# changelog

author: sflees@suse.de
changelog:
  - Fix CVE-2019-12749 Authentication bypass (CVE-2019-12749 bsc#1137832)
    * added fix-CVE-2019-12749.patch


author: sflees@suse.de
changelog:
  - Fix CVE-2020-35512 - shared UID's caused issues (CVE-2020-35512 bsc#1187105)
    * fix-upstream-userdb-constpointer.patch
    * fix-upstream-CVE-2020-35512.patch


author: sflees@suse.de
changelog:
  - Fix CVE-2020-12049 truncated messages lead to resource exhaustion
    (CVE-2020-12049, bsc#1172505)
    * fix-upstream-CVE-2020-12049.patch
  - Rebased fix-CVE-2019-12749.patch


author: dcermak@suse.com
changelog:
  - Remove pointless %%post scriptlet leveraging non-existent systemd env
    variables
    FIRST_ARG has been used in our systemd macros, but this has now been gone for
    years. Thus the true branch of the if has never been executed for years and is
    only causing warnings when installing dbus.


author: sflees@suse.de
changelog:
  - Fix a potential crash that could be triggered by an invalid signature.
    (CVE-2022-42010, bsc#1204111)
    * fix-upstream-CVE-2022-42010.patch
  - Fix an out of bounds read caused by a fixed length array (CVE-2022-42011,
    bsc#1204112)
    * fix-upstream-CVE-2022-42011.patch
  - A message in non-native endianness with out-of-band Unix file descriptors
    would cause a use-after-free and possible memory corruption CVE-2022-42012,
    bsc#1204113)
    * fix-upstream-CVE-2022-42012.patch
  - Disable asserts (bsc#1087072)
  - Refreshed patches
    * fix-upstream-CVE-2020-35512.patch


author: sflees@suse.de
changelog:
  - Sometimes unprivileged users were able to crash dbus-daemon
    (CVE-2023-34969, bsc#1212126)
    * fix-upstream-CVE-2023-34969.patch


author: antonio.feijoo@suse.com
changelog:
  - Update to version 055+suse.279.g3b3c36b2:
    * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236)
    * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360)
    * fix(convertfs): ignore commented lines in fstab (bsc#1200251)
    * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654)


author: antonio.feijoo@suse.com
changelog:
  - Update to version 055+suse.283.ge98ece25:
    * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975)
    * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709)


author: antonio.feijoo@suse.com
changelog:
  - Update to version 055+suse.294.gc5bc4bb5:
    Missing network-manager module fixes (bsc#1201975):
    * fix(network-manager): avoid calling unavailable dracut-logger functions
    * fix(network-manager): skip non-directories in /sys/class/net
    * fix(network-manager): disable tty output if the console is not usable
    * fix(network-manager): show output on console only with rd.debug enabled
    * fix(network-manager): write DHCP filename option to dhcpopts file
    * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts
    * fix(network-manager): include nm-daemon-helper binary
    * fix(network-manager): don't pull in systemd-udev-settle
    * fix(network-manager): support teaming under NM+systemd
    * fix(network-manager): pull in network.target in nm-initrd.service


author: antonio.feijoo@suse.com
changelog:
  - Update to version 055+suse.302.gc7aee2dc:
    * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)
    * fix(systemd): add missing modprobe@.service (bsc#1203749)
    * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)


author: antonio.feijoo@suse.com
changelog:
  - Update to version 055+suse.323.gca0e74f0:
    * fix(network-manager): always install the library plugins directory (bsc#1202014)
    * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
    A series of fixes for NVMeoF boot (bsc#1203368):
    * fix(network-legacy): misleading duplicate address detection using wicked
    * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
    * fix(network): avoid double brackets around IPv6 address
    * feat(nvmf): set rd.neednet=1 if tcp records encountered
    * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
    * fix(network): don't use same ifname multiple times
    * fix(nvmf): run cmdline hook before parse-ip-opts.sh
    * fix(nvmf): avoid calling "exit" in a cmdline hook
    * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
    * fix(nvmf): don't use "finished" queue for autoconnect
    * fix(nvmf): don't create did-setup file
    * fix(nvmf): no need to load the nvme module
    * fix(nvmf): don't try to validate network connections in cmdline hook
    * fix(nvmf): nvme list-subsys prints the address using commas as separator
    * fix(nvmf): deprecate old nvmf cmdline options
    * fix(nvmf): set executable bit on nvmf-autoconnect.sh


author: antonio.feijoo@suse.com
changelog:
  - Update to version 055+suse.331.g05b9ccb7:
    * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
    * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
    * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
    * fix(nfs): chown using rpc default group (bsc#1204929)


author: antonio.feijoo@suse.com
changelog:
  - Update to version 055+suse.335.gccf7fbc6:
    * feat(lvm): always include all drivers that LVM can use (bsc#1206195)
    * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)


author: antonio.feijoo@suse.com
changelog:
  - Update to version 055+suse.342.g2e6dce8e:
    fips=1 and separate /boot break s390x (bsc#1204478):
    * fix(fips): move fips-boot script to pre-pivot
    * fix(fips): only unmount /boot if it was mounted by the fips module
    * feat(fips): add progress messages
    * fix(fips): do not blindly remove /boot
    * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)


author: antonio.feijoo@suse.com
changelog:
  - Update to version 055+suse.344.g3d5cd8fb:
    * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)


author: antonio.feijoo@suse.com
changelog:
  - Update to version 055+suse.347.gdcb9bdbf:
    * fix(dracut-install): protect against broken links pointing to themselves
    * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)


author: jengelh@inai.de
changelog:
  - Update to release 1.21
    * Handle DWARF5 DW_OP_addrx and
      subprogram ret type with abstract_origin properly.


author: msuchanek@suse.com
changelog:
  - Handle zero sized per-cpu veriables in Linux BTF.
    + btf_encoder-fix-and-complete-filtering-out-zero-sized-per-CPU-variables.patch


author: msuchanek@suse.com
changelog:
  - Update to version 1.21+git175.1ef87b2 (jsc#SLE-17288):
    * libbpf: bump dependency to >= 0.4.0
    * CMakeLists.txt: Enable SHARED and STATIC lib creation
    * libbpf: Allow to use packaged version
    * btfdiff: Support diffing DWARF vs detached BTF
    * pahole: Allow encoding BTF into a detached file
    * pahole: Add --kabi_prefix flag
    * btf_encoder: fix and complete filtering out zero-sized per-CPU variables
    * btf: Remove ftrace filter
    * pahole: Introduce --with_flexible_array option to show just types ending in a flexible array
    * Many updates to btf_encoder and bug fixes
  - Remove upstreamed patches
    - btf_encoder-fix-and-complete-filtering-out-zero-sized-per-CPU-variables.patch
    - remove-ftrace-filter.patch
  - Pretend version 1.22 to make kernel happy
    + dwarves-Prep-1.22.patch


author: msuchanek@suse.com
changelog:
  - 15.4 has new elfutils, drop libebl-plugins dependency.
  - Update to version 1.21+git177.1ef87b2:
    * Fix crash with split BTF debuginfo
    * CMakeList.txt: Bump version to the upcoming 1.22 release, not out of the door yet
    - Remove upstreamed patch dwarves-Prep-1.22.patch


author: jengelh@inai.de
changelog:
  - Update to release 1.22 (bsc#1190340).
    * Ability to encode BTF to a separate file
    * Multithreaded DWARF loading
    * Details at https://marc.info/?l=dwarves&m=162975403628056&w=2


author: mliska@suse.cz
changelog:
  - Update to version 0.183:
    debuginfod: New thread-busy metric and more detailed error metrics.
      New --fdcache-mintmp and tracking of filesystem freespace.
      New increased webapi concurrency while grooming.
    debuginfod-client: DEBUGINFOD_SONAME macro added to debuginfod.h which
      can be used to dlopen the libdebuginfod.so library.
      New function debuginfod_set_verbose_fd and
      DEBUGINFOD_VERBOSE environment variable.
    config: profile.sh and profile.csh won't export DEBUGINFOD_URLS unless
      configured --enable-debuginfod-urls[=URLS]
    elflint, readelf: Recognize SHF_GNU_RETAIN.
      Handle SHT_X86_64_UNWIND as valid relocation target.
  - Remove config-do-not-define-DEBUGINFOD_URLS-environment-var.patch patch.


author: mliska@suse.cz
changelog:
  - Add disable-run-readelf-self-test.patch in order to disable
    a failing test-case with GCC 11 (PR27367).


author: mliska@suse.cz
changelog:
  - Update to version 0.184:
    debuginfod: Use libarchive's bsdtar as the .deb-family file unpacker.
    debuginfod-client: Client caches negative results. If a query for a
      file failed with 404, an empty 000 permission
      file is created in the cache. This will prevent
      requesting the same file for the next 10 minutes.
      Client objects now carry long-lived curl handles
      for outgoing connections.  This makes it more
      efficient for multiple sequential queries, because
      the TCP connections and/or TLS state info are kept
      around awhile, avoiding O(100ms) setup latencies.
    libdw: handle DW_FORM_indirect when reading attributes
    translations: Update Polish translation.


author: mliska@suse.cz
changelog:
  - Update to version 0.185:
    debuginfod-client: Simplify curl handle reuse so downloads which
      return an error are retried.
    elfcompress: Always exit with code 0 when the operation succeeds (even
      when nothing was done). On error the exit code is now always 1.


author: jcheung@suse.com
changelog:
  - For version 0.185, the below patches are no longer needed
    (jsc#SLE-17288, jsc#SLE-17951)
    libdw-check-end-of-attributes-list-consistently.patch
    elflint-dont-check-section-group-without-flags-word.patch
    libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
    libdw-readelf-make-sure-there-is-enough-data-to-read.patch
    elfutils-dont-trust-sh_entsize.patch
    elflint-check-symbol-table-data-is-big-enough-before-check.patch
    size-handle-recursive-elf-ar-files.patch
    elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
    use-the-empty-string-for-note-names-with-zero-size.patch
    readelf-fix-off-by-one-sanity-check.patch
    libebl-check-NT_PLATFORM-core-notes.patch
    libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
    libelf-check-compression-before-allocate-output-buffer.patch
    libdwfl-sanity-check-partial-core-file-data-reads.patch
    arlib-check-that-sh_entsize-isnt-zero.patch


author: martin.liska@suse.com
changelog:
  - Enhance license fields: all the libraries actually have a different
    license to the tools. While the tools are GPL-3.0-or-later, the
    libraries are (LGPL-3.0-or-later OR GPL-2.0-or-later)
    SLE bug (for tracking the above) bsc#1191310


author: jengelh@inai.de
changelog:
  - Update package summaries. Replace old RPM constructs.
  - Remove --with-pic which is useless with --disable-static.
  - Edit pre_checkin.sh to remove dead python3 file.


author: werner@suse.de
changelog:
  - Add patch file-a642587a9c.patch for bsc#1096974, bsc#1096984, and
    CVE-2018-10360 -- Avoid reading past the end of buffer


author: werner@suse.de
changelog:
  - Add patch 0002-PR-62-spinpx-limit-size-of-file_printable.patch to
    fix bsc#1126117, bsc#1126118, and bsc#1126119 for CVE-2019-8905,
    CVE-2019-8906, and CVE-2019-8907


author: werner@suse.de
changelog:
  - Add temporary patch CVE-2019-18218-46a8443f.patch from upstream
    to fix bsc#1154661 -- heap-based buffer overflow in cdf_read_property_info in cdf.c


author: werner@suse.de
changelog:
  - Add patchfix_of_backport_PR-62.patch as previous backport caused
    a shorten output of the elf interprter (bsc#1176123)


author: astieger@suse.com
changelog:
  - GNU awk 4.1.3:
    * Regexp parsing with extra brackets should now be working again.
    * Updated to latest config.guess and config.sub.
    * bug fixes


author: astieger@suse.com
changelog:
  * GNU awk 4.1.4:
    * z/OS support updated
    * debugger improvements
    * return value of system() enhanced to convey more information
    * two-way pipe handling improved
    * The -d option now allows -d- to print to standard output.
    * The DJGPP port is now officially deprecated.


author: josef.moellers@suse.com
changelog:
  - Added an explicit rpmlint rule to keep one file (gawkapi.h)
    from requiring a separate package.
    [+gawk.rpmlintrc]


author: schwab@linux-m68k.org
changelog:
  - Update to gawk 4.2.0
    * If not in POSIX mode, changes to ENVIRON are reflected into
      gawk's environment
    * The series of numbers returned by rand() should now be "more
      random" than previously
    * Multiple changes related to the pretty printer
    * The igawk script and igawk.1 man page are no longer installed
    * Gawk now processes a maximum of two hexadecimal digits in \x
      escape sequences inside strings
    * Setting PROCINFO["redirection", "NONFATAL"] to true makes I/O
      errors for "redirection" not fatal
    * Gawk now supports retryable I/O via PROCINFO[input-file, "RETRY"]
    * Revisions in the POSIX standard remove the special case for POSIX
      mode when FS = " " where newline was not a field separator
    * Gawk now supports strongly typed regexp constants
    * The new typeof() function can be used to indicate if a variable or
      array element is an array, regexp, string or number
    * Optimizations are now enabled by default
    * Passing negative operands to any of the bitwise functions now
      produces a fatal error
    * The mktime function now accepts an optional second argument
    * The FIELDWIDTHS parsing syntax has been enhanced to allow specifying
      how many characters to skip before a field starts
    * The PROCINFO["argv"] array records all of gawk's command line arguments
      as gawk received them
  - gawk_ppc64le_ignore_transient_test_time_failure.patch: removed


author: astieger@suse.com
changelog:
  - GNU awk 4.2.1:
    * documentation updates
    * In MPFR mode, When ROUNDMODE changes, string values for
      numerically type values will be redone
    * various bug fixes
    * drop fold-string.patch, upstream
  - Use %license (boo#1082318)


author: schwab@suse.de
changelog:
  - format-tree-positional-arg.patch: Validate index into argument list
    (CVE-2023-4156, bsc#1214025)


author: schwab@suse.de
changelog:
  - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow
    (CVE-2023-0687, bsc#1207975, BZ #29444)


author: schwab@suse.de
changelog:
  - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid
    is unset (bsc#1209229, BZ #30235)


author: giuliano.belinassi@suse.com
changelog:
  - ulp-prologue-into-asm-functions.patch: Add support for livepatches
    in ASM written functions (bsc#1211726)


author: schwab@suse.de
changelog:
  - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure
    (bsc#1211828, BZ #30527)


author: schwab@suse.de
changelog:
  - remove-excessive-p-align-check.patch: elf: Remove excessive p_align
    check on PT_LOAD segments (bsc#1211829, BZ #28688)
  - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829,
    BZ #28676)
  - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the
    first segment (BZ #30452)


author: schwab@suse.de
changelog:
  - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses
    in files database (bsc#1212819, BZ #25457)


author: schwab@suse.de
changelog:
  - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache
    invalidation if epoll is used (bsc#1212910, BZ #29415)


author: astieger@suse.com
changelog:
  - gzip 1.10:
    * Compressed gzip output no longer contains the current time as
      a timestamp when the input is not a regular file.  Instead, the
      output contains a null (zero) timestamp.  This makes gzip's
      behavior more reproducible when used as part of a pipeline.
    * A use of uninitialized memory on some malformed inputs has been
      fixed.
    * A few theoretical race conditions in signal handers have been
      fixed.
  - drop upstreamed patches:
    * gnulib-libio.patch
    * gzip-1.8-deprecate_netstat.patch


author: kstreitova@suse.com
changelog:
  - add gzip-1.10-ibm_dfltcc_support.patch [jsc#SLE-5818] [jsc#SLE-8914]
    * it adds support for DFLTCC (hardware-accelerated deflation)
      for s390x arch
    * enable it via "--enable-dfltcc" option


author: kstreitova@suse.com
changelog:
  - refresh gzip-1.10-ibm_dfltcc_support.patch to fix three data
    corruption issues [bsc#1145276] [jsc#SLE-5818] [jsc#SLE-8914]


author: kstreitova@suse.com
changelog:
  - Enable DFLTCC compression for s390x for levels 1-6 (i. e. to make
    it used by default) by adding -DDFLTCC_LEVEL_MASK=0x7e to CLFAGS.
    [jsc#SLE-13775]


author: pgajdos@suse.com
changelog:
  - fix DFLTCC segfault [bsc#1177047]
  - added patches
    fix https://git.savannah.gnu.org/cgit/gzip.git/commit/?id=be0a534ba2b6e77da289de8da79e70843b1028cc
    + gzip-1.10-fix-DFLTCC-segfault.patch


author: danilo.spinella@suse.com
changelog:
  - Fix escaping of malicious filenames (CVE-2022-1271 bsc#1198062)
    * bsc1198062.patch
    * bsc1198062-2.patch


author: guillaume.gardet@opensuse.org
changelog:
  - Refresh patch to fix build on non-x86 architecture broken
    by previous commit:
    * kbdsettings-nox86.patch


author: sbrabec@suse.com
changelog:
  - Update to version 2.3.0:
    * Added libkfont library (internal yet).
    * Added Canadian Multilingual Standard keyboard map.
    * Added us1 that maps Right Alt to AltGr and Shift+Tab to
      Alt+Tab.
    * The dead_macron is used instead of macron in fi.map.
    * Added retries when switching to the console (chvt, openvt).
    * Added option -d to double size of font (setfont).
    * Added long options, help messages.
    * Added solar24x32 font.
    * Updated eurlatgr font.
    * Fixed problems with formatting man pages.
    * Fixed search path error (boo#1176854).
  - Refresh partially upstreamed kbd-1.15.2-dumpkeys-C-opt.patch
  - Drop upstreamed libkeymap-Fix-mk_mapname-for-the-plain-map.patch
  - Refresh kbd-1.15.2-setfont-no-cruft.patch and
    kbd-1.15.5-loadkeys-search-path.patch


author: jslaby@suse.cz
changelog:
  - Update to version 2.4.0:
    * po: Update cs and sr translations (from translationproject.org)
    * libkfont: Use only KDFONTOP
    * Added support for a few derivatives of neo
    * Fix use-after-free of pipe_cmd
    * Update solar24x32 font
    * vlock's pam config added to destination directory
    * Update sun12x22.psfu
    * libkeymap: unify non/unicode accent_table generation
    * libkeymap: note about --unicode use
    * libkeymap: remove last ushort
    * fi.map: use newly added deadkeys
    * Do not install internal library
    * Additional deadkeys
  - Remove kbd-1.15.2-setfont-no-cruft.patch
    The old ioctls were finally dropped.


author: christophe@krop.fr
changelog:
  - Update the installed license file.
    COPYING is a symlink to LICENSE. Let's use this file directly.


author: kukuk@suse.com
changelog:
  - Only run kbdsettings.service if /etc/sysconfig/keyboard exists.
    Necessary for image based installations without admin made changes.


author: fvogt@suse.com
changelog:
  - Add patch to fix random doubling of font sizes (bsc#1194698):
    * 0001-libkfont-Initialize-kfont_context-options.patch


author: fbui@suse.com
changelog:
  - Add 'ara' vc keymap (bsc#1210702)
    'ara' is slightly better than 'arabic' as it matches the name of its x11
    layout counterpart. Keep 'arabic' for backward compatibility sake.


author: petr.pavlu@suse.com
changelog:
  - ring-buffer: Fix race while reader and writer are on the same
    page (git-fixes).
  - commit c740036


author: petr.pavlu@suse.com
changelog:
  - tracing: Have tracing_snapshot_instance_cond() write errors
    to the appropriate instance (git-fixes).
  - commit b3421ec


author: petr.pavlu@suse.com
changelog:
  - ftrace: Fix issue that 'direct->addr' not restored in
    modify_ftrace_direct() (git-fixes).
  - commit 03fd814


author: tiwai@suse.de
changelog:
  - mtd: rawnand: meson: fix bitmask for length in command word
    (git-fixes).
  - mtdblock: tolerate corrected bit-flips (git-fixes).
  - mtd: rawnand: stm32_fmc2: use timings.mode instead of checking
    tRC_min (git-fixes).
  - mtd: rawnand: stm32_fmc2: remove unsupported EDO mode
    (git-fixes).
  - commit 6504d96


author: mfranc@suse.cz
changelog:
  - KVM: s390/diag: fix racy access of physical cpu number in diag
    9c handler (git-fixes bsc#1215911).
  - commit 6454286


author: mfranc@suse.cz
changelog:
  - KVM: s390: fix KVM_S390_GET_CMMA_BITS for GFNs in memslot holes
    (git-fixes bsc#1215915).
  - commit fe7fbfc


author: jdelvare@suse.de
changelog:
  - btrfs: fix root ref counts in error handling in
    btrfs_get_root_ref (bsc#1214351 CVE-2023-4389).
  - commit 3731029


author: mfranc@suse.cz
changelog:
  - KVM: s390: pv: fix external interruption loop not always
    detected (git-fixes bsc#1215916).
  - commit f1893aa


author: jslaby@suse.cz
changelog:
  - Fix grub's requoted kernel parameters (bsc#1181111)
    * 0001-libkmod-config-revamp-kcmdline-parsing-into-a-state-.patch
    * 0002-libkmod-config-re-quote-option-from-kernel-cmdline.patch


author: jengelh@inai.de
changelog:
  - Update to release 29
    * Fix `modinfo -F` not working for built-in modules and
      certain fields.
    * Fix a memory leak, overflow and double free on error path.
  - Drop 0001-Fix-modinfo-F-always-shows-name-for-built-ins.patch,
    0001-libkmod-config-revamp-kcmdline-parsing-into-a-state-.patch,
    0002-libkmod-config-re-quote-option-from-kernel-cmdline.patch
    (all merged)


author: msuchanek@suse.de
changelog:
  - /usr/lib should override /lib where both are available. Support /usr/lib for
    depmod.d as well.
    * Refresh usr-lib-modprobe.patch
  - Remove test patches included in release 29
    - kmod-populate-modules-Use-more-bash-more-quotes.patch
    - kmod-testsuite-compress-modules-if-feature-is-enabled.patch
    - kmod-also-test-xz-compression.patch


author: msuchanek@suse.de
changelog:
  - Display module information even for modules built into the running kernel
    (bsc#1189537).
    + libkmod-Provide-info-even-for-modules-built-into-the.patch


author: msuchanek@suse.com
changelog:
  - Use docbook 4 rather than docbook 5 for building man pages (bsc#1190190).
    * Refres no-stylesheet-download.patch


author: msuchanek@suse.com
changelog:
  - Enable ZSTD on 15.3 as well (boo#1192104).
  - Only test ZSTD in testsuite on releases where it is available.


author: suse-beta@cboltz.de
changelog:
  - ensure precompiled cache files are newer than (text) profiles
  - reload profiles in %posttrans instead of %post to ensure both
    - profiles and -abstractons package are updated before the cache
    in /var/cache/apparmor/ gets built (boo#1195463 #c20)


author: nopower@suse.com
changelog:
  - Add samba_deny_net_admin.patch to add new rule to deny
    noisy setsockopt calls from systemd; (bnc#1196850).


author: nopower@suse.com
changelog:
  - Add samba-new-dcerpcd.patch, samba-4.16 has a new dcerpcd daemon
    which now will spawn new additional services on demand. We need to
    modify the existing smbd/winbind profiles and additionally add a
    new set of profiles to cater for the new functionality;
    (bnc#1198309);


author: suse-beta@cboltz.de
changelog:
  - add php8-fpm-mr876.patch so that php8 php-fpm can read its config
    (boo#1186267#c11)
  - parser: add conflict with apparmor-utils < 3.0 to avoid aa-status
    file conflict on upgrade (boo#1198958)
  - utils: add missing dependency on apparmor-parser (boo#1198958#c4)


author: ddiss@suse.com
changelog:
  - add profiles-permit-php-fpm-pid-files-directly-under-run.patch
    https://gitlab.com/apparmor/apparmor/-/merge_requests/914 (bsc#1202344)


author: ddiss@suse.com
changelog:
  - Add pam_apparmor README, referenced from online cha-apparmor-pam.html
    documentation (bsc#1213472)


author: ddiss@suse.com
changelog:
  - update zgrep profile to allow egrep helper use (bsc#1214458)
    - zgrep-profile-sync-with-master.diff


author: lnussel@suse.de
changelog:
  - Update to version 0.0+git20171227.670229c:
    * Added ABI version number
    * AVX2/AVX-512F optimizations of BLAMKA
    * Set Argon2 version number from the command line
    * New bindings
    * Minor bug and warning fixes (no security issue)
  - use _service file


author: sbrabec@suse.com
changelog:
  - Make uuidd lock state file usable and time based UUIDs safe again
    (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).


author: sbrabec@suse.com
changelog:
  - Prevent root owning of /var/lib/libuuid/clock.txt
    (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).


author: sbrabec@suse.com
changelog:
  - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
    util-linux-libuuid-extend-cache.patch).


author: sbrabec@suse.com
changelog:
  - agetty: Resolve tty name even if stdin is specified (bsc#1197178,
    util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
  - libmount: When moving a mount point, update all sub mount entries
    in utab (bsc#1198731,
    util-linux-libmount-moving-mount-point-sub-mounts.patch,
    util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).


author: sbrabec@suse.com
changelog:
  - libuuid improvements (bsc#1201959, PED-1150):
    * libuuid: Fix range when parsing UUIDs
      (util-linux-libuuid-uuid_parse-overrun.patch).
    * Improve cache handling for short running applications-increment
      the cache size over runtime
      (util-linux-libuuid-improve-cache-handling.patch).
    * Implement continuous clock handling for time based UUIDs
      (util-linux-libuuid-continuous-clock-handling.patch).
    * Check clock value from clock file to provide seamless libuuid
      update (util-linux-libuuid-check-clock-value.patch).


author: sbrabec@suse.com
changelog:
  - libuuid continuous clock handling for time based UUIDs:
    Prevent use of the new libuuid ABI by uuidd %post before update
    of libuuid1 (bsc#1205646).
  - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet
    to prevent error message if /var/lib/libuuid/clock.txt does not
    exist.


author: david.anes@suse.com
changelog:
  - Fix tests not passing when '@' character is in build path:
    Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038).
  - Add util-linux-fix-tests-when-at-symbol-in-path.patch


author: daniel.garcia@suse.com
changelog:
  - Add upstream patch fix-lib-internal-cache-size.patch
    bsc#1210164, gh#util-linux/util-linux@2fa4168c8bc9


author: antonio.teixeira@suse.com
changelog:
  - Add util-linux-libblkid-reopen-floppy-without-O_NONBLOCK.patch
    Fixes blkid for floppy drives (bsc#1194900).
  - util-linux-fix-tests-when-at-symbol-in-path.patch:
    Add patch to util-linux-systemd and python3-libmount, as it was
    previously only included in util-linux.


author: tchvatal@suse.com
changelog:
  - Reflect SUSE CFLAGS
  - Do not bother with obscpio if we are fetching direct releases
  - Remove patch 0001-makefile-Fix-install-target.patch seems
    to build/install without it just fine
  - Update to 0.0.6:
    + New features
    - new extensible bpf_object__open_{file,mem} APIs and
      DECLARE_LIBBPF_OPTS() macro to go with them
    - bpf_helpers.h, bpf_endian.h, and bpf_tracing.h are now
      distributed with libbpf
    - BPF CO-RE: added field size, field existence, and bitfield
      relocation support
    - BPF CO-RE: BPF_CORE_READ(), bpf_core_field_exists(),
      bpf_core_field_size() and other BPF CO-RE related helpers
      available through bpf_core_read.h header
    - bpf_object__open() API now auto-detects program type from
      its section name
    - BPF_PROG_TRACING programs support (incuding BTF-typed raw
      tracepoints, fentry/fexit programs)
    - mmap() support for BPF global variables
    - declarative map pinning support added
    - probe_read_{user,kernel}[_str]() BPF helpers added
    - bpf_get_link_xdp_info() function to get more XDP information
      added
    - a bunch of other AF_XDP changes
    + Usability improvements
    - no need for int version SEC('version') = 1; anymore
    - raw_tp/tp and uprobe/uretprobe section prefixes added
    - new bpf_program__get_{type,expected_attach_type} getters
    - preserve error code on program load failure
    + Fixes
    - btf_dump padding handling
    - bpf_object__name() returning name, not path
    - ELF section handling off-by-one bug fix
    - mem leak/double free fix in BPF program relocation code


author: mrostecki@opensuse.org
changelog:
  - Build libbpf from kernel sources, not from github sources, for
    consistency with bpftool package.


author: msuchanek@suse.com
changelog:
  - libbpf is now a separate project, stop building from the kernel
    (bsc#1188419 jsc#SLE-17288 jsc#SLE-18805).
  - Fix LIBSUBDIR
    + libdir.patch


author: shung-hsi.yu@suse.com
changelog:
  - Update to 0.5.0:
    + New features and user-space APIs:
    - libbpf_set_strict_mode() allowing to opt-in into backwards incompatible libbpf-1.0 changes. See "Libbpf: the road to 1.0" and "Libbpf 1.0 migration guide" for more details.
    - streamlined error reporting for low-level APIs, high-level error-returning APIs, and pointer-returning APIs (as a libbpf-1.0 opt-in);
    - "Light" BPF skeleton support;
    - BPF_PROG_TYPE_SYSCALL support;
    - BPF perf link support for kprobe, uprobe, tracepoint, and perf_event BPF programs;
    - BPF cookie support for kprobe, uprobe, tracepoint, and perf_event BPF programs through bpf_program__attach_[ku]probe_opts() APIs;
    - allow to specify ref_ctr_off for USDT semaphores through bpf_program__attach_uprobe_opts() API;
    - btf_custom_path support in bpf_object_open_opts, allowing to specify custom BTF for CO-RE relocations;
    - sk_reuseport/migrate program type support;
    - btf_dump__dump_type_data() API, allowing to dump binary data according to BTF type description;
    - btf__load_into_kernel() and btf__load_from_kernel_by_id(), and split BTF variants of them;
    - btf__load_vmlinux_btf() and btf__load_module_btf() APIs;
    - bpf_map__initial_value() API to get initial value of mmap-ed BPF maps;
    - bpf_map_lookup_and_delete_elem_flags() API.
    + BPF-side APIs and features:
    - support for weak typed __ksym externs;
    - BPF timer helpers: bpf_timer_init(), bpf_timer_set_callback(), bpf_timer_start(), bpf_timer_cancel();
    - bpf_get_attach_cookie() helper to get BPF cookie from BPF program side;
    - bpf_get_func_ip() helper;
    - bpf_sys_bpf() helper;
    - bpf_task_pt_regs() helper;
    - bpf_btf_find_by_name_kind() helper;
    - usability improvements for bpf_tracing.h when target architecture is missing.
    + Bug fixes and compatibility improvements:
    - improve BPF support detection on old Red Hat kernels with backported BPF patches;
    - improvements for LTO builds with GCC 10+;
    - pass NLM_F_EXCL when creating TC qdisc;
    - better support of BPF map reuse on old kernels;
    - fix the bug resulting in sometimes closing FD 0, which wasn't created and owned by libbpf itself.
  - Remove patches merged upstream
    + libdir.patch
    + libbpf-Fix-build-with-latest-gcc-binutils-with-LTO.patch


author: shung-hsi.yu@suse.com
changelog:
  - Fix use-after-free in btf_dump_name_dups (boo#1204391 CVE-2022-3534)
    + libbpf-Fix-use-after-free-in-btf_dump_name_dups.patch
  - Fix null pointer dereference in find_prog_by_sec_insn() (boo#1204502 CVE-2022-3606)
    + libbpf-Fix-null-pointer-dereference-in-find_prog_by_.patch


author: andreas.stieger@gmx.de
changelog:
  - cryptsetup 2.3.5:
    * Fix partial reads of passphrase from an interactive terminal
    * Fix maximum length of password entered through a terminal
    * integritysetup: support new dm-integrity HMAC recalculation
      options
    * integritysetup: display of recalculating sector in dump command
    * veritysetup: fix verity FEC if stored in the same image with
      hashes
    * veritysetup: run FEC repair check even if root hash fails
    * veritysetup: do not process hash image if hash area is empty
    * veritysetup: store verity hash algorithm in superblock in
      lowercase
    * bitlk: fix a crash if the device disappears during BitLocker
      scan
    * bitlk: show a better error when trying to open an NTFS device
    * bitlk: add support for startup key protected VMKs
    * Fix LUKS1 repair code (regression since version 1.7.x)
    * Fix luksKeyChange for LUKS2 with assigned tokens
    * Fix cryptsetup resize using LUKS2 tokens
    * Print a visible error if device resize is not supported
    * Add error message when suspending wrong non-LUKS device
    * Fix default XTS mode key size in reencryption
    * Rephrase missing locking directory warning and move it to
      debug level
    * Many fixes for the use of cipher_null (empty debug cipher)
    * Fixes for libpasswdqc 2.0.x (optional passphrase quality check)
    * Fixes for problems discovered by various tools for code
      analysis
    * Various fixes to man pages
  - silence hmac packaging warnings


author: lnussel@suse.de
changelog:
  - cryptsetup 2.3.6:
    * integritysetup: Fix possible dm-integrity mapping table truncation.
    * cryptsetup: Backup header can be used to activate TCRYPT device.
      Use --header option to specify the header.
    * cryptsetup: Avoid LUKS2 decryption without detached header.
      This feature will be added later and is currently not supported.
    * Additional fixes and workarounds for common warnings produced
      by some static analysis tools (like gcc-11 analyzer) and additional
      code hardening.
    * Fix standalone libintl detection for compiled tests.
    * Add Blake2b and Blake2s hash support for crypto backends.
      Kernel and gcrypt crypto backend support all variants.
      OpenSSL supports only Blake2b-512 and Blake2s-256.
      Crypto backend supports kernel notation e.g. "blake2b-512".


author: fvogt@suse.com
changelog:
  - Use LUKS2 as default format on Tumbleweed.
    It provides some additional features which other tools
    (e.g. systemd-cryptenroll) rely on. GRUB 2.06 supports unlocking
    LUKS2 volumes meanwhile.


author: lnussel@suse.de
changelog:
  - cryptsetup 2.4.0 (jsc#SLE-20275)
    * External LUKS token plugins
    * Experimental SSH token
    * Default LUKS2 PBKDF is now Argon2id
    * Increase minimal memory cost for Argon2 benchmark to 64MiB.
    * Autodetect optimal encryption sector size on LUKS2 format.
    * Use VeraCrypt option by default and add --disable-veracrypt option.
    * Support --hash and --cipher to limit opening time for TCRYPT type
    * Fixed default OpenSSL crypt backend support for OpenSSL3.
    * integritysetup: add integrity-recalculate-reset flag.
    * cryptsetup: retains keyslot number in luksChangeKey for LUKS2.
    * Fix cryptsetup resize using LUKS2 tokens.
    * Add close --deferred and --cancel-deferred options.
    * Rewritten command-line option parsing to avoid libpopt arguments
      memory leaks.
    * Add --test-args option.


author: lnussel@suse.de
changelog:
  - As YaST passes necessary parameters to cryptsetup anyway, we do
    not necessarily need to take grub into consideration. So back to
    Argon2 to see how it goes.


author: lnussel@suse.de
changelog:
  - cryptsetup 2.4.1
    * Fix compilation for libc implementations without dlvsym().
    * Fix compilation and tests on systems with non-standard libraries
    * Try to workaround some issues on systems without udev support.
    * Fixes for OpenSSL3 crypto backend (including FIPS mode).
    * Print error message when assigning a token to an inactive keyslot.
    * Fix offset bug in LUKS2 encryption code if --offset option was used.
    * Do not allow LUKS2 decryption for devices with data offset.
    * Fix LUKS1 cryptsetup repair command for some specific problems.


author: andreas.stieger@gmx.de
changelog:
  - cryptsetup 2.4.2:
    * Fix possible large memory allocation if LUKS2 header size is
      invalid.
    * Fix memory corruption in debug message printing LUKS2
      checksum.
    * veritysetup: remove link to the UUID library for the static
      build.
    * Remove link to pwquality library for integritysetup and
      veritysetup. These tools do not read passphrases.
    * OpenSSL3 backend: avoid remaining deprecated calls in API.
      Crypto backend no longer use API deprecated in OpenSSL 3.0
    * Check if kernel device-mapper create device failed in an early
      phase. This happens when a concurrent creation of device-mapper
      devices meets in the very early state.
    * Do not set compiler optimization flag for Argon2 KDF if the
      memory wipe is implemented in libc.
    * Do not attempt to unload LUKS2 tokens if external tokens are
      disabled. This allows building a static binary with
    - -disable-external-tokens.
    * LUKS convert: also check sysfs for device activity.
      If udev symlink is missing, code fallbacks to sysfs scan to
      prevent data corruption for the active device.


author: andreas.stieger@gmx.de
changelog:
  - cryptsetup 2.4.3:
    * Fix possible attacks against data confidentiality through
      LUKS2 online reencryption extension crash recovery
      CVE-2021-4122, boo#1194469
    * Add configure option --disable-luks2-reencryption to completely
      disable LUKS2 reencryption code.
    * Improve internal metadata validation code for reencryption
      metadata
    * Add updated documentation for LUKS2 On-Disk Format
      Specification version 1.1.0
    * Fix support for bitlk (BitLocker compatible) startup key with
      new  metadata entry introduced in Windows 11
    * Fix space restriction for LUKS2 reencryption with data shift


author: pmonreal@suse.com
changelog:
  - luksFormat: Handle system with low memory and no swap space [bsc#1211079]
    * Check for physical memory available also in PBKDF benchmark.
    * Try to avoid OOM killer on low-memory systems without swap.
    * Use only half of detected free memory on systems without swap.
    * Add patches:
    - cryptsetup-Check-for-physical-memory-available-also-in-PBKDF-be.patch
    - cryptsetup-Try-to-avoid-OOM-killer-on-low-memory-systems-withou.patch
    - cryptsetup-Use-only-half-of-detected-free-memory-on-systems-wit.patch


author: heming.zhao@suse.com
changelog:
  - vgextend crash when extending VG with missing PV (bsc#1191019)
    + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch


author: heming.zhao@suse.com
changelog:
  - starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905)
    + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch
  - LVM vgimportclone on hardware snapshot does not work (bsc#1193181)
    + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch


author: mwilck@suse.com
changelog:
  - udev: create symlinks and watch even in suspended state (bsc#1195231)
    + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch


author: heming.zhao@suse.com
changelog:
  - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
    + change lvm.conf item external_device_info_source from none to udev
    + bug-1179691_config-set-external_device_info_source-none.patch


author: heming.zhao@suse.com
changelog:
  - lvm reports udev database has incomplete information on devices (bsc#1202011)
    + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch


author: heming.zhao@suse.com
changelog:
  - lvm2.spec %post deletes libdevmapper and triggers kernel panic (bsc#1198523)
    - change %post behaviour, only do deleting job for non-link folder


author: heming.zhao@suse.com
changelog:
  - lvmlockd is not supporting sanlock (bsc#1203482)
    - set 1 for _supportsanlock in lvm2.spec for enabling sanlock.


author: heming.zhao@suse.com
changelog:
  - dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074)
    - in lvm2.spec, change device_mapper_version from 1.02.163 to %{lvm2_version}_1.02.163


author: amit.chaudhary@suse.com
changelog:
  - killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216)
    - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch


author: heming.zhao@suse.com
changelog:
  - blkdeactivate calls wrong mountpoint cmd (bsc#1214071)
    + bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch


author: pmonreal@suse.com
changelog:
  - Update to 2.4.1:
    * Bug fixes:
    - Autotools: Fix installed header expat_config.h for multilib
      systems; regression introduced in 2.4.0 by pull request #486
    * Other changes:
    - Version info bumped from 9:0:8 to 9:1:8; see
      https://verbump.de/ for what these numbers do


author: dmueller@suse.com
changelog:
  - update to 2.4.2:
    * Link againgst libm for function "isnan"
    * Include expat_config.h as early as possible
    * Autotools: Include files with release archives:
    - buildconf.sh
    - fuzz/*.c
    * Autotools: Sync CMake templates
    * docs: Document that function XML_GetBuffer may return NULL
      when asking for a buffer of 0 (zero) bytes size
    * docs: Fix return value docs for both
      XML_SetBillionLaughsAttackProtection* functions
    * Version info bumped from 9:1:8 to 9:2:8


author: dmueller@suse.com
changelog:
  - update to 2.4.3 (bsc#1194251, bsc#1194362, bsc#1194474,
      bsc#1194476, bsc#1194477, bsc#1194478, bsc#1194479, bsc#1194480):
    * CVE-2021-45960 -- Fix issues with left shifts by >=29 places
      resulting in
      a) realloc acting as free
      b) realloc allocating too few bytes
      c) undefined behavior
      depending on architecture and precise value
      for XML documents with >=2^27+1 prefixed attributes
      on a single XML tag a la
      "<r xmlns:a='[..]' a:a123='[..]' [..] />"
      where XML_ParserCreateNS is used to create the parser
      (which needs argument "-n" when running xmlwf).
      Impact is denial of service, or more.
    * CVE-2021-46143 (ZDI-CAN-16157) -- Fix integer overflow
      on variable m_groupSize in function doProlog leading
      to realloc acting as free.
      Impact is denial of service or more.
    * CVE-2022-22822 to CVE-2022-22827 -- Prevent integer overflows
      near memory allocation at multiple places.  Mitre assigned
      a dedicated CVE for each involved internal C function:
    - CVE-2022-22822 for function addBinding
    - CVE-2022-22823 for function build_model
    - CVE-2022-22824 for function defineAttribute
    - CVE-2022-22825 for function lookup
    - CVE-2022-22826 for function nextScaffoldPart
    - CVE-2022-22827 for function storeAtts
      Impact is denial of service or more.


author: david.anes@suse.com
changelog:
  - update to 2.4.4 (bsc#1195217, bsc#1195054):
    * Security fixes:
    - CVE-2022-23852 -- Fix signed integer overflow
      (undefined behavior) in function XML_GetBuffer
      that is also called by function XML_Parse internally)
      for when XML_CONTEXT_BYTES is defined to >0 (which is both
      common and default).
      Impact is denial of service or more.
    - CVE-2022-23990 -- Fix unsigned integer overflow in function
      doProlog triggered by large content in element type
      declarations when there is an element declaration handler
      present (from a prior call to XML_SetElementDeclHandler).
      Impact is denial of service or more.
    * Bug fixes:
    - xmlwf: Fix a memory leak on output file opening error
    * Other changes:
    - Version info bumped from 9:3:8 to 9:4:8;
      see https://verbump.de/ for what these numbers do
    * Drop unused file valid-xhtml10.png


author: david.anes@suse.com
changelog:
  - Security fixes:
    * (CVE-2022-25236, bsc#1196025) Expat before 2.4.5 allows
      attackers to insert namespace-separator characters into
      namespace URIs
    - Added expat-CVE-2022-25236.patch
    * (CVE-2022-25235, bsc#1196026) xmltok_impl.c in Expat before
      2.4.5 does not check whether a UTF-8 character is valid in a
      certain context.
    - Added expat-CVE-2022-25235.patch
    * (CVE-2022-25313, bsc#1196168) Stack exhaustion in
      build_model() via uncontrolled recursion
    - Added expat-CVE-2022-25313.patch
    - The fix upstream introduced a regression that was later
      amended in 2.4.6 version
      + Added expat-CVE-2022-25313-fix-regression.patch
    * (CVE-2022-25314, bsc#1196169) Integer overflow in copyString
    - Added expat-CVE-2022-25314.patch
    * (CVE-2022-25315, bsc#1196171) Integer overflow in storeRawNames
    - Added expat-CVE-2022-25315.patch


author: david.anes@suse.com
changelog:
  - Security fixes:
    * (CVE-2022-25236, bsc#1196784) [>=2.4.5] Fix to CVE-2022-25236
      breaks biboumi, ClairMeta, jxmlease, libwbxml,
      openleadr-python, rnv, xmltodict
    - Added expat-CVE-2022-25236-relax-fix.patch


author: david.anes@suse.com
changelog:
  - Security fix:
    * (CVE-2022-40674, bsc#1203438) use-after-free in the doContent
      function in xmlparse.c
    - Added patch expat-CVE-2022-40674.patch


author: david.anes@suse.com
changelog:
  - Security fix:
    * (CVE-2022-43680, bsc#1204708) use-after free caused by overeager
      destruction of a shared DTD in XML_ExternalEntityParserCreate in
      out-of-memory situations
    - Added patch expat-CVE-2022-43680.patch


author: jengelh@inai.de
changelog:
  - Update to new upstream release 1.8.2
    * Fix incorrect handling of various targets and options in
      iptables-nft,ebtables-nft,arptables-nft.


author: kstreitova@suse.com
changelog:
  - Add iptables-1.8.2-dont_read_garbage.patch that fixes a situation
    where 'iptables -L' reads garbage from the struct as the kernel
    never filled it in the bugged case. This can lead to issues like
    mapping a few TiB of memory [bsc#1106751].


author: jengelh@inai.de
changelog:
  - Add 0001-include-fix-build-with-kernel-headers-before-4.2.patch,
    0001-include-extend-the-headers-conflict-workaround-to-in.patch
    to fix build with older linux-glibc-devel. [boo#1132821]


author: jengelh@inai.de
changelog:
  - Update to new upstream release 1.8.3
    * ebtables: Fix rule listing with counters
    * ebtables-nft: Support user-defined chain policies
  - Remove 0001-include-extend-the-headers-conflict-workaround-to-in.patch
    0001-include-fix-build-with-kernel-headers-before-4.2.patch
    (upstreamed)


author: kstreitova@suse.com
changelog:
  - Add Conflicts with iptables-nft = 1.6.2 as during the update to
    iptables 1.8 ip6tables-restore-translate, ip6tables-translate,
    iptables-restore-translate and iptables-translate were moved from
    iptables-nft subpackage (now iptables-backend-nft) to the main
    package. So we need to add a conflict here otherwise we hit file
    conflicts error during the update.


author: jengelh@inai.de
changelog:
  - Update to release 1.8.4
    * Fix for wrong counter format in `ebtables-nft-save -c` output.
    * Print typical iptables-save comments in arptables- and
      ebtables-save, too.
    * xt_owner: add --suppl-groups option
    * Remove support for /etc/xtables.conf
    * Restore support for "-4" and "-6" options in rule lines.


author: jengelh@inai.de
changelog:
  - Update to release 1.8.5
    * IDLETIMER: Add alarm timer option
    * nft: CT: add translation for NOTRACK
  - Drop iptables-apply-mktemp-fix.patch (seemingly applied)


author: jengelh@inai.de
changelog:
  - Update to release 1.8.6
    * iptables-nft had pointlessly added "bitwise" expressions to
      each IP address match, needlessly slowing down run-time
      performance (by 50% in worst cases).
    * iptables-nft-restore: Support basechain policy value of "-"
      (indicating to not change the chain's policy).
    * nft-translte: Fix translation of ICMP type "any" match.


author: jengelh@inai.de
changelog:
  - Update to release 1.8.7
    * iptables-nft:
    * Improved performance when matching on IP/MAC address prefixes
      if the prefix is byte-aligned. In ideal cases, this doubles
      packet processing performance.
    * Dump user-defined chains in lexical order. This way ruleset
      dumps become stable and easily comparable.
    * Avoid pointless table/chain creation. For instance,
      `iptables-nft -L` no longer creates missing base-chains.


author: bruno@ioda-net.ch
changelog:
  - Update to 0.10 version :
    * Add a json_object_to_json_string_ext() function to allow output
    to be formatted in a more human readable form.
    * Add json_object_object_get_ex(), a NULL-safe get object method,
    to be able to distinguish between a key not present and the value
    being NULL.
    * Add an alternative iterator implementation, see json_object_iterator.h
    * Make json_object_iter public to enable external use of the
      json_object_object_foreachC macro.
    * Add a printbuf_memset() function to provide an effecient way to set and
      append things like whitespace indentation.
    * Adjust json_object_is_type and json_object_get_type so they return
      json_type_null for NULL objects and handle NULL passed to
      json_objct_object_get().
    * Rename boolean type to json_bool.
    * Fix various compile issues for Visual Studio and MinGW.
    * Allow json_tokener_parse_ex() to be re-used to parse multiple object.
      Also, fix some parsing issues with capitalized hexadecimal numbers and
      number in E notation.
    * Add json_tokener_get_error() and json_tokener_error_desc() to better
      encapsulate the process of retrieving errors while parsing.
    * Various improvements to the documentation of many functions.
    * Add new json_object_array_sort() function.
    * Fix a bug in json_object_get_int(), which would incorrectly return 0
      when called on a string type object.
      Eric Haszlakiewicz
    * Add a json_type_to_name() function.
      Eric Haszlakiewicz
    * Add a json_tokener_parse_verbose() function.
      Jehiah Czebotar
    * Improve support for null bytes within JSON strings.
      Jehiah Czebotar
    * Fix file descriptor leak if memory allocation fails in json_util
      Zachary Blair, zack_blair at hotmail dot com
    * Add int64 support. Two new functions json_object_net_int64 and
      json_object_get_int64. Binary compatibility preserved.
      Eric Haszlakiewicz, EHASZLA at transunion com
      Rui Miguel Silva Seabra, rms at 1407 dot org
    * Fix subtle bug in linkhash where lookup could hang after all slots
      were filled then successively freed.
      Spotted by Jean-Marc Naud, j dash m at newtraxtech dot com
    * Make json_object_from_file take const char *filename
      Spotted by Vikram Raj V, vsagar at attinteractive dot com
    * Add handling of surrogate pairs (json_tokener.c, test4.c, Makefile.am)
      Brent Miller, bdmiller at yahoo dash inc dot com
    * Correction to comment describing printbuf_memappend in printbuf.h
      Brent Miller, bdmiller at yahoo dash inc dot com
  - Packaging :
    * upgrade upstream location https://gitub.com/json-c/json-c/wiki
    * cleanup old patches included now upstream
    . json-c-0.9-linkhash.patch
    . json-c-0.9-json_tokener.patch
    . json-c-0.9-json_object_from_file.patch
    . json-c-0.9-base.patch
    * Redone lfs patch against new 0.10 release
    * Removed empty NEWS file


author: fstrba@suse.com
changelog:
  - Upgrade to 0.11 version:
    - SONAME change.
    - Fix provides and obsoletes accordingly
    - symlink the .pc file to the oldname for software that needs it
  - Remove json-c-fix-headers.patch integrated upstream


author: idonmez@suse.com
changelog:
  - Add json-c-hash-dos-and-overflow-random-seed-4e.patch to fix
    CVE-2013-6370 and CVE-2013-6371 (bnc#870147)


author: andreas.stieger@gmx.de
changelog:
  - json-c 0.12
    Fixes for security issues contained in this release have been
    previously patched into this package, but listed for completeness:
    * Address security issues:
    * CVE-2013-6371: hash collision denial of service
    * CVE-2013-6370: buffer overflow if size_t is larger than int
  - Further changes:
    * Avoid potential overflow in json_object_get_double
    * Eliminate the mc_abort() function and MC_ABORT macro.
    * Make the json_tokener_errors array local.  It has been deprecated for
      a while, and json_tokener_error_desc() should be used instead.
    * change the floating point output format to %.17g so values with
      more than 6 digits show up in the output.
    * Remove the old libjson.so name compatibility support.  The library is
      only created as libjson-c.so now and headers are only installed
      into the ${prefix}/json-c directory.
    * When supported by the linker, add the -Bsymbolic-functions flag.
    * Make strict mode more strict:
    * number must not start with 0
    * no single-quote strings
    * no comments
    * trailing char not allowed
    * only allow lowercase literals
    * Added a json_object_new_double_s() convenience function to allow
      an exact string representation of a double to be specified when
      creating the object and use it in json_tokener_parse_ex() so
      a re-serialized object more exactly matches the input.
    * Add support NaN and Infinity
  - packaging changes:
    * json-c-hash-dos-and-overflow-random-seed-4e.patch is upstream
    * Move from json-c-lfs.patch which removed warning errors and
      autoconf call to json-c-0.12-unused_variable_size.patch from
      upstream which fixes the warning
    * except for SLE 11 where autoreconf call is required
    * add licence file to main package


author: rpm@fthiessen.de
changelog:
  - Update to upstream release 0.12.1
  - Removed upstream fixed json-c-0.12-unused_variable_size.patch
  - Added fix-set-but-not-used.patch


author: avindra@opensuse.org
changelog:
  - json-c 0.13
    + Deprecated and removed features:
    * Internal use of bits.h has been eliminated.
    * lh_abort() is deprecated
    + Behavior changes:
    * Tighten the number parsing algorithm to raise errors instead
      of truncating the results.  For example 12.3.4 or 2015-01-15,
      which now return null.
    * Use size_t for array length and size. Platforms where
      sizeof(size_t) != sizeof(int) may not be backwards compatible
    * Check for failue when allocating memory, returning NULL and
      errno=ENOMEM.
    * Change json_object_object_add() return type from void to int,
      and will return -1 on failures, instead of exiting. (Note:
      this is not an ABI change)
    + New features:
    * Aiming to follow RFC 7159 now.
    * Support for JSON pointer, RFC 6901 (see json_pointer.h)
    * Add a couple of additional option to json_object_to_json_string_ext:
    JSON_C_TO_STRING_PRETTY_TAB
    JSON_C_TO_STRING_NOSLASHESCAPE
    * json_object_object_add_ex() - better perf when certain
      constraints are known to be true
    * Serialization format of doubles now configurable
    * New functions
    - json_object_equal() - utility function for comparing
      json_objects
    - json_object_deep_copy() - a way to copy entire object
      trees
    - json_object_set_<type>() - modify the value of
      existing json_object's without the need to recreate them.
    Also add a json_object_int_inc function to adjust an int's'
    value.
    - json_util_get_last_err() - retrieve the string describing
      the cause of errors, instead of printing to stderr.
    - perllike hash function for strings
    * json_global_set_string_hash()
    * json_c_visit() - a way to iterate over a tree of json-c
      objects.
    + Notable bug fixes and other improvements:
    * Make reference increment and decrement atomic to allow
      passing json objects between threads.
    * Fix json_object_object_foreach to avoid uninitialized
      variable warnings.
    * Improve performance by removing unneeded data items from
      hashtable code and reducing duplicate hash computation.
    * Performance: store small strings inside json_object
    * Performance: of json_object_to_json_string by removing
      variadic printf
    * Fix parsing of "-Infinity", and avoid needlessly copying the
      input when doing so.
    * Fix stack buffer overflow in json_object_double_to_json_string_format()
    * Fix various potential null ptr deref and int32 overflows
    * Fix a long-standing bug in array_list_put_idx() where it
      would attempt to free previously free'd entries due to not
      checking the current array length.
    * use uselocale() instead of setlocale() in json_tokener to
      behave better in threaded environments.
    * Fix out of bounds read when handling unicode surrogate pairs.
    * Ensure doubles that happen to be a whole number are emitted
      with ".0"
    * Visual Studio: use a snprintf/vsnprintf wrapper that ensures
      the string is terminated.
    * Fix double to int cast overflow in json_object_get_int64.
    * Clamp double to int32 when narrowing in json_object_get_int.
    * Use strtoll() to parse ints - instead of sscanf
    * usual code linting
    + Build changes:
    * Add Appveyor and Travis build support
    * Support for MacOS and Windows through CMake
    * Silent build by default
    * Link against libm when needed
    * Add support for building with AddressSanitizer
    * Add support for building with Clang
    * Add a --enable-threading configure option, and only use the
      (slower) __sync_add_and_fetch()/__sync_sub_and_fetch()
      function when it is specified.
  - cleanup with spec-cleaner
  - remove fix-set-but-not-used.patch
    + fixed: https://github.com/json-c/json-c/issues/240
  - remove gcc7-fix.patch
    + fixed in 014924ba899f659917bb64392bbff7d3c803afc2


author: ncutler@suse.com
changelog:
  - Add patch bsc1171479.patch
    + fix integer overflow and out-of-bounds write (CVE-2020-12762, bsc#1171479)


author: abergmann@suse.com
changelog:
  - Initial release 0.13.0.
    A library and tools to access the kernel crypto api.
    FATE#323554 bsc#1045948


author: jengelh@inai.de
changelog:
  - Compact descriptions a bit
  - Remove libkcapi provide/requires
  - Use %_libdir throughout and avoid /lib


author: meissner@suse.com
changelog:
  - libkcapi-use-external-fipshmac.patch: use external fipshmac,
    our chroots / vm builds do not necessarily have the right kernel.


author: bwiedemann@suse.com
changelog:
  - Add reproduciblesort.patch to always link .o files in the same order and
  - Add reproducibledate.patch to not add current time to man-pages to fix build-compare


author: lnussel@suse.de
changelog:
  - New version 0.20.2
    * Fix bug where blacklist didn't affect extracted ca-anchors if the anchor
      and blacklist were not in the same trust path (regression) [fdo#73558]
    * Check for race in BasicConstraints stapled extension [fdo#69314]
    * Build fixes and cleanup


author: lnussel@suse.de
changelog:
  - new version 0.20.3
    * Fix problems reinitializing managed modules after fork
    * Fix bad bookeeping when fail initializing one of the modules
    * Fix case where module would be unloaded while in use [#74919]
    * Remove assertions when module used before initialized [#74919]
    * Fix handling of mmap failure and mapping empty files [#74773]
    * Stable p11_kit_be_quiet() and p11_kit_be_loud() functions
    * Require automake 1.12 or later
    * Build fixes for Windows [#76594 #74149]
  - apply patches to avoid errors from certificates with invalid public key
    (fdo#82328, bnc#890908,
    trust-Dont-use-invalid-public-keys-for-looking-up-.patch,
    trust-Print-label-of-certificate-when-complaining-.patch)


author: lnussel@suse.de
changelog:
  - remove patches:
    * trust-Print-label-of-certificate-when-complaining-.patch
    * trust-Dont-use-invalid-public-keys-for-looking-up-.patch
  - new version 0.20.7 (stable)
    * New public pkcs11x.h header containing extensions [fdo#83495]
    * Export necessary defines to lookup attached extensions [fdo#83495]
    * Build fixes
  - new version 0.20.6 (stable)
    * Make the p11-kit-proxy.so module respect critical = no [fdo#83651]
    * Build fix for FreeBSD [fdo#75674]
  - new version 0.20.5 (stable)
    * Don't use invalid keys for looking up stapled extensions [fdo#82328]
    * Better error messages when invalid certificate extensions
    * Fix parsing of some odd OpenSSL TRUSTED CERTIFICATE files
    * Fix some leaks, and memory issues
    * Silence some clang scanner warnings
  - new version 0.20.4 (stable)
    * Don't complain about C_Finalize after a fork
    * Fix typo


author: p.drouand@gmail.com
changelog:
  - Update to version 0.23.1 (stable)
    * Use new PKCS#11 URI draft fields for URIs [fdo#86474 fdo#87582]
    * Add pem-directory-hash extract format
    * Build fixes
  - Remove 0001-trust-allow-to-also-add-openssl-style-hashes-to-pem-d.diff;
    fixed on upstream release
  - Remove autoconf, automake and libtool require; unneeded dependencies
  - Add gtk-doc require; needed to build html documentation
  - Remove redundant %clean section


author: mpluskal@suse.com
changelog:
  - Update to 0.23.2
    * Fix forking issues with libffi
    * Fix various crashes in corner cases
    * Updated translations
    * Build fixes
  - Make building more verbose
  - Enable tests
  - Small spec file cleanup with spec-cleaner


author: sbrabec@suse.com
changelog:
  - 32-bit compatibility fixes:
    * Add PKCS11 module to p11-kit-32bit (bsc#996047#c39)
    * Add p11-kit-nss-trust-32bit NSS module
    * Fix potential bi-arch issue with private binaries
      (fdo#98817, p11-kit-biarch.patch)


author: lnussel@suse.de
changelog:
  - support loading NSS attribute CKA_NSS_MOZILLA_CA_POLICY so Firefox
    detects built in certificates (boo#1154871,
    0001-Fix-a-typo-in-x-cetrificate-value-see-also-https-bug.patch,
    0001-Support-loading-new-NSS-attribute-CKA_NSS_MOZILLA_CA.patch)


author: scabrero@suse.de
changelog:
  - Update to version 0.23.22 (bsc#1180064, bsc#1180065, bsc#1180066):
    * Fix memory-safety issues that affect the RPC protocol
    (CVE-2020-29361, CVE-2020-29362, and CVE-2020-29363), discovered
    and fixed by David Cook
    * anchor: Prefer persistent format when storing anchor [PR#329]
    * common: Fix infloop in p11_path_build [PR#326, PR#327]
    * proxy: C_CloseAllSessions: Make sure that calloc args are non-zero [PR#325]
    * common: Check for a NULL locale before freeing it [PR#321]
    * Build and test fixes [PR#313, PR#315, PR#317, PR#318, PR#319, PR#323,
    PR#330, PR#333, PR#334, PR#335, PR#338, PR#339]
  - Changes for version 0.23.21
    * proxy: Do not assign duplicate slot IDs [PR#282]
    * common: Get program name based on executable path if possible [PR#307]
    * anchor: Exit with non-zero code, if any error occurs [PR#304]
    * Build and test fixes [PR#283, PR#290, PR#291, PR#292, PR#296, PR#299,
    PR#305, PR#306, PR#309, PR#311]
  - Changes for version 0.23.20:
    * Revert "Fix RPC when length-s are 0" changes [PR#276]
  - Changes for version 0.23.19:
    * common: add Russian PKCS#11 extensions to pkcs11x.h header [PR#255]
    * Add simple bash completion for provided commands [PR#258]
    * Unbreak list matching in enable-in and disable-in [PR#262]
    * Fix RPC when length-s are 0 [PR#259]
    * rpc: Add vsock transport support [PR#270]
    * trust: Support CKA_NSS_{SERVER,EMAIL}_DISTRUST_AFTER [PR#265]
    * Build fixes [PR#271, PR#272, PR#273, ...]
  - Changes for version 0.23.18:
    * rpc: Allow empty CK_DATE value [PR#253]
    * build: Meson fixes [PR#245]
    * build: Adjust feature parity between meson and autotools [PR#247]
  - Changes for version 0.23.17:
    * common: Fix uClibc-ng compilation [PR#237]
    * trust: do not allow daylight to invalidate date validation [PR#236]
    * build: Port to meson build system [PR#231, PR#234]
    * rpc: On UNIX wait on condition variable instead of FD if header is for a different thread [PR#232]
    * doc: Add 'server' command in help [PR#229]
    * Build and test fixes [PR#230]
  - Changes for version 0.23.16:
    * proxy: Support C_WaitForSlotEvent() if CKF_DONT_BLOCK is specified [PR#225]
    * conf: Ignore user configuration if the program is running as root [PR#226]
    * proxy: Refresh slot list on every C_GetSlotList call [PR#224]
    * modules: Fix index used in call to p11_dict_remove() [PR#219]
    * Fix Win32 p11_dl_error crash [PR#218]
    * modules: check gl.modules before iterates on it when freeing [PR#217]
    * trust: Ignore unreadable content in anchors [PR#215]
    * extract-jks: Prefer _p11_extract_jks_timestamp to SOURCE_DATE_EPOCH [PR#213]
  - Changes for version 0.23.15:
    * trust: Improve error handling if backed trust file is corrupted [PR#206]
    * url: Prefer upper-case letters in hex characters when encoding [PR#193]
    * trust/extract-jks.c: also honor SOURCE_DATE_EPOCH time [PR#202]
    * virtual: Prefer fixed closures to libffi closures [PR#196]
    * Fix issues spotted by coverity and cppcheck [PR#194, PR#204]
    * Build and test fixes [PR#164, PR#191, PR#199, PR#201]
  - Changes for version 0.23.14:
    * proxy: Avoid invalid memory access when unloading proxy module [PR#180]
    * Update pkcs11 header to allow SoftHSMv2 to compile [PR#181]
    * build: Restore libpthread dependency [PR#183]
    * Build fixes [PR#188]
  - Changes for version 0.23.13:
    * server: Enable socket activation through systemd [PR#173]
    * rpc-server: p11_kit_remote_serve_tokens: Allow exporting all modules
      [PR#174]
    * proxy: Fail early if there is no slot mapping [PR#175]
    * Remove hard dependency on libpthread [PR#177]
    * Build fixes [PR#170, PR#176]
  - Changes for version 0.23.12
    * Fix compile error when PKCS#11 GNU calling convention is enabled [PR#160]
    * Fix getauxval() and secure_getenv() emulation on macOS and FreeBSD [PR#167]
    * Build and test fixes on macOS [PR#162, PR#168]
  - Changes for version 0.23.11
    * trust: Add extractor for edk2/cacerts.bin [PR#139]
    * modules: Add option to control module visibility from proxy [PR#140]
    * trust: Prevent trust module being loaded by proxy module [PR#142]
    * library: Use dedicated locale object for printing error [PR#148]
    * Treat CKR_CRYPTOKI_ALREADY_INITIALIZED correctly [PR#134]
    * Improve const correctness for P11KitUri [PR#152]
    * PKCS#11 URI scheme comparison is now case insensitive [PR#156]
    * Build and test fixes [PR#151, PR#149, PR#141, PR#138, PR#135]
  - Changes for version 0.23.10
    * filter: Respect "write-protected" vendor-specific attribute in
      PKCS#11 URI [PR#129]
    * server: Improve shell integration and documentation [PR#107, PR#108]
    * proxy: Reuse existing slot ID mapping in after fork() [PR#120]
    * trust: Forcibly mark "Default Trust" read-only [PR#123]
    * New function p11_kit_override_system_files() which can be used for
      testing [PR#110]
    * trust: Filter out duplicate extensions [PR#69]
    * Update translations [PR#128]
    * Bug fixes [PR#125, PR#126]
  - Changes for version 0.23.9
    * Fix p11-kit server regressions [PR#103, PR#104]
    * trust: Respect anyExtendedKeyUsage in CA certificates [PR#99]
    * Build fixes related to reallocarray [PR#96, PR#98, PR#100]
  - Changes for version 0.23.8
    * Improve vendor query attributes handling in PKCS#11 URI [PR#92]
    * Add OTP and GOST mechanisms to pkcs11.h [PR#90, PR#91]
    * New envvar P11_KIT_NO_USER_CONFIG to stop looking at user
      configurations [PR#87]
    * Build fixes for Solaris and 32-bit big-endian platforms [PR#81, PR#86]
  - Changes for version 0.23.7
    * Fix memory issues with "p11-kit server" [PR#78]
    * Build fixes [PR#77 ...]
  - Changes for version 0.23.6
    * Port "p11-kit server" to Windows and portability fixes of the RPC
      protocol [PR#67, PR#72, PR#74]
    * Recover the old behavior of "trust anchor --remove" [PR#70, PR#71]
    * Build fixes [PR#63 ...]
  - Changes for version 0.23.5
    * Fix license notice of common/unix-peer.c [PR#58]
    * Remove systemd unit files for now [PR#60]
    * Build fixes for FreeBSD [PR#56]
  - Changes for version 0.23.4
    * Recognize query attributes defined in PKCS#11 URI (RFC7512) [PR#31,
      PR#37, PR#52]
    * The trust policy module now recognizes CKA_NSS_MOZILLA_CA_POLICY
      attribute, used by Firefox [#99453, PR#46]
    * Add 'trust dump' command to dump all PKCS#11 objects in the
      persistence format [PR#44]
    * New experimental 'p11-kit server' command that allows PKCS#11
      forwarding through a Unix domain socket.  A client-side module
      p11-kit-client.so is also provided [PR#15]
    * Add systemd unit files for exporting the proxy module through a
      Unix domain socket [PR#35]
    * New P11KitIter API to iterate over slots, tokens, and modules in
      addition to objects [PR#28]
    * libffi dependency is now optional [PR#9]
    * Build fixes for FreeBSD, macOS, and Windows [PR#32, PR#39, PR#45]
  - Changes for version 0.23.3
    * Install private executables in libexecdir [fdo#98817]
    * Fix link error of proxy module on macOS [fdo#98022]
    * Use new PKCS#11 URI specification for URIs [fdo#97245]
    * Support x-init-reserved argument of C_Initialize() in remote modules
      [fdo#80519]
    * Incorporate changes from PKCS#11 2.40 specification
    * Bump libtool library version
    * Documentation fixes
    * Build fixes [fdo#87192 ...]
  - Move RPM macros to %_rpmmacrodir.
  - New server subpackage
  - Change keyring to new maintainer Daiki Ueno
  - Avoid bareword to fix build failure
  - Remove obsolete patches:
    * p11-kit-biarch.patch
    * 0001-Support-loading-new-NSS-attribute-CKA_NSS_MOZILLA_CA.patch
    * 0001-Fix-a-typo-in-x-cetrificate-value-see-also-https-bug.patch


author: mcepl@suse.com
changelog:
  - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
    bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
    overflow in hashlib.sha3_* implementations (originally from the
    XKCP library).


author: mcepl@suse.com
changelog:
  - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
    CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
    extremely long domain names.


author: mcepl@suse.com
changelog:
  - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
    the garbage collection (bsc#1188607).


author: mcepl@suse.com
changelog:
  - Add bpo27321-email-no-replace-header.patch to stop
    email.generator.py from replacing a non-existent header
    (bsc#1208443, gh#python/cpython#71508).


author: mcepl@suse.com
changelog:
  - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
    bsc#1208471) blocklists bypass via the urllib.parse component
    when supplying a URL that starts with blank characters


author: mcepl@suse.com
changelog:
  - Add bpo-44434-libgcc_s-for-pthread_cancel.patch
    which eliminates unnecessary and dangerous calls to
    PyThread_exit_thread() (bsc#1203355).


author: mcepl@suse.com
changelog:
  - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
    CVE-2007-4559 (bsc#1203750) by adding the filter for
    tarfile.extractall (PEP 706).


author: mcepl@suse.com
changelog:
  - Add 99366-patch.dict-can-decorate-async.patch fixing
    gh#python/cpython#98086 (backport from Python 3.10 patch in
    gh#python/cpython!99366), fixing bsc#1211158.


author: daniel.garcia@suse.com
changelog:
  - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing
    gh#python/cpython#108310, backport from upstream patch
    gh#python/cpython#108315
    (bsc#1214692, CVE-2023-40217)


author: jengelh@inai.de
changelog:
  - Update to release 2.4.3
    * Add list of authorized release signatures to README.md
    * Fix multiplexing issue with s390/s390x shm* syscalls
    * Remove the static flag from libseccomp tools compilation
    * Add define for __SNR_ppoll
    * Fix potential memory leak identified by clang in the
      scmp_bpf_sim tool
  - Drop no-static.diff, libseccomp-fix_aarch64-test.patch,
    SNR_ppoll.patch (merged)


author: rhafer@suse.com
changelog:
  - Update to release 2.5.0
    * Add support for the seccomp user notifications, see the
      seccomp_notify_alloc(3), seccomp_notify_receive(3),
      seccomp_notify_respond(3) manpages for more information
    * Add support for new filter optimization approaches, including a balanced
      tree optimization, see the SCMP_FLTATR_CTL_OPTIMIZE filter attribute for
      more information
    * Add support for the 64-bit RISC-V architecture
    * Performance improvements when adding new rules to a filter thanks to the
      use of internal shadow transactions and improved syscall lookup tables
    * Properly document the libseccomp API return values and include them in the
      stable API promise
    * Improvements to the s390 and s390x multiplexed syscall handling
    * Multiple fixes and improvements to the libseccomp manpages
    * Moved from manually maintained syscall tables to an automatically generated
      syscall table in CSV format
    * Update the syscall tables to Linux v5.8.0-rc5
    * Python bindings and build now default to Python 3.x
    * Improvements to the tests have boosted code coverage to over 93%
  - libseccomp.keyring: replaced by Paul Moore <pmoore@redhat.com> key.


author: schwab@suse.de
changelog:
  - testsuite-riscv64-missing-syscalls.patch: Fix testsuite failure on
    riscv64
  - Ignore failure of tests/52-basic-load on qemu linux-user emulation


author: dimstar@opensuse.org
changelog:
  - Do not rely on gperf: pass GPERF=/bin/true to configure and
    remove gperf BuildRequires. The syscalls.perf file it would
    generate is part of the tarball already.


author: dmueller@suse.com
changelog:
  - update to 2.5.1:
    * Fix a bug where seccomp_load() could only be called once
    * Change the notification fd handling to only request a notification fd if
    * the filter has a _NOTIFY action
    * Add documentation about SCMP_ACT_NOTIFY to the seccomp_add_rule(3) manpage
    * Clarify the maintainers' GPG keys
  - remove testsuite-riscv64-missing-syscalls.patch


author: jengelh@inai.de
changelog:
  - Update to release 2.5.2
    * Update the syscall table for Linux v5.14-rc7
    * Add a function, get_notify_fd(), to the Python bindings to
      get the nofication file descriptor.
    * Consolidate multiplexed syscall handling for all
      architectures into one location.
    * Add multiplexed syscall support to PPC and MIPS
    * The meaning of SECCOMP_IOCTL_NOTIF_ID_VALID changed within
      the kernel. libseccomp's fd notification logic was modified
      to support the kernel's previous and new usage of
      SECCOMP_IOCTL_NOTIF_ID_VALID.


author: jengelh@inai.de
changelog:
  - Update to release 2.5.3
    * Update the syscall table for Linux v5.15
    * Fix issues with multiplexed syscalls on mipsel introduced in v2.5.2
    * Document that seccomp_rule_add() may return -EACCES


author: mrueckert@suse.de
changelog:
  - reenable python bindings at least for the distro default python3
    package:
    - adds make-python-build.patch


author: jsegitz@suse.com
changelog:
  - Update to version 2.8 (bsc#1111732)
    For changes please see
    https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20180524/RELEASE-20180524.txt
  - ran spec-cleaner on spec files


author: jsegitz@suse.com
changelog:
  - Update to version 2.9
    * Add security_reject_unknown(3) man page
    * Change matchpathcon usage to match with matchpathcon manpage
    * Do not define gettid() if glibc >= 2.30 is used
    * Fix RESOURCE_LEAK defects reported by coverity scan
    * Fix line wrapping in selabel_file.5
    * Do not dereference symlink with statfs in selinux_restorecon
    * Fix overly strict validation of file_contexts.bin
    * Fix selinux_restorecon() on non-SELinux hosts
    * Fix the whatis line for the selinux_boolean_sub.3 manpage
    * Fix printf format string specifier for uint64_t
    * Fix handling of unknown classes/perms
    * Set an appropriate errno in booleans.c
  - Dropped python3.patch, is now upstream


author: jsegitz@suse.com
changelog:
  - In selinux-ready
    * Removed check for selinux-policy package as we don't ship one
      (bsc#1136845)
    * Add check that restorecond is installed and enabled


author: jsegitz@suse.de
changelog:
  - Added Use-Python-distutils-to-install-SELinux.patch to use
    Python's distutils instead of building and installing python
    bindings manually


author: jsegitz@suse.de
changelog:
  - Update to version 3.0
    * Ignore the stem when looking up all matches in file context
    * Save digest of all partial matches for directory
    * Use Python distutils to install SELinux python bindings
    * ensure that digest_len is not zero
    * fix string conversion of unknown perms
    * mark all exported function "extern"
    Dropped Use-Python-distutils-to-install-SELinux.patch, included
    upstream


author: jsegitz@suse.com
changelog:
  - Update to version 3.1:
    * selinux/flask.h, selinux/av_permissions.h and sepol/policydb/flask.h were
      removed. All userspace object managers should have been updated to use the
      dynamic class/perm mapping support.
      Use string_to_security_class(3) and string_to_av_perm(3) to map the class
      and permission names to their policy values, or selinux_set_mapping(3) to
      create a mapping from class and permission index values used by the
      application to the policy values.
    * Removed restrictions in libsepol and checkpolicy that required all declared
      initial SIDs to be assigned a context.
    * Support for new policy capability genfs_seclabel_symlinks
    * selinuxfs is mounted with noexec and nosuid
    * `security_compute_user()` was deprecated


author: mliska@suse.cz
changelog:
  - Update to version 4.4.3:
    * Add libxcrypt.so, libxcrypt.a and xcrypt.h.
    * Add new man3 manual pages.


author: schwab@suse.de
changelog:
  - Update to version 4.4.10
    * Fix alignment problem for GOST 34.11 (Streebog) in gost-yestcrypt.
    * The crypt_* functions will now all fail and set errno to ERANGE if
      their 'phrase' argument is longer than CRYPT_MAX_PASSPHRASE_SIZE
      characters (this is currently 512)
    * The NT hashing method no longer truncates passphrases at 128
      characters; Windows does not do this.
  - format-overflow.patch: remove


author: schwab@suse.de
changelog:
  - Update to version 4.4.11
    * Fixes for GCC v10.x
    * Change how the known-answer tests are parallelized
  - gcc10.patch: remove


author: schwab@suse.de
changelog:
  - Update to version 4.4.15
    * The compatibility symbols crypt_gensalt_r, xcrypt, xcrypt_r,
      xcrypt_gensalt, and xcrypt_gensalt_r are deprecated further
    * Speed up ka-sunmd5 by skipping most of the test phrases
  - Package README.md and TODO.md (bsc#1165389)


author: msuchanek@suse.de
changelog:
  - Update from current 15 SP4 kernel
    + linux-stable-version-update.patch					(stable-5.14.11)
    + binder-fix-freeze-race.patch					(stable-5.14.9)
    + bpf-Fix-a-typo-of-reuseport-map-in-bpf.h.patch			(stable-5.14.4)
    + fq_codel-reject-silly-quantum-parameters.patch			(stable-5.14.7)
    + habanalabs-add-in-device-creation-status.patch			(stable-5.14.8)
    + serial-8250-Define-RX-trigger-levels-for-OxSemi-950-.patch		(stable-5.14.6)
    + dmanegine-idxd-add-software-command-status.patch			(jsc#SLE-18899)
    + dmaengine-idxd-fix-setting-up-priv-mode-for-dwq.patch		(jsc#SLE-18899)
    + ethtool-add-two-link-extended-substates-of-bad-signa.patch		(bsc#1190336)
    + ethtool-add-two-coalesce-attributes-for-CQE-mode.patch		(jsc#SLE-19253)
    + msft-hv-2440-hyper-v-Replace-uuid.h-with-types.h.patch		(git-fixes)
    + RDMA-mlx5-Add-DCS-offload-support.patch				(jsc#SLE-19250)
    + remove-the-lightnvm-subsystem.patch					(bsc#1190569)
    + scsi-fc-Add-EDC-ELS-definition.patch				(bsc#1190576)
    + uapi-add-a-compatibility-layer-between-linux-uio-h-and-glibc	(bsc#1053501)
    + md-display-timeout-error.patch					(bsc#763402)


author: dfaggioli@suse.com
changelog:
  - Export the macros necessary for making core-scheduling usable (bsc#1194659)
    + uapi-linux-prctl-provide-macro-definitions-for-the-PR_SCHED_CORE-type-argument


author: msuchanek@suse.com
changelog:
  - Delete RDMA-mlx5-Add-DCS-offload-support.patch (bsc#1191550)
  - Update from current 15 SP4 kernel (jsc#SLE-17360)
    * Refresh linux-stable-version-update.patch
    + kvm-sev-add-support-for-sev-intra-host-migration			(jsc#SLE-19924)
    + PCI-Add-PCI_EXP_DEVCTL_PAYLOAD_-macros.patch			(stable-5.14.19)
    + ethtool-fix-ethtool-msg-len-calculation-for-pause-st.patch		(stable-5.14.19)
    + uapi-fix-linux-nfc.h-userspace-compilation-errors.patch		(git-fixes)
    + nfc-uapi-use-kernel-size_t-to-fix-user-space-builds.patch		(git-fixes)
    + cifs-remove-pathname-for-file-from-SPDX-header.patch		(bsc#1193629)
    + uapi-Fix-undefined-__always_inline-on-non-glibc-syst.patch		(git-fixes)
    + tty-Partially-revert-the-removal-of-the-Cyclades-pub.patch		(git-fixes)
    + um-virt-pci-fix-uapi-documentation					(git-fixes)
    + net-sched-act_skbmod-Add-SKBMOD_F_ECN-option-support.patch		(bsc#1189998)
    + stddef-Introduce-struct_group-helper-macro.patch			(jsc#SLE-18978)
    + net-smc-add-support-for-user-defined-EIDs				(jsc#SLE-18331)
    + net-smc-add-generic-netlink-support-for-system-EID			(jsc#SLE-18331)
    + net-smc-add-netlink-support-for-SMC-Rv2				(jsc#SLE-18331)
    + net_sched-refactor-TC-action-init-API.patch				(bsc#1189998)
    + 0001-mm-mempolicy-add-MPOL_PREFERRED_MANY-for-multiple-pr.patch	(jsc#SLE-23098)
    + 0003-mm-mempolicy-wire-up-syscall-set_mempolicy_home_node.patch	(jsc#SLE-23098)
    + devlink-report-maximum-number-of-snapshots-with-regi.patch		(jsc#SLE-19253)
    + x86-arch_prctl-add-controls-for-dynamic-xstate-components.patch	(jsc#SLE-18931)
    + 0005-efi-generate-secret-key-in-EFI-boot-environment.patch		(fate#316350)
    + mptcp-add-missing-documented-NL-params				(git-fixes)
    + stddef-Introduce-DECLARE_FLEX_ARRAY-helper.patch			(git-fixes)


author: msuchanek@suse.com
changelog:
  - Add the rest of 1.0 IAA operation definitions to the user header (jsc#PED-813).
    + dmaengine-idxd-update-IAA-definitions-for-user-heade.patch


author: tiwai@suse.com
changelog:
  - Add linux/sev-guest.h (bsc#1211096):
    virt-Add-SEV-SNP-guest-driver
    virt-sevguest-Add-support-to-derive-key
    virt-sevguest-Add-support-to-get-extended-report


author: kukuk@suse.de
changelog:
  - Update to version 0.93: Teach pam_cracklib module about
    enforce_for_root [bnc#929079, FATE#312643].


author: kukuk@suse.de
changelog:
  - Update to version 1.0:
    - Add search in different locations for config files
    - Add support for pam_mktemp [bsc#1123878]


author: josef.moellers@suse.com
changelog:
  - prior to writing an service-specific config file, the main function
    calls access() on the destination file in /etc/pam.d.
    This will fail and no config file will be written when the original
    config file was installed in /usr/etc/pam.d.
    A similar problem exists when creating the new service file:
    create_service_file() wants to give the new service file the same
    user, group and mode as the old one, but the old one may not exist.
    In that case, set these to 0(root), 0(root), and 0644.
    [pam-config-remove-bad-access-call.patch, bsc#1187091]


author: josef.moellers@suse.com
changelog:
  - Add "revoke" to the option list for pam_keyinit
    (Remove some leftover debugs while we're at it)
    [pam-config-fix-pam_keyinit-options.patch]


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#136
  - report error if config file could not be updated (bsc#1188768)
  - 0.936


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#137
  - grub2 install: Support secure boot on powerpc (bsc#1192764
    jsc#SLE-18271).
  - 0.937


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#138
  - grub2/install: reset error code when passing through recover code
    (bsc#1198197)
  - 0.938


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#142
  - use fw_platform_size to distinguish between 32 bit and 64 bit
    UEFI platforms (bsc#1208003)
  - 0.942


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#147
  - UEFI: update also default location, if it is controlled by SUSE
    (bsc#1210799, bsc#1201399)
  - 0.943


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#152
  - use signed grub EFI binary when updating grub in default EFI
    location (bsc#1210799)
  - check whether grub2-install supports --suse-force-signed option
  - 0.944


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#157
  - bootloader_entry script can have an optional 'force-default'
    argument (bsc#1215064)
  - skip warning about unsupported options when in compat mode
  - 0.945


author: sweet_f_a@gmx.de
changelog:
  - update to 2.2.5:
    * add --rsyncable functionality
    * many bug fixes
  - remove all suse patches:
    * pigz-dictzip.patch, large and unmaintained patch. If somebody
      really needs that then we should rebase and test it. In this
      case --dictzip should be probably also added to original gzip.
    * pigz-always-thread.patch was a folloup of pigz-dictzip.patch
    * pigz-do-symlinks.patch added IMO dangerous and stupid behaviour
      for symlinks. The original behaviour is now again like we know
      it from gzip, bzip2 and xz.
    * pigz-spl.patch, why we hacked in special handling of .spl
      files?
    * Generally we want to have pigz to replace gzip (and vice versa)
      so better avoiding interface incompatibilities.
  - cleanup spec file


author: adam@mizerski.pl
changelog:
  - update to 2.3
    * Don't complain about missing suffix when not writing output file
    * Put all global variables in one global structure for readability
    * Do not decompress concatenated zlib streams -- only gzip streams
    * Add option for compression level 11 to use zopfli
    * Fix handling of junk after compressed data
  - added pigz-lm.patch
    * adds missing "-lm"
  - provide unpigz binary and manpage as symlink, not copy.
  - removed fake cc script - build system honors CC
  - cleanup spec file


author: p.drouand@gmail.com
changelog:
  - Update to version 2.3.3
    * Portability improvements
    * Update copyright years in documentation
  - Add build fix patches
    * pigz-fix-wrong-include.patch
    * pigz-fix-missing-linker.patch
  - Remove pigz-lm.patch; fixed
  - Use download Url as source


author: dimstar@opensuse.org
changelog:
  - Update to version 0.27:
    + Drop usage of popt for equivalent API in glib2
    + Add back an internal snapshot of glib2 to break circular
      dependency
    + Fix --exists to check for Requires and Requires.private.
    + Various fixes for MinGW which should allow it to be used
      unpatched on that system
    + New autoconf macros PKG_INSTALLDIR and PKG_NOARCH_INSTALLDIR to
      help determine the .pc file install directory
    + Fix handling of --exact/atleast/max-version vs. =/>=/<=
    + Fix errors in man page source
    + Ensure testing only searches in the check directory
    + Bump glib requirement to 2.16 to avoid deprecated
      g_win32_get_package_installation_subdirectory()
    + Autotools refresh and update
    + Use g_alloca from glib instead of figuring out alloca ourselves
    + Remove search for setresuid & setreuid only needed for internal
      popt
    + Bugs fixed: fdo#833, fdo#2458, fdo#5214, fdo#5326, fdo#5703,
      fdo#6074, fdo#8653, fdo#9135, fdo#9143, fdo#9584, fdo#10652,
      fdo#11464, fdo#14396, fdo#17053, fdo#23922, fdo#28776,
      fdo#29011, fdo#29801, fdo#31699, fdo#31700, fdo#32622,
      fdo#34382, fdo#37266, fdo#39646, fdo#41081, fdo#43149,
      fdo#44843, fdo#45599, fdo#45742, fdo#48743
  - Changes from version 0.26:
    + Build system fixes
    + More tests
    + pkg.m4 fixups which makes autoconf 2.66 happier.
    + Drop support for legacy -config scripts.  Those should already
      be gone and cause problems in cross-compilation environments.
    + Drop embedded glib
    + Fix up pkg.m4 to handle the case of --exists working and
    - -cflags or --libs failing.
    + Various documentation updates
    + Allow $() through without escaping it.
    + Add --with-system-include-path instead of hard-coding
      /usr/include.
  - Pass --with-internal-glib to configure. We don't want to have a
    build cycle with glib, so we use the interal version.
  - Clean up spec-file using spec-cleaner and manually.
  - Drop pkg-config-dnl.patch: fixed upstream.


author: dimstar@opensuse.org
changelog:
  - Update to version 0.27.1:
    + Various fixes for using the internal glib snapshot. It should
      now be usable pretty much everywhere with the exception that
      universal builds are not supported on OS X.
    + Remove usage of gettext from the internal glib to avoid gettext
      and libintl dependencies
    + Update internal glib snapshot to 2.32.4
    + Fix check for POSIX shell used in tests to work better
    + Handle spaces in autodetected prefix on Windows
    + Bugs fixed: fdo#3550, fdo#51883, fdo#52031, fdo#53493.


author: p.drouand@gmail.com
changelog:
  - Update to version 0.28:
    + Fixed a pair of long-standing and intertwined bugs involving
      unwanted removal of flags:
    - Other Libs flags like -Wl are now kept in context order
      with -l flags.
    - Aggressive removal of all duplicate arguments has been scaled
      back so that just consecutive duplicate arguments are
      removed. One result of this change is that some flags could
      be repeated in the final output, especially flags from
      non-pkg-config packages like -lm. Since pkg-config rarely has
      enough knowledge here about the right thing to do, we throw
      the duplicate arguments at the compiler/linker and trust it
      will do the right thing.
    + Fixed an old bug to allow circular Requires. This fix brings
      along a small behavior change in that pkg-config resolves
      requires depth first, causing some lower level flags to show up
      earlier in the output than previously.
    + Cleaned up many corner-case bugs and ambiguous behavior in
      pkg-config's interface.
    + New autoconf macro PKG_CHECK_VAR for reading variables from .pc
      files.
    + Default to suppressing -L/lib and/or -L/lib64 like their /usr
      counterparts.
    + To help support multiarch scenarios out of the box,
      $host-pkg-config is now installed unless --disable-host-tool
      is passed to configure.
    + Added optional gcov usage through the --with-gcov configure
      option. As a result, many more tests were added to greatly
      increase the coverage of the code to 86% of executed lines on a
      Fedora 18 machine.
    + Bugs fixed: fdo#130, fdo#7331, fdo#16101, fdo#17053, fdo#19950,
      fdo#34504, fdo#48098, fdo#54231, fdo#54271, fdo#54379,
      fdo#54384, fdo#54386, fdo#54388, fdo#54389, fdo#54390,
      fdo#54391, fdo#54427, fdo#54463, fdo#54716, fdo#57078,
      fdo#58363, fdo#59435.


author: dvaleev@suse.com
changelog:
  - Don't redefine _arch, but use file pattern instead. This ensures
    we don't have to run fixing each and every arch.


author: zaitor@opensuse.org
changelog:
  - Update to version 0.29:
    + Fixed a regression from 0.28 in system -L flag handling. If the
      pc file has multiple system -L flags, every other flag will be
      left as is (fdo#78077).
    + Quoting of variables queried through --variable is removed so
      that the output can be used verbatim in subsequent shell
      commands (fdo#67904).
    + Fixed a regression from 0.28 in -L flag handling on Windows. A
      .libs suffix was inadvertantly being added to the library path.
    + Added a --validate option to check pc file syntax. This works
      just like --exists, but package dependencies are disabled
      (fdo#7000).
    + Added the PKG_PREREQ autoconf macro. Whereas
      PKG_PROG_PKG_CONFIG is used to check the version of the
      pkg-config tool, this is used to check the version of the
      pkg-config autoconf macros in use.
    + Added the PKG_CHECK_MODULES_STATIC autoconf macro. This will
      temporarily add --static to the pkg-config calls while invoking
      PKG_CHECK_MODULES (fdo#19541).
    + Many fixes to the testsuite for Windows. It should now pass for
      a MinGW, Cygwin, and cross-compiled MinGW using Wine for test
      execution (fdo#66939).
    + More consistent handling of prefix redefinition. On Windows,
      the prefix was always being redefined based on the pc file
      path. This feature can now be enabled or disabled at runtime on
      all platforms using the --define-prefix and
    - -dont-define-prefix options (fdo#63602).
    + Continue listing packages with --list-all even if there are
      errors in pc files (fdo#26615).
    + Various documentation improvements (fdo#62018, fdo#62374,
      fdo#66155).
    + Fixed a bug when multiple -isystem arguments are used
      (fdo#72584).
    + pkg-config is now built with largefile support to ensure that
      it works correctly on filesystems with 64 bit inodes
      (fdo#90078).
    + Bugs fixed: fdo#7000, fdo#19541, fdo#26615, fdo#62018,
      fdo#62374, fdo#63602, fdo#66155, fdo#66939, fdo#67904,
      fdo#70690, fdo#72584, fdo#78077, fdo#80378, fdo#80380,
      fdo#89267, fdo#90078, fdo#90437, fdo#92002.


author: zaitor@opensuse.org
changelog:
  - Update to version 0.29.1:
    + Fixed a regression from 0.29 with unquoting values queried with
    - -variable. In some cases, this would cause shell special
      characters to be escaped in ways they weren't before. Instead,
      the unquoting only occurs if the value appears to be quoted
      (fdo#93284).
    + Add support for building pkg-config with Microsoft Visual
      Studio (fdo#92489).
    + Allow overriding pkg-config variables with environment
      variables. By setting an environment variable of the form
      PKG_CONFIG_$PACKAGE_$VARIABLE, a pkg-config variable can be set
      globally without always having to pass --define-variable
      (fdo#90917).
    + Honor -Wl,-framework in addition to -framework so that multiple
      frameworks are handled on OSX (fdo#1278).
    + Fix the OSX build using --with-internal-glib (fdo#92902).


author: dimstar@opensuse.org
changelog:
  - Update to version 0.29.2:
    + Improved pkg-config's recursive package list expansion
      performance.
    + Handle an empty prefix setting correctly when --define-prefix
      is used (fdo#97453).
    + Lazily load pc files instead of reading all available pc files
      during initialization (fdo#98215).
    + Check the CPATH environment variable when determining system
      include paths like GCC does. Document the system search path
      behavior (fdo#99224).
    + Make PKG_CHECK_MODULES show the module list rather than the
      variable prefix in configure output (fdo#98334).
    + Fix bundled glib build with GCC 6 (fdo#98334).
    + Handle -isystem and -idirafter when PKG_CONFIG_SYSROOT_DIR is
      set (fdo#97337).
    + Check the INCLUDE environment variable when determining system
      include paths on Windows builds when --msvc-syntax is used
      (fdo#94729).
  - Drop pkg-config-gdate-fix.patch: fixed upstream.


author: mwilck@suse.com
changelog:
  - Update to version 15.4.8:
    * Same as Factory version 16.0.14
    * add udev rules from udev-extra-rules (formerly system-tuning-common-SUSE).
      Both packages are now both obsoleted by suse-module-tools.
      (jsc#SLE-21032)
    * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
      (jsc#SLE-21032, bsc#1192161)
    * 60-io-scheduler.rules: use "none" for multipath components
      (bsc#1192161)


author: mwilck@suse.com
changelog:
  - Update to version 15.4.9:
    * same as Factory version 16.0.16
    * modprobe.d: split conf files (jsc#SLE-21626, boo#1193059)
    - Rather than shipping two large files with modprobe.d options
      (00-system.conf and 50-blacklist.conf), ship multiple small
      per-module files. This makes it easier for users to override
      distribution defaults.
    * blacklist isst_if_mbox_msr (bsc#1187196)
    * boot-sysctl: make sure file exists (fix for containers)
    * remove blacklist entry for snd_bt87x (bsc#1192974, bsc#51718)


author: mwilck@suse.com
changelog:
  - Update to version 15.4.10:
    * same as Factory version 16.0.17
    * 60-io-scheduler.rules: add rules for virtual devices
      (boo#1193759)
    * 60-io-scheduler.rules: enforce "none" for loop devices
      (boo#1193759)
    * install some modprobe.d files only for relevant architectures
      (apm_bios, sonypi, toshiba, legacy rtc) (bsc#1192974)


author: mwilck@suse.com
changelog:
  - Update to version 15.4.11:
    * cdrom: Disable autoclose by default (boo#1165047).
    * Make regenerate-initrd-posttrans compatible with Dracut's
      UEFI mode (unified kernel image)


author: mwilck@suse.com
changelog:
  - Update to version 15.4.12:
    * Add /etc/modprobe.d/README on SLE/Leap (bsc#1195051)
    * rpm-script: force-copy kernel to /boot (boo#1194501)


author: mwilck@suse.com
changelog:
  - Update to version 15.4.13:
    * 80-hotplug-cpu-mem.rules: restrict cpu rule to x86_64 (bsc#1204423)


author: mwilck@suse.com
changelog:
  - Update to version 15.4.15: Backport bug fixes from factory
    * driver-check.sh, unblacklist: convert egrep to grep -E (bsc#1203092)
    * kernel-scriptlets: don't pass flags to weak-modules2 (bsc#1195391)
    * driver-check.sh: avoid false positive error messages (boo#1200107)


author: mwilck@suse.com
changelog:
  - Update to version 15.4.17:
    * cert-script: warn only once about non-writable efivarfs
    * cert-script: skip cert handling if efivarfs is not writable
      (bsc#1213428, bsc#1201066)


author: jfehlig@suse.com
changelog:
  - Add system account and groups for kvm, qemu, and libvirt
    (jsc#SLE-11629)
    New files: system-group-kvm.conf, system-group-libvirt.conf,
    system-user-qemu.conf


author: fbui@suse.com
changelog:
  - Add default hardware group for 'sgx' enclave access
    Since udev v248, a default rule for /dev/sgx_enclave is provided to
    give rw access to the new group hopefully making 'sgx' the standard
    group name for such devices. [bsc#1190572]


author: msuchanek@suse.com
changelog:
  - system-user-tss.conf: Remove group entry, not needed and did
    contain syntax errors (bsc#1190401).


author: fbui@suse.com
changelog:
  - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741)
    That way "systemd --user" instances get their own session keyring instead of
    the user default session keyring. For some reasons cifscreds refuses to work
    with the latter. That's what is expected for every PAM session anyway.


author: fbui@suse.com
changelog:
  - Rather than having one script per fix, use a single script (or "fixlet") per
    (sub) package that contains all the fixups relative to a (sub) package. This
    has the advantage to limit the number of scripts but more importantly it will
    ease the sharing of the spec file between TW and SLE. We should also be able
    to compare the fixlets of two distros even if the spec files have diverged.
    Note that all the fixups are run just once now.


author: fbui@suse.com
changelog:
  - Make sure to pre-install the groups systemd and udev rely on. This is needed
    when the tmpfiles are run at package installation time (i.e. when
    file-triggers are disabled).


author: fbui@suse.com
changelog:
  - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14
    3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576)
    6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576)
    37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185)
    02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576)
    412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576)
    16f897570a units: remove the restart limit on the modprobe@.service
    e4e85b08bd tests: add test case for long unit names
    3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194)


author: fbui@suse.com
changelog:
  - Import commit b473c02cc08e093e370034425671cbc001c6748e
    02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target
    70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873)
    e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char*
    c9d3dd5954 udev: set description for device monitor
    3f07f44fde test: use sd_device_monitor_set_description()
    b304a1e1a2 sd-device-monitor: logs description for device monitor
    929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description()
    340e523048 sd-device-monitor: fix inversed condition
    02659c7b67 tree-wide: port various places over to new stat_inode_same() helper
    b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one
    d25219cbe3 libsystemd: ignore both EINTR and EAGAIN
    648a151313 errno-util: introduce ERRNO_IS_TRANSIENT()


author: fbui@suse.com
changelog:
  - Introduce "upstream" branding sub-package
    Installing this branding sub-package is supposed to restore upstream
    defaults by uninstalling all custom drop-ins installed by other
    branding sub-packages.


author: fbui@suse.com
changelog:
  - Import 0.3
    d299248 List drop-in directories in SUSE.list exclusively
    e4651a7 Disable memory accounting by default for all distros (jsc#PM-2229 jsc#PM-2230)


author: fbui@suse.com
changelog:
  - Import 0.4
    a97bb54 Makefile: don't generate the rpm file lists anymore
    5473da6 Makefile: introduce 'archive' target


author: fbui@suse.com
changelog:
  - Import 0.5
    0c5e241 SLE: turn off RemoveIPC by default for logind (fate#320125)
    cb6914f SLE: restore ProtectHostname=no for udevd (bsc#1178374)
    7e332a6 Add a header in all each drop-ins
    465e1c7 Makefile: simplify 'archive' target


author: zren@suse.com
changelog:
  - Enable lvm2-monitor.service by default (bsc#1072492)
  - Enable lvm2-lvmpolld.socket by default (bsc#1074211)


author: kukuk@suse.de
changelog:
  - Enable backup-rpmdb.timer, backup-sysconfig.timer and
    check-battery.timer, previously cron.daily jobs.


author: varkoly@suse.com
changelog:
  - spamassassin: migrate from cron to systemd timers (bsc#1115411)
    enable spamassassin.timer by default


author: jsegitz@suse.com
changelog:
  - Removed ixpdimm-monitor.service and readonly-root.service
    (bsc#1129270)
  - Added snapd.apparmor.service (bsc#1129435)


author: matthias.gerstner@suse.com
changelog:
  Cleanup of outdated autostart services (bsc#1171656):
  - Remove acpid.service. acpid is only available on SLE via openSUSE
    backports.  In openSUSE acpid.service is *not* autostarted. I see no
    reason why it should be on SLE.
  - Remove spamassassin.timer. This timer never seems to have existed.
    Instead spamassassin ships a "sa-update.timer". But it is not
    default-enabled and nobody ever complained about this.
  - Remove snapd.apparmor.service: This service was proactively added a year
    ago, but snapd didn't even make it into openSUSE yet. There's no reason
    to keep this entry unless snapd actually enters SLE which is not
    foreseeable.


author: fvogt@suse.com
changelog:
  - Don't enable btrfsmaintenance-refresh.service, btrfsmaintenance is
    managed by systemd-presets-common-SUSE instead (boo#1165780)


author: fvogt@suse.com
changelog:
  - Enable btrfsmaintenance-refresh.path and disable
    btrfsmaintenance-refresh.service to avoid needless refresh on boot
    (boo#1165780)


author: alarrosa@suse.com
changelog:
  - When installing the systemd-presets-common-SUSE package for the
    first time in a new system, it might happen that some services
    are installed before systemd so the %systemd_pre/post macros
    would not work. This is handled by enabling all preset services
    in this package's %posttrans section but it wasn't enabling
    user services, just system services. Now it enables also the
    user services installed before this package, thus fixing
    boo#1186561


author: alarrosa@suse.com
changelog:
  - Add the wireplumber user service preset to enable it by default
    in SLE15-SP4 where it replaced pipewire-media-session, but keep
    pipewire-media-session preset so we don't have to branch the
    systemd-presets-common-SUSE package for SP4 (boo#1200485)


author: alarrosa@suse.com
changelog:
  - Modify branding-preset-states to fix systemd-presets-common-SUSE
    not enabling new user systemd service preset configuration just
    as it handles system service presets. By passing an (optional)
    second parameter "user", the save/apply-changes commands now
    work with user services instead of system ones (boo#1200485)


author: fbui@suse.com
changelog:
  - Introduce %_systemd_util_dir
    It's a backport of upstream commit 3bc66bfa0136e370a8f7b06c3b69a52f5636ef82.


author: fbui@suse.com
changelog:
  - %sysusers_create_inline was wrongly marked as deprecated
  - %sysusers_create can be useful in certain cases and won't go away until we'll
    move to file triggers. So don't mark it as deprecated too


author: fbui@suse.com
changelog:
  - Make %_modprobedir point to /lib/modprobe.d (bsc#1196275 bsc#1196406)
    Until SLE15-SP3:QU2, /usr/lib/modprobe.d path was not supported by kmod and
    since SLE15-SP4 /etc/modprobe.d/README has references to /lib/modprobe.d...


author: fbui@suse.com
changelog:
  - Don't emit a warning when the flag file in /var/lib/systemd/migrated/ is not
    present as it's expected (bsc#1208079).


author: fbui@suse.com
changelog:
  - Fix %sysctl_apply() and %binfmt_apply() so they are disabled when called from
    a chroot (bsc#1211272)


author: dimstar@opensuse.org
changelog:
  - Bump version up to 3.1. The --replace parameter only appeared in
    systemd 238, so we need to ensure to get the update order correct
    for sysuser-generate when using the 3rd command line parameters:
    * systemd -> sysuser-tools -> system-{user|group}-FOO.
  - Add dependency on systemd >=238 if systemd is installed to
    sysuser-shadow
  - update sysuser_requires to request sysuser-shadow 3.1


author: dcermak@suse.com
changelog:
  - Remove usage of grep from sysusers-generate-pre
  - Add a simple test of sysusers-generate-pre to %check


author: olaf@aepfle.de
changelog:
  - Add "quilt setup" friendly hint to %sysusers_requires usage
    It is not required to have sysuser-tools installed when working
    with a pkg source which uses sysuser-tools at build time.


author: olaf@aepfle.de
changelog:
  - Version 3.2
  - update sysusers_requires to request sysuser-shadow 3.2
  - Use TAB consistently for indention in sysusers2shadow.sh
  - This pkg needs to follow behavior which is described in sysusers.d(5).
    Always create a system group of the same name as the system user,
    even if the user already exists. (bsc#1205161, bsc#1207778, bsc#1213240)


author: tchvatal@suse.com
changelog:
  - Add patch to fix compression level switching
    bsc#1175811 bsc#1175830 bsc#1175831
    * zlib-compression-switching.patch


author: danilo.spinella@suse.com
changelog:
  - Update 410.patch to include new fixes from upstream,
    fixes bsc#1192688
  - Refresh bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch
    to match upstream commit
  - Drop patches which changes have been merged in 410.patch:
    * zlib-compression-switching.patch
    * zlib-390x-z15-fix-hw-compression.patch
    * bsc1174551-fxi-imcomplete-raw-streams.patch


author: sbrabec@suse.com
changelog:
  - Fix heap-based buffer over-read or buffer overflow in inflate via
    large gzip header extra field (bsc#1202175, CVE-2022-37434,
    CVE-2022-37434-extra-header-1.patch,
    CVE-2022-37434-extra-header-2.patch).


author: danilo.spinella@suse.com
changelog:
  - Add DFLTCC support for using inflate() with a small window,
    fixes bsc#1206513
    * bsc1206513.patch


author: idonmez@suse.com
changelog:
  - Update to version 1.4.4
    * perf: Improved decompression speed, by > 10%
    * perf: Better compression speed when re-using a context
    * perf: Fix compression ratio when compressing large files with
      small dictionary
    * perf: zstd reference encoder can generate RLE blocks
    * perf: minor generic speed optimization
    * api: new ability to extract sequences from the parser for analysis
    * api: fixed decoding of magic-less frames
    * api: fixed ZSTD_initCStream_advanced() performance with fast modes
    * cli: Named pipes support
    * cli: short tar's extension support
    * cli: command --output-dir-flat=DIE , generates target files into
      requested directory
    * cli: commands --stream-size=# and --size-hint=#
    * cli: command --exclude-compressed
    * cli: faster -t test mode
    * cli: improved some error messages
    * cli: fix rare deadlock condition within dictionary builder
    * misc: Improved documentation : ZSTD_CLEVEL, DYNAMIC_BMI2,
      ZSTD_CDict, function deprecation, zstd format
    * misc: fixed educational decoder : accept larger literals section,
      and removed UNALIGNED() macro
  - Refresh pzstd.1.patch


author: idonmez@suse.com
changelog:
  - Update to version 1.4.5
    * perf: Improved decompression speed (x64 >+5%, ARM >+15%)
    * perf: Automatically downsizes ZSTD_DCtx when too large for too
    * perf: Improved fast compression speed on aarch64 (#2040, ~+3%)
    * perf: Small level 1 compression speed gains (depending on compiler)
    * fix: Compression ratio regression on huge files (> 3 GB) using high
      levels (--ultra) and multithreading
    * api: ZDICT_finalizeDictionary() is promoted to stable
    * api: new experimental parameter ZSTD_d_stableOutBuffer
    * cli: New --patch-from command, create and apply patches from files
    * cli: --filelist= : Provide a list of files to operate upon from a file
    * cli: -b can now benchmark multiple files in decompression mode
    * cli: New --no-content-size command
    * cli: New --show-default-cparams command
    * misc: new diagnosis tool, checked_flipped_bits, in contrib/
    * misc: Extend largeNbDicts benchmark to compression
    * misc: experimental edit-distance match finder in contrib/


author: bwiedemann@suse.com
changelog:
  - Update to version 1.4.7
    * Improved --long mode
    * --long now automatically enabled for any window size >= 128MB
    * Faster decompression of small blocks
    * CLI improvements
      + accept parameter through environment variable ZSTD_NBTHREADS
      + new command --output-dir-mirror
      + more accurate warning and error messages
    * New experimental features
      + Shared Thread Pool
      + Faster Dictionary Compression
      + New Sequence Ingestion API
    * Drop upstream fix-lib-build.patch


author: bwiedemann@suse.com
changelog:
  - Update to version 1.4.9
    * https://github.com/facebook/zstd/releases/tag/v1.4.9
    * >2x Faster Long Distance Mode
    * New Experimental Decompression Feature: ZSTD_d_refMultipleDDicts
    * bug: Use umask() to Constrain Created File Permissions
    * bug: Make Simple Single-Pass Functions Ignore Advanced Parameters
    * cli: Fix --output-dir-mirror's Rejection of ..-Containing Paths
    * cli: Allow Input From Console When -f/--force is Passed


author: ali.abdallah@suse.com
changelog:
  - Update to version 1.5.0 (jsc#SLE-20392)
    * https://github.com/facebook/zstd/releases/tag/v1.5.0
    * Improved Middle-Level Compression Speed
    * Improved High-Level Compression Ratio
    * Faster Decompression Speed
    * Dynamic Library Supports Multithreading by Default


author: ali.abdallah@suse.com
changelog:
  - Fix CVE-2022-4899, bsc#1209533
    * Fix buffer underflow when dir1 == ""
    * Disallow empty string as an argument for --output-dir-flat=""
    and --output-dir-mirror="".
  - Added patches:
    * Disallow-empty-output-directory.patch
    * Fix-buffer-underflow-for-null-dir1.patch


