# changelog

author: sflees@suse.de
changelog:
  - Fix CVE-2019-12749 Authentication bypass (CVE-2019-12749 bsc#1137832)
    * added fix-CVE-2019-12749.patch


author: sflees@suse.de
changelog:
  - Fix CVE-2020-35512 - shared UID's caused issues (CVE-2020-35512 bsc#1187105)
    * fix-upstream-userdb-constpointer.patch
    * fix-upstream-CVE-2020-35512.patch


author: sflees@suse.de
changelog:
  - Fix CVE-2020-12049 truncated messages lead to resource exhaustion
    (CVE-2020-12049, bsc#1172505)
    * fix-upstream-CVE-2020-12049.patch
  - Rebased fix-CVE-2019-12749.patch


author: dcermak@suse.com
changelog:
  - Remove pointless %%post scriptlet leveraging non-existent systemd env
    variables
    FIRST_ARG has been used in our systemd macros, but this has now been gone for
    years. Thus the true branch of the if has never been executed for years and is
    only causing warnings when installing dbus.


author: sflees@suse.de
changelog:
  - Fix a potential crash that could be triggered by an invalid signature.
    (CVE-2022-42010, bsc#1204111)
    * fix-upstream-CVE-2022-42010.patch
  - Fix an out of bounds read caused by a fixed length array (CVE-2022-42011,
    bsc#1204112)
    * fix-upstream-CVE-2022-42011.patch
  - A message in non-native endianness with out-of-band Unix file descriptors
    would cause a use-after-free and possible memory corruption CVE-2022-42012,
    bsc#1204113)
    * fix-upstream-CVE-2022-42012.patch
  - Disable asserts (bsc#1087072)
  - Refreshed patches
    * fix-upstream-CVE-2020-35512.patch


author: sflees@suse.de
changelog:
  - Sometimes unprivileged users were able to crash dbus-daemon
    (CVE-2023-34969, bsc#1212126)
    * fix-upstream-CVE-2023-34969.patch


author: antonio.feijoo@suse.com
changelog:
  - Update to version 059+suse.494.g2ed56105:
    Update to current upstream version (059+backports) (jsc#PED-4884)
    Upstream backports not included in 059:
    Features:
    * feat(network-wicked): remove module
    * feat(systemd-rfkill): remove module
    * feat(livenet): add memory size check depending on live image size
    * feat(nvmf): add code for parsing the NBFT
    * chore(shfmt): update to pass with shfmt v3.5.1
    * feat(dracut-init.sh): do not print by default if an udev rule is skipped
    * feat(lsinitrd): notify user on missing compressor
    * feat(dracut): use log level indicator in console output
    * feat(kernel-modules): driver support for macbook keyboards
    * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
    Fixes:
    * fix(dracut-install): protect against broken links pointing to themselves
    * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
    * fix(systemd-udevd): add missing override paths
    * fix(systemd-journald): add systemd-sysusers dependency
    * fix(base): correct handling of quiet in loginit
    * fix(integrity): do not require ls
    * fix(dracut-init.sh): `module_check` method ignores `forced` option
    * fix(man): add missing initrd-root-device.target to flow chart
    * fix(dracut-init.sh): use the local _ret variable
    * chore(suse): require gawk instead of awk
    * fix(dracut.sh): use gawk for strtonum
    * fix(man): remove duplicate entry
    * fix(systemd-sysext): handle confexts and correct extensions search path
    * fix(modsign): load keys to correct keyring
    * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
    * fix(fs-lib): remove quoting form the first argument of the e2fsck call
    * fix(Makefile): remove leftover rpm build rules
    * fix(Makefile): no longer upload to kernel.org
    * fix(nvmf): support /etc/nvme/config.json
    * fix(install.d): respect even more kernel-install vars, plus style fixes
    * fix(install.d): respect more kernel-install env variables
    * fix(dracut.sh): also prevent fsfreeze for tmpfs
    * fix(dmsquash-live): allow other fstypes
    * fix(bluetooth): make bluetooth rules more strict
    * fix(bluetooth): add missing files
    * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
    * fix(btrfs): do not require module via cmdline when --no-kernel
    * fix(btrfs): add missing cmdline function
    * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
    * fix(systemd-timedated): correct typo in override path
    * fix(systemd-resolved): correct typo in override path
    * fix(systemd-networkd): correct typos in override paths
    * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
    * fix(Makefile): execute command -v instead of which
    * fix(network-legacy): typo
    * fix(network,dbus): improve dependency checking
    * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
    * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
    * fix(systemd-journald): do not include systemd-journal-flush.service
    * fix(systemd): do not include systemd-random-seed.service
    * fix(kernel-modules): add interconnect drivers
    * fix(dracut-lib.sh): remove successful finished initqueue scripts
    * fix(udev-rules): remove firmware.rules
    * fix(dracut.sh): silence the output of hardlinking files by default
    * fix(virtiofs): add virtio_pci kernel module to virtiofs
    * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
    * fix(dracut-systemd): check and create generator dir outside of inner function
    * fix(dracut-systemd): do not hardcode the systemd generator directory
    * fix(dracut-functions): avoid calling grep with PCRE (-P)
    * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
    * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
    * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
    * fix(systemd-networkd): add missing conf files and services
    * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
    * fix(multipath): remove dependency on multipathd.socket
    * fix(99base): adjust to allow mksh as initrd shell
    * fix(base): do not quote $CLINE in the `set` command
    * fix(systemd-ac-power): correct systemd-ac-power binary path
    * fix(dracut.sh): use dynamically uefi's sections offset
    * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
    * fix(dmsquash-live): restore compatibility with earlier releases
    * fix(dracut.sh): kmoddir does not handle trailing /
    * fix(udev-rules): remove old eudev specific rule
    * fix(udev-rules): remove old redhat specific rule
    * fix(udev-rules): remove old edd_id extra rules
    * fix(udev-rules): remove old debian specific rules
    * fix(kernel-modules): add UFS drivers
    * fix(kernel-modules): use modalias info in get_dev_module()
    * fix(crypt): add missing libraries
    * revert(network-manager): avoid restarting NetworkManager
    * fix(dracut.sh): handle sbsign errors for UEFI builds
    * fix(dracut.sh): handle out of space error for UEFI builds
    * fix(plymouth): remove /etc/system-release dependency
    * fix(network-manager): add "After" dependency on dbus.service
    * fix(fido2): libfido2.so depends on libz.so
    * fix: make iso-scan trigger udev events
    * fix(install): do not undef _FILE_OFFSET_BITS
    * fix(dracut.sh): --sysroot option broken if global variables not set in conf
    * fix(lsinitrd.sh): handle filenames with special characters
    * fix(dracut-systemd): remove unused argument
    * fix(dracut-init.sh): correct typo in comment
    * fix(dracut.sh): correct --help and --version exit codes
    * fix(crypt-gpg): do not use always --card-status
    * fix(dmsquash-live): live:/dev/*
    * fix(load_fstype): avoid false positive searchs
    * fix: shellcheck 0.8.0
    Other:
    * refactor(install): log about missing firmware only once
    * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
    * refactor(virtiofs): remove exit after die
    * build: remove rpm spec file and build rules
    * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
    * chore(gentoo.conf): remove examples to avoid confusion
    * chore: remove git2spec.pl, it is no longer used
    * chore(suse): update url in spec
    Bugs between 056 and 059 not referenced yet:
    * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
    * revert(multipath): install multipathd.socket (bsc#1207524)
    * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
    * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
    * fix(i18n): add required includes for keymaps (bsc#1200950)
    * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
    * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
    * fix(lvm): add missing grep requirement (bsc#1198271)
    * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
    For more details on the changes included with 056, 057, 058 and 059 see:
    * https://github.com/dracutdevs/dracut/releases/tag/059
    * https://github.com/dracutdevs/dracut/releases/tag/058
    * https://github.com/dracutdevs/dracut/releases/tag/057
    * https://github.com/dracutdevs/dracut/releases/tag/056


author: antonio.feijoo@suse.com
changelog:
  - Update to version 059+suse.497.g6a2c5f83:
    * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)


author: antonio.feijoo@suse.com
changelog:
  - Update to version 059+suse.499.g2976c52f:
    * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)


author: antonio.feijoo@suse.com
changelog:
  - Update to version 059+suse.502.g92237883:
    * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
    * revert(suse): fix systemd-sysvinit dependency


author: antonio.feijoo@suse.com
changelog:
  - Update to version 059+suse.506.gd33b6bef:
    * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
    * fix(network): correct network device naming (bsc#1192986)


author: antonio.feijoo@suse.com
changelog:
  - Update to version 059+suse.515.g83296e6f:
    * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
    * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
    * fix(i18n): handle symlinked keymap (bsc#1221193)
    * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
    * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)


author: antonio.feijoo@suse.com
changelog:
  - Update to version 059+suse.519.g3edf43b4:
    * chore(suse): remove obsolete fillup template (bsc#1223467)


author: antonio.feijoo@suse.com
changelog:
  - Update to version 059+suse.521.g8412a1c0:
    * fix(suse-initrd): clean return of installkernel() (bsc#1223467)


author: antonio.feijoo@suse.com
changelog:
  - Update to version 059+suse.527.g7870f083:
    * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
    * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
    * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)


author: msuchanek@suse.com
changelog:
  - Update to version 1.21+git175.1ef87b2 (jsc#SLE-17288):
    * libbpf: bump dependency to >= 0.4.0
    * CMakeLists.txt: Enable SHARED and STATIC lib creation
    * libbpf: Allow to use packaged version
    * btfdiff: Support diffing DWARF vs detached BTF
    * pahole: Allow encoding BTF into a detached file
    * pahole: Add --kabi_prefix flag
    * btf_encoder: fix and complete filtering out zero-sized per-CPU variables
    * btf: Remove ftrace filter
    * pahole: Introduce --with_flexible_array option to show just types ending in a flexible array
    * Many updates to btf_encoder and bug fixes
  - Remove upstreamed patches
    - btf_encoder-fix-and-complete-filtering-out-zero-sized-per-CPU-variables.patch
    - remove-ftrace-filter.patch
  - Pretend version 1.22 to make kernel happy
    + dwarves-Prep-1.22.patch


author: msuchanek@suse.com
changelog:
  - 15.4 has new elfutils, drop libebl-plugins dependency.
  - Update to version 1.21+git177.1ef87b2:
    * Fix crash with split BTF debuginfo
    * CMakeList.txt: Bump version to the upcoming 1.22 release, not out of the door yet
    - Remove upstreamed patch dwarves-Prep-1.22.patch


author: jengelh@inai.de
changelog:
  - Update to release 1.22 (bsc#1190340).
    * Ability to encode BTF to a separate file
    * Multithreaded DWARF loading
    * Details at https://marc.info/?l=dwarves&m=162975403628056&w=2


author: jengelh@inai.de
changelog:
  - Update to release 1.23
    * Ability to encode BTF tags.
    * Ability to carry attributes to the kernel BPF verifier for
      further checks.
    * Inference of struct member unnatural alignment
      (__attribute__(__aligned__(N))) to help in generating
      compileable headers matching the original type layout from
      BTF data.


author: dmueller@suse.com
changelog:
  - update to 1.24:
    * Add support to BTF_KIND_ENUM64 to represent enumeration
      entries with more than 32 bits.
    * Support multithreaded encoding, in addition to DWARF
      multithreaded loading, speeding up the process. Selected just
      like DWARF multithreaded loading, using the 'pahole -j'
      option.
    * Encode 'char' type as signed.
    * Add support to BTF_KIND_ENUM64.
    * Introduce --lang and --lang_exclude to specify the language
      the DWARF compile units were originated from to use or
      filter.
    * Introduce --compile to generate compilable code in a similar
      fashion to: bpftool btf dump file vmlinux format c >
      vmlinux.h As with 'bpftool', this will notice type shadowing,
      i.e. multiple types with the same name and will disambiguate
      by adding a suffix.
    * Don't segfault when processing bogus files.
  - add dwarves.keyring for source validation


author: mliska@suse.cz
changelog:
  - Add 0001-pahole-Support-lang-lang_exclude-asm.patch,
    0002-btf_encoder-Add-extra-debug-info-for-unsupported-DWA.patch,
    0003-btf_encoder-Store-the-CU-being-processed-to-avoid-ch.patch,
    0004-core-Add-DW_TAG_unspecified_type-to-tag__is_tag_type.patch,
    0005-core-Record-if-a-CU-has-a-DW_TAG_unspecified_type.patch,
    0006-btf_encoder-Encode-DW_TAG_unspecified_type-returning.patch,
    0007-dwarves-Zero-initialize-struct-cu-in-cu__new-to-prev.patch
    as in order to support DW_TAG_unspecified_type that is newly
    emitted by binutils 2.40+.


author: jengelh@inai.de
changelog:
  - Update to release 1.25
    * Fixed the handling of DW_TAG_unspecified type in assembly
      functions that came with binutils 2.40
    * Allow the BTF encoding of optimized functions (ending in
      .constprop, .isra),
    * Exclude BTF optimized functions not following the calling
      convention
    * Support for DW_TAG_atomic_type
    * Support for the DW_TAG_LLVM_annotation BTF equivalent
      (BTF_KIND_TYPE_TAG) on the BTF loader and for now suppressing
      it when pretty printing
  - Drop 0001-pahole-Support-lang-lang_exclude-asm.patch,
    0002-btf_encoder-Add-extra-debug-info-for-unsupported-DWA.patch,
    0003-btf_encoder-Store-the-CU-being-processed-to-avoid-ch.patch,
    0004-core-Add-DW_TAG_unspecified_type-to-tag__is_tag_type.patch,
    0005-core-Record-if-a-CU-has-a-DW_TAG_unspecified_type.patch,
    0006-btf_encoder-Encode-DW_TAG_unspecified_type-returning.patch,
    0007-dwarves-Zero-initialize-struct-cu-in-cu__new-to-prev.patch


author: mliska@suse.cz
changelog:
  - Update to version 0.183:
    debuginfod: New thread-busy metric and more detailed error metrics.
      New --fdcache-mintmp and tracking of filesystem freespace.
      New increased webapi concurrency while grooming.
    debuginfod-client: DEBUGINFOD_SONAME macro added to debuginfod.h which
      can be used to dlopen the libdebuginfod.so library.
      New function debuginfod_set_verbose_fd and
      DEBUGINFOD_VERBOSE environment variable.
    config: profile.sh and profile.csh won't export DEBUGINFOD_URLS unless
      configured --enable-debuginfod-urls[=URLS]
    elflint, readelf: Recognize SHF_GNU_RETAIN.
      Handle SHT_X86_64_UNWIND as valid relocation target.
  - Remove config-do-not-define-DEBUGINFOD_URLS-environment-var.patch patch.


author: mliska@suse.cz
changelog:
  - Add disable-run-readelf-self-test.patch in order to disable
    a failing test-case with GCC 11 (PR27367).


author: mliska@suse.cz
changelog:
  - Update to version 0.184:
    debuginfod: Use libarchive's bsdtar as the .deb-family file unpacker.
    debuginfod-client: Client caches negative results. If a query for a
      file failed with 404, an empty 000 permission
      file is created in the cache. This will prevent
      requesting the same file for the next 10 minutes.
      Client objects now carry long-lived curl handles
      for outgoing connections.  This makes it more
      efficient for multiple sequential queries, because
      the TCP connections and/or TLS state info are kept
      around awhile, avoiding O(100ms) setup latencies.
    libdw: handle DW_FORM_indirect when reading attributes
    translations: Update Polish translation.


author: mliska@suse.cz
changelog:
  - Update to version 0.185:
    debuginfod-client: Simplify curl handle reuse so downloads which
      return an error are retried.
    elfcompress: Always exit with code 0 when the operation succeeds (even
      when nothing was done). On error the exit code is now always 1.


author: jcheung@suse.com
changelog:
  - For version 0.185, the below patches are no longer needed
    (jsc#SLE-17288, jsc#SLE-17951)
    libdw-check-end-of-attributes-list-consistently.patch
    elflint-dont-check-section-group-without-flags-word.patch
    libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
    libdw-readelf-make-sure-there-is-enough-data-to-read.patch
    elfutils-dont-trust-sh_entsize.patch
    elflint-check-symbol-table-data-is-big-enough-before-check.patch
    size-handle-recursive-elf-ar-files.patch
    elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
    use-the-empty-string-for-note-names-with-zero-size.patch
    readelf-fix-off-by-one-sanity-check.patch
    libebl-check-NT_PLATFORM-core-notes.patch
    libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
    libelf-check-compression-before-allocate-output-buffer.patch
    libdwfl-sanity-check-partial-core-file-data-reads.patch
    arlib-check-that-sh_entsize-isnt-zero.patch


author: martin.liska@suse.com
changelog:
  - Enhance license fields: all the libraries actually have a different
    license to the tools. While the tools are GPL-3.0-or-later, the
    libraries are (LGPL-3.0-or-later OR GPL-2.0-or-later)
    SLE bug (for tracking the above) bsc#1191310


author: jsegitz@suse.com
changelog:
  - Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
    * harden_rdisc.service.patch


author: pvorel@suse.cz
changelog:
  - Update to version 20211215
    https://github.com/iputils/iputils/releases/tag/20211215
  - rarpd and rdisc are going to be removed in next release
    (https://github.com/iputils/iputils/issues/363)
    therefore don't pack it since this release
  - Drop harden_rdisc.service.patch, which was 1) merged upstream
    4bb0ace ("systemd: Add ProtectHostname, ProtectKernelLogs")
    for all services
    2) we don't build rdisc since this release


author: pvorel@suse.cz
changelog:
  - Backport 2 fixes for bsc#1203957:
    0001-ping-Add-SA_RESTART-to-sa_flags.patch
    0002-ping-Make-ping_rts-struct-static.patch


author: pvorel@suse.cz
changelog:
  - Update to version 20221126
    https://github.com/iputils/iputils/releases/tag/20221126
  - Update configure variables (ninfod, rarpd and rdisc were removed from
    upstream in next release => remove -DBUILD_NINFOD=false -DBUILD_RARPD=false
    - DBUILD_RDISC=false)
  - Remove 2 backported fixes from this release
    0001-ping-Add-SA_RESTART-to-sa_flags.patch
    0002-ping-Make-ping_rts-struct-static.patch


author: pvorel@suse.cz
changelog:
  - Backport upstream fix for bsc#1224877
    4db1de6 ("arping: Fix 1s delay on exit for unsolicited arpings")
    0001-arping-Fix-1s-delay-on-exit-for-unsolicited-arpings.patch


author: pvorel@suse.cz
changelog:
  - Backport proposed fix for regression in upstream commit 4db1de6 (bsc#1224877)
    0002-arping-Fix-unsolicited-ARP-regressions-on-c-1.patch


author: pvorel@suse.cz
changelog:
  - Update 0002-arping-Fix-unsolicited-ARP-regressions-on-c-1.patch
    after upstream merged the fix, update git commit hashes.


author: guillaume.gardet@opensuse.org
changelog:
  - Refresh patch to fix build on non-x86 architecture broken
    by previous commit:
    * kbdsettings-nox86.patch


author: sbrabec@suse.com
changelog:
  - Update to version 2.3.0:
    * Added libkfont library (internal yet).
    * Added Canadian Multilingual Standard keyboard map.
    * Added us1 that maps Right Alt to AltGr and Shift+Tab to
      Alt+Tab.
    * The dead_macron is used instead of macron in fi.map.
    * Added retries when switching to the console (chvt, openvt).
    * Added option -d to double size of font (setfont).
    * Added long options, help messages.
    * Added solar24x32 font.
    * Updated eurlatgr font.
    * Fixed problems with formatting man pages.
    * Fixed search path error (boo#1176854).
  - Refresh partially upstreamed kbd-1.15.2-dumpkeys-C-opt.patch
  - Drop upstreamed libkeymap-Fix-mk_mapname-for-the-plain-map.patch
  - Refresh kbd-1.15.2-setfont-no-cruft.patch and
    kbd-1.15.5-loadkeys-search-path.patch


author: jslaby@suse.cz
changelog:
  - Update to version 2.4.0:
    * po: Update cs and sr translations (from translationproject.org)
    * libkfont: Use only KDFONTOP
    * Added support for a few derivatives of neo
    * Fix use-after-free of pipe_cmd
    * Update solar24x32 font
    * vlock's pam config added to destination directory
    * Update sun12x22.psfu
    * libkeymap: unify non/unicode accent_table generation
    * libkeymap: note about --unicode use
    * libkeymap: remove last ushort
    * fi.map: use newly added deadkeys
    * Do not install internal library
    * Additional deadkeys
  - Remove kbd-1.15.2-setfont-no-cruft.patch
    The old ioctls were finally dropped.


author: christophe@krop.fr
changelog:
  - Update the installed license file.
    COPYING is a symlink to LICENSE. Let's use this file directly.


author: kukuk@suse.com
changelog:
  - Only run kbdsettings.service if /etc/sysconfig/keyboard exists.
    Necessary for image based installations without admin made changes.


author: fvogt@suse.com
changelog:
  - Add patch to fix random doubling of font sizes (bsc#1194698):
    * 0001-libkfont-Initialize-kfont_context-options.patch


author: fbui@suse.com
changelog:
  - Add 'ara' vc keymap (bsc#1210702)
    'ara' is slightly better than 'arabic' as it matches the name of its x11
    layout counterpart. Keep 'arabic' for backward compatibility sake.


author: jack@suse.cz
changelog:
  - ext4: fix mb_cache_entry's e_refcnt leak in
    ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
  - commit d72f4d7


author: jack@suse.cz
changelog:
  - ext4: fold quota accounting into
    ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
  - commit 94f6f2b


author: ailiop@suse.com
changelog:
  - xfs: don't walk off the end of a directory data block
    (bsc#1228405 CVE-2024-41013).
  - commit 8a0b7eb


author: ailiop@suse.com
changelog:
  - xfs: add bounds checking to xlog_recover_process_data
    (bsc#1228408 CVE-2024-41014).
  - commit bb0300d


author: jslaby@suse.cz
changelog:
  - Fix grub's requoted kernel parameters (bsc#1181111)
    * 0001-libkmod-config-revamp-kcmdline-parsing-into-a-state-.patch
    * 0002-libkmod-config-re-quote-option-from-kernel-cmdline.patch


author: jengelh@inai.de
changelog:
  - Update to release 29
    * Fix `modinfo -F` not working for built-in modules and
      certain fields.
    * Fix a memory leak, overflow and double free on error path.
  - Drop 0001-Fix-modinfo-F-always-shows-name-for-built-ins.patch,
    0001-libkmod-config-revamp-kcmdline-parsing-into-a-state-.patch,
    0002-libkmod-config-re-quote-option-from-kernel-cmdline.patch
    (all merged)


author: msuchanek@suse.de
changelog:
  - /usr/lib should override /lib where both are available. Support /usr/lib for
    depmod.d as well.
    * Refresh usr-lib-modprobe.patch
  - Remove test patches included in release 29
    - kmod-populate-modules-Use-more-bash-more-quotes.patch
    - kmod-testsuite-compress-modules-if-feature-is-enabled.patch
    - kmod-also-test-xz-compression.patch


author: msuchanek@suse.de
changelog:
  - Display module information even for modules built into the running kernel
    (bsc#1189537).
    + libkmod-Provide-info-even-for-modules-built-into-the.patch


author: msuchanek@suse.com
changelog:
  - Use docbook 4 rather than docbook 5 for building man pages (bsc#1190190).
    * Refres no-stylesheet-download.patch


author: msuchanek@suse.com
changelog:
  - Enable ZSTD on 15.3 as well (boo#1192104).
  - Only test ZSTD in testsuite on releases where it is available.


author: julio@juliogonzalez.es
changelog:
  - Add apparmor-systemd-sessions.patch to allow read access to
    /run/systemd/sessions/ (bsc#1216878)


author: suse-beta@cboltz.de
changelog:
  - Add dovecot-unix_chkpwd.diff to allow dovecot-auth to execute
    unix_chkpwd, and add a profile for unix_chkpwd. This is needed
    for PAM 1.6 (boo#1219139)
  - Refresh apparmor.keyring - the key was renewed


author: suse-beta@cboltz.de
changelog:
  - Update to AppArmor 3.1.7
    - aa-logprof: don't skip exec events in hats
    - fix aa-cleanprof to work with named profiles
    - add permissions in various abstractions
    - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.1.7
      for the full list of changes
  - drop upstreamed apparmor-systemd-sessions.patch


author: ddiss@suse.com
changelog:
  - Add apparmor-abstractions-openssl-allow-version-specific-en.patch to
    allow version specific engdef & engines openssl paths (boo#1219571)


author: nopower@suse.com
changelog:
  - Add smbd-unix_chkpwd.diff to allow smbd to execute
    unix_chkpwd and fix other pam related denies; (boo#1220032).


author: suse-beta@cboltz.de
changelog:
  - Remove workaround for boo#853019 in %postun parser -
    apparmor.service contains a more safe workaround.
    This also fixes boo#1220708 (missing daemon-reload).


author: lnussel@suse.de
changelog:
  - Update to version 0.0+git20171227.670229c:
    * Added ABI version number
    * AVX2/AVX-512F optimizations of BLAMKA
    * Set Argon2 version number from the command line
    * New bindings
    * Minor bug and warning fixes (no security issue)
  - use _service file


author: wolfgang.frisch@suse.com
changelog:
  - Update to version 0.0+git20190520.62358ba (boo#1170512):
    * Fix the Makefile to install libargon2.pc.
    * Wait for already running threads if a thread creation failed.
    * Added Argon2 Erlang binding.
    * Additional JVM bindings (Jargon2).


author: rpm@fthiessen.de
changelog:
  - Fix version of package: 20190702 is the upstream version number
    of the package
  - Replaced optflags.patch with adjust-makefile.patch, the
    patch will now also allow to set the file permissions of installed
    libraries. This fixes the rpmlint error: shared-library-not-executable


author: shung-hsi.yu@suse.com
changelog:
  - Update to release 0.8.0
    * New features and APIs:
    - support auto-resolution of binaries and shared libraries from PATH, if necessary;
    - support attaching by function names (only by IP was supported before);
    - support attaching to USDTs (SEC("usdt/...") and
      bpf_program__attach_usdt()) with initially supported architectures:
      x86-64 (amd64); x86 (i386); s390x; ARM64 (aarch64); RISC V (riscv);
    - improved BPF verifier log reporting for CO-RE relocation failures (no
      more obscure "invalid func unknown#195896080" errors);
    - auto-adjust BPF ringbuf size according to host kernel's page size requirements;
    - high-level BPF map APIs: bpf_map__lookup_elem(), bpf_map__update_elem(),
      etc that validate key/value buffer sizes;
    - bpf_link_create() can create all bpf_link-based (including raw_tp,
      fentry/fexit, etc), falling back to bpf_raw_tracepoint_open() on old
      kernels transparently;
    - support opting out from auto-loading BPF programs declaratively with
      SEC("?...");
    - support opting out from auto-creation of declarative BPF maps with
      bpf_map__set_autocreate();
    - support multi-kprobes (SEC("kprobe.multi/...") and
      bpf_program__attach_kprobe_multi_opts());
    - support target-less SEC() programs (e.g., SEC("kprobe"), SEC("tp"), etc);
    - support BPF sub-skeletons for "incomplete" BPF object files (requires
      matching bpftool to generate .subskel.h);
    - BPF cookie support for fentry/fexit/fmod_ret BPF programs
      (bpf_program__attach_trace_opts());
    - support for custom SEC() handlers (libbpf_register_prog_handler()).
    * BPF-side API
    - BPF-side USDT APIs. See new usdt.bpf.h header:
    * BPF_USDT() program wrapper macro; bpf_usdt_arg(), bpf_usdt_arg_cnt(),
    * bpf_usdt_cookie() helpers;
    - new bpf_core_field_offset() CO-RE helper and support
      bpf_core_field_size(type, field) forms;
    - barrier() and barrier_var() macros for improving BPF code generation;
    - __kptr and __kptr_ref tags added;
    - ARC architecture support in bpf_tracing.h header;
    - new BPF helpers:
    * bpf_skb_set_tstamp();
    * bpf_ima_file_hash();
    * bpf_kptr_xchg();
    * bpf_map_lookup_percpu_elem().
    * Bug fixes
    - netlink bug fixes;
    - libbpf.pc fixes to support patch releases properly;
    - BPF_MAP_TYPE_PERF_EVENT_ARRAY map auto-pinning fix;
    - minor CO-RE fixes and improvements for some corner cases;
    - various other small fixes and improvements.


author: dmueller@suse.com
changelog:
  - update to 1.0.1:
    * fix inadvertently changed struct bpf_object_open_opts memory layout;
    * fix btf.h header relying on struct enum64 type defined in kernel UAPI headers;
    * fix NULL pointer exception in API btf_dump__dump_type_data;
    * remove struct btf_map_def accidentally left in bpf_helpers.h header.
    * All deprecated APIs and features removed!
    * support for syscall-specific kprobe/kretprobe
      (SEC("ksyscall/<syscall_name>") and SEC("kretsyscall/<syscall_name>"));
    * support for sleepable uprobe BPF programs (SEC("uprobe.s"));
    * support for per-cgroup LSM BPF programs (SEC("lsm_cgroup"));
    * support for new BPF CO-RE relocation TYPE_MATCHES;
    * bpf_prog_load() and bpf_map_create() are now smarter about handling program
      and map name on old kernels (it will be ignored if kernel doesn't support
      names);
    * BTF_KIND_ENUM64 support;
    * increase tracing attachment (kprobe/uprobe/tracepoint) robustness by using
      tracefs or debugfs, whichever is mounted;
    * new APIs for converting BPF enums to their string representation:
    * libbpf_bpf_prog_type_str();
    * libbpf_bpf_map_type_str();
    * libbpf_bpf_link_type_str();
    * libbpf_bpf_attach_type_str();
    * bpf_program__set_autoattach() and bpf_program__autoattach() to allow opting
      out from auto-attaching of BPF program by BPF skeleton;
    * perf_buffer__buffer() API to give access to underlying per-CPU buffer for BPF ringbuf;
    * bpf_obj_get_opts() API for more flexible fetching of BPF kernel objects' information.
  - see https://github.com/libbpf/libbpf/releases/tag/v1.0.0 for detailed changelog


author: shung-hsi.yu@suse.com
changelog:
  - Fix out-of-bound heap write (boo#1194248 boo#1194249 CVE-2021-45940 CVE-2021-45941)
    + libbpf-Use-elf_getshdrnum-instead-of-e_shnum.patch
  - Fix use-after-free in btf_dump_name_dups (boo#1204391 CVE-2022-3534)
    + libbpf-Fix-use-after-free-in-btf_dump_name_dups.patch
  - Fix memory leak in parse_usdt_arg() (boo#1204393 CVE-2022-3533)
    + libbpf-Fix-memory-leak-in-parse_usdt_arg.patch
  - Fix null pointer dereference in find_prog_by_sec_insn() (boo#1204502 CVE-2022-3606)
    + libbpf-Fix-null-pointer-dereference-in-find_prog_by_.patch


author: dmueller@suse.com
changelog:
  - update to v1.1.0:
    User space-side features and APIs:
    * user-space ring buffer (BPF_MAP_TYPE_USER_RINGBUF) support;
    * new documentation page listing all recognized SEC() definitions;
    * BTF dedup improvements:
    * unambiguous fwd declaration resolution for structs and unions;
    * better handling of some corner cases with identical structs and arrays;
    * mixed enum and enum64 forward declaration resolution logic;
    * bpf_{link,btf,pro,mapg}_get_fd_by_id_opts() and bpf_get_fd_by_id_opts()
      APIs;
    * libbpf supports loading raw BTF for BPF CO-RE from known search paths;
    * support for new cgroup local storage (BPF_MAP_TYPE_CGRP_STORAGE);
    * libbpf will only add BPF_F_MMAPABLE flag for data maps with global
      (i.e., non-static) vars;
    * latest Linux UAPI headers with lots of changes synced into
      include/uapi/linux.
    BPF-side features and APIs;
    * BPF_PROG2() macro added that supports struct-by-value arguments;
    * new BPF helpers:
    * bpf_user_ringbuf_drain();
    * cgrp_storage_get() and cgrp_storage_delete().
    Bug fixes
    * better handling of padding corner cases;
    * btf__align_of() determines packed structs better now;
    * improved handling of enums of non-standard sizes;
    * USDT spec parsing improvements;
    * overflow handling fixes for ringbufs;
    * Makefile fixes to support cross-compilation for 32-bit targets;
    * fix crash if SEC("freplace") programs don't have attach_prog_fd set;
    * better handling of file existence checks when running as non-root with
      enhanced capabilities;
    * a bunch of small fixes:
    * ELF handling improvements;
    * fix memory leak in USDT argument parsing logic;
    * fix NULL dereferences in few corner cases;
    * improved netlink attribute iteration handling.
  - drop libbpf-Use-elf_getshdrnum-instead-of-e_shnum.patch,
    libbpf-Fix-use-after-free-in-btf_dump_name_dups.patch,
    libbpf-Fix-memory-leak-in-parse_usdt_arg.patch
    libbpf-Fix-null-pointer-dereference-in-find_prog_by_.patch (upstream)


author: dmueller@suse.com
changelog:
  - update to 1.2.0:
    * completely overhauled "Libbpf overview" landing documentation
      page;
    * support for BPF link-based `struct_ops` programs:
    * `SEC(".struct_ops.link")` annotations;
    * `bpf_map__attach_struct_ops()` attach API;
    * `bpf_link__update_map()` link update API;
    * support sleepable `SEC("struct_ops.s")` programs
    * improved thread-safety of libbpf print callbacks and
      `libbpf_set_print()`
    * improve handling and reporting of missing BPF kfuncs
    * `bpf_{btf,link,map,prog}_get_info_by_fd()` APIs
    * `bpf_xdp_query_opts()` supports fetching XDP/XSK supported
      features;
    * `perf_buffer__new()` allows customizing notification/sampling
      period now;
    * BPF verifier logging improvements:
    * pass-through BPF verifier log level and flags to kernel as
      is
    * support `log_true_size` for getting required log buffer size
      to fit BPF verifier log completely;
    * allow precise control over kprobe/uprobe attach mode: legacy,
      perf-based, link-based.
    * fix legacy kprobe events names sanitization;
    * fix clobbering errno in some cases;
    * fix BPF map's `BPF_F_MMAPABLE` flag sanitization;
    * fix BPF-side USDT support code on s390x architecture;
    * fix `BPF_PROBE_READ{_STR}_INTO()` on s390x architecture;
    * fix kernel version setting for Debian kernels;
    * fix netlink protocol handling in some cases;
    * improve robustness of attaching to legacy kprobes and
      uprobes;
    * fix double-free during static linking empty ELF sections;
    * a bunch of other small fixes here and there.


author: shung-hsi.yu@suse.com
changelog:
  - update to v1.2.2:
    * fix a regression in perf tool caused by libbpf resetting its custom
      catch-all SEC() handler on explicit bpf_program__set_type() call
    * fix possible double-free in USDT-related libbpf code, which happens when
      libbpf runs out of space in __bpf_usdt_specs map due to having too many
      unique USDT specs


author: shung-hsi.yu@suse.com
changelog:
  - Fix null pointer dereference in bpf_object__collect_prog_relos()
    (bsc#1221101)
    * Add libbpf-Fix-NULL-pointer-dereference-in-bpf_object__c.patch


author: andreas.stieger@gmx.de
changelog:
  - cryptsetup 2.4.3:
    * Fix possible attacks against data confidentiality through
      LUKS2 online reencryption extension crash recovery
      CVE-2021-4122, boo#1194469
    * Add configure option --disable-luks2-reencryption to completely
      disable LUKS2 reencryption code.
    * Improve internal metadata validation code for reencryption
      metadata
    * Add updated documentation for LUKS2 On-Disk Format
      Specification version 1.1.0
    * Fix support for bitlk (BitLocker compatible) startup key with
      new  metadata entry introduced in Windows 11
    * Fix space restriction for LUKS2 reencryption with data shift


author: lnussel@suse.de
changelog:
  - cryptsetup 2.5.0:
    * Split manual pages into per-action pages and use AsciiDoc format.
    * Remove cryptsetup-reencrypt tool from the project and move reencryption
      to already existing "cryptsetup reencrypt" command.
      If you need to emulate the old cryptsetup-reencrypt binary, use simple
      wrappers script running "exec cryptsetup reencrypt $@".
    * LUKS2: implement --decryption option that allows LUKS removal.
    * Fix decryption operation with --active-name option and restrict
      it to be used only with LUKS2.
    * Do not refresh reencryption digest when not needed.
      This should speed up the reencryption resume process.
    * Store proper resilience data in LUKS2 reencrypt initialization.
      Resuming reencryption now does not require specification of resilience
      type parameters if these are the same as during initialization.
    * Properly wipe the unused area after reencryption with datashift in
      the forward direction.
    * Check datashift value against larger sector size.
      For example, it could cause an issue if misaligned 4K sector appears
      during decryption.
    * Do not allow sector size increase reencryption in offline mode.
    * Do not allow dangerous sector size change during reencryption.
    * Ask the user for confirmation before resuming reencryption.
    * Do not resume reencryption with conflicting parameters.
    * Add --force-offline-reencrypt option.
    * Do not allow nested encryption in LUKS reencrypt.
    * Support all options allowed with luksFormat with encrypt action.
    * Add resize action to integritysetup.
    * Remove obsolete dracut plugin reencryption example.
    * Fix possible keyslot area size overflow during conversion to LUKS2.
    * Allow use of --header option for cryptsetup close.
    * Fix activation of LUKS2 device with integrity and detached header.
    * Add ZEROOUT IOCTL support for crypt_wipe API call.
    * VERITY: set loopback sector size according to dm-verity block sizes.
    * veritysetup: dump device sizes.
    * LUKS2 token: prefer token PIN query before passphrase in some cases.
      When a user provides --token-type or specific --token-id, a token PIN
      query is preferred to a passphrase query.
    * LUKS2 token: allow tokens to be replaced with --token-replace option
      for cryptsetup token command.
    * LUKS2 token: do not continue operation when interrupted in PIN prompt.
    * Add --progress-json parameter to utilities.
    * Add support for --key-slot option in luksResume action.
  - move man pages to separate subpackage
  - drop backports handling


author: luca.boccassi@gmail.com
changelog:
  - Add virtual provides for 'integritysetup' and 'veritysetup' to match
    package names provided by Fedora/RHEL, to allow the same set of
    dependencies to be used across all RPM distributions.


author: info@paolostivanin.com
changelog:
  - cryptsetup 2.6.0:
    * Introduce support for handling macOS FileVault2 devices (FVAULT2).
    * libcryptsetup: no longer use global memory locking through mlockall()
    * libcryptsetup: process priority is increased only for key derivation
      (PBKDF) calls.
    * Add new LUKS keyslot context handling functions and API.
    * The volume key may now be extracted using a passphrase, keyfile, or
      token. For LUKS devices, it also returns the volume key after
      a successful crypt_format call.
    * Fix --disable-luks2-reencryption configuration option.
    * cryptsetup: Print a better error message and warning if the format
      produces an image without space available for data.
    * Print error if anti-forensic LUKS2 hash setting is not available.
      If the specified hash was not available, activation quietly failed.
    * Fix internal crypt segment compare routine if the user
      specified cipher in kernel format (capi: prefix).
    * cryptsetup: Add token unassign action.
      This action allows removing token binding on specific keyslot.
    * veritysetup: add support for --use-tasklets option.
      This option sets try_verify_in_tasklet kernel dm-verity option
      (available since Linux kernel 6.0) to allow some performance
      improvement on specific systems.
    * Provide pkgconfig Require.private settings.
      While we do not completely provide static build on udev systems,
      it helps produce statically linked binaries in certain situations.
    * Always update automake library files if autogen.sh is run.
      For several releases, we distributed older automake scripts by mistake.
    * reencryption: Fix user defined moved segment size in LUKS2 decryption.
      The --hotzone-size argument was ignored in cases where the actual data
      size was less than the original LUKS2 data offset.
    * Delegate FIPS mode detection to configured crypto backend.
      System FIPS mode check no longer depends on /etc/system-fips file.
    * Update documentation, including FAQ and man pages.


author: andreas.stieger@gmx.de
changelog:
  - cryptsetup 2.6.1
    * bitlk: Fixes for BitLocker-compatible on-disk metadata parser
    * Fix possible iteration overflow in OpenSSL2 PBKDF2 crypto
      backend
    * portability and compilation fixes
    * verity: Fix possible hash offset setting overflow.
    * bitlk: Fix use of startup BEK key on big-endian platforms.
    * Do not initiate encryption (reencryption command) when the
      header and data devices are the same. If data device reduction
      is not requsted, this leads to data corruption since LUKS
      metadata was written over the data device.
    * Fix possible memory leak if crypt_load() fails.
    * Always use passphrases with a minimal 8 chars length for
      benchmarking, as used in some implementation of FIPS mode


author: pmonreal@suse.com
changelog:
  - FIPS: Remove not needed libcryptsetup12-hmac package that contains
    the HMAC checksums for integrity checking for FIPS. [bsc#1185116]
    * Remove the cryptsetup-rpmlintrc file.
    * Remove not needed fipscheck dependency.


author: pmonreal@suse.com
changelog:
  - Enable running the regression test suite.
  - Force a regeneration of the man pages from AsciiDoc.
  - Add LUKS1 and LUKS2 On-Disk Format Specification pdfs to doc.


author: pmonreal@suse.com
changelog:
  - luksFormat: Handle system with low memory and no swap space [bsc#1211079]
    * Check for physical memory available also in PBKDF benchmark.
    * Try to avoid OOM killer on low-memory systems without swap.
    * Use only half of detected free memory on systems without swap.
    * Add patches:
    - cryptsetup-Check-for-physical-memory-available-also-in-PBKDF-be.patch
    - cryptsetup-Try-to-avoid-OOM-killer-on-low-memory-systems-withou.patch
    - cryptsetup-Use-only-half-of-detected-free-memory-on-systems-wit.patch


author: pmonreal@suse.com
changelog:
  - Update to 2.7.0:
    * Full changelog in:
      mirrors.edge.kernel.org/pub/linux/utils/cryptsetup/v2.7/v2.7.0-ReleaseNotes
    * Introduce support for hardware OPAL disk encryption.
    * plain mode: Set default cipher to aes-xts-plain64 and password hashing
      to sha256.
    * Allow activation (open), luksResume, and luksAddKey to use the volume
      key stored in a keyring.
    * Allow to store volume key to a user-specified keyring in open and
      luksResume commands.
    * Do not flush IO operations if resize grows the device.
      This can help performance in specific cases where the encrypted device
      is extended automatically while running many IO operations.
    * Use only half of detected free memory for Argon2 PBKDF on systems
      without swap (for LUKS2 new keyslot or format operations).
    * Add the possibility to specify a directory for external LUKS2 token
      handlers (plugins).
    * Do not allow reencryption/decryption on LUKS2 devices with
      authenticated encryption or hardware (OPAL) encryption.
    * Do not fail LUKS format if the operation was interrupted on subsequent
      device wipe.
    * Fix the LUKS2 keyslot option to be used while activating the device
      by a token.
    * Properly report if the dm-verity device cannot be activated due to
      the inability to verify the signed root hash (ENOKEY).
    * Fix to check passphrase for selected keyslot only when adding
      new keyslot.
    * Fix to not wipe the keyslot area before in-place overwrite.
    * bitlk: Fix segfaults when attempting to verify the volume key.
    * Add --disable-blkid command line option to avoid blkid device check.
    * Add support for the meson build system.
    * Fix wipe operation that overwrites the whole device if used for LUKS2
      header with no keyslot area.
    * Fix luksErase to work with detached LUKS header.
    * Disallow the use of internal kernel crypto driver names in "capi"
      specification.
    * Fix reencryption to fail early for unknown cipher.
    * tcrypt: Support new Blake2 hash for VeraCrypt.
    * tcrypt: use hash values as substring for limiting KDF check.
    * Add Aria cipher support and block size info.
    * Do not decrease PBKDF parameters if the user forces them.
    * Support OpenSSL 3.2 Argon2 implementation.
    * Add support for Argon2 from libgcrypt
      (requires yet unreleased gcrypt 1.11).
    * Used Argon2 PBKDF implementation is now reported in debug mode
      in the cryptographic backend version. For native support in
      OpenSSL 3.2 or libgcrypt 1.11, "argon2" is displayed.
      If libargon2 is used, "cryptsetup libargon2" (for embedded
      library) or "external libargon2" is displayed.
    * Link only libcrypto from OpenSSL.
    * Disable reencryption for Direct-Access (DAX) devices.
    * Print a warning message if the device is not aligned to sector size.
    * Fix sector size and integrity fields display for non-LUKS2 crypt
      devices for the status command.
    * Fix suspend for LUKS2 with authenticated encryption (also suspend
      dm-integrity device underneath).
    * Update keyring and locking documentation and LUKS2 specification
      for OPAL2 support.
    * Remove patches fixed upstream:
    - cryptsetup-Check-for-physical-memory-available-also-in-PBKDF-be.patch
    - cryptsetup-Try-to-avoid-OOM-killer-on-low-memory-systems-withou.patch
    - cryptsetup-Use-only-half-of-detected-free-memory-on-systems-wit.patch


author: heming.zhao@suse.com
changelog:
  - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
    + change lvm.conf item external_device_info_source from none to udev
    + bug-1179691_config-set-external_device_info_source-none.patch


author: heming.zhao@suse.com
changelog:
  - lvm reports udev database has incomplete information on devices (bsc#1202011)
    + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch


author: heming.zhao@suse.com
changelog:
  - Upgrade lvm2 from LVM2.2.03.05 to LVM2.2.03.16 (bsc#1201616)
    - device-mapper version upgrade to 1.02.185 (bsc#1199074)
  - Drop patches that have been merged into upstream
    - bug-1122666_devices-drop-open-error-message.patch
    - bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch
    - bug-1149408_Fix-rounding-writes-up-to-sector-size.patch
    - bug-1149408_vgcreate-vgextend-restrict-PVs-with-mixed-block-size.patch
    - bug-1152378-md-component-detection-for-differing-PV-and-device-s.patch
    - bug-1152378-pvscan-fix-PV-online-when-device-has-a-different-siz.patch
    - jcs-SLE5498_pvscan-allow-use-of-noudevsync-option.patch
    - bug-1154655_udev-remove-unsupported-OPTIONS-event_timeout-rule.patch
    - bug-1158628_01-tests-replaces-grep-q-usage.patch
    - bug-1158628_02-tests-fix-ra-checking.patch
    - bug-1158628_03-tests-simplify-some-var-settings.patch
    - bug-1158628_04-pvmove-correcting-read_ahead-setting.patch
    - bug-1158628_05-activation-add-synchronization-point.patch
    - bug-1158628_06-pvmove-add-missing-synchronization.patch
    - bug-1158628_07-activation-extend-handling-of-pending_delete.patch
    - bug-1158628_08-lv_manip-add-synchronizations.patch
    - bug-1158628_09-lvconvert-improve-validation-thin-and-cache-pool-con.patch
    - bug-1158628_10-thin-activate-layer-pool-aas-read-only-LV.patch
    - bug-1158628_11-tests-mdadm-stop-in-test-cleanup.patch
    - bug-1158628_12-test-increase-size-of-raid10-LV-allowing-tests-to-su.patch
    - bug-1158628_13-lvconvert-fix-return-value-when-zeroing-fails.patch
    - bug-1158628_14-tests-add-extra-settle.patch
    - bug-1158628_15-test-Fix-handling-leftovers-from-previous-tests.patch
    - bug-1158861_01-config-remove-filter-typo.patch
    - bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch
    - bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch
    - bug-1158861_04-fix-duplicate-pv-size-check.patch
    - bug-1158861_05-hints-fix-copy-of-filter.patch
    - bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch
    - bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch
    - bug-1158861_08-hints-fix-mem-leaking-buffers.patch
    - bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch
    - bug-1150021_02-bcache-add-bcache_abort.patch
    - bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch
    - bug-1150021_04-bcache-add-unit-test.patch
    - bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch
    - bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch
    - bug-1157736-add-suggestion-message-for-mirror-LVs.patch
    - bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch
    - bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch
    - bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch
    - bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch
    - bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch
    - bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch
    - bug-1181319_03-lvmlockctl-use-inline-initilizers.patch
    - bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch
    - bug-1181319_05-cov-check-sscanf-result.patch
    - bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch
    - bug-1185190_01-pvscan-support-disabled-event_activation.patch
    - bug-1185190_02-config-improve-description-for-event_activation.patch
    - bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch
    - bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch
    - bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch
    - bug-1202011_vgchange-monitor-don-t-use-udev-info.patch
    - bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch
    - bug-1179691_config-set-external_device_info_source-none.patch
  - Update patch
    - fate-309425_display-dm-name-for-lv-name.patch
    - bug-1184687_Add-nolvm-for-kernel-cmdline.patch
  - replace exist patch with fixed bug patches
    - (remove) fate-31841_fsadm-add-support-for-btrfs.patch
    - (add) fate-31841-01_fsadm-add-support-to-resize-check-btrfs-filesystem.patch
    - (add) fate-31841-02_man-add-support-for-btrfs.patch
    - (add) fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch
  - Add upstream patch
    - 0001-devices-file-move-clean-up-after-command-is-run.patch
    - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch
    - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch
    - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch
    - 0005-pvdisplay-restore-reportformat-option.patch
    - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch
    - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch
    - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch
    - 0009-mm-remove-libaio-from-being-skipped.patch
    - 0010-dmsetup-check-also-for-ouf-of-range-value.patch
    - 0011-devices-drop-double-from-sysfs-path.patch
    - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch
    - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch
    - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch
  - update lvm2.spec
    - indent some lines for easy read
    - add new binraries: lvmdevices lvm_import_vdo vgimportdevices dmfilemapd
    - remove config item '--enable-cmirrord', which was obsoleted.
    - remove config item '--enable-realtime', which became default setting.
    - add config item "--with-cluster=internal" for cluster test
    - add config item "--enable-dmfilemapd" for new daemon dmfilemapd
    - add new man: lvmautoactivation.7 lvmdevices.8 lvm_import_vdo.8 dmfilemapd.8
    - remove lvm2-activation-generator & lvm2-activation-generator.8
    - remove lvm2-pvscan@.service
    - replace 69-dm-lvm-metad.rules with 69-dm-lvm.rules
    - change %post behaviour, only do deleting job for non-link folder (bsc#1198523)
  - lvm.conf
    - follow upstream style, comment out default value (bsc#1179739)


author: heming.zhao@suse.com
changelog:
  - lvmlockd is not supporting sanlock (bsc#1203482)
    - set 1 for _supportsanlock in lvm2.spec for enabling sanlock.


author: heming.zhao@suse.com
changelog:
  - lvm.conf should re-enable commented out option use_lvmlockd (bsc#1204219)
    - re-enable "use_lvmlockd = 0" in lvm.conf


author: heming.zhao@suse.com
changelog:
  - dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074)
    - in lvm2.spec, change device_mapper_version from 1.02.185 to %{lvm2_version}_1.02.185


author: amit.chaudhary@suse.com
changelog:
  - killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216)
    - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch


author: heming.zhao@suse.com
changelog:
  - multipath_component_detection = 0 in lvm.conf does not have any effect (bsc#1212613)
    - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch


author: heming.zhao@suse.com
changelog:
  - blkdeactivate calls wrong mountpoint cmd (bsc#1214071)
    + bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch


author: glass.su@suse.com
changelog:
  - Update lvm2 from LVM2.2.03.16 to LVM2.2.03.22 (jsc#PED-6339)
    * 2.03.22:
    * Fix pv_major/pv_minor report field types so they are integers, not strings.
    * Add lvmdevices --delnotfound to delete entries for missing devices.
    * Always use cachepool name for metadata backup LV for lvconvert --repair.
    * Make metadata backup LVs read-only after pool's lvconvert --repair.
    * Handle 'lvextend --usepolicies' for pools for all activation variants.
    * Fix memleak in vgchange autoactivation setup.
    * Support conversion from thick to fully provisioned thin LV.
    * Cache/Thin-pool can use error and zero volumes for testing.
    * Individual thin volume can be cached, but cannot take snapshot.
    * internal support for handling error and zero target (for testing).
    * COW above trimmed maximal size is does not return error.
    * Add lvm.conf thin_restore and cache_restore settings.
    * Handle multiple mounts while resizing volume with a FS.
    * Handle leading/trailing spaces in sys_wwid and sys_serial used by deivce_id.
    * Fix failing -S|--select for non-reporting cmds if using LV info/status fields.
    * Allow snapshots of raid+integrity LV.
    * Fix multisegment RAID1 allocator to prevent using single disk for more legs.
    * 2.03.21:
    * Allow (write)cache over raid+integrity LV.
    * 2.03.20:
    * Fix segfault if using -S|--select with log/report_command_log=1 setting.
    * 2.03.19:
    * Do not reset SYSTEMD_READY variable in udev for PVs on MD and loop devices.
    * Ensure udev is processing origin LV before its thick snapshots LVs.
    * 2.03.18:
    * Fix warning for thin pool overprovisioning on lvextend.
    * Add support for writecache metadata_only and pause_writeback settings.
    * Fix missing error messages in lvmdbusd.
    * 2.03.17:
    * Add new options (--fs, --fsmode) for FS handling when resizing LVs (btrfs is unsupported).
    * Fix 'lvremove -S|--select LV' to not also remove its historical LV right away.
    * Fix lv_active field type to binary so --select and --binary applies properly.
    * Error out in lvm shell if using a cmd argument not supported in the shell.
    * Fix lvm shell's lastlog command to report previous pre-command failures.
    * Add --valuesonly option to lvmconfig to print only values without keys.
    * Add json_std output format for more JSON standard compliant version of output.
    * Fix many corner cases in device_id, including handling of S/N duplicates.
    * Fix various issues in lvmdbusd.
  - device-mapper version upgrade to 1.02.196
    * Improve parallel creation of /dev/mapper/control device node.
    * Import previous ID_FS_* udev records in 13-dm-disk.rules for suspended DM dev.
    * Remove NAME="mapper/control" rule from 10-dm.rules to avoid udev warnings.
    * Improve 'dmsetup create' without given table line with new kernels.
    * Add DM_REPORT_GROUP_JSON_STD for more JSON standard compliant output format.
  - Drop patches that have been merged into upstream
    - 0001-devices-file-move-clean-up-after-command-is-run.patch
    - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch
    - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch
    - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch
    - 0005-pvdisplay-restore-reportformat-option.patch
    - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch
    - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch
    - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch
    - 0009-mm-remove-libaio-from-being-skipped.patch
    - 0010-dmsetup-check-also-for-ouf-of-range-value.patch
    - 0011-devices-drop-double-from-sysfs-path.patch
    - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch
    - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch
    - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch
    - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch
    - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch
  - Add upstream patch
    + 0001-lvconvert-swapmetadata-fix-lvmlockd-locking.patch
    + 0002-lvconvert-fix-ret-values-fro-integrity-remove.patch
    + 0003-lvconvert-fix-regresion-from-integrity-check.patch
    + 0004-gcc-cleanup-warnings.patch
    + 0005-lvmlockd-fix-thick-to-thin-lv-conversion.patch
    + 0006-lvmlockd-let-lockd_init_lv_args-set-lock_args.patch
    + 0007-lvmlockd-fix-lvconvert-to-thin-pool.patch
    + 0008-lvconvert-run-error-path-code-only-for-shared-VG.patch
    + 0009-vgchange-acquire-an-exclusive-VG-lock-for-refresh.patch
    + 0010-lvmlockd-client-mutex-ordering.patch
    + 0011-filesystem-move-stat-after-open-check.patch
    + 0012-tests-check-for-writecache.patch
    + 0013-lvresize-fix-32-bit-overflow-in-size-calculation.patch
    + 0014-gcc-fix-warnings-for-x32-architecture.patch
    + 0015-gcc-warning-missing-braces-around-initializer.patch
    + 0016-test-improve-aux-teardown.patch
    + 0017-tests-aux-try-with-extra-sleep.patch
    + 0018-tests-aux-using-singl-lvmconf-call.patch
    + 0019-tests-missing-to-check-for-writecache-support.patch
    + 0020-tests-pvmove-large-disk-area.patch
    + 0021-tests-enforce-full-fs-check.patch
    + 0022-tests-update-for-work-in-fake-dev-environment.patch
    + 0023-tests-skip-test-when-lvmdbusd-runs-on-the-system.patch
    + 0024-tests-better-slowdown.patch
  - Update patch
    - bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch
    - bug-1184124-link-tests-as-PIE.patch
    - bug-1184687_Add-nolvm-for-kernel-cmdline.patch
    - fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch
  - Rename & Update patch
    - bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch
    + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-rules.patch
  - update lvm2.spec
    - change upstream_device_mapper_version to 1.02.196
    - change device_mapper_version to %{lvm2_version}_1.02.196
    - add config item "-with-libexecdir=%{_libexecdir}" to fix libexec path since commit a2d33cdf
    - add new binary "%{_libexecdir}/lvresize_fs_helper" to lvm2 package


author: jengelh@inai.de
changelog:
  - Update to new upstream release 1.8.2
    * Fix incorrect handling of various targets and options in
      iptables-nft,ebtables-nft,arptables-nft.


author: kstreitova@suse.com
changelog:
  - Add iptables-1.8.2-dont_read_garbage.patch that fixes a situation
    where 'iptables -L' reads garbage from the struct as the kernel
    never filled it in the bugged case. This can lead to issues like
    mapping a few TiB of memory [bsc#1106751].


author: jengelh@inai.de
changelog:
  - Add 0001-include-fix-build-with-kernel-headers-before-4.2.patch,
    0001-include-extend-the-headers-conflict-workaround-to-in.patch
    to fix build with older linux-glibc-devel. [boo#1132821]


author: jengelh@inai.de
changelog:
  - Update to new upstream release 1.8.3
    * ebtables: Fix rule listing with counters
    * ebtables-nft: Support user-defined chain policies
  - Remove 0001-include-extend-the-headers-conflict-workaround-to-in.patch
    0001-include-fix-build-with-kernel-headers-before-4.2.patch
    (upstreamed)


author: kstreitova@suse.com
changelog:
  - Add Conflicts with iptables-nft = 1.6.2 as during the update to
    iptables 1.8 ip6tables-restore-translate, ip6tables-translate,
    iptables-restore-translate and iptables-translate were moved from
    iptables-nft subpackage (now iptables-backend-nft) to the main
    package. So we need to add a conflict here otherwise we hit file
    conflicts error during the update.


author: jengelh@inai.de
changelog:
  - Update to release 1.8.4
    * Fix for wrong counter format in `ebtables-nft-save -c` output.
    * Print typical iptables-save comments in arptables- and
      ebtables-save, too.
    * xt_owner: add --suppl-groups option
    * Remove support for /etc/xtables.conf
    * Restore support for "-4" and "-6" options in rule lines.


author: jengelh@inai.de
changelog:
  - Update to release 1.8.5
    * IDLETIMER: Add alarm timer option
    * nft: CT: add translation for NOTRACK
  - Drop iptables-apply-mktemp-fix.patch (seemingly applied)


author: jengelh@inai.de
changelog:
  - Update to release 1.8.6
    * iptables-nft had pointlessly added "bitwise" expressions to
      each IP address match, needlessly slowing down run-time
      performance (by 50% in worst cases).
    * iptables-nft-restore: Support basechain policy value of "-"
      (indicating to not change the chain's policy).
    * nft-translte: Fix translation of ICMP type "any" match.


author: jengelh@inai.de
changelog:
  - Update to release 1.8.7
    * iptables-nft:
    * Improved performance when matching on IP/MAC address prefixes
      if the prefix is byte-aligned. In ideal cases, this doubles
      packet processing performance.
    * Dump user-defined chains in lexical order. This way ruleset
      dumps become stable and easily comparable.
    * Avoid pointless table/chain creation. For instance,
      `iptables-nft -L` no longer creates missing base-chains.


author: rpm@fthiessen.de
changelog:
  - Update to upstream release 0.12.1
  - Removed upstream fixed json-c-0.12-unused_variable_size.patch
  - Added fix-set-but-not-used.patch


author: avindra@opensuse.org
changelog:
  - json-c 0.13
    + Deprecated and removed features:
    * Internal use of bits.h has been eliminated.
    * lh_abort() is deprecated
    + Behavior changes:
    * Tighten the number parsing algorithm to raise errors instead
      of truncating the results.  For example 12.3.4 or 2015-01-15,
      which now return null.
    * Use size_t for array length and size. Platforms where
      sizeof(size_t) != sizeof(int) may not be backwards compatible
    * Check for failue when allocating memory, returning NULL and
      errno=ENOMEM.
    * Change json_object_object_add() return type from void to int,
      and will return -1 on failures, instead of exiting. (Note:
      this is not an ABI change)
    + New features:
    * Aiming to follow RFC 7159 now.
    * Support for JSON pointer, RFC 6901 (see json_pointer.h)
    * Add a couple of additional option to json_object_to_json_string_ext:
    JSON_C_TO_STRING_PRETTY_TAB
    JSON_C_TO_STRING_NOSLASHESCAPE
    * json_object_object_add_ex() - better perf when certain
      constraints are known to be true
    * Serialization format of doubles now configurable
    * New functions
    - json_object_equal() - utility function for comparing
      json_objects
    - json_object_deep_copy() - a way to copy entire object
      trees
    - json_object_set_<type>() - modify the value of
      existing json_object's without the need to recreate them.
    Also add a json_object_int_inc function to adjust an int's'
    value.
    - json_util_get_last_err() - retrieve the string describing
      the cause of errors, instead of printing to stderr.
    - perllike hash function for strings
    * json_global_set_string_hash()
    * json_c_visit() - a way to iterate over a tree of json-c
      objects.
    + Notable bug fixes and other improvements:
    * Make reference increment and decrement atomic to allow
      passing json objects between threads.
    * Fix json_object_object_foreach to avoid uninitialized
      variable warnings.
    * Improve performance by removing unneeded data items from
      hashtable code and reducing duplicate hash computation.
    * Performance: store small strings inside json_object
    * Performance: of json_object_to_json_string by removing
      variadic printf
    * Fix parsing of "-Infinity", and avoid needlessly copying the
      input when doing so.
    * Fix stack buffer overflow in json_object_double_to_json_string_format()
    * Fix various potential null ptr deref and int32 overflows
    * Fix a long-standing bug in array_list_put_idx() where it
      would attempt to free previously free'd entries due to not
      checking the current array length.
    * use uselocale() instead of setlocale() in json_tokener to
      behave better in threaded environments.
    * Fix out of bounds read when handling unicode surrogate pairs.
    * Ensure doubles that happen to be a whole number are emitted
      with ".0"
    * Visual Studio: use a snprintf/vsnprintf wrapper that ensures
      the string is terminated.
    * Fix double to int cast overflow in json_object_get_int64.
    * Clamp double to int32 when narrowing in json_object_get_int.
    * Use strtoll() to parse ints - instead of sscanf
    * usual code linting
    + Build changes:
    * Add Appveyor and Travis build support
    * Support for MacOS and Windows through CMake
    * Silent build by default
    * Link against libm when needed
    * Add support for building with AddressSanitizer
    * Add support for building with Clang
    * Add a --enable-threading configure option, and only use the
      (slower) __sync_add_and_fetch()/__sync_sub_and_fetch()
      function when it is specified.
  - cleanup with spec-cleaner
  - remove fix-set-but-not-used.patch
    + fixed: https://github.com/json-c/json-c/issues/240
  - remove gcc7-fix.patch
    + fixed in 014924ba899f659917bb64392bbff7d3c803afc2


author: avindra@opensuse.org
changelog:
  - json-c 0.13.1
    * Add const size_t json_c_object_sizeof()
    * Avoid invalid free (and thus a segfault) when ref_count gets < 0
    * Fix handling of custom double formats that include a ".0"
    * Avoid uninitialized variable warnings in json_object_object_foreach
    * Add a top level fuzz directory for fuzzers run by OSS-Fuzz
    * Fix build for certain uClibc based systems.
    * Bump sonum to 4.0 to avoid conflicts because some packagers made
      their own bump to ".so.3" for the older 0.12 release


author: info@paolostivanin.com
changelog:
  - json-c 0.14:
    * bits.h has been removed
    * lh_abort() has been removed
    * lh_table_lookup() has been removed, use lh_table_lookup_ex() instead.
    * Remove TRUE and FALSE defines, use 1 and 0 instead.
    * Switch to cmake
    * Build fixes
    * Doc updates
    * Added a json_tokener_get_parse_end() function to replace
      direct access of tok->char_offset
    * json_tokener_parse_ex() now accepts a new JSON_TOKENER_VALIDATE_UTF8 flag
      to validate that input is UTF8
    * Add support for unsigned 64-bit integers
    * A total of 7 new functions were added:
    * json_object_get_uint64 ( struct json_object const* jso )
    * json_object_new_uint64 ( uint64_t i )
    * json_object_set_uint64 ( struct json_object* jso, uint64_t new_value )
    * json_parse_uint64 ( char const* buf, uint64_t* retval )
    * See description of uint64 support, above.
    * json_tokener_get_parse_end ( struct json_tokener* tok )
    * See details under "json_tokener changes", above.
    * json_object_from_fd_ex ( int fd, int in_depth )
    * Allows the max nesting depth to be specified.
    * json_object_new_null ( )
    * Simply returns NULL.  Its use is not recommended.
    * The size of struct json_object has decreased from 96 bytes to 88 bytes.


author: dcermak@suse.com
changelog:
  - Add upstream fix for boo#1173022
    * Added patch 0001-Detect-broken-RDRAND-during-initialization.patch
    * use URL from the releases page on github
    * run spec-cleaner over the spec file


author: dmueller@suse.com
changelog:
  - update to 0.15:
    * Deprecate `array_list_new()` in favor of `array_list_new2()`
    * Remove the THIS_FUNCTION_IS_DEPRECATED define.
    * Remove config.h.win32
    * Add a `JSON_TOKENER_ALLOW_TRAILING_CHARS` flag to allow multiple objects
      to be parsed even when `JSON_TOKENER_STRICT` is set.
    * Add `json_object_new_array_ext(int)` and `array_list_new_2(int)` to allow
      arrays to be allocated with the exact size needed, when known.
    * Add `json_object_array_shrink()` (and `array_list_shrink()`) and use it in
      json_tokener to minimize the amount of memory used.
    * Add a json_parse binary, for use in testing changes (not installed, but
      available in the apps directory).
    * Split the internal json_object structure into several sub-types, one for
      each json_type (json_object_object, json_object_string, etc...).
      This improves memory usage and speed, with the benchmark under
      bench/ report 5.8% faster test time and 6%(max RSS)-12%(peak heap)
      less memory usage.
      Memory used just for json_object structures decreased 27%, so use cases
      with fewer arrays and/or strings would benefit more.
    * Minimize memory usage in array handling in json_tokener by shrinking
      arrays to the exact number of elements parsed.  On bench/ benchmark:
      9% faster test time, 39%(max RSS)-50%(peak heap) less memory usage.
      Add json_object_array_shrink() and array_list_shrink() functions.
    * #616 - Parsing of surrogate pairs in unicode escapes now properly handles
      incremental parsing.
    * Fix incremental parsing of numbers, especially those with exponents, e.g.
      so parsing "[0", "e+", "-]" now properly returns an error.
      Strict mode now rejects missing exponents ("0e").
    * Successfully return number objects at the top level even when they are
      followed by a "-", "." or "e".  This makes parsing things like "123-45"
      behave consistently with things like "123xyz".
    * #589 - Detect broken RDRAND during initialization; also, fix segfault
      in the CPUID check.
    * #592 - Fix integer overflows to prevert out of bounds write on large input.
      (CVE-2020-12762, bsc#1171479)
    * Protect against division by zero in linkhash, when creaed with zero size.
    * #602 - Fix json_parse_uint64() internal error checking, leaving the retval
      untouched in more failure cases.
    * #614 - Prevent truncation when custom double formatters insert extra \0's
  - remove 0001-Detect-broken-RDRAND-during-initialization.patch (upstream)


author: ncutler@suse.com
changelog:
  - Add patch bsc1171479.patch
    + fix integer overflow and out-of-bounds write (CVE-2020-12762, bsc#1171479)


author: info@paolostivanin.com
changelog:
  - Update to 0.16: (jsc#PED-5061)
    + Deprecated and removed features:
    * JSON_C_OBJECT_KEY_IS_CONSTANT is deprecated in favor of
      JSON_C_OBJECT_ADD_CONSTANT_KEY
    * Direct access to lh_table and lh_entry structure members is deprecated.
      Use access functions instead, lh_table_head(), lh_entry_next(), etc...
    * Drop REFCOUNT_DEBUG code.
    + Changes and bug fixes
    * Cap string length at INT_MAX to avoid various issues with very long strings.
    * json_object_deep_copy: fix deep copy of strings containing '\0'
    * Fix read past end of buffer in the "json_parse" command
    * Avoid out of memory accesses in the locally provided vasprintf() function
      (for those platforms that use it)
    * Handle allocation failure in json_tokener_new_ex
    * Fix use-after-free in json_tokener_new_ex() in the event of printbuf_new() returning NULL
    * printbuf_memset(): set gaps to zero - areas within the print buffer which
      have not been initialized by using printbuf_memset
    * printbuf: return -1 on invalid arguments (len < 0 or total buffer > INT_MAX)
    * sprintbuf(): propagate printbuf_memappend errors back to the caller
    * Validate size arguments in arraylist functions.
    * Use getrandom() if available; with GRND_NONBLOCK to allow use of json-c
      very early during boot, such as part of cryptsetup.
    * Use arc4random() if it's available.
    * random_seed: on error, continue to next method instead of exiting the process
    * Close file when unable to read from /dev/urandom in get_dev_random_seed()
    * Speed up parsing by replacing ctype functions with simplified, faster
      non-locale-sensitive ones in json_tokener and json_object_to_json_string.
    * Neither vertical tab nor formfeed are considered whitespace per the JSON spec
    * json_object: speed up creation of objects, calloc() -> malloc() + set fields
    * Avoid needless extra strlen() call in json_c_shallow_copy_default() and
      json_object_equal() when the object is known to be a json_type_string.
  - remove bsc1171479.patch


author: abergmann@suse.com
changelog:
  - Initial release 0.13.0.
    A library and tools to access the kernel crypto api.
    FATE#323554 bsc#1045948


author: jengelh@inai.de
changelog:
  - Compact descriptions a bit
  - Remove libkcapi provide/requires
  - Use %_libdir throughout and avoid /lib


author: meissner@suse.com
changelog:
  - libkcapi-use-external-fipshmac.patch: use external fipshmac,
    our chroots / vm builds do not necessarily have the right kernel.


author: bwiedemann@suse.com
changelog:
  - Add reproduciblesort.patch to always link .o files in the same order and
  - Add reproducibledate.patch to not add current time to man-pages to fix build-compare


author: pmonreal@suse.com
changelog:
  - FIPS: kcapi-hasher: zeroise temporary values for FIPS 140-3
    * Add libkcapi-zeroize-hasher.patch [bsc#1222768]


author: jengelh@inai.de
changelog:
  - Update to release 2.4.3
    * Add list of authorized release signatures to README.md
    * Fix multiplexing issue with s390/s390x shm* syscalls
    * Remove the static flag from libseccomp tools compilation
    * Add define for __SNR_ppoll
    * Fix potential memory leak identified by clang in the
      scmp_bpf_sim tool
  - Drop no-static.diff, libseccomp-fix_aarch64-test.patch,
    SNR_ppoll.patch (merged)


author: rhafer@suse.com
changelog:
  - Update to release 2.5.0
    * Add support for the seccomp user notifications, see the
      seccomp_notify_alloc(3), seccomp_notify_receive(3),
      seccomp_notify_respond(3) manpages for more information
    * Add support for new filter optimization approaches, including a balanced
      tree optimization, see the SCMP_FLTATR_CTL_OPTIMIZE filter attribute for
      more information
    * Add support for the 64-bit RISC-V architecture
    * Performance improvements when adding new rules to a filter thanks to the
      use of internal shadow transactions and improved syscall lookup tables
    * Properly document the libseccomp API return values and include them in the
      stable API promise
    * Improvements to the s390 and s390x multiplexed syscall handling
    * Multiple fixes and improvements to the libseccomp manpages
    * Moved from manually maintained syscall tables to an automatically generated
      syscall table in CSV format
    * Update the syscall tables to Linux v5.8.0-rc5
    * Python bindings and build now default to Python 3.x
    * Improvements to the tests have boosted code coverage to over 93%
  - libseccomp.keyring: replaced by Paul Moore <pmoore@redhat.com> key.


author: schwab@suse.de
changelog:
  - testsuite-riscv64-missing-syscalls.patch: Fix testsuite failure on
    riscv64
  - Ignore failure of tests/52-basic-load on qemu linux-user emulation


author: dimstar@opensuse.org
changelog:
  - Do not rely on gperf: pass GPERF=/bin/true to configure and
    remove gperf BuildRequires. The syscalls.perf file it would
    generate is part of the tarball already.


author: dmueller@suse.com
changelog:
  - update to 2.5.1:
    * Fix a bug where seccomp_load() could only be called once
    * Change the notification fd handling to only request a notification fd if
    * the filter has a _NOTIFY action
    * Add documentation about SCMP_ACT_NOTIFY to the seccomp_add_rule(3) manpage
    * Clarify the maintainers' GPG keys
  - remove testsuite-riscv64-missing-syscalls.patch


author: jengelh@inai.de
changelog:
  - Update to release 2.5.2
    * Update the syscall table for Linux v5.14-rc7
    * Add a function, get_notify_fd(), to the Python bindings to
      get the nofication file descriptor.
    * Consolidate multiplexed syscall handling for all
      architectures into one location.
    * Add multiplexed syscall support to PPC and MIPS
    * The meaning of SECCOMP_IOCTL_NOTIF_ID_VALID changed within
      the kernel. libseccomp's fd notification logic was modified
      to support the kernel's previous and new usage of
      SECCOMP_IOCTL_NOTIF_ID_VALID.


author: jengelh@inai.de
changelog:
  - Update to release 2.5.3
    * Update the syscall table for Linux v5.15
    * Fix issues with multiplexed syscalls on mipsel introduced in v2.5.2
    * Document that seccomp_rule_add() may return -EACCES


author: mrueckert@suse.de
changelog:
  - reenable python bindings at least for the distro default python3
    package:
    - adds make-python-build.patch


author: kukuk@suse.de
changelog:
  - Update to version 1.0:
    - Add search in different locations for config files
    - Add support for pam_mktemp [bsc#1123878]


author: josef.moellers@suse.com
changelog:
  - prior to writing an service-specific config file, the main function
    calls access() on the destination file in /etc/pam.d.
    This will fail and no config file will be written when the original
    config file was installed in /usr/etc/pam.d.
    A similar problem exists when creating the new service file:
    create_service_file() wants to give the new service file the same
    user, group and mode as the old one, but the old one may not exist.
    In that case, set these to 0(root), 0(root), and 0644.
    [pam-config-remove-bad-access-call.patch, bsc#1187091]


author: josef.moellers@suse.com
changelog:
  - Add "revoke" to the option list for pam_keyinit
    (Remove some leftover debugs while we're at it)
    [pam-config-fix-pam_keyinit-options.patch]


author: valentin.lefebvre@suse.com
changelog:
  - Add pam_systemd_home module for the version 254 of systemd
    [pam-config-add-systemd_home-support.patch, bsc#1216318]


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#148
  - UEFI: update also default location, if it is controlled by SUSE
    (bsc#1210799, bsc#1201399)
  - 1.2


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#149
  - use signed grub EFI binary when updating grub in default EFI
    location (bsc#1210799)
  - 1.3


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#151
  - default-settings: support non-x86 architectures
  - add man pages for all commands
  - 1.4


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#153
  - check whether grub2-install supports --suse-force-signed option
  - 1.5


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#154
  - move kexec-bootloader from kexec-tools to perl-Bootloader
  - 1.6


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#156
  - bootloader_entry script can have an optional 'force-default'
    argument (bsc#1215064)
  - 1.7


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#158
  - skip warning about unsupported options when in compat mode
  - 1.8


author: sweet_f_a@gmx.de
changelog:
  - update to 2.2.5:
    * add --rsyncable functionality
    * many bug fixes
  - remove all suse patches:
    * pigz-dictzip.patch, large and unmaintained patch. If somebody
      really needs that then we should rebase and test it. In this
      case --dictzip should be probably also added to original gzip.
    * pigz-always-thread.patch was a folloup of pigz-dictzip.patch
    * pigz-do-symlinks.patch added IMO dangerous and stupid behaviour
      for symlinks. The original behaviour is now again like we know
      it from gzip, bzip2 and xz.
    * pigz-spl.patch, why we hacked in special handling of .spl
      files?
    * Generally we want to have pigz to replace gzip (and vice versa)
      so better avoiding interface incompatibilities.
  - cleanup spec file


author: adam@mizerski.pl
changelog:
  - update to 2.3
    * Don't complain about missing suffix when not writing output file
    * Put all global variables in one global structure for readability
    * Do not decompress concatenated zlib streams -- only gzip streams
    * Add option for compression level 11 to use zopfli
    * Fix handling of junk after compressed data
  - added pigz-lm.patch
    * adds missing "-lm"
  - provide unpigz binary and manpage as symlink, not copy.
  - removed fake cc script - build system honors CC
  - cleanup spec file


author: p.drouand@gmail.com
changelog:
  - Update to version 2.3.3
    * Portability improvements
    * Update copyright years in documentation
  - Add build fix patches
    * pigz-fix-wrong-include.patch
    * pigz-fix-missing-linker.patch
  - Remove pigz-lm.patch; fixed
  - Use download Url as source


author: mwilck@suse.com
changelog:
  - Update to version 15.6.1:
    * change wording in filesystem blacklist files
      (gh#openSUSE/suse-module-tools#71)
    * rpm-script: update bootloader after creating initramfs
      (boo#1213822)
    * Drop support for usrmerged distro (boo#1206798)
    * rpm-script: check for regenerate-initrd-posttrans in %posttrans
      (boo#1212957)
    * rpm-script: skip run_bootloader check (boo#1208117)
    * get rid of weak-modules (bsc#1202353)
    * Remove last mentions of mkinitrd
    * cert-script: skip cert handling if efivarfs is not writable
      (bsc#1201066, bsc#1213428)
    * weak-modules2: only use kernel version under /run/regenerate-initrd
      (boo#1201387)


author: mwilck@suse.com
changelog:
  - Update to version 15.6.2:
    * Revert "weak-modules2: only use kernel version under /run/regenerate-initrd"
      (bsc#1214877)


author: mwilck@suse.com
changelog:
  - Update to version 15.6.3:
    * blacklist RNDIS modules (bsc#1205767, jsc#PED-5731, CVE-2023-23559)
    * modprobe.d: Blacklist cls_tcindex module (bsc#1210335, CVE-2023-1829)


author: mwilck@suse.com
changelog:
  - Update to version 15.6.5:
    * Add more modules to file system blacklist (jsc#PED-6167)
      Blacklisted filesystem modules that aren't officially supported
      by SUSE: f2fs, hfsplus, jfss2, kafs, ntfs3, orangefs, pstore, romfs, zonefs.
      This affects Leap and SLED only, as these modules aren't shipped
      for SLE anyway. As usual, the blacklist entries can be removed
      by running an explicit "modrobe $FS_MODULE" command.


author: mwilck@suse.com
changelog:
  - Update to version 15.6.8:
    * macros.initrd: %regenerate_initrd_post: don't fail if mkdir is unavailable
      (boo#1217979)
    * Don't rebuild existing initramfs images if the environment variable
      SKIP_REGENERATE_ALL=1 is set (boo#1192014)


author: mwilck@suse.com
changelog:
  - Update to version 15.6.9:
    * Include unblacklist in initramfs (bsc#1224320)
    * regenerate-initrd-posttrans: run update-bootloader --refresh for XEN
      (bsc#1223278)
    * 60-io-scheduler.rules: test for "scheduler" sysfs attribute (boo#1216717)
    * README: Update blacklist description (gh#openSUSE/suse-module-tools#71)


author: jfehlig@suse.com
changelog:
  - Add system account and groups for kvm, qemu, and libvirt
    (jsc#SLE-11629)
    New files: system-group-kvm.conf, system-group-libvirt.conf,
    system-user-qemu.conf


author: fbui@suse.com
changelog:
  - Add default hardware group for 'sgx' enclave access
    Since udev v248, a default rule for /dev/sgx_enclave is provided to
    give rw access to the new group hopefully making 'sgx' the standard
    group name for such devices. [bsc#1190572]


author: msuchanek@suse.com
changelog:
  - system-user-tss.conf: Remove group entry, not needed and did
    contain syntax errors (bsc#1190401).


author: fbui@suse.com
changelog:
  - Update 1010-sysv-generator-add-back-support-for-SysV-scripts-for.patch (bsc#1221479)
    Really skip redundant dependencies specified the LSB description that
    references the file name of the service itself for early boot scripts.
    Note that the dropped code was incorrect as it didn't freed the original
    allocated pointer 'filename' but 'filename+5'.


author: fbui@suse.com
changelog:
  - Import commit e8d77af4240894da620de74fbc7823aaaa448fef
    d317008225 gpt-auto-generator: be more defensive when checking the presence of ESP in fstab
    fed117d448 journalctl: explicitly check < 0 for error
    41d9e82099 journalctl: make --until work again with --after-cursor and --lines (bsc#1221906)


author: fbui@suse.com
changelog:
  - Restore the gpt-auto generator. The workaround is not needed anymore as commit
    d317008225 (see below) should fix the issue reported in bsc#1218671.


author: fbui@suse.com
changelog:
  - Import commit 85db84ee440eac202c4b5507e96e1704269179bc (merge of v254.11)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/e8d77af4240894da620de74fbc7823aaaa448fef...85db84ee440eac202c4b5507e96e1704269179bc


author: fbui@suse.com
changelog:
  - Import commit a8a3a9567de992eb7c23705f5a55585cdc5fb4fa (merge of v254.13)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/85db84ee440eac202c4b5507e96e1704269179bc...a8a3a9567de992eb7c23705f5a55585cdc5fb4fa
  - Temporarily add 5013-Revert-run-pass-the-pty-slave-fd-to-transient-servic.patch
    This revert the backport of the broken commit 28459ba1f4df until a fix is
    released in the v254-stable tree (see pr#33216).


author: antonio.feijoo@suse.com
changelog:
  - Do not remove existing configuration files in /etc. If these files were
    modified on the systemd, that may cause unwanted side effects (bsc#1226415).


author: fbui@suse.com
changelog:
  - Import commit ea63a23a20292d4136612808bc8777db283d0bca (merge of v254.14)
  - Drop 5013-Revert-run-pass-the-pty-slave-fd-to-transient-servic.patch as
    v254.14 contains the workaround (commit e2d6762fa3fca4bf) for the broken
    commit 28459ba1f4df.


author: fbui@suse.com
changelog:
  - Import commit 957aeb6452837326866e1f89092e6d0e0665fc10 (merge of v254.15)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/ea63a23a20292d4136612808bc8777db283d0bca...957aeb6452837326866e1f89092e6d0e0665fc10


author: fbui@suse.com
changelog:
  - Import 0.5
    0c5e241 SLE: turn off RemoveIPC by default for logind (fate#320125)
    cb6914f SLE: restore ProtectHostname=no for udevd (bsc#1178374)
    7e332a6 Add a header in all each drop-ins
    465e1c7 Makefile: simplify 'archive' target


author: fbui@suse.com
changelog:
  - Import commit 6b8dde1d4f867aff713af6d6830510a84fad58d2
    6b8dde1 Convert more drop-ins into early ones


author: fbui@suse.com
changelog:
  - Import 0.8
    f34372f User priority '26' for SLE-Micro
    c8b6f0a Revert "Convert more drop-ins into early ones"


author: fbui@suse.com
changelog:
  - The usage of drop-ins is now the official way for configuring systemd and its
    various daemons on Factory/ALP. Hence the early drop-ins SUSE specific
    "feature" has been abandoned.


author: varkoly@suse.com
changelog:
  - spamassassin: migrate from cron to systemd timers (bsc#1115411)
    enable spamassassin.timer by default


author: jsegitz@suse.com
changelog:
  - Removed ixpdimm-monitor.service and readonly-root.service
    (bsc#1129270)
  - Added snapd.apparmor.service (bsc#1129435)


author: matthias.gerstner@suse.com
changelog:
  Cleanup of outdated autostart services (bsc#1171656):
  - Remove acpid.service. acpid is only available on SLE via openSUSE
    backports.  In openSUSE acpid.service is *not* autostarted. I see no
    reason why it should be on SLE.
  - Remove spamassassin.timer. This timer never seems to have existed.
    Instead spamassassin ships a "sa-update.timer". But it is not
    default-enabled and nobody ever complained about this.
  - Remove snapd.apparmor.service: This service was proactively added a year
    ago, but snapd didn't even make it into openSUSE yet. There's no reason
    to keep this entry unless snapd actually enters SLE which is not
    foreseeable.


author: fvogt@suse.com
changelog:
  - Don't enable btrfsmaintenance-refresh.service, btrfsmaintenance is
    managed by systemd-presets-common-SUSE instead (boo#1165780)


author: alarrosa@suse.com
changelog:
  - Modify branding-preset-states to fix systemd-presets-common-SUSE
    not enabling new user systemd service preset configuration just
    as it handles system service presets. By passing an (optional)
    second parameter "user", the save/apply-changes commands now
    work with user services instead of system ones (boo#1200485)


author: kukuk@suse.com
changelog:
  - Add wtmpdb-update-boot.service and wtmpdb-rotate.timer to enable
    wtmpdb as Y2038 safe wtmp replacement


author: kukuk@suse.com
changelog:
  - Don't call systemctl list-unit-files with an empty argument,
    this will break enabling of system unit files [bsc#1212496]


author: alarrosa@suse.com
changelog:
  - Fix another case of systemctl being called with an empty
    argument. This if a preemptive fix for a similar issue to
    bsc#1212496.


author: msuchanek@suse.com
changelog:
  - Split hcn-init.service to hcn-init-NetworkManager and hcn-init-wicked
    (bsc#1200731 ltc#198485 https://github.com/ibm-power-utilities/powerpc-utils/pull/84)
    Support both the old and new service to avoid complex version interdependency.


author: sbrabec@suse.com
changelog:
  - Minor multibuild fixes (PED-307):
    * Restore /bin symlinks in util-linux-systemd.
    * Restore compatibility supplements and split-provides.
    * Update safety check instructions.
    * Prevent propagating of structured comments to scriptlets.


author: ailiop@suse.com
changelog:
  - Add upstream patch
    util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch
    bsc#1207987 gh#util-linux/util-linux@1d98827edde4


author: sbrabec@suse.com
changelog:
  - Upgrade to version 2.39.3 (PED-7694):
    * libblkid: add support for bcachefs sub-device labels
    * libblkid: detect large bcachefs superblocks
    * libblkid: validate that NTFS sector_size is a power of two
    * libblkid: report endianness for VXFS
    * libmount: Fix regression when mounting with atime
    * libmount: accept '\' as escape for options separator
    * libmount: gracefully handle NULL path in mnt_resolve_target()
    * libmount: report statx in features list
    * libsmartcols: handle nameless tables in export format
    * libuuid: avoid truncation of clocks.txt to improve performance
    * lscpu: fix caches separator for --parse=<list>
    * lscpu: Add Phytium FTC862 cpu model
    * lsfd: fix the form for the optional argument of --inet option
      in manpage
    * lsfd: avoid a case of undefined behavior
    * lsfd: fix a memory leak
    * lslogins: fix -y option formatting in manpage
    * more: avoid an out-of-bound access
    * setpriv: fix some group argument completion
    * setterm: avoid restoring flags from uninitialized memory
    * umount: handle bindmounts during --recursive
    * other changes, see:
      https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/v2.39/v2.39.3-ReleaseNotes
    * Changes from 2.39.2:
    * libblkid: fix topology chain types mismatch
    * libmount:
    * handle failure to apply flags as part of a mount operation
    * improve EPERM interpretation
    * update documentation for MNT_ERR_APPLYFLAGS
    * use mount(2) for remount on Linux < 5.14
    * use some MS_* flags as superblock flags
    * setarch: add PER_LINUX_FDPIC fallback
    * uuidd: improve man page for -cont-clock
    * wall: do not error for ttys that do not exist
    * zramctl: add hint about supported algorithms
    * other changes, see:
      https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/v2.39/v2.39.2-ReleaseNotes
    * Changes from 2.39.1:
    * Various bug fixes including problem with parsing mount options.
      https://www.kernel.org/pub/linux/utils/util-linux/v2.39/v2.39.1-ReleaseNotes
    * Changes from 2.39:
    * blkpr: New command to run persistent reservations ioctls on a device.
    * pipesz: New command to set or examine pipe and FIFO buffer sizes.
    * waitpid: New command to wait for arbitrary processes.
    * mount, libmount: Supports new file descriptors based mount kernel API.
    * mount, libmount: New mount options X-mount.idmap=, X-mount.auto-fstypes,
      X-mount.{owner,group,mode}=, rootcontext=@target.
    * renice: Supports posix-compliant -n (via POSIXLY_CORRECT) and add a new
      option --relative.
    * dmesg: Supports subsecond granularity for --since and --until.
    * dmesg: Option --level accepts '+' prefix or postfix for a level name to specify
      all higher or all lower levels.
    * blkid, libblkid: Supports bcachefs.
    * fstrim: New option --types to filter out by filesystem types.
    * lsblk: --nvme and --virtio are new options to filter out devices.
    * lsblk: Improves detection of hotplug and removable status.
    * nsenter: New option --env for allowing environment variables inheritance.
    * namei: New option -Z to report SELinux contexts.
    * Many other new features and fixes. For complete list see
      https://kernel.org/pub/linux/utils/util-linux/v2.39/v2.39-ReleaseNotes
    * Changes from 2.38.1:
    * column: fix buffer overflow when -l specified, fix greedy mode
    on -l
    * dmesg: fix --since and --until
    * libmount: when moving a mount point, all sub mount entries in
      utab should also be updated (bsc#1198731)
    * libuuid: improve cache handling (bsc#1201959, PED-1150)
    * lsblk: fix JSON output when without --bytes
    * lsfd:fix crash triggered by an empty filter expression
    * sulogin: fix includes (obsoletes linux-fs.patch)
    * Many other fixes, improvements and code cleanup. For the
      complete list see
      https://www.kernel.org/pub/linux/utils/util-linux/v2.38/v2.38.1-ReleaseNotes
    * Changes from 2.38:
    * first release with translated util-linux man-pages
    * mount: new options --mkdir as shortcut for X-mount.mkdir
    * mount, libmount: new mount options X-mount.subdir=
    * lsfd: new command
    * dmesg: new option --json to print kernel log in JSON format
    * libfdisk: improved to set correct CHS addresses in MBR
    * fstrim: ignores all /ect/fstab entries with X-fstrim.notrim
      (jsc#SLE-17942)
    * hardlink: now supports reflinks and new option --method=
    * hwclock: new command line options --param-get and --param-set
    * irqtop: new option --cpu-stat
    * libblkid: supports zoned disks for btrfs
    * lsblk: new options --noempty to ignore all devices with zero
      size, and --zoned to print information about zones
    * mkswap: new option --quiet
    * nsenter: new option --wdns to change working directory within
      namespace
    * rename: new options --all and --last to replace all or last
      occurrences of expression rather than the first one
    * su: now resets RLIMIT_AS, RLIMIT_{NICE,RTPRIO}, RLIMIT_FSIZE
      and RLIMIT_NOFILE reourse limits.
    * unshare: new options --map-users= and --map-groups= to map
      block of group IDs; new option --map-auto to map the first
      block of user IDs owned by the effective user from /etc/subuid
    * wdctl: new options --setpregovernor to set pre-timeout governor
      name, and --setpretimeout to set watchdog pre-timeout in
      seconds
    * Many other new features and fixes. For the complete list see
      https://www.kernel.org/pub/linux/utils/util-linux/v2.38/v2.38-ReleaseNotes
  - Port patches/libmount-print-a-blacklist-hint-for-unknown-filesyst.patch
  - Drop upstreamed patches: util-linux-sulogin4bsc1175514.patch,
    blockdev-remove-nbsp.patch,
    util-linux-fstrim-implement-X-fstrim.notrim.patch,
    util-linux-uuidd-fix-lock-state.patch,
    util-linux-libuuid-extend-cache.patch (better upstream
    implementation exists),
    util-linux-uuidd-prevent-root-owning.patch (it should not happen
    in the re-implemented libuuid),
    util-linux-agetty-resolve-tty-if-stdin-is-specified.patch,
    util-linux-libmount-moving-mount-point-sub-mounts.patch,
    util-linux-libmount-fix-and-improve-utab-on-ms_move.patch,
    util-linux-libuuid-uuid_parse-overrun.patch,
    util-linux-libuuid-improve-cache-handling.patch,
    util-linux-libuuid-continuous-clock-handling.patch,
    util-linux-libuuid-check-clock-value.patch,
    util-linux-fix-tests-when-at-symbol-in-path.patch,
    util-linux-flock-limitations.patch,
    util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch.
  - Disable failing check fadvise/drop on ppc64le (test file does not
    appear in the kernel cache at all).


author: sbrabec@suse.com
changelog:
  - Properly neutralize escape sequences in wall
    (util-linux-wall-CVE-2024-28085.patch, bsc#1221831,
    CVE-2024-28085).


author: rgoldwyn@suse.com
changelog:
  - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU
    + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch


author: mwilck@suse.com
changelog:
  - Fix misdetection of LUKS2 partition on MD RAID
    (bsc#1224393, boo#1213227, boo#1213361)
    * add Revert-libblkid-try-LUKS2-first-when-probing.patch


author: sbrabec@suse.com
changelog:
  - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609,
    util-linux-chcpu-document-zVM-limitations.patch).


author: idonmez@suse.com
changelog:
  - Update to version 1.4.5
    * perf: Improved decompression speed (x64 >+5%, ARM >+15%)
    * perf: Automatically downsizes ZSTD_DCtx when too large for too
    * perf: Improved fast compression speed on aarch64 (#2040, ~+3%)
    * perf: Small level 1 compression speed gains (depending on compiler)
    * fix: Compression ratio regression on huge files (> 3 GB) using high
      levels (--ultra) and multithreading
    * api: ZDICT_finalizeDictionary() is promoted to stable
    * api: new experimental parameter ZSTD_d_stableOutBuffer
    * cli: New --patch-from command, create and apply patches from files
    * cli: --filelist= : Provide a list of files to operate upon from a file
    * cli: -b can now benchmark multiple files in decompression mode
    * cli: New --no-content-size command
    * cli: New --show-default-cparams command
    * misc: new diagnosis tool, checked_flipped_bits, in contrib/
    * misc: Extend largeNbDicts benchmark to compression
    * misc: experimental edit-distance match finder in contrib/


author: bwiedemann@suse.com
changelog:
  - Update to version 1.4.7
    * Improved --long mode
    * --long now automatically enabled for any window size >= 128MB
    * Faster decompression of small blocks
    * CLI improvements
      + accept parameter through environment variable ZSTD_NBTHREADS
      + new command --output-dir-mirror
      + more accurate warning and error messages
    * New experimental features
      + Shared Thread Pool
      + Faster Dictionary Compression
      + New Sequence Ingestion API
    * Drop upstream fix-lib-build.patch


author: bwiedemann@suse.com
changelog:
  - Update to version 1.4.9
    * https://github.com/facebook/zstd/releases/tag/v1.4.9
    * >2x Faster Long Distance Mode
    * New Experimental Decompression Feature: ZSTD_d_refMultipleDDicts
    * bug: Use umask() to Constrain Created File Permissions
    * bug: Make Simple Single-Pass Functions Ignore Advanced Parameters
    * cli: Fix --output-dir-mirror's Rejection of ..-Containing Paths
    * cli: Allow Input From Console When -f/--force is Passed


author: ali.abdallah@suse.com
changelog:
  - Update to version 1.5.0 (jsc#SLE-20392)
    * https://github.com/facebook/zstd/releases/tag/v1.5.0
    * Improved Middle-Level Compression Speed
    * Improved High-Level Compression Ratio
    * Faster Decompression Speed
    * Dynamic Library Supports Multithreading by Default


author: ali.abdallah@suse.com
changelog:
  - Fix CVE-2022-4899, bsc#1209533
    * Fix buffer underflow when dir1 == ""
    * Disallow empty string as an argument for --output-dir-flat=""
    and --output-dir-mirror="".
  - Added patches:
    * Disallow-empty-output-directory.patch
    * Fix-buffer-underflow-for-null-dir1.patch


author: ali.abdallah@suse.com
changelog:
  - update to 1.5.5:
    * fix: fix rare corruption bug affecting the high compression
      mode, reported by @danlark1
    * perf: improve mid-level compression speed
    * lib: deprecated bufferless block-level API (#3534) by
      @terrelln
    * cli: mmap large dictionaries to save memory, by
      @daniellerozenblit
    * cli: improve speed of --patch-from mode (~+50%) (#3545) by
      @daniellerozenblit
    * cli: improve i/o speed (~+10%) when processing lots of small
      files (#3479) by @felixhandte
    * cli: zstd no longer crashes when requested to write into
      write-protected directory (#3541) by @felixhandte
    * cli: fix decompression into block device using -o, reported
      by @georgmu
    * misc: improve seekable format ingestion speed (~+100%) for
      very small chunk sizes (#3544) by @Cyan4973
    * misc: tests/fullbench can benchmark multiple files (#3516) by
      @dloidolt
    * Upstream changelog from version 1.5.0 to 1.5.4
      https://github.com/facebook/zstd/blob/v1.5.4/CHANGELOG
    * Dropped patches:
    - Disallow-empty-output-directory.patch
    - Fix-buffer-underflow-for-null-dir1.patch
      Fixed upstream in version 1.5.4
  - enable zlib/gzip compatible backend, as zlib is significantly
    (50%-100%) faster than gzip
  - add zstd-gzip compatibility subpackage which can be used
    as a drop in compatible replacement for gzip
  - small spec file cleanups
  - add zcat in zstd-gzip (needed by for example the kernel scripts)
  - Build AVX2 enabled hwcaps library for x86_64-v3


