: Jindrich Novy <jnovy@redhat.com> - 0.7.2-6
changelog:
  - fix "Pushing container image built with rootless podman fails with: "file integrity checksum failed""
  - Resolves: #1810498


author: Dave Dykstra <dwd@fedoraproject.org> - 3.4.2-4
changelog:
  - Bump release number in order to larger than a rebuild of fuse package
    done before separation pull request was merged.


author: Jeff Moyer <jmoyer@redhat.com> - 0.3.109-8
changelog:
  - Change the source location to the new upstream on fedorahosted
  - import a new tarball from the new source


author: Jeff Moyer <jmoyer@redhat.com> - 0.3.109-10
changelog:
  - Un-revert the RHEL-specific changes. (Jeff Moyer)
  - Make devel sub-package depend on specific ver-rel (Jeff Moyer)
  - Resolves: bz#905462


author: Jeff Moyer <jmoyer@redhat.com> - 0.3.109-12.2
changelog:
  - Get rid of sparc support (we don't build it) (Jeff Moyer)
  - Implement proper support for aarch64 (Jeff Moyer)
  - Resolves: bz#1026429


author: Nikola Forró <nforro@redhat.com> - 0.41-12
changelog:
  - resolves: #1406927
    start cgred service after nss-user-lookup target
    show warnings about unsuccessful user/group lookups


author: Nikola Forró <nforro@redhat.com> - 0.41-17
changelog:
  - show warning when "tasks" file can not be opened
  - extend description of "controllers" section in cgrules.conf man page
    resolves: #1561736


author: Dan Williams <dcbw@redhat.com> - 1.1-14
changelog:
  - Fix portmap position calculation (rh #677526) (rh #677725)
  - Make port allocation threadsafe (rh #677527) (rh #677724)


author: Dan Walsh <dwalsh@redhat.com> - 0.3.3-7
changelog:
  - Add secolor.conf.5 man page
  - Make mcstransd watch for content being written to /run/setrans for files names containing translations.
  -- This will allow apps like libvirt to write content nameing randomly selected MCS labels
  - Fix memory leak in mcstransd


author: Daniel Walsh <dwalsh@redhat.com> - 0-5.13.git
changelog:
  - Disable this hook by default.
  - Not many people are using it, and it is causing some issues with Docker.


author: Dan Walsh <dwalsh@redhat.com> - 1:0.1.15-1.git
changelog:
  - Fix issue with oci-systemd-hook running in user namespaces
  - fix json file to run container with proper stage field.


author: Brian C. Lane <bcl@redhat.com> 3.1-23
changelog:
  - libparted: Use read only when probing devices on linux
    Resolves: rhbz#1245144
  - tests: Use wait_for_dev_to_ functions
    Related: rhbz#1245144


author: Brian C. Lane <bcl@redhat.com> 3.1-24
changelog:
  - tests: Add udevadm settle to wait_for_ loop
    Related: rhbz#1260664
  - tests: Add-wait-to-t9042
    Resolves: rhbz#1257415
  - tests: Fix t1700 failing on a host with a 4k xfs file
    Related: rhbz#1260664


author: Brian C. Lane <bcl@redhat.com> 3.1-25
changelog:
  - docs: Add list of filesystems for fs-type
    Resolves: rhbz#1311596
  - libparted: Remove fdasd geometry code from alloc_metadata
    Resolves: rhbz#1244833


author: Brian C. Lane <bcl@redhat.com> - 3.1-29
changelog:
  - Add support for NVMe devices
    Resolves: rhbz#1316239
  - Backport partition resize command
    Resolves: rhbz#1423357


author: Brian C. Lane <bcl@redhat.com> - 3.1-30
changelog:
  - partprobe: always close dev when probing disks
    Resolves: rhbz#1551411
  - tests: Add t4201 to test partprobe with 1025 devices
    Related: rhbz#1551411


author: Brian C. Lane <bcl@redhat.com> - 3.1-31
changelog:
  - Backport patches for dasd on virtio
    fdasd: geometry handling updated from upstream s390-tools
    dasd: enhance device probing
    parted: fix build error on s390
    fdasd.c: Safeguard against geometry misprobing
    Resolves: rhbz#1676604
  - Add part-label documentation to mkpart command
    Resolves: rhbz#1686659


author: Tomas Mraz <tmraz@redhat.com> 0.78.99-1
changelog:
  - use better (auditable) libselinux calls for checking
    the access to passwd (#518268)
  - add support for the -e option as seen on Debian passwd
  - make the binary PIE and full RELRO (#784483)


author: Jiri Kucera <jkucera@redhat.com> - 0.79-5
changelog:
  - Backport ca46cac (allow passwords longer than 79 characters)
    Backport Steve Grubb's patches
    - stop double auditing, use appropriate record types, update op field in
      audit events, don't audit status check, fix password aging logging
    Backport 02d4478 (better document -S option)
    Fix URL and Source tags
    Resolves: #1276570, #1489086, #1638105, #1145256, #1472567


author: Jiri Kucera <jkucera@redhat.com> - 0.79-6
changelog:
  - Fix incorrect -S output when password field in /etc/passwd is empty but the
    password information in /etc/shadow is set
    Resolves: #1686436


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-30
changelog:
  - semanage/seobject: Fix listing boolean values (#1391605)
  - sepolicy: Make policy files sorting more robust
  - semanage: Fix setting alternative policy store (#1558033)
  - semanage: Load a store policy and set the store SELinux policy root
  - sepolicy: Add sepolicy.load_store_policy(store)
  - semanage: import sepolicy only when it's needed
  - semanage: move valid_types initialisations to class constructors
  - semanage/seobject: Fix indentation issues
  - scripts/fixfiles: Do not fail on file_contexts.local (#1647714)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-31
changelog:
  - semanage: Start exporting "ibendport" and "ibpkey" entries (#1657196)
  - semanage: Do not show "None" levels when using a non-MLS policy (#1400482)
  - semanage: Include MCS/MLS range when exporting local customizations (#1400482)


author: Matt Domsch <mdomsch@fedoraproject.org> - 0.70-1
changelog:
  - Version 0.70 (2009-10-29)
    * New "major" version because it may break compatibility
    * Fix __cmp__(): IP('0.0.0.0/0') and IP('0.0.0.0') are not equal
    * Fix IP.net() of the network "::/0": "::" instead of "0.0.0.0".
      IPy 0.63 should fix this bug, but it wasn't.


author: Matt Domsch <mdomsch@fedoraproject.org> - 0.75-1
changelog:
  - Version 0.75 (2011-04-12)
   * IP('::/0').netmask() gives IP('::') instead of IP('0.0.0.0') (BZ#690625)
   * Fix tests for Python 3.1 and 3.2
   * ip.__nonzero__() and (ipa in ipb) return a bool instead of 0 or 1
   * IP('0.0.0.0/0') + IP('0.0.0.0/0') raises an error, fix written by Arfrever
   * Support Python 3: setup.py runs 2to3
   * Update the ranges for IPv6 IPs
   * Fix reverseName() and reverseNames() for IPv4 in IPv6 addresses
   * Drop support of Python < 2.5
   * Include examples and MANIFEST.in in source build (add them to MANIFEST.in)
   * Remove __rcsid__ constant from IPy module
   * Use xrange() instead of range()
   * Use isinstance(x, int) instead of type(x) == types.IntType
   * Prepare support of Python3 (use integer division: x // y)
   * Fix IP(long) constructor: ensure that the address is not too large
   * Constructor raise a TypeError if the type is not int, long, str or unicode
   * 223.0.0.0/8 is now public (belongs to APNIC)


author: Rahul Sundaram <sundaram@fedoraproject.org> - 1.5-1
changelog:
  - New upstream release
  - Fix UTF8 encoding correctly
  - Drop buildroot, clean, defattr and use macro for Source


author: Bohuslav Kabrda <bkabrda@redhat.com> - 0.8-2
changelog:
  - Fixed reporting of more IPv4 addresses per interface
  Resolves: rhbz#1027685
  - Make get_active_devices() return IPv6-only devices, too
  Resolves: rhbz#1027678


author: Bohuslav Kabrda <bkabrda@redhat.com> - 0.8-1
changelog:
  - Switch source from distribute to setuptools, that are now uptodate and supported.
  - Update to setuptools 0.8.0.
  - Specfile cleanup (unnecessary Python 3 logic, old RPM stuff, bogus changelog dates)


author: Christopher Snyder <csnyder@redhat.com> 1.24.42-1
changelog:
  - 1848636, 1849074: Update insights machine-id path (csnyder@redhat.com)
  - 1796833: Update translations (csnyder@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 1.24.43-1
changelog:
  - 1826300: Ignore auto-attach, when SCA mode is used
    (jhnidek@redhat.com)
  - 1850919: False positive log "rhsmd process exceeded runtime and was killed."
    (wpoteat@redhat.com)
  - 1868936: Do not print traceback, when profile upload failed
    (wpoteat@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 1.24.46-1
changelog:
  - 1896715: Set proper read permissions on certs (#2466) (wpoteat@redhat.com)
  - 1935592: Fix getting releases, when SCA is used (jhnidek@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 1.24.49-1
changelog:
  - 2010137: Fix redundant API calls to Candlepin (hyu@redhat.com)
  - [1.24] Added support for marketplace ID on RHEL7. (jhnidek@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 1.24.51-1
changelog:
  - 1.24 Add gcp_license_codes to system facts. (jhnidek@redhat.com)
  - 1.24 Fix of automatic registration (jhnidek@redhat.com)
  - [1.24] Backport support for GCP marketplace ID (jhnidek@redhat.com)
  - [1.24] Backported automatic registration (jhnidek@redhat.com)
  - Back-ported cloud-what for Python 2.7 (jhnidek@redhat.com)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-261
changelog:
  - Update sudo_role_template() to allow caller domain to read syslog pid files
  Resolves: rhbz#1651253


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-264
changelog:
  - Allow tmpwatch process labeled as tmpreaper_t domain to execute fuser command
  Resolves: rhbz#1765063


author: Zdenek Pytela <zpytela@redhat.com> - 3.13.1-267
changelog:
  - Allow chronyd_t domain to exec shell
  Resolves: rhbz#1775573
  - Allow pmie daemon to send signal pcmd daemon
  Resolves: rhbz#1770123
  - Allow auditd poweroff or switch to single mode
  Resolves: rhbz#1780332


author: Zdenek Pytela <zpytela@redhat.com> - 3.13.1-268
changelog:
  - Allow rhsmd read process state of all domains and kernel threads
  Resolves: rhbz#1837461
  - Allow ipa-adtrust-install restart sssd and dirsrv services
  Resolves: rhbz#1820298
  - Allow nagios_plugin_domain execute programs in bin directories
  Resolves: rhbz#1824625
  - selinux policy: add the right context for org.freeipa.server.trust-enable-agent
  Related: rhbz#1820298


author: Zdenek Pytela <zpytela@redhat.com> - 3.13.1-268.2
changelog:
  - Allow certmonger add new entries in a generic certificates directory
  Resolves: rhbz#1879496
  - Allow slapd add new entries in ldap certificates directory
  Resolves: rhbz#1879496
  - Add miscfiles_add_entry_generic_cert_dirs() interface
  Resolves: rhbz#1879496


author: dwalsh <dwalsh@redhat.com> - 0.1.25-2.git2e8377a7
changelog:
  -  Add manifest type conversion to skopeo copy
  -  User can select from 3 manifest types: oci, v2s1, or v2s2
  -   e.g skopeo copy --format v2s1 --compress-blobs docker-archive:alp.tar dir:my-directory


author: dwalsh <dwalsh@redhat.com> - 0.1.29-2.git
changelog:
  - bump to 0.1.29-1
  - Updated containers/image
      docker-archive generates docker legacy compatible images
      Do not create $DiffID subdirectories for layers with no configs
      Ensure the layer IDs in legacy docker/tarfile metadata are unique
      docker-archive: repeated layers are symlinked in the tar file
      sysregistries: remove all trailing slashes
      Improve docker/* error messages
      Fix failure to make auth directory
      Create a new slice in Schema1.UpdateLayerInfos
      Drop unused storageImageDestination.{image,systemContext}
      Load a *storage.Image only once in storageImageSource
      Support gzip for docker-archive files
      Remove .tar extension from blob and config file names
      ostree, src: support copy of compressed layers
      ostree: re-pull layer if it misses uncompressed_digest|uncompressed_size
      image: fix docker schema v1 -> OCI conversion
      Add /etc/containers/certs.d as default certs directory


author: systemd maintenance team <systemd-maint@redhat.com> - 219-76
changelog:
  - core: enforce a ratelimiter when stopping units due to StopWhenUnneeded=1 (#1775291)
  - core: rework StopWhenUnneeded= logic (#1775291)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-77
changelog:
  - core: coldplug possible nop_job (#1829754)
  - core: make sure to restore the control command id, too (#1828953)


author: Miloslav Trmač <mitr@redhat.com> - 1.110-1
changelog:
  - Update to usermode-1.110.
    Note that this drops halt/poweroff/reboot helpers, the respective
    implementations in systemd now include PolicyKit support.  Spec file change
    based on a patch by Lennart Poettering <lpoetter@redhat.com>.
    Resolves: #804088, #849208


author: Jiri Kucera <jkucera@redhat.com> - 1.111-6
changelog:
  - Fix inconsistent capitalization in userhelper.8
    Fix URL and Source
    Fix bogus dates
    Resolves: #1349840, #1502441


author: Richard W.M. Jones <rjones@redhat.com> - 1.13-7
changelog:
  - Add support for detecting POWER KVM and LPAR
    resolves: rhbz#1147876
  - Detect RHEV/oVirt
    resolves: rhbz#1249438
  - Detect ACPI boot aarch64 guest
    resolves: rhbz#1275349
  - Fix typo in manual page
    resolves: rhbz#1099289


author: Richard W.M. Jones <rjones@redhat.com> - 1.18-2
changelog:
  - Rebase to Fedora Rawhide / upstream version.
  - Include upstream patches since 1.18 was released.
    resolves: rhbz#1476878


author: Eric Sandeen <sandeen@redhat.com> 4.5.0-13
changelog:
  - mkfs.xfs: clarify ftype defaults in manpage (#1488124)
  - mkfs.xfs: allow specification of 0 data stripe width (#1444166)
  - mkfs.xfs: Don't stagger AG for a single disk (#1492552)
  - xfs_db: xfs_db-update-buffer-size-when-new-type-is-set (#1458670)


author: Eric Sandeen <sandeen@redhat.com> 4.5.0-16
changelog:
  - xfs_db: fix the source command when passed as -c option (#1510279)
  - xfs_metadump: allow much larger extent counts (#1502927)
  - xfs_db: fix crash when field list selector has garbage (#1532271)
  - mkfs.xfs, others: don't stat non-block devices on startup (#1573974)
  - Update project URLs throughout the pkg, code and docs (#1550798)


author: Eric Sandeen <sandeen@redhat.com> 4.5.0-20
changelog:
  - xfs_quota: fix errors if project flag is not set on regular files (#1663502)
  - xfs_repair: initialize non-leaf finobt blocks with correct magic (#1670154)


author: Eric Sandeen <sandeen@redhat.com> 4.5.0-21
changelog:
  - mkfs.xfs: make device discard interruptable, print notice (#1769786)
  - xfs_io: remove +/-x flag from chattr, not supported in kernel (#1630112)
  - xfs_metadump: fix symlink handling (#1693138)


author: Daniel P. Berrange <berrange@redhat.com> - 2.0.4-1
changelog:
  - Update to 2.0.4 release (rhbz #845777)
  - Fix License tag to reflect change in 2.0.0 series from BSD to ISC


author: Sebastiaan van Stijn <thajeztah@docker.com> - 1.6.11-3.1
changelog:
  - Update containerd to v1.6.11
  - Update Golang runtime to 1.18.9, which includes fixes for CVE-2022-41717,
    CVE-2022-41720, and CVE-2022-41720.


author: Sebastiaan van Stijn <thajeztah@docker.com> - 1.6.18-3.1
changelog:
  - update containerd binary to v1.6.18, which includes fixes for CVE-2023-25153
    and CVE-2023-25173.
  - update Golang runtime to 1.19.6, which includes fixes for CVE-2022-41722,
    CVE-2022-41725, CVE-2022-41724, and CVE-2022-41723.


author: Phil Sutter - 1.4.21-27
changelog:
  - libxt_tcpmss: Detect invalid ranges (RHBZ#1128510)
  - ip(6)tables-save/restore: Exit if invalid option was given (RHBZ#1465078)
  - ip(6)tables-save/restore: Require value to -W option (RHBZ#1465078)
  - ip(6)tables-save/restore: Don't accept -W without -w (RHBZ#1465078)
  - Ignore security table when setting policies (RHBZ#1494012)
  - Fix spec file changing SRPM content (RHBZ#1531290)


author: Phil Sutter - 1.4.21-29
changelog:
  - Do not attempt to unload any modules when stopping the firewall (RHBZ#1520534)
  - Fix for covscan warnings (RHBZ#1525980)


author: Phil Sutter <psutter@redhat.com> - 1.4.21-31
changelog:
  - Fix iptables-restore with empty comment in rule (RHBZ#1668475)
  - Fix parsing and printing of -m ipvs --vproto option (RHBZ#1679726)
  - Fix for wrong location of devgroup definition file (RHBZ#1657075)
  - Fix for non-numeric devgroup name output (RHBZ#1657075)
  - Reject negative realm values (RHBZ#1657075)


author: Phil Sutter <psutter@redhat.com> - 1.4.21-34
changelog:
  - Fix iptables-restore for rules with '-' and 't' in comments (RHBZ#1749700)
  - Make services start before network-pre.target is reached (RHBZ#1736765)


author: Sebastiaan van Stijn <thajeztah@docker.com> - 1.6.20-3.1
changelog:
  - update containerd binary to v1.6.20.
  - update runc binary to v1.1.5, which includes fixes for CVE-2023-25809,
    CVE-2023-27561, and CVE-2023-28642.


author: Sebastiaan van Stijn <thajeztah@docker.com> - 1.6.21-3.1
changelog:
  - update containerd binary to v1.6.21
  - update runc binary to v1.1.7
  - Update Golang runtime to 1.19.9


author: Sebastiaan van Stijn <thajeztah@docker.com> - 1.6.22-3.1
changelog:
  - update containerd binary to v1.6.22
  - update runc binary to v1.1.8
  - Update Golang runtime to 1.19.11


author: Sebastiaan van Stijn <thajeztah@docker.com> - 1.6.24-3.1
changelog:
  - update containerd binary to v1.6.24
  - update runc binary to v1.1.9
  - Update Golang runtime to 1.20.8


author: Sebastiaan van Stijn <thajeztah@docker.com> - 1.6.25-3.1
changelog:
  - update containerd binary to v1.6.25
  - update runc binary to v1.1.10
  - Update Golang runtime to 1.20.10


author: Sebastiaan van Stijn <thajeztah@docker.coml> - 1.6.27-3.1
changelog:
  - update containerd binary to v1.6.27
  - update runc binary to v1.1.11
  - Update Golang runtime to 1.20.13


author: Steve Grubb <sgrubb@redhat.com> 2.7.8-1
changelog:
  resolves: #1406887 - auditd validate_email uses obsolete gethostbyname
  resolves: #1448526 - aureport shows the wrong auid "-1"
  resolves: #1475998 - python audit crash if when using AUSOURCE_FILE_POINTER
  resolves: #1482121 - python audit crash dereferencing auparse_state_t le field


author: Steve Grubb <sgrubb@redhat.com> 2.8.1-1
changelog:
  resolves: #982154 - Can't find the "avc" event with the auvirt command
  resolves: #1101605 - Ipv6 seems no working
  resolves: #1399314 - Allow non-equality comparisons for uid and gid fields
  resolves: #1455598 - Default port is wrong in audisp-remote.conf
  resolves: #1476406 - Audit package rebase


author: Sebastiaan van Stijn <thajeztah@docker.com> - 1.6.28-3.1
changelog:
  - update containerd binary to v1.6.28.
  - update runc binary to v1.1.12, which includes fixes for CVE-2024-21626.


author: Sebastiaan van Stijn <thajeztah@docker.com> - 1.6.33-3.1
changelog:
  - Update containerd binary to v1.6.33
  - Update Golang runtime to 1.21.11, which includes fixes for CVE-2024-24789, CVE-2024-24790.


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-20
changelog:
  - setfiles: Mention customizable types in restorecon man page (#1260238)
  - sepolicy: do not fail when file_contexts.local or .subs do not exist (#1512590)
  - semanage: Fix export of ibendport entries (#1471809)


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-22
changelog:
  - semanage: Fix fcontext help message (#1499259)
  - semanage: Improve semanage-user.8 man page (#1079946)
  - semodule: Improve man page (#1337192)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-23
changelog:
  - Update translation files and remove empty ones (#1375915)
  - sepolicy: Fix sepolicy manpage (#1509383)
  - semanage/seobject: Fix moduleRecords.modify() (#1408331)
  - semodule: Improve man page and unify it with --help (#1320565)
  - setfiles: Improve description of -d switch (#1271327)
  - sepolgen: Try to translate SELinux contexts to raw (#1356149)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-24
changelog:
  - Stop rejecting SCTP and DCCP in sepolicy.info
  - semanage: Replace bare except with specific one (#1598444)
  - semanage: Fix logger class definition (#1598444)
  - semanage: Stop rejecting aliases in semanage commands (#1544793)
  - sepolicy: Stop rejecting aliases in sepolicy commands (#1600009)
  - semanage: Stop logging loginRecords changes (#1294663)
  - Use file_contexts.local in fixfiles restore (#1559808)


author: liudingyao<liudingyao@kylinos.cn> - 2.7.5-94.ns7.01
changelog:
  - Type: Tasks#196628
  - ID: NA
  - SUG: NA
  - DESC: add Patch1000: 01000-Kylin_recommend_2_socket_check.patch


author: Phil Sutter - 1.4.21-20
changelog:
  - Prevent iptables.service and ip6tables.service from running in parallel
    (RHBZ#1486803)
  - Don't restart services upon upgrade (RHBZ#1380141)


author: Phil Sutter - 1.4.21-25
changelog:
  - Fix for stopping iptables and ip6tables at the same time (RHBZ#1560012)
  - Propagate errors on service stop (RHBZ#1560012)


author: NVIDIA CORPORATION <cudatools@nvidia.com> 1.13.0-rc.1-1
changelog:
  - Include all `gsp*.bin` firmware files if present
  - Align `.deb` and `.rpm` release candidate package versions


author: NVIDIA CORPORATION <cudatools@nvidia.com> 1.13.0-rc.3-1
changelog:
  - Fix segmentation fault when RPC initialization fails.
  - Build centos variants of the NVIDIA Container Library with static libtirpc v1.3.2.
  - Remove make targets for fedora35 as the centos8 packages are compatible.


author: NVIDIA CORPORATION <cudatools@nvidia.com> 1.13.5-1
changelog:
  - See https://gitlab.com/nvidia/container-toolkit/container-toolkit/-/blob/6b8589dcb4dead72ab64f14a5912886e6165c079/CHANGELOG.md
  - Bump libnvidia-container dependency to libnvidia-container-tools >= 1.13.5-1


author: NVIDIA CORPORATION <cudatools@nvidia.com> 2.13.0-1
changelog:
  - As of 2.7.0-1 the package changelog is generated automatically. This means that releases since 2.7.0-1 all contain this same changelog entry updated for the version being released.
  - Bump nvidia-container-toolkit dependency to 1.13.0-1
  - Docker dependency to docker-ce >= 18.06.3.ce-3.el7


author: Ivan Vecera <ivecera@redhat.com> - 2:4.8-2
changelog:
  - Added support for configurable RSS hash function
  - Fixed SFF 8079 cable technology bit parsing
  - Added support for HWTSTAMP_FILTER_NTP_ALL


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.79.1.el7]
changelog:
  - x86/speculation: Add LFENCE to RSB fill sequence (Rafael Aquini) [2115073] {CVE-2022-26373}
  - x86/speculation: Protect against userspace-userspace spectreRSB (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/speculation: cope with spectre_v2=retpoline cmdline on retbleed-affected Intel CPUs (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - KVM: emulate: do not adjust size of fastop and setcc subroutines (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/kvm: fix FASTOP_SIZE when return thunks are enabled (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/speculation: Disable RRSBA behavior (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/kexec: Disable RET on kexec (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/bugs: Do not enable IBPB-on-entry when IBPB is not supported (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/bugs: Add Cannon lake to RETBleed affected CPU list (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/cpu/amd: Enumerate BTC_NO (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/common: Stamp out the stepping madness (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/cpu/amd: Add Spectral Chicken (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/bugs: Do IBPB fallback check only once (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/bugs: Add retbleed=ibpb (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/bugs: Report Intel retbleed vulnerability (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/bugs: Enable STIBP for JMP2RET (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/bugs: Add AMD retbleed= boot parameter (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/bugs: Report AMD retbleed vulnerability (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86: Add magic AMD return-thunk (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86: Use return-thunk in asm code (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/sev: Avoid using __x86_return_thunk (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/vsyscall_emu/64: Don't use RET in vsyscall emulation (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/kvm: Fix SETcc emulation for return thunks (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86,objtool: Create .return_sites (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86: Undo return-thunk damage (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/retpoline: Use -mfunction-return (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/cpufeatures: Move RETPOLINE flags to word 11 (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - objtool: Add ELF writing capability (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86: Prepare asm files for straight-line-speculation (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86: Prepare inline-asm for straight-line-speculation (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/kvm: Fix fastop function ELF metadata (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/kvm: Move kvm_fastop_exception to .fixup section (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/vdso: Fix vDSO build if a retpoline is emitted (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/cpufeatures: Combine word 11 and 12 into a new scattered features word (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/cpufeatures: Carve out CQM features retrieval (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/cpufeatures: Re-tabulate the X86_FEATURE definitions (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/cpufeature: Move processor tracing out of scattered features (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/cpu: Probe CPUID leaf 6 even when cpuid_level == 6 (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/alternatives: Cleanup DPRINTK macro (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.80.1.el7]
changelog:
  - scsi: lpfc: Fix FCP I/O flush functionality for TMF routines (Dick Kennedy) [1969988]
  - scsi: lpfc: Fix illegal memory access on Abort IOCBs (Dick Kennedy) [1969988]
  - NFS: Fix extra call to dput() in nfs_prime_dcache (Benjamin Coddington) [2117856]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.81.1.el7]
changelog:
  - [netdrv] bnxt: don't lock the tx queue from napi poll (Jamie Bainbridge) [2110869]
  - [netdrv] bnxt_en: reverse order of TX disable and carrier off (Jamie Bainbridge) [2110869]
  - [netdrv] qede: confirm skb is allocated before using (Jamie Bainbridge) [2131145]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.82.1.el7]
changelog:
  - net: usb: ax88179_178a: Fix packet receiving (Jose Ignacio Tornos Martinez) [2120504] {CVE-2022-2964}
  - net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup (Jose Ignacio Tornos Martinez) [2120504] {CVE-2022-2964}
  - net: usb: Merge cpu_to_le32s + memcpy to put_unaligned_le32 (Jose Ignacio Tornos Martinez) [2120504] {CVE-2022-2964}
  - ax88179_178a: Merge memcpy + le32_to_cpus to get_unaligned_le32 (Jose Ignacio Tornos Martinez) [2120504] {CVE-2022-2964}
  - net: usb: ax88179_178a: fix packet alignment padding (Jose Ignacio Tornos Martinez) [2120504] {CVE-2022-2964}
  - mm: swap: disable swap_vma_readahead for PPC64 (Rafael Aquini) [2142455]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.83.1.el7]
changelog:
  - x86/sme: avoid using __x86_return_thunk (Rafael Aquini) [2122158]
  - scsi: core: Simplify control flow in scmd_eh_abort_handler() (Ewan D. Milne) [2128337]
  - scsi: core: Avoid leaving shost->last_reset with stale value if EH does not run (Ewan D. Milne) [2128337]
  - [netdrv] i40e: Fix freeing of uninitialized misc IRQ vector (Jamie Bainbridge) [2129248]
  - x86/speculation: Use generic retpoline by default on AMD (Rafael Aquini) [2062165] {CVE-2021-26401}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.84.1.el7]
changelog:
  - blk-mq: fix flush-rq race (Ming Lei) [2088029]
  - scsi: target: iscsi: Fix a race condition between login_work and the login thread (Maurizio Lombardi) [2154243]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.85.1.el7]
changelog:
  - sctp: do asoc update earlier in sctp_sf_do_dupcook_b (Xin Long) [2054037]
  - sctp: do asoc update earlier in sctp_sf_do_dupcook_a (Xin Long) [2054037]
  - sctp: handle errors when updating asoc (Xin Long) [2054037]
  - sctp: no need to check assoc id before calling sctp_assoc_set_id (Xin Long) [2054037]
  - s390/topology: fix warning when disabling cpus (Tobias Huschle) [2071980]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.86.1.el7]
changelog:
  - openvswitch: fix OOB access in reserve_sfa_size() (Rado Vrbovsky) [2141780] {CVE-2022-2639}
  - openvswitch: fix flow actions reallocation (Rado Vrbovsky) [2141780] {CVE-2022-2639}
  - gitlab-ci: use CI templates from production branch (Michael Hofmann)
  - mm: prevent page_frag_alloc() from corrupting the memory (Rafael Aquini) [2141062]
  - mm: Use fixed constant in page_frag_alloc instead of size + 1 (Rafael Aquini) [2141062]
  - mm: page_alloc: fix ref bias in page_frag_alloc() for 1-byte allocs (Rafael Aquini) [2141062]
  - x86/pat: Pass valid address to sanitize_phys() (Jeff Moyer) [1974485]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.87.1.el7]
changelog:
  - Revert "openvswitch: fix flow actions reallocation" (Rado Vrbovsky) [2141780] {CVE-2022-2639}
  - Revert "openvswitch: fix OOB access in reserve_sfa_size()" (Rado Vrbovsky) [2141780] {CVE-2022-2639}
  - kvm/emulate: Fix SETcc emulation function offsets with SLS (Vitaly Kuznetsov) [2143438]
  - mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse (Rafael Aquini) [2138620] {CVE-2022-42703}
  - mm, rmap: handle anon_vma_prepare() common case inline (Rafael Aquini) [2138620] {CVE-2022-42703}
  - proc: proc_skip_spaces() shouldn't think it is working on C strings (Wander Lairson Costa) [2152565] {CVE-2022-4378}
  - proc: avoid integer type confusion in get_proc_long (Wander Lairson Costa) [2152565] {CVE-2022-4378}
  - scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts (Nilesh Javali) [2092105]
  - fs: move S_ISGID stripping into the vfs_*() helpers (Andrey Albershteyn) [2159946] {CVE-2018-13405 CVE-2021-4037}
  - fs: Add missing umask strip in vfs_tmpfile (Andrey Albershteyn) [2159946] {CVE-2018-13405 CVE-2021-4037}
  - fs: add mode_strip_sgid() helper (Andrey Albershteyn) [2159946] {CVE-2018-13405 CVE-2021-4037}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.88.1.el7]
changelog:
  - KVM: x86: add bit to indicate correct tsc_shift (Marcelo Tosatti) [2152838]
  - KVM: x86: rewrite handling of scaled TSC for kvmclock (Marcelo Tosatti) [2152838]
  - KVM: x86: rename argument to kvm_set_tsc_khz (Marcelo Tosatti) [2152838]


author: Rex Dieter <rdieter@fedoraproject.org> - 1.0-2
changelog:
  - %files: track lib soname (so bumps aren't a surprise)
  - tighten subpkg deps (%_isa)
  - %build: --disable-static


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.111.1.el7]
changelog:
  - redhat: rewrite genlog and support Y- tags (Jan Stancek)
  - scsi: zfcp: Fix double free of FSF request when qdio send fails (Tobias Huschle) [RHEL-16335]
  - fbcon: set_con2fb_map needs to set con2fb_map! (Jocelyn Falempe) [RHEL-1204] {CVE-2023-38409}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.112.1.el7]
changelog:
  - net: sched: sch_qfq: Use non-work-conserving warning handler (Davide Caratti) [RHEL-14397]
  - net: sched: sch_qfq: Fix UAF in qfq_dequeue() (Davide Caratti) [RHEL-14397] {CVE-2023-4921}
  - cpufreq: Initialize policy->kobj while allocating policy (Waiman Long) [2161654]
  - net: bonding: fix possible NULL deref in rlb code (Hangbin Liu) [RHEL-17227]
  - net: bonding: fix use-after-free after 802.3ad slave unbind (Hangbin Liu) [RHEL-17227]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.113.1.el7]
changelog:
  - igb: set max size RX buffer when store bad packet is enabled (Wander Lairson Costa) [RHEL-15181] {CVE-2023-45871}
  - Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm (David Marlin) [RHEL-2742] {CVE-2022-42896}
  - Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM (David Marlin) [RHEL-2742] {CVE-2022-42896}
  - Bluetooth: Use separate L2CAP LE credit based connection result values (David Marlin) [RHEL-2742] {CVE-2022-42896}
  - Bluetooth: L2CAP: Fix L2CAP_CR_SCID_IN_USE value (David Marlin) [RHEL-2742] {CVE-2022-42896}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.114.1.el7]
changelog:
  - netfilter: nf_tables: reject QUEUE/DROP verdict parameters (Florian Westphal) [RHEL-23500] {CVE-2024-1086}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.115.1.el7]
changelog:
  - af_unix: Fix null-ptr-deref in unix_stream_sendpage(). (Guillaume Nault) [RHEL-16144] {CVE-2023-4622}
  - NFS: Set the stable writes BDI capability (Benjamin Coddington) [RHEL-22193]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.116.1.el7]
changelog:
  - bluetooth: Add cmd validity checks at the start of hci_sock_ioctl() (David Marlin) [RHEL-3682] {CVE-2023-2002}
  - bluetooth: Perform careful capability checks in hci_sock_ioctl() (David Marlin) [RHEL-3682] {CVE-2023-2002}
  - cifs: fix panic in smb2_reconnect (Jay Shin) [RHEL-26301]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.117.1.el7]
changelog:
  - tracing/perf: Fix double put of trace event when init fails (Michael Petlan) [RHEL-18052]
  - tracing: Fix race in perf_trace_buf initialization (Michael Petlan) [RHEL-18052]
  - net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve (Davide Caratti) [RHEL-16458] {CVE-2023-4623}
  - net/sched: sch_hfsc: Ensure inner classes have fsc curve (Davide Caratti) [RHEL-16458] {CVE-2023-4623}
  - gfs2: Fix invalid metadata access in punch_hole (Andrew Price) [RHEL-28785]
  - vt: vt_ioctl: fix race in VT_RESIZEX (Jay Shin) [RHEL-28639] {CVE-2020-36558}
  - selinux: cleanup and consolidate the XFRM alloc/clone/delete/free code (Ondrej Mosnacek) [RHEL-27751]
  - bluetooth: Add cmd validity checks at the start of hci_sock_ioctl() (David Marlin) [RHEL-3682] {CVE-2023-2002}
  - bluetooth: Perform careful capability checks in hci_sock_ioctl() (David Marlin) [RHEL-3682] {CVE-2023-2002}
  - cifs: fix panic in smb2_reconnect (Jay Shin) [RHEL-26301]
  - af_unix: Fix null-ptr-deref in unix_stream_sendpage(). (Guillaume Nault) [RHEL-16144] {CVE-2023-4622}
  - NFS: Set the stable writes BDI capability (Benjamin Coddington) [RHEL-22193]
  - RDMA/i40iw: Prevent zero-length STAG registration (Kamal Heib) [RHEL-6299] {CVE-2023-25775}
  - sched/membarrier: reduce the ability to hammer on sys_membarrier (Wander Lairson Costa) [RHEL-26402] {CVE-2024-26602}


author: NVIDIA CORPORATION <cudatools@nvidia.com> 1.12.1-1
changelog:
  - See https://gitlab.com/nvidia/container-toolkit/container-toolkit/-/blob/0bedf07e7b06f89a02394e6d8e6b5f8cbb0828a7/CHANGELOG.md
  - Bump libnvidia-container dependency to libnvidia-container-tools >= 1.12.1-1


author: NVIDIA CORPORATION <cudatools@nvidia.com> 2.12.0-1
changelog:
  - As of 2.7.0-1 the package changelog is generated automatically. This means that releases since 2.7.0-1 all contain this same changelog entry updated for the version being released.
  - Bump nvidia-container-toolkit dependency to 1.12.0-1
  - Docker dependency to docker-ce >= 18.06.3.ce-3.el7


author: Robert Scheck <robert@fedoraproject.org> 1.0-0.21.pre4
changelog:
  - Added patch from upstream to choose first "running" interface,
    rather than first "up" interface (#1403025)
  - Added patch from upstream to support scales beyond 1 Gbps


author: Michal Sekletar <msekleta@redhat.com> - 14:1.5.3-4
changelog:
  - disable TPACKET_V3 memory mapped packet capture on AF_PACKET socket, use TPACKET_V2 instead (#1085096)


author: Michal Sekletar <msekleta@redhat.com> - 14:1.5.3-5
changelog:
  - display also first packet when capturing in cooked mode (#1176612)
  - make sure that userland bpf filter interpreter is given snaplen such that size of
    cooked header is account for


author: Michal Sekletar <msekleta@redhat.com> - 14:1.5.3-6
changelog:
  - libpcap now correctly recognizes Netlink datalink type (#1031974)
  - fix vlan tagged packet filtering (#1079525)


author: Jan Kratochvil <jan.kratochvil@redhat.com> - 3.14-9
changelog:
  - Fix stack corruption on a moved directory, reproducible on aarch64.
    https://bugzilla.redhat.com/show_bug.cgi?id=1741472
    0006-Fix-buffer-overrun-in-inotifytools.c.patch
  - Fix buffer overrun on -c|--csv with '"', ',' or '\n' in directory name.
    0005-Fix-segfault-with-csv-output-when-filename-contains-.patch


author: Tomáš Mráz <tmraz@redhat.com> - 1.4.11-16
changelog:
  - disable mail from anacron with empty MAILTO
  - crontab: do not block access with PAM when running as root
  - improve the crontab man page
  - do not hardcode system_u selinux user but use the user from
    the current context


author: Tomáš Mráz <tmraz@redhat.com> - 1.4.11-17
changelog:
  - make anacron not to contradict itself in syslog
    (job output does not have to be necessarily mailed)


author: Tomáš Mráz <tmraz@redhat.com> - 1.4.11-18
changelog:
  - fix regression - spurious PAM log message from crontab (#1479064)
  - allow empty variables in crontabs (#1439217)


author: Marcel Plch <mplch@redhat.com> - 1.4.11-20
changelog:
  - Fix race condition when crontab is modified the same second
    before and after reading the crontab
  - Resolves: rhbz#1638691


author: Marcel Plch <mplch@redhat.com> - 1.4.11-22
changelog:
  - Backport upstream patch to fix cron failing on
    smart card authentication
  - Resolves: rhbz#1650314


author: Jan Staněk <jstanek@redhat.com> - 1.4.11-24
changelog:
  - Limit memory allocated for file descriptors
    Backports https://github.com/cronie-crond/cronie/commit/584911514ce6aa2f16e1d79431bac816ea62cb2c
    Resolves: rhbz#2026289


author: Martin Sehnoutka <msehnout@redhat.com> - 3.4.0-0.20160601gitf9185e5.1
changelog:
  - New upstream release
  - Drop patches that are already present in upstream
  - Apply upstream fix for systemd paths
  - Resolves: #1297795


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.4.0-6.20160601gitf9185e5
changelog:
  - Fix License field capitalization
  - Resolves: rhbz#1577175
  - Add detection of AMD Ryzen w/ Vega graphics
  - Resolves: rhbz#1569542
  - Fix issues found by Coverity Scan
  - Resolves: rhbz#1578007


author: Bryan Mason <bmason@redhat.com> - 3.4.0-8.20160601gitf9185e5.el7_9.1
changelog:
  - New flag for no sensors added. This flag is used in VM environment
    to make sensors binaries not fail if no sensors was detected.
  - Resolves: RHEL-17699


author: Michal Sekletár <msekleta@redhat.com> - 10.1.5-18
changelog:
  - add -f flag to force fdatasync() after sa file update (#1662094)
  - don't call filesystem count functions when we are not collecting fs statistics (#1670060)
  - skip autofs when gathering filesystem statistics (#1670060)
  - fix use of incorrect preposition in sar man page (#1624410)
  - fix CPU usage reporting (#1618688)


author: Jan Vcelak <jvcelak@redhat.com> 1.22.1-1
changelog:
  - new upstream release (#890973)
    + various fixes in manual pages
    + various fixes and improvements in macros
    + new gropdf driver for generating PDF files
  - fix: backslash-period escape does not work (#682857)
  - fix: groff ftbfs - patch does not apply (#885225)


author: Peter Jones <pjones@redhat.com> - 8.28-17
changelog:
  - Fix the ordering of creating the debug entries, so they don't get picked
    when we're choosing kernel command line defaults on upgrades.
    Related: rhbz#1212128


author: rmarshall@redhat.com - 8.28-18
changelog:
  - Patched new-kernel-pkg so that kernel installations when MAKEDEBUG is
    set would put the debugging entries after the non-debugging entries.
    Resolves: #1285601
  - Re-numbered the last set of patches to go with the flow. No actual
    changes to the patches; just a git mv to rename.
  - Re-organized and updated the grubby man page contents to include some
    features that were not documented as well as correct typos and
    re-write some entries for better clarity.
    Resolves: #1232168


author: rmarshall@redhat.com - 8.28-21
changelog:
  - Resolve issues with the recent grubby logic patches that
    appeared on the ppc platform. Fix a problem that occurred
    on systems where no kernel update had ever been installed.
    Resolves: rhbz#1285601
  - Specify the actual prune_debug file in sources.
    Resolves: rhbz#1285601


author: rmarshall@redhat.com - 8.28-23
changelog:
  - Fixes --info flag on s390/s390x.
    Related: rhbz#1285601
  - Fixes --set-default-index on s390/s390x.
    Related: rhbz#1285601
  - Allows prune_debug to run on s390/s390x.
    Resolves: rhbz#1285601


author: Peter Jones <pjones@redhat.com> - 8.28-24
changelog:
  - Ensure "grubby --default-title" takes the bootloader selection into
    account
    Resolves: rhbz#1340893


author: Peter Jones <pjones@redhat.com> - 8.28-25
changelog:
  - Ensure /etc/sysconfig/kernel has a stable mode, now that rpm handles ghost
    files differently.
    Resolves: rhbz#1584313


author: Javier Martinez Canillas <javierm@redhat.com> - 8.28-26
changelog:
  - Exclude building on i686
    Related: rhbz#1476273
  - Fix grubby removing wrong kernel command line parameter
    Resolves: rhbz#1476273
  - Improve man page for --info option (jstodola)
    Resolves: rhbz#1651673
  - Print default image even if isn't a suitable one
    Resolves: rhbz#1323842


author: Jiri Popelka <jpopelka@redhat.com> - 3.11-3
changelog:
  - remove some rh-specific bits from rh.patch as they are no longer valid (#881913)
  - remove outdated de & pt man pages
  - /usr move: use _bindir macro


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.45-1
changelog:
  - network: parsing of /proc/mounts returned (bug #1572659)
  - netconsole: LSB header added (bug #1508489)
  - ifdown-eth: no longer needed 'pidof -x dhclient' condition removed (bug #1559384)


author: Jan Macku <jamacku@redhat.com> - 9.49.48-1
changelog:
  - network: don't fail with IFDOWN_ON_SHUTDOWN (bug #1693977)
  - Configure autorelabel service to output to journal and to console if set (bug #1634661)
  - Fix changelog typo


author: Jan Macku <jamacku@redhat.com> - 9.49.49-1
changelog:
  - ifup-eth: Check that device name is set (bug #1741830)
  - Add option for IPv6 GRE tunnel (bug #1691552)


author: Andrea Claudi <aclaudi@redhat.com> [4.11.0-21.el7]
changelog:
  - Check user supplied interface name lengths (Andrea Claudi) [1465646]
  - tc: flower: No need to cache indev arg (Andrea Claudi) [1465646]
  - ip{6, }tunnel: Avoid copying user-supplied interface name around (Andrea Claudi) [1465646]
  - utils: strlcpy() and strlcat() don't clobber dst (Andrea Claudi) [1465646]
  - lnstat_util: Make sure buffer is NUL-terminated (Andrea Claudi) [1465646]
  - tc_util: No need to terminate an snprintf'ed buffer (Andrea Claudi) [1465646]
  - ipxfrm: Replace STRBUF_CAT macro with strlcat() (Andrea Claudi) [1465646]
  - Convert harmful calls to strncpy() to strlcpy() (Andrea Claudi) [1465646]
  - Convert the obvious cases to strlcpy() (Andrea Claudi) [1465646]
  - utils: Implement strlcpy() and strlcat() (Andrea Claudi) [1465646]
  - lib/libnetlink: Don't pass NULL parameter to memcpy() (Andrea Claudi) [1465646]
  - lib/fs: Fix and simplify make_path() (Andrea Claudi) [1465646]
  - lib/bpf: Check return value of write() (Andrea Claudi) [1465646]
  - netem/maketable: Check return value of fscanf() (Andrea Claudi) [1465646]
  - ss: Make sure scanned index value to unix_state_map is sane (Andrea Claudi) [1465646]
  - ss: Make struct tcpstat fields 'timer' and 'timeout' unsigned (Andrea Claudi) [1465646]
  - lib/ll_map: Choose size of new cache items at run-time (Andrea Claudi) [1465646]
  - tc/m_xt: Fix for potential string buffer overflows (Andrea Claudi) [1465646]
  - lnstat_util: Simplify alloc_and_open() a bit (Andrea Claudi) [1465646]
  - lib/inet_proto: Review inet_proto_{a2n,n2a}() (Andrea Claudi) [1465646]
  - lib/fs: Fix format string in find_fs_mount() (Andrea Claudi) [1465646]
  - ipntable: Avoid memory allocation for filter.name (Andrea Claudi) [1465646]
  - tipc/bearer: Prevent NULL pointer dereference (Andrea Claudi) [1465646]
  - tc/tc_filter: Make sure filter name is not empty (Andrea Claudi) [1465646]
  - tc/q_netem: Don't dereference possibly NULL pointer (Andrea Claudi) [1465646]
  - ifstat, nstat: Check fdopen() return value (Andrea Claudi) [1465646]
  - lib/bpf: Don't leak fp in bpf_find_mntpt() (Andrea Claudi) [1465646]
  - devlink: Check return code of strslashrsplit() (Andrea Claudi) [1465646]
  - iplink_vrf: Complain if main table is not found (Andrea Claudi) [1465646]
  - iproute: Check mark value input (Andrea Claudi) [1465646]
  - tc/q_multiq: Don't pass garbage in TCA_OPTIONS (Andrea Claudi) [1465646]
  - netem/maketable: Check return value of fstat() (Andrea Claudi) [1465646]
  - ss: Use C99 initializer in netlink_show_one() (Andrea Claudi) [1465646]
  - ipmaddr: Avoid accessing uninitialized data (Andrea Claudi) [1465646]
  - iplink_can: Prevent overstepping array bounds (Andrea Claudi) [1465646]
  - ipaddress: Avoid accessing uninitialized variable lcl (Andrea Claudi) [1465646]
  - tc/m_gact: Drop dead code (Andrea Claudi) [1465646]
  - ss: Drop useless assignment (Andrea Claudi) [1465646]
  - ss: Skip useless check in parse_hostcond() (Andrea Claudi) [1465646]
  - lib/rt_names: Drop dead code in rtnl_rttable_n2a() (Andrea Claudi) [1465646]
  - iproute: Fix for missing 'Oifs:' display (Andrea Claudi) [1465646]
  - ipntable: No need to check and assign to parms_rta (Andrea Claudi) [1465646]
  - devlink: No need for this self-assignment (Andrea Claudi) [1465646]
  - tipc/bearer: Fix resource leak in error path (Andrea Claudi) [1465646]
  - ss: Fix potential memleak in unix_stats_print() (Andrea Claudi) [1465646]
  - ifstat: Fix memleak in dump_kern_db() for json output (Andrea Claudi) [1465646]
  - ifstat: Fix memleak in error case (Andrea Claudi) [1465646]
  - ipvrf: Fix error path of vrf_switch() (Andrea Claudi) [1465646]
  - tc/em_ipset: Don't leak sockfd on error path (Andrea Claudi) [1465646]
  - ss: Don't leak fd in tcp_show_netlink_file() (Andrea Claudi) [1465646]
  - iproute_lwtunnel: csum_mode value checking was ineffective (Andrea Claudi) [1465646]
  - iproute_lwtunnel: Argument to strerror must be positive (Andrea Claudi) [1465646]
  - tipc/node: Fix socket fd check in cmd_node_get_addr() (Andrea Claudi) [1465646]
  - ifcfg: Quote left-hand side of [ ] expression (Andrea Claudi) [1465646]
  - examples: Some shell fixes to cbq.init (Andrea Claudi) [1465646]
  - ip-address: Use correct max attribute value in print_vf_stats64() (Andrea Claudi) [1679749]
  - ss: enclose IPv6 address in brackets (Andrea Claudi) [1588122]
  - tc: f_flower: Add support for matching first frag packets (Andrea Claudi) [1559814]


author: Andrea Claudi <aclaudi@redhat.com> [4.11.0-23.el7]
changelog:
  - tc_util: Silence spurious compiler warning (Andrea Claudi) [1714660]
  - gre6: add collect metadata support (Andrea Claudi) [1714660]
  - tc: m_tunnel_key: add csum/nocsum option (Andrea Claudi) [1714660]
  - m_mirred: don't bail if the control action is missing (Andrea Claudi) [1714660]
  - tc: fix parsing of the control action (Andrea Claudi) [1714660]
  - tc: util: Don't call NEXT_ARG_FWD() in __parse_action_control() (Andrea Claudi) [1714660]
  - tc: don't print error message on miss when parsing action with default (Andrea Claudi) [1714660]
  - tc: gact: fix control action parsing (Andrea Claudi) [1714660]
  - tc/actions: introduce support for goto chain action (Andrea Claudi) [1714660]
  - tc: actions: add helpers to parse and print control actions (Andrea Claudi) [1714660]
  - tc_filter: add support for chain index (Andrea Claudi) [1714660]
  - gre/gre6: allow clearing {,i,o}{key,seq,csum} flags (Andrea Claudi) [1714660]
  - man: ip link: document GRE tunnels (Andrea Claudi) [1714660]
  - ip/tunnel: Use tnl_parse_key() to parse tunnel key (Andrea Claudi) [1714660]


author: Andrea Claudi <aclaudi@redhat.com> [4.11.0-25.el7]
changelog:
  - tc: implement ingress/egress block index attributes for qdiscs (Andrea Claudi) [1721291]
  - tc: introduce support for block-handle for filter operations (Andrea Claudi) [1721291]
  - tc_filter: resolve device name before parsing filter (Andrea Claudi) [1721291]
  - tc: introduce tc_qdisc_block_exists helper (Andrea Claudi) [1721291]


author: Andrea Claudi <aclaudi@redhat.com> [4.11.0-27.el7]
changelog:
  - ss: fix NULL pointer access when parsing unix sockets with oldformat (Andrea Claudi) [1795891]
  - tc_util: Add support for showing TCA_STATS_BASIC_HW statistics (Andrea Claudi) [1637437]
  - Update kernel headers (Andrea Claudi) [1637437]
  - uapi: update bpf headers (Andrea Claudi) [1637437]
  - Update kernel headers (Andrea Claudi) [1637437]
  - man: Clarify idleslope calculation for tc-cbs (Andrea Claudi) [1557461]
  - man: Add initial manpage for tc-cbs(8) (Andrea Claudi) [1557461]
  - tc: Add support for the CBS qdisc (Andrea Claudi) [1557461]
  - nstat: print useful error messages in abort() cases (Andrea Claudi) [1792908]


author: Jan Synáček <jsynacek@redhat.com> - 20160308-7
changelog:
  - ping hung when it cannot receive echo reply (#1362463)
  - arping documentation inconsistency (#1351704)


author: Jan Synáček <jsynacek@redhat.com> - 20160308-9
changelog:
  - IPv4 vs IPv6 inconsistency on return value of ping (#1362388)
  - ping6 does not use device specified with -I parameter (#1371824, #1424965)
  - double cap_free call in ping_common.c (#1410114)
  - ping assumes EACCESS errors are due to broadcast addresses (#1387315)
  - ping -t with multicast address without effect on ppc64 (#1373333)
  - arping -c <n> does not exit when the device is deleted (#1387542)


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-949.el7]
changelog:
  - [scsi] libsas: fix memory leak in sas_smp_get_phy_events() (Tomas Henzl) [1558582] {CVE-2018-7757}
  - [vhost] fix info leak due to uninitialized memory (Jason Wang) [1573705] {CVE-2018-1118}
  - [pci] Fix calculation of bridge window's size and alignment (Myron Stowe) [1623800]
  - [md] dm thin metadata: try to avoid ever aborting transactions (Mike Snitzer) [1614151]
  - [crypto] api: fix finding algorithm currently being tested (Herbert Xu) [1618701]
  - [sound] alsa: hda/realtek: Fix HP Headset Mic can't record (Jaroslav Kysela) [1622721]
  - [sound] alsa: hda/realtek - Fixup for HP x360 laptops with B&O speakers (Jaroslav Kysela) [1622721]
  - [sound] alsa: hda/realtek - Fixup mute led on HP Spectre x360 (Jaroslav Kysela) [1622721]
  - [target] scsi: tcmu: use u64 for dev_size (Xiubo Li) [1603363]
  - [target] scsi: tcmu: use match_int for dev params (Xiubo Li) [1603363]
  - [target] scsi: tcmu: do not set max_blocks if data_bitmap has been setup (Xiubo Li) [1603363]
  - [target] scsi: tcmu: unmap if dev is configured (Xiubo Li) [1603363]
  - [target] scsi: tcmu: check if dev is configured before block/reset (Xiubo Li) [1603363]
  - [target] scsi: tcmu: use lio core se_device configuration helper (Xiubo Li) [1603363]
  - [target] scsi: target: add helper to check if dev is configured (Xiubo Li) [1603363]
  - [target] scsi: tcmu: initialize list head (Xiubo Li) [1603363]
  - [target] scsi: target_core_user: fix double unlock (Xiubo Li) [1603363]
  - [s390] arch: Set IORESOURCE_SYSTEM_RAM flag for resources (Gary Hook) [1627889]
  - [x86] efi-bgrt: Switch all pr_err() to pr_notice() for invalid BGRT (Lenny Szubowicz) [1464241]
  - [x86] efi/bgrt: Don't ignore the BGRT if the 'valid' bit is 0 (Lenny Szubowicz) [1464241]
  - [x86] efi: Preface all print statements with efi* tag (Lenny Szubowicz) [1464241]
  - [x86] efi-bgrt: Switch pr_err() to pr_debug() for invalid BGRT (Lenny Szubowicz) [1464241]
  - [x86] efi-bgrt: Add error handling; inform the user when ignoring the BGRT (Lenny Szubowicz) [1464241]
  - [x86] efi: Check status field to validate BGRT header (Lenny Szubowicz) [1464241]


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-950.el7]
changelog:
  - [kernel] posix-timer: Properly check sigevent->sigev_notify (Phil Auld) [1613711] {CVE-2017-18344}
  - [sound] alsa: rawmidi: Change resized buffers atomically (Denys Vlasenko) [1593087] {CVE-2018-10902}
  - [fs] Fix up non-directory creation in SGID directories (Miklos Szeredi) [1600953] {CVE-2018-13405}
  - [fs] pnfs: Layoutreturn must free the layout after the layout-private data (Scott Mayhew) [1625517]
  - [fs] sunrpc: Ensure we always close the socket after a connection shuts down (Steve Dickson) [1614950]
  - [fs] xfs: remove filestream item xfs_inode reference (Brian Foster) [1518623]
  - [mm] set IORESOURCE_SYSTEM_RAM to system RAM to fix memory hot-add failure (Larry Woodman) [1628349]
  - [firmware] efivars: Protect DataSize and Data in efivar_entry.var (Lenny Szubowicz) [1597868]


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-951.el7]
changelog:
  - [fs] fanotify: fix logic of events on child (Miklos Szeredi) [1597738]
  - [fs] cifs: add a check for session expiry (Leif Sahlberg) [1626358]
  - [fs] xfs: completely disable per-inode DAX behavior (Eric Sandeen) [1623150]
  - [fs] fs: get_rock_ridge_filename(): handle malformed NM entries (Bill O'Donnell) [1340778] {CVE-2016-4913}
  - [md] fix 'allow faster resync only on non-rotational media' underneath dm (Nigel Croxon) [1561162]
  - [md] Revert "allow faster resync only on non-rotational media" (Nigel Croxon) [1561162]
  - [mm] madvise: fix madvise() infinite loop under special circumstances (Rafael Aquini) [1552982] {CVE-2017-18208}
  - [infiniband] srpt: Support HCAs with more than two ports (Don Dutile) [1616192]
  - [infiniband] overflow.h: Add allocation size calculation helpers (Don Dutile) [1616192]
  - [net] ip_tunnel: clean the GSO bits properly (Flavio Leitner) [1607907]
  - [kernel] revert cpuset: fix a warning when clearing configured masks in old hierarchy (Aristeu Rozanski) [1626943]
  - [s390] sclp: Change SCLP console default buffer-full behavior (Hendrik Brueckner) [1625350]
  - [x86] kvm: Take out __exit annotation in vmx_exit() (Waiman Long) [1626560]
  - [x86] mark coffeelake-s 8+2 as supported (David Arcari) [1575457]
  - [x86] kvm: vmx: fixes for vmentry_l1d_flush module parameter (Marcelo Tosatti) [1619602]
  - [x86] speculation: Use ARCH_CAPABILITIES to skip L1D flush on vmentry (Marcelo Tosatti) [1619602]


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-952.el7]
changelog:
  - [netdrv] mlx5e: IPoIB, Use priv stats in completion rx flow (Alaa Hleihel) [1618609]
  - [netdrv] mlx5e: IPoIB, Add ndo stats support for IPoIB child devices (Alaa Hleihel) [1618609]
  - [netdrv] mlx5e: IPoIB, Add ndo stats support for IPoIB netdevices (Alaa Hleihel) [1618609]
  - [netdrv] mlx5e: IPoIB, Initialize max_opened_tc in mlx5i_init flow (Alaa Hleihel) [1618609]
  - [netdrv] mlx5e: Present SW stats when state is not opened (Alaa Hleihel) [1618609]
  - [netdrv] mlx5e: Avoid reset netdev stats on configuration changes (Alaa Hleihel) [1618609]
  - [netdrv] mlx5e: Use bool as return type for mlx5e_xdp_handle (Alaa Hleihel) [1618609]
  - [netdrv] net: aquantia: memory corruption on jumbo frames (Igor Russkikh) [1628238]
  - [kernel] revert "platform/uv: Add adjustable set memory block size function" (Baoquan He) [1625143]
  - [x86] revert "mm: probe memory block size for generic x86 64bit" (Baoquan He) [1625143]
  - [x86] revert "mm: Use 2GB memory block size on large-memory x86-64 systems" (Baoquan He) [1625143]
  - [x86] revert "mm: Streamline and restore probe_memory_block_size()" (Baoquan He) [1625143]
  - [x86] revert "mm/memory_hotplug: determine block size based on the end of boot memory" (Baoquan He) [1625143]
  - [mm] revert "memory_hotplug: do not fail offlining too early" (Baoquan He) [1625143]
  - [mm] revert "memory_hotplug: remove timeout from __offline_memory" (Baoquan He) [1625143]
  - [kernel] revert "x86/platform/uv: Add adjustable set memory block size function" (Baoquan He) [1625143]


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-953.el7]
changelog:
  - [cdrom] information leak in cdrom_ioctl_media_changed() (Sanskriti Sharma) [1578207] {CVE-2018-10940}
  - [mm] mlock: remove lru_add_drain_all() (Oleksandr Natalenko) [1624765]
  - [block] blk-mq: fix race between updating nr_hw_queues and switching io sched (Ming Lei) [1619988]
  - [block] blk-mq: avoid to map CPU into stale hw queue (Ming Lei) [1619988]
  - [block] blk-mq: fix sysfs inflight counter (Ming Lei) [1548261]
  - [block] blk-mq: count allocated but not started requests in iostats inflight (Ming Lei) [1548261]
  - [block] fix a crash caused by wrong API (Ming Lei) [1548261]
  - [block] blk-mq: enable checking two part inflight counts at the same time (Ming Lei) [1548261]
  - [block] blk-mq: provide internal in-flight variant (Ming Lei) [1548261]
  - [block] make part_in_flight() take an array of two ints (Ming Lei) [1548261]
  - [block] pass in queue to inflight accounting (Ming Lei) [1548261]
  - [x86] Mark Intel Cascade Lake supported (Steve Best) [1584343]


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-954.el7]
changelog:
  - [fs] exec: Limit arg stack to at most 75 of _STK_LIM (Yauheni Kaliuta) [1625991] {CVE-2018-14634}
  - [fs] exec: account for argv/envp pointers (Yauheni Kaliuta) [1625991] {CVE-2018-14634}
  - [kernel] revert "sched/topology: Introduce NUMA identity node sched domain" (Gustavo Duarte) [1620031]
  - [powerpc] revert "powernv: Add a virtual irqchip for opal events" (Gustavo Duarte) [1617966]
  - [powerpc] revert "powernv: Reorder OPAL subsystem initialisation" (Gustavo Duarte) [1617966]
  - [char] revert "ipmi/powernv: Convert to irq event interface" (Gustavo Duarte) [1617966]
  - [tty] revert "hvc: Convert to using interrupts instead of opal events" (Gustavo Duarte) [1617966]
  - [powerpc] revert "powernv/eeh: Update the EEH code to use the opal irq domain" (Gustavo Duarte) [1617966]
  - [powerpc] revert "powernv/opal: Convert opal message events to opal irq domain" (Gustavo Duarte) [1617966]
  - [powerpc] revert "powernv/elog: Convert elog to opal irq domain" (Gustavo Duarte) [1617966]
  - [powerpc] revert "powernv/opal-dump: Convert to irq domain" (Gustavo Duarte) [1617966]
  - [powerpc] revert "opal: Remove events notifier" (Gustavo Duarte) [1617966]
  - [powerpc] revert "powernv: Increase opal-irqchip initcall priority" (Gustavo Duarte) [1617966]
  - [powerpc] revert "opal-irqchip: Fix double endian conversion" (Gustavo Duarte) [1617966]
  - [powerpc] revert "opal-irqchip: Fix deadlock introduced by "Fix double endian conversion"" (Gustavo Duarte) [1617966]
  - [sound] alsa: hda/realtek - two more lenovo models need fixup of MIC_LOCATION (Jaroslav Kysela) [1611958]
  - [sound] alsa: hda/realtek - Fix the problem of two front mics on more machines (Jaroslav Kysela) [1611958]
  - [sound] alsa: hda/realtek - Enable mic-mute hotkey for several Lenovo AIOs (Jaroslav Kysela) [1611958]


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-955.el7]
changelog:
  - [netdrv] net/mlx5e: IPoIB, Set the netdevice sw mtu in ipoib enhanced flow (Alaa Hleihel) [1633652]
  - [netdrv] net/mlx5e: Fix traffic between VF and representor (Alaa Hleihel) [1633652]
  - [mm] vmscan: do not loop on too_many_isolated for ever (Waiman Long) [1632050]


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-956.el7]
changelog:
  - [block] blk-mq: fix hctx debugfs entry related race between update hw queues and cpu hotplug (Ming Lei) [1619988]
  - [nvme] nvme-pci: unquiesce dead controller queues (Ming Lei) [1632424]


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-957.el7]
changelog:
  - [mm] mlock: avoid increase mm->locked_vm on mlock() when already mlock2(, MLOCK_ONFAULT) (Rafael Aquini) [1633059]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.57.1.el7]
changelog:
  - fix regression in "epoll: Keep a reference on files added to the check list" (Carlos Maiolino) [2042760] {CVE-2020-0466}
  - epoll: Keep a reference on files added to the check list (Carlos Maiolino) [2042760] {CVE-2020-0466}
  - drm/i915: Flush TLBs before releasing backing store (Dave Airlie) [2044319] {CVE-2022-0330}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.58.1.el7]
changelog:
  - Bluetooth: fix use-after-free error in lock_sock_nested() (Gopal Tiwari) [2005687]
  - drm/vmwgfx: Fix stale file descriptors on failed usercopy (Dave Airlie) [2047597] {CVE-2022-22942}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.60.1.el7]
changelog:
  - svcrdma: Fix leak of svc_rdma_recv_ctxt objects (Benjamin Coddington) [2028740]
  - sunrpc: Remove unneeded pointer dereference (Benjamin Coddington) [2028740]
  - x86/platform/uv: Add more to secondary CPU kdump info (Frank Ramsay) [2042462]
  - [s390] s390/AP: support new dynamic AP bus size limit (Claudio Imbrenda) [1997156]
  - CI: Enable baseline realtime checks (Veronika Kabatova)
  - CI: Rename pipelines to include release names (Veronika Kabatova)
  - RDMA/cma: Do not change route.addr.src_addr.ss_family (Kamal Heib) [2032075] {CVE-2021-4028}
  - fget: clarify and improve __fget_files() implementation (Miklos Szeredi) [2032478] {CVE-2021-4083}
  - fget: check that the fd still exists after getting a ref to it (Miklos Szeredi) [2032478] {CVE-2021-4083}
  - net: Set fput_needed iff FDPUT_FPUT is set (Miklos Szeredi) [2032478] {CVE-2021-4083}
  - vfs, fdtable: Add fget_task helper (Miklos Szeredi) [2032478] {CVE-2021-4083}
  - fs: add fget_many() and fput_many() (Miklos Szeredi) [2032478] {CVE-2021-4083}
  - fs/file.c: __fget() and dup2() atomicity rules (Miklos Szeredi) [2032478] {CVE-2021-4083}
  - vfs: Don't let __fdget_pos() get FMODE_PATH files (Miklos Szeredi) [2032478] {CVE-2021-4083}
  - get rid of fget_light() (Miklos Szeredi) [2032478] {CVE-2021-4083}
  - sockfd_lookup_light(): switch to fdget^W^Waway from fget_light (Miklos Szeredi) [2032478] {CVE-2021-4083}
  - fs: __fget_light() can use __fget() in slow path (Miklos Szeredi) [2032478] {CVE-2021-4083}
  - fs: factor out common code in fget_light() and fget_raw_light() (Miklos Szeredi) [2032478] {CVE-2021-4083}
  - fs: factor out common code in fget() and fget_raw() (Miklos Szeredi) [2032478] {CVE-2021-4083}
  - introduce __fcheck_files() to fix rcu_dereference_check_fdtable(), kill rcu_my_thread_group_empty() (Miklos Szeredi) [2032478] {CVE-2021-4083}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.61.1.el7]
changelog:
  - x86/efi: reset the correct tlb_state when returning from efi_switch_mm() (Rafael Aquini) [2055587]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.62.1.el7]
changelog:
  - cifs: fix handling of DFS links where we can not access all components (Ronnie Sahlberg) [1937304]
  - redhat: kernel.spec: install new kernel boot entry in posttrans, not post (Denys Vlasenko) [1893756]
  - [s390] s390/cpumf: Support for CPU Measurement Facility CSVN 7 (Mete Durlu) [2048920]
  - dm table: fix iterate_devices based device capability checks (Mike Snitzer) [2054743]
  - buffer: eliminate the need to call free_more_memory() in __getblk_slow() (Carlos Maiolino) [2030609]
  - buffer: grow_dev_page() should use __GFP_NOFAIL for all cases (Carlos Maiolino) [2030609]
  - buffer: have alloc_page_buffers() use __GFP_NOFAIL (Carlos Maiolino) [2030609]
  - mm: memcg: do not fail __GFP_NOFAIL charges (Rafael Aquini) [2054345]
  - mm: filemap: do not drop action modifier flags from the gfp_mask passed to __add_to_page_cache_locked() (Rafael Aquini) [2054345]
  - Added ZSTREAM=yes to makefile (Lucas Zampieri)


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.63.1.el7]
changelog:
  - NFSv4: Set the connection timeout to match the lease period (Benjamin Coddington) [2066699]
  - SUNRPC: Allow changing of the TCP timeout parameters on the fly (Benjamin Coddington) [2066699]
  - SUNRPC: Refactor TCP socket timeout code into a helper function (Benjamin Coddington) [2066699]
  - SUNRPC: Remove unused function rpc_get_timeout() (Benjamin Coddington) [2066699]
  - kernel/timer: Fix incorrect assertion in requeue_timers() (Waiman Long) [2048502]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.65.1.el7]
changelog:
  - CI: Remove deprecated option (Veronika Kabatova)
  - RDMA/core: Fix panic when port_pkey_list isn't initialized (Kamal Heib) [2046571]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.66.1.el7]
changelog:
  - net-sysfs: add check for netdevice being present to speed_show (William Zhao) [2055457]
  - CI: Drop baseline runs (Veronika Kabatova)
  - perf/x86/intel: Add more Icelake CPUIDs (Michael Petlan) [2072317]
  - perf vendor events intel: Add Icelake V1.00 event file (Michael Petlan) [2072317]
  - perf vendor events intel: Add core event list for Icelake Server (Michael Petlan) [2072317]


author: Bruno E. O. Meneguele <bmeneg@redhat.com> - 20190318-71.git283373f
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - cxgb4: update firmware to revision 1.23.3.0 (rhbz 1642422)


author: Bruno E. O. Meneguele <bmeneg@redhat.com> - 20190429-72.gitddde598
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - cxgb4: update firmware to revision 1.23.4.0 (rhbz 1690727)
  - linux-firmware: Add firmware file for Intel Bluetooth 22161 (rhbz 1622438)


author: Jan Stancek <jstancek@redhat.com> - 20190815-73.git07b925b
changelog:
  - Update to latest upstream linux-firmware image for assorted updates (rhbz 1741356)
  - iwlwifi- Update to support the Cyclone Peak Dual Band 2x2 802.11ax
  - iwl7265-firmware sub-package merged into iwl7260-firmware sub-package


author: Jan Stancek <jstancek@redhat.com> - 20190918-74.git6c6918a
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Update bnx2x firmware to latest upstream (rhbz 1720386)


author: Jan Stancek <jstancek@redhat.com> - 20191203-75.gite8a0f4c
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Update qed zipped/unzipped firmware to latest upstream (rhbz 1720385)


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.16.3-291
changelog:
  - Backported and sub-packaged libraries historically supplied with Perl 4
    into perl-Perl4-CoreLibs


author: Petr Pisar <ppisar@redhat.com> - 4:5.16.3-293
changelog:
  - Add SSL support to Net::SMTP (bug #1557574)
  - Do not overload ".." in Math::BigInt (bug #1497734)
  - Provide perl(:VERSION) and perl-interpreter RPM symbols (bug #1410347)


author: Petr Pisar <ppisar@redhat.com> - 2.51-6
changelog:
  - Rebuild against "file" package fixed by Jan Kaluza to correct run-time
    dependencies (bug #1048910)


author: Petr Pisar <ppisar@redhat.com> - 0.033-2
changelog:
  - Croak on failed write into a file (bug #1031096)
  - Do not use already existing temporary files (bug #1031096)


author: Marcela Mašláňová <mmaslano@redhat.com> - 1:0.225-4
changelog:
  - Install to vendor directories rather than perl core directories so as to
    avoid conflicts between our debuginfo and the main perl-debuginfo package


author: Paul Howarth <paul@city-fan.org> - 1:0.225-6
changelog:
  - Reinstate compatibility with old distributions like EL-5
    - Add back buildroot definition and cleaning
  - Use DESTDIR rather than PERL_INSTALL_ROOT
  - Make %files list more explicit
  - Drop redundant %{?perl_default_filter}
  - Don't use macros for commands
  - Use tabs


author: Paul Howarth <paul@city-fan.org> - 1:0.225-242
changelog:
  - Don't need to remove empty directories from the buildroot
  - Drop %defattr, redundant since rpm 4.4


author: Jitka Plesnikova <jplesnik@redhat.com> - 1.42-2
changelog:
  - Add BR perl(File::Spec)
  - Replace PERL_INSTALL_ROOT with DESTDIR
  - Remove deleting empty directories
  - Remove defattr


author: systemd maintenance team <systemd-maint@redhat.com> - 219-74
changelog:
  - sd-bus: bump message queue size again (#1770158)
  - unit: fix potential use of cgroup_path after free() when freeing unit (#1760149)
  - add test for ExecStopPost (#1733998)
  - core: when restarting services, don't close fds (#1757704)
  - unit: rework a bit how we keep the service fdstore from being destroyed during service restart (#1757704)
  - tests: add basic journal test (#1757704)
  - tests: add regression test for `systemctl restart systemd-journald` (#1757704)
  - tests: add test that journald keeps fds over termination by signal (#1757704)
  - nss-util: silence warning about deprecated RES_USE_INET6 (#1799002)
  - journal: do not trigger assertion when journal_file_close() get NULL (#1786046)
  - mount: don't propagate errors from mount_setup_unit() further up (#1804757)
  - mount: when allocating a Mount object based on /proc/self/mountinfo mark it so (#1804757)
  - fix the fix for #1691511 (#1804757)
  - v3: Properly parsing SCSI Hyperv devices (#8509) (#1809053)
  - Consider smb3 as remote filesystem (#1811700)
  - mount: don't add Requires for tmp.mount (#1813270)
  - sd-bus: when attached to an sd-event loop, disconnect on processing errors (#1769928)
  - sd-journal: close journal files that were deleted by journald before we've setup inotify watch (#1812889)
  - sd-journal: remove the dead code and actually fix #14695 (#1812889)
  - swap: adjust swap.c in a similar way to what we just did to mount.c (#1749621)
  - swap: finish the secondary swap units' jobs if deactivation of the primary swap unit fails (#1749621)
  - core: add a new unit file setting CollectMode= for tweaking the GC logic (#1817576)
  - run: add "-G" as shortcut for "--property=CollectMode=inactive-or-failed" (#1817576)
  - core: clarify that the CollectMode bus property is constant (#1817576)
  - udev-rules: make tape-changers also apprear in /dev/tape/by-path/ (#1814028)
  - logind: check PolicyKit before allowing VT switch (#1797672)
  - timer: don't use persietent file timestamps from the future (#6823) (#1769923)
  - core: transition to FINAL_SIGTERM state after ExecStopPost= (#1766477)
  - bus_open leak sd_event_source when udevadm trigger。 (#1798503)
  - journal-remote: split-mode=host, remove port from journal filename (#1244691)
  - core: downgrade log message about inability to propagate cgroup release message (#1679934)
  - units: move Before deps for quota services to remote-fs.target (#5627) (#1693374)
  - set kptr_restrict=1 (#1689344)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.8-9
changelog:
  - Amended fix for FIPS enforcement issue (#1163848)
  - Fixed issue with applications that close all file descriptors (#1165047)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.8-11
changelog:
  - Applied fix for urandom FD in FIPS140 mode (#1165047)
  - Applied fix for FIPS140-2 related regression (#1110696)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.8-13
changelog:
  - Corrected reseed and respect of max_number_of_bits_per_request in 
    FIPS140-2 mode. Also enhanced the initial tests. (#1228199)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.24-1
changelog:
  - Addressed issue with DSA public keys smaller than 2^1024 (#1238279)
  - Addressed two-byte buffer overflow in the DTLS-0.9 protocol (#1209365)
  - When writing certificates to smart cards write the CKA_ISSUER and
    CKA_SERIAL_NUMBER fields to allow NSS reading them (#1272179)
  - Use the shared system certificate store (#1110750)
  - Address MD5 transcript collision attacks in TLS key exchange (#1289888, 
    CVE-2015-7575)
  - Allow hashing data over 2^32 bytes (#1306953)
  - Ensure written PKCS#11 public keys are not marked as private (#1339453)
  - Ensure secure_getenv() is called on all uses of environment variables
    (#1344591).
  - Fix issues related to PKCS #11 private key listing on certain HSMs
    (#1351389)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.26-7
changelog:
  - Address interoperability issue with 3.5.x (#1388932)
  - Reject CAs which are both trusted and blacklisted in trust module (#1375303)
  - Added new functions to set issuer and subject ID in certificates (#1378373)
  - Reject connections with less than 1024-bit DH parameters (#1335931)
  - Fix issue that made GnuTLS parse only the first 32 extensions (#1383748)
  - Mention limitations of certtool in manpage (#1375463)
  - Read PKCS#8 files with HMAC-SHA256 -as generated by openssl 1.1 (#1380642)
  - Do not link directly to trousers but instead use dlopen (#1379739)
  - Fix incorrect OCSP validation (#1377569)
  - Added support for pin-value in PKCS#11 URIs (#1379283)
  - Added the --id option to p11tool (#1399232)
  - Improved sanity checks in RSA key generation (#1444780)
  - Addressed CVE-2017-5334, CVE-2017-5335, CVE-2017-5336, CVE-2017-5337,
    CVE-2017-7869


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.26-9
changelog:
  - Address crash in OCSP status request extension, by eliminating the
    unneeded parsing (CVE-2017-7507, #1455828)


author: Anderson Sasaki <ansasaki@redhat.com> 3.3.29-8
changelog:
  - Backported --sni-hostname option which allows overriding the hostname
    advertised to the peer (#1444792)
  - Improved counter-measures in TLS CBC record padding for lucky13 attack
    (CVE-2018-10844, #1589704, CVE-2018-10845, #1589707)
  - Added counter-measures for "Just in Time" PRIME + PROBE cache-based attack
    (CVE-2018-10846, #1589708)
  - Address p11tool issue in object deletion in batch mode (#1375307)
  - Backport PKCS#11 tests from master branch. Some tests were disabled due to
    unsupported features in 3.3.x (--load-pubkey and --test-sign options, ECC key
    generation without login, and certificates do not inherit ID from the private
    key)
  - p11tool explicitly marks certificates and public keys as NOT private objects
    and private keys as private objects
  - Enlarge buffer size to support resumption with large keys (#1542461)
  - Legacy HMAC-SHA384 cipher suites were disabled by default
  - Added DSA key generation to p11tool (#1464896)
  - Address session renegotiation issue using client certificate (#1434091)
  - Address issue when importing private keys into Atos HSM (#1460125)


author: Luboš Uhliarik <luhliari@redhat.com> - 4.4.8-6
changelog:
  - Fix lftp does not follow http redirect (302) in mirror mode (#1181580)
  - Fix lftp exists randomly when "cmd:fail-exit" is set (#1193984)
  - Added RFE - lftp configurations for restricting each SSL/TLS 
    version (#1182987)
  - Fixed bogus dates of this SPEC


author: Michal Ruprich - 4.4.8-9
changelog:
  - Resolves: #1374653 -  File size decreases when synchronizing folders with a sftp account using lftp


author: Michal Ruprich - 4.4.8-10
changelog:
  - Related: #1374653 - File size decreases when synchronizing folders with a sftp account using lftp
                      - Patch edited so that it corresponds to upstream


author: Michal Ruprich <mruprich@redhat.com> - 4.4.8-11
changelog:
  - Resolves: #1514815 - lftp doesn't seems to consider 'set net:max-retries'
  - Resolves: #1556675 - "get" command with lftp does not fail on net:max-retries


author: Michal Ruprich <mruprich@redhat.com> - 4.4.8-12
changelog:
  - Resolves: #1611641 - CVE-2018-10916 lftp: particular remote file names may lead to current working directory erased


author: Michal Ruprich <michalruprich@gmail.com> - 4.4.8-12.1
changelog:
  - Resolves: #1797964 - lftp with ssl gives error Fatal error: gnutls_record_recv: The TLS connection was non-properly terminated


author: Nikos Mavrogiannopoulos <nmav@redhat.com> - 2.7.1-5
changelog:
  - Fixed SHA-3 implementation to conform to final standard (#1252936)
  - Fixed CVE-2015-8803 CVE-2015-8804 CVE-2015-8805 which caused issues
    in secp256r1 and secp384r1 calculations (#1314374)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> - 2.7.1-8
changelog:
  - Use a cache-silent version of mpz_powm to prevent cache-timing
    attacks against RSA and DSA in shared VMs. (#1364897,CVE-2016-6489)


author: Jeff Law <law@redhat.com> - 0.10.0-5
changelog:
  - Use symver attribute for symbol versioning
    Fix configure test compromised by LTO
    Fix nlist test compromised by LTO
    Re-enable LTO


author: Robert Scheck <robert@fedoraproject.org> 1.1.1c-2
changelog:
  - backport from 1.1.1c-15: add selftest of the RAND_DRBG implementation
  - backport from 1.1.1c-14: fix incorrect error return value from FIPS_selftest_dsa
  - backport from 1.1.1c-14: S390x: properly restore SIGILL signal handler
  - backport from 1.1.1c-12: additional fix for the edk2 build
  - backport from 1.1.1c-9: disallow use of SHA-1 signatures in TLS in FIPS mode
  - backport from 1.1.1c-8: fix CVE-2019-1547 - side-channel weak encryption vulnerability
  - backport from 1.1.1c-8: fix CVE-2019-1563 - padding oracle in CMS API
  - backport from 1.1.1c-8: fix CVE-2019-1549 - ensure fork safety of the DRBG
  - backport from 1.1.1c-8: fix handling of non-FIPS allowed EC curves in FIPS mode
  - backport from 1.1.1c-8: fix TLS compliance issues
  - backport from 1.1.1c-7: backported ARM performance fixes from master
  - backport from 1.1.1c-6: backport of S390x ECC CPACF enhancements from master
  - backport from 1.1.1c-6: FIPS mode: properly disable 1024 bit DSA key generation
  - backport from 1.1.1c-6: FIPS mode: skip ED25519 and ED448 algorithms in openssl speed
  - backport from 1.1.1c-6: FIPS mode: allow AES-CCM ciphersuites
  - backport from 1.1.1c-5: make the code suitable for edk2 build
  - backport from 1.1.1c-4: backport of SSKDF from master
  - backport from 1.1.1c-3: backport of KBKDF and KRB5KDF from master


author: Robert Scheck <robert@fedoraproject.org> 1.1.1g-1
changelog:
  - backport from 1.1.1g-11: Further changes for SP 800-56A rev3 requirements
  - backport from 1.1.1g-9: Rewire FIPS_drbg API to use the RAND_DRBG
  - backport from 1.1.1g-9: Use the well known DH groups in TLS even for 2048 and 1024 bit parameters
  - backport from 1.1.1g-7: Disallow dropping Extended Master Secret extension on renegotiation
  - backport from 1.1.1g-7: Return alert from s_server if ALPN protocol does not match
  - backport from 1.1.1g-7: SHA1 is allowed in @SECLEVEL=2 only if allowed by TLS SigAlgs configuration
  - backport from 1.1.1g-6: Add FIPS selftest for PBKDF2 and KBKDF
  - backport from 1.1.1g-5: Allow only well known DH groups in the FIPS mode
  - backport from 1.1.1g-1: update to the 1.1.1g release
  - backport from 1.1.1g-1: FIPS module installed state definition is modified


author: Robert Scheck <robert@fedoraproject.org> 1.1.1g-2
changelog:
  - backport from 1.1.1g-12: Fix CVE-2020-1971 ediparty null pointer dereference
  - backport from 1.1.1g-11.1: Implemented new FIPS requirements in regards to KDF and DH selftests
  - backport from 1.1.1g-11.1: Disallow certificates with explicit EC parameters


author: Robert Scheck <robert@fedoraproject.org> 1.1.1g-3
changelog:
  - backport from 1.1.1g-15: version bump
  - backport from 1.1.1g-14: CVE-2021-3450 openssl: CA certificate check bypass with X509_V_FLAG_X509_STRICT
  - backport from 1.1.1g-13: Fix CVE-2021-3449 NULL pointer deref in signature_algorithms processing


author: Robert Scheck <robert@fedoraproject.org> 1.1.1k-1
changelog:
  - backport from 1.1.1k-4: Fixes bugs in s390x AES code
  - backport from 1.1.1k-4: Uses the first detected address family if IPv6 is not available
  - backport from 1.1.1k-4: Reverts the changes in https://github.com/openssl/openssl/pull/13305
    as it introduces a regression if server has a DSA key pair, the handshake fails
    when the protocol is not explicitly set to TLS 1.2. However, if the patch is reverted,
    it has an effect on the "ssl_reject_handshake" feature in nginx. Although, this feature
    will continue to work, TLS 1.3 protocol becomes unavailable/disabled. This is already
    known - https://trac.nginx.org/nginx/ticket/2071#comment:1
    As per https://github.com/openssl/openssl/issues/16075#issuecomment-879939938, nginx could
    early callback instead of servername callback. Resolves: rhbz#197821, related: rhbz#1934534
  - backport from 1.1.1k-3: Cleansup the peer point formats on renegotiation. Resolves rhbz#1965362
  - backport from 1.1.1k-2: Fixes FIPS_selftest to work in FIPS mode. Resolves: rhbz#1940085
  - backport from 1.1.1k-2: Using safe primes for FIPS DH self-test
  - backport from 1.1.1k-1: Update to version 1.1.1k
  - backport from 1.1.1g-16: Use AI_ADDRCONFIG only when explicit host name is given
  - backport from 1.1.1g-16: Allow only curves defined in RFC 8446 in TLS 1.3


author: Robert Scheck <robert@fedoraproject.org> 1.1.1k-2
changelog:
  - backport from 1.1.1k-5: CVE-2021-3712 openssl: Read buffer overruns processing ASN.1 strings
    Resolves: rhbz#2005402


author: Robert Scheck <robert@fedoraproject.org> 1.1.1k-3
changelog:
  - backport from 1.1.1k-6: CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
    Resolves: rhbz#2067146


author: Robert Scheck <robert@fedoraproject.org> 1.1.1k-4
changelog:
  - backport from 1.1.1k-7: CVE-2022-2097: AES OCB fails to encrypt some bytes on 32-bit x86
    Resolves: CVE-2022-2097
  - backport from 1.1.1k-7: Update expired certificates used in the testsuite
    Resolves: rhbz#2092462
  - backport from 1.1.1k-7: CVE-2022-1292: openssl: c_rehash script allows command injection
    Resolves: rhbz#2090372
  - backport from 1.1.1k-7: CVE-2022-2068: the c_rehash script allows command injection
    Resolves: rhbz#2098279


author: Robert Scheck <robert@fedoraproject.org> 1.1.1k-5
changelog:
  - backport from 1.1.1k-9: Fixed Timing Oracle in RSA Decryption
    Resolves: CVE-2022-4304
  - backport from 1.1.1k-9: Fixed Double free after calling PEM_read_bio_ex
    Resolves: CVE-2022-4450
  - backport from 1.1.1k-9: Fixed Use-after-free following BIO_new_NDEF
    Resolves: CVE-2023-0215
  - backport from 1.1.1k-9: Fixed X.400 address type confusion in X.509 GeneralName
    Resolves: CVE-2023-0286
  - backport from 1.1.1k-8: Fix no-ec build
    Resolves: rhbz#2071020


author: Michal Ruprich <mruprich@redhat.com> - 2.0-0.18.20131004git
changelog:
  - Resolves: #1063913 - netstat doesn't list sctp servers in -A mode
  - Resolves: #1257549 - netstat tool does not throw correct exit code on wrong parameter
  - Resolves: #1392910 - ifconfig inaccurately rounds exabytes


author: Michal Ruprich <mruprich@redhat.com> - 2.0-0.25.20131004git
changelog:
  - Resolves: #1632905 - The output of `route -A inet6` does not display properly when the 'Use' column output is over 6 digits


author: Ray Strode <rstrode@redhat.com> 69.1.6-1
changelog:
  - Update syslinux background to black
    Resolves: #1003873
  - Prune unused images from anaconda/ after talking to #anaconda


author: Jim Perrin <jperrin@centos.org> - 70.0.5-1
changelog:
  - Properly import all backgrounds images
  - update poweredby.png
  - Add CREDITS for artwork attribution as possible. 
  - Update anaconda rnotes images from Tuomas, inspired by Alain


author: Miroslav Rezanina <mrezanin@redhat.com> 2.4-2
changelog:
  - gperf-allow-customizing-trace-filename.patch [bz#1232702]
  - Resolves: bz#1232702
    (gperftools: tcmalloc debug version uses hard-coded path /tmp/google.alloc)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.4-8.el7
changelog:
  - gp-Use-initial-exec-tls-for-libunwind-s-recursion-flag.patch [bz#1339710]
  - Resolves: bz#1339710
    (initalization of 'recursive' tls variable in libunwind stack capturer occasionally triggers deadlock in ceph)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.4-8.el7
changelog:
  - Rebase to 2.6.1 [bz#1431240]
  - Removed libunwind usage [bz#1467203]
  - Resolves: bz#1431240 
    (gperftools fails to build on s390x, lacks s390x support)
  - Resolves: bz#1467203
    (Please, remove libunwind from the gperftools-libs (and 389-ds-base) requirements)


author: Petr Machata <pmachata@redhat.com> - 1:3.82-18
changelog:
  - Backport upstream patch that adds wildcard expansion to pattern
    rules. (make-3.82-stem_glob.patch)


author: Petr Machata <pmachata@redhat.com> - 1:3.82-19
changelog:
  - make now restores rlimit to its original values before launching
    subprocess via $(shell) (make-3.82-func_shell-rlimit.patch)
  - Determinize one test (make-3.82-tests-SECONDARY.patch)


author: Patsy Franklin <pfrankli@redhat.com> - 1:3.82-22
changelog:
  - Check if the target-specific variable is the same as the global
    variable, and if it is, don't free it.  Savannah bug #31743.
    Resolves: #1323206


author: Patsy Franklin <pfrankli@redhat.com> - 1:3.82-23
changelog:
  - In very obscure situations we may incorrectly write the free token
    back to the pipe.
    Resolves: #1322670


author: DJ Delorie <dj@redhat.com> - 1:3.82-24
changelog:
  - Change fatal() to error() when a mix of explicit and implicit
    targets (in that order) is detected.
    Resolves: #1582545


author: Tomáš Mráz <tmraz@redhat.com> 1.1.1c-2
changelog:
  - do not try to use EC groups disallowed in FIPS mode
    in TLS
  - fix Valgrind regression with constant-time code


author: Robert Scheck <robert@fedoraproject.org> 1.1.1k-3
changelog:
  - backport from 1.1.1k-6: CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
    Resolves: rhbz#2067145


author: Robert Scheck <robert@fedoraproject.org> 1.1.1k-4
changelog:
  - backport from 1.1.1k-7: CVE-2022-2097: AES OCB fails to encrypt some bytes on 32-bit x86
    Resolves: CVE-2022-2097
  - backport from 1.1.1k-7: Update expired certificates used in the testsuite
    Resolves: rhbz#2100554
  - backport from 1.1.1k-7: CVE-2022-1292: openssl: c_rehash script allows command injection
    Resolves: rhbz#2090371
  - backport from 1.1.1k-7: CVE-2022-2068: the c_rehash script allows command injection
    Resolves: rhbz#2098278


author: Neal Gompa <ngompa@datto.com> - 2:2021.8.22-1
changelog:
  - Rebase to version 2021.8.22 to fix various CVEs (RHBZ#1999869)
  - Clean up old cruft for RHEL < 7
  - Split libraries out to libs subpackage


author: Richard W.M. Jones <rjones@redhat.com> - 2:2022.5.17-1
changelog:
  - New upstream version 2022.5.17
  - Fixes: CVE-2021-46790, CVE-2022-30783, CVE-2022-30784, CVE-2022-30785,
    CVE-2022-30786, CVE-2022-30787, CVE-2022-30788, CVE-2022-30789


author: Tomas Orsava <torsava@redhat.com> - 3-28
changelog:
  - Fix the %py_dist_name macro to not convert dots (".") into dashes, so that
    submodules can be addressed as well Resolves: rhbz#1564095


author: Lumír Balhar <lbalhar@redhat.com> - 3-31
changelog:
  - Converting specfile from F28 to RHEL7
  - Move the macros to the standard RHEL7 macro location at /etc/rpm/,
    instead of Fedora's location at /usr/lib/rpm/macros.d/
  - Import the macros.python{,2} files from the python-devel package where they
    resided until now, and Conflict with that old version of python-devel
  - Import the macros.pybytecompile from Fedora rawhide / RHEL8
  Resolves: rhbz#1660579


author: Miro Hrončok <mhroncok@redhat.com> - 3-32
changelog:
  - %python_provide: Obsolete and provide python36- from python3-
  - %python_provide: Provide python3- from python36-
  Resolves: rhbz#1702719


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 0.252-8.9
changelog:
  - Updated pci, usb, vendor ids and hwdb files
    Resolves: #1560493
  - Blacklisted sha{256,512}-mb modules
    Resolves: #1562114


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 0.252-9.5
changelog:
  - Fix URL for downloading hwdb files
  - Updated pci, usb, vendor ids and hwdb files
    Resolves: #1721908


author: Paul Howarth <paul@city-fan.org> - 2.055-1
changelog:
  - Update to 2.055
    - Fix misuse of magic in API (CPAN RT#78080)
  - Drop redundant explicit requires for perl(Exporter) and perl(File::Temp)


author: Paul Howarth <paul@city-fan.org> - 2.058-1
changelog:
  - Update to 2.058
    - Compress::Raw::Bzip2 needs to use PERL_NO_GET_CONTEXT (CPAN RT#80318)
    - Install to 'site' instead of 'perl' when perl version is 5.11+
      (CPAN RT#79811)
    - Update to ppport.h that includes SvPV_nomg_nolen (CPAN RT#78080)


author: Paul Howarth <paul@city-fan.org> - 2.058-1
changelog:
  - Update to 2.058
    - Compress::Raw::Zlib needs to use PERL_NO_GET_CONTEXT (CPAN RT#80319)
    - Install to 'site' instead of 'perl' when perl version is 5.11+
      (CPAN RT#79812)
    - Update to ppport.h that includes SvPV_nomg_nolen (CPAN RT#78079)


author: Paul Howarth <paul@city-fan.org> - 2.061-1
changelog:
  - Update to 2.061
    - Include zlib 1.2.8 source
    - Typo fix (CPAN RT#85431)
    - Silence compiler warning by making 2nd parameter to DispStream a const char*


author: Marcela Mašláňová <mmaslano@redhat.com> - 2.135.07-240
changelog:
  - update the version to override the module from perl.srpm
  - bump release to override sub-package from perl.spec


author: Paul Howarth <paul@city-fan.org> - 2.055-1
changelog:
  - Update to 2.055
    - FAQ: added a few paragraphs on how to deal with pbzip2 files
      (CPAN RT#77743)
    - Compress::Zip: speed up compress, uncompress, memGzip and memGunzip
      (CPAN RT#77350)
  - BR: perl(lib)
  - Drop BR: perl(Test::Builder) and perl(Test::More) as they're bundled
  - Drop BR: perl(Config), perl(Fcntl), perl(File::Copy), perl(File::Glob),
    perl(POSIX) and perl(Symbol) as they're not dual-lived
  - Drop redundant explicit require for perl(Exporter)
  - Don't use macros for commands


author: Paul Howarth <paul@city-fan.org> - 2.058-1
changelog:
  - Update to 2.058
    - IO::Compress::Zip
      - Allow member name and Zip Comment to be "0"
    - IO::Compress::Base::Common
      - Remove "-r" test - the file open will catch this
      - IO::Compress::Base::Common returned that it could not read readable files
        in NFS (CPAN RT#80855)
    - Install to 'site' instead of 'perl' when perl version is 5.11+
      (CPAN RT#79820)
    - General performance improvements
    - Fix failing 01misc.t subtest introduced in 2.057 (CPAN RT#81119)
  - Explicitly install to 'perl' directories


author: Paul Howarth <paul@city-fan.org> - 2.059-1
changelog:
  - Update to 2.059
    - IO::Compress::Base
      - Added "Encode" option (fixes the encoding half of CPAN RT#42656)


author: Paul Howarth <paul@city-fan.org> - 2.060-1
changelog:
  - Update to 2.060
    - Updated POD
      - CPAN RT#82138: Example code not clear - gunzip() takes filenames!
    - IO::Compress::Base
      - Remove the flush call when opening a filehandle


author: Paul Howarth <paul@city-fan.org> - 2.061-1
changelog:
  - Update to 2.061
    - zipdetails (1.06)
      - Get it to cope with Android 'zipalign' non-standard extra fields; these
        are used to make sure that a non-compressed member starts on a 4 byte
        boundary
    - unzip example with IO::Uncompress::Unzip (CPAN RT#84647)


author: Ingvar Hagelund <ingvar@redpill-linpro.com> - 3.5.1-1
changelog:
  - New upstream release
  - Updated nopprof patch to match new release
  - Fixed a few bogus changelog entries


author: Kamil Dudka <kdudka@redhat.com> - 3.8.6-10
changelog:
  - fix #1192936 - provide diagnostic in case log does not need rotating
  - fix #1321980 - do not exit if status file is corrupted


author: Kamil Dudka <kdudka@redhat.com> - 3.8.6-13
changelog:
  - fix #1393247 - migration of state file from previous versions of logrotate
  - fix #1374331 - preserve SELinux context with 'compress' and 'sharedscripts'
  - fix #1377335 - make 'createolddir' preserve sticky bit
  - fix #1369438 - heap buffer overflow when using long date format
  - fix #1375638 - make olddir respect the missingok flag


author: Kamil Dudka <kdudka@redhat.com> - 3.8.6-14
changelog:
  - fix #1381719 - make /var/lib/logrotate/logrotate.status the default state file
  - fix #1387533 - make 'su' directive accept usernames starting with digits


author: Kamil Dudka <kdudka@redhat.com> - 3.8.6-15
changelog:
  - fix #1483800 - update references to project page
  - fix #1472984 - improve the error message for bad config file mode
  - fix #1465720 - trigger weekly rotations more predictably
  - fix #1461907 - make 'copy' and 'copytruncate' work together


author: Kamil Dudka <kdudka@redhat.com> - 3.8.6-18
changelog:
  - fix #1680436 - do not treat errors in reading configuration as fatal
  - fix #1631218 - rename already existing file


author: Nathan Scott <nathans@redhat.com> - 3.2.9-1
changelog:
  - Upstream 3.2.9
  - Add RuntimeDirectory=redis to systemd unit file (RHBZ #1454700)
  - Mark rundir as %ghost since it may disappear (tmpfs - #1454700)
  - Fix a shutdown failure with Unix domain sockets (RHBZ #1444988)


author: Nathan Scott <nathans@redhat.com> - 3.2.10-1
changelog:
  - Upstream 3.2.10 release
  - Ensure both the redis and redis-sentinel service files set correct perms
  - Dropped systemd tmpfiles source, handled directly in systemd service files


author: Nathan Scott <nathans@redhat.com> - 3.2.11-1
changelog:
  - Upstream 3.2.11 bug-fix-only release
  - Switch to using Type=notify for Redis systemd services (RHBZ #1172841)
  - Add Provides:bundled hiredis, linenoise, lua-libs clauses (RHBZ #788500)


author: Nathan Scott <nathans@redhat.com> - 3.2.12-1
changelog:
  - Upstream 3.2.12 security fix release.
  - Fixes CVE-2017-15047: Lack clusterLoadConfig input validation (RHBZ #1499153)
  - Fixes CVE-2018-11218: Heap corruption in lua_cmsgpack.c (RHBZ #1591537)
  - Fixes CVE-2018-11219: Integer overflow in lua_struct.c b_unpack (RHBZ #1591538)
  - Fixes CVE-2018-12326: code execution via a crafted command line (RHBZ #1594294)


author: Tomas Mraz <tmraz@redhat.com> - 1.2.0-1
changelog:
  - add lib subpackage to avoid multilib on the base package
  - add ability to compute hmacs on multiple files at once
  - improved debugging with FIPSCHECK_DEBUG


author: Jakub Jelen <jjelen@redhat.com> - 7.4p1-15 + 0.10.3-2
changelog:
  - Do not hang if SSH AuthorizedKeysCommand output is too large (#1496467)
  - Do not segfault pam_ssh_agent_auth if keyfile is missing (#1494268)
  - Do not segfault in audit code during cleanup (#1488083)
  - Add WinSCP 5.10+ compatibility (#1496808)
  - Clatch between ClientAlive and rekeying timeouts (#1480510)
  - Exclude dsa and ed25519 from default proposed keys in FIPS mode (#1456853)
  - Add enablement for openssl-ibmca and openssl-ibmpkcs11 (#1478035)


author: Jakub Jelen <jjelen@redhat.com> - 7.4p1-18 + 0.10.3-2
changelog:
  - invalidate supplemental group cache used by temporarily_use_uid()
    when the target uid differs (#1583735)


author: Martin Sehnoutka <msehnout@redhat.com> - 14:4.9.0-4
changelog:
  - Drop downstream patch (drop root privileges)
  - Add libcap-ng as a new build dependency
  - Related: #1262283


author: Michal Ruprich <mruprich@redhat.com> - 14:4.9.2-4
changelog:
  - Resolves: #1664648 - tcpdump post creates user and groups unconditionally, raising alerts in corporate environment


author: Steve Dickson <steved@redhat.com> 2.0.14-1
changelog:
  - Updated to latest stable upstream version: 2.0.14-stable (bz 727129)
  - Removed the installion of the outdate man pages and the latex raw docs.
  - Corrected where the other doc are installed.


author: Steve Dickson <steved@redhat.com> 2.0.18-1
changelog:
  - Updated to latest stable upstream version: 2.0.18-stable
  - Moved documentation into its own rpm (bz 810138)


author: Sven Lankes <sven@lank.es> 1.5-1
changelog:
  - New upstream release
  - Do the right thing (tm) and revert to $upstream-behaviour: 
     No longer install tmux setgid and no longer use /var/run/tmux 
     for sockets. Use "tmux -S /var/run/tmux/tmux-`id -u`/default attach"
     if you need to access an "old" tmux session
  - tmux can be used as a login shell so add it to /etc/shells


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.107.1.el7]
changelog:
  - netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c (Phil Sutter) [RHEL-8433] {CVE-2023-42753}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.108.1.el7]
changelog:
  - net: usb: ax88179_178a: fix failed operations during ax88179_reset (Jose Ignacio Tornos Martinez) [RHEL-6302]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.109.1.el7]
changelog:
  - x86/speculation: Mark all Skylake CPUs as vulnerable to GDS (Waiman Long) [RHEL-17703]
  - scsi: qedf: Do not touch __user pointer in qedf_dbg_fp_int_cmd_read() directly (Oleksandr Natalenko) [2224973]
  - scsi: qedf: Do not touch __user pointer in qedf_dbg_debug_cmd_read() directly (Oleksandr Natalenko) [2224973]
  - scsi: qedf: Do not touch __user pointer in qedf_dbg_stop_io_on_error_cmd_read() directly (Oleksandr Natalenko) [2224973]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.114.2.el7]
changelog:
  - sched/membarrier: reduce the ability to hammer on sys_membarrier (Wander Lairson Costa) [RHEL-26402] {CVE-2024-26602}


author: Chengweizheng <chengweizheng@kylinos.cn> - [3.10.0-1160.114.2.el7.01]
changelog:
  - Type: cves
  - ID:   [TASK#202889]
  - SUG:  NA
  - DESC:
  -  debrand for kylin kernel productization
  -  net: Add patch 10000-KYLIN-Fix-OOB-read-and-write-in-hw_atl_utils_fw_rpc_wait.patch to fix CVE-2021-43975
  -  cpu: Add suport HYGON and Zhaoxin.
  -  Add patch 10001-KYLIN-support-ZHAOXIN.patch
  -  Add patch 000_x86_add_hygon_family_18h.patch
  -  Add patch 10002-KYLIN-Fix-CNVD-C-2022-231201-l2tp.patch
  -  Add patch 10004-ext4-don-t-BUG-on-inconsistent-journal-feature.patch


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.38-1
changelog:
  - ifdown-eth: we need to flush global scope as well
  - killproc/status: add missing '-b <binary>' option
  - specfile: mark 'rwtab' and 'statetab' as config files
  - spec: we need newer lvm
  - rwtab: add /var/lib/systemd/timers
  - ifup-eth: remove quote marks
  - 9.70-sync: Move everything to github
  - 9.70-sync: rwtab updated
  - 9.70-sync: service file updated
  - 9.70-sync: syconfig.txt updated
  - 9.70-sync: systemd/rhel-import-state updated
  - 9.70-sync: sysconfig/network-scripts/* updated - part 2
  - 9.70-sync: sysconfig/network-scripts/* updated - part 1
  - 9.70-sync: rc.d/init.d/network updated
  - 9.70-sync: rc.d/init.d/netconsole updated
  - 9.70-sync: rc.d/init.d/functions updated
  - 9.70-sync: ipv6-6to4.howto example updated
  - 9.70-sync: examples/networking/ifcfg-bridge updated
  - network: load NetworkManager connection via dbus
  - network: check for running NetworkManager via dbus


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.39-1
changelog:
  - sysconfig.txt: mention previously introduced NO_DHCP_HOSTNAME option
  - DHCP_FQDN and DHCP_SEND_HOSTNAME introduced
  - re-add missing $HOSTNAME initialization
  - ifup: add support for VLAN_EGRESS_PRIORITY_MAP
  - rhel-autorelabel: synchronize cached writes before reboot


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.40-1
changelog:
  - require 'redhat-release' instead of /etc/system-release & conflict with older versions
  - ifup-post: always update 'nameserver' & 'search' entries in /etc/resolv.conf
  - systemd/system: symlinks for initscripts' services removed
  - *.old extension added to list of ignored files
  - ifup-eth: wait for STP to complete setup on bridge if $DELAY is not set
  - init.d/functions: convert2sec() function added
  - init.d/functions: is_true() & is_false() extended by ON/OFF support
  - usleep(1) calls replaced with sleep(1) calls
  - network-scripts: DBus calls forwarded to /dev/null
  - network-scripts: firewall-cmd replaced with DBus calls
  - ARPUDATE option introduced


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.41-1
changelog:
  - ifdown-post: fix logical error in commit 5d61564
  - network-functions: use POSIX forwarding instead of bash-ism


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.42-1
changelog:
  - rhel-autorelabel: set UEFI boot order (BootNext) same as BootCurrent
  - network-functions: use tr to upper case strings rather than awk
  - sysconfig/readonly-root: Clarify the usage of readonly-root
  - network-functions: add error messages for bonding installation
  - sysctl.conf.s390: drop SHMALL and SHMMAX
  - network.service: 'reload' removed
  - rhel-readonly.service: target name for random seed fixed
  - init.d/functions: fix sourcing for ksh


author: Phil Sutter <psutter@redhat.com> [4.11.0-6.el7]
changelog:
  - link_gre6: Fix for changing tclass/flowlabel (Phil Sutter) [1487486]
  - utils: return default family when rtm_family is not RTNL_FAMILY_IPMR/IP6MR (Stefano Brivio) [1475762]
  - netns: avoid directory traversal (Phil Sutter) [1468529]
  - Disable -fexceptions CFLAG passed by build system (Phil Sutter) [1418715]


author: Phil Sutter <psutter@redhat.com> [4.11.0-9.el7]
changelog:
  - lib/libnetlink: update rtnl_talk to support malloc buff at run time (Hangbin Liu) [1380803]
  - lib/libnetlink: re malloc buff if size is not enough (Hangbin Liu) [1380803]
  - iplink: double the buffer size also in iplink_get() (Hangbin Liu) [1380803]
  - iplink: check for message truncation in iplink_get() (Hangbin Liu) [1380803]
  - iproute: Add support for extended ack to rtnl_talk (Hangbin Liu) [1380803]
  - libnetlink: drop unused parameter to rtnl_dump_done (Hangbin Liu) [1380803]
  - netlink: Change rtnl_dump_done to always show error (Hangbin Liu) [1380803]


author: Phil Sutter <psutter@redhat.com> [4.11.0-10.el7]
changelog:
  - tc: flower: add support for matching on ip tos and ttl (Kamal Heib) [1456539]
  - iplink: Update usage in help message (Kamal Heib) [1456539]
  - tc: flower: add support for tcp flags (Kamal Heib) [1456539]
  - devlink: Add option to set and show eswitch encapsulation support (Kamal Heib) [1456539]
  - pedit: Introduce ipv6 support (Kamal Heib) [1456539]
  - pedit: Check for extended capability in protocol parser (Kamal Heib) [1456539]
  - pedit: Do not allow using retain for too big fields (Kamal Heib) [1456539]
  - pedit: Fix a typo in warning (Kamal Heib) [1456539]
  - tc: Reflect HW offload status (Kamal Heib) [1456539]
  - devlink: Add support for pipeline debug (dpipe) (Kamal Heib) [1456539]
  - devlink: Change netlink attribute validation (Kamal Heib) [1456539]
  - Update linux headers (Phil Sutter) [1456539]


author: Phil Sutter <psutter@redhat.com> [4.11.0-11.el7]
changelog:
  - ss: add AF_VSOCK support (Stefano Brivio) [1472759]
  - ss: allow AF_FAMILY constants >32 (Stefano Brivio) [1472759]
  - uapi: add include linux/vm_sockets_diag.h (Stefano Brivio) [1472759]
  - iproute: build more easily on Android (Phil Sutter) [1472759]


author: Phil Sutter <psutter@redhat.com> [4.11.0-12.el7]
changelog:
  - man: tc-csum.8: Fix inconsistency in example description (Phil Sutter) [1417162]
  - link_gre6: Detect invalid encaplimit values (Phil Sutter) [1459600]


author: Bruno Meneguele <bmeneg@redhat.com> - 20191202-95.gite8a0f4c9
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Update qed zipped/unzipped firmware to latest upstream (rhbz 1720394)
  - Update bnx2x firmware to latest upstream (rhbz 1720395)
  - AX200(Cyclone Peak 2 or CcP2) Bluetooth support (rhbz 1722693)
  - Firmware for Chelsio T4/T5/T6 adapters (rhbz 1725821)
  - Include to support Intel AX201 Harrison Peak(CNVi) on CML-U (rhbz 1725873)
  - Icelake Bluetooth firmware update (AX201, Harrison Peak, or HrP2) (rhbz 1726182)
  - DDP Package to support Columbiaville NIC (rhbz 1726454)
  - Add iwlwifi-cc-a0-48.ucode to linux-firmware (rhbz 1753962)
  - Change install section to use usptream installation process


author: Frantisek Hrbata <fhrbata@redhat.com> - 20200512-98.gitb2cad6a2
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Update qed zipped/unzipped firmware to latest upstream (rhbz 1791030)
  - Update bnx2x firmware to latest upstream (rhbz 1791031)
  - Firmware - nvidia: add TU102/TU104/TU106 / TU116/117 signed firmware (rhbz 1801025)
  - Update latest Signed FW for AMD NAVI 10 Graphic (rhbz 1809846)


author: Jan Stancek <jstancek@redhat.com> - 20201022-100.gitdae4b4cd
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - ice: Pull Comms Market Segment Package (rhbz 1861491)
  - ice: Update to the Default OS DDP Package for ice driver (rhbz 1879278)


author: Jan Stancek <jstancek@redhat.com> - 20201118-101.git7455a360
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Include to support Intel AX210 Typhoon Peak - Bluetooth firmware support (rhbz 1897069)
  - Include support for the Qualcomm AX500-DBS (QCA6390) 802.11ax Wireless - firmware support (rhbz 1725913)


author: Like <like@kylinos.cn> - 20201218-102.git05789708.ns7.02
changelog:
  - Type:CVE
  - ID:NA
  - SUG:NA
  - DESC: AMD: INVD instruction may lead to a loss of SEV-ES guest machine memory integrity problem (RHEL-13985) fix CVE-2023-20592


author: Petr Pisar <ppisar@redhat.com> - 4:5.16.3-286
changelog:
  - Remove CPU-speed-sensitive test in Benchmark test (bug #1238567)
  - Rebuild with corrected binutils to fix systemtap support (bug #1238472)


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.16.3-288
changelog:
  - Fix CRLF conversion in ASCII FTP upload (bug #1263734)
  - Don't leak the temp utf8 copy of namepv (bug #1063330)


