# changelog

author: sflees@suse.de
changelog:
  - Fix CVE-2019-12749 Authentication bypass (CVE-2019-12749 bsc#1137832)
    * added fix-CVE-2019-12749.patch


author: sflees@suse.de
changelog:
  - Fix CVE-2020-35512 - shared UID's caused issues (CVE-2020-35512 bsc#1187105)
    * fix-upstream-userdb-constpointer.patch
    * fix-upstream-CVE-2020-35512.patch


author: sflees@suse.de
changelog:
  - Fix CVE-2020-12049 truncated messages lead to resource exhaustion
    (CVE-2020-12049, bsc#1172505)
    * fix-upstream-CVE-2020-12049.patch
  - Rebased fix-CVE-2019-12749.patch


author: dcermak@suse.com
changelog:
  - Remove pointless %%post scriptlet leveraging non-existent systemd env
    variables
    FIRST_ARG has been used in our systemd macros, but this has now been gone for
    years. Thus the true branch of the if has never been executed for years and is
    only causing warnings when installing dbus.


author: sflees@suse.de
changelog:
  - Fix a potential crash that could be triggered by an invalid signature.
    (CVE-2022-42010, bsc#1204111)
    * fix-upstream-CVE-2022-42010.patch
  - Fix an out of bounds read caused by a fixed length array (CVE-2022-42011,
    bsc#1204112)
    * fix-upstream-CVE-2022-42011.patch
  - A message in non-native endianness with out-of-band Unix file descriptors
    would cause a use-after-free and possible memory corruption CVE-2022-42012,
    bsc#1204113)
    * fix-upstream-CVE-2022-42012.patch
  - Disable asserts (bsc#1087072)
  - Refreshed patches
    * fix-upstream-CVE-2020-35512.patch


author: sflees@suse.de
changelog:
  - Sometimes unprivileged users were able to crash dbus-daemon
    (CVE-2023-34969, bsc#1212126)
    * fix-upstream-CVE-2023-34969.patch


author: antonio.feijoo@suse.com
changelog:
  - Update to version 059+suse.531.g48487c31:
    * feat(systemd*): include systemd config files from /usr/lib/systemd (bsc#1228398)
    * fix(convertfs): error in conditional expressions (bsc#1228847)


author: antonio.feijoo@suse.com
changelog:
  - Update to version 059+suse.539.gdd3495f7:
    * fix(dracut.spec): add Builddeps for initrd posttrans macros (bsc#1230639)
    * fix(zfcp_rules): check for presence of legacy rules (bsc#1230330)
    Fixes for NVMeoF boot (bsc#1230468):
    * fix(nvmf): install (only) required nvmf modules
    * fix(nvmf): require NVMeoF modules
    * fix(nvmf): move /etc/nvme/host{nqn,id} requirement to hostonly


author: antonio.feijoo@suse.com
changelog:
  - Update to version 059+suse.541.g3c2df232:
    * fix(dasd-rules): handle all possible options in `rd.dasd` (bsc#1230110)


author: antonio.feijoo@suse.com
changelog:
  - Update to version 059+suse.543.g98d7f037:
    * fix(dm): remove 59-persistent-storage-dm.rules (bsc#1232063)


author: antonio.feijoo@suse.com
changelog:
  - Update to version 059+suse.552.g232957b4:
    Fixes related to getting live image size (bsc#1235912):
    * fix(livenet): split `imgsize` calculation to avoid misleading error message
    * fix(livenet): check also `content-length` from live image header
    * fix(livenet): propagate error code
    Fixes for booting from iSCSI offload with bnx2i (bsc#1228086):
    * fix(iscsi): attempt iSCSI login before all interfaces are up
    * fix(iscsi): don't require network setup for bnx2i
    Other:
    * fix(dracut): rework timeout for devices added via --mount and --add-device (bsc#1231792)


author: antonio.feijoo@suse.com
changelog:
  - Update to version 059+suse.557.gccd6ab94:
    * fix(iscsi): make sure services are shut down when switching root (bsc#1237695)
    * fix(iscsi): don't require network setup for qedi
    * fix(network-legacy): do not require pgrep when using wicked (bsc#1236982)


author: antonio.feijoo@suse.com
changelog:
  - Update to version 059+suse.562.g5ab4efaa:
    * fix(crypt): always install s390 crypto modules (jsc#IBM-1444)
    * fix(crypt): install dm_crypt module in non-hostonly mode as well
    * fix(nfs): set correct ownership of rpc.statd state directories (bsc#1217885)
    * perf(nfs): remove references to old rpcbind state dir
    * fix(nfs): libnfsidmap plugins not added in some distributions


author: antonio.feijoo@suse.com
changelog:
  - Update to version 059+suse.564.g984c275a:
    * fix(rngd): adjust license to match the license of the whole project
    * fix(dracut): kernel module name normalization in drivers lists (bsc#1241680)


author: antonio.feijoo@suse.com
changelog:
  - Update to version 059+suse.565.g51c2c969:
    * fix(dracut-util): crash if CMDLINE ends with quotation mark (bsc#1247819)


author: antonio.feijoo@suse.com
changelog:
  - Update to version 059+suse.566.gc1c35aa5:
    * fix(kernel-modules-extra): remove stray \ before / (bsc#1253029)


author: mliska@suse.cz
changelog:
  - Update to version 0.183:
    debuginfod: New thread-busy metric and more detailed error metrics.
      New --fdcache-mintmp and tracking of filesystem freespace.
      New increased webapi concurrency while grooming.
    debuginfod-client: DEBUGINFOD_SONAME macro added to debuginfod.h which
      can be used to dlopen the libdebuginfod.so library.
      New function debuginfod_set_verbose_fd and
      DEBUGINFOD_VERBOSE environment variable.
    config: profile.sh and profile.csh won't export DEBUGINFOD_URLS unless
      configured --enable-debuginfod-urls[=URLS]
    elflint, readelf: Recognize SHF_GNU_RETAIN.
      Handle SHT_X86_64_UNWIND as valid relocation target.
  - Remove config-do-not-define-DEBUGINFOD_URLS-environment-var.patch patch.


author: mliska@suse.cz
changelog:
  - Add disable-run-readelf-self-test.patch in order to disable
    a failing test-case with GCC 11 (PR27367).


author: mliska@suse.cz
changelog:
  - Update to version 0.184:
    debuginfod: Use libarchive's bsdtar as the .deb-family file unpacker.
    debuginfod-client: Client caches negative results. If a query for a
      file failed with 404, an empty 000 permission
      file is created in the cache. This will prevent
      requesting the same file for the next 10 minutes.
      Client objects now carry long-lived curl handles
      for outgoing connections.  This makes it more
      efficient for multiple sequential queries, because
      the TCP connections and/or TLS state info are kept
      around awhile, avoiding O(100ms) setup latencies.
    libdw: handle DW_FORM_indirect when reading attributes
    translations: Update Polish translation.


author: mliska@suse.cz
changelog:
  - Update to version 0.185:
    debuginfod-client: Simplify curl handle reuse so downloads which
      return an error are retried.
    elfcompress: Always exit with code 0 when the operation succeeds (even
      when nothing was done). On error the exit code is now always 1.


author: jcheung@suse.com
changelog:
  - For version 0.185, the below patches are no longer needed
    (jsc#SLE-17288, jsc#SLE-17951)
    libdw-check-end-of-attributes-list-consistently.patch
    elflint-dont-check-section-group-without-flags-word.patch
    libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
    libdw-readelf-make-sure-there-is-enough-data-to-read.patch
    elfutils-dont-trust-sh_entsize.patch
    elflint-check-symbol-table-data-is-big-enough-before-check.patch
    size-handle-recursive-elf-ar-files.patch
    elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
    use-the-empty-string-for-note-names-with-zero-size.patch
    readelf-fix-off-by-one-sanity-check.patch
    libebl-check-NT_PLATFORM-core-notes.patch
    libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
    libelf-check-compression-before-allocate-output-buffer.patch
    libdwfl-sanity-check-partial-core-file-data-reads.patch
    arlib-check-that-sh_entsize-isnt-zero.patch


author: martin.liska@suse.com
changelog:
  - Enhance license fields: all the libraries actually have a different
    license to the tools. While the tools are GPL-3.0-or-later, the
    libraries are (LGPL-3.0-or-later OR GPL-2.0-or-later)
    SLE bug (for tracking the above) bsc#1191310


author: matz@suse.com
changelog:
  - Add elfutils-fix-large-alignment.diff and elfutils-pr28190.diff
    to fix build/testsuite for more recent glibc and kernels.
  - Add elfutils-fuzz-1.diff, elfutils-fuzz-2.diff,
    elfutils-fuzz-3.diff, elfutils-fuzz-4.diff [bsc#1237236,
    bsc#1237240, bsc#1237241, bsc#1237242].
  - Add elfutils-fix-debuginfod-groom-race.diff to fix a testsuite
    race in run-debuginfod-find.sh.


author: jengelh@inai.de
changelog:
  - Update package summaries. Replace old RPM constructs.
  - Remove --with-pic which is useless with --disable-static.
  - Edit pre_checkin.sh to remove dead python3 file.


author: werner@suse.de
changelog:
  - Add patch file-a642587a9c.patch for bsc#1096974, bsc#1096984, and
    CVE-2018-10360 -- Avoid reading past the end of buffer


author: werner@suse.de
changelog:
  - Add patch 0002-PR-62-spinpx-limit-size-of-file_printable.patch to
    fix bsc#1126117, bsc#1126118, and bsc#1126119 for CVE-2019-8905,
    CVE-2019-8906, and CVE-2019-8907


author: werner@suse.de
changelog:
  - Add temporary patch CVE-2019-18218-46a8443f.patch from upstream
    to fix bsc#1154661 -- heap-based buffer overflow in cdf_read_property_info in cdf.c


author: werner@suse.de
changelog:
  - Add patchfix_of_backport_PR-62.patch as previous backport caused
    a shorten output of the elf interprter (bsc#1176123)


author: jsikes@suse.de
changelog:
  - Updated fipscheck to 1.5.0
    * Changed source to local file since latest official release
      is not in the official releases directory.
    * Downgraded libopenssl-devel to libopenssl-1_0_0-devel because
      1.0.2 supports FIPS.


author: vcizek@suse.com
changelog:
  - Use the shipped manpages instead of building them with xmlto
    in order to avoid a build cycle (fipscheck, xmlto, libxslt, libgcrypt)
    * add fipscheck-dont_generate_manpages.patch
  - fix build on older distributions


author: vcizek@suse.com
changelog:
  - Remove #include of unused fips.h to fix build with OpenSSL 1.1.1
    (bsc#1149792)
    * add fipscheck-fips.h_not_needed.patch
  - Drop obsolete openssl-1_1-port.patch (upstream)


author: meissner@suse.com
changelog:
  - updated to 1.7.0 (from a different supplier)
    - openssl 3 support
  - dropped fipscheck-dont_generate_manpages.patch (not needed)
  - dropped fipscheck-fips.h_not_needed.patch (not needed)


author: mjambor@suse.com
changelog:
  - Backport upstream patches fipscheck-fix_check_openssl_version.patch
    and fipscheck-fix_incorrect_length_type.patch to fix C99 violations
    which are errors by default with GCC 14 [boo#1221714] - although the
    first one looks like it possibly fixes some more substantial error.


author: astieger@suse.com
changelog:
  - GNU awk 4.1.3:
    * Regexp parsing with extra brackets should now be working again.
    * Updated to latest config.guess and config.sub.
    * bug fixes


author: astieger@suse.com
changelog:
  * GNU awk 4.1.4:
    * z/OS support updated
    * debugger improvements
    * return value of system() enhanced to convey more information
    * two-way pipe handling improved
    * The -d option now allows -d- to print to standard output.
    * The DJGPP port is now officially deprecated.


author: josef.moellers@suse.com
changelog:
  - Added an explicit rpmlint rule to keep one file (gawkapi.h)
    from requiring a separate package.
    [+gawk.rpmlintrc]


author: schwab@linux-m68k.org
changelog:
  - Update to gawk 4.2.0
    * If not in POSIX mode, changes to ENVIRON are reflected into
      gawk's environment
    * The series of numbers returned by rand() should now be "more
      random" than previously
    * Multiple changes related to the pretty printer
    * The igawk script and igawk.1 man page are no longer installed
    * Gawk now processes a maximum of two hexadecimal digits in \x
      escape sequences inside strings
    * Setting PROCINFO["redirection", "NONFATAL"] to true makes I/O
      errors for "redirection" not fatal
    * Gawk now supports retryable I/O via PROCINFO[input-file, "RETRY"]
    * Revisions in the POSIX standard remove the special case for POSIX
      mode when FS = " " where newline was not a field separator
    * Gawk now supports strongly typed regexp constants
    * The new typeof() function can be used to indicate if a variable or
      array element is an array, regexp, string or number
    * Optimizations are now enabled by default
    * Passing negative operands to any of the bitwise functions now
      produces a fatal error
    * The mktime function now accepts an optional second argument
    * The FIELDWIDTHS parsing syntax has been enhanced to allow specifying
      how many characters to skip before a field starts
    * The PROCINFO["argv"] array records all of gawk's command line arguments
      as gawk received them
  - gawk_ppc64le_ignore_transient_test_time_failure.patch: removed


author: astieger@suse.com
changelog:
  - GNU awk 4.2.1:
    * documentation updates
    * In MPFR mode, When ROUNDMODE changes, string values for
      numerically type values will be redone
    * various bug fixes
    * drop fold-string.patch, upstream
  - Use %license (boo#1082318)


author: schwab@suse.de
changelog:
  - format-tree-positional-arg.patch: Validate index into argument list
    (CVE-2023-4156, bsc#1214025)


author: pvorel@suse.cz
changelog:
  - Update to version 20211215
    https://github.com/iputils/iputils/releases/tag/20211215
  - rarpd and rdisc are going to be removed in next release
    (https://github.com/iputils/iputils/issues/363)
    therefore don't pack it since this release
  - Drop harden_rdisc.service.patch, which was 1) merged upstream
    4bb0ace ("systemd: Add ProtectHostname, ProtectKernelLogs")
    for all services
    2) we don't build rdisc since this release


author: pvorel@suse.cz
changelog:
  - Backport 2 fixes for bsc#1203957:
    0001-ping-Add-SA_RESTART-to-sa_flags.patch
    0002-ping-Make-ping_rts-struct-static.patch


author: pvorel@suse.cz
changelog:
  - Update to version 20221126
    https://github.com/iputils/iputils/releases/tag/20221126
  - Update configure variables (ninfod, rarpd and rdisc were removed from
    upstream in next release => remove -DBUILD_NINFOD=false -DBUILD_RARPD=false
    - DBUILD_RDISC=false)
  - Remove 2 backported fixes from this release
    0001-ping-Add-SA_RESTART-to-sa_flags.patch
    0002-ping-Make-ping_rts-struct-static.patch


author: pvorel@suse.cz
changelog:
  - Backport upstream fix for bsc#1224877
    4db1de6 ("arping: Fix 1s delay on exit for unsolicited arpings")
    0001-arping-Fix-1s-delay-on-exit-for-unsolicited-arpings.patch


author: pvorel@suse.cz
changelog:
  - Backport proposed fix for regression in upstream commit 4db1de6 (bsc#1224877)
    0002-arping-Fix-unsolicited-ARP-regressions-on-c-1.patch


author: pvorel@suse.cz
changelog:
  - Update 0002-arping-Fix-unsolicited-ARP-regressions-on-c-1.patch
    after upstream merged the fix, update git commit hashes.


author: angel.yankov@suse.com
changelog:
  - Security fix [bsc#1242300, CVE-2025-47268]
    * integer overflow in RTT calculation can lead to undefined behavior
    * Add iputils-CVE-2025-47268.patch


author: angel.yankov@suse.com
changelog:
  - Security fix [bsc#1243772, CVE-2025-48964]
    * Fix  integer overflow in ping statistics via zero timestamp
    * Add iputils-CVE-2025-48964_01.patch
    * Add iputils-CVE-2025-48964_02.patch
    * Add iputils-CVE-2025-48964_03.patch
    * Add iputils-CVE-2025-48964_04.patch
    * Add iputils-CVE-2025-48964_regression.patch


author: christophe@krop.fr
changelog:
  - Update the installed license file.
    COPYING is a symlink to LICENSE. Let's use this file directly.


author: kukuk@suse.com
changelog:
  - Only run kbdsettings.service if /etc/sysconfig/keyboard exists.
    Necessary for image based installations without admin made changes.


author: fvogt@suse.com
changelog:
  - Add patch to fix random doubling of font sizes (bsc#1194698):
    * 0001-libkfont-Initialize-kfont_context-options.patch


author: fbui@suse.com
changelog:
  - Add 'ara' vc keymap (bsc#1210702)
    'ara' is slightly better than 'arabic' as it matches the name of its x11
    layout counterpart. Keep 'arabic' for backward compatibility sake.


author: sbrabec@suse.com
changelog:
  - Move legacy keymaps that have no acceptable xkb counterpart and
    its includes back to kbd. (bsc#1194609)


author: sbrabec@suse.com
changelog:
  - Remove obsolete parts of suse-add.tar.bz2 (jsc#PED-7977),
    possible BREAKING CHANGES for obscure configurations:
    * Replace consolefonts/Cyr_a8x*.psf with upstream instances.
    * Replace consolefonts/cp850-full-8x*.psfu with upstream
      instances.
    * Drop consolefonts/lat5--*.psfu in favor of upstream
      lat5-*.psfu, exactly the same fonts with a better unimap.
    * Drop consolefonts/lat7.psf as it is lat7a-16.psf in the
      upstream.
    * Drop consolefonts/lt-brim-8x14.psfu in favor of upstream
      lat7a-14.psfu, exactly the same fonts with a better unimap.
    * Drop keymaps/i386/qwerty/Pl02.map in favor of nearly equal
      upstream pl2.map.
    * Drop keymaps/i386/qwerty/br-abnt-alt.map in favor of nearly
      equal upstream br-abnt.map.
    * Drop keymaps/i386/qwerty/tj_alt-UTF8.map that is already
      upstreamed.
    * Drop unimaps/iso07*.uni that is already upstreamed.
  - Remove broken KBD_DISABLE_CAPS_LOCK feature (sysconfig.keyboard,
    kbdsettings, boo#1179897, jsc#PED-7814).
    Can be replaced by KEYMAP="{my map} disable.capslock" in
    /etc/vconsole.conf.


author: sbrabec@suse.com
changelog:
  - sysconfig.keyboard: KBD_NUMLOCK="bios" works only on systems
    without Secure Boot. Document that. Change the default to
    KBD_NUMLOCK="no". (boo#1212141)
  - kbdsettings-nox86.patch: Update and return missing chunk.


author: sbrabec@suse.com
changelog:
  - Don't search for resources in the current directory. It can cause
    unwanted side effects or even infinite loop (bsc#1237230,
    kbd-ignore-working-directory-1.patch,
    kbd-ignore-working-directory-2.patch,
    kbd-ignore-working-directory-3.patch).


author: sndirsch@suse.com
changelog:
  - dummy update to trigger rebuild after having updated
    console-setup (bsc#1246522); so this needs to be checked in and
    build after checking in console-setup !!!
  - kbd-better-error-message-on-unsupported-unicode-value.patch
    * has been extremely useful for debugging that issue


author: dsterba@suse.com
changelog:
  - bnxt_en: Fix null pointer dereference in bnxt_bs_trace_check_wrap() (CVE-2025-68197 bsc#1255242)
  - commit 85b99e2


author: rgoldwyn@suse.com
changelog:
  - fuse: fix livelock in synchronous file put from fuseblk workers (CVE-2025-40220 bsc#1254520).
  - commit 46a797f


author: hoyeon.lee@suse.com
changelog:
  - bpf: Fix invalid prog->stats access when update_effective_progs
    fails (CVE-2025-68742 bsc#1255707).
  - commit 53d4b3c


author: tiwai@suse.de
changelog:
  - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix
    Halo (bsc#1256528).
  - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev
    (bsc#1256528).
  - x86/microcode/AMD: Add more known models to entry sign checking
    (bsc#1256528).
  - x86/microcode/AMD: Limit Entrysign signature checking to known
    generations (bsc#1256528).
  - x86/microcode: Fix Entrysign revision check for Zen1/Naples
    (bsc#1256528).
  - x86/microcode/AMD: Add TSA microcode SHAs (bsc#1256528).
  - x86/microcode/AMD: Use sha256() instead of init/update/final
    (bsc#1256528).
  - x86/microcode/AMD: Clean the cache if update did not load
    microcode (bsc#1256528).
  - x86/microcode/AMD: Extend the SHA check to Zen5, block
    loading of any unreleased standalone Zen5 microcode patches
    (bsc#1256528).
  - x86/microcode/AMD: Fix __apply_microcode_amd()'s return value
    (bsc#1256528).
  - x86/microcode/AMD: Add some forgotten models to the SHA check
    (bsc#1256528).
  - x86/microcode/AMD: Load only SHA256-checksummed patches
    (bsc#1256528).
  - commit ed14359


author: tiwai@suse.de
changelog:
  - x86/microcode/AMD: Select which microcode patch to load
    (bsc#1256528).
  - Refresh
    patches.suse/x86-microcode-AMD-Handle-the-case-of-no-BIOS-microcode.patch.
  - commit 3b809fe


author: jengelh@inai.de
changelog:
  - Update to release 29
    * Fix `modinfo -F` not working for built-in modules and
      certain fields.
    * Fix a memory leak, overflow and double free on error path.
  - Drop 0001-Fix-modinfo-F-always-shows-name-for-built-ins.patch,
    0001-libkmod-config-revamp-kcmdline-parsing-into-a-state-.patch,
    0002-libkmod-config-re-quote-option-from-kernel-cmdline.patch
    (all merged)


author: msuchanek@suse.de
changelog:
  - /usr/lib should override /lib where both are available. Support /usr/lib for
    depmod.d as well.
    * Refresh usr-lib-modprobe.patch
  - Remove test patches included in release 29
    - kmod-populate-modules-Use-more-bash-more-quotes.patch
    - kmod-testsuite-compress-modules-if-feature-is-enabled.patch
    - kmod-also-test-xz-compression.patch


author: msuchanek@suse.de
changelog:
  - Display module information even for modules built into the running kernel
    (bsc#1189537).
    + libkmod-Provide-info-even-for-modules-built-into-the.patch


author: msuchanek@suse.com
changelog:
  - Use docbook 4 rather than docbook 5 for building man pages (bsc#1190190).
    * Refres no-stylesheet-download.patch


author: msuchanek@suse.com
changelog:
  - Enable ZSTD on 15.3 as well (boo#1192104).
  - Only test ZSTD in testsuite on releases where it is available.


author: msuchanek@suse.de
changelog:
  - man: modprobe.d: document the config file order handling (bsc#1253741)
    * man-modprobe.d-document-the-config-file-order-handling.patch


author: suse-beta@cboltz.de
changelog:
  - Update to AppArmor 3.1.7
    - aa-logprof: don't skip exec events in hats
    - fix aa-cleanprof to work with named profiles
    - add permissions in various abstractions
    - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.1.7
      for the full list of changes
  - drop upstreamed apparmor-systemd-sessions.patch


author: ddiss@suse.com
changelog:
  - Add apparmor-abstractions-openssl-allow-version-specific-en.patch to
    allow version specific engdef & engines openssl paths (boo#1219571)


author: nopower@suse.com
changelog:
  - Add smbd-unix_chkpwd.diff to allow smbd to execute
    unix_chkpwd and fix other pam related denies; (boo#1220032).


author: suse-beta@cboltz.de
changelog:
  - Remove workaround for boo#853019 in %postun parser -
    apparmor.service contains a more safe workaround.
    This also fixes boo#1220708 (missing daemon-reload).


author: valentin.lefebvre@suse.com
changelog:
  - Allow dovecot-auth to execute unix_chkpwd from /sbin, not only from /usr/bin
    (bsc#1234452)
    * Update dovecot-unix_chkpwd.diff


author: valentin.lefebvre@suse.com
changelog:
  - Allow pam_unix to execute unix_chkpwd with abi/3.0
    - remove dovecot-unix_chkpwd.diff
    - Add allow-pam_unix-to-execute-unix_chkpwd.patch
    - Add revert-abi-change-for-unix_chkpwd.patch
    (bsc#1234452, bsc#1232234)


author: valentin.lefebvre@suse.com
changelog:
  - Add dac_read_search capability for unix_chkpwd to allow it to read the shadow
    file even if it has 000 permissions. This is needed after the CVE-2024-10041
    fix in PAM.
    * unix-chkpwd-add-read-capability.path, bsc#1241678


author: lnussel@suse.de
changelog:
  - Update to version 0.0+git20171227.670229c:
    * Added ABI version number
    * AVX2/AVX-512F optimizations of BLAMKA
    * Set Argon2 version number from the command line
    * New bindings
    * Minor bug and warning fixes (no security issue)
  - use _service file


author: wolfgang.frisch@suse.com
changelog:
  - Update to version 0.0+git20190520.62358ba (boo#1170512):
    * Fix the Makefile to install libargon2.pc.
    * Wait for already running threads if a thread creation failed.
    * Added Argon2 Erlang binding.
    * Additional JVM bindings (Jargon2).


author: rpm@fthiessen.de
changelog:
  - Fix version of package: 20190702 is the upstream version number
    of the package
  - Replaced optflags.patch with adjust-makefile.patch, the
    patch will now also allow to set the file permissions of installed
    libraries. This fixes the rpmlint error: shared-library-not-executable


author: schwab@suse.de
changelog:
  - Disable multilib and go on riscv64
  - libgcc-riscv-div.patch: Backport of r12-5799-g45116f342057b7 to fix
    build with current binutils


author: rguenther@suse.com
changelog:
  - Add gcc7-aarch64-bsc1214052.patch to fix -fstack-protector issues
    with variable length stack allocations on aarch64.
    Fixes CVE-2023-4039.  [bsc#1214052]
  - Add gcc7-aarch64-untyped_call.patch to fix issue with __builtin_apply
  - Add gcc7-lra-elim.patch to fix internal compiler error when forming
    paired loads and stores on aarch64.


author: rguenther@suse.com
changelog:
  - Add gcc7-bsc1216488.patch to avoid creating recursive DIE references
    through DW_AT_abstract_origin when using LTO.  [bsc#1216488]


author: rguenther@suse.com
changelog:
  - Add gcc7-pr88345-min-func-alignment.diff to add support for
    - fmin-function-alignment.  [bsc#1214934]


author: lnussel@suse.de
changelog:
  - cryptsetup 2.5.0:
    * Split manual pages into per-action pages and use AsciiDoc format.
    * Remove cryptsetup-reencrypt tool from the project and move reencryption
      to already existing "cryptsetup reencrypt" command.
      If you need to emulate the old cryptsetup-reencrypt binary, use simple
      wrappers script running "exec cryptsetup reencrypt $@".
    * LUKS2: implement --decryption option that allows LUKS removal.
    * Fix decryption operation with --active-name option and restrict
      it to be used only with LUKS2.
    * Do not refresh reencryption digest when not needed.
      This should speed up the reencryption resume process.
    * Store proper resilience data in LUKS2 reencrypt initialization.
      Resuming reencryption now does not require specification of resilience
      type parameters if these are the same as during initialization.
    * Properly wipe the unused area after reencryption with datashift in
      the forward direction.
    * Check datashift value against larger sector size.
      For example, it could cause an issue if misaligned 4K sector appears
      during decryption.
    * Do not allow sector size increase reencryption in offline mode.
    * Do not allow dangerous sector size change during reencryption.
    * Ask the user for confirmation before resuming reencryption.
    * Do not resume reencryption with conflicting parameters.
    * Add --force-offline-reencrypt option.
    * Do not allow nested encryption in LUKS reencrypt.
    * Support all options allowed with luksFormat with encrypt action.
    * Add resize action to integritysetup.
    * Remove obsolete dracut plugin reencryption example.
    * Fix possible keyslot area size overflow during conversion to LUKS2.
    * Allow use of --header option for cryptsetup close.
    * Fix activation of LUKS2 device with integrity and detached header.
    * Add ZEROOUT IOCTL support for crypt_wipe API call.
    * VERITY: set loopback sector size according to dm-verity block sizes.
    * veritysetup: dump device sizes.
    * LUKS2 token: prefer token PIN query before passphrase in some cases.
      When a user provides --token-type or specific --token-id, a token PIN
      query is preferred to a passphrase query.
    * LUKS2 token: allow tokens to be replaced with --token-replace option
      for cryptsetup token command.
    * LUKS2 token: do not continue operation when interrupted in PIN prompt.
    * Add --progress-json parameter to utilities.
    * Add support for --key-slot option in luksResume action.
  - move man pages to separate subpackage
  - drop backports handling


author: luca.boccassi@gmail.com
changelog:
  - Add virtual provides for 'integritysetup' and 'veritysetup' to match
    package names provided by Fedora/RHEL, to allow the same set of
    dependencies to be used across all RPM distributions.


author: info@paolostivanin.com
changelog:
  - cryptsetup 2.6.0:
    * Introduce support for handling macOS FileVault2 devices (FVAULT2).
    * libcryptsetup: no longer use global memory locking through mlockall()
    * libcryptsetup: process priority is increased only for key derivation
      (PBKDF) calls.
    * Add new LUKS keyslot context handling functions and API.
    * The volume key may now be extracted using a passphrase, keyfile, or
      token. For LUKS devices, it also returns the volume key after
      a successful crypt_format call.
    * Fix --disable-luks2-reencryption configuration option.
    * cryptsetup: Print a better error message and warning if the format
      produces an image without space available for data.
    * Print error if anti-forensic LUKS2 hash setting is not available.
      If the specified hash was not available, activation quietly failed.
    * Fix internal crypt segment compare routine if the user
      specified cipher in kernel format (capi: prefix).
    * cryptsetup: Add token unassign action.
      This action allows removing token binding on specific keyslot.
    * veritysetup: add support for --use-tasklets option.
      This option sets try_verify_in_tasklet kernel dm-verity option
      (available since Linux kernel 6.0) to allow some performance
      improvement on specific systems.
    * Provide pkgconfig Require.private settings.
      While we do not completely provide static build on udev systems,
      it helps produce statically linked binaries in certain situations.
    * Always update automake library files if autogen.sh is run.
      For several releases, we distributed older automake scripts by mistake.
    * reencryption: Fix user defined moved segment size in LUKS2 decryption.
      The --hotzone-size argument was ignored in cases where the actual data
      size was less than the original LUKS2 data offset.
    * Delegate FIPS mode detection to configured crypto backend.
      System FIPS mode check no longer depends on /etc/system-fips file.
    * Update documentation, including FAQ and man pages.


author: andreas.stieger@gmx.de
changelog:
  - cryptsetup 2.6.1
    * bitlk: Fixes for BitLocker-compatible on-disk metadata parser
    * Fix possible iteration overflow in OpenSSL2 PBKDF2 crypto
      backend
    * portability and compilation fixes
    * verity: Fix possible hash offset setting overflow.
    * bitlk: Fix use of startup BEK key on big-endian platforms.
    * Do not initiate encryption (reencryption command) when the
      header and data devices are the same. If data device reduction
      is not requsted, this leads to data corruption since LUKS
      metadata was written over the data device.
    * Fix possible memory leak if crypt_load() fails.
    * Always use passphrases with a minimal 8 chars length for
      benchmarking, as used in some implementation of FIPS mode


author: pmonreal@suse.com
changelog:
  - FIPS: Remove not needed libcryptsetup12-hmac package that contains
    the HMAC checksums for integrity checking for FIPS. [bsc#1185116]
    * Remove the cryptsetup-rpmlintrc file.
    * Remove not needed fipscheck dependency.


author: pmonreal@suse.com
changelog:
  - Enable running the regression test suite.
  - Force a regeneration of the man pages from AsciiDoc.
  - Add LUKS1 and LUKS2 On-Disk Format Specification pdfs to doc.


author: pmonreal@suse.com
changelog:
  - luksFormat: Handle system with low memory and no swap space [bsc#1211079]
    * Check for physical memory available also in PBKDF benchmark.
    * Try to avoid OOM killer on low-memory systems without swap.
    * Use only half of detected free memory on systems without swap.
    * Add patches:
    - cryptsetup-Check-for-physical-memory-available-also-in-PBKDF-be.patch
    - cryptsetup-Try-to-avoid-OOM-killer-on-low-memory-systems-withou.patch
    - cryptsetup-Use-only-half-of-detected-free-memory-on-systems-wit.patch


author: pmonreal@suse.com
changelog:
  - Update to 2.7.0:
    * Full changelog in:
      mirrors.edge.kernel.org/pub/linux/utils/cryptsetup/v2.7/v2.7.0-ReleaseNotes
    * Introduce support for hardware OPAL disk encryption.
    * plain mode: Set default cipher to aes-xts-plain64 and password hashing
      to sha256.
    * Allow activation (open), luksResume, and luksAddKey to use the volume
      key stored in a keyring.
    * Allow to store volume key to a user-specified keyring in open and
      luksResume commands.
    * Do not flush IO operations if resize grows the device.
      This can help performance in specific cases where the encrypted device
      is extended automatically while running many IO operations.
    * Use only half of detected free memory for Argon2 PBKDF on systems
      without swap (for LUKS2 new keyslot or format operations).
    * Add the possibility to specify a directory for external LUKS2 token
      handlers (plugins).
    * Do not allow reencryption/decryption on LUKS2 devices with
      authenticated encryption or hardware (OPAL) encryption.
    * Do not fail LUKS format if the operation was interrupted on subsequent
      device wipe.
    * Fix the LUKS2 keyslot option to be used while activating the device
      by a token.
    * Properly report if the dm-verity device cannot be activated due to
      the inability to verify the signed root hash (ENOKEY).
    * Fix to check passphrase for selected keyslot only when adding
      new keyslot.
    * Fix to not wipe the keyslot area before in-place overwrite.
    * bitlk: Fix segfaults when attempting to verify the volume key.
    * Add --disable-blkid command line option to avoid blkid device check.
    * Add support for the meson build system.
    * Fix wipe operation that overwrites the whole device if used for LUKS2
      header with no keyslot area.
    * Fix luksErase to work with detached LUKS header.
    * Disallow the use of internal kernel crypto driver names in "capi"
      specification.
    * Fix reencryption to fail early for unknown cipher.
    * tcrypt: Support new Blake2 hash for VeraCrypt.
    * tcrypt: use hash values as substring for limiting KDF check.
    * Add Aria cipher support and block size info.
    * Do not decrease PBKDF parameters if the user forces them.
    * Support OpenSSL 3.2 Argon2 implementation.
    * Add support for Argon2 from libgcrypt
      (requires yet unreleased gcrypt 1.11).
    * Used Argon2 PBKDF implementation is now reported in debug mode
      in the cryptographic backend version. For native support in
      OpenSSL 3.2 or libgcrypt 1.11, "argon2" is displayed.
      If libargon2 is used, "cryptsetup libargon2" (for embedded
      library) or "external libargon2" is displayed.
    * Link only libcrypto from OpenSSL.
    * Disable reencryption for Direct-Access (DAX) devices.
    * Print a warning message if the device is not aligned to sector size.
    * Fix sector size and integrity fields display for non-LUKS2 crypt
      devices for the status command.
    * Fix suspend for LUKS2 with authenticated encryption (also suspend
      dm-integrity device underneath).
    * Update keyring and locking documentation and LUKS2 specification
      for OPAL2 support.
    * Remove patches fixed upstream:
    - cryptsetup-Check-for-physical-memory-available-also-in-PBKDF-be.patch
    - cryptsetup-Try-to-avoid-OOM-killer-on-low-memory-systems-withou.patch
    - cryptsetup-Use-only-half-of-detected-free-memory-on-systems-wit.patch


author: meissner@suse.com
changelog:
  - cryptsetup-fips140-3.patch: extend the password for PBKDF2 benchmarking
    to be more than 20 chars to meet FIPS 140-3 requirements (bsc#1229975)


author: heming.zhao@suse.com
changelog:
  - multipath_component_detection = 0 in lvm.conf does not have any effect (bsc#1212613)
    - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch


author: heming.zhao@suse.com
changelog:
  - blkdeactivate calls wrong mountpoint cmd (bsc#1214071)
    + bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch


author: glass.su@suse.com
changelog:
  - Update lvm2 from LVM2.2.03.16 to LVM2.2.03.22 (jsc#PED-6339)
    * 2.03.22:
    * Fix pv_major/pv_minor report field types so they are integers, not strings.
    * Add lvmdevices --delnotfound to delete entries for missing devices.
    * Always use cachepool name for metadata backup LV for lvconvert --repair.
    * Make metadata backup LVs read-only after pool's lvconvert --repair.
    * Handle 'lvextend --usepolicies' for pools for all activation variants.
    * Fix memleak in vgchange autoactivation setup.
    * Support conversion from thick to fully provisioned thin LV.
    * Cache/Thin-pool can use error and zero volumes for testing.
    * Individual thin volume can be cached, but cannot take snapshot.
    * internal support for handling error and zero target (for testing).
    * COW above trimmed maximal size is does not return error.
    * Add lvm.conf thin_restore and cache_restore settings.
    * Handle multiple mounts while resizing volume with a FS.
    * Handle leading/trailing spaces in sys_wwid and sys_serial used by deivce_id.
    * Fix failing -S|--select for non-reporting cmds if using LV info/status fields.
    * Allow snapshots of raid+integrity LV.
    * Fix multisegment RAID1 allocator to prevent using single disk for more legs.
    * 2.03.21:
    * Allow (write)cache over raid+integrity LV.
    * 2.03.20:
    * Fix segfault if using -S|--select with log/report_command_log=1 setting.
    * 2.03.19:
    * Do not reset SYSTEMD_READY variable in udev for PVs on MD and loop devices.
    * Ensure udev is processing origin LV before its thick snapshots LVs.
    * 2.03.18:
    * Fix warning for thin pool overprovisioning on lvextend.
    * Add support for writecache metadata_only and pause_writeback settings.
    * Fix missing error messages in lvmdbusd.
    * 2.03.17:
    * Add new options (--fs, --fsmode) for FS handling when resizing LVs (btrfs is unsupported).
    * Fix 'lvremove -S|--select LV' to not also remove its historical LV right away.
    * Fix lv_active field type to binary so --select and --binary applies properly.
    * Error out in lvm shell if using a cmd argument not supported in the shell.
    * Fix lvm shell's lastlog command to report previous pre-command failures.
    * Add --valuesonly option to lvmconfig to print only values without keys.
    * Add json_std output format for more JSON standard compliant version of output.
    * Fix many corner cases in device_id, including handling of S/N duplicates.
    * Fix various issues in lvmdbusd.
  - device-mapper version upgrade to 1.02.196
    * Improve parallel creation of /dev/mapper/control device node.
    * Import previous ID_FS_* udev records in 13-dm-disk.rules for suspended DM dev.
    * Remove NAME="mapper/control" rule from 10-dm.rules to avoid udev warnings.
    * Improve 'dmsetup create' without given table line with new kernels.
    * Add DM_REPORT_GROUP_JSON_STD for more JSON standard compliant output format.
  - Drop patches that have been merged into upstream
    - 0001-devices-file-move-clean-up-after-command-is-run.patch
    - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch
    - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch
    - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch
    - 0005-pvdisplay-restore-reportformat-option.patch
    - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch
    - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch
    - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch
    - 0009-mm-remove-libaio-from-being-skipped.patch
    - 0010-dmsetup-check-also-for-ouf-of-range-value.patch
    - 0011-devices-drop-double-from-sysfs-path.patch
    - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch
    - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch
    - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch
    - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch
    - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch
  - Add upstream patch
    + 0001-lvconvert-swapmetadata-fix-lvmlockd-locking.patch
    + 0002-lvconvert-fix-ret-values-fro-integrity-remove.patch
    + 0003-lvconvert-fix-regresion-from-integrity-check.patch
    + 0004-gcc-cleanup-warnings.patch
    + 0005-lvmlockd-fix-thick-to-thin-lv-conversion.patch
    + 0006-lvmlockd-let-lockd_init_lv_args-set-lock_args.patch
    + 0007-lvmlockd-fix-lvconvert-to-thin-pool.patch
    + 0008-lvconvert-run-error-path-code-only-for-shared-VG.patch
    + 0009-vgchange-acquire-an-exclusive-VG-lock-for-refresh.patch
    + 0010-lvmlockd-client-mutex-ordering.patch
    + 0011-filesystem-move-stat-after-open-check.patch
    + 0012-tests-check-for-writecache.patch
    + 0013-lvresize-fix-32-bit-overflow-in-size-calculation.patch
    + 0014-gcc-fix-warnings-for-x32-architecture.patch
    + 0015-gcc-warning-missing-braces-around-initializer.patch
    + 0016-test-improve-aux-teardown.patch
    + 0017-tests-aux-try-with-extra-sleep.patch
    + 0018-tests-aux-using-singl-lvmconf-call.patch
    + 0019-tests-missing-to-check-for-writecache-support.patch
    + 0020-tests-pvmove-large-disk-area.patch
    + 0021-tests-enforce-full-fs-check.patch
    + 0022-tests-update-for-work-in-fake-dev-environment.patch
    + 0023-tests-skip-test-when-lvmdbusd-runs-on-the-system.patch
    + 0024-tests-better-slowdown.patch
  - Update patch
    - bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch
    - bug-1184124-link-tests-as-PIE.patch
    - bug-1184687_Add-nolvm-for-kernel-cmdline.patch
    - fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch
  - Rename & Update patch
    - bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch
    + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-rules.patch
  - update lvm2.spec
    - change upstream_device_mapper_version to 1.02.196
    - change device_mapper_version to %{lvm2_version}_1.02.196
    - add config item "-with-libexecdir=%{_libexecdir}" to fix libexec path since commit a2d33cdf
    - add new binary "%{_libexecdir}/lvresize_fs_helper" to lvm2 package


author: heming.zhao@suse.com
changelog:
  - Update lvm2 from LVM2.2.03.22 to LVM2.2.03.24
    * ** WHATS_NEW from 2.03.22 to 2.03.24 ***
    Version 2.03.24 - 16th May 2024
    ===============================
      Lvconvert supports VDO options for thin-pool with vdo conversion.
      Improve placement to .data.rel.ro and .rodata sections.
      Fix support for -y and -W when creating thinpool with vdo.
      Bettter support for runtime valgrind detection.
      Allow command interruption when communicating with dmeventd.
      Fix resize of VDO volume used for thin pool data volume.
      Use -Wl,-z,now and -Wl,--as-needed for compilation by default.
      Require 3.7 as minimal version for sanlock.
      Share code for closing opened desriptors on program startup.
      Fix memleak in lvmcache.
      Add configure --with-default-event-activation=ON setting.
      Fix return value from reporter function when hitting internal error.
      Skip checking of pools for lvremove and vgremove commands.
      VDO modprobes dm-vdo for 6.9 kernel and kvdo for older kernel version.
      Fix lvs reporting for VDO volumes with new upstream kernel driver.
      Don't import DM_UDEV_DISABLE_OTHER_RULES_FLAG in LVM rules, DM rules cover it.
      Fix table line generation for cache snapshots using cachevol.
      Enhance lvconvert support for external origins stacking.
      When swapping LV names also swap properties like hostname, time and data.
      Fix removal of stacked external origins.
      Lock filesystem when converting volume to read-only external origin.
      Support external origin between different thin-pool.
      Improve validation of acceptable volumes for external origins.
      Reduce amount of preloaded devices for complex device trees.
      Avoid logging problems from monitoring snapshots with inactive origins.
      Check for cache policy module presence in kernel's builtin modules file.
      Add configure --with-modulesdir to select kernel modules directory.
      Support creation of thin-pool with VDO use for its data volume.
    Version 2.03.23 - 21st November 2023
    ====================================
      Set the first lv_attr flag for raid integrity images to i or I.
      Add -A option for pvs and pvscan to show PVs outside devices file.
      Improve searched_devnames temp file usage to prevent redundant scanning.
      Change default search_for_devnames from auto to all.
      Add lvmdevices --refresh to search for missing PVIDs on all devices.
      Add comparison between old and new entries in lvmdevices --check.
      Fix device_id matching order - match non-devname first.
      Fix "lvconvert -m 0" when there is other than first in-sync leg.
      Use system.devices as default for dmeventd when dmeventd.devices is undefined.
      Accept WWIDs containing QEMU HARDDISK for device_id.
      Improve handling of non-standard WWID prefixes used for device_id.
      Configure automatically enables cmdlib for dmeventd and notify-dbus for dbus.
      Fix hint calculation for pools with zero or error segment.
      Configure supports --disable-shared to build only static binaries.
      Configure supports --without-{blkid|systemd|udev} for easier static build.
      Refresh device ids if the system changes.
      Fix pvmove when specifying raid components as moved LVs.
      Enhance error detection for lvm_import_vdo.
      Support PV lists with thin lvconvert.
      Fix support for lvm_import_vdo with SCSI VDO volumes.
      Fix locking issue leading to hanging concurrent vgchange --refresh.
      Recognize lvm.conf report/headings=2 for full column names in report headings.
      Add --headings none|abbrev|full cmd line option to set report headings type.
      Fix conversion to thin pool using lvmlockd.
      Fix conversion from thick into thin volume using lvmlockd.
      Require writable LV for conversion to vdo pool.
      Fix return value from lvconvert integrity remove.
      Preserve UUID for pool metadata spare.
      Preserve UUID for swapped pool metadata.
      Rewrite validation of device name entries used as device_id.
    * ** WHATS_NEW_DM from 1.02.196 to 1.02.198 ***
    Version 1.02.198 - 16th May 2024
    ================================
      Fix static only compilation of libdevmapper.a and dmsetup tool.
      Use better code for closing opened descriptors when starting dmeventd.
      Correct dmeventd -R for systemd environment.
      Restart of dmeventd -R checks pid file to detect running dmeventd first.
      Query with dmeventd -i quickly ends when there is no running dmeventd.
      Enhance dm_get_status_raid to handle mismatching status or reported legs.
      Create /dev/disk/by-label symlinks for DM devs that have crypto as next layer.
      Persist udev db for DM devs on cleanup used in initrd to rootfs transition.
      Process synthetic udev events other than 'add/change' as 'change' events.
      Increase DM_UDEV_RULES_VSN to 3 to indicate changed udev rules.
      Rename DM_NOSCAN to .DM_NOSCAN so it's not stored in udev db.
      Rename DM_SUSPENDED to .DM_SUSPENDED so it's not stored in udev db.
      Do not import DM_UDEV_DISABLE_OTHER_RULES_FLAG from db in 10-dm-disk.rules.
      Test DISK_RO after importing properties from db in 10-dm.rules.
      Also import ID_FS_TYPE in 13-dm-disk.rules from db if needed.
    Version 1.02.197 - 21st November 2023
    =====================================
      Fix invalid JSON report if using DM_REPORT_OUTPUT_MULTIPLE_TIMES and selection.
      Propagate ioctl errno from dm_task_run when creating new table line.
      Add support for group aliases in dmstats.
      Add support for exit-on file for dmeventd to reduce shutdown delays.
      Add configure option --with-dmeventd-exit-on-path to specify default path.
      Add dmsetup --headings none|abbrev|full to set report headings type.
      Add DM_REPORT_OUTPUT_FIELD_IDS_IN_HEADINGS to provide alternative headings.
  - Drop patches that have been merged into upstream
    - 0001-lvconvert-swapmetadata-fix-lvmlockd-locking.patch
    - 0002-lvconvert-fix-ret-values-fro-integrity-remove.patch
    - 0003-lvconvert-fix-regresion-from-integrity-check.patch
    - 0004-gcc-cleanup-warnings.patch
    - 0005-lvmlockd-fix-thick-to-thin-lv-conversion.patch
    - 0006-lvmlockd-let-lockd_init_lv_args-set-lock_args.patch
    - 0007-lvmlockd-fix-lvconvert-to-thin-pool.patch
    - 0008-lvconvert-run-error-path-code-only-for-shared-VG.patch
    - 0009-vgchange-acquire-an-exclusive-VG-lock-for-refresh.patch
    - 0010-lvmlockd-client-mutex-ordering.patch
    - 0011-filesystem-move-stat-after-open-check.patch
    - 0012-tests-check-for-writecache.patch
    - 0013-lvresize-fix-32-bit-overflow-in-size-calculation.patch
    - 0014-gcc-fix-warnings-for-x32-architecture.patch
    - 0015-gcc-warning-missing-braces-around-initializer.patch
    - 0016-test-improve-aux-teardown.patch
    - 0017-tests-aux-try-with-extra-sleep.patch
    - 0018-tests-aux-using-singl-lvmconf-call.patch
    - 0019-tests-missing-to-check-for-writecache-support.patch
    - 0020-tests-pvmove-large-disk-area.patch
    - 0021-tests-enforce-full-fs-check.patch
    - 0022-tests-update-for-work-in-fake-dev-environment.patch
    - 0023-tests-skip-test-when-lvmdbusd-runs-on-the-system.patch
    - 0024-tests-better-slowdown.patch
  - Update patch
    - bug-1184687_Add-nolvm-for-kernel-cmdline.patch


author: glass.su@suse.com
changelog:
  - add rpm dependency in spec file for aligning new DM udev rules (bsc#1225783 bsc#1229518 bsc#1232063)
    * update lvm2.spec for multipath-tools and udev


author: heming.zhao@suse.com
changelog:
  - system with LVM on iSCSI hangs on shutdown because blk-availability.service is not enabled (bsc#1236788)
    * update lvm2.spec
    - remove blk-availability.service from %postun
    - add new Provides 'dont_stop_blk_availability_service'


author: heming.zhao@suse.com
changelog:
  - Fixes the lvm2-testsuite failure to run on SUSE kernel (bsc#1238213)
    * Add upstream patch
      + tests-fix-wrong-pos-with-CONFIG_PRINTK_CALLER.patch


author: heming.zhao@suse.com
changelog:
  - Fixes the lvm2-testsuite case fsadm-btrfs.sh (bsc#1238857)
    * Update SUSE special patch
      + fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch


author: heming.zhao@suse.com
changelog:
  - LVM filter behaves unexpectedly for MPIO devices in SLES15SP5 (bsc#1216938)
    * set lvm.conf devices.multipath_wwids_file=""


author: glass.su@suse.com
changelog:
  - L3: systemd fails to start lvmlockd with sanlock running (bsc#1246691)
    * Add upstream patches for sd_notify configure option
      + bug-1246691_01-configure.ac-build-lvmlockd-with-notify.patch
      + bug-1246691_02-configure-autoreconf.patch
      + bug-1246691_03-configure.ac-add-option-disable-enable-sd-notify.patch
      + bug-1246691_04-lvmlockd-utilize-SD_NOTIFY_SUPPORT.patch
      + bug-1246691_05-configure-autoreconf.patch
    * Update lvm2.spec
      + add pkgconfig(systemd) for lvmlockd build
      + enable configure option '--enable-sd-notify' for lvmlockd


author: andreas.stieger@gmx.de
changelog:
  - update to 2.6.1:
    * Expose billion laughs API with XML_DTD defined and XML_GE
      undefined, regression from 2.6.0
    * Make tests independent of CPU speed, and thus more robust
  - drop libxml2-fix-xmlwf.1-handling.patch, upstream


author: andreas.stieger@gmx.de
changelog:
  - update to 2.6.2:
    * CVE-2024-28757 -- Prevent billion laughs attacks with isolated
      use of external parsers (boo#1221289)
    * Reject direct parameter entity recursion and avoid the related
      undefined behavior


author: david.anes@suse.com
changelog:
  - Update to 2.6.3:
    * Security fixes:
    - CVE-2024-45490, bsc#1229930 -- Calling function XML_ParseBuffer with
      len < 0 without noticing and then calling XML_GetBuffer
      will have XML_ParseBuffer fail to recognize the problem
      and XML_GetBuffer corrupt memory.
      With the fix, XML_ParseBuffer now complains with error
      XML_ERROR_INVALID_ARGUMENT just like sibling XML_Parse
      has been doing since Expat 2.2.1, and now documented.
      Impact is denial of service to potentially artitrary code
      execution.
    - CVE-2024-45491, bsc#1229931 -- Internal function dtdCopy can have an
      integer overflow for nDefaultAtts on 32-bit platforms
      (where UINT_MAX equals SIZE_MAX).
      Impact is denial of service to potentially artitrary code
      execution.
    - CVE-2024-45492, bsc#1229932 -- Internal function nextScaffoldPart can
      have an integer overflow for m_groupSize on 32-bit
      platforms (where UINT_MAX equals SIZE_MAX).
      Impact is denial of service to potentially artitrary code
      execution.
    * Other changes:
    - Autotools: Sync CMake templates with CMake 3.28
    - Autotools: Always provide path to find(1) for portability
    - Autotools: Ensure that the m4 directory always exists.
    - Autotools: Simplify handling of SIZEOF_VOID_P
    - Autotools: Support non-GNU sed
    - Autotools|CMake: Fix main() to main(void)
    - Autotools|CMake: Fix compile tests for HAVE_SYSCALL_GETRANDOM
    - Autotools|CMake: Stop requiring dos2unix
    - CMake: Fix check for symbols size_t and off_t
    - docs|tests: Convert README to Markdown and update
    - Windows: Drop support for Visual Studio <=15.0/2017
    - Drop needless XML_DTD guards around is_param access
    - Fix typo in a code comment
    - Version info bumped from 10:2:9 (libexpat*.so.1.9.2)
      to 10:3:9 (libexpat*.so.1.9.3); see https://verbump.de/
      for what these numbers do


author: pgajdos@suse.com
changelog:
  - version update to 2.6.4
    * Security fixes: [bsc#1232601][bsc#1232579]
      [#915]  CVE-2024-50602 -- Fix crash within function XML_ResumeParser
      from a NULL pointer dereference by disallowing function
      XML_StopParser to (stop or) suspend an unstarted parser.
      A new error code XML_ERROR_NOT_STARTED was introduced to
      properly communicate this situation.  // CWE-476 CWE-754
    * Other changes:
      [#903]  CMake: Add alias target "expat::expat"
      [#905]  docs: Document use via CMake >=3.18 with FetchContent
      and SOURCE_SUBDIR and its consequences
      [#902]  tests: Reduce use of global parser instance
      [#904]  tests: Resolve duplicate handler
    [#317] #918  tests: Improve tests on doctype closing (ex CVE-2019-15903)
      [#914]  Fix signedness of format strings
    [#919] #920  Version info bumped from 10:3:9 (libexpat*.so.1.9.3)
      to 11:0:10 (libexpat*.so.1.10.0); see https://verbump.de/
      for what these numbers do


author: pgajdos@suse.com
changelog:
  - version update to 2.7.0 (CVE-2024-8176 [bsc#1239618])
    * Security fixes:
      [#893] #973  CVE-2024-8176 -- Fix crash from chaining a large number
      of entities caused by stack overflow by resolving use of
      recursion, for all three uses of entities:
    - general entities in character data ("<e>&g1;</e>")
    - general entities in attribute values ("<e k1='&g1;'/>")
    - parameter entities ("%p1;")
      Known impact is (reliable and easy) denial of service:
      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C
      (Base Score: 7.5, Temporal Score: 7.2)
      Please note that a layer of compression around XML can
      significantly reduce the minimum attack payload size.
    * Other changes:
      [#935] #937  Autotools: Make generated CMake files look for
      libexpat.@SO_MAJOR@.dylib on macOS
      [#925]  Autotools: Sync CMake templates with CMake 3.29
    [#945] #962 #966  CMake: Drop support for CMake <3.13
      [#942]  CMake: Small fuzzing related improvements
      [#921]  docs: Add missing documentation of error code
      XML_ERROR_NOT_STARTED that was introduced with 2.6.4
      [#941]  docs: Document need for C++11 compiler for use from C++
      [#959]  tests/benchmark: Fix a (harmless) TOCTTOU
      [#944]  Windows: Fix installer target location of file xmlwf.xml
      for CMake
      [#953]  Windows: Address warning -Wunknown-warning-option
      about -Wno-pedantic-ms-format from LLVM MinGW
      [#971]  Address Cppcheck warnings
      [#969] #970  Mass-migrate links from http:// to https://
      [#947] #958 ..
      [#974] #975  Document changes since the previous release
      [#974] #975  Version info bumped from 11:0:10 (libexpat*.so.1.10.0)
      to 11:1:10 (libexpat*.so.1.10.1); see https://verbump.de/
      for what these numbers do


author: pgajdos@suse.com
changelog:
  - version update to 2.7.1
      Bug fixes:
      [#980] #989  Restore event pointer behavior from Expat 2.6.4
      (that the fix to CVE-2024-8176 changed in 2.7.0);
      affected API functions are:
    - XML_GetCurrentByteCount
    - XML_GetCurrentByteIndex
    - XML_GetCurrentColumnNumber
    - XML_GetCurrentLineNumber
    - XML_GetInputContext
      Other changes:
      [#976] #977  Autotools: Integrate files "fuzz/xml_lpm_fuzzer.{cpp,proto}"
      with Automake that were missing from 2.7.0 release tarballs
      [#983] #984  Fix printf format specifiers for 32bit Emscripten
      [#992]  docs: Promote OpenSSF Best Practices self-certification
      [#978]  tests/benchmark: Resolve mistaken double close
      [#986]  Address compiler warnings
      [#990] #993  Version info bumped from 11:1:10 (libexpat*.so.1.10.1)
      to 11:2:10 (libexpat*.so.1.10.2); see https://verbump.de/
      for what these numbers do
      Infrastructure:
      [#982]  CI: Start running Perl XML::Parser integration tests
      [#987]  CI: Enforce Clang Static Analyzer clean code
      [#991]  CI: Re-enable warning clang-analyzer-valist.Uninitialized
      for clang-tidy
      [#981]  CI: Cover compilation with musl
      [#983] #984  CI: Cover compilation with 32bit Emscripten
      [#976] #977  CI: Protect against fuzzer files missing from future
      release archives


author: jengelh@inai.de
changelog:
  - Update to new upstream release 1.8.2
    * Fix incorrect handling of various targets and options in
      iptables-nft,ebtables-nft,arptables-nft.


author: kstreitova@suse.com
changelog:
  - Add iptables-1.8.2-dont_read_garbage.patch that fixes a situation
    where 'iptables -L' reads garbage from the struct as the kernel
    never filled it in the bugged case. This can lead to issues like
    mapping a few TiB of memory [bsc#1106751].


author: jengelh@inai.de
changelog:
  - Add 0001-include-fix-build-with-kernel-headers-before-4.2.patch,
    0001-include-extend-the-headers-conflict-workaround-to-in.patch
    to fix build with older linux-glibc-devel. [boo#1132821]


author: jengelh@inai.de
changelog:
  - Update to new upstream release 1.8.3
    * ebtables: Fix rule listing with counters
    * ebtables-nft: Support user-defined chain policies
  - Remove 0001-include-extend-the-headers-conflict-workaround-to-in.patch
    0001-include-fix-build-with-kernel-headers-before-4.2.patch
    (upstreamed)


author: kstreitova@suse.com
changelog:
  - Add Conflicts with iptables-nft = 1.6.2 as during the update to
    iptables 1.8 ip6tables-restore-translate, ip6tables-translate,
    iptables-restore-translate and iptables-translate were moved from
    iptables-nft subpackage (now iptables-backend-nft) to the main
    package. So we need to add a conflict here otherwise we hit file
    conflicts error during the update.


author: jengelh@inai.de
changelog:
  - Update to release 1.8.4
    * Fix for wrong counter format in `ebtables-nft-save -c` output.
    * Print typical iptables-save comments in arptables- and
      ebtables-save, too.
    * xt_owner: add --suppl-groups option
    * Remove support for /etc/xtables.conf
    * Restore support for "-4" and "-6" options in rule lines.


author: jengelh@inai.de
changelog:
  - Update to release 1.8.5
    * IDLETIMER: Add alarm timer option
    * nft: CT: add translation for NOTRACK
  - Drop iptables-apply-mktemp-fix.patch (seemingly applied)


author: jengelh@inai.de
changelog:
  - Update to release 1.8.6
    * iptables-nft had pointlessly added "bitwise" expressions to
      each IP address match, needlessly slowing down run-time
      performance (by 50% in worst cases).
    * iptables-nft-restore: Support basechain policy value of "-"
      (indicating to not change the chain's policy).
    * nft-translte: Fix translation of ICMP type "any" match.


author: jengelh@inai.de
changelog:
  - Update to release 1.8.7
    * iptables-nft:
    * Improved performance when matching on IP/MAC address prefixes
      if the prefix is byte-aligned. In ideal cases, this doubles
      packet processing performance.
    * Dump user-defined chains in lexical order. This way ruleset
      dumps become stable and easily comparable.
    * Avoid pointless table/chain creation. For instance,
      `iptables-nft -L` no longer creates missing base-chains.


author: rpm@fthiessen.de
changelog:
  - Update to upstream release 0.12.1
  - Removed upstream fixed json-c-0.12-unused_variable_size.patch
  - Added fix-set-but-not-used.patch


author: avindra@opensuse.org
changelog:
  - json-c 0.13
    + Deprecated and removed features:
    * Internal use of bits.h has been eliminated.
    * lh_abort() is deprecated
    + Behavior changes:
    * Tighten the number parsing algorithm to raise errors instead
      of truncating the results.  For example 12.3.4 or 2015-01-15,
      which now return null.
    * Use size_t for array length and size. Platforms where
      sizeof(size_t) != sizeof(int) may not be backwards compatible
    * Check for failue when allocating memory, returning NULL and
      errno=ENOMEM.
    * Change json_object_object_add() return type from void to int,
      and will return -1 on failures, instead of exiting. (Note:
      this is not an ABI change)
    + New features:
    * Aiming to follow RFC 7159 now.
    * Support for JSON pointer, RFC 6901 (see json_pointer.h)
    * Add a couple of additional option to json_object_to_json_string_ext:
    JSON_C_TO_STRING_PRETTY_TAB
    JSON_C_TO_STRING_NOSLASHESCAPE
    * json_object_object_add_ex() - better perf when certain
      constraints are known to be true
    * Serialization format of doubles now configurable
    * New functions
    - json_object_equal() - utility function for comparing
      json_objects
    - json_object_deep_copy() - a way to copy entire object
      trees
    - json_object_set_<type>() - modify the value of
      existing json_object's without the need to recreate them.
    Also add a json_object_int_inc function to adjust an int's'
    value.
    - json_util_get_last_err() - retrieve the string describing
      the cause of errors, instead of printing to stderr.
    - perllike hash function for strings
    * json_global_set_string_hash()
    * json_c_visit() - a way to iterate over a tree of json-c
      objects.
    + Notable bug fixes and other improvements:
    * Make reference increment and decrement atomic to allow
      passing json objects between threads.
    * Fix json_object_object_foreach to avoid uninitialized
      variable warnings.
    * Improve performance by removing unneeded data items from
      hashtable code and reducing duplicate hash computation.
    * Performance: store small strings inside json_object
    * Performance: of json_object_to_json_string by removing
      variadic printf
    * Fix parsing of "-Infinity", and avoid needlessly copying the
      input when doing so.
    * Fix stack buffer overflow in json_object_double_to_json_string_format()
    * Fix various potential null ptr deref and int32 overflows
    * Fix a long-standing bug in array_list_put_idx() where it
      would attempt to free previously free'd entries due to not
      checking the current array length.
    * use uselocale() instead of setlocale() in json_tokener to
      behave better in threaded environments.
    * Fix out of bounds read when handling unicode surrogate pairs.
    * Ensure doubles that happen to be a whole number are emitted
      with ".0"
    * Visual Studio: use a snprintf/vsnprintf wrapper that ensures
      the string is terminated.
    * Fix double to int cast overflow in json_object_get_int64.
    * Clamp double to int32 when narrowing in json_object_get_int.
    * Use strtoll() to parse ints - instead of sscanf
    * usual code linting
    + Build changes:
    * Add Appveyor and Travis build support
    * Support for MacOS and Windows through CMake
    * Silent build by default
    * Link against libm when needed
    * Add support for building with AddressSanitizer
    * Add support for building with Clang
    * Add a --enable-threading configure option, and only use the
      (slower) __sync_add_and_fetch()/__sync_sub_and_fetch()
      function when it is specified.
  - cleanup with spec-cleaner
  - remove fix-set-but-not-used.patch
    + fixed: https://github.com/json-c/json-c/issues/240
  - remove gcc7-fix.patch
    + fixed in 014924ba899f659917bb64392bbff7d3c803afc2


author: avindra@opensuse.org
changelog:
  - json-c 0.13.1
    * Add const size_t json_c_object_sizeof()
    * Avoid invalid free (and thus a segfault) when ref_count gets < 0
    * Fix handling of custom double formats that include a ".0"
    * Avoid uninitialized variable warnings in json_object_object_foreach
    * Add a top level fuzz directory for fuzzers run by OSS-Fuzz
    * Fix build for certain uClibc based systems.
    * Bump sonum to 4.0 to avoid conflicts because some packagers made
      their own bump to ".so.3" for the older 0.12 release


author: info@paolostivanin.com
changelog:
  - json-c 0.14:
    * bits.h has been removed
    * lh_abort() has been removed
    * lh_table_lookup() has been removed, use lh_table_lookup_ex() instead.
    * Remove TRUE and FALSE defines, use 1 and 0 instead.
    * Switch to cmake
    * Build fixes
    * Doc updates
    * Added a json_tokener_get_parse_end() function to replace
      direct access of tok->char_offset
    * json_tokener_parse_ex() now accepts a new JSON_TOKENER_VALIDATE_UTF8 flag
      to validate that input is UTF8
    * Add support for unsigned 64-bit integers
    * A total of 7 new functions were added:
    * json_object_get_uint64 ( struct json_object const* jso )
    * json_object_new_uint64 ( uint64_t i )
    * json_object_set_uint64 ( struct json_object* jso, uint64_t new_value )
    * json_parse_uint64 ( char const* buf, uint64_t* retval )
    * See description of uint64 support, above.
    * json_tokener_get_parse_end ( struct json_tokener* tok )
    * See details under "json_tokener changes", above.
    * json_object_from_fd_ex ( int fd, int in_depth )
    * Allows the max nesting depth to be specified.
    * json_object_new_null ( )
    * Simply returns NULL.  Its use is not recommended.
    * The size of struct json_object has decreased from 96 bytes to 88 bytes.


author: dcermak@suse.com
changelog:
  - Add upstream fix for boo#1173022
    * Added patch 0001-Detect-broken-RDRAND-during-initialization.patch
    * use URL from the releases page on github
    * run spec-cleaner over the spec file


author: dmueller@suse.com
changelog:
  - update to 0.15:
    * Deprecate `array_list_new()` in favor of `array_list_new2()`
    * Remove the THIS_FUNCTION_IS_DEPRECATED define.
    * Remove config.h.win32
    * Add a `JSON_TOKENER_ALLOW_TRAILING_CHARS` flag to allow multiple objects
      to be parsed even when `JSON_TOKENER_STRICT` is set.
    * Add `json_object_new_array_ext(int)` and `array_list_new_2(int)` to allow
      arrays to be allocated with the exact size needed, when known.
    * Add `json_object_array_shrink()` (and `array_list_shrink()`) and use it in
      json_tokener to minimize the amount of memory used.
    * Add a json_parse binary, for use in testing changes (not installed, but
      available in the apps directory).
    * Split the internal json_object structure into several sub-types, one for
      each json_type (json_object_object, json_object_string, etc...).
      This improves memory usage and speed, with the benchmark under
      bench/ report 5.8% faster test time and 6%(max RSS)-12%(peak heap)
      less memory usage.
      Memory used just for json_object structures decreased 27%, so use cases
      with fewer arrays and/or strings would benefit more.
    * Minimize memory usage in array handling in json_tokener by shrinking
      arrays to the exact number of elements parsed.  On bench/ benchmark:
      9% faster test time, 39%(max RSS)-50%(peak heap) less memory usage.
      Add json_object_array_shrink() and array_list_shrink() functions.
    * #616 - Parsing of surrogate pairs in unicode escapes now properly handles
      incremental parsing.
    * Fix incremental parsing of numbers, especially those with exponents, e.g.
      so parsing "[0", "e+", "-]" now properly returns an error.
      Strict mode now rejects missing exponents ("0e").
    * Successfully return number objects at the top level even when they are
      followed by a "-", "." or "e".  This makes parsing things like "123-45"
      behave consistently with things like "123xyz".
    * #589 - Detect broken RDRAND during initialization; also, fix segfault
      in the CPUID check.
    * #592 - Fix integer overflows to prevert out of bounds write on large input.
      (CVE-2020-12762, bsc#1171479)
    * Protect against division by zero in linkhash, when creaed with zero size.
    * #602 - Fix json_parse_uint64() internal error checking, leaving the retval
      untouched in more failure cases.
    * #614 - Prevent truncation when custom double formatters insert extra \0's
  - remove 0001-Detect-broken-RDRAND-during-initialization.patch (upstream)


author: ncutler@suse.com
changelog:
  - Add patch bsc1171479.patch
    + fix integer overflow and out-of-bounds write (CVE-2020-12762, bsc#1171479)


author: info@paolostivanin.com
changelog:
  - Update to 0.16: (jsc#PED-5061)
    + Deprecated and removed features:
    * JSON_C_OBJECT_KEY_IS_CONSTANT is deprecated in favor of
      JSON_C_OBJECT_ADD_CONSTANT_KEY
    * Direct access to lh_table and lh_entry structure members is deprecated.
      Use access functions instead, lh_table_head(), lh_entry_next(), etc...
    * Drop REFCOUNT_DEBUG code.
    + Changes and bug fixes
    * Cap string length at INT_MAX to avoid various issues with very long strings.
    * json_object_deep_copy: fix deep copy of strings containing '\0'
    * Fix read past end of buffer in the "json_parse" command
    * Avoid out of memory accesses in the locally provided vasprintf() function
      (for those platforms that use it)
    * Handle allocation failure in json_tokener_new_ex
    * Fix use-after-free in json_tokener_new_ex() in the event of printbuf_new() returning NULL
    * printbuf_memset(): set gaps to zero - areas within the print buffer which
      have not been initialized by using printbuf_memset
    * printbuf: return -1 on invalid arguments (len < 0 or total buffer > INT_MAX)
    * sprintbuf(): propagate printbuf_memappend errors back to the caller
    * Validate size arguments in arraylist functions.
    * Use getrandom() if available; with GRND_NONBLOCK to allow use of json-c
      very early during boot, such as part of cryptsetup.
    * Use arc4random() if it's available.
    * random_seed: on error, continue to next method instead of exiting the process
    * Close file when unable to read from /dev/urandom in get_dev_random_seed()
    * Speed up parsing by replacing ctype functions with simplified, faster
      non-locale-sensitive ones in json_tokener and json_object_to_json_string.
    * Neither vertical tab nor formfeed are considered whitespace per the JSON spec
    * json_object: speed up creation of objects, calloc() -> malloc() + set fields
    * Avoid needless extra strlen() call in json_c_shallow_copy_default() and
      json_object_equal() when the object is known to be a json_type_string.
  - remove bsc1171479.patch


author: abergmann@suse.com
changelog:
  - Initial release 0.13.0.
    A library and tools to access the kernel crypto api.
    FATE#323554 bsc#1045948


author: jengelh@inai.de
changelog:
  - Compact descriptions a bit
  - Remove libkcapi provide/requires
  - Use %_libdir throughout and avoid /lib


author: meissner@suse.com
changelog:
  - libkcapi-use-external-fipshmac.patch: use external fipshmac,
    our chroots / vm builds do not necessarily have the right kernel.


author: bwiedemann@suse.com
changelog:
  - Add reproduciblesort.patch to always link .o files in the same order and
  - Add reproducibledate.patch to not add current time to man-pages to fix build-compare


author: pmonreal@suse.com
changelog:
  - FIPS: kcapi-hasher: zeroise temporary values for FIPS 140-3
    * Add libkcapi-zeroize-hasher.patch [bsc#1222768]


author: avindra@opensuse.org
changelog:
  - Update to new upstream release 1.8.1.2
    * Most visible new feature is support for dictionary compression
    * Support is now more formally added on the API side within
      lib/lz4frame_static.h. It's early days, and this new API is
      tagged "experimental" for the time being.
    * Support is also added in the command line utility lz4, using
      the new command -D. The behavior of this command is identical
      to zstd, should you be already familiar.
    * lz4 doesn't specify how to build a dictionary. All it says is
      that it can be any file up to 64 KB.
    * This approach is compatible with zstd dictionary builder, which
      can be instructed to create a 64 KB dictionary.
    * Improved performance at ultra settings (levels 10+).
    * These levels receive a new code, called optimal parser,
      available in lib/lz4_opt.h.
    * New parser uses less memory (from 384KB to 256KB), performs
      faster, compresses a little bit better (not much, as it was
      already close to theoretical limit), and resists pathological
      patterns which could destroy performance.
    * New parser is directly compatible with lower compression levels,
      which brings additional benefits:
      + Compatibility with LZ4_*_destSize() variant, which reverses
      the logic by trying to fit as much data as possible into a
      predefined limited size buffer.
      + Compatibility with Dictionary compression, as it uses the
      same tables as regular HC mode
    * In the future, this compatibility will also allow dynamic change
      of compression level.
    * Small set of bug fixes and improvements:
      + perf : faster and stronger ultra modes (levels 10+)
      + perf : slightly faster compression and decompression speed
      + perf : fix bad degenerative case
      + fix : decompression failed when using a combination of
      extDict + low memory address
      + cli : support for dictionary compression (-D)
      + cli : fix : lz4 -d --rm preserves timestamp
      + cli : fix : do not modify /dev/null permission as root
      + api : _destSize() variant supported for all compression
      levels
  - partial cleanup with spec-cleaner
  - drop lz4-use-shlib.diff, breaks build
  - misc spec cleanups
    - remove Makefile fix
    - build and install separately
    - New URL


author: astieger@suse.com
changelog:
  - lz4 1.8.2:
    * speed inprovemtns for compression and decompression
    * fix compression compatible with low memory addresses
    * fix decompression segfault when provided with NULL input
    * cli: new command --favor-decSpeed
    * cli: benchmark mode more accurate for small inputs


author: astieger@suse.com
changelog:
  - lz4 1.8.3:
    * minor decompression speed improvement (~+2%) with gcc
    * fix corruption in v1.8.2 at level 9 for files > 64KB under
      rare conditions
    * Add new command --fast
    * api: LZ4_decompress_safe_partial() now decodes exactly the
      number of bytes requested


author: jengelh@inai.de
changelog:
  - Update to new upstream release 1.9.1
    * Decompression speed was improved by about 12% (x86/x64).
    * New option `lz4 --list` to inspect the block type, checksum
      information, compressed and decompressed sizes (if present). The
      command is limited to single-frame files for the time being.


author: pgajdos@suse.com
changelog:
  - version update to 1.9.2
    * decompression functions were reading a few bytes beyond input size
    * api: lz4frame initializers compatibility with c++, reported by @degski
    * cli : added command --list, based on a patch by @gabrielstedman
    * fixes CVE-2019-17543 [bsc#1153936]


author: jengelh@inai.de
changelog:
  - Update to release 1.9.3
    * api: LZ4_decompress_safe_partial() now supports unknown
      compressed size
    * api: improved LZ4F_compressBound() with automatic flushing
    * cli: multiple files are compressed now using the legacy format


author: jengelh@inai.de
changelog:
  - Update to release 1.9.4
    * Decompression speed on high-end ARM64 platform is improved,
      by ~+20%.
    * For the specific scenario of data compressed with -BD4
      setting (small blocks, <= 64 KB, linked) decompressed
      block-by-block into a flush buffer (like lz4 CLI does),
      decompression speed is improved ~+70%.
    * For compressed data employing the lz4frame format (native
      format of lz4 CLI), it's possible to ignore checksum
      validation during decompression, resulting in speed
      improvements of ~+40% . This capability is exposed at both
      CLI (see --no-crc) and library levels.


author: pmonreal@suse.com
changelog:
  - FIPS: The X9.31 scheme is not approved for RSA signature
    operations in FIPS 186-5. [bsc#1224269]
    * Add openssl-1_1-ossl-sli-017-X9.31-sign.patch


author: pmonreal@suse.com
changelog:
  - FIPS: Mark HKDF and TLSv1.3 KDF as approved in the SLI [bsc#1228619]
    * Add openssl-1_1-ossl-sli-018-TLS13-HKDF.patch


author: pmonreal@suse.com
changelog:
  - FIPS: Mark PBKDF2 and HKDF HMAC input keys with size >= 112 bits
    as approved in the SLI. [bsc#1228623]
    * openssl-1_1-ossl-sli-020-PBKDF2-HMAC-size-SLI.patch


author: pmonreal@suse.com
changelog:
  - FIPS: AES GCM external IV implementation [bsc#1228618]
    * Mark the standalone AES-GCM encryption with external IV
      as non-approved in the SLI.
    * Add openssl-1_1-ossl-sli-021-AES-GCM-external-IV.patch


author: pmonreal@suse.com
changelog:
  - Security fix: [bsc#1220262, CVE-2023-50782]
    * Implicit rejection in PKCS#1 v1.5
    * Add openssl-CVE-2023-50782.patch


author: pmonreal@suse.com
changelog:
  - FIPS: Use the NID_X9_62_prime256v1 curve in ECDSA KAT test
    instead of NID_secp256k1. [bsc#1246697]
    * Add openssl-fips-ECDSA-KAT.patch


author: lucas.mulling@suse.com
changelog:
  - Security fix: [bsc#1250232 CVE-2025-9230]
    * Fix out-of-bounds read & write in RFC 3211 KEK unwrap
    * Add patch openssl3-CVE-2025-9230.patch


author: angel.yankov@suse.com
changelog:
  - Security fixes:
    * Missing ASN1_TYPE validation in PKCS#12 parsing
    * ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function
    - openssl-CVE-2026-22795.patch [bsc#1256839, CVE-2026-22795], [bsc#1256840, CVE-2026-22796]
    * Missing ASN1_TYPE validation in TS_RESP_verify_response() function
    - openssl-CVE-2025-69420.patch [bsc#1256837, CVE-2025-69420]
    * NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function
    - openssl-CVE-2025-69421.patch [bsc#1256838, CVE-2025-69421]
    * Heap out-of-bounds write in BIO_f_linebuffer on short writes
    - openssl-CVE-2025-68160.patch [bsc#1256834, CVE-2025-68160]
    * Unauthenticated/unencrypted trailing bytes with low-level OCB function calls
    - openssl-CVE-2025-69418.patch [bsc#1256835, CVE-2025-69418]
    * Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion
    - openssl-CVE-2025-69419.patch [bsc#1256836, CVE-2025-69419]


author: jengelh@inai.de
changelog:
  - Update to release 2.4.3
    * Add list of authorized release signatures to README.md
    * Fix multiplexing issue with s390/s390x shm* syscalls
    * Remove the static flag from libseccomp tools compilation
    * Add define for __SNR_ppoll
    * Fix potential memory leak identified by clang in the
      scmp_bpf_sim tool
  - Drop no-static.diff, libseccomp-fix_aarch64-test.patch,
    SNR_ppoll.patch (merged)


author: rhafer@suse.com
changelog:
  - Update to release 2.5.0
    * Add support for the seccomp user notifications, see the
      seccomp_notify_alloc(3), seccomp_notify_receive(3),
      seccomp_notify_respond(3) manpages for more information
    * Add support for new filter optimization approaches, including a balanced
      tree optimization, see the SCMP_FLTATR_CTL_OPTIMIZE filter attribute for
      more information
    * Add support for the 64-bit RISC-V architecture
    * Performance improvements when adding new rules to a filter thanks to the
      use of internal shadow transactions and improved syscall lookup tables
    * Properly document the libseccomp API return values and include them in the
      stable API promise
    * Improvements to the s390 and s390x multiplexed syscall handling
    * Multiple fixes and improvements to the libseccomp manpages
    * Moved from manually maintained syscall tables to an automatically generated
      syscall table in CSV format
    * Update the syscall tables to Linux v5.8.0-rc5
    * Python bindings and build now default to Python 3.x
    * Improvements to the tests have boosted code coverage to over 93%
  - libseccomp.keyring: replaced by Paul Moore <pmoore@redhat.com> key.


author: schwab@suse.de
changelog:
  - testsuite-riscv64-missing-syscalls.patch: Fix testsuite failure on
    riscv64
  - Ignore failure of tests/52-basic-load on qemu linux-user emulation


author: dimstar@opensuse.org
changelog:
  - Do not rely on gperf: pass GPERF=/bin/true to configure and
    remove gperf BuildRequires. The syscalls.perf file it would
    generate is part of the tarball already.


author: dmueller@suse.com
changelog:
  - update to 2.5.1:
    * Fix a bug where seccomp_load() could only be called once
    * Change the notification fd handling to only request a notification fd if
    * the filter has a _NOTIFY action
    * Add documentation about SCMP_ACT_NOTIFY to the seccomp_add_rule(3) manpage
    * Clarify the maintainers' GPG keys
  - remove testsuite-riscv64-missing-syscalls.patch


author: jengelh@inai.de
changelog:
  - Update to release 2.5.2
    * Update the syscall table for Linux v5.14-rc7
    * Add a function, get_notify_fd(), to the Python bindings to
      get the nofication file descriptor.
    * Consolidate multiplexed syscall handling for all
      architectures into one location.
    * Add multiplexed syscall support to PPC and MIPS
    * The meaning of SECCOMP_IOCTL_NOTIF_ID_VALID changed within
      the kernel. libseccomp's fd notification logic was modified
      to support the kernel's previous and new usage of
      SECCOMP_IOCTL_NOTIF_ID_VALID.


author: jengelh@inai.de
changelog:
  - Update to release 2.5.3
    * Update the syscall table for Linux v5.15
    * Fix issues with multiplexed syscalls on mipsel introduced in v2.5.2
    * Document that seccomp_rule_add() may return -EACCES


author: mrueckert@suse.de
changelog:
  - reenable python bindings at least for the distro default python3
    package:
    - adds make-python-build.patch


author: fbui@suse.com
changelog:
  - Import commit a4100e9c74b0eafae18a13e9d1d988ebc8376c6a
    806c21e22b umount: do not move busy network mounts (bsc#1236177)


author: fbui@suse.com
changelog:
  - Import commit b0ae3b6e85b6a4030cf2adb88519a6ca0ffc1343
    41d2be2fb5 Revert "macro: terminate the temporary VA_ARGS_FOREACH() array with a sentinel" (SUSE specific)


author: fbui@suse.com
changelog:
  - Import commit e08f49f2432509787abfb7f3fc0b2f2c459def04 (merge of v254.25)
    This merge includes the following fix:
      7fc7aa5a4d coredump: use %d in kernel core pattern (bsc#1243935 CVE-2025-4598)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/b0ae3b6e85b6a4030cf2adb88519a6ca0ffc1343...e08f49f2432509787abfb7f3fc0b2f2c459def04
  - Drop 1021-Revert-macro-terminate-the-temporary-VA_ARGS_FOREACH.patch
    The SUSE specific patch has been integrated into the SUSE/v254 git
    branch. Some of the imported commits from the stable tree rely on the macro
    now.


author: fbui@suse.com
changelog:
  - Start the systemd-coredump.socket unit on systemd-coredump package
    installation.
  - Restore the kernel default values of the coredump sysctl settings on
    systemd-coredump package removal.


author: fbui@suse.com
changelog:
  - Import commit 278fb676146e35a7b4057f52f34a7bbaf1b82369
    aa12f501ae logs-show: get timestamp and boot ID only when necessary (bsc#1242827)
    e8b17d11bc sd-journal: drop to use Hashmap to manage journal files per boot ID
    ea80273738 tree-wide: set SD_JOURNAL_ASSUME_IMMUTABLE where appropriate
    a5b3b5344f sd-journal: introduce SD_JOURNAL_ASSUME_IMMUTABLE flag
    5fa0600b34 sd-journal: make journal_file_read_tail_timestamp() notify to the caller that some new journal entries added
    737e8193e7 sd-journal: cache last entry offset and journal file state
    057dca426f sd-journal: fix typo in function name


author: fbui@suse.com
changelog:
  - Import commit 130293e510ceb4d121d11823e6ebd4b1e8332ea0 (merge of v254.27)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/278fb676146e35a7b4057f52f34a7bbaf1b82369...130293e510ceb4d121d11823e6ebd4b1e8332ea0


author: fbui@suse.com
changelog:
  - Split systemd-network into two new sub-packages: systemd-networkd and
    systemd-resolved (bsc#1224386 jsc#PED-12669)


author: valentin.lefebvre@suse.com
changelog:
  - systemd.spec: use %sysusers_generate_pre so that some systemd users are
    already available in %pre. This is important because D-Bus automatically
    reloads its configuration whenever new configuration files are installed,
    i.e. between %pre and %post. (bsc#1248501)
    No needs for systemd and udev packages as they are always installed during
    the initial installation.


author: kukuk@suse.de
changelog:
  - Update to version 1.0:
    - Add search in different locations for config files
    - Add support for pam_mktemp [bsc#1123878]


author: josef.moellers@suse.com
changelog:
  - prior to writing an service-specific config file, the main function
    calls access() on the destination file in /etc/pam.d.
    This will fail and no config file will be written when the original
    config file was installed in /usr/etc/pam.d.
    A similar problem exists when creating the new service file:
    create_service_file() wants to give the new service file the same
    user, group and mode as the old one, but the old one may not exist.
    In that case, set these to 0(root), 0(root), and 0644.
    [pam-config-remove-bad-access-call.patch, bsc#1187091]


author: josef.moellers@suse.com
changelog:
  - Add "revoke" to the option list for pam_keyinit
    (Remove some leftover debugs while we're at it)
    [pam-config-fix-pam_keyinit-options.patch]


author: valentin.lefebvre@suse.com
changelog:
  - Add pam_systemd_home module for the version 254 of systemd
    [pam-config-add-systemd_home-support.patch, bsc#1216318]


author: valentin.lefebvre@suse.com
changelog:
  - Change check for existence of modules.
    If we have a biarch architecture, we check that the 64bit
    PAM module is there and report an error if not. For the 32bit
    variant, we only issue a warning.
    [pam-config-change-check-for-existence-of-modules.patch, bsc#1227216]


author: valentin.lefebvre@suse.com
changelog:
  - Stop adding pam_env in AUTH stack, and be sure to put this module at the
    really end of the SESSION stack.
    [bsc#1243226, CVE-2025-6018, remove-pam_env-from-auth-stack.patch]


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#180
  - enhanced test cases
  - update test result data
  - reordered tests
  - add optional dash support in test cases
  - 1.17


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#182
  - Use sdbootutil to set default entry
  - User sdbootutil to install a new kernel
  - Set default entry and add a new kernel via sdbootutil


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#184
  - bash in SLE15 works differently than in TW; adjust for
    differences (bsc#1231018)
  - 1.20


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#185
  - provide default settings in cases where kernel and initrd
    symlinks are missing (bsc#1233956)
  - update test results
  - 1.21


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#189
  - make update-bootloader an alias for pbl and re-add still in-use
    legacy options (bsc#1235320)
  - update tests
  - 1.23


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#190
  - re-add --refresh option (bsc#1236393)
  - update tests
  - 1.24


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#191
  - avoid spurious warning messages when parsing /etc/default/grub
    (bsc#1246373, bsc#1245323)
  - 1.25


author: sweet_f_a@gmx.de
changelog:
  - update to 2.2.5:
    * add --rsyncable functionality
    * many bug fixes
  - remove all suse patches:
    * pigz-dictzip.patch, large and unmaintained patch. If somebody
      really needs that then we should rebase and test it. In this
      case --dictzip should be probably also added to original gzip.
    * pigz-always-thread.patch was a folloup of pigz-dictzip.patch
    * pigz-do-symlinks.patch added IMO dangerous and stupid behaviour
      for symlinks. The original behaviour is now again like we know
      it from gzip, bzip2 and xz.
    * pigz-spl.patch, why we hacked in special handling of .spl
      files?
    * Generally we want to have pigz to replace gzip (and vice versa)
      so better avoiding interface incompatibilities.
  - cleanup spec file


author: adam@mizerski.pl
changelog:
  - update to 2.3
    * Don't complain about missing suffix when not writing output file
    * Put all global variables in one global structure for readability
    * Do not decompress concatenated zlib streams -- only gzip streams
    * Add option for compression level 11 to use zopfli
    * Fix handling of junk after compressed data
  - added pigz-lm.patch
    * adds missing "-lm"
  - provide unpigz binary and manpage as symlink, not copy.
  - removed fake cc script - build system honors CC
  - cleanup spec file


author: p.drouand@gmail.com
changelog:
  - Update to version 2.3.3
    * Portability improvements
    * Update copyright years in documentation
  - Add build fix patches
    * pigz-fix-wrong-include.patch
    * pigz-fix-missing-linker.patch
  - Remove pigz-lm.patch; fixed
  - Use download Url as source


author: mpluskal@suse.com
changelog:
  - Update to version 2.4:
    * Generate Zip64 format .zip files when the output is greater
      than or equal to 4 GiB.
    * Improved gzip options processing and return code compatibility
    * Some bug fixes
  - Drop no longer needed patches:
    * pigz-fix-missing-linker.patch
    * pigz-fix-wrong-include.patch


author: crrodriguez@opensuse.org
changelog:
  - Build with -fexceptions to get compiler/os specific (aka. sane)
    implementations of pthread_cleanup* routines.


author: dmueller@suse.com
changelog:
  - update to 2.6:
    * Add --huffman/-H and --rle/U strategy options
    * Fix issue when compiling for no threads
    * Fail silently on a broken pipe
    * Add --alias/-A option to set .zip name for stdin input
    * Add --comment/-C option to add comment in .gz or .zip
    * Several bug and behavior fixes
  - drop fortify.patch: obsolete


author: andreas.stieger@gmx.de
changelog:
  - update to 2.7:
    * Improved display of multiple-member gzip files
    * Better gzip compatibility and bug fixes
  - add pigz-2.7-NOTHREAD-tests.patch to fix tests


author: pgajdos@suse.com
changelog:
  - version update to 2.8
    - Fixed a version bug when compiling with the just-released zlib 1.3
    - Will save a modification time only for regular files (just like gzip since 1.10)
    - Will write all available uncompressed data on an error, for partial data recovery
  - deleted patches
    - pigz-2.7-NOTHREAD-tests.patch (upstreamed)


author: dimstar@opensuse.org
changelog:
  - Update to version 0.27.1:
    + Various fixes for using the internal glib snapshot. It should
      now be usable pretty much everywhere with the exception that
      universal builds are not supported on OS X.
    + Remove usage of gettext from the internal glib to avoid gettext
      and libintl dependencies
    + Update internal glib snapshot to 2.32.4
    + Fix check for POSIX shell used in tests to work better
    + Handle spaces in autodetected prefix on Windows
    + Bugs fixed: fdo#3550, fdo#51883, fdo#52031, fdo#53493.


author: p.drouand@gmail.com
changelog:
  - Update to version 0.28:
    + Fixed a pair of long-standing and intertwined bugs involving
      unwanted removal of flags:
    - Other Libs flags like -Wl are now kept in context order
      with -l flags.
    - Aggressive removal of all duplicate arguments has been scaled
      back so that just consecutive duplicate arguments are
      removed. One result of this change is that some flags could
      be repeated in the final output, especially flags from
      non-pkg-config packages like -lm. Since pkg-config rarely has
      enough knowledge here about the right thing to do, we throw
      the duplicate arguments at the compiler/linker and trust it
      will do the right thing.
    + Fixed an old bug to allow circular Requires. This fix brings
      along a small behavior change in that pkg-config resolves
      requires depth first, causing some lower level flags to show up
      earlier in the output than previously.
    + Cleaned up many corner-case bugs and ambiguous behavior in
      pkg-config's interface.
    + New autoconf macro PKG_CHECK_VAR for reading variables from .pc
      files.
    + Default to suppressing -L/lib and/or -L/lib64 like their /usr
      counterparts.
    + To help support multiarch scenarios out of the box,
      $host-pkg-config is now installed unless --disable-host-tool
      is passed to configure.
    + Added optional gcov usage through the --with-gcov configure
      option. As a result, many more tests were added to greatly
      increase the coverage of the code to 86% of executed lines on a
      Fedora 18 machine.
    + Bugs fixed: fdo#130, fdo#7331, fdo#16101, fdo#17053, fdo#19950,
      fdo#34504, fdo#48098, fdo#54231, fdo#54271, fdo#54379,
      fdo#54384, fdo#54386, fdo#54388, fdo#54389, fdo#54390,
      fdo#54391, fdo#54427, fdo#54463, fdo#54716, fdo#57078,
      fdo#58363, fdo#59435.


author: dvaleev@suse.com
changelog:
  - Don't redefine _arch, but use file pattern instead. This ensures
    we don't have to run fixing each and every arch.


author: zaitor@opensuse.org
changelog:
  - Update to version 0.29:
    + Fixed a regression from 0.28 in system -L flag handling. If the
      pc file has multiple system -L flags, every other flag will be
      left as is (fdo#78077).
    + Quoting of variables queried through --variable is removed so
      that the output can be used verbatim in subsequent shell
      commands (fdo#67904).
    + Fixed a regression from 0.28 in -L flag handling on Windows. A
      .libs suffix was inadvertantly being added to the library path.
    + Added a --validate option to check pc file syntax. This works
      just like --exists, but package dependencies are disabled
      (fdo#7000).
    + Added the PKG_PREREQ autoconf macro. Whereas
      PKG_PROG_PKG_CONFIG is used to check the version of the
      pkg-config tool, this is used to check the version of the
      pkg-config autoconf macros in use.
    + Added the PKG_CHECK_MODULES_STATIC autoconf macro. This will
      temporarily add --static to the pkg-config calls while invoking
      PKG_CHECK_MODULES (fdo#19541).
    + Many fixes to the testsuite for Windows. It should now pass for
      a MinGW, Cygwin, and cross-compiled MinGW using Wine for test
      execution (fdo#66939).
    + More consistent handling of prefix redefinition. On Windows,
      the prefix was always being redefined based on the pc file
      path. This feature can now be enabled or disabled at runtime on
      all platforms using the --define-prefix and
    - -dont-define-prefix options (fdo#63602).
    + Continue listing packages with --list-all even if there are
      errors in pc files (fdo#26615).
    + Various documentation improvements (fdo#62018, fdo#62374,
      fdo#66155).
    + Fixed a bug when multiple -isystem arguments are used
      (fdo#72584).
    + pkg-config is now built with largefile support to ensure that
      it works correctly on filesystems with 64 bit inodes
      (fdo#90078).
    + Bugs fixed: fdo#7000, fdo#19541, fdo#26615, fdo#62018,
      fdo#62374, fdo#63602, fdo#66155, fdo#66939, fdo#67904,
      fdo#70690, fdo#72584, fdo#78077, fdo#80378, fdo#80380,
      fdo#89267, fdo#90078, fdo#90437, fdo#92002.


author: zaitor@opensuse.org
changelog:
  - Update to version 0.29.1:
    + Fixed a regression from 0.29 with unquoting values queried with
    - -variable. In some cases, this would cause shell special
      characters to be escaped in ways they weren't before. Instead,
      the unquoting only occurs if the value appears to be quoted
      (fdo#93284).
    + Add support for building pkg-config with Microsoft Visual
      Studio (fdo#92489).
    + Allow overriding pkg-config variables with environment
      variables. By setting an environment variable of the form
      PKG_CONFIG_$PACKAGE_$VARIABLE, a pkg-config variable can be set
      globally without always having to pass --define-variable
      (fdo#90917).
    + Honor -Wl,-framework in addition to -framework so that multiple
      frameworks are handled on OSX (fdo#1278).
    + Fix the OSX build using --with-internal-glib (fdo#92902).


author: dimstar@opensuse.org
changelog:
  - Update to version 0.29.2:
    + Improved pkg-config's recursive package list expansion
      performance.
    + Handle an empty prefix setting correctly when --define-prefix
      is used (fdo#97453).
    + Lazily load pc files instead of reading all available pc files
      during initialization (fdo#98215).
    + Check the CPATH environment variable when determining system
      include paths like GCC does. Document the system search path
      behavior (fdo#99224).
    + Make PKG_CHECK_MODULES show the module list rather than the
      variable prefix in configure output (fdo#98334).
    + Fix bundled glib build with GCC 6 (fdo#98334).
    + Handle -isystem and -idirafter when PKG_CONFIG_SYSROOT_DIR is
      set (fdo#97337).
    + Check the INCLUDE environment variable when determining system
      include paths on Windows builds when --msvc-syntax is used
      (fdo#94729).
  - Drop pkg-config-gdate-fix.patch: fixed upstream.


author: mwilck@suse.com
changelog:
  - Update to version 15.6.9:
    * Include unblacklist in initramfs (bsc#1224320)
    * regenerate-initrd-posttrans: run update-bootloader --refresh for XEN
      (bsc#1223278)
    * 60-io-scheduler.rules: test for "scheduler" sysfs attribute (boo#1216717)
    * README: Update blacklist description (gh#openSUSE/suse-module-tools#71)


author: mwilck@suse.com
changelog:
  - Update to version 15.7.1:
    * udevrules: Add rule to set maximum readahead window
      (jsc#PED-11154)
    * rpm-script: create vmlinuz and initrd also in image build environments
      (bsc#1231040, bsc#1230858)
    * regenerate-initrd-posttrans: Fix SKIP_REGENERATE_INITRD_ALL
      (bsc#1228929)
    * Improve handling of /boot/vmlinuz and /boot/initrd symlinks
      (boo#1207703)
    * Fix 64k check in check_arm_pagesize() that would cause OBS
      builds to fail
    * rpm scriptlets: fix shellcheck warnings


author: mwilck@suse.com
changelog:
  - Update to version 15.7.2:
    * rpm-script: create dangling symlinks in kiwi environments
      (bsc#1234275)


author: mwilck@suse.com
changelog:
  - Update to version 15.7.3:
    * regenerate-initrd-posttrans: return error if regenerating all initrds fails (bsc#1234308)


author: mwilck@suse.com
changelog:
  - Update to version 15.7.4:
    * rpm-script: create /boot/vmlinuz and /boot/initrd in kiwi environment
      (bsc#1234275, bsc#1234759)


author: mwilck@suse.com
changelog:
  - Update to version 15.7.7:
    * weak-modules2: skip livepatch dir when checking for unresolved symbols
      (bsc#1250655)


author: jfehlig@suse.com
changelog:
  - Add system account and groups for kvm, qemu, and libvirt
    (jsc#SLE-11629)
    New files: system-group-kvm.conf, system-group-libvirt.conf,
    system-user-qemu.conf


author: fbui@suse.com
changelog:
  - Add default hardware group for 'sgx' enclave access
    Since udev v248, a default rule for /dev/sgx_enclave is provided to
    give rw access to the new group hopefully making 'sgx' the standard
    group name for such devices. [bsc#1190572]


author: msuchanek@suse.com
changelog:
  - system-user-tss.conf: Remove group entry, not needed and did
    contain syntax errors (bsc#1190401).


author: fbui@suse.com
changelog:
  - Import 0.5
    0c5e241 SLE: turn off RemoveIPC by default for logind (fate#320125)
    cb6914f SLE: restore ProtectHostname=no for udevd (bsc#1178374)
    7e332a6 Add a header in all each drop-ins
    465e1c7 Makefile: simplify 'archive' target


author: fbui@suse.com
changelog:
  - Import commit 6b8dde1d4f867aff713af6d6830510a84fad58d2
    6b8dde1 Convert more drop-ins into early ones


author: fbui@suse.com
changelog:
  - Import 0.8
    f34372f User priority '26' for SLE-Micro
    c8b6f0a Revert "Convert more drop-ins into early ones"


author: fbui@suse.com
changelog:
  - The usage of drop-ins is now the official way for configuring systemd and its
    various daemons on Factory/ALP. Hence the early drop-ins SUSE specific
    "feature" has been abandoned.


author: varkoly@suse.com
changelog:
  - spamassassin: migrate from cron to systemd timers (bsc#1115411)
    enable spamassassin.timer by default


author: jsegitz@suse.com
changelog:
  - Removed ixpdimm-monitor.service and readonly-root.service
    (bsc#1129270)
  - Added snapd.apparmor.service (bsc#1129435)


author: matthias.gerstner@suse.com
changelog:
  Cleanup of outdated autostart services (bsc#1171656):
  - Remove acpid.service. acpid is only available on SLE via openSUSE
    backports.  In openSUSE acpid.service is *not* autostarted. I see no
    reason why it should be on SLE.
  - Remove spamassassin.timer. This timer never seems to have existed.
    Instead spamassassin ships a "sa-update.timer". But it is not
    default-enabled and nobody ever complained about this.
  - Remove snapd.apparmor.service: This service was proactively added a year
    ago, but snapd didn't even make it into openSUSE yet. There's no reason
    to keep this entry unless snapd actually enters SLE which is not
    foreseeable.


author: fvogt@suse.com
changelog:
  - Don't enable btrfsmaintenance-refresh.service, btrfsmaintenance is
    managed by systemd-presets-common-SUSE instead (boo#1165780)


author: pgajdos@suse.com
changelog:
  - enable sysstat_collect.timer and sysstat_summary.timer [bsc#1244553]
    and [bsc#1246835]
  - modified sources
    % default-SLE.preset


author: alarrosa@suse.com
changelog:
  - Modify branding-preset-states to fix systemd-presets-common-SUSE
    not enabling new user systemd service preset configuration just
    as it handles system service presets. By passing an (optional)
    second parameter "user", the save/apply-changes commands now
    work with user services instead of system ones (boo#1200485)


author: kukuk@suse.com
changelog:
  - Add wtmpdb-update-boot.service and wtmpdb-rotate.timer to enable
    wtmpdb as Y2038 safe wtmp replacement


author: kukuk@suse.com
changelog:
  - Don't call systemctl list-unit-files with an empty argument,
    this will break enabling of system unit files [bsc#1212496]


author: alarrosa@suse.com
changelog:
  - Fix another case of systemctl being called with an empty
    argument. This if a preemptive fix for a similar issue to
    bsc#1212496.


author: msuchanek@suse.com
changelog:
  - Split hcn-init.service to hcn-init-NetworkManager and hcn-init-wicked
    (bsc#1200731 ltc#198485 https://github.com/ibm-power-utilities/powerpc-utils/pull/84)
    Support both the old and new service to avoid complex version interdependency.


author: fbui@suse.com
changelog:
  - Don't emit a warning when the flag file in /var/lib/systemd/migrated/ is not
    present as it's expected (bsc#1208079).


author: fbui@suse.com
changelog:
  - Fix %sysctl_apply() and %binfmt_apply() so they are disabled when called from
    a chroot (bsc#1211272)


author: fbui@suse.com
changelog:
  - Switch to `systemd-hwdb` tool when updating the HW database. It's been
    introduced in systemd v219 and replaces the deprecated command `udevadm hwdb`.


author: fbui@suse.com
changelog:
  - Order packages that requires systemd after systemd-sysvcompat when this part
    of the transaction (bsc#1217964)
    systemd-sysvcompat has been introduced recently and contains the compatibility
    scripts used to support SysV init scripts. Make sure that the packages ordered
    after systemd are also ordered after systemd-sysvcompat so theirs rpm
    scriptlets can still rely on the compat scripts.
    On distributions where systemd-sysvcompat doesn't exist, the new ordering
    constraint should be a nop.


author: fbui@suse.com
changelog:
  - Introduce %udev_trigger_with_reload() for packages that need to trigger events
    in theirs scriplets. The new macro automatically triggers a reload of the udev
    rule files as this step is often overlooked by packages (bsc#1237143).


author: tchvatal@suse.com
changelog:
  - Version update to 1.18.10:
    * Various few fixes, see changelog file in the package
    * Refresh patch update-alternatives-suse.patch
    * Remove patch dpkg-sparc.diff


author: tchvatal@suse.com
changelog:
  - Update to 1.18.23:
    * Various small fixes and memleaks removed
  - Make sure to generate manpage
  - Refresh patch update-alternatives-suse.patch


author: tchvatal@suse.com
changelog:
  - Silence the update-alternatives regen output wrt bsc#1050848
    it causes more confusion than benefits


author: mpluskal@suse.com
changelog:
  - Use dbpath macro for locationg rpm state directory
  - Require exactly same version of rpm we had when building to make
    sure dbpath matches


author: mpluskal@suse.com
changelog:
  - Move update alternatives database to new location
  - Update rpm requirements to avoid unnecessary builds


author: dimstar@opensuse.org
changelog:
  - Migrate u-a data from /var/lib/rpm instead of relying on dbpath:
    no u-a version ever installed files explicitly into dbpath, but
    always hard specified /var/lib/rpm. The fact that RPM moved its
    database is irrelevant to update-alternatives. In case RPM moved
    it's database, our files are still accessible via the
    /var/lib/rpm symlink being put in place.
  - Drop the arbitrary depenency on a specific rpm version: the idea
    was to ensure to have an rpm with the new dbpath location in
    place. For one, the dependency does not work as intended, and
    2nd, as the migration now happens explicitly from the old u-a
    admindir without relying on dbpath, is no longer needed.


author: tchvatal@suse.com
changelog:
  - Update to 1.19.0.4:
    * No changes in update-alternatives just match step with dpkg
  - Drop patch 0001-In-case-of-equal-priority-rather-update.patch
    * Causes issues on too eagerly regenerating stuff bsc#1075971
    * Reason for this patch should no longer be needed as all python
      packages are singlespec
    * Also drop the post override


author: sbrabec@suse.com
changelog:
  - Don't delete binaries not common for all architectures. Create an
    util-linux-extra subpackage instead, so users of third party
    tools can use them. (bsc#1222285)


author: sbrabec@suse.com
changelog:
  - Document unexpected side effects of lazy destruction
    (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch,
    util-linux-umount-losetup-lazy-destruction-generated.patch).


author: sbrabec@suse.com
changelog:
  - agetty: Prevent login cursor escape (bsc#1194818,
    util-linux-agetty-prevent-cursor-escape.patch).


author: sbrabec@suse.com
changelog:
  - Skip aarch64 decode path for rest of the architectures
    (bsc#1229476, util-linux-lscpu-skip-aarch64-decode.patch).


author: sbrabec@suse.com
changelog:
  - Update to version 2.40.2 (jsc#PED-9751):
    * Add lastlog2 (disabled for this build, SLE15/Leap15
      infrastructure is not ready for it)
    * agetty: Load autologin user from agetty.autologin credential
    * agetty: use get_terminal_default_type()
    * agetty: use sd_get_sessions() for number of users (#2088)
    * agetty: don't overwrite TERM passed by the user
    * blockdev: add support for BLKGETZONESZ
    * cfdisk: ask y/n before wipe
    * cfdisk: properly handle out-of-order partitions during resize
    * cfdisk: fix possible integer overflow
    * chcpu: document limitations of -g (bsc#1218609)
    * chsh: use libeconf to read /etc/shells
    * column: fix -l
    * column: fix memory leak
    * dmesg: fix FD leak
    * dmesg: fix delta calculation
    * dmesg: fix wrong size calculation
    * dmesg: support reading kmsg format from file
    * enosys: a new small command to make syscalls fail with ENOSYS
    * exch: new command to atomically exchanges paths between two files
    * fdisk: add support for partition resizing
    * fdisk: remove usage of VLA
    * fincore: add --output-all
    * findmnt: add --list-columns
    * findmnt: add -I, --dfi options for imitating the output of df -i
    * findmnt: add inode-related columns for implementing "df -i" like output
    * fsck.minix: fix possible overrun
    * hexdump: add '--one-byte-hex' format option
    * hwclock: add support for RTC_VL_READ/RTC_VL_CLR ioctls
    * libblkid: fix segfault when blkid.conf doesn't exist
    * libfdisk: add initializer to geometry
    * libmount: improving robustness in reading kernel messages,
      add pidfs to pseudo fs list
    * libmount: fix access check for utab in context
    * libmount: fix umount --read-only
    * login: initialize noauth from login.noauth credential
    * lsblk: add --filter
    * lsblk: add --highlight
    * lsblk: add --list-columns
    * lsclocks: new command to show clocks
    * lscpu: even more Arm part numbers (bsc#1223605)
    * lscpu: New Arm Cortex part numbers
      fix hang of lscpu -e (bsc#1225598)
    * lsfd: Refactor the pidfd logic, support pidfs
    * lsns: fix netns use
    * mkfs.minix: handle 64bit time on 32bit system
    * mkswap: implement --file
    * mkswap: implement --offset
    * mkswap.8.adoc: update note regarding swapfile creation
    * more: clean processes not cleaned up after failed SSH session
      using up 100% CPU (bsc#1220117)
    * mount: add --map-users and --map-groups convenience options
    * nsenter: add option `-c` to join the cgroup of target process
    * setarch: add riscv64/riscv32 support
    * setpgid: new command to run a program in a new process group
    * setpgid: make -f work
    * uuidd: add cont_clock persistence
    * uuidgen: add option --count
    * wall: query logind for list of users with tty (#2088)
      properly neutralize escape sequences (bsc#1221831,
      CVE-2024-28085)
    * write: query logind for list of users with tty (#2088)
    * libuuid: improved support for 64-bit time
    * Many other fixes, improvements and code cleanup. For the
      complete list see
      https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/v2.40/v2.40.2-ReleaseNotes
  - Drop upstreamed patches:
      Revert-libblkid-try-LUKS2-first-when-probing.patch,
      util-linux-libsmartcols-fix-reduction-stages-use.patch,
      util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch,
      util-linux-chcpu-document-zVM-limitations.patch,
      util-linux-lscpu-add-ARM-cores-neoverse3.patch,
      util-linux-chcpu-document-zVM-limitations-generated.patch and
      util-linux-wall-CVE-2024-28085.patch.
  - Add file conflict of util-linux-tty-tools and busybox-util-linux.
  - Update util-linux-bash-completion-su-chsh-l.patch,
    Add-documentation-on-blacklisted-modules-to-mount-8-.patch and
    make-sure-sbin-resp-usr-sbin-are-in-PATH.diff.
  - Move autoreconf back to %build.
  - Add devel dependencies.
  - Remove util-linux-rpmlintrc. It is no more needed with multibuild.
  - uncomment "autoreconf --install" to use the new version of automake
  - disable libmagic in more(1) for binary detection (bsc#1225197)
  - Skip tests marked as ts_skip_qemu_user when running under qemu
  - Mark racy lslocks test as known fail
  - Re-enable lsfd tests using mkfds, as it is fixed now.


author: sbrabec@suse.com
changelog:
  - Update to version 2.40.4 (jsc#PED-9751):
    * agetty: Prevent cursor escape (bsc#1194818, drop
      util-linux-agetty-prevent-cursor-escape.patch)
      add "systemd" to --version output\
    * chcpu(8): Document CPU deconfiguring behavior
    * fdisk: SGI fixes
    * hardlink: fix memory corruption
    * hardlink.1 directory|file is mandatory
    * lib/env: fix env_list_setenv() for strings without '='
    * libblkid:
      (exfat) validate fields used by prober
      (gpt) use blkid_probe_verify_csum() for partition array
      checksum
      add FSLASTBLOCK for swaparea
      bitlocker fix version on big-endian systems
    * libfdisk: make sure libblkid uses the same sector size
    * libmount:
      extract common error handling function
      propagate first error of multiple filesystem types
    * logger: correctly format tv_usec
    * lscpu: Skip aarch64 decode path for rest of the architectures
      (bsc#1229476, drop util-linux-lscpu-skip-aarch64-decode.patch)
    * lsns: ignore ESRCH errors reported when accessing files under
      /proc
    * mkswap: set selinux label also when creating file
    * more: make sure we have data on stderr
    * nsenter: support empty environ
    * umount, losetup: Document loop destroy behavior
      (bsc#1159034, drop
      util-linux-umount-losetup-lazy-destruction.patch,
      util-linux-umount-losetup-lazy-destruction-generated.patch).
    * uuidd: fix /var/lib/libuuid mode uuidd-tmpfiles.conf
      fix /var/lib/libuuid mode uuidd-tmpfiles.conf
    * Many other fixes, improvements and code cleanup. For the
      complete list see
      https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/v2.40/v2.40.3-ReleaseNotes
      https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/v2.40/v2.40.4-ReleaseNotes
    - Refresh util-linux.keyring. Key validity was extended.


author: sbrabec@suse.com
changelog:
  - lscpu: Add support for NVIDIA Olympus arm64 core (jsc#PED-13682,
    util-linux-lscpu-add-arm64-NVIDIA-Olympus.patch).


author: sbrabec@suse.com
changelog:
  - Fix heap buffer overread in setpwnam() when processing 256-byte
    usernames (bsc#1254666, CVE-2025-14104,
    util-linux-CVE-2025-14104-1.patch,
    util-linux-CVE-2025-14104-2.patch).


author: bwiedemann@suse.com
changelog:
  - Update to version 1.4.7
    * Improved --long mode
    * --long now automatically enabled for any window size >= 128MB
    * Faster decompression of small blocks
    * CLI improvements
      + accept parameter through environment variable ZSTD_NBTHREADS
      + new command --output-dir-mirror
      + more accurate warning and error messages
    * New experimental features
      + Shared Thread Pool
      + Faster Dictionary Compression
      + New Sequence Ingestion API
    * Drop upstream fix-lib-build.patch


author: bwiedemann@suse.com
changelog:
  - Update to version 1.4.9
    * https://github.com/facebook/zstd/releases/tag/v1.4.9
    * >2x Faster Long Distance Mode
    * New Experimental Decompression Feature: ZSTD_d_refMultipleDDicts
    * bug: Use umask() to Constrain Created File Permissions
    * bug: Make Simple Single-Pass Functions Ignore Advanced Parameters
    * cli: Fix --output-dir-mirror's Rejection of ..-Containing Paths
    * cli: Allow Input From Console When -f/--force is Passed


author: ali.abdallah@suse.com
changelog:
  - Update to version 1.5.0 (jsc#SLE-20392)
    * https://github.com/facebook/zstd/releases/tag/v1.5.0
    * Improved Middle-Level Compression Speed
    * Improved High-Level Compression Ratio
    * Faster Decompression Speed
    * Dynamic Library Supports Multithreading by Default


author: ali.abdallah@suse.com
changelog:
  - Fix CVE-2022-4899, bsc#1209533
    * Fix buffer underflow when dir1 == ""
    * Disallow empty string as an argument for --output-dir-flat=""
    and --output-dir-mirror="".
  - Added patches:
    * Disallow-empty-output-directory.patch
    * Fix-buffer-underflow-for-null-dir1.patch


author: ali.abdallah@suse.com
changelog:
  - update to 1.5.5:
    * fix: fix rare corruption bug affecting the high compression
      mode, reported by @danlark1
    * perf: improve mid-level compression speed
    * lib: deprecated bufferless block-level API (#3534) by
      @terrelln
    * cli: mmap large dictionaries to save memory, by
      @daniellerozenblit
    * cli: improve speed of --patch-from mode (~+50%) (#3545) by
      @daniellerozenblit
    * cli: improve i/o speed (~+10%) when processing lots of small
      files (#3479) by @felixhandte
    * cli: zstd no longer crashes when requested to write into
      write-protected directory (#3541) by @felixhandte
    * cli: fix decompression into block device using -o, reported
      by @georgmu
    * misc: improve seekable format ingestion speed (~+100%) for
      very small chunk sizes (#3544) by @Cyan4973
    * misc: tests/fullbench can benchmark multiple files (#3516) by
      @dloidolt
    * Upstream changelog from version 1.5.0 to 1.5.4
      https://github.com/facebook/zstd/blob/v1.5.4/CHANGELOG
    * Dropped patches:
    - Disallow-empty-output-directory.patch
    - Fix-buffer-underflow-for-null-dir1.patch
      Fixed upstream in version 1.5.4
  - enable zlib/gzip compatible backend, as zlib is significantly
    (50%-100%) faster than gzip
  - add zstd-gzip compatibility subpackage which can be used
    as a drop in compatible replacement for gzip
  - small spec file cleanups
  - add zcat in zstd-gzip (needed by for example the kernel scripts)
  - Build AVX2 enabled hwcaps library for x86_64-v3


author: ali.abdallah@suse.com
changelog:
  - update to 1.5.7:
    * zstd now employs multiple threads by default
    * Fix a rare bug in 32-bit mode
    * Enhanced Compression Speed for Small Data Blocks
    * Substantial --patch-from performance improvements
  - Drop pzstd.1.patch - not upstream, but also not needed
  - Changes between 1.5.5 and 1.5.6:
    * Introduce a new stable parameter ZSTD_c_targetCBlockSize,
      enabling the division of blocks into smaller segments to
      enhance initial byte delivery speed for congested networks
    * library allows allow ganular binary size selection


