# changelog

author: werner@suse.de
changelog:
  - Add patch git-33-04c9daea971d58248c64076d41315129a7083629.patch
    * In bash.bashrc move ssh/sudo source of profile to avoid removing
      the `is' variable before last use (boo#1088524)
    * Avoid the shell code checker stumble over `function' keys
      word in ls.bash (git#54).


author: werner@suse.de
changelog:
  - Add patch git-35-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
    No error at login if java system directory is empty (bsc#1102310)


author: ro@suse.de
changelog:
  -  Add patch git-34-011e1546bd1092c2a8c9754866ca02439ed23d54.patch
    * Get mixed use case of service wrapper script straight
      (bsc#1040613)


author: ro@suse.de
changelog:
  - add patch git-36-7a00987c0df059cc1495cba7d70d319593d4cfed.patch
    test for xdgdir/applications before adding data dir (bsc#1095969)


author: ro@suse.de
changelog:
  - Add patch git-39-00d332a443062395957f422c89eaed9d0979ec00.patch
    * update logic for JRE_HOME env variable (bsc#1128246)


author: ro@suse.de
changelog:
  - Add patch git-40-b66cf03e673e84902ce0330f88f84f4fbdc8c9e9.patch
    * Restore old position of ssh/sudo source of profile
      for bug bsc#1118364 but hopefully do not reintroduce
      bug boo#1088524


author: sandonov@suse.com
changelog:
  - Revert "Avoid NAT on Bridges. Bridges are L2 devices, really."
    (bsc#1115020). Based on github.com/openSUSE/aaa_base/pull/35
    * 0001-Revert-Avoid-NAT-on-Bridges-Bridges-are-L2-devices-really-bsc-1115020.patch


author: ro@suse.de
changelog:
  - add patch git-36-4b7d6b6e126d96e48757783e9fc59ac477ba6a44.patch
    xdg-environment: reduce list in /opt/* to gnome,kde4,kde3
    (bnc#910904) (bsc#1149127)
  - rename patch
    git-36-7a00987c0df059cc1495cba7d70d319593d4cfed.patch to
    git-37-7a00987c0df059cc1495cba7d70d319593d4cfed.patch


author: werner@suse.de
changelog:
  - Add patch git-38-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
    Use official key binding functions in inputrc
    that is replace up-history with previous-history, down-history with
    next-history and backward-delete-word with backward-kill-word
    (bsc#1084934).


author: ro@suse.de
changelog:
  - add patch git-41-0da43d3808a0529003524d762118ff46a628e0b0.patch
    * generalize testing for JVMs when creating the java path
      to support sapjvm and others (boo#1157794)


author: sweet_f_a@gmx.de
changelog:
  - update to upstream alpha 1.06.95 (2006-09-05), in use in other
    major distros for quite a long time (Debian, Fedora, Ubuntu, ...)
  - add patches from Fedora
  - automake dependency removed


author: sflees@suse.de
changelog:
  - Remove call to %{insserv_force_if_yast dbus} initscripts are
    removed and this causes errors. bsc#1046173


author: sflees@suse.de
changelog:
  - Fix CVE-2019-12749 Authentication bypass (CVE-2019-12749 bsc#1137832)
    * added fix-CVE-2019-12749.patch


author: sflees@suse.de
changelog:
  - Fix CVE-2020-35512 - shared UID's caused issues (CVE-2020-35512 bsc#1187105)
    * fix-upstream-userdb-constpointer.patch
    * fix-upstream-CVE-2020-35512.patch
  - Fix CVE-2020-12049 truncated messages lead to resource exhaustion
    (CVE-2020-12049, bsc#1172505)
    * fix-upstream-CVE-2020-12049_2.patch


author: sflees@suse.de
changelog:
  - Fix a potential crash that could be triggered by an invalid signature.
    (CVE-2022-42010, bsc#1204111)
    * fix-upstream-CVE-2022-42010.patch
  - Fix an out of bounds read caused by a fixed length array (CVE-2022-42011,
    bsc#1204112)
    * fix-upstream-CVE-2022-42011.patch
  - A message in non-native endianness with out-of-band Unix file descriptors
    would cause a use-after-free and possible memory corruption CVE-2022-42012,
    bsc#1204113)
    * fix-upstream-CVE-2022-42012.patch
  - Disable asserts (bsc#1087072)
  - Refreshed patches
    * dbus-do-autolaunch.patch
    * increase-backlog.patch
    * fix-upstream-timeout-reset-2.patch
    * fix-upstream-CVE-2020-12049_2.patch


author: scabrero@suse.de
changelog:
  - Fix IO lock contention, causing timeouts; (fdo#102839);
    (bsc#1193780).
    Add fix-upstream-fdo102839-io-lock-contention.patch


author: sflees@suse.de
changelog:
  - Sometimes unprivileged users were able to crash dbus-daemon
    (CVE-2023-34969, bsc#1212126)
    * fix-upstream-CVE-2023-34969.patch


author: daniel.molkentin@suse.com
changelog:
  - modules.d: fix udev rules detection of multipath devices (bsc#1171370)
    * add 0620-modules.d-fix-udev-rules-detection-of-multipath-devi.patch


author: daniel.molkentin@suse.com
changelog:
  - dracut-init: downgrade module load failure to warning (bsc#1169997)
    * add 0621-dracut-init-downgrade-module-load-failure-to-warning.patch


author: daniel.molkentin@suse.com
changelog:
  - 01fips: modprobe failures during manual module loading is not fatal
    * add 0622-01fips-modprobe-failures-during-manual-module-loadin.patch


author: thomas.blume@suse.com
changelog:
  - support network setup on infiniband devices (bsc#996146)
    * add 0623-net-lib.sh-support-infiniband-network-mac-addresses.patch


author: daniel.molkentin@suse.com
changelog:
  - fix(shutdown): add timeout to umount calls (bsc#1178219)
    * add 0624-shutdown-guard-against-read-only-run.patch
    * add 0625-shutdown-sleep-a-little-if-a-process-was-killed.patch
    * add 0626-fix-shutdown-add-timeout-to-umount-calls.patch


author: thomas.blume@suse.com
changelog:
  - remove references to INITRD_MODULES (bsc#1187115)
    * add 0627-fix-suse-initrd-remove-references-to-INITRD_MODULES-.patch


author: thomas.blume@suse.com
changelog:
  - fix ordering cycle that caused boot hang (bsc#1189545)
    * add 0632-dracut-systemd-add-back-missing-dependencies.patch
  - Emergency shell fixes (bsc#1188376, bsc#1188378)
    * add 0630-emergency.service-use-Type-idle.patch
    * add 0631-dracut-systemd-fixed-dependencies.patch
  - fix usage information for -f parameter (bsc#1187470)
    * add 0628-fix-suse-initrd-inform-on-usage-of-obsolete-f-parame.patch
  - fix obsolete reference to 96insmodpost in manpage (bsc#1187774)
    * add 0629-docs-fix-reference-to-insmodpost-module.patch


author: thomas.blume@suse.com
changelog:
  - fix handling of omit_dracutmodules parameter (bsc#1208929)
    * add 0633-fix-dracut.sh-omission-is-an-addition-to-other-omiss.patch


author: antonio.feijoo@suse.com
changelog:
  - fix(dracut): do not read /proc/modules to get the host modules (bsc#1210910)
    * add 0634-fix-dracut-do-not-read-proc-modules-to-get-the-host-.patch


author: schwab@suse.de
changelog:
  - mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
    (CVE-2021-33574, bsc#1186489, BZ #27896)


author: schwab@suse.de
changelog:
  - cancelable-syscall-stack-align.patch: x86: fix stack alignment in
    cancelable syscall stub (bsc#1191835)


author: schwab@suse.de
changelog:
  - dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
    object to work (bsc#1192620, BZ #16272)


author: schwab@suse.de
changelog:
  - hton-identity.patch: Make endian-conversion macros always return correct
    types (bsc#1193478, BZ #16458)


author: schwab@suse.de
changelog:
  - clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
    for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
  - svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
    (CVE-2022-23218, bsc#1194770, BZ #28768)
  - getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
    (CVE-2021-3999, bsc#1194640, BZ #28769)


author: schwab@suse.de
changelog:
  - pthread-cond-wait-stack-align.patch: x86: fix stack alignment in
    pthread_cond_[timed]wait (bsc#1196852)


author: schwab@suse.de
changelog:
  - pop-fail-stack.patch: Assertion failure in pop_fail_stack when executing
    a malformed regexp (CVE-2015-8985, bsc#1193625, BZ #21163)


author: schwab@suse.de
changelog:
  - s390-nl-current-lc-foo-used.patch: S390: Fix relocation of
    _nl_current_LC_CATETORY_used in static build (bsc#1215504, BZ #19860)


author: schwab@suse.de
changelog:
  - gai-merge-continue-actions.patch: Simplify allocations and fix merge and
    continue actions (CVE-2023-4813, bsc#1215286, BZ #28931)


author: dap.darkness@gmail.com
changelog:
  - Update to version 1.15.4:
    * vlock: New utility which locks one or more virtual consoles.
    * loadkeys: Change the handling of -C option.
    * loadkeys: Fix -d option.
    * Add dvorak-es keymap.
    * Add dvorak-uk keymap (Joe MacMahon).
    * Add dvorak-sv-a1 and dvorak-sv-a5 keymaps.
    * Add ruwin_alt_sh-UTF-8 keymap (Dmitriy Perlow).
  - kbd-1.15.3-po-es.patch was fixed.
  - Applied into upstream patches were deleted.
  - Fixed up via spec-cleaner.
  - Clean-section was removed.
  - Macro warnings were fixed via '%' deleting.


author: dap.darkness@gmail.com
changelog:
  - Update to version 1.15.5:
    * Fix msgstr in es.po and update translations.
    * Update changelog and increase version (1.15.5wip).
    * po: Update vi.po from translationproject.org.
    * Fix various vlock build errors.
    * Fix loadkeys.analyze lex handling.
    * Ignore config.cache files.
  - Applied into upstream kbd-1.15.3-po-es.patch was deleted.


author: crrodriguez@opensuse.org
changelog:
  - Remove sysvinit support, init scripts from this package
    are masked by systemd and only serve for confusion.


author: marceloatie@gmail.com
changelog:
  - Fix data/keymaps/i386/querty/br-abnt2.map
    (boo#984958, kbd-1.15.5-br-abnt2-slash-question.patch)


author: sbrabec@suse.com
changelog:
  - Update to version 2.0.4 from SLE 15 (FATE#325454):
    * Thu Apr  5 17:32:03 CEST 2018 - sbrabec@suse.com
    * Disable characters >=U+F000. These do not work properly
      (bsc#1085432#c15, kbd-unicode-fxxx.patch).
    * Thu Mar 15 17:04:06 CET 2018 - sbrabec@suse.com
    * Do not cause error on UNICODE characters >= 0xF000 (e. g.
      ligature fi) (bsc#1085432, kbd-unicode-fxxx.patch).
    * Fri Jan 12 17:39:18 CET 2018 - sbrabec@suse.com
    * Move initial NumLock handling from systemd back to kbd:
    * Add kbdsettings service written by Thomas Blume (boo#1010880,
      kbdsettings, kbdsettings.service, numlockbios.c,
      update sysconfig.console and sysconfig.keyboard).
    * Exclude numlockbios support for non x86 platforms
      (kbdsettings-nox86.patch).
    * Drop references to KEYTABLE and COMPOSETABLE (boo#1010880#c32,
      boo#1010880#c54,  sysconfig.keyboard.del, README.SUSE,
      drop kbd.fillup).
    * Fix paths in kbd.pl.
    * Wed Dec  6 13:30:49 UTC 2017 - fbui@suse.com
    * Drop from some fill-up templates, a couple of sysconfig variables no
      more read by systemd (fate#319454)
      So the relevant settings can be defined in only one place.
    * Thu Nov 23 13:40:21 UTC 2017 - rbrown@suse.com
    * Replace references to /var/adm/fillup-templates with new
      %_fillupdir macro (boo#1069468)
    * Fri Oct 13 14:53:41 CEST 2017 - sbrabec@suse.com
    * Add vlock.pamd PAM file (bsc#1056449#c8).
    * Clean spec file.
    * Fri Sep 22 15:51:51 CEST 2017 - sbrabec@suse.com
    * Version update to 2.0.4:
    * translation updates
    * support for U+202F
    * minor fixes and code cleanup
    * minor improvements and more characters support
    * Enable vlock (bsc#1056449, FATE#261).
    * Sun Apr 30 04:31:25 UTC 2017 - bwiedemann@suse.com
    * call gzip -n to make build fully reproducible
    * Thu Mar 23 23:23:20 UTC 2017 - zaitor@opensuse.org
    * Revert dropping of kdb-legacy Requires: There are still packages
      and installation flows that needs this to be present
      (boo#1027379).
    * Sun Feb 12 23:37:52 UTC 2017 - zaitor@opensuse.org
    * Drop kdb-legacy Requires: No longer needed, and was always meant
      to be temporary.
    * Tue Jul 12 12:52:31 UTC 2016 - tchvatal@suse.com
    * Version update to 2.0.3:
    * Various small updates
    * Obsolete merged patch:
    * kbd-1.15.5-br-abnt2-slash-question.patch
    * Quickly run over with spec-cleaner
    * Remove arch check for alpha and other unused platforms
    * Drop kbd.fillup.nonpc as it should not be needed nowdays
    * Thu Jun 16 00:18:55 CET 2016 - marceloatie@gmail.com
    * Fix data/keymaps/i386/querty/br-abnt2.map
      (boo#984958, kbd-1.15.5-br-abnt2-slash-question.patch)
    * Thu Dec 10 16:31:10 CET 2015 - tiwai@suse.de
    * Fix missing dependency on coreutils for initrd macros (boo#958562)
    * Call missing initrd macro at postun (boo#958562)
    * Fri Aug 21 10:50:21 UTC 2015 - opensuse.lietuviu.kalba@gmail.com
    * Rename conflicting legacy keymaps:
    * dvorak/no.map -> dvorak/no-dvorak.map
    * fgGIod/trf.map -> fgGIod/trf-fgGIod.map
    * olpc/pt.map -> olpc/pt-olpc.map
    * qwerty/cz.map -> qwerty/cz-qwerty.map
    * i386/qwerty/sr-latin links to sr-cy
    * add compose rules to cz layout (rh#1181581)
    * Mon Aug 10 11:53:48 UTC 2015 - sndirsch@suse.com
    * genmap4systemd.sh: use 'abnt2' model for 'br' layouts, 'jp106'
      model for 'jp' layouts and 'microsoftpro' for anything else
      (instead of 'pc105' before) (FATE#318426)
    * Tue Jul 21 10:05:35 UTC 2015 - sndirsch@suse.com
    * added genmap4systemd.sh tool, which generates entries for
      systemd's /usr/share/systemd/kbd-model-map table from
      xkeyboard-config converted keymaps; entries are written to
      /usr/share/systemd/kbd-model-map.xkb-generated, so these can
      easily be added to /usr/share/systemd/kbd-model-map by systemd
      package (FATE#318426)
    * Fri Jul 17 12:54:27 UTC 2015 - sndirsch@suse.com
    * Include xkb layouts from xkeyboard-config converted to console
      keymaps, (FATE#318426)
    * Rename Finnish xkb converted layout
    * Add xkb and legacy keymaps subdirs to loadkyes search path
      (kbd-1.15.5-loadkeys-search-path.patch), remove symlinks,
      Don't convert layouts that can't input ASCII,
    * Original keymaps moved to legacy dir, created symlinks to xkb
      keymaps
    * Thu Apr  2 18:36:23 UTC 2015 - crrodriguez@opensuse.org
    * For the previos change to wok, we need to buildrequire
      suse-module-tools to get the initrd rpm macros.
    * Sat Mar 28 21:15:08 UTC 2015 - crrodriguez@opensuse.org
    * Regenerate the initrd if this package changes as it is
      included there for early console setup.
    * Tue Feb 10 15:45:09 UTC 2015 - tchvatal@suse.com
    * Convert changelog to utf8
    * Sat Nov 29 22:14:00 UTC 2014 - Led <ledest@gmail.com>
    * fix bashisms in scripts
    * add patches:
    * kbd-2.0.2-fix-bashisms.patch
    * update patches:
    * kbd-1.15.2-unicode_scripts.patch
    * Thu Sep 25 10:33:55 UTC 2014 - pgajdos@suse.com
    * euro{,1,2}.map now produces correct unicode for Euro sign
      [bnc#360993]
    * added patches:
    * kbd-2.0.2-euro-unicode.patch
    * Thu Sep 18 10:54:51 UTC 2014 - pgajdos@suse.com
    * port dumpkeys-C-opt.patch
    * modified patches:
    * kbd-1.15.2-dumpkeys-C-opt.patch
    * Fri Sep 12 09:52:30 UTC 2014 - pgajdos@suse.com
    * kbd-2.0.2-doshell-reference.patch:
      drop doshell reference from openvt.1 man page [bnc#675317]
    * Thu Sep  4 17:51:54 UTC 2014 - jw@owncloud.com
    * added /usr/bin/kbd, a simple userfriedly keymap switcher.
      From https://github.com/jnweiger/kbd-wrapper
    * Fri Aug 22 09:50:15 UTC 2014 - pgajdos@suse.com
    * drop kbd-1.15.2-chvt-userwait.patch [bnc#830805] (internal)
      (--userwait seems to not be used anywhere)
    * Fri Aug 22 09:25:51 UTC 2014 - pgajdos@suse.com
    * remove testutf8 stub (2009: testutf8 will be soon removed completely,
      it's kept only not to break /etc/profile currently)
    * Fri Aug 22 06:51:23 UTC 2014 - pgajdos@suse.com
    * Update to version 2.0.2:
      libkeymap: fix kmap on big-endian machines
      Add functions to get the total number of elements
      Add functions to convert ksyms
      eurlatgr - new Linux console font
      Hide syms array
      Add information about the total number of elements
      Add function to obtain items from the diacritical table
      Change the API for working with the diacritical table
      Change API for working with list of functions
      Add functions to check diacr/func existance
      Add pancyrillic font
      po: Update translations (from translationproject.org)
      vlock: implement PAM account and password management
      vlock: rename ERROR_TIMEOUT macro to LONG_DELAY
      vlock: introduce short delays after non-fatal PAM errors
      Added Latvian keymap
      (changelog taken from
      http://lists.altlinux.org/pipermail/kbd/2014-July/000476.html)
    * add kbd-2.0.2-comment-typo-qwerty.patch [bnc#825385]
    * Thu Jul 24 20:31:47 UTC 2014 - dimstar@opensuse.org
    * No longer recommend fbset: the package does no longer exist in
      openSUSE since late 2013.
    * Sun Nov  3 17:51:09 UTC 2013 - dap.darkness@gmail.com
    * Update to version 2.0.1:
    * Disable arch-specific tests.
    * Fix regression in processing alt_is_meta keyword.
    * Rename Bepo keymaps:
      dvorak-fr-bepo.map -> fr-bepo-latin9.map
      dvorak-fr-bepo-utf8.map -> fr-bepo.map.
    * Deleted kbd-1.15.2-dumpkeys-ppc.patch as obsolete:
      http://lists.opensuse.org/opensuse-factory/2013-08/msg00347.html
    * gcc 4.6+ became required to prevent compilling error:
      "expected declaration specifiers or '...' before 'va_list'".
    * Mon Aug 19 18:27:19 UTC 2013 - dap.darkness@gmail.com
    * Update to version 2.0.0:
    * Add bepo keyboard layout;
    * Add libkeymap;
    * The loadkeys and dumpkeys always use the libkeymap.
    * Updated patches because of docs moved:
    * kbd-1.15.2-chvt-userwait.patch
    * kbd-1.15.2-docu-X11R6-xorg.patch
    * Disabled patches because of dumpkeys rewritten:
    * kbd-1.15.2-dumpkeys-C-opt.patch
    * kbd-1.15.2-dumpkeys-ppc.patch


author: mgorman@suse.de
changelog:
  - blacklist.conf: Complex dependencies missing, fix only in the event of a customer bug
  - commit ede2396


author: mgorman@suse.de
changelog:
  - blacklist.conf: Complex dependencies missing, fix only in the event of a customer bug
  - commit d6a80de


author: mgorman@suse.de
changelog:
  - blacklist.conf: Complex dependencies missing, fix only in the event of a customer bug
  - commit bb2fa98


author: mgorman@suse.de
changelog:
  - blacklist.conf: Complex dependencies missing, fix only in the event of a customer bug
  - commit 9afb234


author: mgorman@suse.de
changelog:
  - blacklist.conf: Complex dependencies missing, fix only in the event of a customer bug
  - commit b83449b


author: mgorman@suse.de
changelog:
  - sched/fair: Don't balance task to its current running CPU
    (git fixes (sched)).
  - sched/core: Mitigate race
    cpus_share_cache()/update_top_cache_domain() (git fixes
    (sched)).
  - sched: Reenable interrupts in do_sched_yield() (git fixes
    (sched)).
  - sched: correct SD_flags returned by tl->sd_flags() (git fixes
    (sched)).
  - sched: Avoid scale real weight down to zero (git fixes (sched)).
  - sched/core: Fix migration to invalid CPU in
    __set_cpus_allowed_ptr() (git fixes (sched)).
  - sched/rt: Restore rt_runtime after disabling RT_RUNTIME_SHARE
    (git fixes (sched)).
  - sched/rt: Minimize rq->lock contention in
    do_sched_rt_period_timer() (git fixes (sched)).
  - commit 913e5fc


author: oneukum@suse.com
changelog:
  - USB: ene_usb6250: Allocate enough memory for full object
    (bsc#1216051 CVE-2023-45862).
  - commit 6d3e018


author: mmarek@suse.cz
changelog:
  - testsutie: Uncompress most modules (updated test-files.tar.xz)
  - testsuite: Do not run tests with *.ko.gz if zlib is not enabled
  - Disable compression support, as other tools do not support it
    (e.g. module signing)


author: mmarek@suse.cz
changelog:
  - Updated to kmod 17
    * Do not require xsltproc for build
    * Parse softdeps stored in kernel modules
    * Add experimental python bindings (not enabled in the package yet)
    * Misc bugfixes
  - Deleted patches that went upstream. Only the unsupported modules
    feature remains:
    0002-modprobe-Recognize-allow-unsupported-modules-on-comm.patch
    0003-libkmod-config-Recognize-allow_unsupported_modules-i.patch
    0009-libkmod-Implement-filtering-of-unsupported-modules-o.patch
    0010-modprobe-Implement-allow-unsupported-modules.patch
    0001-Do-not-filter-unsupported-modules-when-running-a-van.patch


author: dvaleev@suse.com
changelog:
  - Fix kernel master build for ppc64le (bsc#1070209)
    depmod-Ignore_PowerPC64_ABIv2_.TOC.symbol.patch


author: mmarek@suse.cz
changelog:
  - libkmod: Handle long lines in /proc/modules (bsc#983754)
    0001-libkmod-Handle-long-lines-in-proc-modules.patch


author: martin.wilck@suse.com
changelog:
  - Fix race while loading modules (bsc#998906)
    * Add 0001-Fix-race-while-loading-modules.patch (upstream fd44a98)


author: msuchanek@suse.com
changelog:
  - Fix resolving .TOC. in modules on 4.4 and older kernel (bsc#1070209)
    depmod-Don-t-add-.TOC.-when-it-s-in-the-kernel.patch


author: msuchanek@suse.de
changelog:
  - Fix module dependency file corruption on parallel invocation (bsc#1118629).
    depmod-Prevent-module-dependency-files-corruption-du.patch
    depmod-Prevent-module-dependency-files-missing-durin.patch


author: msuchanek@suse.de
changelog:
  - Fix warming in libkmod.h (boo#1097869).
    kmod-build-cure-compiler-warnings-showing-up-externa.patch
  - Prevent potential buffer overflow in libkmod (bsc#1118629).
    depmod-shut-up-gcc-insufficinet-buffer-warning.patch


author: lnussel@suse.de
changelog:
  - Update to version 0.0+git20171227.670229c:
    * Added ABI version number
    * AVX2/AVX-512F optimizations of BLAMKA
    * Set Argon2 version number from the command line
    * New bindings
    * Minor bug and warning fixes (no security issue)
  - use _service file


author: alexander_naumov@opensuse.org
changelog:
  - Update to version 1.7.2:
    * Update LUKS documentation format.
      Clarify fixed sector size and keyslots alignment.
    * Support activation options for error handling modes in
      Linux kernel dm-verity module:
    - -ignore-corruption - dm-verity just logs detected corruption
    - -restart-on-corruption - dm-verity restarts the kernel if
      corruption is detected
      If the options above are not specified, default behavior for
      dm-verity remains. Default is that I/O operation fails with
      I/O error if corrupted block is detected.
    - -ignore-zero-blocks - Instructs dm-verity to not verify
      blocks that are expected to contain zeroes and always
      return zeroes directly instead.
      NOTE that these options could have security or functional
      impacts, do not use them without assessing the risks!
    * Fix help text for cipher benchmark specification
      (mention --cipher option).
    * Fix off-by-one error in maximum keyfile size.
      Allow keyfiles up to compiled-in default and not that value
      minus one.
    * Support resume of interrupted decryption in cryptsetup-reencrypt
      utility. To resume decryption, LUKS device UUID (--uuid option)
      option must be used.
    * Do not use direct-io for LUKS header with unaligned keyslots.
      Such headers were used only by the first cryptsetup-luks-1.0.0
      release (2005).
    * Fix device block size detection to properly work on particular
      file-based containers over underlying devices with 4k sectors.
  - Update to version 1.7.1:
    * Code now uses kernel crypto API backend according to new
      changes introduced in mainline kernel
      While mainline kernel should contain backward compatible
      changes, some stable series kernels do not contain fully
      backported compatibility patches.
      Without these patches  most of cryptsetup operations
      (like unlocking device) fail.
      This change in cryptsetup ensures that all operations using
      kernel crypto API works even on these kernels.
    * The cryptsetup-reencrypt utility now properly detects removal
      of underlying link to block device and does not remove
      ongoing re-encryption log.
      This allows proper recovery (resume) of reencrypt operation later.
      NOTE: Never use /dev/disk/by-uuid/ path for reencryption utility,
      this link disappears once the device metadata is temporarily
      removed from device.
    * Cryptsetup now allows special "-" (standard input) keyfile handling
      even for TCRYPT (TrueCrypt and VeraCrypt compatible) devices.
    * Cryptsetup now fails if there are more keyfiles specified
      for non-TCRYPT device.
    * The luksKillSlot command now does not suppress provided password
      in batch mode (if password is wrong slot is not destroyed).
      Note that not providing password in batch mode means that keyslot
      is destroyed unconditionally.


author: mpluskal@suse.com
changelog:
  - Update to version 1.7.4:
    * Allow to specify LUKS1 hash algorithm in Python luksFormat
      wrapper.
    * Use LUKS1 compiled-in defaults also in Python wrapper.
    * OpenSSL backend: Fix OpenSSL 1.1.0 support without backward
      compatible API.
    * OpenSSL backend: Fix LibreSSL compatibility.
    * Check for data device and hash device area overlap in
      veritysetup.
    * Fix a possible race while allocating a free loop device.
    * Fix possible file descriptor leaks if libcryptsetup is run from
      a forked process.
    * Fix missing same_cpu_crypt flag in status command.
    * Various updates to FAQ and man pages.
  - Changes for version 1.7.3:
    * Fix device access to hash offsets located beyond the 2GB device
      boundary in veritysetup.
    * Set configured (compile-time) default iteration time for
      devices created directly through libcryptsetup
    * Fix PBKDF2 benchmark to not double iteration count for specific
      corner case.
    * Verify passphrase in cryptsetup-reencrypt when encrypting a new
      drive.
    * OpenSSL backend: fix memory leak if hash context was repeatedly
      reused.
    * OpenSSL backend: add support for OpenSSL 1.1.0.
    * Fix several minor spelling errors.
    * Properly check maximal buffer size when parsing UUID from
      /dev/disk/.


author: mpluskal@suse.com
changelog:
  - Update to version 1.7.5:
    * Fixes to luksFormat to properly support recent kernel running
      in FIPS mode (bsc#1031998).
    * Fixes accesses to unaligned hidden legacy TrueCrypt header.
    * Fixes to optional dracut ramdisk scripts for offline
      re-encryption on initial boot.


author: archie.cobbs@gmail.com
changelog:
  - Update to version 2.0.0:
    * Add support for new on-disk LUKS2 format
    * Enable to use system libargon2 instead of bundled version
    * Install tmpfiles.d configuration for LUKS2 locking directory
    * New command integritysetup: support for the new dm-integrity kernel target
    * Support for larger sector sizes for crypt devices
    * Miscellaneous fixes and improvements


author: astieger@suse.com
changelog:
  - update to 2.0.1:
    * To store volume key into kernel keyring, kernel 4.15 with
      dm-crypt 1.18.1 is required
    * Increase maximum allowed PBKDF memory-cost limit to 4 GiB
    * Use /run/cryptsetup as default for cryptsetup locking dir
    * Introduce new 64-bit byte-offset *keyfile_device_offset functions.
    * New set of fucntions that allows 64-bit offsets even on 32bit systems
      are now availeble:
    - crypt_resume_by_keyfile_device_offset
    - crypt_keyslot_add_by_keyfile_device_offset
    - crypt_activate_by_keyfile_device_offset
    - crypt_keyfile_device_read
      The new functions have added the _device_ in name.
      Old functions are just internal wrappers around these.
    * Also cryptsetup --keyfile-offset and --new-keyfile-offset now
      allows 64-bit offsets as parameters.
    * Add error hint for wrongly formatted cipher strings in LUKS1 and
      properly fail in luksFormat if cipher format is missing required IV.


author: lnussel@suse.de
changelog:
  - New version 2.0.4
    Changes since version 2.0.3
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~
    * Use the libblkid (blockid) library to detect foreign signatures
      on a device before LUKS format and LUKS2 auto-recovery.
      This change fixes an unexpected recovery using the secondary
      LUKS2 header after a device was already overwritten with
      another format (filesystem or LVM physical volume).
      LUKS2 will not recreate a primary header if it detects a valid
      foreign signature. In this situation, a user must always
      use cryptsetup repair command for the recovery.
      Note that libcryptsetup and utilities are now linked to libblkid
      as a new dependence.
      To compile code without blockid support (strongly discouraged),
      use --disable-blkid configure switch.
    * Add prompt for format and repair actions in cryptsetup and
      integritysetup if foreign signatures are detected on the device
      through the blockid library.
      After the confirmation, all known signatures are then wiped as
      part of the format or repair procedure.
    * Print consistent verbose message about keyslot and token numbers.
      For keyslot actions: Key slot <number> unlocked/created/removed.
      For token actions: Token <number> created/removed.
    * Print error, if a non-existent token is tried to be removed.
    * Add support for LUKS2 token definition export and import.
      The token command now can export/import customized token JSON file
      directly from command line. See the man page for more details.
    * Add support for new dm-integrity superblock version 2.
    * Add an error message when nothing was read from a key file.
    * Update cryptsetup man pages, including --type option usage.
    * Add a snapshot of LUKS2 format specification to documentation
      and accordingly fix supported secondary header offsets.
    * Add bundled optimized Argon2 SSE (X86_64 platform) code.
      If the bundled Argon2 code is used and the new configure switch
    - -enable-internal-sse-argon2 option is present, and compiler flags
      support required optimization, the code will try to use optimized
      and faster variant.
      Always use the shared library (--enable-libargon2) if possible.
      This option was added because an enterprise distribution
      rejected to support the shared Argon2 library and native support
      in generic cryptographic libraries is not ready yet.
    * Fix compilation with crypto backend for LibreSSL >= 2.7.0.
      LibreSSL introduced OpenSSL 1.1.x API functions, so compatibility
      wrapper must be commented out.
    * Fix on-disk header size calculation for LUKS2 format if a specific
      data alignment is requested. Until now, the code used default size
      that could be wrong for converted devices.
    Changes since version 2.0.2
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~
    * Expose interface to unbound LUKS2 keyslots.
      Unbound LUKS2 keyslot allows storing a key material that is independent
      of master volume key (it is not bound to encrypted data segment).
    * New API extensions for unbound keyslots (LUKS2 only)
      crypt_keyslot_get_key_size() and crypt_volume_key_get()
      These functions allow to get key and key size for unbound keyslots.
    * New enum value CRYPT_SLOT_UNBOUND for keyslot status (LUKS2 only).
    * Add --unbound keyslot option to the cryptsetup luksAddKey command.
    * Add crypt_get_active_integrity_failures() call to get integrity
      failure count for dm-integrity devices.
    * Add crypt_get_pbkdf_default() function to get per-type PBKDF default
      setting.
    * Add new flag to crypt_keyslot_add_by_key() to force update device
      volume key. This call is mainly intended for a wrapped key change.
    * Allow volume key store in a file with cryptsetup.
      The --dump-master-key together with --master-key-file allows cryptsetup
      to store the binary volume key to a file instead of standard output.
    * Add support detached header for cryptsetup-reencrypt command.
    * Fix VeraCrypt PIM handling - use proper iterations count formula
      for PBKDF2-SHA512 and PBKDF2-Whirlpool used in system volumes.
    * Fix cryptsetup tcryptDump for VeraCrypt PIM (support --veracrypt-pim).
    * Add --with-default-luks-format configure time option.
      (Option to override default LUKS format version.)
    * Fix LUKS version conversion for detached (and trimmed) LUKS headers.
    * Add luksConvertKey cryptsetup command that converts specific keyslot
      from one PBKDF to another.
    * Do not allow conversion to LUKS2 if LUKSMETA (external tool metadata)
      header is detected.
    * More cleanup and hardening of LUKS2 keyslot specific validation options.
      Add more checks for cipher validity before writing metadata on-disk.
    * Do not allow LUKS1 version downconversion if the header contains tokens.
    * Add "paes" family ciphers (AES wrapped key scheme for mainframes)
      to allowed ciphers.
      Specific wrapped ley configuration logic must be done by 3rd party tool,
      LUKS2 stores only keyslot material and allow activation of the device.
    * Add support for --check-at-most-once option (kernel 4.17) to veritysetup.
      This flag can be dangerous; if you can control underlying device
      (you can change its content after it was verified) it will no longer
      prevent reading tampered data and also it does not prevent silent
      data corruptions that appear after the block was once read.
    * Fix return code (EPERM instead of EINVAL) and retry count for bad
      passphrase on non-tty input.
    * Enable support for FEC decoding in veritysetup to check dm-verity devices
      with additional Reed-Solomon code in userspace (verify command).
    Changes since version 2.0.1
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~
    * Fix a regression in early detection of inactive keyslot for luksKillSlot.
      It tried to ask for passphrase even for already erased keyslot.
    * Fix a regression in loopaesOpen processing for keyfile on standard input.
      Use of "-" argument was not working properly.
    * Add LUKS2 specific options for cryptsetup-reencrypt.
      Tokens and persistent flags are now transferred during reencryption;
      change of PBKDF keyslot parameters is now supported and allows
      to set precalculated values (no benchmarks).
    * Do not allow LUKS2 --persistent and --test-passphrase cryptsetup flags
      combination. Persistent flags are now stored only if the device was
      successfully activated with the specified flags.
    * Fix integritysetup format after recent Linux kernel changes that
      requires to setup key for HMAC in all cases.
      Previously integritysetup allowed HMAC with zero key that behaves
      like a plain hash.
    * Fix VeraCrypt PIM handling that modified internal iteration counts
      even for subsequent activations. The PIM count is no longer printed
      in debug log as it is sensitive information.
      Also, the code now skips legacy TrueCrypt algorithms if a PIM
      is specified (they cannot be used with PIM anyway).
    * PBKDF values cannot be set (even with force parameters) below
      hardcoded minimums. For PBKDF2 is it 1000 iterations, for Argon2
      it is 4 iterations and 32 KiB of memory cost.
    * Introduce new crypt_token_is_assigned() API function for reporting
      the binding between token and keyslots.
    * Allow crypt_token_json_set() API function to create internal token types.
      Do not allow unknown fields in internal token objects.
    * Print message in cryptsetup that about was aborted if a user did not
      answer YES in a query.


author: lnussel@suse.de
changelog:
  - Suggest hmac package (boo#1090768)
  - remove old upgrade hack for upgrades from 12.1
  - New version 2.0.5
    Changes since version 2.0.4
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~
    * Wipe full header areas (including unused) during LUKS format.
      Since this version, the whole area up to the data offset is zeroed,
      and subsequently, all keyslots areas are wiped with random data.
      This ensures that no remaining old data remains in the LUKS header
      areas, but it could slow down format operation on some devices.
      Previously only first 4k (or 32k for LUKS2) and the used keyslot
      was overwritten in the format operation.
    * Several fixes to error messages that were unintentionally replaced
      in previous versions with a silent exit code.
      More descriptive error messages were added, including error
      messages if
    - a device is unusable (not a block device, no access, etc.),
    - a LUKS device is not detected,
    - LUKS header load code detects unsupported version,
    - a keyslot decryption fails (also happens in the cipher check),
    - converting an inactive keyslot.
    * Device activation fails if data area overlaps with LUKS header.
    * Code now uses explicit_bzero to wipe memory if available
      (instead of own implementation).
    * Additional VeraCrypt modes are now supported, including Camellia
      and Kuznyechik symmetric ciphers (and cipher chains) and Streebog
      hash function. These were introduced in a recent VeraCrypt upstream.
      Note that Kuznyechik requires out-of-tree kernel module and
      Streebog hash function is available only with the gcrypt cryptographic
      backend for now.
    * Fixes static build for integritysetup if the pwquality library is used.
    * Allows passphrase change for unbound keyslots.
    * Fixes removed keyslot number in verbose message for luksKillSlot,
      luksRemoveKey and erase command.
    * Adds blkid scan when attempting to open a plain device and warn the user
      about existing device signatures in a ciphertext device.
    * Remove LUKS header signature if luksFormat fails to add the first keyslot.
    * Remove O_SYNC from device open and use fsync() to speed up
      wipe operation considerably.
    * Create --master-key-file in luksDump and fail if the file already exists.
    * Fixes a bug when LUKS2 authenticated encryption with a detached header
      wiped the header device instead of dm-integrity data device area (causing
      unnecessary LUKS2 header auto recovery).


author: lnussel@suse.de
changelog:
  - New version 2.0.6 (jsc#SLE-5911, bsc#1165580):
    Changes since version 2.0.5
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~
    * Fix support of larger metadata areas in LUKS2 header.
      This release properly supports all specified metadata areas, as documented
      in LUKS2 format description (see docs/on-disk-format-luks2.pdf in archive).
      Currently, only default metadata area size is used (in format or convert).
      Later cryptsetup versions will allow increasing this metadata area size.
    * If AEAD (authenticated encryption) is used, cryptsetup now tries to check
      if the requested AEAD algorithm with specified key size is available
      in kernel crypto API.
      This change avoids formatting a device that cannot be later activated.
      For this function, the kernel must be compiled with the
      CONFIG_CRYPTO_USER_API_AEAD option enabled.
      Note that kernel user crypto API options (CONFIG_CRYPTO_USER_API and
      CONFIG_CRYPTO_USER_API_SKCIPHER) are already mandatory for LUKS2.
    * Fix setting of integrity no-journal flag.
      Now you can store this flag to metadata using --persistent option.
    * Fix cryptsetup-reencrypt to not keep temporary reencryption headers
      if interrupted during initial password prompt.
    * Adds early check to plain and LUKS2 formats to disallow device format
      if device size is not aligned to requested sector size.
      Previously it was possible, and the device was rejected to activate by
      kernel later.
    * Fix checking of hash algorithms availability for PBKDF early.
      Previously LUKS2 format allowed non-existent hash algorithm with
      invalid keyslot preventing the device from activation.
    * Allow Adiantum cipher construction (a non-authenticated length-preserving
      fast encryption scheme), so it can be used both for data encryption and
      keyslot encryption in LUKS1/2 devices.
      For benchmark, use:
      [#] cryptsetup benchmark -c xchacha12,aes-adiantum
      [#] cryptsetup benchmark -c xchacha20,aes-adiantum
      For LUKS format:
      [#] cryptsetup luksFormat -c xchacha20,aes-adiantum-plain64 -s 256 <device>
      The support for Adiantum will be merged in Linux kernel 4.21.
      For more info see the paper https://eprint.iacr.org/2018/720.


author: pmonreal@suse.com
changelog:
  - luksFormat: Handle system with low memory and no swap space [bsc#1211079]
    * Check for physical memory available also in PBKDF benchmark.
    * Try to avoid OOM killer on low-memory systems without swap.
    * Use only half of detected free memory on systems without swap.
    * Add patches:
    - cryptsetup-Check-for-physical-memory-available-also-in-PBKDF-be.patch
    - cryptsetup-Try-to-avoid-OOM-killer-on-low-memory-systems-withou.patch
    - cryptsetup-Use-only-half-of-detected-free-memory-on-systems-wit.patch


author: tonyj@suse.com
changelog:
  - Fix integer overflow in check_section (CVE-2014-0172, bnc#872785)
    Add patch: elfutils-check-for-overflow-before-calling-malloc-to-uncompress-data.patch


author: tonyj@suse.com
changelog:
  - CVE-2014-9447: elfutils: Directory traversal vulnerability (bnc#911662)
    Add patch: elfutils-fix-dir-traversal-vuln-in-ar-extraction.patch


author: jmoreira@suse.com
changelog:
  - CVE-2017-7613: elfutils: denial of service (memory consumption)
    via a crafted ELF file (bnc#1033090)
    Add patch:
    elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
  - CVE-2017-7612: elfutils: denial of service (heap-based buffer
    over-read and application crash) via a crafted ELF file
    (bnc#1033089)
    Add patch: elfutils-dont-trust-sh_entsize.patch


author: jmoreira@suse.com
changelog:
  - Fix warnings captured by asan while reproducing the bugs below
    Add patch:
    elfutils-prevent-incorrect-memory-read.patch
  - CVE-2016-10254: elfutils: memory allocation failure in allocate_elf
    (common.h) (bnc#1030472)
    Add patch:
    libelf-always-set-elf-maxsize-when-reading.patch
  - CVE-2016-10255: elfutils: memory allocation failure in
    __libelf_set_rawdata_wrlock (elf_getdata.c) (bnc#1030476)
    Add patch:
    libelf-sanity-check-offset-and-size.patch
  - CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the
    function arlib_add_symbols() used by eu-ranlib (bnc#1112723)
    Add patch:
    arlib-check-that-sh_entsize-isnt-zero.patch
  - CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and
    application crash) via a crafted ELF file (bnc#1033088)
    Add patch:
    elflint-check-symbol-table-data-is-big-enough-before-check.patch
  - CVE-2017-7610: elflint: heap-based buffer overflow in check_group
    (bnc#1033087)
    Add patch:
    elflint-dont-check-section-group-without-flags-word.patch
  - CVE-2018-16062: heap-buffer-overflow in
    /elfutils/libdw/dwarf_getaranges.c:156 (bnc#1106390)
    Add patch:
    libdw-readelf-make-sure-there-is-enough-data-to-read.patch
  - CVE-2018-18310: Invalid Address Read problem in
    dwfl_segment_report_module.c (bnc#1111973)
    Add patch:
    libdwfl-sanity-check-partial-core-file-data-reads.patch
  - CVE-2019-7150: dwfl_segment_report_module doesn't check whether
    the dyn data read from core file is truncated (bnc#1123685)
    Add patch:
    libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
  - CVE-2019-7665: NT_PLATFORM core file note should be a zero
    terminated string (CVE is a bit misleading, as this is not a bug
    in libelf as described) (bnc#1125007)
    Add patch:
    libebl-check-NT_PLATFORM-core-notes.patch
  - CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi
    (readelf.c) (bnc#1033084)
    Add patch:
    readelf-fix-off-by-one-sanity-check.patch
  - CVE-2018-18520: eu-size: Bad handling of ar files inside are
    files (bnc#1112726)
    Add patch:
    size-handle-recursive-elf-ar-files.patch
  - CVE-2017-7608: heap-based buffer overflow in
    ebl_object_note_type_name (eblobjnotetypename.c) (bnc#1033085)
    Add patch:
    use-the-empty-string-for-note-names-with-zero-size.patch


author: jmoreira@suse.com
changelog:
  - CVE-2018-16403: elfutils: Heap-based buffer over-read in
    libdw/dwarf_getabbrev.c and libdw/dwarf_hasattr.c causes crash
    (bnc#1107067)
    Add patch:
    libdw-check-end-of-attributes-list-consistently.patch
  - Add reference number to patch
    elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch


author: martin.liska@suse.com
changelog:
  - Add elfutils-nm-Fix-nm-external-sysv-format-output.patch
    [bsc#1157578].
    Fix nm issue: if index zero wasn't a real symbol it has already
    been filtered out in show_symbols so don't skip it in show_symbols_sysv.


author: crrodriguez@opensuse.org
changelog:
  - Fix LFS support in x86.
  - Do not build with -Werror
  - Remove "la" files
  - tune up autotools scripts as well ensure config.h is included
    everywhere


author: bruno@ioda-net.ch
changelog:
  - Update to 0.10 version :
    * Add a json_object_to_json_string_ext() function to allow output
    to be formatted in a more human readable form.
    * Add json_object_object_get_ex(), a NULL-safe get object method,
    to be able to distinguish between a key not present and the value
    being NULL.
    * Add an alternative iterator implementation, see json_object_iterator.h
    * Make json_object_iter public to enable external use of the
      json_object_object_foreachC macro.
    * Add a printbuf_memset() function to provide an effecient way to set and
      append things like whitespace indentation.
    * Adjust json_object_is_type and json_object_get_type so they return
      json_type_null for NULL objects and handle NULL passed to
      json_objct_object_get().
    * Rename boolean type to json_bool.
    * Fix various compile issues for Visual Studio and MinGW.
    * Allow json_tokener_parse_ex() to be re-used to parse multiple object.
      Also, fix some parsing issues with capitalized hexadecimal numbers and
      number in E notation.
    * Add json_tokener_get_error() and json_tokener_error_desc() to better
      encapsulate the process of retrieving errors while parsing.
    * Various improvements to the documentation of many functions.
    * Add new json_object_array_sort() function.
    * Fix a bug in json_object_get_int(), which would incorrectly return 0
      when called on a string type object.
      Eric Haszlakiewicz
    * Add a json_type_to_name() function.
      Eric Haszlakiewicz
    * Add a json_tokener_parse_verbose() function.
      Jehiah Czebotar
    * Improve support for null bytes within JSON strings.
      Jehiah Czebotar
    * Fix file descriptor leak if memory allocation fails in json_util
      Zachary Blair, zack_blair at hotmail dot com
    * Add int64 support. Two new functions json_object_net_int64 and
      json_object_get_int64. Binary compatibility preserved.
      Eric Haszlakiewicz, EHASZLA at transunion com
      Rui Miguel Silva Seabra, rms at 1407 dot org
    * Fix subtle bug in linkhash where lookup could hang after all slots
      were filled then successively freed.
      Spotted by Jean-Marc Naud, j dash m at newtraxtech dot com
    * Make json_object_from_file take const char *filename
      Spotted by Vikram Raj V, vsagar at attinteractive dot com
    * Add handling of surrogate pairs (json_tokener.c, test4.c, Makefile.am)
      Brent Miller, bdmiller at yahoo dash inc dot com
    * Correction to comment describing printbuf_memappend in printbuf.h
      Brent Miller, bdmiller at yahoo dash inc dot com
  - Packaging :
    * upgrade upstream location https://gitub.com/json-c/json-c/wiki
    * cleanup old patches included now upstream
    . json-c-0.9-linkhash.patch
    . json-c-0.9-json_tokener.patch
    . json-c-0.9-json_object_from_file.patch
    . json-c-0.9-base.patch
    * Redone lfs patch against new 0.10 release
    * Removed empty NEWS file


author: fstrba@suse.com
changelog:
  - Upgrade to 0.11 version:
    - SONAME change.
    - Fix provides and obsoletes accordingly
    - symlink the .pc file to the oldname for software that needs it
  - Remove json-c-fix-headers.patch integrated upstream


author: idonmez@suse.com
changelog:
  - Add json-c-hash-dos-and-overflow-random-seed-4e.patch to fix
    CVE-2013-6370 and CVE-2013-6371 (bnc#870147)


author: andreas.stieger@gmx.de
changelog:
  - json-c 0.12
    Fixes for security issues contained in this release have been
    previously patched into this package, but listed for completeness:
    * Address security issues:
    * CVE-2013-6371: hash collision denial of service
    * CVE-2013-6370: buffer overflow if size_t is larger than int
  - Further changes:
    * Avoid potential overflow in json_object_get_double
    * Eliminate the mc_abort() function and MC_ABORT macro.
    * Make the json_tokener_errors array local.  It has been deprecated for
      a while, and json_tokener_error_desc() should be used instead.
    * change the floating point output format to %.17g so values with
      more than 6 digits show up in the output.
    * Remove the old libjson.so name compatibility support.  The library is
      only created as libjson-c.so now and headers are only installed
      into the ${prefix}/json-c directory.
    * When supported by the linker, add the -Bsymbolic-functions flag.
    * Make strict mode more strict:
    * number must not start with 0
    * no single-quote strings
    * no comments
    * trailing char not allowed
    * only allow lowercase literals
    * Added a json_object_new_double_s() convenience function to allow
      an exact string representation of a double to be specified when
      creating the object and use it in json_tokener_parse_ex() so
      a re-serialized object more exactly matches the input.
    * Add support NaN and Infinity
  - packaging changes:
    * json-c-hash-dos-and-overflow-random-seed-4e.patch is upstream
    * Move from json-c-lfs.patch which removed warning errors and
      autoconf call to json-c-0.12-unused_variable_size.patch from
      upstream which fixes the warning
    * except for SLE 11 where autoreconf call is required
    * add licence file to main package


author: rpm@fthiessen.de
changelog:
  - Update to upstream release 0.12.1
  - Removed upstream fixed json-c-0.12-unused_variable_size.patch
  - Added fix-set-but-not-used.patch


author: crrodriguez@opensuse.org
changelog:
  - package fails to build with PIE globally enabled, due to
    error: inconsistent operand constraints in an 'asm'.
    Turns out there is a GCC builtin for doing the operation
    cleanly. (numactl-clearcache-pie.patch)


author: fschnizlein@suse.com
changelog:
  - Update to 2.0.11
    * 150116 libnuma: numa_node_to_cpu skips over non-existing
      nodes (Petr Holasek)
    * 151210 libnuma: supress warnings for non-existing node (Petr Holasek)


author: fschnizlein@suse.com
changelog:
  - Update to latest HEAD (ea3a70681c2f523fe58e1d44527f478ca76db74e)
    * Fix usage of __GLIBC_PREREQ for non-glibc toolchains
    * Fix usage of __GLIBC_PREREQ for non-glibc toolchains
    * Clean up numa_error() calls.
    * Handle sched_getaffinity() failing with errno != EINVAL.
    * "Further more" should be a single word
    * Fix for numa_police_memory()
    * Segment fault when numa nodes not sequential or contiguous
    * Update prototype of get_mempolicy


author: matwey.kornilov@gmail.com
changelog:
  - Disable building at 32-bit ARM.
    NUMA is not supported by 32-bit ARM Linux Kernel, so build failed
    with
    [#]error "Add syscalls for your architecture or update kernel headers"


author: egotthold@suse.com
changelog:
  - Update to version 2.0.12:
    * Release numactl 2.0.12
    * Cleanup whitespace from *.c and *.h files
    * Add Travis build status to numactl README
    * Convert README and INSTALL to Markdown
    * Remove `threadtest.c`
    * Remove `mkolddemo` script
    * Remove file TODO, which has outdated contents
    * Remove file DESIGN, which has no contents
    * Remove changelogs from the repository
    * Revert "make clearcache work on x86/PIC"
    * Add "NAME" section to numastat manpage
    * Allow building on ARM systems
    * Add pkg-config file for NUMA library
    * readdir_r(3) is deprecated, use readdir(3) instead
    * Avoid filename truncation in numastat
    * fix coding style in last change
    * Fix: numademo test between sparse nodes
    * Fix: allocation of dynamic array
    * Fix: numactl distance between sparse nodes
    * include sys/sysmacros.h for major/minor
    * make clearcache work on x86/PIC
    * Fix regress test for invalid hard code of nodenames
    * Fix end of line check in distance parsing
    * Optimize numa_distance check
    * affinity: Include sys/sysmacros.h to fix warning
    * numademo: Increase buffer to avoid theoretical buffer overflow
    * Check for invalid nodes in numa_distance


author: trenn@suse.de
changelog:
  - For obs regression checker, this version includes following SLE
    fixes:
    - enable build for aarch64 (fate#319973) (bsc#976199)
      factory has an extra patch to disable ARM 32 bit archs which
      looks a bit misleading as %arm macro only covers 32 bit ARM.
    - Bug 955334 - numactl/libnuma: add patch for Dynamic Reconfiguration
      bsc#955334


author: jsikes@suse.com
changelog:
  - Added openssl-1_0_0-paramgen-default_to_rfc7919.patch
    * bsc#1180995
    * Default to RFC7919 groups when generating ECDH parameters
      using 'genpkey' or 'dhparam' in FIPS mode.


author: otto.hollmann@suse.com
changelog:
  - Update further expiring certificates that affect tests [bsc#1201627]
    * Add openssl-Update-further-expiring-certificates.patch


author: otto.hollmann@suse.com
changelog:
  - Security Fix: [bsc#1207533, CVE-2023-0286]
    * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
      for x400Address
    * Add openssl-CVE-2023-0286.patch
  - Security Fix: [bsc#1207536, CVE-2023-0215]
    * Use-after-free following BIO_new_NDEF()
    * Add patches:
    - openssl-CVE-2023-0215-1of4.patch
    - openssl-CVE-2023-0215-2of4.patch
    - openssl-CVE-2023-0215-3of4.patch
    - openssl-CVE-2023-0215-4of4.patch
    - openssl-Groundwork-for-a-perl-based-testing-framework.patch
    - openssl-Add-recipes-for-the-larger-protocols.patch
  - Security Fix: [bsc#1207534, CVE-2022-4304]
    * Timing Oracle in RSA Decryption
    * Add openssl-CVE-2022-4304.patch


author: otto.hollmann@suse.com
changelog:
  - Fix DH key generation in FIPS mode, add support for constant BN for
    DH parameters [bsc#1202062]
    * Add patch: openssl-fips_fix_DH_key_generation.patch


author: otto.hollmann@suse.com
changelog:
  - Security Fix: [CVE-2023-0464, bsc#1209624]
    * Excessive Resource Usage Verifying X.509 Policy Constraints
    * Add openssl-CVE-2023-0464.patch


author: otto.hollmann@suse.com
changelog:
  - Security Fix: [CVE-2023-0465, bsc#1209878]
    * Invalid certificate policies in leaf certificates are silently ignored
    * Add openssl-CVE-2023-0465.patch
  - Security Fix: [CVE-2023-0466, bsc#1209873]
    * Certificate policy check not enabled
    * Add openssl-CVE-2023-0466.patch


author: otto.hollmann@suse.com
changelog:
  - Security Fix: [CVE-2023-2650, bsc#1211430]
    * Possible DoS translating ASN.1 object identifiers
    * Add openssl-CVE-2023-2650.patch


author: otto.hollmann@suse.com
changelog:
  - Security Fix: [bsc#1207534, CVE-2022-4304]
    * Reworked the Fix for the Timing Oracle in RSA Decryption
      The previous fix for this timing side channel turned out to cause
      a severe 2-3x performance regression in the typical use case
      compared to 1.1.1s.
    * Reworked openssl-CVE-2022-4304.patch
    * Refreshed openssl-CVE-2023-0286.patch


author: pmonreal@suse.com
changelog:
  - Security fix: [bsc#1213487, CVE-2023-3446]
    * Fix DH_check() excessive time with over sized modulus.
    * The function DH_check() performs various checks on DH parameters.
      One of those checks confirms that the modulus ("p" parameter) is
      not too large. Trying to use a very large modulus is slow and
      OpenSSL will not normally use a modulus which is over 10,000 bits
      in length.
      However the DH_check() function checks numerous aspects of the
      key or parameters that have been supplied. Some of those checks
      use the supplied modulus value even if it has already been found
      to be too large.
      A new limit has been added to DH_check of 32,768 bits. Supplying
      a key/parameters with a modulus over this size will simply cause
      DH_check() to fail.
    * Add openssl-CVE-2023-3446.patch


author: otto.hollmann@suse.com
changelog:
  - Security fix: (bsc#1213853, CVE-2023-3817)
    * Fix excessive time spent checking DH q parameter value
      (bsc#1213853, CVE-2023-3817). The function DH_check() performs
      various checks on DH parameters. After fixing CVE-2023-3446 it
      was discovered that a large q parameter value can also trigger
      an overly long computation during some of these checks. A
      correct q value, if present, cannot be larger than the modulus
      p parameter, thus it is unnecessary to perform these checks if
      q is larger than p. If DH_check() is called with such q parameter
      value, DH_CHECK_INVALID_Q_VALUE return flag is set and the
      computationally intensive checks are skipped.
    * Add openssl-1_0-CVE-2023-3817.patch


author: vcizek@suse.com
changelog:
  - Obsolete openssl-debuginfo
    * the package doesn't exist any more, has been replaced by
      openssl-{so_version}-debuginfo (bsc#1040172)


author: vcizek@suse.com
changelog:
  - Revert version back to 1.0.2m to get security fixes quickly to
    Tumbleweed
    * OpenSSL Security Advisory [02 Nov 2017] (bsc#1066242,bsc#1056058)


author: vcizek@suse.com
changelog:
  - change the sonum to 1.1, as all the minor versions keep ABI
    compatibility (bsc#1081335)
  - update baselibs.conf


author: vcizek@suse.com
changelog:
  - Packaged for SLE-12-SP4 (fate#325336)
    * point to 1.0.2h
    * adjust baselibs to 1_0_0
    - recommend openssl from libopenssl-devel


author: mmarek@suse.cz
changelog:
  - Update to kernel headers 4.4 (fate#320305).
  - Remove pre-4.4 backports:
    0001-packet-fill-the-gap-of-TPACKET_ALIGNMENT-with-zeros.patch
    0001-powerpc-Include-the-appropriate-endianness-header.patch
    0001-s390-kernel-add-system-calls-for-PCI-memory-access.patch
    0002-packet-deliver-VLAN-TPID-to-userspace.patch


author: mmarek@suse.cz
changelog:
  - Sync <rdma/hfi/hfi1_user.h> with the SLE12-SP2 kernel
    (bsc#973818, fate#319242, bsc#981074).
    Added following patches:
    staging-hfi1-enable-tid-caching-feature.patch
    staging-rdma-hfi1-adjust-eprom-partitions-add-eprom-.patch
    staging-rdma-hfi1-clean-up-macro-indentation.patch
    uapi-hfi1_user-add-command-and-event-for-tid-caching.patch
    uapi-hfi1_user-correct-comment-for-capability-bit.patch


author: mmarek@suse.cz
changelog:
  - Backport ND_CMD_CALL ioctl to <linux/ndctl.h> (FATE#319858, bsc#986519)
    0001-nfit-libnvdimm-limited-whitelisted-dimm-command-mars.patch


author: mmarek@suse.com
changelog:
  - Sync <rdma/hfi/hfi1_user.h> with the SLE12-SP3 kernel (bsc#1040698)
    Added / renamed patches:
    staging-rdma-hfi1-clean-up-macro-indentation.patch
    - > 0001-staging-rdma-hfi1-Clean-up-macro-indentation.patch
    staging-rdma-hfi1-adjust-eprom-partitions-add-eprom-.patch
    - > 0002-staging-rdma-hfi1-Adjust-EPROM-partitions-add-EPROM-.patch
    uapi-hfi1_user-correct-comment-for-capability-bit.patch
    - > 0003-uapi-hfi1_user-Correct-comment-for-capability-bit.patch
    uapi-hfi1_user-add-command-and-event-for-tid-caching.patch
    - > 0004-uapi-hfi1_user-Add-command-and-event-for-TID-caching.patch
    staging-hfi1-enable-tid-caching-feature.patch
    - > 0005-staging-hfi1-Enable-TID-caching-feature.patch
    0006-IB-hfi1-Remove-multiple-device-cdev.patch
    0007-IB-hfi1-Remove-EPROM-functionality-from-data-device.patch
    0008-IB-hfi1-Remove-unused-user-command.patch
    0009-IB-hfi1-Add-ioctl-interface-for-user-commands.patch
    0010-IB-hfi1-Remove-write-use-ioctl-for-user-cmds.patch
    0011-IB-hfi1-Allow-for-non-double-word-multiple-message-s.patch
    0012-IB-hfi1-Disable-header-suppression-for-short-packets.patch
    0013-RDMA-core-Commonize-RDMA-IOCTL-declarations-location.patch
    0014-RDMA-core-Move-legacy-MAD-IOCTL-declarations-to-comm.patch
    0015-RDMA-hfi1-Avoid-redeclaration-error.patch
    0016-RDMA-core-Move-HFI1-IOCTL-declarations-to-common-fil.patch
    0017-RDMA-core-Rename-RDMA-magic-number.patch
    0018-RDMA-core-Unify-style-of-IOCTL-commands.patch


author: schwab@suse.de
changelog:
  - Update to kernel headers 4.12 (bsc#1103375, FATE#318470)
  - Removed patches upstreamed between 4.4 and 4.12:
      0001-staging-rdma-hfi1-Clean-up-macro-indentation.patch
      0002-staging-rdma-hfi1-Adjust-EPROM-partitions-add-EPROM-.patch
      0003-uapi-hfi1_user-Correct-comment-for-capability-bit.patch
      0004-uapi-hfi1_user-Add-command-and-event-for-TID-caching.patch
      0005-staging-hfi1-Enable-TID-caching-feature.patch
      0006-IB-hfi1-Remove-multiple-device-cdev.patch
      0007-IB-hfi1-Remove-EPROM-functionality-from-data-device.patch
      0008-IB-hfi1-Remove-unused-user-command.patch
      0009-IB-hfi1-Add-ioctl-interface-for-user-commands.patch
      0010-IB-hfi1-Remove-write-use-ioctl-for-user-cmds.patch
      0011-IB-hfi1-Allow-for-non-double-word-multiple-message-s.patch
      0012-IB-hfi1-Disable-header-suppression-for-short-packets.patch
      0013-RDMA-core-Commonize-RDMA-IOCTL-declarations-location.patch
      0014-RDMA-core-Move-legacy-MAD-IOCTL-declarations-to-comm.patch
      0015-RDMA-hfi1-Avoid-redeclaration-error.patch
      0016-RDMA-core-Move-HFI1-IOCTL-declarations-to-common-fil.patch
      0017-RDMA-core-Rename-RDMA-magic-number.patch
      0018-RDMA-core-Unify-style-of-IOCTL-commands.patch
      0001-nfit-libnvdimm-limited-whitelisted-dimm-command-mars.patch


author: dimstar@opensuse.org
changelog:
  - BuildIgnore linux-kernel-headers: the symbol will only exist once
    the package was built in a bootstrap cycle.
  - BuildIgnore gettext-tools: required by rpm-build, but we can
    build without it, allowing to shorten a bootstrap cycle.


author: bwiedemann@suse.com
changelog:
  - Don't embed build system's kernel version in rpm
    to make package build reproducible (boo#1101107)


author: werner@suse.de
changelog:
  - Add patches
    CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based
      buffer over-read in _nc_find_entry function in tinfo/comp_hash.c
    CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based
      buffer over-read in fmt_entry function in tinfo/comp_hash.c


author: werner@suse.de
changelog:
  - Fix last change, that is add missed library linker paths as well
    as missed include directories for none standard paths (bsc#1158586,
    bsc#1159162)
  - Let helper script handle.linux call sed command smart


author: werner@suse.de
changelog:
  - Also remove private requirements as (lib)tinfo are binary compatible
    with normal and wide version of (lib)ncurses (bsc#1158586, bsc#1159162)


author: werner@suse.de
changelog:
  - Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for
    CVE-2021-39537: ncurses: heap-based buffer overflow in
    _nc_captoinfo in captoinfo.c


author: werner@suse.de
changelog:
  - Add patch ncurses-bnc1198627.patch
    * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read


author: werner@suse.de
changelog:
  - Modify patch ncurses-6.1.dif
    * Secure writing terminfo entries by setfs[gu]id in s[gu]id
      (boo#1210434, CVE-2023-29491)
    * Reading is done since 2000/01/17


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#136
  - report error if config file could not be updated (bsc#1188768)
  - 0.936


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#137
  - grub2 install: Support secure boot on powerpc (bsc#1192764
    jsc#SLE-18271).
  - 0.937


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#138
  - grub2/install: reset error code when passing through recover code
    (bsc#1198197)
  - 0.938


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#142
  - use fw_platform_size to distinguish between 32 bit and 64 bit
    UEFI platforms (bsc#1208003)
  - 0.942


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#147
  - UEFI: update also default location, if it is controlled by SUSE
    (bsc#1210799, bsc#1201399)
  - 0.943


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#152
  - use signed grub EFI binary when updating grub in default EFI
    location (bsc#1210799)
  - check whether grub2-install supports --suse-force-signed option
  - 0.944


author: coolo@novell.com
changelog:
  - Readd pkg-config-dnl.patch, see
    http://lists.gnu.org/archive/html/autoconf/2010-07/msg00035.html


author: dimstar@opensuse.org
changelog:
  - Update to version 0.27:
    + Drop usage of popt for equivalent API in glib2
    + Add back an internal snapshot of glib2 to break circular
      dependency
    + Fix --exists to check for Requires and Requires.private.
    + Various fixes for MinGW which should allow it to be used
      unpatched on that system
    + New autoconf macros PKG_INSTALLDIR and PKG_NOARCH_INSTALLDIR to
      help determine the .pc file install directory
    + Fix handling of --exact/atleast/max-version vs. =/>=/<=
    + Fix errors in man page source
    + Ensure testing only searches in the check directory
    + Bump glib requirement to 2.16 to avoid deprecated
      g_win32_get_package_installation_subdirectory()
    + Autotools refresh and update
    + Use g_alloca from glib instead of figuring out alloca ourselves
    + Remove search for setresuid & setreuid only needed for internal
      popt
    + Bugs fixed: fdo#833, fdo#2458, fdo#5214, fdo#5326, fdo#5703,
      fdo#6074, fdo#8653, fdo#9135, fdo#9143, fdo#9584, fdo#10652,
      fdo#11464, fdo#14396, fdo#17053, fdo#23922, fdo#28776,
      fdo#29011, fdo#29801, fdo#31699, fdo#31700, fdo#32622,
      fdo#34382, fdo#37266, fdo#39646, fdo#41081, fdo#43149,
      fdo#44843, fdo#45599, fdo#45742, fdo#48743
  - Changes from version 0.26:
    + Build system fixes
    + More tests
    + pkg.m4 fixups which makes autoconf 2.66 happier.
    + Drop support for legacy -config scripts.  Those should already
      be gone and cause problems in cross-compilation environments.
    + Drop embedded glib
    + Fix up pkg.m4 to handle the case of --exists working and
    - -cflags or --libs failing.
    + Various documentation updates
    + Allow $() through without escaping it.
    + Add --with-system-include-path instead of hard-coding
      /usr/include.
  - Pass --with-internal-glib to configure. We don't want to have a
    build cycle with glib, so we use the interal version.
  - Clean up spec-file using spec-cleaner and manually.
  - Drop pkg-config-dnl.patch: fixed upstream.


author: dimstar@opensuse.org
changelog:
  - Update to version 0.27.1:
    + Various fixes for using the internal glib snapshot. It should
      now be usable pretty much everywhere with the exception that
      universal builds are not supported on OS X.
    + Remove usage of gettext from the internal glib to avoid gettext
      and libintl dependencies
    + Update internal glib snapshot to 2.32.4
    + Fix check for POSIX shell used in tests to work better
    + Handle spaces in autodetected prefix on Windows
    + Bugs fixed: fdo#3550, fdo#51883, fdo#52031, fdo#53493.


author: p.drouand@gmail.com
changelog:
  - Update to version 0.28:
    + Fixed a pair of long-standing and intertwined bugs involving
      unwanted removal of flags:
    - Other Libs flags like -Wl are now kept in context order
      with -l flags.
    - Aggressive removal of all duplicate arguments has been scaled
      back so that just consecutive duplicate arguments are
      removed. One result of this change is that some flags could
      be repeated in the final output, especially flags from
      non-pkg-config packages like -lm. Since pkg-config rarely has
      enough knowledge here about the right thing to do, we throw
      the duplicate arguments at the compiler/linker and trust it
      will do the right thing.
    + Fixed an old bug to allow circular Requires. This fix brings
      along a small behavior change in that pkg-config resolves
      requires depth first, causing some lower level flags to show up
      earlier in the output than previously.
    + Cleaned up many corner-case bugs and ambiguous behavior in
      pkg-config's interface.
    + New autoconf macro PKG_CHECK_VAR for reading variables from .pc
      files.
    + Default to suppressing -L/lib and/or -L/lib64 like their /usr
      counterparts.
    + To help support multiarch scenarios out of the box,
      $host-pkg-config is now installed unless --disable-host-tool
      is passed to configure.
    + Added optional gcov usage through the --with-gcov configure
      option. As a result, many more tests were added to greatly
      increase the coverage of the code to 86% of executed lines on a
      Fedora 18 machine.
    + Bugs fixed: fdo#130, fdo#7331, fdo#16101, fdo#17053, fdo#19950,
      fdo#34504, fdo#48098, fdo#54231, fdo#54271, fdo#54379,
      fdo#54384, fdo#54386, fdo#54388, fdo#54389, fdo#54390,
      fdo#54391, fdo#54427, fdo#54463, fdo#54716, fdo#57078,
      fdo#58363, fdo#59435.


author: dvaleev@suse.com
changelog:
  - Don't redefine _arch, but use file pattern instead. This ensures
    we don't have to run fixing each and every arch.


author: msuchanek@suse.de
changelog:
  - Optimize lsdevinfo filtering to prevent LPM timeouts (bsc#1189571 ltc#193419).
    + lsdevinfo-optimize-criteria-filtering.patch


author: msuchanek@suse.de
changelog:
  - Avoid error with HCN IDs containing same consecutive bytes (bsc#1192095 ltc#194963).
    + hcnmgr-Avoid-hexdum-squeezing-consecutive-identical-.patch


author: msuchanek@suse.com
changelog:
  - Fix reported online memory in legacy format (bsc#1191147).
    + lparstat-Fix-reported-online-memory-in-legacy-format.patch


author: msuchanek@suse.com
changelog:
  - errinjct: sanitize devspec output of a newline if one is present (bsc#1194579 ltc#195746).
    + errinjct-sanitize-devspec-output-of-a-newline-if-one.patch


author: msuchanek@suse.com
changelog:
  - lparstat: report LPAR name from lparcfg (bsc#1187716 ltc#193451).
    + lparstat-report-LPAR-name-from-lparcfg.patch


author: msuchanek@suse.com
changelog:
  - Fix lsslot showing "Unknown slot type" for recent PCIe slot types (bsc#1196411 ltc#196505).
    - lsslot-Add-new-DRC-type-description-strings.patch


author: msuchanek@suse.com
changelog:
  - Fix "lsslot -c mem" output when LMB size is set to 4GB (bsc#1202777 ltc#199300)
    + Fix-format-specifiers-in-printf-and-sprintf-calls.patch
    + lsslot-Fix-lsslot-c-mem-output-when-using-4GB-LMB-si.patch
    + lsslot-Explicity-declare-that-lmb_address-be-display.patch


author: msuchanek@suse.com
changelog:
  - Fix lparstat output of purr values (PED-3947 bsc#1210544 ltc#202303)
    + powerpc-utils-Enhance-error-message-when-lparstat-E-.patch
    + lparstat-Fix-error-message.patch
    + lparstat-Fix-array-overflow-issue.patch


author: msuchanek@suse.com
changelog:
  - Fix negative utilization value reported by lparstat -E (bsc#1212031)
    + lparstat-Fix-negative-values-seen-while-running-lpar.patch
  - Fix lparstat error with mixed SMT state (bsc#1211883 ltc#02144)
    + lparstat-report-mixed-SMT-state.patch
    + lparstat-Fix-offline-threads-uninitialized-entries.patch


author: mwilck@suse.com
changelog:
  - Update to version 12.5:
    * spec file: add conflicts for dracut < 44.2 (bsc#1127891)
    * modprobe.conf.common: add csiostor->cxgb4 dependency
      (bsc#1100989, bsc#1131635)
  - Fix driver-check.sh (boo#1123697, boo#1123704)
  - modsign-verify: support for parsing PKCS#7 signatures
    (bsc#1111300, bsc#1105495)


author: mwilck@suse.com
changelog:
  - Update to version 12.6:
    * weak-modules2: emit "inconsistent" warning only if replacement fails
    (bsc#1127155)


author: mwilck@suse.com
changelog:
  - Update to version 12.7:
    * remove modhash (moved to mokutil package in SLE12-SP5)
    (jsc#SLE-6094)
    * modprobe.tar.bz2: remove bogus backup (*~) file


author: mwilck@suse.com
changelog:
  - Update to version 12.8:
    * modprobe.conf: add dependency of papr_scm on libnvdimm
    (bsc#1142152, ltc#176292, FATE#327775)
    * Load fbcon together with virtio_gpu on s390 (bsc#1132798)


author: mwilck@suse.com
changelog:
  - Update to version 12.11: Import kernel scriptlets from kernel-source
    * rpm-script: fix bad exit status in OpenQA (bsc#1191922)
    * cert-script: Deal with existing $cert.delete file (bsc#1191804).
    * cert-script: Ignore kernel keyring for kernel certificates (bsc#1191480).
    * cert-script: Only print mokutil output in verbose mode.
    * inkmp-script(postun): don't pass  existing files to weak-modules2
      (boo#1191200)
    * kernel-scriptlets: skip cert scriptlet on non-UEFI systems
      (boo#1191260)
    * rpm-script: link config also into /boot (boo#1189879)
    * Import kernel scriptlets from kernel-source.
      (bsc#1189841, bsc#1190598)
    * Provide "suse-kernel-rpm-scriptlets"


author: mwilck@suse.com
changelog:
  - Update to version 12.13: added blacklist entries in modprobe.conf
    * blacklist RNDIS modules (bsc#1205767, jsc#PED-5731, CVE-2023-23559)
    * blacklist cls_tcindex module (bsc#1210335, CVE-2023-1829)
    * blacklist isst_if_mbox_msr (bsc#1187196)


author: fbui@suse.com
changelog:
  - Import commit 3fad90a5e2a1d0099ba2925793df42e0084cad35
    dbf8419fdb busctl: add a timestamp to the output of the busctl monitor command (bsc#1180225 jsc#SLE-21861)
    7a9abad886 sysctl: configure kernel parameters in the order they occur in each sysctl configuration files (#4205) (bsc#1191399)
    7dd902bfa6 manager: reexecute on SIGRTMIN+25, user instances only
    fb9e399bca basic/unit-name: do not use strdupa() on a path (bsc#1188063 CVE-2021-33910)
    e0fde642ec logind: terminate cleanly on SIGTERM/SIGINT (bsc#1188018)
    fe106cccdd units: make fsck/grows/makefs/makeswap units conflict against shutdown.target


author: fbui@suse.com
changelog:
  - Import commit 81e1235110a58f78e4e7514b45a2897ceddadf88
    8348b7f7ea systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23869 jsc#SLE-23871)
    d827639164 systemctl: exit with 1 if no unit files found (bsc#1193841)
    99d0949499 umount: show correct error message
    16f9b8a5fa core/umount: fix unitialized fields in MountPoint in dm_list_get()
    8f7b39e250 umount: Add more asserts and remove some unused arguments
    6858714b68 umount: Fix memory leak
    4a83c21fb1 mount-util: fix fd_is_mount_point() when both the parent and directory are network fs (bsc#1190984)


author: fbui@suse.com
changelog:
  - Import commit d2bcac88a6f3e540774efcd9ab12672da12cf3fe
    7076cc48ad core: make sure we always free the list of changes
    1d69ad935b Install: correctly report symlink creations
    0ea76851fb core: make sure we generate a nicer error when a linked unit is attempted to be enabled
    8c4d1006cc install: unify checking whether operations may be applied to a unit file in a new function
    f072dc87b0 install: fix errno handling
    ca63895cec systemctl: Allow 'edit' and 'cat' on unloaded units
    f535ae8ee3 Don't open /var journals in volatile mode when runtime_journal==NULL
    d6c79be377 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
    c6274db870 man: tweak description of auto/noauto (bsc#1191502)


author: fbui@suse.com
changelog:
  - Import commit 417bb0944e035969594fff83a3ab9c2ca9a56234
    e4ba341080 time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
    20743c1a44 logind: fix crash in logind on user-specified message string
    b971b5f085 tmpfiles: check the directory we were supposed to create, not its parent
    2850271ea6 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
    3d3bd5fc8d systemd --user: call pam_loginuid when creating user@.service (#3120) (bsc#1198507)
    4b56c3540a parse-util: introduce pid_is_valid()
    aa811a4c0c systemd-detect-virt: refine hypervisor detection (#7171) (bsc#1197244)


author: fbui@suse.com
changelog:
  - Fix systemd-coredump to not allow user to access coredumps with changed
    uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
    Add 5000-errno-util-add-new-errno_or_else-helper.patch
    Add 5001-coredump-do-not-allow-user-to-access-coredumps-with-.patch


author: fbui@suse.com
changelog:
  - Disable coredump support when building the mini flavor to avoid pulling in
    elfutils as some elf macro definitions are now needed by coredump.c


author: fbui@suse.com
changelog:
  - Import commit 284594087815b5a621c9cbdfd7fde382c3fa110e
    408bdd5b5c units: restore RemainAfterExit=yes in systemd-vconsole-setup.service
    c9d71f32e9 vconsole-setup: don't concat strv if we don't need to (i.e. not in debug log mode)
    36cea26f87 vconsole-setup: add more log messages
    ed5157ad87 units: restore Before dependencies for systemd-vconsole-setup.service
    e9ae2bacc4 vconsole-setup: add lots of debug messages
    40b348e753 Add enable_disable() helper
    33ac2fa67a vconsole: correct kernel command line namespace
    41e28b24d6 vconsole: Don't do static installation under sysinit.target
    d5a5e14c0b vconsole: use KD_FONT_OP_GET/SET to handle copying (bsc#1181636)
    4e62cab082 vconsole: updates of keyboard/font loading functions
    8fd6316be5 vconsole: Add generic is_*() functions
    a755ea98ec vconsole: add two new toggle functions, remove old enable/disable ones
    9ca3cfe2aa vconsole: copy font to 63 consoles instead of 15
    7ddfcaab83 vconsole: add log_oom() where appropriate
    8d61f5bde5 vconsole-setup: Store fonts on heap (#3268)
    6efe43abe2 coredump: do not allow user to access coredumps with changed uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
    1f09db3094 errno-util: add new errno_or_else() helper
  - Drop 5000-errno-util-add-new-errno_or_else-helper.patch
      5001-coredump-do-not-allow-user-to-access-coredumps-with-.patch
    They have been integrated in SUSE/v228, see above.


author: fbui@suse.com
changelog:
  - Import commit 95ad6444b8d4c9cbd6c745ba9b4463264109ee11
    acb6da7b4a pager: make pager secure when under euid is changed or explicitly requested
    7c8bbe16a2 pager: set $LESSSECURE whenver we invoke a pager (bsc#1208958 CVE-2023-26604)
    e931881112 core: if the start command vanishes during runtime don't hit an assert (bsc#1206985)


author: trenn@suse.de
changelog:
  - Do not start mcelog service based on an udev (/dev/mcelog) rule
    (bsc#976781), but enable it automatically at install time.


author: ohering@suse.de
changelog:
  - enable xencommons (bnc#897352, bnc#1012842)
    xendomains must be enabled manually by the local admin (bnc#937371)


author: fbui@suse.com
changelog:
  - Enable by default uuidd shipped by util-linux (bsc#1012850)
    util-linux was previously shipping a preset file enabling uuidd by
    default. This is now done here as other packages are not supposed to
    ship their own preset rules.
    Also increase the package version so util-linux can conflict with
    the previous versions and hence will be updated *after* the new
    version of the presets package is. This is important otherwise if
    util-linux removed its preset file first, then the presets package
    would believe a new change in the presets and you enable again
    uuidd.


author: sbrabec@suse.com
changelog:
  - Bump version to 12.2 to make version numbers consistent between
    SLE and Leap (boo#1029775).
  - Remove superfluous uuidd.service. uuidd.socket is sufficient
    (bsc#1012850#c8).


author: sschricker@suse.com
changelog:
  - enable nvmefc-boot-connections.service to discover
    network-provided nvme drives on boot (bsc#1128428)


author: idonmez@suse.com
changelog:
  - Update to version 1.2.8
    * Add new inflateGetDictionary() function
    * Fix bug where gzopen() immediately followed by gzclose()
      would write an empty file instead of an empty gzip stream.
    * Fix bug in gzclose() when gzwrite() runs out of memory


author: tchvatal@suse.com
changelog:
  - Remove zlib-devel-static, nothing should use libz.a anyway.
  - Package minizip library, everything using it should now pull
    minizip-devel and unbundle it bnc#935864


author: tchvatal@suse.com
changelog:
  - Include fixes for bnc#1003580 bnc#1003579 bnc#1003577 bnc#1013882:
    * zlib-bnc1003577.patch
    * zlib-bnc1003579-part2.patch
    * zlib-bnc1003579.patch
    * zlib-bnc1003580.patch refreshed
    * zlib-bnc1013882.patch CVE-2016-9843


author: tchvatal@suse.com
changelog:
  - Add patch to safeguard against negative values in uInt bsc#1071321:
    * 0001-Do-not-try-to-store-negative-values-in-unsigned-int.patch


