# changelog

author: werner@suse.de
changelog:
  - Make clear that blog is split off from sysvinit-tools
  - Avoid to be tagged with GLIBC_PRIVATE
  - Use libblogger.so with version, that is major and minor


author: werner@suse.de
changelog:
  - Do not use privata glibc API (boo#967437) but implement
    missing shared memory mkstemp()
  - Remove patch remove-bad-symbol-use.patch


author: pmladek@suse.com
changelog:
  - hardening of the console list generation (bsc#1071568):
    * libconsole-never-return-empty-list-from-getconsoles.patch
    * libconsole-Really-allow-to-use-dev-console-as-a-fall.patch
    * libconsole-Add-console-into-the-list-only-when-succe.patch
    * libconsole-Correctly-ignore-early-consoles.patch


author: sflees@suse.de
changelog:
  - Fix CVE-2019-12749 Authentication bypass (CVE-2019-12749 bsc#1137832)
    * added fix-CVE-2019-12749.patch


author: sflees@suse.de
changelog:
  - Fix CVE-2020-35512 - shared UID's caused issues (CVE-2020-35512 bsc#1187105)
    * fix-upstream-userdb-constpointer.patch
    * fix-upstream-CVE-2020-35512.patch


author: sflees@suse.de
changelog:
  - Fix CVE-2020-12049 truncated messages lead to resource exhaustion
    (CVE-2020-12049, bsc#1172505)
    * fix-upstream-CVE-2020-12049.patch
  - Rebased fix-CVE-2019-12749.patch


author: sflees@suse.de
changelog:
  - Fix a potential crash that could be triggered by an invalid signature.
    (CVE-2022-42010, bsc#1204111)
    * fix-upstream-CVE-2022-42010.patch
  - Fix an out of bounds read caused by a fixed length array (CVE-2022-42011,
    bsc#1204112)
    * fix-upstream-CVE-2022-42011.patch
  - A message in non-native endianness with out-of-band Unix file descriptors
    would cause a use-after-free and possible memory corruption CVE-2022-42012,
    bsc#1204113)
    * fix-upstream-CVE-2022-42012.patch
  - Disable asserts (bsc#1087072)
  - Refreshed patches
    * fix-upstream-CVE-2020-35512.patch


author: antonio.feijoo@suse.com
changelog:
  - Update to version 049.1+suse.224.gd285ddd8:
    * fix(dracut.spec): change util-linux-systemd version for SLE15-SP2 (bsc#1194162)
    * fix(dracut.spec): require util-linux-systemd (bsc#1194162)
    * fix(url-lib): improve ca-bundle detection (bsc#1175892)


author: antonio.feijoo@suse.com
changelog:
  - Update to version 049.1+suse.228.g07676562:
    * fix(network): consistent use of "$gw" for gateway (bsc#1192685)
    * fix(install): handle builtin modules (bsc#1194716)


author: antonio.feijoo@suse.com
changelog:
  - Update to version 049.1+suse.232.g2ccee559:
    * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508)
    * fix(dracut-functions.sh): ip route parsing (bsc#1195011)


author: antonio.feijoo@suse.com
changelog:
  - Update to version 049.1+suse.234.g902e489c:
    * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967)


author: antonio.feijoo@suse.com
changelog:
  - Update to version 049.1+suse.238.gd8dbb075:
    * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
    * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461)


author: antonio.feijoo@suse.com
changelog:
  - Update to version 049.1+suse.247.gfb7df05c:
    * fix(systemd): add missing modprobe@.service (bsc#1203749)
    * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)
    * fix(drm): consider also drm_dev_register when looking for gpu driver (bsc#1195618)
    * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654)


author: thomas.blume@suse.com
changelog:
  - Update to version 049.1+suse.251.g0b8dad5:
    * fix(dracut.sh): omission is an addition to other omissions in conf files (bsc#1208929)
    * fix(nfs): chown using rpc default group (bsc#1204929)


author: antonio.feijoo@suse.com
changelog:
  - Update to version 049.1+suse.253.g1008bf13:
    * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)


author: antonio.feijoo@suse.com
changelog:
  - Update to version 049.1+suse.255.g19bd61fd:
    * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)


author: antonio.feijoo@suse.com
changelog:
  - Update to version 049.1+suse.257.gf94c3fd1:
    * fix(udev-rules): Correct network device naming (bsc#1192986)


author: mliska@suse.cz
changelog:
  - Add 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch:
    fix .gnu.attributes checking on ppc64{,le}.


author: mliska@suse.cz
changelog:
  - Add 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch
    unconditionally in the spec file. As we can't support binary diff,
    a newly added test-case is removed from the patch.


author: schwab@linux-m68k.org
changelog:
  - ppc-machine-flags.patch: support EM_PPC machine flags
  - disable-tests-with-ptrace.patch: disable more tests


author: jengelh@inai.de
changelog:
  - Update package descriptions.
  - Rename libebl1 to libebl-plugins as these are not linked,
    but dlopened using their unversioned libebl_$ARCH.so name.
  - Have libelf1 require libebl-plugins (libebl.a, which does the
    dlopen call, is staticly built into libelf1). This is necessary
    for pahole to display its results. [boo#1049871]


author: jmoreira@suse.com
changelog:
  - CVE-2017-7613: elfutils: denial of service (memory consumption)
    via a crafted ELF file (bnc#1033090)
    Add patch:
    elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
  - CVE-2017-7612: elfutils: denial of service (heap-based buffer
    over-read and application crash) via a crafted ELF file
    (bnc#1033089)
    Add patch: elfutils-dont-trust-sh_entsize.patch


author: jmoreira@suse.com
changelog:
  - CVE-2018-16402: libelf: denial of service/double free on an
    attempt to decompress the same section twice (bnc#1107066)
    Add patch:
    libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
  - CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the
    function arlib_add_symbols() used by eu-ranlib (bnc#1112723)
    Add patch:
    arlib-check-that-sh_entsize-isnt-zero.patch
  - CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and
    application crash) via a crafted ELF file (bnc#1033088)
    Add patch:
    elflint-check-symbol-table-data-is-big-enough-before-check.patch
  - CVE-2017-7610: elflint: heap-based buffer overflow in check_group
    (bnc#1033087)
    Add patch:
    elflint-dont-check-section-group-without-flags-word.patch
  - CVE-2018-16403: heap buffer overflow in readelf (bnc#1107067)
    Add patch:
    libdw-check-end-of-attributes-list-consistently.patch
  - CVE-2018-16062: heap-buffer-overflow in
    /elfutils/libdw/dwarf_getaranges.c:156 (bnc#1106390)
    Add patch:
    libdw-readelf-make-sure-there-is-enough-data-to-read.patch
  - CVE-2018-18310: Invalid Address Read problem in
    dwfl_segment_report_module.c (bnc#1111973)
    Add patch:
    libdwfl-sanity-check-partial-core-file-data-reads.patch
  - CVE-2019-7150: dwfl_segment_report_module doesn't check whether
    the dyn data read from core file is truncated (bnc#1123685)
    Add patch:
    libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
  - CVE-2019-7665: NT_PLATFORM core file note should be a zero
    terminated string (CVE is a bit misleading, as this is not a bug
    in libelf as described) (bnc#1125007)
    Add patch:
    libebl-check-NT_PLATFORM-core-notes.patch
  - CVE-2017-7609: memory allocation failure in __libelf_decompress
    (bnc#1033086)
    Add patch:
    libelf-check-compression-before-allocate-output-buffer.patch
  - CVE-2018-16402: Double-free crash in nm and readelf (bnc#1107066)
    Add patch:
    libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
  - CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi
    (readelf.c) (bnc#1033084)
    Add patch:
    readelf-fix-off-by-one-sanity-check.patch
  - CVE-2018-18520: eu-size: Bad handling of ar files inside are
    files (bnc#1112726)
    Add patch:
    size-handle-recursive-elf-ar-files.patch
  - CVE-2017-7608: heap-based buffer overflow in
    ebl_object_note_type_name (eblobjnotetypename.c) (bnc#1033085)
    Add patch:
    use-the-empty-string-for-note-names-with-zero-size.patch


author: jengelh@inai.de
changelog:
  - Update package summaries. Replace old RPM constructs.
  - Remove --with-pic which is useless with --disable-static.
  - Edit pre_checkin.sh to remove dead python3 file.


author: werner@suse.de
changelog:
  - Add patch file-a642587a9c.patch for bsc#1096974, bsc#1096984, and
    CVE-2018-10360 -- Avoid reading past the end of buffer


author: werner@suse.de
changelog:
  - Add patch 0002-PR-62-spinpx-limit-size-of-file_printable.patch to
    fix bsc#1126117, bsc#1126118, and bsc#1126119 for CVE-2019-8905,
    CVE-2019-8906, and CVE-2019-8907


author: werner@suse.de
changelog:
  - Add temporary patch CVE-2019-18218-46a8443f.patch from upstream
    to fix bsc#1154661 -- heap-based buffer overflow in cdf_read_property_info in cdf.c


author: werner@suse.de
changelog:
  - Add patchfix_of_backport_PR-62.patch as previous backport caused
    a shorten output of the elf interprter (bsc#1176123)


author: schwab@suse.de
changelog:
  - gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
    ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)


author: schwab@suse.de
changelog:
  - euc-kr-overrun.patch: Fix buffer overrun in EUC-KR conversion module
    (CVE-2019-25013, bsc#1182117, BZ #24973)


author: schwab@suse.de
changelog:
  - wordexp-param-overflow.patch: wordexp: handle overflow in positional
    parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)
  - mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
    (CVE-2021-33574, bsc#1186489, BZ #27896)


author: schwab@suse.de
changelog:
  - iconv-option-parsing.patch: Rewrite iconv option parsing
    (CVE-2016-10228, bsc#1027496, BZ #19519)


author: schwab@suse.de
changelog:
  - always-do-locking-when-iterating-over-list-of-streams.patch: Upstream
    part of fix-locking-in-_IO_cleanup.patch
  - libio-do-not-attempt-to-free-wide-buffers-of-legacy-streams.patch:
    libio: do not attempt to free wide buffers of legacy streams
    (bsc#1183085, BZ #24228)
  - fix-locking-in-_IO_cleanup.patch: rediff


author: schwab@suse.de
changelog:
  - pop-fail-stack.patch: Assertion failure in pop_fail_stack when executing
    a malformed regexp (CVE-2015-8985, bsc#1193625, BZ #21163)


author: schwab@suse.de
changelog:
  - pthread-rwlock-trylock-stalls.patch: nptl: Fix pthread_rwlock_try*lock
    stalls (bsc#1195560, BZ #23844)
  - clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
    for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
  - svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
    (CVE-2022-23218, bsc#1194770, BZ #28768)
  - getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
    (CVE-2021-3999, bsc#1194640, BZ #28769)


author: schwab@suse.de
changelog:
  - gai-merge-continue-actions.patch: Simplify allocations and fix merge and
    continue actions (CVE-2023-4813, bsc#1215286, BZ #28931)


author: schwab@suse.de
changelog:
  - elf-test-have-protected-data.patch: Run vismain only if linker supports
    protected data symbol (bsc#1215505)


author: astieger@suse.com
changelog:
  - gzip 1.10:
    * Compressed gzip output no longer contains the current time as
      a timestamp when the input is not a regular file.  Instead, the
      output contains a null (zero) timestamp.  This makes gzip's
      behavior more reproducible when used as part of a pipeline.
    * A use of uninitialized memory on some malformed inputs has been
      fixed.
    * A few theoretical race conditions in signal handers have been
      fixed.
  - drop upstreamed patches:
    * gnulib-libio.patch
    * gzip-1.8-deprecate_netstat.patch


author: kstreitova@suse.com
changelog:
  - add gzip-1.10-ibm_dfltcc_support.patch [jsc#SLE-5818] [jsc#SLE-8914]
    * it adds support for DFLTCC (hardware-accelerated deflation)
      for s390x arch
    * enable it via "--enable-dfltcc" option


author: kstreitova@suse.com
changelog:
  - refresh gzip-1.10-ibm_dfltcc_support.patch to fix three data
    corruption issues [bsc#1145276] [jsc#SLE-5818] [jsc#SLE-8914]


author: kstreitova@suse.com
changelog:
  - Enable DFLTCC compression for s390x for levels 1-6 (i. e. to make
    it used by default) by adding -DDFLTCC_LEVEL_MASK=0x7e to CLFAGS.
    [jsc#SLE-13775]


author: pgajdos@suse.com
changelog:
  - fix DFLTCC segfault [bsc#1177047]
  - added patches
    fix https://git.savannah.gnu.org/cgit/gzip.git/commit/?id=be0a534ba2b6e77da289de8da79e70843b1028cc
    + gzip-1.10-fix-DFLTCC-segfault.patch


author: danilo.spinella@suse.com
changelog:
  - Fix escaping of malicious filenames (CVE-2022-1271 bsc#1198062)
    * bsc1198062.patch
    * bsc1198062-2.patch


author: fcrozat@suse.com
changelog:
  - Update package url section
  - Update manpage to add bugs section
  - Update code to latest version:
    + fix possible buffer overflows, integer overflows
      (CVE-2011-3630 CVE-2011-3631 CVE-2011-3632)
    + do not allow to hardlink files across filesystems by default
      (rh#786719) (use -f option to override)
    + don't use mmap(2) to avoid failure on u386 with 1GB files or
      larger (rh#672917)


author: jengelh@inai.de
changelog:
  - Create a tarball from git and use that instead of loose files
  - Put the hardlink utility in bindir so that normal users can make
    use of it as well


author: fcrozat@suse.com
changelog:
  - Switch to source service and update git snapshot to e66999f:
    * Make hardlinking atomic wrt replacing existing files
    * Fixed 32 bit build with gcc7 (rh#1422989) (boo#1030251)


author: sbrabec@suse.com
changelog:
  - Version update to 2.0.4:
    * translation updates
    * support for U+202F
    * minor fixes and code cleanup
    * minor improvements and more characters support
  - Enable vlock (bsc#1056449, FATE#261).


author: fbui@suse.com
changelog:
  - Drop from some fill-up templates, a couple of sysconfig variables no
    more read by systemd (fate#319454)
    So the relevant settings can be defined in only one place.


author: sbrabec@suse.com
changelog:
  - Move initial NumLock handling from systemd back to kbd:
    * Add kbdsettings service written by Thomas Blume (boo#1010880,
      kbdsettings, kbdsettings.service, numlockbios.c,
      update sysconfig.console and sysconfig.keyboard).
    * Exclude numlockbios support for non x86 platforms
      (kbdsettings-nox86.patch).
  - Drop references to KEYTABLE and COMPOSETABLE (boo#1010880#c32,
    boo#1010880#c54,  sysconfig.keyboard.del, README.SUSE,
    drop kbd.fillup).
  - Fix paths in kbd.pl.


author: sbrabec@suse.com
changelog:
  - Do not cause error on UNICODE characters >= 0xF000 (e. g.
    ligature fi) (bsc#1085432, kbd-unicode-fxxx.patch).


author: sbrabec@suse.com
changelog:
  - Disable characters >=U+F000. These do not work properly
    (bsc#1085432#c15, kbd-unicode-fxxx.patch).


author: vkarasulli@suse.de
changelog:
  - net: tls: fix possible race condition between
    do_tls_getsockopt_conf() and do_tls_setsockopt_conf()
    (bsc#1209366 CVE-2023-28466).
  - commit 5f7c4a6


author: vkarasulli@suse.de
changelog:
  - kvm: initialize all of the kvm_debugregs structure before
    sending it to userspace (bsc#1209532 CVE-2023-1513).
  - commit bd9c11d


author: ohering@suse.de
changelog:
  - PCI: hv: Add a per-bus mutex state_lock (bsc#1207185).
  - Revert "PCI: hv: Fix a timing issue which causes kdump to fail
    occasionally" (bsc#1207185).
  - PCI: hv: Remove the useless hv_pcichild_state from struct
    hv_pci_dev (bsc#1207185).
  - PCI: hv: Fix a race condition in hv_irq_unmask() that can
    cause panic (bsc#1207185).
  - PCI: hv: fix a race condition bug in hv_pci_query_relations()
    (bsc#1207185).
  - commit 2555bc7


author: mkubecek@suse.cz
changelog:
  - net/ulp: use consistent error code when blocking ULP
    (CVE-2023-0461 bsc#1208787).
  - net/ulp: prevent ULP without clone op from entering the LISTEN
    status (CVE-2023-0461 bsc#1208787).
  - commit 028f0fd


author: mkubecek@suse.cz
changelog:
  - series.conf: cleanup
  - update upstream references and resort:
    - patches.suse/wifi-cfg80211-avoid-nontransmitted-BSS-list-corrupti.patch
  - commit 9bae747


author: jlee@suse.com
changelog:
  - kobject: Fix slab-out-of-bounds in fill_kobj_path() (bsc#1216058
    CVE-2023-45863).
  - commit 1b6a097


author: fcrozat@suse.com
changelog:
  - Ensure ia32_emulation is always enabled for kernel-obs-build
    If ia32_emulation is disabled by default, ensure it is enabled
    back for OBS kernel to allow building 32bit binaries (jsc#PED-3184)
    [ms: Always pass the parameter, no need to grep through the config which
    may not be very reliable]
  - commit 56a2c2f


author: bwiedemann@suse.de
changelog:
  - Do not store build host name in initrd
    Without this patch, kernel-obs-build stored the build host name
    in its .build.initrd.kvm
    This patch allows for reproducible builds of kernel-obs-build and thus
    avoids re-publishing the kernel-obs-build.rpm when nothing changed.
    Note that this has no influence on the /etc/hosts file
    that is used during other OBS builds.
    https://bugzilla.opensuse.org/show_bug.cgi?id=1084909
  - commit fd3a75e


author: jslaby@suse.cz
changelog:
  - README.SUSE: fix patches.addon use
    It's series, not series.conf in there.
    And make it more precise on when the patches are applied.
  - commit cb8969c


author: denis.kirjanov@suse.com
changelog:
  - net/tls: do not free tls_rec on async operation in
    bpf_exec_tx_verdict() (bsc#1217332 CVE-2023-6176).
  - commit 20678d9


author: msuchanek@suse.de
changelog:
  - kernel-binary: suse-module-tools is also required when installed
    Requires(pre) adds dependency for the specific sciptlet.
    However, suse-module-tools also ships modprobe.d files which may be
    needed at posttrans time or any time the kernel is on the system for
    generating ramdisk. Add plain Requires as well.
  - commit 8c12816


author: mkubecek@suse.cz
changelog:
  - netfilter: conntrack: dccp: copy entire header to stack buffer,
    not just basic one (CVE-2023-39197 bsc#1216976).
  - commit 5e51ad1


author: tbogendoerfer@suse.de
changelog:
  - net: mana: Configure hwc timeout from hardware (bsc#1214037).
  - net: mana: Fix MANA VF unload when hardware is unresponsive
    (bsc#1214764).
  - commit 5ea585b


author: msuchanek@suse.com
changelog:
  - Fix resolving .TOC. in modules on 4.4 and older kernel (bsc#1070209)
    depmod-Don-t-add-.TOC.-when-it-s-in-the-kernel.patch


author: msuchanek@suse.com
changelog:
  - Update to kmod v25
    * Fix resolving symbols with MODULE_REL_CRCS (bsc#1077867)
  - Drop depmod-Don-t-add-.TOC.-when-it-s-in-the-kernel.patch


author: msuchanek@suse.com
changelog:
  - Fix PKCS#7 signature display in modinfo (bsc#1077693).
    * Add libkmod-signature-implement-pkcs7-parsing-with-asn1c.patch
    * Add libkmod-signature-Fix-crash-when-module-signature-is.patch
    * Refresh 0010-modprobe-Implement-allow-unsupported-modules.patch


author: ro@suse.de
changelog:
  - for sle, buildexclude the 32bit platforms in kmod-testsuite,
    they have no kernel binaries anyway (bnc#1085640)


author: msuchanek@suse.com
changelog:
  - Fix crash when PKCS#7 signer name is not present in signature (bsc#1088244)
    Add libkmod-signature-pkcs-7-fix-crash-when-signer-info-.patch


author: vlad.botanic@gmail.com
changelog:
  - allow 'modprobe -c' print the status of "allow_unsupported_modules" option.
    Add 0012-modprobe-print-unsupported-status.patch


author: msuchanek@suse.de
changelog:
  - Fix module dependency file corruption on parallel invocation (bsc#1118629).
    * Add depmod-Prevent-module-dependency-files-corruption-du.patch
    * Add depmod-Prevent-module-dependency-files-missing-durin.patch
    * Add depmod-shut-up-gcc-insufficinet-buffer-warning.patch


author: suse-beta@cboltz.de
changelog:
  - update to AppArmor 2.11.1
    - mostly test-related changes in libapparmor
    - see http://wiki.apparmor.net/index.php/ReleaseNotes_2_11_1 for
      upstream changelog


author: suse-beta@cboltz.de
changelog:
  - update to AppArmor 2.11.95 aka 2.12 beta1
    - no changes in libapparmor
    - see http://wiki.apparmor.net/index.php/ReleaseNotes_2_11_95
      for the detailed upstream changelog


author: suse-beta@cboltz.de
changelog:
  - update to AppArmor 2.12
    - preserve errno across aa_*_unref() functions
    - see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.12
      for the detailed upstream changelog
  - no longer package static libapparmor.a


author: suse-beta@cboltz.de
changelog:
  - update to AppArmor 2.13
    - add support for multiple cache directories and cache overlays
      (boo#1069906, boo#1074429)
    - see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.13
      for the detailed upstream changelog


author: suse-beta@cboltz.de
changelog:
  - update to AppArmor 2.13.1
    - several bug fixes
    - see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.13.1
      for the detailed upstream changelog


author: suse-beta@cboltz.de
changelog:
  - update to AppArmor 2.13.2
    - no changes in libapparmor
    - see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.13.2
      for the detailed upstream changelog


author: suse-beta@cboltz.de
changelog:
  - update to AppArmor 2.13.1
    - some fixes in cache handling
    - see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.13.3
      for the detailed upstream changelog


author: suse-beta@cboltz.de
changelog:
  - update to AppArmor 2.13.4
    - fix log parsing for logs with an embedded newline
    - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
      for the detailed upstream changelog


author: lnussel@suse.de
changelog:
  - Update to version 0.0+git20171227.670229c:
    * Added ABI version number
    * AVX2/AVX-512F optimizations of BLAMKA
    * Set Argon2 version number from the command line
    * New bindings
    * Minor bug and warning fixes (no security issue)
  - use _service file


author: alexander_naumov@opensuse.org
changelog:
  - Update to version 1.7.2:
    * Update LUKS documentation format.
      Clarify fixed sector size and keyslots alignment.
    * Support activation options for error handling modes in
      Linux kernel dm-verity module:
    - -ignore-corruption - dm-verity just logs detected corruption
    - -restart-on-corruption - dm-verity restarts the kernel if
      corruption is detected
      If the options above are not specified, default behavior for
      dm-verity remains. Default is that I/O operation fails with
      I/O error if corrupted block is detected.
    - -ignore-zero-blocks - Instructs dm-verity to not verify
      blocks that are expected to contain zeroes and always
      return zeroes directly instead.
      NOTE that these options could have security or functional
      impacts, do not use them without assessing the risks!
    * Fix help text for cipher benchmark specification
      (mention --cipher option).
    * Fix off-by-one error in maximum keyfile size.
      Allow keyfiles up to compiled-in default and not that value
      minus one.
    * Support resume of interrupted decryption in cryptsetup-reencrypt
      utility. To resume decryption, LUKS device UUID (--uuid option)
      option must be used.
    * Do not use direct-io for LUKS header with unaligned keyslots.
      Such headers were used only by the first cryptsetup-luks-1.0.0
      release (2005).
    * Fix device block size detection to properly work on particular
      file-based containers over underlying devices with 4k sectors.
  - Update to version 1.7.1:
    * Code now uses kernel crypto API backend according to new
      changes introduced in mainline kernel
      While mainline kernel should contain backward compatible
      changes, some stable series kernels do not contain fully
      backported compatibility patches.
      Without these patches  most of cryptsetup operations
      (like unlocking device) fail.
      This change in cryptsetup ensures that all operations using
      kernel crypto API works even on these kernels.
    * The cryptsetup-reencrypt utility now properly detects removal
      of underlying link to block device and does not remove
      ongoing re-encryption log.
      This allows proper recovery (resume) of reencrypt operation later.
      NOTE: Never use /dev/disk/by-uuid/ path for reencryption utility,
      this link disappears once the device metadata is temporarily
      removed from device.
    * Cryptsetup now allows special "-" (standard input) keyfile handling
      even for TCRYPT (TrueCrypt and VeraCrypt compatible) devices.
    * Cryptsetup now fails if there are more keyfiles specified
      for non-TCRYPT device.
    * The luksKillSlot command now does not suppress provided password
      in batch mode (if password is wrong slot is not destroyed).
      Note that not providing password in batch mode means that keyslot
      is destroyed unconditionally.


author: mpluskal@suse.com
changelog:
  - Update to version 1.7.4:
    * Allow to specify LUKS1 hash algorithm in Python luksFormat
      wrapper.
    * Use LUKS1 compiled-in defaults also in Python wrapper.
    * OpenSSL backend: Fix OpenSSL 1.1.0 support without backward
      compatible API.
    * OpenSSL backend: Fix LibreSSL compatibility.
    * Check for data device and hash device area overlap in
      veritysetup.
    * Fix a possible race while allocating a free loop device.
    * Fix possible file descriptor leaks if libcryptsetup is run from
      a forked process.
    * Fix missing same_cpu_crypt flag in status command.
    * Various updates to FAQ and man pages.
  - Changes for version 1.7.3:
    * Fix device access to hash offsets located beyond the 2GB device
      boundary in veritysetup.
    * Set configured (compile-time) default iteration time for
      devices created directly through libcryptsetup
    * Fix PBKDF2 benchmark to not double iteration count for specific
      corner case.
    * Verify passphrase in cryptsetup-reencrypt when encrypting a new
      drive.
    * OpenSSL backend: fix memory leak if hash context was repeatedly
      reused.
    * OpenSSL backend: add support for OpenSSL 1.1.0.
    * Fix several minor spelling errors.
    * Properly check maximal buffer size when parsing UUID from
      /dev/disk/.


author: mpluskal@suse.com
changelog:
  - Update to version 1.7.5:
    * Fixes to luksFormat to properly support recent kernel running
      in FIPS mode (bsc#1031998).
    * Fixes accesses to unaligned hidden legacy TrueCrypt header.
    * Fixes to optional dracut ramdisk scripts for offline
      re-encryption on initial boot.


author: archie.cobbs@gmail.com
changelog:
  - Update to version 2.0.0:
    * Add support for new on-disk LUKS2 format
    * Enable to use system libargon2 instead of bundled version
    * Install tmpfiles.d configuration for LUKS2 locking directory
    * New command integritysetup: support for the new dm-integrity kernel target
    * Support for larger sector sizes for crypt devices
    * Miscellaneous fixes and improvements


author: astieger@suse.com
changelog:
  - update to 2.0.1:
    * To store volume key into kernel keyring, kernel 4.15 with
      dm-crypt 1.18.1 is required
    * Increase maximum allowed PBKDF memory-cost limit to 4 GiB
    * Use /run/cryptsetup as default for cryptsetup locking dir
    * Introduce new 64-bit byte-offset *keyfile_device_offset functions.
    * New set of fucntions that allows 64-bit offsets even on 32bit systems
      are now availeble:
    - crypt_resume_by_keyfile_device_offset
    - crypt_keyslot_add_by_keyfile_device_offset
    - crypt_activate_by_keyfile_device_offset
    - crypt_keyfile_device_read
      The new functions have added the _device_ in name.
      Old functions are just internal wrappers around these.
    * Also cryptsetup --keyfile-offset and --new-keyfile-offset now
      allows 64-bit offsets as parameters.
    * Add error hint for wrongly formatted cipher strings in LUKS1 and
      properly fail in luksFormat if cipher format is missing required IV.


author: lnussel@suse.de
changelog:
  - New version 2.0.4
    Changes since version 2.0.3
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~
    * Use the libblkid (blockid) library to detect foreign signatures
      on a device before LUKS format and LUKS2 auto-recovery.
      This change fixes an unexpected recovery using the secondary
      LUKS2 header after a device was already overwritten with
      another format (filesystem or LVM physical volume).
      LUKS2 will not recreate a primary header if it detects a valid
      foreign signature. In this situation, a user must always
      use cryptsetup repair command for the recovery.
      Note that libcryptsetup and utilities are now linked to libblkid
      as a new dependence.
      To compile code without blockid support (strongly discouraged),
      use --disable-blkid configure switch.
    * Add prompt for format and repair actions in cryptsetup and
      integritysetup if foreign signatures are detected on the device
      through the blockid library.
      After the confirmation, all known signatures are then wiped as
      part of the format or repair procedure.
    * Print consistent verbose message about keyslot and token numbers.
      For keyslot actions: Key slot <number> unlocked/created/removed.
      For token actions: Token <number> created/removed.
    * Print error, if a non-existent token is tried to be removed.
    * Add support for LUKS2 token definition export and import.
      The token command now can export/import customized token JSON file
      directly from command line. See the man page for more details.
    * Add support for new dm-integrity superblock version 2.
    * Add an error message when nothing was read from a key file.
    * Update cryptsetup man pages, including --type option usage.
    * Add a snapshot of LUKS2 format specification to documentation
      and accordingly fix supported secondary header offsets.
    * Add bundled optimized Argon2 SSE (X86_64 platform) code.
      If the bundled Argon2 code is used and the new configure switch
    - -enable-internal-sse-argon2 option is present, and compiler flags
      support required optimization, the code will try to use optimized
      and faster variant.
      Always use the shared library (--enable-libargon2) if possible.
      This option was added because an enterprise distribution
      rejected to support the shared Argon2 library and native support
      in generic cryptographic libraries is not ready yet.
    * Fix compilation with crypto backend for LibreSSL >= 2.7.0.
      LibreSSL introduced OpenSSL 1.1.x API functions, so compatibility
      wrapper must be commented out.
    * Fix on-disk header size calculation for LUKS2 format if a specific
      data alignment is requested. Until now, the code used default size
      that could be wrong for converted devices.
    Changes since version 2.0.2
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~
    * Expose interface to unbound LUKS2 keyslots.
      Unbound LUKS2 keyslot allows storing a key material that is independent
      of master volume key (it is not bound to encrypted data segment).
    * New API extensions for unbound keyslots (LUKS2 only)
      crypt_keyslot_get_key_size() and crypt_volume_key_get()
      These functions allow to get key and key size for unbound keyslots.
    * New enum value CRYPT_SLOT_UNBOUND for keyslot status (LUKS2 only).
    * Add --unbound keyslot option to the cryptsetup luksAddKey command.
    * Add crypt_get_active_integrity_failures() call to get integrity
      failure count for dm-integrity devices.
    * Add crypt_get_pbkdf_default() function to get per-type PBKDF default
      setting.
    * Add new flag to crypt_keyslot_add_by_key() to force update device
      volume key. This call is mainly intended for a wrapped key change.
    * Allow volume key store in a file with cryptsetup.
      The --dump-master-key together with --master-key-file allows cryptsetup
      to store the binary volume key to a file instead of standard output.
    * Add support detached header for cryptsetup-reencrypt command.
    * Fix VeraCrypt PIM handling - use proper iterations count formula
      for PBKDF2-SHA512 and PBKDF2-Whirlpool used in system volumes.
    * Fix cryptsetup tcryptDump for VeraCrypt PIM (support --veracrypt-pim).
    * Add --with-default-luks-format configure time option.
      (Option to override default LUKS format version.)
    * Fix LUKS version conversion for detached (and trimmed) LUKS headers.
    * Add luksConvertKey cryptsetup command that converts specific keyslot
      from one PBKDF to another.
    * Do not allow conversion to LUKS2 if LUKSMETA (external tool metadata)
      header is detected.
    * More cleanup and hardening of LUKS2 keyslot specific validation options.
      Add more checks for cipher validity before writing metadata on-disk.
    * Do not allow LUKS1 version downconversion if the header contains tokens.
    * Add "paes" family ciphers (AES wrapped key scheme for mainframes)
      to allowed ciphers.
      Specific wrapped ley configuration logic must be done by 3rd party tool,
      LUKS2 stores only keyslot material and allow activation of the device.
    * Add support for --check-at-most-once option (kernel 4.17) to veritysetup.
      This flag can be dangerous; if you can control underlying device
      (you can change its content after it was verified) it will no longer
      prevent reading tampered data and also it does not prevent silent
      data corruptions that appear after the block was once read.
    * Fix return code (EPERM instead of EINVAL) and retry count for bad
      passphrase on non-tty input.
    * Enable support for FEC decoding in veritysetup to check dm-verity devices
      with additional Reed-Solomon code in userspace (verify command).
    Changes since version 2.0.1
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~
    * Fix a regression in early detection of inactive keyslot for luksKillSlot.
      It tried to ask for passphrase even for already erased keyslot.
    * Fix a regression in loopaesOpen processing for keyfile on standard input.
      Use of "-" argument was not working properly.
    * Add LUKS2 specific options for cryptsetup-reencrypt.
      Tokens and persistent flags are now transferred during reencryption;
      change of PBKDF keyslot parameters is now supported and allows
      to set precalculated values (no benchmarks).
    * Do not allow LUKS2 --persistent and --test-passphrase cryptsetup flags
      combination. Persistent flags are now stored only if the device was
      successfully activated with the specified flags.
    * Fix integritysetup format after recent Linux kernel changes that
      requires to setup key for HMAC in all cases.
      Previously integritysetup allowed HMAC with zero key that behaves
      like a plain hash.
    * Fix VeraCrypt PIM handling that modified internal iteration counts
      even for subsequent activations. The PIM count is no longer printed
      in debug log as it is sensitive information.
      Also, the code now skips legacy TrueCrypt algorithms if a PIM
      is specified (they cannot be used with PIM anyway).
    * PBKDF values cannot be set (even with force parameters) below
      hardcoded minimums. For PBKDF2 is it 1000 iterations, for Argon2
      it is 4 iterations and 32 KiB of memory cost.
    * Introduce new crypt_token_is_assigned() API function for reporting
      the binding between token and keyslots.
    * Allow crypt_token_json_set() API function to create internal token types.
      Do not allow unknown fields in internal token objects.
    * Print message in cryptsetup that about was aborted if a user did not
      answer YES in a query.


author: lnussel@suse.de
changelog:
  - Suggest hmac package (boo#1090768)
  - remove old upgrade hack for upgrades from 12.1
  - New version 2.0.5
    Changes since version 2.0.4
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~
    * Wipe full header areas (including unused) during LUKS format.
      Since this version, the whole area up to the data offset is zeroed,
      and subsequently, all keyslots areas are wiped with random data.
      This ensures that no remaining old data remains in the LUKS header
      areas, but it could slow down format operation on some devices.
      Previously only first 4k (or 32k for LUKS2) and the used keyslot
      was overwritten in the format operation.
    * Several fixes to error messages that were unintentionally replaced
      in previous versions with a silent exit code.
      More descriptive error messages were added, including error
      messages if
    - a device is unusable (not a block device, no access, etc.),
    - a LUKS device is not detected,
    - LUKS header load code detects unsupported version,
    - a keyslot decryption fails (also happens in the cipher check),
    - converting an inactive keyslot.
    * Device activation fails if data area overlaps with LUKS header.
    * Code now uses explicit_bzero to wipe memory if available
      (instead of own implementation).
    * Additional VeraCrypt modes are now supported, including Camellia
      and Kuznyechik symmetric ciphers (and cipher chains) and Streebog
      hash function. These were introduced in a recent VeraCrypt upstream.
      Note that Kuznyechik requires out-of-tree kernel module and
      Streebog hash function is available only with the gcrypt cryptographic
      backend for now.
    * Fixes static build for integritysetup if the pwquality library is used.
    * Allows passphrase change for unbound keyslots.
    * Fixes removed keyslot number in verbose message for luksKillSlot,
      luksRemoveKey and erase command.
    * Adds blkid scan when attempting to open a plain device and warn the user
      about existing device signatures in a ciphertext device.
    * Remove LUKS header signature if luksFormat fails to add the first keyslot.
    * Remove O_SYNC from device open and use fsync() to speed up
      wipe operation considerably.
    * Create --master-key-file in luksDump and fail if the file already exists.
    * Fixes a bug when LUKS2 authenticated encryption with a detached header
      wiped the header device instead of dm-integrity data device area (causing
      unnecessary LUKS2 header auto recovery).


author: lnussel@suse.de
changelog:
  - New version 2.0.6 (jsc#SLE-5911, bsc#1165580):
    Changes since version 2.0.5
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~
    * Fix support of larger metadata areas in LUKS2 header.
      This release properly supports all specified metadata areas, as documented
      in LUKS2 format description (see docs/on-disk-format-luks2.pdf in archive).
      Currently, only default metadata area size is used (in format or convert).
      Later cryptsetup versions will allow increasing this metadata area size.
    * If AEAD (authenticated encryption) is used, cryptsetup now tries to check
      if the requested AEAD algorithm with specified key size is available
      in kernel crypto API.
      This change avoids formatting a device that cannot be later activated.
      For this function, the kernel must be compiled with the
      CONFIG_CRYPTO_USER_API_AEAD option enabled.
      Note that kernel user crypto API options (CONFIG_CRYPTO_USER_API and
      CONFIG_CRYPTO_USER_API_SKCIPHER) are already mandatory for LUKS2.
    * Fix setting of integrity no-journal flag.
      Now you can store this flag to metadata using --persistent option.
    * Fix cryptsetup-reencrypt to not keep temporary reencryption headers
      if interrupted during initial password prompt.
    * Adds early check to plain and LUKS2 formats to disallow device format
      if device size is not aligned to requested sector size.
      Previously it was possible, and the device was rejected to activate by
      kernel later.
    * Fix checking of hash algorithms availability for PBKDF early.
      Previously LUKS2 format allowed non-existent hash algorithm with
      invalid keyslot preventing the device from activation.
    * Allow Adiantum cipher construction (a non-authenticated length-preserving
      fast encryption scheme), so it can be used both for data encryption and
      keyslot encryption in LUKS1/2 devices.
      For benchmark, use:
      [#] cryptsetup benchmark -c xchacha12,aes-adiantum
      [#] cryptsetup benchmark -c xchacha20,aes-adiantum
      For LUKS format:
      [#] cryptsetup luksFormat -c xchacha20,aes-adiantum-plain64 -s 256 <device>
      The support for Adiantum will be merged in Linux kernel 4.21.
      For more info see the paper https://eprint.iacr.org/2018/720.


author: pmonreal@suse.com
changelog:
  - luksFormat: Handle system with low memory and no swap space [bsc#1211079]
    * Check for physical memory available also in PBKDF benchmark.
    * Try to avoid OOM killer on low-memory systems without swap.
    * Use only half of detected free memory on systems without swap.
    * Add patches:
    - cryptsetup-Check-for-physical-memory-available-also-in-PBKDF-be.patch
    - cryptsetup-Try-to-avoid-OOM-killer-on-low-memory-systems-withou.patch
    - cryptsetup-Use-only-half-of-detected-free-memory-on-systems-wit.patch


author: ghe@suse.com
changelog:
  - Add metadata-based autoactivation property for VG and LV (bsc#1178680)
    + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch


author: heming.zhao@suse.com
changelog:
  - LVM cannot be disabled on boot (bsc#1184687)
    + bug-1184687_Add-nolvm-for-kernel-cmdline.patch
  - Update patch for avoiding apply warning message
    + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch


author: heming.zhao@suse.com
changelog:
  - Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190)
    + bug-1185190_01-pvscan-support-disabled-event_activation.patch
    + bug-1185190_02-config-improve-description-for-event_activation.patch


author: wolfgang.frisch@suse.com
changelog:
  - Link test as position independent executable (bsc#1184124).
    + bug-1184124-link-tests-as-PIE.patch


author: heming.zhao@suse.com
changelog:
  - vgextend crash when extending VG with missing PV (bsc#1191019)
    + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch


author: heming.zhao@suse.com
changelog:
  - starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905)
    + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch
  - LVM vgimportclone on hardware snapshot does not work (bsc#1193181)
    + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch


author: mwilck@suse.com
changelog:
  - udev: create symlinks and watch even in suspended state (bsc#1195231)
    + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch


author: heming.zhao@suse.com
changelog:
  - lvm2.spec %post deletes libdevmapper and triggers kernel panic (bsc#1198523)
    - change %post behaviour, only do deleting job for non-link folder


author: heming.zhao@suse.com
changelog:
  - dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074)
    - in lvm2.spec, change device_mapper_version from 1.02.163 to %{lvm2_version}_1.02.163


author: amit.chaudhary@suse.com
changelog:
  - killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216)
    - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch


author: bruno@ioda-net.ch
changelog:
  - Update to 0.10 version :
    * Add a json_object_to_json_string_ext() function to allow output
    to be formatted in a more human readable form.
    * Add json_object_object_get_ex(), a NULL-safe get object method,
    to be able to distinguish between a key not present and the value
    being NULL.
    * Add an alternative iterator implementation, see json_object_iterator.h
    * Make json_object_iter public to enable external use of the
      json_object_object_foreachC macro.
    * Add a printbuf_memset() function to provide an effecient way to set and
      append things like whitespace indentation.
    * Adjust json_object_is_type and json_object_get_type so they return
      json_type_null for NULL objects and handle NULL passed to
      json_objct_object_get().
    * Rename boolean type to json_bool.
    * Fix various compile issues for Visual Studio and MinGW.
    * Allow json_tokener_parse_ex() to be re-used to parse multiple object.
      Also, fix some parsing issues with capitalized hexadecimal numbers and
      number in E notation.
    * Add json_tokener_get_error() and json_tokener_error_desc() to better
      encapsulate the process of retrieving errors while parsing.
    * Various improvements to the documentation of many functions.
    * Add new json_object_array_sort() function.
    * Fix a bug in json_object_get_int(), which would incorrectly return 0
      when called on a string type object.
      Eric Haszlakiewicz
    * Add a json_type_to_name() function.
      Eric Haszlakiewicz
    * Add a json_tokener_parse_verbose() function.
      Jehiah Czebotar
    * Improve support for null bytes within JSON strings.
      Jehiah Czebotar
    * Fix file descriptor leak if memory allocation fails in json_util
      Zachary Blair, zack_blair at hotmail dot com
    * Add int64 support. Two new functions json_object_net_int64 and
      json_object_get_int64. Binary compatibility preserved.
      Eric Haszlakiewicz, EHASZLA at transunion com
      Rui Miguel Silva Seabra, rms at 1407 dot org
    * Fix subtle bug in linkhash where lookup could hang after all slots
      were filled then successively freed.
      Spotted by Jean-Marc Naud, j dash m at newtraxtech dot com
    * Make json_object_from_file take const char *filename
      Spotted by Vikram Raj V, vsagar at attinteractive dot com
    * Add handling of surrogate pairs (json_tokener.c, test4.c, Makefile.am)
      Brent Miller, bdmiller at yahoo dash inc dot com
    * Correction to comment describing printbuf_memappend in printbuf.h
      Brent Miller, bdmiller at yahoo dash inc dot com
  - Packaging :
    * upgrade upstream location https://gitub.com/json-c/json-c/wiki
    * cleanup old patches included now upstream
    . json-c-0.9-linkhash.patch
    . json-c-0.9-json_tokener.patch
    . json-c-0.9-json_object_from_file.patch
    . json-c-0.9-base.patch
    * Redone lfs patch against new 0.10 release
    * Removed empty NEWS file


author: fstrba@suse.com
changelog:
  - Upgrade to 0.11 version:
    - SONAME change.
    - Fix provides and obsoletes accordingly
    - symlink the .pc file to the oldname for software that needs it
  - Remove json-c-fix-headers.patch integrated upstream


author: idonmez@suse.com
changelog:
  - Add json-c-hash-dos-and-overflow-random-seed-4e.patch to fix
    CVE-2013-6370 and CVE-2013-6371 (bnc#870147)


author: andreas.stieger@gmx.de
changelog:
  - json-c 0.12
    Fixes for security issues contained in this release have been
    previously patched into this package, but listed for completeness:
    * Address security issues:
    * CVE-2013-6371: hash collision denial of service
    * CVE-2013-6370: buffer overflow if size_t is larger than int
  - Further changes:
    * Avoid potential overflow in json_object_get_double
    * Eliminate the mc_abort() function and MC_ABORT macro.
    * Make the json_tokener_errors array local.  It has been deprecated for
      a while, and json_tokener_error_desc() should be used instead.
    * change the floating point output format to %.17g so values with
      more than 6 digits show up in the output.
    * Remove the old libjson.so name compatibility support.  The library is
      only created as libjson-c.so now and headers are only installed
      into the ${prefix}/json-c directory.
    * When supported by the linker, add the -Bsymbolic-functions flag.
    * Make strict mode more strict:
    * number must not start with 0
    * no single-quote strings
    * no comments
    * trailing char not allowed
    * only allow lowercase literals
    * Added a json_object_new_double_s() convenience function to allow
      an exact string representation of a double to be specified when
      creating the object and use it in json_tokener_parse_ex() so
      a re-serialized object more exactly matches the input.
    * Add support NaN and Infinity
  - packaging changes:
    * json-c-hash-dos-and-overflow-random-seed-4e.patch is upstream
    * Move from json-c-lfs.patch which removed warning errors and
      autoconf call to json-c-0.12-unused_variable_size.patch from
      upstream which fixes the warning
    * except for SLE 11 where autoreconf call is required
    * add licence file to main package


author: rpm@fthiessen.de
changelog:
  - Update to upstream release 0.12.1
  - Removed upstream fixed json-c-0.12-unused_variable_size.patch
  - Added fix-set-but-not-used.patch


author: avindra@opensuse.org
changelog:
  - json-c 0.13
    + Deprecated and removed features:
    * Internal use of bits.h has been eliminated.
    * lh_abort() is deprecated
    + Behavior changes:
    * Tighten the number parsing algorithm to raise errors instead
      of truncating the results.  For example 12.3.4 or 2015-01-15,
      which now return null.
    * Use size_t for array length and size. Platforms where
      sizeof(size_t) != sizeof(int) may not be backwards compatible
    * Check for failue when allocating memory, returning NULL and
      errno=ENOMEM.
    * Change json_object_object_add() return type from void to int,
      and will return -1 on failures, instead of exiting. (Note:
      this is not an ABI change)
    + New features:
    * Aiming to follow RFC 7159 now.
    * Support for JSON pointer, RFC 6901 (see json_pointer.h)
    * Add a couple of additional option to json_object_to_json_string_ext:
    JSON_C_TO_STRING_PRETTY_TAB
    JSON_C_TO_STRING_NOSLASHESCAPE
    * json_object_object_add_ex() - better perf when certain
      constraints are known to be true
    * Serialization format of doubles now configurable
    * New functions
    - json_object_equal() - utility function for comparing
      json_objects
    - json_object_deep_copy() - a way to copy entire object
      trees
    - json_object_set_<type>() - modify the value of
      existing json_object's without the need to recreate them.
    Also add a json_object_int_inc function to adjust an int's'
    value.
    - json_util_get_last_err() - retrieve the string describing
      the cause of errors, instead of printing to stderr.
    - perllike hash function for strings
    * json_global_set_string_hash()
    * json_c_visit() - a way to iterate over a tree of json-c
      objects.
    + Notable bug fixes and other improvements:
    * Make reference increment and decrement atomic to allow
      passing json objects between threads.
    * Fix json_object_object_foreach to avoid uninitialized
      variable warnings.
    * Improve performance by removing unneeded data items from
      hashtable code and reducing duplicate hash computation.
    * Performance: store small strings inside json_object
    * Performance: of json_object_to_json_string by removing
      variadic printf
    * Fix parsing of "-Infinity", and avoid needlessly copying the
      input when doing so.
    * Fix stack buffer overflow in json_object_double_to_json_string_format()
    * Fix various potential null ptr deref and int32 overflows
    * Fix a long-standing bug in array_list_put_idx() where it
      would attempt to free previously free'd entries due to not
      checking the current array length.
    * use uselocale() instead of setlocale() in json_tokener to
      behave better in threaded environments.
    * Fix out of bounds read when handling unicode surrogate pairs.
    * Ensure doubles that happen to be a whole number are emitted
      with ".0"
    * Visual Studio: use a snprintf/vsnprintf wrapper that ensures
      the string is terminated.
    * Fix double to int cast overflow in json_object_get_int64.
    * Clamp double to int32 when narrowing in json_object_get_int.
    * Use strtoll() to parse ints - instead of sscanf
    * usual code linting
    + Build changes:
    * Add Appveyor and Travis build support
    * Support for MacOS and Windows through CMake
    * Silent build by default
    * Link against libm when needed
    * Add support for building with AddressSanitizer
    * Add support for building with Clang
    * Add a --enable-threading configure option, and only use the
      (slower) __sync_add_and_fetch()/__sync_sub_and_fetch()
      function when it is specified.
  - cleanup with spec-cleaner
  - remove fix-set-but-not-used.patch
    + fixed: https://github.com/json-c/json-c/issues/240
  - remove gcc7-fix.patch
    + fixed in 014924ba899f659917bb64392bbff7d3c803afc2


author: ncutler@suse.com
changelog:
  - Add patch bsc1171479.patch
    + fix integer overflow and out-of-bounds write (CVE-2020-12762, bsc#1171479)


author: fcrozat@suse.com
changelog:
  - Remove buildrequires on libSDL-devel, only required when running
    autoreconf, which is not needed at all now.


author: cgiboudeaux@gmx.com
changelog:
  - Update to 3.4.1
    * A bug that mutual exclusion was not performed has been fixed
    * Colored QR Code support
    * SVG, UTF8, and ANSIUTF8 output supports have been added to the command line tool.


author: cgiboudeaux@gmx.com
changelog:
  - Fix the SLES build:
    * Replace 'pkgconfig(libpng)'
    * Replace %make_install
    * BuildRequires: pkg-config


author: asterios.dramis@gmail.com
changelog:
  - Update to 3.4.2:
    * Memory leak bug has been fixed.
    * Micro QR Code encoding bug has been fixed.
    * String splitting has been improved.
  - Removed qrencode-libpng16.patch (fixed upstream).


author: asterios.dramis@gmail.com
changelog:
  - Update to 3.4.3:
    * New option "--rle" has been added to the command line tool.
    * Bug fixes in the library and command line tool.


author: cgiboudeaux@gmx.com
changelog:
  - Update to 3.4.4
    * Bugfix release. See the changelog file for the list of changes.
    * New option "--verbose" has been added to the command line tool.


author: tchvatal@suse.com
changelog:
  - Switch to github as an url so people can see the progress
    * web is not really up-to-date
  - Remove compat support for sle11


author: christophe@krop.fr
changelog:
  - Update to 4.0.0
    * EPS output now supports foreground and background color
    * XPM and PNG32 support added
    * CMake support added
    * Various bugs and performance fixes
  - Add qrencode-fix-installation.patch. Fixes installation for x86_64
    targets.


author: jengelh@inai.de
changelog:
  - Update to new upstream release 2.3.1
    * arch: fix the multiplexed ipc() syscalls
    * s390: handle multiplexed syscalls correctly
  - Remove 0001-arch-fix-a-number-of-32-bit-x86-failures-related-to-.patch,
    0001-tests-replace-socket-syscall-references-in-15-basic-.patch
    (fixed upstream)


author: tchvatal@suse.com
changelog:
  - Update to release 2.3.2:
    * Achieved full compliance with the CII Best Practices program
    * Added Travis CI builds to the GitHub repository
    * Added code coverage reporting with the "--enable-code-coverage" configure
      flag and added Coveralls to the GitHub repository
    * Updated the syscall tables to match Linux v4.10-rc6+
    * Support for building with Python v3.x
    * Allow rules with the -1 syscall if the SCMP\_FLTATR\_API\_TSKIP attribute is
      set to true
    * Several small documentation fixes
  - Remove service file as we are not based on git


author: meissner@suse.com
changelog:
  - updated to 2.4.0 (bsc#1128828 CVE-2019-9893)
    - Update the syscall table for Linux v5.0-rc5
    - Added support for the SCMP_ACT_KILL_PROCESS action
    - Added support for the SCMP_ACT_LOG action and SCMP_FLTATR_CTL_LOG attribute
    - Added explicit 32-bit (SCMP_AX_32(...)) and 64-bit (SCMP_AX_64(...)) argument comparison macros to help protect against unexpected sign extension
    - Added support for the parisc and parisc64 architectures
    - Added the ability to query and set the libseccomp API level via seccomp_api_get(3) and seccomp_api_set(3)
    - Return -EDOM on an endian mismatch when adding an architecture to a filter
    - Renumber the pseudo syscall number for subpage_prot() so it no longer conflicts with spu_run()
    - Fix PFC generation when a syscall is prioritized, but no rule exists
    - Numerous fixes to the seccomp-bpf filter generation code
    - Switch our internal hashing function to jhash/Lookup3 to MurmurHash3
    - Numerous tests added to the included test suite, coverage now at ~92%
    - Update our Travis CI configuration to use Ubuntu 16.04
    - Numerous documentation fixes and updates
  - now gpg signed, added key of Paul Moore from keyserver.


author: jengelh@inai.de
changelog:
  - Update to new upstream release 2.4.1
    * Fix a BPF generation bug where the optimizer mistakenly
      identified duplicate BPF code blocks.


author: bwiedemann@suse.com
changelog:
  - Don't embed build system's kernel version in rpm
    to make package build reproducible (boo#1101107)


author: schwab@suse.de
changelog:
  - Update to kernel headers 4.20
  - netfilter-bridge-define-INT_MIN-INT_MAX-in-userspace.patch: remove


author: kukuk@suse.de
changelog:
  - Update to version 0.93: Teach pam_cracklib module about
    enforce_for_root [bnc#929079, FATE#312643].


author: kukuk@suse.de
changelog:
  - Update to version 1.0:
    - Add search in different locations for config files
    - Add support for pam_mktemp [bsc#1123878]


author: josef.moellers@suse.com
changelog:
  - prior to writing an service-specific config file, the main function
    calls access() on the destination file in /etc/pam.d.
    This will fail and no config file will be written when the original
    config file was installed in /usr/etc/pam.d.
    A similar problem exists when creating the new service file:
    create_service_file() wants to give the new service file the same
    user, group and mode as the old one, but the old one may not exist.
    In that case, set these to 0(root), 0(root), and 0644.
    [pam-config-remove-bad-access-call.patch, bsc#1187091]


author: josef.moellers@suse.com
changelog:
  - Add "revoke" to the option list for pam_keyinit
    (Remove some leftover debugs while we're at it)
    [pam-config-fix-pam_keyinit-options.patch]


author: jreidinger@suse.cz
changelog:
  - merge gh#openSUSE/perl-bootloader#121
  - Fix secureboot on aarch64 (boo#1136601)
  - [RFC] Fix secureboot on aarch64 (boo#1136601)
  - 0.924


author: jreidinger@suse.cz
changelog:
  - merge gh#openSUSE/perl-bootloader#122
  - Replace --suse-signed-grub by --suse-force-signed to follow
    update from boo#1136601
  - 0.925


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#126
  - always install EFI fallback boot for aarch64 (bsc#1167015)
  - 0.927


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#129
  - Check tpm.mod in the new grub2 directory (bsc#1174320)
  - 0.931


author: sweet_f_a@gmx.de
changelog:
  - update to 2.2.5:
    * add --rsyncable functionality
    * many bug fixes
  - remove all suse patches:
    * pigz-dictzip.patch, large and unmaintained patch. If somebody
      really needs that then we should rebase and test it. In this
      case --dictzip should be probably also added to original gzip.
    * pigz-always-thread.patch was a folloup of pigz-dictzip.patch
    * pigz-do-symlinks.patch added IMO dangerous and stupid behaviour
      for symlinks. The original behaviour is now again like we know
      it from gzip, bzip2 and xz.
    * pigz-spl.patch, why we hacked in special handling of .spl
      files?
    * Generally we want to have pigz to replace gzip (and vice versa)
      so better avoiding interface incompatibilities.
  - cleanup spec file


author: adam@mizerski.pl
changelog:
  - update to 2.3
    * Don't complain about missing suffix when not writing output file
    * Put all global variables in one global structure for readability
    * Do not decompress concatenated zlib streams -- only gzip streams
    * Add option for compression level 11 to use zopfli
    * Fix handling of junk after compressed data
  - added pigz-lm.patch
    * adds missing "-lm"
  - provide unpigz binary and manpage as symlink, not copy.
  - removed fake cc script - build system honors CC
  - cleanup spec file


author: p.drouand@gmail.com
changelog:
  - Update to version 2.3.3
    * Portability improvements
    * Update copyright years in documentation
  - Add build fix patches
    * pigz-fix-wrong-include.patch
    * pigz-fix-missing-linker.patch
  - Remove pigz-lm.patch; fixed
  - Use download Url as source


author: dimstar@opensuse.org
changelog:
  - Update to version 0.27:
    + Drop usage of popt for equivalent API in glib2
    + Add back an internal snapshot of glib2 to break circular
      dependency
    + Fix --exists to check for Requires and Requires.private.
    + Various fixes for MinGW which should allow it to be used
      unpatched on that system
    + New autoconf macros PKG_INSTALLDIR and PKG_NOARCH_INSTALLDIR to
      help determine the .pc file install directory
    + Fix handling of --exact/atleast/max-version vs. =/>=/<=
    + Fix errors in man page source
    + Ensure testing only searches in the check directory
    + Bump glib requirement to 2.16 to avoid deprecated
      g_win32_get_package_installation_subdirectory()
    + Autotools refresh and update
    + Use g_alloca from glib instead of figuring out alloca ourselves
    + Remove search for setresuid & setreuid only needed for internal
      popt
    + Bugs fixed: fdo#833, fdo#2458, fdo#5214, fdo#5326, fdo#5703,
      fdo#6074, fdo#8653, fdo#9135, fdo#9143, fdo#9584, fdo#10652,
      fdo#11464, fdo#14396, fdo#17053, fdo#23922, fdo#28776,
      fdo#29011, fdo#29801, fdo#31699, fdo#31700, fdo#32622,
      fdo#34382, fdo#37266, fdo#39646, fdo#41081, fdo#43149,
      fdo#44843, fdo#45599, fdo#45742, fdo#48743
  - Changes from version 0.26:
    + Build system fixes
    + More tests
    + pkg.m4 fixups which makes autoconf 2.66 happier.
    + Drop support for legacy -config scripts.  Those should already
      be gone and cause problems in cross-compilation environments.
    + Drop embedded glib
    + Fix up pkg.m4 to handle the case of --exists working and
    - -cflags or --libs failing.
    + Various documentation updates
    + Allow $() through without escaping it.
    + Add --with-system-include-path instead of hard-coding
      /usr/include.
  - Pass --with-internal-glib to configure. We don't want to have a
    build cycle with glib, so we use the interal version.
  - Clean up spec-file using spec-cleaner and manually.
  - Drop pkg-config-dnl.patch: fixed upstream.


author: dimstar@opensuse.org
changelog:
  - Update to version 0.27.1:
    + Various fixes for using the internal glib snapshot. It should
      now be usable pretty much everywhere with the exception that
      universal builds are not supported on OS X.
    + Remove usage of gettext from the internal glib to avoid gettext
      and libintl dependencies
    + Update internal glib snapshot to 2.32.4
    + Fix check for POSIX shell used in tests to work better
    + Handle spaces in autodetected prefix on Windows
    + Bugs fixed: fdo#3550, fdo#51883, fdo#52031, fdo#53493.


author: p.drouand@gmail.com
changelog:
  - Update to version 0.28:
    + Fixed a pair of long-standing and intertwined bugs involving
      unwanted removal of flags:
    - Other Libs flags like -Wl are now kept in context order
      with -l flags.
    - Aggressive removal of all duplicate arguments has been scaled
      back so that just consecutive duplicate arguments are
      removed. One result of this change is that some flags could
      be repeated in the final output, especially flags from
      non-pkg-config packages like -lm. Since pkg-config rarely has
      enough knowledge here about the right thing to do, we throw
      the duplicate arguments at the compiler/linker and trust it
      will do the right thing.
    + Fixed an old bug to allow circular Requires. This fix brings
      along a small behavior change in that pkg-config resolves
      requires depth first, causing some lower level flags to show up
      earlier in the output than previously.
    + Cleaned up many corner-case bugs and ambiguous behavior in
      pkg-config's interface.
    + New autoconf macro PKG_CHECK_VAR for reading variables from .pc
      files.
    + Default to suppressing -L/lib and/or -L/lib64 like their /usr
      counterparts.
    + To help support multiarch scenarios out of the box,
      $host-pkg-config is now installed unless --disable-host-tool
      is passed to configure.
    + Added optional gcov usage through the --with-gcov configure
      option. As a result, many more tests were added to greatly
      increase the coverage of the code to 86% of executed lines on a
      Fedora 18 machine.
    + Bugs fixed: fdo#130, fdo#7331, fdo#16101, fdo#17053, fdo#19950,
      fdo#34504, fdo#48098, fdo#54231, fdo#54271, fdo#54379,
      fdo#54384, fdo#54386, fdo#54388, fdo#54389, fdo#54390,
      fdo#54391, fdo#54427, fdo#54463, fdo#54716, fdo#57078,
      fdo#58363, fdo#59435.


author: dvaleev@suse.com
changelog:
  - Don't redefine _arch, but use file pattern instead. This ensures
    we don't have to run fixing each and every arch.


author: zaitor@opensuse.org
changelog:
  - Update to version 0.29:
    + Fixed a regression from 0.28 in system -L flag handling. If the
      pc file has multiple system -L flags, every other flag will be
      left as is (fdo#78077).
    + Quoting of variables queried through --variable is removed so
      that the output can be used verbatim in subsequent shell
      commands (fdo#67904).
    + Fixed a regression from 0.28 in -L flag handling on Windows. A
      .libs suffix was inadvertantly being added to the library path.
    + Added a --validate option to check pc file syntax. This works
      just like --exists, but package dependencies are disabled
      (fdo#7000).
    + Added the PKG_PREREQ autoconf macro. Whereas
      PKG_PROG_PKG_CONFIG is used to check the version of the
      pkg-config tool, this is used to check the version of the
      pkg-config autoconf macros in use.
    + Added the PKG_CHECK_MODULES_STATIC autoconf macro. This will
      temporarily add --static to the pkg-config calls while invoking
      PKG_CHECK_MODULES (fdo#19541).
    + Many fixes to the testsuite for Windows. It should now pass for
      a MinGW, Cygwin, and cross-compiled MinGW using Wine for test
      execution (fdo#66939).
    + More consistent handling of prefix redefinition. On Windows,
      the prefix was always being redefined based on the pc file
      path. This feature can now be enabled or disabled at runtime on
      all platforms using the --define-prefix and
    - -dont-define-prefix options (fdo#63602).
    + Continue listing packages with --list-all even if there are
      errors in pc files (fdo#26615).
    + Various documentation improvements (fdo#62018, fdo#62374,
      fdo#66155).
    + Fixed a bug when multiple -isystem arguments are used
      (fdo#72584).
    + pkg-config is now built with largefile support to ensure that
      it works correctly on filesystems with 64 bit inodes
      (fdo#90078).
    + Bugs fixed: fdo#7000, fdo#19541, fdo#26615, fdo#62018,
      fdo#62374, fdo#63602, fdo#66155, fdo#66939, fdo#67904,
      fdo#70690, fdo#72584, fdo#78077, fdo#80378, fdo#80380,
      fdo#89267, fdo#90078, fdo#90437, fdo#92002.


author: zaitor@opensuse.org
changelog:
  - Update to version 0.29.1:
    + Fixed a regression from 0.29 with unquoting values queried with
    - -variable. In some cases, this would cause shell special
      characters to be escaped in ways they weren't before. Instead,
      the unquoting only occurs if the value appears to be quoted
      (fdo#93284).
    + Add support for building pkg-config with Microsoft Visual
      Studio (fdo#92489).
    + Allow overriding pkg-config variables with environment
      variables. By setting an environment variable of the form
      PKG_CONFIG_$PACKAGE_$VARIABLE, a pkg-config variable can be set
      globally without always having to pass --define-variable
      (fdo#90917).
    + Honor -Wl,-framework in addition to -framework so that multiple
      frameworks are handled on OSX (fdo#1278).
    + Fix the OSX build using --with-internal-glib (fdo#92902).


author: dimstar@opensuse.org
changelog:
  - Update to version 0.29.2:
    + Improved pkg-config's recursive package list expansion
      performance.
    + Handle an empty prefix setting correctly when --define-prefix
      is used (fdo#97453).
    + Lazily load pc files instead of reading all available pc files
      during initialization (fdo#98215).
    + Check the CPATH environment variable when determining system
      include paths like GCC does. Document the system search path
      behavior (fdo#99224).
    + Make PKG_CHECK_MODULES show the module list rather than the
      variable prefix in configure output (fdo#98334).
    + Fix bundled glib build with GCC 6 (fdo#98334).
    + Handle -isystem and -idirafter when PKG_CONFIG_SYSROOT_DIR is
      set (fdo#97337).
    + Check the INCLUDE environment variable when determining system
      include paths on Windows builds when --msvc-syntax is used
      (fdo#94729).
  - Drop pkg-config-gdate-fix.patch: fixed upstream.


author: mwilck@suse.com
changelog:
  - Update to version 15.2.9:
    * 00-system.conf: move br_netfilter softdep to separate file
      (boo#1158817)


author: mwilck@suse.com
changelog:
  - Update to version 15.2.10:
    * ppc64le: fix dependency of papr_scm
      (bsc#1142152, ltc#176292, FATE#327775).


author: mwilck@suse.com
changelog:
  - Update to version 15.2.11:
    * spec: remove SLE/openSUSE difference in allow_unsupported_modules
    (jsc#SLE-12255)
    * spec: use same fs_blacklist on SLE and openSUSE
    (jsc#SLE-12255, jsc#SLE-3926)
    * spec: use br_netfilter softdep only for SLE12
    (jsc#SLE-12255, bsc#1166531, boo#1158817, bsc#937216)


author: mwilck@suse.com
changelog:
  - Update to version 15.2.12:
    * modprobe.d: Remove dma=none setting for parport_pc
      (bsc#1177695)


author: mwilck@suse.com
changelog:
  - Update to version 15.2.13:
    * Import kernel scriptlets from kernel-source
      (bsc#1189841, bsc#1190598)
    * Provide "suse-kernel-rpm-scriptlets"


author: mwilck@suse.com
changelog:
  - Update to version 15.2.14:
    * Bump version to 15.2.14
    * rpm-script: fix bad exit status in OpenQA (bsc#1191922)
    * cert-script: Deal with existing $cert.delete file (bsc#1191804).
    * cert-script: Ignore kernel keyring for kernel certificates (bsc#1191480).
    * cert-script: Only print mokutil output in verbose mode.
    * kernel-scriptlets: skip cert scriptlet on non-UEFI systems (bsc#1191260)
    * inkmp-script(postun): don't pass  existing files to weak-modules2 (bsc#1191200)


author: mwilck@suse.com
changelog:
  - Update to version 15.2.18:
    * blacklist RNDIS modules (bsc#1205767, jsc#PED-5731)
    * modprobe.conf: Blacklist cls_tcindex module (bsc#1210335, CVE-2023-1829)
    * modprobe.conf: s390x: remove softdep on fbcon


author: fbui@suse.com
changelog:
  - Import commit 5acd9826521306d7b312826135afe491bd889a29
    df05d5b906 shutdown: Reduce log level of unmounts (bsc#1191252)
    31f2b51c18 umount: Don't bother remounting api and ro filesystems read-only
    4914963481 umount: Provide the same mount flags too when remounting read-only
    04463997a7 umount: Decide whether to remount read-only earlier
    143aed644f umount: Add more asserts and remove some unused arguments
    09c7ad555d umount: Fix memory leak
    1899743f50 shutdown: explicitly set a log target in shutdown.c
    a66287c2fe test: add tests for mount_option_mangle()
    036077c2a0 mount-util: add mount_option_mangle()
    e90a30bc86 dissect: automatically mark partitions read-only that have a read-only file system
    b09a5f1835 build-sys: require libmount >= 2.30 (#6795)
    2679668b86 systemd-shutdown: use log_set_prohibit_ipc(true)
    32625253bc rationalize interface for opening/closing logging
    46774b1d21 pid1: when we can't log to journal, remember our fallback log target
    cd994c1e81 log: remove LOG_TARGET_SAFE pseudo log target
    8d4ec9ec2e log: add brief comment for log_set_open_when_needed() and log_set_always_reopen_console()
    a914dd2003 pid1: make use of new "prohibit_ipc" logging flag in PID 1 (bsc#1189803)
    496668c670 log: add new "prohibit_ipc" flag to logging system
    9df8261e38 log: make log_set_upgrade_syslog_to_journal() take effect immediately
    15b3fcf953 mount-util: fix fd_is_mount_point() when both the parent and directory are network fs (bsc#1190984)
    1898f668dd core: rework how we connect to the bus (bsc#1190325)
    22a4287477 dbus: split up bus_done() into seperate functions
    42ce096d80 machine-id-setup: generate machine-id from DMI product ID on Amazon EC2
    39ea02b718 virt: detect Amazon EC2 Nitro instance (bsc#1190440)
    ef0253c6e5 virt: if we detect Xen by DMI, trust that over CPUID


author: fbui@suse.com
changelog:
  - Import commit d126915ede24b052216ca940155ea5531970aa95
    f2cf0ac034 busctl: use usec granularity for the timestamp printed by the busctl monitor command (jsc#SLE-21862 jsc#SLE-18102 jsc#SLE-18103)


author: mwilck@suse.com
changelog:
  - Fix IO scheduler udev rules
    * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
      (jsc#SLE-21032, bsc#1192161)
    * 60-io-scheduler.rules: use "none" for multipath components
      (bsc#1192161)


author: fbui@suse.com
changelog:
  - Import commit 43e57122ef9856db4ec4a8a2758bc8f73d2d1835
    1a6747aa01 umount: show correct error message
    e4b8a01ca5 core/umount: fix unitialized fields in MountPoint in dm_list_get()


author: fbui@suse.com
changelog:
  - Import commit d38785e9adcf79c9729b94ef9f21185dd5a6d35f
    e1e30f53f2 Revert "core: rework how we connect to the bus" (bsc#1193521 bsc#1193481)
    3463e3178c sleep-config: partitions can't be deleted, only files can
    e9e021b3b9 shared/sleep-config: exclude zram devices from hibernation candidates
  - Drop 0001-core-prevent-bus_init_api-from-being-called-recursiv.patch
    This patch is no more needed since it was a follow-up for "core: rework how we
    connect to the bus", which has been reverted.


author: mwilck@suse.com
changelog:
  * 60-io-scheduler.rules: add rules for virtual devices
      (boo#1193759)
    * 60-io-scheduler.rules: enforce "none" for loop devices
      (boo#1193759)


author: fbui@suse.com
changelog:
  - Import commit c46bcb2df93c802f43e240ceb96eaf28027808a8
    28e379cc21 systemctl: exit with 1 if no unit files found (bsc#1193841)


author: fbui@suse.com
changelog:
  - Import commit 5e7db68eb43ec3733c56e98262973431f57e2265
    4f00efadc7 systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23868 jsc#SLE-23870)


author: fbui@suse.com
changelog:
  - Import commit 5183646e041a0ac78107bc4e5b06594e3a27657f
    8187a5e5f6 Allow control characters in environment variable values (bsc#1200170)
    da394cc0b0 test-env-util: Verify that \r is disallowed in env var values
    da0120492d test-env-util: print function headers
    0702ce5b4e basic/env-util: Allow newlines in values of environment variables
    6fda9a8c7b udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
    52174bfc1a man: tweak description of auto/noauto (bsc#1191502)
    8a57b62f90 shared/install: ignore failures for auxiliary files
    86079f3522 systemctl: supress enable/disable messages when -q is given (#7067)
    aa4b7b7925 shared/install: fix error codes returned by install_context_apply()
    ce671cf6e3 shared/install: avoid overwriting 'r' counter with a partial result (bsc#1148309)


author: zren@suse.com
changelog:
  - Enable lvm2-monitor.service by default (bsc#1072492)
  - Enable lvm2-lvmpolld.socket by default (bsc#1074211)


author: kukuk@suse.de
changelog:
  - Enable backup-rpmdb.timer, backup-sysconfig.timer and
    check-battery.timer, previously cron.daily jobs.


author: varkoly@suse.com
changelog:
  - spamassassin: migrate from cron to systemd timers (bsc#1115411)
    enable spamassassin.timer by default


author: jsegitz@suse.com
changelog:
  - Removed ixpdimm-monitor.service and readonly-root.service
    (bsc#1129270)
  - Added snapd.apparmor.service (bsc#1129435)


author: matthias.gerstner@suse.com
changelog:
  Cleanup of outdated autostart services (bsc#1171656):
  - Remove acpid.service. acpid is only available on SLE via openSUSE
    backports.  In openSUSE acpid.service is *not* autostarted. I see no
    reason why it should be on SLE.
  - Remove spamassassin.timer. This timer never seems to have existed.
    Instead spamassassin ships a "sa-update.timer". But it is not
    default-enabled and nobody ever complained about this.
  - Remove snapd.apparmor.service: This service was proactively added a year
    ago, but snapd didn't even make it into openSUSE yet. There's no reason
    to keep this entry unless snapd actually enters SLE which is not
    foreseeable.


author: fvogt@suse.com
changelog:
  - Don't enable btrfsmaintenance-refresh.service, btrfsmaintenance is
    managed by systemd-presets-common-SUSE instead (boo#1165780)


author: fvogt@suse.com
changelog:
  - Enable btrfsmaintenance-refresh.path and disable
    btrfsmaintenance-refresh.service to avoid needless refresh on boot
    (boo#1165780)


author: alarrosa@suse.com
changelog:
  - When installing the systemd-presets-common-SUSE package for the
    first time in a new system, it might happen that some services
    are installed before systemd so the %systemd_pre/post macros
    would not work. This is handled by enabling all preset services
    in this package's %posttrans section but it wasn't enabling
    user services, just system services. Now it enables also the
    user services installed before this package, thus fixing
    boo#1186561


author: alarrosa@suse.com
changelog:
  - Add the wireplumber user service preset to enable it by default
    in SLE15-SP4 where it replaced pipewire-media-session, but keep
    pipewire-media-session preset so we don't have to branch the
    systemd-presets-common-SUSE package for SP4 (boo#1200485)


author: alarrosa@suse.com
changelog:
  - Modify branding-preset-states to fix systemd-presets-common-SUSE
    not enabling new user systemd service preset configuration just
    as it handles system service presets. By passing an (optional)
    second parameter "user", the save/apply-changes commands now
    work with user services instead of system ones (boo#1200485)


author: lnussel@suse.de
changelog:
  - use systemd-rpm-macros instead of systemd-devel to avoid build
    dependency on systemd and it's deps in turn
  - don't install mkinitrd stuff on > 131 anymore


author: sweet_f_a@gmx.de
changelog:
  - cleanup package:
    * don't build binaries which are not installed
    * remove unused sources
    * remove patches (or parts of patches) which modify unused files
    * remove old build conditions (sysvinit, util-linux, mkinitrd)
    * remove unused dependencies
  - this cleanup does not change the resulting binaries (except some
    package dependencies)
  - list of removed patches:
    * sysvinit-2.82-startstop.patch
    * sysvinit-2.88+dsf-blowfish.dif
    * sysvinit-2.88+dsf-crypt.patch
    * sysvinit-2.88+dsf-env.patch
    * sysvinit-2.88dsf-multiple-sulogin.patch
    * sysvinit-2.88+dsf-run.diff
    * sysvinit-2.88+dsf-xen.patch
  - list of modified patches:
    * notify-pam-dead.patch
    * sysvinit-2.88+dsf.dif
    * sysvinit-2.88+dsf-sulogin.diff
    * sysvinit-2.88dsf-suse.patch


author: werner@suse.de
changelog:
  - Split off showconsole as its separate package called blog
    Moved also the patches: showconsole-1.16.dif, showconsole-1.16-deadlock.diff,
    showconsole-1.16-glibc.dif


author: sbrabec@suse.com
changelog:
  - Prevent root owning of /var/lib/libuuid/clock.txt
    (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).


author: sbrabec@suse.com
changelog:
  - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
    util-linux-libuuid-extend-cache.patch).


author: sbrabec@suse.com
changelog:
  - agetty: Resolve tty name even if stdin is specified (bsc#1197178,
    util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
  - libmount: When moving a mount point, update all sub mount entries
    in utab (bsc#1198731,
    util-linux-libmount-moving-mount-point-sub-mounts.patch,
    util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).


author: sbrabec@suse.com
changelog:
  - mesg: use only stat() to get the current terminal status
    (bsc#1200842, util-linux-mesg-use-only-stat.patch).


author: sbrabec@suse.com
changelog:
  - su: Change owner and mode for pty (bsc#1200842,
    util-linux-login-move-generic-setting-to-ttyutils.patch,
    util-linux-su-change-owner-and-mode-for-pty.patch).


author: sbrabec@suse.com
changelog:
  - libuuid improvements (bsc#1201959, PED-1150):
    * libuuid: Fix range when parsing UUIDs
      (util-linux-libuuid-uuid_parse-overrun.patch).
    * Improve cache handling for short running applications-increment
      the cache size over runtime
      (util-linux-libuuid-improve-cache-handling.patch).
    * Implement continuous clock handling for time based UUIDs
      (util-linux-libuuid-continuous-clock-handling.patch).
    * Check clock value from clock file to provide seamless libuuid
      update (util-linux-libuuid-check-clock-value.patch).


author: sbrabec@suse.com
changelog:
  - libuuid continuous clock handling for time based UUIDs:
    Prevent use of the new libuuid ABI by uuidd %post before update
    of libuuid1 (bsc#1205646).


author: david.anes@suse.com
changelog:
  - Fix tests not passing when '@' character is in build path:
    Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038).
  - Add util-linux-fix-tests-when-at-symbol-in-path.patch


author: daniel.garcia@suse.com
changelog:
  - Add upstream patch fix-lib-internal-cache-size.patch
    bsc#1210164, gh#util-linux/util-linux@2fa4168c8bc9


author: antonio.teixeira@suse.com
changelog:
  - Add upstream patch util-linux-bash-completion-shell-character-escape-CVE-2018-7738.patch
    Fix shell code injection in umount bash-completions (bsc#1213865, CVE-2018-7738)


author: astieger@suse.com
changelog:
  - xz 5.2.3:
    * xz: always close a file before trying to delete it to avoid
      problems on some operating system and file system combinations.
    * C99/C11 conformance fixes to liblzma. The issues affected at
      least some builds using link-time optimizations.
    * Fixed bugs in the rarely-used function lzma_index_dup().
    * Use of external SHA-256 code is now disabled by default.
      It can still be enabled by passing --enable-external-sha256
    * Changed CPU core count detection to use sched_getaffinity() on
      GNU/Linux and GNU/kFreeBSD.
    * Fixes to the build-system


author: jengelh@inai.de
changelog:
  - % needs to be encoded in description; adjust weird indent there
    as well. Expand LZMA in summaries.


author: kstreitova@suse.com
changelog:
  - add SUSE-Public-Domain licence as some parts of xz utils (liblzma,
    xz, xzdec, lzmadec, documentation, translated messages, tests,
    debug, extra directory) are in public domain licence [bsc#1135709]


author: danilo.spinella@suse.com
changelog:
  - Fix ZDI-CAN-16587 Fix escaping of malicious filenames
    (ZDI-CAN-16587 bsc#1198062 CVE-2022-1271)
    * bsc1198062.patch


author: tchvatal@suse.com
changelog:
  - Add patch to fix compression level switching
    bsc#1175811 bsc#1175830 bsc#1175831
    * zlib-compression-switching.patch


author: danilo.spinella@suse.com
changelog:
  - Update 410.patch to include new fixes from upstream,
    fixes bsc#1192688
  - Refresh bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch
    to match upstream commit
  - Drop patches which changes have been merged in 410.patch:
    * zlib-compression-switching.patch
    * zlib-390x-z15-fix-hw-compression.patch
    * bsc1174551-fxi-imcomplete-raw-streams.patch


author: sbrabec@suse.com
changelog:
  - Fix heap-based buffer over-read or buffer overflow in inflate via
    large gzip header extra field (bsc#1202175, CVE-2022-37434,
    CVE-2022-37434-extra-header-1.patch,
    CVE-2022-37434-extra-header-2.patch).


author: danilo.spinella@suse.com
changelog:
  - Add DFLTCC support for using inflate() with a small window,
    fixes bsc#1206513
    * bsc1206513.patch


