# changelog

author: Lennart Poettering <lpoetter@redhat.com> - 24-1
changelog:
- New upstream release
- https://bugzilla.redhat.com/show_bug.cgi?id=694079
- https://bugzilla.redhat.com/show_bug.cgi?id=693289
- https://bugzilla.redhat.com/show_bug.cgi?id=693274
- https://bugzilla.redhat.com/show_bug.cgi?id=693161


author: Lennart Poettering <lpoetter@redhat.com> - 25-1
changelog:
- New upstream release
- https://bugzilla.redhat.com/show_bug.cgi?id=694788
- https://bugzilla.redhat.com/show_bug.cgi?id=694321
- https://bugzilla.redhat.com/show_bug.cgi?id=690253
- https://bugzilla.redhat.com/show_bug.cgi?id=688661
- https://bugzilla.redhat.com/show_bug.cgi?id=682662
- https://bugzilla.redhat.com/show_bug.cgi?id=678555
- https://bugzilla.redhat.com/show_bug.cgi?id=628004


author: Lennart Poettering <lpoetter@redhat.com> - 26-1
changelog:
- New upstream release
- https://bugzilla.redhat.com/show_bug.cgi?id=699394
- https://bugzilla.redhat.com/show_bug.cgi?id=698198
- https://bugzilla.redhat.com/show_bug.cgi?id=698674
- https://bugzilla.redhat.com/show_bug.cgi?id=699114
- https://bugzilla.redhat.com/show_bug.cgi?id=699128


author: Lennart Poettering <lpoetter@redhat.com> - 26-2
changelog:
- Bugfix release
- https://bugzilla.redhat.com/show_bug.cgi?id=707507
- https://bugzilla.redhat.com/show_bug.cgi?id=707483
- https://bugzilla.redhat.com/show_bug.cgi?id=705427
- https://bugzilla.redhat.com/show_bug.cgi?id=707577


author: Michal Schmidt <mschmidt@redhat.com> - 28-3
changelog:
- Apply patches from current upstream
- https://bugzilla.redhat.com/show_bug.cgi?id=709909
- https://bugzilla.redhat.com/show_bug.cgi?id=710839
- https://bugzilla.redhat.com/show_bug.cgi?id=711015


author: Michal Schmidt <mschmidt@redhat.com> - 28-4
changelog:
- Apply patches from current upstream.
- Fixes memory size detection on 32-bit with >4GB RAM (BZ712341)


author: Lennart Poettering <lpoetter@redhat.com> - 35-1
changelog:
- New upstream release
- Update post scripts
- Resolves: #726683, #713384, #698198, #722803, #727315, #729997, #733706, #734611


author: Michal Schmidt <mschmidt@redhat.com> - 37-2
changelog:
- A couple of fixes from upstream:
- Fix a regression in bash-completion reported in Bodhi.
- Fix a crash in isolating.
- Resolves: #717325


author: Michal Schmidt <mschmidt@redhat.com> - 38-5
changelog:
- Build against libgee06. Reenable gtk tools.
- Delete unused patches.
- Add easy building of git snapshots.
- Remove legacy spec file elements.
- Don't mention implicit BuildRequires.
- Configure with --disable-static.
- Merge -units into the main package.
- Move section 3 manpages to -devel.
- Fix unowned directory.
- Run ldconfig in scriptlets.
- Split systemd-analyze to a subpackage.


author: Lennart Poettering <lpoetter@redhat.com> - 42-1
changelog:
- New upstream release
- Save a bit of entropy during system installation (#789407)
- Don't own /etc/os-release anymore, leave that to fedora-release


author: Dennis Gilmore <dennis@ausil.us> - 43-2
changelog:
- don't conflict with fedora-release systemd never actually provided
- /etc/os-release so there is no actual conflict


author: Dennis Gilmore <dennis@ausil.us> - 44-3
changelog:
- apply patch from upstream so we can build systemd on arm and ppc
- and likely the rest of the secondary arches


author: Michal Schmidt <mschmidt@redhat.com> - 44-4
changelog:
- Add triggers from Bill Nottingham to correct the damage done by
the obsoleted systemd-units's preun scriptlet (#807457).


author: Michal Schmidt <mschmidt@redhat.com> - 185-4.gita2368a3
changelog:
- Update to current git snapshot
- Add systemd-readahead-analyze
- Drop upstream patch
- Split systemd-libs
- Drop duplicate doc files
- Fixed License headers of subpackages


author: Lennart Poettering <lpoetter@redhat.com> - 188-1
changelog:
- New upstream release
- Enable gdm and avahi by default via the preset file
- Convert /etc/sysconfig/desktop to display-manager.service symlink
- Enable hardened build


author: Lennart Poettering <lpoetter@redhat.com> - 188-3
changelog:
- Remount file systems MS_PRIVATE before switching roots
- https://bugzilla.redhat.com/show_bug.cgi?id=847418


author: Ray Strode <rstrode@redhat.com> 188-4
changelog:
- more scriptlet fixes
(move dm migration logic to %posttrans so the service
files it's looking for are available at the time
the logic is run)


author: Lennart Poettering <lpoetter@redhat.com> - 189-3
changelog:
- Update preset policy
- Rename preset policy file from 99-default.preset to 90-default.preset so that people can order their own stuff after the Fedora default policy if they wish


author: Lennart Poettering <lpoetter@redhat.com> - 190-1
changelog:
- New upstream release
- Take possession of /etc/localtime, and remove /etc/sysconfig/clock
- https://bugzilla.redhat.com/show_bug.cgi?id=858780
- https://bugzilla.redhat.com/show_bug.cgi?id=858787
- https://bugzilla.redhat.com/show_bug.cgi?id=858771
- https://bugzilla.redhat.com/show_bug.cgi?id=858754
- https://bugzilla.redhat.com/show_bug.cgi?id=858746
- https://bugzilla.redhat.com/show_bug.cgi?id=858266
- https://bugzilla.redhat.com/show_bug.cgi?id=858224
- https://bugzilla.redhat.com/show_bug.cgi?id=857670
- https://bugzilla.redhat.com/show_bug.cgi?id=856975
- https://bugzilla.redhat.com/show_bug.cgi?id=855863
- https://bugzilla.redhat.com/show_bug.cgi?id=851970
- https://bugzilla.redhat.com/show_bug.cgi?id=851275
- https://bugzilla.redhat.com/show_bug.cgi?id=851131
- https://bugzilla.redhat.com/show_bug.cgi?id=847472
- https://bugzilla.redhat.com/show_bug.cgi?id=847207
- https://bugzilla.redhat.com/show_bug.cgi?id=846483
- https://bugzilla.redhat.com/show_bug.cgi?id=846085
- https://bugzilla.redhat.com/show_bug.cgi?id=845973
- https://bugzilla.redhat.com/show_bug.cgi?id=845194
- https://bugzilla.redhat.com/show_bug.cgi?id=845028
- https://bugzilla.redhat.com/show_bug.cgi?id=844630
- https://bugzilla.redhat.com/show_bug.cgi?id=839736
- https://bugzilla.redhat.com/show_bug.cgi?id=835848
- https://bugzilla.redhat.com/show_bug.cgi?id=831740
- https://bugzilla.redhat.com/show_bug.cgi?id=823485
- https://bugzilla.redhat.com/show_bug.cgi?id=821813
- https://bugzilla.redhat.com/show_bug.cgi?id=807886
- https://bugzilla.redhat.com/show_bug.cgi?id=802198
- https://bugzilla.redhat.com/show_bug.cgi?id=767795
- https://bugzilla.redhat.com/show_bug.cgi?id=767561
- https://bugzilla.redhat.com/show_bug.cgi?id=752774
- https://bugzilla.redhat.com/show_bug.cgi?id=732874
- https://bugzilla.redhat.com/show_bug.cgi?id=858735


author: Lennart Poettering <lpoetter@redhat.com> - 194-1
changelog:
- New upstream release
- https://bugzilla.redhat.com/show_bug.cgi?id=859614
- https://bugzilla.redhat.com/show_bug.cgi?id=859655


author: Lennart Poettering <lpoetter@redhat.com> - 195-1
changelog:
- New upstream release
- https://bugzilla.redhat.com/show_bug.cgi?id=831665
- https://bugzilla.redhat.com/show_bug.cgi?id=847720
- https://bugzilla.redhat.com/show_bug.cgi?id=858693
- https://bugzilla.redhat.com/show_bug.cgi?id=863481
- https://bugzilla.redhat.com/show_bug.cgi?id=864629
- https://bugzilla.redhat.com/show_bug.cgi?id=864672
- https://bugzilla.redhat.com/show_bug.cgi?id=864674
- https://bugzilla.redhat.com/show_bug.cgi?id=865128
- https://bugzilla.redhat.com/show_bug.cgi?id=866346
- https://bugzilla.redhat.com/show_bug.cgi?id=867407
- https://bugzilla.redhat.com/show_bug.cgi?id=868603


author: Michal Schmidt <mschmidt@redhat.com> - 195-4
changelog:
- add dmraid-activation.service to the default preset
- add yum protected.d fragment
- https://bugzilla.redhat.com/show_bug.cgi?id=869619
- https://bugzilla.redhat.com/show_bug.cgi?id=869717


author: Michal Schmidt <mschmidt@redhat.com> - 195-6
changelog:
- Fix cyclical dep between systemd and systemd-libs.
- Avoid broken build of test-journal-syslog.
- https://bugzilla.redhat.com/show_bug.cgi?id=873387
- https://bugzilla.redhat.com/show_bug.cgi?id=872638


author: Michal Schmidt <mschmidt@redhat.com> - 195-7
changelog:
- Revert udev killing cgroup patch for F18 Beta.
- https://bugzilla.redhat.com/show_bug.cgi?id=873576


author: Lennart Poettering <lpoetter@redhat.com> - 195-8
changelog:
- https://bugzilla.redhat.com/show_bug.cgi?id=873459
- https://bugzilla.redhat.com/show_bug.cgi?id=878093


author: Michal Schmidt <mschmidt@redhat.com> - 196-2
changelog:
- added spice-vdagentd.service to presets (Lennart, #876237)
- BR cryptsetup-devel instead of the legacy cryptsetup-luks-devel provide name
(requested by Milan Brož).
- verbose make to see the actual build flags


author: Michal Schmidt <mschmidt@redhat.com> - 196-3
changelog:
- Disable hardening on s390(x) because PIE is broken there and produces
text relocations with __thread (#868839).


author: Michal Schmidt <mschmidt@redhat.com> - 197-2
changelog:
- Added qemu-guest-agent.service to presets (Lennart, #885406).
- Add missing pygobject3-base to systemd-analyze deps (Lennart).
- Do not require hwdata, it is all in the hwdb now (Kay).
- Drop dependency on dbus-python.


author: Michal Schmidt <mschmidt@redhat.com> - 201-2
changelog:
- Automatically discover whether to run autoreconf and add autotools and git
BuildRequires based on the presence of patches to be applied.
- Use find -delete.


author: Harald Hoyer <harald@redhat.com> 202-2
changelog:
- nspawn create empty /etc/resolv.conf if necessary
- python wrapper: add sd_journal_add_conjunction()
- fix s390 booting
- Resolves: rhbz#953217


author: Harald Hoyer <harald@redhat.com> 202-3
changelog:
- fix ENOENT for getaddrinfo
- Resolves: rhbz#954012 rhbz#956035
- crypt-setup-generator: correctly check return of strdup
- logind-dbus: initialize result variable
- prevent library underlinking


author: Lennart Poettering <lpoetter@redhat.com> - 204-5
changelog:
- Rename 90-display-manager.preset to 85-display-manager.preset so that it actually takes precedence over 90-default.preset's "disable *" line (#903690)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 206-3
changelog:
- add dependency on kmod >= 14
- remove /var/log/journal to make journal non-persistant (#989750)
- add hypervkvpd.service to presets (#924321)


author: Harald Hoyer <harald@redhat.com> 206-4
changelog:
- journal: handle multiline syslog messages
- man: Fix copy&paste error
- core: synchronously block when logging
- journal: immediately sync to disk as soon as we receieve an EMERG/ALERT/CRIT message
- initctl: use irreversible jobs when switching runlevels
- udev: log error if chmod/chown of static dev nodes fails
- udev: static_node - don't touch permissions uneccessarily
- tmpfiles: support passing --prefix multiple times
- tmpfiles: introduce --exclude-prefix
- tmpfiles-setup: exclude /dev prefixes files
- logind: update state file after generating the session fifo, not before
- journalctl: use _COMM= match for scripts
- man: systemd.unit: fix volatile path
- man: link up scope+slice units from systemd.unit(5)
- man: there is no session mode, only user mode
- journal: fix hashmap leak in mmap-cache
- systemd-delta: Only print colors when on a tty
- systemd: fix segv in snapshot creation
- udev: hwdb - try reading modalias for usb before falling back to the composed one
- udevd: respect the log-level set in /etc/udev/udev.conf
- fstab-generator: respect noauto/nofail when adding sysroot mount


author: Harald Hoyer <harald@redhat.com> 206-5
changelog:
- obsolete upstart
Resolves: rhbz#978014
- obsolete hal
Resolves: rhbz#975589
- service: always unwatch PIDs before forgetting old ones
Resolves: rhbz#995197
- units: disable kmod-static-nodes.service in containers
- use CAP_MKNOD ConditionCapability
- fstab-generator: read rd.fstab=on/off switch correctly
- backlight: add minimal tool to save/restore screen brightness
- backlight: instead of syspath use sysname for identifying
- sysctl: allow overwriting of values specified in "later"
- systemd-python: fix initialization of _Reader objects
- udevd: simplify sigterm check
- libudev: fix hwdb validation to look for the *new* file
- units: make fsck units remain after exit
- udev: replace CAP_MKNOD by writable /sys condition
- libudev-enumerate.c:udev_enumerate_get_list_entry() fixed
- journal: fix parsing of facility in syslog messages


author: Harald Hoyer <harald@redhat.com> 206-8
changelog:
- support "debug" kernel command line parameter
- journald: fix fd leak in journal_file_empty
- journald: fix vacuuming of archived journals
- libudev: enumerate - do not try to match against an empty subsystem
- cgtop: fixup the online help
- libudev: fix memleak when enumerating childs


author: Lukas Nykryn <lnykryn@redhat.com> - 207-2
changelog:
- Advertise hibernation only if there's enough free swap
- swap: create .wants symlink to 'auto' swap devices
- Verify validity of session name when received from outside
- polkit: Avoid race condition in scraping /proc
Resolves: rhbz#1005142


author: Lukas Nykryn <lnykryn@redhat.com> - 207-5
changelog:
- create /etc/rc.d/rc.local (#968401)
- cgroup: always enable memory.use_hierarchy= for all cgroups (#1011575)
- remove user@.service (#1019738)
- drop some out-of-date references to cgroup settings (#1000004)
- explain NAME in systemctl man page (#978954)


author: Harald Hoyer <harald@redhat.com> 207-6
changelog:
- changed systemd-journal-gateway login shell to /sbin/nologin
- backported a lot of bugfixes
- udev: path_id - fix by-path link generation for scm devices
Resolves: rhbz#888707


author: Lukas Nykryn <lnykryn@redhat.com> - 207-9
changelog:
- treat reload failure as failure (#1036848)
- improve journal performance (#1029604)
- backport bugfixes (#1043525)
- fix handling of trailing whitespace in split_quoted (#984832)
- localed: match converted keymaps before legacy (#903776)
- improve the description of parameter X in tmpfiles.d page (#1029604)
- obsolete ConsoleKit (#1039761)
- make rc.local more backward comaptible (#1039465)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 207-12
changelog:
- shell-completion: remove load and dump from systemctl (#1048066)
- delta: ensure that d_type will be set on every fs (#1050795)
- tmpfiles: don't allow label_fix to print ENOENT when we want to ignore it (#1044871)
- udev/net_id: Introduce predictable network names for Linux on System z (#870859)
- coredumpctl: in case of error free pattern after print (#1052786)


author: Michal Sekletar <msekleta@redhat.com> - 208-1
changelog:
- rebase to systemd-208 (#1063332)
- do not create symlink /etc/systemd/system/syslog.service (#1055421)


author: Michal Sekletar <msekleta@redhat.com> - 208-2
changelog:
- require redhat-release package
- call systemd-tmpfiles after package installation (#1059345)
- move preset policy out of systemd package (#903690)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 208-7
changelog:
- setup tty permissions and group for /dev/sclp_line0 (#1070310)
- cdrom_id: use the old MMC fallback (#1038015)
- mount: don't send out PropertiesChanged message if actually nothing got changed (#1069718)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 208-8
changelog:
- rules: mark loop device as SYSTEMD_READY=0 if no file is attached (#1067422)
- utmp: make sure we don't write the utmp reboot record twice on each boot (#1053600)
- rework session shutdown logic (#1047614)
- introduce new stop protocol for unit scopes (#1064976)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 208-9
changelog:
- fixes crashes in logind and systemd (#1073994)
- run fsck before mouting root in initramfs (#1056661)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 208-11
changelog:
- logind-session: save stopping flag (#1082692)
- unit: add waiting jobs to run queue in unit_coldplug (#1083159)


author: Lukas Nykryn <lnykryn@redhat.com> - 208-12
changelog:
- units/serial-getty@.service: add [Install] section (#1083936)
- units: order network-online.target after network.target (#1072431)
- util: consider both fuse.glusterfs and glusterfs network file systems (#1080229)
- core: make StopWhenUnneeded work in conjunction with units that fail during their start job (#986949)
- cgroups-agent: down-grade log level (#1044386)
- random-seed: raise POOL_SIZE_MIN constant to 1024 (#1066517)
- delta: do not use unicode chars in C locale (#1088419)
- core: print debug instead of error message (#1105608)
- journald: always add syslog facility for messages coming from kmsg (#1113215)
- fsck,fstab-generator: be lenient about missing fsck.<type> (#1098310)
- rules/60-persistent-storage: add nvme pcie ssd scsi_id ENV (#1042990)
- cgls: fix running with -M option (#1085455)
- getty: Start getty on 3270 terminals available on Linux on System z (#1075729)
- core: Added support for ERRNO NOTIFY_SOCKET  message parsing (#1106457)
- socket: add SocketUser= and SocketGroup= for chown()ing sockets in the file system (#1111761)
- tmpfiles: add --root option to operate on an alternate fs tree (#1111199)
- units: make ExecStopPost action part of ExecStart (#1036276)
- machine-id: only look into KVM uuid when we are not running in a container (#1123452)
- util: reset signals when we fork off agents (#1134818)
- udev: do not skip the execution of RUN when renaming a network device fails (#1102135)
- man: mention System Administrator's Guide in systemctl manpage (#978948)
- vconsole: also copy character maps (not just fonts) from vt1 to vt2, vt3, ... (#1002450)
- localed: consider an unset model as a wildcard (#903776)
- systemd-detect-virt: detect s390 virtualization (#1139149)
- socket: introduce SELinuxContextFromNet option (#1113790)
- sysctl: make --prefix allow all kinds of sysctl paths (#1138591)
- man: mention localectl in locale.conf (#1049286)
- rules: automatically online hot-added CPUs (#968811)
- rules: add rule for naming Dell iDRAC USB Virtual NIC as 'idrac' (#1054477)
- bash-completion: add verb set-property (#1064487)
- man: update journald rate limit defaults (#1145352)
- core: don't try to connect to d-bus after switchroot (#1083300)
- localed: check for partially matching converted keymaps (#1109145)
- fileio: make parse_env_file() return number of parsed items (#1069420)


author: Lukas Nykryn <lnykryn@redhat.com> - 208-13
changelog:
- tmpfiles: minor modernizations (#1147524)
- install: when looking for a unit file for enabling, search for templates only after traversing all search directories (#1147524)
- install: remove unused variable (#1147524)
- bootctl: typo fix in help message (#1147524)
- logind: ignore failing close() on session-devices (#1147524)
- sysfs-show.c: return negative error (#1147524)
- core: only send SIGHUP when doing first kill, not when doing final sigkill (#1147524)
- cgroup: make sure to properly send SIGCONT to all processes of a cgroup if that's requested (#1147524)
- core: don't send duplicate SIGCONT when killing units (#1147524)
- efi: fix Undefined reference efi_loader_get_boot_usec when EFI support is disabled (#1147524)
- macro: better make IN_SET() macro use const arrays (#1147524)
- macro: make sure we can use IN_SET() also with complex function calls as first argument (#1147524)
- core: fix property changes in transient units (#1147524)
- load-modules: properly return a failing error code if some module fails to load (#1147524)
- core/unit: fix unit_add_target_dependencies() for units with no dependencies (#1147524)
- man: there is no ExecStopPre= for service units (#1147524)
- man: document that per-interface sysctl variables are applied as network interfaces show up (#1147524)
- journal: downgrade vaccuum message to debug level (#1147524)
- logs-show: fix corrupt output with empty messages (#1147524)
- journalctl: refuse extra arguments with --verify and similar (#1147524)
- journal: assume that next entry is after previous entry (#1147524)
- journal: forget file after encountering an error (#1147524)
- man: update link to LSB (#1147524)
- man: systemd-bootchart - fix spacing in command (#1147524)
- man: add missing comma (#1147524)
- units: Do not unescape instance name in systemd-backlight@.service (#1147524)
- manager: flush memory stream before using the buffer (#1147524)
- man: multiple sleep modes are to be separated by whitespace, not commas (#1147524)
- man: fix description of systemctl --after/--before (#1147524)
- udev: properly detect reference to unexisting part of PROGRAM's result (#1147524)
- gpt-auto-generator: don't return OOM on parentless devices (#1147524)
- man: improve wording of systemctl's --after/--before (#1147524)
- cgroup: it's not OK to invoke alloca() in loops (#1147524)
- core: don't try to relabel mounts before we loaded the policy (#1147524)
- systemctl: --kill-mode is long long gone, don't mention it in the man page (#1147524)
- ask-password: when the user types a overly long password, beep and refuse (#1147524)
- logind: don't print error if devices vanish during ACL-init (#1147524)
- tty-ask-password-agent: return negative errno (#1147524)
- journal: cleanup up error handling in update_catalog() (#1147524)
- bash completion: fix __get_startable_units (#1147524)
- core: check the right variable for failed open() (#1147524)
- man: sd_journal_send does nothing when journald is not available (#1147524)
- man: clarify that the ExecReload= command should be synchronous (#1147524)
- conf-parser: never consider it an error if we cannot load a drop-in file because it is missing (#1147524)
- socket: properly handle if our service vanished during runtime (#1147524)
- Do not unescape unit names in [Install] section (#1147524)
- util: ignore_file should not allow files ending with '~' (#1147524)
- core: fix invalid free() in killall() (#1147524)
- install: fix invalid free() in unit_file_mask() (#1147524)
- unit-name: fix detection of unit templates/instances (#1147524)
- journald: make MaxFileSec really default to 1month (#1147524)
- bootchart: it's not OK to return -1 from a main program (#1147524)
- journald: Fix off-by-one error in "Missed X kernel messages" warning (#1147524)
- man: drop references to removed and obsolete 'systemctl load' command (#1147524)
- units: fix BindsTo= logic when applied relative to services with Type=oneshot (#1147524)


author: Lukas Nykryn <lnykryn@redhat.com> - 208-15
changelog:
- core: do not segfault if /proc/swaps cannot be opened (#1151239)
- man: we don't have 'Wanted' dependency (#1152487)
- environment: append unit_id to error messages regarding EnvironmentFile (#1147691)
- udevd: add --event-timeout commandline option (#1154778)


author: Lukas Nykryn <lnykryn@redhat.com> - 208-16
changelog:
- logind: use correct "who" enum values with KillUnit. (#1155502)
- logind: always kill session when termination is requested (#1155502)
- udev: net_id - correctly name netdevs based on dev_port when set (#1155996)


author: Lukas Nykryn <lnykryn@redhat.com> - 208-17
changelog:
- udev: net_id dev_port is base 10 (#1155996)
- udev: Fix parsing of udev.event-timeout kernel parameter (#1154778)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 217-0.2
changelog:
- spec fixes
- core: introduce new Delegate=yes/no property controlling creation of cgroup subhierarchies


author: Lukáš Nykrýn <lnykryn@redhat.com> - 218-0.3
changelog:
- rebase to 218
- remove networkd tmpfiles snipets due to packaging issues
- add resolved subpackage
- backport some nspawn features from upstream


author: Lukas Nykryn <lnykryn@redhat.com> - 219-2
changelog:
- udev: restore udevadm settle timeout (#1210981)
- udev: settle should return immediately when timeout is 0 (#1210981)
- udev: Fix ping timeout when settle timeout is 0 (#1210981)
- detect-virt: use /proc/device-tree (#1207773)
- ARM: detect-virt: detect Xen (#1207773)
- ARM: detect-virt: detect QEMU/KVM (#1207773)
- Persistent by_path links for ata devices (#1045498)
- man: document forwarding to syslog better (#1177336)
- man: fix typos in previous comimt (#1177336)
- LSB: always add network-online.target to services with priority over 10 (#1189253)
- rules: enable memory hotplug (#1105020)
- rules: reload sysctl settings when the bridge module is loaded (#1182105)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-3
changelog:
- console-getty.service: don't start when /dev/console is missing (#1222517)
- resolved: Do not add .busname dependencies, when compiling without kdbus. (#1222517)
- man: add journal-remote.conf(5) (#1222517)
- mount: don't run quotaon only for network filesystems (#1222517)
- mount: fix up wording in the comment (#1222517)
- udev: net_id - fix copy-paste error (#1222517)
- man: don't mention "journalctl /dev/sda" (#1222517)
- units: move After=systemd-hwdb-update.service dependency from udev to udev-trigger (#1222517)
- units: explicitly order systemd-user-sessions.service after nss-user-lookup.target (#1222517)
- zsh-completion: update loginctl (#1222517)
- zsh-completion: add missing -M completion for journalctl (#1222517)
- zsh-completion: update hostnamectl (#1222517)
- shell-completion: systemctl switch-root verb (#1222517)
- core/automount: beef up error message (#1222517)
- man: remove 'fs' from 'rootfsflags' (#1222517)
- shared: fix memleak (#1222517)
- udevd: fix synchronization with settle when handling inotify events (#1222517)
- python-systemd: fix is_socket_inet to cope with ports (#1222517)
- man: fix examples indentation in tmpfiles.d(5) (#1222517)
- systemctl: avoid bumping NOFILE rlimit unless needed (#1222517)
- exit-status: Fix "NOTINSSTALLED" typo (#1222517)
- tmpfiles: there's no systemd-forbid-user-logins.service service (#1222517)
- kmod-setup: load ip_tables kmod at boot (#1222517)
- util: Fix assertion in split() on missing ' (#1222517)
- units: set KillMode=mixed for our daemons that fork worker processes (#1222517)
- unit: don't add automatic dependencies on device units if they aren't supported (#1222517)
- update-done: ignore nanosecond file timestamp components, they are not reliable (#1222517)
- sd-daemon: simplify sd_pid_notify_with_fds (#1222517)
- fstab-generator: add x-systemd.requires and x-systemd.requires-mounts-for (#1164334)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-4
changelog:
- core: Fix assertion with empty Exec*= paths (#1222517)
- rules: load sg module (#1186462)
- util: add shell_maybe_quote() call for preparing a string for shell cmdline inclusion (#1016680)
- bus-util: be more verbose if dbus job fails (#1016680)
- notify: fix badly backported help message (#1199644)
- cryptsetup: craft a unique ID with the source device (#1226333)
- systemctl: introduce --now for enable, disable and mask (#1233081)
- udev: also create old sas paths (#957112)
- journald: do not strip leading whitespace from messages (#1227396)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-5
changelog:
- Revert "core: one step back again, for nspawn we actually can't wait for cgroups running empty since systemd will get exactly zero notifications about it" (#1199644)
- bus-creds: always set SD_BUS_CREDS_PID when we set pid in the mask (#1230190)
- sd-bus: do not use per-datagram auxiliary information (#1230190)
- sd-bus: store selinux context at connection time (#1230190)
- journald: simplify context handling (#1230190)
- bash-completion: add verb set-property (#1235635)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-6
changelog:
- sd-bus: don't inherit connection creds into message creds when we have a direct connection (#1230190)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-8
changelog:
- sysv-generator test: Fix assertion (#1222517)
- man: avoid line break in url (#1222517)
- Add VARIANT as a standard value for /etc/os-release (#1222517)
- Fix permissions on /run/systemd/nspawn/locks (#1222517)
- generators: rename add_{root,usr}_mount to add_{sysroot,sysroot_usr}_mount (#1222517)
- Generate systemd-fsck-root.service in the initramfs (#1222517)
- units: fix typo in systemd-resolved.service (#1222517)
- core: don't consider umask for SocketMode= (#1222517)
- timedate: fix memory leak in timedated (#1222517)
- coredump: make sure we vacuum by default (#1222517)
- tmpfiles: don't fail if we cannot create a subvolume because a file system is read-only but a dir already exists anyway (#1222517)
- resolved: fix crash when shutting down (#1222517)
- resolved: allow DnsAnswer objects with no space for RRs (#1222517)
- id128: add new sd_id128_is_null() call (#1222517)
- journalctl: Improve boot ID lookup (#1222517)
- test-hashmap: fix an assert (#1222517)
- units: make sure systemd-nspawn@.slice instances are actually located in machine.slice (#1222517)
- Revert "journald-audit: exit gracefully in the case we can't join audit multicast group" (#1222517)
- journald: handle more gracefully when bind() fails on audit sockets (#1222517)
- udev: link-config - fix corruption (#1222517)
- udev/net_id: Only read the first 64 bytes of PCI config space (#1222517)
- shared: generator - correct path to systemd-fsck (#1222517)
- logind: Save the user’s state when a session enters SESSION_ACTIVE (#1222517)
- small fix ru translation (#1222517)
- kmod-setup: don't warn when ipv6 can't be loaded (#1222517)
- Partially revert "ma-setup: simplify" (#1222517)
- ima-setup: write policy one line at a time (#1222517)
- ata_id: unbotch format specifier (#1222517)
- install: explicitly return 0 on success (#1222517)
- systemd.service.xml: document that systemd removes the PIDFile (#1222517)
- core: handle --log-target=null when calling systemd-shutdown (#1222517)
- man: ProtectHome= protects /root as well (#1222517)
- timedatectl: trim non-local RTC warning to 80 chars wide (#1222517)
- escape: fix exit code (#1222517)
- man: information about available properties (#1222517)
- journal: in persistent mode create /var/log/journal, with all parents. (#1222517)
- sysv-generator: fix wrong "Overwriting existing symlink" warnings (#1222517)
- mount: don't claim a device is gone from /proc/self/mountinfo before it is gone from *all* lines (#1222517)
- mount: properly check for mounts currently in /proc/self/mountinfo (#1222517)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-9
changelog:
- units: add [Install] section to tmp.mount
- bus-util: add articles to explanation messages (#1016680)
- bus-util: print correct warnings for units that fail but for which we have a NULL result only (#1016680)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-11
changelog:
- journald-server: don't read audit events (#1252409)
- everything: remove traces of --user (#1071363)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-12
changelog:
- selinux: fix check for transient units (#1255129)
- socket: fix setsockopt call. SOL_SOCKET changed to SOL_TCP. (#1135599)
- selinux: fix missing SELinux unit access check (#1185120)
- selinux: always use *_raw API from libselinux (#1256888)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-14
changelog:
- Revert "sysctl.d: default to fq_codel, fight bufferbloat" (#1263158)
- loginctl: print nontrivial properties in logictl show-* (#1260465)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-15
changelog:
- login: fix label on /run/nologin (#1264073)
- udev-rules: prandom character device node permissions (#1264112)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-16
changelog:
- login: fix gcc warning, include missing header file (#1264073)
- shutdown: make sure /run/nologin has correct label (#1264073)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-17
changelog:
- sd-event: fix prepare priority queue comparison function (#1266479)
- units: run ldconfig also when cache is unpopulated (#1265539)
- selinux: fix regression of systemctl subcommands when absolute unit file paths are specified (#1185120)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-19
changelog:
- udev: make naming for virtio devices opt-in (#1269216)
- tmpfiles.d: don't clean SAP sockets either (#1186044)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-20
changelog:
- run: synchronously wait until the scope unit we create is started (#1272368)
- device: rework how we enter tentative state (#1283579)
- core: Do not bind a mount unit to a device, if it was from mountinfo (#1283579)
- logind: set RemoveIPC=no by default (#1284588)
- sysv-generator: follow symlinks in /etc/rc.d/init.d (#1285492)
- sysv-generator test: always log to console (#1279034)
- man: RemoveIPC is set to no on rhel (#1284588)
- Avoid /tmp being mounted as tmpfs without the user's will (#1298109)
- test sysv-generator: Check for network-online.target. (#1279034)
- arm/aarch64: detect-virt: check dmi (#1278165)
- detect-virt: dmi: look for KVM (#1278165)
- Revert "journald: turn ForwardToSyslog= off by default" (#1285642)
- terminal-util: when resetting terminals, don't wait for carrier (#1266745)
- basic/terminal-util: introduce SYSTEMD_COLORS environment variable (#1247963)
- ask-password: don't abort when message is missing (#1261136)
- sysv-generator: do not join dependencies on one line, split them (#1288600)
- udev: fibre channel: fix NPIV support (#1266934)
- ata_id: unreverse WWN identifier (#1273306)
- Fixup WWN bytes for big-endian systems (#1273306)
- sd-journal: introduce has_runtime_files and has_persistent_files (#1082179)
- journalctl: improve error messages when the specified boot is not found (#1082179)
- journalctl: show friendly info when using -b on runtime journal only (#1082179)
- journalctl: make "journalctl /dev/sda" work (#947636)
- journalctl: add match for the current boot when called with devpath (#947636)
- man: clarify what happens when journalctl is called with devpath (#947636)
- core: downgrade warning about duplicate device names (#1296249)
- udev: downgrade a few warnings to debug messages (#1289461)
- man: LEVEL in systemd-analyze set-log level is not optional (#1268336)
- Revert "udev: fibre channel: fix NPIV support" (#1266934)
- udev: path-id: fibre channel NPIV - use fc_vport's port_name (#1266934)
- systemctl: is-active/failed should return 0 if at least one unit is in given state (#1254650)
- rules: set SYSTEMD_READY=0 on DM_UDEV_DISABLE_OTHER_RULES_FLAG=1 only with ADD event (#1312011)
- s390: add personality support (#1300344)
- socket_address_listen - do not rely on errno (#1316452)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-21
changelog:
- path_id: reintroduce by-path links for virtio block devices (#952567)
- journal: fix error handling when compressing journal objects (#1292447)
- journal: irrelevant coding style fixes (#1292447)
- install: follow unit file symlinks in /usr, but not /etc when looking for [Install] data (#1159308)
- core: look for instance when processing template name (#1159308)
- core: improve error message when starting template without instance (#1142369)
- man/tmpfiles.d: add note about permissions and ownership of symlinks (#1296288)
- tmpfiles: don't follow symlinks when adjusting ACLs, fille attributes, access modes or ownership (#1296288)
- udev: filter out non-sensically high onboard indexes reported by the kernel (#1230210)
- test-execute: add tests for RuntimeDirectory (#1324826)
- core: fix group ownership when Group is set (#1324826)
- fstab-generator: cescape device name in root-fsck service (#1306126)
- core: add new RandomSec= setting for time units (#1305279)
- core: rename Random* to RandomizedDelay* (#1305279)
- journal-remote: change owner of /var/log/journal/remote and create /var/lib/systemd/journal-upload (#1327303)
- Add Seal option in the configuration file for journald-remote (#1329233)
- tests: fix make check failure (#1159308)
- device: make sure to not ignore re-plugged device (#1332606)
- device: Ensure we have sysfs path before comparing. (#1332606)
- core: fix memory leak on set-default, enable, disable etc (#1331667)
- nspawn: fix minor memory leak (#1331667)
- basic: fix error/memleak in socket-util (#1331667)
- core: fix memory leak in manager_run_generators() (#1331667)
- modules-load: fix memory leak (#1331667)
- core: fix memory leak on failed preset-all (#1331667)
- sd-bus: fix memory leak in test-bus-chat (#1331667)
- core: fix memory leak in transient units (#1331667)
- bus: fix leak in error path (#1331667)
- shared/logs-show: fix memleak in add_matches_for_unit (#1331667)
- logind: introduce LockedHint and SetLockedHint (#3238) (#1335499)
- import: use the old curl api (#1284974)
- importd: drop dkr support (#1284974)
- import: add support for gpg2 for verifying imported images (#1284974)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-22
changelog:
- nspawn: when connected to pipes for stdin/stdout, pass them as-is to PID 1 (#1307080)
- mount: remove obsolete -n (#1339721)
- core: don't log job status message in case job was effectively NOP (#3199) (#1280014)
- core: use an AF_UNIX/SOCK_DGRAM socket for cgroup agent notification (#1305608)
- logind: process session/inhibitor fds at higher priority (#1305608)
- Teach bus_append_unit_property_assignment() about 'Delegate' property (#1337922)
- sd-netlink: fix deep recursion in message destruction (#1330593)
- add REMOTE_ADDR and REMOTE_PORT for Accept=yes (#1341154)
- core: don't dispatch load queue when setting Slice= for transient units (#1343904)
- run: make --slice= work in conjunction with --scope (#1343904)
- myhostname: fix timeout if ipv6 is disabled (#1330973)
- readahead: do not increase nr_requests for root fs block device (#1314559)
- manager: reduce complexity of unit_gc_sweep (#3507) (#1344556)
- hwdb: selinuxify a bit (#3460) (#1343648)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-23
changelog:
- udevadm: explicitly relabel /etc/udev/hwdb.bin after rename (#1350756)
- systemctl: return diffrent error code if service exist or not (#3385) (#1047466)
- systemctl: Replace init script error codes with enum (#3400) (#1047466)
- systemctl: rework "systemctl status" a bit (#1047466)
- journal-verify: don't hit SIGFPE when determining progress (#1350232)
- journal: avoid mapping empty data and field hash tables (#1350232)
- journal: when verifying journal files, handle empty ones nicely (#1350232)
- journal: explain the error when we find a non-DATA object that is compressed (#1350232)
- journalctl: properly detect empty journal files (#1350232)
- journal: uppercase first character in verify error messages (#1350232)
- journalctl: make sure 'journalctl -f -t unmatched' blocks (#1350232)
- journalctl: don't print -- No entries -- in quiet mode (#1350232)
- sd-event: expose the event loop iteration counter via sd_event_get_iteration() (#1342173)
- manager: Only invoke a single sigchld per unit within a cleanup cycle (#1342173)
- manager: Fixing a debug printf formatting mistake (#1342173)
- core: support IEC suffixes for RLIMIT stuff (#1351415)
- core: accept time units for time-based resource limits (#1351415)
- time-util: add parse_time(), which is like parse_sec() but allows specification of default time unit if none is specified (#1351415)
- core: support <soft:hard> ranges for RLIMIT options (#1351415)
- core: fix rlimit parsing (#1351415)
- core: dump rlim_cur too (#1351415)
- install: fix disable via unit file path (#1348208)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-25
changelog:
- units: increase watchdog timeout to 3min for all our services (#1267707)
- core: bump net.unix.max_dgram_qlen really early during boot (#1267707)
- core: fix priority ordering in notify-handling (#1267707)
- tests: fix personality tests on ppc64 and aarch64 (#1361049)
- systemctl: consider service running only when it is in active or reloading state (#3874) (#1362461)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-26
changelog:
- install: do not crash when processing empty (masked) unit file (#1159308)
- Revert "install: fix disable via unit file path" (#1348208)
- systemctl: allow disable on the unit file path, but warn about it (#3806) (#1348208)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-27
changelog:
- tmpfiles: enforce ordering when executing lines (#1365870)
- Introduce bus_unit_check_load_state() helper (#1256858)
- core: use bus_unit_check_load_state() in transaction_add_job_and_dependencies() (#1256858)
- udev/path_id: correct segmentation fault due to missing NULL check (#1365556)
- rules: load sg driver also when scsi_target appears (#45) (#1322773)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-29
changelog:
- fix gcc warnings about uninitialized variables (#1318994)
- journalctl: rework code that checks whether we have access to /var/log/journal (#1318994)
- journalctl: Improve boot ID lookup (#1318994)
- journalctl: only have a single exit path from main() (#1318994)
- journalctl: free all command line argument objects (#1318994)
- journalctl: rename boot_id_t to BootId (#1318994)
- util: introduce CMSG_FOREACH() macro and make use of it everywhere (#1318994)
- journald: don't employ inner loop for reading from incoming sockets (#1318994)
- journald: fix count of object meta fields (#1318994)
- journal-cat: return a correct error, not -1 (#1318994)
- journalctl: introduce short options for --since and --until (#1318994)
- journal: s/Envalid/Invalid/ (#1318994)
- journald: dispatch SIGTERM/SIGINT with a low priority (#1318994)
- lz4: fix size check which had no chance of working on big-endian (#1318994)
- journal: normalize priority of logging sources (#1318994)
- Fix miscalculated buffer size and uses of size-unlimited sprintf() function. (#1318994)
- journal: Drop monotonicity check when appending to journal file (#1318994)
- journalctl: unify how we free boot id lists a bit (#1318994)
- journalctl: don't trust the per-field entry tables when looking for boot IDs (#1318994)
- units: remove udev control socket when systemd stops the socket unit (#49) (#1370133)
- logind: don't assert if the slice is missing (#1371437)
- core: enable transient unit support for slice units (#1370299)
- sd-bus: bump message queue size (#1371205)
- install: fix disable when /etc/systemd/system is a symlink (#1285996)
- rules: add NVMe rules (#3136) (#1274651)
- rules: introduce disk/by-id (model_serial) symlinks for NVMe drives (#3974) (#1274651)
- rules: fix for possible whitespace in the "model" attribute (#1274651)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-30
changelog:
- systemctl,pid1: do not warn about missing install info with "preset" (#1373950)
- systemctl/core: ignore masked units in preset-all (#1375097)
- shared/install: handle dangling aliases as an explicit case, report nicely (#1375097)
- shared/install: ignore unit symlinks when doing preset-all (#1375097)
- 40-redhat.rules: don't hoplug memory on s390x (#1370161)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-30.1
changelog:
- If the notification message length is 0, ignore the message (#4237) (#1381573)
- systemctl: suppress errors with "show" for nonexistent units and properties (#1380686)
- 40-redhat.rules: disable auto-online of hot-plugged memory on IBM z Systems (#1381123)
- pid1: don't return any error in manager_dispatch_notify_fd() (#4240) (#1381573)
- pid1: process zero-length notification messages again (#1381573)
- pid1: more informative error message for ignored notifications (#1381573)


author: Michal Sekletar <msekleta@redhat.com> - 219-30.5
changelog:
- on update from systemd version 219-21 and older generate udev rules that preserve old network interface names on VMware VMs (#1391944)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-31
changelog:
- If the notification message length is 0, ignore the message (#4237) (#1380175)
- systemctl: suppress errors with "show" for nonexistent units and properties (#1380259)
- 40-redhat.rules: disable auto-online of hot-plugged memory on IBM z Systems (#1375603)
- pid1: don't return any error in manager_dispatch_notify_fd() (#4240) (#1380259)
- pid1: process zero-length notification messages again (#1380259
- pid1: more informative error message for ignored notifications (#1380259)
- manager: 219 needs u->id in log_unit_debug (#1380259)
- virt: add possibility to skip the check for chroot (#1379852)
- load-fragment: fix parsing values in bytes and prevent returning -ERANGE incorrectly (#1396277)
- core: fix assertion check (#1396312)
- tmp.mount.hm4: After swap.target (#3087) (#1298355)
- make sure all swap units are ordered before the swap target (#1298355)
- Recognise Lustre as a remote file system (#4530) (#1390542)
- unit: don't add Requires for tmp.mount (#1372249)
- core: return 0 from device_serialize() (#1403249)
- mtd_probe: include stdint (#1404251)
- tests: fix failure of test-execute if /dev/mem is not available (#5028) (#1410056)
- sd-journal: properly export has_{persistent|runtime}_files() (#1409527)
- core: add possibility to set action for ctrl-alt-del burst (#4105) (#1353028)
- failure-action: generalize failure action to emergency action (#1353028)
- core: use emergency_action for ctr+alt+del burst (#1353028)
- udev/path_id: introduce support for NVMe devices (#4169) (#1373150)
- core: fix CapabilityBoundingSet merging (#1409586)
- core: fix capability bounding set parsing (#1409586)
- core: make parsing of RLIMIT_NICE aware of actual nice levels (#1409588)
- shared: fix double free in unmask (#5005) (#1409997)
- shared: fix double free in link (#1409997)
- shared: check strdup != NULL (#1409997)
- core: improve error message when RefuseManualStart(Stop) is hit (#5132) (#1026648)
- systemctl: fix 'is-enabled' exit status on failure when executed in chroot (#4773) (#1413964)
- man: document that the automatic journal limits are capped to 4G by default (#1418547)
- random-seed: raise POOL_SIZE_MIN to 1024 (#1386824)
- bash-completion: add support for --now (#5155) (#1351806)
- basic: fix touch() creating files with 07777 mode (#1416062)
- udev: net_id: add support for phys_port_name attribute (#4506) (#1392426)
- install: introduce UnitFileFlags (#1413041)
- shared, systemctl: teach is-enabled to show installation targets (#1413041)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-32
changelog:
- udev: fix crash with invalid udev.log-priority (#1245293)
- core: make exec code a bit more readable (#1421181)
- core: Private*/Protect* options with RootDirectory (#1421181)
- core: if the start command vanishes during runtime don't hit an assert (#1421658)
- systemctl: make sure that --now is carried out (#5209) (#1417459)
- udev: inform systemd how many workers we can potentially spawn (#4036) (#1361601)
- service: log_unit consumes id of unit not a unit (#1421658)
- automount: add expire support (#1354410)
- fstab-generator: fix memleak (#1354410)
- remove bus-proxyd (#1317518)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-33
changelog:
- execute: Add new PassEnvironment= directive (#1426214)
- test-execute: Add tests for new PassEnvironment= directive (#1426214)
- test-execute: Clarify interaction of PassEnvironment= and MANAGER_USER (#1426214)
- load-fragment: resolve specifiers in RuntimeDirectory (#1428110)
- Add microphone mute keymap for Dell Precision (#1413477)
- hwdb: update micmute YCODE on device node at DELL LATITUDE laptops for mic mute button. (#5012) (#1413477)
- udev/path_id: improve and enhance bus detection for Linux on z Systems (#1274401)
- core: port config_parse_bounding_set to extract_first_word (#1387398)
- core: simplify parsing of capability bounding set settings (#1387398)
- test: add test for capability bounding set parsing (#1387398)
- capabilities: keep bounding set in non-inverted format. (#1387398)
- capabilities: added support for ambient capabilities. (#1387398)
- man: add AmbientCapabilities entry. (#1387398)
- test-capability: rebase to upstream version (#1387398)
- namespace: don't fail on masked mounts (#1433687)
- sysv-generator: Provides: $network should also pull network.target to transaction (#5652) (#1438749)
- Install: correctly report symlink creations (#1435098)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-35
changelog:
- tmpfiles: add new 'e' action which cleans up a dir without creating it (#1225739)
- util:bind_remount_recursive(): handle return 0 of set_consume() (#1433687)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-37
changelog:
- core: add support for the "pids" cgroup controller (#1337244)
- core: add new DefaultTasksMax= setting for system.conf (#1337244)
- logind: add a new UserTasksMax= setting to logind.conf (#1337244)
- core: support percentage specifications on TasksMax= (#1337244)
- core: reinstate propagation of stop/restart jobs via RequsiteOf dependencies (#1436021)
- core: when propagating restart requests due to deps, downgrade restart to try-restart (#1436021)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-39
changelog:
- tests: set tasks_max to infinity (#1337244)
- Avoid forever loop for journalctl --list-boots command (#4278) (#1294516)
- sd-journal: return SD_JOURNAL_INVALIDATE only if journal files were actually deleted/moved (#5580) (#1446140)
- load-fragment: don't print error about incorrect syntax when IPv6 is disabled (#1377055)
- core: manager: add some missing dbus properties (#1427927)
- core: manager: expose DefaultLimit* as properties on dbus (#1427927)
- fstab-generator: remove bogus condition (#1446171)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-40
changelog:
- readahead-collect: don't print warning message when handling symlink (#1387095)
- tmpfiles: don't recursively descend into journal directories in /var (#1411199)
- tmpfiles: also set acls on /var/log/journal (#1411199)
- tmpfiles: set acls on system.journal explicitly (#1411199)
- sysctl: configure kernel parameters in the order they occur in each sysctl configuration files (#4205) (#1382244)
- units: drop explicit NotifyAccess setting from journald's unit file (#5749) (#1444356)
- systemd-notify: Always pass a valid pid to sd_pid_notify (#1381743)
- sd_pid_notify_with_fds: fix computing msg_controllen (#1381743)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-43
changelog:
- tests: use XFS as root filesystem for system tests (#1475870)
- tests: use fdisk instead of sfdisk (#1475870)
- Revert "udev: net_id: add support for phys_port_name attribute (#4506)" (#1477285)
- reintroduce naming based on phys_port_name for mlxsw and rocker via udev rule


author: Lukas Nykryn <lnykryn@redhat.com> - 219-44
changelog:
- core: unset sysfs path after transition to dead state (#1408916)
- sysctl: fix uninitialized variable (#1485121)
- udev: ignore SIGCHLD from unexpected processes (#1306539) (#1306539)
- compile with -Werror (#1447937)
- myhostname: don't return any ipv6 entries when ipv6 is disabled (#1444824)
- core:execute: fix fork() fail handling in exec_spawn() (#1437114)
- fix compilation after commit 382877acc6c029e59e359a076d203ca03b4b9e9e (#1447937)
- Redefine 32bit time_t format to signed (#1447937)
- sd-bus/bus-kernel.c: fix format errors on ppc64le (#1447937)
- tmpfiles: with "e" don't attempt to set permissions when file doesn't exist (#1445732)
- units: introduce getty-pre.target (#6667) (#1173080)
- units: order container and console getty units after getty-pre.target (#1173080)
- log: never log into foreign fd #2 in PID 1 or its pre-execve() children (#1420505)
- nspawn: new option to start as PID2 (#1417387)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-45
changelog:
- journal: implicitly flush to var on recovery (#4028) (#1364092)
- journal: add/use flushed_flag_is_set() helper (#4041) (#1364092)
- journald: don't flush to /var/log/journal before we get asked to (#1364092)
- path-util: make use of "mnt_id" field exported in /proc/self/fdinfo/<fd> (#1472439)
- Revert "Revert "journald: allow restarting journald without losing stream connections"" (#1359939)
- journald: make sure we retain all stream fds across restarts (#6348) (#1359939)
- Allow systemd-tmpfiles to set the file/directory attributes (#1299714)
- tmpfiles: rework file attribute code (#1299714)
- tmpfiles: warn if we get an argument on lines that don't take any (#1299714)
- tmpfiles: substitute % specifiers in arguments for writing files and xattrs (#1299714)
- btrfs-util: introduce btrfs_is_filesystem() and make use of it where appropriate (#1299714)
- journal: don't force FS_NOCOW_FL on new journal files, but warn if it is missing (#1299714)
- tmpfiles: Add +C attrib to the journal files directories (#1299714)
- Revert "path-util: make use of "mnt_id" field exported in /proc/self/fdinfo/<fd>" (#1472439)
- device: make sure to remove all device units sharing the same sysfs path (#6679) (#1408916)
- manager: when reexecuting try to connect to bus only when dbus.service is around (#6773) (#1465737)
- doc: document service exit codes (#1178929)
- units: order cryptsetup-pre.target before cryptsetup.target (#1384014)
- man: add an explicit description of _netdev to systemd.mount(5) (#1384014)
- units: add remote-cryptsetup.target and remote-cryptsetup-pre.target (#1384014)
- cryptsetup-generator: use remote-cryptsetup.target when _netdev is present (#1384014)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-46
changelog:
- Support 'rdma' as a ListenNetlink= argument (#6626) (#1494610)
- core/namespace: Protect /usr instead of /home with ProtectSystem=yes (#1493047)
- udev: Use parent bus id for virtio disk builtin path-id (#5500) (#1496697)
- socket-util: socket_address_parse() should not log errors on its own (#1497639)
- test: fix failing test-socket-util when running with ipv6.disable=1 kernel param (#1497639)
- scsi_id: add missing options to getopt_long() (#6501) (#1476910)
- unmount: Pass in mount options when remounting read-only (#1312002)
- shutdown: don't remount,ro network filesystems. (#6588) (#1312002)
- shutdown: fix incorrect fscanf() result check (#6806) (#1312002)
- path-util: make use of "mnt_id" field exported in /proc/self/fdinfo/<fd> (#1472439)
- support ranges when parsing CPUAffinity (#1493976)
- man: Update man page documentation for CPUAffinity (#1493976)
- test-path-util: force rm_rf (#1472439)
- Export NVMe WWID udev attribute (#5348) (#1503253)
- mount: make sure we unmount tmpfs mounts before we deactivate swaps (#7076) (#1437518)
- journald: never accept fds from file systems with mandatory locking enabled (#1501017)
- udev: builtin-keyboard: move fetching the device node up (#1500119)
- udev: builtin-keyboard: immediately EVIOCSKEYCODE when we have a pair (#1500119)
- udev: builtin-keyboard: move actual key mapping to a helper function (#1500119)
- udev: builtin-keyboard: invert a condition (#1500119)
- udev: builtin-keyboard: add support for EVDEV_ABS_* (#1500119)
- hwdb: sync 60-evdev.hwdb from systemd v235 (rhbz#1500119)
- journal: ensure open journals from find_journal() (#3973) (#1493846)
- journal: only check available space when journal is open (#1493846)
- automount: if an automount unit is masked, don't react to activation anymore (#5445) (#1498318)
- units: add [Install] section to remote-cryptsetup.target (#1477757)
- units: replace remote-cryptsetup-pre.target with remote-fs-pre.target (#1477757)
- man: add a note about _netdev usage (#1477757)
- units: make remote-cryptsetup.target also after cryptsetup-pre.target (#1477757)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-47
changelog:
- cryptsetup-generator: use after free (#1477757)
- manager: fix connecting to bus when dbus is actually around (#7205) (#1465737)
- journal-remote: make --url option support arbitrary url (#1505385)
- journald: make maximum size of stream log lines configurable and bump it to 48K (#6838) (#1442262)
- service: serialize information about currently executing command (#1404657,#1471230)
- tests: add new test for issue #518 (#1404657,)
- tests: in RHEL-7 we don't have python3 by default (#1404657,)
- service: attempt to execute next main command only for oneshot services (#6619) (#1404657,)
- timedatectl: stop using xstrftime (#1503942)
- Add support to read lz4 compressed journals (rhbz#1431687)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-48
changelog:
- journald: never block when sending messages on NOTIFY_SOCKET socket (#1511565)
- journal: restore watchdog support (#1511565)
- cgroup resource property setting ignored if einval (rhbz#1302305)
- fileio: add new helper call read_line() as bounded getline() replacement (#1503106)
- def: add new constant LONG_LINE_MAX (#1503106)
- fileio: rework read_one_line_file() on top of read_line() (#1503106)
- cgroup-util: replace one use of fgets() by read_line() (#1503106)
- conf-parse: remove 4K line length limit (#1503106)
- test-conf-parser: add tests for config parser (#1503106)
- fileio: use _cleanup_ for FILE unlocking (#1503106)
- test-fileio: also test read_line() with actual files (#1503106)
- fileio: return 0 from read_one_line_file on success (#1503106)
- man: fix description of --force in halt(8) (#7392) (#1515130)
- journal: return better error for empty files (#1465759)
- journalctl: continue operation, even if we run into an invalid file (#1465759)
- journal: remove error check that never happens (#1465759)
- sd-journal: various clean-ups and modernizations (#1465759)
- journalctl: when we fail to open a journal file, print why (#1465759)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-50
changelog:
- core: fix the reversed sanity check when setting StartupBlockIOWeight over dbus (#1302305)
- shared/dropin: ignore ENAMETOOLONG when checking drop-in directories (#7525) (#1489095)
- enable display manager only on systemd installation (#1464893)
- remove unnecessary dependency on dracut (#1466676)
- substitute PACKAGE_STRING with the actual package NVR (#1453153)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-52
changelog:
- cryptsetup: when unlocking always put path to the object into Id (#1511043)
- cryptsetup: use more descriptive name for the variable and drop redundant function (#1511043)
- cryptsetup-generator: do not bind to the decrypted device unit (#6538) (#1511043)
- introduce naming based on phys_port_name for nfp via udev rule (#1516283)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-54
changelog:
- automount: ack automount requests even when already mounted (#1535135)
- udev: net_id add support for platform bus (ACPI, mostly arm64) devices (#1529633)
- journald-native: Fix typo in MANDLOCK message (#1501017)
- process-util: make our freeze() routine do something useful (#1540941)
- dbus: propagate errors from bus_init_system() and bus_init_api() (#1541061)
- bus-util.c: fix TasksMax= property assignment (#1537147)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-55
changelog:
- sparse: avoid clash with __bitwise and __force from 4.10 linux/types.h (#5061) (#1447937)
- core: Let two more booleans survive a daemon-reload (#1542391)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-57
changelog:
- sd-journal: properly handle inotify queue overflow (#1540538)
- sd-journal: make sure it's safe to call sd_journal_process() before the first sd_journal_wait() (#1540538)
- journalctl: Periodically call sd_journal_process in journalctl (#1540538)
- sd-journal: when picking up a new file, compare inode/device info with previous open file by same name (#1540538)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-58
changelog:
- tmpfiles: don't skip cleanup of read-only root owned files if TMPFILES_AGE_ALL is set (#1533638)
- timer: we already got the trigger before, no need to call UNIT_TRIGGER again (#1549119)
- doc: fix links to binfmt_misc kernel documentation (#1572244)
- man/udevadm: remove superfluous --version from subcommand (#1553076)
- man/udevadm: correctly show the short version of --exit (#1552712)
- core/timer: downgrade message about random time addition (#5229) (#1587906)
- fd-util: add new acquire_data_fd() API helper (#1446095)
- systemd-analyze: make dump work for large # of units (#1446095)
- use max. message size allowed by DBus spec (#8936) (#1446095)
- cryptsetup: support LUKS2 on-disk format (#1573838)
- units: don't put udev to its own mount namespace with slave propagation (#1432211)
- rules: disable support for Lenovo IR cameras (#1540418)
- core: make sure "systemctl reload-or-try-restart is actually a noop if a unit is not running (#1191920)
- core: fix confusing logging of instantaneous jobs (#1506256)
- core: correct return value from reload methods (#1506256)
- core: always try harder to get unit status message format string (#1506256)
- core: unit_get_status_message_format() never returns NULL (#1506256)
- core: try harder to get job completion messages too (#1506256)
- core: remove generic job completion messages from unit vtables (#1506256)
- core: do not log done failed-condition jobs as if unit started (#1506256)
- core: log completion of remaining job types (#1506256)
- core: adjust job completion message log levels (#1506256)
- mount: add new LazyUnmount= setting for mount units, mapping to umount(8)'s "-l" switch (#3827) (#1497264)
- rules: Add MODEL_ID for NVMe device (#7037) (#1397264)
- umount: always use MNT_FORCE in umount_all() (#7213) (#1571098)
- core: Implement timeout based umount/remount limit (#1571098)
- core: Implement sync_with_progress() (#1571098)
- journal: forward messages from /dev/log unmodified to syslog.socket (#1409659)
- tmpfiles: use safe_glob() (#1436004)
- core: delay adding target dependencies until all units are loaded and aliases resolved (#8381) (#1368856)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-59
changelog:
- man: correct the meaning of TimeoutStopSec= (#1305509)
- rules: mark hotplugged memory as movable (#1563532)
- udev: add ID_INPUT_SWITCH for devices with switch capability (#5057) (#1597240)
- rules: disable support for Dell IR cameras (#1591316)
- rpm: fix 
if [ $1 -eq 1 ] ; then 
                systemctl preset \--global  >/dev/null 2>&1 || : 
fi 
() macro. (#1582383)
- rpm: remove confusing --user before --global (#1582383)
- automount: handle state changes of the corresponding mount unit correctly (#1596241)
- man: document that SIGCONT always follows SIGTERM (#1601794)
- rules: add udev rule that automatically offline HW attached to ACPI container (#1597958)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-60
changelog:
- Revert "rules: mark hotplugged memory as movable" (#1614686)
- rules: implement new memory hotplug policy (#1614686)
- Revert "rules: add udev rule that automatically offline HW attached to ACPI container" (#1597958)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-62
changelog:
- cryptsetup-generator: introduce basic keydev support (#1619743)
- cryptsetup-generator: don't return error if target directory already exists (#1619743)
- cryptsetup-generator: allow whitespace characters in keydev specification (#1619743)
- Make sure the mount units pulled by 'RequiresMountsFor=' are loaded (if they exist) (#1619743)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-63
changelog:
- dhcp6: make sure we have enough space for the DHCP6 option header (CVE-2018-15688)
- journald: do not store the iovec entry for process commandline on stack (#1657788)
- journald: set a limit on the number of fields (1k) (#1657792)
- journal-remote: set a limit on the number of fields in a message (#1657792)
- journald: free cmdline buffers owned by iovec (#1666646)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-64
changelog:
- detect-virt: do not try to read all of /proc/cpuinfo (#1631531)
- core: disable the effect of Restart= if there's a stop job pending for a service (#6581) (#1626382)
- networkd: respect DHCP UseRoutes option (#1663365)
- networkd: fix dhcp4 link without routes not being considered ready (#8728) (#1663365)
- networkd: dont crash when mtu changes (#6594) (#1663365)
- tmpfiles: "e" takes globs (#1641764)
- tmpfiles: 'e' is supposed to operate on directory only (#1641764)
- tmpfiles: 'e' is supposed to accept shell-style globs (#1641764)
- bus-message: do not crash on message with a string of zero length (#1643396)
- Revert "bus: when dumping string property values escape the chars we use as end-of-line and end-of-item marks" (#1643172)
- set automount state to waiting when the mount is stopped (#1651257)
- core: when deserializing state always use read_line(…, LONG_LINE_MAX, …) (CVE-2018-15686)
- shorten hostname before checking for trailing dot (#1631625)
- journald: fixed assertion failure when system journal rotation fails (#9893) (#1619543)
- local-addresses: handle gracefully if routes lack an RTA_OIF attribute (#1627750)
- rules: fix memory hotplug rule so systemd-detect-virt does not run too often (#1666612)
- 6647 - use path_startswith("/dev") in cryptsetup (#6732) (#1664695)
- core: mount-setup: handle non-existing mountpoints gracefully (#1585411)
- units/rescue.service.in: fix announcement message (#1660422)
- systemctl: Allow 'edit' and 'cat' on unloaded units (#1649518)
- main: improve RLIMIT_NOFILE handling (#5795) (#1585913)
- shared/sleep-config: exclude zram devices from hibernation candidates (#1609816)
- journalctl: allow --file/--directory with --boot or --list-boots (#1463678)
- journalct: allow --boot=0 to DTRT with --file/--directory (#1463678)
- journal-remote: show error message if output file name does not end with .journal (bz#1267552)
- artificially serialize building of .policy files (#1272485)
- cryptsetup: add support for sector-size= option (#9936) (#1571801)
- cryptsetup: do not define arg_sector_size if libgcrypt is v1.x (#9990) (#1571801)
- journal: fix syslog_parse_identifier() (#1657794)
- journal: do not remove multiple spaces after identifier in syslog message (#1657794)
- tmpfiles: change ownership of symlinks too (#1620110)
- tmpfiles: fix check for figuring out whether to call chmod() (#1620110)
- shared/install: allow "enable" on linked unit files (#1628575)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-65
changelog:
- backport fd_is_fs_type (#1663143)
- backport chase_symlinks (#1663143)
- fs-util: add new CHASE_SAFE flag to chase_symlinks() (#1663143)
- fs-util: add new chase_symlinks() flag CHASE_OPEN (#1663143)
- sd-dameon: also sent ucred when our UID differs from EUID (#1663143)
- notify: add new --uid= command (#1663143)
- core: be stricter when handling PID files and MAINPID sd_notify() messages (#1663143)
- journald: respect KeepFree= as well as MaxUse= values (#1361893)
- shutdown: in_container was used before its definition (#1693716)
- core: Fix edge case when processing /proc/self/mountinfo (#1691511)
- sd-bus: deal with cookie overruns (#1693559)
- Refuse dbus message paths longer than BUS_PATH_SIZE_MAX limit. (#1667871)
- Allocate temporary strings to hold dbus paths on the heap (#1667871)
- sd-bus: if we receive an invalid dbus message, ignore and proceeed (#1667871)
- udev: check if the spawned PID didn't exit after reaping unexpected PID (#1697909)
- udev: call poll() again after killing the spawned process (#1697909)
- udev: check age against both timeouts to prevent integer wraparound (#1697909)
- avoid possible hang if our child process hangs (#1697909)
- missing: when adding syscall replacements, use different names (#1694605)
- include sys/sysmacros.h in more places (#1694605)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-66
changelog:
- sd-bus: unify three code-paths which free struct bus_container (#1643394)
- hashmap: don't use mempool (#1609349)
- man: be more explicit about thread safety of sd_journal (#1609349)
- selinux: don't log SELINUX_INFO and SELINUX_WARNING messages to audit (#1240730)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-67.1
changelog:
- return error value on failure (#1729226)
- revert local changes made during backport of the test (#1729226)
- core/timer: Prevent timer looping when unit cannot start (#1729230)
- core: add a "Requires=" dependency between units and the slices they are located in (#1729228)
- core: rerun GC logic for a unit that loses a reference (#1729228)
- pid1: rename unit_check_gc to unit_may_gc (#1729228)
- pid1: include the source unit in UnitRef (#1729228)
- pid1: fix collection of cycles of units which reference one another (#1729228)
- pid1: free basic unit information at the very end, before freeing the unit (#1729228)
- pid1: properly remove references to the unit from gc queue during final cleanup (#1729228)
- service: relax PID file symlink chain checks a bit (#8133) (#1729414)
- path-util: fix more path_is_mount e792e890f fallout (#1279231)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-69
changelog:
- revert local changes made during backport of the test (#1726785)
- core: add a "Requires=" dependency between units and the slices they are located in (#1718953)
- core: rerun GC logic for a unit that loses a reference (#1718953)
- pid1: rename unit_check_gc to unit_may_gc (#1718953)
- pid1: include the source unit in UnitRef (#1718953)
- pid1: fix collection of cycles of units which reference one another (#1718953)
- pid1: free basic unit information at the very end, before freeing the unit (#1718953)
- pid1: properly remove references to the unit from gc queue during final cleanup (#1718953)
- core/timer: Prevent timer looping when unit cannot start (#1710302)
- service: relax PID file symlink chain checks a bit (#8133) (#1724420)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-70
changelog:
- udev-rules: Add rule for /dev/kfd (#1659516)
- core: exclude .slice units from "systemctl isolate" (#1745199)
- udev/scsi_id: fix incorrect page length when get device identification VPD page (#1635945)
- core: when determining whether a process exit status is clean, consider whether it is a command or a daemon (#1560417)
- units: add Wants=initrd-cleanup.service to initrd-switch-root.target (#4345) (#1560417)
- units: make sure initrd-cleanup.service terminates before switching to rootfs (#1560417)
- core: tiny tweak for cgroup trimming during manager_free() (#1630378)
- process: an empty environment block should be returned as such (#1685648)
- core: make sure initrd-switch-root command survives PID1's killing spree (#4730) (#1754053)
- systemctl: always avoid being killed when doing switch-root (#1754053)
- units: drop KillMode= from initrd-switch-root.service (#1754053)
- systemctl: ignore SIGTERM after switch root (#1754053)
- units: restore Before dependencies for systemd-vconsole-setup.service (#1754053)
- core: reduce the number of stalled PIDs from the watched processes list when possible (#1501796)
- timedate: use gmtime_r() and localtime_r() (#1694605)
- sd-bus: stop using the result of an assignment as an operand of && (#1694605)
- journal-upload: add asserts that snprintf does not return an error (#1694605)
- analyze: actually select longest activated-time of services (#1694605)
- pid1: remove unnecessary error reassignment (#1694605)
- core: drop unnecessary condition (#1694605)
- import: drop unnecessary condition (#1694605)
- journal-verify: add comment and silence LGTM warning (#1694605)
- journal: drop redundant condition (#1694605)
- lldp: set correct state for processing (#1694605)
- sd-bus: fix implicit downcast of bitfield reported by LGTM (#1694605)
- tree-wide: use 'signed int' instead of 'int' for bit field variables (#1694605)
- machinectl: check correct FD for a return value (#1694605)
- shared/install: avoid overwriting 'r' counter with a partial result (#1694605)
- systemctl: set_put() can't return (-)EEXIST (#1694605)
- systemctl: remove dead check (#1694605)
- journal-gateway: explicitly declare local variables (#1694605)
- journal-gateway: use localStorage["cursor"] only when it has valid value (#1694605)
- lgtm: ignore files dropped in upstream (#1694605)
- lgtm: suppress several constant comparisons (#1694605)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-71
changelog:
- core: add a new unit_needs_console() call (#1524359)
- core: rework how we count the n_on_console counter (#1524359)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-72
changelog:
- service: introduce protocol error type (#1733998)
- service: fix main processes exit behavior for type notify services (#1733998)
- service: go through stop_post on failure (#4770) (#1733998)
- Call getgroups() to know size of supplementary groups array to allocate (#1743230256 KB)
- udev: introduce CONST key name (#1748051)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-73.2
changelog:
- core: when restarting services, don't close fds (#1803802)
- unit: rework a bit how we keep the service fdstore from being destroyed during service restart (#1803802)
- tests: add basic journal test (#1803802)
- tests: add regression test for `systemctl restart systemd-journald` (#1803802)
- tests: add test that journald keeps fds over termination by signal (#1803802)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-74
changelog:
- sd-bus: bump message queue size again (#1770158)
- unit: fix potential use of cgroup_path after free() when freeing unit (#1760149)
- add test for ExecStopPost (#1733998)
- core: when restarting services, don't close fds (#1757704)
- unit: rework a bit how we keep the service fdstore from being destroyed during service restart (#1757704)
- tests: add basic journal test (#1757704)
- tests: add regression test for `systemctl restart systemd-journald` (#1757704)
- tests: add test that journald keeps fds over termination by signal (#1757704)
- nss-util: silence warning about deprecated RES_USE_INET6 (#1799002)
- journal: do not trigger assertion when journal_file_close() get NULL (#1786046)
- mount: don't propagate errors from mount_setup_unit() further up (#1804757)
- mount: when allocating a Mount object based on /proc/self/mountinfo mark it so (#1804757)
- fix the fix for #1691511 (#1804757)
- v3: Properly parsing SCSI Hyperv devices (#8509) (#1809053)
- Consider smb3 as remote filesystem (#1811700)
- mount: don't add Requires for tmp.mount (#1813270)
- sd-bus: when attached to an sd-event loop, disconnect on processing errors (#1769928)
- sd-journal: close journal files that were deleted by journald before we've setup inotify watch (#1812889)
- sd-journal: remove the dead code and actually fix #14695 (#1812889)
- swap: adjust swap.c in a similar way to what we just did to mount.c (#1749621)
- swap: finish the secondary swap units' jobs if deactivation of the primary swap unit fails (#1749621)
- core: add a new unit file setting CollectMode= for tweaking the GC logic (#1817576)
- run: add "-G" as shortcut for "--property=CollectMode=inactive-or-failed" (#1817576)
- core: clarify that the CollectMode bus property is constant (#1817576)
- udev-rules: make tape-changers also apprear in /dev/tape/by-path/ (#1814028)
- logind: check PolicyKit before allowing VT switch (#1797672)
- timer: don't use persietent file timestamps from the future (#6823) (#1769923)
- core: transition to FINAL_SIGTERM state after ExecStopPost= (#1766477)
- bus_open leak sd_event_source when udevadm trigger。 (#1798503)
- journal-remote: split-mode=host, remove port from journal filename (#1244691)
- core: downgrade log message about inability to propagate cgroup release message (#1679934)
- units: move Before deps for quota services to remote-fs.target (#5627) (#1693374)
- set kptr_restrict=1 (#1689344)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-76
changelog:
- core: enforce a ratelimiter when stopping units due to StopWhenUnneeded=1 (#1775291)
- core: rework StopWhenUnneeded= logic (#1775291)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-77
changelog:
- core: coldplug possible nop_job (#1829754)
- core: make sure to restore the control command id, too (#1828953)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-78.1
changelog:
- device: make sure we emit PropertiesChanged signal once we set sysfs (#1793527)
- device: don't emit PropetiesChanged needlessly (#1793527)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-78.2
changelog:
- core: don't update unit description if it is already set to the same value (#1793527)
- unit: don't emit PropertiesChanged signal if adding a dependency to a unit is a no-op (#1793527)
- core: fix unnecessary fallback to the rescue mode caused by initrd-switch-root.service's exit status judgment error (#1825232)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-78.4
changelog:
- test: add a test/reproducer for BZ#1989245 (#1989245)
- strv: fix buffer size calculation in strv_join_quoted() (#1989245)
- install: refactor find_symlinks() and don't search for symlinks recursively (#1828758)


author: Dmitrii Samoilov <dsamoilov@cloudlinux.com> - 219-78.7.tuxcare.els1
changelog:
- CVE-2023-26604: use only less as a pager and restrict its functionality
  (e.g stop running external shell) unless environment variable
  SYSTEMD_PAGERSECURE is defined


author: Dmitrii Samoilov <dsamoilov@cloudlinux.com> - 219-78.9.tuxcare.els1
changelog:
- Moved tuxcare patches from 219-78.7.tuxcare.els1
- CVE-2023-26604: use only less as a pager and restrict its functionality
  (e.g stop running external shell) unless environment variable
  SYSTEMD_PAGERSECURE is defined


author: Peter Hutterer <peter.hutterer@redhat.com> 1.6.3-3
changelog:
- Fix touchpad tap timestamps (#1491525)
- Fix missing show-keycodes entry in man page (#1491532)
- Change palm detection thresholds (#1491537)
- Ignore tap motion threshold for nfingers > nslots (#1491533)
- Fix a memory leak on destroy
- Ignore hovering touches while tapping
- Fix a man page typo


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.8
changelog:
- Resolves: rhbz#1910131 - sssd throwing error " Unable to parse name test' [1432158283]: The internal name format cannot be parsed" at debug_level 2 [rhel-7.9.z]
- Resolves: rhbz#1922244 - First smart refresh query contains modifyTimestamp even if the modifyTimestamp is 0. [rhel-7.9.z]
- Resolves: rhbz#1935685 - SSSD not detecting subdomain from AD forest (7.9z)
- Resolves: rhbz#1945552 - IPA missing secondary IPA Posix groups in latest sssd 1.16.5-10.el7_9.7 [rhel-7.9.z]
- Resolves: rhbz#1839972 - Authentication handshake (ldap_install_tls()) fails due to underlying openssl operation failing with EINTR [rhel-7.9.z]


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.9
changelog:
- Resolves: rhbz#1988463 - Missing search index for `originalADgidNumber` [rhel-7.9.z]
- Resolves: rhbz#1968330 - id lookup is failing intermittently
- Resolves: rhbz#1964415 - Memory leak in the simple access provider
- Resolves: rhbz#1985457 - EMBARGOED CVE-2021-3621 sssd: shell command injection in sssctl [rhel-7.9.z]


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.11
changelog:
- Resolves: rhbz#1968316 - SSSD: User authentication failing after server reboot.
- Resolves: rhbz#2000238 - disabled root ad domain causes subdomains to be marked offline
- Resolves: rhbz#1984591 - After sssd update to 1.16.5-10.el7_9.8.x86_64 the customer is facing slow connection/authentication (due to discovery of unexpected AD domains)


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.12
changelog:
- Resolves: rhbz#2006382 - IPA Intermittence fetching groups
- Resolves: rhbz#2006866 - sssd_be segfault due to empty forest root name
- Resolves: rhbz#2031729 - IPA clients fail to resolve override group names.
- Resolves: rhbz#2032867 - AD Domain in the AD Forest Missing after sssd latest update


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.13
changelog:
- Resolves: rhbz#2079441 - SSSD update prompts for smartcard pin twice - After update to 7.9 [rhel-7.9.z]
- Resolves: rhbz#2073352 - Use right sdap_domain in ad_domain_info_send [rhel-7.9.z]


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.14
changelog:
- Resolves: rhbz#2097014 - SSSD -> sssd_be and sssd_ifp coredump [rhel-7.9.z]
- Resolves: rhbz#2107380 - sssd timezone issues sudonotafter [rhel-7.9.z]
- Resolves: rhbz#2116207 - SSSD starting offline after reboot [rhel-7.9.z]


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.15
changelog:
- Resolves: rhbz#2149703 - smartcards: special characters must be escaped when building search filter [rhel-7.9.z]
- Resolves: rhbz#2149902 - EMBARGOED CVE-2022-4254 sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters [rhel-7.9.z]


author: Eduardo Lima (Etrunko) <etrunko@redhat.com> 1.16.5-10.16
changelog:
- Resolves: RHEL-16003 - sssd : AD user login problem when modify ldap_user_name= name and restricted by GPO Policy [rhel-7.9.z]


author: Koba Karaputadze <kkaraputadze@cloudlinux.com> 1.16.5-10.0.3.16.tuxcare.els1
changelog:
- CVE-2025-11561: prevent unexpected Kerberos principal-to-account mappings
  when SSSD's localauth plugin cannot resolve a principal


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.7
changelog:
- Resolves: rhbz#1875514 - filter_groups option partially filters the group from 'id' output of the user because gidNumber still appears in 'id' output [rhel-7.9.z]
- Resolves: rhbz#1772513 - SSSD is generating lot of LDAP queries in a very large environment [rhel-7.9.z]
- Resolves: rhbz#1736845 - [RFE] Backporting certificate matching rules for files, AD and LDAP provider [rhel-7.9.z]


author: Jiri Pirko <jpirko@redhat.com> - 1.2-1
changelog:
- Update to 1.2
- libndp: silently ignore packets with optlen 0 [1016064]
- libndp: fix processing for larger options [1016064]
- libndp: do not fail on receiving non-ndp packets [1016078]


author: Jiri Pirko <jpirko@redhat.com> - 1.2-3
changelog:
- libndp: fix [cppcheck] Undefined behavior: Variable 'buf' is used as parameter and destination in s[n]printf() [1044084]


author: Lubomir Rintel <lrintel@redhat.com> - 1.2-5
changelog:
- libndp: validate the IPv6 hop limit [CVE-2016-3698]
- libndb: reject redirect and router advertisements from non-link-local [CVE-2016-3698]


author: Eric Garver <egarver@redhat.com> - 1.2-7
changelog:
- libndp: add option flags to send messages
- ndptool: add option to send messages types
- libndp: fix type of field "na" in "struct ndp_msgna"
- libndp: revert API change for ndp_msg_send() and add


author: Tom Lane <tgl@redhat.com> 2:1.5.10-3
changelog:
- Remove compat subpackage (it's now a separate package "libpng12")
- Minor specfile cleanup per suggestions from Tom Callaway
Related: #845110


author: Tom Lane <tgl@redhat.com> 2:1.5.12-1
changelog:
- Update to libpng 1.5.12 for minor bug fixes
- Activate chunk size limits by default, with a very generous default limit


author: Petr Hracek <phracek@redhat.com> - 2:1.5.13-7
changelog:
- Security fix for CVE-2015-8126
- Changing png_ptr to info_ptr base on upstream
- Related: #1283575


author: Jai S <jsathyapalan@cloudlinux.com> - 2:1.5.13-8.tuxcare.els1
changelog:
- CVE-2025-64505: fix heap buffer over-read vulnerability in png_do_quantize
  function by validating palette_lookup array bounds


author: Tamar Zerekidze <tzerekidze@cloudlinux.com> - 2:1.5.13-8.tuxcare.els2
changelog:
- CVE-2025-64720: fix buffer overflow in png_init_read_transformations function
  during palette compositing with optimized alpha


author: Michal Hlavinka <mhlavink@redhat.com> - 1.0.25-12.1
changelog:
- a crafted wav file could cause heap buffer overflow that allowed an arbitrary code execution(#1985024)


author: Milan Crha <mcrha@redhat.com> - 2.62.2-2
changelog:
- Backport upstream patch for CVE-2018-12910 - Crash in soup_cookie_jar.c: get_cookies() on empty hostnames
- Resolves: #1598838


author: Koba Karaputadze <kkaraputadze@cloudlinux.com> - 2.62.2-2.0.1.tuxcare.els4
changelog:
- CVE-2025-32906: fix out-of-bound read vulnerability
- CVE-2025-32911: fix use-after-free vulnerability
- CVE-2025-32913: fix NULL pointer dereference


author: Koba Karaputadze <kkaraputadze@cloudlinux.com> - 2.62.2-2.0.1.tuxcare.els5
changelog:
- CVE-2025-32050: fix overflow in append_param_quoted()
- CVE-2025-32052: fix heap buffer overflow in soup_content_sniffer_sniff()
- CVE-2025-32053: fix heap buffer overflow in sniff_feed_or_html()
- CVE-2025-32907: soup-message-headers: correct merge of ranges
- CVE-2025-46420: fix leak in soup_header_parse_quality_list()
- CVE-2025-46421: strip authentication credentails on cross-origin redirect
- CVE-2025-2784: fix heap buffer over-read when sniffing content via the
  skip_insight_whitespace() function


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 2.62.2-2.0.5.tuxcare.els1
changelog:
- CVE-2025-4948: fix integer underflow in soup_multipart_new_from_message()
- CVE-2025-32049: fix Denial of Service attack to websocket server
- CVE-2025-32914: fix OOB Read through soup_multipart_new_from_message()


author: Jai S <jsathyapalan@cloudlinux.com> - 2.62.2-2.0.5.tuxcare.els2
changelog:
- CVE-2025-4945: fix integer overflow vulnerability in date/time parsing
- CVE-2025-11021: fix out-of-bounds memory read in cookie date handling logic


author: Bartosz Staszewski <bstaszewski@cloudlinux.com> - 2.62.2-2.0.5.tuxcare.els3
changelog:
- CVE-2025-14523: reject duplicate Host headers to prevent request smuggling,
  cache poisoning, and host-based access control bypass attacks


author: Bartosz Staszewski <bstaszewski@cloudlinux.com> - 2.62.2-2.0.5.tuxcare.els4
changelog:
- CVE-2026-1761: fix stack-based buffer overflow in multipart HTTP response
  parsing caused by incorrect length calculation in
  soup_filter_input_stream_read_until()
- CVE-2026-0719: fix stack-based buffer overflow in NTLM authentication
  caused by integer overflow in md4sum() with excessively long passwords


author: Andrija Jokanovic <ajokanovic@cloudlinux.com> - 2.62.2-2.0.5.tuxcare.els6
changelog:
- CVE-2026-2369: fix integer underflow in sniff_unknown() on zero-length
  buffer that caused an out-of-bounds read in the content sniffer


author: Kamil Dudka <kdudka@redhat.com> 1.4.3-9
changelog:
- curl consumes too much memory during scp download (#1080459)
- prevent a not-connected agent from closing STDIN (#1147717)


author: Kamil Dudka <kdudka@redhat.com> 1.4.3-12
changelog:
- session: avoid printing misleading debug messages (#1503294)
- scp: send valid commands for remote execution (#1489733)


author: Kamil Dudka <kdudka@redhat.com> 1.8.0-2
changelog:
- fix integer overflow in keyboard interactive handling that allows out-of-bounds writes (CVE-2019-3863)
- fix out-of-bounds memory comparison with specially crafted message channel request (CVE-2019-3862)
- fix out-of-bounds reads with specially crafted SSH packets (CVE-2019-3861)
- fix zero-byte allocation in SFTP packet processing resulting in out-of-bounds read (CVE-2019-3858)
- fix integer overflow in SSH packet processing channel resulting in out of bounds write (CVE-2019-3857)
- fix integer overflow in keyboard interactive handling resulting in out of bounds write (CVE-2019-3856)
- fix integer overflow in transport read resulting in out of bounds write (CVE-2019-3855)


author: Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de> 0:0.2.5-0.fdr.1
changelog:
- updated to 0.2.5
- changed license to LGPL
- rearranged %check to reflect execution order
- minor cosmetical changes


author: Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de> - 1.3-1
changelog:
- updated to 1.3 (#426488, #431334)
- use wrapper around libtasn1-config which should make it multilib
  safe (#342411); this implies an untagged 'Requires: pkgconfig' for
  -devel now
- conditionalized BR of valgrind (#401041)


author: Tomas Mraz <tmraz@redhat.com> - 2.2-1
changelog:
- updated to new upstream version
- SMP build should work now
- drop fix for spurious rpath - no longer necessary


author: Areg Gasparyan <agasparyan@cloudlinux.com> - 4.10-1.tuxcare.els2
changelog:
- CVE-2018-6003: Restrict recursion depth in _asn1_decode_simple_ber()
  to prevent stack exhaustion DoS via crafted indefinite-length BER input.


author: Nikola Forró <nforro@redhat.com> - 4.0.3-26
changelog:
- Add patches for CVEs:
  CVE-2016-9533, CVE-2016-9534, CVE-2016-9535,
  CVE-2016-9536, CVE-2016-9537, CVE-2016-9540,
  CVE-2016-5652, CVE-2015-8870
- Resolves: #1412081


author: Nikola Forró <nforro@redhat.com> - 4.0.3-28
changelog:
- Fix CVE-2016-3186
- Resolves: #1319503
- Fix CVE-2018-7456
- Resolves: #1561318
- Fix CVE-2018-8905
- Resolves: #1574548
- Fix CVE-2018-10779
- Resolves: #1598503
- Fix CVE-2018-10963
- Resolves: #1598726
- Fix CVE-2018-12900
- Resolves: #1600430
- Fix CVE-2018-17100
- Resolves: #1632578
- Fix CVE-2018-17101
- Resolves: #1632579
- Fix CVE-2018-18557
- Resolves: #1647737
- Fix CVE-2018-18661
- Resolves: #1647965


author: Nikita Maliutin <nmaliutin@cloudlinux.com> - 4.0.3-35.tuxcare.els1
changelog:
- CVE-2023-52356: added proper validation and boundary checks to prevent
  the SEGV and potential heap-buffer overflow
- CVE-2023-52355: added functionality to set a maximum possible allocation size
  in bytes in order to prevent out-of-memory issues when opening a TIFF file and
  added memory limit option in tools


author: Koba Karaputadze <kkaraputadze@cloudlinux.com> - 4.0.3-35.tuxcare.els4
changelog:
- CVE-2025-8176: fix use after free in tools/tiffmedian.c
- CVE-2025-8177: fix buffer overflow in tools/thumbnail.c


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 4.0.3-35.tuxcare.els8
changelog:
- CVE-2022-3970: fix integer overflow in TIFFReadRGBATileExt on strips/tiles > 2 GB
- CVE-2022-0891: fix heap buffer overflow in extractImageSection in tiffcrop


author: Vratislav Podzimek <vpodzime@redhat.com> - 2.7.3-2
changelog:
- Put back the hack to ensure hardening
  Related: rhbz#1477736
- Fix the relationship between new udisks2 and storaged
  Related: rhbz#1477736


author: Vratislav Podzimek <vpodzime@redhat.com> - 2.7.3-3
changelog:
- Add and use a service for cleaning up mount point directories
  Resolves: rhbz#1384796
- Do not try to create file watchers for RAIDs without redundancy
  Resolves: rhbz#1400056


author: Vojtech Trefny <vtrefny@redhat.com> - 2.7.3-7
changelog:
- core: Add Encrypted.Resize method
  Resolves: rhbz#1567992
- Fix checking for distribution and version in integration tests
  Resolves: rhbz#1508385
- Do not skip integration tests on CentOS/RHEL
  Resolves: rhbz#1511974
- Fix failing MDRAID integration test
  Resolves: rhbz#1511986


author: Tomas Bzatek <tbzatek@redhat.com> - 2.7.3-9
changelog:
- Build udisks2-lsm subpackage (#1672664)
- Fix sigint source removal on daemon exit (#1643350)
- CVE-2018-17336: Fix format string vulnerability in udisks_log (#1637427)
- Describe command options in the udisksctl man page (#1568269)


author: Giorgi Lasareishvili <glasareishvili@cloudlinux.com> - 2.8.4-1.tuxcare.els1
changelog:
- CVE-2025-8067: fix issue allowing unprivileged users to create loop devices
  with negative index values


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-32
changelog:
- qemu: Don't emit SUSPENDED_POSTCOPY event on destination (rhbz#1791886)
- node_device_conf: Don't leak @physical_function in virNodeDeviceGetPCISRIOVCaps (rhbz#1792831)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-34
changelog:
- vmx: shortcut earlier few 'ignore' cases in virVMXParseDisk() (rhbz#1815269)
- vmx: make 'fileName' optional for CD-ROMs (rhbz#1815269)
- RHEL: Fix migration on AMD hosts with old QEMU (rhbz#1815572)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-35
changelog:
- qemu: don't take agent and monitor job for shutdown (CVE-2019-20485)
- qemu: don't hold a monitor and agent job for reboot (CVE-2019-20485)
- qemu: don't hold monitor and agent job when setting time (CVE-2019-20485)
- qemu: remove use of qemuDomainObjBeginJobWithAgent() (CVE-2019-20485)
- qemu: remove qemuDomainObjBegin/EndJobWithAgent() (CVE-2019-20485)
- storage: Fix daemon crash on lookup storagepool by targetpath (CVE-2020-10703)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-36
changelog:
- virDevMapperGetTargetsImpl: Be tolerant to kernels without DM support (rhbz#1823976)
- virDevMapperGetTargetsImpl: quit early if device is not a devmapper target (rhbz#1823976)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-36.el7_9.1
changelog:
- qemu: end the agent job in qemuDomainSetTimeAgent (rhbz#1844952)
- util: string: Introduce macro for automatic string lists (rhbz#1839992)
- util: Rework virStringListAdd (rhbz#1839992)
- qemu: Create multipath targets for PRs (rhbz#1839992)
- util: Move virIsDevMapperDevice() to virdevmapper.c (rhbz#1839992)
- virDevMapperGetTargetsImpl: Check for dm major properly (rhbz#1839992)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-36.el7_9.3
changelog:
- rpc: gendispatch: handle empty flags (CVE-2020-25637)
- rpc: add support for filtering @acls by uint params (CVE-2020-25637)
- rpc: require write acl for guest agent in virDomainInterfaceAddresses (CVE-2020-25637)
- qemu: agent: set ifname to NULL after freeing (CVE-2020-25637)
- conf: properly clear out autogenerated macvtap names when formatting/parsing (rhbz#1868549)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-36.el7_9.4
changelog:
- virdevmapper.c: Join two WITH_DEVMAPPER sections together (rhbz#1933557)
- virDevMapperGetTargetsImpl: Use VIR_AUTOSTRINGLIST (rhbz#1933557)
- virdevmapper: Don't use libdevmapper to obtain dependencies (rhbz#1933557)
- virdevmapper: Don't cache device-mapper major (rhbz#1933557)
- virdevmapper: Handle kernel without device-mapper support (rhbz#1933557)
- virdevmapper: Ignore all errors when opening /dev/mapper/control (rhbz#1933557)
- virdevmapper: fix stat comparison in virDMSanitizepath (rhbz#1933557)
- virDevMapperGetTargetsImpl: Use correct length when copying into dm.name (rhbz#1933557)


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 2.9.1-6.6.tuxcare.els3
changelog:
- CVE-2017-7375: add validation for parsed entity references
- CVE-2017-7376: fix buffer overflow in URL handling
- CVE-2017-8872: free input buffer in xmlHaltParser


author: Koba Karaputadze <kkaraputadze@cloudlinux.com> - 2.9.1-6.0.3.tuxcare.els5
changelog:
- CVE-2025-49794: fix memory safety issues in xmlSchematronReportOutput when parsing
  XPath elements
- CVE-2025-49796: fix memory corruption issue triggered by processing sch:name
  elements in input XML file


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 2.9.1-6.0.3.tuxcare.els6
changelog:
- CVE-2025-24928: fix stack-based buffer overflow in xmlSnprintfElements in
  valid.c
- CVE-2024-56171: fix use-after-free in xmlSchemaIDCFillNodeTables and
  xmlSchemaBubbleIDCNodeTables in xmlschemas.c


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 2.9.1-6.0.3.tuxcare.els7
changelog:
- CVE-2025-7425: fix heap-use-after-free in xmlFreeID caused by 'atype'
  corruption
- CVE-2025-6021: fix integer overflows in buffer size calculations


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 2.9.1-6.0.11.6.tuxcare.els2
changelog:
- CVE-2021-3516: fix use-after-free with `xmllint --html --push` by calling
  htmlCtxtUseOptions to avoid storing names in dictionaries


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 2.9.1-6.0.11.6.tuxcare.els3
changelog:
- CVE-2022-49043: fix use-after-free in xmlXIncludeAddNode by deferring
  xmlFree(URI) until after the error path has consumed the value


author: Daniel Veillard <veillard@redhat.com> - 2.9.1-6
changelog:
- Fix missing entities after CVE-2014-3660 fix
- CVE-2014-0191 Do not fetch external parameter entities (rhbz#1195650)
- Fix regressions introduced by CVE-2014-0191 patch


author: Daniel Veillard <veillard@redhat.com> - 2.9.1-6.2
changelog:
- Fix a series of CVEs (rhbz#1286496)
- CVE-2015-7941 Stop parsing on entities boundaries errors
- CVE-2015-7941 Cleanup conditional section error handling
- CVE-2015-8317 Fail parsing early on if encoding conversion failed
- CVE-2015-7942 Another variation of overflow in Conditional sections
- CVE-2015-7942 Fix an error in previous Conditional section patch
- Fix parsing short unclosed comment uninitialized access
- CVE-2015-7498 Avoid processing entities after encoding conversion failures
- CVE-2015-7497 Avoid an heap buffer overflow in xmlDictComputeFastQKey
- CVE-2015-5312 Another entity expansion issue
- CVE-2015-7499 Add xmlHaltParser() to stop the parser
- CVE-2015-7499 Detect incoherency on GROW
- CVE-2015-7500 Fix memory access error due to incorrect entities boundaries
- CVE-2015-8242 Buffer overead with HTML parser in push mode
- CVE-2015-1819 Enforce the reader to run in constant memory


author: Daniel Veillard <veillard@redhat.com> - libxml2-2.9.1-6.3
changelog:
- Heap-based buffer overread in xmlNextChar (CVE-2016-1762)
- Bug 763071: Heap-buffer-overflow in xmlStrncat <https://bugzilla.gnome.org/show_bug.cgi?id=763071> (CVE-2016-1834)
- Bug 757711: Heap-buffer-overflow in xmlFAParsePosCharGroup <https://bugzilla.gnome.org/show_bug.cgi?id=757711> (CVE-2016-1840)
- Bug 758588: Heap-based buffer overread in xmlParserPrintFileContextInternal <https://bugzilla.gnome.org/show_bug.cgi?id=758588> (CVE-2016-1838)
- Bug 758605: Heap-based buffer overread in xmlDictAddString <https://bugzilla.gnome.org/show_bug.cgi?id=758605> (CVE-2016-1839)
- Bug 759398: Heap use-after-free in xmlDictComputeFastKey <https://bugzilla.gnome.org/show_bug.cgi?id=759398> (CVE-2016-1836)
- Fix inappropriate fetch of entities content (CVE-2016-4449)
- Heap use-after-free in htmlParsePubidLiteral and htmlParseSystemiteral (CVE-2016-1837)
- Heap use-after-free in xmlSAX2AttributeNs (CVE-2016-1835)
- Heap-based buffer-underreads due to xmlParseName (CVE-2016-4447)
- Heap-based buffer overread in htmlCurrentChar (CVE-2016-1833)
- Add missing increments of recursion depth counter to XML parser. (CVE-2016-3705)
- Avoid building recursive entities (CVE-2016-3627)
- Fix some format string warnings with possible format string vulnerability (CVE-2016-4448)
- More format string warnings with possible format string vulnerability (CVE-2016-4448)


author: David King <dking@redhat.com> - 2.9.1-6.4
changelog:
- Fix CVE-2015-8035 (#1595697)
- Fix CVE-2018-14404 (#1602817)
- Fix CVE-2017-15412 (#1729857)
- Fix CVE-2016-5131 (#1714050)
- Fix CVE-2017-18258 (#1579211)
- Fix CVE-2018-1456 (#1622715)


author: David King <dking@redhat.com> - 2.9.1-6.5
changelog:
- Fix CVE-2019-19956 (#1793000)
- Fix CVE-2019-20388 (#1810057)
- Fix CVE-2020-7595 (#1810073)
- Fix xsd:any schema validation (#1812145)


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 2.9.1-6.6.tuxcare.els1
changelog:
- CVE-2021-3517: fix flaw in the xml entity encoding
- CVE-2021-3518: fix dangling pointers in entity reference nodes
- CVE-2022-23308: fix use-after-free of ID and IDREF attributes
- CVE-2022-40303: fix integer counters overflow when parsing a multi-gigabyte XML
- CVE-2022-40304: fix double free as a result of an invalid XML entity
- fix testapi.c to avoid false positive test errors
- fix a parser and fix a null pointer dereference


author: Daniel Veillard <veillard@redhat.com> 2.6.27-1
changelog:
- upstream release 2.6.27 see http://xmlsoft.org/news.html
- very large amount of bug fixes reported upstream


author: Daniel Veillard <veillard@redhat.com> 2.7.0-1.fc10
changelog:
- upstream release of 2.7.0
- switch to XML 1.0 5th edition
- switch to RFC 3986 for URI parsing
- better entity handling
- option to remove hardcoded limitations in the parser
- more testing
- a new API to allocate entity nodes
- and lot of fixes and clanups


author: Daniel Veillard <veillard@redhat.com> 2.7.2-1.fc10
changelog:
- new release 2.7.2
- Fixes the known problems in 2.7.1
- increase the set of options when saving documents


author: Daniel Veillard <veillard@redhat.com> - 2.7.3-1
changelog:
- new release 2.7.3
- limit default max size of text nodes
- special parser mode for PHP
- bug fixes and more compiler checks


author: Daniel Veillard <veillard@redhat.com> - 2.7.4-1
changelog:
- upstream release 2.7.4
- symbol versioning of libxml2 shared libs
- very large number of bug fixes


author: Daniel Veillard <veillard@redhat.com> - 2.7.7-1
changelog:
- Upstream release of 2.7.7
- fix serious trouble with zlib >= 1.2.4
- xmllint new option --xpath
- various HTML parser improvements
- includes a number of nug fixes


author: Daniel Veillard <veillard@redhat.com> - 2.7.8-1
changelog:
- Upstream release of 2.7.8
- various bug fixes, including potential crashes
- new non-destructive formatting option
- date parsing updated to RFC 5646


author: Daniel Veillard <veillard@redhat.com> - 2.9.0-0rc1
changelog:
- upstream release candidate 1 of 2.9.0
- introduce a small API change, but ABI compatible, see
  https://mail.gnome.org/archives/xml/2012-August/msg00005.html
  patches for php, gcc/libjava and evolution-data-connector are upstream
  Grab me in cases of problems veillard@redhat.com
- many bug fixes including security aspects and small improvements


author: Daniel Veillard <veillard@redhat.com> - 2.9.0-1
changelog:
- upstream release of 2.9.0
- A few new API entry points
- More resilient push parser mode
- A lot of portability improvement
- Faster XPath evaluation
- a lot of bug fixes and smaller improvement


author: Daniel Veillard <veillard@redhat.com> - 2.9.0-2
changelog:
- remaining cleanups from merge bug rhbz#226079
- do not put the docs in the main package, only in -devel rhbz#864731


author: Daniel Veillard <veillard@redhat.com> - 2.9.1-1
changelog:
- upstream release of 2.9.1
- a couple more API entry point
- compatibility with python3
- a lot of bug fixes


author: Matthias Clasen <mclasen@redhat.com> - 1.1.28-3
changelog:
- Don't ship api docs twice (they were included in both
  the main and the devel package, by accident (need to save
  space on the f19 live images)


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 1.1.28-6.tuxcare.els2
changelog:
- CVE-2025-24855: fix use-after-free issue in numbers.c by restoring XPath
  context node in nested XPath evaluations


author: pjp <pjp@fedoraproject.org> - r106-2
changelog:
- fixed install section above as suggested in the review.
  -> https://bugzilla.redhat.com/show_bug.cgi?id=1015263#c1


author: pjp <pjp@fedoraproject.org> - r106-3
changelog:
- fixed install section to replace /usr/ with a macro.
  -> https://bugzilla.redhat.com/show_bug.cgi?id=1015263#c5


author: pjp <pjp@fedoraproject.org> - r127-1
changelog:
- Fixed a bug in LZ4 HC streaming mode
- New lz4frame API integrated into liblz4
- Fixed a GCC 4.9 bug on highest performance settings


author: pjp <pjp@fedoraproject.org> - r128-1
changelog:
- lz4cli sparse file support
- Restored lz4hc compression ratio
- lz4 cli supports long commands
- Introduced lz4-static sub package BZ#1208203


author: pjp <pjp@fedoraproject.org> - r129-1
changelog:
- New LZ4_compress_fast() API.
- New LZ4 CLI improved performance with multiple files.
- Other bug fix and documentation updates.


author: pjp <pjp@fedoraproject.org> - r130-1
changelog:
- Fixed: incompatibility sparse mode vs console.
- Fixed: LZ4IO exits too early when frame crc not present.
- Fixed: incompatibility sparse mode vs append mode.
- Performance fix: big compression speed boost for clang(+30%).


author: pjp <pjp@fedoraproject.org> - r131-1
changelog:
- New: Dos/DJGPP target #114.
- Added: Example using lz4frame library #118.
- Changed: liblz4.a no longer compiled with -fPIC by default.


author: Jakub Martisko <jamartis@rehat.com> - 1.8.3-1
changelog:
- Rebase to 1.8.3
- Drop the patch from 1.7.5-3. It is now part of the upstream archive
- Resolves: #1813245


author: Dave Jones <davej@redhat.com>
changelog:
- Only enable microcode_ctl service if the CPU is capable.
- Prevent microcode_ctl getting restarted multiple times on initlevel change (#141581)
- Make restart/reload work properly
- Do nothing if not started by root.


author: Dave Jones <davej@redhat.com>
changelog:
- Create/remove the /dev/cpu/microcode dev node as needed.
- Use correct path again for the microcode.dat.
- Remove some no longer needed tests in the init script.


author: Dave Jones <davej@redhat.com>
changelog:
- Drop the node creation/deletion change from previous release.
  It'll cause grief with selinux, and was a hack to get around
  a udev shortcoming that should be fixed properly.


author: Jarod Wilson <jwilson@redhat.com>
changelog:
- Spec cleanup and macro standardization.
- Update license
- Update microcode data file to 20080131 revision.


author: Dave Jones <davej@redhat.com>
changelog:
- Shorten sleep time during init.
  This really needs to be replaced with proper udev hooks, but this is
  a quick interim fix.


author: Kyle McMartin <kyle@redhat.com> 1.17-1.56
changelog:
- Add AMD x86/x86-64 microcode. (Dated: 2009-10-09)
  Doesn't need microcode_ctl modifications as it's loaded by
  request_firmware() like any other sensible driver.
- Eventually, this AMD firmware can probably live inside
  kernel-firmware once it is split out.


author: Anton Arapov <anton@redhat.com> 1.17-18
changelog:
- Ship splitted microcode for Intel CPUs [#690930]
- Include tool for splitting microcode for Intl CPUs (Kay Sievers )


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-34
changelog:
- Update to upstream 2.1-18. Intel CPU microcode update to 20180703.
- Add infrastructure for handling kernel-version-dependant microcode.
- Resolves: #1574582


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-37
changelog:
- Add model name blacklist infrastructure.
- Store Intel ucode files in /usr/share/microcode_ctl; do not populate them
  in a virtualised environment.
- Resolves: #1596627


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-44
changelog:
- Intel CPU microcode update to 20180807a.
- Add README.caveats documentation file.
- Add intel-microcode2ucode manual page.
- Add check for early microcode load, use it in microcode_ctl dracut module.
- Resolves: #1596627.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-52
changelog:
- Remove disclaimer, as it is not as important now to justify kmsg/log
  pollution; its contents are partially adopted in README.caveats.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-54
changelog:
- Intel CPU microcode update to 20190918.
- Add new disclaimer, generated based on relevant caveats.
- Resolves: #1753541.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-57
changelog:
- Intel CPU microcode update to 20191112, addresses CVE-2017-5715,
  CVE-2019-0117, CVE-2019-11135, CVE-2019-11139 (#1755025, #1764058, #1764071,
    - Addition of 06-a6-00/0x80 (CML-U 6+2 A0) microcode at revision 0xc6;
  - Addition of 06-66-03/0x80 (CNL-U D0) microcode at revision 0x2a;
  - Addition of 06-55-03/0x97 (SKL-SP B1) microcode at revision 0x1000150;
  - Addition of 06-7e-05/0x80 (ICL-U/Y D1) microcode at revision 0x46;
  - Update of 06-4e-03/0xc0 (SKL-U/Y D0) microcode from revision 0xcc to 0xd4;
  - Update of 06-5e-03/0x36 (SKL-H/S/Xeon E3 R0/N0) microcode from revision 0xcc
    to 0xd4
  - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode from revision 0xb4 to 0xc6;
  - Update of 06-8e-09/0xc0 (KBL-U/Y H0) microcode from revision 0xb4 to 0xc6;
  - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0) microcode from revision 0xb4
    to 0xc6;
  - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode from revision 0xb8 to 0xc6;
  - Update of 06-8e-0c/0x94 (AML-Y V0) microcode from revision 0xb8 to 0xc6;
  - Update of 06-8e-0c/0x94 (CML-U 4+2 V0) microcode from revision 0xb8 to 0xc6;
  - Update of 06-8e-0c/0x94 (WHL-U V0) microcode from revision 0xb8 to 0xc6;
  - Update of 06-9e-09/0x2a (KBL-G/X H0) microcode from revision 0xb4 to 0xc6;
  - Update of 06-9e-09/0x2a (KBL-H/S/Xeon E3 B0) microcode from revision 0xb4
    to 0xc6;
  - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode from revision 0xb4
    to 0xc6;
  - Update of 06-9e-0b/0x02 (CFL-S B0) microcode from revision 0xb4 to 0xc6;
  - Update of 06-9e-0d/0x22 (CFL-H R0) microcode from revision 0xb8 to 0xc6.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-58
changelog:
- Package the publicy available microcode-20191112 release (#1755025):
  - Addition of 06-4d-08/0x1 (AVN B0/C0) microcode at revision 0x12d;
  - Addition of 06-55-06/0xbf (CSL-SP B0) microcode at revision 0x400002c;
  - Addition of 06-7a-08/0x1 (GLK R0) microcode at revision 0x16;
  - Update of 06-55-03/0x97 (SKL-SP B1) microcode from revision 0x1000150
    up to 0x1000151;
  - Update of 06-55-04/0xb7 (SKL-SP H0/M0/U0, SKL-D M1) microcode from revision
    0x2000064 up to 0x2000065;
  - Update of 06-55-07/0xbf (CSL-SP B1) microcode from revision 0x500002b
    up to 0x500002c;
  - Update of 06-7a-01/0x1 (GLK B0) microcode from revision 0x2e up to 0x32;
- Include 06-9e-0c (CFL-H/S P0) microcode from the microcode-20190918 release.
- Correct the releasenote file (0001-releasenote-changes-summary-fixes.patch).
- Update README.caveats with the link to the new Knowledge Base article.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-59
changelog:
- Update Intel CPU microcode to microcode-20191113 release:
  - Update of 06-9e-0c (CFL-H/S P0) microcode from revision 0xae up to 0xc6.
- Drop 0001-releasenote-changes-summary-fixes.patch.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-60
changelog:
- Update Intel CPU microcode to microcode-20191115 release:
  - Update of 06-4e-03/0xc0 (SKL-U/Y D0) from revision 0xd4 up to 0xd6;
  - Update of 06-5e-03/0x36 (SKL-H/S/Xeon E3 R0/N0) from revision 0xd4
    up to 0xd6;
  - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) from revision 0xc6 up to 0xca;
  - Update of 06-8e-09/0xc0 (KBL-U/Y H0) from revision 0xc6 up to 0xca;
  - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0) from revision 0xc6 up to 0xca;
  - Update of 06-8e-0b/0xd0 (WHL-U W0) from revision 0xc6 up to 0xca;
  - Update of 06-8e-0c/0x94 (AML-Y V0, CML-U 4+2 V0, WHL-U V0) from revision
    0xc6 up to 0xca;
  - Update of 06-9e-09/0x2a (KBL-G/X H0, KBL-H/S/Xeon E3 B0) from revision 0xc6
    up to 0xca;
  - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) from revision 0xc6 up to 0xca;
  - Update of 06-9e-0b/0x02 (CFL-S B0) from revision 0xc6 up to 0xca;
  - Update of 06-9e-0c/0x22 (CFL-S/Xeon E P0) from revision 0xc6 up to 0xca;
  - Update of 06-9e-0d/0x22 (CFL-H/S R0) from revision 0xc6 up to 0xca;
  - Update of 06-a6-00/0x80 (CML-U 6+2 A0) from revision 0xc6 up to 0xca.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-62
changelog:
- Update stale posttrans dependency, add triggers for proper handling
  of the debug kernel flavour along with kernel-rt (#1780257).


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-64
changelog:
- Re-generate initramfs not only for the currently running kernel,
  but for several recently installed kernels as well (#1773347).


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-66
changelog:
- Update Intel CPU microcode to microcode-20200508 release (#1835549):
  - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0x46
    up to 0x78.
- Change the URL in the intel-microcode2ucode.8 to point to the GitHub
  repository since the microcode download section at Intel Download Center
  does not exist anymore.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-67
changelog:
- Update Intel CPU microcode to microcode-20200520 release (#1783103):
  - Update of 06-2d-06/0x6d (SNB-E/EN/EP C1/M0) microcode from revision 0x61f
    up to 0x621;
  - Update of 06-2d-07/0x6d (SNB-E/EN/EP C2/M1) microcode from revision 0x718
    up to 0x71a.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-68
changelog:
- Update Intel CPU microcode to microcode-20200602 release, addresses
  CVE-2020-0543, CVE-2020-0548, CVE-2020-0549 (#1795352, #1795355, #1827190):
  - Update of 06-3c-03/0x32 (HSW C0) microcode from revision 0x27 up to 0x28;
  - Update of 06-3d-04/0xc0 (BDW-U/Y E0/F0) microcode from revision 0x2e
    up to 0x2f;
  - Update of 06-45-01/0x72 (HSW-U C0/D0) microcode from revision 0x25
    up to 0x26;
  - Update of 06-46-01/0x32 (HSW-H C0) microcode from revision 0x1b up to 0x1c;
  - Update of 06-47-01/0x22 (BDW-H/Xeon E3 E0/G0) microcode from revision 0x21
    up to 0x22;
  - Update of 06-4e-03/0xc0 (SKL-U/Y D0) microcode from revision 0xd6
    up to 0xdc;
  - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x1000151
    up to 0x1000157;
  - Update of 06-55-04/0xb7 (SKX-SP H0/M0/U0, SKX-D M1) microcode
    (in intel-06-55-04/intel-ucode/06-55-04) from revision 0x2000065
    up to 0x2006906;
  - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x400002c
    up to 0x4002f01;
  - Update of 06-55-07/0xbf (CLX-SP B1) microcode from revision 0x500002c
    up to 0x5002f01;
  - Update of 06-5e-03/0x36 (SKL-H/S R0/N0) microcode from revision 0xd6
    up to 0xdc;
  - Update of 06-8e-09/0x10 (AML-Y22 H0) microcode from revision 0xca
    up to 0xd6;
  - Update of 06-8e-09/0xc0 (KBL-U/Y H0) microcode from revision 0xca
    up to 0xd6;
  - Update of 06-8e-0a/0xc0 (CFL-U43e D0) microcode from revision 0xca
    up to 0xd6;
  - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode from revision 0xca
    up to 0xd6;
  - Update of 06-8e-0c/0x94 (AML-Y42 V0, CML-Y42 V0, WHL-U V0) microcode
    from revision 0xca up to 0xd6;
  - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode from revision
    0xca up to 0xd6;
  - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E3 U0) microcode from revision 0xca
    up to 0xd6;
  - Update of 06-9e-0b/0x02 (CFL-S B0) microcode from revision 0xca up to 0xd6;
  - Update of 06-9e-0c/0x22 (CFL-H/S P0) microcode from revision 0xca
    up to 0xd6;
  - Update of 06-9e-0d/0x22 (CFL-H R0) microcode from revision 0xca up to 0xd6.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-70
changelog:
- Do not update 06-4e-03 (SKL-U/Y) and 06-5e-03 (SKL-H/S/Xeon E3 v5) to revision
  0xdc, use 0xd6 by default (#1846133).


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73
changelog:
- Update Intel CPU microcode to microcode-20200609 release (#1826589):
  - Fixed a typo in the release note file.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.1
changelog:
- Add README file to the documentation directory.
- Add publicly-sourced codenames list to supply to gen_provides.sh; update
  the latter to handle the somewhat different format.
- Add SUMMARY.intel-ucode file containing metadata information from
  the microcode file headers.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.2
changelog:
- Update Intel CPU microcode to microcode-20201027 release, addresses
  CVE-2020-8694, CVE-2020-8695, CVE-2020-8696, CVE-2020-8698
  (#1893261, #1893249, #1893229):
  - Addition of 06-55-0b/0xbf (CPX-SP A1) microcode at revision 0x700001e;
  - Addition of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode at revision 0x68;
  - Addition of 06-a5-02/0x20 (CML-H R1) microcode at revision 0xe0;
  - Addition of 06-a5-03/0x22 (CML-S 6+2 G1) microcode at revision 0xe0;
  - Addition of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode at revision 0xe0;
  - Addition of 06-a6-01/0x80 (CML-U 6+2 v2 K0) microcode at revision
    0xe0;
  - Update of 06-4e-03/0xc0 (SKL-U/U 2+3e/Y D0/K1) microcode (in
    intel-06-4e-03/intel-ucode/06-4e-03) from revision 0xdc up to 0xe2;
  - Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in
    intel-06-55-04/intel-ucode/06-55-04) from revision 0x2006906 up
    to 0x2006a08;
  - Update of 06-5e-03/0x36 (SKL-H/S/Xeon E3 N0/R0/S0) microcode (in
    intel-06-5e-03/intel-ucode/06-5e-03) from revision 0xdc up to 0xe2;
  - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xd6 up
    to 0xde;
  - Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xd6 up
    to 0xde;
  - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0a) from revision 0xd6 up
    to 0xe0;
  - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0b) from revision 0xd6 up
    to 0xde;
  - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
    microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0c) from
    revision 0xd6 up to 0xde;
  - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-9e-09) from revision 0xd6 up
    to 0xde;
  - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0a) from revision 0xd6 up
    to 0xde;
  - Update of 06-9e-0b/0x02 (CFL-E/H/S B0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0b) from revision 0xd6 up
    to 0xde;
  - Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0c) from revision 0xd6 up
    to 0xde;
  - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0xd6 up
    to 0xde;
  - Update of 06-3f-02/0x6f (HSX-E/EN/EP/EP 4S C0/C1/M1/R2) microcode
    from revision 0x43 up to 0x44;
  - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x1000157
    up to 0x1000159;
  - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x4002f01
    up to 0x4003003;
  - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
    0x5002f01 up to 0x5003003;
  - Update of 06-5c-09/0x03 (APL D0) microcode from revision 0x38 up
    to 0x40;
  - Update of 06-5c-0a/0x03 (APL B1/F1) microcode from revision 0x16 up
    to 0x1e;
  - Update of 06-7a-08/0x01 (GLK-R R0) microcode from revision 0x16 up
    to 0x18;
  - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0x78
    up to 0xa0;
  - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xca
    up to 0xe0.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.4
changelog:
- Update Intel CPU microcode to microcode-20201112 release:
  - Addition of 06-8a-01/0x10 (LKF B2/B3) microcode at revision 0x28;
  - Update of 06-7a-01/0x01 (GLK B0) microcode from revision 0x32 up
    to 0x34;
  - Updated releasenote file.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.5
changelog:
- Do not use "grep -q" in a pipe in check_caveats.
- Add 06-55-04/06-55-06/06-55-07 (SKX-SP/CLX-SP) microcode-20201110 caveats
  (#1905111).


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.8
changelog:
- Update Intel CPU microcode to microcode-20210216 release (#1905111):
  - Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in
    intel-06-55-04/intel-ucode/06-55-04) from revision 0x2006a08 up
    to 0x2006a0a;
  - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x4003003
    up to 0x4003006;
  - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
    0x5003003 up to 0x5003006.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.9
changelog:
- Update Intel CPU microcode to microcode-20210525 release, addresses
  CVE-2020-24489, CVE-2020-24511, CVE-2020-24512, and CVE-2020-24513
  (#1962659, #1962709, #1962729, #1962675):
  - Addition of 06-55-05/0xb7 (CLX-SP A0) microcode at revision 0x3000010;
  - Addition of 06-6a-05/0x87 (ICX-SP C0) microcode at revision 0xc0002f0;
  - Addition of 06-6a-06/0x87 (ICX-SP D0) microcode at revision 0xd0002a0;
  - Addition of 06-86-04/0x01 (SNR B0) microcode at revision 0xb00000f;
  - Addition of 06-86-05/0x01 (SNR B1) microcode (in intel-ucode/06-86-04)
    at revision 0xb00000f;
  - Addition of 06-86-04/0x01 (SNR B0) microcode (in intel-ucode/06-86-05)
    at revision 0xb00000f;
  - Addition of 06-86-05/0x01 (SNR B1) microcode at revision 0xb00000f;
  - Addition of 06-8c-02/0xc2 (TGL-R C0) microcode at revision 0x16;
  - Addition of 06-8d-01/0xc2 (TGL-H R0) microcode at revision 0x2c;
  - Addition of 06-96-01/0x01 (EHL B1) microcode at revision 0x11;
  - Addition of 06-9c-00/0x01 (JSL A0/A1) microcode at revision 0x1d;
  - Addition of 06-a7-01/0x02 (RKL-S B0) microcode at revision 0x40;
  - Update of 06-4e-03/0xc0 (SKL-U/U 2+3e/Y D0/K1) microcode (in
    intel-06-4e-03/intel-ucode/06-4e-03) from revision 0xe2 up to 0xea;
  - Update of 06-4f-01/0xef (BDX-E/EP/EX/ML B0/M0/R0) microcode (in
    intel-06-4f-01/intel-ucode/06-4f-01) from revision 0xb000038 up
    to 0xb00003e;
  - Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in
    intel-06-55-04/intel-ucode/06-55-04) from revision 0x2006a0a up
    to 0x2006b06;
  - Update of 06-5e-03/0x36 (SKL-H/S/Xeon E3 N0/R0/S0) microcode (in
    intel-06-5e-03/intel-ucode/06-5e-03) from revision 0xe2 up to 0xea;
  - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in
    intel-06-8c-01/intel-ucode/06-8c-01) from revision 0x68 up to 0x88;
  - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xde up
    to 0xea;
  - Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xde up
    to 0xea;
  - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0a) from revision 0xe0 up
    to 0xea;
  - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0b) from revision 0xde up
    to 0xea;
  - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
    microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0c) from
    revision 0xde up to 0xea;
  - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-9e-09) from revision 0xde up
    to 0xea;
  - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0a) from revision 0xde up
    to 0xea;
  - Update of 06-9e-0b/0x02 (CFL-E/H/S B0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0b) from revision 0xde up
    to 0xea;
  - Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0c) from revision 0xde up
    to 0xea;
  - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0xde up
    to 0xea;
  - Update of 06-3f-02/0x6f (HSX-E/EN/EP/EP 4S C0/C1/M1/R2) microcode
    from revision 0x44 up to 0x46;
  - Update of 06-3f-04/0x80 (HSX-EX E0) microcode from revision 0x16 up
    to 0x19;
  - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x1000159
    up to 0x100015b;
  - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x4003006
    up to 0x4003102;
  - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
    0x5003006 up to 0x5003102;
  - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x700001e
    up to 0x7002302;
  - Update of 06-56-03/0x10 (BDX-DE V2/V3) microcode from revision
    0x7000019 up to 0x700001b;
  - Update of 06-56-04/0x10 (BDX-DE Y0) microcode from revision 0xf000017
    up to 0xf000019;
  - Update of 06-56-05/0x10 (BDX-NS A0/A1, HWL A1) microcode from revision
    0xe00000f up to 0xe000012;
  - Update of 06-5c-09/0x03 (APL D0) microcode from revision 0x40 up
    to 0x44;
  - Update of 06-5c-0a/0x03 (APL B1/F1) microcode from revision 0x1e up
    to 0x20;
  - Update of 06-5f-01/0x01 (DNV B0) microcode from revision 0x2e up
    to 0x34;
  - Update of 06-7a-01/0x01 (GLK B0) microcode from revision 0x34 up
    to 0x36;
  - Update of 06-7a-08/0x01 (GLK-R R0) microcode from revision 0x18 up
    to 0x1a;
  - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xa0
    up to 0xa6;
  - Update of 06-8a-01/0x10 (LKF B2/B3) microcode from revision 0x28 up
    to 0x2a;
  - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xe0 up
    to 0xea;
  - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xe0
    up to 0xea;
  - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xe0
    up to 0xec;
  - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xe0
    up to 0xe8;
  - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K0) microcode from revision
    0xe0 up to 0xea.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.10
changelog:
- Make intel-06-2d-07, intel-06-4e-03, intel-06-4f-01, intel-06-55-04,
  intel-06-5e-03, intel-06-8c-01, intel-06-8e-9e-0x-0xca,
  and intel-06-8e-9e-0x-dell caveats dependent on intel caveat.
- Enable 06-8c-01 microcode update by default.
- Enable 06-5e-03 microcode update by default (#1897684).


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.12
changelog:
- Update Intel CPU microcode to microcode-20220204 release, addresses
  CVE-2021-0127, CVE-2021-0145, CVE-2021-33120 (#2051547, #2049549, #2049566):
  - Removal of 06-86-04/0x01 (SNR B0) microcode at revision 0xb00000f;
  - Removal of 06-86-05/0x01 (SNR B1) microcode (in intel-ucode/06-86-04)
    at revision 0xb00000f;
  - Removal of 06-86-04/0x01 (SNR B0) microcode (in intel-ucode/06-86-05)
    at revision 0xb00000f;
  - Removal of 06-86-05/0x01 (SNR B1) microcode at revision 0xb00000f;
  - Update of 06-4e-03/0xc0 (SKL-U/U 2+3e/Y D0/K1) microcode (in
    intel-06-4e-03/intel-ucode/06-4e-03) from revision 0xea up to 0xec;
  - Update of 06-4f-01/0xef (BDX-E/EP/EX/ML B0/M0/R0) microcode (in
    intel-06-4f-01/intel-ucode/06-4f-01) from revision 0xb00003e up
    to 0xb000040;
  - Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in
    intel-06-55-04/intel-ucode/06-55-04) from revision 0x2006b06 up
    to 0x2006c0a;
  - Update of 06-5e-03/0x36 (SKL-H/S/Xeon E3 N0/R0/S0) microcode (in
    intel-06-5e-03/intel-ucode/06-5e-03) from revision 0xea up to 0xec;
  - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in
    intel-06-8c-01/intel-ucode/06-8c-01) from revision 0x88 up to 0x9a;
  - Update of 06-3f-02/0x6f (HSX-E/EN/EP/EP 4S C0/C1/M1/R2) microcode
    from revision 0x46 up to 0x49;
  - Update of 06-3f-04/0x80 (HSX-EX E0) microcode from revision 0x19 up
    to 0x1a;
  - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x100015b
    up to 0x100015c;
  - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x4003102
    up to 0x400320a;
  - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
    0x5003102 up to 0x500320a;
  - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x7002302
    up to 0x7002402;
  - Update of 06-56-03/0x10 (BDX-DE V2/V3) microcode from revision
    0x700001b up to 0x700001c;
  - Update of 06-56-04/0x10 (BDX-DE Y0) microcode from revision 0xf000019
    up to 0xf00001a;
  - Update of 06-56-05/0x10 (BDX-NS A0/A1, HWL A1) microcode from revision
    0xe000012 up to 0xe000014;
  - Update of 06-5c-09/0x03 (APL D0) microcode from revision 0x44 up
    to 0x46;
  - Update of 06-5c-0a/0x03 (APL B1/F1) microcode from revision 0x20 up
    to 0x24;
  - Update of 06-5f-01/0x01 (DNV B0) microcode from revision 0x34 up
    to 0x36;
  - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd0002a0
    up to 0xd000331;
  - Update of 06-7a-01/0x01 (GLK B0) microcode from revision 0x36 up
    to 0x38;
  - Update of 06-7a-08/0x01 (GLK-R R0) microcode from revision 0x1a up
    to 0x1c;
  - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xa6
    up to 0xa8;
  - Update of 06-8a-01/0x10 (LKF B2/B3) microcode from revision 0x2a up
    to 0x2d;
  - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x16 up
    to 0x22;
  - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x2c up
    to 0x3c;
  - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode from revision 0xea
    up to 0xec;
  - Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode from revision
    0xea up to 0xec;
  - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode from
    revision 0xea up to 0xec;
  - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode from revision 0xea up
    to 0xec;
  - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
    microcode from revision 0xea up to 0xec;
  - Update of 06-96-01/0x01 (EHL B1) microcode from revision 0x11 up
    to 0x15;
  - Update of 06-9c-00/0x01 (JSL A0/A1) microcode from revision 0x1d up
    to 0x2400001f;
  - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode from
    revision 0xea up to 0xec;
  - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode from revision
    0xea up to 0xec;
  - Update of 06-9e-0b/0x02 (CFL-E/H/S B0) microcode from revision 0xea
    up to 0xec;
  - Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode from revision
    0xea up to 0xec;
  - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode from revision
    0xea up to 0xec;
  - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xea up
    to 0xec;
  - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xea
    up to 0xec;
  - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xec
    up to 0xee;
  - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xe8
    up to 0xea;
  - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K1) microcode from revision
    0xea up to 0xec;
  - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x40 up
    to 0x50.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.14
changelog:
- Update Intel CPU microcode to microcode-20220510 release, addresses
  CVE-2022-0005, CVE-2022-21131, CVE-2022-21136, CVE-2022-21151 (#2090246,
    - Addition of 06-97-02/0x03 (ADL-HX C0) microcode at revision 0x1f;
  - Addition of 06-97-05/0x03 (ADL-S 6+0 K0) microcode (in
    intel-ucode/06-97-02) at revision 0x1f;
  - Addition of 06-bf-02/0x03 (ADL C0) microcode (in intel-ucode/06-97-02)
    at revision 0x1f;
  - Addition of 06-bf-05/0x03 (ADL C0) microcode (in intel-ucode/06-97-02)
    at revision 0x1f;
  - Addition of 06-97-02/0x03 (ADL-HX C0) microcode (in
    intel-ucode/06-97-05) at revision 0x1f;
  - Addition of 06-97-05/0x03 (ADL-S 6+0 K0) microcode at revision 0x1f;
  - Addition of 06-bf-02/0x03 (ADL C0) microcode (in intel-ucode/06-97-05)
    at revision 0x1f;
  - Addition of 06-bf-05/0x03 (ADL C0) microcode (in intel-ucode/06-97-05)
    at revision 0x1f;
  - Addition of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode at
    revision 0x41c;
  - Addition of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in
    intel-ucode/06-9a-03) at revision 0x41c;
  - Addition of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
    intel-ucode/06-9a-04) at revision 0x41c;
  - Addition of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode at revision 0x41c;
  - Addition of 06-97-02/0x03 (ADL-HX C0) microcode (in
    intel-ucode/06-bf-02) at revision 0x1f;
  - Addition of 06-97-05/0x03 (ADL-S 6+0 K0) microcode (in
    intel-ucode/06-bf-02) at revision 0x1f;
  - Addition of 06-bf-02/0x03 (ADL C0) microcode at revision 0x1f;
  - Addition of 06-bf-05/0x03 (ADL C0) microcode (in intel-ucode/06-bf-02)
    at revision 0x1f;
  - Addition of 06-97-02/0x03 (ADL-HX C0) microcode (in
    intel-ucode/06-bf-05) at revision 0x1f;
  - Addition of 06-97-05/0x03 (ADL-S 6+0 K0) microcode (in
    intel-ucode/06-bf-05) at revision 0x1f;
  - Addition of 06-bf-02/0x03 (ADL C0) microcode (in intel-ucode/06-bf-05)
    at revision 0x1f;
  - Addition of 06-bf-05/0x03 (ADL C0) microcode at revision 0x1f;
  - Update of 06-4e-03/0xc0 (SKL-U/U 2+3e/Y D0/K1) microcode (in
    intel-06-4e-03/intel-ucode/06-4e-03) from revision 0xec up to 0xf0;
  - Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in
    intel-06-55-04/intel-ucode/06-55-04) from revision 0x2006c0a up
    to 0x2006d05;
  - Update of 06-5e-03/0x36 (SKL-H/S/Xeon E3 N0/R0/S0) microcode (in
    intel-06-5e-03/intel-ucode/06-5e-03) from revision 0xec up to 0xf0;
  - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in
    intel-06-8c-01/intel-ucode/06-8c-01) from revision 0x9a up to 0xa4;
  - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xec up
    to 0xf0;
  - Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xec up
    to 0xf0;
  - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0a) from revision 0xec up
    to 0xf0;
  - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0b) from revision 0xec up
    to 0xf0;
  - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
    microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0c) from
    revision 0xec up to 0xf0;
  - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-9e-09) from revision 0xec up
    to 0xf0;
  - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0a) from revision 0xec up
    to 0xf0;
  - Update of 06-9e-0b/0x02 (CFL-E/H/S B0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0b) from revision 0xec up
    to 0xf0;
  - Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0c) from revision 0xec up
    to 0xf0;
  - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0xec up
    to 0xf0;
  - Update of 06-37-09/0x0f (VLV D0) microcode from revision 0x90c up
    to 0x90d;
  - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x100015c
    up to 0x100015d;
  - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x400320a
    up to 0x4003302;
  - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
    0x500320a up to 0x5003302;
  - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x7002402
    up to 0x7002501;
  - Update of 06-5c-09/0x03 (APL D0) microcode from revision 0x46 up
    to 0x48;
  - Update of 06-5c-0a/0x03 (APL B1/F1) microcode from revision 0x24 up
    to 0x28;
  - Update of 06-5f-01/0x01 (DNV B0) microcode from revision 0x36 up
    to 0x38;
  - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd000331
    up to 0xd000363;
  - Update of 06-7a-01/0x01 (GLK B0) microcode from revision 0x38 up
    to 0x3a;
  - Update of 06-7a-08/0x01 (GLK-R R0) microcode from revision 0x1c up
    to 0x1e;
  - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xa8
    up to 0xb0;
  - Update of 06-8a-01/0x10 (LKF B2/B3) microcode from revision 0x2d up
    to 0x31;
  - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x22 up
    to 0x26;
  - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x3c up
    to 0x3e;
  - Update of 06-96-01/0x01 (EHL B1) microcode from revision 0x15 up
    to 0x16;
  - Update of 06-9c-00/0x01 (JSL A0/A1) microcode from revision 0x2400001f
    up to 0x24000023;
  - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xec up
    to 0xf0;
  - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xec
    up to 0xf0;
  - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xee
    up to 0xf0;
  - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xea
    up to 0xf0;
  - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K1) microcode from revision
    0xec up to 0xf0;
  - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x50 up
    to 0x53.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.15
changelog:
- Update Intel CPU microcode to microcode-20220510 release, addresses
  CVE-2022-21233 (#2119080):
  - Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in
    intel-06-55-04/intel-ucode/06-55-04) from revision 0x2006d05 up
    to 0x2006e05;
  - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x100015d
    up to 0x100015e;
  - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd000363
    up to 0xd000375;
  - Update of 06-7a-01/0x01 (GLK B0) microcode from revision 0x3a up
    to 0x3c;
  - Update of 06-7a-08/0x01 (GLK-R R0) microcode from revision 0x1e up
    to 0x20;
  - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xb0
    up to 0xb2;
  - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x26 up
    to 0x28;
  - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x3e up
    to 0x40;
  - Update of 06-97-02/0x03 (ADL-HX/S 8+8 C0) microcode from revision
    0x1f up to 0x22;
  - Update of 06-97-05/0x03 (ADL-S 6+0 K0) microcode (in
    intel-ucode/06-97-02) from revision 0x1f up to 0x22;
  - Update of 06-bf-02/0x03 (ADL C0) microcode (in intel-ucode/06-97-02)
    from revision 0x1f up to 0x22;
  - Update of 06-bf-05/0x03 (ADL C0) microcode (in intel-ucode/06-97-02)
    from revision 0x1f up to 0x22;
  - Update of 06-97-02/0x03 (ADL-HX/S 8+8 C0) microcode (in
    intel-ucode/06-97-05) from revision 0x1f up to 0x22;
  - Update of 06-97-05/0x03 (ADL-S 6+0 K0) microcode from revision 0x1f
    up to 0x22;
  - Update of 06-bf-02/0x03 (ADL C0) microcode (in intel-ucode/06-97-05)
    from revision 0x1f up to 0x22;
  - Update of 06-bf-05/0x03 (ADL C0) microcode (in intel-ucode/06-97-05)
    from revision 0x1f up to 0x22;
  - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision
    0x41c up to 0x421;
  - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in
    intel-ucode/06-9a-03) from revision 0x41c up to 0x421;
  - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
    intel-ucode/06-9a-04) from revision 0x41c up to 0x421;
  - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x41c
    up to 0x421;
  - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x53 up
    to 0x54;
  - Update of 06-97-02/0x03 (ADL-HX/S 8+8 C0) microcode (in
    intel-ucode/06-bf-02) from revision 0x1f up to 0x22;
  - Update of 06-97-05/0x03 (ADL-S 6+0 K0) microcode (in
    intel-ucode/06-bf-02) from revision 0x1f up to 0x22;
  - Update of 06-bf-02/0x03 (ADL C0) microcode from revision 0x1f up
    to 0x22;
  - Update of 06-bf-05/0x03 (ADL C0) microcode (in intel-ucode/06-bf-02)
    from revision 0x1f up to 0x22;
  - Update of 06-97-02/0x03 (ADL-HX/S 8+8 C0) microcode (in
    intel-ucode/06-bf-05) from revision 0x1f up to 0x22;
  - Update of 06-97-05/0x03 (ADL-S 6+0 K0) microcode (in
    intel-ucode/06-bf-05) from revision 0x1f up to 0x22;
  - Update of 06-bf-02/0x03 (ADL C0) microcode (in intel-ucode/06-bf-05)
    from revision 0x1f up to 0x22;
  - Update of 06-bf-05/0x03 (ADL C0) microcode from revision 0x1f up
    to 0x22.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.16
changelog:
- Update Intel CPU microcode to microcode-20230214 release, addresses
  CVE-2022-21216, CVE-2022-33196, CVE-2022-33972, CVE-2022-38090 (#2171238,
    - Addition of 06-6c-01/0x10 (ICL-D B0) microcode at revision 0x1000211;
  - Addition of 06-8f-04/0x87 (SPR-SP E0/S1) microcode at revision
    0x2b000181;
  - Addition of 06-8f-04/0x10 microcode at revision 0x2c000170;
  - Addition of 06-8f-05/0x87 (SPR-SP E2) microcode (in
    intel-ucode/06-8f-04) at revision 0x2b000181;
  - Addition of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
    intel-ucode/06-8f-04) at revision 0x2c000170;
  - Addition of 06-8f-06/0x87 (SPR-SP E3) microcode (in
    intel-ucode/06-8f-04) at revision 0x2b000181;
  - Addition of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-04) at
    revision 0x2c000170;
  - Addition of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
    intel-ucode/06-8f-04) at revision 0x2b000181;
  - Addition of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
    intel-ucode/06-8f-04) at revision 0x2b000181;
  - Addition of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
    intel-ucode/06-8f-04) at revision 0x2c000170;
  - Addition of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
    intel-ucode/06-8f-05) at revision 0x2b000181;
  - Addition of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-05) at
    revision 0x2c000170;
  - Addition of 06-8f-05/0x87 (SPR-SP E2) microcode at revision
    0x2b000181;
  - Addition of 06-8f-05/0x10 (SPR-HBM B1) microcode at revision
    0x2c000170;
  - Addition of 06-8f-06/0x87 (SPR-SP E3) microcode (in
    intel-ucode/06-8f-05) at revision 0x2b000181;
  - Addition of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-05) at
    revision 0x2c000170;
  - Addition of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
    intel-ucode/06-8f-05) at revision 0x2b000181;
  - Addition of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
    intel-ucode/06-8f-05) at revision 0x2b000181;
  - Addition of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
    intel-ucode/06-8f-05) at revision 0x2c000170;
  - Addition of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
    intel-ucode/06-8f-06) at revision 0x2b000181;
  - Addition of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-06) at
    revision 0x2c000170;
  - Addition of 06-8f-05/0x87 (SPR-SP E2) microcode (in
    intel-ucode/06-8f-06) at revision 0x2b000181;
  - Addition of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
    intel-ucode/06-8f-06) at revision 0x2c000170;
  - Addition of 06-8f-06/0x87 (SPR-SP E3) microcode at revision
    0x2b000181;
  - Addition of 06-8f-06/0x10 microcode at revision 0x2c000170;
  - Addition of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
    intel-ucode/06-8f-06) at revision 0x2b000181;
  - Addition of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
    intel-ucode/06-8f-06) at revision 0x2b000181;
  - Addition of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
    intel-ucode/06-8f-06) at revision 0x2c000170;
  - Addition of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
    intel-ucode/06-8f-07) at revision 0x2b000181;
  - Addition of 06-8f-05/0x87 (SPR-SP E2) microcode (in
    intel-ucode/06-8f-07) at revision 0x2b000181;
  - Addition of 06-8f-06/0x87 (SPR-SP E3) microcode (in
    intel-ucode/06-8f-07) at revision 0x2b000181;
  - Addition of 06-8f-07/0x87 (SPR-SP E4/S2) microcode at revision
    0x2b000181;
  - Addition of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
    intel-ucode/06-8f-07) at revision 0x2b000181;
  - Addition of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
    intel-ucode/06-8f-08) at revision 0x2b000181;
  - Addition of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-08) at
    revision 0x2c000170;
  - Addition of 06-8f-05/0x87 (SPR-SP E2) microcode (in
    intel-ucode/06-8f-08) at revision 0x2b000181;
  - Addition of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
    intel-ucode/06-8f-08) at revision 0x2c000170;
  - Addition of 06-8f-06/0x87 (SPR-SP E3) microcode (in
    intel-ucode/06-8f-08) at revision 0x2b000181;
  - Addition of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-08) at
    revision 0x2c000170;
  - Addition of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
    intel-ucode/06-8f-08) at revision 0x2b000181;
  - Addition of 06-8f-08/0x87 (SPR-SP E5/S3) microcode at revision
    0x2b000181;
  - Addition of 06-8f-08/0x10 (SPR-HBM B3) microcode at revision
    0x2c000170;
  - Addition of 06-b7-01/0x32 (RPL-S S0) microcode at revision 0x112;
  - Addition of 06-ba-02/0xc0 microcode at revision 0x410e;
  - Addition of 06-ba-03/0xc0 microcode (in intel-ucode/06-ba-02) at
    revision 0x410e;
  - Addition of 06-ba-02/0xc0 microcode (in intel-ucode/06-ba-03) at
    revision 0x410e;
  - Addition of 06-ba-03/0xc0 microcode at revision 0x410e;
  - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in
    intel-06-8c-01/intel-ucode/06-8c-01) from revision 0xa4 up to 0xa6;
  - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
    microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0c) from
    revision 0xf0 up to 0xf4;
  - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0xf0 up
    to 0xf4;
  - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x100015e
    up to 0x1000161;
  - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x4003302
    up to 0x4003303;
  - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
    0x5003302 up to 0x5003303;
  - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x7002501
    up to 0x7002503;
  - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd000375
    up to 0xd000389;
  - Update of 06-7a-01/0x01 (GLK B0) microcode from revision 0x3c up
    to 0x3e;
  - Update of 06-7a-08/0x01 (GLK-R R0) microcode from revision 0x20 up
    to 0x22;
  - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xb2
    up to 0xb8;
  - Update of 06-8a-01/0x10 (LKF B2/B3) microcode from revision 0x31 up
    to 0x32;
  - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x40 up
    to 0x42;
  - Update of 06-96-01/0x01 (EHL B1) microcode from revision 0x16 up
    to 0x17;
  - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision
    0x22 up to 0x2c (old pf 0x3);
  - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
    intel-ucode/06-97-02) from revision 0x22 up to 0x2c (old pf 0x3);
  - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
    from revision 0x22 up to 0x2c (old pf 0x3);
  - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
    from revision 0x22 up to 0x2c (old pf 0x3);
  - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
    intel-ucode/06-97-05) from revision 0x22 up to 0x2c (old pf 0x3);
  - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x22
    up to 0x2c (old pf 0x3);
  - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
    from revision 0x22 up to 0x2c (old pf 0x3);
  - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
    from revision 0x22 up to 0x2c (old pf 0x3);
  - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision
    0x421 up to 0x429;
  - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in
    intel-ucode/06-9a-03) from revision 0x421 up to 0x429;
  - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
    intel-ucode/06-9a-04) from revision 0x421 up to 0x429;
  - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x421
    up to 0x429;
  - Update of 06-9c-00/0x01 (JSL A0/A1) microcode from revision 0x24000023
    up to 0x24000024;
  - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xf0 up
    to 0xf4;
  - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xf0
    up to 0xf4;
  - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xf0
    up to 0xf4;
  - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xf0
    up to 0xf4;
  - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K1) microcode from revision
    0xf0 up to 0xf4;
  - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x54 up
    to 0x57;
  - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
    intel-ucode/06-bf-02) from revision 0x22 up to 0x2c (old pf 0x3);
  - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
    intel-ucode/06-bf-02) from revision 0x22 up to 0x2c (old pf 0x3);
  - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x22 up to
    0x2c (old pf 0x3);
  - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02)
    from revision 0x22 up to 0x2c (old pf 0x3);
  - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
    intel-ucode/06-bf-05) from revision 0x22 up to 0x2c (old pf 0x3);
  - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
    intel-ucode/06-bf-05) from revision 0x22 up to 0x2c (old pf 0x3);
  - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05)
    from revision 0x22 up to 0x2c (old pf 0x3);
  - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x22 up to
    0x2c (old pf 0x3).
- Change the logger severity level to warning to align with the kmsg one.


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 2:2.1-73.16.tuxcare.els1
changelog:
- Update Intel CPU microcode to microcode-20231114 release, addresses
  CVE-2022-40982 (INTEL-SA-00828), CVE-2022-41804 (INTEL-SA-00837),
  CVE-2023-23908 (INTEL-SA-00836), CVE-2023-23583 (INTEL-SA-00950):
  - Addition of 06-9a-04/0x40 microcode (in 06-9a-04) at revision 0x5;
  - Addition of 06-ba-02/0xe0 microcode (in 06-ba-02) at revision 0x411c;
  - Addition of 06-ba-02/0xe0 microcode (in 06-ba-02) at revision 0x411c;
  - Addition of 06-ba-03/0xe0 microcode (in 06-ba-02) at revision 0x411c;
  - Addition of 06-ba-02/0xe0 microcode (in 06-ba-03) at revision 0x411c;
  - Addition of 06-ba-02/0xe0 microcode (in 06-ba-03) at revision 0x411c;
  - Addition of 06-ba-03/0xe0 microcode (in 06-ba-03) at revision 0x411c;
  - Addition of 06-be-00/0x11 microcode (in 06-be-00) at revision 0x12;
  - Removal of 06-ba-02/0xc0 microcode (in 06-ba-02) at revision 0x410e;
  - Removal of 06-ba-02/0xc0 microcode (in 06-ba-02) at revision 0x410e;
  - Removal of 06-ba-03/0xc0 microcode (in 06-ba-02) at revision 0x410e;
  - Removal of 06-ba-02/0xc0 microcode (in 06-ba-03) at revision 0x410e;
  - Removal of 06-ba-02/0xc0 microcode (in 06-ba-03) at revision 0x410e;
  - Removal of 06-ba-03/0xc0 microcode (in 06-ba-03) at revision 0x410e;
  - Update of 06-55-03/0x97 (SKX-SP B1) microcode (in 06-55-03) from revision
    0x1000161 up to 0x1000181;
  - Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in 06-55-04)
    from revision 0x2006e05 up to 0x2007006;
  - Update of 06-55-06/0xbf (CLX-SP B0) microcode (in 06-55-06) from revision
    0x4003303 up to 0x4003604;
  - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode (in 06-55-07) from
    revision 0x5003303 up to 0x5003604;
  - Update of 06-55-0b/0xbf (CPX-SP A1) microcode (in 06-55-0b) from revision
    0x7002503 up to 0x7002703;
  - Update of 06-6a-06/0x87 (ICX-SP D0) microcode (in 06-6a-06) from revision
    0xd000389 up to 0xd0003b9;
  - Update of 06-6c-01/0x10 (ICL-D B0) microcode (in 06-6c-01) from revision
    0x1000211 up to 0x1000268;
  - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode (in 06-7e-05) from revision
    0xb8 up to 0xc2;
  - Update of 06-8a-01/0x10 (LKF B2/B3) microcode (in 06-8a-01) from revision
    0x32 up to 0x33;
  - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in 06-8c-01) from
    revision 0xa6 up to 0xb4;
  - Update of 06-8c-02/0xc2 (TGL-R C0) microcode (in 06-8c-02) from revision
    0x28 up to 0x34;
  - Update of 06-8d-01/0xc2 (TGL-H R0) microcode (in 06-8d-01) from revision
    0x42 up to 0x4e;
  - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode (in 06-8e-09) from
    revision 0xf0 up to 0xf4;
  - Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode (in 06-8e-09) from
    revision 0xf0 up to 0xf4;
  - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode (in 06-8e-0a)
    from revision 0xf0 up to 0xf4;
  - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode (in 06-8e-0b) from revision
    0xf0 up to 0xf4;
  - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0) microcode
    (in 06-8e-0c) from revision 0xf4 up to 0xf8;
  - Update of 06-8f-04/0x10 microcode (in 06-8f-04) from revision 0x2c000170 up
    to 0x2c000290;
  - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in 06-8f-04) from
    revision 0x2b000181 up to 0x2b0004d0;
  - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in 06-8f-04) from revision
    0x2c000170 up to 0x2c000290;
  - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in 06-8f-04) from revision
    0x2b000181 up to 0x2b0004d0;
  - Update of 06-8f-06/0x10 microcode (in 06-8f-04) from revision 0x2c000170 up
    to 0x2c000290;
  - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in 06-8f-04) from revision
    0x2b000181 up to 0x2b0004d0;
  - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in 06-8f-04) from
    revision 0x2b000181 up to 0x2b0004d0;
  - Addition of 06-8f-08/0x10 (SPR-HBM B3) microcode (in 06-8f-04) at revision
    0x2c000290;
  - Addition of 06-8f-08/0x10 (SPR-HBM B3) microcode (in 06-8f-04) at revision
    0x2c000290;
  - Removal of 06-8f-08/0x10 (SPR-HBM B3) microcode (in 06-8f-04) at revision
    0x2c000170;
  - Removal of 06-8f-08/0x10 (SPR-HBM B3) microcode (in 06-8f-04) at revision
    0x2c000170;
  - Addition of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in 06-8f-04) at
    revision 0x2b0004d0;
  - Addition of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in 06-8f-04) at
    revision 0x2b0004d0;
  - Removal of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in 06-8f-04) at revision
    0x2b000181;
  - Removal of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in 06-8f-04) at revision
    0x2b000181;
  - Update of 06-8f-04/0x10 microcode (in 06-8f-05) from revision 0x2c000170 up
    to 0x2c000290;
  - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in 06-8f-05) from
    revision 0x2b000181 up to 0x2b0004d0;
  - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in 06-8f-05) from revision
    0x2c000170 up to 0x2c000290;
  - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in 06-8f-05) from revision
    0x2b000181 up to 0x2b0004d0;
  - Update of 06-8f-06/0x10 microcode (in 06-8f-05) from revision 0x2c000170 up
    to 0x2c000290;
  - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in 06-8f-05) from revision
    0x2b000181 up to 0x2b0004d0;
  - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in 06-8f-05) from
    revision 0x2b000181 up to 0x2b0004d0;
  - Addition of 06-8f-08/0x10 (SPR-HBM B3) microcode (in 06-8f-05) at revision
    0x2c000290;
  - Addition of 06-8f-08/0x10 (SPR-HBM B3) microcode (in 06-8f-05) at revision
    0x2c000290;
  - Removal of 06-8f-08/0x10 (SPR-HBM B3) microcode (in 06-8f-05) at revision
    0x2c000170;
  - Removal of 06-8f-08/0x10 (SPR-HBM B3) microcode (in 06-8f-05) at revision
    0x2c000170;
  - Addition of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in 06-8f-05) at
    revision 0x2b0004d0;
  - Addition of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in 06-8f-05) at
    revision 0x2b0004d0;
  - Removal of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in 06-8f-05) at revision
    0x2b000181;
  - Removal of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in 06-8f-05) at revision
    0x2b000181;
  - Update of 06-8f-04/0x10 microcode (in 06-8f-06) from revision 0x2c000170 up
    to 0x2c000290;
  - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in 06-8f-06) from
    revision 0x2b000181 up to 0x2b0004d0;
  - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in 06-8f-06) from revision
    0x2c000170 up to 0x2c000290;
  - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in 06-8f-06) from revision
    0x2b000181 up to 0x2b0004d0;
  - Update of 06-8f-06/0x10 microcode (in 06-8f-06) from revision 0x2c000170 up
    to 0x2c000290;
  - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in 06-8f-06) from revision
    0x2b000181 up to 0x2b0004d0;
  - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in 06-8f-06) from
    revision 0x2b000181 up to 0x2b0004d0;
  - Addition of 06-8f-08/0x10 (SPR-HBM B3) microcode (in 06-8f-06) at revision
    0x2c000290;
  - Addition of 06-8f-08/0x10 (SPR-HBM B3) microcode (in 06-8f-06) at revision
    0x2c000290;
  - Removal of 06-8f-08/0x10 (SPR-HBM B3) microcode (in 06-8f-06) at revision
    0x2c000170;
  - Removal of 06-8f-08/0x10 (SPR-HBM B3) microcode (in 06-8f-06) at revision
    0x2c000170;
  - Addition of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in 06-8f-06) at
    revision 0x2b0004d0;
  - Addition of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in 06-8f-06) at
    revision 0x2b0004d0;
  - Removal of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in 06-8f-06) at revision
    0x2b000181;
  - Removal of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in 06-8f-06) at revision
    0x2b000181;
  - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in 06-8f-07) from
    revision 0x2b000181 up to 0x2b0004d0;
  - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in 06-8f-07) from revision
    0x2b000181 up to 0x2b0004d0;
  - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in 06-8f-07) from revision
    0x2b000181 up to 0x2b0004d0;
  - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in 06-8f-07) from
    revision 0x2b000181 up to 0x2b0004d0;
  - Addition of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in 06-8f-07) at
    revision 0x2b0004d0;
  - Addition of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in 06-8f-07) at
    revision 0x2b0004d0;
  - Removal of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in 06-8f-07) at revision
    0x2b000181;
  - Removal of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in 06-8f-07) at revision
    0x2b000181;
  - Update of 06-8f-04/0x10 microcode (in 06-8f-08) from revision 0x2c000170 up
    to 0x2c000290;
  - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in 06-8f-08) from
    revision 0x2b000181 up to 0x2b0004d0;
  - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in 06-8f-08) from revision
    0x2c000170 up to 0x2c000290;
  - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in 06-8f-08) from revision
    0x2b000181 up to 0x2b0004d0;
  - Update of 06-8f-06/0x10 microcode (in 06-8f-08) from revision 0x2c000170 up
    to 0x2c000290;
  - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in 06-8f-08) from revision
    0x2b000181 up to 0x2b0004d0;
  - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in 06-8f-08) from
    revision 0x2b000181 up to 0x2b0004d0;
  - Addition of 06-8f-08/0x10 (SPR-HBM B3) microcode (in 06-8f-08) at revision
    0x2c000290;
  - Addition of 06-8f-08/0x10 (SPR-HBM B3) microcode (in 06-8f-08) at revision
    0x2c000290;
  - Removal of 06-8f-08/0x10 (SPR-HBM B3) microcode (in 06-8f-08) at revision
    0x2c000170;
  - Removal of 06-8f-08/0x10 (SPR-HBM B3) microcode (in 06-8f-08) at revision
    0x2c000170;
  - Addition of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in 06-8f-08) at
    revision 0x2b0004d0;
  - Addition of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in 06-8f-08) at
    revision 0x2b0004d0;
  - Removal of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in 06-8f-08) at revision
    0x2b000181;
  - Removal of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in 06-8f-08) at revision
    0x2b000181;
  - Addition of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in 06-97-02) at
    revision 0x32;
  - Addition of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in 06-97-02) at
    revision 0x32;
  - Removal of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in 06-97-02) at
    revision 0x2c;
  - Removal of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in 06-97-02) at
    revision 0x2c;
  - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in 06-97-02) from
    revision 0x2c up to 0x32;
  - Update of 06-bf-02/0x07 (ADL C0) microcode (in 06-97-02) from revision 0x2c
    up to 0x32;
  - Update of 06-bf-05/0x07 (ADL C0) microcode (in 06-97-02) from revision 0x2c
    up to 0x32;
  - Addition of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in 06-97-05) at
    revision 0x32;
  - Addition of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in 06-97-05) at
    revision 0x32;
  - Removal of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in 06-97-05) at
    revision 0x2c;
  - Removal of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in 06-97-05) at
    revision 0x2c;
  - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in 06-97-05) from
    revision 0x2c up to 0x32;
  - Update of 06-bf-02/0x07 (ADL C0) microcode (in 06-97-05) from revision 0x2c
    up to 0x32;
  - Update of 06-bf-05/0x07 (ADL C0) microcode (in 06-97-05) from revision 0x2c
    up to 0x32;
  - Addition of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in 06-9a-03) at
    revision 0x430;
  - Addition of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in 06-9a-03) at
    revision 0x430;
  - Removal of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in 06-9a-03) at
    revision 0x429;
  - Removal of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in 06-9a-03) at
    revision 0x429;
  - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in 06-9a-03) from
    revision 0x429 up to 0x430;
  - Addition of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in 06-9a-04) at
    revision 0x430;
  - Addition of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in 06-9a-04) at
    revision 0x430;
  - Removal of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in 06-9a-04) at
    revision 0x429;
  - Removal of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in 06-9a-04) at
    revision 0x429;
  - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in 06-9a-04) from
    revision 0x429 up to 0x430;
  - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode (in 06-9e-09)
    from revision 0xf0 up to 0xf4;
  - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode (in 06-9e-0a) from
    revision 0xf0 up to 0xf4;
  - Update of 06-9e-0b/0x02 (CFL-E/H/S B0) microcode (in 06-9e-0b) from
    revision 0xf0 up to 0xf4;
  - Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode (in 06-9e-0c) from
    revision 0xf0 up to 0xf4;
  - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in 06-9e-0d) from
    revision 0xf4 up to 0xfa;
  - Update of 06-a5-02/0x20 (CML-H R1) microcode (in 06-a5-02) from revision
    0xf4 up to 0xf8;
  - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode (in 06-a5-03) from
    revision 0xf4 up to 0xf8;
  - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode (in 06-a5-05) from
    revision 0xf4 up to 0xf8;
  - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode (in 06-a6-00) from
    revision 0xf4 up to 0xf8;
  - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K1) microcode (in 06-a6-01) from
    revision 0xf4 up to 0xf8;
  - Update of 06-a7-01/0x02 (RKL-S B0) microcode (in 06-a7-01) from revision
    0x57 up to 0x5d;
  - Update of 06-b7-01/0x32 (RPL-S S0) microcode (in 06-b7-01) from revision
    0x112 up to 0x11d;
  - Addition of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in 06-bf-02) at
    revision 0x32;
  - Addition of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in 06-bf-02) at
    revision 0x32;
  - Removal of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in 06-bf-02) at
    revision 0x2c;
  - Removal of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in 06-bf-02) at
    revision 0x2c;
  - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in 06-bf-02) from
    revision 0x2c up to 0x32;
  - Update of 06-bf-02/0x07 (ADL C0) microcode (in 06-bf-02) from revision 0x2c
    up to 0x32;
  - Update of 06-bf-05/0x07 (ADL C0) microcode (in 06-bf-02) from revision 0x2c
    up to 0x32;
  - Addition of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in 06-bf-05) at
    revision 0x32;
  - Addition of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in 06-bf-05) at
    revision 0x32;
  - Removal of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in 06-bf-05) at
    revision 0x2c;
  - Removal of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in 06-bf-05) at
    revision 0x2c;
  - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in 06-bf-05) from
    revision 0x2c up to 0x32;
  - Update of 06-bf-02/0x07 (ADL C0) microcode (in 06-bf-05) from revision 0x2c
    up to 0x32;
  - Update of 06-bf-05/0x07 (ADL C0) microcode (in 06-bf-05) from revision 0x2c
    up to 0x32;
- gen_update2.py was updated to output strings having restricted length.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.17
changelog:
- Force locale to C in check_caveats, reload_microcode, and update_ucode.
- Cleanup the dangling symlinks in update_ucode.
- Avoid spurious find failures due to calls on directories that may not exist.
- Add support for the new, more correct, variant of dracut's default
  $fw_dir path in dracut_99microcode_ctl-fw_dir_override_module_init.sh.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.18
changelog:
- Update Intel CPU microcode to microcode-20230516 release:
  - Addition of 06-be-00/0x01 (ADL-N A0) microcode at revision 0x10;
  - Addition of 06-9a-04/0x40 (AZB A0) microcode at revision 0x4;
  - Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in
    intel-06-55-04/intel-ucode/06-55-04) from revision 0x2006e05 up
    to 0x2006f05;
  - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in
    intel-06-8c-01/intel-ucode/06-8c-01) from revision 0xa6 up to 0xaa;
  - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x1000161
    up to 0x1000171;
  - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x4003303
    up to 0x4003501;
  - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
    0x5003303 up to 0x5003501;
  - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x7002503
    up to 0x7002601;
  - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd000389
    up to 0xd000390;
  - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x1000211
    up to 0x1000230;
  - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xb8
    up to 0xba;
  - Update of 06-8a-01/0x10 (LKF B2/B3) microcode from revision 0x32 up
    to 0x33;
  - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x28 up
    to 0x2a;
  - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x42 up
    to 0x44;
  - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode from revision 0xf0
    up to 0xf2;
  - Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode from revision
    0xf0 up to 0xf2;
  - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode from
    revision 0xf0 up to 0xf2;
  - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode from revision 0xf0 up
    to 0xf2;
  - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
    microcode from revision 0xf4 up to 0xf6;
  - Update of 06-8f-04/0x10 microcode from revision 0x2c000170 up to
    0x2c0001d1;
  - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode from revision
    0x2b000181 up to 0x2b000461;
  - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
    intel-ucode/06-8f-04) from revision 0x2c000170 up to 0x2c0001d1;
  - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
    intel-ucode/06-8f-04) from revision 0x2b000181 up to 0x2b000461;
  - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-04) from
    revision 0x2c000170 up to 0x2c0001d1;
  - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
    intel-ucode/06-8f-04) from revision 0x2b000181 up to 0x2b000461;
  - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
    intel-ucode/06-8f-04) from revision 0x2b000181 up to 0x2b000461;
  - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
    intel-ucode/06-8f-04) from revision 0x2c000170 up to 0x2c0001d1;
  - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
    intel-ucode/06-8f-04) from revision 0x2b000181 up to 0x2b000461;
  - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-05) from
    revision 0x2c000170 up to 0x2c0001d1;
  - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
    intel-ucode/06-8f-05) from revision 0x2b000181 up to 0x2b000461;
  - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode from revision
    0x2c000170 up to 0x2c0001d1;
  - Update of 06-8f-05/0x87 (SPR-SP E2) microcode from revision 0x2b000181
    up to 0x2b000461;
  - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-05) from
    revision 0x2c000170 up to 0x2c0001d1;
  - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
    intel-ucode/06-8f-05) from revision 0x2b000181 up to 0x2b000461;
  - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
    intel-ucode/06-8f-05) from revision 0x2b000181 up to 0x2b000461;
  - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
    intel-ucode/06-8f-05) from revision 0x2c000170 up to 0x2c0001d1;
  - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
    intel-ucode/06-8f-05) from revision 0x2b000181 up to 0x2b000461;
  - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-06) from
    revision 0x2c000170 up to 0x2c0001d1;
  - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
    intel-ucode/06-8f-06) from revision 0x2b000181 up to 0x2b000461;
  - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
    intel-ucode/06-8f-06) from revision 0x2c000170 up to 0x2c0001d1;
  - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
    intel-ucode/06-8f-06) from revision 0x2b000181 up to 0x2b000461;
  - Update of 06-8f-06/0x10 microcode from revision 0x2c000170 up to
    0x2c0001d1;
  - Update of 06-8f-06/0x87 (SPR-SP E3) microcode from revision 0x2b000181
    up to 0x2b000461;
  - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
    intel-ucode/06-8f-06) from revision 0x2b000181 up to 0x2b000461;
  - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
    intel-ucode/06-8f-06) from revision 0x2c000170 up to 0x2c0001d1;
  - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
    intel-ucode/06-8f-06) from revision 0x2b000181 up to 0x2b000461;
  - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
    intel-ucode/06-8f-07) from revision 0x2b000181 up to 0x2b000461;
  - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
    intel-ucode/06-8f-07) from revision 0x2b000181 up to 0x2b000461;
  - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
    intel-ucode/06-8f-07) from revision 0x2b000181 up to 0x2b000461;
  - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision
    0x2b000181 up to 0x2b000461;
  - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
    intel-ucode/06-8f-07) from revision 0x2b000181 up to 0x2b000461;
  - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-08) from
    revision 0x2c000170 up to 0x2c0001d1;
  - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
    intel-ucode/06-8f-08) from revision 0x2b000181 up to 0x2b000461;
  - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
    intel-ucode/06-8f-08) from revision 0x2c000170 up to 0x2c0001d1;
  - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
    intel-ucode/06-8f-08) from revision 0x2b000181 up to 0x2b000461;
  - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-08) from
    revision 0x2c000170 up to 0x2c0001d1;
  - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
    intel-ucode/06-8f-08) from revision 0x2b000181 up to 0x2b000461;
  - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
    intel-ucode/06-8f-08) from revision 0x2b000181 up to 0x2b000461;
  - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode from revision
    0x2c000170 up to 0x2c0001d1;
  - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode from revision
    0x2b000181 up to 0x2b000461;
  - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision
    0x429 up to 0x42a;
  - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in
    intel-ucode/06-9a-03) from revision 0x429 up to 0x42a;
  - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
    intel-ucode/06-9a-04) from revision 0x429 up to 0x42a;
  - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x429
    up to 0x42a;
  - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode from
    revision 0xf0 up to 0xf2;
  - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode from revision
    0xf0 up to 0xf2;
  - Update of 06-9e-0b/0x02 (CFL-E/H/S B0) microcode from revision 0xf0
    up to 0xf2;
  - Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode from revision
    0xf0 up to 0xf2;
  - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode from revision
    0xf4 up to 0xf8;
  - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xf4 up
    to 0xf6;
  - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xf4
    up to 0xf6;
  - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xf4
    up to 0xf6;
  - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xf4
    up to 0xf6;
  - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K1) microcode from revision
    0xf4 up to 0xf6;
  - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x57 up
    to 0x58;
  - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x112 up
    to 0x113;
  - Update of 06-ba-02/0xc0 (RPL-H 6+8/P 6+8 J0) microcode from revision
    0x410e up to 0x4112;
  - Update of 06-ba-03/0xc0 (RPL-U 2+8 Q0) microcode (in
    intel-ucode/06-ba-02) from revision 0x410e up to 0x4112;
  - Update of 06-ba-02/0xc0 (RPL-H 6+8/P 6+8 J0) microcode (in
    intel-ucode/06-ba-03) from revision 0x410e up to 0x4112;
  - Update of 06-ba-03/0xc0 (RPL-U 2+8 Q0) microcode from revision 0x410e
    up to 0x4112.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.19
changelog:
- Update Intel CPU microcode to microcode-20230808 release, addresses
  CVE-2022-40982, CVE-2022-41804, CVE-2023-23908 (#2223994):
  - Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in
    intel-06-55-04/intel-ucode/06-55-04) from revision 0x2006f05 up
    to 0x2007006;
  - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in
    intel-06-8c-01/intel-ucode/06-8c-01) from revision 0xaa up to 0xac;
  - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x1000171
    up to 0x1000181;
  - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x4003501
    up to 0x4003604;
  - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
    0x5003501 up to 0x5003604;
  - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x7002601
    up to 0x7002703;
  - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd000390
    up to 0xd0003a5;
  - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xba
    up to 0xbc;
  - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x2a up
    to 0x2c;
  - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x44 up
    to 0x46;
  - Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode from revision
    0xf2 up to 0xf4;
  - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode from revision 0xf2
    up to 0xf4;
  - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode from
    revision 0xf2 up to 0xf4;
  - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode from revision 0xf2 up
    to 0xf4;
  - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
    microcode from revision 0xf6 up to 0xf8;
  - Update of 06-8f-04/0x10 microcode from revision 0x2c0001d1 up to
    0x2c000271;
  - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode from revision
    0x2b000461 up to 0x2b0004b1;
  - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
    intel-ucode/06-8f-04) from revision 0x2c0001d1 up to 0x2c000271;
  - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
    intel-ucode/06-8f-04) from revision 0x2b000461 up to 0x2b0004b1;
  - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-04) from
    revision 0x2c0001d1 up to 0x2c000271;
  - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
    intel-ucode/06-8f-04) from revision 0x2b000461 up to 0x2b0004b1;
  - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
    intel-ucode/06-8f-04) from revision 0x2b000461 up to 0x2b0004b1;
  - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
    intel-ucode/06-8f-04) from revision 0x2c0001d1 up to 0x2c000271;
  - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
    intel-ucode/06-8f-04) from revision 0x2b000461 up to 0x2b0004b1;
  - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-05) from
    revision 0x2c0001d1 up to 0x2c000271;
  - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
    intel-ucode/06-8f-05) from revision 0x2b000461 up to 0x2b0004b1;
  - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode from revision
    0x2c0001d1 up to 0x2c000271;
  - Update of 06-8f-05/0x87 (SPR-SP E2) microcode from revision 0x2b000461
    up to 0x2b0004b1;
  - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-05) from
    revision 0x2c0001d1 up to 0x2c000271;
  - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
    intel-ucode/06-8f-05) from revision 0x2b000461 up to 0x2b0004b1;
  - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
    intel-ucode/06-8f-05) from revision 0x2b000461 up to 0x2b0004b1;
  - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
    intel-ucode/06-8f-05) from revision 0x2c0001d1 up to 0x2c000271;
  - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
    intel-ucode/06-8f-05) from revision 0x2b000461 up to 0x2b0004b1;
  - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-06) from
    revision 0x2c0001d1 up to 0x2c000271;
  - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
    intel-ucode/06-8f-06) from revision 0x2b000461 up to 0x2b0004b1;
  - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
    intel-ucode/06-8f-06) from revision 0x2c0001d1 up to 0x2c000271;
  - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
    intel-ucode/06-8f-06) from revision 0x2b000461 up to 0x2b0004b1;
  - Update of 06-8f-06/0x10 microcode from revision 0x2c0001d1 up to
    0x2c000271;
  - Update of 06-8f-06/0x87 (SPR-SP E3) microcode from revision 0x2b000461
    up to 0x2b0004b1;
  - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
    intel-ucode/06-8f-06) from revision 0x2b000461 up to 0x2b0004b1;
  - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
    intel-ucode/06-8f-06) from revision 0x2c0001d1 up to 0x2c000271;
  - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
    intel-ucode/06-8f-06) from revision 0x2b000461 up to 0x2b0004b1;
  - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
    intel-ucode/06-8f-07) from revision 0x2b000461 up to 0x2b0004b1;
  - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
    intel-ucode/06-8f-07) from revision 0x2b000461 up to 0x2b0004b1;
  - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
    intel-ucode/06-8f-07) from revision 0x2b000461 up to 0x2b0004b1;
  - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision
    0x2b000461 up to 0x2b0004b1;
  - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
    intel-ucode/06-8f-07) from revision 0x2b000461 up to 0x2b0004b1;
  - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-08) from
    revision 0x2c0001d1 up to 0x2c000271;
  - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
    intel-ucode/06-8f-08) from revision 0x2b000461 up to 0x2b0004b1;
  - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
    intel-ucode/06-8f-08) from revision 0x2c0001d1 up to 0x2c000271;
  - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
    intel-ucode/06-8f-08) from revision 0x2b000461 up to 0x2b0004b1;
  - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-08) from
    revision 0x2c0001d1 up to 0x2c000271;
  - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
    intel-ucode/06-8f-08) from revision 0x2b000461 up to 0x2b0004b1;
  - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
    intel-ucode/06-8f-08) from revision 0x2b000461 up to 0x2b0004b1;
  - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode from revision
    0x2c0001d1 up to 0x2c000271;
  - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode from revision
    0x2b000461 up to 0x2b0004b1;
  - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision
    0x2c up to 0x2e;
  - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
    intel-ucode/06-97-02) from revision 0x2c up to 0x2e;
  - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
    from revision 0x2c up to 0x2e;
  - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
    from revision 0x2c up to 0x2e;
  - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
    intel-ucode/06-97-05) from revision 0x2c up to 0x2e;
  - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x2c
    up to 0x2e;
  - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
    from revision 0x2c up to 0x2e;
  - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
    from revision 0x2c up to 0x2e;
  - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision
    0x42a up to 0x42c;
  - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in
    intel-ucode/06-9a-03) from revision 0x42a up to 0x42c;
  - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
    intel-ucode/06-9a-04) from revision 0x42a up to 0x42c;
  - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x42a
    up to 0x42c;
  - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode from
    revision 0xf2 up to 0xf4;
  - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode from revision
    0xf2 up to 0xf4;
  - Update of 06-9e-0b/0x02 (CFL-E/H/S B0) microcode from revision 0xf2
    up to 0xf4;
  - Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode from revision
    0xf2 up to 0xf4;
  - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode from revision
    0xf8 up to 0xfa;
  - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xf6 up
    to 0xf8;
  - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xf6
    up to 0xf8;
  - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xf6
    up to 0xf8;
  - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xf6
    up to 0xf8;
  - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K1) microcode from revision
    0xf6 up to 0xf8;
  - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x58 up
    to 0x59;
  - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x113 up
    to 0x119;
  - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
    intel-ucode/06-bf-02) from revision 0x2c up to 0x2e;
  - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
    intel-ucode/06-bf-02) from revision 0x2c up to 0x2e;
  - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x2c up
    to 0x2e;
  - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02)
    from revision 0x2c up to 0x2e;
  - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
    intel-ucode/06-bf-05) from revision 0x2c up to 0x2e;
  - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
    intel-ucode/06-bf-05) from revision 0x2c up to 0x2e;
  - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05)
    from revision 0x2c up to 0x2e;
  - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x2c up
    to 0x2e;
  - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision
    0x4112 up to 0x4119 (old pf 0xc0);
  - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in
    intel-ucode/06-ba-02) from revision 0x4112 up to 0x4119 (old pf 0xc0);
  - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in
    intel-ucode/06-ba-03) from revision 0x4112 up to 0x4119 (old pf 0xc0);
  - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4112
    up to 0x4119 (old pf 0xc0);
  - Update of 06-be-00/0x11 (ADL-N A0) microcode from revision 0x10 up
    to 0x11 (old pf 0x1).


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.20
changelog:
- Update Intel CPU microcode to microcode-20231009 release, addresses
  CVE-2023-23583 (RHEL-3920):
  - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in
    intel-06-8c-01/intel-ucode/06-8c-01) from revision 0xac up to 0xb4;
  - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd0003a5
    up to 0xd0003b9;
  - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x1000230
    up to 0x1000268;
  - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xbc
    up to 0xc2;
  - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x2c up
    to 0x34;
  - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x46 up
    to 0x4e;
  - Update of 06-8f-04/0x10 microcode from revision 0x2c000271 up to
    0x2c000290;
  - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode from revision
    0x2b0004b1 up to 0x2b0004d0;
  - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
    intel-ucode/06-8f-04) from revision 0x2c000271 up to 0x2c000290;
  - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
    intel-ucode/06-8f-04) from revision 0x2b0004b1 up to 0x2b0004d0;
  - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-04) from
    revision 0x2c000271 up to 0x2c000290;
  - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
    intel-ucode/06-8f-04) from revision 0x2b0004b1 up to 0x2b0004d0;
  - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
    intel-ucode/06-8f-04) from revision 0x2b0004b1 up to 0x2b0004d0;
  - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
    intel-ucode/06-8f-04) from revision 0x2c000271 up to 0x2c000290;
  - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
    intel-ucode/06-8f-04) from revision 0x2b0004b1 up to 0x2b0004d0;
  - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-05) from
    revision 0x2c000271 up to 0x2c000290;
  - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
    intel-ucode/06-8f-05) from revision 0x2b0004b1 up to 0x2b0004d0;
  - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode from revision
    0x2c000271 up to 0x2c000290;
  - Update of 06-8f-05/0x87 (SPR-SP E2) microcode from revision 0x2b0004b1
    up to 0x2b0004d0;
  - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-05) from
    revision 0x2c000271 up to 0x2c000290;
  - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
    intel-ucode/06-8f-05) from revision 0x2b0004b1 up to 0x2b0004d0;
  - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
    intel-ucode/06-8f-05) from revision 0x2b0004b1 up to 0x2b0004d0;
  - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
    intel-ucode/06-8f-05) from revision 0x2c000271 up to 0x2c000290;
  - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
    intel-ucode/06-8f-05) from revision 0x2b0004b1 up to 0x2b0004d0;
  - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-06) from
    revision 0x2c000271 up to 0x2c000290;
  - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
    intel-ucode/06-8f-06) from revision 0x2b0004b1 up to 0x2b0004d0;
  - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
    intel-ucode/06-8f-06) from revision 0x2c000271 up to 0x2c000290;
  - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
    intel-ucode/06-8f-06) from revision 0x2b0004b1 up to 0x2b0004d0;
  - Update of 06-8f-06/0x10 microcode from revision 0x2c000271 up to
    0x2c000290;
  - Update of 06-8f-06/0x87 (SPR-SP E3) microcode from revision 0x2b0004b1
    up to 0x2b0004d0;
  - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
    intel-ucode/06-8f-06) from revision 0x2b0004b1 up to 0x2b0004d0;
  - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
    intel-ucode/06-8f-06) from revision 0x2c000271 up to 0x2c000290;
  - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
    intel-ucode/06-8f-06) from revision 0x2b0004b1 up to 0x2b0004d0;
  - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
    intel-ucode/06-8f-07) from revision 0x2b0004b1 up to 0x2b0004d0;
  - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
    intel-ucode/06-8f-07) from revision 0x2b0004b1 up to 0x2b0004d0;
  - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
    intel-ucode/06-8f-07) from revision 0x2b0004b1 up to 0x2b0004d0;
  - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision
    0x2b0004b1 up to 0x2b0004d0;
  - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
    intel-ucode/06-8f-07) from revision 0x2b0004b1 up to 0x2b0004d0;
  - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-08) from
    revision 0x2c000271 up to 0x2c000290;
  - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
    intel-ucode/06-8f-08) from revision 0x2b0004b1 up to 0x2b0004d0;
  - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
    intel-ucode/06-8f-08) from revision 0x2c000271 up to 0x2c000290;
  - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
    intel-ucode/06-8f-08) from revision 0x2b0004b1 up to 0x2b0004d0;
  - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-08) from
    revision 0x2c000271 up to 0x2c000290;
  - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
    intel-ucode/06-8f-08) from revision 0x2b0004b1 up to 0x2b0004d0;
  - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
    intel-ucode/06-8f-08) from revision 0x2b0004b1 up to 0x2b0004d0;
  - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode from revision
    0x2c000271 up to 0x2c000290;
  - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode from revision
    0x2b0004b1 up to 0x2b0004d0;
  - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision
    0x2e up to 0x32;
  - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
    intel-ucode/06-97-02) from revision 0x2e up to 0x32;
  - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
    from revision 0x2e up to 0x32;
  - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
    from revision 0x2e up to 0x32;
  - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
    intel-ucode/06-97-05) from revision 0x2e up to 0x32;
  - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x2e
    up to 0x32;
  - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
    from revision 0x2e up to 0x32;
  - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
    from revision 0x2e up to 0x32;
  - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision
    0x42c up to 0x430;
  - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in
    intel-ucode/06-9a-03) from revision 0x42c up to 0x430;
  - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
    intel-ucode/06-9a-04) from revision 0x42c up to 0x430;
  - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x42c
    up to 0x430;
  - Update of 06-9a-04/0x40 (AZB A0) microcode from revision 0x4 up
    to 0x5;
  - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x59 up
    to 0x5d;
  - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x119 up
    to 0x11d;
  - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision
    0x4119 up to 0x411c;
  - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in
    intel-ucode/06-ba-02) from revision 0x4119 up to 0x411c;
  - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in
    intel-ucode/06-ba-03) from revision 0x4119 up to 0x411c;
  - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4119
    up to 0x411c;
  - Update of 06-be-00/0x11 (ADL-N A0) microcode from revision 0x11 up
    to 0x12;
  - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
    intel-ucode/06-bf-02) from revision 0x2e up to 0x32;
  - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
    intel-ucode/06-bf-02) from revision 0x2e up to 0x32;
  - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x2e up
    to 0x32;
  - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02)
    from revision 0x2e up to 0x32;
  - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
    intel-ucode/06-bf-05) from revision 0x2e up to 0x32;
  - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
    intel-ucode/06-bf-05) from revision 0x2e up to 0x32;
  - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05)
    from revision 0x2e up to 0x32;
  - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x2e up
    to 0x32.


author: Dmitrii Samoilov <dsamoilov@cloudlinux.com> - 2:2.1-73.20.tuxcare.els1
changelog:
- Moved tuxcare patches from 2:2.1-73.16.tuxcare.els1
  - gen_update2.py was updated to output strings having restricted length
  - Update Intel CPU microcode to microcode-20231114 release (it's the same
    as microcode-20231009)
- Update vendor patches


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 2:2.1-73.21.tuxcare.els1
changelog:
- Update Intel CPU microcode to 20240813:
  - Addition of cpuid:806F8/0x10 (SPR-HBM B3) microcode (in microcode.dat) at
    revision 0x2c000390;
  - Addition of cpuid:806F8/0x87 (SPR-SP E5/S3) microcode (in microcode.dat) at
    revision 0x2b0005c0;
  - Addition of cpuid:90672/0x07 (ADL-HX/S 8+8 C0) microcode (in microcode.dat)
    at revision 0x35;
  - Addition of cpuid:906A3/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
    microcode.dat) at revision 0x433;
  - Addition of cpuid:A06A4/0xe6 microcode (in microcode.dat) at revision 0x1e;
  - Addition of cpuid:B06A2/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in
    microcode.dat) at revision 0x4121;
  - Addition of cpuid:B06A3/0xe0 (RPL-U 2+8 Q0) microcode (in microcode.dat) at
    revision 0x4121;
  - Addition of cpuid:B06A8/0xe0 microcode (in microcode.dat) at revision
    0x4121;
  - Addition of cpuid:C06F1/0x87 microcode (in microcode.dat) at revision
    0x21000230;
  - Addition of cpuid:C06F2/0x87 microcode (in microcode.dat) at revision
    0x21000230;
  - Removal of cpuid:806F4/0x10 microcode (in microcode.dat) at revision
    0x2c000290;
  - Removal of cpuid:806F4/0x87 (SPR-SP E0/S1) microcode (in microcode.dat) at
    revision 0x2b0004d0;
  - Removal of cpuid:806F5/0x10 (SPR-HBM B1) microcode (in microcode.dat) at
    revision 0x2c000290;
  - Removal of cpuid:806F5/0x87 (SPR-SP E2) microcode (in microcode.dat) at
    revision 0x2b0004d0;
  - Removal of cpuid:806F6/0x10 microcode (in microcode.dat) at revision
    0x2c000290;
  - Removal of cpuid:806F6/0x87 (SPR-SP E3) microcode (in microcode.dat) at
    revision 0x2b0004d0;
  - Removal of cpuid:806F7/0x87 (SPR-SP E4/S2) microcode (in microcode.dat) at
    revision 0x2b0004d0;
  - Removal of cpuid:806F8/0x10 (SPR-HBM B3) microcode (in microcode.dat) at
    revision 0x2c000290;
  - Removal of cpuid:806F8/0x87 (SPR-SP E5/S3) microcode (in microcode.dat) at
    revision 0x2b0004d0;
  - Removal of cpuid:90672/0x07 (ADL-HX/S 8+8 C0) microcode (in microcode.dat)
    at revision 0x32;
  - Removal of cpuid:906A3/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
    microcode.dat) at revision 0x430;
  - Removal of cpuid:B06A2/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in
    microcode.dat) at revision 0x411c;
  - Update of cpuid:50653/0x97 (SKX-SP B1) microcode (in microcode.dat) from
    revision 0x1000181 up to 0x1000191;
  - Update of cpuid:50656/0xbf (CLX-SP B0) microcode (in microcode.dat) from
    revision 0x4003604 up to 0x4003605;
  - Update of cpuid:50657/0xbf (CLX-SP/W/X B1/L1) microcode (in microcode.dat)
    from revision 0x5003604 up to 0x5003707;
  - Update of cpuid:5065B/0xbf (CPX-SP A1) microcode (in microcode.dat) from
    revision 0x7002703 up to 0x7002904;
  - Update of cpuid:50665/0x10 (BDX-NS A0/A1, HWL A1) microcode (in
    microcode.dat) from revision 0xe000014 up to 0xe000015;
  - Update of cpuid:506F1/0x01 (DNV B0) microcode (in microcode.dat) from
    revision 0x38 up to 0x3e;
  - Update of cpuid:606A6/0x87 (ICX-SP D0) microcode (in microcode.dat) from
    revision 0xd0003b9 up to 0xd0003e7;
  - Update of cpuid:606C1/0x10 (ICL-D B0) microcode (in microcode.dat) from
    revision 0x1000268 up to 0x10002b0;
  - Update of cpuid:706A1/0x01 (GLK B0) microcode (in microcode.dat) from
    revision 0x3e up to 0x42;
  - Update of cpuid:706A8/0x01 (GLK-R R0) microcode (in microcode.dat) from
    revision 0x22 up to 0x24;
  - Update of cpuid:706E5/0x80 (ICL-U/Y D1) microcode (in microcode.dat) from
    revision 0xc2 up to 0xc6;
  - Update of cpuid:806C1/0x80 (TGL-UP3/UP4 B1) microcode (in microcode.dat)
    from revision 0xb4 up to 0xb8;
  - Update of cpuid:806C2/0xc2 (TGL-R C0) microcode (in microcode.dat) from
    revision 0x34 up to 0x38;
  - Update of cpuid:806D1/0xc2 (TGL-H R0) microcode (in microcode.dat) from
    revision 0x4e up to 0x52;
  - Update of cpuid:806E9/0x10 (AML-Y 2+2 H0) microcode (in microcode.dat) from
    revision 0xf4 up to 0xf6;
  - Update of cpuid:806E9/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode (in
    microcode.dat) from revision 0xf4 up to 0xf6;
  - Update of cpuid:806EA/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode (in
    microcode.dat) from revision 0xf4 up to 0xf6;
  - Update of cpuid:806EB/0xd0 (WHL-U W0) microcode (in microcode.dat) from
    revision 0xf4 up to 0xf6;
  - Update of cpuid:806EC/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0) microcode
    (in microcode.dat) from revision 0xf8 up to 0xfc;
  - Update of cpuid:806F4/0x10 microcode (in microcode.dat) from revision
    0x2c000290 up to 0x2c000390;
  - Update of cpuid:806F4/0x87 (SPR-SP E0/S1) microcode (in microcode.dat) from
    revision 0x2b0004d0 up to 0x2b0005c0;
  - Update of cpuid:806F5/0x10 (SPR-HBM B1) microcode (in microcode.dat) from
    revision 0x2c000290 up to 0x2c000390;
  - Update of cpuid:806F5/0x87 (SPR-SP E2) microcode (in microcode.dat) from
    revision 0x2b0004d0 up to 0x2b0005c0;
  - Update of cpuid:806F6/0x10 microcode (in microcode.dat) from revision
    0x2c000290 up to 0x2c000390;
  - Update of cpuid:806F6/0x87 (SPR-SP E3) microcode (in microcode.dat) from
    revision 0x2b0004d0 up to 0x2b0005c0;
  - Update of cpuid:806F7/0x87 (SPR-SP E4/S2) microcode (in microcode.dat) from
    revision 0x2b0004d0 up to 0x2b0005c0;
  - Update of cpuid:90661/0x01 (EHL B1) microcode (in microcode.dat) from
    revision 0x17 up to 0x1a;
  - Update of cpuid:90675/0x07 (ADL-S 6+0 K0) microcode (in microcode.dat) from
    revision 0x32 up to 0x35;
  - Update of cpuid:906A4/0x40 (AZB A0) microcode (in microcode.dat) from
    revision 0x5 up to 0x7;
  - Update of cpuid:906A4/0x80 (ADL-P 2+8 R0) microcode (in microcode.dat) from
    revision 0x430 up to 0x433;
  - Update of cpuid:906C0/0x01 (JSL A0/A1) microcode (in microcode.dat) from
    revision 0x24000024 up to 0x24000026;
  - Update of cpuid:906E9/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode (in
    microcode.dat) from revision 0xf4 up to 0xf8;
  - Update of cpuid:906EA/0x22 (CFL-H/S/Xeon E U0) microcode (in microcode.dat)
    from revision 0xf4 up to 0xf8;
  - Update of cpuid:906EB/0x02 (CFL-E/H/S B0) microcode (in microcode.dat) from
    revision 0xf4 up to 0xf6;
  - Update of cpuid:906EC/0x22 (CFL-H/S/Xeon E P0) microcode (in microcode.dat)
    from revision 0xf4 up to 0xf8;
  - Update of cpuid:906ED/0x22 (CFL-H/S/Xeon E R0) microcode (in microcode.dat)
    from revision 0xfa up to 0x100;
  - Update of cpuid:A0652/0x20 (CML-H R1) microcode (in microcode.dat) from
    revision 0xf8 up to 0xfc;
  - Update of cpuid:A0653/0x22 (CML-S 6+2 G1) microcode (in microcode.dat) from
    revision 0xf8 up to 0xfc;
  - Update of cpuid:A0655/0x22 (CML-S 10+2 Q0) microcode (in microcode.dat)
    from revision 0xf8 up to 0xfc;
  - Update of cpuid:A0660/0x80 (CML-U 6+2 A0) microcode (in microcode.dat) from
    revision 0xf8 up to 0xfe;
  - Update of cpuid:A0661/0x80 (CML-U 6+2 v2 K1) microcode (in microcode.dat)
    from revision 0xf8 up to 0xfc;
  - Update of cpuid:A0671/0x02 (RKL-S B0) microcode (in microcode.dat) from
    revision 0x5d up to 0x62;
  - Update of cpuid:B0671/0x32 (RPL-S B0) microcode (in microcode.dat) from
    revision 0x11d up to 0x123;
  - Update of cpuid:B06A3/0xe0 (RPL-U 2+8 Q0) microcode (in microcode.dat) from
    revision 0x411c up to 0x4121;
  - Update of cpuid:B06E0/0x11 (ADL-N A0) microcode (in microcode.dat) from
    revision 0x12 up to 0x17;
  - Update of cpuid:B06F2/0x07 (ADL C0) microcode (in microcode.dat) from
    revision 0x32 up to 0x35;
  - Update of cpuid:B06F5/0x07 (ADL C0) microcode (in microcode.dat) from
    revision 0x32 up to 0x35;


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 2:2.1-73.22.tuxcare.els1
changelog:
- Update Intel CPU microcode to 20250211:
  - Addition of cpuid:806F8/0x10 (SPR-HBM B3) microcode (in microcode.dat) at
    revision 0x2c0003e0;
  - Addition of cpuid:806F8/0x87 (SPR-SP E5/S3) microcode (in microcode.dat) at
    revision 0x2b000620;
  - Addition of cpuid:90672/0x07 (ADL-HX/S 8+8 C0) microcode (in microcode.dat)
    at revision 0x38;
  - Addition of cpuid:906A3/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
    microcode.dat) at revision 0x436;
  - Addition of cpuid:A06F3/0x01 (SRF-SP C0) microcode (in microcode.dat) at
    revision 0x3000330;
  - Addition of cpuid:B0671/0x32 (RPL-S B0) microcode (in microcode.dat) at
    revision 0x12c;
  - Addition of cpuid:B0674/0x32 microcode (in microcode.dat) at revision
    0x12c;
  - Addition of cpuid:B06A2/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in
    microcode.dat) at revision 0x4124;
  - Addition of cpuid:B06E0/0x19 (ADL-N A0) microcode (in microcode.dat) at
    revision 0x1c;
  - Addition of cpuid:B06F6/0x07 microcode (in microcode.dat) at revision 0x38;
  - Addition of cpuid:B06F7/0x07 microcode (in microcode.dat) at revision 0x38;
  - Addition of cpuid:C06F2/0x87 (EMR-SP A1) microcode (in microcode.dat) at
    revision 0x21000291;
  - Removal of cpuid:806F4/0x10 microcode (in microcode.dat) at revision
    0x2c000290;
  - Removal of cpuid:806F4/0x10 microcode (in microcode.dat) at revision
    0x2c000390;
  - Removal of cpuid:806F4/0x87 (SPR-SP E0/S1) microcode (in microcode.dat) at
    revision 0x2b0004d0;
  - Removal of cpuid:806F4/0x87 (SPR-SP E0/S1) microcode (in microcode.dat) at
    revision 0x2b0005c0;
  - Removal of cpuid:806F5/0x10 (SPR-HBM B1) microcode (in microcode.dat) at
    revision 0x2c000290;
  - Removal of cpuid:806F5/0x10 (SPR-HBM B1) microcode (in microcode.dat) at
    revision 0x2c000390;
  - Removal of cpuid:806F5/0x87 (SPR-SP E2) microcode (in microcode.dat) at
    revision 0x2b0004d0;
  - Removal of cpuid:806F5/0x87 (SPR-SP E2) microcode (in microcode.dat) at
    revision 0x2b0005c0;
  - Removal of cpuid:806F6/0x10 microcode (in microcode.dat) at revision
    0x2c000290;
  - Removal of cpuid:806F6/0x10 microcode (in microcode.dat) at revision
    0x2c000390;
  - Removal of cpuid:806F6/0x87 (SPR-SP E3) microcode (in microcode.dat) at
    revision 0x2b0004d0;
  - Removal of cpuid:806F6/0x87 (SPR-SP E3) microcode (in microcode.dat) at
    revision 0x2b0005c0;
  - Removal of cpuid:806F7/0x87 (SPR-SP E4/S2) microcode (in microcode.dat) at
    revision 0x2b0004d0;
  - Removal of cpuid:806F7/0x87 (SPR-SP E4/S2) microcode (in microcode.dat) at
    revision 0x2b0005c0;
  - Removal of cpuid:806F8/0x10 (SPR-HBM B3) microcode (in microcode.dat) at
    revision 0x2c000290;
  - Removal of cpuid:806F8/0x10 (SPR-HBM B3) microcode (in microcode.dat) at
    revision 0x2c000390;
  - Removal of cpuid:806F8/0x87 (SPR-SP E5/S3) microcode (in microcode.dat) at
    revision 0x2b0004d0;
  - Removal of cpuid:806F8/0x87 (SPR-SP E5/S3) microcode (in microcode.dat) at
    revision 0x2b0005c0;
  - Removal of cpuid:90672/0x07 (ADL-HX/S 8+8 C0) microcode (in microcode.dat)
    at revision 0x35;
  - Removal of cpuid:906A3/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
    microcode.dat) at revision 0x433;
  - Removal of cpuid:B0671/0x32 (RPL-S B0) microcode (in microcode.dat) at
    revision 0x123;
  - Removal of cpuid:B06A2/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in
    microcode.dat) at revision 0x4121;
  - Removal of cpuid:B06A3/0xe0 (RPL-U 2+8 Q0) microcode (in microcode.dat) at
    revision 0x4121;
  - Removal of cpuid:B06A8/0xe0 microcode (in microcode.dat) at revision
    0x4121;
  - Removal of cpuid:B06E0/0x11 (ADL-N A0) microcode (in microcode.dat) at
    revision 0x17;
  - Removal of cpuid:C06F2/0x87 (EMR-SP A1) microcode (in microcode.dat) at
    revision 0x21000230;
  - Update of cpuid:606A6/0x87 (ICX-SP D0) microcode (in microcode.dat) from
    revision 0xd0003e7 up to 0xd0003f5;
  - Update of cpuid:606C1/0x10 (ICL-D B0) microcode (in microcode.dat) from
    revision 0x10002b0 up to 0x10002c0;
  - Update of cpuid:806F4/0x10 microcode (in microcode.dat) from revision
    0x2c000390 up to 0x2c0003e0;
  - Update of cpuid:806F4/0x87 (SPR-SP E0/S1) microcode (in microcode.dat) from
    revision 0x2b0005c0 up to 0x2b000620;
  - Update of cpuid:806F5/0x10 (SPR-HBM B1) microcode (in microcode.dat) from
    revision 0x2c000390 up to 0x2c0003e0;
  - Update of cpuid:806F5/0x87 (SPR-SP E2) microcode (in microcode.dat) from
    revision 0x2b0005c0 up to 0x2b000620;
  - Update of cpuid:806F6/0x10 microcode (in microcode.dat) from revision
    0x2c000390 up to 0x2c0003e0;
  - Update of cpuid:806F6/0x87 (SPR-SP E3) microcode (in microcode.dat) from
    revision 0x2b0005c0 up to 0x2b000620;
  - Update of cpuid:806F7/0x87 (SPR-SP E4/S2) microcode (in microcode.dat) from
    revision 0x2b0005c0 up to 0x2b000620;
  - Update of cpuid:90675/0x07 (ADL-S 6+0 K0) microcode (in microcode.dat) from
    revision 0x35 up to 0x38;
  - Update of cpuid:906A4/0x40 (AZB A0) microcode (in microcode.dat) from
    revision 0x7 up to 0x9;
  - Update of cpuid:906A4/0x80 (ADL-P 2+8 R0) microcode (in microcode.dat) from
    revision 0x433 up to 0x436;
  - Update of cpuid:906EA/0x22 (CFL-H/S/Xeon E U0) microcode (in microcode.dat)
    from revision 0xf8 up to 0xfa;
  - Update of cpuid:906ED/0x22 (CFL-H/S/Xeon E R0) microcode (in microcode.dat)
    from revision 0x100 up to 0x102;
  - Update of cpuid:A0671/0x02 (RKL-S B0) microcode (in microcode.dat) from
    revision 0x62 up to 0x63;
  - Update of cpuid:A06A4/0xe6 (MTL-H/U C0) microcode (in microcode.dat) from
    revision 0x1e up to 0x20;
  - Update of cpuid:B06A3/0xe0 (RPL-U 2+8 Q0) microcode (in microcode.dat) from
    revision 0x4121 up to 0x4124;
  - Update of cpuid:B06A8/0xe0 microcode (in microcode.dat) from revision
    0x4121 up to 0x4124;
  - Update of cpuid:B06F2/0x07 (ADL C0) microcode (in microcode.dat) from
    revision 0x35 up to 0x38;
  - Update of cpuid:B06F5/0x07 (ADL C0) microcode (in microcode.dat) from
    revision 0x35 up to 0x38;
  - Update of cpuid:C06F1/0x87 (EMR-SP A0) microcode (in microcode.dat) from
    revision 0x21000230 up to 0x21000291;
- Remove old firmware versions: 06-8f-04, 06-8f-05, 06-8f-06, 06-ba-08;


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 2:2.1-73.25.tuxcare.els1
changelog:
- Update Intel CPU microcode to 20250812:
  - Addition of cpuid:806F8/0x10 (SPR-HBM B3) microcode (in microcode.dat) at
    revision 0x2c000401;
  - Addition of cpuid:806F8/0x87 (SPR-SP E5/S3) microcode (in microcode.dat) at
    revision 0x2b000643;
  - Addition of cpuid:90672/0x07 (ADL-HX/S 8+8 C0) microcode (in microcode.dat)
    at revision 0x3a;
  - Addition of cpuid:906A3/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
    microcode.dat) at revision 0x437;
  - Addition of cpuid:A06D1/0x20 (GNR-AP/SP H0) microcode (in microcode.dat) at
    revision 0xa000100;
  - Addition of cpuid:A06D1/0x95 (GNR-AP/SP B0) microcode (in microcode.dat) at
    revision 0x10003d0;
  - Addition of cpuid:B0650/0x80 (ARL-U A1) microcode (in microcode.dat) at
    revision 0xa;
  - Addition of cpuid:B0671/0x32 (RPL-S B0) microcode (in microcode.dat) at
    revision 0x12f;
  - Addition of cpuid:B06A2/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in
    microcode.dat) at revision 0x4129;
  - Addition of cpuid:B06D1/0x80 (LNL B0) microcode (in microcode.dat) at
    revision 0x123;
  - Addition of cpuid:C0652/0x82 (ARL-H A1) microcode (in microcode.dat) at
    revision 0x119;
  - Addition of cpuid:C0662/0x82 (ARL-HX 8P/S B0) microcode (in microcode.dat)
    at revision 0x119;
  - Addition of cpuid:C0664/0x82 microcode (in microcode.dat) at revision
    0x119;
  - Addition of cpuid:C06A2/0x82 microcode (in microcode.dat) at revision
    0x119;
  - Addition of cpuid:C06F2/0x87 (EMR-SP A1) microcode (in microcode.dat) at
    revision 0x210002b3;
  - Removal of cpuid:50656/0xbf (CLX-SP B0) microcode (in microcode.dat) at
    revision 0x4003605;
  - Removal of cpuid:806F8/0x10 (SPR-HBM B3) microcode (in microcode.dat) at
    revision 0x2c0003e0;
  - Removal of cpuid:806F8/0x87 (SPR-SP E5/S3) microcode (in microcode.dat) at
    revision 0x2b000620;
  - Removal of cpuid:90672/0x07 (ADL-HX/S 8+8 C0) microcode (in microcode.dat)
    at revision 0x38;
  - Removal of cpuid:906A3/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
    microcode.dat) at revision 0x436;
  - Removal of cpuid:B0671/0x32 (RPL-S B0) microcode (in microcode.dat) at
    revision 0x12c;
  - Removal of cpuid:B06A2/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in
    microcode.dat) at revision 0x4124;
  - Removal of cpuid:C06F1/0x87 (EMR-SP A0) microcode (in microcode.dat) at
    revision 0x21000291;
  - Removal of cpuid:C06F2/0x87 (EMR-SP A1) microcode (in microcode.dat) at
    revision 0x21000291;
  - Update of cpuid:50657/0xbf (CLX-SP/W/X B1/L1) microcode (in microcode.dat)
    from revision 0x5003707 up to 0x5003901;
  - Update of cpuid:5065B/0xbf (CPX-SP A1) microcode (in microcode.dat) from
    revision 0x7002904 up to 0x7002b01;
  - Update of cpuid:606A6/0x87 (ICX-SP D0) microcode (in microcode.dat) from
    revision 0xd0003f5 up to 0xd000410;
  - Update of cpuid:606C1/0x10 (ICL-D B0) microcode (in microcode.dat) from
    revision 0x10002c0 up to 0x10002e0;
  - Update of cpuid:706A8/0x01 (GLK-R R0) microcode (in microcode.dat) from
    revision 0x24 up to 0x26;
  - Update of cpuid:706E5/0x80 (ICL-U/Y D1) microcode (in microcode.dat) from
    revision 0xc6 up to 0xca;
  - Update of cpuid:806C1/0x80 (TGL-UP3/UP4 B1) microcode (in microcode.dat)
    from revision 0xb8 up to 0xbc;
  - Update of cpuid:806C2/0xc2 (TGL-R C0) microcode (in microcode.dat) from
    revision 0x38 up to 0x3c;
  - Update of cpuid:806D1/0xc2 (TGL-H R0) microcode (in microcode.dat) from
    revision 0x52 up to 0x56;
  - Update of cpuid:806EC/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0) microcode
    (in microcode.dat) from revision 0xfc up to 0x100;
  - Update of cpuid:806F4/0x10 microcode (in microcode.dat) from revision
    0x2c0003e0 up to 0x2c000401;
  - Update of cpuid:806F4/0x87 (SPR-SP E0/S1) microcode (in microcode.dat) from
    revision 0x2b000620 up to 0x2b000643;
  - Update of cpuid:806F5/0x10 (SPR-HBM B1) microcode (in microcode.dat) from
    revision 0x2c0003e0 up to 0x2c000401;
  - Update of cpuid:806F5/0x87 (SPR-SP E2) microcode (in microcode.dat) from
    revision 0x2b000620 up to 0x2b000643;
  - Update of cpuid:806F6/0x10 microcode (in microcode.dat) from revision
    0x2c0003e0 up to 0x2c000401;
  - Update of cpuid:806F6/0x87 (SPR-SP E3) microcode (in microcode.dat) from
    revision 0x2b000620 up to 0x2b000643;
  - Update of cpuid:806F7/0x87 (SPR-SP E4/S2) microcode (in microcode.dat) from
    revision 0x2b000620 up to 0x2b000643;
  - Update of cpuid:90675/0x07 (ADL-S 6+0 K0) microcode (in microcode.dat) from
    revision 0x38 up to 0x3a;
  - Update of cpuid:906A4/0x40 (AZB A0) microcode (in microcode.dat) from
    revision 0x9 up to 0xa;
  - Update of cpuid:906A4/0x80 (ADL-P 2+8 R0) microcode (in microcode.dat) from
    revision 0x436 up to 0x437;
  - Update of cpuid:906ED/0x22 (CFL-H/S/Xeon E R0) microcode (in microcode.dat)
    from revision 0x102 up to 0x104;
  - Update of cpuid:A0652/0x20 (CML-H R1) microcode (in microcode.dat) from
    revision 0xfc up to 0x100;
  - Update of cpuid:A0653/0x22 (CML-S 6+2 G1) microcode (in microcode.dat) from
    revision 0xfc up to 0x100;
  - Update of cpuid:A0655/0x22 (CML-S 10+2 Q0) microcode (in microcode.dat)
    from revision 0xfc up to 0x100;
  - Update of cpuid:A0660/0x80 (CML-U 6+2 A0) microcode (in microcode.dat) from
    revision 0xfe up to 0x102;
  - Update of cpuid:A0661/0x80 (CML-U 6+2 v2 K1) microcode (in microcode.dat)
    from revision 0xfc up to 0x100;
  - Update of cpuid:A0671/0x02 (RKL-S B0) microcode (in microcode.dat) from
    revision 0x63 up to 0x64;
  - Update of cpuid:A06A4/0xe6 (MTL-H/U C0) microcode (in microcode.dat) from
    revision 0x20 up to 0x25;
  - Update of cpuid:A06F3/0x01 (SRF-SP C0) microcode (in microcode.dat) from
    revision 0x3000330 up to 0x3000362;
  - Update of cpuid:B0674/0x32 microcode (in microcode.dat) from revision 0x12c
    up to 0x12f;
  - Update of cpuid:B06A3/0xe0 (RPL-U 2+8 Q0) microcode (in microcode.dat) from
    revision 0x4124 up to 0x4129;
  - Update of cpuid:B06A8/0xe0 microcode (in microcode.dat) from revision
    0x4124 up to 0x4129;
  - Update of cpuid:B06E0/0x19 (ADL-N A0) microcode (in microcode.dat) from
    revision 0x1c up to 0x1d;
  - Update of cpuid:B06F2/0x07 (ADL C0) microcode (in microcode.dat) from
    revision 0x38 up to 0x3a;
  - Update of cpuid:B06F5/0x07 (ADL C0) microcode (in microcode.dat) from
    revision 0x38 up to 0x3a;
  - Update of cpuid:B06F6/0x07 microcode (in microcode.dat) from revision 0x38
    up to 0x3a;
  - Update of cpuid:B06F7/0x07 microcode (in microcode.dat) from revision 0x38
    up to 0x3a;
  - Update of cpuid:C06F1/0x87 (EMR-SP A0) microcode (in microcode.dat) from
    revision 0x21000291 up to 0x210002b3;


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 2:2.1-73.26.tuxcare.els1
changelog:
- Update Intel CPU microcode to 20251111:
  - Addition of cpuid:806F8/0x10 (SPR-HBM B3) microcode (in microcode.dat) at
    revision 0x2c000410;
  - Addition of cpuid:806F8/0x87 (SPR-SP E5/S3) microcode (in microcode.dat) at
    revision 0x2b000650;
  - Addition of cpuid:90672/0x07 (ADL-HX/S 8+8 C0) microcode (in microcode.dat)
    at revision 0x3d;
  - Addition of cpuid:906A3/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
    microcode.dat) at revision 0x43a;
  - Addition of cpuid:A06E1/0x97 microcode (in microcode.dat) at revision
    0x1000273;
  - Addition of cpuid:B0671/0x32 (RPL-S B0) microcode (in microcode.dat) at
    revision 0x132;
  - Addition of cpuid:B06A2/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in
    microcode.dat) at revision 0x6133;
  - Addition of cpuid:C0662/0x82 (ARL-HX 8P/S B0) microcode (in microcode.dat)
    at revision 0x11a;
  - Addition of cpuid:C06F2/0x87 (EMR-SP A1) microcode (in microcode.dat) at
    revision 0x210002c0;
  - Removal of cpuid:50656/0xbf (CLX-SP B0) microcode (in microcode.dat) at
    revision 0x4003605;
  - Removal of cpuid:806F8/0x10 (SPR-HBM B3) microcode (in microcode.dat) at
    revision 0x2c000401;
  - Removal of cpuid:806F8/0x87 (SPR-SP E5/S3) microcode (in microcode.dat) at
    revision 0x2b000643;
  - Removal of cpuid:90672/0x07 (ADL-HX/S 8+8 C0) microcode (in microcode.dat)
    at revision 0x3a;
  - Removal of cpuid:906A3/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
    microcode.dat) at revision 0x437;
  - Removal of cpuid:B0671/0x32 (RPL-S B0) microcode (in microcode.dat) at
    revision 0x12f;
  - Removal of cpuid:B06A2/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in
    microcode.dat) at revision 0x4129;
  - Removal of cpuid:C0662/0x82 (ARL-HX 8P/S B0) microcode (in microcode.dat)
    at revision 0x119;
  - Removal of cpuid:C06F1/0x87 (EMR-SP A0) microcode (in microcode.dat) at
    revision 0x21000291;
  - Removal of cpuid:C06F2/0x87 (EMR-SP A1) microcode (in microcode.dat) at
    revision 0x21000291;
  - Removal of cpuid:C06F2/0x87 (EMR-SP A1) microcode (in microcode.dat) at
    revision 0x210002b3;
  - Update of cpuid:806F4/0x10 microcode (in microcode.dat) from revision
    0x2c000401 up to 0x2c000410;
  - Update of cpuid:806F4/0x87 (SPR-SP E0/S1) microcode (in microcode.dat) from
    revision 0x2b000643 up to 0x2b000650;
  - Update of cpuid:806F5/0x10 (SPR-HBM B1) microcode (in microcode.dat) from
    revision 0x2c000401 up to 0x2c000410;
  - Update of cpuid:806F5/0x87 (SPR-SP E2) microcode (in microcode.dat) from
    revision 0x2b000643 up to 0x2b000650;
  - Update of cpuid:806F6/0x10 microcode (in microcode.dat) from revision
    0x2c000401 up to 0x2c000410;
  - Update of cpuid:806F6/0x87 (SPR-SP E3) microcode (in microcode.dat) from
    revision 0x2b000643 up to 0x2b000650;
  - Update of cpuid:806F7/0x87 (SPR-SP E4/S2) microcode (in microcode.dat) from
    revision 0x2b000643 up to 0x2b000650;
  - Update of cpuid:90675/0x07 (ADL-S 6+0 K0) microcode (in microcode.dat) from
    revision 0x3a up to 0x3d;
  - Update of cpuid:906A4/0x40 (AZB A0) microcode (in microcode.dat) from
    revision 0xa up to 0xb;
  - Update of cpuid:906A4/0x80 (ADL-P 2+8 R0) microcode (in microcode.dat) from
    revision 0x437 up to 0x43a;
  - Update of cpuid:A06D1/0x20 (GNR-AP/SP H0) microcode (in microcode.dat) from
    revision 0xa000100 up to 0xa000124;
  - Update of cpuid:A06D1/0x95 (GNR-AP/SP B0) microcode (in microcode.dat) from
    revision 0x10003d0 up to 0x10003f0;
  - Update of cpuid:A06F3/0x01 (SRF-SP C0) microcode (in microcode.dat) from
    revision 0x3000362 up to 0x3000382;
  - Update of cpuid:B0674/0x32 microcode (in microcode.dat) from revision 0x12f
    up to 0x132;
  - Update of cpuid:B06A3/0xe0 (RPL-U 2+8 Q0) microcode (in microcode.dat) from
    revision 0x4129 up to 0x6133;
  - Update of cpuid:B06A8/0xe0 microcode (in microcode.dat) from revision
    0x4129 up to 0x6133;
  - Update of cpuid:B06D1/0x80 (LNL B0) microcode (in microcode.dat) from
    revision 0x123 up to 0x125;
  - Update of cpuid:B06E0/0x19 (ADL-N A0) microcode (in microcode.dat) from
    revision 0x1d up to 0x1e;
  - Update of cpuid:B06F2/0x07 (ADL C0) microcode (in microcode.dat) from
    revision 0x3a up to 0x3d;
  - Update of cpuid:B06F5/0x07 (ADL C0) microcode (in microcode.dat) from
    revision 0x3a up to 0x3d;
  - Update of cpuid:B06F6/0x07 microcode (in microcode.dat) from revision 0x3a
    up to 0x3d;
  - Update of cpuid:B06F7/0x07 microcode (in microcode.dat) from revision 0x3a
    up to 0x3d;
  - Update of cpuid:C0652/0x82 (ARL-H A1) microcode (in microcode.dat) from
    revision 0x119 up to 0x11a;
  - Update of cpuid:C0664/0x82 microcode (in microcode.dat) from revision 0x119
    up to 0x11a;
  - Update of cpuid:C06A2/0x82 microcode (in microcode.dat) from revision 0x119
    up to 0x11a;
  - Update of cpuid:C06F1/0x87 (EMR-SP A0) microcode (in microcode.dat) from
    revision 0x210002b3 up to 0x210002c0;


author: Trond Eivind Glomsrød <teg@redhat.com> 1.1.3-24
changelog:
- Add example.c and minigzip.c to the doc files, as
  they are listed as examples in the README (#52574)


author: Jakub Jelinek <jakub@redhat.com> 1.1.4-2
changelog:
- remove glibc patch, it is no longer needed (zlib uses gcc -shared
  as it should)
- run tests and only build the package if they succeed


author: Jeff Johnson <jbj@jbj.org> 1.2.0.7-2
changelog:
- fix: gzeof not set when reading compressed file (#106424).
- fix: revert zlib.h include constants for now (#106291).


author: Stepan Kasal <skasal@redhat.com> - 1.2.3-21
changelog:
- consolidate the autoconfiscation patches into one and clean it up
- consequently, clean up the %build and %install sections
- zconf.h includes unistd.h again (#479133)


author: Ivana Hutarova Varekova <varekova@redhat.com> - 1.2.4-1
changelog:
- update to 1.2.4
  use the upstream make/configure files for zlib,
  change additional makefile/configure file to be used only to minizip
  add pkgconfig to zlib


author: Ivana Hutarova Varekova <varekova@redhat.com> - 1.2.5-4
changelog:
- Resolves: #678603
  zlib from minizip allowed NULL pointer parameter of function unzGetCurrentFileInfo


author: Peter Schiffer <pschiffe@redhat.com> - 1.2.7-7
changelog:
- resolves: #844791
  rank Z_BLOCK flush below Z_PARTIAL_FLUSH only when last flush was Z_BLOCK
- done some minor .spec file cleanup


author: Peter Schiffer <pschiffe@redhat.com> - 1.2.7-8
changelog:
- related: #832545
  reverted changes for this bug, static libraries shouldn't be compiled with
  -fPIC flag


author: Lukas Javorsky <ljavorsk@redhat.com> - 1.2.7-21
changelog:
- Fix heap-based buffer over-read or buffer overflow in inflate in inflate.c
- Resolves: CVE-2022-37434


author: Peter Jones <pjones@redhat.com> - 12-2
changelog:
- Fix /boot/efi/... permissions to match the filesystem's requirements
  Related: rhbz#1512749
- Minor .spec cleanups
  Related: rhbz#1512749


author: Peter Jones <pjones@redhat.com> - 15-7
changelog:
- New signing keys
  Related: CVE-2020-10713
  Related: CVE-2020-14308
  Related: CVE-2020-14309
  Related: CVE-2020-14310
  Related: CVE-2020-14311


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 15.8-1.el7.tuxcare.els1
changelog:
- Make this package installable on a system having a either 
  Centos or Cloudlinux signed kernel
- Update to shim-15.8 and fix the following CVEs:
  Resolves: CVE-2023-40546
  Resolves: CVE-2023-40547
  Resolves: СVE-2023-40548
  Resolves: СVE-2023-40549
  Resolves: CVE-2023-40550
  Resolves: CVE-2023-40551


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 15.8-1.el7.tuxcare.els1
changelog:
- Make this package installable on a system having a either
  Centos or Cloudlinux signed kernel
- Update to shim-15.8 and fix the following CVEs:
  Resolves: CVE-2023-40546
  Resolves: CVE-2023-40547
  Resolves: СVE-2023-40548
  Resolves: СVE-2023-40549
  Resolves: CVE-2023-40550
  Resolves: CVE-2023-40551


author: Cristian Gafton <gafton@redhat.com>
changelog:
- new patch to get xterm-color and nxterm terminfo entries
- aliased them to rxvt, as that seems to satisfy everybody


author: Cristian Gafton <gafton@redhat.com>
changelog:
- added terminfo entry for the poor guys using lat1 and/or lat-2 on their
  consoles... Enjoy linux-lat ! Thanks, Erik !


author: Cristian Gafton <gafton@redhat.com>
changelog:
- don't build the C++ demo code
- update patch set to the current as of today (redid all the individual
  patches in a single one)


author: Bernhard Rosenkraenzer <bero@redhat.com>
changelog:
- 5.0
- some spec cleanups to make updating easier
- add links *.so.5 to *.so.4 - they are fully binary compatible.
  (Why did they change the invocation number???)


author: Bernhard Rosenkraenzer <bero@redhat.com>
changelog:
- Fix a typo in spec
- Add the 19991006 patch, fixing some C++ STL compatibility problems.
- get rid of profiling and debugging versions - we need to save space...


author: Cristian Gafton <gafton@redhat.com>
changelog:
- revert to the old major number - because the ABI is not changed (and we
  should be handling the changes via symbol versioning anyway)


author: Bernhard Rosenkränzer <bero@redhat.com>
changelog:
- Add xterm patch from Hans de Goede <hans@highrise.nl>
- Patch 20000108, this fixes a problem with a header file.


author: Bernhard Rosenkraenzer <bero@redhat.com>
changelog:
- 5.2
- Fix typo in man page (Bug #20205)
- update the "screen" terminfo entries to the version supplied with
  screen 3.9.8


author: Bernhard Rosenkraenzer <bero@redhat.com> 5.2-17
changelog:
- Patchlevel 20020209
- Fix zero-substitution of cf_cv_type_of_bool (#59450)
- Fix rebuilding of configure script with autoconf 2.5x


author: Bernhard Rosenkraenzer <bero@redhat.com> 5.2-26
changelog:
- Remove duplicated files (#62752)
- Don't strip libraries (#60398)
- Remove cbt capability from xterm description (#61077)


author: Adrian Havill <havill@redhat.com> 5.3-1
changelog:
- upgrade to 5.3 for sake of utf-8, wide chars (#77585 ...)
- spec file summary/desc grammar (#73583)
- add Requires: for c++ devel subpkg (#74002)
- terminfo.src patches no longer needed
- adjust autoconf patch


author: Adrian Havill <havill@redhat.com> 5.3-3
changelog:
- remunged xterm changes from 5.2 patch for 5.3
- updated screen entry (#82951)
- fixed ka3, kb2 and kf0 entries (#77506)


author: Adrian Havill <havill@redhat.com> 5.3-5
changelog:
- added latest rollup patch with widec/UTF8 centric weekly (20030517)
- added --enable-widec to configure (#86311)
  original work done by Mr. Sam <sam@email-scan.com>
- require sharutils (#86605)
- add gpm, xmc support
- add debug syms back into package
- updated autoconf/configure patch


author: Adrian Havill <havill@redhat.com> 5.3-7
changelog:
- fixed the safe sprintf code that was enabled in the previous release
  by the configure parameter. (#101486)


author: Adrian Havill <havill@redhat.com> 5.3-9
changelog:
- remove not-so safe-sprintf configure option because the code does
  not appear to be stable enough for some apps. (#103790)


author: Adrian Havill <havill@redhat.com> 5.4-3
changelog:
- link "xterm" to "xterm-color" as temp fix for escape problem (#115448)
- remove old zcat for PATCH1


author: Adrian Havill <havill@redhat.com> 5.4-5
changelog:
- remove --with-gpm from configure, as it adds a pkg
  dependency (#122336) and causes too many problems vs its benefits


author: Adrian Havill <havill@redhat.com> 5.4-9
changelog:
- remove terminfo try-to-please-all xterm hackery; it's now ptty
  and profile's job to point to the correct terminal. (#122815)


author: Adrian Havill <havill@redhat.com> 5.4-11
changelog:
- add latest rollup patches and weekly patches
- remove home/end patch, which is now included in latest
  terminfo.src and termcap.src
- add term.sh to /etc/profile.d, reference in /etc/bashrc
- modify term.sh to support rxvt (#122815 comment 93)


author: Petr Rockai <prockai@redhat.com> - 5.4-17
changelog:
- apply patch from Hans de Goede, fixing BR142659 [The
  terminfo data for kbs changed from \177 to ^H]


author: 5.4-19 <praszyk@redhat.com> 5.4-19
changelog:
- Clear window after: filter()+initscr()+endwin()+refresh()
  See bug #2966, patch ncurses-5.4-filter.patch


author: Petr Raszyk <praszyk@redhat.com> 5.4-21
changelog:
- Clear window after: filter()+'terminal-resizing'+endwin()
  doupdate()+endwin()
  See bug #174498, patch ncurses-5.4-endwinfilter.patch


author: Petr Raszyk <praszyk@redhat.com> 5.5-11
changelog:
- According Henrik Nordstrom (hno@squid-cache.org)
  Diff between the two versions of curses.h on x86_64
  Patch ncurses-5.5-chtypeaslong2.patch
  See #178824


author: Miroslav Lichvar <mlichvar@redhat.com> 5.5-20
changelog:
- update to patch 20060701
- don't strip libraries, chmod +x them
- move .so links to devel package
- add gpm-devel to buildrequires
- spec cleanup


author: Miroslav Lichvar <mlichvar@redhat.com> 5.5-24.20060715
changelog:
- modify tgetstr to make screen happy (#202480)
- use CFLAGS when linking (#199369)
- change BuildRoot tag to comply with Fedora packaging guidelines


author: Miroslav Lichvar <mlichvar@redhat.com> 5.5-25.20060715
changelog:
- move libncurses and some terminfo entries out of /usr
- drop console symlink and sparc terminfo entries


author: Miroslav Lichvar <mlichvar@redhat.com> 5.5-27.20061209
changelog:
- update to patch 20061209
- strip large tables from shared libraries, reduce number of relocations
- package utils linked with libncurses instead of libncursesw
- package only wide-character headers


author: Miroslav Lichvar <mlichvar@redhat.com> 5.6-2.20070120
changelog:
- update to patch 20070120
- don't depend on bash, drop resetall script
- include rxvt-unicode description


author: Miroslav Lichvar <mlichvar@redhat.com> 5.6-4.20070210
changelog:
- update to patch 20070210
- generate separate terminfo library
- move static libraries to -static subpackage
- avoid unnecessary linking with libdl


author: Miroslav Lichvar <mlichvar@redhat.com> 5.6-6.20070303
changelog:
- update to patch 20070303
- use one libtinfo for both libncurses and libncursesw
- shorten -devel description


author: Miroslav Lichvar <mlichvar@redhat.com> 5.6-10.20070812
changelog:
- fix comp_hash string output
- avoid comparing padding in cchar_t structure
- remove gawk from buildrequires


author: Miroslav Lichvar <mlichvar@redhat.com> 5.6-13.20080112
changelog:
- update to patch 20080112
- make -libs, -base, -term subpackages
- obsolete termcap and libtermcap
- update urxvt entry


author: Miroslav Lichvar <mlichvar@redhat.com> 5.6-16.20080301
changelog:
- update to patch 20080301
- provide libtermcap.so (#428898)
- move all headers to /usr/include
- move libncursesw out of /usr
- make examples in documentation compilable (#436355)


author: Miroslav Lichvar <mlichvar@redhat.com> 5.6-18.20080628
changelog:
- update to patch 20080628
- move mlterm and screen.* entries to -base
- change kbs to ^? in rxvt and screen entries


author: Miroslav Lichvar <mlichvar@redhat.com> 5.7-5.20100116
changelog:
- fix narrow/wide libtinfo compatibility
- fix wattrset macro to not produce warning with current gcc (#556645)


author: Miroslav Lichvar <mlichvar@redhat.com> 5.9-8.20130126
changelog:
- update to 20130126
- clear scrollback buffer in clear (#815790)
- make -base and -term subpackages noarch
- make some dependencies arch-specific


author: Dmitrii Samoilov <dsamoilov@cloudlinux.com> - 5.9-14.20130511.tuxcare.els1
changelog:
- CVE-2023-29491.patch: Mitigate vulnerability by building the packages with
  modified --disable-root-environ option which now limits usage of environment
  for setuid/setgid programs only
- CVE-2021-39537.patch: Add a check for end-of-string in cvtchar to handle a
  malformed string in infotocap


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.9-14.20130511.tuxcare.els2
changelog:
- CVE-2023-50495: check return value of _nc_save_str() (from upstream patch 20230424),
  add validity checks in _nc_parse_entry() (from upstream patch 20170826)


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 5.9-14.20130511.tuxcare.els3
changelog:
- CVE-2025-69720: add a limit-check in infocmp -i option's
  analyze_string function to prevent stack-based buffer overflow
  (from upstream ncurses 6.5 patchlevel 20251213)


author: Josef Ridky <jridky@redhat.com> - 1:5.7.2-49
changelog:
- add missing part of memory leak patch (#1794168)
- fix if_inet6 messages floood (#1765449)
- revert bz#1486733 (#1771050)
- fix issue for process status when process name contains whitespace (#1782180)


author: EL Errata <el-errata_ww@oracle.com> - 1:5.7.2-49.0.1.4
changelog:
- skip setting asp->index if already set in function netsnmp_wrap_up_request
  (nishant.nayan@oracle.com) [Orabug: 33054569]


author: Ian Weller <ianweller@gmail.com> 1.15-2
changelog:
- Removed redundant requires
- Removed redundant documentation between packages
- Fixed license tag
- Fixed -devel description
- Added the static library back to -devel
- Added make clean


author: Nikos Mavrogiannopoulos <nmav@redhat.com> - 2.7.1-5
changelog:
- Fixed SHA-3 implementation to conform to final standard (#1252936)
- Fixed CVE-2015-8803 CVE-2015-8804 CVE-2015-8805 which caused issues
  in secp256r1 and secp384r1 calculations (#1314374)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> - 2.7.1-8
changelog:
- Use a cache-silent version of mpz_powm to prevent cache-timing
  attacks against RSA and DSA in shared VMs. (#1364897,CVE-2016-6489)


author: Dmitriy Popov <dpopov@cloudlinux.com> - 2.7.1-9.tuxcare.els1
changelog:
- Port side-channel silent functions from 3.4.1. Partially fix
  for CVE-2018-16869
- CVE-2018-16869: Add side-channel silent memory, math, PKCS1,
  RSA functions
- Added tests for side-channel silent implementations


author: Christopher Aillon <caillon@redhat.com> 3.11-0.cvs
changelog:
- Initial import into Fedora Core, based on a CVS snapshot of
  the NSS_3_11_RTM tag
- Fix up the pkcs11-devel subpackage to contain the proper headers
- Build with RPM_OPT_FLAGS
- No need to have rpath of /usr/lib in the pc file


author: Kai Engert <kengert@redhat.com> - 3.11.3-2
changelog:
- Revert the attempt to require latest NSPR, as it is not yet available
  in the build infrastructure.


author: Kai Engert <kengert@redhat.com> - 3.11.5-1
changelog:
- Update to 3.11.5
- This update fixes two security vulnerabilities with SSL 2
- Do not use -rpath link option
- Added several unsupported tools to tools package


author: Kai Engert <kengert@redhat.com> - 3.11.5-2
changelog:
- Fix rhbz#230545, failure to enable FIPS mode
- Fix rhbz#220542, make NSS more tolerant of resets when in the 
  middle of prompting for a user password.


author: Kai Engert <kengert@redhat.com> - 3.11.7-2
changelog:
- Update to 3.11.7, but freebl/softokn remain at 3.11.5.
- Use a workaround to avoid mozilla bug 51429.


author: Kai Engert <kengert@redhat.com> - 3.11.7-10
changelog:
- Add /etc/prelink.conf.d/nss-prelink.conf in order to blacklist
  our signed libraries and protect them from modification.


author: Kai Engert <kengert@redhat.com> - 3.11.99.3-2
changelog:
- Build against gcc 4.3.0, use workaround for bug 432146
- Run the test suite after the build and abort on failures.


author: Kai Engert <kengert@redhat.com> - 3.12.0.3-3
changelog:
- nss package should own /etc/prelink.conf.d folder, rhbz#452062
- use upstream patch to fix test suite abort


author: Kai Engert <kaie@redhat.com> - 3.12.3-3
changelog:
- ship .chk files instead of running shlibsign at install time
- include .chk file in softokn-freebl subpackage
- add patch for upstream nss bug 488350


author: Kai Engert <kaie@redhat.com> - 3.12.3-7
changelog:
- re-enable test suite
- add patch for upstream bug 488646 and add newer paypal
  certs in order to make the test suite pass


author: Elio Maldonado <emaldona@redhat.com> - 3.12.3.99.3-5
changelog:
- updated pem module incorporates various patches
- fix off-by-one error when computing size to reduce memory leak. (483855)
- fix data type to work on x86_64 systems. (429175)
- fix various memory leaks and free internal objects on module unload. (501080)
- fix to not clone internal objects in collect_objects().  (501118)
- fix to not bypass initialization if module arguments are omitted. (501058)
- fix numerous gcc warnings. (500815)
- fix to support arbitrarily long password while loading a private key. (500180) 
- fix memory leak in make_key and memory leaks and return values in pem_mdSession_Login (501191)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.3.99.3-10
changelog:
- must install libnssutil3.since nss-util is untagged at the moment
- preserve time stamps when installing various files


author: Elio Maldonado+emaldona@redhat.com - 3.12.3.99.3-11
changelog:
- split off nss-softokn and nss-util as subpackages with their own rpms
- first phase of splitting nss-softokn and nss-util as their own packages


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-19
changelog:
- remove patches that are now in nss-softokn and
- remove spurious exec-permissions for nss.pc per rpmlint
- single requires line in nss.pc.in


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-22
changelog:
- Fix nss-config not to include nssutil
- Add BuildRequires on nss-softokn and nss-util since build also runs the test suite


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-25
changelog:
- Remove nss-prelink.conf as signed all shared libraries moved to nss-softokn
- Add a temprary hack to nss.pc.in to unblock builds


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-29
changelog:
- Restoring patches 2 and 7 as we still compile all sources
- Applying the nss-nolocalsql.patch solves nss-tools sqlite dependency problems


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-30
changelog:
- Fix FORTIFY_SOURCE buffer overflows in test suite on ppc and ppc64 - bug 519766
- Fixed requires and buildrequires as per recommendations in spec file review


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-2
changelog:
- Remove symbolic links to shared libraries from devel - 521155
- No rpath-link in nss-softokn-config


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-3
changelog:
- PEM module implements memory management for internal objects - 509705
- PEM module doesn't crash when processing malformed key files - 512019


author: Elio Maldonado<emaldona@redhat.com - 3.12.4-9
changelog:
- Install blank databases and configuration file for system shared database
- nsssysinit queries system for fips mode before relying on environment variable


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-13
changelog:
- User no longer prompted for a password when listing keys an empty system db (#527048)
- Fix setup-nsssysinit to handle more general formats (#527051)


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-13.1
changelog:
- Require nss-softoken of same architecture as nss (#527867)
- Merge setup-nsssysinit.sh improvements from F-12 (#527051)


author: Elio Maldonado<emaldona@redhat.com> - 3.12.5-1
changelog:
- Update to 3.12.5
- Patch to allow ssl/tls clients to interoperate with servers that require renogiation


author: Elio Maldonado<emaldona@redhat.com> - 3.12.5-1.5
changelog:
- Fix nsssysinit to set the default flags on the crypto module (#545779)
- Remove redundant header from the pem module


author: Elio Maldonado<emaldona@redhat.com> - 3.12.5-1.6
changelog:
- Fix nsssysinit to enable apps to use system cert store, patch contributed by David Woodhouse (#546221)
- Fix spec so sysinit requires coreutils for post install scriplet (#547067)
- Fix segmentation fault when listing keys or certs in the database, patch contributed by Kamil Dudka (#540387)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.6-1.1
changelog:
- Using SSL_RENEGOTIATE_TRANSITIONAL as default while on transition period
- Disabling ssl tests suites until bug 539183 is resolved


author: Elio Maldonado <emaldona@redhat.com> - 3.12.6-3
changelog:
- Add sed to sysinit requires as setup-nsssysinit.sh requires it (#576071)
- Update PayPalEE test cert with unexpired one (#580207)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.6-5
changelog:
- Update pem source tar to pick up the following bug fixes:
- PEM - Allow collect objects to search through all objects
- PEM - Make CopyObject return a new shallow copy
- PEM - Fix memory leak in pem_mdCryptoOperationRSAPriv


author: Elio Maldonado <emaldona@redhat.com> - 3.12.7-2
changelog:
- Define NSS_USE_SYSTEM_SQLITE and remove unneeded patch
- Add comments regarding an unversioned provides which triggers rpmlint warning
- Build requires nss-softokn-devel >= 3.12.7


author: Elio Maldonado <emaldona@redhat.com> - 3.12.8-1
changelog:
- Update to 3.12.8
- Prevent disabling of nss-sysinit on package upgrade (#636787)
- Create pkcs11.txt with correct permissions regardless of umask (#636792) 
- Setup-nsssysinit.sh reports whether nss-sysinit is turned on or off (#636801)
- Added provides pkcs11-devel-static to comply with packaging guidelines (#609612)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.8-3
changelog:
- Replace posttrans sysinit scriptlet with a triggerpostun one (#636787)
- Fix and cleanup the setup-nsssysinit.sh script (#636792, #636801)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.8.99.2-1
changelog:
- Update to NSS_3_12_9_BETA2
- Fix libpnsspem crash when cacert dir contains other directories (#642433)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-5
changelog:
- Fix the earlier infinite recursion patch (#499444)
- Remove a header that now nss-softokn-freebl-devel ships


author: Christopher Aillon <caillon@redhat.com> - 3.12.9-6
changelog:
- Revert patches for 499444 as they use a C++ reserved word and
  cause compilation of Firefox to fail


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-10
changelog:
- Fix cms headers to not use c++ reserved words (#676036)
- Reenabling Bug 499444 patches
- Fix to swap internal key slot on fips mode switches


author: Elio Maldonado <emaldona@redhat.com> - 3.12.10-4
changelog:
- Enable pluggable ecc support (#712556)
- Disable the nssdb write-access-on-read-only-dir tests when user is root (#646045)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.11-3
changelog:
- Fix attempt to free initilized pointer (#717338)
- Fix leak on pem_CreateObject when given non-existing file name (#734760)
- Fix pem_Initialize to return CKR_CANT_LOCK on multi-treaded calls (#736410)


author: Elio Maldonado Batiz <emaldona@redhat.com> - 3.13.1-4
changelog:
- Rebuild with nss-softokn from 3.12 in the buildroot
- Allows the pem module to statically link against 3.12.x freebl
- Required for using nss-3.13.x with nss-softokn-3.12.y for a merge inrto rhel git repo
- Build will be temprarily placed on buildroot override but not pushed in bodhi


author: Elio Maldonado <emaldona@redhat.com> - 3.13.1-5
changelog:
- Statically link the pem module against system freebl found in buildroot
- Disabling sha224-related powerup selftest until we update softokn
- Disable sha224 and pss tests which nss-softokn 3.12.x doesn't support


author: Elio Maldonado <emaldona@redhat.com> - 3.13.1-6
changelog:
- Removed unwanted /usr/include/nss3 in front of the normal cflags include path
- Removed unnecessary patch dealing with CERTDB_TERMINAL_RECORD, it's visible


author: Elio Maldonado <emaldona@redhat.com> - 3.13.1-7
changelog:
- Resolves: Bug 750376 - nss 3.13 breaks sssd TLS
- Fix how pem is built so that nss-3.13.x works with nss-softokn-3.12.y
- Only patch blapitest for the lack of sha224 on system freebl
- Completed the patch to make pem link against system freebl


author: elio maldonado <emaldona@redhat.com> - 3.13.1-9
changelog:
- Revert to using current nss_softokn_version
- Patch to deal with lack of sha224 is no longer needed


author: Elio Maldonado <emaldona@redhat.com> - 3.13.1-10
changelog:
- Resolves: Bug 770682 - nss update breaks pidgin-sipe connectivity
- NSS_SSL_CBC_RANDOM_IV set to 0 by default and changed to 1 on user request


author: Elio Maldonado <emaldona@redhat.com> - 3.13.3-2
changelog:
- Pick up fixes from RHEL
- Resolves: rhbz#800674 - Unable to contact LDAP Server during winsync
- Resolves: rhbz#800682 - Qpid AMQP daemon fails to load after nss update
- Resolves: rhbz#800676 - NSS workaround for freebl bug that causes openswan to drop connections


author: Elio Maldonado <emaldona@redhat.com> - 3.13.4-1
changelog:
- Update to NSS_3_13_4_RTM
- Update the nss-pem source archive to the latest version
- Remove no longer needed patches
- Resolves: Bug 806043 - use pem files interchangeably in a single process
- Resolves: Bug 806051 - PEM various flaws detected by Coverity
- Resolves: Bug 806058 - PEM pem_CreateObject leaks memory given a non-existing file name


author: Elio Maldonado <emaldona@redhat.com> - 3.13.4-2
changelog:
- Resolves: Bug 805723 - Library needs partial RELRO support added
- Patch coreconf/Linux.mk as done on RHEL 6.2


author: Elio Maldonado <emaldona@redhat.com> - 3.13.5-4
changelog:
- Resolves: Bug 830410 - Missing Requires %{?_isa}
- Use Requires: %{name}%{?_isa} = %{version}-%{release} on tools
- Drop zlib requires which rpmlint reports as error E: explicit-lib-dependency zlib
- Enable sha224 portion of powerup selftest when running test suites
- Require nspr 4.9.1


author: Elio Maldonado <emaldona@redhat.com> - 3.13.5-8
changelog:
- Rebase pem sources to fedora-hosted upstream to pick up two fixes from rhel-6.3
- Resolves: rhbz#847460 - Fix invalid read and free on invalid cert load
- Resolves: rhbz#847462 - PEM module may attempt to free uninitialized pointer 
- Remove unneeded fix gcc 4.7 c++ issue in secmodt.h that actually undoes the upstream fix


author: Elio Maldonado <emaldona@redhat.com> - 3.14-0.1.rc.1
changelog:
- Update to NSS_3_14_RC1
- update nss-589636.patch to apply to httpdserv
- turn off ocsp tests for now
- remove no longer needed patches
- remove headers shipped by nss-util


author: Elio Maldonado <emaldona@redhat.com> - 3.14-2
changelog:
- Add secmodt.h to the headers installed by nss-devel
- nss-devel must install secmodt.h which moved from softoken to pk11wrap with nss-3.14


author: Elio Maldonado <emaldona@redhat.com> - 3.14-5
changelog:
- Fix the spec file so sechash.h gets installed
- Resolves: rhbz#871882 - missing header: sechash.h in nss 3.14


author: Elio Maldonado <emaldona@redhat.com> - 3.14-6
changelog:
- Fix a previous unwanted merge from f18
- Update the SS_SSL_CBC_RANDOM_IV patch to match new sources while
- Keeping the patch disabled while we are still in rawhide and
- State in comment that patch is needed for both stable and beta branches
- Update .gitignore to download only the new sources


author: Elio Maldonado <emaldona@redhat.com> - 3.14-7
changelog:
- Add a dummy source file for testing /preventing fedpkg breakage
- Helps test the fedpkg new-sources and upload commands for breakage by nss updates
- Related to Bug 872124 - nss 3.14 breaks fedpkg new-sources


author: Elio Maldonado <emaldona@redhat.com> - 3.14-8
changelog:
- Fix pk11wrap locking which fixes 'fedpkg new-sources' and 'fedpkg update' hangs
- Bug 872124 - nss-3.14 breaks fedpkg new-sources
- Fix should be considered preliminary since the patch may change upon upstream approval


author: Elio Maldonado <emaldona@redhat.com> - 3.14-9
changelog:
- Disable bypass code at build time and return failure on attempts to enable at runtime
- Bug 806588 - Disable SSL PKCS #11 bypass at build time


author: Elio Maldonado <emaldona@redhat.com> - 3.14-11
changelog:
- Bug 879978 - Install the nssck.api header template in a place where mod_revocator can access it
- Install nssck.api in /usr/includes/nss3


author: Elio Maldonado <emaldona@redhat.com> - 3.14-12
changelog:
- Bug 879978 - Install the nssck.api header template where mod_revocator can access it
- Install nssck.api in /usr/includes/nss3/templates


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-1
changelog:
- Update to NSS_3_14_3_RTM
- sync up pem rsawrapr.c with softoken upstream changes for nss-3.14.3
- Resolves: rhbz#908257 - CVE-2013-1620 nss: TLS CBC padding timing attack
- Resolves: rhbz#896651 - PEM module trashes private keys if login fails
- Resolves: rhbz#909775 - specfile support for AArch64
- Resolves: rhbz#910584 - certutil -a does not produce ASCII output


author: Kai Engert <kaie@redhat.com> - 3.14.3-9
changelog:
- Configure libnssckbi.so to use the alternatives system
  in order to prepare for a drop in replacement.


author: Elio Maldonado <emaldona@redhat.com> - 3.15-5
changelog:
- Install man pages for nss-tools and the nss-config and setup-nsssysinit scripts
- Resolves: rhbz#606020 - nss security tools lack man pages


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-2
changelog:
- Update to NSS_3_15_1_RTM
- Apply various fixes to the man pages and add new ones
- Enable the iquote.patch to access newly introduced types
- Add man page for pkcs11.txt configuration file and cert and key databases
- Add missing option descriptions for {cert|cms|crl}util
- Resolves: rhbz#948495 - Man page scan results for nss
- Resolves: rhbz#982723 - Fix path to script in man page for nss-sysinit


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-4
changelog:
- Install symlink to nss-sysinit.sh without the .sh suffix
- Resolves: rhbz#982723 - nss-sysinit man page has wrong path for the script


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-1
changelog:
- Rebase to nss-3.15.2
- Resolves: rhbz#1012656 - pick up NSS 3.15.2 to fix CVE-2013-1739 and disable MD5 in OCSP/CRL


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-2
changelog:
- Add description of the certutil's --email option to it's manpage
- Resolves: rhbz#Bug 948495 - Man page scan results for nss


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-4
changelog:
- Enable fips when system is in fips mode
- Resolves: rhbz#852023 - FIPS mode detection does not work


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-6
changelog:
- Fix errors in ssl disabling patches for both library and tests
- Add s390x to the multilib_arches definition used for alt_ckbi
- Resolves: rhbz#1001841 - Disable SSL2 and the export cipher suites


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-7
changelog:
- Fix bash syntax error in patch for disabling ssl2 tests
- Resolves: rhbz#1001841 - Disable SSL2 and the export cipher suites


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-8
changelog:
- Fix patch for disabling ssl2 in ssl to correctly set error code
- Fix syntax error reported in the build.log even tough it succeeds
- Add patch top ignore setpolicy result 
- Resolves: rhbz#1001841 - Disable SSL2 and the export cipher suites
- Resolves: rhbz#1026677 - Attempt to run ipa-client-install fails


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-9
changelog:
- Fix certutil man page options names to be consistent with help
- Resolves: rhbz#948495 - man page scan results for nss
- Remove incorrect count argument in status description in nss-sysinit man page
- Resolves: rhbz#982723 - man page of nss-sysinit incorrect option descriptions


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-10
changelog:
- Fix path to script and remove -- from some options in nss-sysinit man page
- Resolves: rhbz#982723 - man page of nss-sysinit worong path and other flaws


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-2
changelog:
- Revoke trust in one mis-issued anssi certificate
- Resolves: Bug 1040284 - nss: Mis-issued ANSSI/DCSSI certificate (MFSA 2013-117) [rhel-7.0]


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-4
changelog:
- Improve pluggable ECC support for ECDSA
- Resolves: Bug 752980 - [7.0 FEAT] Support ECDSA algorithm in the nss package


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-6
changelog:
- Fix a coverity scan compile time warning for the pem module
- Resolves: Bug 1002271 - NSS pem module should not require unique base file names


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-7
changelog:
- Move several nss-sysinit manpages tar archives to the %files
- Resolves: Bug 1050163 - Same files in two packages create rpm conflict


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-8
changelog:
- Fix the spec file to apply the nss ecc list patch for bug 752980
- Resolves: Bug 752980 - Support ECDSA algorithm in the nss package via puggable ecc


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-9
changelog:
- Rebase to nss-3.15.4
- Resolves: Bug 1054457 - CVE-2013-1740 nss: false start PR_Recv information disclosure security issue
- Remove no longer needed patches for manpages that were applied upstream
- Remove no longer needed patch to disable ocsp stapling tests
- Update iquote.patch on account of upstream changes
- Update and rename patch to pem/rsawrapr.c on account of upstream changes
- Use the pristine upstream sources for nss without repackaging
- Avoid unneeded manual step which may introduce errors


author: Elio Maldonado <emaldona@redhat.com> - 3.15.4-3
changelog:
- Remove spurious man5 wildcard entry as all manpages are listed by name
- Resolves: Bug 1050163 - Same files in two packages create rpm conflict


author: Elio Maldonado <emaldona@redhat.com> - 3.15.4-4
changelog:
- Update pem sources to latest from nss-pem upstream
- Pick up pem module fixes verified on RHEL and applied upstream
- Remove no loger needed pem patches on acccount on this update
- Add comments documenting the iquote.patch 
- Resolves: Bug 1054457 - CVE-2013-1740


author: Elio Maldonado <emaldona@redhat.com> - 3.15.4-5
changelog:
- Pick up a fix from rhel-6 and fix an rpm conflict
- Don't hold issuer cert handles in crl cache
- Resolves: Bug 1034409 - deadlock in trust domain and object lock
- Move nss shared db files to the main package
- Resolves: Bug 1050163 - Same files in two packages create rpm conflict


author: Elio Maldonado <emaldona@redhat.com> - 3.15.4-6
changelog:
- Disallow disabling the internal module
- Resolves: Bug 1056036 - nss segfaults with opencryptoki module


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2-1
changelog:
- Rebase to nss-3.16.2
- Resolves: Bug 1103252 - Rebase RHEL 7.1 to at least NSS 3.16.1 (FF 31)
- Fix test failure detection in the %check section
- Move removal of unwanted source directories to the end of the %prep section
- Update various patches on account of the rebase
- Remove unused patches rendered obsolete by the rebase


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2-2
changelog:
- Fix libssl and test patches that disable ssl2 support
- Resolves: Bug 1123435
- Replace expired PayPal test certificate with current one


author: Elio Maldonado <pbrobinson@redhat.com> 3.16.2-3
changelog:
- Generic 32/64 bit platform detection (fix ppc64le build)
- Resolves: Bug 1125619 - nss fails to build on arch: ppc64le (missing dependencies)
- Fix contributed by Peter Robinson <pbrobinson@redhat.com>


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2-10
changelog:
- Resolves: Bug 1158161 - Upgrade to NSS 3.16.2.3 for Firefox 31.3
- Support TLS_FALLBACK_SCSV in tstclnt and ssltap


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-2
changelog:
- Restore patch for certutil man page
- supply missing options descriptions
- Resolves: Bug 1158161 - Upgrade to NSS 3.16.2.3 for Firefox 31.3


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-4
changelog:
- Fix race condition
- Resolves: Bug 1094468 - 389-ds-base server reported crash in stan_GetCERTCertificate
- under the replication replay failure condition


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-5
changelog:
- Reverse the sense of a test in patch to fix pk12util segfault
- Resolves: Bug 1174527 - Segfault in pk12util when using -l option with certain .p12 files


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-2
changelog:
- Replace expired PayPal test certificate that breaks the build
- Resolves: Bug 1200898 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL7.1]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-3
changelog:
- Fix shell syntax error on nss/tests/all.sh
- Resolves: Bug 1200898 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL7.1]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-4
changelog:
- Update and reeneable nss-646045.patch on account of the rebase
- Resolves: Bug 1200898 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL7.1]


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-4
changelog:
- Add support for sha384 tls cipher suites
- Add support for server-side hde key exchange
- Add support for DSS+SHA256 ciphersuites


author: Kai Engert <kaie@redhat.com> - 3.19.1-5
changelog:
- Incremental patches to fix SSL/TLS test suite execution,
  fix the earlier SHA384 patch, and inform clients to use SHA384 with
  certificate_verify if required by NSS.


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-9
changelog:
- Fix checks to skip ssl2/export cipher suites tests to not skip needed tests
- Fix libssl ssl2/export disabling patch to handle NULL cipher cases
- Enable additional cipher suites by default


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-12
changelog:
- Support TLS > 1.0 by support while still allowing to connect to SSL3 only servers
- Enable ECDSA cipher suites by default, a subset of the ones requested


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-13
changelog:
- Reorder the cipher suites and enable two more by default
- Fix some of the ssauth sni and ocsp stapling tests


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-14
changelog:
- Update the required_softokn_build_version to -14
- Add references to bugs filed upstream for new patches
- Merge ocsp stapling and sslauth sni tests patches into one


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-16
changelog:
- Fix check for public key size of DSA certificates
- Use size of prime P not the size of dsa.publicValue


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-17
changelog:
- Change the required_softokn_build_version back to -13
- Ensure we use nss-softokn-3.16.2.3-13.el7_1


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-19
changelog:
- Prevent TLS 1.2 Transcript Collision attacks against MD5 in key exchange protocol
- Fix a mockbuild reported bad %if condition when using the __isa_bits macro instead of list of 64-bit architectures
- Change the test to %if 0%{__isa_bits} == 64 as required for building the srpm which is noarch
- Resolves: Bug 1289884


author: Kai Engert <kaie@redhat.com> - 3.21.0-5
changelog:
- Merge fixes from the rhel-7.2 branch
- Fix the SigAlgs sent in certificate_request
- Ensure all ssl.sh tests are executed
- Update sslauth test patch to run additional tests


author: Elio Maldonado <emaldona@redhat.com> - 3.21.0-13
changelog:
- Fix reuse of session cache entry
- Resolves: Bug 1241172 - Certificate verification fails with multiple https urls


author: Kai Engert <kaie@redhat.com> - 3.21.0-14
changelog:
- Support TLS 1.2 certificate_verify hashes other than PRF,
  backported fix from NSS 3.25 (upstream bug 1179338).


author: Kai Engert <kaie@redhat.com> - 3.21.0-16
changelog:
- enable ssl_gtests (without extended master secret tests), Bug 1298692
- call SECMOD_RestartModules in nss_Init, Bug 1317691


author: Daiki Ueno <dueno@redhat.com> - 3.28.2-1.0
changelog:
- Rebase to NSS 3.28.2
- Remove NSS_ENABLE_ECC and NSS_ECC_MORE_THAN_SUITE_B setting, which
  is no-op now
- Enable gtests when requested
- Remove nss-646045.patch and fix-nss-test-filtering.patch, which are
  not necessary
- Remove sslauth-no-v2.patch and
  nss-sslstress-txt-ssl3-lower-value-in-range.patch, as SSLv2 is
  already disabled in upstream
- Remove ssl-server-min-key-sizes.patch, as we decided to support DH
  key size greater than 1023 bits
- Remove local patches for SHA384 cipher suites (now supported in
  upstream): dhe-sha384-dss-support.patch,
  client_auth_for_sha384_prf_support.patch,
  nss-fix-client-auth-init-hashes.patch, nss-map-oid-to-hashalg.patch,
  nss-enable-384-cipher-tests.patch, nss-fix-signature-and-hash.patch,
  fix-allowed-sig-alg.patch, tests-extra.patch
- Remove upstreamed patches: rh1238290.patch,
  fix-reuse-of-session-cache-entry.patch, flexible-certverify.patch,
  call-restartmodules-in-nssinit.patch


author: Daiki Ueno <dueno@redhat.com> - 3.28.2-3
changelog:
- Remove %nss_cycles setting, which was also mistakenly added
- Re-enable BUILD_OPT, mistakenly disabled in the previous build
- Prevent ABI incompatibilty of SECKEYECPublicKey
- Disable TLS_ECDHE_{RSA,ECDSA}_WITH_AES_128_CBC_SHA256 by default
- Enable 4 AES_256_GCM_SHA384 ciphersuites, enabled by the downstream
  patch in the previous release
- Fix crash with tstclnt -W
- Always enable gtests for supported features
- Add patch to fix bash syntax error in tests/ssl.sh
- Build with support for SSLKEYLOGFILE
- Disable the use of RSA-PSS with SSL/TLS


author: Daiki Ueno <dueno@redhat.com> - 3.28.3-3
changelog:
- Make sure 32bit nss-pem always be installed with 32bit nss in
  multlib environment, patch by Kamil Dudka
- Enable new algorithms supported by the new nss-softokn


author: Daiki Ueno <dueno@redhat.com> - 3.28.3-4
changelog:
- Utilize CKA_NSS_MOZILLA_CA_POLICY attribute, patch by Kai Engert
- Backport changes adding SSL alert callbacks from upstream
- Add nss-check-policy-file.patch from Fedora
- Install policy config in /etc/pki/nss-legacy/nss-rhel7.config


author: Daiki Ueno <dueno@redhat.com> - 3.28.3-5
changelog:
- Switch default hash algorithm used by tools from SHA-1 to SHA-256
- Avoid race condition in nssSlot_IsTokenPresent()
- Enable SHA-2 and AES in pk12util
- Disable RSA-PSS for now


author: Daiki Ueno <dueno@redhat.com> - 3.28.4-3
changelog:
- Reorder ChaCha20-Poly1305 cipher suites, as suggested in:
  https://bugzilla.redhat.com/show_bug.cgi?id=1373158#c9


author: Daiki Ueno <dueno@redhat.com> - 3.28.4-11
changelog:
- Backport patch to simplify transcript calculation for CertificateVerify
- Enable TLS 1.3 and RSA-PSS
- Disable some upstream tests failing due to downstream ciphersuites changes


author: Daiki Ueno <dueno@redhat.com> - 3.33.0-1
changelog:
- Rebase to NSS 3.33
- Disable TLS 1.3, temporarily disable failing gtests (Skip13Variants)
- Temporarily disable race.patch and nss-3.16-token-init-race.patch,
  which causes a deadlock in newly added test cases
- Remove upstreamed patches: moz-1320932.patch,
  nss-tstclnt-optspec.patch,
  nss-1334976-1336487-1345083-ca-2.14.patch, nss-alert-handler.patch,
  nss-tools-sha256-default.patch, nss-is-token-present-race.patch,
  nss-pk12util.patch, nss-ssl3gthr.patch, and nss-transcript.patch


author: Daiki Ueno <dueno@redhat.com> - 3.36.0-3
changelog:
- Decrease the iteration count of PKCS#12 for compatibility with Windows
- Fix deadlock when a token is re-inserted while a client process is running


author: Daiki Ueno <dueno@redhat.com> - 3.36.0-7
changelog:
- Backport upstream fix for CVE-2018-12384
- Remove nss-lockcert-api-change.patch, which turned out to be a
  mistake (the symbol was not exported from libnss)


author: Bob Relyea <rrelyea@redhat.com> - 3.43.0-2
changelog:
- Expand IPSEC usage to include ssl and email certs. Remove special
  processing of the usage based on the critical flag


author: Daiki Ueno <dueno@redhat.com> - 3.43.0-7
changelog:
- Don't override date in man-pages
- Revert the change to use XDG basedirs (mozilla#818686)
- Enable SSL2 compatible ClientHello by default
- Disable SSL3 and RC4 by default


author: Daiki Ueno <dueno@redhat.com> - 3.44.0-1
changelog:
- Rebase to NSS 3.44
- Restore fix-min-library-version-in-SSLVersionRange.patch to keep
  SSL3 supported in the code level while it is disabled by policy
- Skip TLS 1.3 tests under FIPS mode


author: Daiki Ueno <dueno@redhat.com> - 3.44.0-2
changelog:
- Skip sysinit gtests properly
- Fix shell syntax error in tests/ssl/ssl.sh
- Regenerate manual pages


author: Daiki Ueno <dueno@redhat.com> - 3.44.0-3
changelog:
- Disable TLS 1.3 under FIPS mode
- Disable RSASSA-PKCS1-v1_5 in TLS 1.3
- Fix post-handshake auth transcript calculation if
  SSL_ENABLE_SESSION_TICKETS is set


author: Bob Relyea <rrelyea@redhat.com> - 3.44.0-5
changelog:
- Fix pkix name constraints processing to only process the common name if the
  certusage you are checking is IPSEC or SSL Server.


author: Bob Relyea <rrelyea@redhat.com> - 3.44.0-7
changelog:
- back out out-of-bounds patch (patch for nss-softokn).
- Fix segfault on empty or malformed ecdh keys (#1777712)


author: Bob Relyea <rrelyea@redhat.com> - 3.44.0-8
changelog:
- Increase timeout on ssl_gtest so that slow platforms can complete when
   running on a busy system.


author: Daiki Ueno <dueno@redhat.com> - 3.53.1-3
changelog:
- Disable dh timing test because it's unreliable on s390 (from Bob Relyea)
- Explicitly enable upgradedb/sharedb test cycles


author: Bob Relyea <rrelyea@redhat.com> - 3.67.0-3
changelog:
- revert sql default language in man pages
- fix SEC_PKCS12EnableCipher so python-nss tests will still work.


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 3.90.0-2.tuxcare.els1
changelog:
- Update to CKBI 2.64 from NSS 3.95
- Removed:
-     # Certificate "E-Tugra Certification Authority"
-     # Certificate "Hongkong Post Root CA 1"
-     # Certificate "Symantec Class 1 Public Primary Certification Authority - G6"
-     # Certificate "Symantec Class 2 Public Primary Certification Authority - G6"
-     # Certificate "TrustCor ECA-1"
-     # Certificate "TrustCor RootCert CA-1"
-     # Certificate "TrustCor RootCert CA-2"
-     # Certificate "Verisign Class 1 Public Primary Certification Authority - G3"
-     # Certificate "Verisign Class 2 Public Primary Certification Authority - G3"
- Added:
-     # Certificate "Atos TrustedRoot Root CA ECC G2 2020"
-     # Certificate "Atos TrustedRoot Root CA ECC TLS 2021"
-     # Certificate "Atos TrustedRoot Root CA RSA G2 2020"
-     # Certificate "Atos TrustedRoot Root CA RSA TLS 2021"
-     # Certificate "CommScope Public Trust ECC Root-01"
-     # Certificate "CommScope Public Trust ECC Root-02"
-     # Certificate "CommScope Public Trust RSA Root-01"
-     # Certificate "CommScope Public Trust RSA Root-02"
-     # Certificate "LAWtrust Root CA2 (4096)"
-     # Certificate "Sectigo Public Email Protection Root E46"
-     # Certificate "Sectigo Public Email Protection Root R46"
-     # Certificate "Sectigo Public Server Authentication Root E46"
-     # Certificate "Sectigo Public Server Authentication Root R46"
-     # Certificate "SSL.com Client ECC Root CA 2022"
-     # Certificate "SSL.com Client RSA Root CA 2022"
-     # Certificate "SSL.com TLS ECC Root CA 2022"
-     # Certificate "SSL.com TLS RSA Root CA 2022"
-     # Certificate "TrustAsia Global Root CA G3"
-     # Certificate "TrustAsia Global Root CA G4"
- Update test certificates
- Tests were activated
- dbtests.sh waiting time was increased to pass the test on slow VM


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 3.90.0-2.tuxcare.els2
changelog:
- update to CKBI 2.70 from NSS 3.104
- updated certificates:
-     # Certificate "GLOBALTRUST 2020"
-     # Certificate "certSIGN ROOT CA"
-     # Certificate "ACCVRAIZ1"
-     # Certificate "OISTE WISeKey Global Root GC CA"
- removed certificates:
-     # Certificate "Security Communication Root CA"
-     # Certificate "Camerfirma Chambers of Commerce Root"
-     # Certificate "Chambers of Commerce Root - 2008"
-     # Certificate "Global Chambersign Root - 2008"
-     # Certificate "E-Tugra Global Root CA RSA v3"
-     # Certificate "E-Tugra Global Root CA ECC v3"
- added certificates:
-     # Certificate "D-Trust SBR Root CA 1 2022"
-     # Certificate "D-Trust SBR Root CA 2 2022"
-     # Certificate "Telekom Security SMIME ECC Root 2021"
-     # Certificate "Telekom Security TLS ECC Root 2020"
-     # Certificate "Telekom Security SMIME RSA Root 2023"
-     # Certificate "Telekom Security TLS RSA Root 2023"
-     # Certificate "FIRMAPROFESIONAL CA ROOT-A WEB"
-     # Certificate "TWCA CYBER Root CA"
-     # Certificate "TWCA Global Root CA G2"
-     # Certificate "SecureSign Root CA12"
-     # Certificate "SecureSign Root CA14"
-     # Certificate "SecureSign Root CA15"


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 3.90.0-2.tuxcare.els3
changelog:
- update to CKBI 2.74 from NSS 3.110
- updated certificates:
-     # Certificate "Entrust.net Premium 2048 Secure Server CA"
-     # Certificate "Entrust Root Certification Authority"
-     # Certificate "AffirmTrust Commercial"
-     # Certificate "AffirmTrust Networking"
-     # Certificate "AffirmTrust Premium"
-     # Certificate "AffirmTrust Premium ECC"
-     # Certificate "Entrust Root Certification Authority - G2"
-     # Certificate "Entrust Root Certification Authority - EC1"
-     # Certificate "Entrust Root Certification Authority - G4"
-     # Certificate "Security Communication ECC RootCA1"
-     # Certificate "BJCA Global Root CA1"
-     # Certificate "BJCA Global Root CA2"
- added certificates:
-     # Certificate "D-TRUST BR Root CA 2 2023"
-     # Certificate "D-TRUST EV Root CA 2 2023"


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 3.90.0-2.tuxcare.els4
changelog:
- update to CKBI 2.82 from NSS 3.120
- updated certificates:
-     # Certificate "ePKI Root Certification Authority"
-     # Certificate "GlobalSign Root CA"
-     # Certificate "Entrust.net Premium 2048 Secure Server CA"
-     # Certificate "Comodo AAA Services root"
-     # Certificate "XRamp Global CA Root"
-     # Certificate "Go Daddy Class 2 CA"
-     # Certificate "Starfield Class 2 CA"
- removed certificates:
-     # Certificate "Baltimore CyberTrust Root"
- added certificates:
-     # Certificate "TrustAsia SMIME ECC Root CA"
-     # Certificate "TrustAsia SMIME RSA Root CA"
-     # Certificate "TrustAsia TLS ECC Root CA"
-     # Certificate "TrustAsia TLS RSA Root CA"
-     # Certificate "SwissSign RSA SMIME Root CA 2022 - 1"
-     # Certificate "SwissSign RSA TLS Root CA 2022 - 1"
-     # Certificate "OISTE Client Root ECC G1"
-     # Certificate "OISTE Client Root RSA G1"
-     # Certificate "OISTE Server Root ECC G1"
-     # Certificate " OISTE Server Root RSA G1"


author: Bob Relyea <rrelyea@redhat.com> - 3.67.0-3
changelog:
- Include softoken specific patches required by the NSS 3.67
  release including:
-  sdb timeout fixes.
-  coverity patch.
-  fixing private key macing


author: Bob Relyea <rrelyea@redhat.com> - 3.79.0-1
changelog:
- Rebase to NSS 3.79.
- add reader/writer lock on encrypted attribute access
- skip attribute verification on attributes with default values
- don't export trust objects if they are default trust objects from dbm


author: Koba Karaputadze <kkaraputadze@cloudlinux.com> - 3.90.0-6.tuxcare.els1
changelog:
- CVE-2023-5388: fix timing attack against RSA decryption
- Bug 1784253: avoid processing unexpected inputs by checking for m_exptmod base sign
- Bug 1911912: avoid misuse of ctype(3) functions


author: Bill Nottingham <notting@redhat.com>
changelog:
- update to 1.2.7
- fix some bugs from bugzilla (#4885, #4887, #4888, #4967)
- take include files out of base package


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- add -D_REENTRANT to make threaded stuff more stable, even though it looks
  like the sources define it, too
- mark *.ph files in migration tools as config files


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- move the defaults for databases and whatnot to /var/lib/ldap (bug #10714)
- fix some possible string-handling problems


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- update to 1.2.10
- add revamped version of patch from kos@bastard.net to allow execution as
  any non-root user
- remove test suite from %build because of weirdness in the build system


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- more minimalistic fix for bug #11111 after consultation with OpenLDAP team
- backport replacement for the ldapuser patch


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- update to 1.2.11
- add condrestart logic to init script
- munge migration scripts so that you don't have to be
  /usr/share/openldap/migration to run them
- add code to create pid files in /var/run


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- tweak init script to return error codes properly
- change initscripts dependency to one on /etc/init.d


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- switch to gdbm; I'm getting off the db merry-go-round
- tweak the init script some more
- add instdir to @INC in migration scripts


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- split off clients and servers to shrink down the package and remove the
  base package's dependency on Perl
- make certain that the binaries have sane permissions


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- build a semistatic slurpd with threads, everything else without
- disable reverse lookups, per email on OpenLDAP mailing lists
- make sure the execute bits are set on the shared libraries


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- add the nis.schema and inetorgperson.schema to the default server config
- make ldapadd a hard link to ldapmodify because they're identical binaries


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- update to 2.0.6
- add buildprereq on cyrus-sasl-devel, krb5-devel, openssl-devel
- take the -s flag off of slapadd invocations in migration tools
- add the cosine.schema to the default server config, needed by inetorgperson


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- try adding the suffix first when doing online migrations
- force ldapadd to use simple authentication in migration scripts
- add indexing of a few attributes to the default configuration
- add commented-out section on using TLS to default configuration


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- add missing required attributes to conversion scripts to comply with schema
- add schema for mail aliases, autofs, and kerberosSecurityObject rooted in
  our own OID tree to define attributes and classes migration scripts expect
- tweak automounter migration script


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- reorganize the patch list to separate MigrationTools and OpenLDAP patches
- switch to Luke Howard's rfc822MailMember schema instead of the aliases.schema
- configure slapd to run as the non-root user "ldap" (#19370)
- chdir() before chroot() (we don't use chroot, though) (#19369)
- disable saving of the pid file because the parent thread which saves it and
  the child thread which listens have different pids


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- add Norbert Klasen's patch (via Del) to fix searches using ldaps URLs
  (OpenLDAP ITS #889)
- add "-h ldaps:///" to server init when TLS is enabled, in order to support
  ldaps in addition to the regular STARTTLS (suggested by Del)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- change automount object OID from 1.3.6.1.1.1.2.9 to 1.3.6.1.1.1.2.13,
  per mail from the ldap-nis mailing list


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- add support for additional OPTIONS, SLAPD_OPTIONS, and SLURPD_OPTIONS in
  a /etc/sysconfig/ldap file (#23549)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- back out pidfile patches, which interact weirdly with Linux threads
- mark non-standard schema as such by moving them to a different directory


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- build dummy certificate in %post, use it in default config
- configure-time shenanigans to help a confused configure script


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- move shared libraries to /lib
- redo init script for better internationalization (#26154)
- don't use ldaprc files in the current directory (#38402) (patch from
  hps@intermeta.de)
- add BuildPrereq on tcp wrappers since we configure with
  --enable-wrappers (#43707)
- don't overflow debug buffer in mail500 (#41751)
- don't call krb5_free_creds instead of krb5_free_cred_contents any
  more (#43159)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- require cyrus-sasl-md5 (support for DIGEST-MD5 is required for RFC
  compliance) by name (follows from #43079, which split cyrus-sasl's
  cram-md5 and digest-md5 modules out into cyrus-sasl-md5)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- add a build-time requirement on pam-devel
- add a build-time requirement on a sufficiently-new libtool to link
  shared libraries to other shared libraries (which is needed in order
  for prelinking to work)


author: Nalin Dahyabhai <nalin@redhat.com> 2.0.12-1
changelog:
- update to 2.0.12 to pull in fixes for setting of default TLS options, among
  other things
- update to migration tools 39
- drop tls patch, which was fixed better in this release


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- disable kbind support (deprecated, and I suspect unused)
- configure with --with-kerberos=k5only instead of --with-kerberos=k5
- build slapd with threads


author: Nalin Dahyabhai <nalin@redhat.com> 2.0.20-2
changelog:
- temporarily disable optimizations for ia64 arches
- specify pthreads at configure-time instead of letting configure guess


author: Nalin Dahyabhai <nalin@redhat.com> 2.0.22-2
changelog:
- switch to an internalized Berkeley DB as the ldbm back-end  (NOTE: this breaks
  access to existing on-disk directory data)
- add slapcat/slapadd with gdbm for migration purposes
- remove Kerberos dependency in client libs (the direct Kerberos dependency
  is used by the server for checking {kerberos} passwords)


author: Nalin Dahyabhai <nalin@redhat.com> 2.0.25-1
changelog:
- update to 2.0.25 "stable", ldbm-over-gdbm (putting off migration of LDBM
  slapd databases until we move to 2.1.x)
- use %{_smp_mflags} when running make
- update to MigrationTools 44
- enable dynamic module support in slapd


author: Nalin Dahyabhai <nalin@redhat.com> 2.0.25-2
changelog:
- change LD_FLAGS to refer to /usr/kerberos/_libdir instead of
  /usr/kerberos/lib, which might not be right on some arches


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- incorporate fixes from SuSE's security audit, except for fixes to ITS 1963,
  1936, 2007, 2009, which were included in 2.0.26.
- add two more patches for db 4.1.24 from sleepycat's updates page
- use openssl pkgconfig data, if any is available


author: Nalin Dahyabhai <nalin@redhat.com> 2.0.27-8
changelog:
- back down to db 4.0.x, which 2.0.x can compile with in ldbm-over-db setups
- tweak SuSE patch to fix a few copy-paste errors and a NULL dereference


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- update to 2.1.17
- disable the shell backend, not expected to work well with threads
- drop the kerberosSecurityObject schema, the krbName attribute it
  contains is only used if slapd is built with v2 kbind support


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- install the db utils for the bundled libdb as %{_sbindir}/slapd_db_*
- install slapcat/slapadd from 2.0.x for migration purposes


author: Nalin Dahyabhai <nalin@redhat.com> 2.1.22-0
changelog:
- 2.1.22 now badged stable
- be more aggressive in what we index by default
- use/require libtool 1.5


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- actually require newer libtool, as was intended back in 2.1.22-0, noted as
  missed by Jim Richardson


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- build bundled libdb for slapd dynamically to make the package smaller,
  among other things
- on tls-capable arches, build libdb both with and without shared posix
  mutexes, otherwise just without
- disable posix mutexes unconditionally for db 4.0, which shouldn't need
  them for the migration cases where it's used
- update to MigrationTools 45


author: Nalin Dahyabhai <nalin@redhat.com> 2.1.22-8
changelog:
- add another section to the ABI note for the TLS libdb so that it's marked as
  not needing an executable stack (from Arjan Van de Ven)


author: Nalin Dahyabhai <nalin@redhat.com> 2.1.25-1
changelog:
- change logging facility used from daemon to local4 (#112730, reversing #11047)
  BEHAVIOR CHANGE - SHOULD BE MENTIONED IN THE RELEASE NOTES.


author: Nalin Dahyabhai <nalin@redhat.com> 2.1.25-2
changelog:
- fix incorrect use of find when attempting to detect a common permissions
  error in the init script (#114866)


author: Thomas Woerner <twoerner@redhat.com> 2.1.29-3
changelog:
- removed rpath
- added pie patch: slapd and slurpd are now pie
- requires libtool >= 1.5.6-2 (PIC libltdl.a)


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.13-1
changelog:
- add compat-openldap subpackage
- default to bdb, as upstream does, gambling that we're only going to be
  on systems with nptl now


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.13-2
changelog:
- build a separate, static set of libraries for openldap-devel with the
  non-standard ntlm bind patch applied, for use by the evolution-connector
  package (#125579), and installing them under
  evolution_connector_prefix)
- provide openldap-evolution-devel = version-release in openldap-devel
  so that evolution-connector's source package can require a version of
  openldap-devel which provides what it wants


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- move slapd startup to earlier in the boot sequence (#103160)
- update to 2.2.15 (stable-20040822)
- change version number on compat-openldap to include the non-compat version
  from which it's compiled, otherwise would have to start 2.2.15 at release 3
  so that it upgrades correctly


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- update to 2.2.17 (stable-20040923) (#135188)
- move nptl libraries into arch-specific subdirectories on x86 boxes
- require a newer glibc which can provide nptl libpthread on i486/i586


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.20-1
changelog:
- update to 2.2.20 (stable-20050103)
- warn about unreadable krb5 keytab files containing "ldap" keys
- warn about unreadable TLS-related files
- own a ref to subdirectories which we create under _libdir/tls


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.23-1
changelog:
- update to 2.2.23 (stable-20050125)
- update notes on upgrading from earlier versions
- drop slapcat variations for 2.0/2.1, which choke on 2.2's config files


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.24-1
changelog:
- update to 2.2.24 (stable 20050318)
- export KRB5_KTNAME in the init script, in case it was set in the sysconfig
  file but not exported


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- update to 2.2.26 (stable 20050429)
- enable the lmpasswd scheme
- print a warning if slaptest fails, slaptest -u succeeds, and one of the
  directories listed as the storage location for a given suffix in slapd.conf
  contains a readable file named __db.001 (#118678)


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.26-1
changelog:
- run slaptest with the -u flag if no id2entry db files are found, because
  you can't check for read-write access to a non-existent database (#156787)
- add _sysconfdir/openldap/cacerts, which authconfig sets as the
  TLS_CACERTDIR path in /etc/openldap/ldap.conf now
- use a temporary wrapper script to launch slapd, in case we have arguments
  with embedded whitespace (#158111)


author: Jay Fenlason <fenlason@redhat.com>
changelog:
- Add the tls-fix-connection-test patch to close
  bz#161991 openldap password disclosure issue
- add the hop patches to prevent infinite looping when chasing referrals.
  OpenLDAP ITS #3578


author: Jay Fenlason <fenlason@redhat.com> 2.2.26-2
changelog:
- Move the slapd.pem file to /etc/pki/tls/certs
  and edit the -config patch to match to close
  bz#143393  Creates certificates + keys at an insecure/bad place
- also use _sysconfdir instead of hard-coding /etc


author: Jay Fenlason <fenlason@redhat.com> 2.3.11-2
changelog:
- Upgrade to 2.3.11, which upstream now considers stable.
- Switch compat-openldap to 2.2.29
- remove references to nss_ldap_build from the spec file
- remove references to 2.0 and 2.1 from the spec file.
- reorganize the build() function slightly in the spec file to limit the
  number of redundant and conflicting options passedto configure.
- Remove the attempt to hardlink ldapmodify and ldapadd together, since
  the current make install make ldapadd a symlink to ldapmodify.
- Include the -ads patches to allow SASL binds to an Active Directory
  server to work.  Nalin <nalin@redhat.com> wrote the patch, based on my
  broken first attempt.


author: Jay Fenlason <fenlason@redhat.com> 2.3.11-3
changelog:
- Remove Requires: cyrus-sasl and cyrus-sasl-md5 from openldap- and
  compat-openldap- to close
  bz#173313 Remove exlicit 'Requires: cyrus-sasl" + 'Requires: cyrus-sasl-md5'


author: Jay Fenlason <fenlason@redhat.com> 2.3.19-2
changelog:
- Upgrade to 2.3.19, which upstream now considers stable
- Modify the -config.patch, ldap.init, and this spec file to put the
  pid file and args file in an ldap-owned openldap subdirectory under
  /var/run.
- Move back_sql* out of _sbindir/openldap , which requires
  hand-moving slapd and slurpd to _sbindir, and recreating symlinks
  by hand.
- Retire openldap-2.3.11-ads.patch, which went upstream.
- Update the ldap.init script to run slaptest as the ldap user rather
  than as root.  This solves
  bz#150172 Startup failure after database problem
- Add to the servers post and preun scriptlets so that on preun, the
  database is slapcatted to /var/lib/ldap/upgrade.ldif and the
  database files are saved to /var/lib/ldap/rpmorig.  On post, if
  /var/lib/ldap/upgrade.ldif exists, it is slapadded.  This means that
  on upgrades from 2.3.16-2 to higher versions, the database files may
  be automatically upgraded.  Unfortunatly, because of the changes to
  the preun scriptlet, users have to do the slapcat, etc by hand when
  upgrading to 2.3.16-2.  Also note that the /var/lib/ldap/rpmorig
  files need to be removed by hand because automatically removing your
  emergency fallback files is a bad idea.
- Upgrade internal bdb to db-4.4.20.  For a clean upgrade, this will
  require that users slapcat their databases into a temp file, move
  /var/lib/ldap someplace safe, upgrade the openldap rpms, then
  slapadd the temp file.


author: Jay Fenlason <fenlason@redhat.com> 2.3.27-2
changelog:
- New upstream release
- Include the gethostbyname_r patch so that nss_ldap won't hang
  on recursive attemts to ldap_initialize.


author: Jay Fenlason <fenlason@redhat.com> 2.3.27-3
changelog:
- Include --enable-multimaster to close
  bz#185821: adding slapd_multimaster to the configure options
- Upgade guide.html to the correct one for openladp-2.3.27, closing
  bz#190383: openldap 2.3 packages contain the administrator's guide for 2.2
- Remove the quotes from around the slaptestflags in ldap.init
  This closes one part of
  bz#204593: service ldap fails after having added entries to ldap
- include __db.* in the list of files to check ownership of in
  ldap.init, as suggested in
  bz#199322: RFE: perform cleanup in ldap.init


author: Thomas Woerner <twoerner@redhat.com> 2.3.30-1.1
changelog:
- tcp_wrappers has a new devel and libs sub package, therefore changing build
  requirement for tcp_wrappers to tcp_wrappers-devel


author: Jay Fenlason <fenlason<redhat.com> 2.3.34-1
changelog:
- New upstream release
- Upgrade the scripts for migrating the database so that they might
  actually work.
- change bind-libbind-devel to bind-devel in BuildPreReq


author: Jan Safranek <jsafranek@redhat.com> 2.3.34-2
changelog:
- slapadd during package update is now quiet (bz#224581)
- use _localstatedir instead of var/ during build (bz#220970)
- bind-libbind-devel removed from BuildRequires (bz#216851)
- slaptest is now quiet during service ldap start, if
  there is no error/warning (bz#143697)
- libldap_r.so now links with pthread (bz#198226)
- do not strip binaries to produce correct .debuginfo packages
  (bz#152516)


author: Jan Safranek <jsafranek@redhat.com> 2.3.34-3
changelog:
- do not create script in /tmp on startup (bz#188298)
- add compat-slapcat to openldap-compat (bz#179378)
- do not import ddp services with migrate_services.pl
  (bz#201183)
- sort the hosts by adders, preventing duplicities
  in migrate*nis*.pl (bz#201540)
- start slupd for each replicated database (bz#210155)
- add ldconfig to devel post/postun (bz#240253)
- include misc.schema in default slapd.conf (bz#147805)


author: Jan Safranek <jsafranek@redhat.com> 2.3.34-4
changelog:
- Fix initscript return codes (#242667)
- Provide overlays (as modules; #246036, #245896)
- Add available modules to config file


author: Jan Safranek <jsafranek@redhat.com> 2.3.34-6
changelog:
- fix compat-slapcat compilation. Now it can be found in
  /usr/lib/compat-openldap/slapcat, because the tool checks argv[0]
  (#246581)


author: Jan Safranek <jsafranek@redhat.com> 2.3.37-2
changelog:
- do not use specific automake and autoconf
- do not distinguish between NPTL and non-NPTL platforms, we have NPTL
  everywhere
- db-4.6.18 integrated
- updated openldap-servers License: field to reference BDB license


author: Jan Safranek <jsafranek@redhat.com> 2.3.38-2
changelog:
- skeleton /etc/sysconfig/ldap added
- new SLAPD_LDAP option to turn off listening on ldap:/// (#292591)
- fixed checking of SSL (#292611)
- fixed upgrade with empty database


author: Jan Safranek <jsafranek@redhat.com> 2.4.7-4
changelog:
- fixed rpmlint warnings and errors
  - /etc/openldap/schema/README moved to /usr/share/doc/openldap


author: Jan Safranek <jsafranek@redhat.com> 2.4.8-3
changelog:
- reworked the upgrade logic, slapcat/slapadd of the whole database
  is needed only if minor version changes (2.3.x -> 2.4.y)
- do not try to save database in LDIF format, if openldap-servers package
  is  being removed (it's up to the admin to do so manually)


author: Jan Safranek <jsafranek@redhat.com> 2.4.8-4
changelog:
- bdb upgraded to 4.6.21
- reworked upgrade logic again to run db_upgrade when bdb version
  changes


author: Jan Safranek <jsafranek@redhat.com> 2.4.11-3
changelog:
- add SLAPD_SHUTDOWN_TIMEOUT to /etc/sysconfig/ldap, allowing admins
  to set non-default slapd shutdown timeout
- add checkpoint to default slapd.conf file (#458679)


author: Jan Zeleny <jzeleny@redhat.com> 2.4.15-3
changelog:
- extended previous patch (#481310) to remove options cfMP
  from some client tools
- correction of patch setugid (#494330)


author: Jan Zeleny <jzeleny@redhat.com> 2.4.16-1
changelog:
- rebase of openldap to 2.4.16
- fixed minor issue in spec file (output looking interactive
  when installing servers)


author: Jan Zeleny <jzeleny@redhat.com> 2.4.18-2
changelog:
- changed configuration approach. Instead od slapd.conf slapd
  is using slapd.d directory now
- fix of some issues caused by renaming of init script
- fix of buffer overflow issue in ldif.c pointed out by new glibc


author: Jan Zeleny <jzeleny@redhat.com> 2.4.18-4
changelog:
- updated smbk5pwd patch to be linked with libldap (#526500)
- the last buffer overflow patch replaced with the one from upstream
- added /etc/openldap/slapd.d and /etc/openldap/slapd.conf.bak
  to files owned by openldap-servers


author: Jan Zeleny <jzeleny@redhat.com> - 2.4.19-2
changelog:
- fixed tls connection accepting when TLSVerifyClient = allow
- /etc/openldap/ldap.conf removed from files owned by openldap-servers
- minor changes in spec file to supress warnings
- some changes in init script, so it would be possible to use it when
  using old configuration style


author: Jan Zeleny <jzeleny@redhat.com> - 2.4.22-1
changelog:
- rebased to 2.4.22 (mostly bugfixes, added back-ldif, back-null testing support)
- due to some possible issues pointed out in last update testing phase, I'm
  pulling back the last change (slapd can't be moved since it depends on /usr
  possibly mounted from network)


author: Rich Megginson <rmeggins@redhat.com> - 2.4.22-3
changelog:
- added ldif.h to the public api in the devel package
- added -lldif to the public api
- added HAVE_MOZNSS and other flags to use Mozilla NSS for crypto


author: Jan Vcelak <jvcelak@redhat.com> - 2.4.22-6
changelog:
- CVE-2010-0211 openldap: modrdn processing uninitialized pointer free (#605448)
- CVE-2010-0212 openldap: modrdn processing IA5StringNormalize NULL pointer dereference (#605452)
- obsolete configuration file moved to /usr/share/openldap-servers (#612602)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.22-7
changelog:
- Mozilla NSS - delay token auth until needed (#616552)
- Mozilla NSS - support use of self signed CA certs as server certs (#614545)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-1
changelog:
- rebase to 2.4.23
- embeded db4 library removed
- removed bogus links in "SEE ALSO" in several man-pages (#624616)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-2
changelog:
- fix possible infinite loop when checking permissions of TLS files (#641946)
- removed outdated autofs.schema (#643045)
- removed outdated README.upgrade
- removed relics of migrationtools


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-3
changelog:
- add support for multiple prefixed Mozilla NSS database files in TLS_CACERTDIR
- reject non-file keyfiles in TLS_CACERTDIR (#652315)
- TLS_CACERTDIR precedence over TLS_CACERT (#652304)
- accept only files in hash.0 format in TLS_CACERTDIR (#650288)
- improve SSL/TLS trace messages (#652818)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-4
changelog:
- Mozilla NSS - implement full non-blocking semantics
  ldapsearch -Z hangs server if starttls fails (#652822)
- updated list of all overlays in slapd.conf (#655899)
- fix database upgrade process (#656257)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-5
changelog:
- initscript: slaptest with '-u' to skip database opening (#667768)
- removed slurpd options from sysconfig/ldap
- fix: verification of self issued certificates (#657984)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-6
changelog:
- fix: some server certificates refused with inadequate type error (#668899)
- fix: default encryption strength dropped in switch to using NSS (#669446)
- systemd compatibility: add configuration file (#656647, #668223)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-7
changelog:
- fix: openldap can't use TLS after a fork() (#636956)
- fix: openldap-server upgrade gets stuck when the database is damaged (#664433)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.24-2
changelog:
- new: system resource limiting for slapd using ulimit
- fix update: openldap can't use TLS after a fork() (#636956)
- fix: possible null pointer dereference in NSS implementation
- fix: openldap-servers upgrade hangs or do not upgrade the database (#664433)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.25-1
changelog:
- rebase to new upstream release
- change default database type from BDB to HDB
- enable ldapi:/// interface by default
- set cn=config management ACLs for root user, SASL external schema (#712495)
- fix: server scriptlets require initscripts package (#716857)
- fix: connection fails if TLS_CACERTDIR doesn't exist but TLS_REQCERT
  is set to 'never' (#716854)
- fix: segmentation fault caused by double-free in ldapexop (#699683)
- fix: segmentation fault of client tool when input line in LDIF file
  is splitted but indented incorrectly (#716855)
- fix: segmentation fault of client tool when LDIF input file is not terminated
  by a new line character (#716858)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.26-2
changelog:
- security hardening: library needs partial RELRO support added (#733071)
- fix: NSS_Init* functions are not thread safe (#731112)
- fix: incorrect behavior of allow/try options of VerifyCert and TLS_REQCERT (#725819)
- fix: memleak - free the return of tlsm_find_and_verify_cert_key (#725818)
- fix: conversion of constraint overlay settings to cn=config is incorrect (#733067)
- fix: DDS overlay tolerance parametr doesn't function and breakes default TTL (#733069)
- manpage fix: errors in manual page slapo-unique (#733070)
- fix: matching wildcard hostnames in certificate Subject field does not work (#733073)
- new feature: honor priority/weight with ldap_domain2hostlist (#733078)
- manpage fix: wrong ldap_sync_destroy() prototype in ldap_sync(3) manpage (#717722)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.26-3
changelog:
- fix: SSL_ForceHandshake function is not thread safe (#701678)
- fix: allow unsetting of tls_* syncrepl options (#734187)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.26-5
changelog:
- rebuild: openldap does not work after libdb rebase (#743824)
- regression fix: openldap built without tcp_wrappers (#743213)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.26-6
changelog:
- package cleanup:
  + hardened build: switch from LDFLAGS to RPM macros
  + remove old provides and obsoletes
  + add new slapd maintainance scripts
  + drop defattr macros, clean up permissions in specfile
  + fix rpmlint warnings: macros in comments/changelog
  + fix rpmlint warnings: non UTF-8 documentation
  + rename environment file to be more consistent (ldap -> slapd)
- replace sysv initscript with systemd service file (#
- new format of environment file due to switch to systemd
  (automatic conversion is performed)
- patch OpenLDAP to skip empty command line arguments
  (arguments expansion in systemd works different than in shell)
- CVE-2011-4079: one-byte buffer overflow in slapd (#749324)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.28-1
changelog:
- new upstream release
  + server: support for delta-syncrepl in multi master replication
  + server: add experimental backend - MDB
  + server: dynamic configuration for passwd, perl, shell, sock, and sql backends
  + server: support passwords in APR1
  + library: support for Wahl (draft)
  + a lot of bugfixes
- remove patches which were merged upstream
- compile backends as modules (except BDB, HDB, and monitor)
- reload systemd daemon after installation


author: Jan Vcelak <jvcelak@redhat.com> 2.4.28-3
changelog:
- fix: replication (syncrepl) with TLS causes segfault (#783431)
- fix: slapd segfaults when PEM certificate is used and key is not set (#772890)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.29-1
changelog:
- new upstream release
  + MozNSS fixes
  + connection handling fixes
  + server: buxfixes in mdb backend
  + server: buxfixes in overlays (syncrepl, meta, monitor, perl, sql, dds, rwm)
- openldap-servers now provide ldib2ldbm (#437104)
- certificates management improvements
  + create empty Mozilla NSS certificate database during installation
  + enable builtin Root CA in generated database (#789088)
  + generate server certificate using Mozilla NSS tools instead of OpenSSL tools
  + fix: correct path to check-config.sh in service file (Jan Synáček <jsynacek@redhat.com>)
- temporarily disable certificates checking in check-config.sh script
- fix: check-config.sh get stuck when executing command as a ldap user


author: Jan Vcelak <jvcelak@redhat.com> 2.4.29-2
changelog:
- fix update: provide ldif2ldbm, not ldib2ldbm (#437104)
- Jan Synáček <jsynacek@redhat.com>:
  + unify systemctl binary paths throughout the specfile and make them usrmove compliant
  + make path to chkconfig binary usrmove compliant


author: Jan Vcelak <jvcelak@redhat.com> 2.4.29-3
changelog:
- fix: ldap_result does not succeed for sssd (#771484)
- Jan Synáček <jsynacek@redhat.com>:
  + fix: count constraint broken when using multiple modifications (#795766)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.29-4
changelog:
- fix: missing options in manual pages of client tools (#796232)
- fix: SASL_NOCANON option missing in ldap.conf manual page (#732915)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.30-1
changelog:
- new upstream release
  + server: fixes in mdb backend
  + server: fixes in manual pages
  + server: fixes in syncprov, syncrepl, and pcache
- removed patches which were merged upstream


author: Jan Vcelak <jvcelak@redhat.com> 2.4.31-1
changelog:
- new upstream release
  + library: IPv6 url detection
  + library: rebinding to failed connections
  + server: various fixes in mdb backend
  + server: various fixes in replication
  + server: various fixes in overlays and minor backends
  + documentation fixes
- remove patches which were merged upstream


author: Jan Vcelak <jvcelak@redhat.com> 2.4.31-2
changelog:
- fix: nss-tools package is required by the base package, not the server subpackage
- fix: MozNSS CA certdir does not work together with PEM CA cert file (#819536)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.31-3
changelog:
- update fix: count constraint broken when using multiple modifications (#795766)
- fix: invalid order of TLS shutdown operations (#808464)
- fix: TLS error messages overwriting in tlsm_verify_cert() (#810462)
- fix: reading pin from file can make all TLS connections hang (#829317)
- CVE-2012-2668: cipher suite selection by name can be ignored (#825875)
- fix: slapd fails to start on reboot (#829272)
- fix: default cipher suite is always selected (#828790)
- fix: less influence between individual TLS contexts:
  - replication with TLS does not work (#795763)
  - possibly others


author: Jan Vcelak <jvcelak@redhat.com> 2.4.31-4
changelog:
- modify the package build process
  + fix autoconfig files to detect Mozilla NSS library using pkg-config
  + remove compiler flags which are not needed currently
  + build server, client and library together
  + avoid stray dependencies by using --as-needed linker flag
  + enable SLAPI interface in slapd


author: Jan Vcelak <jvcelak@redhat.com> 2.4.31-5
changelog:
- fix: querying for IPv6 DNS records when IPv6 is disabled on the host (#835013)
- fix: smbk5pwd module computes invalid LM hashes (#841560)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.32-1
changelog:
- new upstream release
  + library: double free, SASL handling
  + tools: read SASL_NOCANON from config file
  + slapd: config index renumbering, duplicate error response
  + backends: various fixes in mdb, bdb/hdb, ldap
  + accesslog, syncprov: fix memory leaks in with replication
  + sha2: portability, thread safety, support SSHA256,384,512
  + documentation fixes


author: Jan Vcelak <jvcelak@redhat.com> 2.4.32-2
changelog:
- enhancement: TLS, prefer private keys from authenticated slots
- enhancement: TLS, allow certificate specification including token name
- resolve TLS failures in replication in 389 Directory Server


author: Jan Vcelak <jvcelak@redhat.com> 2.4.32-3
changelog:
- fix: some TLS ciphers cannot be enabled (#852338)
- fix: connection hangs after fallback to second server when certificate hostname verification fails (#852476)
- fix: not all certificates in OpenSSL compatible CA certificate directory format are loaded (#852786)
- fix: MozNSS certificate database in SQL format cannot be used (#857373)
- fix: libldap does not load PEM certificate if certdb is used as TLS_CACERTDIR (#857455)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.33-1
changelog:
- new upstream release:
  + slapd: ACLs, syncrepl
  + backends: locking and memory management in MDB
  + manpages: slapo-refint
- patch update: MozNSS certificate database in SQL format cannot be used (#860317)
- fix: slapd.service should not use /tmp (#859019)


author: Jan Vcelak <jvcelak@fedoraproject.org> 2.4.34-1
changelog:
- new upstream release (#917603)
- fix: slapcat segfaults if cn=config.ldif not present (#872784)
- use systemd-rpm macros in spec file (#850247)


author: Jan Synáček <jsynacek@redhat.com> 2.4.34-1
changelog:
- enable perl backend (#820547)
- package ppolicy-check-password (#829749)
- add perl specific BuildRequires
- fix bogus dates


author: Jan Synáček <jsynacek@redhat.com> 2.4.34-2
changelog:
- fix: syncrepl push DELETE operation does not recover (#920482)
- run autoreconf every build, drop autoreconf patch (#926280)


author: Jan Synáček <jsynacek@redhat.com> 2.4.35-1
changelog:
- new upstream release (#947235)
- fix: slapd.service should ensure that network is up before starting (#946921)
- fix: NSS related resource leak (#929357)


author: Jan Synáček <jsynacek@redhat.com> 2.4.35-3
changelog:
- fix: minor documentation fixes
- set SASL_NOCANON to on by default (#949864)
- remove trailing spaces


author: Jan Synáček <jsynacek@redhat.com> 2.4.35-4
changelog:
- do not needlessly run ldconfig after installing openldap-devel
- fix: LDAPI with GSSAPI does not work if SASL_NOCANON=on (#960222)
- fix: lt_dlopen() with back_perl (#960048)


author: Jan Synáček <jsynacek@redhat.com> - 2.4.39-4
changelog:
- support TLS 1.1 and later (#1160468)
- fix: /etc/openldap/certs directory is empty after installation (#1064251)
- fix: Typo in script to generate /usr/libexec/openldap/generate-server-cert.sh (#1087490)
- fix: remove correct tmp file when generating server cert (#1103101)
- fix: slapd.ldif olcFrontend missing important/required objectclass (#1132094)


author: Jan Synáček <jsynacek@redhat.com> - 2.4.39-5
changelog:
- add documentation reference to service file (#1087288)
- fix: tls_reqcert try has bad behavior (#1027613)


author: Matúš Honěk <mhonek@redhat.com> - 2.4.40-1
changelog:
- new upstream release (#1147982)
- fix: PIE and RELRO check (#1092562)
- fix: slaptest doesn't convert perlModuleConfig lines (#1184585)
- fix: OpenLDAP crash in NSS shutdown handling (#1158005)
- fix: slapd.service may fail to start if binding to NIC ip (#1198781)
- fix: deadlock during SSL_ForceHandshake when getting connection to replica (#1125152)
- improve check_password (#1174723, #1196243)
- provide an unversioned symlink to check_password.so.1.1 (#1174634)
- add findutils to requires (#1209229)


author: Matúš Honěk <mhonek@redhat.com> - 2.4.40-5
changelog:
- enhancement: support TLS 1.1 and later (#1231522,#1160467)
- fix: openldap ciphersuite parsing code handles masks incorrectly (#1231522)
- fix the patch in commit da1b5c (fix: OpenLDAP crash in NSS shutdown handling) (#1231228)


author: Matúš Honěk <mhonek@redhat.com> - 2.4.40-7
changelog:
- Merge two MozNSS cipher suite definition patches into one. (#1245279)
- Use what NSS considers default for DEFAULT cipher string. (#1245279)
- Remove unnecesary defaults from ciphers' definitions (#1245279)


author: Matúš Honěk <mhonek@redhat.com> - 2.4.40-8
changelog:
- NSS does not support string ordering (#1231522)
- implement and correct order of parsing attributes (#1231522)
- add multi_mask and multi_strength to correctly handle sets of attributes (#1231522)
- add new cipher suites and correct AES-GCM attributes (#1245279)
- correct DEFAULT ciphers handling to exclude eNULL cipher suites (#1245279)


author: Matus Honek <mhonek@redhat.com> - 2.4.40-10
changelog:
- fix: slapd fails to start on boot (#1315958)
- fix: id_query option is not available after rebasing openldap to 2.4.39 (#1311832)
- Include sha2 module (#1292568)
- Compile AllOp together with other overlays (#990893)
- Missing mutex unlock in accesslog overlay (#1261003)
- ITS#8337 fix missing olcDbChecksum config attr (#1292590)
- ITS#8003 fix off-by-one in LDIF length (#1292619)


author: Matus Honek <mhonek@redhat.com> - 2.4.40-12
changelog:
- fix: slapd crash in do_search (#1316450)
- fix: Setting olcTLSProtocolMin does not change supported protocols (#1249093)


author: Matus Honek <mhonek@redhat.com> - 2.4.40-13
changelog:
- fix: Bad log levels in check_password module
- fix: We can't search expected entries from LDAP server
- fix: OpenLDAP ciphersuite parsing doesn't match OpenSSL ciphers man page
  + Add TLS_DHE_DSS_WITH_AES_256_GCM_SHA384 to list of ciphers
  + Add DH cipher string parsing option
  + Correct handling kECDH ciphers with aRSA or aECDSA


author: Matus Honek <mhonek@redhat.com> - 2.4.44-5
changelog:
- fix CVE-2017-9287 openldap: Double free vulnerability in servers/slapd/back-mdb/search.c (#1458210)


author: Matus Honek <mhonek@redhat.com> - 2.4.44-10
changelog:
- Drop update-ppolicy-schema.sh scriptlet's output (#1487857)
- Fix issues in MozNSS compatibility layer (#1400578)
  + Force write file with fsync to avoid race conditions
  + Always filestamp both sql and dbm NSS DB variants to not rely on default DB type prefix
  + Allow missing cert and key which is a valid usecase
  + Create extraction folder only in /tmp to simplify selinux rules
  + Fix Covscan issues


author: Matus Honek <mhonek@redhat.com> - 2.4.44-11
changelog:
- MozNSS Compat. Layer: Enable usage of NSS DB with PEM cert/key (#1525485)
  + Fix a possible invalid dereference (covscan)


author: Matus Honek <mhonek@redhat.com> - 2.4.44-12
changelog:
- MozNSS Compat. Layer: Ensure consistency of a PEM dir before usage (#1516409)
  + Warn just before use of a PIN about key file extraction


author: Matus Honek <mhonek@redhat.com> - 2.4.44-13
changelog:
- MozNSS Compat. Layer: fix recursive directory deletion (#1516409)
- MozNSS Compat. Layer: fix PIN disclaimer not always shown (#1516409)
- MozNSS Compat. Layer: fix incorrect parsing of CACertDir (#1533955)


author: Matus Honek <mhonek@redhat.com> - 2.4.44-17
changelog:
- MozNSS Compat. Layer: Fix memleaks reported by valgrind (#1575549)
- Reset OPTIND in libexec/functions for getopts to work in subsequent calls (#1564382)
- MozNSS Compat. Layer: Fix typos, and spelling in the README file header (#1543451)


author: Matus Honek <mhonek@redhat.com> - 2.4.44-18
changelog:
- MozNSS Compat. Layer: Make log messages more clear (#1543955)
- Build with LDAP_USE_NON_BLOCKING_TLS (#1471039)


author: Matus Honek <mhonek@redhat.com> - 2.4.44-22
changelog:
- Fix CVE-2020-12243 openldap: denial of service via nested boolean expressions in LDAP search filters (#1838405)


author: Simon Pichugin <spichugi@redhat.com> - 2.4.44-23
changelog:
- Fix CVE-2020-25692 openldap: NULL pointer dereference for unauthenticated packet in slapd (#1895328)


author: Simon Pichugin <spichugi@redhat.com> - 2.4.44-25
changelog:
- Fix CVE-2020-25709 openldap: assertion failure in Certificate List syntax validation (#2040539)
- Fix CVE-2020-25710 openldap: assertion failure in CSN normalization with invalid input (#2040538)


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 2.4.44-25.tuxcare.els1
changelog:
- CVE-2022-29155: fix a SQL injection vulnerability in the back-sql backend
  to slapd
- CVE-2021-27212: fix denial of service (daemon exit) via a short timestamp
  if slapd is used


author: Jakub Jelen <jjelen@redhat.com> - 7.4p1-18 + 0.10.3-2
changelog:
- invalidate supplemental group cache used by temporarily_use_uid()
  when the target uid differs (#1583735)


author: Dmitrii Samoilov <dsamoilov@cloudlinux.com> - 7.4p1-23.tuxcare.els2 + 0.10.3-2.tuxcare.els2
changelog:
- CVE-2023-48795: implement "strict key exchange" in ssh and sshd
- Moved ELS patches to the top to avoid patch conflicts


author: Jai S <jsathyapalan@cloudlinux.com> - 7.4p1-23.0.3.tuxcare.els1 + 0.10.3-2.tuxcare.els1
changelog:
- CVE-2025-26465: fix vulnerability in OpenSSH when the VerifyHostKeyDNS option is enabled
- enlarge format buffer size for certificate serial number so the log message can record any 64-bit
  integer without truncation (openssh bz#3012) [Orabug: 30448895]


author: Jai S <jsathyapalan@cloudlinux.com> - 7.4p1-23.0.3.tuxcare.els1 + 0.10.3-2.tuxcare.els1
changelog:
- CVE-2025-26465: fix vulnerability in OpenSSH when the VerifyHostKeyDNS
  option is enabled
- enlarge format buffer size for certificate serial number so the log
  message can record any 64-bit integer without truncation
  (openssh bz#3012) [Orabug: 30448895]


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.4p1-23.0.3.tuxcare.els3 + 0.10.3-2.tuxcare.els3
changelog:
- CVE-2018-20685: fix a vulnerability scp client where a malicious server
  could bypass intended access restrictions and modify target directory
  permissions via crafted filenames
- CVE-2019-6109: fix scp client where a malicious server could manipulate
  the client's progress display output due to missing character encoding
- CVE-2019-6111: fix scp client vulnerability that allowed a malicious
  server to overwrite arbitrary files in the client's target directory,
  including subdirectories, when performing transfers


author: Bartosz Staszewski <bstaszewski@cloudlinux.com> - 7.4p1-23.0.3.tuxcare.els4 + 0.10.3-2.tuxcare.els4
changelog:
- CVE-2026-35414: fix incorrect matching of the authorized_keys
  principals="" option against certificate principals containing
  comma characters


author: Andrija Jokanovic <ajokanovic@cloudlinux.com> - 7.4p1-23.0.3.tuxcare.els5 + 0.10.3-2.tuxcare.els5
changelog:
- CVE-2026-35386: fix client-side command execution via control characters
  in usernames by adding iscntrl rejection to valid_ruser


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- Patch to build with neither RSA nor RSAref.
- Miscellaneous FHS-compliance tweaks.
- Fix for possibly-compressed man pages.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- Move condrestart to server postun.
- Move key generation to init script.
- Actually use the right patch for moving the key generation to the init script.
- Clean up the init script a bit.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- Update to 2.1.1p4, which includes fixes for config file parsing problems.
- Move the init script back.
- Add Damien's quick fix for wackiness.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- Update to 20000823 snapshot.
- Change subpackage requirements from %{version} to %{version}-%{release}
- Back out the pipe patch.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- Update x11-askpass to 1.0.2. (#17835)
- Add BuildPreReqs for /bin/login and /usr/bin/rsh so that configure will
  always find them in the right place. (#17909)
- Set the default path to be the same as the one supplied by /bin/login, but
  add /usr/X11R6/bin. (#17909)
- Try to handle obsoletion of ssh-server more cleanly.  Package names
  are different, but init script name isn't. (#17865)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- Add BuildPreReq on /usr/include/security/pam_appl.h to be sure we always
  build PAM authentication in.
- Try setting SSH_ASKPASS if gnome-ssh-askpass is installed.
- Clean out no-longer-used patches.
- Patch ssh-add to try to add both identity and id_dsa, and to error only
  when neither exists.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- Update to OpenSSH 2.3.0p1.
- Update to x11-askpass 1.1.0.
- Enable keyboard-interactive authentication.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- Resync with conditional options in Damien Miller's .spec file for an errata.
- Change libexecdir from %{_libexecdir}/ssh to %{_libexecdir}/openssh.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- Add the primes file from the latest snapshot to the main package (#20884).
- Add the dev package to the prereq list (#19984).
- Remove the default path and mimic login's behavior in the server itself.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- Disable the built-in MD5 password support.  We're using PAM.
- Take a crack at doing keyboard-interactive authentication with PAM, and
  enable use of it in the default client configuration so that the client
  will try it when the server disallows password authentication.
- Build with debugging flags.  Build root policies strip all binaries anyway.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- Merge multiple PAM text messages into subsequent prompts when possible when
  doing keyboard-interactive authentication.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- Update to x11-askpass 1.1.1. (#21301)
- Don't second-guess fixpaths, which causes paths to get fixed twice. (#21290)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- Don't treat pam_setcred() failure as fatal unless pam_authenticate() has
  succeeded, to allow public-key authentication after a failure with "none"
  authentication.  (#21268)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- More gettextizing.
- Close all files after going into daemon mode (needs more testing).
- Extract patch from CVS to handle auth banners (in the client).
- Extract patch from CVS to handle compat weirdness.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- Don't open a PAM session until we've forked and become the user (#25690).
- Apply Andrew Bartlett's patch for letting pam_authenticate() know which
  host the user is attempting a login from.
- Resync with parts of Damien Miller's openssh.spec from CVS.
- Don't expose KbdInt responses in debug messages (from CVS).
- Detect and handle errors in rsa_{public,private}_decrypt (from CVS).


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- Update for 2.5.0p1.
- Use $RPM_OPT_FLAGS instead of -O when building gnome-ssh-askpass
- Resync with parts of Damien Miller's openssh.spec from CVS, including
  update of x11 askpass to 1.2.0.
- Only require openssl (don't prereq) because we generate keys in the init
  script now.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- Update for 2.5.1p1.
- Add init script mods from Pekka Savola.
- Tweak the init script to match the CVS contrib script more closely.
- Redo patch to ssh-add to try to adding both identity and id_dsa to also try
  adding id_rsa.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- Redo patch to move pam_open_session after the server setuid()s to the user.
- Rework the nopam patch to use be picked up by autoconf.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- Chuck the closing patch.
- Add a trigger to add host keys for protocol 2 to the config file, now that
  configuration file syntax requires us to specify it with HostKey if we
  specify any other HostKey values, which we do.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- Revert the patch to move pam_open_session.
- Init script and spec file changes from Pekka Savola. (#28750)
- Patch sftp to recognize '-o protocol' arguments. (#29540)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- update to 2.5.2p1 (includes endianness fixes in the rijndael implementation)
- don't enable challenge-response by default until we find a way to not
  have too many userauth requests (we may make up to six pubkey and up to
  three password attempts as it is)
- remove build dependency on rsh to match openssh.com's packages more closely


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- update to 2.5.2p2
- call setcred() again after initgroups, because the "creds" could actually
  be group memberships


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- make do_pam_setcred() smart enough to know when to establish creds and
  when to reinitialize them
- add in a couple of other fixes from Damien for inclusion in the errata


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- mention that challengereponse supports PAM, so disabling password doesn't
  limit users to pubkey and rsa auth (#34378)
- bypass the daemon() function in the init script and call initlog directly,
  because daemon() won't start a daemon it detects is already running (like
  open connections)
- require the version of openssl we had when we were built


author: Preston Brown <pbrown@redhat.com>
changelog:
- remove explicit openssl requirement, fixes builddistro issue
- make initscript stop() function wait until sshd really dead to avoid 
  races in condrestart


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- finish marking strings in the init script for translation
- modify init script to source /etc/sysconfig/sshd and pass $OPTIONS to sshd
  at startup (change merged from openssh.com init script, originally by
  Pekka Savola)
- refuse to do X11 forwarding if xauth isn't there, handy if you enable
  it by default on a system that doesn't have X installed


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- add in Simon Wilkinson's GSSAPI patch to give it some testing in-house,
  to be removed before the next beta cycle because it's a big departure
  from the upstream version


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- fix an error parsing the new default sshd_config
- add a fix from Markus Friedl (via openssh-unix-dev) for ssh-keygen not
  dealing with comments right


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- change Copyright: BSD to License: BSD
- add Markus Friedl's unverified patch for the cookie file deletion problem
  so that we can verify it
- drop patch to check if xauth is present (was folded into cookie patch)
- don't apply gssapi patches for the errata candidate
- clear supplemental groups list at startup


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- pull cvs patch to add session initialization to no-pty sessions
- pull cvs patch to not cut off challengeresponse auth needlessly
- refuse to do X11 forwarding if xauth isn't there, handy if you enable
  it by default on a system that doesn't have X installed (#49263)


author: Nalin Dahyabhai <nalin@redhat.com> 2.9p2-7
changelog:
- fix scp's server's reporting of file sizes, and build with the proper
  preprocessor define to get large-file capable open(), stat(), etc.
  (sftp has been doing this correctly all along) (#51827)
- configure without --with-ipv4-default on RHL 7.x and newer (#45987,#52247)
- pull cvs patch to fix support for /etc/nologin for non-PAM logins (#47298)
- mark profile.d scriptlets as config files (#42337)
- refer to Jason Stone's mail for zsh workaround for exit-hanging quasi-bug
- change a couple of log() statements to debug() statements (#50751)
- pull cvs patch to add -t flag to sshd (#28611)
- clear fd_sets correctly (one bit per FD, not one byte per FD) (#43221)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- update to 3.0p1
- update to x11-ssh-askpass 1.2.4.1
- change build dependency on a file from pam-devel to the pam-devel package
- replace primes with moduli


author: Nalin Dahyabhai <nalin@redhat.com> 3.0p1-1
changelog:
- merge some of Damien Miller <djm@mindrot.org> changes from the upstream
  3.0p1 spec file and init script


author: Nalin Dahyabhai <nalin@redhat.com> 3.0.2p1-3
changelog:
- add patches from Simon Wilkinson and Nicolas Williams for GSSAPI key
  exchange, authentication, and named key support


author: Nalin Dahyabhai <nalin@redhat.com> SNAP-20020220
changelog:
- update to SNAP-20020220 for testing purposes (you've been warned, if there's
  anything to be warned about, gss patches won't apply, I don't mind)


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-1
changelog:
- require sharutils for building (mindrot #137)
- require db1-devel only when building for 6.x (#55105), which probably won't
  work anyway (3.1 requires OpenSSL 0.9.6 to build), but what the heck
- require pam-devel by file (not by package name) again
- add Markus's patch to compile with OpenSSL 0.9.5a (from
  http://bugzilla.mindrot.org/show_bug.cgi?id=141) and apply it if we're
  building for 6.x


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-2gss
changelog:
- reintroduce Simon's gssapi patches
- add buildprereq for autoconf253, which is needed to regenerate configure
  after applying the gssapi patches
- refresh to the latest version of Markus's patch to build properly with
  older versions of OpenSSL


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-3
changelog:
- pull patch from CVS to avoid printing error messages when some of the
  default keys aren't available when running ssh-add
- refresh to current revisions of Simon's patches


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-4
changelog:
- drop buildreq on db1-devel
- require pam-devel by package name
- require autoconf instead of autoconf253 again


author: Nalin Dahyabhai <nalin@redhat.com> 3.3p1-1
changelog:
- update to 3.3p1
- merge in spec file changes from upstream (remove setuid from ssh, ssh-keysign)
- disable gtk2 askpass
- require pam-devel by filename rather than by package for erratum
- include patch from Solar Designer to work around anonymous mmap failures


author: Nalin Dahyabhai <nalin@redhat.com> 3.3p1-2
changelog:
- rework the close-on-exit docs
- include configuration file man pages
- make use of nologin as the privsep shell optional


author: Nalin Dahyabhai <nalin@redhat.com> 3.5p1-2
changelog:
- patch PAM configuration to use relative path names for the modules, allowing
  us to not worry about which arch the modules are built for on multilib systems


author: Nalin Dahyabhai <nalin@redhat.com> 3.5p1-6
changelog:
- move scp to the -clients subpackage, because it directly depends on ssh
  which is also in -clients (#84329)


author: Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-6
changelog:
- modify patch which clears the supplemental group list at startup to only
  complain if setgroups() fails if sshd has euid == 0
- handle krb5 installed in %{_prefix} or elsewhere by using krb5-config


author: Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-11
changelog:
- apply patch to store the correct buffer size in allocated buffers
  (CAN-2003-0693)
- skip the initial PAM authentication attempt with an empty password if
  empty passwords are not permitted in our configuration (#103998)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
- additional fix for apparently-never-happens double-free in buffer_free()
- extend fix for #103998 to cover SSH1


author: Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-34
changelog:
* Wed Mar 03 2004 Phil Knirsch <pknirsch@redhat.com> 3.6.1p2-33.30.1
- Built RHLE3 U2 update package.


author: Nalin Dahyabhai <nalin@redhat.com> 3.8.1p1-1
changelog:
- request gssapi-with-mic by default but not delegation (flag day for anyone
  who used previous gssapi patches)
- no longer request x11 forwarding by default


author: Nalin Dahyabhai <nalin@redhat.com> 3.9p1-8
changelog:
- add a --enable-vendor-patchlevel option which allows a ShowPatchLevel option
  to enable display of a vendor patch level during version exchange (#120285)
- configure with --disable-strip to build useful debuginfo subpackages


author: Tomas Mraz <tmraz@redhat.com>
changelog:
- change permissions on pam.d/sshd to 0644 (#64697)
- patch initscript so it doesn't kill opened sessions if
  the sshd daemon isn't running anymore (#67624)


author: Tomas Mraz <tmraz@redhat.com> 3.9p1-10
changelog:
- enable trusted forwarding by default if X11 forwarding is 
  required by user (#137685 and duplicates)
- disable protocol 1 support by default in sshd server config (#88329)
- keep the gnome-askpass dialog above others (#69131)


author: Tomas Mraz <tmraz@redhat.com> 3.9p1-11
changelog:
- don't call syslog in signal handler
- allow password authentication when copying from remote
  to remote machine (#103364)


author: Tomas Mraz <tmraz@redhat.com> 4.0p1-2
changelog:
- fixed Local/RemoteForward in ssh_config.5 manpage
- fix fatal when Local/RemoteForward is used and scp run (#153258)
- don't leak user validity when using krb5 authentication


author: Tomas Mraz <tmraz@redhat.com> 4.1p1-3
changelog:
- fix small regression caused by the nologin patch (#161956)
- fix race in getpeername error checking (mindrot #1054)


author: Tomas Mraz <tmraz@redhat.com> 4.1p1-4
changelog:
- don't deadlock on exit with multiple X forwarded channels (#152432)
- don't use X11 port which can't be bound on all IP families (#163732)


author: Tomas Mraz <tmraz@redhat.com> 4.1p1-5
changelog:
- use x11-ssh-askpass if openssh-askpass-gnome is not installed (#165207)
- install ssh-copy-id from contrib (#88707)


author: Tomas Mraz <tmraz@redhat.com> 4.2p1-2
changelog:
- use include instead of pam_stack in pam config
- use fork+exec instead of system in scp - CVE-2006-0225 (#168167)
- upstream patch for displaying authentication errors


author: Warren Togami <wtogami@redhat.com> - 4.2p1-7
changelog:
- xorg-x11-devel -> libXt-devel
- rebuild for new xauth location so X forwarding works
- buildreq audit-libs-devel
- buildreq automake for aclocal
- buildreq imake for xmkmf
-  -D_GNU_SOURCE in flags in order to get it to build
   Ugly hack to workaround openssh defining __USE_GNU which is
   not allowed and causes problems according to Ulrich Drepper
   fix this the correct way after FC5test1


author: Nalin Dahyabhai <nalin@redhat.com> - 4.2p1-8
changelog:
- work around missing gccmakedep by wrapping makedepend in a local script
- remove now-obsolete build dependency on "xauth"


author: Tomas Mraz <tmraz@redhat.com> - 4.2p1-9
changelog:
- drop x11-ssh-askpass from the package
- drop old build_6x ifs from spec file
- improve gnome-ssh-askpass so it doesn't reveal number of passphrase 
  characters to person looking at the display
- less hackish fix for the __USE_GNU problem


author: Tomas Mraz <tmraz@redhat.com> - 4.3p1-2
changelog:
- fixed another place where syslog was called in signal handler
- pass locale environment variables to server, accept them there (#179851)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-3
changelog:
- enable the subprocess in chroot to send messages to system log
- sshd should prevent login if audit call fails


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-6
changelog:
- improve selinux patch (by Jan Kiszka)
- upstream patch for buffer append space error (#191940)
- fixed typo in configure.ac (#198986)
- added pam_keyinit to pam configuration (#198628)
- improved error message when askpass dialog cannot grab
  keyboard input (#198332)
- buildrequires xauth instead of xorg-x11-xauth
- fixed a few rpmlint warnings


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-7
changelog:
- dropped old ssh obsoletes
- call the pam_session_open/close from the monitor when privsep is
  enabled so it is always called as root (patch by Darren Tucker)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-8
changelog:
- drop the pam-session patch from the previous build (#201341)
- don't set IPV6_V6ONLY sock opt when listening on wildcard addr (#201594)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-9
changelog:
- don't report duplicate syslog messages, use correct local time (#189158)
- don't allow spnego as gssapi mechanism (from upstream)
- fixed memleaks found by Coverity (from upstream)
- allow ip options except source routing (#202856) (patch by HP)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-10
changelog:
- improve gssapi-no-spnego patch (#208102)
- CVE-2006-4924 - prevent DoS on deattack detector (#207957)
- CVE-2006-5051 - don't call cleanups from signal handler (#208459)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-11
changelog:
- merge sshd initscript patches
- kill all ssh sessions when stop is called in halt or reboot runlevel
- remove -TERM option from killproc so we don't race on sshd restart


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-13
changelog:
- improved pam_session patch so it doesn't regress, the patch is necessary
  for the pam_session_close to be called correctly as uid 0


author: Tomas Mraz <tmraz@redhat.com> - 4.5p1-2
changelog:
- support mls on labeled networks (#220487)
- support mls level selection on unlabeled networks
- allow / in usernames in scp (only beginning /, ./, and ../ is special)


author: Tomas Mraz <tmraz@redhat.com> - 4.5p1-8
changelog:
- fix sftp client problems on write error (#247802)
- allow disabling autocreation of server keys (#235466)


author: Tomas Mraz <tmraz@redhat.com> - 4.7p1-1
changelog:
- upgrade to latest upstream
- use libedit in sftp (#203009)
- fixed audit log injection problem (CVE-2007-3102)


author: Tomas Mraz <tmraz@redhat.com> - 4.7p1-4
changelog:
- do not copy /etc/localtime into the chroot as it is not
  necessary anymore (#193184)
- call setkeycreatecon when selinux context is established
- test for NULL privk when freeing key (#391871) - patch by
  Pierre Ossman


author: Tomas Mraz <tmraz@redhat.com> - 4.7p1-9
changelog:
- set FD_CLOEXEC on client socket
- apply real fix for window size problem (#286181) from upstream
- apply fix for the spurious failed bind from upstream
- apply open handle leak in sftp fix from upstream


author: Tomas Mraz <tmraz@redhat.com> - 4.7p1-10
changelog:
- fix race on control master and cleanup stale control socket (#436311)
  patches by David Woodhouse


author: Tomas Mraz <tmraz@redhat.com> - 5.0p1-1
changelog:
- upgrade to new upstream (#441066)
- prevent initscript from killing itself on halt with upstart (#438449)
- initscript status should show that the daemon is running
  only when the main daemon is still alive (#430882)


author: Tomas Mraz <tmraz@redhat.com> - 5.0p1-2
changelog:
- add LANGUAGE to accepted/sent environment variables (#443231)
- use pam_selinux to obtain the user context instead of doing it itself
- unbreak server keep alive settings (patch from upstream)
- small addition to scp manpage


author: Tomas Mraz <tmraz@redhat.com> - 5.1p1-1
changelog:
- upgrade to new upstream release
- fixed a problem with public key authentication and explicitely
  specified SELinux role


author: Tomas Mraz <tmraz@redhat.com> - 5.1p1-4
changelog:
- set FD_CLOEXEC on channel sockets (#475866)
- adjust summary
- adjust nss-keys patch so it is applicable without selinux patches (#470859)


author: Tomas Mraz <tmraz@redhat.com> - 5.1p1-5
changelog:
- remove obsolete --with-rsh (#478298)
- add pam_sepermit to allow blocking confined users in permissive mode
  (#471746)
- move system-auth after pam_selinux in the session stack


author: Jan F. Chadima <jchadima@redhat.com> - 5.2p1-20
changelog:
- merged xmodifiers to redhat patch
- merged gssapi-role to selinux patch
- merged cve-2007_3102 to audit patch
- sesftp patch only with WITH_SELINUX flag
- rearange sesftp patch according to upstream request


author: Jan F. Chadima <jchadima@redhat.com> - 5.2p1-28
changelog:
- Repair initscript to be acord to guidelines (#521860)
- Add bugzilla# to application of edns and xmodifiers patch


author: Jan F. Chadima <jchadima@redhat.com> - 5.5p1-10 + 0.9.2-26
changelog:
- Repair the reference in man ssh-ldap-helper(8)
- Repair the PubkeyAgent section in sshd_config(5)
- Provide example ldap.conf


author: Jan F. Chadima <jchadima@redhat.com> - 5.6p1-20 + 0.9.2-29
changelog:
- reapair clientloop crash (#627332)
- properly restore euid in case connect to the ssh-agent socket fails


author: Jan F. Chadima <jchadima@redhat.com> - 5.8p1-18 + 0.9.2-30
changelog:
- add periodical reseeding of random generator 
- change selinux contex for internal sftp in do_usercontext
- exit(0) after sigterm


author: Jan F. Chadima <jchadima@redhat.com> - 5.8p1-20 + 0.9.2-30
changelog:
- use /dev/random or /dev/urandom for seeding prng
- improve periodical reseeding of random generator


author: Jan F. Chadima <jchadima@redhat.com> - 5.8p2-12 + 0.9.2-31
changelog:
- Systemd compatibility according to Mathieu Bridon <bochecha@fedoraproject.org>
- Split out the host keygen into their own command, to ease future migration
  to systemd. Compatitbility with the init script was kept.
- Migrate the package to full native systemd unit files, according to the Fedora
  packaging guidelines.
- Prepate the unit files for running an ondemand server. (do not add it actually)


author: Tomas Mraz <tmraz@redhat.com> - 5.9p1-11 + 0.9.2-32
changelog:
- remove unnecessary requires on initscripts
- set VerifyHostKeyDNS to ask in the default configuration (#739856)


author: Tomas Mraz <tmraz@redhat.com> - 5.9p1-12 + 0.9.2-32
changelog:
- still support /etc/sysconfig/sshd loading in sshd service (#754732)
- fix incorrect key permissions generated by sshd-keygen script (#754779)


author: Tomas Mraz <tmraz@redhat.com> - 5.9p1-13 + 0.9.2-32
changelog:
- add back the restorecon call to ssh-copy-id - it might be needed on older
  distributions (#739989)


author: Petr Lautrbach <plautrba@redhat.com> 5.9p1-18 + 0.9.2-32
changelog:
- replace TwoFactorAuth with RequiredAuthentications[12]
  https://bugzilla.mindrot.org/show_bug.cgi?id=983


author: Tomas Mraz <tmraz@redhat.com> 5.9p1-23 + 0.9.3-1
changelog:
- fix segfault in su when pam_ssh_agent_auth is used and the ssh-agent
  is not running, most probably not exploitable
- update pam_ssh_agent_auth to 0.9.3 upstream version


author: Petr Lautrbach <plautrba@redhat.com> 6.1p1-1 + 0.9.3-3
changelog:
- new upstream release (#852651)
- use DIR: kerberos type cache (#848228)
- don't use chroot_user_t for chrooted users (#830237)
- replace scriptlets with systemd macros (#850249)
- don't use /bin and /sbin paths (#856590)


author: Petr Lautrbach <plautrba@redhat.com> 6.1p1-2
changelog:
- add SELinux comment to /etc/ssh/sshd_config about SELinux command to modify port (#861400)
- drop required chkconfig (#865498)
- drop openssh-5.9p1-sftp-chroot.patch (#830237)


author: Petr Lautrbach <plautrba@redhat.com> 6.1p1-3 + 0.9.3-3
changelog:
- replace RequiredAuthentications2 with AuthenticationMethods based on upstream
- obsolete RequiredAuthentications[12] options
- fix openssh-6.1p1-privsep-selinux.patch


author: Petr Lautrbach <plautrba@redhat.com> 6.2p1-2 + 0.9.3-4
changelog:
- keep track of which IndentityFile options were manually supplied and
  which were default options, and don't warn if the latter are missing.
  (mindrot#2084)


author: Petr Lautrbach <plautrba@redhat.com> 6.2p1-3 + 0.9.3-4
changelog:
- sshd.service: use KillMode=process (#890376)
- add latest config.{sub,guess} to support aarch64 (#926284)


author: Petr Lautrbach <plautrba@redhat.com> 6.2p2-4 + 0.9.3-5
changelog:
- don't show Success for EAI_SYSTEM (#985964)
- make sftp's libedit interface marginally multibyte aware (#841771)


author: Petr Lautrbach <plautrba@redhat.com> 6.2p2-7 + 0.9.3-5
changelog:
- use hmac_suffix for ssh{,d} hmac checksums
- bump the minimum value of SSH_USE_STRONG_RNG to 14 according to SP800-131A
- automatically restart sshd.service on-failure after 42s interval


author: Petr Lautrbach <plautrba@redhat.com> 6.2p2-8 + 0.9.3-5
changelog:
- sshd-keygen: generate only RSA keys by default (#1010361)
- use dist tag in suffixes for hmac checksum files


author: Petr Lautrbach <plautrba@redhat.com> 6.2p2-9 + 0.9.3-5
changelog:
- use dracut-fips package to determine if a FIPS module is installed (#1001566)
- revert -fips subpackages and hmac files suffixes


author: Petr Lautrbach <plautrba@redhat.com> 6.3p1-2 + 0.9.3-6
changelog:
- use default_ccache_name from /etc/krb5.conf for a kerberos cache (#991186)
- increase the size of the Diffie-Hellman groups (#1010607)
- sshd-keygen to generate ECDSA keys <i.grok@comcast.net> (#1019222)


author: Petr Lautrbach <plautrba@redhat.com> 6.3p1-4 + 0.9.3-7
changelog:
- adjust gss kex mechanism to the upstream changes (#1024004)
- don't use xfree in pam_ssh_agent_auth sources <geertj@gmail.com> (#1024965)


author: Petr Lautrbach <plautrba@redhat.com> 6.4p1-2 + 0.9.3-1
changelog:
- fix fatal() cleanup in the audit patch (#1029074)
- fix parsing logic of ldap.conf file (#1033662)


author: Petr Lautrbach <plautrba@redhat.com> 6.4p1-3 + 0.9.3-8
changelog:
- sshd-keygen - use correct permissions on ecdsa host key (#1023945)
- use only rsa and ecdsa host keys by default


author: Petr Lautrbach <plautrba@redhat.com> 6.4p1-5 + 0.9.3-8
changelog:
- use tty allocation for a remote scp (#985650)
- run ssh-copy-id in the legacy mode when SSH_COPY_ID_LEGACY variable is set (#969375)
- FIPS mode - adjust the key echange DH groups and ssh-keygen according toSP800-131A (#1001748)


author: Petr Lautrbach <plautrba@redhat.com> 6.4p1-7 + 0.9.3-8
changelog:
- log fipscheck verification message into syslog authpriv
- ssh-keygen - relative-specified certificate expiry time should be relative
  to current time and not the validity start time (#1058234)
- use the size of security of 3des for DH (#1053107)
- ssh-copy-id.1 man page fix (#1058792)


author: Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-1 + 0.9.3-9
changelog:
- new upstream release (#1059667)
- prevent a server from skipping SSHFP lookup - CVE-2014-2653 (#1081338)
- make /etc/ssh/moduli file public (#1134448)
- test existence of /etc/ssh/ssh_host_ecdsa_key in sshd-keygen.service
- don't clean up gssapi credentials by default (#1134447)
- ssh-agent - try CLOCK_BOOTTIME with fallback (#1134449)
- disable the curve25519 KEX when speaking to OpenSSH 6.5 or 6.6
- add support for ED25519 keys to sshd-keygen and sshd.sysconfig
- standardise on NI_MAXHOST for gethostname() string lengths (#1097665)
- set a client's address right after a connection is set (mindrot#2257) (#912792)
- apply RFC3454 stringprep to banners when possible (mindrot#2058) (#1104662)
- don't consider a partial success as a failure (mindrot#2270) (#1112972)


author: Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-2 + 0.9.3-9
changelog:
- slightly change systemd units logic - use sshd-keygen.service (#1066615)
- log when a client requests an interactive session and only sftp is allowed (#1130198)
- sshd-keygen - don't generate DSA and ED25519 host keys in FIPS mode (#1143867)


author: Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-4 + 0.9.3-9
changelog:
- revert the default of KerberosUseKuserok back to yes
- fix kuserok patch which checked for the existence of .k5login unconditionally
  and hence prevented other mechanisms to be used properly


author: Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-8 + 0.9.3-9
changelog:
- increase size of AUDIT_LOG_SIZE to 256 (#1171163)
- record pfs= field in CRYPTO_SESSION audit event (#1171248)


author: Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-10 + 0.9.3-9
changelog:
- add new option GSSAPIEnablek5users and disable using ~/.k5users by default CVE-2014-9278
  (#1169843)


author: Jakub Jelen <jjelen@redhat.com> 6.6.1p1-13 + 0.9.3-9
changelog:
- Increase limit of files for glob match in sftp (#1160377)
- Add pam_reauthorize.so to /etc/pam.d/sshd (#1204233)
- Show all config values in sshd test mode (#1187597)
- Document required selinux boolean for working ssh-ldap-helper (#1178116)
- Consistent usage of pam_namespace in sshd (#1125110)
- Fix auditing when using combination of ForcedCommand and PTY (#1199112)
- Add sftp option to force mode of created files (#1197989)
- Ability to specify an arbitrary LDAP filter in ldap.conf for ssh-ldap-helper (#1201753)
- Provide documentation line for systemd service and socket (#1181591)
- Provide LDIF version of LPK schema (#1184938)
- Document TERM environment variable (#1162683)
- Fix ssh-copy-id on non-sh remote shells (#1201758)
- Do not read RSA1 hostkeys for HostBased authentication in FIPS (#1197666)


author: Jakub Jelen <jjelen@redhat.com> 6.6.1p1-14 + 0.9.3-9
changelog:
- Fix ldif schema to have correct spacing on newlines (#1184938)
- Add missing values for sshd test mode (#1187597)
- ssh-copy-id: tcsh doesnt work with multiline strings (#1201758)
- Fix memory problems with newkeys and array transfers (#1223218)
- Enhance AllowGroups documentation in man page (#1150007)


author: Jakub Jelen <jjelen@redhat.com> 6.6.1p1-15 + 0.9.3-9
changelog:
- One more typo in manual page documenting TERM variable (#1162683)
- Fix race condition with auditing messages answers (#1240613)


author: Jakub Jelen <jjelen@redhat.com> 6.6.1p1-17 + 0.9.3-9
changelog:
- Security fixes released with openssh-6.9 (CVE-2015-5352) (#1247864)
 - XSECURITY restrictions bypass under certain conditions in ssh(1) (#1238231)
 - weakness of agent locking (ssh-add -x) to password guessing (#1238238)


author: Jakub Jelen <jjelen@redhat.com> 6.6.1p1-20 + 0.9.3-9
changelog:
- Fix vulnerabilities published with openssh-7.0 (#1265807)
 - Privilege separation weakness related to PAM support
 - Use-after-free bug related to PAM support


author: Jakub Jelen <jjelen@redhat.com> 6.6.1p1-23 + 0.9.3-9
changelog:
- Disable undocumented feauture Roaming for good (#1298218)
- prevents CVE-2016-0777 and CVE-2016-0778


author: Jakub Jelen <jjelen@redhat.com> 6.6.1p1-26 + 0.9.3-9
changelog:
- Drop glob patch for sftp client preventing listing many files (#1310303)
- Fix race condition between audit messages from different processes (#1310684)
- Make systemd service forking to properly report state (#1291172)
- Get rid of rpm triggers for openssh-5.x (#1312013)
- Generate the host keys when the key files are empty (#1266043)
- pam_ssh_agent_auth: authorized_keys_command option (#1317858)
- Don't use MD5 digest from pam_ssh_agent_auth in FIPS mode (#1317952)


author: Jakub Jelen <jjelen@redhat.com> - 6.6.1p1-27 + 0.9.3-9
changelog:
- Coverity and RPMDiff build issues (#1334326)
- CVE-2015-8325: privilege escalation via user's PAM environment and UseLogin=yes (#1329191)
- Check for real location of .k5login file (#1328243)
- close ControlPersist background process stderr (#1335540)


author: Jakub Jelen <jjelen@redhat.com> - 6.6.1p1-28 + 0.9.3-9
changelog:
- SFTP force permission collision with umask (#1344614)
- Make closefrom() ignore FD's to /dev/ devices on s390 (#1318760)
- Create a default value for AuthenticationMethods any (#1237129)
- Fix ssh-copy-id with LogLevel=quiet (#1349556)
- Expose more information to PAM (#1312304)
- Move MAX_DISPLAYS to a configuration option (#1341302)
- Add a wildcard option to PermitOpen directive (host) (#1344106)


author: Jakub Jelen <jjelen@redhat.com> - 7.4p1-1 + 0.10.3-1
changelog:
- Rebase to openssh 7.4 and pam_ssh_agent_auth 0.10.3 (#1341754)
- detach -cavs subpackage
- enable seccomp filter for sandboxed child


author: Jakub Jelen <jjelen@redhat.com> - 7.4p1-2 + 0.10.3-1
changelog:
- Fix coverity scan results
- Adjust FIPS algorithms list (#1420910)
- Revert problematic feature for chroot(#1418062)
- Fix CBC weakness in released OpenSSH 7.5


author: Jakub Jelen <jjelen@redhat.com> - 7.4p1-3 + 0.10.3-1
changelog:
- Do not completely disable SHA-1 key exchange methods in FIPS (#1324493)
- Remove wrong coverity patches


author: Jakub Jelen <jjelen@redhat.com> - 7.4p1-5 + 0.10.3-1
changelog:
- Fix the default key exchange proposal in FIPS mode (#1438414)
- Remove another wrong coverity chunk to unbreak gsskex (#1438414)


author: Jakub Jelen <jjelen@redhat.com> - 7.4p1-15 + 0.10.3-2
changelog:
- Do not hang if SSH AuthorizedKeysCommand output is too large (#1496467)
- Do not segfault pam_ssh_agent_auth if keyfile is missing (#1494268)
- Do not segfault in audit code during cleanup (#1488083)
- Add WinSCP 5.10+ compatibility (#1496808)
- Clatch between ClientAlive and rekeying timeouts (#1480510)
- Exclude dsa and ed25519 from default proposed keys in FIPS mode (#1456853)
- Add enablement for openssl-ibmca and openssl-ibmpkcs11 (#1478035)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-17
changelog:
- use SHA-256 in FIPS RSA pairwise key check
- fix CVE-2018-5407 (and CVE-2018-0735) - EC signature local
  timing side-channel key extraction


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-18
changelog:
- fix CVE-2018-0734 - DSA signature local timing side channel
- fix CVE-2019-1559 - 0-byte record padding oracle
- close the RSA decryption One & done EM side channel (#1619558)


author: Sahana Prasad <sahana@redhat.com> 1.0.2k-22
changelog:
- fix CVE-2021-23841 openssl: NULL pointer dereference
  in X509_issuer_and_serial_hash()
- fix CVE-2021-23840 openssl: integer overflow in CipherUpdate
- Resolves: rhbz#1932132, rhbz#1932126


author: Sahana Prasad <sahana@redhat.com> 1.0.2k-23
changelog:
- fixes CVE-2021-3712 openssl: Read buffer overruns processing ASN.1 strings
- Resolves: rhbz#1996054


author: Sahana Prasad <sahana@redhat.com> 1.0.2k-24
changelog:
- Updates patch openssl-1.0.2k-cve-2021-3712.patch to only free on push failure.
- Resolves: rhbz#2039993


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.0.2k-25
changelog:
- Fixes CVE-2022-2078 Infinite loop in BN_mod_sqrt() reachable when parsing certificates
- Related: rhbz#2067160


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 1:1.0.2k-26.tuxcare.els1
changelog:
- CVE-2022-1292: c_rehash: Do not use shell to invoke openssl to prevent
  command injection
- CVE-2022-2068: c_rehash: Fix file operations to prevent command injection
- Update expired smime certificates
- Add testing using old certificates (sha1) to have both types of
  certificates (sha1, sha256) checked with S/MIME


author: Dmitriy Popov <dpopov@cloudlinux.com> - 1:1.0.2k-26.tuxcare.els2
changelog:
- CVE-2023-0215: bio_ndef: fix a UAF resulting from a bug in BIO_new_NDEF
- CVE-2023-0464: x509v3: Limit X.509 certificate tree size to avoid exponential
  use of computational resources


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 1:1.0.2k-26.tuxcare.els3
changelog:
- Backport the implicit rejection mechanism for RSA PKCS#1 v1.5 to
  prevent Bleichenbacher attacks; add an option to disable the mechanism


author: Koba Karaputadze <kkaraputadze@cloudlinux.com> - 1:1.0.2k-26.tuxcare.els6
changelog:
- CVE-2019-1547: fix side-channel vulnerability in ECDSA when using explicit
  EC parameters without cofactor
- CVE-2025-9230: fix incorrect check of unwrapped key size


author: Andrija Jokanovic <ajokanovic@cloudlinux.com> - 1:1.0.2k-26.tuxcare.els8
changelog:
- CVE-2026-28389: fix NULL pointer dereference in dh_cms_set_shared_info and
  ecdh_cms_set_shared_info when the CMS KeyEncryptionAlgorithmIdentifier
  parameter field is omitted


author: Andrija Jokanovic <ajokanovic@cloudlinux.com> - 1:1.0.2k-26.tuxcare.els9
changelog:
- CVE-2026-28390: fix NULL pointer dereference in rsa_cms_decrypt() when CMS
  RSA-OAEP pSourceFunc is missing its parameter


author: Andrija Jokanovic <ajokanovic@cloudlinux.com> - 1:1.0.2k-26.tuxcare.els10
changelog:
- CVE-2026-28388: fix NULL pointer dereference in check_delta_base() when delta
  CRL lacks CRL Number extension


author: Robert Scheck <robert@fedoraproject.org> 1.1.1c-2
changelog:
- backport from 1.1.1c-15: add selftest of the RAND_DRBG implementation
- backport from 1.1.1c-14: fix incorrect error return value from FIPS_selftest_dsa
- backport from 1.1.1c-14: S390x: properly restore SIGILL signal handler
- backport from 1.1.1c-12: additional fix for the edk2 build
- backport from 1.1.1c-9: disallow use of SHA-1 signatures in TLS in FIPS mode
- backport from 1.1.1c-8: fix CVE-2019-1547 - side-channel weak encryption vulnerability
- backport from 1.1.1c-8: fix CVE-2019-1563 - padding oracle in CMS API
- backport from 1.1.1c-8: fix CVE-2019-1549 - ensure fork safety of the DRBG
- backport from 1.1.1c-8: fix handling of non-FIPS allowed EC curves in FIPS mode
- backport from 1.1.1c-8: fix TLS compliance issues
- backport from 1.1.1c-7: backported ARM performance fixes from master
- backport from 1.1.1c-6: backport of S390x ECC CPACF enhancements from master
- backport from 1.1.1c-6: FIPS mode: properly disable 1024 bit DSA key generation
- backport from 1.1.1c-6: FIPS mode: skip ED25519 and ED448 algorithms in openssl speed
- backport from 1.1.1c-6: FIPS mode: allow AES-CCM ciphersuites
- backport from 1.1.1c-5: make the code suitable for edk2 build
- backport from 1.1.1c-4: backport of SSKDF from master
- backport from 1.1.1c-3: backport of KBKDF and KRB5KDF from master


author: Robert Scheck <robert@fedoraproject.org> 1.1.1g-1
changelog:
- backport from 1.1.1g-11: Further changes for SP 800-56A rev3 requirements
- backport from 1.1.1g-9: Rewire FIPS_drbg API to use the RAND_DRBG
- backport from 1.1.1g-9: Use the well known DH groups in TLS even for 2048 and 1024 bit parameters
- backport from 1.1.1g-7: Disallow dropping Extended Master Secret extension on renegotiation
- backport from 1.1.1g-7: Return alert from s_server if ALPN protocol does not match
- backport from 1.1.1g-7: SHA1 is allowed in @SECLEVEL=2 only if allowed by TLS SigAlgs configuration
- backport from 1.1.1g-6: Add FIPS selftest for PBKDF2 and KBKDF
- backport from 1.1.1g-5: Allow only well known DH groups in the FIPS mode
- backport from 1.1.1g-1: update to the 1.1.1g release
- backport from 1.1.1g-1: FIPS module installed state definition is modified


author: Robert Scheck <robert@fedoraproject.org> 1.1.1g-2
changelog:
- backport from 1.1.1g-12: Fix CVE-2020-1971 ediparty null pointer dereference
- backport from 1.1.1g-11.1: Implemented new FIPS requirements in regards to KDF and DH selftests
- backport from 1.1.1g-11.1: Disallow certificates with explicit EC parameters


author: Robert Scheck <robert@fedoraproject.org> 1.1.1g-3
changelog:
- backport from 1.1.1g-15: version bump
- backport from 1.1.1g-14: CVE-2021-3450 openssl: CA certificate check bypass with X509_V_FLAG_X509_STRICT
- backport from 1.1.1g-13: Fix CVE-2021-3449 NULL pointer deref in signature_algorithms processing


author: Robert Scheck <robert@fedoraproject.org> 1.1.1k-1
changelog:
- backport from 1.1.1k-4: Fixes bugs in s390x AES code
- backport from 1.1.1k-4: Uses the first detected address family if IPv6 is not available
- backport from 1.1.1k-4: Reverts the changes in https://github.com/openssl/openssl/pull/13305
  as it introduces a regression if server has a DSA key pair, the handshake fails
  when the protocol is not explicitly set to TLS 1.2. However, if the patch is reverted,
  it has an effect on the "ssl_reject_handshake" feature in nginx. Although, this feature
  will continue to work, TLS 1.3 protocol becomes unavailable/disabled. This is already
  known - https://trac.nginx.org/nginx/ticket/2071#comment:1
  As per https://github.com/openssl/openssl/issues/16075#issuecomment-879939938, nginx could
  early callback instead of servername callback. Resolves: rhbz#197821, related: rhbz#1934534
- backport from 1.1.1k-3: Cleansup the peer point formats on renegotiation. Resolves rhbz#1965362
- backport from 1.1.1k-2: Fixes FIPS_selftest to work in FIPS mode. Resolves: rhbz#1940085
- backport from 1.1.1k-2: Using safe primes for FIPS DH self-test
- backport from 1.1.1k-1: Update to version 1.1.1k
- backport from 1.1.1g-16: Use AI_ADDRCONFIG only when explicit host name is given
- backport from 1.1.1g-16: Allow only curves defined in RFC 8446 in TLS 1.3


author: Robert Scheck <robert@fedoraproject.org> 1.1.1k-2
changelog:
- backport from 1.1.1k-5: CVE-2021-3712 openssl: Read buffer overruns processing ASN.1 strings
  Resolves: rhbz#2005402


author: Robert Scheck <robert@fedoraproject.org> 1.1.1k-3
changelog:
- backport from 1.1.1k-6: CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  Resolves: rhbz#2067146


author: Robert Scheck <robert@fedoraproject.org> 1.1.1k-4
changelog:
- backport from 1.1.1k-7: CVE-2022-2097: AES OCB fails to encrypt some bytes on 32-bit x86
  Resolves: CVE-2022-2097
- backport from 1.1.1k-7: Update expired certificates used in the testsuite
  Resolves: rhbz#2092462
- backport from 1.1.1k-7: CVE-2022-1292: openssl: c_rehash script allows command injection
  Resolves: rhbz#2090372
- backport from 1.1.1k-7: CVE-2022-2068: the c_rehash script allows command injection
  Resolves: rhbz#2098279


author: Robert Scheck <robert@fedoraproject.org> 1.1.1k-5
changelog:
- backport from 1.1.1k-9: Fixed Timing Oracle in RSA Decryption
  Resolves: CVE-2022-4304
- backport from 1.1.1k-9: Fixed Double free after calling PEM_read_bio_ex
  Resolves: CVE-2022-4450
- backport from 1.1.1k-9: Fixed Use-after-free following BIO_new_NDEF
  Resolves: CVE-2023-0215
- backport from 1.1.1k-9: Fixed X.400 address type confusion in X.509 GeneralName
  Resolves: CVE-2023-0286
- backport from 1.1.1k-8: Fix no-ec build
  Resolves: rhbz#2071020


author: Robert Scheck <robert@fedoraproject.org> 1.1.1k-6
changelog:
- backport from 1.1.1k-11: Fix CVE-2023-5678: Generating excessively long X9.42 DH keys or checking
  excessively long X9.42 DH keys or parameters may be very slow
  Resolves: RHEL-16538
- backport from 1.1.1k-10: Fix CVE-2023-3446: Excessive time spent checking DH keys and parameters
  Resolves: RHEL-14245
- backport from 1.1.1k-10: Fix CVE-2023-3817: Excessive time spent checking DH q parameter value
  Resolves: RHEL-14239


author: Robert Scheck <robert@fedoraproject.org> 1.1.1k-7
changelog:
- backport from 1.1.1k-12: Backport implicit rejection mechanism for RSA PKCS#1 v1.5 to RHEL-8 series
  (a proper fix for CVE-2020-25659). Resolves: RHEL-17696


author: Wim Taymans <wtaymans@redhat.com> - 0.4.22-2
changelog:
- Don't run tests during build
- add new source
- remove old patches, add new patch
- Resolves: #1174391


author: Wim Taymans <wtaymans@redhat.com> - 0.4.22-5
changelog:
- Run backup functions on s390x instead of emulation
- Fix load of parameters smaller than 64 bits
- Related: rhbz#1249506


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 0.4.26-1.tuxcare.els1
changelog:
- CVE-2024-40897: fix stack buffer overflow while construct error messages
- Disable gtk-doc building due lack of gtkdoc-mktmpl command in gtk-doc-1.28-2.el7


author: Tomáš Mráz <tmraz@redhat.com> 1.1.8-14
changelog:
- pam_unix: add no_pass_expiry option for ignoring password
  expiration in crond and sshd with public key authentication
- add manual page for environment(5) (#1110257)
- pam_loginuid: log if auditd not detected
- always ignore audit error when -EPERM is returned (#1287800)
- pam_lastlog: fix possible NULL dereference when localtime fails (#1313537)


author: Tomáš Mráz <tmraz@redhat.com> 1.1.8-19
changelog:
- pam_access: (group) match syntax is prioritized over network@netgroup
  match (#1358881), add support for additional /etc/security/access.d/*.conf
  files, improve documentation (#1421735)
- pam_lastlog: fix pt_BR translation (#1185697)
- pam_faillock: support admin_group with users equivalent to root in
  faillock handling (#1285550)


author: Tomáš Mráz <tmraz@redhat.com> 1.1.8-23
changelog:
- pam_get_authtok_verify: ensure no double verification happens
- manual page fixes for pam_tty_audit and pam_wheel
- pam_unix: lower the excessive maximum number of closed fd descriptors
  when spawning handlers
- pam_loginuid: do not prevent login in unprivileged containers


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> 1.1.8-23.0.1.tuxcare.els1
changelog:
- CVE-2024-10041: fix possibility of leakage of secret information
  stored in memory
- CVE-2024-22365: fix potential DoS via mkfifo because the openat
  call lacks O_DIRECTORY


author: Petr Pisar <ppisar@redhat.com> - 10.22-7
changelog:
- Fix pcre2-config --libs-posix output (upstream bug #1924)
- Fix a memory leak and a typo in a documentation (upstream bug #1973)
- Fix a buffer overflow in partial match test for CRLF in an empty buffer
  (upstream bug #1975)
- Fix a crash in pcre2test when displaying a wide character with a set locate
  (upstream bug #1976)


author: Petr Pisar <ppisar@redhat.com> - 10.22-8
changelog:
- Fix a crash when doing an extended substitution for \p, \P, or \X
  (upstream bug #1977)
- Fix a crash in substitution if starting offest was specified beyond the
  subject end (upstream bug #1992)


author: Petr Pisar <ppisar@redhat.com> - 10.23-2
changelog:
- Handle memmory allocation failures in pcre2test tool
- Fix a crash when finding a Unicode property for a character with a code
  point greater than 0x10ffff in UTF-32 library while UTF mode is disabled
  (upstream bug #2052)


author: Bartosz Staszewski <bstaszewski@cloudlinux.com> - 10.23-2.el7.tuxcare.els1
changelog:
- CVE-2022-1586: fix out-of-bounds read in JIT compile_xclass_matchingpath
- CVE-2022-41409: diagnose negative repeat value in pcre2test


author: Tom "spot" Callaway <tcallawa@redhat.com> - 4:5.10.0-1
changelog:
- 5.10.0 final
- clear out all the unnecessary patches (down to 8 patches!)
- get rid of super perl debugging mode
- add new subpackages


author: Tom "spot" Callaway <tcallawa@redhat.com> - 4:5.10.0-4
changelog:
- create %{_prefix}/lib/perl5/vendor_perl/%{perl_version}/auto and own it
  in base perl (resolves bugzilla 214580)


author: Tom "spot" Callaway <tcallawa@redhat.com> - 4:5.10.0-5
changelog:
- disable some futime tests in t/io/fs.t because they started failing on x86_64
  in the Fedora builders, and no one can figure out why. :/


author: Stepan Kasal <skasal@redhat.com> - 4:5.10.0-7
changelog:
- Add perl-File-Temp provides/obsoletes/conflicts (#433836),
  reported by Bill McGonigle <bill@bfccomputing.com>
- escape the macros in Jan 30 entry


author: Tom "spot" Callaway <tcallawa@redhat.com> 4:5.10.0-12
changelog:
- conditionalize multilib patch report in patchlevel.h
- Update Archive::Extract to 0.26
- Update Module::Load::Conditional to 0.24


author: Tom "spot" Callaway <tcallawa@redhat.com> 4:5.10.0-19
changelog:
- fix CPANPLUS-Dist-Build Provides/Obsoletes (bz 437615)
- bump version on Module-CoreList subpackage


author: Tom "spot" Callaway <tcallawa@redhat.com> 4:5.10.0-20
changelog:
- create the vendor_perl/%{perl_version}/%{perl_archname}/auto directory 
  in %{_libdir} so we own it properly


author: Tom "spot" Callaway <tcallawa@redhat.com> 4:5.10.0-21
changelog:
- sparc64 fails two tests under mysterious circumstances. we need to get the
  rest of the tree moving, so we temporarily disable the tests on that arch.


author: Stepan Kasal <skasal@redhat.com> 4:5.10.0-26
changelog:
- make config parameter list consistent for 32bit and 64bit platforms,
  add config option -Dinc_version_list=none (#448735)
- use perl_archname consistently
- cleanup of usage of *_lib macros in %install


author: Marcela Maslanova <mmaslano@redhat.com> 4:5.10.0-33
changelog:
- 451078 update Test::Harness to 3.12 for more testing. Removed verbose 
test, new Test::Harness has possibly verbose output, but updated package
has a lot of features f.e. TAP::Harness. Carefully watched all new bugs 
related to tests!


author: Marcela Maslanova <mmaslano@redhat.com> 4:5.10.0-38
changelog:
- 455933 update to CGI-3.38
- fix fuzz problems (patch6)
- 217833 pos() function handle unicode characters correct


author: Stepan Kasal <skasal@redhat.com> 4:5.10.0-39.fc10
changelog:
- CGI.pm bug in exists() on tied param hash (#457085)
- move the enc2xs templates (../Encode/*.e2x) to -devel, (#456534)


author: Marcela Maslanova <mmaslano@redhat.com> 4:5.10.0-44.fc10
changelog:
- remove Tar.pm from Archive-Extract
- fix version of Test::Simple in spec
- update Test::Simple
- update Archive::Tar to 1.38


author: Stepan Kasal <skasal@redhat.com> - 4:5.10.0-46
changelog:
- also preserve the timestamp of AUTHORS; move the fix to the recode
  function, which is where the stamps go wrong


author: Marcela Mašláňová <mmaslano@redhat.com> 4:5.10.0-47.fc10
changelog:
- rt#33242, rhbz#459918. Segfault after reblessing objects in Storable.
- rhbz#465728 upgrade Simple::Pod to 3.07


author: Tom "spot" Callaway <tcallawa@redhat.com> - 4:5.10.0-51
changelog:
- to fix Fedora bz 473223, which is really perl bug #54186 (http://rt.perl.org/rt3//Public/Bug/Display.html?id=54186)
  we apply Changes 33640, 33881, 33896, 33897


author: Marcela Mašláňová <mmaslano@redhat.com> - 4:5.10.0-52
changelog:
- 295021 CVE-2007-4829 perl-Archive-Tar directory traversal flaws
- add another source for binary files, which test untaring links


author: Marcela Mašláňová <mmaslano@redhat.com> - 4:5.10.0-54
changelog:
- 455410 http://rt.perl.org/rt3/Public/Bug/Display.html?id=54934
  Attempt to free unreferenced scalar fiddling with the symbol table
  Keep the refcount of the globs generated by PerlIO::via balanced.


author: Stepan Kasal <skasal@redhat.com> - 4:5.10.0-60
changelog:
- remove compatibility obsolete sitelib directories
- use a better BuildRoot
- drop a redundant mkdir in %install
- call patchlevel.h only once; rm patchlevel.bak
- update modules Sys::Syslog, Module::Load::Conditional, Module::CoreList,
  Test::Harness, Test::Simple, CGI.pm (dropping the upstreamed patch),
  File::Path (that includes our perl-5.10.0-CVE-2008-2827.patch),
  constant, Pod::Simple, Archive::Tar, Archive::Extract, File::Fetch,
  File::Temp, IPC::Cmd, Time::HiRes, Module::Build, ExtUtils::CBuilder
- standardize the patches for updating embedded modules
- work around a bug in Module::Build tests bu setting TMPDIR to a directory
  inside the source tree


author: Tom "spot" Callaway <tcallawa@redhat.com> - 4:5.10.0-61
changelog:
- apply Change 34507: Fix memory leak in single-char character class optimization
- Reorder @INC, based on b9ba2fadb18b54e35e5de54f945111a56cbcb249
- fix Archive::Extract to fix test failure caused by tar >= 1.21
- Merge useful Debian patches


author: Stepan Kasal <skasal@redhat.com> - 4:5.10.0-66
changelog:
- fix CGI::escape for all strings (#472571)
- perl-CGI-t-util-58.patch: Do not distort lib/CGI/t/util-58.t
  http://rt.perl.org/rt3/Ticket/Display.html?id=64502


author: Stepan Kasal <skasal@redhat.com> - 4:5.10.0-74
changelog:
- fix generated .ph files so that they no longer cause warnings (#509676)
- remove PREREQ_FATAL from Makefile.PL's processed by miniperl
- update to latest Scalar-List-Utils (#507378)
- perl-skip-prereq.patch: skip more prereq declarations in Makefile.PL files


author: Chris Weyl <cweyl@alumni.drew.edu> - 4:5.10.0-82
changelog:
- update our Test-Simple update to 0.92 (patch by Iain Arnell), #519417
- update Module-Pluggable to 3.9


author: Stepan Kasal <skasal@redhat.com> - 4:5.10.0-87
changelog:
- fix patch-update-Compress-Raw-Zlib.patch (did not patch Zlib.pm)
- update Compress::Raw::Zlib to 2.023
- update IO::Compress::Base, and IO::Compress::Zlib to 2.015 (#542645)


author: Stepan Kasal <skasal@redhat.com> - 4:5.10.1-100
changelog:
- new upstream version
- release number must be high, because of stale version numbers of some
  of the subpackages
- drop upstreamed patches
- update the versions of bundled modules
- shorten the paths in @INC
- build without DEBUGGING
- implement compatibility measures for the above two changes, for a short
  transition period
- provide perl(:MODULE_COMPAT_5.10.0), for that transition period only


author: Marcela Mašláňová <mmaslano@redhat.com> - 4:5.10.1-109
changelog:
- 547656 CVE-2009-3626 perl: regexp matcher crash on invalid UTF-8 characters  
- 549306 version::Internals should be packaged in perl-version subpackage
- Parse-CPAN-Meta updated and separate package is dead


author: Paul Howarth <paul@city-fan.org> - 4:5.10.1-115
changelog:
- restore missing version macros for Compress::Raw::Zlib, IO::Compress::Base
  and IO::Compress::Zlib


author: Marcela Mašláňová <mmaslano@redhat.com> - 4:5.10.1-116
changelog:
- add noarch into correct sub-packages
- move Provides/Obsoletes into correct modules from main perl


author: Marcela Mašláňová <mmaslano@redhat.com> - 4:5.10.1-118
changelog:
- 463773 remove useless txt files from installation
- 575842 remove PERL_USE_SAFE_PUTENV, use perl putenv


author: Marcela Mašláňová <mmaslano@redhat.com> - 4:5.12.1-123
changelog:
- remove patch with debugging symbols, which should be now ok without it
- update to 5.12.1
- MODULE_COMPAT


author: Petr Pisar <ppisar@redhat.com> - 4:5.12.1-130
changelog:
- Run tests in parallel
- Add "-Wl,--enable-new-dtags" to linker to allow to override perl's rpath by
  LD_LIBRARY_PATH used in tests. Otherwise tested perl would link to old
  in-system libperl.so.
- Normalize spec file indentation


author: Petr Sabata <psabata@redhat.com> - 4:5.12.2-1
changelog:
- Update to 5.12.2
- Removed one hardcoded occurence of perl version in build process
- Added correct path to dtrace binary
- BuildRequires: systemtap-sdt-devel


author: Marcela Mašláňová <mmaslano@redhat.com> - 4:5.12.2-141
changelog:
- 643447 fix redefinition of constant C in h2ph (visible in git send mail,
  XML::Twig test suite)
- remove ifdef for s390


author: Marcela Mašláňová <mmaslano@redhat.com> - 4:5.14.0-161
changelog:
- test build of released 5.14.0
- remove Class::ISA from sub-packages
- patches 8+ are part of new release
- remove vendorarch/auto/Compress/Zlib


author: Marcela Mašláňová <mmaslano@redhat.com> - 4:5.14.0-169
changelog:
- filter even Mac:: requires, polish filter again for correct installation
- add sub-package Compress-Raw-Bzip2, solve Bzip2 conflicts after install
- and add IO::Uncompress::Bunzip2 correctly into IO-Compress


author: Marcela Mašláňová <mmaslano@redhat.com> - 4:5.14.0-170
changelog:
- try to update to latest ExtUtils::MakeMaker, no luck -> rebuild with current 
  version, fix bug RT#67618 in modules


author: Marcela Mašláňová <mmaslano@redhat.com> - 4:5.14.1-171
changelog:
- update to 5.14.1 - no new modules, just serious bugfixes and doc
- switch off fork test, which is failing only on koji


author: Marcela Mašláňová <mmaslano@redhat.com> - 4:5.14.1-178
changelog:
- update macros -> add %perl_bootstrap 1 and example for readability
- add into Module::Build dependency on perl-devel (contains macros.perl)
- create new sub-package macros, because we need macros in minimal buildroot


author: Iain Arnell <iarnell@gmail.com> 4:5.14.1-179
changelog:
- Parse-CPAN-Meta explicitly requires CPAN::Meta::YAML and JSON::PP
- Exclude CPAN::Meta* from CPAN sub-package
- Don't try to normalize CPAN-Meta, JSON-PP, and Parse-CPAN-Meta versions;
  their dual-life packages aren't and have much higher numbers already


author: Paul Howarth <paul@city-fan.org> - 4:5.14.1-182
changelog:
- Have perl-Module-Build explicitly require perl(CPAN::Meta) >= 2.110420,
  needed for creation of MYMETA files by Build.PL; the dual-life version of
  the package already has this dependency


author: Petr Pisar <ppisar@redhat.com> - 4:5.14.1-188
changelog:
- Make gdbm support optional to bootstrap with new gdbm
- Split Carp into standalone sub-package to dual-live with newer versions
  (bug #736768)


author: Petr Pisar <ppisar@redhat.com> - 4:5.14.1-189
changelog:
- Correct perl-CGI list of Provides
- Make tests optional
- Correct perl-ExtUtils-ParseXS Provides
- Correct perl-Locale-Codes Provides
- Correct perl-Module-CoreList version
- Automate perl-Test-Simple-tests Requires version


author: Petr Pisar <ppisar@redhat.com> - 4:5.14.2-193
changelog:
- 5.14.2 bump (see
  https://metacpan.org/module/FLORA/perl-5.14.2/pod/perldelta.pod for release
  notes).
- Fixes panics when processing regular expression with \b class and /aa
  modifier (bug #731062)
- Fixes CVE-2011-2728 (File::Glob bsd_glob() crash with certain glob flags)
  (bug #742987)


author: Petr Pisar <ppisar@redhat.com> - 4:5.14.2-195
changelog:
- Fix CVE-2011-3597 (code injection in Digest) (bug #743010)
- Sub-package Digest and thus Digest::MD5 module (bug #743247)


author: Petr Pisar <ppisar@redhat.com> - 4:5.14.2-196
changelog:
- Filter false perl(DynaLoader) provide from perl-ExtUtils-MakeMaker
  (bug #736714)
- Change Perl_repeatcpy() prototype to allow repeat count above 2^31
  (bug #720610)
- Do not own site directories located in /usr/local (bug #732799)


author: Marcela Mašláňová <mmaslano@redhat.com> - 4:5.14.2-197
changelog:
- cleaned spec (thanks to Grigory Batalov)
-  Module-Metadata sub-package contained perl_privlib instead of privlib
-  %files parent section was repeated twice


author: Petr Pisar <ppisar@redhat.com> - 4:5.14.2-205
changelog:
- Sub-package ExtUtils::Install
- Sub-package ExtUtils::Manifest
- Do not provide private perl(ExtUtils::MakeMaker::_version)


author: Petr Pisar <ppisar@redhat.com> - 4:5.14.2-207
changelog:
- Fix interrupted reading. Thanks to Šimon Lukašík for reporting this issue
  and thanks to Marcela Mašláňová for finding fix. (bug #767931)


author: Petr Pisar <ppisar@redhat.com> - 4:5.14.2-211
changelog:
- Fix searching for Unicode::Collate::Locale data (bug #756118)
- Run safe signal handlers before returning from sigsuspend() and pause()
  (bug #771228)
- Correct perl-Scalar-List-Utils files list
- Stop !$^V from leaking (bug #787613)


author: Marcela Mašláňová <mmaslano@redhat.com> - 4:5.16.0-RC2-217
changelog:
- clean patches, not needed with new version
- regen by podcheck list of failed pods. cn, jp, ko pods failed. I can't decide
  whether it's a real problem or false positives.


author: Paul Howarth <paul@city-fan.org> 4:5.16.0-226
changelog:
- Move the rest of ExtUtils-ParseXS into its sub-package, so that the main
  perl package doesn't need to pull in perl-devel (bug #839953)


author: Jitka Plesnikova <jplesnik@redhat.com> 4:5.16.1-228
changelog:
- 5.16.1 bump (see
  http://search.cpan.org/dist/perl-5.16.1/pod/perldelta.pod for release
  notes)
- Fixed reopening by scalar handle (bug #834221)
- Fixed tr/// multiple transliteration (bug #831679)
- Fixed heap-overflow in gv_stashpv (bug #826516)


author: Petr Pisar <ppisar@redhat.com> - 4:5.16.1-233
changelog:
- Do not access freed memory when cloning thread (bug #825749)
- Match non-breakable space with /[\h]/ in ASCII mode (bug #844919)
- Clear $@ before `do' I/O error (bug #834226)
- Do not truncate syscall() return value to 32 bits (bug #838551)


author: Petr Pisar <ppisar@redhat.com> - 4:5.16.1-238
changelog:
- Do not leak with attribute on my variable (bug #858966)
- Allow operator after numeric keyword argument (bug #859328)
- Extend stack in File::Glob::glob (bug #859332)


author: Petr Pisar <ppisar@redhat.com> - 4:5.16.2-249
changelog:
- Run-require POD convertors by Module-Build and ExtUtils-MakeMaker to
  generate documentation when building other packages


author: Petr Pisar <ppisar@redhat.com> - 4:5.16.2-250
changelog:
- Sub-package Text-Soundex (bug #905889)
- Fix conflict declaration at perl-Pod-LaTeX (bug #904085)
- Remove bundled Module-Pluggable (bug #903624)


author: Petr Pisar <ppisar@redhat.com> - 4:5.16.2-254
changelog:
- Correct perl-podlators dependencies
- Obsolete perl-ExtUtils-Typemaps by perl-ExtUtils-ParseXS (bug #891952)


author: Petr Pisar <ppisar@redhat.com> - 4:5.16.2-256
changelog:
- Sub-package File-CheckTree (bug #909144)
- Sub-package Text-ParseWords
- Sub-package Encode (bug #859149)


author: Petr Pisar <ppisar@redhat.com> - 4:5.16.3-261
changelog:
- 5.16.3 bump (see <http://search.cpan.org/dist/perl-5.16.3/pod/perldelta.pod>
  for release notes)
- Remove bundled autodie, B-Lint, CPANPLUS, Encode, File-CheckTree, IPC-Cmd,
  Params-Check, Text-Soundex, Thread-Queue


author: Petr Pisar <ppisar@redhat.com> - 4:5.16.3-263
changelog:
- Correct perl-Digest-MD5 dependencies
- Remove bundled Archive-Extract, File-Fetch, HTTP-Tiny,
  Module-Load-Conditional, Time-Local


author: Petr Pisar <ppisar@redhat.com> - 4:5.16.3-265
changelog:
- Conflict perl-autodie with older perl (bug #911226)
- Sub-package Env (bug #924619)
- Sub-package Exporter (bug #924645)
- Sub-package File-Path (bug #924782)
- Sub-package File-Temp (bug #924822)


author: Petr Pisar <ppisar@redhat.com> - 4:5.16.3-267
changelog:
- Remove bundled constant, DB_File, Digest-MD5, Env, Exporter, File-Path,
  File-Temp, Module-Load, Log-Message-Simple, Pod-Simple, Test-Harness,
  Text-ParseWords


author: Petr Pisar <ppisar@redhat.com> - 4:5.16.3-270
changelog:
- Fix leaking tied hashes (bug #859910)
- Fix dead lock in PerlIO after fork from thread (bug #947444)
- Add proper conflicts to perl-Getopt-Long, perl-Locale-Maketext, and
  perl-Sys-Syslog


author: Petr Pisar <ppisar@redhat.com> - 4:5.16.3-271
changelog:
- Sub-package Time-HiRes (bug #957048)
- Remove bundled Getopt-Long, Locale-Maketext, and Sys-Syslog


author: Petr Pisar <ppisar@redhat.com> - 4:5.16.3-272
changelog:
- Make regular expression engine safe in a signal handler (bug #849703)
- Remove bundled ExtUtils-ParseXS, and Time-HiRes


author: Petr Pisar <ppisar@redhat.com> - 4:5.16.3-277
changelog:
- Move CPANPLUS-Dist-Build files from perl-CPANPLUS
- Move CPAN-Meta-Requirements files from CPAN-Meta
- Add perl-Scalar-List-Utils to perl-core dependencies


author: Petr Pisar <ppisar@redhat.com> - 4:5.16.3-278
changelog:
- Update SystemTap scripts to recognize new phase__change marker and new probe
  arguments (bug #971094)
- Update h2ph(1) documentation (bug #948538)
- Update pod2html(1) documentation (bug #948538)
- Do not double-own archlib directory (bug #894195)


author: Petr Pisar <ppisar@redhat.com> - 4:5.16.3-279
changelog:
- Do not distribute File::Spec::VMS (bug #973713)
- Remove bundled CPANPLUS-Dist-Build (bug #973041)


author: Petr Pisar <ppisar@redhat.com> - 4:5.16.3-284
changelog:
- Use a macro to cover all 64-bit PowerPC architectures (bug #1061792)
- Declare dependencies for cpan tool (bug #1122368)
- Use stronger algorithm needed for FIPS in t/op/crypt.t (bug #1084796)
- Make *DBM_File desctructors thread-safe (bug #1107542)


author: Petr Pisar <ppisar@redhat.com> - 4:5.16.3-286
changelog:
- Remove CPU-speed-sensitive test in Benchmark test (bug #1238567)
- Rebuild with corrected binutils to fix systemtap support (bug #1238472)


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.16.3-288
changelog:
- Fix CRLF conversion in ASCII FTP upload (bug #1263734)
- Don't leak the temp utf8 copy of namepv (bug #1063330)


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.16.3-291
changelog:
- Backported and sub-packaged libraries historically supplied with Perl 4
  into perl-Perl4-CoreLibs


author: Petr Pisar <ppisar@redhat.com> - 4:5.16.3-293
changelog:
- Add SSL support to Net::SMTP (bug #1557574)
- Do not overload ".." in Math::BigInt (bug #1497734)
- Provide perl(:VERSION) and perl-interpreter RPM symbols (bug #1410347)


author: Petr Pisar <ppisar@redhat.com> - 0.033-2
changelog:
- Croak on failed write into a file (bug #1031096)
- Do not use already existing temporary files (bug #1031096)


author: Tom Callaway <tcallawa@redhat.com>
changelog:
- bump to 5.0.0
- add patch to prevent clobbering struct re_registers from regex.h
- remove domxml references, replaced with dom now built-in
- fix php.ini to refer to php5 not php4


author: Joe Orton <jorton@redhat.com> 5.0.1-1
changelog:
- update to 5.0.1
- only build shared modules once
- put dom extension in php-dom subpackage again
- move extension modules into %{_libdir}/php/modules
- don't use --with-regex=system, it's ignored for the apache* SAPIs


author: Joe Orton <jorton@redhat.com> 5.0.2-4
changelog:
- update to 5.0.2 (#127980)
- build against mysqlclient10-devel
- use new RTLD_DEEPBIND to load extension modules
- drop explicit requirement for elfutils-devel
- use AddHandler in default conf.d/php.conf (#135664)
- "fix" round() fudging for recent gcc on x86
- disable sqlite pending audit of warnings and subpackage split


author: Joe Orton <jorton@redhat.com> 5.0.2-5
changelog:
- fix phpize installation for lib64 platforms
- add fix for segfault in variable parsing introduced in 5.0.2


author: Joe Orton <jorton@redhat.com> 5.0.2-7
changelog:
- truncate changelog at 4.3.1-1
- merge from 4.3.x package:
 - enable mime_magic extension and Require: file (#130276)


author: Joe Orton <jorton@redhat.com> 5.0.3-1
changelog:
- update to 5.0.3 (thanks to Robert Scheck et al, #143101)
- enable xsl extension (#142174)
- package both the xsl and dom extensions in php-xml
- enable soap extension, shared (php-soap package) (#142901)
- add patches from upstream 5.0 branch:
 * Zend_strtod.c compile fixes
 * correct php_sprintf return value usage


author: Joe Orton <jorton@redhat.com> 5.0.3-2
changelog:
- install the ext/gd headers (#145891)
- enable pcntl extension in /usr/bin/php (#142903)
- add libmbfl array arithmetic fix (dcb314@hotmail.com, #143795)
- add BuildRequire for recent pcre-devel (#147448)


author: Joe Orton <jorton@redhat.com> 5.0.3-4
changelog:
- package mysqli extension in php-mysql
- really enable pcntl (#142903)
- don't build with --enable-safe-mode (#148969)
- use "Instant Client" libraries for oci8 module (Kai Bolay, #149873)


author: Joe Orton <jorton@redhat.com> 5.0.3-5
changelog:
- BuildRequire mysql-devel >= 4.1
- don't mark php.ini as noreplace to make upgrades work (#152171)
- fix subpackage descriptions (#152628)
- fix memset(,,0) in Zend (thanks to Dave Jones)
- fix various compiler warnings in Zend


author: Joe Orton <jorton@redhat.com> 5.0.4-1
changelog:
- update to 5.0.4 (#153068)
- add .phps AddType to php.conf (#152973)
- better gcc4 fix for libxmlrpc


author: Joe Orton <jorton@redhat.com> 5.0.4-4
changelog:
- bundle from PEAR: HTTP, Mail, XML_Parser, Net_Socket, Net_SMTP
- snmp: disable MSHUTDOWN function to prevent error_log noise (#153988)
- mysqli: add fix for crash on x86_64 (Georg Richter, upstream #32282)


author: Joe Orton <jorton@redhat.com> 5.0.4-6
changelog:
- build /usr/bin/php with the CLI SAPI, and add /usr/bin/php-cgi,
  built with the CGI SAPI (thanks to Edward Rudd, #137704)
- add php(1) man page for CLI
- fix more test cases to use -n when invoking php


author: Joe Orton <jorton@redhat.com> 5.0.4-7
changelog:
- split out dba and bcmath extensions into subpackages
- BuildRequire gcc-c++ to avoid AC_PROG_CXX{,CPP} failure (#155221)
- pear: update to DB-1.7.6
- enable FastCGI support in /usr/bin/php-cgi (#149596)


author: Joe Orton <jorton@redhat.com> 5.0.4-9
changelog:
- build simplexml_import_dom even with shared dom (#156434)
- prevent truncation of copied files to ~2Mb (#155916)
- install /usr/bin/php from CLI build alongside CGI
- enable sysvmsg extension (#142988)


author: Joe Orton <jorton@redhat.com> 5.0.5-3
changelog:
- update to 5.0.5
- add fix for upstream #34435
- devel: require autoconf, automake (#159283)
- pear: update to HTTP-1.3.6, Mail-1.1.8, Net_SMTP-1.2.7, XML_RPC-1.4.1
- fix imagettftext et al (upstream, #161001)


author: Joe Orton <jorton@redhat.com> 5.1.1-2
changelog:
- update to 5.1.1
- remove pear subpackage
- enable pdo extensions (php-pdo subpackage)
- remove non-standard conditional module builds
- enable xmlreader extension


author: Joe Orton <jorton@redhat.com> 5.1.2-5
changelog:
- provide php-api (#183227)
- add provides for all builtin modules (Tim Jackson, #173804)
- own %{_libdir}/php/pear for PEAR packages (per #176733)
- add obsoletes to allow upgrade from FE4 PDO packages (#181863)


author: Joe Orton <jorton@redhat.com> 5.1.4-5
changelog:
- provide mod_php (#187891)
- provide php-cli (#192196)
- use correct LDAP fix (#181518)
- define _GNU_SOURCE in php_config.h and leave it defined
- drop (circular) dependency on php-pear


author: Joe Orton <jorton@redhat.com> 5.1.4-8
changelog:
- Provide php-posix (#194583)
- only provide php-pcntl from -cli subpackage
- add missing defattr's (thanks to Matthias Saou)


author: Joe Orton <jorton@redhat.com> 5.2.0-3
changelog:
- update to 5.2.0 (#213837)
- php-xml provides php-domxml (#215656)
- fix php-pdo-abi provide (#214281)


author: Joe Orton <jorton@redhat.com> 5.2.0-4
changelog:
- provide php-zend-abi (#212804)
- add /etc/rpm/macros.php exporting interface versions
- synch with upstream recommended php.ini


author: Joe Orton <jorton@redhat.com> 5.2.0-5
changelog:
- build json and zip shared, in -common (Remi Collet, #215966)
- obsolete php-json and php-pecl-zip
- build readline extension into /usr/bin/php* (#210585)
- change module subpackages to require php-common not php (#177821)


author: Joe Orton <jorton@redhat.com> 5.2.0-9
changelog:
- add php(api), php(zend-abi) provides (#221302)
- package /usr/share/php and append to default include_path (#225434)


author: Joe Orton <jorton@redhat.com> 5.2.0-10
changelog:
- bump default memory_limit to 32M (#220821)
- mark config files noreplace again (#174251)
- drop trailing dots from Summary fields
- use standard BuildRoot
- drop libtool15 patch (#226294)


author: Joe Orton <jorton@redhat.com> 5.2.3-3
changelog:
- add mcrypt, mhash, tidy, mssql subpackages (Dmitry Butskoy)
- enable dbase extension and package in -common


author: Joe Orton <jorton@redhat.com> 5.2.6-3
changelog:
- update to 5.2.6
- sync default php.ini with upstream
- drop extension_dir from default php.ini, rely on hard-coded
  default, to make php-common multilib-safe (#455091)
- update to r3 of systzdata patch


author: Joe Orton <jorton@redhat.com> 5.2.6-6
changelog:
- move gd_README to php-gd
- update to r4 of systzdata patch; introduces a default timezone
  name of "System/Localtime", which uses /etc/localtime (#469532)


author: Joe Orton <jorton@redhat.com> 5.2.8-4
changelog:
- move wddx to php-xml, build curl shared in -common
- remove BR for expat-devel, bogus configure option


author: Joe Orton <jorton@redhat.com> 5.2.8-9
changelog:
- add recode support, -recode subpackage (#106755)
- add -zts subpackage with ZTS-enabled build of httpd SAPI
- adjust php.conf to use -zts SAPI build for worker MPM


author: Remi Collet <Fedora@famillecollet.com> 5.3.0-1
changelog:
- update to 5.3.0
- remove ncurses, dbase, mhash extensions
- add enchant, sqlite3, intl, phar, fileinfo extensions
- raise sqlite version to 3.6.0 (for sqlite3, build with --enable-load-extension)
- sync with upstream "production" php.ini


author: Joe Orton <jorton@redhat.com> 5.3.0-2
changelog:
- update to v5 of systzdata patch; parses zone.tab and extracts
  timezone->{country-code,long/lat,comment} mapping table


author: Remi Collet <Fedora@famillecollet.com> 5.3.1-1
changelog:
- update to 5.3.1
- remove openssl patch (merged upstream)
- add provides for php-pecl-json
- add prod/devel php.ini in doc


author: Remi Collet <Fedora@famillecollet.com> 5.3.2-1
changelog:
- PHP 5.3.2 Released!
- remove mime_magic option (now provided by fileinfo, by emu)
- add patch for http://bugs.php.net/50578
- remove patch for libedit (upstream)
- add runselftest option to allow build without test suite


author: Remi Collet <remi@fedoraproject.org> 5.3.8-2
changelog:
- add mysqlnd sub-package
- drop patch4, use --libdir to use /usr/lib*/php/build
- add patch to redirect mysql.sock (in mysqlnd)


author: Remi Collet <remi@fedoraproject.org> 5.3.8-3
changelog:
- revert is_a() to php <= 5.3.6 behavior (from upstream)
  with new option (allow_string) for new behavior


author: Remi Collet <remi@fedoraproject.org> 5.4.0-0.3.RC7
changelog:
- update to PHP 5.4.0RC7
- provides env file for php-fpm (#784770)
- add patch to use system libzip (thanks to spot)
- don't provide INSTALL file


author: Remi Collet <remi@fedoraproject.org> 5.4.0-5
changelog:
- fix Loadmodule with MPM event (use ZTS if not MPM worker)
- split conf.d/php.conf + conf.modules.d/10-php.conf with httpd 2.4


author: Remi Collet <remi@fedoraproject.org> 5.4.4-1
changelog:
- update to 5.4.4 (CVE-2012-2143, CVE-2012-2386)
- use /usr/lib/tmpfiles.d instead of /etc/tmpfiles.d
- use /run/php-fpm instead of /var/run/php-fpm


author: Remi Collet <rcollet@redhat.com> 5.4.7-8
changelog:
- systemd integration, https://bugs.php.net/63085
- no odbc call during timeout, https://bugs.php.net/63171
- check sqlite3_column_table_name, https://bugs.php.net/63149


author: Remi Collet <remi@fedoraproject.org> 5.4.7-9
changelog:
- php-fpm: enable PrivateTmp
- php-fpm: new systemd macros (#850268)
- php-fpm: add upstream patch for startup issue (#846858)


author: Remi Collet <remi@fedoraproject.org> 5.4.8-1
changelog:
- update to 5.4.8
- define both session.save_handler and session.save_path
- fix possible segfault in libxml (#828526)
- php-fpm: create apache user if needed
- use SKIP_ONLINE_TEST during make test
- php-devel requires pcre-devel and php-cli (instead of php)


author: Remi Collet <rcollet@redhat.com> 5.4.8-6
changelog:
- clarify Licenses
- missing provides xmlreader and xmlwriter
- modernize spec
- change php embedded library soname version to 5.4


author: Remi Collet <rcollet@redhat.com> 5.4.9-0.1.RC1
changelog:
- update to 5.4.9RC1
- improves php.conf (use FilesMatch + SetHandler)
- improves filter (httpd module)
- apply ldap_r patch on fedora >= 18 only


author: Remi Collet <remi@fedoraproject.org> 5.4.12-1
changelog:
- update to 5.4.12
- security fix for CVE-2013-1635
- enable tokyocabinet dba handler
- upstream patch (5.4.13) to fix dval to lval conversion
  https://bugs.php.net/64142
- upstream patch (5.4.13) for 2 failed tests
- fix buit-in web server on ppc64 (fdset usage)
  https://bugs.php.net/64128


author: Remi Collet <rcollet@redhat.com> 5.4.13-1
changelog:
- update to 5.4.13
- security fix for CVE-2013-1643
- Hardened build (links with -z now option)
- Remove %config from /etc/rpm/macros.php


author: Remi Collet <rcollet@redhat.com> 5.4.16-1
changelog:
- update to 5.4.16
- switch systemd unit to Type=notify
- patch for upstream Bug #64915 error_log ignored when daemonize=0
- patch for upstream Bug #64949 Buffer overflow in _pdo_pgsql_error
- patch for upstream bug #64960 Segfault in gc_zval_possible_root
- add version to "Obsoletes"
- own /usr/share/fpm


author: Remi Collet <rcollet@redhat.com> - 5.4.16-4
changelog:
- improve mod_php, pgsql and ldap description
- add provides php(pdo-abi) for consistency with php(api) and php(zend-abi)
- use %__isa_bits instead of %__isa in ABI suffix


author: Remi Collet <rcollet@redhat.com> - 5.4.16-19
changelog:
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712


author: Remi Collet <rcollet@redhat.com> - 5.4.16-23
changelog:
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix extensive backtracking CVE-2013-7345
- core: type confusion issue in phpinfo(). CVE-2014-4721
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515


author: Remi Collet <rcollet@redhat.com> - 5.4.16-27
changelog:
- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597


author: Remi Collet <rcollet@redhat.com> - 5.4.16-29
changelog:
- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670


author: Remi Collet <rcollet@redhat.com> - 5.4.16-33
changelog:
- core: use after free vulnerability in unserialize()
  CVE-2014-8142 and CVE-2015-0231
- core: fix use-after-free in unserialize CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: use after free vulnerability in unserialize CVE-2015-0273
- enchant: fix heap buffer overflow in enchant_broker_request_dict
  CVE-2014-9705
- exif: free called on unitialized pointer CVE-2015-0232
- fileinfo: fix out of bounds read in mconvert CVE-2014-9652
- gd: fix buffer read overflow in gd_gif_in.c CVE-2014-9709
- phar: use after free in phar_object.c CVE-2015-2301
- soap: fix type confusion through unserialize


author: Remi Collet <rcollet@redhat.com> - 5.4.16-34
changelog:
- fix memory corruption in fileinfo module on big endian
  machines #1082624
- fix segfault in pdo_odbc on x86_64 #1159892
- fix segfault in gmp allocator #1154760


author: Remi Collet <rcollet@redhat.com> - 5.4.16-35
changelog:
- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330


author: Remi Collet <rcollet@redhat.com> - 5.4.16-38
changelog:
- curl: add options to enable TLS #1291667
- mysqli: fix segfault in mysqli_stmt::bind_result() when
  link is closed #1096800
- fpm: fix incorrectly defined SCRIPT_NAME variable when
  using Apache #1138563
- core: fix segfault when a zend_extension is loaded twice #1289457
- openssl: change default_md algo from MD5 to SHA1 #1073388
- wddx: fix segfault in php_wddx_serialize_var #1131979


author: Remi Collet <rcollet@redhat.com> - 5.4.16-41
changelog:
- gd: fix integer overflow in _gd2GetHeader() resulting in
  heap overflow CVE-2016-5766
- gd: fix integer overflow in gdImagePaletteToTrueColor()
  resulting in heap overflow CVE-2016-5767
- mbstring: fix double free in _php_mb_regex_ereg_replace_exec
  CVE-2016-5768


author: Remi Collet <rcollet@redhat.com> - 5.4.16-43
changelog:
- gd: fix DoS vulnerability in gdImageCreateFromGd2Ctx() CVE-2016-10167
- gd: Signed Integer Overflow gd_io.c CVE-2016-10168


author: Remi Collet <rcollet@redhat.com> - 5.4.16-44
changelog:
- fix php should provide php(httpd) #1215429
- fpm: backport PHP-FPM's clear_env option from 5.4.27 #1410010
  default value is "yes", preserving previous behaviour
- openssl: fix default_socket_timeout does not work with SSL #1378196


author: Remi Collet <rcollet@redhat.com> - 5.4.16-47
changelog:
- fix stack-buffer-overflow while parsing HTTP response CVE-2018-7584
- fix out-of-bounds read in base64_decode_xmlrpc CVE-2019-9024
- fix reflected XSS in phar 404 page CVE-2018-5712
- fix reflected XSS in phar 403 and 404 error pages CVE-2018-10547


author: Dmitriy Popov <dpopov@cloudlinux.com> - 5.4.16-48.tuxcare.els1
changelog:
- CVE-2021-21702: Fix null pointer crash because of malformed
  SOAP server response
- CVE-2021-21703: Fix error in php fpm shared memory organization
  leading to privilage escalation
- CVE-2022-31625: Fix freeing of uninitialized memory leading to RCE
- CVE-2022-31626: Fix buffer overflow in mysqlnd driver leading to RCE
- CVE-2023-0568: Fix array overrun when appending slash to paths
  in DOM and XML cases
- CVE-2023-0662: Fix DOS vulnerabality by limiting number of parsed
  multipart body parts and printing upload limit exceed error
  message only once
- CVE-2023-3823: Fix external entity loading in XML without enabling it,
  by sanitizing libxml2 globals before parsing
- CVE-2023-3824: Fix buffer mismanagement in phar_dir_read()


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.4.16-48.tuxcare.els2
changelog:
- CVE-2020-7071: fix URL validation with functions like
  filter_var($url, FILTER_VALIDATE_URL)
- CVE-2021-21705: fix URL validation functionality via filter_var() function
  with FILTER_VALIDATE_URL parameter when an URL with invalid password field
  can be accepted as valid


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.4.16-48.tuxcare.els4
changelog:
- CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data
  boundaries larger than the read buffer


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.4.16-48.tuxcare.els9
changelog:
- CVE-2025-1217: fix handling of folded headers by the http stream parser
- CVE-2025-1734: fix validation of http headers with missing colon
- CVE-2025-1861: fix incorrect http redirect location truncation


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 5.4.16-48.tuxcare.els11
changelog:
- CVE-2025-1735: add error checking for pgsql extension escape functions,
  mainly to fix possible issues with multi-byte encoding of Postgres databases


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 5.4.16-48.tuxcare.els14
changelog:
- CVE-2017-9224: fix out-of-bounds read of a stack in match_at function
- CVE-2017-9226: fix out-of-bounds write or read of a heap in
  next_state_val function
- CVE-2017-9227: fix out-of-bounds read of a stack in mbc_enc_len function


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.4.16-48.tuxcare.els15
changelog:
- CVE-2017-9228: fix heap out-of-bounds write in bitset_set_range() and
  parse_char_class() functions


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 0.34.0-1.el7.tuxcare.els1
changelog:
- CVE-2022-44638: Integer overflow in pixman_sample_floor_y leading to heap out-of-bounds write in rasterize_edges_8.


author: Marek Kasik <mkasik@redhat.com> - 0.26.5-38
changelog:
- Constrain number of cycles in rescale filter
- Compute correct coverage values for box filter
- Resolves: #1688417


author: Tamar Zerekidze <tzerekidze@cloudlinux.com> - 0.26.5-43.1.tuxcare.els2
changelog:
- CVE-2025-32365: fix segmentation fault due to an invalid memory read, occurring in JBIG2Bitmap::combine


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2:2.10.1-7
changelog:
- Fixed haproxy with TLS
  Resolves: rhbz#1370455
- Fixed documentation about canonical maps
  Resolves: rhbz#1381871
- Fixed build with kernel-4.*
  Resolves: rhbz#1575658


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2:2.10.1-9
changelog:
- Compiled with USE_LDAP_SASL if both "ldap" and "sasl" options are enabled
  Resolves: rhbz#1733938


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 9.2.24-9.tuxcare.els5
changelog:
- CVE-2025-1094: fix potential SQL injections allowed by an improper encoding
  validation in data quoting functions


author: Jan Rybar <jrybar@redhat.com> - 3.3.10-28
changelog:
- pgrep: uid/gid conversion overflow
- vmstat: manpage line about I/O blocked procs unclear
- Resolves: rhbz#1624514, rhbz#1796043


author: Jeremy Hylton <jeremy@beopen.com>
changelog:
- Version 2 of 2.0b1
- Make the package relocatable.  Thanks to Suchandra Thapa.
- Exclude Tkinter from main RPM.  If it is in a separate RPM, it is
  easier to track Tk releases.


author: Jeremy Hylton <jeremy@beopen.com>
changelog:
- updated for 2.0c1
- build audioop, imageop, and rgbimg extension modules
- include xml.parsers subpackage
- add test.xml.out to files list


author: Matt Wilson <msw@redhat.com>
changelog:
- modify all files to use "python2.0" as the intrepter
- don't build the Expat bindings
- build against db1


author: Trond Eivind Glomsrød <teg@redhat.com>
changelog:
- fix the "requires" clause, it lacked a space causing problems
- use %{_tmppath}
- don't define name, version etc
- add the available patches from the Python home page


author: Trond Eivind Glomsrød <teg@redhat.com> 2.2-0.4a4
changelog:
- 2.2a4
- Enable UCS4 support
- Enable IPv6
- Provide distutils
- Include msgfmt.py and pygettext.py


author: Matt Wilson <msw@redhat.com> 2.2-0.9b2
changelog:
- changed DESTDIR to point to / so that distutils will install dynload
  modules properly in the installroot


author: Trond Eivind Glomsrød <teg@redhat.com> 2.2-0.11c1
changelog:
- 2.2 RC 1
- Don't include the _tkinter module in the main package - it's 
  already in the tkiter packace
- Turn off the mpzmodule, something broke in the buildroot


author: Nalin Dahyabhai <nalin@redhat.com> 2.2-5
changelog:
- disable ndbm support, which is db2 in disguise (really interesting things
  can happen when you mix db2 and db4 in a single application)


author: Trond Eivind Glomsrød <teg@redhat.com> 2.2-8
changelog:
- Make files in /usr/bin install side by side with python 1.5 when
- Drop explicit requirement of db4
  built as python2


author: Trond Eivind Glomsrød <teg@redhat.com> 2.2-16
changelog:
- the same, but in builddirs - this will remove them from the 
  docs package, which doesn't look in the buildroot for files.


author: Mihai Ibanescu <misa@redhat.com>
changelog:
- builds as python2 require a different libdb
- changed the buildroot name of python to match python2 builds


author: Mihai Ibanescu <misa@redhat.com>
changelog:
2.2.2-2
- Fix #76912 (python-tools contains idle, which uses tkinter, but there is no
  requirement of tkinter from python-tools).
- Fix #74013 (rpm is missing the /usr/lib/python2.2/test directory)


author: Mihai Ibanescu <misa@redhat.com>
changelog:
2.2.2-3.*
- Merged patch from Karsten Hopp <karsten@redhat.de> from 2.2.1-17hammer to
  use %{_libdir}
- Added XFree86-libs as BuildRequires (because of tkinter)
- Fixed duplicate listing of plat-linux2
- Fixed exclusion of lib-dynload/japanese
- Added lib64 patch for the japanese codecs
- Use setup magic instead of using tar directly on JapaneseCodecs


author: Mihai Ibanescu <misa@redhat.com>
changelog:
2.2.2-5
- Fixed configuration patch to add -lcrypt when compiling cryptmodule.c

2.2.2-4
- Spec file change from Matt Wilson <msw@redhat.com> to disable linking 
  with the C++ compiler.


author: Mihai Ibanescu <misa@redhat.com>
changelog:
2.2.2-3.7.3
- Recompiled for 7.3 (to fix the -lcrypt bug)
- Fix for the spurious error message at the end of the build (build-requires
  gets confused by executable files starting with """"): make the tests
  non-executable.


author: Mihai Ibanescu <misa@redhat.com> 2.2.2-7
changelog:
- Fix bug #79647 (Rebuild of SRPM fails if python isn't installed)
- Added a bunch of missing BuildRequires found while fixing the
  above-mentioned bug


author: Jeremy Katz <katzj@redhat.com> 2.2.2-8
changelog:
- urllib2 didn't support non-anonymous ftp.  add support based on how 
  urllib did it (#80676, #78168)


author: Mihai Ibanescu <misa@redhat.com> 2.2.2-11.7.3
changelog:
- Fixed bug #82544: Errata removes most tools
- Fixed bug #82435: Python 2.2.2 errata breaks redhat-config-users
- Removed .lib64 and - files that get installed after we fix the multilib
  .py files.


author: Mihai Ibanescu <misa@redhat.com> 2.2.2-13
changelog:
- Attempt to look both in /usr/lib64 and /usr/lib/python2.2/site-packages/:
  some work on python-2.2.2-lib64.patch


author: Mihai Ibanescu <misa@redhat.com> 2.2.2-22
changelog:
- Using newer Japanese codecs (1.4.9). Thanks to 
  Peter Bowen <pzb@datastacks.com> for pointing this out.


author: Jeremy Katz <katzj@redhat.com> 2.2.2-23
changelog:
- ftp uri's should be able to specify being rooted at the root instead of 
  where you login via ftp (#84692)


author: Mihai Ibanescu <misa@redhat.com> 2.2.2-25
changelog:
- Fixed bug #84886: pydoc dies when run w/o arguments
- Fixed bug #84205: add python shm module back (used to be shipped with 1.5.2)
- Fixed bug #84966: path in byte-compiled code still wrong


author: Mihai Ibanescu <misa@redhat.com> 2.3-0.2
changelog:
- Building python 2.3
- Added more BuildRequires
- Updated the startup files for modulator and pynche; idle installs its own
  now.


author: Mihai Ibanescu <misa@redhat.com> 2.3.3-4
changelog:
- Fix for bug #122304 : splitting the domain name fails on 64-bit arches
- Fix for bug #120879 : including Makefile into the main package

- Requires XFree86-devel instead of -libs (see bug #118442)


author: Mihai Ibanescu <misa@redhat.com> 2.3.3-6
changelog:
- Correct fix for #122304 from upstream:
  http://sourceforge.net/tracker/?func=detail&atid=105470&aid=931848&group_id=5470


author: Mihai Ibanescu <misa@redhat.com> 2.3.4-1
changelog:
- Updated to 2.3.4-1 with Robert Scheck's help (bug #124764)
- Added BuildRequires: tix-devel (bug #124918)


author: Mihai Ibanescu <misa@redhat.com> 2.3.4-3
changelog:
- Added an optik.py that provides the same interface from optparse for
  backward compatibility; obsoleting python-optik


author: Mihai Ibanescu <misa@redhat.com> 2.3.4-6
changelog:
- Fixed #128030 (help() not printing anything)
- Fixed #125472 (distutils.sysconfig.get_python_lib() not returning the right
  path on 64-bit systems)
- Fixed #127357 (building python as a shared library)
- Fixed  #19347 (including the contents of Tools/scripts/ in python-tools)


author: Mihai Ibanescu <misa@redhat.com> 2.3.4-7
changelog:
- Including html documentation for non-i386 arches
- Fixed #125362 (python-doc html files have japanese character encoding)
- Fixed #128923 (missing dependency between python and python-devel)


author: Mihai Ibanescu <misa@redhat.com> 2.3.4-8
changelog:
- Fixed bug #129769: Makefile in new python conflicts with older version found
  in old python-devel
- Reorganized the spec file to get rid of the aspython2 define; __python_ver
  is more powerful.


author: Mihai Ibanescu <misa@redhat.com> 2.3.4-10
changelog:
- Fixed bug #77418 (Demo dir not packaged)
- More tweaking on #19347 (Moved Tools/ under /usr/lib/python2.3/Tools)


author: Jeff Johnson <jbj@jbj.org> 2.4-2
changelog:
- db-4.3.21 returns DB_BUFFER_SMALL rather than ENOMEM (#141994).
- add Provide: python(abi) = 2.4
- include msgfmt/pygettext *.pyc and *.pyo from brp-python-bytecompile.


author: Mihai Ibanescu <misa@redhat.com> 2.4-6
changelog:
- building the docs from a different source rpm, to decouple bootstrapping
  python from having tetex installed


author: Mihai Ibanescu <misa@redhat.com> 2.4.1-2
changelog:
- Fixed bug #143667 (python should own /usr/lib/python* on 64-bit systems, for
  noarch packages)
- Fixed bug #143419 (BuildRequires db4 is not versioned)


author: Mihai Ibanescu <misa@redhat.com> 2.4.1-7
changelog:
- Fixed bug #169046 (realpath is unsafe); thanks to 
  Peter Jones <pjones@redhat.com> and Arjan van de Ven <arjanv@redhat.com> for
  diagnosing and the patch.


