# changelog

author: matz@suse.com
changelog:
  - Add -std=gnu17 to move gcc15 forward, as temporary measure until
    the binutils version can be updated [bsc#1241916].


author: matz@suse.com
changelog:
  - Update to version 2.45:
    * New versioned release of libsframe.so.2
    * s390: tools now support SFrame format 2; recognize "z17" as CPU
      name [bsc#1247105, jsc#IBM-1485]
    * sframe sections are now of ELF section type SHT_GNU_SFRAME.
    * sframe secions generated by the assembler have
      SFRAME_F_FDE_FUNC_START_PCREL set.
    * riscv: Support more extensions: standard: Zicfiss v1.0, Zicfilp v1.0,
      Zcmp v1.0, Zcmt v1.0, Smrnmi v1.0, S[sm]dbltrp v1.0, S[sm]ctr v1.0,
      ssqosid v1.0, ssnpm v1.0, smnpm v1.0, smmpm v1.0, sspm v1.0, supm v1.0,
      sha v1.0, zce v1.0, smcdeleg v1.0, ssccfg v1.0, svvptc v1.0, zilsd v1.0,
      zclsd v1.0, smrnmi v1.0;
      vendor: CORE-V, xcvbitmanip v1.0 and xcvsimd v1.0;
      SiFive, xsfvqmaccdod v1.0, xsfvqmaccqoqv1.0 and xsfvfnrclipxfqf v1.0;
      T-Head: xtheadvdot v1.0;
      MIPS: xmipscbop v1.0, xmipscmov v1.0, xmipsexectl v1.0, xmipslsp v1.0.
    * Support RISC-V privileged version 1.13, profiles 20/22/23, and
      .bfloat16 directive.
    * x86: Add support for these ISAs: Intel Diamond Rapids AMX, MOVRS,
      AVX10.2 (including SM4), MSR_IMM; Zhaoxin PadLock PHE2, RNG2, GMI, XMODX.
      Drop support for  AVX10.2 256 bit rounding.
    * arm: Add support for most of Armv9.6, enabled by -march=armv9.6-a and
      extensions '+cmpbr', '+f8f16mm', '+f8f32mm', '+fprcvt', '+lsfe', '+lsui',
      '+occmo', '+pops', '+sme2p2', '+ssve-aes', '+sve-aes', '+sve-aes2',
      '+sve-bfscale', '+sve-f16f32mm' and '+sve2p2'.
    * Predefined symbols "GAS(version)" and, on non-release builds, "GAS(date)"
      are now being made available.
    * Add .errif and .warnif directives.
    * linker:
    - Add --image-base=<ADDR> option to the ELF linker to behave the same
      as -Ttext-segment for compatibility with LLD.
    - Add support for mixed LTO and non-LTO codes in relocatable output.
    - s390: linker generates .eh_frame and/or .sframe for linker
      generated .plt sections by default (can be disabled
      by --no-ld-generated-unwind-info).
    - riscv: add new PLT formats, and GNU property merge rules for zicfiss
      and zicfilp extensions.
  - gold is no longer included
  - Contains fixes for these non-CVEs (not security bugs per upstreams
    SECURITY.md):
    * bsc#1236632 aka CVE-2025-0840 aka PR32560
    * bsc#1236977 aka CVE-2025-1149 aka PR32576
    * bsc#1236978 aka CVE-2025-1148 aka PR32576
    * bsc#1236999 aka CVE-2025-1176 aka PR32636
    * bsc#1237000 aka CVE-2025-1153 aka PR32603
    * bsc#1237001 aka CVE-2025-1152 aka PR32576
    * bsc#1237003 aka CVE-2025-1151 aka PR32576
    * bsc#1237005 aka CVE-2025-1150 aka PR32576
    * bsc#1237018 aka CVE-2025-1178 aka PR32638
    * bsc#1237019 aka CVE-2025-1181 aka PR32643
    * bsc#1237020 aka CVE-2025-1180 aka PR32642
    * bsc#1237021 aka CVE-2025-1179 aka PR32640
    * bsc#1237042 aka CVE-2025-1182 aka PR32644
    * bsc#1240870 aka CVE-2025-3198 aka PR32716
    * bsc#1243756 aka CVE-2025-5244 aka PR32858
    * bsc#1243760 aka CVE-2025-5245 aka PR32829
    * bsc#1246481 aka CVE-2025-7545 aka PR33049
    * bsc#1246486 aka CVE-2025-7546 aka PR33050
    * bsc#1247114 aka CVE-2025-8224 aka PR32109
    * bsc#1247117 aka CVE-2025-8225 no PR
  - Add these backport patches:
    * pr32556.diff for bsc#1236976 aka CVE-2025-1147 aka PR32556
    * pr33457.diff for bsc#1250632 aka CVE-2025-11083 aka PR33457
    * pr33452.diff for bsc#1251275 aka CVE-2025-11412 aka PR33452
    * pr33456.diff and pr33456-2.diff for bsc#1251276 aka CVE-2025-11413
      aka PR33456
    * pr33450.diff for bsc#1251277 aka CVE-2025-11414 aka PR33450
    * pr33499.diff for bsc#1251794 aka CVE-2025-11494 aka PR33499
    * pr33502.diff for bsc#1251795 aka CVE-2025-11495 aka PR33502
  - Adjust binutils-disable-code-arch-error.diff,
    binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff,
    binutils-revert-rela.diff, binutils-skip-rpaths.patch
  - Remove pr33029.patch (upstreamed), enable-targets-gold.diff (obsolete),
    binutils-2.43.tar.bz2.sig, binutils-2.43.tar.bz2,
    binutils-2.43-branch.diff.gz
  - Add binutils-2.45.tar.bz2.sig, binutils-2.45.tar.bz2,
    binutils-2.45-branch.diff.gz
  - Rename binutils-fix-branch.diff to binutils-fix-branch.diff.templ
    as long as its empty.


author: matz@suse.com
changelog:
  - Amend binutils-compat-old-behaviour.diff to not enable
    '-z gcs=implicit' on aarch64 for old codestreams.


author: matz@suse.com
changelog:
  - Update to current 2.45 branch at 94cb1c075 to include fix
    for PR33584 (a problem related to LTO vs fortran COMMON
    blocks).


author: rguenther@suse.com
changelog:
  - Remove README in empty packages only required for SLE11 and older.
  - Remove now empty %build section.


author: rguenther@suse.com
changelog:
  - Guard gcc-devel so it is only built on Tumbleweed.
  - Remove bogus link to versioned g++.info file which doesn't exist.
    Instead refer to gcc.info from the g++ info directory entry.
    [bnc#922419]


author: rguenther@suse.com
changelog:
  - Add gccgo symlink, add go and gofmt as alternatives to support
    parallel install of golang.  [bnc#1096677]


author: rguenther@suse.com
changelog:
  - With gcc-PIE add -pie even when -fPIC is specified but we are
    not linking a shared library.  [boo#1185348]
  - Fix postun of gcc-go alternative.


author: schwab@suse.de
changelog:
  - Disable multilib and go on riscv64
  - libgcc-riscv-div.patch: Backport of r12-5799-g45116f342057b7 to fix
    build with current binutils


author: rguenther@suse.com
changelog:
  - Add gcc7-aarch64-bsc1214052.patch to fix -fstack-protector issues
    with variable length stack allocations on aarch64.
    Fixes CVE-2023-4039.  [bsc#1214052]
  - Add gcc7-aarch64-untyped_call.patch to fix issue with __builtin_apply
  - Add gcc7-lra-elim.patch to fix internal compiler error when forming
    paired loads and stores on aarch64.


author: rguenther@suse.com
changelog:
  - Add gcc7-bsc1216488.patch to avoid creating recursive DIE references
    through DW_AT_abstract_origin when using LTO.  [bsc#1216488]


author: rguenther@suse.com
changelog:
  - Add gcc7-pr88345-min-func-alignment.diff to add support for
    - fmin-function-alignment.  [bsc#1214934]


author: sflees@suse.de
changelog:
  - Fix CVE-2019-12749 Authentication bypass (CVE-2019-12749 bsc#1137832)
    * added fix-CVE-2019-12749.patch


author: sflees@suse.de
changelog:
  - Fix CVE-2020-35512 - shared UID's caused issues (CVE-2020-35512 bsc#1187105)
    * fix-upstream-userdb-constpointer.patch
    * fix-upstream-CVE-2020-35512.patch


author: sflees@suse.de
changelog:
  - Fix CVE-2020-12049 truncated messages lead to resource exhaustion
    (CVE-2020-12049, bsc#1172505)
    * fix-upstream-CVE-2020-12049.patch
  - Rebased fix-CVE-2019-12749.patch


author: dcermak@suse.com
changelog:
  - Remove pointless %%post scriptlet leveraging non-existent systemd env
    variables
    FIRST_ARG has been used in our systemd macros, but this has now been gone for
    years. Thus the true branch of the if has never been executed for years and is
    only causing warnings when installing dbus.


author: sflees@suse.de
changelog:
  - Fix a potential crash that could be triggered by an invalid signature.
    (CVE-2022-42010, bsc#1204111)
    * fix-upstream-CVE-2022-42010.patch
  - Fix an out of bounds read caused by a fixed length array (CVE-2022-42011,
    bsc#1204112)
    * fix-upstream-CVE-2022-42011.patch
  - A message in non-native endianness with out-of-band Unix file descriptors
    would cause a use-after-free and possible memory corruption CVE-2022-42012,
    bsc#1204113)
    * fix-upstream-CVE-2022-42012.patch
  - Disable asserts (bsc#1087072)
  - Refreshed patches
    * fix-upstream-CVE-2020-35512.patch


author: sflees@suse.de
changelog:
  - Sometimes unprivileged users were able to crash dbus-daemon
    (CVE-2023-34969, bsc#1212126)
    * fix-upstream-CVE-2023-34969.patch


author: antonio.feijoo@suse.com
changelog:
  - Update to version 059+suse.519.g3edf43b4:
    * chore(suse): remove obsolete fillup template (bsc#1223467)


author: antonio.feijoo@suse.com
changelog:
  - Update to version 059+suse.521.g8412a1c0:
    * fix(suse-initrd): clean return of installkernel() (bsc#1223467)


author: antonio.feijoo@suse.com
changelog:
  - Update to version 059+suse.527.g7870f083:
    * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
    * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
    * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)


author: antonio.feijoo@suse.com
changelog:
  - Update to version 059+suse.531.g48487c31:
    * feat(systemd*): include systemd config files from /usr/lib/systemd (bsc#1228398)
    * fix(convertfs): error in conditional expressions (bsc#1228847)


author: antonio.feijoo@suse.com
changelog:
  - Update to version 059+suse.539.gdd3495f7:
    * fix(dracut.spec): add Builddeps for initrd posttrans macros (bsc#1230639)
    * fix(zfcp_rules): check for presence of legacy rules (bsc#1230330)
    Fixes for NVMeoF boot (bsc#1230468):
    * fix(nvmf): install (only) required nvmf modules
    * fix(nvmf): require NVMeoF modules
    * fix(nvmf): move /etc/nvme/host{nqn,id} requirement to hostonly


author: antonio.feijoo@suse.com
changelog:
  - Update to version 059+suse.541.g3c2df232:
    * fix(dasd-rules): handle all possible options in `rd.dasd` (bsc#1230110)


author: antonio.feijoo@suse.com
changelog:
  - Update to version 059+suse.543.g98d7f037:
    * fix(dm): remove 59-persistent-storage-dm.rules (bsc#1232063)


author: antonio.feijoo@suse.com
changelog:
  - Update to version 059+suse.552.g232957b4:
    Fixes related to getting live image size (bsc#1235912):
    * fix(livenet): split `imgsize` calculation to avoid misleading error message
    * fix(livenet): check also `content-length` from live image header
    * fix(livenet): propagate error code
    Fixes for booting from iSCSI offload with bnx2i (bsc#1228086):
    * fix(iscsi): attempt iSCSI login before all interfaces are up
    * fix(iscsi): don't require network setup for bnx2i
    Other:
    * fix(dracut): rework timeout for devices added via --mount and --add-device (bsc#1231792)


author: antonio.feijoo@suse.com
changelog:
  - Update to version 059+suse.557.gccd6ab94:
    * fix(iscsi): make sure services are shut down when switching root (bsc#1237695)
    * fix(iscsi): don't require network setup for qedi
    * fix(network-legacy): do not require pgrep when using wicked (bsc#1236982)


author: antonio.feijoo@suse.com
changelog:
  - Update to version 059+suse.562.geca59f6b:
    * fix(dracut-util): crash if CMDLINE ends with quotation mark (bsc#1247819)
    * fix(rngd): adjust license to match the license of the whole project
    * fix(nfs): set correct ownership of rpc.statd state directories (bsc#1217885)
    * perf(nfs): remove references to old rpcbind state dir
    * fix(nfs): libnfsidmap plugins not added in some distributions


author: msuchanek@suse.com
changelog:
  - Update to version 1.21+git175.1ef87b2 (jsc#SLE-17288):
    * libbpf: bump dependency to >= 0.4.0
    * CMakeLists.txt: Enable SHARED and STATIC lib creation
    * libbpf: Allow to use packaged version
    * btfdiff: Support diffing DWARF vs detached BTF
    * pahole: Allow encoding BTF into a detached file
    * pahole: Add --kabi_prefix flag
    * btf_encoder: fix and complete filtering out zero-sized per-CPU variables
    * btf: Remove ftrace filter
    * pahole: Introduce --with_flexible_array option to show just types ending in a flexible array
    * Many updates to btf_encoder and bug fixes
  - Remove upstreamed patches
    - btf_encoder-fix-and-complete-filtering-out-zero-sized-per-CPU-variables.patch
    - remove-ftrace-filter.patch
  - Pretend version 1.22 to make kernel happy
    + dwarves-Prep-1.22.patch


author: msuchanek@suse.com
changelog:
  - 15.4 has new elfutils, drop libebl-plugins dependency.
  - Update to version 1.21+git177.1ef87b2:
    * Fix crash with split BTF debuginfo
    * CMakeList.txt: Bump version to the upcoming 1.22 release, not out of the door yet
    - Remove upstreamed patch dwarves-Prep-1.22.patch


author: jengelh@inai.de
changelog:
  - Update to release 1.22 (bsc#1190340).
    * Ability to encode BTF to a separate file
    * Multithreaded DWARF loading
    * Details at https://marc.info/?l=dwarves&m=162975403628056&w=2


author: jengelh@inai.de
changelog:
  - Update to release 1.23
    * Ability to encode BTF tags.
    * Ability to carry attributes to the kernel BPF verifier for
      further checks.
    * Inference of struct member unnatural alignment
      (__attribute__(__aligned__(N))) to help in generating
      compileable headers matching the original type layout from
      BTF data.


author: dmueller@suse.com
changelog:
  - update to 1.24:
    * Add support to BTF_KIND_ENUM64 to represent enumeration
      entries with more than 32 bits.
    * Support multithreaded encoding, in addition to DWARF
      multithreaded loading, speeding up the process. Selected just
      like DWARF multithreaded loading, using the 'pahole -j'
      option.
    * Encode 'char' type as signed.
    * Add support to BTF_KIND_ENUM64.
    * Introduce --lang and --lang_exclude to specify the language
      the DWARF compile units were originated from to use or
      filter.
    * Introduce --compile to generate compilable code in a similar
      fashion to: bpftool btf dump file vmlinux format c >
      vmlinux.h As with 'bpftool', this will notice type shadowing,
      i.e. multiple types with the same name and will disambiguate
      by adding a suffix.
    * Don't segfault when processing bogus files.
  - add dwarves.keyring for source validation


author: mliska@suse.cz
changelog:
  - Add 0001-pahole-Support-lang-lang_exclude-asm.patch,
    0002-btf_encoder-Add-extra-debug-info-for-unsupported-DWA.patch,
    0003-btf_encoder-Store-the-CU-being-processed-to-avoid-ch.patch,
    0004-core-Add-DW_TAG_unspecified_type-to-tag__is_tag_type.patch,
    0005-core-Record-if-a-CU-has-a-DW_TAG_unspecified_type.patch,
    0006-btf_encoder-Encode-DW_TAG_unspecified_type-returning.patch,
    0007-dwarves-Zero-initialize-struct-cu-in-cu__new-to-prev.patch
    as in order to support DW_TAG_unspecified_type that is newly
    emitted by binutils 2.40+.


author: jengelh@inai.de
changelog:
  - Update to release 1.25
    * Fixed the handling of DW_TAG_unspecified type in assembly
      functions that came with binutils 2.40
    * Allow the BTF encoding of optimized functions (ending in
      .constprop, .isra),
    * Exclude BTF optimized functions not following the calling
      convention
    * Support for DW_TAG_atomic_type
    * Support for the DW_TAG_LLVM_annotation BTF equivalent
      (BTF_KIND_TYPE_TAG) on the BTF loader and for now suppressing
      it when pretty printing
  - Drop 0001-pahole-Support-lang-lang_exclude-asm.patch,
    0002-btf_encoder-Add-extra-debug-info-for-unsupported-DWA.patch,
    0003-btf_encoder-Store-the-CU-being-processed-to-avoid-ch.patch,
    0004-core-Add-DW_TAG_unspecified_type-to-tag__is_tag_type.patch,
    0005-core-Record-if-a-CU-has-a-DW_TAG_unspecified_type.patch,
    0006-btf_encoder-Encode-DW_TAG_unspecified_type-returning.patch,
    0007-dwarves-Zero-initialize-struct-cu-in-cu__new-to-prev.patch


author: mliska@suse.cz
changelog:
  - Update to version 0.183:
    debuginfod: New thread-busy metric and more detailed error metrics.
      New --fdcache-mintmp and tracking of filesystem freespace.
      New increased webapi concurrency while grooming.
    debuginfod-client: DEBUGINFOD_SONAME macro added to debuginfod.h which
      can be used to dlopen the libdebuginfod.so library.
      New function debuginfod_set_verbose_fd and
      DEBUGINFOD_VERBOSE environment variable.
    config: profile.sh and profile.csh won't export DEBUGINFOD_URLS unless
      configured --enable-debuginfod-urls[=URLS]
    elflint, readelf: Recognize SHF_GNU_RETAIN.
      Handle SHT_X86_64_UNWIND as valid relocation target.
  - Remove config-do-not-define-DEBUGINFOD_URLS-environment-var.patch patch.


author: mliska@suse.cz
changelog:
  - Add disable-run-readelf-self-test.patch in order to disable
    a failing test-case with GCC 11 (PR27367).


author: mliska@suse.cz
changelog:
  - Update to version 0.184:
    debuginfod: Use libarchive's bsdtar as the .deb-family file unpacker.
    debuginfod-client: Client caches negative results. If a query for a
      file failed with 404, an empty 000 permission
      file is created in the cache. This will prevent
      requesting the same file for the next 10 minutes.
      Client objects now carry long-lived curl handles
      for outgoing connections.  This makes it more
      efficient for multiple sequential queries, because
      the TCP connections and/or TLS state info are kept
      around awhile, avoiding O(100ms) setup latencies.
    libdw: handle DW_FORM_indirect when reading attributes
    translations: Update Polish translation.


author: mliska@suse.cz
changelog:
  - Update to version 0.185:
    debuginfod-client: Simplify curl handle reuse so downloads which
      return an error are retried.
    elfcompress: Always exit with code 0 when the operation succeeds (even
      when nothing was done). On error the exit code is now always 1.


author: jcheung@suse.com
changelog:
  - For version 0.185, the below patches are no longer needed
    (jsc#SLE-17288, jsc#SLE-17951)
    libdw-check-end-of-attributes-list-consistently.patch
    elflint-dont-check-section-group-without-flags-word.patch
    libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
    libdw-readelf-make-sure-there-is-enough-data-to-read.patch
    elfutils-dont-trust-sh_entsize.patch
    elflint-check-symbol-table-data-is-big-enough-before-check.patch
    size-handle-recursive-elf-ar-files.patch
    elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
    use-the-empty-string-for-note-names-with-zero-size.patch
    readelf-fix-off-by-one-sanity-check.patch
    libebl-check-NT_PLATFORM-core-notes.patch
    libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
    libelf-check-compression-before-allocate-output-buffer.patch
    libdwfl-sanity-check-partial-core-file-data-reads.patch
    arlib-check-that-sh_entsize-isnt-zero.patch


author: martin.liska@suse.com
changelog:
  - Enhance license fields: all the libraries actually have a different
    license to the tools. While the tools are GPL-3.0-or-later, the
    libraries are (LGPL-3.0-or-later OR GPL-2.0-or-later)
    SLE bug (for tracking the above) bsc#1191310


author: matz@suse.com
changelog:
  - Add elfutils-fix-large-alignment.diff and elfutils-pr28190.diff
    to fix build/testsuite for more recent glibc and kernels.
  - Add elfutils-fuzz-1.diff, elfutils-fuzz-2.diff,
    elfutils-fuzz-3.diff, elfutils-fuzz-4.diff [bsc#1237236,
    bsc#1237240, bsc#1237241, bsc#1237242].
  - Add elfutils-fix-debuginfod-groom-race.diff to fix a testsuite
    race in run-debuginfod-find.sh.


author: jengelh@inai.de
changelog:
  - Update package summaries. Replace old RPM constructs.
  - Remove --with-pic which is useless with --disable-static.
  - Edit pre_checkin.sh to remove dead python3 file.


author: werner@suse.de
changelog:
  - Add patch file-a642587a9c.patch for bsc#1096974, bsc#1096984, and
    CVE-2018-10360 -- Avoid reading past the end of buffer


author: werner@suse.de
changelog:
  - Add patch 0002-PR-62-spinpx-limit-size-of-file_printable.patch to
    fix bsc#1126117, bsc#1126118, and bsc#1126119 for CVE-2019-8905,
    CVE-2019-8906, and CVE-2019-8907


author: werner@suse.de
changelog:
  - Add temporary patch CVE-2019-18218-46a8443f.patch from upstream
    to fix bsc#1154661 -- heap-based buffer overflow in cdf_read_property_info in cdf.c


author: werner@suse.de
changelog:
  - Add patchfix_of_backport_PR-62.patch as previous backport caused
    a shorten output of the elf interprter (bsc#1176123)


author: jsikes@suse.de
changelog:
  - Updated fipscheck to 1.5.0
    * Changed source to local file since latest official release
      is not in the official releases directory.
    * Downgraded libopenssl-devel to libopenssl-1_0_0-devel because
      1.0.2 supports FIPS.


author: vcizek@suse.com
changelog:
  - Use the shipped manpages instead of building them with xmlto
    in order to avoid a build cycle (fipscheck, xmlto, libxslt, libgcrypt)
    * add fipscheck-dont_generate_manpages.patch
  - fix build on older distributions


author: vcizek@suse.com
changelog:
  - Remove #include of unused fips.h to fix build with OpenSSL 1.1.1
    (bsc#1149792)
    * add fipscheck-fips.h_not_needed.patch
  - Drop obsolete openssl-1_1-port.patch (upstream)


author: meissner@suse.com
changelog:
  - updated to 1.7.0 (from a different supplier)
    - openssl 3 support
  - dropped fipscheck-dont_generate_manpages.patch (not needed)
  - dropped fipscheck-fips.h_not_needed.patch (not needed)


author: mjambor@suse.com
changelog:
  - Backport upstream patches fipscheck-fix_check_openssl_version.patch
    and fipscheck-fix_incorrect_length_type.patch to fix C99 violations
    which are errors by default with GCC 14 [boo#1221714] - although the
    first one looks like it possibly fixes some more substantial error.


author: astieger@suse.com
changelog:
  - GNU awk 4.1.3:
    * Regexp parsing with extra brackets should now be working again.
    * Updated to latest config.guess and config.sub.
    * bug fixes


author: astieger@suse.com
changelog:
  * GNU awk 4.1.4:
    * z/OS support updated
    * debugger improvements
    * return value of system() enhanced to convey more information
    * two-way pipe handling improved
    * The -d option now allows -d- to print to standard output.
    * The DJGPP port is now officially deprecated.


author: josef.moellers@suse.com
changelog:
  - Added an explicit rpmlint rule to keep one file (gawkapi.h)
    from requiring a separate package.
    [+gawk.rpmlintrc]


author: schwab@linux-m68k.org
changelog:
  - Update to gawk 4.2.0
    * If not in POSIX mode, changes to ENVIRON are reflected into
      gawk's environment
    * The series of numbers returned by rand() should now be "more
      random" than previously
    * Multiple changes related to the pretty printer
    * The igawk script and igawk.1 man page are no longer installed
    * Gawk now processes a maximum of two hexadecimal digits in \x
      escape sequences inside strings
    * Setting PROCINFO["redirection", "NONFATAL"] to true makes I/O
      errors for "redirection" not fatal
    * Gawk now supports retryable I/O via PROCINFO[input-file, "RETRY"]
    * Revisions in the POSIX standard remove the special case for POSIX
      mode when FS = " " where newline was not a field separator
    * Gawk now supports strongly typed regexp constants
    * The new typeof() function can be used to indicate if a variable or
      array element is an array, regexp, string or number
    * Optimizations are now enabled by default
    * Passing negative operands to any of the bitwise functions now
      produces a fatal error
    * The mktime function now accepts an optional second argument
    * The FIELDWIDTHS parsing syntax has been enhanced to allow specifying
      how many characters to skip before a field starts
    * The PROCINFO["argv"] array records all of gawk's command line arguments
      as gawk received them
  - gawk_ppc64le_ignore_transient_test_time_failure.patch: removed


author: astieger@suse.com
changelog:
  - GNU awk 4.2.1:
    * documentation updates
    * In MPFR mode, When ROUNDMODE changes, string values for
      numerically type values will be redone
    * various bug fixes
    * drop fold-string.patch, upstream
  - Use %license (boo#1082318)


author: schwab@suse.de
changelog:
  - format-tree-positional-arg.patch: Validate index into argument list
    (CVE-2023-4156, bsc#1214025)


author: schwab@suse.de
changelog:
  - assert-message-allocation.patch: Fix underallocation of abort_msg_s
    struct (CVE-2025-0395, bsc#1236282, BZ #32582))


author: schwab@suse.de
changelog:
  - Bump minimal kernel version to 4.3 to enable use of direct socketcalls
    on x86-32 and s390x (bsc#1234713)


author: schwab@suse.de
changelog:
  - static-setuid-ld-library-path.patch: elf: Ignore LD_LIBRARY_PATH and
    debug env var for setuid for static (CVE-2025-4802, bsc#1243317)


author: schwab@suse.de
changelog:
  - regcomp-double-free.patch: posix: Fix double-free after allocation
    failure in regcomp (CVE-2025-8058, bsc#1246965, BZ #33185)


author: schwab@suse.de
changelog:
  - memalign-overflow-check.patch: memalign: reinstate alignment overflow
    check (CVE-2026-0861, bsc#1256766, BZ #33796)
  - nss-dns-getnetbyaddr.patch: resolv: Fix NSS DNS backend for getnetbyaddr
    (CVE-2026-0915, bsc#1256822, BZ #33802)
  - nptl-optimize-trylock.patch: nptl: Optimize trylock for high cache
    contention workloads (bsc#1256437, BZ #33704)
  - wordexp-wrde-reuse.patch: posix: Reset wordexp_t fields with WRDE_REUSE
    (CVE-2025-15281, bsc#1257005, BZ #33814)


author: schwab@suse.de
changelog:
  - nss-missing-checks.patch: nss: Missing checks in __nss_configure_lookup,
    __nss_database_get (bsc#1258319, BZ #28940)


author: pvorel@suse.cz
changelog:
  - Update to version 20211215
    https://github.com/iputils/iputils/releases/tag/20211215
  - rarpd and rdisc are going to be removed in next release
    (https://github.com/iputils/iputils/issues/363)
    therefore don't pack it since this release
  - Drop harden_rdisc.service.patch, which was 1) merged upstream
    4bb0ace ("systemd: Add ProtectHostname, ProtectKernelLogs")
    for all services
    2) we don't build rdisc since this release


author: pvorel@suse.cz
changelog:
  - Backport 2 fixes for bsc#1203957:
    0001-ping-Add-SA_RESTART-to-sa_flags.patch
    0002-ping-Make-ping_rts-struct-static.patch


author: pvorel@suse.cz
changelog:
  - Update to version 20221126
    https://github.com/iputils/iputils/releases/tag/20221126
  - Update configure variables (ninfod, rarpd and rdisc were removed from
    upstream in next release => remove -DBUILD_NINFOD=false -DBUILD_RARPD=false
    - DBUILD_RDISC=false)
  - Remove 2 backported fixes from this release
    0001-ping-Add-SA_RESTART-to-sa_flags.patch
    0002-ping-Make-ping_rts-struct-static.patch


author: pvorel@suse.cz
changelog:
  - Backport upstream fix for bsc#1224877
    4db1de6 ("arping: Fix 1s delay on exit for unsolicited arpings")
    0001-arping-Fix-1s-delay-on-exit-for-unsolicited-arpings.patch


author: pvorel@suse.cz
changelog:
  - Backport proposed fix for regression in upstream commit 4db1de6 (bsc#1224877)
    0002-arping-Fix-unsolicited-ARP-regressions-on-c-1.patch


author: pvorel@suse.cz
changelog:
  - Update 0002-arping-Fix-unsolicited-ARP-regressions-on-c-1.patch
    after upstream merged the fix, update git commit hashes.


author: angel.yankov@suse.com
changelog:
  - Security fix [bsc#1242300, CVE-2025-47268]
    * integer overflow in RTT calculation can lead to undefined behavior
    * Add iputils-CVE-2025-47268.patch


author: angel.yankov@suse.com
changelog:
  - Security fix [bsc#1243772, CVE-2025-48964]
    * Fix  integer overflow in ping statistics via zero timestamp
    * Add iputils-CVE-2025-48964_01.patch
    * Add iputils-CVE-2025-48964_02.patch
    * Add iputils-CVE-2025-48964_03.patch
    * Add iputils-CVE-2025-48964_04.patch
    * Add iputils-CVE-2025-48964_regression.patch


author: sbrabec@suse.com
changelog:
  - Update to version 2.3.0:
    * Added libkfont library (internal yet).
    * Added Canadian Multilingual Standard keyboard map.
    * Added us1 that maps Right Alt to AltGr and Shift+Tab to
      Alt+Tab.
    * The dead_macron is used instead of macron in fi.map.
    * Added retries when switching to the console (chvt, openvt).
    * Added option -d to double size of font (setfont).
    * Added long options, help messages.
    * Added solar24x32 font.
    * Updated eurlatgr font.
    * Fixed problems with formatting man pages.
    * Fixed search path error (boo#1176854).
  - Refresh partially upstreamed kbd-1.15.2-dumpkeys-C-opt.patch
  - Drop upstreamed libkeymap-Fix-mk_mapname-for-the-plain-map.patch
  - Refresh kbd-1.15.2-setfont-no-cruft.patch and
    kbd-1.15.5-loadkeys-search-path.patch


author: jslaby@suse.cz
changelog:
  - Update to version 2.4.0:
    * po: Update cs and sr translations (from translationproject.org)
    * libkfont: Use only KDFONTOP
    * Added support for a few derivatives of neo
    * Fix use-after-free of pipe_cmd
    * Update solar24x32 font
    * vlock's pam config added to destination directory
    * Update sun12x22.psfu
    * libkeymap: unify non/unicode accent_table generation
    * libkeymap: note about --unicode use
    * libkeymap: remove last ushort
    * fi.map: use newly added deadkeys
    * Do not install internal library
    * Additional deadkeys
  - Remove kbd-1.15.2-setfont-no-cruft.patch
    The old ioctls were finally dropped.


author: christophe@krop.fr
changelog:
  - Update the installed license file.
    COPYING is a symlink to LICENSE. Let's use this file directly.


author: kukuk@suse.com
changelog:
  - Only run kbdsettings.service if /etc/sysconfig/keyboard exists.
    Necessary for image based installations without admin made changes.


author: fvogt@suse.com
changelog:
  - Add patch to fix random doubling of font sizes (bsc#1194698):
    * 0001-libkfont-Initialize-kfont_context-options.patch


author: fbui@suse.com
changelog:
  - Add 'ara' vc keymap (bsc#1210702)
    'ara' is slightly better than 'arabic' as it matches the name of its x11
    layout counterpart. Keep 'arabic' for backward compatibility sake.


author: sbrabec@suse.com
changelog:
  - Don't search for resources in the current directory. It can cause
    unwanted side effects or even infinite loop (bsc#1237230,
    kbd-ignore-working-directory-1.patch,
    kbd-ignore-working-directory-2.patch,
    kbd-ignore-working-directory-3.patch).


author: fmancera@suse.de
changelog:
  - net/sched: cls_u32: use skb_header_pointer_careful()
    (CVE-2026-23204 bsc#1258340).
    In addition backport 13e00fdc9236b which introduces
    skb_header_pointer_careful() helper which is required.
  - commit 926e136


author: mkubecek@suse.cz
changelog:
  - net/sched: ets: Always remove class from active list before
    deleting in ets_qdisc_change (CVE-2025-71066 bsc#1256645).
  - commit bd83957


author: ohering@suse.de
changelog:
  - net: mana: Ring doorbell at 4 CQ wraparounds (git-fixes).
  - net: mana: Fix double destroy_workqueue on service rescan PCI path (git-fixes).
  - PCI: hv: remove unnecessary module_init/exit functions (git-fixes).
  - PCI: hv: Remove unused field pci_bus in struct hv_pcibus_device (git-fixes).
  - RDMA/mana_ib: Add device-memory support (git-fixes).
  - RDMA/mana_ib: Take CQ type from the device type (git-fixes).
  - net: mana: Implement ndo_tx_timeout and serialize queue resets per port (bsc#1257472).
  - RDMA/mana_ib: check cqe length for kernel CQs (git-fixes).
  - net: mana: Fix use-after-free in reset service rescan path (git-fixes).
  - Drivers: hv: fix missing kernel-doc description for 'size' in request_arr_init() (git-fixes).
  - Drivers: hv: remove stale comment (git-fixes).
  - net: mana: Handle hardware recovery events when probing the device (bsc#1257466).
  - net: mana: Drop TX skb on post_work_request failure and unmap resources (git-fixes).
  - net: mana: Handle SKB if TX SGEs exceed hardware limit (git-fixes).
  - net: mana: Add standard counter rx_missed_errors (git-fixes).
  - net: mana: Move hardware counter stats from per-port to per-VF context (git-fixes).
  - net: mana: Support HW link state events (bsc#1253049).
  - Drivers: hv: vmbus: Fix typos in vmbus_drv.c (git-fixes).
  - Drivers: hv: vmbus: Fix sysfs output format for ring buffer index (git-fixes).
  - Drivers: hv: vmbus: Clean up sscanf format specifier in target_cpu_store() (git-fixes).
  - scsi: storvsc: Remove redundant ternary operators (git-fixes).
  - RDMA/mana_ib: Extend modify QP (git-fixes).
  - RDMA/mana_ib: Drain send wrs of GSI QP (git-fixes).
  - net: mana: Reduce waiting time if HWC not responding (bsc#1252266).
  - RDMA/mana_ib: add support of multiple ports (bsc#1251135).
  - RDMA/mana_ib: add additional port counters (bsc#1251135).
  - RDMA/mana_ib: Fix DSCP value in modify QP (git-fixes).
  - RDMA/mana_ib: Add device statistics support (git-fixes).
  - net: mana: fix spelling for mana_gd_deregiser_irq() (git-fixes).
  - net: mana: Handle Reset Request from MANA NIC (bsc#1245728 bsc#1251971).
  - net: mana: Handle unsupported HWC commands (git-fixes).
  - net: mana: Fix warnings for missing export.h header inclusion (git-fixes).
  - PCI: hv: Remove unnecessary flex array in struct pci_packet (git-fixes).
  - tools: hv: Enable debug logs for hv_kvp_daemon (git-fixes).
  - net: mana: Add support for auxiliary device servicing events (bsc#1251971).
  - RDMA/mana_ib: unify mana_ib functions to support any gdma device (git-fixes).
  - RDMA/mana_ib: Add support of mana_ib for RNIC and ETH nic (git-fixes).
  - net: mana: Probe rdma device in mana driver (git-fixes).
  - RDMA/mana_ib: Add support of 4M, 1G, and 2G pages (git-fixes).
  - RDMA/mana_ib: support of the zero based MRs (bsc#1251135).
  - RDMA/mana_ib: Access remote atomic for MRs (bsc#1251135).
  - RDMA/mana_ib: Fix integer overflow during queue creation (bsc#1251135).
  - RDMA/mana_ib: Handle net event for pointing to the current netdev (bsc#1256690).
  - net: mana: Change the function signature of mana_get_primary_netdev_rcu (bsc#1256690).
  - RDMA/mana_ib: Use safer allocation function() (bsc#1251135).
  - RDMA/mana_ib: Implement DMABUF MR support (git-fixes).
  - RDMA/mana_ib: Fix error code in probe() (git-fixes).
  - RDMA/mana_ib: Add port statistics support (git-fixes).
  - RDMA/mana_ib: request error CQEs when supported (git-fixes).
  - RDMA/mana_ib: Query feature_flags bitmask from FW (git-fixes).
  - RDMA/mana_ib: indicate CM support (git-fixes).
  - RDMA/mana_ib: polling of CQs for GSI/UD (git-fixes).
  - RDMA/mana_ib: extend mana QP table (git-fixes).
  - RDMA/mana_ib: implement req_notify_cq (git-fixes).
  - RDMA/mana_ib: UD/GSI work requests (git-fixes).
  - RDMA/mana_ib: create/destroy AH (git-fixes).
  - RDMA/mana_ib: UD/GSI QP creation for kernel (git-fixes).
  - RDMA/mana_ib: Create and destroy UD/GSI QP (git-fixes).
  - RDMA/mana_ib: create kernel-level CQs (git-fixes).
  - RDMA/mana_ib: helpers to allocate kernel queues (git-fixes).
  - RDMA/mana_ib: implement get_dma_mr (git-fixes).
  - RDMA/mana_ib: Allow registration of DMA-mapped memory in PDs (git-fixes).
  - PCI: hv: Correct a comment (git-fixes).
  - net: mana: Add metadata support for xdp mode (git-fixes).
  - tools/hv: reduce resource usage in hv_kvp_daemon (git-fixes).
  - tools/hv: add a .gitignore file (git-fixes).
  - tools/hv: reduce resouce usage in hv_get_dns_info helper (git-fixes).
  - hv/hv_kvp_daemon: Pass NIC name to hv_get_dns_info as well (git-fixes).
  - net: mana: use ethtool string helpers (git-fixes).
  - tools: hv: lsvmbus: change shebang to use python3 (git-fixes).
  - RDMA/mana_ib: Set correct device into ib (git-fixes).
  - RDMA/mana_ib: Process QP error events in mana_ib (git-fixes).
  - RDMA/mana_ib: extend query device (git-fixes).
  - RDMA/mana_ib: set node_guid (git-fixes).
  - RDMA/mana_ib: Modify QP state (git-fixes).
  - RDMA/mana_ib: Implement uapi to create and destroy RC QP (git-fixes).
  - RDMA/mana_ib: Create and destroy RC QP (git-fixes).
  - net: mana: Use mana_cleanup_port_context() for rxq cleanup (git-fixes).
  - RDMA/mana_ib: implement uapi for creation of rnic cq (git-fixes).
  - RDMA/mana_ib: boundary check before installing cq callbacks (git-fixes CVE-2024-38542 bsc#1226591).
  - RDMA/mana_ib: introduce a helper to remove cq callbacks (git-fixes).
  - RDMA/mana_ib: create and destroy RNIC cqs (git-fixes).
  - RDMA/mana_ib: create EQs for RNIC CQs (git-fixes).
  - RDMA/mana_ib: Fix missing ret value (git-fixes).
  - RDMA/mana_ib: Configure mac address in RNIC (git-fixes).
  - RDMA/mana_ib: Adding and deleting GIDs (git-fixes).
  - RDMA/mana_ib: Enable RoCE on port 1 (git-fixes).
  - RDMA/mana_ib: Implement port parameters (git-fixes).
  - RDMA/mana_ib: Create and destroy rnic adapter (git-fixes).
  - RDMA/mana_ib: Add EQ creation for rnic adapter (git-fixes).
  - RDMA/mana_ib: Use num_comp_vectors of ib_device (git-fixes).
  - RDMA/mana_ib: remove useless return values from dbg prints (git-fixes).
  - RDMA/mana_ib: Use struct mana_ib_queue for RAW QPs (git-fixes).
  - RDMA/mana_ib: Use struct mana_ib_queue for WQs (git-fixes).
  - RDMA/mana_ib: Use struct mana_ib_queue for CQs (git-fixes).
  - RDMA/mana_ib: Introduce helpers to create and destroy mana queues (git-fixes).
  - hv/hv_kvp_daemon: Handle IPv4 and Ipv6 combination for keyfile format (git-fixes).
  - RDMA/mana_ib: Introduce mana_ib_install_cq_cb helper function (git-fixes).
  - RDMA/mana_ib: Introduce mana_ib_get_netdev helper function (git-fixes).
  - RDMA/mana_ib: Introduce mdev_to_gc helper function (git-fixes).
  - commit 8690084


author: ddiss@suse.de
changelog:
  - apparmor: fix race between freeing data and fs accessing it
    (bsc#1258849).
  - apparmor: fix race on rawdata dereference (bsc#1258849).
  - apparmor: fix differential encoding verification (bsc#1258849).
  - apparmor: fix unprivileged local user can do privileged policy
    management (bsc#1258849).
  - apparmor: Fix double free of ns_name in aa_replace_profiles()
    (bsc#1258849).
  - apparmor: fix missing bounds check on DEFAULT table in
    verify_dfa() (bsc#1258849).
  - apparmor: fix side-effect bug in match_char() macro usage
    (bsc#1258849).
  - apparmor: fix: limit the number of levels of policy namespaces
    (bsc#1258849).
  - apparmor: replace recursive profile removal with iterative
    approach (bsc#1258849).
  - apparmor: fix memory leak in verify_header (bsc#1258849).
  - apparmor: validate DFA start states are in bounds in unpack_pdb
    (bsc#1258849).
  - commit 9f31a2e


author: duwe@suse.de
changelog:
  - crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (CVE-2025-71231 bsc#1258424).
  - commit f8a95c7


author: jengelh@inai.de
changelog:
  - Update to release 29
    * Fix `modinfo -F` not working for built-in modules and
      certain fields.
    * Fix a memory leak, overflow and double free on error path.
  - Drop 0001-Fix-modinfo-F-always-shows-name-for-built-ins.patch,
    0001-libkmod-config-revamp-kcmdline-parsing-into-a-state-.patch,
    0002-libkmod-config-re-quote-option-from-kernel-cmdline.patch
    (all merged)


author: msuchanek@suse.de
changelog:
  - /usr/lib should override /lib where both are available. Support /usr/lib for
    depmod.d as well.
    * Refresh usr-lib-modprobe.patch
  - Remove test patches included in release 29
    - kmod-populate-modules-Use-more-bash-more-quotes.patch
    - kmod-testsuite-compress-modules-if-feature-is-enabled.patch
    - kmod-also-test-xz-compression.patch


author: msuchanek@suse.de
changelog:
  - Display module information even for modules built into the running kernel
    (bsc#1189537).
    + libkmod-Provide-info-even-for-modules-built-into-the.patch


author: msuchanek@suse.com
changelog:
  - Use docbook 4 rather than docbook 5 for building man pages (bsc#1190190).
    * Refres no-stylesheet-download.patch


author: msuchanek@suse.com
changelog:
  - Enable ZSTD on 15.3 as well (boo#1192104).
  - Only test ZSTD in testsuite on releases where it is available.


author: msuchanek@suse.de
changelog:
  - man: modprobe.d: document the config file order handling (bsc#1253741)
    * man-modprobe.d-document-the-config-file-order-handling.patch


author: suse-beta@cboltz.de
changelog:
  - Update to AppArmor 3.1.7
    - aa-logprof: don't skip exec events in hats
    - fix aa-cleanprof to work with named profiles
    - add permissions in various abstractions
    - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.1.7
      for the full list of changes
  - drop upstreamed apparmor-systemd-sessions.patch


author: ddiss@suse.com
changelog:
  - Add apparmor-abstractions-openssl-allow-version-specific-en.patch to
    allow version specific engdef & engines openssl paths (boo#1219571)


author: nopower@suse.com
changelog:
  - Add smbd-unix_chkpwd.diff to allow smbd to execute
    unix_chkpwd and fix other pam related denies; (boo#1220032).


author: suse-beta@cboltz.de
changelog:
  - Remove workaround for boo#853019 in %postun parser -
    apparmor.service contains a more safe workaround.
    This also fixes boo#1220708 (missing daemon-reload).


author: valentin.lefebvre@suse.com
changelog:
  - Allow dovecot-auth to execute unix_chkpwd from /sbin, not only from /usr/bin
    (bsc#1234452)
    * Update dovecot-unix_chkpwd.diff


author: valentin.lefebvre@suse.com
changelog:
  - Allow pam_unix to execute unix_chkpwd with abi/3.0
    - remove dovecot-unix_chkpwd.diff
    - Add allow-pam_unix-to-execute-unix_chkpwd.patch
    - Add revert-abi-change-for-unix_chkpwd.patch
    (bsc#1234452, bsc#1232234)


author: valentin.lefebvre@suse.com
changelog:
  - Add dac_read_search capability for unix_chkpwd to allow it to read the shadow
    file even if it has 000 permissions. This is needed after the CVE-2024-10041
    fix in PAM.
    * unix-chkpwd-add-read-capability.path, bsc#1241678


author: lnussel@suse.de
changelog:
  - Update to version 0.0+git20171227.670229c:
    * Added ABI version number
    * AVX2/AVX-512F optimizations of BLAMKA
    * Set Argon2 version number from the command line
    * New bindings
    * Minor bug and warning fixes (no security issue)
  - use _service file


author: wolfgang.frisch@suse.com
changelog:
  - Update to version 0.0+git20190520.62358ba (boo#1170512):
    * Fix the Makefile to install libargon2.pc.
    * Wait for already running threads if a thread creation failed.
    * Added Argon2 Erlang binding.
    * Additional JVM bindings (Jargon2).


author: rpm@fthiessen.de
changelog:
  - Fix version of package: 20190702 is the upstream version number
    of the package
  - Replaced optflags.patch with adjust-makefile.patch, the
    patch will now also allow to set the file permissions of installed
    libraries. This fixes the rpmlint error: shared-library-not-executable


author: schwab@suse.de
changelog:
  - Update to GCC 15 branch head, 15.1.1+git9866
  - Fix PR120827, ICE due to splitter emitting constant loads directly


author: rguenther@suse.com
changelog:
  - Prune the use of update-alternatives from openSUSE Factory and
    SLFO.
  - Adjust crosses to conflict consistently where they did not
    already and make them use unsuffixed binaries.


author: schwab@suse.de
changelog:
  - Update to GCC 15 branch head, 15.1.1+git9973
  - Fixes PR120995, unrecognizable insn UNSPEC_COMPARE_AND_SWAP with
    rv64gc_zabha_zacas


author: schwab@suse.de
changelog:
  - Update to GCC 15 branch head, 15.1.1+gitt10077
  - Fixes PR120714, RISC-V: incorrect frame pointer CFA address for
    stack-clash protection loops


author: rguenther@suse.com
changelog:
  - Update to GCC 15.2 release
    * the GCC 15.2 release contains regression fixes accumulated since
      the GCC 15.1 release


author: rguenther@suse.com
changelog:
  - Add gcc15-bsc1253043.patch to enable the use of _dl_find_object
    even when not available at build time.  [bsc#1253043]


author: shung-hsi.yu@suse.com
changelog:
  - Update to release 0.8.0
    * New features and APIs:
    - support auto-resolution of binaries and shared libraries from PATH, if necessary;
    - support attaching by function names (only by IP was supported before);
    - support attaching to USDTs (SEC("usdt/...") and
      bpf_program__attach_usdt()) with initially supported architectures:
      x86-64 (amd64); x86 (i386); s390x; ARM64 (aarch64); RISC V (riscv);
    - improved BPF verifier log reporting for CO-RE relocation failures (no
      more obscure "invalid func unknown#195896080" errors);
    - auto-adjust BPF ringbuf size according to host kernel's page size requirements;
    - high-level BPF map APIs: bpf_map__lookup_elem(), bpf_map__update_elem(),
      etc that validate key/value buffer sizes;
    - bpf_link_create() can create all bpf_link-based (including raw_tp,
      fentry/fexit, etc), falling back to bpf_raw_tracepoint_open() on old
      kernels transparently;
    - support opting out from auto-loading BPF programs declaratively with
      SEC("?...");
    - support opting out from auto-creation of declarative BPF maps with
      bpf_map__set_autocreate();
    - support multi-kprobes (SEC("kprobe.multi/...") and
      bpf_program__attach_kprobe_multi_opts());
    - support target-less SEC() programs (e.g., SEC("kprobe"), SEC("tp"), etc);
    - support BPF sub-skeletons for "incomplete" BPF object files (requires
      matching bpftool to generate .subskel.h);
    - BPF cookie support for fentry/fexit/fmod_ret BPF programs
      (bpf_program__attach_trace_opts());
    - support for custom SEC() handlers (libbpf_register_prog_handler()).
    * BPF-side API
    - BPF-side USDT APIs. See new usdt.bpf.h header:
    * BPF_USDT() program wrapper macro; bpf_usdt_arg(), bpf_usdt_arg_cnt(),
    * bpf_usdt_cookie() helpers;
    - new bpf_core_field_offset() CO-RE helper and support
      bpf_core_field_size(type, field) forms;
    - barrier() and barrier_var() macros for improving BPF code generation;
    - __kptr and __kptr_ref tags added;
    - ARC architecture support in bpf_tracing.h header;
    - new BPF helpers:
    * bpf_skb_set_tstamp();
    * bpf_ima_file_hash();
    * bpf_kptr_xchg();
    * bpf_map_lookup_percpu_elem().
    * Bug fixes
    - netlink bug fixes;
    - libbpf.pc fixes to support patch releases properly;
    - BPF_MAP_TYPE_PERF_EVENT_ARRAY map auto-pinning fix;
    - minor CO-RE fixes and improvements for some corner cases;
    - various other small fixes and improvements.


author: dmueller@suse.com
changelog:
  - update to 1.0.1:
    * fix inadvertently changed struct bpf_object_open_opts memory layout;
    * fix btf.h header relying on struct enum64 type defined in kernel UAPI headers;
    * fix NULL pointer exception in API btf_dump__dump_type_data;
    * remove struct btf_map_def accidentally left in bpf_helpers.h header.
    * All deprecated APIs and features removed!
    * support for syscall-specific kprobe/kretprobe
      (SEC("ksyscall/<syscall_name>") and SEC("kretsyscall/<syscall_name>"));
    * support for sleepable uprobe BPF programs (SEC("uprobe.s"));
    * support for per-cgroup LSM BPF programs (SEC("lsm_cgroup"));
    * support for new BPF CO-RE relocation TYPE_MATCHES;
    * bpf_prog_load() and bpf_map_create() are now smarter about handling program
      and map name on old kernels (it will be ignored if kernel doesn't support
      names);
    * BTF_KIND_ENUM64 support;
    * increase tracing attachment (kprobe/uprobe/tracepoint) robustness by using
      tracefs or debugfs, whichever is mounted;
    * new APIs for converting BPF enums to their string representation:
    * libbpf_bpf_prog_type_str();
    * libbpf_bpf_map_type_str();
    * libbpf_bpf_link_type_str();
    * libbpf_bpf_attach_type_str();
    * bpf_program__set_autoattach() and bpf_program__autoattach() to allow opting
      out from auto-attaching of BPF program by BPF skeleton;
    * perf_buffer__buffer() API to give access to underlying per-CPU buffer for BPF ringbuf;
    * bpf_obj_get_opts() API for more flexible fetching of BPF kernel objects' information.
  - see https://github.com/libbpf/libbpf/releases/tag/v1.0.0 for detailed changelog


author: shung-hsi.yu@suse.com
changelog:
  - Fix out-of-bound heap write (boo#1194248 boo#1194249 CVE-2021-45940 CVE-2021-45941)
    + libbpf-Use-elf_getshdrnum-instead-of-e_shnum.patch
  - Fix use-after-free in btf_dump_name_dups (boo#1204391 CVE-2022-3534)
    + libbpf-Fix-use-after-free-in-btf_dump_name_dups.patch
  - Fix memory leak in parse_usdt_arg() (boo#1204393 CVE-2022-3533)
    + libbpf-Fix-memory-leak-in-parse_usdt_arg.patch
  - Fix null pointer dereference in find_prog_by_sec_insn() (boo#1204502 CVE-2022-3606)
    + libbpf-Fix-null-pointer-dereference-in-find_prog_by_.patch


author: dmueller@suse.com
changelog:
  - update to v1.1.0:
    User space-side features and APIs:
    * user-space ring buffer (BPF_MAP_TYPE_USER_RINGBUF) support;
    * new documentation page listing all recognized SEC() definitions;
    * BTF dedup improvements:
    * unambiguous fwd declaration resolution for structs and unions;
    * better handling of some corner cases with identical structs and arrays;
    * mixed enum and enum64 forward declaration resolution logic;
    * bpf_{link,btf,pro,mapg}_get_fd_by_id_opts() and bpf_get_fd_by_id_opts()
      APIs;
    * libbpf supports loading raw BTF for BPF CO-RE from known search paths;
    * support for new cgroup local storage (BPF_MAP_TYPE_CGRP_STORAGE);
    * libbpf will only add BPF_F_MMAPABLE flag for data maps with global
      (i.e., non-static) vars;
    * latest Linux UAPI headers with lots of changes synced into
      include/uapi/linux.
    BPF-side features and APIs;
    * BPF_PROG2() macro added that supports struct-by-value arguments;
    * new BPF helpers:
    * bpf_user_ringbuf_drain();
    * cgrp_storage_get() and cgrp_storage_delete().
    Bug fixes
    * better handling of padding corner cases;
    * btf__align_of() determines packed structs better now;
    * improved handling of enums of non-standard sizes;
    * USDT spec parsing improvements;
    * overflow handling fixes for ringbufs;
    * Makefile fixes to support cross-compilation for 32-bit targets;
    * fix crash if SEC("freplace") programs don't have attach_prog_fd set;
    * better handling of file existence checks when running as non-root with
      enhanced capabilities;
    * a bunch of small fixes:
    * ELF handling improvements;
    * fix memory leak in USDT argument parsing logic;
    * fix NULL dereferences in few corner cases;
    * improved netlink attribute iteration handling.
  - drop libbpf-Use-elf_getshdrnum-instead-of-e_shnum.patch,
    libbpf-Fix-use-after-free-in-btf_dump_name_dups.patch,
    libbpf-Fix-memory-leak-in-parse_usdt_arg.patch
    libbpf-Fix-null-pointer-dereference-in-find_prog_by_.patch (upstream)


author: dmueller@suse.com
changelog:
  - update to 1.2.0:
    * completely overhauled "Libbpf overview" landing documentation
      page;
    * support for BPF link-based `struct_ops` programs:
    * `SEC(".struct_ops.link")` annotations;
    * `bpf_map__attach_struct_ops()` attach API;
    * `bpf_link__update_map()` link update API;
    * support sleepable `SEC("struct_ops.s")` programs
    * improved thread-safety of libbpf print callbacks and
      `libbpf_set_print()`
    * improve handling and reporting of missing BPF kfuncs
    * `bpf_{btf,link,map,prog}_get_info_by_fd()` APIs
    * `bpf_xdp_query_opts()` supports fetching XDP/XSK supported
      features;
    * `perf_buffer__new()` allows customizing notification/sampling
      period now;
    * BPF verifier logging improvements:
    * pass-through BPF verifier log level and flags to kernel as
      is
    * support `log_true_size` for getting required log buffer size
      to fit BPF verifier log completely;
    * allow precise control over kprobe/uprobe attach mode: legacy,
      perf-based, link-based.
    * fix legacy kprobe events names sanitization;
    * fix clobbering errno in some cases;
    * fix BPF map's `BPF_F_MMAPABLE` flag sanitization;
    * fix BPF-side USDT support code on s390x architecture;
    * fix `BPF_PROBE_READ{_STR}_INTO()` on s390x architecture;
    * fix kernel version setting for Debian kernels;
    * fix netlink protocol handling in some cases;
    * improve robustness of attaching to legacy kprobes and
      uprobes;
    * fix double-free during static linking empty ELF sections;
    * a bunch of other small fixes here and there.


author: shung-hsi.yu@suse.com
changelog:
  - update to v1.2.2:
    * fix a regression in perf tool caused by libbpf resetting its custom
      catch-all SEC() handler on explicit bpf_program__set_type() call
    * fix possible double-free in USDT-related libbpf code, which happens when
      libbpf runs out of space in __bpf_usdt_specs map due to having too many
      unique USDT specs


author: shung-hsi.yu@suse.com
changelog:
  - Fix null pointer dereference in bpf_object__collect_prog_relos()
    (bsc#1221101)
    * Add libbpf-Fix-NULL-pointer-dereference-in-bpf_object__c.patch


author: shung-hsi.yu@suse.com
changelog:
  - Workaround kernel module size increase due to BTF deduplication
    issue since the introduction of TYPEOF_UNQUAL (poo#183503 bsc#1244135)
    * add 0001-libbpf-Add-identical-pointer-detection-to-btf_dedup_.patch


author: lnussel@suse.de
changelog:
  - cryptsetup 2.5.0:
    * Split manual pages into per-action pages and use AsciiDoc format.
    * Remove cryptsetup-reencrypt tool from the project and move reencryption
      to already existing "cryptsetup reencrypt" command.
      If you need to emulate the old cryptsetup-reencrypt binary, use simple
      wrappers script running "exec cryptsetup reencrypt $@".
    * LUKS2: implement --decryption option that allows LUKS removal.
    * Fix decryption operation with --active-name option and restrict
      it to be used only with LUKS2.
    * Do not refresh reencryption digest when not needed.
      This should speed up the reencryption resume process.
    * Store proper resilience data in LUKS2 reencrypt initialization.
      Resuming reencryption now does not require specification of resilience
      type parameters if these are the same as during initialization.
    * Properly wipe the unused area after reencryption with datashift in
      the forward direction.
    * Check datashift value against larger sector size.
      For example, it could cause an issue if misaligned 4K sector appears
      during decryption.
    * Do not allow sector size increase reencryption in offline mode.
    * Do not allow dangerous sector size change during reencryption.
    * Ask the user for confirmation before resuming reencryption.
    * Do not resume reencryption with conflicting parameters.
    * Add --force-offline-reencrypt option.
    * Do not allow nested encryption in LUKS reencrypt.
    * Support all options allowed with luksFormat with encrypt action.
    * Add resize action to integritysetup.
    * Remove obsolete dracut plugin reencryption example.
    * Fix possible keyslot area size overflow during conversion to LUKS2.
    * Allow use of --header option for cryptsetup close.
    * Fix activation of LUKS2 device with integrity and detached header.
    * Add ZEROOUT IOCTL support for crypt_wipe API call.
    * VERITY: set loopback sector size according to dm-verity block sizes.
    * veritysetup: dump device sizes.
    * LUKS2 token: prefer token PIN query before passphrase in some cases.
      When a user provides --token-type or specific --token-id, a token PIN
      query is preferred to a passphrase query.
    * LUKS2 token: allow tokens to be replaced with --token-replace option
      for cryptsetup token command.
    * LUKS2 token: do not continue operation when interrupted in PIN prompt.
    * Add --progress-json parameter to utilities.
    * Add support for --key-slot option in luksResume action.
  - move man pages to separate subpackage
  - drop backports handling


author: luca.boccassi@gmail.com
changelog:
  - Add virtual provides for 'integritysetup' and 'veritysetup' to match
    package names provided by Fedora/RHEL, to allow the same set of
    dependencies to be used across all RPM distributions.


author: info@paolostivanin.com
changelog:
  - cryptsetup 2.6.0:
    * Introduce support for handling macOS FileVault2 devices (FVAULT2).
    * libcryptsetup: no longer use global memory locking through mlockall()
    * libcryptsetup: process priority is increased only for key derivation
      (PBKDF) calls.
    * Add new LUKS keyslot context handling functions and API.
    * The volume key may now be extracted using a passphrase, keyfile, or
      token. For LUKS devices, it also returns the volume key after
      a successful crypt_format call.
    * Fix --disable-luks2-reencryption configuration option.
    * cryptsetup: Print a better error message and warning if the format
      produces an image without space available for data.
    * Print error if anti-forensic LUKS2 hash setting is not available.
      If the specified hash was not available, activation quietly failed.
    * Fix internal crypt segment compare routine if the user
      specified cipher in kernel format (capi: prefix).
    * cryptsetup: Add token unassign action.
      This action allows removing token binding on specific keyslot.
    * veritysetup: add support for --use-tasklets option.
      This option sets try_verify_in_tasklet kernel dm-verity option
      (available since Linux kernel 6.0) to allow some performance
      improvement on specific systems.
    * Provide pkgconfig Require.private settings.
      While we do not completely provide static build on udev systems,
      it helps produce statically linked binaries in certain situations.
    * Always update automake library files if autogen.sh is run.
      For several releases, we distributed older automake scripts by mistake.
    * reencryption: Fix user defined moved segment size in LUKS2 decryption.
      The --hotzone-size argument was ignored in cases where the actual data
      size was less than the original LUKS2 data offset.
    * Delegate FIPS mode detection to configured crypto backend.
      System FIPS mode check no longer depends on /etc/system-fips file.
    * Update documentation, including FAQ and man pages.


author: andreas.stieger@gmx.de
changelog:
  - cryptsetup 2.6.1
    * bitlk: Fixes for BitLocker-compatible on-disk metadata parser
    * Fix possible iteration overflow in OpenSSL2 PBKDF2 crypto
      backend
    * portability and compilation fixes
    * verity: Fix possible hash offset setting overflow.
    * bitlk: Fix use of startup BEK key on big-endian platforms.
    * Do not initiate encryption (reencryption command) when the
      header and data devices are the same. If data device reduction
      is not requsted, this leads to data corruption since LUKS
      metadata was written over the data device.
    * Fix possible memory leak if crypt_load() fails.
    * Always use passphrases with a minimal 8 chars length for
      benchmarking, as used in some implementation of FIPS mode


author: pmonreal@suse.com
changelog:
  - FIPS: Remove not needed libcryptsetup12-hmac package that contains
    the HMAC checksums for integrity checking for FIPS. [bsc#1185116]
    * Remove the cryptsetup-rpmlintrc file.
    * Remove not needed fipscheck dependency.


author: pmonreal@suse.com
changelog:
  - Enable running the regression test suite.
  - Force a regeneration of the man pages from AsciiDoc.
  - Add LUKS1 and LUKS2 On-Disk Format Specification pdfs to doc.


author: pmonreal@suse.com
changelog:
  - luksFormat: Handle system with low memory and no swap space [bsc#1211079]
    * Check for physical memory available also in PBKDF benchmark.
    * Try to avoid OOM killer on low-memory systems without swap.
    * Use only half of detected free memory on systems without swap.
    * Add patches:
    - cryptsetup-Check-for-physical-memory-available-also-in-PBKDF-be.patch
    - cryptsetup-Try-to-avoid-OOM-killer-on-low-memory-systems-withou.patch
    - cryptsetup-Use-only-half-of-detected-free-memory-on-systems-wit.patch


author: pmonreal@suse.com
changelog:
  - Update to 2.7.0:
    * Full changelog in:
      mirrors.edge.kernel.org/pub/linux/utils/cryptsetup/v2.7/v2.7.0-ReleaseNotes
    * Introduce support for hardware OPAL disk encryption.
    * plain mode: Set default cipher to aes-xts-plain64 and password hashing
      to sha256.
    * Allow activation (open), luksResume, and luksAddKey to use the volume
      key stored in a keyring.
    * Allow to store volume key to a user-specified keyring in open and
      luksResume commands.
    * Do not flush IO operations if resize grows the device.
      This can help performance in specific cases where the encrypted device
      is extended automatically while running many IO operations.
    * Use only half of detected free memory for Argon2 PBKDF on systems
      without swap (for LUKS2 new keyslot or format operations).
    * Add the possibility to specify a directory for external LUKS2 token
      handlers (plugins).
    * Do not allow reencryption/decryption on LUKS2 devices with
      authenticated encryption or hardware (OPAL) encryption.
    * Do not fail LUKS format if the operation was interrupted on subsequent
      device wipe.
    * Fix the LUKS2 keyslot option to be used while activating the device
      by a token.
    * Properly report if the dm-verity device cannot be activated due to
      the inability to verify the signed root hash (ENOKEY).
    * Fix to check passphrase for selected keyslot only when adding
      new keyslot.
    * Fix to not wipe the keyslot area before in-place overwrite.
    * bitlk: Fix segfaults when attempting to verify the volume key.
    * Add --disable-blkid command line option to avoid blkid device check.
    * Add support for the meson build system.
    * Fix wipe operation that overwrites the whole device if used for LUKS2
      header with no keyslot area.
    * Fix luksErase to work with detached LUKS header.
    * Disallow the use of internal kernel crypto driver names in "capi"
      specification.
    * Fix reencryption to fail early for unknown cipher.
    * tcrypt: Support new Blake2 hash for VeraCrypt.
    * tcrypt: use hash values as substring for limiting KDF check.
    * Add Aria cipher support and block size info.
    * Do not decrease PBKDF parameters if the user forces them.
    * Support OpenSSL 3.2 Argon2 implementation.
    * Add support for Argon2 from libgcrypt
      (requires yet unreleased gcrypt 1.11).
    * Used Argon2 PBKDF implementation is now reported in debug mode
      in the cryptographic backend version. For native support in
      OpenSSL 3.2 or libgcrypt 1.11, "argon2" is displayed.
      If libargon2 is used, "cryptsetup libargon2" (for embedded
      library) or "external libargon2" is displayed.
    * Link only libcrypto from OpenSSL.
    * Disable reencryption for Direct-Access (DAX) devices.
    * Print a warning message if the device is not aligned to sector size.
    * Fix sector size and integrity fields display for non-LUKS2 crypt
      devices for the status command.
    * Fix suspend for LUKS2 with authenticated encryption (also suspend
      dm-integrity device underneath).
    * Update keyring and locking documentation and LUKS2 specification
      for OPAL2 support.
    * Remove patches fixed upstream:
    - cryptsetup-Check-for-physical-memory-available-also-in-PBKDF-be.patch
    - cryptsetup-Try-to-avoid-OOM-killer-on-low-memory-systems-withou.patch
    - cryptsetup-Use-only-half-of-detected-free-memory-on-systems-wit.patch


author: meissner@suse.com
changelog:
  - cryptsetup-fips140-3.patch: extend the password for PBKDF2 benchmarking
    to be more than 20 chars to meet FIPS 140-3 requirements (bsc#1229975)


author: heming.zhao@suse.com
changelog:
  - lvmlockd is not supporting sanlock (bsc#1203482)
    - set 1 for _supportsanlock in lvm2.spec for enabling sanlock.


author: heming.zhao@suse.com
changelog:
  - lvm.conf should re-enable commented out option use_lvmlockd (bsc#1204219)
    - re-enable "use_lvmlockd = 0" in lvm.conf


author: heming.zhao@suse.com
changelog:
  - dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074)
    - in lvm2.spec, change device_mapper_version from 1.02.185 to %{lvm2_version}_1.02.185


author: amit.chaudhary@suse.com
changelog:
  - killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216)
    - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch


author: heming.zhao@suse.com
changelog:
  - multipath_component_detection = 0 in lvm.conf does not have any effect (bsc#1212613)
    - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch


author: heming.zhao@suse.com
changelog:
  - blkdeactivate calls wrong mountpoint cmd (bsc#1214071)
    + bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch


author: glass.su@suse.com
changelog:
  - Update lvm2 from LVM2.2.03.16 to LVM2.2.03.22 (jsc#PED-6339)
    * 2.03.22:
    * Fix pv_major/pv_minor report field types so they are integers, not strings.
    * Add lvmdevices --delnotfound to delete entries for missing devices.
    * Always use cachepool name for metadata backup LV for lvconvert --repair.
    * Make metadata backup LVs read-only after pool's lvconvert --repair.
    * Handle 'lvextend --usepolicies' for pools for all activation variants.
    * Fix memleak in vgchange autoactivation setup.
    * Support conversion from thick to fully provisioned thin LV.
    * Cache/Thin-pool can use error and zero volumes for testing.
    * Individual thin volume can be cached, but cannot take snapshot.
    * internal support for handling error and zero target (for testing).
    * COW above trimmed maximal size is does not return error.
    * Add lvm.conf thin_restore and cache_restore settings.
    * Handle multiple mounts while resizing volume with a FS.
    * Handle leading/trailing spaces in sys_wwid and sys_serial used by deivce_id.
    * Fix failing -S|--select for non-reporting cmds if using LV info/status fields.
    * Allow snapshots of raid+integrity LV.
    * Fix multisegment RAID1 allocator to prevent using single disk for more legs.
    * 2.03.21:
    * Allow (write)cache over raid+integrity LV.
    * 2.03.20:
    * Fix segfault if using -S|--select with log/report_command_log=1 setting.
    * 2.03.19:
    * Do not reset SYSTEMD_READY variable in udev for PVs on MD and loop devices.
    * Ensure udev is processing origin LV before its thick snapshots LVs.
    * 2.03.18:
    * Fix warning for thin pool overprovisioning on lvextend.
    * Add support for writecache metadata_only and pause_writeback settings.
    * Fix missing error messages in lvmdbusd.
    * 2.03.17:
    * Add new options (--fs, --fsmode) for FS handling when resizing LVs (btrfs is unsupported).
    * Fix 'lvremove -S|--select LV' to not also remove its historical LV right away.
    * Fix lv_active field type to binary so --select and --binary applies properly.
    * Error out in lvm shell if using a cmd argument not supported in the shell.
    * Fix lvm shell's lastlog command to report previous pre-command failures.
    * Add --valuesonly option to lvmconfig to print only values without keys.
    * Add json_std output format for more JSON standard compliant version of output.
    * Fix many corner cases in device_id, including handling of S/N duplicates.
    * Fix various issues in lvmdbusd.
  - device-mapper version upgrade to 1.02.196
    * Improve parallel creation of /dev/mapper/control device node.
    * Import previous ID_FS_* udev records in 13-dm-disk.rules for suspended DM dev.
    * Remove NAME="mapper/control" rule from 10-dm.rules to avoid udev warnings.
    * Improve 'dmsetup create' without given table line with new kernels.
    * Add DM_REPORT_GROUP_JSON_STD for more JSON standard compliant output format.
  - Drop patches that have been merged into upstream
    - 0001-devices-file-move-clean-up-after-command-is-run.patch
    - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch
    - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch
    - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch
    - 0005-pvdisplay-restore-reportformat-option.patch
    - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch
    - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch
    - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch
    - 0009-mm-remove-libaio-from-being-skipped.patch
    - 0010-dmsetup-check-also-for-ouf-of-range-value.patch
    - 0011-devices-drop-double-from-sysfs-path.patch
    - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch
    - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch
    - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch
    - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch
    - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch
  - Add upstream patch
    + 0001-lvconvert-swapmetadata-fix-lvmlockd-locking.patch
    + 0002-lvconvert-fix-ret-values-fro-integrity-remove.patch
    + 0003-lvconvert-fix-regresion-from-integrity-check.patch
    + 0004-gcc-cleanup-warnings.patch
    + 0005-lvmlockd-fix-thick-to-thin-lv-conversion.patch
    + 0006-lvmlockd-let-lockd_init_lv_args-set-lock_args.patch
    + 0007-lvmlockd-fix-lvconvert-to-thin-pool.patch
    + 0008-lvconvert-run-error-path-code-only-for-shared-VG.patch
    + 0009-vgchange-acquire-an-exclusive-VG-lock-for-refresh.patch
    + 0010-lvmlockd-client-mutex-ordering.patch
    + 0011-filesystem-move-stat-after-open-check.patch
    + 0012-tests-check-for-writecache.patch
    + 0013-lvresize-fix-32-bit-overflow-in-size-calculation.patch
    + 0014-gcc-fix-warnings-for-x32-architecture.patch
    + 0015-gcc-warning-missing-braces-around-initializer.patch
    + 0016-test-improve-aux-teardown.patch
    + 0017-tests-aux-try-with-extra-sleep.patch
    + 0018-tests-aux-using-singl-lvmconf-call.patch
    + 0019-tests-missing-to-check-for-writecache-support.patch
    + 0020-tests-pvmove-large-disk-area.patch
    + 0021-tests-enforce-full-fs-check.patch
    + 0022-tests-update-for-work-in-fake-dev-environment.patch
    + 0023-tests-skip-test-when-lvmdbusd-runs-on-the-system.patch
    + 0024-tests-better-slowdown.patch
  - Update patch
    - bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch
    - bug-1184124-link-tests-as-PIE.patch
    - bug-1184687_Add-nolvm-for-kernel-cmdline.patch
    - fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch
  - Rename & Update patch
    - bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch
    + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-rules.patch
  - update lvm2.spec
    - change upstream_device_mapper_version to 1.02.196
    - change device_mapper_version to %{lvm2_version}_1.02.196
    - add config item "-with-libexecdir=%{_libexecdir}" to fix libexec path since commit a2d33cdf
    - add new binary "%{_libexecdir}/lvresize_fs_helper" to lvm2 package


author: heming.zhao@suse.com
changelog:
  - LVM2 mirror attached to another node couldn't be converted into linear LV (bsc#1231796)
    + bug-1231796_lvconvert-fix-lvconvert-m-0-for-in-sync-legs.patch


author: heming.zhao@suse.com
changelog:
  - LVM filter behaves unexpectedly for MPIO devices in SLES15SP5 (bsc#1216938)
    * set lvm.conf devices.multipath_wwids_file=""


author: glass.su@suse.com
changelog:
  - systemctl start lvmlockd.service times out (bsc#1233655)
    * Add a patch containing multiple picked upstream patches
      + bug-1233655_configure-add-option-disable-enable-sd-notify-and-au.patch
    * Update lvm2.spec
    - add pkgconfig(systemd) for lvmlockd build
    - enable configure option '--enable-sd-notify' for lvmlockd


author: andreas.stieger@gmx.de
changelog:
  - update to 2.6.1:
    * Expose billion laughs API with XML_DTD defined and XML_GE
      undefined, regression from 2.6.0
    * Make tests independent of CPU speed, and thus more robust
  - drop libxml2-fix-xmlwf.1-handling.patch, upstream


author: andreas.stieger@gmx.de
changelog:
  - update to 2.6.2:
    * CVE-2024-28757 -- Prevent billion laughs attacks with isolated
      use of external parsers (boo#1221289)
    * Reject direct parameter entity recursion and avoid the related
      undefined behavior


author: david.anes@suse.com
changelog:
  - Update to 2.6.3:
    * Security fixes:
    - CVE-2024-45490, bsc#1229930 -- Calling function XML_ParseBuffer with
      len < 0 without noticing and then calling XML_GetBuffer
      will have XML_ParseBuffer fail to recognize the problem
      and XML_GetBuffer corrupt memory.
      With the fix, XML_ParseBuffer now complains with error
      XML_ERROR_INVALID_ARGUMENT just like sibling XML_Parse
      has been doing since Expat 2.2.1, and now documented.
      Impact is denial of service to potentially artitrary code
      execution.
    - CVE-2024-45491, bsc#1229931 -- Internal function dtdCopy can have an
      integer overflow for nDefaultAtts on 32-bit platforms
      (where UINT_MAX equals SIZE_MAX).
      Impact is denial of service to potentially artitrary code
      execution.
    - CVE-2024-45492, bsc#1229932 -- Internal function nextScaffoldPart can
      have an integer overflow for m_groupSize on 32-bit
      platforms (where UINT_MAX equals SIZE_MAX).
      Impact is denial of service to potentially artitrary code
      execution.
    * Other changes:
    - Autotools: Sync CMake templates with CMake 3.28
    - Autotools: Always provide path to find(1) for portability
    - Autotools: Ensure that the m4 directory always exists.
    - Autotools: Simplify handling of SIZEOF_VOID_P
    - Autotools: Support non-GNU sed
    - Autotools|CMake: Fix main() to main(void)
    - Autotools|CMake: Fix compile tests for HAVE_SYSCALL_GETRANDOM
    - Autotools|CMake: Stop requiring dos2unix
    - CMake: Fix check for symbols size_t and off_t
    - docs|tests: Convert README to Markdown and update
    - Windows: Drop support for Visual Studio <=15.0/2017
    - Drop needless XML_DTD guards around is_param access
    - Fix typo in a code comment
    - Version info bumped from 10:2:9 (libexpat*.so.1.9.2)
      to 10:3:9 (libexpat*.so.1.9.3); see https://verbump.de/
      for what these numbers do


author: pgajdos@suse.com
changelog:
  - version update to 2.6.4
    * Security fixes: [bsc#1232601][bsc#1232579]
      [#915]  CVE-2024-50602 -- Fix crash within function XML_ResumeParser
      from a NULL pointer dereference by disallowing function
      XML_StopParser to (stop or) suspend an unstarted parser.
      A new error code XML_ERROR_NOT_STARTED was introduced to
      properly communicate this situation.  // CWE-476 CWE-754
    * Other changes:
      [#903]  CMake: Add alias target "expat::expat"
      [#905]  docs: Document use via CMake >=3.18 with FetchContent
      and SOURCE_SUBDIR and its consequences
      [#902]  tests: Reduce use of global parser instance
      [#904]  tests: Resolve duplicate handler
    [#317] #918  tests: Improve tests on doctype closing (ex CVE-2019-15903)
      [#914]  Fix signedness of format strings
    [#919] #920  Version info bumped from 10:3:9 (libexpat*.so.1.9.3)
      to 11:0:10 (libexpat*.so.1.10.0); see https://verbump.de/
      for what these numbers do


author: pgajdos@suse.com
changelog:
  - version update to 2.7.0 (CVE-2024-8176 [bsc#1239618])
    * Security fixes:
      [#893] #973  CVE-2024-8176 -- Fix crash from chaining a large number
      of entities caused by stack overflow by resolving use of
      recursion, for all three uses of entities:
    - general entities in character data ("<e>&g1;</e>")
    - general entities in attribute values ("<e k1='&g1;'/>")
    - parameter entities ("%p1;")
      Known impact is (reliable and easy) denial of service:
      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C
      (Base Score: 7.5, Temporal Score: 7.2)
      Please note that a layer of compression around XML can
      significantly reduce the minimum attack payload size.
    * Other changes:
      [#935] #937  Autotools: Make generated CMake files look for
      libexpat.@SO_MAJOR@.dylib on macOS
      [#925]  Autotools: Sync CMake templates with CMake 3.29
    [#945] #962 #966  CMake: Drop support for CMake <3.13
      [#942]  CMake: Small fuzzing related improvements
      [#921]  docs: Add missing documentation of error code
      XML_ERROR_NOT_STARTED that was introduced with 2.6.4
      [#941]  docs: Document need for C++11 compiler for use from C++
      [#959]  tests/benchmark: Fix a (harmless) TOCTTOU
      [#944]  Windows: Fix installer target location of file xmlwf.xml
      for CMake
      [#953]  Windows: Address warning -Wunknown-warning-option
      about -Wno-pedantic-ms-format from LLVM MinGW
      [#971]  Address Cppcheck warnings
      [#969] #970  Mass-migrate links from http:// to https://
      [#947] #958 ..
      [#974] #975  Document changes since the previous release
      [#974] #975  Version info bumped from 11:0:10 (libexpat*.so.1.10.0)
      to 11:1:10 (libexpat*.so.1.10.1); see https://verbump.de/
      for what these numbers do


author: pgajdos@suse.com
changelog:
  - version update to 2.7.0 for SLE-15-SP4
  - deleted patches
    - expat-CVE-2022-25235.patch (upstreamed)
    - expat-CVE-2022-25236-relax-fix.patch (upstreamed)
    - expat-CVE-2022-25236.patch (upstreamed)
    - expat-CVE-2022-25313-fix-regression.patch (upstreamed)
    - expat-CVE-2022-25313.patch (upstreamed)
    - expat-CVE-2022-25314.patch (upstreamed)
    - expat-CVE-2022-25315.patch (upstreamed)
    - expat-CVE-2022-40674.patch (upstreamed)
    - expat-CVE-2022-43680.patch (upstreamed)
    - expat-CVE-2023-52425-1.patch (upstreamed)
    - expat-CVE-2023-52425-2.patch (upstreamed)
    - expat-CVE-2023-52425-backport-parser-changes.patch (upstreamed)
    - expat-CVE-2023-52425-fix-tests.patch (upstreamed)
    - expat-CVE-2024-28757.patch (upstreamed)
    - expat-CVE-2024-45490.patch (upstreamed)
    - expat-CVE-2024-45491.patch (upstreamed)
    - expat-CVE-2024-45492.patch (upstreamed)
    - expat-CVE-2024-50602.patch (upstreamed)


author: pgajdos@suse.com
changelog:
  - version update to 2.7.1
      Bug fixes:
      [#980] #989  Restore event pointer behavior from Expat 2.6.4
      (that the fix to CVE-2024-8176 changed in 2.7.0);
      affected API functions are:
    - XML_GetCurrentByteCount
    - XML_GetCurrentByteIndex
    - XML_GetCurrentColumnNumber
    - XML_GetCurrentLineNumber
    - XML_GetInputContext
      Other changes:
      [#976] #977  Autotools: Integrate files "fuzz/xml_lpm_fuzzer.{cpp,proto}"
      with Automake that were missing from 2.7.0 release tarballs
      [#983] #984  Fix printf format specifiers for 32bit Emscripten
      [#992]  docs: Promote OpenSSF Best Practices self-certification
      [#978]  tests/benchmark: Resolve mistaken double close
      [#986]  Address compiler warnings
      [#990] #993  Version info bumped from 11:1:10 (libexpat*.so.1.10.1)
      to 11:2:10 (libexpat*.so.1.10.2); see https://verbump.de/
      for what these numbers do
      Infrastructure:
      [#982]  CI: Start running Perl XML::Parser integration tests
      [#987]  CI: Enforce Clang Static Analyzer clean code
      [#991]  CI: Re-enable warning clang-analyzer-valist.Uninitialized
      for clang-tidy
      [#981]  CI: Cover compilation with musl
      [#983] #984  CI: Cover compilation with 32bit Emscripten
      [#976] #977  CI: Protect against fuzzer files missing from future
      release archives


author: hpj@suse.com
changelog:
  - Updated nss-fips-approved-crypto-non-ec.patch to not pass in
    bad targetKeyLength parameters when checking for FIPS approval
    after keygen. This was causing false rejections.


author: martin.sirringhaus@suse.com
changelog:
  - Add nss-reproducible-chksums.patch to make NSS-build reproducible
    Use key from openssl (bsc#1081723)


author: martin.sirringhaus@suse.com
changelog:
  - update to NSS 3.110
    * bmo#1930806 - FIPS changes need to be upstreamed: force ems policy
    * bmo#1954724 - Prevent excess allocations in sslBuffer_Grow
    * bmo#1953429 - Remove Crl templates from ASN1 fuzz target
    * bmo#1953429 - Remove CERT_CrlTemplate from ASN1 fuzz target
    * bmo#1952855 - Fix memory leak in NSS_CMSMessage_IsSigned
    * bmo#1930807 - NSS policy updates
    * bmo#1951161 - Improve locking in nssPKIObject_GetInstances
    * bmo#1951394 - Fix race in sdb_GetMetaData
    * bmo#1951800 - Fix member access within null pointer
    * bmo#1950077 - Increase smime fuzzer memory limit
    * bmo#1949677 - Enable resumption when using custom extensions
    * bmo#1952568 - change CN of server12 test certificate
    * bmo#1949118 - Part 2: Add missing check in
      NSS_CMSDigestContext_FinishSingle
    * bmo#1949118 - Part 1: Fix smime UBSan errors
    * bmo#1930806 - FIPS changes need to be upstreamed: updated key checks
    * bmo#1951491 - Don't build libpkix in static builds
    * bmo#1951395 - handle `-p all` in try syntax
    * bmo#1951346 - fix opt-make builds to actually be opt
    * bmo#1951346 - fix opt-static builds to actually be opt
    * bmo#1916439 - Remove extraneous assert
  - Removed upstreamed nss-fips-stricter-dh.patch
  - Removed upstreamed nss-reproducible-chksums.patch
  - Added bmo1962556.patch to fix test failures
  - Rebased nss-fips-approved-crypto-non-ec.patch nss-fips-combined-hash-sign-dsa-ecdsa.patch
  - update to NSS 3.109
    * bmo#1939512 - Call BL_Init before RNG_RNGInit() so that special
      SHA instructions can be used if available
    * bmo#1930807 - NSS policy updates - fix inaccurate key policy issues
    * bmo#1945883 - SMIME fuzz target
    * bmo#1914256 - ASN1 decoder fuzz target
    * bmo#1936001 - Part 2: Revert “Extract testcases from ssl gtests
      for fuzzing”
    * bmo#1915155 - Add fuzz/README.md
    * bmo#1936001 - Part 4: Fix tstclnt arguments script
    * bmo#1944545 - Extend pkcs7 fuzz target
    * bmo#1912320 - Extend certDN fuzz target
    * bmo#1944300 - revert changes to HACL* files from bug 1866841
    * bmo#1936001 - Part 3: Package frida corpus script
  - update to NSS 3.108
    * bmo#1923285 - libclang-16 -> libclang-19
    * bmo#1939086 - Turn off Secure Email Trust Bit for Security
      Communication ECC RootCA1
    * bmo#1937332 - Turn off Secure Email Trust Bit for BJCA Global Root
      CA1 and BJCA Global Root CA2
    * bmo#1915902 - Remove SwissSign Silver CA – G2
    * bmo#1938245 - Add D-Trust 2023 TLS Roots to NSS
    * bmo#1942301 - fix fips test failure on windows
    * bmo#1935925 - change default sensitivity of KEM keys
    * bmo#1936001 - Part 1: Introduce frida hooks and script
    * bmo#1942350 - add missing arm_neon.h include to gcm.c
    * bmo#1831552 - ci: update windows workers to win2022
    * bmo#1831552 - strip trailing carriage returns in tools tests
    * bmo#1880256 - work around unix/windows path translation issues
      in cert test script
    * bmo#1831552 - ci: let the windows setup script work without $m
    * bmo#1880255 - detect msys
    * bmo#1936680 - add a specialized CTR_Update variant for AES-GCM
    * bmo#1930807 - NSS policy updates
    * bmo#1930806 - FIPS changes need to be upstreamed: FIPS 140-3 RNG
    * bmo#1930806 - FIPS changes need to be upstreamed: Add SafeZero
    * bmo#1930806 - FIPS changes need to be upstreamed - updated POST
    * bmo#1933031 - Segmentation fault in SECITEM_Hash during pkcs12 processing
    * bmo#1929922 - Extending NSS with LoadModuleFromFunction functionality
    * bmo#1935984 - Ensure zero-initialization of collectArgs.cert
    * bmo#1934526 - pkcs7 fuzz target use CERT_DestroyCertificate
    * bmo#1915898 - Fix actual underlying ODR violations issue
    * bmo#1184059 - mozilla::pkix: allow reference ID labels to begin
      and/or end with hyphens
    * bmo#1927953 - don't look for secmod.db in nssutil_ReadSecmodDB if
      NSS_DISABLE_DBM is set
    * bmo#1934526 - Fix memory leak in pkcs7 fuzz target
    * bmo#1934529 - Set -O2 for ASan builds in CI
    * bmo#1934543 - Change branch of tlsfuzzer dependency
    * bmo#1915898 - Run tests in CI for ASan builds with detect_odr_violation=1
    * bmo#1934241 - Fix coverage failure in CI
    * bmo#1934213 - Add fuzzing for delegated credentials, DTLS short
      header and Tls13BackendEch
    * bmo#1927142 - Add fuzzing for SSL_EnableTls13GreaseEch and
      SSL_SetDtls13VersionWorkaround
    * bmo#1913677 - Part 3: Restructure fuzz/
    * bmo#1931925 - Extract testcases from ssl gtests for fuzzing
    * bmo#1923037 - Force Cryptofuzz to use NSS in CI
    * bmo#1923037 - Fix Cryptofuzz on 32 bit in CI
    * bmo#1933154 - Update Cryptofuzz repository link
    * bmo#1926256 - fix build error from 9505f79d
    * bmo#1926256 - simplify error handling in get_token_objects_for_cache
    * bmo#1931973 - nss doc: fix a warning
    * bmo#1930797 - pkcs12 fixes from RHEL need to be picked up
  - remove obsolete patches
    * nss-fips-safe-memset.patch
    * nss-bmo1930797.patch
  - update to NSS 3.107
    * bmo#1923038 - Remove MPI fuzz targets.
    * bmo#1925512 - Remove globals `lockStatus` and `locksEverDisabled`.
    * bmo#1919015 - Enable PKCS8 fuzz target.
    * bmo#1923037 - Integrate Cryptofuzz in CI.
    * bmo#1913677 - Part 2: Set tls server target socket options in config class
    * bmo#1913677 - Part 1: Set tls client target socket options in config class
    * bmo#1913680 - Support building with thread sanitizer.
    * bmo#1922392 - set nssckbi version number to 2.72.
    * bmo#1919913 - remove Websites Trust Bit from Entrust Root
      Certification Authority - G4.
    * bmo#1920641 - remove Security Communication RootCA3 root cert.
    * bmo#1918559 - remove SecureSign RootCA11 root cert.
    * bmo#1922387 - Add distrust-after for TLS to Entrust Roots.
    * bmo#1927096 - update expected error code in pk12util pbmac1 tests.
    * bmo#1929041 - Use random tstclnt args with handshake collection script
    * bmo#1920466 - Remove extraneous assert in ssl3gthr.c.
    * bmo#1928402 - Adding missing release notes for NSS_3_105.
    * bmo#1874451 - Enable the disabled mlkem tests for dtls.
    * bmo#1874451 - NSS gtests filter cleans up the constucted buffer
      before the use.
    * bmo#1925505 - Make ssl_SetDefaultsFromEnvironment thread-safe.
    * bmo#1925503 - Remove short circuit test from ssl_Init.
  - fix build on loongarch64 (setting it as 64bit arch)
  - Remove upstreamed bmo-1400603.patch
  - Added nss-bmo1930797.patch to fix failing tests in testsuite
  - update to NSS 3.106
    * bmo#1925975 - NSS 3.106 should be distributed with NSPR 4.36.
    * bmo#1923767 - pk12util: improve error handling in p12U_ReadPKCS12File.
    * bmo#1899402 - Correctly destroy bulkkey in error scenario.
    * bmo#1919997 - PKCS7 fuzz target, r=djackson,nss-reviewers.
    * bmo#1923002 - Extract certificates with handshake collection script.
    * bmo#1923006 - Specify len_control for fuzz targets.
    * bmo#1923280 - Fix memory leak in dumpCertificatePEM.
    * bmo#1102981 - Fix UBSan errors for SECU_PrintCertificate and
      SECU_PrintCertificateBasicInfo.
    * bmo#1921528 - add new error codes to mozilla::pkix for Firefox to use.
    * bmo#1921768 - allow null phKey in NSC_DeriveKey.
    * bmo#1921801 - Only create seed corpus zip from existing corpus.
    * bmo#1826035 - Use explicit allowlist for for KDF PRFS.
    * bmo#1920138 - Increase optimization level for fuzz builds.
    * bmo#1920470 - Remove incorrect assert.
    * bmo#1914870 - Use libFuzzer options from fuzz/options/\*.options in CI.
    * bmo#1920945 - Polish corpus collection for automation.
    * bmo#1917572 - Detect new and unfuzzed SSL options.
    * bmo#1804646 - PKCS12 fuzzing target.
  - requires NSPR 4.36
  - update to NSS 3.105
    * bmo#1915792 - Allow importing PKCS#8 private EC keys missing public key
    * bmo#1909768 - UBSAN fix: applying zero offset to null pointer in sslsnce.c
    * bmo#1919577 - set KRML_MUSTINLINE=inline in makefile builds
    * bmo#1918965 - Don't set CKA_SIGN for CKK_EC_MONTGOMERY private keys
    * bmo#1918767 - override default definition of KRML_MUSTINLINE
    * bmo#1916525 - libssl support for mlkem768x25519
    * bmo#1916524 - support for ML-KEM-768 in softoken and pk11wrap
    * bmo#1866841 - Add Libcrux implementation of ML-KEM 768 to FreeBL
    * bmo#1911912 - Avoid misuse of ctype(3) functions
    * bmo#1917311 - part 2: run clang-format
    * bmo#1917311 - part 1: upgrade to clang-format 13
    * bmo#1916953 - clang-format fuzz
    * bmo#1910370 - DTLS client message buffer may not empty be on retransmit
    * bmo#1916413 - Optionally print config for TLS client and server
      fuzz target
    * bmo#1916059 - Fix some simple documentation issues in NSS.
    * bmo#1915439 - improve performance of NSC_FindObjectsInit when
      template has CKA_TOKEN attr
    * bmo#1912828 - define CKM_NSS_ECDHE_NO_PAIRWISE_CHECK_KEY_PAIR_GEN
  - Fix build error under Leap by rebasing nss-fips-safe-memset.patch.
  - update to NSS 3.104
    * bmo#1910071 - Copy original corpus to heap-allocated buffer
    * bmo#1910079 - Fix min ssl version for DTLS client fuzzer
    * bmo#1908990 - Remove OS2 support just like we did on NSPR
    * bmo#1910605 - clang-format NSS improvements
    * bmo#1902078 - Adding basicutil.h to use HexString2SECItem function
    * bmo#1908990 - removing dirent.c from build
    * bmo#1902078 - Allow handing in keymaterial to shlibsign to make
      the output reproducible
    * bmo#1908990 - remove nec4.3, sunos4, riscos and SNI references
    * bmo#1908990 - remove other old OS (BSDI, old HP UX, NCR,
      openunix, sco, unixware or reliantUnix
    * bmo#1908990 - remove mentions of WIN95
    * bmo#1908990 - remove mentions of WIN16
    * bmo#1913750 - More explicit directory naming
    * bmo#1913755 - Add more options to TLS server fuzz target
    * bmo#1913675 - Add more options to TLS client fuzz target
    * bmo#1835240 - Use OSS-Fuzz corpus in NSS CI
    * bmo#1908012 - set nssckbi version number to 2.70.
    * bmo#1914499 - Remove Email Trust bit from ACCVRAIZ1 root cert.
    * bmo#1908009 - Remove Email Trust bit from certSIGN ROOT CA.
    * bmo#1908006 - Add Cybertrust Japan Roots to NSS.
    * bmo#1908004 - Add Taiwan CA Roots to NSS.
    * bmo#1911354 - remove search by decoded serial in
      nssToken_FindCertificateByIssuerAndSerialNumber
    * bmo#1913132 - Fix tstclnt CI build failure
    * bmo#1913047 - vfyserv: ensure peer cert chain is in db for
      CERT_VerifyCertificateNow
    * bmo#1912427 - Enable all supported protocol versions for UDP
    * bmo#1910361 - Actually use random PSK hash type
    * bmo#1911576 - Initialize NSS DB once
    * bmo#1910361 - Additional ECH cipher suites and PSK hash types
    * bmo#1903604 - Automate corpus file generation for TLS client Fuzzer
    * bmo#1910364 - Fix crash with UNSAFE_FUZZER_MODE
    * bmo#1910605 - clang-format shlibsign.c
  - remove obsolete nss-reproducible-builds.patch
  - update to NSS 3.103
    * bmo#1908623 - move list size check after lock acquisition in sftk_PutObjectToList.
    * bmo#1899542 - Add fuzzing support for SSL_ENABLE_POST_HANDSHAKE_AUTH,
    * bmo#1909638 - Follow-up to fix test for presence of file nspr.patch.
    * bmo#1903783 - Adjust libFuzzer size limits
    * bmo#1899542 - Add fuzzing support for SSL_SetCertificateCompressionAlgorithm,
      SSL_SetClientEchConfigs, SSL_VersionRangeSet and SSL_AddExternalPsk
    * bmo#1899542 - Add fuzzing support for SSL_ENABLE_GREASE and
      SSL_ENABLE_CH_EXTENSION_PERMUTATION
  - Add nss-reproducible-builds.patch to make the rpms reproducible,
    by using a hardcoded, static key to generate the checksums (*.chk-files)
  - Updated nss-fips-approved-crypto-non-ec.patch to enforce
    approved curves with the CKK_EC_MONTGOMERY key type (bsc#1224113).
  - update to NSS 3.102.1
    * bmo#1905691 - ChaChaXor to return after the function
  - update to NSS 3.102
    * bmo#1880351 - Add Valgrind annotations to freebl Chacha20-Poly1305.
    * bmo#1901932 - missing sqlite header.
    * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME.
    * bmo#1615298 - improve certutil keyUsage, extKeyUsage, and nsCertType keyword handling.
    * bmo#1660676 - correct length of raw SPKI data before printing in pp utility.


author: martin.sirringhaus@suse.com
changelog:
  - update to NSS 3.111
    * bmo#1930806 - FIPS changes need to be upstreamed: force ems policy
    * bmo#1957685 - Turn off Websites Trust Bit from CAs
    * bmo#1937338 - Update nssckbi version following April 2025 Batch of Changes
    * bmo#1943135 - Disable SMIME ‘trust bit’ for GoDaddy CAs
    * bmo#1874383 - Replaced deprecated sprintf function with snprintf in dbtool.c
    * bmo#1954612 - Need up update NSS for PKCS 3.1
    * bmo#1773374 - avoid leaking localCert if it is already set in ssl3_FillInCachedSID
    * bmo#1953097 - Decrease ASAN quarantine size for Cryptofuzz in CI
    * bmo#1943962 - selfserv: Add support for zlib certificate compression


author: martin.sirringhaus@suse.com
changelog:
  - update to NSS 3.112
    * bmo#1963792 - Fix alias for mac workers on try
    * bmo#1966786 - ensure all options can be configured with SSL_OptionSet and SSL_OptionSetDefault
    * bmo#1931930 - ABI/API break in ssl certificate processing
    * bmo#1955971 - remove unnecessary assertion in sec_asn1d_init_state_based_on_template
    * bmo#1965754 - update taskgraph to v14.2.1
    * bmo#1964358 - Workflow for automation of the release on GitHub when pushing a tag
    * bmo#1952860 - fix faulty assertions in SEC_ASN1DecoderUpdate
    * bmo#1934877 - Renegotiations should use a fresh ECH GREASE buffer
    * bmo#1951396 - update taskgraph to v14.1.1
    * bmo#1962503 - Partial fix for ACVP build CI job
    * bmo#1961827 - Initialize find in sftk_searchDatabase
    * bmo#1963121 - Add clang-18 to extra builds
    * bmo#1963044 - Fault tolerant git fetch for fuzzing
    * bmo#1962556 - Tolerate intermittent failures in ssl_policy_pkix_ocsp
    * bmo#1962770 - fix compiler warnings when DEBUG_ASN1D_STATES or CMSDEBUG are set
    * bmo#1961835 - fix content type tag check in NSS_CMSMessage_ContainsCertsOrCrls
    * bmo#1963102 - Remove Cryptofuzz CI version check


author: martin.sirringhaus@suse.com
changelog:
  - update to NSS 3.112.1
    * bmo#1982742 - restore support for finding certificates by decoded serial number.


author: martin.sirringhaus@suse.com
changelog:
  - update to NSS 3.112.2
    * bmo#1970079 - Prevent leaks during pkcs12 decoding.
    * bmo#1988046 - SEC_ASN1Decode* should ensure it has read as many bytes as each length field indicates
  - Adding patch bmo1980465.patch to fix bug on s390x (bmo#1980465)
  - Adding patch bmo1956754.patch to fix possible undefined behaviour (bmo#1956754)


author: jengelh@inai.de
changelog:
  - Update to new upstream release 1.8.2
    * Fix incorrect handling of various targets and options in
      iptables-nft,ebtables-nft,arptables-nft.


author: kstreitova@suse.com
changelog:
  - Add iptables-1.8.2-dont_read_garbage.patch that fixes a situation
    where 'iptables -L' reads garbage from the struct as the kernel
    never filled it in the bugged case. This can lead to issues like
    mapping a few TiB of memory [bsc#1106751].


author: jengelh@inai.de
changelog:
  - Add 0001-include-fix-build-with-kernel-headers-before-4.2.patch,
    0001-include-extend-the-headers-conflict-workaround-to-in.patch
    to fix build with older linux-glibc-devel. [boo#1132821]


author: jengelh@inai.de
changelog:
  - Update to new upstream release 1.8.3
    * ebtables: Fix rule listing with counters
    * ebtables-nft: Support user-defined chain policies
  - Remove 0001-include-extend-the-headers-conflict-workaround-to-in.patch
    0001-include-fix-build-with-kernel-headers-before-4.2.patch
    (upstreamed)


author: kstreitova@suse.com
changelog:
  - Add Conflicts with iptables-nft = 1.6.2 as during the update to
    iptables 1.8 ip6tables-restore-translate, ip6tables-translate,
    iptables-restore-translate and iptables-translate were moved from
    iptables-nft subpackage (now iptables-backend-nft) to the main
    package. So we need to add a conflict here otherwise we hit file
    conflicts error during the update.


author: jengelh@inai.de
changelog:
  - Update to release 1.8.4
    * Fix for wrong counter format in `ebtables-nft-save -c` output.
    * Print typical iptables-save comments in arptables- and
      ebtables-save, too.
    * xt_owner: add --suppl-groups option
    * Remove support for /etc/xtables.conf
    * Restore support for "-4" and "-6" options in rule lines.


author: jengelh@inai.de
changelog:
  - Update to release 1.8.5
    * IDLETIMER: Add alarm timer option
    * nft: CT: add translation for NOTRACK
  - Drop iptables-apply-mktemp-fix.patch (seemingly applied)


author: jengelh@inai.de
changelog:
  - Update to release 1.8.6
    * iptables-nft had pointlessly added "bitwise" expressions to
      each IP address match, needlessly slowing down run-time
      performance (by 50% in worst cases).
    * iptables-nft-restore: Support basechain policy value of "-"
      (indicating to not change the chain's policy).
    * nft-translte: Fix translation of ICMP type "any" match.


author: jengelh@inai.de
changelog:
  - Update to release 1.8.7
    * iptables-nft:
    * Improved performance when matching on IP/MAC address prefixes
      if the prefix is byte-aligned. In ideal cases, this doubles
      packet processing performance.
    * Dump user-defined chains in lexical order. This way ruleset
      dumps become stable and easily comparable.
    * Avoid pointless table/chain creation. For instance,
      `iptables-nft -L` no longer creates missing base-chains.


author: rguenther@suse.com
changelog:
  - Update to ISL version 0.12.2
    * isl_int has been replaced by isl_val
    * some of the old functions are still available in isl/deprecated/*.h
    but they will be removed in the future
    * The functions isl_pw_qpolynomial_eval, isl_union_pw_qpolynomial_eval,
    isl_pw_qpolynomial_fold_eval and isl_union_pw_qpolynomial_fold_eval have
    been changed to return an isl_val instead of an isl_qpolynomial
  - Remove obsolete config-guess-sub-update.diff patch


author: rguenther@suse.com
changelog:
  - Update to ISL version 0.14
    * support IMath as an optional replacement for GMP
    * minor AST generator improvements
  - Inherits changes from ISL version 0.13
    * deprecate isl_int
    * improved support for multi piecewise quasi-affine expressions
    * allow the user to impose a bound on the number of low-level operations
    * add isl_id_to_ast_expr and isl_id_to_pw_aff
    * add isl_schedule_constraints
    * hide internal structure of isl_vec
    * remove support for piplib
  - Add isl-0.14-fixes.patch to fix function returning without value.


author: rguenther@suse.com
changelog:
  - Update to ISL version 0.15
    * improve coalescing
    * add isl_union_access_info_compute_flow
    * add mark nodes in AST
    * add isl_union_pw_aff and isl_multi_union_pw_aff
    * add schedule trees
    * deprecate band forests
    * deprecate separation_class AST generation option
    * introduce isl_bool and isl_stat types
  - Removes no longer needed isl-0.14-fixes.patch.


author: mpluskal@suse.com
changelog:
  - Update to 0.16.1
    * fix bug in simplification
  - Changes for 0.16
    * add 32 bit integer optimization for IMath
    * minor AST generator improvements
    * add isl_union_flow_get_full_{may,must}_dependence
    * minor improvements to Python bindings
    * minor improvements to set and map printing


author: rguenther@suse.com
changelog:
  - Update to 0.18
    * improve elimination of redundant existentially quantified variables
    * improve coalescing
    * improve parametric integer programming
    * preserve isolate option in isl_schedule_node_band_split
    * print AST nodes in YAML format
    * minor improvements to Python bindings
  - Inherits update to 0.17.1
    * fix bug in coalescing treatment
  - Inherits update to 0.17
    * optionally combine SCCs incrementally in scheduler
    * optionally maximize coincidence in scheduler
    * optionally avoid loop coalescing in scheduler
    * fix handling of nested integer divisions
    * optionally detect min/max expressions during AST generation
    * minor AST generator improvements
    * simplify stride constraints
    * improve support for expansions in schedule trees


author: meissner@suse.com
changelog:
  - updated to 3.4.0
    * enhancement: add API call jent_set_fips_failure_callback as requested by Daniel Ojalvo
    * fix: Change the SHA-3 integration: The entropy pool is now a SHA-3 state.
    It is filled with the time delta containing entropy and auxiliary data that does not contain entropy using a SHA update operation. The auxiliary data is calculated by a SHA-3 hashing of some varying state data. The time delta that contains entropy is measured about the SHA-3 hasing of the auxiliary data. This satisfies FIPS 140-3 IG D.K resolutions 4, 6, and 8.
    * enhancement: add CMake support by Andrew Hopkins
  - updated to 3.3.1
    * fix: bug fix in initialization logic by Vladis Dronov <vdronov@redhat.com>
    * fix: use __asm__ instead of asm to suit the C11 standard
  - added a -devel-static package to be able to link it static.


author: meissner@suse.com
changelog:
  - updated to 3.4.1
    * add FIPS 140 hints to man page
    * simplify the test tool to search for optimal configurations
    * fix: jent_loop_shuffle: re-add setting the time that was lost with 3.4.0
    * enhancement: add ARM64 assembler code to read high-res timer


author: meissner@suse.com
changelog:
  - jitterentropy-split-internal-header.patch:
    Hide the non-GNUC constructs that are library internal from the
    exported header. (bsc#1202870)


author: pmonreal@suse.com
changelog:
  - Fix a stack corruption on s390x: [bsc#1209627]
    * Output size of the STCKE command on s390x is 16 bytes, compared
      to 8 bytes of the STCK command. Fix a stack corruption in the
      s390x version of jent_get_nstime(). Add some more detailed
      information on the STCKE command.
    * github.com/smuellerDD/jitterentropy-library/commit/7bf9f85
    * Add jitterentropy-fix-a-stack-corruption-on-s390x.patch


author: rpm@fthiessen.de
changelog:
  - Update to upstream release 0.12.1
  - Removed upstream fixed json-c-0.12-unused_variable_size.patch
  - Added fix-set-but-not-used.patch


author: avindra@opensuse.org
changelog:
  - json-c 0.13
    + Deprecated and removed features:
    * Internal use of bits.h has been eliminated.
    * lh_abort() is deprecated
    + Behavior changes:
    * Tighten the number parsing algorithm to raise errors instead
      of truncating the results.  For example 12.3.4 or 2015-01-15,
      which now return null.
    * Use size_t for array length and size. Platforms where
      sizeof(size_t) != sizeof(int) may not be backwards compatible
    * Check for failue when allocating memory, returning NULL and
      errno=ENOMEM.
    * Change json_object_object_add() return type from void to int,
      and will return -1 on failures, instead of exiting. (Note:
      this is not an ABI change)
    + New features:
    * Aiming to follow RFC 7159 now.
    * Support for JSON pointer, RFC 6901 (see json_pointer.h)
    * Add a couple of additional option to json_object_to_json_string_ext:
    JSON_C_TO_STRING_PRETTY_TAB
    JSON_C_TO_STRING_NOSLASHESCAPE
    * json_object_object_add_ex() - better perf when certain
      constraints are known to be true
    * Serialization format of doubles now configurable
    * New functions
    - json_object_equal() - utility function for comparing
      json_objects
    - json_object_deep_copy() - a way to copy entire object
      trees
    - json_object_set_<type>() - modify the value of
      existing json_object's without the need to recreate them.
    Also add a json_object_int_inc function to adjust an int's'
    value.
    - json_util_get_last_err() - retrieve the string describing
      the cause of errors, instead of printing to stderr.
    - perllike hash function for strings
    * json_global_set_string_hash()
    * json_c_visit() - a way to iterate over a tree of json-c
      objects.
    + Notable bug fixes and other improvements:
    * Make reference increment and decrement atomic to allow
      passing json objects between threads.
    * Fix json_object_object_foreach to avoid uninitialized
      variable warnings.
    * Improve performance by removing unneeded data items from
      hashtable code and reducing duplicate hash computation.
    * Performance: store small strings inside json_object
    * Performance: of json_object_to_json_string by removing
      variadic printf
    * Fix parsing of "-Infinity", and avoid needlessly copying the
      input when doing so.
    * Fix stack buffer overflow in json_object_double_to_json_string_format()
    * Fix various potential null ptr deref and int32 overflows
    * Fix a long-standing bug in array_list_put_idx() where it
      would attempt to free previously free'd entries due to not
      checking the current array length.
    * use uselocale() instead of setlocale() in json_tokener to
      behave better in threaded environments.
    * Fix out of bounds read when handling unicode surrogate pairs.
    * Ensure doubles that happen to be a whole number are emitted
      with ".0"
    * Visual Studio: use a snprintf/vsnprintf wrapper that ensures
      the string is terminated.
    * Fix double to int cast overflow in json_object_get_int64.
    * Clamp double to int32 when narrowing in json_object_get_int.
    * Use strtoll() to parse ints - instead of sscanf
    * usual code linting
    + Build changes:
    * Add Appveyor and Travis build support
    * Support for MacOS and Windows through CMake
    * Silent build by default
    * Link against libm when needed
    * Add support for building with AddressSanitizer
    * Add support for building with Clang
    * Add a --enable-threading configure option, and only use the
      (slower) __sync_add_and_fetch()/__sync_sub_and_fetch()
      function when it is specified.
  - cleanup with spec-cleaner
  - remove fix-set-but-not-used.patch
    + fixed: https://github.com/json-c/json-c/issues/240
  - remove gcc7-fix.patch
    + fixed in 014924ba899f659917bb64392bbff7d3c803afc2


author: avindra@opensuse.org
changelog:
  - json-c 0.13.1
    * Add const size_t json_c_object_sizeof()
    * Avoid invalid free (and thus a segfault) when ref_count gets < 0
    * Fix handling of custom double formats that include a ".0"
    * Avoid uninitialized variable warnings in json_object_object_foreach
    * Add a top level fuzz directory for fuzzers run by OSS-Fuzz
    * Fix build for certain uClibc based systems.
    * Bump sonum to 4.0 to avoid conflicts because some packagers made
      their own bump to ".so.3" for the older 0.12 release


author: info@paolostivanin.com
changelog:
  - json-c 0.14:
    * bits.h has been removed
    * lh_abort() has been removed
    * lh_table_lookup() has been removed, use lh_table_lookup_ex() instead.
    * Remove TRUE and FALSE defines, use 1 and 0 instead.
    * Switch to cmake
    * Build fixes
    * Doc updates
    * Added a json_tokener_get_parse_end() function to replace
      direct access of tok->char_offset
    * json_tokener_parse_ex() now accepts a new JSON_TOKENER_VALIDATE_UTF8 flag
      to validate that input is UTF8
    * Add support for unsigned 64-bit integers
    * A total of 7 new functions were added:
    * json_object_get_uint64 ( struct json_object const* jso )
    * json_object_new_uint64 ( uint64_t i )
    * json_object_set_uint64 ( struct json_object* jso, uint64_t new_value )
    * json_parse_uint64 ( char const* buf, uint64_t* retval )
    * See description of uint64 support, above.
    * json_tokener_get_parse_end ( struct json_tokener* tok )
    * See details under "json_tokener changes", above.
    * json_object_from_fd_ex ( int fd, int in_depth )
    * Allows the max nesting depth to be specified.
    * json_object_new_null ( )
    * Simply returns NULL.  Its use is not recommended.
    * The size of struct json_object has decreased from 96 bytes to 88 bytes.


author: dcermak@suse.com
changelog:
  - Add upstream fix for boo#1173022
    * Added patch 0001-Detect-broken-RDRAND-during-initialization.patch
    * use URL from the releases page on github
    * run spec-cleaner over the spec file


author: dmueller@suse.com
changelog:
  - update to 0.15:
    * Deprecate `array_list_new()` in favor of `array_list_new2()`
    * Remove the THIS_FUNCTION_IS_DEPRECATED define.
    * Remove config.h.win32
    * Add a `JSON_TOKENER_ALLOW_TRAILING_CHARS` flag to allow multiple objects
      to be parsed even when `JSON_TOKENER_STRICT` is set.
    * Add `json_object_new_array_ext(int)` and `array_list_new_2(int)` to allow
      arrays to be allocated with the exact size needed, when known.
    * Add `json_object_array_shrink()` (and `array_list_shrink()`) and use it in
      json_tokener to minimize the amount of memory used.
    * Add a json_parse binary, for use in testing changes (not installed, but
      available in the apps directory).
    * Split the internal json_object structure into several sub-types, one for
      each json_type (json_object_object, json_object_string, etc...).
      This improves memory usage and speed, with the benchmark under
      bench/ report 5.8% faster test time and 6%(max RSS)-12%(peak heap)
      less memory usage.
      Memory used just for json_object structures decreased 27%, so use cases
      with fewer arrays and/or strings would benefit more.
    * Minimize memory usage in array handling in json_tokener by shrinking
      arrays to the exact number of elements parsed.  On bench/ benchmark:
      9% faster test time, 39%(max RSS)-50%(peak heap) less memory usage.
      Add json_object_array_shrink() and array_list_shrink() functions.
    * #616 - Parsing of surrogate pairs in unicode escapes now properly handles
      incremental parsing.
    * Fix incremental parsing of numbers, especially those with exponents, e.g.
      so parsing "[0", "e+", "-]" now properly returns an error.
      Strict mode now rejects missing exponents ("0e").
    * Successfully return number objects at the top level even when they are
      followed by a "-", "." or "e".  This makes parsing things like "123-45"
      behave consistently with things like "123xyz".
    * #589 - Detect broken RDRAND during initialization; also, fix segfault
      in the CPUID check.
    * #592 - Fix integer overflows to prevert out of bounds write on large input.
      (CVE-2020-12762, bsc#1171479)
    * Protect against division by zero in linkhash, when creaed with zero size.
    * #602 - Fix json_parse_uint64() internal error checking, leaving the retval
      untouched in more failure cases.
    * #614 - Prevent truncation when custom double formatters insert extra \0's
  - remove 0001-Detect-broken-RDRAND-during-initialization.patch (upstream)


author: ncutler@suse.com
changelog:
  - Add patch bsc1171479.patch
    + fix integer overflow and out-of-bounds write (CVE-2020-12762, bsc#1171479)


author: info@paolostivanin.com
changelog:
  - Update to 0.16: (jsc#PED-5061)
    + Deprecated and removed features:
    * JSON_C_OBJECT_KEY_IS_CONSTANT is deprecated in favor of
      JSON_C_OBJECT_ADD_CONSTANT_KEY
    * Direct access to lh_table and lh_entry structure members is deprecated.
      Use access functions instead, lh_table_head(), lh_entry_next(), etc...
    * Drop REFCOUNT_DEBUG code.
    + Changes and bug fixes
    * Cap string length at INT_MAX to avoid various issues with very long strings.
    * json_object_deep_copy: fix deep copy of strings containing '\0'
    * Fix read past end of buffer in the "json_parse" command
    * Avoid out of memory accesses in the locally provided vasprintf() function
      (for those platforms that use it)
    * Handle allocation failure in json_tokener_new_ex
    * Fix use-after-free in json_tokener_new_ex() in the event of printbuf_new() returning NULL
    * printbuf_memset(): set gaps to zero - areas within the print buffer which
      have not been initialized by using printbuf_memset
    * printbuf: return -1 on invalid arguments (len < 0 or total buffer > INT_MAX)
    * sprintbuf(): propagate printbuf_memappend errors back to the caller
    * Validate size arguments in arraylist functions.
    * Use getrandom() if available; with GRND_NONBLOCK to allow use of json-c
      very early during boot, such as part of cryptsetup.
    * Use arc4random() if it's available.
    * random_seed: on error, continue to next method instead of exiting the process
    * Close file when unable to read from /dev/urandom in get_dev_random_seed()
    * Speed up parsing by replacing ctype functions with simplified, faster
      non-locale-sensitive ones in json_tokener and json_object_to_json_string.
    * Neither vertical tab nor formfeed are considered whitespace per the JSON spec
    * json_object: speed up creation of objects, calloc() -> malloc() + set fields
    * Avoid needless extra strlen() call in json_c_shallow_copy_default() and
      json_object_equal() when the object is known to be a json_type_string.
  - remove bsc1171479.patch


author: abergmann@suse.com
changelog:
  - Initial release 0.13.0.
    A library and tools to access the kernel crypto api.
    FATE#323554 bsc#1045948


author: jengelh@inai.de
changelog:
  - Compact descriptions a bit
  - Remove libkcapi provide/requires
  - Use %_libdir throughout and avoid /lib


author: meissner@suse.com
changelog:
  - libkcapi-use-external-fipshmac.patch: use external fipshmac,
    our chroots / vm builds do not necessarily have the right kernel.


author: bwiedemann@suse.com
changelog:
  - Add reproduciblesort.patch to always link .o files in the same order and
  - Add reproducibledate.patch to not add current time to man-pages to fix build-compare


author: pmonreal@suse.com
changelog:
  - FIPS: kcapi-hasher: zeroise temporary values for FIPS 140-3
    * Add libkcapi-zeroize-hasher.patch [bsc#1222768]


author: rguenther@suse.com
changelog:
  - Update to version 1.0.
    - Bump SONAME to libmpc3
    - License change: LGPLv3+ for code, GFDLv1.3+ (with no invariant sections)
      for documentation
    - Functions renamed:
      mpc_mul_2exp to mpc_mul_2ui, mpc_div_2exp to mpc_div_2ui
    - New functions: mpc_log10, mpc_mul_2si, mpc_div_2si
    - Speed-ups:
    - mpc_fma
    - Bug fixes:
    - mpc_div and mpc_norm now return a value indicating the effective
      rounding direction, as the other functions
    - mpc_mul, mpc_sqr and mpc_norm now return correct results even if there
      are over- or underflows during the computation
    - mpc_asin, mpc_proj, mpc_sqr: Wrong result when input variable has
      infinite part and equals output variable is corrected
    - mpc_fr_sub: Wrong return value for imaginary part is corrected
  - Skips version 0.9:
    - New functions:
    - mpc_set_dc, mpc_set_ldc, mpc_get_dc, mpc_get_ldc for converting
      between mpc type variables and C variables of type double _Complex
      or long double _Complex
    - mpc_sin_cos, computing simultaneously the sine and cosine
    - Speed-ups:
    - mpc_pow_si through binary exponentiation
    - mpc_pow_z when the exponent fits in a long
    - mpc_tan through the use of mpc_sin_cos
    - Bug fixes:
    - trigonometric functions: infinite loop due to overflow for large
      arguments
    - mpc_exp: close to infinite loop for argument close to 0
    - mpc_sqrt: close to infinite loop for argument close to 1
    - mpc_add_si: replaced macro by function, since the macro evaluated the
      same expression twice


author: rguenther@suse.com
changelog:
  - Update to version 1.0.2.
    - Fixed mpc_atan, mpc_atanh for (+-0, +-1)
    - Fixed mpc_log10 for purely imaginary argument
    - Fixed case of intermediate zero real or imaginary part in mpc_fma


author: mpluskal@suse.com
changelog:
  - Add gpg signature
  - Add info scriplet dependencies and move them to correct sections
  - Cleanup spec file with spec-cleaner


author: rguenther@suse.com
changelog:
  - Update to version 1.1.0.
    - Compatible with mpfr 4.0.0, obsoletes mpc-1.0.3-addsubulp.diff
      and mpc-1.0.3-fmma.diff.
    - New functions mpc_cmp_abs and mpc_rootofunity
    - Rewrite of the testing framework
    - New mpcbench tool, used with make bench
    - Fixed handling of over- and underflows with directed rounding in
      the "other direction" for mpc_cos, mpc_sin, mpc_exp and mpc_pow
    - Fixed a bug in mpc_atan(0,y) with |y| near 1
  - Adjust URLs to tarball and signature.


author: rguenther@suse.com
changelog:
  - Add mpfr-3.1.5-p9.patch with cummulative patches to patchlevel p9,
    obsoletes mpfr-3.1.5-p8.patch.


author: rguenther@suse.com
changelog:
  - Update to mpfr 4.0.0
    * The "dinde aux marrons" release.
    * MPFR now depends on GMP 5.0+ instead of 4.1+.
    * API change:
      Applications that call GMP's mp_set_memory_functions function to change
      the allocators must first call the new function mpfr_mp_memory_cleanup
      in all threads where MPFR is potentially used; this new function is
      currently equivalent to mpfr_free_cache.
      The reason is that the way memory allocation is done by MPFR has changed
      (again), so that the current GMP allocators are used (since for some
      applications, the old allocators may become invalid).
      Note: Freeing the caches like this might have a performance impact on some
      particular applications; if this is an issue, this could be handled for a
      future MPFR version.
    * Mini-gmp support via the --enable-mini-gmp configure option (experimental).
    * The minimum precision MPFR_PREC_MIN is now 1, with rounding defined as
      in the errata of IEEE 754-2008 and in the following IEEE 754 revision
      (ties rounded away from zero).
    * Shared caches for multithreaded applications.
      New function mpfr_free_cache2.
    * Partial support of MPFR_RNDF (faithful rounding).
    * New functions: mpfr_fpif_export and mpfr_fpif_import to export and import
      numbers in a floating-point interchange format, independent both on the
      number of bits per word and on the endianness.
    * New function mpfr_fmodquo to return the low bits of the quotient
      corresponding to mpfr_fmod.
    * New functions mpfr_flags_clear, mpfr_flags_set, mpfr_flags_test,
      mpfr_flags_save and mpfr_flags_restore to operate on groups of flags.
    * New functions mpfr_set_float128 and mpfr_get_float128 to convert from/to
      the __float128 type (requires --enable-float128 and compiler support).
    * New functions mpfr_buildopt_float128_p and mpfr_buildopt_sharedcache_p.
    * New functions mpfr_rint_roundeven and mpfr_roundeven, completing the
      other similar round-to-integer functions for rounding to nearest with
      the even-rounding rule.
    * New macro mpfr_round_nearest_away to add partial emulation of the
      rounding to nearest-away (as defined in IEEE 754-2008).
    * New functions mpfr_nrandom and mpfr_erandom to generate random numbers
      following normal and exponential distributions respectively.
    * New functions mpfr_fmma and mpfr_fmms to compute a*b+c*d and a*b-c*d.
    * New function mpfr_rootn_ui, similar to mpfr_root, but agreeing with the
      rootn function of the IEEE 754-2008 standard.
    * New functions mpfr_log_ui to compute the logarithm of an integer,
      mpfr_gamma_inc for the incomplete Gamma function.
    * New function mpfr_beta for the Beta function (incomplete, experimental).
    * New function mpfr_get_q to convert a floating-point number into rational.
    * The mpfr_dump function is now described in the manual; its output format
      has slightly changed.
    * The mpfr_eint function now returns the value of the E1/eint1 function
      for negative argument.
    * The behavior of the mpfr_set_exp function changed, as it could easily
      yield undefined behavior in some cases (this modifies both the API and
      the ABI).
    * In function mpfr_urandom, the next random state no longer depends on the
      current exponent range and the rounding mode. The exceptions due to the
      rounding of the random number are now correctly generated, following the
      uniform distribution.
    * Functions mpfr_grandom and mpfr_root are deprecated and will be removed
      in a future release.
    * Complete rewrite of function mpfr_sum, which now works in all cases (the
      old one could take all the memory and/or crash with inputs of different
      magnitudes in case of huge cancellation or table maker's dilemma). The
      sign of an exact zero result is now specified, and the return value is
      now the usual ternary value. Note that the position of "const" in the
      mpfr_sum prototype has been fixed (the manual was correct); user code
      should not be affected.
    * Old, deprecated macros mpfr_add_one_ulp and mpfr_sub_one_ulp removed.
      The mpfr_next* functions should be used instead.
    * Internally, improved caching: a minimum of 10% increase of the precision
      is guaranteed to avoid too many recomputations.
    * Added internal small-precision mpz_t pool, which aims to avoid the
      overhead of memory allocation, in particular.
      New function mpfr_free_pool.
    * Added configure option --enable-assert=none to avoid checking any assertion.
    * The --enable-decimal-float configure option no longer requires
    - -with-gmp-build, and support for decimal floats is now automatically
      detected by default (similarly for support for __float128).
    * Updated tuning parameters.
    * Better support for Automake 1.13+ (now used to generate the tarball).
    * Dropped K&R C compatibility.
    * Improved MPFR manual.
    * New MPFRbench program (see the tools/bench directory).
    * Major speedup in mpfr_add, mpfr_sub, mpfr_mul, mpfr_div and mpfr_sqrt when
      all operands have the same precision and this precision is less than twice
      the number of bits per word, e.g., less than 128 on a 64-bit computer.
    * Speedup by a factor of almost 2 in the double <--> mpfr conversions
      (mpfr_set_d and mpfr_get_d).
    * Speedup in mpfr_log1p and mpfr_atanh for small arguments.
    * Speedup in the mpfr_const_euler function (contributed by Fredrik Johansson),
      in the computation of Bernoulli numbers (used in mpfr_gamma, mpfr_li2,
      mpfr_digamma, mpfr_lngamma and mpfr_lgamma), in mpfr_div, in mpfr_fma
      and mpfr_fms.
    * Test coverage: 96.3% lines of code.
    * Bug fixes. In particular: a speed improvement when the --enable-assert
      or --enable-assert=full configure option is used with GCC; mpfr_get_str
      now sets the NaN flag on NaN input and the inexact flag when the conversion
      is inexact. For a full list, see http://www.mpfr.org/mpfr-3.1.6/#fixed
      and the same section for any previous 3.1.x version (follow the links
      in the "Changes..." sections).
    * Microsoft Windows: Added support for thread-safe DLL (shared library).
      Tested with MinGW, ICC and MSVC.
    * Limited pkg-config support.
    * Autotools: Under Linux, make sure that the old dtags (when supported)
      are used if LD_LIBRARY_PATH is defined; otherwise "make check" would
      check an installed, compatible MPFR library found in LD_LIBRARY_PATH
      instead of the one that has been built with "make".
    * New: optional "make check-gmp-symbols", mainly for binary distributions,
      to check that MPFR does not use GMP internal symbols (experimental).


author: astieger@suse.com
changelog:
  - update to 4.0.1:
    * Improved MPFR manual
    * bug fixes, including mpfr_div_ui, mpfr_div rounding issue


author: rguenther@suse.com
changelog:
  - Add mpfr-4.0.1-cummulative-patch.patch.  Fixes
    * A subtraction of two numbers of the same sign or addition of two
      numbers of different signs can be rounded incorrectly (and the
      ternary value can be incorrect) when one of the two inputs is
      reused as the output (destination) and all these MPFR numbers
      have exactly GMP_NUMB_BITS bits of precision (typically, 32 bits
      on 32-bit machines, 64 bits on 64-bit machines).
    * The mpfr_fma and mpfr_fms functions can behave incorrectly in case
      of internal overflow or underflow.
    * The result of the mpfr_sqr function can be rounded incorrectly
      in a rare case near underflow when the destination has exactly
      GMP_NUMB_BITS bits of precision (typically, 32 bits on 32-bit
      machines, 64 bits on 64-bit machines) and the input has at most
      GMP_NUMB_BITS bits of precision.
    * The behavior and documentation of the mpfr_get_str function are
      inconsistent concerning the minimum precision (this is related to
      the change of the minimum precision from 2 to 1 in MPFR 4.0.0). The
      get_str patch fixes this issue in the following way: the value 1
      can now be provided for n (4th argument of mpfr_get_str); if n = 0,
      then the number of significant digits in the output string can now
      be 1, as already implied by the documentation (but the code was
      increasing it to 2).
    * The mpfr_cmp_q function can behave incorrectly when the rational
      (mpq_t) number has a null denominator.
    * The mpfr_inp_str and mpfr_out_str functions might behave
      incorrectly when the stream is a null pointer: the stream is
      replaced by stdin and stdout, respectively. This behavior is
      useless, not documented (thus incorrect in case a null pointer
      would have a special meaning), and not consistent with other
      input/output functions.


author: antoine.belvire@opensuse.org
changelog:
  - Fix %install_info_delete usage:
    * It has to be performed in %preun not in %postun.
    * See https://en.opensuse.org/openSUSE:Packaging_Conventions_RPM_Macros#.25install_info_delete.


author: pmonreal@suse.com
changelog:
  - FIPS: Mark HKDF and TLSv1.3 KDF as approved in the SLI [bsc#1228619]
    * Add openssl-1_1-ossl-sli-018-TLS13-HKDF.patch


author: pmonreal@suse.com
changelog:
  - FIPS: Mark PBKDF2 and HKDF HMAC input keys with size >= 112 bits
    as approved in the SLI. [bsc#1228623]
    * openssl-1_1-ossl-sli-020-PBKDF2-HMAC-size-SLI.patch


author: pmonreal@suse.com
changelog:
  - FIPS: AES GCM external IV implementation [bsc#1228618]
    * Mark the standalone AES-GCM encryption with external IV
      as non-approved in the SLI.
    * Add openssl-1_1-ossl-sli-021-AES-GCM-external-IV.patch


author: pmonreal@suse.com
changelog:
  - Security fix: [bsc#1220262, CVE-2023-50782]
    * Implicit rejection in PKCS#1 v1.5
    * Add openssl-CVE-2023-50782.patch


author: angel.yankov@suse.com
changelog:
  - Security fix: [bsc#1236136, CVE-2024-13176]
    * timing side-channel in the ECDSA signature computation
    * Add openssl-CVE-2024-13176.patch


author: angel.yankov@suse.com
changelog:
  - Fix bsc#1236771 - Non approved PBKDF parameters wrongly resulting as approved
    * Add openssl-FIPS-PBKDF-params.patch


author: pmonreal@suse.com
changelog:
  - FIPS: Use the NID_X9_62_prime256v1 curve in ECDSA KAT test
    instead of NID_secp256k1. [bsc#1246697]
    * Add openssl-fips-ECDSA-KAT.patch


author: lucas.mulling@suse.com
changelog:
  - Security fix: [bsc#1250232 CVE-2025-9230]
    * Fix out-of-bounds read & write in RFC 3211 KEK unwrap
    * Add patch openssl3-CVE-2025-9230.patch


author: angel.yankov@suse.com
changelog:
  - Security fixes:
    * Missing ASN1_TYPE validation in PKCS#12 parsing
    * ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function
    - openssl-CVE-2026-22795.patch [bsc#1256839, CVE-2026-22795], [bsc#1256840, CVE-2026-22796]
    * Missing ASN1_TYPE validation in TS_RESP_verify_response() function
    - openssl-CVE-2025-69420.patch [bsc#1256837, CVE-2025-69420]
    * NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function
    - openssl-CVE-2025-69421.patch [bsc#1256838, CVE-2025-69421]
    * Heap out-of-bounds write in BIO_f_linebuffer on short writes
    - openssl-CVE-2025-68160.patch [bsc#1256834, CVE-2025-68160]
    * Unauthenticated/unencrypted trailing bytes with low-level OCB function calls
    - openssl-CVE-2025-69418.patch [bsc#1256835, CVE-2025-69418]
    * Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion
    - openssl-CVE-2025-69419.patch [bsc#1256836, CVE-2025-69419]


author: mcepl@suse.com
changelog:
  - Update CVE-2024-11168-validation-IPv6-addrs.patch
    according to the Debian version
    (gh#python/cpython#103848#issuecomment-2708135083).


author: mcepl@cepl.eu
changelog:
  - Add CVE-2025-4516-DecodeError-handler.patch fixing
    CVE-2025-4516 (bsc#1243273) blocking DecodeError handling
    vulnerability, which could lead to DoS.


author: mcepl@suse.com
changelog:
  - Add ipaddress-update-pr60.patch from gh#phihag/ipaddress!60 to
    update vendored ipaddress module to 3.8 equivalent
  - Add gh-128840_parse-IPv6-with-emb-IPv4.patch to limit buffer
    size for IPv6 address parsing (gh#python/cpython#128840,
    bsc#1244401).
  - Update CVE-2025-4516-DecodeError-handler.patch not to break
    _PyBytes_DecodeEscape signature.


author: mcepl@cepl.eu
changelog:
  - Add CVE-2025-4435-normalize-lnk-trgts-tarfile.patch
    Security fixes for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138,
    CVE-2024-12718, CVE-2025-4435 on tarfile (bsc#1244032,
    bsc#1244061, bsc#1244059, bsc#1244060, bsc#1244056).
    The backported fixes do not contain changes for ntpath.py and
    related tests, because the support for symlinks and junctions
    were added later in Python 3.9, and it does not make sense to
    backport them to 3.6 here.
    The patch is contains the following changes:
    - python@42deeab fixes symlink handling for tarfile.data_filter
    - python@9d2c2a8 fixes handling of existing files/symlinks in tarfile
    - python@00af979 adds a new "strict" argument to realpath()
    - python@dd8f187 fixes mulriple CVE fixes in the tarfile module
    - downstream only fixes that makes the changes work and
      compatible with Python 3.6
  - Add CVE-2025-6069-quad-complex-HTMLParser.patch to avoid worst
    case quadratic complexity when processing certain crafted
    malformed inputs with HTMLParser (CVE-2025-6069, bsc#1244705).


author: mcepl@cepl.eu
changelog:
  - Add CVE-2025-8194-tarfile-no-neg-offsets.patch which now
    validates archives to ensure member offsets are non-negative
    (gh#python/cpython#130577, CVE-2025-8194, bsc#1247249).


author: mcepl@cepl.eu
changelog:
  - Add CVE-2025-8291-consistency-zip64.patch which checks
    consistency of the zip64 end of central directory record, and
    preventing obfuscation of the payload, i.e., you scanning for
    malicious content in a ZIP file with one ZIP parser (let's say
    a Rust one) then unpack it in production with another (e.g.,
    the Python one) and get malicious content that the other parser
    did not see (CVE-2025-8291, bsc#1251305)
  - Readjust patches while synchronizing between openSUSE and SLE trees:
    - F00251-change-user-install-location.patch
    - doc-py38-to-py36.patch
    - gh126985-mv-pyvenv.cfg2getpath.patch


author: mcepl@suse.com
changelog:
  - Add CVE-2025-6075-expandvars-perf-degrad.patch avoid simple
    quadratic complexity vulnerabilities of os.path.expandvars()
    (CVE-2025-6075, bsc#1252974).
  - Skip test_curses on ppc64le (gh#python/cpython#141534)


author: mcepl@cepl.eu
changelog:
  - Add CVE-2025-13836-http-resp-cont-len.patch (bsc#1254400,
    CVE-2025-13836) to prevent reading an HTTP response from
    a server, if no read amount is specified, with using
    Content-Length per default as the length.
  - Add CVE-2025-12084-minidom-quad-search.patch prevent quadratic
    behavior in node ID cache clearing (CVE-2025-12084,
    bsc#1254997).
  - Add CVE-2025-13837-plistlib-mailicious-length.patch protect
    against OOM when loading malicious content (CVE-2025-13837,
    bsc#1254401).


author: mcepl@suse.com
changelog:
  - CVE-2025-11468: preserving parens when folding comments in
    email headers (bsc#1257029, gh#python/cpython#143935).
    CVE-2025-11468-email-hdr-fold-comment.patch
  - CVE-2026-0672: rejects control characters in http cookies.
    (bsc#1257031, gh#python/cpython#143919)
    CVE-2026-0672-http-hdr-inject-cookie-Morsel.patch
  - CVE-2026-0865: rejecting control characters in
    wsgiref.headers.Headers, which could be abused for injecting
    false HTTP headers. (bsc#1257042, gh#python/cpython#143916)
    CVE-2026-0865-wsgiref-ctrl-chars.patch
  - CVE-2025-15366: basically the same as the previous patch for
    IMAP protocol. (bsc#1257044, gh#python/cpython#143921)
    CVE-2025-15366-imap-ctrl-chars.patch
  - CVE-2025-15282: basically the same as the previous patch for
    urllib library. (bsc#1257046, gh#python/cpython#143925)
    CVE-2025-15282-urllib-ctrl-chars.patch
  - CVE-2025-15367: basically the same as the previous patch for
    poplib library. (bsc#1257041, gh#python/cpython#143923)
    CVE-2025-15367-poplib-ctrl-chars.patch


author: jengelh@inai.de
changelog:
  - Update to release 2.4.3
    * Add list of authorized release signatures to README.md
    * Fix multiplexing issue with s390/s390x shm* syscalls
    * Remove the static flag from libseccomp tools compilation
    * Add define for __SNR_ppoll
    * Fix potential memory leak identified by clang in the
      scmp_bpf_sim tool
  - Drop no-static.diff, libseccomp-fix_aarch64-test.patch,
    SNR_ppoll.patch (merged)


author: rhafer@suse.com
changelog:
  - Update to release 2.5.0
    * Add support for the seccomp user notifications, see the
      seccomp_notify_alloc(3), seccomp_notify_receive(3),
      seccomp_notify_respond(3) manpages for more information
    * Add support for new filter optimization approaches, including a balanced
      tree optimization, see the SCMP_FLTATR_CTL_OPTIMIZE filter attribute for
      more information
    * Add support for the 64-bit RISC-V architecture
    * Performance improvements when adding new rules to a filter thanks to the
      use of internal shadow transactions and improved syscall lookup tables
    * Properly document the libseccomp API return values and include them in the
      stable API promise
    * Improvements to the s390 and s390x multiplexed syscall handling
    * Multiple fixes and improvements to the libseccomp manpages
    * Moved from manually maintained syscall tables to an automatically generated
      syscall table in CSV format
    * Update the syscall tables to Linux v5.8.0-rc5
    * Python bindings and build now default to Python 3.x
    * Improvements to the tests have boosted code coverage to over 93%
  - libseccomp.keyring: replaced by Paul Moore <pmoore@redhat.com> key.


author: schwab@suse.de
changelog:
  - testsuite-riscv64-missing-syscalls.patch: Fix testsuite failure on
    riscv64
  - Ignore failure of tests/52-basic-load on qemu linux-user emulation


author: dimstar@opensuse.org
changelog:
  - Do not rely on gperf: pass GPERF=/bin/true to configure and
    remove gperf BuildRequires. The syscalls.perf file it would
    generate is part of the tarball already.


author: dmueller@suse.com
changelog:
  - update to 2.5.1:
    * Fix a bug where seccomp_load() could only be called once
    * Change the notification fd handling to only request a notification fd if
    * the filter has a _NOTIFY action
    * Add documentation about SCMP_ACT_NOTIFY to the seccomp_add_rule(3) manpage
    * Clarify the maintainers' GPG keys
  - remove testsuite-riscv64-missing-syscalls.patch


author: jengelh@inai.de
changelog:
  - Update to release 2.5.2
    * Update the syscall table for Linux v5.14-rc7
    * Add a function, get_notify_fd(), to the Python bindings to
      get the nofication file descriptor.
    * Consolidate multiplexed syscall handling for all
      architectures into one location.
    * Add multiplexed syscall support to PPC and MIPS
    * The meaning of SECCOMP_IOCTL_NOTIF_ID_VALID changed within
      the kernel. libseccomp's fd notification logic was modified
      to support the kernel's previous and new usage of
      SECCOMP_IOCTL_NOTIF_ID_VALID.


author: jengelh@inai.de
changelog:
  - Update to release 2.5.3
    * Update the syscall table for Linux v5.15
    * Fix issues with multiplexed syscalls on mipsel introduced in v2.5.2
    * Document that seccomp_rule_add() may return -EACCES


author: mrueckert@suse.de
changelog:
  - reenable python bindings at least for the distro default python3
    package:
    - adds make-python-build.patch


author: mliska@suse.cz
changelog:
  - Update to gcc-11 branch head (d4a1d3c4b377f1d4acb), git1173
    * Fix D memory corruption in -M output.
    * Fix ICE in is_this_parameter with coroutines.  [boo#1193659]


author: rguenther@suse.com
changelog:
  - Add a list of Obsoletes to libstdc++6-pp-gcc11 so updates from
    packages provided by older GCC work.  Add a requires from that
    package to the corresponding libstc++6 package to keep those
    at the same version.  [bsc#1196107]


author: dmueller@suse.com
changelog:
  - drop armv5tel, merge arm and armv6hl
  - use --with-cpu rather than specifying --with-arch/--with-tune


author: rguenther@suse.com
changelog:
  - Update to gcc-11 branch head (6a1150d1524aeda3381b21717), git1406
    * includes change to adjust gnats idea of the target, fixing
      the build of gprbuild.  [bsc#1196861]
  - Add gcc11-pr104931.patch to fix miscompile of embedded premake
    in 0ad on i586.  [bsc#1197065]


author: rguenther@suse.com
changelog:
  - Add provides/conflicts to glibc crosses since only one GCC version
    for the same target can be installed at the same time.
  - Add provides/conflicts to libgccjit.


author: rguenther@suse.com
changelog:
  - Update to gcc-11 branch head (691af15031e00227ba6d5935c), git1635
    * includes gcc11-pr104931.patch
    * includes fix for Firefox ICE  [gcc#105256]


author: schwab@suse.de
changelog:
  - Update to version 4.4.10
    * Fix alignment problem for GOST 34.11 (Streebog) in gost-yestcrypt.
    * The crypt_* functions will now all fail and set errno to ERANGE if
      their 'phrase' argument is longer than CRYPT_MAX_PASSPHRASE_SIZE
      characters (this is currently 512)
    * The NT hashing method no longer truncates passphrases at 128
      characters; Windows does not do this.
  - format-overflow.patch: remove


author: schwab@suse.de
changelog:
  - Update to version 4.4.11
    * Fixes for GCC v10.x
    * Change how the known-answer tests are parallelized
  - gcc10.patch: remove


author: schwab@suse.de
changelog:
  - Update to version 4.4.15
    * The compatibility symbols crypt_gensalt_r, xcrypt, xcrypt_r,
      xcrypt_gensalt, and xcrypt_gensalt_r are deprecated further
    * Speed up ka-sunmd5 by skipping most of the test phrases
  - Package README.md and TODO.md (bsc#1165389)


author: pgajdos@suse.com
changelog:
  - fix variable name for datamember in 'struct crypt_data' [bsc#1215496]
  - added patches
    fix https://github.com/besser82/libxcrypt/commit/b212d601549a0fc84cbbcaf21b931f903787d7e2
    + libxcrypt-man-fix-variable-name.patch


author: tiwai@suse.com
changelog:
  - Sync with the latest SLE15-SP6 kernel, as of commit 3a5699ce2499
    (bsc#1217465): linux-glibc-devel-current.patch
    * EFI update (fate#316350)
    * amd/amdkfd updates (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070 jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511 jsc#PED-6041 jsc#PED-6069 jsc#PED-6071)
    * Sound updates (jsc#PED-6045 jsc#PED-6036 jsc#PED-6104 jsc#PED-6114 jsc#PED-6067 jsc#PED-6123)
    * UAPI fixes (bsc#1217382)
    * IB updates (jsc#PED-6864)
    * KVM s390 updates (jsc#PED-5441)
    * RDMA updates (jsc#PED-7574 jsc#PED-6864)
    * Block updates (bsc#1012628 jsc#PED-3545 bsc#1216436 bsc#1216435 bsc#1218003)
    * BPF updates (jsc#PED-6811)
    * virtual/devlink updates (jsc#PED-3311 jsc#PED-7785 jsc#PED-5853 jsc#PED-5505)
    * DPLL updates (jsc#PED-6079)
    * FUSE fix (bsc#1012628)
    * io_uring updates (bsc#1215211)
    * MD fix (bnc#763402)
    * Media fixes (bsc#1012628)
    * Net updates (jsc#PED-4876 jsc#PED-4860 jsc#PED-6079 jsc#PED-7574)
    * perf updates (jsc#PED-6012 jsc#PED-6121)
    * Arm64 updates (jsc#PED-5458)
    * PowerPC updates (jsc#PED-4486 jsc#PED-5452)
    * S390 updates (jsc#PED-6371 jsc#PED-3289 jsc#PED-5417 bsc#1218992)
    * X86 updates (jsc#PED-6018 bsc#1216611)
    * WiFi updates (jsc#PED-6081 jsc#PED-6130)
  - Add scripts to create a patch from kernel-source git tree


author: wr@rosenauer.org
changelog:
  - update to version 4.29
    * Remove macOS Code Fragment Manager support code
    * Remove XP_MACOSX and OS_TARGET=MacOSX
    * Refresh config.guess and config.sub
    * Remove NSPR's patch to config.sub
    * Add support for e2k target (64-bit Elbrus 2000)


author: wr@rosenauer.org
changelog:
  - update to version 4.30
    * support longer thread names on macOS
    * fix a build failure on OpenBSD


author: andreas.stieger@gmx.de
changelog:
  - update to version 4.31:
    * Lock access to PRCallOnceType members in PR_CallOnce* for
      thread safety bmo#1686138


author: martin.sirringhaus@suse.com
changelog:
  - update to version 4.32:
    * implement new socket option PR_SockOpt_DontFrag
    * support larger DNS records by increasing the default buffer
      size for DNS queries


author: wr@rosenauer.org
changelog:
  - update to version 4.34
    * add an API that returns a preferred loopback IP on hosts that
      have two IP stacks available.


author: wr@rosenauer.org
changelog:
  - update to version 4.35
    * fixes for building with clang
    * use the number of online processors for the
      PR_GetNumberOfProcessors() API on some platforms
    * fix build on mips+musl libc
    * Add support for the LoongArch 64-bit architecture


author: wr@rosenauer.org
changelog:
  - update to version 4.36
    * remove support for OS/2
    * remove support for Unixware, Bsdi, old AIX, old HPUX9 & scoos
    * remove support for Windows 16 bit
    * renamed the prwin16.h header to prwin.h
    * configure was updated from 2.69 to 2.71
    * various build, test and automation script fixes
    * major parts of the source code were reformatted


author: martin.sirringhaus@suse.com
changelog:
  - update to NSPR 4.36.2
    * Fixed a syntax error in test file parsetm.c,
      which was introduced in 4.36.1
  - update to NSPR 4.36.1
    * Incorrect time value produced by PR_ParseTimeString and
      PR_ParseTimeStringToExplodedTime if input string doesn't
      specify seconds.


author: kukuk@suse.de
changelog:
  - Update to version 1.0:
    - Add search in different locations for config files
    - Add support for pam_mktemp [bsc#1123878]


author: josef.moellers@suse.com
changelog:
  - prior to writing an service-specific config file, the main function
    calls access() on the destination file in /etc/pam.d.
    This will fail and no config file will be written when the original
    config file was installed in /usr/etc/pam.d.
    A similar problem exists when creating the new service file:
    create_service_file() wants to give the new service file the same
    user, group and mode as the old one, but the old one may not exist.
    In that case, set these to 0(root), 0(root), and 0644.
    [pam-config-remove-bad-access-call.patch, bsc#1187091]


author: josef.moellers@suse.com
changelog:
  - Add "revoke" to the option list for pam_keyinit
    (Remove some leftover debugs while we're at it)
    [pam-config-fix-pam_keyinit-options.patch]


author: valentin.lefebvre@suse.com
changelog:
  - Add pam_systemd_home module for the version 254 of systemd
    [pam-config-add-systemd_home-support.patch, bsc#1216318]


author: valentin.lefebvre@suse.com
changelog:
  - Change check for existence of modules.
    If we have a biarch architecture, we check that the 64bit
    PAM module is there and report an error if not. For the 32bit
    variant, we only issue a warning.
    [pam-config-change-check-for-existence-of-modules.patch, bsc#1227216]


author: valentin.lefebvre@suse.com
changelog:
  - Stop adding pam_env in AUTH stack, and be sure to put this module at the
    really end of the SESSION stack.
    [bsc#1243226, CVE-2025-6018, remove-pam_env-from-auth-stack.patch]


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#148
  - UEFI: update also default location, if it is controlled by SUSE
    (bsc#1210799, bsc#1201399)
  - 1.2


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#149
  - use signed grub EFI binary when updating grub in default EFI
    location (bsc#1210799)
  - 1.3


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#151
  - default-settings: support non-x86 architectures
  - add man pages for all commands
  - 1.4


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#153
  - check whether grub2-install supports --suse-force-signed option
  - 1.5


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#154
  - move kexec-bootloader from kexec-tools to perl-Bootloader
  - 1.6


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#156
  - bootloader_entry script can have an optional 'force-default'
    argument (bsc#1215064)
  - 1.7


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#158
  - skip warning about unsupported options when in compat mode
  - 1.8


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#176
  - handle missing grub_installdevice on powerpc (bsc#1230070)
  - 1.8.2


author: glin@suse.com
changelog:
  - Add pesign-obs-integration-bsc1183747-always-pad-efi-images.patch
    to fix the potential hash mismatching (bsc#1183747)


author: glin@suse.com
changelog:
  - Add pesign-obs-integration-support-gzip-zstd-compression.patch
    to support gzip and zstd module compression


author: dmueller@suse.com
changelog:
  - Update to version git master (10.2):
    * Add support for GZIP and ZSTD module compression (bsc#1188636)
    * Always pad the EFI image when calculating the hash
    * Version bump to 10.2
    * approach issue#22 false noarch subpackage
  - drop pesign-obs-integration-bsc1183747-always-pad-efi-images.patch
    pesign-obs-integration-support-gzip-zstd-compression.patch (merged)


author: lnussel@suse.de
changelog:
  - Update to version 10.2+git20210730.0cb100c:
    * Sign kernel also in module dir (boo#1184804)
      (replaces pesign-kernel-in-lib.diff)
  - switch package to obs_scm to avoid recompression


author: lnussel@suse.de
changelog:
  - Update to version 10.2+git20210804.ff18da1:
    * brp-99-pesign: fix that the signature of shim be broken


author: msuchanek@suse.com
changelog:
  - Support signing grub on powerpc (jsc#SLE-18271 bsc#1192764).
    + 0001-Support-ppc-grub-signing-jsc-SLE-18271-bsc-1192764.patch
    + 0002-kernel-sign-file-Move-x509-parsing-into-a-function.patch
    + 0003-kernel-sign-file-Support-appending-verbatim-PKCS-7-s.patch
    + 0004-Add-padding-to-grub-signature-correctly-jsc-SLE-1827.patch


author: jlee@suse.com
changelog:
  - Add 0001-pesign-gen-repackage-spec-fix-the-filename-issue-in-.patch
    to fix fix the filename issue in the scripts of generated ueficert
    package. (bsc#1195805)(bsc#1205917)


author: jlee@suse.com
changelog:
  - Add 0001-Add-support-for-dependency-generators.patch to
    - Add support for including macros in pesign-repackage.spec by
      using pesign-spec-macros
    - Add support for copying sources to the new build directory by
      using pesign-copy-sources
    - Update README for dependency generation
    - Add Dependency Generation section
    - Convert to Markdown
      (bsc#1207520)(jsc#PED-2658)


author: jlee@suse.com
changelog:
  - Add the following patches for bsc#1248618:
    - Bug 1248618 - pesign-obs-integration fails build when no signed binary is produced
    - bsc1248618-Create-archive-first.patch
    - bsc1248618-Skip-signing-when-there-are-no-files-to-sign-bsc-124.patch
    - bsc1248618-pesign-repackage.spec.in-Stop-repacking-process-when.patch


author: sweet_f_a@gmx.de
changelog:
  - update to 2.2.5:
    * add --rsyncable functionality
    * many bug fixes
  - remove all suse patches:
    * pigz-dictzip.patch, large and unmaintained patch. If somebody
      really needs that then we should rebase and test it. In this
      case --dictzip should be probably also added to original gzip.
    * pigz-always-thread.patch was a folloup of pigz-dictzip.patch
    * pigz-do-symlinks.patch added IMO dangerous and stupid behaviour
      for symlinks. The original behaviour is now again like we know
      it from gzip, bzip2 and xz.
    * pigz-spl.patch, why we hacked in special handling of .spl
      files?
    * Generally we want to have pigz to replace gzip (and vice versa)
      so better avoiding interface incompatibilities.
  - cleanup spec file


author: adam@mizerski.pl
changelog:
  - update to 2.3
    * Don't complain about missing suffix when not writing output file
    * Put all global variables in one global structure for readability
    * Do not decompress concatenated zlib streams -- only gzip streams
    * Add option for compression level 11 to use zopfli
    * Fix handling of junk after compressed data
  - added pigz-lm.patch
    * adds missing "-lm"
  - provide unpigz binary and manpage as symlink, not copy.
  - removed fake cc script - build system honors CC
  - cleanup spec file


author: p.drouand@gmail.com
changelog:
  - Update to version 2.3.3
    * Portability improvements
    * Update copyright years in documentation
  - Add build fix patches
    * pigz-fix-wrong-include.patch
    * pigz-fix-missing-linker.patch
  - Remove pigz-lm.patch; fixed
  - Use download Url as source


author: dimstar@opensuse.org
changelog:
  - Update to version 0.27.1:
    + Various fixes for using the internal glib snapshot. It should
      now be usable pretty much everywhere with the exception that
      universal builds are not supported on OS X.
    + Remove usage of gettext from the internal glib to avoid gettext
      and libintl dependencies
    + Update internal glib snapshot to 2.32.4
    + Fix check for POSIX shell used in tests to work better
    + Handle spaces in autodetected prefix on Windows
    + Bugs fixed: fdo#3550, fdo#51883, fdo#52031, fdo#53493.


author: p.drouand@gmail.com
changelog:
  - Update to version 0.28:
    + Fixed a pair of long-standing and intertwined bugs involving
      unwanted removal of flags:
    - Other Libs flags like -Wl are now kept in context order
      with -l flags.
    - Aggressive removal of all duplicate arguments has been scaled
      back so that just consecutive duplicate arguments are
      removed. One result of this change is that some flags could
      be repeated in the final output, especially flags from
      non-pkg-config packages like -lm. Since pkg-config rarely has
      enough knowledge here about the right thing to do, we throw
      the duplicate arguments at the compiler/linker and trust it
      will do the right thing.
    + Fixed an old bug to allow circular Requires. This fix brings
      along a small behavior change in that pkg-config resolves
      requires depth first, causing some lower level flags to show up
      earlier in the output than previously.
    + Cleaned up many corner-case bugs and ambiguous behavior in
      pkg-config's interface.
    + New autoconf macro PKG_CHECK_VAR for reading variables from .pc
      files.
    + Default to suppressing -L/lib and/or -L/lib64 like their /usr
      counterparts.
    + To help support multiarch scenarios out of the box,
      $host-pkg-config is now installed unless --disable-host-tool
      is passed to configure.
    + Added optional gcov usage through the --with-gcov configure
      option. As a result, many more tests were added to greatly
      increase the coverage of the code to 86% of executed lines on a
      Fedora 18 machine.
    + Bugs fixed: fdo#130, fdo#7331, fdo#16101, fdo#17053, fdo#19950,
      fdo#34504, fdo#48098, fdo#54231, fdo#54271, fdo#54379,
      fdo#54384, fdo#54386, fdo#54388, fdo#54389, fdo#54390,
      fdo#54391, fdo#54427, fdo#54463, fdo#54716, fdo#57078,
      fdo#58363, fdo#59435.


author: dvaleev@suse.com
changelog:
  - Don't redefine _arch, but use file pattern instead. This ensures
    we don't have to run fixing each and every arch.


author: zaitor@opensuse.org
changelog:
  - Update to version 0.29:
    + Fixed a regression from 0.28 in system -L flag handling. If the
      pc file has multiple system -L flags, every other flag will be
      left as is (fdo#78077).
    + Quoting of variables queried through --variable is removed so
      that the output can be used verbatim in subsequent shell
      commands (fdo#67904).
    + Fixed a regression from 0.28 in -L flag handling on Windows. A
      .libs suffix was inadvertantly being added to the library path.
    + Added a --validate option to check pc file syntax. This works
      just like --exists, but package dependencies are disabled
      (fdo#7000).
    + Added the PKG_PREREQ autoconf macro. Whereas
      PKG_PROG_PKG_CONFIG is used to check the version of the
      pkg-config tool, this is used to check the version of the
      pkg-config autoconf macros in use.
    + Added the PKG_CHECK_MODULES_STATIC autoconf macro. This will
      temporarily add --static to the pkg-config calls while invoking
      PKG_CHECK_MODULES (fdo#19541).
    + Many fixes to the testsuite for Windows. It should now pass for
      a MinGW, Cygwin, and cross-compiled MinGW using Wine for test
      execution (fdo#66939).
    + More consistent handling of prefix redefinition. On Windows,
      the prefix was always being redefined based on the pc file
      path. This feature can now be enabled or disabled at runtime on
      all platforms using the --define-prefix and
    - -dont-define-prefix options (fdo#63602).
    + Continue listing packages with --list-all even if there are
      errors in pc files (fdo#26615).
    + Various documentation improvements (fdo#62018, fdo#62374,
      fdo#66155).
    + Fixed a bug when multiple -isystem arguments are used
      (fdo#72584).
    + pkg-config is now built with largefile support to ensure that
      it works correctly on filesystems with 64 bit inodes
      (fdo#90078).
    + Bugs fixed: fdo#7000, fdo#19541, fdo#26615, fdo#62018,
      fdo#62374, fdo#63602, fdo#66155, fdo#66939, fdo#67904,
      fdo#70690, fdo#72584, fdo#78077, fdo#80378, fdo#80380,
      fdo#89267, fdo#90078, fdo#90437, fdo#92002.


author: zaitor@opensuse.org
changelog:
  - Update to version 0.29.1:
    + Fixed a regression from 0.29 with unquoting values queried with
    - -variable. In some cases, this would cause shell special
      characters to be escaped in ways they weren't before. Instead,
      the unquoting only occurs if the value appears to be quoted
      (fdo#93284).
    + Add support for building pkg-config with Microsoft Visual
      Studio (fdo#92489).
    + Allow overriding pkg-config variables with environment
      variables. By setting an environment variable of the form
      PKG_CONFIG_$PACKAGE_$VARIABLE, a pkg-config variable can be set
      globally without always having to pass --define-variable
      (fdo#90917).
    + Honor -Wl,-framework in addition to -framework so that multiple
      frameworks are handled on OSX (fdo#1278).
    + Fix the OSX build using --with-internal-glib (fdo#92902).


author: dimstar@opensuse.org
changelog:
  - Update to version 0.29.2:
    + Improved pkg-config's recursive package list expansion
      performance.
    + Handle an empty prefix setting correctly when --define-prefix
      is used (fdo#97453).
    + Lazily load pc files instead of reading all available pc files
      during initialization (fdo#98215).
    + Check the CPATH environment variable when determining system
      include paths like GCC does. Document the system search path
      behavior (fdo#99224).
    + Make PKG_CHECK_MODULES show the module list rather than the
      variable prefix in configure output (fdo#98334).
    + Fix bundled glib build with GCC 6 (fdo#98334).
    + Handle -isystem and -idirafter when PKG_CONFIG_SYSROOT_DIR is
      set (fdo#97337).
    + Check the INCLUDE environment variable when determining system
      include paths on Windows builds when --msvc-syntax is used
      (fdo#94729).
  - Drop pkg-config-gdate-fix.patch: fixed upstream.


author: mwilck@suse.com
changelog:
  - Update to version 15.6.5:
    * Add more modules to file system blacklist (jsc#PED-6167)
      Blacklisted filesystem modules that aren't officially supported
      by SUSE: f2fs, hfsplus, jfss2, kafs, ntfs3, orangefs, pstore, romfs, zonefs.
      This affects Leap and SLED only, as these modules aren't shipped
      for SLE anyway. As usual, the blacklist entries can be removed
      by running an explicit "modrobe $FS_MODULE" command.


author: mwilck@suse.com
changelog:
  - Update to version 15.6.8:
    * macros.initrd: %regenerate_initrd_post: don't fail if mkdir is unavailable
      (boo#1217979)
    * Don't rebuild existing initramfs images if the environment variable
      SKIP_REGENERATE_ALL=1 is set (boo#1192014)


author: mwilck@suse.com
changelog:
  - Update to version 15.6.9:
    * Include unblacklist in initramfs (bsc#1224320)
    * regenerate-initrd-posttrans: run update-bootloader --refresh for XEN
      (bsc#1223278)
    * 60-io-scheduler.rules: test for "scheduler" sysfs attribute (boo#1216717)
    * README: Update blacklist description (gh#openSUSE/suse-module-tools#71)


author: mwilck@suse.com
changelog:
  - Update to version 15.6.11:
    * spec file: add missing util-linux requirement (bsc#1241038)
    * regenerate-initrd-posttrans: Fix SKIP_REGENERATE_INITRD_ALL
    (bsc#1228929)


author: mwilck@suse.com
changelog:
  - Update to version 15.6.12:
    * weak-modules2: skip livepatch dir when checking for unresolved symbols
      (bsc#1250655)


author: mwilck@suse.com
changelog:
  - Update to version 15.6.13:
    * spec file: move %udev_rules_update call to %posttrans (bsc#1250664)


author: jfehlig@suse.com
changelog:
  - Add system account and groups for kvm, qemu, and libvirt
    (jsc#SLE-11629)
    New files: system-group-kvm.conf, system-group-libvirt.conf,
    system-user-qemu.conf


author: fbui@suse.com
changelog:
  - Add default hardware group for 'sgx' enclave access
    Since udev v248, a default rule for /dev/sgx_enclave is provided to
    give rw access to the new group hopefully making 'sgx' the standard
    group name for such devices. [bsc#1190572]


author: msuchanek@suse.com
changelog:
  - system-user-tss.conf: Remove group entry, not needed and did
    contain syntax errors (bsc#1190401).


author: fbui@suse.com
changelog:
  - Split systemd-network into two new sub-packages: systemd-networkd and
    systemd-resolved (bsc#1224386 jsc#PED-12669)


author: valentin.lefebvre@suse.com
changelog:
  - systemd.spec: use %sysusers_generate_pre so that some systemd users are
    already available in %pre. This is important because D-Bus automatically
    reloads its configuration whenever new configuration files are installed,
    i.e. between %pre and %post. (bsc#1248501)
    No needs for systemd and udev packages as they are always installed during
    the initial installation.


author: fbui@suse.com
changelog:
  - Import commit 00ba3646e6cb3ce40bb3de3e92f93ebec0adce6d
    e4dd315b6c units: don't force the loading of the loop and dm_mod modules in systemd-repart.service (bsc#1248356)
    b58e72215a units: add dep on systemd-logind.service by user@.service
    97ceca445c detect-virt: add bare-metal support for GCE (bsc#1244449)


author: fbui@suse.com
changelog:
  - Reintroduce systemd-network as a transitional dummy package containing no
    files (bsc#1254202)
    The contents of this package were split into two independent packages:
    systemd-networkd and systemd-resolved. However, the initial replacement caused
    both network services to be disabled. Consequently, the original package has
    been restored as an empty transitional package to prevent the disabling of the
    services. It can be safely removed once the update is complete.


author: fbui@suse.com
changelog:
  - Import commit 5caaa71f4a7b00e6a6ceb396d08486af73687d45
    9ecd162284 timer: rebase last_trigger timestamp if needed
    cd4a9103ef timer: rebase the next elapse timestamp only if timer didn't already run
    c3f4407e97 timer: don't run service immediately after restart of a timer (bsc#1254563)
    05bcfe3295 test: check the next elapse timer timestamp after deserialization
    fe8f656975 test: restarting elapsed timer shouldn't trigger the corresponding service


author: fbui@suse.com
changelog:
  - Import commit 75eab961ea843dc161707d4af0789b018d499676
    - 8bbac1d508 detect-virt: bare-metal GCE only for x86 and i386 (bsc#1254293)


author: fbui@suse.com
changelog:
  - Name libsystemd-{shared,core} based on the major version of systemd and the
    package release number (bsc#1228081 bsc#1256427)
    This way, both the old and new versions of the shared libraries will be
    present during the update. This should prevent issues during package updates
    when incompatible changes are introduced in the new versions of the shared
    libraries.


author: fbui@suse.com
changelog:
  - Import commit 626ffc7844795870235d15c6daab695f2d53a11e
    aef6e11921 core/cgroup: avoid one unnecessary strjoina()
    cc7426f38a sd-json: fix off-by-one issue when updating parent for array elements
    26a748f727 core: validate input cgroup path more prudently (CVE-2026-29111 bsc#1259418)
    99d8308fde core/dbus-manager: propagate meaningful dbus errors from EnqueueMarkedJobs


author: fbui@suse.com
changelog:
  - Import commit c89ea566d98c8e3fb29a5b8edd4576b135b4bc92
    a943e3ce2f machined: reject invalid class types when registering machines (bsc#1259650 CVE-2026-4105)
    71593f77db udev: fix review mixup
    73a89810b4 udev-builtin-net-id: print cescaped bad attributes
    0f360bfdc0 udev-builtin-net_id: do not assume the current interface name is ethX
    40905232e2 udev: ensure tag parsing stays within bounds
    7bce9026e3 udev: ensure there is space for trailing NUL before calling sprintf
    d018ac1ea3 udev: check for invalid chars in various fields received from the kernel (bsc#1259697)


author: fbui@suse.com
changelog:
  - Import 0.5
    0c5e241 SLE: turn off RemoveIPC by default for logind (fate#320125)
    cb6914f SLE: restore ProtectHostname=no for udevd (bsc#1178374)
    7e332a6 Add a header in all each drop-ins
    465e1c7 Makefile: simplify 'archive' target


author: fbui@suse.com
changelog:
  - Import commit 6b8dde1d4f867aff713af6d6830510a84fad58d2
    6b8dde1 Convert more drop-ins into early ones


author: fbui@suse.com
changelog:
  - Import 0.8
    f34372f User priority '26' for SLE-Micro
    c8b6f0a Revert "Convert more drop-ins into early ones"


author: fbui@suse.com
changelog:
  - The usage of drop-ins is now the official way for configuring systemd and its
    various daemons on Factory/ALP. Hence the early drop-ins SUSE specific
    "feature" has been abandoned.


author: varkoly@suse.com
changelog:
  - spamassassin: migrate from cron to systemd timers (bsc#1115411)
    enable spamassassin.timer by default


author: jsegitz@suse.com
changelog:
  - Removed ixpdimm-monitor.service and readonly-root.service
    (bsc#1129270)
  - Added snapd.apparmor.service (bsc#1129435)


author: matthias.gerstner@suse.com
changelog:
  Cleanup of outdated autostart services (bsc#1171656):
  - Remove acpid.service. acpid is only available on SLE via openSUSE
    backports.  In openSUSE acpid.service is *not* autostarted. I see no
    reason why it should be on SLE.
  - Remove spamassassin.timer. This timer never seems to have existed.
    Instead spamassassin ships a "sa-update.timer". But it is not
    default-enabled and nobody ever complained about this.
  - Remove snapd.apparmor.service: This service was proactively added a year
    ago, but snapd didn't even make it into openSUSE yet. There's no reason
    to keep this entry unless snapd actually enters SLE which is not
    foreseeable.


author: fvogt@suse.com
changelog:
  - Don't enable btrfsmaintenance-refresh.service, btrfsmaintenance is
    managed by systemd-presets-common-SUSE instead (boo#1165780)


author: pgajdos@suse.com
changelog:
  - enable sysstat_collect.timer and sysstat_summary.timer [bsc#1244553]
    and [bsc#1246835]
  - modified sources
    % default-SLE.preset


author: alarrosa@suse.com
changelog:
  - Modify branding-preset-states to fix systemd-presets-common-SUSE
    not enabling new user systemd service preset configuration just
    as it handles system service presets. By passing an (optional)
    second parameter "user", the save/apply-changes commands now
    work with user services instead of system ones (boo#1200485)


author: kukuk@suse.com
changelog:
  - Add wtmpdb-update-boot.service and wtmpdb-rotate.timer to enable
    wtmpdb as Y2038 safe wtmp replacement


author: kukuk@suse.com
changelog:
  - Don't call systemctl list-unit-files with an empty argument,
    this will break enabling of system unit files [bsc#1212496]


author: alarrosa@suse.com
changelog:
  - Fix another case of systemctl being called with an empty
    argument. This if a preemptive fix for a similar issue to
    bsc#1212496.


author: msuchanek@suse.com
changelog:
  - Split hcn-init.service to hcn-init-NetworkManager and hcn-init-wicked
    (bsc#1200731 ltc#198485 https://github.com/ibm-power-utilities/powerpc-utils/pull/84)
    Support both the old and new service to avoid complex version interdependency.


author: fbui@suse.com
changelog:
  - Don't emit a warning when the flag file in /var/lib/systemd/migrated/ is not
    present as it's expected (bsc#1208079).


author: fbui@suse.com
changelog:
  - Fix %sysctl_apply() and %binfmt_apply() so they are disabled when called from
    a chroot (bsc#1211272)


author: fbui@suse.com
changelog:
  - Switch to `systemd-hwdb` tool when updating the HW database. It's been
    introduced in systemd v219 and replaces the deprecated command `udevadm hwdb`.


author: fbui@suse.com
changelog:
  - Order packages that requires systemd after systemd-sysvcompat when this part
    of the transaction (bsc#1217964)
    systemd-sysvcompat has been introduced recently and contains the compatibility
    scripts used to support SysV init scripts. Make sure that the packages ordered
    after systemd are also ordered after systemd-sysvcompat so theirs rpm
    scriptlets can still rely on the compat scripts.
    On distributions where systemd-sysvcompat doesn't exist, the new ordering
    constraint should be a nop.


author: fbui@suse.com
changelog:
  - Introduce %udev_trigger_with_reload() for packages that need to trigger events
    in theirs scriplets. The new macro automatically triggers a reload of the udev
    rule files as this step is often overlooked by packages (bsc#1237143).


author: tchvatal@suse.com
changelog:
  - Version update to 1.18.10:
    * Various few fixes, see changelog file in the package
    * Refresh patch update-alternatives-suse.patch
    * Remove patch dpkg-sparc.diff


author: tchvatal@suse.com
changelog:
  - Update to 1.18.23:
    * Various small fixes and memleaks removed
  - Make sure to generate manpage
  - Refresh patch update-alternatives-suse.patch


author: tchvatal@suse.com
changelog:
  - Silence the update-alternatives regen output wrt bsc#1050848
    it causes more confusion than benefits


author: mpluskal@suse.com
changelog:
  - Use dbpath macro for locationg rpm state directory
  - Require exactly same version of rpm we had when building to make
    sure dbpath matches


author: mpluskal@suse.com
changelog:
  - Move update alternatives database to new location
  - Update rpm requirements to avoid unnecessary builds


author: dimstar@opensuse.org
changelog:
  - Migrate u-a data from /var/lib/rpm instead of relying on dbpath:
    no u-a version ever installed files explicitly into dbpath, but
    always hard specified /var/lib/rpm. The fact that RPM moved its
    database is irrelevant to update-alternatives. In case RPM moved
    it's database, our files are still accessible via the
    /var/lib/rpm symlink being put in place.
  - Drop the arbitrary depenency on a specific rpm version: the idea
    was to ensure to have an rpm with the new dbpath location in
    place. For one, the dependency does not work as intended, and
    2nd, as the migration now happens explicitly from the old u-a
    admindir without relying on dbpath, is no longer needed.


author: tchvatal@suse.com
changelog:
  - Update to 1.19.0.4:
    * No changes in update-alternatives just match step with dpkg
  - Drop patch 0001-In-case-of-equal-priority-rather-update.patch
    * Causes issues on too eagerly regenerating stuff bsc#1075971
    * Reason for this patch should no longer be needed as all python
      packages are singlespec
    * Also drop the post override


author: sbrabec@suse.com
changelog:
  - Properly neutralize escape sequences in wall
    (util-linux-wall-CVE-2024-28085.patch, bsc#1221831,
    CVE-2024-28085).


author: rgoldwyn@suse.com
changelog:
  - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU
    + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch


author: mwilck@suse.com
changelog:
  - Fix misdetection of LUKS2 partition on MD RAID
    (bsc#1224393, boo#1213227, boo#1213361)
    * add Revert-libblkid-try-LUKS2-first-when-probing.patch


author: sbrabec@suse.com
changelog:
  - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609,
    util-linux-chcpu-document-zVM-limitations.patch,
    util-linux-chcpu-document-zVM-limitations-generated.patch).


author: sbrabec@suse.com
changelog:
  - Don't delete binaries not common for all architectures. Create an
    util-linux-extra subpackage instead, so users of third party
    tools can use them. (bsc#1222285)


author: sbrabec@suse.com
changelog:
  - Document unexpected side effects of lazy destruction
    (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch,
    util-linux-umount-losetup-lazy-destruction-generated.patch).


author: sbrabec@suse.com
changelog:
  - agetty: Prevent login cursor escape (bsc#1194818,
    util-linux-agetty-prevent-cursor-escape.patch).


author: sbrabec@suse.com
changelog:
  - Skip aarch64 decode path for rest of the architectures
    (bsc#1229476, util-linux-lscpu-skip-aarch64-decode.patch).


author: danilo.spinella@suse.com
changelog:
  - Fix memory corruption on deflate, bsc#1197459
    * bsc1197459.patch - CVE-2018-25032
  - Update 410.patch
    * Remove included patches:
      bsc1174551-fxi-imcomplete-raw-streams.patch
      zlib-compression-switching.patch
      zlib-s390x-z15-fix-hw-compression.patch
  - Refresh bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch


author: danilo.spinella@suse.com
changelog:
  - Update to 1.2.12:
    * A lot of bug fixes
    * Improve speed of crc32 functions
    * Use ARM crc32 instructions if the ARM architecture has them
    For the complete changes, see ChangeLog
  - Fixes CVE-2022-37434,  heap-based buffer over-read or buffer overflow in
    inflate.c via a large gzip header extra field
    (CVE-2022-37434, bsc#1202175)
  - Added patches:
    * zlib-1.2.11-covscan-issues-rhel9.patch
    * zlib-1.2.11-covscan-issues.patch
    * zlib-1.2.12-s390-vectorize-crc32.patch
    * zlib-1.2.12-optimized-crc32-power8.patch
    * zlib-1.2.12-IBM-Z-hw-accelerated-deflate-s390x.patch
    * zlib-1.2.12-fix-configure.patch
    * zlib-1.2.12-correct-inputs-provided-to-crc-func.patch
    * zlib-1.2.12-fix-CVE-2022-37434.patch
    * zlib-1.2.5-minizip-fixuncrypt.patch
  - Removed patches:
    * bsc1197459.patch (upstreamed)
    * zlib-power8-fate325307.patch
      (replaced by zlib-1.2.12-optimized-crc32-power8.patch)
    * bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch
      (replaced by zlib-1.2.12-IBM-Z-hw-accelrated-deflate-s390x.patch)
    * 410.patch
      (replaced by zlib-1.2.12-IBM-Z-hw-accelrated-deflate-s390x.patch)
  - Refreshed patches:
    * zlib-format.patch
    * zlib-no-version-check.patch
  - Disable profiling since it breaks tests
  - Update zlib-rpmlintrc


author: danilo.spinella@suse.com
changelog:
  - Add Power8 optimizations:
    * zlib-1.2.12-add-optimized-slide_hash-for-power.patch
    * zlib-1.2.12-add-vectorized-longest_match-for-power.patch
    * zlib-1.2.12-adler32-vector-optimizations-for-power.patch
    * zlib-1.2.12-fix-invalid-memory-access-on-ppc-and-ppc64.patch
  - Update zlib-1.2.12-IBM-Z-hw-accelerated-deflate-s390x.patch


author: danilo.spinella@suse.com
changelog:
  - Update to 1.13:
    * Fix configure issue that discarded provided CC definition
    * Correct incorrect inputs provided to the CRC functions
    * Repair prototypes and exporting of new CRC functions
    * Fix inflateBack to detect invalid input with distances too far
    * Have infback() deliver all of the available output up to any error
    * Fix a bug when getting a gzip header extra field with inflate()
    * Fix bug in block type selection when Z_FIXED used
    * Tighten deflateBound bounds
    * Remove deleted assembler code references
    * Various portability and appearance improvements
  - Added patches:
    * zlib-1.2.13-IBM-Z-hw-accelerated-deflate-s390x.patch
    * zlib-1.2.13-fix-bug-deflateBound.patch
    * zlib-1.2.13-optimized-s390.patch
  - Refreshed patches:
    * zlib-1.2.12-add-optimized-slide_hash-for-power.patch
    * zlib-1.2.12-add-vectorized-longest_match-for-power.patch
    * zlib-1.2.12-s390-vectorize-crc32.patch
  - Removed patches:
    * zlib-1.2.12-fix-configure.patch
    * zlib-1.2.12-IBM-Z-hw-accelerated-deflate-s390x.patch
    * zlib-1.2.12-optimized-crc32-power8.patch
    * zlib-1.2.12-correct-inputs-provided-to-crc-func.patch
    * zlib-1.2.12-fix-CVE-2022-37434.patch
    * zlib-1.2.11-optimized-s390.patch


author: oss@danyspin97.org
changelog:
  - Fix CVE-2023-45853, integer overflow and resultant heap-based buffer
    overflow in zipOpenNewFileInZip4_6, bsc#1216378
    * CVE-2023-45853.patch


author: idonmez@suse.com
changelog:
  - Update to version 1.4.5
    * perf: Improved decompression speed (x64 >+5%, ARM >+15%)
    * perf: Automatically downsizes ZSTD_DCtx when too large for too
    * perf: Improved fast compression speed on aarch64 (#2040, ~+3%)
    * perf: Small level 1 compression speed gains (depending on compiler)
    * fix: Compression ratio regression on huge files (> 3 GB) using high
      levels (--ultra) and multithreading
    * api: ZDICT_finalizeDictionary() is promoted to stable
    * api: new experimental parameter ZSTD_d_stableOutBuffer
    * cli: New --patch-from command, create and apply patches from files
    * cli: --filelist= : Provide a list of files to operate upon from a file
    * cli: -b can now benchmark multiple files in decompression mode
    * cli: New --no-content-size command
    * cli: New --show-default-cparams command
    * misc: new diagnosis tool, checked_flipped_bits, in contrib/
    * misc: Extend largeNbDicts benchmark to compression
    * misc: experimental edit-distance match finder in contrib/


author: bwiedemann@suse.com
changelog:
  - Update to version 1.4.7
    * Improved --long mode
    * --long now automatically enabled for any window size >= 128MB
    * Faster decompression of small blocks
    * CLI improvements
      + accept parameter through environment variable ZSTD_NBTHREADS
      + new command --output-dir-mirror
      + more accurate warning and error messages
    * New experimental features
      + Shared Thread Pool
      + Faster Dictionary Compression
      + New Sequence Ingestion API
    * Drop upstream fix-lib-build.patch


author: bwiedemann@suse.com
changelog:
  - Update to version 1.4.9
    * https://github.com/facebook/zstd/releases/tag/v1.4.9
    * >2x Faster Long Distance Mode
    * New Experimental Decompression Feature: ZSTD_d_refMultipleDDicts
    * bug: Use umask() to Constrain Created File Permissions
    * bug: Make Simple Single-Pass Functions Ignore Advanced Parameters
    * cli: Fix --output-dir-mirror's Rejection of ..-Containing Paths
    * cli: Allow Input From Console When -f/--force is Passed


author: ali.abdallah@suse.com
changelog:
  - Update to version 1.5.0 (jsc#SLE-20392)
    * https://github.com/facebook/zstd/releases/tag/v1.5.0
    * Improved Middle-Level Compression Speed
    * Improved High-Level Compression Ratio
    * Faster Decompression Speed
    * Dynamic Library Supports Multithreading by Default


author: ali.abdallah@suse.com
changelog:
  - Fix CVE-2022-4899, bsc#1209533
    * Fix buffer underflow when dir1 == ""
    * Disallow empty string as an argument for --output-dir-flat=""
    and --output-dir-mirror="".
  - Added patches:
    * Disallow-empty-output-directory.patch
    * Fix-buffer-underflow-for-null-dir1.patch


author: ali.abdallah@suse.com
changelog:
  - update to 1.5.5:
    * fix: fix rare corruption bug affecting the high compression
      mode, reported by @danlark1
    * perf: improve mid-level compression speed
    * lib: deprecated bufferless block-level API (#3534) by
      @terrelln
    * cli: mmap large dictionaries to save memory, by
      @daniellerozenblit
    * cli: improve speed of --patch-from mode (~+50%) (#3545) by
      @daniellerozenblit
    * cli: improve i/o speed (~+10%) when processing lots of small
      files (#3479) by @felixhandte
    * cli: zstd no longer crashes when requested to write into
      write-protected directory (#3541) by @felixhandte
    * cli: fix decompression into block device using -o, reported
      by @georgmu
    * misc: improve seekable format ingestion speed (~+100%) for
      very small chunk sizes (#3544) by @Cyan4973
    * misc: tests/fullbench can benchmark multiple files (#3516) by
      @dloidolt
    * Upstream changelog from version 1.5.0 to 1.5.4
      https://github.com/facebook/zstd/blob/v1.5.4/CHANGELOG
    * Dropped patches:
    - Disallow-empty-output-directory.patch
    - Fix-buffer-underflow-for-null-dir1.patch
      Fixed upstream in version 1.5.4
  - enable zlib/gzip compatible backend, as zlib is significantly
    (50%-100%) faster than gzip
  - add zstd-gzip compatibility subpackage which can be used
    as a drop in compatible replacement for gzip
  - small spec file cleanups
  - add zcat in zstd-gzip (needed by for example the kernel scripts)
  - Build AVX2 enabled hwcaps library for x86_64-v3


