# changelog

author: matz@suse.com
changelog:
  - Add -std=gnu17 to move gcc15 forward, as temporary measure until
    the binutils version can be updated [bsc#1241916].


author: matz@suse.com
changelog:
  - Update to version 2.45:
    * New versioned release of libsframe.so.2
    * s390: tools now support SFrame format 2; recognize "z17" as CPU
      name [bsc#1247105, jsc#IBM-1485]
    * sframe sections are now of ELF section type SHT_GNU_SFRAME.
    * sframe secions generated by the assembler have
      SFRAME_F_FDE_FUNC_START_PCREL set.
    * riscv: Support more extensions: standard: Zicfiss v1.0, Zicfilp v1.0,
      Zcmp v1.0, Zcmt v1.0, Smrnmi v1.0, S[sm]dbltrp v1.0, S[sm]ctr v1.0,
      ssqosid v1.0, ssnpm v1.0, smnpm v1.0, smmpm v1.0, sspm v1.0, supm v1.0,
      sha v1.0, zce v1.0, smcdeleg v1.0, ssccfg v1.0, svvptc v1.0, zilsd v1.0,
      zclsd v1.0, smrnmi v1.0;
      vendor: CORE-V, xcvbitmanip v1.0 and xcvsimd v1.0;
      SiFive, xsfvqmaccdod v1.0, xsfvqmaccqoqv1.0 and xsfvfnrclipxfqf v1.0;
      T-Head: xtheadvdot v1.0;
      MIPS: xmipscbop v1.0, xmipscmov v1.0, xmipsexectl v1.0, xmipslsp v1.0.
    * Support RISC-V privileged version 1.13, profiles 20/22/23, and
      .bfloat16 directive.
    * x86: Add support for these ISAs: Intel Diamond Rapids AMX, MOVRS,
      AVX10.2 (including SM4), MSR_IMM; Zhaoxin PadLock PHE2, RNG2, GMI, XMODX.
      Drop support for  AVX10.2 256 bit rounding.
    * arm: Add support for most of Armv9.6, enabled by -march=armv9.6-a and
      extensions '+cmpbr', '+f8f16mm', '+f8f32mm', '+fprcvt', '+lsfe', '+lsui',
      '+occmo', '+pops', '+sme2p2', '+ssve-aes', '+sve-aes', '+sve-aes2',
      '+sve-bfscale', '+sve-f16f32mm' and '+sve2p2'.
    * Predefined symbols "GAS(version)" and, on non-release builds, "GAS(date)"
      are now being made available.
    * Add .errif and .warnif directives.
    * linker:
    - Add --image-base=<ADDR> option to the ELF linker to behave the same
      as -Ttext-segment for compatibility with LLD.
    - Add support for mixed LTO and non-LTO codes in relocatable output.
    - s390: linker generates .eh_frame and/or .sframe for linker
      generated .plt sections by default (can be disabled
      by --no-ld-generated-unwind-info).
    - riscv: add new PLT formats, and GNU property merge rules for zicfiss
      and zicfilp extensions.
  - gold is no longer included
  - Contains fixes for these non-CVEs (not security bugs per upstreams
    SECURITY.md):
    * bsc#1236632 aka CVE-2025-0840 aka PR32560
    * bsc#1236977 aka CVE-2025-1149 aka PR32576
    * bsc#1236978 aka CVE-2025-1148 aka PR32576
    * bsc#1236999 aka CVE-2025-1176 aka PR32636
    * bsc#1237000 aka CVE-2025-1153 aka PR32603
    * bsc#1237001 aka CVE-2025-1152 aka PR32576
    * bsc#1237003 aka CVE-2025-1151 aka PR32576
    * bsc#1237005 aka CVE-2025-1150 aka PR32576
    * bsc#1237018 aka CVE-2025-1178 aka PR32638
    * bsc#1237019 aka CVE-2025-1181 aka PR32643
    * bsc#1237020 aka CVE-2025-1180 aka PR32642
    * bsc#1237021 aka CVE-2025-1179 aka PR32640
    * bsc#1237042 aka CVE-2025-1182 aka PR32644
    * bsc#1240870 aka CVE-2025-3198 aka PR32716
    * bsc#1243756 aka CVE-2025-5244 aka PR32858
    * bsc#1243760 aka CVE-2025-5245 aka PR32829
    * bsc#1246481 aka CVE-2025-7545 aka PR33049
    * bsc#1246486 aka CVE-2025-7546 aka PR33050
    * bsc#1247114 aka CVE-2025-8224 aka PR32109
    * bsc#1247117 aka CVE-2025-8225 no PR
  - Add these backport patches:
    * pr32556.diff for bsc#1236976 aka CVE-2025-1147 aka PR32556
    * pr33457.diff for bsc#1250632 aka CVE-2025-11083 aka PR33457
    * pr33452.diff for bsc#1251275 aka CVE-2025-11412 aka PR33452
    * pr33456.diff and pr33456-2.diff for bsc#1251276 aka CVE-2025-11413
      aka PR33456
    * pr33450.diff for bsc#1251277 aka CVE-2025-11414 aka PR33450
    * pr33499.diff for bsc#1251794 aka CVE-2025-11494 aka PR33499
    * pr33502.diff for bsc#1251795 aka CVE-2025-11495 aka PR33502
  - Adjust binutils-disable-code-arch-error.diff,
    binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff,
    binutils-revert-rela.diff, binutils-skip-rpaths.patch
  - Remove pr33029.patch (upstreamed), enable-targets-gold.diff (obsolete),
    binutils-2.43.tar.bz2.sig, binutils-2.43.tar.bz2,
    binutils-2.43-branch.diff.gz
  - Add binutils-2.45.tar.bz2.sig, binutils-2.45.tar.bz2,
    binutils-2.45-branch.diff.gz
  - Rename binutils-fix-branch.diff to binutils-fix-branch.diff.templ
    as long as its empty.


author: matz@suse.com
changelog:
  - Amend binutils-compat-old-behaviour.diff to not enable
    '-z gcs=implicit' on aarch64 for old codestreams.


author: matz@suse.com
changelog:
  - Update to current 2.45 branch at 94cb1c075 to include fix
    for PR33584 (a problem related to LTO vs fortran COMMON
    blocks).


author: rguenther@suse.com
changelog:
  - Remove README in empty packages only required for SLE11 and older.
  - Remove now empty %build section.


author: rguenther@suse.com
changelog:
  - Guard gcc-devel so it is only built on Tumbleweed.
  - Remove bogus link to versioned g++.info file which doesn't exist.
    Instead refer to gcc.info from the g++ info directory entry.
    [bnc#922419]


author: rguenther@suse.com
changelog:
  - Add gccgo symlink, add go and gofmt as alternatives to support
    parallel install of golang.  [bnc#1096677]


author: rguenther@suse.com
changelog:
  - With gcc-PIE add -pie even when -fPIC is specified but we are
    not linking a shared library.  [boo#1185348]
  - Fix postun of gcc-go alternative.


author: dimstar@opensuse.org
changelog:
  - Add _multibuild to define 2nd spec file as additional flavor.
    Eliminates the need for source package links in OBS.


author: schwab@suse.de
changelog:
  - Disable multilib and go on riscv64
  - libgcc-riscv-div.patch: Backport of r12-5799-g45116f342057b7 to fix
    build with current binutils


author: rguenther@suse.com
changelog:
  - Add gcc7-aarch64-bsc1214052.patch to fix -fstack-protector issues
    with variable length stack allocations on aarch64.
    Fixes CVE-2023-4039.  [bsc#1214052]
  - Add gcc7-aarch64-untyped_call.patch to fix issue with __builtin_apply
  - Add gcc7-lra-elim.patch to fix internal compiler error when forming
    paired loads and stores on aarch64.


author: rguenther@suse.com
changelog:
  - Add gcc7-bsc1216488.patch to avoid creating recursive DIE references
    through DW_AT_abstract_origin when using LTO.  [bsc#1216488]


author: rguenther@suse.com
changelog:
  - Add gcc7-pr88345-min-func-alignment.diff to add support for
    - fmin-function-alignment.  [bsc#1214934]


author: pmonreal@suse.com
changelog:
  - Update to version 20210213.5c710c0: [bsc#1180938]
    * setup_directories(): perform safer creation of directories
    * save_config(): avoid re-opening output file for each iteration
    * save_config(): break after first match to avoid unnecessary stat() calls
    * CryptoPolicy.parse(): actually stop parsing line on syntax error
    * ProfileConfig.parse_string(): correctly extended subpolicies
    * Exclude RC4 from LEGACY
    * Introduce rc4_md5_in_krb5 to narrow AD_SUPPORT
    * code style: fix 'not in' membership testing
    * pylintrc: tighten up a bit
    * formatting: avoid long lines
    * formatting: use f-strings instead of format()
    * formatting: reformat all python code with autopep8
    * nss: postponing the version check again, to 3.61
    * Revert "Unfortunately we have to keep ignoring the openssh check for sk-"


author: pmonreal@suse.com
changelog:
  - Disable DTLS0.9 protocol in GnuTLS DEFAULT policy. [bsc#1180938]
    * The minimum DTLS protocol version in the DEFAULT and FUTURE
      policies is DTLS1.2.
    * Fixed upstream: 05203d21f6d0ea9bbdb351e4600f1e273720bb8e


author: pmonreal@suse.com
changelog:
  - Update to version 20210225.05203d2:
    * Disable DTLS0.9 protocol in the DEFAULT policy.
    * policies/FIPS: insignificant reformatting
    * policygenerators/libssh: respect ssh_certs
    * policies/modules/OSPP: tighten to follow RHEL 8
    * crypto-policies(7): drop not-reenableable comment
    * follow up on disabling RC4


author: pmonreal@suse.com
changelog:
  - Update to version 20210917.c9d86d1:
    * openssl: fix disabling ChaCha20
    * pacify pylint 2.11: use format strings
    * pacify pylint 2.11: specify explicit encoding
    * fix minor things found by new pylint
    * update-crypto-policies: --check against regenerated
    * update-crypto-policies: fix --check's walking order
    * policygenerators/gnutls: revert disabling DTLS0.9...
    * policygenerators/java: add javasystem backend
    * LEGACY: bump 1023 key size to 1024
    * cryptopolicies: fix 'and' in deprecation warnings
    * *ssh: condition ecdh-sha2-nistp384 on SECP384R1
    * nss: hopefully the last fix for nss sigalgs check
    * cryptopolicies: Python 3.10 compatibility
    * nss: postponing check + testing at least something
    * Rename 'policy modules' to 'subpolicies'
    * validation.rules: fix a missing word in error
    * cryptopolicies: raise errors right after warnings
    * update-crypto-policies: capitalize warnings
    * cryptopolicies: syntax-precheck scope errors
    * .gitlab-ci.yml, Makefile: enable codespell
    * all: fix several typos
    * docs: don't leave zero TLS/DTLS protocols on
    * openssl: separate TLS/DTLS MinProtocol/MaxProtocol
    * alg_lists: order protocols new-to-old for consistency
    * alg_lists: max_{d,}tls_version
    * update-crypto-policies: fix pregenerated + local.d
    * openssh: allow validation with pre-8.5
    * .gitlab-ci.yml: run commit-range against upstream
    * openssh: Use the new name for PubkeyAcceptedKeyTypes
    * sha1_in_dnssec: deprecate
    * .gitlab-ci.yml: test commit ranges
    * FIPS:OSPP: sign = -*-SHA2-224
    * scoped policies: documentation update
    * scoped policies: use new features to the fullest...
    * scoped policies: rewrite + minimal policy changes
    * scoped policies: rewrite preparations
    * nss: postponing the version check again, to 3.64
  - Remove patches fixed upstream: crypto-policies-typos.patch
  - Rebase: crypto-policies-test_supported_modules_only.patch
  - Merge crypto-policies-asciidoc.patch into
      crypto-policies-no-build-manpages.patch


author: pmonreal@suse.com
changelog:
  - Remove the scripts and documentation regarding
    fips-finish-install and test-fips-setup
    * Add crypto-policies-FIPS.patch


author: pmonreal@suse.com
changelog:
  - Update the update-crypto-policies(8) man pages and README.SUSE
    to mention the supported back-end policies. [bsc#1209998]


author: pmonreal@suse.com
changelog:
  - FIPS: Enable to set the kernel FIPS mode with fips-mode-setup
    and fips-finish-install commands, add also the man pages.
    * Adapt the fips-mode-setup script for SLE [jsc#PED-5041]
    * Rebase crypto-policies-FIPS.patch
    * Simplify the man pages creation:
    - Rebase crypto-policies-no-build-manpages.patch
    - Add crypto-policies-asciidoc.patch


author: pmonreal@suse.com
changelog:
  - FIPS: Adapt the fips-mode-setup script to use the pbl command
    from the perl-Bootloader package to replace grubby. Add a note
    for transactional systems. Ship the man 8 pages for
    fips-mode-setup and fips-finish-install [jsc#PED-5041].
    * Rebase crypto-policies-FIPS.patch


author: pmonreal@suse.com
changelog:
  - Make the supported versions change in the update-crypto-policies(8)
    man page persistent [bsc#1209998].
    * Add patch crypto-policies-supported.patch
    * Rebase patches:
    - crypto-policies-asciidoc.patch
    - crypto-policies-no-build-manpages.patch


author: jengelh@inai.de
changelog:
  - Update to release 1.21
    * Handle DWARF5 DW_OP_addrx and
      subprogram ret type with abstract_origin properly.


author: msuchanek@suse.com
changelog:
  - Handle zero sized per-cpu veriables in Linux BTF.
    + btf_encoder-fix-and-complete-filtering-out-zero-sized-per-CPU-variables.patch


author: msuchanek@suse.com
changelog:
  - Update to version 1.21+git175.1ef87b2 (jsc#SLE-17288):
    * libbpf: bump dependency to >= 0.4.0
    * CMakeLists.txt: Enable SHARED and STATIC lib creation
    * libbpf: Allow to use packaged version
    * btfdiff: Support diffing DWARF vs detached BTF
    * pahole: Allow encoding BTF into a detached file
    * pahole: Add --kabi_prefix flag
    * btf_encoder: fix and complete filtering out zero-sized per-CPU variables
    * btf: Remove ftrace filter
    * pahole: Introduce --with_flexible_array option to show just types ending in a flexible array
    * Many updates to btf_encoder and bug fixes
  - Remove upstreamed patches
    - btf_encoder-fix-and-complete-filtering-out-zero-sized-per-CPU-variables.patch
    - remove-ftrace-filter.patch
  - Pretend version 1.22 to make kernel happy
    + dwarves-Prep-1.22.patch


author: msuchanek@suse.com
changelog:
  - 15.4 has new elfutils, drop libebl-plugins dependency.
  - Update to version 1.21+git177.1ef87b2:
    * Fix crash with split BTF debuginfo
    * CMakeList.txt: Bump version to the upcoming 1.22 release, not out of the door yet
    - Remove upstreamed patch dwarves-Prep-1.22.patch


author: jengelh@inai.de
changelog:
  - Update to release 1.22 (bsc#1190340).
    * Ability to encode BTF to a separate file
    * Multithreaded DWARF loading
    * Details at https://marc.info/?l=dwarves&m=162975403628056&w=2


author: meissner@suse.com
changelog:
  - updated to 1.4.1
    - added manpages
    - fipscheck/fipshmac: Add -s option to specify the hmac suffix
    - fipshmac: Add '-d' option to specify where to put the .hmac files
    - various bugfixes


author: vcizek@suse.com
changelog:
  - Remove #include of unused fips.h to fix build with OpenSSL 1.1.1
    (bsc#1149792)
    * add fipscheck-fips.h_not_needed.patch


author: schwab@suse.de
changelog:
  - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound
    writes when writing escape sequence (CVE-2024-2961, bsc#1222992)


author: giuliano.belinassi@suse.com
changelog:
  - glibc-CVE-2024-33599-nscd-Stack-based-buffer-overflow-in-n.patch:
    nscd: Stack-based buffer overflow in netgroup cache
    (CVE-2024-33599, bsc#1223423, BZ #31677)
  - glibc-CVE-2024-33600-nscd-Avoid-null-pointer-crashes-after.patch:
    nscd: Avoid null pointer crashes after notfound response
    (CVE-2024-33600, bsc#1223424, BZ #31678)
  - glibc-CVE-2024-33600-nscd-Do-not-send-missing-not-found-re.patch:
    nscd: Do not send missing not-found response in addgetnetgrentX
    (CVE-2024-33600, bsc#1223424, BZ #31678)
  - glibc-CVE-2024-33601-CVE-2024-33602-nscd-netgroup-Use-two.patch:
    netgroup: Use two buffers in addgetnetgrentX (CVE-2024-33601,
    CVE-2024-33602, bsc#1223425, BZ #31680)


author: giuliano.belinassi@suse.com
changelog:
  - ulp-prologue-into-asm-functions.patch: Avoid creating ULP prologue
    for _start routine (bsc#1221940)


author: schwab@suse.de
changelog:
  - nscd-netgroup-cache-timeout.patch: Use time_t for return type of
    addgetnetgrentX (CVE-2024-33602, bsc#1223425)


author: schwab@suse.de
changelog:
  - tcache-thread-shutdown.patch: malloc: Initiate tcache shutdown even
    without allocations (bsc#1228661, BZ #28028)


author: schwab@suse.de
changelog:
  - assert-message-allocation.patch: Fix underallocation of abort_msg_s
    struct (CVE-2025-0395, bsc#1236282, BZ #32582))


author: schwab@suse.de
changelog:
  - static-setuid-ld-library-path.patch: elf: Ignore LD_LIBRARY_PATH and
    debug env var for setuid for static (CVE-2025-4802, bsc#1243317)


author: astieger@suse.com
changelog:
  - gzip 1.10:
    * Compressed gzip output no longer contains the current time as
      a timestamp when the input is not a regular file.  Instead, the
      output contains a null (zero) timestamp.  This makes gzip's
      behavior more reproducible when used as part of a pipeline.
    * A use of uninitialized memory on some malformed inputs has been
      fixed.
    * A few theoretical race conditions in signal handers have been
      fixed.
  - drop upstreamed patches:
    * gnulib-libio.patch
    * gzip-1.8-deprecate_netstat.patch


author: kstreitova@suse.com
changelog:
  - add gzip-1.10-ibm_dfltcc_support.patch [jsc#SLE-5818] [jsc#SLE-8914]
    * it adds support for DFLTCC (hardware-accelerated deflation)
      for s390x arch
    * enable it via "--enable-dfltcc" option


author: kstreitova@suse.com
changelog:
  - refresh gzip-1.10-ibm_dfltcc_support.patch to fix three data
    corruption issues [bsc#1145276] [jsc#SLE-5818] [jsc#SLE-8914]


author: kstreitova@suse.com
changelog:
  - Enable DFLTCC compression for s390x for levels 1-6 (i. e. to make
    it used by default) by adding -DDFLTCC_LEVEL_MASK=0x7e to CLFAGS.
    [jsc#SLE-13775]


author: pgajdos@suse.com
changelog:
  - fix DFLTCC segfault [bsc#1177047]
  - added patches
    fix https://git.savannah.gnu.org/cgit/gzip.git/commit/?id=be0a534ba2b6e77da289de8da79e70843b1028cc
    + gzip-1.10-fix-DFLTCC-segfault.patch


author: danilo.spinella@suse.com
changelog:
  - Fix escaping of malicious filenames (CVE-2022-1271 bsc#1198062)
    * bsc1198062.patch
    * bsc1198062-2.patch


author: tbogendoerfer@suse.de
changelog:
  - cnic: Fix use-after-free bugs in cnic_delete_task
    (CVE-2025-39945 bsc#1251230).
  - commit cf588ad


author: joao.povoas@suse.com
changelog:
  - Update
    patches.suse/0032-blk-throttle-prevent-overflow-while-calculating-wait-time.patch
    (git-fixes CVE-2022-50580 bsc#1252542).
  - Update
    patches.suse/0044-dm-thin-Fix-UAF-in-run_timer_softirq.patch
    (git-fixes CVE-2022-50563 bsc#1252480).
  - Update
    patches.suse/ACPI-x86-s2idle-Catch-multiple-ACPI_TYPE_PACKAGE-obj.patch
    (git-fixes CVE-2023-53708 bsc#1252537).
  - Update
    patches.suse/ASoC-audio-graph-card-fix-refcount-leak-of-cpu_ep-in.patch
    (git-fixes CVE-2022-50572 bsc#1252526).
  - Update patches.suse/NFS-Fix-a-potential-data-corruption.patch
    (bsc#1211162 CVE-2023-53711 bsc#1252536).
  - Update
    patches.suse/USB-gadget-Fix-the-memory-leak-in-raw_gadget-driver.patch
    (git-fixes CVE-2023-53693 bsc#1252489).
  - Update
    patches.suse/arm64-csum-Fix-OoB-access-in-IP-checksum-code-for-ne.patch
    (git-fixes CVE-2023-53726 bsc#1252565).
  - Update
    patches.suse/arm64-ftrace-fix-module-PLTs-with-mcount.patch
    (git-fixes CVE-2022-50579 bsc#1252521).
  - Update
    patches.suse/blk-iocost-use-spin_lock_irqsave-in-adjust_inuse_and.patch
    (bsc#1214992 CVE-2023-53730 bsc#1252495).
  - Update
    patches.suse/class-fix-possible-memory-leak-in-__class_register.patch
    (git-fixes CVE-2022-50578 bsc#1252519).
  - Update
    patches.suse/clk-imx-clk-imx8mp-improve-error-handling-in-imx8mp_.patch
    (git-fixes CVE-2023-53704 bsc#1252490).
  - Update
    patches.suse/clk-imx-scu-fix-memleak-on-platform_device_add-fails.patch
    (git-fixes CVE-2022-50559 bsc#1252535).
  - Update
    patches.suse/clocksource-drivers-cadence-ttc-Fix-memory-leak-in-t.patch
    (git-fixes CVE-2023-53725 bsc#1252492).
  - Update
    patches.suse/drm-Fix-potential-null-ptr-deref-due-to-drmm_mode_co.patch
    (git-fixes CVE-2022-50556 bsc#1252529).
  - Update
    patches.suse/drm-amdgpu-disable-sdma-ecc-irq-only-when-sdma-RAS-i.patch
    (git-fixes CVE-2023-53723 bsc#1252634).
  - Update
    patches.suse/drm-meson-explicitly-remove-aggregate-driver-at-modu.patch
    (git-fixes CVE-2022-50560 bsc#1252568).
  - Update patches.suse/drm-omap-dss-Fix-refcount-leak-bugs.patch
    (git-fixes CVE-2022-50574 bsc#1252516).
  - Update
    patches.suse/ext4-fix-use-after-free-read-in-ext4_find_extent-for.patch
    (bsc#1213098 CVE-2023-53692 bsc#1252515).
  - Update
    patches.suse/fs-jfs-fix-shift-out-of-bounds-in-dbAllocAG.patch
    (git-fixes CVE-2022-50567 bsc#1252486).
  - Update patches.suse/hfs-fix-OOB-Read-in-__hfs_brec_find.patch
    (git-fixes CVE-2022-50581 bsc#1252549).
  - Update
    patches.suse/iio-fix-memory-leak-in-iio_device_register_eventset.patch
    (git-fixes CVE-2022-50561 bsc#1252474).
  - Update
    patches.suse/md-raid1-fix-potential-OOB-in-raid1_remove_disk-8b04.patch
    (git-fixes CVE-2023-53722 bsc#1252499).
  - Update
    patches.suse/media-max9286-Fix-memleak-in-max9286_v4l2_register.patch
    (git-fixes CVE-2023-53700 bsc#1252522).
  - Update
    patches.suse/mfd-pcf50633-adc-Fix-potential-memleak-in-pcf50633_a.patch
    (git-fixes CVE-2023-53724 bsc#1252497).
  - Update
    patches.suse/mtd-Fix-device-name-leak-when-register-device-failed.patch
    (git-fixes CVE-2022-50566 bsc#1252484).
  - Update
    patches.suse/platform-chrome-fix-memory-corruption-in-ioctl.patch
    (git-fixes CVE-2022-50570 bsc#1252475).
  - Update
    patches.suse/regulator-core-Prevent-integer-underflow.patch
    (git-fixes CVE-2022-50582 bsc#1252476).
  - Update
    patches.suse/ring-buffer-Do-not-swap-cpu_buffer-during-resize-process.patch
    (git-fixes CVE-2023-53718 bsc#1252564).
  - Update
    patches.suse/ring-buffer-Handle-race-between-rb_move_tail-and-rb_check_pages.patch
    (git-fixes CVE-2023-53709 bsc#1252532).
  - Update
    patches.suse/s390-netiucv-Fix-return-type-of-netiucv_tx.patch
    (git-fixes bsc#1211692 CVE-2022-50564 bsc#1252538).
  - Update
    patches.suse/scsi-qla2xxx-Fix-memory-leak-in-qla2x00_probe_one.patch
    (git-fixes CVE-2023-53696 bsc#1252513).
  - Update
    patches.suse/scsi-ses-Fix-possible-addl_desc_ptr-out-of-bounds-accesses.patch
    (git-fixes CVE-2023-7324 bsc#1252893).
  - Update
    patches.suse/serial-arc_uart-fix-of_iomap-leak-in-arc_serial_prob.patch
    (git-fixes CVE-2023-53719 bsc#1252501).
  - Update
    patches.suse/serial-pch-Fix-PCI-device-refcount-leak-in-pch_reque.patch
    (git-fixes CVE-2022-50576 bsc#1252508).
  - Update
    patches.suse/tpm-acpi-Call-acpi_put_table-to-fix-memory-leak.patch
    (git-fixes CVE-2022-50562 bsc#1252528).
  - Update
    patches.suse/udf-Detect-system-inodes-linked-into-directory-hiera.patch
    (bsc#1213114 CVE-2023-53695 bsc#1252539).
  - Update
    patches.suse/usb-gadget-f_hid-fix-f_hidg-lifetime-vs-cdev.patch
    (git-fixes CVE-2022-50568 bsc#1252523).
  - Update
    patches.suse/wifi-ath9k-Fix-potential-stack-out-of-bounds-write-i.patch
    (git-fixes CVE-2023-53717 bsc#1252560).
  - Update
    patches.suse/wifi-brcmfmac-cfg80211-Pass-the-PMK-in-binary-instea.patch
    (git-fixes CVE-2023-53715 bsc#1252545).
  - Update
    patches.suse/xen-privcmd-Fix-a-possible-warning-in-privcmd_ioctl_.patch
    (git-fixes CVE-2022-50575 bsc#1252509).
  - Update
    patches.suse/xfrm-xfrm_alloc_spi-shouldn-t-use-0-as-SPI.patch
    (CVE-2025-39797 bsc#1249608 CVE-2025-39965 bsc#1251967).
  - commit a20baaf


author: jack@suse.cz
changelog:
  - Fixup build warning
    patches.suse/udf-fix-uninit-value-use-in-udf_get_fileshortad.patch.
    Refresh
    patches.suse/fs-udf-fix-OOB-read-in-lengthAllocDescs-handling.patch
  - commit df1ebe7


author: aabdallah@suse.de
changelog:
  - hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp()
    (bsc#1252904 CVE-2025-40088).
  - commit 438a073


author: aabdallah@suse.de
changelog:
  - KVM: arm64: Prevent access to vCPU events before init
    (bsc#1252919 CVE-2025-40102).
  - commit 760ca7b


author: jslaby@suse.cz
changelog:
  - Fix grub's requoted kernel parameters (bsc#1181111)
    * 0001-libkmod-config-revamp-kcmdline-parsing-into-a-state-.patch
    * 0002-libkmod-config-re-quote-option-from-kernel-cmdline.patch


author: jengelh@inai.de
changelog:
  - Update to release 29
    * Fix `modinfo -F` not working for built-in modules and
      certain fields.
    * Fix a memory leak, overflow and double free on error path.
  - Drop 0001-Fix-modinfo-F-always-shows-name-for-built-ins.patch,
    0001-libkmod-config-revamp-kcmdline-parsing-into-a-state-.patch,
    0002-libkmod-config-re-quote-option-from-kernel-cmdline.patch
    (all merged)


author: msuchanek@suse.de
changelog:
  - /usr/lib should override /lib where both are available. Support /usr/lib for
    depmod.d as well.
    * Refresh usr-lib-modprobe.patch
  - Remove test patches included in release 29
    - kmod-populate-modules-Use-more-bash-more-quotes.patch
    - kmod-testsuite-compress-modules-if-feature-is-enabled.patch
    - kmod-also-test-xz-compression.patch


author: msuchanek@suse.de
changelog:
  - Display module information even for modules built into the running kernel
    (bsc#1189537).
    + libkmod-Provide-info-even-for-modules-built-into-the.patch


author: msuchanek@suse.com
changelog:
  - Use docbook 4 rather than docbook 5 for building man pages (bsc#1190190).
    * Refres no-stylesheet-download.patch


author: msuchanek@suse.com
changelog:
  - Enable ZSTD on 15.3 as well (boo#1192104).
  - Only test ZSTD in testsuite on releases where it is available.


author: rguenther@suse.com
changelog:
  - Revert pruning the set of cross-compilers that conflict with different
    versions from the set using update-alternatives.  This causes
    endless headache with file conflicts with older GCC releases.


author: rguenther@suse.com
changelog:
  - Remove all %gcc_icecream mode cross-compilers and the corresponding
    icecream backend subpackages.  Instead use glibc-bootstrap only
    configs for cross-x86_64-gcc (ipxe,ovmf,qemu), cross-ppc64-gcc (qemu)
    and cross-arm-gcc (ovmf).


author: schwab@suse.de
changelog:
  - Update to GCC 15 branch head, 15.1.1+git9866
  - Fix PR120827, ICE due to splitter emitting constant loads directly


author: rguenther@suse.com
changelog:
  - Prune the use of update-alternatives from openSUSE Factory and
    SLFO.
  - Adjust crosses to conflict consistently where they did not
    already and make them use unsuffixed binaries.


author: schwab@suse.de
changelog:
  - Update to GCC 15 branch head, 15.1.1+git9973
  - Fixes PR120995, unrecognizable insn UNSPEC_COMPARE_AND_SWAP with
    rv64gc_zabha_zacas


author: schwab@suse.de
changelog:
  - Update to GCC 15 branch head, 15.1.1+gitt10077
  - Fixes PR120714, RISC-V: incorrect frame pointer CFA address for
    stack-clash protection loops


author: rguenther@suse.com
changelog:
  - Update to GCC 15.2 release
    * the GCC 15.2 release contains regression fixes accumulated since
      the GCC 15.1 release


author: tchvatal@suse.com
changelog:
  - Reflect SUSE CFLAGS
  - Do not bother with obscpio if we are fetching direct releases
  - Remove patch 0001-makefile-Fix-install-target.patch seems
    to build/install without it just fine
  - Update to 0.0.6:
    + New features
    - new extensible bpf_object__open_{file,mem} APIs and
      DECLARE_LIBBPF_OPTS() macro to go with them
    - bpf_helpers.h, bpf_endian.h, and bpf_tracing.h are now
      distributed with libbpf
    - BPF CO-RE: added field size, field existence, and bitfield
      relocation support
    - BPF CO-RE: BPF_CORE_READ(), bpf_core_field_exists(),
      bpf_core_field_size() and other BPF CO-RE related helpers
      available through bpf_core_read.h header
    - bpf_object__open() API now auto-detects program type from
      its section name
    - BPF_PROG_TRACING programs support (incuding BTF-typed raw
      tracepoints, fentry/fexit programs)
    - mmap() support for BPF global variables
    - declarative map pinning support added
    - probe_read_{user,kernel}[_str]() BPF helpers added
    - bpf_get_link_xdp_info() function to get more XDP information
      added
    - a bunch of other AF_XDP changes
    + Usability improvements
    - no need for int version SEC('version') = 1; anymore
    - raw_tp/tp and uprobe/uretprobe section prefixes added
    - new bpf_program__get_{type,expected_attach_type} getters
    - preserve error code on program load failure
    + Fixes
    - btf_dump padding handling
    - bpf_object__name() returning name, not path
    - ELF section handling off-by-one bug fix
    - mem leak/double free fix in BPF program relocation code


author: mrostecki@opensuse.org
changelog:
  - Build libbpf from kernel sources, not from github sources, for
    consistency with bpftool package.


author: msuchanek@suse.com
changelog:
  - libbpf is now a separate project, stop building from the kernel
    (bsc#1188419 jsc#SLE-17288 jsc#SLE-18805).
  - Fix LIBSUBDIR
    + libdir.patch


author: shung-hsi.yu@suse.com
changelog:
  - Update to 0.5.0:
    + New features and user-space APIs:
    - libbpf_set_strict_mode() allowing to opt-in into backwards incompatible libbpf-1.0 changes. See "Libbpf: the road to 1.0" and "Libbpf 1.0 migration guide" for more details.
    - streamlined error reporting for low-level APIs, high-level error-returning APIs, and pointer-returning APIs (as a libbpf-1.0 opt-in);
    - "Light" BPF skeleton support;
    - BPF_PROG_TYPE_SYSCALL support;
    - BPF perf link support for kprobe, uprobe, tracepoint, and perf_event BPF programs;
    - BPF cookie support for kprobe, uprobe, tracepoint, and perf_event BPF programs through bpf_program__attach_[ku]probe_opts() APIs;
    - allow to specify ref_ctr_off for USDT semaphores through bpf_program__attach_uprobe_opts() API;
    - btf_custom_path support in bpf_object_open_opts, allowing to specify custom BTF for CO-RE relocations;
    - sk_reuseport/migrate program type support;
    - btf_dump__dump_type_data() API, allowing to dump binary data according to BTF type description;
    - btf__load_into_kernel() and btf__load_from_kernel_by_id(), and split BTF variants of them;
    - btf__load_vmlinux_btf() and btf__load_module_btf() APIs;
    - bpf_map__initial_value() API to get initial value of mmap-ed BPF maps;
    - bpf_map_lookup_and_delete_elem_flags() API.
    + BPF-side APIs and features:
    - support for weak typed __ksym externs;
    - BPF timer helpers: bpf_timer_init(), bpf_timer_set_callback(), bpf_timer_start(), bpf_timer_cancel();
    - bpf_get_attach_cookie() helper to get BPF cookie from BPF program side;
    - bpf_get_func_ip() helper;
    - bpf_sys_bpf() helper;
    - bpf_task_pt_regs() helper;
    - bpf_btf_find_by_name_kind() helper;
    - usability improvements for bpf_tracing.h when target architecture is missing.
    + Bug fixes and compatibility improvements:
    - improve BPF support detection on old Red Hat kernels with backported BPF patches;
    - improvements for LTO builds with GCC 10+;
    - pass NLM_F_EXCL when creating TC qdisc;
    - better support of BPF map reuse on old kernels;
    - fix the bug resulting in sometimes closing FD 0, which wasn't created and owned by libbpf itself.
  - Remove patches merged upstream
    + libdir.patch
    + libbpf-Fix-build-with-latest-gcc-binutils-with-LTO.patch


author: shung-hsi.yu@suse.com
changelog:
  - Fix use-after-free in btf_dump_name_dups (boo#1204391 CVE-2022-3534)
    + libbpf-Fix-use-after-free-in-btf_dump_name_dups.patch
  - Fix null pointer dereference in find_prog_by_sec_insn() (boo#1204502 CVE-2022-3606)
    + libbpf-Fix-null-pointer-dereference-in-find_prog_by_.patch


author: schwab@suse.de
changelog:
  - Update to version 4.4.10
    * Fix alignment problem for GOST 34.11 (Streebog) in gost-yestcrypt.
    * The crypt_* functions will now all fail and set errno to ERANGE if
      their 'phrase' argument is longer than CRYPT_MAX_PASSPHRASE_SIZE
      characters (this is currently 512)
    * The NT hashing method no longer truncates passphrases at 128
      characters; Windows does not do this.
  - format-overflow.patch: remove


author: schwab@suse.de
changelog:
  - Update to version 4.4.11
    * Fixes for GCC v10.x
    * Change how the known-answer tests are parallelized
  - gcc10.patch: remove


author: schwab@suse.de
changelog:
  - Update to version 4.4.15
    * The compatibility symbols crypt_gensalt_r, xcrypt, xcrypt_r,
      xcrypt_gensalt, and xcrypt_gensalt_r are deprecated further
    * Speed up ka-sunmd5 by skipping most of the test phrases
  - Package README.md and TODO.md (bsc#1165389)


author: pgajdos@suse.com
changelog:
  - fix variable name for datamember in 'struct crypt_data' [bsc#1215496]
  - added patches
    fix https://github.com/besser82/libxcrypt/commit/b212d601549a0fc84cbbcaf21b931f903787d7e2
    + libxcrypt-man-fix-variable-name.patch


author: mliska@suse.cz
changelog:
  - Update to version 0.183:
    debuginfod: New thread-busy metric and more detailed error metrics.
      New --fdcache-mintmp and tracking of filesystem freespace.
      New increased webapi concurrency while grooming.
    debuginfod-client: DEBUGINFOD_SONAME macro added to debuginfod.h which
      can be used to dlopen the libdebuginfod.so library.
      New function debuginfod_set_verbose_fd and
      DEBUGINFOD_VERBOSE environment variable.
    config: profile.sh and profile.csh won't export DEBUGINFOD_URLS unless
      configured --enable-debuginfod-urls[=URLS]
    elflint, readelf: Recognize SHF_GNU_RETAIN.
      Handle SHT_X86_64_UNWIND as valid relocation target.
  - Remove config-do-not-define-DEBUGINFOD_URLS-environment-var.patch patch.


author: mliska@suse.cz
changelog:
  - Add disable-run-readelf-self-test.patch in order to disable
    a failing test-case with GCC 11 (PR27367).


author: mliska@suse.cz
changelog:
  - Update to version 0.184:
    debuginfod: Use libarchive's bsdtar as the .deb-family file unpacker.
    debuginfod-client: Client caches negative results. If a query for a
      file failed with 404, an empty 000 permission
      file is created in the cache. This will prevent
      requesting the same file for the next 10 minutes.
      Client objects now carry long-lived curl handles
      for outgoing connections.  This makes it more
      efficient for multiple sequential queries, because
      the TCP connections and/or TLS state info are kept
      around awhile, avoiding O(100ms) setup latencies.
    libdw: handle DW_FORM_indirect when reading attributes
    translations: Update Polish translation.


author: mliska@suse.cz
changelog:
  - Update to version 0.185:
    debuginfod-client: Simplify curl handle reuse so downloads which
      return an error are retried.
    elfcompress: Always exit with code 0 when the operation succeeds (even
      when nothing was done). On error the exit code is now always 1.


author: jcheung@suse.com
changelog:
  - For version 0.185, the below patches are no longer needed
    (jsc#SLE-17288, jsc#SLE-17951)
    libdw-check-end-of-attributes-list-consistently.patch
    elflint-dont-check-section-group-without-flags-word.patch
    libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
    libdw-readelf-make-sure-there-is-enough-data-to-read.patch
    elfutils-dont-trust-sh_entsize.patch
    elflint-check-symbol-table-data-is-big-enough-before-check.patch
    size-handle-recursive-elf-ar-files.patch
    elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
    use-the-empty-string-for-note-names-with-zero-size.patch
    readelf-fix-off-by-one-sanity-check.patch
    libebl-check-NT_PLATFORM-core-notes.patch
    libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
    libelf-check-compression-before-allocate-output-buffer.patch
    libdwfl-sanity-check-partial-core-file-data-reads.patch
    arlib-check-that-sh_entsize-isnt-zero.patch


author: martin.liska@suse.com
changelog:
  - Enhance license fields: all the libraries actually have a different
    license to the tools. While the tools are GPL-3.0-or-later, the
    libraries are (LGPL-3.0-or-later OR GPL-2.0-or-later)
    SLE bug (for tracking the above) bsc#1191310


author: matz@suse.com
changelog:
  - Add elfutils-fix-large-alignment.diff and elfutils-pr28190.diff
    to fix build/testsuite for more recent glibc and kernels.
  - Add elfutils-fuzz-1.diff, elfutils-fuzz-2.diff,
    elfutils-fuzz-3.diff, elfutils-fuzz-4.diff [bsc#1237236,
    bsc#1237240, bsc#1237241, bsc#1237242].
  - Add elfutils-fix-debuginfod-groom-race.diff to fix a testsuite
    race in run-debuginfod-find.sh.


author: hpj@suse.com
changelog:
  - Updated nss-fips-approved-crypto-non-ec.patch to approve
    RSA signature verification  mechanisms with PKCS padding and
    legacy moduli (bsc#1222834).


author: hpj@suse.com
changelog:
  - Updated nss-fips-approved-crypto-non-ec.patch to not pass in
    bad targetKeyLength parameters when checking for FIPS approval
    after keygen. This was causing false rejections.


author: martin.sirringhaus@suse.com
changelog:
  - Add nss-reproducible-chksums.patch to make NSS-build reproducible
    Use key from openssl (bsc#1081723)


author: martin.sirringhaus@suse.com
changelog:
  - update to NSS 3.110
    * bmo#1930806 - FIPS changes need to be upstreamed: force ems policy
    * bmo#1954724 - Prevent excess allocations in sslBuffer_Grow
    * bmo#1953429 - Remove Crl templates from ASN1 fuzz target
    * bmo#1953429 - Remove CERT_CrlTemplate from ASN1 fuzz target
    * bmo#1952855 - Fix memory leak in NSS_CMSMessage_IsSigned
    * bmo#1930807 - NSS policy updates
    * bmo#1951161 - Improve locking in nssPKIObject_GetInstances
    * bmo#1951394 - Fix race in sdb_GetMetaData
    * bmo#1951800 - Fix member access within null pointer
    * bmo#1950077 - Increase smime fuzzer memory limit
    * bmo#1949677 - Enable resumption when using custom extensions
    * bmo#1952568 - change CN of server12 test certificate
    * bmo#1949118 - Part 2: Add missing check in
      NSS_CMSDigestContext_FinishSingle
    * bmo#1949118 - Part 1: Fix smime UBSan errors
    * bmo#1930806 - FIPS changes need to be upstreamed: updated key checks
    * bmo#1951491 - Don't build libpkix in static builds
    * bmo#1951395 - handle `-p all` in try syntax
    * bmo#1951346 - fix opt-make builds to actually be opt
    * bmo#1951346 - fix opt-static builds to actually be opt
    * bmo#1916439 - Remove extraneous assert
  - Removed upstreamed nss-fips-stricter-dh.patch
  - Removed upstreamed nss-reproducible-chksums.patch
  - Added bmo1962556.patch to fix test failures
  - Rebased nss-fips-approved-crypto-non-ec.patch nss-fips-combined-hash-sign-dsa-ecdsa.patch
  - update to NSS 3.109
    * bmo#1939512 - Call BL_Init before RNG_RNGInit() so that special
      SHA instructions can be used if available
    * bmo#1930807 - NSS policy updates - fix inaccurate key policy issues
    * bmo#1945883 - SMIME fuzz target
    * bmo#1914256 - ASN1 decoder fuzz target
    * bmo#1936001 - Part 2: Revert “Extract testcases from ssl gtests
      for fuzzing”
    * bmo#1915155 - Add fuzz/README.md
    * bmo#1936001 - Part 4: Fix tstclnt arguments script
    * bmo#1944545 - Extend pkcs7 fuzz target
    * bmo#1912320 - Extend certDN fuzz target
    * bmo#1944300 - revert changes to HACL* files from bug 1866841
    * bmo#1936001 - Part 3: Package frida corpus script
  - update to NSS 3.108
    * bmo#1923285 - libclang-16 -> libclang-19
    * bmo#1939086 - Turn off Secure Email Trust Bit for Security
      Communication ECC RootCA1
    * bmo#1937332 - Turn off Secure Email Trust Bit for BJCA Global Root
      CA1 and BJCA Global Root CA2
    * bmo#1915902 - Remove SwissSign Silver CA – G2
    * bmo#1938245 - Add D-Trust 2023 TLS Roots to NSS
    * bmo#1942301 - fix fips test failure on windows
    * bmo#1935925 - change default sensitivity of KEM keys
    * bmo#1936001 - Part 1: Introduce frida hooks and script
    * bmo#1942350 - add missing arm_neon.h include to gcm.c
    * bmo#1831552 - ci: update windows workers to win2022
    * bmo#1831552 - strip trailing carriage returns in tools tests
    * bmo#1880256 - work around unix/windows path translation issues
      in cert test script
    * bmo#1831552 - ci: let the windows setup script work without $m
    * bmo#1880255 - detect msys
    * bmo#1936680 - add a specialized CTR_Update variant for AES-GCM
    * bmo#1930807 - NSS policy updates
    * bmo#1930806 - FIPS changes need to be upstreamed: FIPS 140-3 RNG
    * bmo#1930806 - FIPS changes need to be upstreamed: Add SafeZero
    * bmo#1930806 - FIPS changes need to be upstreamed - updated POST
    * bmo#1933031 - Segmentation fault in SECITEM_Hash during pkcs12 processing
    * bmo#1929922 - Extending NSS with LoadModuleFromFunction functionality
    * bmo#1935984 - Ensure zero-initialization of collectArgs.cert
    * bmo#1934526 - pkcs7 fuzz target use CERT_DestroyCertificate
    * bmo#1915898 - Fix actual underlying ODR violations issue
    * bmo#1184059 - mozilla::pkix: allow reference ID labels to begin
      and/or end with hyphens
    * bmo#1927953 - don't look for secmod.db in nssutil_ReadSecmodDB if
      NSS_DISABLE_DBM is set
    * bmo#1934526 - Fix memory leak in pkcs7 fuzz target
    * bmo#1934529 - Set -O2 for ASan builds in CI
    * bmo#1934543 - Change branch of tlsfuzzer dependency
    * bmo#1915898 - Run tests in CI for ASan builds with detect_odr_violation=1
    * bmo#1934241 - Fix coverage failure in CI
    * bmo#1934213 - Add fuzzing for delegated credentials, DTLS short
      header and Tls13BackendEch
    * bmo#1927142 - Add fuzzing for SSL_EnableTls13GreaseEch and
      SSL_SetDtls13VersionWorkaround
    * bmo#1913677 - Part 3: Restructure fuzz/
    * bmo#1931925 - Extract testcases from ssl gtests for fuzzing
    * bmo#1923037 - Force Cryptofuzz to use NSS in CI
    * bmo#1923037 - Fix Cryptofuzz on 32 bit in CI
    * bmo#1933154 - Update Cryptofuzz repository link
    * bmo#1926256 - fix build error from 9505f79d
    * bmo#1926256 - simplify error handling in get_token_objects_for_cache
    * bmo#1931973 - nss doc: fix a warning
    * bmo#1930797 - pkcs12 fixes from RHEL need to be picked up
  - remove obsolete patches
    * nss-fips-safe-memset.patch
    * nss-bmo1930797.patch
  - update to NSS 3.107
    * bmo#1923038 - Remove MPI fuzz targets.
    * bmo#1925512 - Remove globals `lockStatus` and `locksEverDisabled`.
    * bmo#1919015 - Enable PKCS8 fuzz target.
    * bmo#1923037 - Integrate Cryptofuzz in CI.
    * bmo#1913677 - Part 2: Set tls server target socket options in config class
    * bmo#1913677 - Part 1: Set tls client target socket options in config class
    * bmo#1913680 - Support building with thread sanitizer.
    * bmo#1922392 - set nssckbi version number to 2.72.
    * bmo#1919913 - remove Websites Trust Bit from Entrust Root
      Certification Authority - G4.
    * bmo#1920641 - remove Security Communication RootCA3 root cert.
    * bmo#1918559 - remove SecureSign RootCA11 root cert.
    * bmo#1922387 - Add distrust-after for TLS to Entrust Roots.
    * bmo#1927096 - update expected error code in pk12util pbmac1 tests.
    * bmo#1929041 - Use random tstclnt args with handshake collection script
    * bmo#1920466 - Remove extraneous assert in ssl3gthr.c.
    * bmo#1928402 - Adding missing release notes for NSS_3_105.
    * bmo#1874451 - Enable the disabled mlkem tests for dtls.
    * bmo#1874451 - NSS gtests filter cleans up the constucted buffer
      before the use.
    * bmo#1925505 - Make ssl_SetDefaultsFromEnvironment thread-safe.
    * bmo#1925503 - Remove short circuit test from ssl_Init.
  - fix build on loongarch64 (setting it as 64bit arch)
  - Remove upstreamed bmo-1400603.patch
  - Added nss-bmo1930797.patch to fix failing tests in testsuite
  - update to NSS 3.106
    * bmo#1925975 - NSS 3.106 should be distributed with NSPR 4.36.
    * bmo#1923767 - pk12util: improve error handling in p12U_ReadPKCS12File.
    * bmo#1899402 - Correctly destroy bulkkey in error scenario.
    * bmo#1919997 - PKCS7 fuzz target, r=djackson,nss-reviewers.
    * bmo#1923002 - Extract certificates with handshake collection script.
    * bmo#1923006 - Specify len_control for fuzz targets.
    * bmo#1923280 - Fix memory leak in dumpCertificatePEM.
    * bmo#1102981 - Fix UBSan errors for SECU_PrintCertificate and
      SECU_PrintCertificateBasicInfo.
    * bmo#1921528 - add new error codes to mozilla::pkix for Firefox to use.
    * bmo#1921768 - allow null phKey in NSC_DeriveKey.
    * bmo#1921801 - Only create seed corpus zip from existing corpus.
    * bmo#1826035 - Use explicit allowlist for for KDF PRFS.
    * bmo#1920138 - Increase optimization level for fuzz builds.
    * bmo#1920470 - Remove incorrect assert.
    * bmo#1914870 - Use libFuzzer options from fuzz/options/\*.options in CI.
    * bmo#1920945 - Polish corpus collection for automation.
    * bmo#1917572 - Detect new and unfuzzed SSL options.
    * bmo#1804646 - PKCS12 fuzzing target.
  - requires NSPR 4.36
  - update to NSS 3.105
    * bmo#1915792 - Allow importing PKCS#8 private EC keys missing public key
    * bmo#1909768 - UBSAN fix: applying zero offset to null pointer in sslsnce.c
    * bmo#1919577 - set KRML_MUSTINLINE=inline in makefile builds
    * bmo#1918965 - Don't set CKA_SIGN for CKK_EC_MONTGOMERY private keys
    * bmo#1918767 - override default definition of KRML_MUSTINLINE
    * bmo#1916525 - libssl support for mlkem768x25519
    * bmo#1916524 - support for ML-KEM-768 in softoken and pk11wrap
    * bmo#1866841 - Add Libcrux implementation of ML-KEM 768 to FreeBL
    * bmo#1911912 - Avoid misuse of ctype(3) functions
    * bmo#1917311 - part 2: run clang-format
    * bmo#1917311 - part 1: upgrade to clang-format 13
    * bmo#1916953 - clang-format fuzz
    * bmo#1910370 - DTLS client message buffer may not empty be on retransmit
    * bmo#1916413 - Optionally print config for TLS client and server
      fuzz target
    * bmo#1916059 - Fix some simple documentation issues in NSS.
    * bmo#1915439 - improve performance of NSC_FindObjectsInit when
      template has CKA_TOKEN attr
    * bmo#1912828 - define CKM_NSS_ECDHE_NO_PAIRWISE_CHECK_KEY_PAIR_GEN
  - Fix build error under Leap by rebasing nss-fips-safe-memset.patch.
  - update to NSS 3.104
    * bmo#1910071 - Copy original corpus to heap-allocated buffer
    * bmo#1910079 - Fix min ssl version for DTLS client fuzzer
    * bmo#1908990 - Remove OS2 support just like we did on NSPR
    * bmo#1910605 - clang-format NSS improvements
    * bmo#1902078 - Adding basicutil.h to use HexString2SECItem function
    * bmo#1908990 - removing dirent.c from build
    * bmo#1902078 - Allow handing in keymaterial to shlibsign to make
      the output reproducible
    * bmo#1908990 - remove nec4.3, sunos4, riscos and SNI references
    * bmo#1908990 - remove other old OS (BSDI, old HP UX, NCR,
      openunix, sco, unixware or reliantUnix
    * bmo#1908990 - remove mentions of WIN95
    * bmo#1908990 - remove mentions of WIN16
    * bmo#1913750 - More explicit directory naming
    * bmo#1913755 - Add more options to TLS server fuzz target
    * bmo#1913675 - Add more options to TLS client fuzz target
    * bmo#1835240 - Use OSS-Fuzz corpus in NSS CI
    * bmo#1908012 - set nssckbi version number to 2.70.
    * bmo#1914499 - Remove Email Trust bit from ACCVRAIZ1 root cert.
    * bmo#1908009 - Remove Email Trust bit from certSIGN ROOT CA.
    * bmo#1908006 - Add Cybertrust Japan Roots to NSS.
    * bmo#1908004 - Add Taiwan CA Roots to NSS.
    * bmo#1911354 - remove search by decoded serial in
      nssToken_FindCertificateByIssuerAndSerialNumber
    * bmo#1913132 - Fix tstclnt CI build failure
    * bmo#1913047 - vfyserv: ensure peer cert chain is in db for
      CERT_VerifyCertificateNow
    * bmo#1912427 - Enable all supported protocol versions for UDP
    * bmo#1910361 - Actually use random PSK hash type
    * bmo#1911576 - Initialize NSS DB once
    * bmo#1910361 - Additional ECH cipher suites and PSK hash types
    * bmo#1903604 - Automate corpus file generation for TLS client Fuzzer
    * bmo#1910364 - Fix crash with UNSAFE_FUZZER_MODE
    * bmo#1910605 - clang-format shlibsign.c
  - remove obsolete nss-reproducible-builds.patch
  - update to NSS 3.103
    * bmo#1908623 - move list size check after lock acquisition in sftk_PutObjectToList.
    * bmo#1899542 - Add fuzzing support for SSL_ENABLE_POST_HANDSHAKE_AUTH,
    * bmo#1909638 - Follow-up to fix test for presence of file nspr.patch.
    * bmo#1903783 - Adjust libFuzzer size limits
    * bmo#1899542 - Add fuzzing support for SSL_SetCertificateCompressionAlgorithm,
      SSL_SetClientEchConfigs, SSL_VersionRangeSet and SSL_AddExternalPsk
    * bmo#1899542 - Add fuzzing support for SSL_ENABLE_GREASE and
      SSL_ENABLE_CH_EXTENSION_PERMUTATION
  - Add nss-reproducible-builds.patch to make the rpms reproducible,
    by using a hardcoded, static key to generate the checksums (*.chk-files)
  - Updated nss-fips-approved-crypto-non-ec.patch to enforce
    approved curves with the CKK_EC_MONTGOMERY key type (bsc#1224113).
  - update to NSS 3.102.1
    * bmo#1905691 - ChaChaXor to return after the function
  - update to NSS 3.102
    * bmo#1880351 - Add Valgrind annotations to freebl Chacha20-Poly1305.
    * bmo#1901932 - missing sqlite header.
    * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME.
    * bmo#1615298 - improve certutil keyUsage, extKeyUsage, and nsCertType keyword handling.
    * bmo#1660676 - correct length of raw SPKI data before printing in pp utility.


author: martin.sirringhaus@suse.com
changelog:
  - update to NSS 3.111
    * bmo#1930806 - FIPS changes need to be upstreamed: force ems policy
    * bmo#1957685 - Turn off Websites Trust Bit from CAs
    * bmo#1937338 - Update nssckbi version following April 2025 Batch of Changes
    * bmo#1943135 - Disable SMIME ‘trust bit’ for GoDaddy CAs
    * bmo#1874383 - Replaced deprecated sprintf function with snprintf in dbtool.c
    * bmo#1954612 - Need up update NSS for PKCS 3.1
    * bmo#1773374 - avoid leaking localCert if it is already set in ssl3_FillInCachedSID
    * bmo#1953097 - Decrease ASAN quarantine size for Cryptofuzz in CI
    * bmo#1943962 - selfserv: Add support for zlib certificate compression


author: martin.sirringhaus@suse.com
changelog:
  - update to NSS 3.112
    * bmo#1963792 - Fix alias for mac workers on try
    * bmo#1966786 - ensure all options can be configured with SSL_OptionSet and SSL_OptionSetDefault
    * bmo#1931930 - ABI/API break in ssl certificate processing
    * bmo#1955971 - remove unnecessary assertion in sec_asn1d_init_state_based_on_template
    * bmo#1965754 - update taskgraph to v14.2.1
    * bmo#1964358 - Workflow for automation of the release on GitHub when pushing a tag
    * bmo#1952860 - fix faulty assertions in SEC_ASN1DecoderUpdate
    * bmo#1934877 - Renegotiations should use a fresh ECH GREASE buffer
    * bmo#1951396 - update taskgraph to v14.1.1
    * bmo#1962503 - Partial fix for ACVP build CI job
    * bmo#1961827 - Initialize find in sftk_searchDatabase
    * bmo#1963121 - Add clang-18 to extra builds
    * bmo#1963044 - Fault tolerant git fetch for fuzzing
    * bmo#1962556 - Tolerate intermittent failures in ssl_policy_pkix_ocsp
    * bmo#1962770 - fix compiler warnings when DEBUG_ASN1D_STATES or CMSDEBUG are set
    * bmo#1961835 - fix content type tag check in NSS_CMSMessage_ContainsCertsOrCrls
    * bmo#1963102 - Remove Cryptofuzz CI version check


author: martin.sirringhaus@suse.com
changelog:
  - update to NSS 3.112.1
    * bmo#1982742 - restore support for finding certificates by decoded serial number.


author: martin.sirringhaus@suse.com
changelog:
  - update to NSS 3.112.2
    * bmo#1970079 - Prevent leaks during pkcs12 decoding.
    * bmo#1988046 - SEC_ASN1Decode* should ensure it has read as many bytes as each length field indicates
  - Adding patch bmo1980465.patch to fix bug on s390x (bmo#1980465)
  - Adding patch bmo1956754.patch to fix possible undefined behaviour (bmo#1956754)


author: rguenther@suse.com
changelog:
  - Update to ISL version 0.12.2
    * isl_int has been replaced by isl_val
    * some of the old functions are still available in isl/deprecated/*.h
    but they will be removed in the future
    * The functions isl_pw_qpolynomial_eval, isl_union_pw_qpolynomial_eval,
    isl_pw_qpolynomial_fold_eval and isl_union_pw_qpolynomial_fold_eval have
    been changed to return an isl_val instead of an isl_qpolynomial
  - Remove obsolete config-guess-sub-update.diff patch


author: rguenther@suse.com
changelog:
  - Update to ISL version 0.14
    * support IMath as an optional replacement for GMP
    * minor AST generator improvements
  - Inherits changes from ISL version 0.13
    * deprecate isl_int
    * improved support for multi piecewise quasi-affine expressions
    * allow the user to impose a bound on the number of low-level operations
    * add isl_id_to_ast_expr and isl_id_to_pw_aff
    * add isl_schedule_constraints
    * hide internal structure of isl_vec
    * remove support for piplib
  - Add isl-0.14-fixes.patch to fix function returning without value.


author: rguenther@suse.com
changelog:
  - Update to ISL version 0.15
    * improve coalescing
    * add isl_union_access_info_compute_flow
    * add mark nodes in AST
    * add isl_union_pw_aff and isl_multi_union_pw_aff
    * add schedule trees
    * deprecate band forests
    * deprecate separation_class AST generation option
    * introduce isl_bool and isl_stat types
  - Removes no longer needed isl-0.14-fixes.patch.


author: mpluskal@suse.com
changelog:
  - Update to 0.16.1
    * fix bug in simplification
  - Changes for 0.16
    * add 32 bit integer optimization for IMath
    * minor AST generator improvements
    * add isl_union_flow_get_full_{may,must}_dependence
    * minor improvements to Python bindings
    * minor improvements to set and map printing


author: rguenther@suse.com
changelog:
  - Update to 0.18
    * improve elimination of redundant existentially quantified variables
    * improve coalescing
    * improve parametric integer programming
    * preserve isolate option in isl_schedule_node_band_split
    * print AST nodes in YAML format
    * minor improvements to Python bindings
  - Inherits update to 0.17.1
    * fix bug in coalescing treatment
  - Inherits update to 0.17
    * optionally combine SCCs incrementally in scheduler
    * optionally maximize coincidence in scheduler
    * optionally avoid loop coalescing in scheduler
    * fix handling of nested integer divisions
    * optionally detect min/max expressions during AST generation
    * minor AST generator improvements
    * simplify stride constraints
    * improve support for expansions in schedule trees


author: meissner@suse.com
changelog:
  - updated to 3.4.0
    * enhancement: add API call jent_set_fips_failure_callback as requested by Daniel Ojalvo
    * fix: Change the SHA-3 integration: The entropy pool is now a SHA-3 state.
    It is filled with the time delta containing entropy and auxiliary data that does not contain entropy using a SHA update operation. The auxiliary data is calculated by a SHA-3 hashing of some varying state data. The time delta that contains entropy is measured about the SHA-3 hasing of the auxiliary data. This satisfies FIPS 140-3 IG D.K resolutions 4, 6, and 8.
    * enhancement: add CMake support by Andrew Hopkins
  - updated to 3.3.1
    * fix: bug fix in initialization logic by Vladis Dronov <vdronov@redhat.com>
    * fix: use __asm__ instead of asm to suit the C11 standard
  - added a -devel-static package to be able to link it static.


author: meissner@suse.com
changelog:
  - updated to 3.4.1
    * add FIPS 140 hints to man page
    * simplify the test tool to search for optimal configurations
    * fix: jent_loop_shuffle: re-add setting the time that was lost with 3.4.0
    * enhancement: add ARM64 assembler code to read high-res timer


author: meissner@suse.com
changelog:
  - jitterentropy-split-internal-header.patch:
    Hide the non-GNUC constructs that are library internal from the
    exported header. (bsc#1202870)


author: pmonreal@suse.com
changelog:
  - Fix a stack corruption on s390x: [bsc#1209627]
    * Output size of the STCKE command on s390x is 16 bytes, compared
      to 8 bytes of the STCK command. Fix a stack corruption in the
      s390x version of jent_get_nstime(). Add some more detailed
      information on the STCKE command.
    * github.com/smuellerDD/jitterentropy-library/commit/7bf9f85
    * Add jitterentropy-fix-a-stack-corruption-on-s390x.patch


author: rguenther@suse.com
changelog:
  - Update to version 1.0.
    - Bump SONAME to libmpc3
    - License change: LGPLv3+ for code, GFDLv1.3+ (with no invariant sections)
      for documentation
    - Functions renamed:
      mpc_mul_2exp to mpc_mul_2ui, mpc_div_2exp to mpc_div_2ui
    - New functions: mpc_log10, mpc_mul_2si, mpc_div_2si
    - Speed-ups:
    - mpc_fma
    - Bug fixes:
    - mpc_div and mpc_norm now return a value indicating the effective
      rounding direction, as the other functions
    - mpc_mul, mpc_sqr and mpc_norm now return correct results even if there
      are over- or underflows during the computation
    - mpc_asin, mpc_proj, mpc_sqr: Wrong result when input variable has
      infinite part and equals output variable is corrected
    - mpc_fr_sub: Wrong return value for imaginary part is corrected
  - Skips version 0.9:
    - New functions:
    - mpc_set_dc, mpc_set_ldc, mpc_get_dc, mpc_get_ldc for converting
      between mpc type variables and C variables of type double _Complex
      or long double _Complex
    - mpc_sin_cos, computing simultaneously the sine and cosine
    - Speed-ups:
    - mpc_pow_si through binary exponentiation
    - mpc_pow_z when the exponent fits in a long
    - mpc_tan through the use of mpc_sin_cos
    - Bug fixes:
    - trigonometric functions: infinite loop due to overflow for large
      arguments
    - mpc_exp: close to infinite loop for argument close to 0
    - mpc_sqrt: close to infinite loop for argument close to 1
    - mpc_add_si: replaced macro by function, since the macro evaluated the
      same expression twice


author: rguenther@suse.com
changelog:
  - Update to version 1.0.2.
    - Fixed mpc_atan, mpc_atanh for (+-0, +-1)
    - Fixed mpc_log10 for purely imaginary argument
    - Fixed case of intermediate zero real or imaginary part in mpc_fma


author: mpluskal@suse.com
changelog:
  - Add gpg signature
  - Add info scriplet dependencies and move them to correct sections
  - Cleanup spec file with spec-cleaner


author: rguenther@suse.com
changelog:
  - Update to version 1.1.0.
    - Compatible with mpfr 4.0.0, obsoletes mpc-1.0.3-addsubulp.diff
      and mpc-1.0.3-fmma.diff.
    - New functions mpc_cmp_abs and mpc_rootofunity
    - Rewrite of the testing framework
    - New mpcbench tool, used with make bench
    - Fixed handling of over- and underflows with directed rounding in
      the "other direction" for mpc_cos, mpc_sin, mpc_exp and mpc_pow
    - Fixed a bug in mpc_atan(0,y) with |y| near 1
  - Adjust URLs to tarball and signature.


author: rguenther@suse.com
changelog:
  - Add mpfr-3.1.5-p9.patch with cummulative patches to patchlevel p9,
    obsoletes mpfr-3.1.5-p8.patch.


author: rguenther@suse.com
changelog:
  - Update to mpfr 4.0.0
    * The "dinde aux marrons" release.
    * MPFR now depends on GMP 5.0+ instead of 4.1+.
    * API change:
      Applications that call GMP's mp_set_memory_functions function to change
      the allocators must first call the new function mpfr_mp_memory_cleanup
      in all threads where MPFR is potentially used; this new function is
      currently equivalent to mpfr_free_cache.
      The reason is that the way memory allocation is done by MPFR has changed
      (again), so that the current GMP allocators are used (since for some
      applications, the old allocators may become invalid).
      Note: Freeing the caches like this might have a performance impact on some
      particular applications; if this is an issue, this could be handled for a
      future MPFR version.
    * Mini-gmp support via the --enable-mini-gmp configure option (experimental).
    * The minimum precision MPFR_PREC_MIN is now 1, with rounding defined as
      in the errata of IEEE 754-2008 and in the following IEEE 754 revision
      (ties rounded away from zero).
    * Shared caches for multithreaded applications.
      New function mpfr_free_cache2.
    * Partial support of MPFR_RNDF (faithful rounding).
    * New functions: mpfr_fpif_export and mpfr_fpif_import to export and import
      numbers in a floating-point interchange format, independent both on the
      number of bits per word and on the endianness.
    * New function mpfr_fmodquo to return the low bits of the quotient
      corresponding to mpfr_fmod.
    * New functions mpfr_flags_clear, mpfr_flags_set, mpfr_flags_test,
      mpfr_flags_save and mpfr_flags_restore to operate on groups of flags.
    * New functions mpfr_set_float128 and mpfr_get_float128 to convert from/to
      the __float128 type (requires --enable-float128 and compiler support).
    * New functions mpfr_buildopt_float128_p and mpfr_buildopt_sharedcache_p.
    * New functions mpfr_rint_roundeven and mpfr_roundeven, completing the
      other similar round-to-integer functions for rounding to nearest with
      the even-rounding rule.
    * New macro mpfr_round_nearest_away to add partial emulation of the
      rounding to nearest-away (as defined in IEEE 754-2008).
    * New functions mpfr_nrandom and mpfr_erandom to generate random numbers
      following normal and exponential distributions respectively.
    * New functions mpfr_fmma and mpfr_fmms to compute a*b+c*d and a*b-c*d.
    * New function mpfr_rootn_ui, similar to mpfr_root, but agreeing with the
      rootn function of the IEEE 754-2008 standard.
    * New functions mpfr_log_ui to compute the logarithm of an integer,
      mpfr_gamma_inc for the incomplete Gamma function.
    * New function mpfr_beta for the Beta function (incomplete, experimental).
    * New function mpfr_get_q to convert a floating-point number into rational.
    * The mpfr_dump function is now described in the manual; its output format
      has slightly changed.
    * The mpfr_eint function now returns the value of the E1/eint1 function
      for negative argument.
    * The behavior of the mpfr_set_exp function changed, as it could easily
      yield undefined behavior in some cases (this modifies both the API and
      the ABI).
    * In function mpfr_urandom, the next random state no longer depends on the
      current exponent range and the rounding mode. The exceptions due to the
      rounding of the random number are now correctly generated, following the
      uniform distribution.
    * Functions mpfr_grandom and mpfr_root are deprecated and will be removed
      in a future release.
    * Complete rewrite of function mpfr_sum, which now works in all cases (the
      old one could take all the memory and/or crash with inputs of different
      magnitudes in case of huge cancellation or table maker's dilemma). The
      sign of an exact zero result is now specified, and the return value is
      now the usual ternary value. Note that the position of "const" in the
      mpfr_sum prototype has been fixed (the manual was correct); user code
      should not be affected.
    * Old, deprecated macros mpfr_add_one_ulp and mpfr_sub_one_ulp removed.
      The mpfr_next* functions should be used instead.
    * Internally, improved caching: a minimum of 10% increase of the precision
      is guaranteed to avoid too many recomputations.
    * Added internal small-precision mpz_t pool, which aims to avoid the
      overhead of memory allocation, in particular.
      New function mpfr_free_pool.
    * Added configure option --enable-assert=none to avoid checking any assertion.
    * The --enable-decimal-float configure option no longer requires
    - -with-gmp-build, and support for decimal floats is now automatically
      detected by default (similarly for support for __float128).
    * Updated tuning parameters.
    * Better support for Automake 1.13+ (now used to generate the tarball).
    * Dropped K&R C compatibility.
    * Improved MPFR manual.
    * New MPFRbench program (see the tools/bench directory).
    * Major speedup in mpfr_add, mpfr_sub, mpfr_mul, mpfr_div and mpfr_sqrt when
      all operands have the same precision and this precision is less than twice
      the number of bits per word, e.g., less than 128 on a 64-bit computer.
    * Speedup by a factor of almost 2 in the double <--> mpfr conversions
      (mpfr_set_d and mpfr_get_d).
    * Speedup in mpfr_log1p and mpfr_atanh for small arguments.
    * Speedup in the mpfr_const_euler function (contributed by Fredrik Johansson),
      in the computation of Bernoulli numbers (used in mpfr_gamma, mpfr_li2,
      mpfr_digamma, mpfr_lngamma and mpfr_lgamma), in mpfr_div, in mpfr_fma
      and mpfr_fms.
    * Test coverage: 96.3% lines of code.
    * Bug fixes. In particular: a speed improvement when the --enable-assert
      or --enable-assert=full configure option is used with GCC; mpfr_get_str
      now sets the NaN flag on NaN input and the inexact flag when the conversion
      is inexact. For a full list, see http://www.mpfr.org/mpfr-3.1.6/#fixed
      and the same section for any previous 3.1.x version (follow the links
      in the "Changes..." sections).
    * Microsoft Windows: Added support for thread-safe DLL (shared library).
      Tested with MinGW, ICC and MSVC.
    * Limited pkg-config support.
    * Autotools: Under Linux, make sure that the old dtags (when supported)
      are used if LD_LIBRARY_PATH is defined; otherwise "make check" would
      check an installed, compatible MPFR library found in LD_LIBRARY_PATH
      instead of the one that has been built with "make".
    * New: optional "make check-gmp-symbols", mainly for binary distributions,
      to check that MPFR does not use GMP internal symbols (experimental).


author: astieger@suse.com
changelog:
  - update to 4.0.1:
    * Improved MPFR manual
    * bug fixes, including mpfr_div_ui, mpfr_div rounding issue


author: rguenther@suse.com
changelog:
  - Add mpfr-4.0.1-cummulative-patch.patch.  Fixes
    * A subtraction of two numbers of the same sign or addition of two
      numbers of different signs can be rounded incorrectly (and the
      ternary value can be incorrect) when one of the two inputs is
      reused as the output (destination) and all these MPFR numbers
      have exactly GMP_NUMB_BITS bits of precision (typically, 32 bits
      on 32-bit machines, 64 bits on 64-bit machines).
    * The mpfr_fma and mpfr_fms functions can behave incorrectly in case
      of internal overflow or underflow.
    * The result of the mpfr_sqr function can be rounded incorrectly
      in a rare case near underflow when the destination has exactly
      GMP_NUMB_BITS bits of precision (typically, 32 bits on 32-bit
      machines, 64 bits on 64-bit machines) and the input has at most
      GMP_NUMB_BITS bits of precision.
    * The behavior and documentation of the mpfr_get_str function are
      inconsistent concerning the minimum precision (this is related to
      the change of the minimum precision from 2 to 1 in MPFR 4.0.0). The
      get_str patch fixes this issue in the following way: the value 1
      can now be provided for n (4th argument of mpfr_get_str); if n = 0,
      then the number of significant digits in the output string can now
      be 1, as already implied by the documentation (but the code was
      increasing it to 2).
    * The mpfr_cmp_q function can behave incorrectly when the rational
      (mpq_t) number has a null denominator.
    * The mpfr_inp_str and mpfr_out_str functions might behave
      incorrectly when the stream is a null pointer: the stream is
      replaced by stdin and stdout, respectively. This behavior is
      useless, not documented (thus incorrect in case a null pointer
      would have a special meaning), and not consistent with other
      input/output functions.


author: antoine.belvire@opensuse.org
changelog:
  - Fix %install_info_delete usage:
    * It has to be performed in %preun not in %postun.
    * See https://en.opensuse.org/openSUSE:Packaging_Conventions_RPM_Macros#.25install_info_delete.


author: otto.hollmann@suse.com
changelog:
  - Security fix: [bsc#1216922, CVE-2023-5678]
    * Fix excessive time spent in DH check / generation with large Q
      parameter value.
    * Applications that use the functions DH_generate_key() to generate
      an X9.42 DH key may experience long delays. Likewise,
      applications that use DH_check_pub_key(), DH_check_pub_key_ex
      () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42
      DH parameters may experience long delays. Where the key or
      parameters that are being checked have been obtained from an
      untrusted source this may lead to a Denial of Service.
    * Add openssl-CVE-2023-5678.patch


author: otto.hollmann@suse.com
changelog:
  - Security fix: [bsc#1219243, CVE-2024-0727]
    * Add NULL checks where ContentInfo data can be NULL
    * Add openssl-CVE-2024-0727.patch


author: otto.hollmann@suse.com
changelog:
  - Security fix: [bsc#1222548, CVE-2024-2511]
    * Fix unconstrained session cache growth in TLSv1.3
    * Add openssl-CVE-2024-2511.patch


author: psimons@suse.com
changelog:
  - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free
    security vulnerability. Calling the function SSL_free_buffers()
    potentially caused memory to be accessed that was previously
    freed in some situations and a malicious attacker could attempt
    to engineer a stituation where this occurs to facilitate a
    denial-of-service attack. [CVE-2024-4741, bsc#1225551]


author: pmonreal@suse.com
changelog:
  - Security fix: [bsc#1227138, CVE-2024-5535]
    * SSL_select_next_proto buffer overread
    * Add openssl-CVE-2024-5535.patch


author: pmonreal@suse.com
changelog:
  - Security fix: [bsc#1220262, CVE-2023-50782]
    * Implicit rejection in PKCS#1 v1.5
    * Add openssl-CVE-2023-50782.patch


author: angel.yankov@suse.com
changelog:
  - Security fix: [bsc#1236136, CVE-2024-13176]
    * timing side-channel in the ECDSA signature computation
    * Add openssl-CVE-2024-13176.patch


author: pmonreal@suse.com
changelog:
  - FIPS: Use the NID_X9_62_prime256v1 curve in ECDSA KAT test
    instead of NID_secp256k1. [bsc#1246697]
    * Add openssl-fips-ECDSA-KAT.patch


author: lucas.mulling@suse.com
changelog:
  - Security fix: [bsc#1250232 CVE-2025-9230]
    * Fix out-of-bounds read & write in RFC 3211 KEK unwrap
    * Add patch openssl3-CVE-2025-9230.patch


author: mcepl@cepl.eu
changelog:
  - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote
    path names provided when creating a virtual environment
    (bsc#1232241, CVE-2024-9287)


author: mcepl@cepl.eu
changelog:
  - Add CVE-2024-11168-validation-IPv6-addrs.patch
    fixing bsc#1233307 (CVE-2024-11168,
    gh#python/cpython#103848): Improper validation of IPv6 and
    IPvFuture addresses.


author: mcepl@cepl.eu
changelog:
  - Remove -IVendor/ from python-config boo#1231795
  - Fix CVE-2024-11168-validation-IPv6-addrs.patch
  - PGO run of build freezes with parallel processing, switch to -j1


author: mcepl@cepl.eu
changelog:
  - Add CVE-2025-0938-sq-brackets-domain-names.patch which
    disallows square brackets ([ and ]) in domain names for parsed
    URLs (bsc#1236705, CVE-2025-0938, gh#python/cpython#105704)


author: mcepl@suse.com
changelog:
  - Update CVE-2024-11168-validation-IPv6-addrs.patch
    according to the Debian version
    (gh#python/cpython#103848#issuecomment-2708135083).


author: mcepl@cepl.eu
changelog:
  - Add CVE-2025-4516-DecodeError-handler.patch fixing
    CVE-2025-4516 (bsc#1243273) blocking DecodeError handling
    vulnerability, which could lead to DoS.


author: mcepl@suse.com
changelog:
  - Add ipaddress-update-pr60.patch from gh#phihag/ipaddress!60 to
    update vendored ipaddress module to 3.8 equivalent
  - Add gh-128840_parse-IPv6-with-emb-IPv4.patch to limit buffer
    size for IPv6 address parsing (gh#python/cpython#128840,
    bsc#1244401).
  - Update CVE-2025-4516-DecodeError-handler.patch not to break
    _PyBytes_DecodeEscape signature.


author: mcepl@cepl.eu
changelog:
  - Add CVE-2025-4435-normalize-lnk-trgts-tarfile.patch
    Security fixes for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138,
    CVE-2024-12718, CVE-2025-4435 on tarfile (bsc#1244032,
    bsc#1244061, bsc#1244059, bsc#1244060, bsc#1244056).
    The backported fixes do not contain changes for ntpath.py and
    related tests, because the support for symlinks and junctions
    were added later in Python 3.9, and it does not make sense to
    backport them to 3.6 here.
    The patch is contains the following changes:
    - python@42deeab fixes symlink handling for tarfile.data_filter
    - python@9d2c2a8 fixes handling of existing files/symlinks in tarfile
    - python@00af979 adds a new "strict" argument to realpath()
    - python@dd8f187 fixes mulriple CVE fixes in the tarfile module
    - downstream only fixes that makes the changes work and
      compatible with Python 3.6
  - Add CVE-2025-6069-quad-complex-HTMLParser.patch to avoid worst
    case quadratic complexity when processing certain crafted
    malformed inputs with HTMLParser (CVE-2025-6069, bsc#1244705).


author: mcepl@cepl.eu
changelog:
  - Add CVE-2025-8194-tarfile-no-neg-offsets.patch which now
    validates archives to ensure member offsets are non-negative
    (gh#python/cpython#130577, CVE-2025-8194, bsc#1247249).


author: mliska@suse.cz
changelog:
  - Update to gcc-11 branch head (d4a1d3c4b377f1d4acb), git1173
    * Fix D memory corruption in -M output.
    * Fix ICE in is_this_parameter with coroutines.  [boo#1193659]


author: rguenther@suse.com
changelog:
  - Add a list of Obsoletes to libstdc++6-pp-gcc11 so updates from
    packages provided by older GCC work.  Add a requires from that
    package to the corresponding libstc++6 package to keep those
    at the same version.  [bsc#1196107]


author: dmueller@suse.com
changelog:
  - drop armv5tel, merge arm and armv6hl
  - use --with-cpu rather than specifying --with-arch/--with-tune


author: rguenther@suse.com
changelog:
  - Update to gcc-11 branch head (6a1150d1524aeda3381b21717), git1406
    * includes change to adjust gnats idea of the target, fixing
      the build of gprbuild.  [bsc#1196861]
  - Add gcc11-pr104931.patch to fix miscompile of embedded premake
    in 0ad on i586.  [bsc#1197065]


author: rguenther@suse.com
changelog:
  - Add provides/conflicts to glibc crosses since only one GCC version
    for the same target can be installed at the same time.
  - Add provides/conflicts to libgccjit.


author: rguenther@suse.com
changelog:
  - Update to gcc-11 branch head (691af15031e00227ba6d5935c), git1635
    * includes gcc11-pr104931.patch
    * includes fix for Firefox ICE  [gcc#105256]


author: msuchanek@suse.de
changelog:
  - Update from current 15 SP4 kernel
    + linux-stable-version-update.patch					(stable-5.14.11)
    + binder-fix-freeze-race.patch					(stable-5.14.9)
    + bpf-Fix-a-typo-of-reuseport-map-in-bpf.h.patch			(stable-5.14.4)
    + fq_codel-reject-silly-quantum-parameters.patch			(stable-5.14.7)
    + habanalabs-add-in-device-creation-status.patch			(stable-5.14.8)
    + serial-8250-Define-RX-trigger-levels-for-OxSemi-950-.patch		(stable-5.14.6)
    + dmanegine-idxd-add-software-command-status.patch			(jsc#SLE-18899)
    + dmaengine-idxd-fix-setting-up-priv-mode-for-dwq.patch		(jsc#SLE-18899)
    + ethtool-add-two-link-extended-substates-of-bad-signa.patch		(bsc#1190336)
    + ethtool-add-two-coalesce-attributes-for-CQE-mode.patch		(jsc#SLE-19253)
    + msft-hv-2440-hyper-v-Replace-uuid.h-with-types.h.patch		(git-fixes)
    + RDMA-mlx5-Add-DCS-offload-support.patch				(jsc#SLE-19250)
    + remove-the-lightnvm-subsystem.patch					(bsc#1190569)
    + scsi-fc-Add-EDC-ELS-definition.patch				(bsc#1190576)
    + uapi-add-a-compatibility-layer-between-linux-uio-h-and-glibc	(bsc#1053501)
    + md-display-timeout-error.patch					(bsc#763402)


author: dfaggioli@suse.com
changelog:
  - Export the macros necessary for making core-scheduling usable (bsc#1194659)
    + uapi-linux-prctl-provide-macro-definitions-for-the-PR_SCHED_CORE-type-argument


author: msuchanek@suse.com
changelog:
  - Delete RDMA-mlx5-Add-DCS-offload-support.patch (bsc#1191550)
  - Update from current 15 SP4 kernel (jsc#SLE-17360)
    * Refresh linux-stable-version-update.patch
    + kvm-sev-add-support-for-sev-intra-host-migration			(jsc#SLE-19924)
    + PCI-Add-PCI_EXP_DEVCTL_PAYLOAD_-macros.patch			(stable-5.14.19)
    + ethtool-fix-ethtool-msg-len-calculation-for-pause-st.patch		(stable-5.14.19)
    + uapi-fix-linux-nfc.h-userspace-compilation-errors.patch		(git-fixes)
    + nfc-uapi-use-kernel-size_t-to-fix-user-space-builds.patch		(git-fixes)
    + cifs-remove-pathname-for-file-from-SPDX-header.patch		(bsc#1193629)
    + uapi-Fix-undefined-__always_inline-on-non-glibc-syst.patch		(git-fixes)
    + tty-Partially-revert-the-removal-of-the-Cyclades-pub.patch		(git-fixes)
    + um-virt-pci-fix-uapi-documentation					(git-fixes)
    + net-sched-act_skbmod-Add-SKBMOD_F_ECN-option-support.patch		(bsc#1189998)
    + stddef-Introduce-struct_group-helper-macro.patch			(jsc#SLE-18978)
    + net-smc-add-support-for-user-defined-EIDs				(jsc#SLE-18331)
    + net-smc-add-generic-netlink-support-for-system-EID			(jsc#SLE-18331)
    + net-smc-add-netlink-support-for-SMC-Rv2				(jsc#SLE-18331)
    + net_sched-refactor-TC-action-init-API.patch				(bsc#1189998)
    + 0001-mm-mempolicy-add-MPOL_PREFERRED_MANY-for-multiple-pr.patch	(jsc#SLE-23098)
    + 0003-mm-mempolicy-wire-up-syscall-set_mempolicy_home_node.patch	(jsc#SLE-23098)
    + devlink-report-maximum-number-of-snapshots-with-regi.patch		(jsc#SLE-19253)
    + x86-arch_prctl-add-controls-for-dynamic-xstate-components.patch	(jsc#SLE-18931)
    + 0005-efi-generate-secret-key-in-EFI-boot-environment.patch		(fate#316350)
    + mptcp-add-missing-documented-NL-params				(git-fixes)
    + stddef-Introduce-DECLARE_FLEX_ARRAY-helper.patch			(git-fixes)


author: msuchanek@suse.com
changelog:
  - Add the rest of 1.0 IAA operation definitions to the user header (jsc#PED-813).
    + dmaengine-idxd-update-IAA-definitions-for-user-heade.patch


author: tiwai@suse.com
changelog:
  - Add linux/sev-guest.h (bsc#1211096):
    virt-Add-SEV-SNP-guest-driver
    virt-sevguest-Add-support-to-derive-key
    virt-sevguest-Add-support-to-get-extended-report


author: wr@rosenauer.org
changelog:
  - update to version 4.29
    * Remove macOS Code Fragment Manager support code
    * Remove XP_MACOSX and OS_TARGET=MacOSX
    * Refresh config.guess and config.sub
    * Remove NSPR's patch to config.sub
    * Add support for e2k target (64-bit Elbrus 2000)


author: wr@rosenauer.org
changelog:
  - update to version 4.30
    * support longer thread names on macOS
    * fix a build failure on OpenBSD


author: andreas.stieger@gmx.de
changelog:
  - update to version 4.31:
    * Lock access to PRCallOnceType members in PR_CallOnce* for
      thread safety bmo#1686138


author: martin.sirringhaus@suse.com
changelog:
  - update to version 4.32:
    * implement new socket option PR_SockOpt_DontFrag
    * support larger DNS records by increasing the default buffer
      size for DNS queries


author: wr@rosenauer.org
changelog:
  - update to version 4.34
    * add an API that returns a preferred loopback IP on hosts that
      have two IP stacks available.


author: wr@rosenauer.org
changelog:
  - update to version 4.35
    * fixes for building with clang
    * use the number of online processors for the
      PR_GetNumberOfProcessors() API on some platforms
    * fix build on mips+musl libc
    * Add support for the LoongArch 64-bit architecture


author: wr@rosenauer.org
changelog:
  - update to version 4.36
    * remove support for OS/2
    * remove support for Unixware, Bsdi, old AIX, old HPUX9 & scoos
    * remove support for Windows 16 bit
    * renamed the prwin16.h header to prwin.h
    * configure was updated from 2.69 to 2.71
    * various build, test and automation script fixes
    * major parts of the source code were reformatted


author: vcizek@suse.com
changelog:
  - Obsolete openssl-debuginfo
    * the package doesn't exist any more, has been replaced by
      openssl-{so_version}-debuginfo (bsc#1040172)


author: vcizek@suse.com
changelog:
  - Revert version back to 1.0.2m to get security fixes quickly to
    Tumbleweed
    * OpenSSL Security Advisory [02 Nov 2017] (bsc#1066242,bsc#1056058)


author: vcizek@suse.com
changelog:
  - change the sonum to 1.1, as all the minor versions keep ABI
    compatibility (bsc#1081335)
  - update baselibs.conf


author: glin@suse.com
changelog:
  - Add pesign-obs-integration-bsc1183747-always-pad-efi-images.patch
    to fix the potential hash mismatching (bsc#1183747)


author: glin@suse.com
changelog:
  - Add pesign-obs-integration-support-gzip-zstd-compression.patch
    to support gzip and zstd module compression


author: dmueller@suse.com
changelog:
  - Update to version git master (10.2):
    * Add support for GZIP and ZSTD module compression (bsc#1188636)
    * Always pad the EFI image when calculating the hash
    * Version bump to 10.2
    * approach issue#22 false noarch subpackage
  - drop pesign-obs-integration-bsc1183747-always-pad-efi-images.patch
    pesign-obs-integration-support-gzip-zstd-compression.patch (merged)


author: lnussel@suse.de
changelog:
  - Update to version 10.2+git20210730.0cb100c:
    * Sign kernel also in module dir (boo#1184804)
      (replaces pesign-kernel-in-lib.diff)
  - switch package to obs_scm to avoid recompression


author: lnussel@suse.de
changelog:
  - Update to version 10.2+git20210804.ff18da1:
    * brp-99-pesign: fix that the signature of shim be broken


author: msuchanek@suse.com
changelog:
  - Support signing grub on powerpc (jsc#SLE-18271 bsc#1192764).
    + 0001-Support-ppc-grub-signing-jsc-SLE-18271-bsc-1192764.patch
    + 0002-kernel-sign-file-Move-x509-parsing-into-a-function.patch
    + 0003-kernel-sign-file-Support-appending-verbatim-PKCS-7-s.patch
    + 0004-Add-padding-to-grub-signature-correctly-jsc-SLE-1827.patch


author: jlee@suse.com
changelog:
  - Add 0001-pesign-gen-repackage-spec-fix-the-filename-issue-in-.patch
    to fix fix the filename issue in the scripts of generated ueficert
    package. (bsc#1195805)(bsc#1205917)


author: jlee@suse.com
changelog:
  - Add 0001-Add-support-for-dependency-generators.patch to
    - Add support for including macros in pesign-repackage.spec by
      using pesign-spec-macros
    - Add support for copying sources to the new build directory by
      using pesign-copy-sources
    - Update README for dependency generation
    - Add Dependency Generation section
    - Convert to Markdown
      (bsc#1207520)(jsc#PED-2658)


author: jlee@suse.com
changelog:
  - Add the following patches for bsc#1248618:
    - Bug 1248618 - pesign-obs-integration fails build when no signed binary is produced
    - bsc1248618-Create-archive-first.patch
    - bsc1248618-Skip-signing-when-there-are-no-files-to-sign-bsc-124.patch
    - bsc1248618-pesign-repackage.spec.in-Stop-repacking-process-when.patch


author: dimstar@opensuse.org
changelog:
  - Update to version 0.27:
    + Drop usage of popt for equivalent API in glib2
    + Add back an internal snapshot of glib2 to break circular
      dependency
    + Fix --exists to check for Requires and Requires.private.
    + Various fixes for MinGW which should allow it to be used
      unpatched on that system
    + New autoconf macros PKG_INSTALLDIR and PKG_NOARCH_INSTALLDIR to
      help determine the .pc file install directory
    + Fix handling of --exact/atleast/max-version vs. =/>=/<=
    + Fix errors in man page source
    + Ensure testing only searches in the check directory
    + Bump glib requirement to 2.16 to avoid deprecated
      g_win32_get_package_installation_subdirectory()
    + Autotools refresh and update
    + Use g_alloca from glib instead of figuring out alloca ourselves
    + Remove search for setresuid & setreuid only needed for internal
      popt
    + Bugs fixed: fdo#833, fdo#2458, fdo#5214, fdo#5326, fdo#5703,
      fdo#6074, fdo#8653, fdo#9135, fdo#9143, fdo#9584, fdo#10652,
      fdo#11464, fdo#14396, fdo#17053, fdo#23922, fdo#28776,
      fdo#29011, fdo#29801, fdo#31699, fdo#31700, fdo#32622,
      fdo#34382, fdo#37266, fdo#39646, fdo#41081, fdo#43149,
      fdo#44843, fdo#45599, fdo#45742, fdo#48743
  - Changes from version 0.26:
    + Build system fixes
    + More tests
    + pkg.m4 fixups which makes autoconf 2.66 happier.
    + Drop support for legacy -config scripts.  Those should already
      be gone and cause problems in cross-compilation environments.
    + Drop embedded glib
    + Fix up pkg.m4 to handle the case of --exists working and
    - -cflags or --libs failing.
    + Various documentation updates
    + Allow $() through without escaping it.
    + Add --with-system-include-path instead of hard-coding
      /usr/include.
  - Pass --with-internal-glib to configure. We don't want to have a
    build cycle with glib, so we use the interal version.
  - Clean up spec-file using spec-cleaner and manually.
  - Drop pkg-config-dnl.patch: fixed upstream.


author: dimstar@opensuse.org
changelog:
  - Update to version 0.27.1:
    + Various fixes for using the internal glib snapshot. It should
      now be usable pretty much everywhere with the exception that
      universal builds are not supported on OS X.
    + Remove usage of gettext from the internal glib to avoid gettext
      and libintl dependencies
    + Update internal glib snapshot to 2.32.4
    + Fix check for POSIX shell used in tests to work better
    + Handle spaces in autodetected prefix on Windows
    + Bugs fixed: fdo#3550, fdo#51883, fdo#52031, fdo#53493.


author: p.drouand@gmail.com
changelog:
  - Update to version 0.28:
    + Fixed a pair of long-standing and intertwined bugs involving
      unwanted removal of flags:
    - Other Libs flags like -Wl are now kept in context order
      with -l flags.
    - Aggressive removal of all duplicate arguments has been scaled
      back so that just consecutive duplicate arguments are
      removed. One result of this change is that some flags could
      be repeated in the final output, especially flags from
      non-pkg-config packages like -lm. Since pkg-config rarely has
      enough knowledge here about the right thing to do, we throw
      the duplicate arguments at the compiler/linker and trust it
      will do the right thing.
    + Fixed an old bug to allow circular Requires. This fix brings
      along a small behavior change in that pkg-config resolves
      requires depth first, causing some lower level flags to show up
      earlier in the output than previously.
    + Cleaned up many corner-case bugs and ambiguous behavior in
      pkg-config's interface.
    + New autoconf macro PKG_CHECK_VAR for reading variables from .pc
      files.
    + Default to suppressing -L/lib and/or -L/lib64 like their /usr
      counterparts.
    + To help support multiarch scenarios out of the box,
      $host-pkg-config is now installed unless --disable-host-tool
      is passed to configure.
    + Added optional gcov usage through the --with-gcov configure
      option. As a result, many more tests were added to greatly
      increase the coverage of the code to 86% of executed lines on a
      Fedora 18 machine.
    + Bugs fixed: fdo#130, fdo#7331, fdo#16101, fdo#17053, fdo#19950,
      fdo#34504, fdo#48098, fdo#54231, fdo#54271, fdo#54379,
      fdo#54384, fdo#54386, fdo#54388, fdo#54389, fdo#54390,
      fdo#54391, fdo#54427, fdo#54463, fdo#54716, fdo#57078,
      fdo#58363, fdo#59435.


author: dvaleev@suse.com
changelog:
  - Don't redefine _arch, but use file pattern instead. This ensures
    we don't have to run fixing each and every arch.


author: zaitor@opensuse.org
changelog:
  - Update to version 0.29:
    + Fixed a regression from 0.28 in system -L flag handling. If the
      pc file has multiple system -L flags, every other flag will be
      left as is (fdo#78077).
    + Quoting of variables queried through --variable is removed so
      that the output can be used verbatim in subsequent shell
      commands (fdo#67904).
    + Fixed a regression from 0.28 in -L flag handling on Windows. A
      .libs suffix was inadvertantly being added to the library path.
    + Added a --validate option to check pc file syntax. This works
      just like --exists, but package dependencies are disabled
      (fdo#7000).
    + Added the PKG_PREREQ autoconf macro. Whereas
      PKG_PROG_PKG_CONFIG is used to check the version of the
      pkg-config tool, this is used to check the version of the
      pkg-config autoconf macros in use.
    + Added the PKG_CHECK_MODULES_STATIC autoconf macro. This will
      temporarily add --static to the pkg-config calls while invoking
      PKG_CHECK_MODULES (fdo#19541).
    + Many fixes to the testsuite for Windows. It should now pass for
      a MinGW, Cygwin, and cross-compiled MinGW using Wine for test
      execution (fdo#66939).
    + More consistent handling of prefix redefinition. On Windows,
      the prefix was always being redefined based on the pc file
      path. This feature can now be enabled or disabled at runtime on
      all platforms using the --define-prefix and
    - -dont-define-prefix options (fdo#63602).
    + Continue listing packages with --list-all even if there are
      errors in pc files (fdo#26615).
    + Various documentation improvements (fdo#62018, fdo#62374,
      fdo#66155).
    + Fixed a bug when multiple -isystem arguments are used
      (fdo#72584).
    + pkg-config is now built with largefile support to ensure that
      it works correctly on filesystems with 64 bit inodes
      (fdo#90078).
    + Bugs fixed: fdo#7000, fdo#19541, fdo#26615, fdo#62018,
      fdo#62374, fdo#63602, fdo#66155, fdo#66939, fdo#67904,
      fdo#70690, fdo#72584, fdo#78077, fdo#80378, fdo#80380,
      fdo#89267, fdo#90078, fdo#90437, fdo#92002.


author: zaitor@opensuse.org
changelog:
  - Update to version 0.29.1:
    + Fixed a regression from 0.29 with unquoting values queried with
    - -variable. In some cases, this would cause shell special
      characters to be escaped in ways they weren't before. Instead,
      the unquoting only occurs if the value appears to be quoted
      (fdo#93284).
    + Add support for building pkg-config with Microsoft Visual
      Studio (fdo#92489).
    + Allow overriding pkg-config variables with environment
      variables. By setting an environment variable of the form
      PKG_CONFIG_$PACKAGE_$VARIABLE, a pkg-config variable can be set
      globally without always having to pass --define-variable
      (fdo#90917).
    + Honor -Wl,-framework in addition to -framework so that multiple
      frameworks are handled on OSX (fdo#1278).
    + Fix the OSX build using --with-internal-glib (fdo#92902).


author: dimstar@opensuse.org
changelog:
  - Update to version 0.29.2:
    + Improved pkg-config's recursive package list expansion
      performance.
    + Handle an empty prefix setting correctly when --define-prefix
      is used (fdo#97453).
    + Lazily load pc files instead of reading all available pc files
      during initialization (fdo#98215).
    + Check the CPATH environment variable when determining system
      include paths like GCC does. Document the system search path
      behavior (fdo#99224).
    + Make PKG_CHECK_MODULES show the module list rather than the
      variable prefix in configure output (fdo#98334).
    + Fix bundled glib build with GCC 6 (fdo#98334).
    + Handle -isystem and -idirafter when PKG_CONFIG_SYSROOT_DIR is
      set (fdo#97337).
    + Check the INCLUDE environment variable when determining system
      include paths on Windows builds when --msvc-syntax is used
      (fdo#94729).
  - Drop pkg-config-gdate-fix.patch: fixed upstream.


author: mwilck@suse.com
changelog:
  - Update to version 15.4.11:
    * cdrom: Disable autoclose by default (boo#1165047).
    * Make regenerate-initrd-posttrans compatible with Dracut's
      UEFI mode (unified kernel image)


author: mwilck@suse.com
changelog:
  - Update to version 15.4.12:
    * Add /etc/modprobe.d/README on SLE/Leap (bsc#1195051)
    * rpm-script: force-copy kernel to /boot (boo#1194501)


author: mwilck@suse.com
changelog:
  - Update to version 15.4.13:
    * 80-hotplug-cpu-mem.rules: restrict cpu rule to x86_64 (bsc#1204423)


author: mwilck@suse.com
changelog:
  - Update to version 15.4.15: Backport bug fixes from factory
    * driver-check.sh, unblacklist: convert egrep to grep -E (bsc#1203092)
    * kernel-scriptlets: don't pass flags to weak-modules2 (bsc#1195391)
    * driver-check.sh: avoid false positive error messages (boo#1200107)


author: mwilck@suse.com
changelog:
  - Update to version 15.4.17:
    * cert-script: warn only once about non-writable efivarfs
    * cert-script: skip cert handling if efivarfs is not writable
      (bsc#1213428, bsc#1201066)


author: mwilck@suse.com
changelog:
  - Update to version 15.4.18:
    * blacklist RNDIS modules (bsc#1205767, jsc#PED-5731, CVE-2023-23559)
    * modprobe.d: Blacklist cls_tcindex module (bsc#1210335, CVE-2023-1829)
    (note: this is not a full fix for that CVE)


author: mwilck@suse.com
changelog:
  - Update to version 15.4.20:
    * add blacklist entry for reiserfs (jsc#PED-6167)
    * Add more modules to file system blacklist (jsc#PED-6167)
    * Add hfsplus to file system blacklist (bsc#1240950, jsc#PED-12632)


author: fbui@suse.com
changelog:
  - Don't emit a warning when the flag file in /var/lib/systemd/migrated/ is not
    present as it's expected (bsc#1208079).


author: fbui@suse.com
changelog:
  - Fix %sysctl_apply() and %binfmt_apply() so they are disabled when called from
    a chroot (bsc#1211272)


author: fbui@suse.com
changelog:
  - Switch to `systemd-hwdb` tool when updating the HW database. It's been
    introduced in systemd v219 and replaces the deprecated command `udevadm hwdb`.


author: fbui@suse.com
changelog:
  - Order packages that requires systemd after systemd-sysvcompat when this part
    of the transaction (bsc#1217964)
    systemd-sysvcompat has been introduced recently and contains the compatibility
    scripts used to support SysV init scripts. Make sure that the packages ordered
    after systemd are also ordered after systemd-sysvcompat so theirs rpm
    scriptlets can still rely on the compat scripts.
    On distributions where systemd-sysvcompat doesn't exist, the new ordering
    constraint should be a nop.


author: fbui@suse.com
changelog:
  - Introduce %udev_trigger_with_reload() for packages that need to trigger events
    in theirs scriplets. The new macro automatically triggers a reload of the udev
    rule files as this step is often overlooked by packages (bsc#1237143).


author: tchvatal@suse.com
changelog:
  - Add patch to fix compression level switching
    bsc#1175811 bsc#1175830 bsc#1175831
    * zlib-compression-switching.patch


author: danilo.spinella@suse.com
changelog:
  - Update 410.patch to include new fixes from upstream,
    fixes bsc#1192688
  - Refresh bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch
    to match upstream commit
  - Drop patches which changes have been merged in 410.patch:
    * zlib-compression-switching.patch
    * zlib-390x-z15-fix-hw-compression.patch
    * bsc1174551-fxi-imcomplete-raw-streams.patch


author: sbrabec@suse.com
changelog:
  - Fix heap-based buffer over-read or buffer overflow in inflate via
    large gzip header extra field (bsc#1202175, CVE-2022-37434,
    CVE-2022-37434-extra-header-1.patch,
    CVE-2022-37434-extra-header-2.patch).


author: danilo.spinella@suse.com
changelog:
  - Add DFLTCC support for using inflate() with a small window,
    fixes bsc#1206513
    * bsc1206513.patch


author: oss@danyspin97.org
changelog:
  - Fix CVE-2023-45853, integer overflow and resultant heap-based buffer
    overflow in zipOpenNewFileInZip4_6, bsc#1216378
    * CVE-2023-45853.patch


author: idonmez@suse.com
changelog:
  - Update to version 1.4.4
    * perf: Improved decompression speed, by > 10%
    * perf: Better compression speed when re-using a context
    * perf: Fix compression ratio when compressing large files with
      small dictionary
    * perf: zstd reference encoder can generate RLE blocks
    * perf: minor generic speed optimization
    * api: new ability to extract sequences from the parser for analysis
    * api: fixed decoding of magic-less frames
    * api: fixed ZSTD_initCStream_advanced() performance with fast modes
    * cli: Named pipes support
    * cli: short tar's extension support
    * cli: command --output-dir-flat=DIE , generates target files into
      requested directory
    * cli: commands --stream-size=# and --size-hint=#
    * cli: command --exclude-compressed
    * cli: faster -t test mode
    * cli: improved some error messages
    * cli: fix rare deadlock condition within dictionary builder
    * misc: Improved documentation : ZSTD_CLEVEL, DYNAMIC_BMI2,
      ZSTD_CDict, function deprecation, zstd format
    * misc: fixed educational decoder : accept larger literals section,
      and removed UNALIGNED() macro
  - Refresh pzstd.1.patch


author: idonmez@suse.com
changelog:
  - Update to version 1.4.5
    * perf: Improved decompression speed (x64 >+5%, ARM >+15%)
    * perf: Automatically downsizes ZSTD_DCtx when too large for too
    * perf: Improved fast compression speed on aarch64 (#2040, ~+3%)
    * perf: Small level 1 compression speed gains (depending on compiler)
    * fix: Compression ratio regression on huge files (> 3 GB) using high
      levels (--ultra) and multithreading
    * api: ZDICT_finalizeDictionary() is promoted to stable
    * api: new experimental parameter ZSTD_d_stableOutBuffer
    * cli: New --patch-from command, create and apply patches from files
    * cli: --filelist= : Provide a list of files to operate upon from a file
    * cli: -b can now benchmark multiple files in decompression mode
    * cli: New --no-content-size command
    * cli: New --show-default-cparams command
    * misc: new diagnosis tool, checked_flipped_bits, in contrib/
    * misc: Extend largeNbDicts benchmark to compression
    * misc: experimental edit-distance match finder in contrib/


author: bwiedemann@suse.com
changelog:
  - Update to version 1.4.7
    * Improved --long mode
    * --long now automatically enabled for any window size >= 128MB
    * Faster decompression of small blocks
    * CLI improvements
      + accept parameter through environment variable ZSTD_NBTHREADS
      + new command --output-dir-mirror
      + more accurate warning and error messages
    * New experimental features
      + Shared Thread Pool
      + Faster Dictionary Compression
      + New Sequence Ingestion API
    * Drop upstream fix-lib-build.patch


author: bwiedemann@suse.com
changelog:
  - Update to version 1.4.9
    * https://github.com/facebook/zstd/releases/tag/v1.4.9
    * >2x Faster Long Distance Mode
    * New Experimental Decompression Feature: ZSTD_d_refMultipleDDicts
    * bug: Use umask() to Constrain Created File Permissions
    * bug: Make Simple Single-Pass Functions Ignore Advanced Parameters
    * cli: Fix --output-dir-mirror's Rejection of ..-Containing Paths
    * cli: Allow Input From Console When -f/--force is Passed


author: ali.abdallah@suse.com
changelog:
  - Update to version 1.5.0 (jsc#SLE-20392)
    * https://github.com/facebook/zstd/releases/tag/v1.5.0
    * Improved Middle-Level Compression Speed
    * Improved High-Level Compression Ratio
    * Faster Decompression Speed
    * Dynamic Library Supports Multithreading by Default


author: ali.abdallah@suse.com
changelog:
  - Fix CVE-2022-4899, bsc#1209533
    * Fix buffer underflow when dir1 == ""
    * Disallow empty string as an argument for --output-dir-flat=""
    and --output-dir-mirror="".
  - Added patches:
    * Disallow-empty-output-directory.patch
    * Fix-buffer-underflow-for-null-dir1.patch


