# changelog

author: andreas.stieger@gmx.de
changelog:
  - cryptsetup 2.3.5:
    * Fix partial reads of passphrase from an interactive terminal
    * Fix maximum length of password entered through a terminal
    * integritysetup: support new dm-integrity HMAC recalculation
      options
    * integritysetup: display of recalculating sector in dump command
    * veritysetup: fix verity FEC if stored in the same image with
      hashes
    * veritysetup: run FEC repair check even if root hash fails
    * veritysetup: do not process hash image if hash area is empty
    * veritysetup: store verity hash algorithm in superblock in
      lowercase
    * bitlk: fix a crash if the device disappears during BitLocker
      scan
    * bitlk: show a better error when trying to open an NTFS device
    * bitlk: add support for startup key protected VMKs
    * Fix LUKS1 repair code (regression since version 1.7.x)
    * Fix luksKeyChange for LUKS2 with assigned tokens
    * Fix cryptsetup resize using LUKS2 tokens
    * Print a visible error if device resize is not supported
    * Add error message when suspending wrong non-LUKS device
    * Fix default XTS mode key size in reencryption
    * Rephrase missing locking directory warning and move it to
      debug level
    * Many fixes for the use of cipher_null (empty debug cipher)
    * Fixes for libpasswdqc 2.0.x (optional passphrase quality check)
    * Fixes for problems discovered by various tools for code
      analysis
    * Various fixes to man pages
  - silence hmac packaging warnings


author: lnussel@suse.de
changelog:
  - cryptsetup 2.3.6:
    * integritysetup: Fix possible dm-integrity mapping table truncation.
    * cryptsetup: Backup header can be used to activate TCRYPT device.
      Use --header option to specify the header.
    * cryptsetup: Avoid LUKS2 decryption without detached header.
      This feature will be added later and is currently not supported.
    * Additional fixes and workarounds for common warnings produced
      by some static analysis tools (like gcc-11 analyzer) and additional
      code hardening.
    * Fix standalone libintl detection for compiled tests.
    * Add Blake2b and Blake2s hash support for crypto backends.
      Kernel and gcrypt crypto backend support all variants.
      OpenSSL supports only Blake2b-512 and Blake2s-256.
      Crypto backend supports kernel notation e.g. "blake2b-512".


author: fvogt@suse.com
changelog:
  - Use LUKS2 as default format on Tumbleweed.
    It provides some additional features which other tools
    (e.g. systemd-cryptenroll) rely on. GRUB 2.06 supports unlocking
    LUKS2 volumes meanwhile.


author: lnussel@suse.de
changelog:
  - cryptsetup 2.4.0 (jsc#SLE-20275)
    * External LUKS token plugins
    * Experimental SSH token
    * Default LUKS2 PBKDF is now Argon2id
    * Increase minimal memory cost for Argon2 benchmark to 64MiB.
    * Autodetect optimal encryption sector size on LUKS2 format.
    * Use VeraCrypt option by default and add --disable-veracrypt option.
    * Support --hash and --cipher to limit opening time for TCRYPT type
    * Fixed default OpenSSL crypt backend support for OpenSSL3.
    * integritysetup: add integrity-recalculate-reset flag.
    * cryptsetup: retains keyslot number in luksChangeKey for LUKS2.
    * Fix cryptsetup resize using LUKS2 tokens.
    * Add close --deferred and --cancel-deferred options.
    * Rewritten command-line option parsing to avoid libpopt arguments
      memory leaks.
    * Add --test-args option.


author: lnussel@suse.de
changelog:
  - As YaST passes necessary parameters to cryptsetup anyway, we do
    not necessarily need to take grub into consideration. So back to
    Argon2 to see how it goes.


author: lnussel@suse.de
changelog:
  - cryptsetup 2.4.1
    * Fix compilation for libc implementations without dlvsym().
    * Fix compilation and tests on systems with non-standard libraries
    * Try to workaround some issues on systems without udev support.
    * Fixes for OpenSSL3 crypto backend (including FIPS mode).
    * Print error message when assigning a token to an inactive keyslot.
    * Fix offset bug in LUKS2 encryption code if --offset option was used.
    * Do not allow LUKS2 decryption for devices with data offset.
    * Fix LUKS1 cryptsetup repair command for some specific problems.


author: andreas.stieger@gmx.de
changelog:
  - cryptsetup 2.4.2:
    * Fix possible large memory allocation if LUKS2 header size is
      invalid.
    * Fix memory corruption in debug message printing LUKS2
      checksum.
    * veritysetup: remove link to the UUID library for the static
      build.
    * Remove link to pwquality library for integritysetup and
      veritysetup. These tools do not read passphrases.
    * OpenSSL3 backend: avoid remaining deprecated calls in API.
      Crypto backend no longer use API deprecated in OpenSSL 3.0
    * Check if kernel device-mapper create device failed in an early
      phase. This happens when a concurrent creation of device-mapper
      devices meets in the very early state.
    * Do not set compiler optimization flag for Argon2 KDF if the
      memory wipe is implemented in libc.
    * Do not attempt to unload LUKS2 tokens if external tokens are
      disabled. This allows building a static binary with
    - -disable-external-tokens.
    * LUKS convert: also check sysfs for device activity.
      If udev symlink is missing, code fallbacks to sysfs scan to
      prevent data corruption for the active device.


author: andreas.stieger@gmx.de
changelog:
  - cryptsetup 2.4.3:
    * Fix possible attacks against data confidentiality through
      LUKS2 online reencryption extension crash recovery
      CVE-2021-4122, boo#1194469
    * Add configure option --disable-luks2-reencryption to completely
      disable LUKS2 reencryption code.
    * Improve internal metadata validation code for reencryption
      metadata
    * Add updated documentation for LUKS2 On-Disk Format
      Specification version 1.1.0
    * Fix support for bitlk (BitLocker compatible) startup key with
      new  metadata entry introduced in Windows 11
    * Fix space restriction for LUKS2 reencryption with data shift


author: pmonreal@suse.com
changelog:
  - luksFormat: Handle system with low memory and no swap space [bsc#1211079]
    * Check for physical memory available also in PBKDF benchmark.
    * Try to avoid OOM killer on low-memory systems without swap.
    * Use only half of detected free memory on systems without swap.
    * Add patches:
    - cryptsetup-Check-for-physical-memory-available-also-in-PBKDF-be.patch
    - cryptsetup-Try-to-avoid-OOM-killer-on-low-memory-systems-withou.patch
    - cryptsetup-Use-only-half-of-detected-free-memory-on-systems-wit.patch


author: lnussel@suse.de
changelog:
  - cryptsetup 2.5.0:
    * Split manual pages into per-action pages and use AsciiDoc format.
    * Remove cryptsetup-reencrypt tool from the project and move reencryption
      to already existing "cryptsetup reencrypt" command.
      If you need to emulate the old cryptsetup-reencrypt binary, use simple
      wrappers script running "exec cryptsetup reencrypt $@".
    * LUKS2: implement --decryption option that allows LUKS removal.
    * Fix decryption operation with --active-name option and restrict
      it to be used only with LUKS2.
    * Do not refresh reencryption digest when not needed.
      This should speed up the reencryption resume process.
    * Store proper resilience data in LUKS2 reencrypt initialization.
      Resuming reencryption now does not require specification of resilience
      type parameters if these are the same as during initialization.
    * Properly wipe the unused area after reencryption with datashift in
      the forward direction.
    * Check datashift value against larger sector size.
      For example, it could cause an issue if misaligned 4K sector appears
      during decryption.
    * Do not allow sector size increase reencryption in offline mode.
    * Do not allow dangerous sector size change during reencryption.
    * Ask the user for confirmation before resuming reencryption.
    * Do not resume reencryption with conflicting parameters.
    * Add --force-offline-reencrypt option.
    * Do not allow nested encryption in LUKS reencrypt.
    * Support all options allowed with luksFormat with encrypt action.
    * Add resize action to integritysetup.
    * Remove obsolete dracut plugin reencryption example.
    * Fix possible keyslot area size overflow during conversion to LUKS2.
    * Allow use of --header option for cryptsetup close.
    * Fix activation of LUKS2 device with integrity and detached header.
    * Add ZEROOUT IOCTL support for crypt_wipe API call.
    * VERITY: set loopback sector size according to dm-verity block sizes.
    * veritysetup: dump device sizes.
    * LUKS2 token: prefer token PIN query before passphrase in some cases.
      When a user provides --token-type or specific --token-id, a token PIN
      query is preferred to a passphrase query.
    * LUKS2 token: allow tokens to be replaced with --token-replace option
      for cryptsetup token command.
    * LUKS2 token: do not continue operation when interrupted in PIN prompt.
    * Add --progress-json parameter to utilities.
    * Add support for --key-slot option in luksResume action.
  - move man pages to separate subpackage
  - drop backports handling


author: luca.boccassi@gmail.com
changelog:
  - Add virtual provides for 'integritysetup' and 'veritysetup' to match
    package names provided by Fedora/RHEL, to allow the same set of
    dependencies to be used across all RPM distributions.


author: info@paolostivanin.com
changelog:
  - cryptsetup 2.6.0:
    * Introduce support for handling macOS FileVault2 devices (FVAULT2).
    * libcryptsetup: no longer use global memory locking through mlockall()
    * libcryptsetup: process priority is increased only for key derivation
      (PBKDF) calls.
    * Add new LUKS keyslot context handling functions and API.
    * The volume key may now be extracted using a passphrase, keyfile, or
      token. For LUKS devices, it also returns the volume key after
      a successful crypt_format call.
    * Fix --disable-luks2-reencryption configuration option.
    * cryptsetup: Print a better error message and warning if the format
      produces an image without space available for data.
    * Print error if anti-forensic LUKS2 hash setting is not available.
      If the specified hash was not available, activation quietly failed.
    * Fix internal crypt segment compare routine if the user
      specified cipher in kernel format (capi: prefix).
    * cryptsetup: Add token unassign action.
      This action allows removing token binding on specific keyslot.
    * veritysetup: add support for --use-tasklets option.
      This option sets try_verify_in_tasklet kernel dm-verity option
      (available since Linux kernel 6.0) to allow some performance
      improvement on specific systems.
    * Provide pkgconfig Require.private settings.
      While we do not completely provide static build on udev systems,
      it helps produce statically linked binaries in certain situations.
    * Always update automake library files if autogen.sh is run.
      For several releases, we distributed older automake scripts by mistake.
    * reencryption: Fix user defined moved segment size in LUKS2 decryption.
      The --hotzone-size argument was ignored in cases where the actual data
      size was less than the original LUKS2 data offset.
    * Delegate FIPS mode detection to configured crypto backend.
      System FIPS mode check no longer depends on /etc/system-fips file.
    * Update documentation, including FAQ and man pages.


author: andreas.stieger@gmx.de
changelog:
  - cryptsetup 2.6.1
    * bitlk: Fixes for BitLocker-compatible on-disk metadata parser
    * Fix possible iteration overflow in OpenSSL2 PBKDF2 crypto
      backend
    * portability and compilation fixes
    * verity: Fix possible hash offset setting overflow.
    * bitlk: Fix use of startup BEK key on big-endian platforms.
    * Do not initiate encryption (reencryption command) when the
      header and data devices are the same. If data device reduction
      is not requsted, this leads to data corruption since LUKS
      metadata was written over the data device.
    * Fix possible memory leak if crypt_load() fails.
    * Always use passphrases with a minimal 8 chars length for
      benchmarking, as used in some implementation of FIPS mode


author: pmonreal@suse.com
changelog:
  - FIPS: Remove not needed libcryptsetup12-hmac package that contains
    the HMAC checksums for integrity checking for FIPS. [bsc#1185116]
    * Remove the cryptsetup-rpmlintrc file.
    * Remove not needed fipscheck dependency.


author: pmonreal@suse.com
changelog:
  - Enable running the regression test suite.
  - Force a regeneration of the man pages from AsciiDoc.
  - Add LUKS1 and LUKS2 On-Disk Format Specification pdfs to doc.


author: pmonreal@suse.com
changelog:
  - Update to 2.7.0:
    * Full changelog in:
      mirrors.edge.kernel.org/pub/linux/utils/cryptsetup/v2.7/v2.7.0-ReleaseNotes
    * Introduce support for hardware OPAL disk encryption.
    * plain mode: Set default cipher to aes-xts-plain64 and password hashing
      to sha256.
    * Allow activation (open), luksResume, and luksAddKey to use the volume
      key stored in a keyring.
    * Allow to store volume key to a user-specified keyring in open and
      luksResume commands.
    * Do not flush IO operations if resize grows the device.
      This can help performance in specific cases where the encrypted device
      is extended automatically while running many IO operations.
    * Use only half of detected free memory for Argon2 PBKDF on systems
      without swap (for LUKS2 new keyslot or format operations).
    * Add the possibility to specify a directory for external LUKS2 token
      handlers (plugins).
    * Do not allow reencryption/decryption on LUKS2 devices with
      authenticated encryption or hardware (OPAL) encryption.
    * Do not fail LUKS format if the operation was interrupted on subsequent
      device wipe.
    * Fix the LUKS2 keyslot option to be used while activating the device
      by a token.
    * Properly report if the dm-verity device cannot be activated due to
      the inability to verify the signed root hash (ENOKEY).
    * Fix to check passphrase for selected keyslot only when adding
      new keyslot.
    * Fix to not wipe the keyslot area before in-place overwrite.
    * bitlk: Fix segfaults when attempting to verify the volume key.
    * Add --disable-blkid command line option to avoid blkid device check.
    * Add support for the meson build system.
    * Fix wipe operation that overwrites the whole device if used for LUKS2
      header with no keyslot area.
    * Fix luksErase to work with detached LUKS header.
    * Disallow the use of internal kernel crypto driver names in "capi"
      specification.
    * Fix reencryption to fail early for unknown cipher.
    * tcrypt: Support new Blake2 hash for VeraCrypt.
    * tcrypt: use hash values as substring for limiting KDF check.
    * Add Aria cipher support and block size info.
    * Do not decrease PBKDF parameters if the user forces them.
    * Support OpenSSL 3.2 Argon2 implementation.
    * Add support for Argon2 from libgcrypt
      (requires yet unreleased gcrypt 1.11).
    * Used Argon2 PBKDF implementation is now reported in debug mode
      in the cryptographic backend version. For native support in
      OpenSSL 3.2 or libgcrypt 1.11, "argon2" is displayed.
      If libargon2 is used, "cryptsetup libargon2" (for embedded
      library) or "external libargon2" is displayed.
    * Link only libcrypto from OpenSSL.
    * Disable reencryption for Direct-Access (DAX) devices.
    * Print a warning message if the device is not aligned to sector size.
    * Fix sector size and integrity fields display for non-LUKS2 crypt
      devices for the status command.
    * Fix suspend for LUKS2 with authenticated encryption (also suspend
      dm-integrity device underneath).
    * Update keyring and locking documentation and LUKS2 specification
      for OPAL2 support.
    * Remove patches fixed upstream:
    - cryptsetup-Check-for-physical-memory-available-also-in-PBKDF-be.patch
    - cryptsetup-Try-to-avoid-OOM-killer-on-low-memory-systems-withou.patch
    - cryptsetup-Use-only-half-of-detected-free-memory-on-systems-wit.patch


author: meissner@suse.com
changelog:
  - cryptsetup-fips140-3.patch: extend the password for PBKDF2 benchmarking
    to be more than 20 chars to meet FIPS 140-3 requirements (bsc#1229975)


author: lwang@suse.com
changelog:
  - Delete BuildRequire for device-mapper-devel for all symbols needed
    is created in ./include/.symlinks file.
  - Add link /usr/sbin/lvm file to avoid others using /usr/sbin/lvm


author: dimstar@opensuse.org
changelog:
  - Require device-mapper by device-mapper-devel: otherwise, the .so
    symlinks might happen to point to no target.


author: dimstar@opensuse.org
changelog:
  - Drop libudev-devel BuildRequires: we already buildrequire
    pkgconfig(libudev), which is the better choice, as it allows us
    to get libudev-mini-devel.


author: jeffm@suse.com
changelog:
  - Update to 2.02.114
    - Removed cmirrord-fix-s390-endian-issue.patch
    - Renumbered patches to allow for upstream patches to be applied
      before local ones.


author: lwang@suse.com
changelog:
  - delete lvm2-lvmetad.service from %service_add_pre/post and
    %service_del_preun/postun to avoid lvm2-lvmetad.service running
    when use_lvmetad=0.  (bnc#901859)
  - locking_type is set to 3(clustered lock) by default will output
    warning message if cmirrord is not running. Set to 1 to be same
    with upstream. (bnc#906710)
  - Set silent default to 0 to avoid some commands have no output
    and to be same with upstream. (bnc#888798)


author: dimstar@opensuse.org
changelog:
  - Add lvm2-do-not-strip-pdata_tools.patch: Change build system to
    not strip pdata_tools during installation. We need the file in
    tact in order to be able to produce valid debuginfo packages
    (boo#910327).


author: mpluskal@suse.com
changelog:
  - Re-add lvm2-lvmetad.service to %service_add_pre/post
  - Add service registrations for cmirrord and clvm
  - Correct category for device-mapper-devel


author: lwang@suse.com
changelog:
  - LVM2 does not support unpartitioned DASD device which has special
    format in the first 2 tracks and will siliently discards LVM2 lable
    information written to it when pvcreate. (bsc#894202)
    Add: dab3ebce-devices-Do-not-support-unpartitioned-DASD.patch
  - Delete lvm2-lvmetad.socket from %service_del_preun/postun to avoid
    lvmetad.service being started by 'systemctl retry-start' when updating
    package. (bsc#914415)


author: lwang@suse.com
changelog:
  - Moved BuildRequires: libcorosync-devel and libdlm-devel from lvm package
    to clmv package to avoid dracut build needing cluster stack to be built.
    (bsc#923127)


author: jeffm@suse.com
changelog:
  - Update to 2.02.120
    - Fixed numerous bugs(see WHATS_NEW for full details)
    - Deleted dab3ebce-devices-Do-not-support-unpartitioned-DASD.patch (upstream)


author: lzhong@suse.com
changelog:
  - 13-dm-disk.rules: Import ID_FS_XXX variables from udev
    database(bnc#909358)
      If the disk is unavailable we need to import the existing ID_FS_XXX
      variables from the database, otherwise the filesystem UUID won't
      be set and the by-uuid symlink will disappear, leading to
      intermittent boot failures
      + Import-ID_FS_XXX-variables-bnc909358.patch
  - 10-dm.rules: Reset state variables for spurious events (bsc#932300)
      + 10-dm.rules-Reset-state-variable-for-spurious-events.patch


author: lwang@suse.com
changelog:
  - dmeventd: fix dso_name compare error. dso_name is thought as not
    empty and doesn't create monitor thread. (bnc#935623)
    add: dmeventd-fix-dso-name-wrong-compare.patch


author: mpluskal@suse.com
changelog:
  - Update thin-provisioning tools to 0.5.3
    * Fix bug where the tools would crash if given a very large
      metadata device to restore to.
    * - thin_delta, thin_trim
    * --clear-needs-check flag for cache_check
    * space map checking for thin check
  - Drop unnecessary lvm2-do-not-strip-pdata_tools.patch


author: lwang@suse.com
changelog:
  - Fix boot failed due to segfault at libc (bnc#942755)
    add: lvmetad.c-ignore-lvmetad-global-handle-on-disconnect.patch


author: lwang@suse.com
changelog:
  - Split thin-provisioning-tools from lvm2 package for easier maintenance.
  - Update to lvm2-2.02.141 (device-mapper-1.02.115)
    - Remove patches:
      lvm2-do-not-strip-pdata_tools.patch: thin-provisioning-tools patch
      lvmetad.c-ignore-lvmetad-global-handle-on-disconnect.patch:
    already in upstream
      no_buildroot_shared.diff: LVM_SHARED_PATH dropped by upstream


author: lwang@suse.com
changelog:
  - Add 'Also=lvm2-lvmetad.socket' in '[Install]' section of lvm2-lvmetad.
    service to remove lvm2-lvmetad.socket when disable lvm2-lvmetad.service.
    (bsc#960044)
    add: lvm2-lvmetad.service-add-Also-lvm2-lvmetad.socket.patch


author: lwang@suse.com
changelog:
  - not output error message inside retry loops to avoid noisy error
    message being output inside retry loops in case of remove failure
    because device busy. (bsc#940298 boo#957059)
    add: libdm-iface-not-output-error-message-inside-retry-loop.patch


author: tchvatal@suse.com
changelog:
  - Remove device-mapper-static.patch as there should be no need to
    have static library here and it can be reenabled with some explanation
    if needed


author: tchvatal@suse.com
changelog:
  - Split out device-mapper and clvm to separate spec files
    * No factual changes just deletion in the spec to keep it out
      of interacting with those parts


author: tchvatal@suse.com
changelog:
  - Sync with device-mapper.spec, build only lvm and wipe devicemapper
    binaries
  - Install in /usr there is no technical reason to keep this out
    of /usr


author: tchvatal@suse.com
changelog:
  - Remove evms provides/obsoletes, last seen on sle10
  - Mark configs as such
  - Ghost the during-run created dirs
  - Install rcbla compat service symlinks


author: tchvatal@suse.com
changelog:
  - Regenerate lvm2 tmpfiles after install so they won't populate just
    after the reboot
  - Split out lvm2 libraries to separate subpkgs per standards
  - Rename versioning of plugins patch:
    * version-plugins-in-libdir -> version-plugins-in-libdir.patch


author: tchvatal@suse.com
changelog:
  - Add pre_checkin.sh to allow syncing of patches between packages:
    workflow = add everything to lvm2.spec and run pre_checkin.sh


author: tchvatal@suse.com
changelog:
  - Build and install properly cluster files
  - Remove csm-converter.tar.gz as the evms was last present on sle10
    and thus migration is bit out of scope today


author: tchvatal@suse.com
changelog:
  - Update to 2.02.152 release, read WHATS_NEW for detailed log.
  - Refresh patches:
    * 10-dm.rules-Reset-state-variable-for-spurious-events.patch
    * device-mapper-gcc-warnings.patch
    * device-mapper-link.patch
    * udev-Check-for-DM_NR_VALID_PATHS.patch
  - Slightly tweak btrfs patch as the code changed for the detection:
    * fsadm-add-support-for-btrfs.patch


author: tchvatal@suse.com
changelog:
  - Provide symlinks to 1.02 versions of dm and dm-event libs
    * this should sort out binary packages without the need of double
      rebuilding


author: tchvatal@suse.com
changelog:
  - Keep in sync the common configuration options that are shared among
    all the variants dm/lvm2/clvm


author: tchvatal@suse.com
changelog:
  - Update patch use-mirrortype-asdefault-whenclvmdrunning.patch
    to match up the patches/pvmove_support_clustered_vg.diff and not
    use the define declared only when building clvm codebase;
    it is still broken if someone changes the PID location, but at least
    it now does not depend on clvm code
  - Regenerate_initrd in post of the lvm2 main pkg
  - Update baselibs to point to split-out devicemapper libraries


author: tchvatal@suse.com
changelog:
  - Add conflicts on unsplit packages to allow smooth upgrade path
    Also do the conflict properly in baselibs.conf


author: tchvatal@suse.com
changelog:
  - Add compat symlinks for binaries to /sbin/ to avoid errors on
    hardcoded systems, obsolete them with leap 43


author: tchvatal@suse.com
changelog:
  - Update to 2.02.155 release, read WHATS_NEW for detailed log.
    * Mostly few bugfixes around caching
  - Refresh patch pvmove_support_clustered_vg.diff


author: tchvatal@suse.com
changelog:
  - Update to 2.02.160 release, read WHATS_NEW for detailed log.
    * Most notable is lvconvert refactor/enhancements
    * Refresh patch:
      + cluster_support_mirrord_log.diff


author: tchvatal@suse.com
changelog:
  - Update to 2.02.164 release, WHATS_NEW for changelog
    * Mostly because the old tarball was no longer available
    * Refresh fuzz on patch:
      + make-mirror-legs-on-different-tag-pvs.patch
      + cluster_support_mirrord_log.diff
  - Update patch to use correct api:
    + make-mirror-legs-on-different-tag-pvs.patch


author: tchvatal@suse.com
changelog:
  - This is sync commit from Leap/SLE12 only
  - Add patch pvcreate-enhance-the-error-message.patch bsc#960744
  - Modify GPL-2.0 to GPL-2.0+ and LGPL-2.1 to LGPL-2.1+ to avoid
    license conflict with thin-provisioning-tools which is using GPL-3.0
  - Also contains fix for bsc#969310
  - Fix clvmd.ocf and cmirrord to remove "-d" option for cmirrod
    (bsc#971334)
  - Fix clvmd.ocf to add lvmconf --enable-cluster before start daemon
    when locking_type is not 3 or use_lvmetad is 1 in setting
    (bsc#970439)
  - Modified spec to enable blkid-wiping (fate#319908)
  - Fix clvmd binary not found in case that users still use RA from
    ocf:lvm2:clvm (bsc#980200)
    Add sbindir=$HA_SBIN_DIR for clvmd.ocf and cmirrord.ocf
  - The bsc#979635 wnd bsc#991181 as fixed in past thanks to proper /usr
    migration code
  - Modified raid10_segtype_default from "mirror" to "raid10"(bsc#982329)
  - Remove lvm2-clvmd/cmirrord.service and related activation services
    from %service_add _pre/post/preun/postun because we start clvmd
    /clmirrord and activate via pacemaker and RA. (bsc#980296)
  - Lvchange improve refresh by trying to deactivate snapshot thinLV
    in case it's preventing merge process change integrated upstream.
    (bsc#984321)
  - Fixed in past bsc#992843
  - Fixed by upstream bsc#984321
  - Fixed by upstream bsc#970943
  - 69-dm-lvm-metad.rules: Do not process rules for multipath
    devices (bsc#bsc#990538, bsc#986734)
    Add: 69-dm-lvm-metad.rules-Do-not-process-rules-for-multi.patch
  - Rewrite patches to include patch header:
    * 10-dm.rules-Reset-state-variable-for-spurious-events.patch
    * device-mapper-link
    * device-mapper-type_punning.diff
    * udev_rules-update.diff
  - Sync also lvm.conf


author: tchvatal@suse.com
changelog:
  - Version update to 2.02.168 release, see WHATS_NEW and WHATS_NEW_DM
    files for detailed changelogs
    * Refresh patch cluster_support_mirrord_log.diff


author: tchvatal@suse.com
changelog:
  - Remove special case for md (bsc#1012973)
    * remove-special-case-for-md-in-69-dm-lvm-metadata.rul.patch


author: zren@suse.com
changelog:
  - udev: simplify special-case for md in 69-dm-lvm-metadata.rules
    * fix regression of bsc#1012973
    * drop remove-special-case-for-md-in-69-dm-lvm-metadata.rul.patch
    * add simplify-special-case-for-md-in-69-dm-lvm-metadata.patch


author: zren@suse.com
changelog:
  - Fix several issues about clvmd/cmorriord RAs (bsc#1023283,
    bsc#1025560)
    * deal with time values  passed down with time units
    * make correct "return code"
    * fix format issue that tab messes up with spaces


author: zren@suse.com
changelog:
  - Improve the layout and readability of spec files
    * Place subpackages' sections at the bottom of spec file, making
    the layout more reasonable: 1. main package's spec sections are
    contiguous without a break; 2. subpackage's spec spections can
    also be placed together.
    * Get rid of wild-card usage in %files section; spec file is a
    perfect place for packager to know what files are exactly delivered
    with each RPMs; staring at wild-card doesn't give much information.
    * Put bsc#xxx at previous line of each SUSE patch at my best, some
    are still missing.


author: zren@suse.com
changelog:
  - Add 'lvm2-lockd' subpackage, fate#323203 to lvm2-clvm to not pull
    corosync and other deps to the core lvm2 package


author: tchvatal@suse.com
changelog:
  - Split configure options to have one per line
  - Pass over with spec-cleaner
  - Enable internal cache
  - Enable lvmpolld


author: jnelson-suse@jamponi.net
changelog:
  - Version update to 2.02.169 release, see WHATS_NEW and WHATS_NEW_DM
    files for detailed changelogs


author: zren@suse.com
changelog:
  - Update device mapper version to 1.02.138, see WHATS_NEW_DM for
    detailed changelogs
    * Drop obsolete lvmchange files accordingly
  - Refresh libdm-iface-not-output-error-message-inside-retry-loop.patch
  - Refresh make-mirror-legs-on-different-tag-pvs.patch
  - device-mapper-dmsetup-export.patch


author: tchvatal@suse.com
changelog:
  - Update to 2.02.170:
    * Few smal fixes around; obsoleted 169 release that was removed
      from mirrors
  - Refresh patch:
    * display-dm-name-for-lv-name.diff


author: arvidjaar@gmail.com
changelog:
  - BuildRequire modutils so build script detects modprobe and module
    autoloading works again (boo#983221)


author: zren@suse.com
changelog:
  - This patch has been dropped since SLE12 (bsc#952300)
    * removed sys_mount_instead_linux_fs.diff
  - Drop obsolete patches:
    * removed improve_probing.diff (bsc#49657)
    * removed no-inc-audit.diff
    * removed suppress_format1_size_warning.diff
  - Add more bug/fate references, and reorder the patches accordingly


author: tchvatal@suse.com
changelog:
  - Remove comments breaking scriptlets:
    * warning: %postun(libdevmapper1_03-1.02.137-5.1.x86_64) scriptlet failed


author: zren@suse.com
changelog:
  - Fix compiling issue of lvmlockd, bsc#1037309
    + Makefile-skip-compliling-daemons-lvmlockd-directory.patch


author: zren@suse.com
changelog:
  - Fix test failures about read ahead issue, see bsc#1043040
    + bug-1043040_test-fix-read-ahead-issues-in-test-scripts.patch
  - Reorder the patches to put them into the right groups


author: zren@suse.com
changelog:
  - Backport fix for lvresize-full.sh failed, see bsc#1033691
    + bug-1033691_tests-missed-to-export-lvm-binary-for-fsadm.patch


author: zren@suse.com
changelog:
  - Update to LVM2.2.02.172
  - Cleanup spec file, and refresh patches
    * removed device-mapper-link.patch
    * removed bug-1033691_tests-missed-to-export-lvm-binary-for-fsadm.patch
    * removed Makefile-skip-compliling-daemons-lvmlockd-directory.patch
    * added bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch


author: zren@suse.com
changelog:
  - Don't create symlink for invisible device like thin-pool (bsc#1046591)
    * drop 10-dm.rules-Reset-state-variable-for-spurious-events.patch


author: tchvatal@suse.com
changelog:
  - Require device-mapper-devel rather than recommend. It is really
    needed (the .h files are required by the lvm2app and lvm2cmd)


author: zren@suse.com
changelog:
  - Dropped several not-upstreamed patches, some of them neither have
    history reference nor patch header, some were temporary workaround
    fix.
    - device-mapper-gcc-warnings.patch
    - device-mapper-type_punning.diff
    - fix-closedown-before-thread-finish.patch
    - libdm-iface-not-output-error-message-inside-retry-loop.patch
    - pvcreate-enhance-the-error-message.patch
    - pvmove_support_clustered_vg.diff
    - version-plugins-in-libdir.patch


author: mwilck@suse.com
changelog:
  - Dropped udev rule patches (bsc#1054363)
    * dropped udev_rules-update.diff
    * dropped device-mapper-dmsetup-export.patch
    * dropped udev-Check-for-DM_NR_VALID_PATHS.patch
    * dropped Import-ID_FS_XXX-variables-bnc909358.patch
    * dropped 69-dm-lvm-metad.rules-Do-not-process-rules-for-multi.patch


author: zren@suse.com
changelog:
  - Drop resource agents for clvmd and cmirror (bsc#1058680)
    - clvmd.ocf
    - cmirrord.ocf
  - Drop all patches for cmirror (bsc#1058661)
    - cluster_support_mirrord_log.diff
    - cmirrord_improvment_performance.patch
    - lvconvert-cluster-mirrored-disk-failed.patch
    - improve-mirror-legs-on-different-tag-pvs.patch
    - make-mirror-legs-on-different-tag-pvs.patch
    - use-mirrortype-asdefault-whenclvmdrunning.patch


author: zren@suse.com
changelog:
  - Update to LVM2.2.02.175
  - Use week dependency for lvm2-lockd on libdlm and sanlock
  - Rename/refresh patches:
    - display-dm-name-for-lv-name.diff to fate-309425_display-dm-name-for-lv-name.patch
    - fsadm-add-support-for-btrfs.patch to fate-31841_fsadm-add-support-for-btrfs.patch
    - dmeventd-fix-dso-name-wrong-compare.patch to bug-935623_dmeventd-fix-dso-name-wrong-compare.patch
    - lvm2-lvmetad.service-add-Also-lvm2-lvmetad.socket.patch to bug-960044_lvm2-lvmetad.service-add-Also-lvm2-lvmetad.socket.patch
    - simplify-special-case-for-md-in-69-dm-lvm-metadata.patch to bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch
    - lvm2-testsuite.patch to bug-950089_test-fix-lvm2-testsuite-build-error.patch


author: zren@suse.com
changelog:
  - Update to LVM2.2.02.176:
    Keep Install section only in lvm2-{lvmetad,lvmpolld}.socket systemd unit.
    Fix segfault in lvm_pv_remove in liblvm. (2.02.173)
    Do not allow storing VG metadata with LV without any segment.
    Fix printed message when thin snapshot was already merged.
    Remove created spare LV when creation of thin-pool failed.
    Avoid reading ignored metadata when mda gets used again.
    Fix detection of moved PVs in vgsplit. (2.02.175)
    Ignore --stripes/--stripesize on RAID takeover
    Improve used paths for generated systemd units and init shells.
    Disallow creation of snapshot of mirror/raid subLV (was never supported).
    Fix regression in more advanced vgname extraction in lvconvert (2.02.169).
    Allow lvcreate to be used for caching of _tdata LV.
    Avoid internal error when resizing cache type _tdata LV (not yet supported).
    Show original converted names when lvconverting LV to pool volume.
    Move lib code used only by liblvm into metadata-liblvm.c.
    Distinguish between device not found and excluded by filter.
    Monitor external origin LVs.
    Remove the replicator code, including configure --with-replicators.
    Allow lvcreate --type mirror to work with 100%FREE.
    Improve selection of resource name for complex volume activation lock.
    Avoid cutting first character of resource name for activation lock.
    Support for encrypted devices in fsadm.
    Improve thin pool overprovisioning and repair warning messages.
    Fix incorrect adjustment of region size on striped RaidLVs.
  - Drop: bug-960044_lvm2-lvmetad.service-add-Also-lvm2-lvmetad.socket.patch
  - Refresh: fate-31841_fsadm-add-support-for-btrfs.patch


author: zren@suse.com
changelog:
  - device-mapper.spec: fix wrong replacement of DM_VERSION (bsc#1072524)
  - Fixes failure of some testcases caused by nc behavior change (bsc#1072624)
    + bug-1072624_test-lvmetad_dump-always-timed-out-when-using-nc.patch
  - Refreshed fate-31841_fsadm-add-support-for-btrfs.patch
  - Update to LVM2.2.02.177
    When writing text metadata content, use complete 4096 byte blocks.
    Change text format metadata alignment from 512 to 4096 bytes.
    When writing metadata, consistently skip mdas marked as failed.
    Refactor and adjust text format metadata alignment calculation.
    Ensure _node_send_message always uses clean status of thin pool.
    Fix lvmlockd to use pool lock when accessing _tmeta volume.
    Report expected sanlock_convert errors only when retries fail.
    Avoid blocking in sanlock_convert on SH to EX lock conversion.
    Deactivate missing raid LV legs (_rimage_X-missing_Y_Z) on decativation.
    Categorise I/O with reason annotations in debug messages.
    Allow extending of raid LVs created with --nosync after a failed repair.
    Command will lock memory only when suspending volumes.
    Merge segments when pvmove is finished.
    Activation code for pvmove automatically discovers holding LVs for resume.
    Make a pvmove LV locking holder.
    Do not change critical section counter on resume path without real resume.
    Enhance activation code to automatically suspend pvmove participants.
    Prevent conversion of thin volumes to snapshot origin when lvmlockd is used.
    Add support for pvmove of cache and snapshot origins.
    Avoid using precommitted metadata for suspending pvmove tree.
    Deactivate activated LVs on error path when pvmove activation fails.
    Add "io" to log/debug_classes for logging low-level I/O.
    Avoid importing persistent filter in vgscan/pvscan/vgrename.
    Fix memleak of string buffer when vgcfgbackup runs in secure mode.
    Do not print error when clvmd cannot find running clvmd.
    Prevent start of new merge of snapshot if origin is already being merged.
    Fix offered type for raid6_n_6 to raid5 conversion (raid5_n).
    Deactivate sub LVs when removing unused cache-pool.
    Do not take backup with suspended devices.


author: zren@suse.com
changelog:
  - lvmlockd: add lockopt values for skipping selected locks (fate#323203)
    + fate-323203_lvmlockd-add-lockopt-values-for-skipping-selected-lo.patch


author: zren@suse.com
changelog:
  - clvmd: try to refresh device cache on the first failure
    (bsc#978055, bsc#1076042)
    + bug-978055_clvmd-try-to-refresh-device-cache-on-the-first-failu.patch


author: tchvatal@suse.com
changelog:
  - Fix detection of clvm that happens on compile time based on
    CLVM_PIDFILE, as we determine these features on runtime
    bsc#1080299:
    + bsc1080299-detect-clvm-properly.patch


author: mwilck@suse.com
changelog:
  - Fix handling of udev CHANGE events with systemd (bsc#1067312)
    + lvm2-69-dm-lvm-metad.rules-explicit-pvscan-rule.patch
    + lvm2-69-dm-lvm-metad.rules-set-systemd-vars-on-chang.patch


author: ghe@suse.com
changelog:
  - Fix issuing discard in test mode (bsc#1095960)
    + bug-1095960_dev_io-no-discard-in-testmode.patch


author: ghe@suse.com
changelog:
  - Update to LVM2.2.02.180
    Never send any discard ioctl with test mode.
    Fix thin-pool alloc which needs same PV for data and metadata.
    Extend list of non-memlocked areas with newly linked libs.
    Enhance vgcfgrestore to check for active LVs in restored VG.
    lvconvert: provide possible layouts between linear and striped/raid
    Fix unmonitoring of merging snapshots.
    Add missing -l description in fsadm man page.
    Cache can uses metadata format 2 with cleaner policy.
    Avoid showing internal error in lvs output or pvmoved LVs.
    Fix check if resized PV can also fit metadata area.
    Reopen devices RDWR only before writing to avoid udev issues.
    Change pvresize output confusing when no resize took place.
    Fix lvmetad hanging on shutdown.
    Fix mem leak in clvmd and more coverity issues.
    Fix that pvmove does not work (bsc#1080299)
  - Drop patches that have been merged upstream
    - fate-323203_lvmlockd-add-lockopt-values-for-skipping-selected-lo.patch
    - lvm2-69-dm-lvm-metad.rules-explicit-pvscan-rule.patch
    - lvm2-69-dm-lvm-metad.rules-set-systemd-vars-on-chang.patch
    - bug-1095960_dev_io-no-discard-in-testmode.patch
  - Refresh patches
    + bsc1080299-detect-clvm-properly.patch
    + bug-950089_test-fix-lvm2-testsuite-build-error.patch
  - Update spec files
    Fix BuildRequires package name for modprobe (bsc#1102668)
    Fix cmirrord LV creation/activation failure (bsc#1091863)
  - Fix building error in OBS due to the script interpreter
    + tests-specify-python3-as-the-script-interpreter.patch


author: ghe@suse.com
changelog:
  - Fix lvm2 activation issue when used on top of multipath
    bsc#998893
    + bug-998893_make_pvscan_service_after_multipathd.patch


author: ghe@suse.com
changelog:
  - Prevent writing beyond metadata area (bsc#1114113)
    + bug-1114113_metadata-prevent-writing-beyond-metadata-area.patch


author: ghe@suse.com
changelog:
  - Disable the LVM lock daemon using sanlock, in order to avoid the
    dependence on sanlock related packages (bsc#1121382)


author: ghe@suse.com
changelog:
  - Fix devices drop open error message (bsc#1122666)
    + bug-1122666_devices-drop-open-error-message.patch


author: heming.zhao@suse.com
changelog:
  - Fix using device aliases with lvmetad (bsc#1137296)
    + bug-1137296_pvremove-vgextend-fix-using-device-aliases-with-lvmetad.patch


author: ghe@suse.com
changelog:
  - Fix unknown feature in status message (bsc#1135984)
    + bug-1135984_cache-support-no_discard_passdown.patch


author: heming.zhao@suse.com
changelog:
  - Update to LVM2.2.03.05
    - To drop lvm2-clvm and lvm2-cmirrord rpms (jsc#PM-1324)
    - Fix Out of date package (bsc#1111734)
    - Fix occasional slow shutdowns with kernel 5.0.0 and up (bsc#1137648)
    - Remove clvmd
    - Remove lvmlib (api)
    - Remove lvmetad
  - Drop patches that have been merged into upstream
    - bug-1114113_metadata-prevent-writing-beyond-metadata-area.patch
    - bug-1137296_pvremove-vgextend-fix-using-device-aliases-with-lvmetad.patch
    - bug-1135984_cache-support-no_discard_passdown.patch
  - Drop patches that have been nonexist/unsupport in upstream
    - bsc1080299-detect-clvm-properly.patch
    - bug-998893_make_pvscan_service_after_multipathd.patch
    - bug-978055_clvmd-try-to-refresh-device-cache-on-the-first-failu.patch
    - bug-950089_test-fix-lvm2-testsuite-build-error.patch
    - bug-1072624_test-lvmetad_dump-always-timed-out-when-using-nc.patch
    - tests-specify-python3-as-the-script-interpreter.patch
  - Update spec files
    - merge device-mapper, lvm2-lockd, lvm2 into one spec file
    - clvmd/lvmlib (api)/lvmetad had been removed, so delete related context in spec file
  - Update lvm.conf files
    - remove all lvmetad lines/keywords
    - add event_activation
    - remove fallback_to_lvm1 & related items
    - remove locking_type/fallback_to_clustered_locking/fallback_to_local_locking items
    - remove locking_library item
    - remove all special filter rules


author: ghe@suse.com
changelog:
  - Avoid creation of mixed-blocksize PV on LVM volume groups (bsc#1149408)
    + bug-1149408_Fix-rounding-writes-up-to-sector-size.patch
    + bug-1149408_vgcreate-vgextend-restrict-PVs-with-mixed-block-size.patch
  - Update lvm.conf files
    - add devices/allow_mixed_block_sizes item


author: mwilck@suse.com
changelog:
  - Fix LV activation issues (boo#1152378, rh#1727270)
    + bug-1152378-md-component-detection-for-differing-PV-and-device-s.patch
    + bug-1152378-pvscan-fix-PV-online-when-device-has-a-different-siz.patch


author: heming.zhao@suse.com
changelog:
  - lvm2-pvscan needs process speed improvement on a large scale PVs (jcs#SLE-5498)
    + jcs-SLE5498_pvscan-allow-use-of-noudevsync-option.patch


author: heming.zhao@suse.com
changelog:
  - Fix udev rules issue (bsc#1154655)
    + bug-1154655_udev-remove-unsupported-OPTIONS-event_timeout-rule.patch


author: heming.zhao@suse.com
changelog:
  - backport upstream patches for passing lvm2 testsuite (bsc#1158628)
    + bug-1158628_01-tests-replaces-grep-q-usage.patch
    + bug-1158628_02-tests-fix-ra-checking.patch
    + bug-1158628_03-tests-simplify-some-var-settings.patch
    + bug-1158628-04-pvmove-correcting-read_ahead-setting.patch
    + bug-1158628_05-activation-add-synchronization-point.patch
    + bug-1158628_06-pvmove-add-missing-synchronization.patch
    + bug-1158628_07-activation-extend-handling-of-pending_delete.patch
    + bug-1158628_08-lv_manip-add-synchronizations.patch
    + bug-1158628_09-lvconvert-improve-validation-thin-and-cache-pool-con.patch
    + bug-1158628_10-thin-activate-layer-pool-aas-read-only-LV.patch
    + bug-1158628_11-tests-mdadm-stop-in-test-cleanup.patch
    + bug-1158628_12-test-increase-size-of-raid10-LV-allowing-tests-to-su.patch
    + bug-1158628_13-lvconvert-fix-return-value-when-zeroing-fails.patch
    + bug-1158628_14-tests-add-extra-settle.patch
    + bug-1158628_15-test-Fix-handling-leftovers-from-previous-tests.patch
    - bug-1043040_test-fix-read-ahead-issues-in-test-scripts.patch


author: heming.zhao@suse.com
changelog:
  - backport patches for lvm2 to avoid software abnormal work (bsc#1158861)
    + bug-1158861_01-config-remove-filter-typo.patch
    + bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch
    + bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch
    + bug-1158861_04-fix-duplicate-pv-size-check.patch
    + bug-1158861_05-hints-fix-copy-of-filter.patch
    + bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch
    + bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch
    + bug-1158861_08-hints-fix-mem-leaking-buffers.patch
    + bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch


author: heming.zhao@suse.com
changelog:
  - LVM Metadata Error: Error writing device at 4096 length 512 (bsc#1150021)
    + bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch
    + bug-1150021_02-bcache-add-bcache_abort.patch
    + bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch
    + bug-1150021_04-bcache-add-unit-test.patch
    + bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch
    + bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch
  - Update patch, according to bug-1150021_01-scanning-xxx.patch
    + bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch


author: heming.zhao@suse.com
changelog:
  - vgreduce --removemissing with cache devices will remove lvs (bsc#1157736)
    + bug-1157736-add-suggestion-message-for-mirror-LVs.patch


author: heming.zhao@suse.com
changelog:
  - fix patch name typo
    - bug-1158628-04-pvmove-correcting-read_ahead-setting.patch
    + bug-1158628_04-pvmove-correcting-read_ahead-setting.patch


author: heming.zhao@suse.com
changelog:
  - Add missing patch, which mistakenly removed in lvm2 update
    + bug-998893_make_pvscan_service_after_multipathd.patch
  - Change lvm2.spec for fixing build error
    + lvm2.spec


author: heming.zhao@suse.com
changelog:
  - removing LVM cache with cache volume does not remove the cache volume (bsc#1171907)
    + bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch


author: heming.zhao@suse.com
changelog:
  - problem with LVM cache (data loss) (bsc#1172566)
    + bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch


author: heming.zhao@suse.com
changelog:
  - LVM failing to activate hot spare on surprise removal (bsc#1175110)
    + bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch
  - change lvm2.spec source URL
    - lvm2.spec


author: ghe@suse.com
changelog:
  - Update lvm2.spec file (bsc#1174336)
    - enable lvmlockd remote refresh using libdlmcontrol
    - update libdlm dependency relationship


author: heming.zhao@suse.com
changelog:
  - lvcreate not wiping the lvm signature without prompting with --yes parameter (bsc#1177734)
    + bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch


author: heming.zhao@suse.com
changelog:
  - Update lvm2.spec file (bsc#1177533)
    - in %postun, disable restart blk-availability.service & lvm2-monitor.service


author: heming.zhao@suse.com
changelog:
  - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
    - change lvm.conf item external_device_info_source from none to udev
  - comment out lvm.conf item preferred_names by default (bsc#1179738)
    - comment out preferred_names


author: heming.zhao@suse.com
changelog:
  - back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319)
    + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch
    + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch
    + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch
    + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch
    + bug-1181319_05-cov-check-sscanf-result.patch


author: heming.zhao@suse.com
changelog:
  - revert commit which caused a regression:
    lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
    - change lvm.conf item external_device_info_source from none to udev


author: ghe@suse.com
changelog:
  - Add metadata-based autoactivation property for VG and LV (bsc#1178680)
    + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch


author: heming.zhao@suse.com
changelog:
  - LVM cannot be disabled on boot (bsc#1184687)
    + bug-1184687_Add-nolvm-for-kernel-cmdline.patch
  - Update patch for avoiding apply warning message
    + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch


author: heming.zhao@suse.com
changelog:
  - Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190)
    + bug-1185190_01-pvscan-support-disabled-event_activation.patch
    + bug-1185190_02-config-improve-description-for-event_activation.patch


author: wolfgang.frisch@suse.com
changelog:
  - Link test as position independent executable (bsc#1184124).
    + bug-1184124-link-tests-as-PIE.patch


author: heming.zhao@suse.com
changelog:
  - vgextend crash when extending VG with missing PV (bsc#1191019)
    + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch


author: heming.zhao@suse.com
changelog:
  - starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905)
    + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch
  - LVM vgimportclone on hardware snapshot does not work (bsc#1193181)
    + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch


author: mwilck@suse.com
changelog:
  - udev: create symlinks and watch even in suspended state (bsc#1195231)
    + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch


author: heming.zhao@suse.com
changelog:
  - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
    + change lvm.conf item external_device_info_source from none to udev
    + bug-1179691_config-set-external_device_info_source-none.patch


author: heming.zhao@suse.com
changelog:
  - lvm reports udev database has incomplete information on devices (bsc#1202011)
    + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch


author: heming.zhao@suse.com
changelog:
  - Upgrade lvm2 from LVM2.2.03.05 to LVM2.2.03.16 (bsc#1201616)
    - device-mapper version upgrade to 1.02.185 (bsc#1199074)
  - Drop patches that have been merged into upstream
    - bug-1122666_devices-drop-open-error-message.patch
    - bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch
    - bug-1149408_Fix-rounding-writes-up-to-sector-size.patch
    - bug-1149408_vgcreate-vgextend-restrict-PVs-with-mixed-block-size.patch
    - bug-1152378-md-component-detection-for-differing-PV-and-device-s.patch
    - bug-1152378-pvscan-fix-PV-online-when-device-has-a-different-siz.patch
    - jcs-SLE5498_pvscan-allow-use-of-noudevsync-option.patch
    - bug-1154655_udev-remove-unsupported-OPTIONS-event_timeout-rule.patch
    - bug-1158628_01-tests-replaces-grep-q-usage.patch
    - bug-1158628_02-tests-fix-ra-checking.patch
    - bug-1158628_03-tests-simplify-some-var-settings.patch
    - bug-1158628_04-pvmove-correcting-read_ahead-setting.patch
    - bug-1158628_05-activation-add-synchronization-point.patch
    - bug-1158628_06-pvmove-add-missing-synchronization.patch
    - bug-1158628_07-activation-extend-handling-of-pending_delete.patch
    - bug-1158628_08-lv_manip-add-synchronizations.patch
    - bug-1158628_09-lvconvert-improve-validation-thin-and-cache-pool-con.patch
    - bug-1158628_10-thin-activate-layer-pool-aas-read-only-LV.patch
    - bug-1158628_11-tests-mdadm-stop-in-test-cleanup.patch
    - bug-1158628_12-test-increase-size-of-raid10-LV-allowing-tests-to-su.patch
    - bug-1158628_13-lvconvert-fix-return-value-when-zeroing-fails.patch
    - bug-1158628_14-tests-add-extra-settle.patch
    - bug-1158628_15-test-Fix-handling-leftovers-from-previous-tests.patch
    - bug-1158861_01-config-remove-filter-typo.patch
    - bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch
    - bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch
    - bug-1158861_04-fix-duplicate-pv-size-check.patch
    - bug-1158861_05-hints-fix-copy-of-filter.patch
    - bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch
    - bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch
    - bug-1158861_08-hints-fix-mem-leaking-buffers.patch
    - bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch
    - bug-1150021_02-bcache-add-bcache_abort.patch
    - bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch
    - bug-1150021_04-bcache-add-unit-test.patch
    - bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch
    - bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch
    - bug-1157736-add-suggestion-message-for-mirror-LVs.patch
    - bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch
    - bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch
    - bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch
    - bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch
    - bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch
    - bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch
    - bug-1181319_03-lvmlockctl-use-inline-initilizers.patch
    - bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch
    - bug-1181319_05-cov-check-sscanf-result.patch
    - bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch
    - bug-1185190_01-pvscan-support-disabled-event_activation.patch
    - bug-1185190_02-config-improve-description-for-event_activation.patch
    - bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch
    - bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch
    - bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch
    - bug-1202011_vgchange-monitor-don-t-use-udev-info.patch
    - bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch
    - bug-1179691_config-set-external_device_info_source-none.patch
  - Update patch
    - fate-309425_display-dm-name-for-lv-name.patch
    - bug-1184687_Add-nolvm-for-kernel-cmdline.patch
  - replace exist patch with fixed bug patches
    - (remove) fate-31841_fsadm-add-support-for-btrfs.patch
    - (add) fate-31841-01_fsadm-add-support-to-resize-check-btrfs-filesystem.patch
    - (add) fate-31841-02_man-add-support-for-btrfs.patch
    - (add) fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch
  - Add upstream patch
    - 0001-devices-file-move-clean-up-after-command-is-run.patch
    - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch
    - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch
    - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch
    - 0005-pvdisplay-restore-reportformat-option.patch
    - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch
    - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch
    - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch
    - 0009-mm-remove-libaio-from-being-skipped.patch
    - 0010-dmsetup-check-also-for-ouf-of-range-value.patch
    - 0011-devices-drop-double-from-sysfs-path.patch
    - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch
    - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch
    - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch
  - update lvm2.spec
    - indent some lines for easy read
    - add new binraries: lvmdevices lvm_import_vdo vgimportdevices dmfilemapd
    - remove config item '--enable-cmirrord', which was obsoleted.
    - remove config item '--enable-realtime', which became default setting.
    - add config item "--with-cluster=internal" for cluster test
    - add config item "--enable-dmfilemapd" for new daemon dmfilemapd
    - add new man: lvmautoactivation.7 lvmdevices.8 lvm_import_vdo.8 dmfilemapd.8
    - remove lvm2-activation-generator & lvm2-activation-generator.8
    - remove lvm2-pvscan@.service
    - replace 69-dm-lvm-metad.rules with 69-dm-lvm.rules
    - change %post behaviour, only do deleting job for non-link folder (bsc#1198523)
  - lvm.conf
    - follow upstream style, comment out default value (bsc#1179739)


author: heming.zhao@suse.com
changelog:
  - lvmlockd is not supporting sanlock (bsc#1203482)
    - set 1 for _supportsanlock in lvm2.spec for enabling sanlock.


author: heming.zhao@suse.com
changelog:
  - lvm.conf should re-enable commented out option use_lvmlockd (bsc#1204219)
    - re-enable "use_lvmlockd = 0" in lvm.conf


author: heming.zhao@suse.com
changelog:
  - dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074)
    - in lvm2.spec, change device_mapper_version from 1.02.185 to %{lvm2_version}_1.02.185


author: amit.chaudhary@suse.com
changelog:
  - killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216)
    - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch


author: heming.zhao@suse.com
changelog:
  - multipath_component_detection = 0 in lvm.conf does not have any effect (bsc#1212613)
    - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch


author: heming.zhao@suse.com
changelog:
  - blkdeactivate calls wrong mountpoint cmd (bsc#1214071)
    + bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch


author: glass.su@suse.com
changelog:
  - Update lvm2 from LVM2.2.03.16 to LVM2.2.03.22 (jsc#PED-6753)
    - device-mapper version upgrade to 1.02.196
  - Drop patches that have been merged into upstream
    - 0001-devices-file-move-clean-up-after-command-is-run.patch
    - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch
    - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch
    - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch
    - 0005-pvdisplay-restore-reportformat-option.patch
    - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch
    - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch
    - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch
    - 0009-mm-remove-libaio-from-being-skipped.patch
    - 0010-dmsetup-check-also-for-ouf-of-range-value.patch
    - 0011-devices-drop-double-from-sysfs-path.patch
    - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch
    - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch
    - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch
    - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch
    - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch
  - Add upstream patch
    + 0001-lvconvert-swapmetadata-fix-lvmlockd-locking.patch
    + 0002-lvconvert-fix-ret-values-fro-integrity-remove.patch
    + 0003-lvconvert-fix-regresion-from-integrity-check.patch
    + 0004-gcc-cleanup-warnings.patch
    + 0005-lvmlockd-fix-thick-to-thin-lv-conversion.patch
    + 0006-lvmlockd-let-lockd_init_lv_args-set-lock_args.patch
    + 0007-lvmlockd-fix-lvconvert-to-thin-pool.patch
    + 0008-lvconvert-run-error-path-code-only-for-shared-VG.patch
    + 0009-vgchange-acquire-an-exclusive-VG-lock-for-refresh.patch
    + 0010-lvmlockd-client-mutex-ordering.patch
    + 0011-filesystem-move-stat-after-open-check.patch
    + 0012-tests-check-for-writecache.patch
    + 0013-lvresize-fix-32-bit-overflow-in-size-calculation.patch
    + 0014-gcc-fix-warnings-for-x32-architecture.patch
    + 0015-gcc-warning-missing-braces-around-initializer.patch
    + 0016-test-improve-aux-teardown.patch
    + 0017-tests-aux-try-with-extra-sleep.patch
    + 0018-tests-aux-using-singl-lvmconf-call.patch
    + 0019-tests-missing-to-check-for-writecache-support.patch
    + 0020-tests-pvmove-large-disk-area.patch
    + 0021-tests-enforce-full-fs-check.patch
    + 0022-tests-update-for-work-in-fake-dev-environment.patch
    + 0023-tests-skip-test-when-lvmdbusd-runs-on-the-system.patch
    + 0024-tests-better-slowdown.patch
  - Update patch
    - bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch
    - bug-1184124-link-tests-as-PIE.patch
    - bug-1184687_Add-nolvm-for-kernel-cmdline.patch
    - fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch
  - Rename & Update patch
    - bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch
    + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-rules.patch
  - update lvm2.spec
    - change upstream_device_mapper_version to 1.02.196
    - change device_mapper_version to %{lvm2_version}_1.02.196
    - add config item "-with-libexecdir=%{_libexecdir}" to fix libexec path since commit a2d33cdf
    - add new binary "%{_libexecdir}/lvresize_fs_helper" to lvm2 package


author: glass.su@suse.com
changelog:
  - Update lvm2 from LVM2.2.03.16 to LVM2.2.03.22 (jsc#PED-6339)
    * 2.03.22:
    * Fix pv_major/pv_minor report field types so they are integers, not strings.
    * Add lvmdevices --delnotfound to delete entries for missing devices.
    * Always use cachepool name for metadata backup LV for lvconvert --repair.
    * Make metadata backup LVs read-only after pool's lvconvert --repair.
    * Handle 'lvextend --usepolicies' for pools for all activation variants.
    * Fix memleak in vgchange autoactivation setup.
    * Support conversion from thick to fully provisioned thin LV.
    * Cache/Thin-pool can use error and zero volumes for testing.
    * Individual thin volume can be cached, but cannot take snapshot.
    * internal support for handling error and zero target (for testing).
    * COW above trimmed maximal size is does not return error.
    * Add lvm.conf thin_restore and cache_restore settings.
    * Handle multiple mounts while resizing volume with a FS.
    * Handle leading/trailing spaces in sys_wwid and sys_serial used by deivce_id.
    * Fix failing -S|--select for non-reporting cmds if using LV info/status fields.
    * Allow snapshots of raid+integrity LV.
    * Fix multisegment RAID1 allocator to prevent using single disk for more legs.
    * 2.03.21:
    * Allow (write)cache over raid+integrity LV.
    * 2.03.20:
    * Fix segfault if using -S|--select with log/report_command_log=1 setting.
    * 2.03.19:
    * Do not reset SYSTEMD_READY variable in udev for PVs on MD and loop devices.
    * Ensure udev is processing origin LV before its thick snapshots LVs.
    * 2.03.18:
    * Fix warning for thin pool overprovisioning on lvextend.
    * Add support for writecache metadata_only and pause_writeback settings.
    * Fix missing error messages in lvmdbusd.
    * 2.03.17:
    * Add new options (--fs, --fsmode) for FS handling when resizing LVs (btrfs is unsupported).
    * Fix 'lvremove -S|--select LV' to not also remove its historical LV right away.
    * Fix lv_active field type to binary so --select and --binary applies properly.
    * Error out in lvm shell if using a cmd argument not supported in the shell.
    * Fix lvm shell's lastlog command to report previous pre-command failures.
    * Add --valuesonly option to lvmconfig to print only values without keys.
    * Add json_std output format for more JSON standard compliant version of output.
    * Fix many corner cases in device_id, including handling of S/N duplicates.
    * Fix various issues in lvmdbusd.
  - device-mapper version upgrade to 1.02.196
    * Improve parallel creation of /dev/mapper/control device node.
    * Import previous ID_FS_* udev records in 13-dm-disk.rules for suspended DM dev.
    * Remove NAME="mapper/control" rule from 10-dm.rules to avoid udev warnings.
    * Improve 'dmsetup create' without given table line with new kernels.
    * Add DM_REPORT_GROUP_JSON_STD for more JSON standard compliant output format.
  - Drop patches that have been merged into upstream
    - 0001-devices-file-move-clean-up-after-command-is-run.patch
    - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch
    - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch
    - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch
    - 0005-pvdisplay-restore-reportformat-option.patch
    - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch
    - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch
    - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch
    - 0009-mm-remove-libaio-from-being-skipped.patch
    - 0010-dmsetup-check-also-for-ouf-of-range-value.patch
    - 0011-devices-drop-double-from-sysfs-path.patch
    - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch
    - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch
    - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch
    - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch
    - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch
  - Add upstream patch
    + 0001-lvconvert-swapmetadata-fix-lvmlockd-locking.patch
    + 0002-lvconvert-fix-ret-values-fro-integrity-remove.patch
    + 0003-lvconvert-fix-regresion-from-integrity-check.patch
    + 0004-gcc-cleanup-warnings.patch
    + 0005-lvmlockd-fix-thick-to-thin-lv-conversion.patch
    + 0006-lvmlockd-let-lockd_init_lv_args-set-lock_args.patch
    + 0007-lvmlockd-fix-lvconvert-to-thin-pool.patch
    + 0008-lvconvert-run-error-path-code-only-for-shared-VG.patch
    + 0009-vgchange-acquire-an-exclusive-VG-lock-for-refresh.patch
    + 0010-lvmlockd-client-mutex-ordering.patch
    + 0011-filesystem-move-stat-after-open-check.patch
    + 0012-tests-check-for-writecache.patch
    + 0013-lvresize-fix-32-bit-overflow-in-size-calculation.patch
    + 0014-gcc-fix-warnings-for-x32-architecture.patch
    + 0015-gcc-warning-missing-braces-around-initializer.patch
    + 0016-test-improve-aux-teardown.patch
    + 0017-tests-aux-try-with-extra-sleep.patch
    + 0018-tests-aux-using-singl-lvmconf-call.patch
    + 0019-tests-missing-to-check-for-writecache-support.patch
    + 0020-tests-pvmove-large-disk-area.patch
    + 0021-tests-enforce-full-fs-check.patch
    + 0022-tests-update-for-work-in-fake-dev-environment.patch
    + 0023-tests-skip-test-when-lvmdbusd-runs-on-the-system.patch
    + 0024-tests-better-slowdown.patch
  - Update patch
    - bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch
    - bug-1184124-link-tests-as-PIE.patch
    - bug-1184687_Add-nolvm-for-kernel-cmdline.patch
    - fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch
  - Rename & Update patch
    - bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch
    + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-rules.patch
  - update lvm2.spec
    - change upstream_device_mapper_version to 1.02.196
    - change device_mapper_version to %{lvm2_version}_1.02.196
    - add config item "-with-libexecdir=%{_libexecdir}" to fix libexec path since commit a2d33cdf
    - add new binary "%{_libexecdir}/lvresize_fs_helper" to lvm2 package


author: heming.zhao@suse.com
changelog:
  - LVM2 mirror attached to another node couldn't be converted into linear LV (bsc#1231796)
    + bug-1231796_lvconvert-fix-lvconvert-m-0-for-in-sync-legs.patch


author: kukuk@suse.de
changelog:
  - Update to version 0.0.0+git20190807.7aedb57:
    * Refactor getfilecontent functions
    * Update example file
    * Add econf prefix to public API functions
    * Add cmake targets for debugging
    * Fix build with cmake
    * Fix build with autotools
    * Move Key_File allocation from the stack to the heap
    * Move Key_File create functions to libeconf.c
    * Move destroy functions from helpers.c to libeconf.c
    * Add macro to set supported types generic.


author: kukuk@suse.de
changelog:
  - Update to version 0.0.0+git20190820.742af8c:
    * Remove accidental .swp file
    * Update example with conf.d directory
    * Remove regex, replace with strchr(delim, ch)
    * Add symbol versioning Don't ignore complete lib directory
    * Include all headers in tar archive
    * Don't define our own errno
    * Remove wrong commit
    * Add some basic tests


author: kukuk@suse.de
changelog:
  - Update to version 0.0.0+git20190822.bb9702b:
    * Ignore /usr file if /etc exists when merging
    * Add NULL value handling
    * Update merge example
    * Rework merge_functionality
    * Use deep copies instead of pointers for merged files
    * Replace [] with KEY_FILE_NULL_VALUE
    * Refactor getfilecontent functions
    * Remove cmake files
    * Fix test cases
    * Update libeconf.c
    * Change License from LGPL-2.1 to MIT
    * libeconf.pc should only be deleted on distclean, not normal clean
    * Fix delim argument
    * Add more test cases for login.defs and wrong arguments
    * Link libeconf against libm, so that it is enough to link an application against libeconf and developers don't need to bother with other dependencies
    * Add autogen.sh, which calls autoconf/automake/libtool in the correct order to create the configure script


author: kukuk@suse.de
changelog:
  - Update to version 0.0.0+git20190823.acd8cdf:
    * Update ccpp.yml
    * Fix crash in strcmp, if strchr returns NULL
    * Add error reporting to econf_merge_key_files and adjust the depending code.
    * setStringValue return NULL on error/key not found
    * Add framework for correct error reporting
    * Disable searching through XDG dirs for now
    * Add test cases for econf_get_conf_from_dirs
    * Update comment setValue -> econf_setValue
    * Update test cases to use econf_destroy
    * Replace econf_afree with econf_destroy in example
    * Add _generic macro to free memory of econf_ functions
    * Add tst-merge2 to .gitignore
    * Fix pointer arithmetic
    * Adjust Makefiles and code to make "make distcheck" working


author: kukuk@suse.de
changelog:
  - Update to version 0.0.0+git20190826.9e69003:
    * Update ccpp.yml
    * Add --enable-compiler-checks option to configure, enables AddressSanitizer
    * Fix printf format directive
    * Rework set*Value functions for error checking and error handling
    * Add tst-getconfdirs3: verify we can load original file without local changes
    * Error handling for econf_getGroups and econf_getKeys
    * More errorreporting changes
    * Fix make distcheck/don't mess around with libtool install/uninstall, this breaks to much other stuff.
    * Autotools cleanup and fixes
    * Fix logindefs1 test case


author: kukuk@suse.de
changelog:
  - Update to version 0.0.0+git20190826.99b6bf3:
    * Add more "const".
    * Fix setString and setBoolean
    * Add test suite which sets and gets all possible kind of types. Some are failing, so mark this test as XFAIL.
    * Start marking some string arguments/results as const
    * Optimize some strdup away
    * Mark econf_write_key_file as ALPHA as the API is not stable


author: kukuk@suse.de
changelog:
  - Update to version 0.0.0+git20190827.8374759:
    * Fix missing return
    * Remove XFAIL for tst-setgetvalues1
    * Fix representation of float and double values
    * Add preliminary test case for group handling
    * NULL terminate string returned by addbrackets
    * Fix addbrackets function


author: kukuk@suse.de
changelog:
  - Update to version 0.0.0+git20190827.b243e6c:
    * getStringValueNum returns a newly allocated string or NULL in error case.


author: kukuk@suse.de
changelog:
  - Update to version 0.0.0+git20190827.5ed5492:
    * Mark all input char pointer as const in the official API


author: kukuk@suse.de
changelog:
  - Update to version 0.0.0+git20190828.74eeb32:
    * Fix tst-arguments3 and tst-arguments4 and only use error return code.
    * Bug fixes for new API
    * Change API of econf_get* and econf_set* functions to return error code direct.
    * Fix some compiler warnings
    * Prevent possible crash when parsing 0xFF
    * Add "--enable-compiler-warnings" option to enable much more GCC compiler warnings
    * Fix more cppcheck warnings
    * Fix github actions build
    * Update bin/Makefile.am to work with Asan
    * Add missing tst-getconfdirs4-data to EXTRA_DIST
    * Fix some cppcheck warnings
    * Don't ignore getline return value
    * Add free for getStringValue in tst-group1
    * Remove XFAIL for tst-groups1
    * Update example.c to free after getStringValue
    * Add addbrackets for getValue functions
    * tst-getconfdirs4: make sure, only a file in /etc/ and not in /usr/etc works, too.


author: kukuk@suse.de
changelog:
  - Update to version 0.0.0+git20190829.209219e:
    * Convert all functions to new error API
    * Convert econf_newKeyFile provide the error via return code


author: kukuk@suse.de
changelog:
  - Update to version 0.0.0+git20190829.a1479b1:
    * Make comment argument an array, so that we can support more than one comment character in the future.
    * Change the API
    * Fix size_t as return value of getc()


author: kukuk@suse.de
changelog:
  - Update to version 0.0.0+git20190830.04ba053:
    * Make clear that the API and ABI of the three functions econf_newIniFile, econf_newKeyFile, econf_writeFile are not stable yet.
    * Fix getGroups argument types and add several test cases for this.
    * Fix cppcheck and compiler warnings


author: kukuk@suse.de
changelog:
  - Update to version 0.0.0+git20190831.fb7c1bb:
    * Rewrite econf_readDirs - don't assume suffix is ".conf" - Read files and directories in correct order


author: kukuk@suse.de
changelog:
  - Update to version 0.2.0+git20190904.c9c1820:
    * Implement alternate file parser solving the problems with group entry detection.
    * Add new parse error error code
    * Bool values read from a config file are not sanitzied, so we need to do that in the getBoolValueNum function, too.
    * Only use <file>.<suffix>.d directories
    * Release version 0.2.0
    * Add an explanation about this project.
    * Check for NULL pointer arguments
    * Fix error return value
    * Fix typo in comment
    * Add test case for reading login.defs with data from util-linux test suite


author: kukuk@suse.de
changelog:
  - Update to version 0.2.0+git20190904.03fa5b4:
    * Enhance and adjust test cases
    * Update ccpp.yml
    * Update ccpp.yml
    * Update ccpp.yml


author: kukuk@suse.de
changelog:
  - Update to version 0.3.0+git20190905.0ca8fe2:
    * Merge doc changes from parlt91 (pull rq#73)
    * Implement econf_get*ValueDef functions: if key is not found, a provided default is returned.
    * Differentiate between no value provided and empty value provided
    * Remove obsolete check for comments
    * Enhance and adjust test cases
    * Remove obsolete check for comments


author: kukuk@suse.de
changelog:
  - Update to version 0.3.0+git20190906.0e60a88:
    * Ensure LICENSE, README, and TODO are included in the release tarball
    * Rewrite set*ValueNum functions to avoid libm usage and add error checking
    * Move src/*.c to lib and release version 0.3.0


author: rbrown@suse.com
changelog:
  - Update to version 0.3.1+git20190924.822cf5b:
    * release version 0.3.1
    * Set delimiter in readFile
    * Change parser interface to store file name and line numbers per key
    * Update ccpp.yml


author: kukuk@suse.com
changelog:
  - Update to version 0.3.2+git20190926.fea4a03:
    * Release version 0.3.2
    * Fix merging an empty file (#105)
    * Add test cases for merge function


author: iforster@suse.com
changelog:
  - Update to version 0.3.3+git20191028.3ac14ce:
    * Release version 0.3.3
    * Reset *key_file to NULL after free


author: rbrown@suse.com
changelog:
  - Update to version 0.3.4+git20200121.febebf2:
    * Release version 0.3.4
    * Fix buffer overflow in econf_readDirs
    * Fix parsing of quoted strings, and values starting with delimiters
    * tests: add test for quoted strings
    * tests: tst-configdirs5: fix config dir paths


author: rbrown@suse.com
changelog:
  - Update to version 0.3.5+git20200203.3144b69:
    * Release version 0.3.5
    * Use float.h instead of obsolete gnuism values.h
    * Remove gnuism (strdupa)
    * Check for empty value (NULL pointer) before calling strdup.


author: rbrown@suse.com
changelog:
  - Update to version 0.3.6+git20200529.276359f:
    * Package meson files with autotools
    * Use newer version of actions/checkout
    * Add actions for meson
    * Create meson.yml
    * Use meson source root for tests configuration files
    * Add additional compiler warnings
    * First useable meson build support including unit tests
    * Add global options, build with pie and GNU_SOURCE
    * Fix name of library, add example binary
    * add support for meson
    * Add C++ compatibility
    * Add test case for crash with empty value keys


author: rbrown@suse.com
changelog:
  - Update to version 0.3.8+git20200710.5126fff:
    * Add CMake build scripts, remove autotools support
    * Move C++ ABI compatibility section


author: lnussel@suse.de
changelog:
  - explicitly BuildRequire: pkgconfig for /usr/lib/rpm/pkgconfigdeps.sh
    On TW it's pulled in implicitly by libxcrypt-devel which is not the
    case on 15.2


author: schubi@suse.com
changelog:
  - Update to version 0.4.0+git20210408.6d33e5e:
    * Man pages libeconf.3 and econftool.8.
    * Handling multiline strings.
    * Added libeconf_ext which returns more information like
      line_nr, comments, path of the configuration file,...
    * Econftool, an command line interface for handling configuration
      files.
    * Generating HTML API documentation with doxygen.
    * Improving error handling and semantic file check.
    * Joining entries with the same key to one single entry if
      env variable ECONF_JOIN_SAME_ENTRIES has been set.


author: schubi@suse.com
changelog:
  - Update to version 0.4.0+git20210412.1513a26:
    * Added econftool cat option (#146)
    * new API call: econf_readDirsHistory (showing ALL locations)
    * new API call: econf_getPath (absolute path of the configuration file)


author: schubi@localhost
changelog:
  - Update to version 0.4.1+git20210709.cf671f2:
    * CMake fixes regarding installation of econftool and man pages.


author: schubi@suse.com
changelog:
  - Update to version libeconf-0.4.2+git20211111.c7a2c52:
    * CMake fixes regarding document installation.
    * Fixed different issues while writing string values to file.
    * Writing comments to file too.
    * Fixed memory leaks.
    * Fixed crash while merging values.


author: schubi@suse.com
changelog:
  - Update to version 0.4.2+git20220104.5dfd69d:
    * Reading numbers with different bases (e.g. oktal) (bsc#1193632) (#157)


author: schubi@suse.com
changelog:
  - Update to version 0.4.5+git20220406.c9658f2:
    * econftool:
    * * New call "syntax" for checking the configuration files only.
      Returns an error string with line number if an error occurs.
    * * New options "--comment" and "--delimeters"
    * * Parsing one file only if needed.


author: schubi@suse.com
changelog:
  - Update to version 0.4.6+git20220427.3016f4e:
    * econftool:
    * * Parsing error: Reporting file and line nr.
    * * --delimeters=spaces Taking all kind of spaces for delimiter
    * libeconf:
      Fixed bsc#1198165: Parsing files correctly which have space characters
      AND none space characters as delimiters.


author: schubi@suse.com
changelog:
  - Update to version 0.4.8+git20221114.7ff7704:
    * Parsing files which are containing keys only (#170)
      All delimiters are allowed now : "", " =", " ", "=". But the
      user should use "" in order to be distinct.
    * /usr/etc/shells.d/<file_name> will not be parsed if
      /etc/shells.d/<file_name> is defined too.
    * Lto build fixed (#168)
    * New calls: econf_comment_tag, econf_delimiter_tag, econf_set_comment_tag,
      econf_set_delimiter_tag
    * Checking UID,GroupID, permissions,... of the parsed files (#165)
      New calls: econf_requireOwner, econf_requireGroup, econf_requirePermissions,
      econf_followSymlinks
    * Ignoring Group without brackets; Do not hold brackets in the internal data structure. (#164)
    * Error handling improved for nums and booleans (#163)


author: schubi@suse.com
changelog:
  - Update to version 0.4.9:
    * libeconf.h: added missing sys/types.h header (#171)
    * new API calls: econf_readFileWithCallback,
      econf_readDirsWithCallback, econf_readDirsHistoryWithCallback (#172)
    * Checking NULL comment parameter in the parsing functions.


author: schubi@suse.com
changelog:
  - Update to version 0.5.0:
    * API calls econf_read*WithCallback supporting a general (void *)
      argument for user defined data with which the callback function is
      called.
    * Tagged following functions deprecated:
      econf_requireOwner, econf_requireGroup, econf_requirePermissions,
      econf_followSymlinks, econf_reset_security_settings
      Use one of the econf_read*WithCallback functions instead.


author: schubi@suse.com
changelog:
  - Update to version 0.5.1:
    * Reading files in /usr/_vendor_/_example_._suffix_.d/* regardless
      there is a /etc/_example_._suffix_ file. (#175)


author: schubi@suse.com
changelog:
  - Update to version 0.5.2:
    * Fixed build for aarch64 and gcc13.
    * Making the output verbose when a test fails.
    * Fixed a stack-buffer-overflow vulnerability in "econf_writeFile"
      function.
    * Fixed a stack-buffer-overflow vulnerability in "read_file"
      function.
    * Added new feature: econf_set_conf_dirs (const char **dir_postfix_list)
      Sets a list of directory structures (with order) which describes
      the directories in which the files have to be parsed.
      E.G. with the given list: {"/conf.d/", ".d/", "/", NULL} files in following
      directories will be parsed:
      "<default_dirs>/<project_name>.<suffix>.d/"
      "<default_dirs>/<project_name>/conf.d/"
      "<default_dirs>/<project_name>.d/"
      "<default_dirs>/<project_name>/"
      The entry "<default_dirs>/<project_name>.<suffix>.d/" will be added
      automatically.
    * General code cleanup.


author: schubi@suse.com
changelog:
  - Additional info for version 0.5.2:
    * Fixed a stack-buffer-overflow vulnerability in "econf_writeFile"
      function. (CVE-2023-30078, CVE-2023-32181, bsc#1211078)
    * Fixed a stack-buffer-overflow vulnerability in "read_file"
      function. (CVE-2023-30079, CVE-2023-22652, bsc#1211078)


author: jengelh@inai.de
changelog:
  - Update to new snapshot v1.4.21-367-g9763347 [1.6.0~]
    * -m ah/esp/rt: restore matching "any SPI id" by default
    (they unexpectedly defaulted to --spi 0 rather than --spi ALL)
    * -m cgroup: new module
    * -m dst: make ! --dst-len work
    * -m ipcomp: new module
    * -m socket: add --restore-skmark option
    * -j CT: add support for new zone options
    * -j REJECT: add missing ICMPv6 codes
    * -j TEE: make it possible to delete rules with -D ... -j
    * -j SNAT/DNAT: add randomize-full support


author: jengelh@inai.de
changelog:
  - Update to new upstream release 1.6.1
    * add support for hashlimit rev 2 for higher pps rates
    * add support for cgroup2 path matching
    * translation program for nft


author: matthias.gerstner@suse.com
changelog:
  - Add iptables-batch-lock.patch: Fix a locking issue of
    iptables-batch which can cause it to spuriously fail when other
    programs modify the iptables rules in parallel (bnc#1045130).
    This can especially affect SuSEfirewall2 during startup.


author: jengelh@inai.de
changelog:
  - Update to new upstream release 1.6.2
    * add support for the "srh" match
    * add randomize-full for the "MASQUERADE" target
    * add rate match mode to the "hashlimit" match


author: jengelh@inai.de
changelog:
  - Update to new upstream release 1.8.0 and snapshot 1.8.0.g75
    * The ipv6 "srh" match can now match previous/next/last sid
    * CONNMARK target now supports bit-shifting for restore,set
      and save-mark.
    * DNAT now supports shifted portmap ranges.
    * iptables now comes in two backends: legacy and nft.


author: mchandras@suse.de
changelog:
  - Add missing update-alternatives dependency to Requires(post)
    section. If this is missing the package fails to install properly
    when it is used as build dependency.


author: jengelh@inai.de
changelog:
  - Update to new upstream release 1.8.2
    * Fix incorrect handling of various targets and options in
      iptables-nft,ebtables-nft,arptables-nft.


author: kstreitova@suse.com
changelog:
  - Add iptables-1.8.2-dont_read_garbage.patch that fixes a situation
    where 'iptables -L' reads garbage from the struct as the kernel
    never filled it in the bugged case. This can lead to issues like
    mapping a few TiB of memory [bsc#1106751].


author: jengelh@inai.de
changelog:
  - Add 0001-include-fix-build-with-kernel-headers-before-4.2.patch,
    0001-include-extend-the-headers-conflict-workaround-to-in.patch
    to fix build with older linux-glibc-devel. [boo#1132821]


author: jengelh@inai.de
changelog:
  - Update to new upstream release 1.8.3
    * ebtables: Fix rule listing with counters
    * ebtables-nft: Support user-defined chain policies
  - Remove 0001-include-extend-the-headers-conflict-workaround-to-in.patch
    0001-include-fix-build-with-kernel-headers-before-4.2.patch
    (upstreamed)


author: kstreitova@suse.com
changelog:
  - Add Conflicts with iptables-nft = 1.6.2 as during the update to
    iptables 1.8 ip6tables-restore-translate, ip6tables-translate,
    iptables-restore-translate and iptables-translate were moved from
    iptables-nft subpackage (now iptables-backend-nft) to the main
    package. So we need to add a conflict here otherwise we hit file
    conflicts error during the update.


author: jengelh@inai.de
changelog:
  - Update to release 1.8.4
    * Fix for wrong counter format in `ebtables-nft-save -c` output.
    * Print typical iptables-save comments in arptables- and
      ebtables-save, too.
    * xt_owner: add --suppl-groups option
    * Remove support for /etc/xtables.conf
    * Restore support for "-4" and "-6" options in rule lines.


author: jengelh@inai.de
changelog:
  - Update to release 1.8.5
    * IDLETIMER: Add alarm timer option
    * nft: CT: add translation for NOTRACK
  - Drop iptables-apply-mktemp-fix.patch (seemingly applied)


author: jengelh@inai.de
changelog:
  - Update to release 1.8.6
    * iptables-nft had pointlessly added "bitwise" expressions to
      each IP address match, needlessly slowing down run-time
      performance (by 50% in worst cases).
    * iptables-nft-restore: Support basechain policy value of "-"
      (indicating to not change the chain's policy).
    * nft-translte: Fix translation of ICMP type "any" match.


author: jengelh@inai.de
changelog:
  - Update to release 1.8.7
    * iptables-nft:
    * Improved performance when matching on IP/MAC address prefixes
      if the prefix is byte-aligned. In ideal cases, this doubles
      packet processing performance.
    * Dump user-defined chains in lexical order. This way ruleset
      dumps become stable and easily comparable.
    * Avoid pointless table/chain creation. For instance,
      `iptables-nft -L` no longer creates missing base-chains.


author: bruno@ioda-net.ch
changelog:
  - Update to 0.10 version :
    * Add a json_object_to_json_string_ext() function to allow output
    to be formatted in a more human readable form.
    * Add json_object_object_get_ex(), a NULL-safe get object method,
    to be able to distinguish between a key not present and the value
    being NULL.
    * Add an alternative iterator implementation, see json_object_iterator.h
    * Make json_object_iter public to enable external use of the
      json_object_object_foreachC macro.
    * Add a printbuf_memset() function to provide an effecient way to set and
      append things like whitespace indentation.
    * Adjust json_object_is_type and json_object_get_type so they return
      json_type_null for NULL objects and handle NULL passed to
      json_objct_object_get().
    * Rename boolean type to json_bool.
    * Fix various compile issues for Visual Studio and MinGW.
    * Allow json_tokener_parse_ex() to be re-used to parse multiple object.
      Also, fix some parsing issues with capitalized hexadecimal numbers and
      number in E notation.
    * Add json_tokener_get_error() and json_tokener_error_desc() to better
      encapsulate the process of retrieving errors while parsing.
    * Various improvements to the documentation of many functions.
    * Add new json_object_array_sort() function.
    * Fix a bug in json_object_get_int(), which would incorrectly return 0
      when called on a string type object.
      Eric Haszlakiewicz
    * Add a json_type_to_name() function.
      Eric Haszlakiewicz
    * Add a json_tokener_parse_verbose() function.
      Jehiah Czebotar
    * Improve support for null bytes within JSON strings.
      Jehiah Czebotar
    * Fix file descriptor leak if memory allocation fails in json_util
      Zachary Blair, zack_blair at hotmail dot com
    * Add int64 support. Two new functions json_object_net_int64 and
      json_object_get_int64. Binary compatibility preserved.
      Eric Haszlakiewicz, EHASZLA at transunion com
      Rui Miguel Silva Seabra, rms at 1407 dot org
    * Fix subtle bug in linkhash where lookup could hang after all slots
      were filled then successively freed.
      Spotted by Jean-Marc Naud, j dash m at newtraxtech dot com
    * Make json_object_from_file take const char *filename
      Spotted by Vikram Raj V, vsagar at attinteractive dot com
    * Add handling of surrogate pairs (json_tokener.c, test4.c, Makefile.am)
      Brent Miller, bdmiller at yahoo dash inc dot com
    * Correction to comment describing printbuf_memappend in printbuf.h
      Brent Miller, bdmiller at yahoo dash inc dot com
  - Packaging :
    * upgrade upstream location https://gitub.com/json-c/json-c/wiki
    * cleanup old patches included now upstream
    . json-c-0.9-linkhash.patch
    . json-c-0.9-json_tokener.patch
    . json-c-0.9-json_object_from_file.patch
    . json-c-0.9-base.patch
    * Redone lfs patch against new 0.10 release
    * Removed empty NEWS file


author: fstrba@suse.com
changelog:
  - Upgrade to 0.11 version:
    - SONAME change.
    - Fix provides and obsoletes accordingly
    - symlink the .pc file to the oldname for software that needs it
  - Remove json-c-fix-headers.patch integrated upstream


author: idonmez@suse.com
changelog:
  - Add json-c-hash-dos-and-overflow-random-seed-4e.patch to fix
    CVE-2013-6370 and CVE-2013-6371 (bnc#870147)


author: andreas.stieger@gmx.de
changelog:
  - json-c 0.12
    Fixes for security issues contained in this release have been
    previously patched into this package, but listed for completeness:
    * Address security issues:
    * CVE-2013-6371: hash collision denial of service
    * CVE-2013-6370: buffer overflow if size_t is larger than int
  - Further changes:
    * Avoid potential overflow in json_object_get_double
    * Eliminate the mc_abort() function and MC_ABORT macro.
    * Make the json_tokener_errors array local.  It has been deprecated for
      a while, and json_tokener_error_desc() should be used instead.
    * change the floating point output format to %.17g so values with
      more than 6 digits show up in the output.
    * Remove the old libjson.so name compatibility support.  The library is
      only created as libjson-c.so now and headers are only installed
      into the ${prefix}/json-c directory.
    * When supported by the linker, add the -Bsymbolic-functions flag.
    * Make strict mode more strict:
    * number must not start with 0
    * no single-quote strings
    * no comments
    * trailing char not allowed
    * only allow lowercase literals
    * Added a json_object_new_double_s() convenience function to allow
      an exact string representation of a double to be specified when
      creating the object and use it in json_tokener_parse_ex() so
      a re-serialized object more exactly matches the input.
    * Add support NaN and Infinity
  - packaging changes:
    * json-c-hash-dos-and-overflow-random-seed-4e.patch is upstream
    * Move from json-c-lfs.patch which removed warning errors and
      autoconf call to json-c-0.12-unused_variable_size.patch from
      upstream which fixes the warning
    * except for SLE 11 where autoreconf call is required
    * add licence file to main package


author: rpm@fthiessen.de
changelog:
  - Update to upstream release 0.12.1
  - Removed upstream fixed json-c-0.12-unused_variable_size.patch
  - Added fix-set-but-not-used.patch


author: avindra@opensuse.org
changelog:
  - json-c 0.13
    + Deprecated and removed features:
    * Internal use of bits.h has been eliminated.
    * lh_abort() is deprecated
    + Behavior changes:
    * Tighten the number parsing algorithm to raise errors instead
      of truncating the results.  For example 12.3.4 or 2015-01-15,
      which now return null.
    * Use size_t for array length and size. Platforms where
      sizeof(size_t) != sizeof(int) may not be backwards compatible
    * Check for failue when allocating memory, returning NULL and
      errno=ENOMEM.
    * Change json_object_object_add() return type from void to int,
      and will return -1 on failures, instead of exiting. (Note:
      this is not an ABI change)
    + New features:
    * Aiming to follow RFC 7159 now.
    * Support for JSON pointer, RFC 6901 (see json_pointer.h)
    * Add a couple of additional option to json_object_to_json_string_ext:
    JSON_C_TO_STRING_PRETTY_TAB
    JSON_C_TO_STRING_NOSLASHESCAPE
    * json_object_object_add_ex() - better perf when certain
      constraints are known to be true
    * Serialization format of doubles now configurable
    * New functions
    - json_object_equal() - utility function for comparing
      json_objects
    - json_object_deep_copy() - a way to copy entire object
      trees
    - json_object_set_<type>() - modify the value of
      existing json_object's without the need to recreate them.
    Also add a json_object_int_inc function to adjust an int's'
    value.
    - json_util_get_last_err() - retrieve the string describing
      the cause of errors, instead of printing to stderr.
    - perllike hash function for strings
    * json_global_set_string_hash()
    * json_c_visit() - a way to iterate over a tree of json-c
      objects.
    + Notable bug fixes and other improvements:
    * Make reference increment and decrement atomic to allow
      passing json objects between threads.
    * Fix json_object_object_foreach to avoid uninitialized
      variable warnings.
    * Improve performance by removing unneeded data items from
      hashtable code and reducing duplicate hash computation.
    * Performance: store small strings inside json_object
    * Performance: of json_object_to_json_string by removing
      variadic printf
    * Fix parsing of "-Infinity", and avoid needlessly copying the
      input when doing so.
    * Fix stack buffer overflow in json_object_double_to_json_string_format()
    * Fix various potential null ptr deref and int32 overflows
    * Fix a long-standing bug in array_list_put_idx() where it
      would attempt to free previously free'd entries due to not
      checking the current array length.
    * use uselocale() instead of setlocale() in json_tokener to
      behave better in threaded environments.
    * Fix out of bounds read when handling unicode surrogate pairs.
    * Ensure doubles that happen to be a whole number are emitted
      with ".0"
    * Visual Studio: use a snprintf/vsnprintf wrapper that ensures
      the string is terminated.
    * Fix double to int cast overflow in json_object_get_int64.
    * Clamp double to int32 when narrowing in json_object_get_int.
    * Use strtoll() to parse ints - instead of sscanf
    * usual code linting
    + Build changes:
    * Add Appveyor and Travis build support
    * Support for MacOS and Windows through CMake
    * Silent build by default
    * Link against libm when needed
    * Add support for building with AddressSanitizer
    * Add support for building with Clang
    * Add a --enable-threading configure option, and only use the
      (slower) __sync_add_and_fetch()/__sync_sub_and_fetch()
      function when it is specified.
  - cleanup with spec-cleaner
  - remove fix-set-but-not-used.patch
    + fixed: https://github.com/json-c/json-c/issues/240
  - remove gcc7-fix.patch
    + fixed in 014924ba899f659917bb64392bbff7d3c803afc2


author: ncutler@suse.com
changelog:
  - Add patch bsc1171479.patch
    + fix integer overflow and out-of-bounds write (CVE-2020-12762, bsc#1171479)


author: avindra@opensuse.org
changelog:
  - json-c 0.13.1
    * Add const size_t json_c_object_sizeof()
    * Avoid invalid free (and thus a segfault) when ref_count gets < 0
    * Fix handling of custom double formats that include a ".0"
    * Avoid uninitialized variable warnings in json_object_object_foreach
    * Add a top level fuzz directory for fuzzers run by OSS-Fuzz
    * Fix build for certain uClibc based systems.
    * Bump sonum to 4.0 to avoid conflicts because some packagers made
      their own bump to ".so.3" for the older 0.12 release


author: info@paolostivanin.com
changelog:
  - json-c 0.14:
    * bits.h has been removed
    * lh_abort() has been removed
    * lh_table_lookup() has been removed, use lh_table_lookup_ex() instead.
    * Remove TRUE and FALSE defines, use 1 and 0 instead.
    * Switch to cmake
    * Build fixes
    * Doc updates
    * Added a json_tokener_get_parse_end() function to replace
      direct access of tok->char_offset
    * json_tokener_parse_ex() now accepts a new JSON_TOKENER_VALIDATE_UTF8 flag
      to validate that input is UTF8
    * Add support for unsigned 64-bit integers
    * A total of 7 new functions were added:
    * json_object_get_uint64 ( struct json_object const* jso )
    * json_object_new_uint64 ( uint64_t i )
    * json_object_set_uint64 ( struct json_object* jso, uint64_t new_value )
    * json_parse_uint64 ( char const* buf, uint64_t* retval )
    * See description of uint64 support, above.
    * json_tokener_get_parse_end ( struct json_tokener* tok )
    * See details under "json_tokener changes", above.
    * json_object_from_fd_ex ( int fd, int in_depth )
    * Allows the max nesting depth to be specified.
    * json_object_new_null ( )
    * Simply returns NULL.  Its use is not recommended.
    * The size of struct json_object has decreased from 96 bytes to 88 bytes.


author: dcermak@suse.com
changelog:
  - Add upstream fix for boo#1173022
    * Added patch 0001-Detect-broken-RDRAND-during-initialization.patch
    * use URL from the releases page on github
    * run spec-cleaner over the spec file


author: dmueller@suse.com
changelog:
  - update to 0.15:
    * Deprecate `array_list_new()` in favor of `array_list_new2()`
    * Remove the THIS_FUNCTION_IS_DEPRECATED define.
    * Remove config.h.win32
    * Add a `JSON_TOKENER_ALLOW_TRAILING_CHARS` flag to allow multiple objects
      to be parsed even when `JSON_TOKENER_STRICT` is set.
    * Add `json_object_new_array_ext(int)` and `array_list_new_2(int)` to allow
      arrays to be allocated with the exact size needed, when known.
    * Add `json_object_array_shrink()` (and `array_list_shrink()`) and use it in
      json_tokener to minimize the amount of memory used.
    * Add a json_parse binary, for use in testing changes (not installed, but
      available in the apps directory).
    * Split the internal json_object structure into several sub-types, one for
      each json_type (json_object_object, json_object_string, etc...).
      This improves memory usage and speed, with the benchmark under
      bench/ report 5.8% faster test time and 6%(max RSS)-12%(peak heap)
      less memory usage.
      Memory used just for json_object structures decreased 27%, so use cases
      with fewer arrays and/or strings would benefit more.
    * Minimize memory usage in array handling in json_tokener by shrinking
      arrays to the exact number of elements parsed.  On bench/ benchmark:
      9% faster test time, 39%(max RSS)-50%(peak heap) less memory usage.
      Add json_object_array_shrink() and array_list_shrink() functions.
    * #616 - Parsing of surrogate pairs in unicode escapes now properly handles
      incremental parsing.
    * Fix incremental parsing of numbers, especially those with exponents, e.g.
      so parsing "[0", "e+", "-]" now properly returns an error.
      Strict mode now rejects missing exponents ("0e").
    * Successfully return number objects at the top level even when they are
      followed by a "-", "." or "e".  This makes parsing things like "123-45"
      behave consistently with things like "123xyz".
    * #589 - Detect broken RDRAND during initialization; also, fix segfault
      in the CPUID check.
    * #592 - Fix integer overflows to prevert out of bounds write on large input.
      (CVE-2020-12762, bsc#1171479)
    * Protect against division by zero in linkhash, when creaed with zero size.
    * #602 - Fix json_parse_uint64() internal error checking, leaving the retval
      untouched in more failure cases.
    * #614 - Prevent truncation when custom double formatters insert extra \0's
  - remove 0001-Detect-broken-RDRAND-during-initialization.patch (upstream)


author: info@paolostivanin.com
changelog:
  - Update to 0.16: (jsc#PED-5061)
    + Deprecated and removed features:
    * JSON_C_OBJECT_KEY_IS_CONSTANT is deprecated in favor of
      JSON_C_OBJECT_ADD_CONSTANT_KEY
    * Direct access to lh_table and lh_entry structure members is deprecated.
      Use access functions instead, lh_table_head(), lh_entry_next(), etc...
    * Drop REFCOUNT_DEBUG code.
    + Changes and bug fixes
    * Cap string length at INT_MAX to avoid various issues with very long strings.
    * json_object_deep_copy: fix deep copy of strings containing '\0'
    * Fix read past end of buffer in the "json_parse" command
    * Avoid out of memory accesses in the locally provided vasprintf() function
      (for those platforms that use it)
    * Handle allocation failure in json_tokener_new_ex
    * Fix use-after-free in json_tokener_new_ex() in the event of printbuf_new() returning NULL
    * printbuf_memset(): set gaps to zero - areas within the print buffer which
      have not been initialized by using printbuf_memset
    * printbuf: return -1 on invalid arguments (len < 0 or total buffer > INT_MAX)
    * sprintbuf(): propagate printbuf_memappend errors back to the caller
    * Validate size arguments in arraylist functions.
    * Use getrandom() if available; with GRND_NONBLOCK to allow use of json-c
      very early during boot, such as part of cryptsetup.
    * Use arc4random() if it's available.
    * random_seed: on error, continue to next method instead of exiting the process
    * Close file when unable to read from /dev/urandom in get_dev_random_seed()
    * Speed up parsing by replacing ctype functions with simplified, faster
      non-locale-sensitive ones in json_tokener and json_object_to_json_string.
    * Neither vertical tab nor formfeed are considered whitespace per the JSON spec
    * json_object: speed up creation of objects, calloc() -> malloc() + set fields
    * Avoid needless extra strlen() call in json_c_shallow_copy_default() and
      json_object_equal() when the object is known to be a json_type_string.
  - remove bsc1171479.patch


author: abergmann@suse.com
changelog:
  - Initial release 0.13.0.
    A library and tools to access the kernel crypto api.
    FATE#323554 bsc#1045948


author: jengelh@inai.de
changelog:
  - Compact descriptions a bit
  - Remove libkcapi provide/requires
  - Use %_libdir throughout and avoid /lib


author: meissner@suse.com
changelog:
  - libkcapi-use-external-fipshmac.patch: use external fipshmac,
    our chroots / vm builds do not necessarily have the right kernel.


author: bwiedemann@suse.com
changelog:
  - Add reproduciblesort.patch to always link .o files in the same order and
  - Add reproducibledate.patch to not add current time to man-pages to fix build-compare


author: pmonreal@suse.com
changelog:
  - FIPS: kcapi-hasher: zeroise temporary values for FIPS 140-3
    * Add libkcapi-zeroize-hasher.patch [bsc#1222768]


author: crrodriguez@opensuse.org
changelog:
  - openSSL 1.0.1j
    * Fix SRTP Memory Leak (CVE-2014-3513)
    * Session Ticket Memory Leak (CVE-2014-3567)
    * Add SSL 3.0 Fallback protection (TLS_FALLBACK_SCSV)
    * Build option no-ssl3 is incomplete (CVE-2014-3568)


author: meissner@suse.com
changelog:
  - openssl-1.0.1i-noec2m-fix.patch: only report the Elliptic Curves
    we actually support (not the binary ones) (bnc#905037)


author: meissner@suse.com
changelog:
  - openssl 1.0.1k release
    bsc#912294 CVE-2014-3571: Fix DTLS segmentation fault in dtls1_get_record.
    bsc#912292 CVE-2015-0206: Fix DTLS memory leak in dtls1_buffer_record.
    bsc#911399 CVE-2014-3569: Fix issue where no-ssl3 configuration sets method to NULL.
    bsc#912015 CVE-2014-3572: Abort handshake if server key exchange
      message is omitted for ephemeral ECDH ciphersuites.
    bsc#912014 CVE-2015-0204: Remove non-export ephemeral RSA code on client and server.
    bsc#912293 CVE-2015-0205: Fixed issue where DH client certificates are accepted without verification.
    bsc#912018 CVE-2014-8275: Fix various certificate fingerprint issues.
    bsc#912296 CVE-2014-3570: Correct Bignum squaring.
    and other bugfixes.
  - openssl.keyring: use Matt Caswells current key.
    pub  2048R/0E604491 2013-04-30
    uid                            Matt Caswell <frodo@baggins.org>
    uid                            Matt Caswell <matt@openssl.org>
    sub  2048R/E3C21B70 2013-04-30
  - openssl-1.0.1e-fips.patch: rediffed
  - openssl-1.0.1i-noec2m-fix.patch: removed (upstream)
  - openssl-ocloexec.patch: rediffed


author: vcizek@suse.com
changelog:
  - security update:
    * CVE-2015-0209 (bnc#919648)
    - Fix a failure to NULL a pointer freed on error
    * CVE-2015-0286 (bnc#922496)
    - Segmentation fault in ASN1_TYPE_cmp
    * CVE-2015-0287 (bnc#922499)
    - ASN.1 structure reuse memory corruption
    * CVE-2015-0288 x509: (bnc#920236)
    - added missing public key is not NULL check
    * CVE-2015-0289 (bnc#922500)
    - PKCS7 NULL pointer dereferences
    * CVE-2015-0293 (bnc#922488)
    - Fix reachable assert in SSLv2 servers
    * added patches:
    openssl-CVE-2015-0209.patch
    openssl-CVE-2015-0286.patch
    openssl-CVE-2015-0287.patch
    openssl-CVE-2015-0288.patch
    openssl-CVE-2015-0289.patch
    openssl-CVE-2015-0293.patch


author: vcizek@suse.com
changelog:
  - update to 1.0.2a
    * Major changes since 1.0.1:
    - Suite B support for TLS 1.2 and DTLS 1.2
    - Support for DTLS 1.2
    - TLS automatic EC curve selection.
    - API to set TLS supported signature algorithms and curves
    - SSL_CONF configuration API.
    - TLS Brainpool support.
    - ALPN support.
    - CMS support for RSA-PSS, RSA-OAEP, ECDH and X9.42 DH.
  - packaging changes:
    * merged patches modifying CIPHER_LIST into one, dropping:
    - openssl-1.0.1e-add-suse-default-cipher-header.patch
    - openssl-libssl-noweakciphers.patch
    * fix a manpage with invalid name
    - added openssl-fix_invalid_manpage_name.patch
    * remove a missing fips function
    - openssl-missing_FIPS_ec_group_new_by_curve_name.patch
    * reimported patches from Fedora
      dropped patches:
    - openssl-1.0.1c-default-paths.patch
    - openssl-1.0.1c-ipv6-apps.patch
    - openssl-1.0.1e-fips-ctor.patch
    - openssl-1.0.1e-fips-ec.patch
    - openssl-1.0.1e-fips.patch
    - openssl-1.0.1e-new-fips-reqs.patch
    - VIA_padlock_support_on_64systems.patch
      added patches:
    - openssl-1.0.2a-default-paths.patch
    - openssl-1.0.2a-fips-ctor.patch
    - openssl-1.0.2a-fips-ec.patch
    - openssl-1.0.2a-fips.patch
    - openssl-1.0.2a-ipv6-apps.patch
    - openssl-1.0.2a-new-fips-reqs.patch
    - openssl-1.0.2a-padlock64.patch
    * dropped security fixes (upstream)
    - openssl-CVE-2015-0209.patch
    - openssl-CVE-2015-0286.patch
    - openssl-CVE-2015-0287.patch
    - openssl-CVE-2015-0288.patch
    - openssl-CVE-2015-0289.patch
    - openssl-CVE-2015-0293.patch
    * upstream reformatted the sources, so all the patches have to
      be refreshed


author: vcizek@suse.com
changelog:
  - update to 1.0.2b
    * Malformed ECParameters causes infinite loop (CVE-2015-1788)
    * Exploitable out-of-bounds read in X509_cmp_time (CVE-2015-1789)
    * PKCS7 crash with missing EnvelopedContent (CVE-2015-1790)
    * CMS verify infinite loop with unknown hash function (CVE-2015-1792)
    * Race condition handling NewSessionTicket (CVE-2015-1791)
  - refreshed patches:
    * 0001-Axe-builtin-printf-implementation-use-glibc-instead.patch
    * 0001-libcrypto-Hide-library-private-symbols.patch
    * openssl-1.0.2a-default-paths.patch
    * openssl-1.0.2a-fips.patch
    * compression_methods_switch.patch
    * openssl-1.0.1e-add-test-suse-default-cipher-suite.patch


author: crrodriguez@opensuse.org
changelog:
  - Build with no-ssl3, for details on why this is needed read
    rfc7568. Contrary to the "no-ssl2" option, this does not
    require us to patch dependant packages as the relevant
    functions are still available (SSLv3_(client|server)_method)
    but will fail to negotiate. if removing SSL3 methods is desired
    at a later time, option "no-ssl3-method" needs to be used.


author: normand@linux.vnet.ibm.com
changelog:
  - update merge_from_0.9.8k.patch replacing __LP64__ by __LP64
    this is a change versus previous request 309611
    required to avoid build error for ppc64


author: vcizek@suse.com
changelog:
  - update to 1.0.2d
    * fixes CVE-2015-1793 (bsc#936746)
    Alternate chains certificate forgery
      During certificate verfification, OpenSSL will attempt to find an
      alternative certificate chain if the first attempt to build such a chain
      fails. An error in the implementation of this logic can mean that an
      attacker could cause certain checks on untrusted certificates to be
      bypassed, such as the CA flag, enabling them to use a valid leaf
      certificate to act as a CA and "issue" an invalid certificate.
  - drop openssl-fix_invalid_manpage_name.patch (upstream)


author: vcizek@suse.com
changelog:
  - update to 1.0.2e
    * fixes five security vulnerabilities
    * Anon DH ServerKeyExchange with 0 p parameter
      (CVE-2015-1794) (bsc#957984)
    * BN_mod_exp may produce incorrect results on x86_64
      (CVE-2015-3193) (bsc#957814)
    * Certificate verify crash with missing PSS parameter
      (CVE-2015-3194) (bsc#957815)
    * X509_ATTRIBUTE memory leak
      (CVE-2015-3195) (bsc#957812)
    * Race condition handling PSK identify hint
      (CVE-2015-3196) (bsc#957813)
  - pulled a refreshed fips patch from Fedora
    * openssl-1.0.2a-fips.patch was replaced by
      openssl-1.0.2e-fips.patch
  - refresh openssl-ocloexec.patch


author: vcizek@suse.com
changelog:
  - update to 1.0.2f (boo#963410)
    * ) DH small subgroups (boo#963413)
      Historically OpenSSL only ever generated DH parameters based on "safe"
      primes. More recently (in version 1.0.2) support was provided for
      generating X9.42 style parameter files such as those required for RFC 5114
      support. The primes used in such files may not be "safe". Where an
      application is using DH configured with parameters based on primes that are
      not "safe" then an attacker could use this fact to find a peer's private
      DH exponent. This attack requires that the attacker complete multiple
      handshakes in which the peer uses the same private DH exponent. For example
      this could be used to discover a TLS server's private DH exponent if it's
      reusing the private DH exponent or it's using a static DH ciphersuite.
      (CVE-2016-0701)
    * ) SSLv2 doesn't block disabled ciphers (boo#963415)
      A malicious client can negotiate SSLv2 ciphers that have been disabled on
      the server and complete SSLv2 handshakes even if all SSLv2 ciphers have
      been disabled, provided that the SSLv2 protocol was not also disabled via
      SSL_OP_NO_SSLv2.
      (CVE-2015-3197)
    * ) Reject DH handshakes with parameters shorter than 1024 bits.


author: vcizek@suse.com
changelog:
  - update to 1.0.2g (bsc#968044)
    * Disable weak ciphers in SSLv3 and up in default builds of OpenSSL.
      Builds that are not configured with "enable-weak-ssl-ciphers" will not
      provide any "EXPORT" or "LOW" strength ciphers.
    * Disable SSLv2 default build, default negotiation and weak ciphers.  SSLv2
      is by default disabled at build-time.  Builds that are not configured with
      "enable-ssl2" will not support SSLv2.  Even if "enable-ssl2" is used,
      users who want to negotiate SSLv2 via the version-flexible SSLv23_method()
      will need to explicitly call either of:
      SSL_CTX_clear_options(ctx, SSL_OP_NO_SSLv2);
      or
      SSL_clear_options(ssl, SSL_OP_NO_SSLv2);
      (CVE-2016-0800)
    * Fix a double-free in DSA code
      (CVE-2016-0705)
    * Disable SRP fake user seed to address a server memory leak.
      Add a new method SRP_VBASE_get1_by_user that handles the seed properly.
      (CVE-2016-0798)
    * Fix BN_hex2bn/BN_dec2bn NULL pointer deref/heap corruption
      (CVE-2016-0797)
    * ) Side channel attack on modular exponentiation
      http://cachebleed.info.
      (CVE-2016-0702)
    * ) Change the req app to generate a 2048-bit RSA/DSA key by default,
      if no keysize is specified with default_bits. This fixes an
      omission in an earlier change that changed all RSA/DSA key generation
      apps to use 2048 bits by default.


author: vcizek@suse.com
changelog:
  - add support for "ciphers" providing no encryption (bsc#937085)
    * don't build with -DSSL_FORBID_ENULL


author: vcizek@suse.com
changelog:
  - import fips patches from SLE-12
    * openssl-fips-clearerror.patch
    * openssl-fips-dont-fall-back-to-default-digest.patch
    * openssl-fips-fix-odd-rsakeybits.patch
    * openssl-fips-rsagen-d-bits.patch
    * openssl-fips-selftests_in_nonfips_mode.patch
    * openssl-fips_RSA_compute_d_with_lcm.patch
    * openssl-fips_disallow_ENGINE_loading.patch
    * openssl-fips_disallow_x931_rand_method.patch
    * openssl-rsakeygen-minimum-distance.patch
    * openssl-urandom-reseeding.patch


author: vcizek@suse.com
changelog:
  - OpenSSL Security Advisory [3rd May 2016]
  - update to 1.0.2h (boo#977584, boo#977663)
    * Prevent padding oracle in AES-NI CBC MAC check
      A MITM attacker can use a padding oracle attack to decrypt traffic
      when the connection uses an AES CBC cipher and the server support
      AES-NI.
      (CVE-2016-2107, boo#977616)
    * Fix EVP_EncodeUpdate overflow
      An overflow can occur in the EVP_EncodeUpdate() function which is used for
      Base64 encoding of binary data. If an attacker is able to supply very large
      amounts of input data then a length check can overflow resulting in a heap
      corruption.
      (CVE-2016-2105, boo#977614)
    * Fix EVP_EncryptUpdate overflow
      An overflow can occur in the EVP_EncryptUpdate() function. If an attacker
      is able to supply very large amounts of input data after a previous call to
      EVP_EncryptUpdate() with a partial block then a length check can overflow
      resulting in a heap corruption.
      (CVE-2016-2106, boo#977615)
    * Prevent ASN.1 BIO excessive memory allocation
      When ASN.1 data is read from a BIO using functions such as d2i_CMS_bio()
      a short invalid encoding can casuse allocation of large amounts of memory
      potentially consuming excessive resources or exhausting memory.
      (CVE-2016-2109, boo#976942)
    * EBCDIC overread
      ASN1 Strings that are over 1024 bytes can cause an overread in applications
      using the X509_NAME_oneline() function on EBCDIC systems. This could result
      in arbitrary stack data being returned in the buffer.
      (CVE-2016-2176, boo#978224)
    * Modify behavior of ALPN to invoke callback after SNI/servername
      callback, such that updates to the SSL_CTX affect ALPN.
    * Remove LOW from the DEFAULT cipher list.  This removes singles DES from the
      default.
    * Only remove the SSLv2 methods with the no-ssl2-method option. When the
      methods are enabled and ssl2 is disabled the methods return NULL.


author: vcizek@suse.com
changelog:
  - OpenSSL Security Advisory [22 Sep 2016] (bsc#999665)
    Severity: High
    * OCSP Status Request extension unbounded memory growth
      (CVE-2016-6304) (bsc#999666)
    Severity: Low
    * Pointer arithmetic undefined behaviour (CVE-2016-2177) (bsc#982575)
    * Constant time flag not preserved in DSA signing (CVE-2016-2178) (bsc#983249)
    * DTLS buffered message DoS (CVE-2016-2179) (bsc#994844)
    * OOB read in TS_OBJ_print_bio() (CVE-2016-2180) (bsc#990419)
    * DTLS replay protection DoS (CVE-2016-2181) (bsc#994749)
    * OOB write in BN_bn2dec() (CVE-2016-2182) (bsc#993819)
    * Birthday attack against 64-bit block ciphers (SWEET32)
      (CVE-2016-2183) (bsc#995359)
    * Malformed SHA512 ticket DoS (CVE-2016-6302) (bsc#995324)
    * OOB write in MDC2_Update() (CVE-2016-6303) (bsc#995377)
    * Certificate message OOB reads (CVE-2016-6306) (bsc#999668)
  - update to openssl-1.0.2i
    * remove patches:
      openssl-1.0.2a-new-fips-reqs.patch
      openssl-1.0.2e-fips.patch
    * add patches:
      openssl-1.0.2i-fips.patch
      openssl-1.0.2i-new-fips-reqs.patch


author: vcizek@suse.com
changelog:
  - add FIPS changes from SP2:
  - fix problems with locking in FIPS mode (bsc#992120)
    * duplicates: bsc#991877, bsc#991193, bsc#990392, bsc#990428
      and bsc#990207
    * bring back openssl-fipslocking.patch
  - drop openssl-fips_RSA_compute_d_with_lcm.patch (upstream)
    (bsc#984323)
  - don't check for /etc/system-fips (bsc#982268)
    * add openssl-fips-dont_run_FIPS_module_installed.patch
  - refresh openssl-fips-rsagen-d-bits.patch


author: vcizek@suse.com
changelog:
  - resume reading from /dev/urandom when interrupted by a signal
    (bsc#995075)
    * add openssl-randfile_fread_interrupt.patch


author: meissner@suse.com
changelog:
  - Updated to openssl 1.0.2k
    - bsc#1009528 / CVE-2016-7055: openssl: Montgomery multiplication may produce incorrect results
    - bsc#1019334 / CVE-2016-7056: openssl: ECSDA P-256 timing attack key recovery
    - bsc#1022085 / CVE-2017-3731: openssl: Truncated packet could crash via OOB read
    - bsc#1022086 / CVE-2017-3732: openssl: BN_mod_exp may produce incorrect results on x86_64


author: vcizek@suse.com
changelog:
  - fix X509_CERT_FILE path (bsc#1022271) and rename
    updated openssl-1.0.1e-truststore.diff to openssl-truststore.patch


author: tchvatal@suse.com
changelog:
  - Remove O3 from optflags, no need to not rely on distro wide settings
  - Remove conditions for sle10 and sle11, we care only about sle12+
  - USE SUSE instead of SuSE in readme
  - Pass over with spec-cleaner


author: tchvatal@suse.com
changelog:
  - Drop the symbol hiding patches to ease maintenance updates:
    * 0005-libssl-Hide-library-private-symbols.patch
    * 0001-libcrypto-Hide-library-private-symbols.patch


author: tchvatal@suse.com
changelog:
  - Start update to 1.1.0e basing of the 1.0.0 split release
  - Drop patch merge_from_0.9.8k.patch the ppc64 should work out of the
    box
  - Drop patch openssl-engines-path.patch converted to configure option
  - Drop patch openssl-1.0.2a-padlock64.patch code behind was redone
    does not apply at all
  - Drop patch openssl-fix-pod-syntax.diff mostly merged upstream or
    not applicable
  - Drop patch compression_methods_switch.patch as we do not need
    to keep the compat on this release anymore
  - Drop patch openssl-1.0.2a-ipv6-apps.patch which was upstreamed
  - Drop upstreamed patch openssl-1.0.2a-default-paths.patch
  - Drop obsolete patch openssl-1.0.0-c_rehash-compat.diff
  - Drop obsolete patch openssl-missing_FIPS_ec_group_new_by_curve_name.patch
  - Drop obsolete patch openssl-print_notice-NULL_crash.patch
  - Drop obsolete patch openssl-randfile_fread_interrupt.patch
  - Refresh patch openssl-truststore.patch
  - Refresh baselibs.conf to correctly reflect soname
  - Add patch openssl-1.1.0-fips.patch obsoleting bunch of older:
    * openssl-1.0.2i-fips.patch
    * openssl-1.0.2a-fips-ec.patch
    * openssl-1.0.2a-fips-ctor.patch
    * openssl-1.0.2i-new-fips-reqs.patch
    * openssl-fips_disallow_x931_rand_method.patch
  - Add new patch for upstream:
    * 0001-Resume-reading-from-randfile-when-interrupted-by-a-s.patch
  - Refresh patch openssl-pkgconfig.patch
  - Drop patch openssl-gcc-attributes.patch as the code was redone
  - Rebase patch 0001-Axe-builtin-printf-implementation-use-glibc-instead.patch
  - Rebase patch openssl-no-egd.patch
  - Rebase patch openssl-1.0.1e-add-suse-default-cipher.patch and
    openssl-1.0.1e-add-test-suse-default-cipher-suite.patch
  - Rebase patch openssl-fips_disallow_ENGINE_loading.patch
  - Rebase patch openssl-urandom-reseeding.patch
  - Rebase patch openssl-fips-rsagen-d-bits.patch
  - Rebase patch openssl-fips-selftests_in_nonfips_mode.patch
  - Remove switch for ssl2 - no longer present
  - Remve the buildinf.h parsing, should no longer be needed
  - Drop the rehash in build, no longer needed
  - Drop openssl-fips-hidden.patch as it is not really needed
  - Do not sed in secure_getenv upstream does it in code on their own
  - Do not install html converted manpages
    * openssl-1.1.0-no-html.patch


author: tchvatal@suse.com
changelog:
  - Add patch openssl-static-deps.patch to allow dependencies on
    statically build libraries
  - Refresh openssl-1-1.0-fips.patch to take in use the above approach
  - Silence the install manpage rename phase


author: vcizek@suse.com
changelog:
  - simplify openssl-fips-dont-fall-back-to-default-digest.patch
    The -non-fips-allow option was dropped in OpenSSL 1.1.0
  - drop openssl-no-egd.patch as OpenSSL 1.1.0 disables EGD at compile
    time by default
  - renumber the patches so the numbers are consequent


author: vcizek@suse.com
changelog:
  - drop openssl-fipslocking.patch
    The locking in 1.1.0 has been rewritten and converted to the new
    threading API. The fips deadlock (at least bsc#991193) can't be
    reproduced anymore.
  - don't ship useless INSTALL* files


author: vcizek@suse.com
changelog:
  - disable tests on SLE-12 and its derivates
    * they fail because of glibc bug bsc#1035445
  - remove README-FIPS.txt (outdated)


author: vcizek@suse.com
changelog:
  - re-enable tests on SLE-12 and below despite current failure, so
    they are automatically run once the issue is resolved


author: vcizek@suse.com
changelog:
  - update to 1.1.0f
    * bugfix only release
  - disable RSA keygen tests, because they use too small modulus, which
    is rejected by our CC/FIPS hardening patches
    * added openssl-disable_rsa_keygen_tests_with_small_modulus.patch
  - refreshed openssl-rsakeygen-minimum-distance.patch and
    0001-Axe-builtin-printf-implementation-use-glibc-instead.patch


author: tchvatal@suse.com
changelog:
  - Add patch openssl-no-date.patch to disable date inclusion in most
    of the binaries
  - Use autopatch to make things smaller
  - Enable verbose output on the tests
  - Paralelize depmod


author: vcizek@suse.com
changelog:
  - Fix a race condition in tests to make the package build reliably
    * https://github.com/openssl/openssl/issues/3562
    * 0001-Fix-a-TLSProxy-race-condition.patch


author: jengelh@inai.de
changelog:
  - The description is supposed to describe the package, not the
    development process or history. (Synchronize with the
    already-updates descriptions in openssl-1_0_0.)
  - Update historic copypasted boilerplate summaries
    ("include files mandatory for development")


author: meissner@suse.com
changelog:
  - do not require openssl1_1_0-targettype in devel-targettype, as it
    is not built (it has no libraries)


author: vcizek@suse.com
changelog:
  - update DEFAULT_SUSE cipher list (bsc#1055825)
    * add CHACHA20-POLY1305
    * add ECDSA ciphers
    * remove 3DES
  - modified openssl-1.0.1e-add-suse-default-cipher.patch


author: vcizek@suse.com
changelog:
  - Update to 1.1.0g
    OpenSSL Security Advisory [02 Nov 2017]
    * bn_sqrx8x_internal carry bug on x86_64
      (CVE-2017-3736) (bsc#1066242)
    * Malformed X.509 IPAddressFamily could cause OOB read
      (CVE-2017-3735) (bsc#1056058)
  - drop 0001-Fix-a-TLSProxy-race-condition.patch (upstream)
  - refresh 0001-Axe-builtin-printf-implementation-use-glibc-instead.patch


author: dimstar@opensuse.org
changelog:
  - Obsolete openssl-1_0_0 by openssl-1_1_0: this is required for a
    clean upgrade path as an aid to zypp (boo#1070003).


author: vcizek@suse.com
changelog:
  - Add support for s390x CPACF enhancements (fate#321518)
    patches taken from https://github.com/openssl/openssl/pull/2859:
    * 0002-crypto-modes-asm-ghash-s390x.pl-fix-gcm_gmult_4bit-K.patch
    * 0004-s390x-assembly-pack-add-OPENSSL_s390xcap-environment.patch
    * 0005-s390x-assembly-pack-add-OPENSSL_s390xcap-man-page.patch
    * 0006-s390x-assembly-pack-extended-s390x-capability-vector.patch
    * 0007-crypto-evp-e_aes.c-add-foundations-for-extended-s390.patch
    * 0008-s390x-assembly-pack-extended-s390x-capability-vector.patch
    * 0009-crypto-aes-asm-aes-s390x.pl-add-KMA-code-path.patch
    * 0010-doc-man3-OPENSSL_s390xcap.pod-update-KMA.patch
    * 0011-crypto-aes-asm-aes-s390x.pl-add-CFI-annotations-KMA-.patch
    * 0012-s390x-assembly-pack-add-KMA-code-path-for-aes-gcm.patch
    * 0013-crypto-aes-asm-aes-s390x.pl-add-CFI-annotations-KMA-.patch


author: vcizek@suse.com
changelog:
  - Renamed from openssl-1_1_0 (bsc#1081335)
    * All the minor versions of the 1.1.x openssl branch have the same
      sonum and keep ABI compatibility
    * obsolete the 1_1_0 packages
  - update baselibs.conf with the new version names


author: dimstar@opensuse.org
changelog:
  - Move the libopenssl1_1_0-32bit obsoletes in baselibs.conf to the
    new libopenssl1_1-32bit: it does not belong to the devel
    package.


author: vcizek@suse.com
changelog:
  - Update to 1.1.0h
    OpenSSL Security Advisory [27 Mar 2018]
    * Constructed ASN.1 types with a recursive definition could exceed
      the stack (CVE-2018-0739) (bsc#1087102)
    * rsaz_1024_mul_avx2 overflow bug on x86_64 (CVE-2017-3738)
      (bsc#1071906)
  - refresh patches:
    * 0001-Axe-builtin-printf-implementation-use-glibc-instead.patch
    * openssl-1.1.0-fips.patch
    * openssl-pkgconfig.patch
    * openssl-rsakeygen-minimum-distance.patch
    * openssl-static-deps.patch


author: vcizek@suse.com
changelog:
  - Tolerate a Certificate using a non-supported group on server side
    (boo#1084651)
    * https://github.com/openssl/openssl/pull/5607
    * add 0001-Tolerate-a-Certificate-using-a-non-supported-group-o.patch


author: vcizek@suse.com
changelog:
  - Fix escaping in c_rehash (boo#1091961, bsc#1091963)
    * add 0001-Revert-util-dofile.pl-only-quote-stuff-that-actually.patch


author: vcizek@suse.com
changelog:
  - OpenSSL Security Advisory [16 Apr 2018]
    * Cache timing vulnerability in RSA Key Generation
      (CVE-2018-0737, bsc#1089039)
    * add openssl-CVE-2018-0737.patch


author: sflees@suse.de
changelog:
  - Reject excessively large primes in DH key generation (bsc#1097158,
    CVE-2018-0732)
    * openssl-CVE-2018-0732.patch
  - blinding enhancements for ECDSA and DSA (bsc#1097624, bsc#1098592)
    * openssl-add-blinding-to-ecdsa.patch
    * openssl-add-blinding-to-dsa.patch


author: vcizek@suse.com
changelog:
  - Relax CN name restrictions (bsc#1084011)
    * added patches:
      0001-Limit-scope-of-CN-name-constraints.patch
      0002-Skip-CN-DNS-name-constraint-checks-when-not-needed.patch


author: vcizek@suse.com
changelog:
  - Suggest libopenssl1_1-hmac from libopenssl1_1 package to avoid
    dependency issues during updates (bsc#1090765)


author: vcizek@suse.com
changelog:
  - Add openssl(cli) Provide so the packages that require the openssl
    binary can require this instead of the new openssl meta package
    (bsc#1101470)
  - Don't Require openssl-1_1 from the devel package, just Recommend it


author: vcizek@suse.com
changelog:
  - Update to 1.1.0i
    - Align with SLE-12-SP4
    OpenSSL Security Advisory [12 June 2018]
    * Reject excessively large primes in DH key generation
      (bsc#1097158, CVE-2018-0732)
    * Make EVP_PKEY_asn1_new() a bit stricter about its input
    * Revert blinding in ECDSA sign and instead make problematic addition
      length-invariant. Switch even to fixed-length Montgomery multiplication.
    * Change generating and checking of primes so that the error rate of not
      being prime depends on the intended use based on the size of the input.
    * Increase the number of Miller-Rabin rounds for DSA key generating to 64.
    * Add blinding to ECDSA and DSA signatures to protect against side channel
      attacks
    * When unlocking a pass phrase protected PEM file or PKCS#8 container, we
      now allow empty (zero character) pass phrases.
    * Certificate time validation (X509_cmp_time) enforces stricter
      compliance with RFC 5280. Fractional seconds and timezone offsets
      are no longer allowed.
    * Fixed a text canonicalisation bug in CMS
  - drop patches (upstream):
    * 0001-Limit-scope-of-CN-name-constraints.patch
    * 0001-Revert-util-dofile.pl-only-quote-stuff-that-actually.patch
    * 0001-Tolerate-a-Certificate-using-a-non-supported-group-o.patch
    * 0002-Skip-CN-DNS-name-constraint-checks-when-not-needed.patch
    * openssl-add-blinding-to-dsa.patch
    * openssl-add-blinding-to-ecdsa.patch
    * openssl-CVE-2018-0732.patch
  - refresh patches:
    * openssl-1.1.0-fips.patch
    * openssl-disable_rsa_keygen_tests_with_small_modulus.patch
  - rename openssl-CVE-2018-0737.patch to openssl-CVE-2018-0737-fips.patch
    as it now only includes changes to the fips code


author: vcizek@suse.com
changelog:
  - Fix infinite loop in DSA generation with incorrect parameters
    (bsc#1112209)
    * add openssl-dsa_paramgen2_check.patch


author: vcizek@suse.com
changelog:
  - Obsolete libopenssl-1_0_0-devel by libopenssl-1_1-devel to avoid
    conflicts when updating from older distributions (bsc#1106180)


author: vcizek@suse.com
changelog:
  - OpenSSL Security Advisory [30 October 2018]
    * Timing vulnerability in ECDSA signature generation
      (bsc#1113651, CVE-2018-0735)
    * Timing vulnerability in DSA signature generation
      (bsc#1113652, CVE-2018-0734)
    * And more timing fixes
  - Add patches:
    * openssl-CVE-2018-0734.patch
    * openssl-CVE-2018-0735.patch
    * 0001-DSA-mod-inverse-fix.patch
    * 0001-Add-a-constant-time-flag-to-one-of-the-bignums-to-av.patch


author: vcizek@suse.com
changelog:
  - The 9 Lives of Bleichenbacher's CAT: Cache ATtacks on TLS
    Implementations (bsc#1117951)
    * https://github.com/openssl/openssl/issues/7739
    * add patch openssl-Bleichenbachers_CAT.patch


author: vcizek@suse.com
changelog:
  - Fix FIPS RSA generator (bsc#1118913)
    * import fixed openssl-1.1.0-fips.patch from Fedora
    * drop openssl-CVE-2018-0737-fips.patch which got merged into
      openssl-1.1.0-fips.patch
    * refresh openssl-fips-rsagen-d-bits.patch


author: vcizek@suse.com
changelog:
  - Replace fate#321518 s390x patches from closed pull request
    https://github.com/openssl/openssl/pull/2859 with patches from
    openssl git master (bsc#1122984)
  - add patches:
    0001-s390x-assembly-pack-extend-s390x-capability-vector.patch
    0002-s390x-assembly-pack-add-KMA-code-path-for-aes-ctr.patch
    0003-crypto-aes-asm-aes-s390x.pl-replace-decrypt-flag-by-.patch
    0004-s390x-assembly-pack-add-KMA-code-path-for-aes-gcm.patch
    0005-s390x-assembly-pack-add-KMAC-code-path-for-aes-ccm.patch
    0006-s390x-assembly-pack-add-KM-code-path-for-aes-ecb.patch
    0007-s390x-assembly-pack-add-KMO-code-path-for-aes-ofb.patch
    0008-s390x-assembly-pack-add-KMF-code-path-for-aes-cfb-cf.patch
    0009-Fix-undefined-behavior-in-s390x-aes-gcm-ccm.patch
  - drop patches:
    0002-crypto-modes-asm-ghash-s390x.pl-fix-gcm_gmult_4bit-K.patch
    0004-s390x-assembly-pack-add-OPENSSL_s390xcap-environment.patch
    0005-s390x-assembly-pack-add-OPENSSL_s390xcap-man-page.patch
    0006-s390x-assembly-pack-extended-s390x-capability-vector.patch
    0007-crypto-evp-e_aes.c-add-foundations-for-extended-s390.patch
    0008-s390x-assembly-pack-extended-s390x-capability-vector.patch
    0009-crypto-aes-asm-aes-s390x.pl-add-KMA-code-path.patch
    0010-doc-man3-OPENSSL_s390xcap.pod-update-KMA.patch
    0011-crypto-aes-asm-aes-s390x.pl-add-CFI-annotations-KMA-.patch
    0012-s390x-assembly-pack-add-KMA-code-path-for-aes-gcm.patch
    0013-crypto-aes-asm-aes-s390x.pl-add-CFI-annotations-KMA-.patch


author: vcizek@suse.com
changelog:
  - Add vectorized chacha20 implementation for s390x (fate#326561)
    * https://github.com/openssl/openssl/pull/6919
  - add patches:
    0001-s390x-assembly-pack-perlasm-support.patch
    0002-crypto-chacha-asm-chacha-s390x.pl-add-vx-code-path.patch


author: vcizek@suse.com
changelog:
  - Add s390x poly1305 vectorized implementation (fate#326351)
    * https://github.com/openssl/openssl/pull/7991
  - add 0001-crypto-poly1305-asm-poly1305-s390x.pl-add-vx-code-pa.patch


author: vcizek@suse.com
changelog:
  - OpenSSL Security Advisory [6 March 2019]
    * Prevent long nonces in ChaCha20-Poly1305 (bsc#1128189, CVE-2019-1543)
    * add openssl-CVE-2019-1543.patch


author: vcizek@suse.com
changelog:
  - Fix segfault in openssl speed when an unknown algorithm is passed
    (bsc#1125494)
    * add 0001-apps-speed-fix-segfault-while-looking-up-algorithm-n.patch
  - Correctly skip binary curves in openssl speed to avoid spitting
    errors (bsc#1116833)
    * add openssl-speed_skip_binary_curves_NO_EC2M.patch


author: vcizek@suse.com
changelog:
  - Upgrade to 1.1.1c (jsc#SLE-9135, bsc#1148799)
    * Support for TLSv1.3 added
    * Allow GNU style "make variables" to be used with Configure.
    * Add a STORE module (OSSL_STORE)
    * Claim the namespaces OSSL and OPENSSL, represented as symbol prefixes
    * Add multi-prime RSA (RFC 8017) support
    * Add SM3 implemented according to GB/T 32905-2016
    * Add SM4 implemented according to GB/T 32907-2016.
    * Add 'Maximum Fragment Length' TLS extension negotiation and support
    * Add ARIA support
    * Add SHA3
    * Rewrite of devcrypto engine
    * Add support for SipHash
    * Grand redesign of the OpenSSL random generator
  - drop FIPS support
    * don't build with FIPS mode (not supported in 1.1.1)
    - drop FIPS patches
    * openssl-fips-clearerror.patch
    * openssl-fips_disallow_ENGINE_loading.patch
    * openssl-fips-dont-fall-back-to-default-digest.patch
    * openssl-fips-dont_run_FIPS_module_installed.patch
    * openssl-fips-fix-odd-rsakeybits.patch
    * openssl-fips-rsagen-d-bits.patch
    * openssl-fips-selftests_in_nonfips_mode.patch
    * openssl-rsakeygen-minimum-distance.patch
    * openssl-1.1.0-fips.patch
  - add TLS 1.3 ciphers to DEFAULT_SUSE
  - merge openssl-1.0.1e-add-suse-default-cipher.patch and
    openssl-1.0.1e-add-test-suse-default-cipher-suite.patch to
    openssl-DEFAULT_SUSE_cipher.patch
  - Use upstream patch for the locale crash (bsc#1135550)
    * https://github.com/openssl/openssl/pull/8966
    * add 0001-build_SYS_str_reasons-Fix-a-crash-caused-by-overlong.patch
  - drop patches (upstream):
    * openssl-Bleichenbachers_CAT.patch
    * openssl-CVE-2018-0734.patch
    * openssl-CVE-2018-0735.patch
    * openssl-CVE-2019-1543.patch
    * openssl-disable_rsa_keygen_tests_with_small_modulus.patch
    * openssl-dsa_paramgen2_check.patch
    * openssl-One_and_Done.patch
    * openssl-speed_skip_binary_curves_NO_EC2M.patch
    * openssl-static-deps.patch
    * openssl-urandom-reseeding.patch
    * 0001-Add-a-constant-time-flag-to-one-of-the-bignums-to-av.patch
    * 0001-Axe-builtin-printf-implementation-use-glibc-instead.patch
    * 0001-DSA-mod-inverse-fix.patch
    * 0001-Resume-reading-from-randfile-when-interrupted-by-a-s.patch
    * 0001-apps-speed-fix-segfault-while-looking-up-algorithm-n.patch
  - drop s390x patches (rebased):
    * 0002-s390x-assembly-pack-add-KMA-code-path-for-aes-ctr.patch
    * 0003-crypto-aes-asm-aes-s390x.pl-replace-decrypt-flag-by-.patch
    * 0004-s390x-assembly-pack-add-KMA-code-path-for-aes-gcm.patch
    * 0005-s390x-assembly-pack-add-KMAC-code-path-for-aes-ccm.patch
    * 0006-s390x-assembly-pack-add-KM-code-path-for-aes-ecb.patch
    * 0007-s390x-assembly-pack-add-KMO-code-path-for-aes-ofb.patch
    * 0008-s390x-assembly-pack-add-KMF-code-path-for-aes-cfb-cf.patch
    * 0009-Fix-undefined-behavior-in-s390x-aes-gcm-ccm.patch
    * 0001-crypto-poly1305-asm-poly1305-s390x.pl-add-vx-code-pa.patch
    * 0001-s390x-assembly-pack-extend-s390x-capability-vector.patch
  - add s390x patches:
    * 0001-s390x-assembly-pack-perlasm-support.patch
    * 0002-crypto-chacha-asm-chacha-s390x.pl-add-vx-code-path.patch
    * 0003-crypto-poly1305-asm-poly1305-s390x.pl-add-vx-code-pa.patch
    * 0004-s390x-assembly-pack-fix-formal-interface-bug-in-chac.patch
    * 0005-s390x-assembly-pack-import-chacha-from-cryptogams-re.patch
    * 0006-s390x-assembly-pack-import-poly-from-cryptogams-repo.patch


author: jsikes@suse.com
changelog:
  - To avoid seperate certification of openssh server / client
    move the SSH KDF (Key Derivation Function) into openssl.
    * jsc#SLE-8789
    * Sourced from commit
      8d76481b189b7195ef932e0fb8f0e23ab0120771#diff-a9562bc75317360a2e6b8b0748956e34
      in openssl master (introduce the SSH KDF)
      and commit 5a285addbf39f91d567f95f04b2b41764127950d
      in openssl master (backport EVP/KDF API framework)
    * added openssl-jsc-SLE-8789-backport_KDF.patch


author: vcizek@suse.com
changelog:
  - Update to 1.1.1d (bsc#1133925, jsc#SLE-6430)
    * Fixed a fork protection issue. OpenSSL 1.1.1 introduced a rewritten random
      number generator (RNG). This was intended to include protection in the
      event of a fork() system call in order to ensure that the parent and child
      processes did not share the same RNG state. However this protection was not
      being used in the default case.
      (bsc#1150247, CVE-2019-1549)
    * Compute ECC cofactors if not provided during EC_GROUP construction. Before
      this change, EC_GROUP_set_generator would accept order and/or cofactor as
      NULL. After this change, only the cofactor parameter can be NULL.
      (bsc#1150003, CVE-2019-1547)
    * Fixed a padding oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey.
      (bsc#1150250, CVE-2019-1563)
    * For built-in EC curves, ensure an EC_GROUP built from the curve name is
      used even when parsing explicit parameters, when loading a serialized key
      or calling EC_GROUP_new_from_ecpkparameters()/EC_GROUP_new_from_ecparameters().
    * Early start up entropy quality from the DEVRANDOM seed source has been
      improved for older Linux systems.
    * Changed DH_check to accept parameters with order q and 2q subgroups.
      With order 2q subgroups the bit 0 of the private key is not secret
      but DH_generate_key works around that by clearing bit 0 of the
      private key for those. This avoids leaking bit 0 of the private key.
    * Significantly reduce secure memory usage by the randomness pools.
    * Revert the DEVRANDOM_WAIT feature for Linux systems
  - drop 0001-build_SYS_str_reasons-Fix-a-crash-caused-by-overlong.patch (upstream)
  - refresh patches
    * openssl-1.1.0-no-html.patch
    * openssl-jsc-SLE-8789-backport_KDF.patch


author: jsikes@suse.com
changelog:
  - Fixed EVP_PBE_scrypt() to allow NULL salt values.
    * Revealed by nodejs12 during bsc#1149572.
    * Modified openssl-jsc-SLE-8789-backport_KDF.patch


author: pmonrealgonzalez@suse.com
changelog:
  - Security fix: [bsc#1158809, CVE-2019-1551]
    * Overflow bug in the x64_64 Montgomery squaring procedure used
      in exponentiation with 512-bit moduli
  - Add openssl-1_1-CVE-2019-1551.patch


author: vcizek@suse.com
changelog:
  - Obsolete libopenssl-1_0_0-devel and libopenssl-1_0_0-hmac in order
    to avoid conflict upon upgrade from SLE-12 (bsc#1158499)


author: pmonrealgonzalez@suse.com
changelog:
  - Support for CPACF enhancements - part 1 (crypto) [bsc#1152695, jsc#SLE-7861]
  - Add patches:
    * openssl-s390x-assembly-pack-add-OPENSSL_s390xcap-environment.patch
    * openssl-s390x-assembly-pack-add-support-for-pcc-and-kma-inst.patch
    * openssl-s390x-assembly-pack-add-OPENSSL_s390xcap-man-page.patch
    * openssl-s390x-assembly-pack-update-OPENSSL_s390xcap-3.patch
    * openssl-s390xcpuid.pl-fix-comment.patch
    * openssl-assembly-pack-accelerate-scalar-multiplication.patch
    * openssl-Enable-curve-spefific-ECDSA-implementations-via-EC_M.patch
    * openssl-s390x-assembly-pack-accelerate-ECDSA.patch
    * openssl-OPENSSL_s390xcap.pod-list-msa9-facility-bit-155.patch
    * openssl-s390x-assembly-pack-cleanse-only-sensitive-fields.patch
    * openssl-s390x-assembly-pack-fix-OPENSSL_s390xcap-z15-cpu-mas.patch
    * openssl-s390x-assembly-pack-fix-msa3-stfle-bit-detection.patch
    * openssl-Fix-9bf682f-which-broke-nistp224_method.patch


author: vcizek@suse.com
changelog:
  - Import FIPS patches from Fedora (bsc#1157702, jsc#SLE-9553)
    * openssl-1.1.1-fips-crng-test.patch
    * openssl-1.1.1-fips-post-rand.patch
    * openssl-1.1.1-fips.patch
    * openssl-1.1.0-issuer-hash.patch
    * openssl-1.1.1-evp-kdf.patch
    * openssl-1.1.1-ssh-kdf.patch replaces openssl-jsc-SLE-8789-backport_KDF.patch
  - keep EVP_KDF functions at version 1.1.1d for backward compatibility
    * add openssl-keep_EVP_KDF_functions_version.patch


author: vcizek@suse.com
changelog:
  - Don't run FIPS power-up self-tests when the checksum files aren't
    installed (bsc#1042392)
    * add openssl-fips-run_selftests_only_when_module_is_complete.patch


author: vcizek@suse.com
changelog:
  - Import FIPS patches from SLE-15
    * openssl-fips-dont_run_FIPS_module_installed.patch
    * openssl-fips_mode.patch
    * openssl-ship_fips_standalone_hmac.patch
    * openssl-fips-clearerror.patch
    * openssl-fips-selftests_in_nonfips_mode.patch


author: vcizek@suse.com
changelog:
  - Temporarily ignore broken OPENSSL_INIT_NO_ATEXIT due to our
    layered FIPS initialization (bsc#1161789)
    * openssl-fips-ignore_broken_atexit_test.patch


author: pmonrealgonzalez@suse.com
changelog:
  - Support for CPACF enhancements - part 2 (crypto) [jsc#SLE-7403]
  - Add patches:
    * openssl-s390x-assembly-pack-accelerate-X25519-X448-Ed25519-and-Ed448.patch
    * openssl-s390x-fix-x448-and-x448-test-vector-ctime-for-x25519-and-x448.patch


author: vcizek@suse.com
changelog:
  - Fix wrong return values of FIPS DSA and ECDH selftests (bsc#1163569)
    * add openssl-fips_fix_selftests_return_value.patch


author: vcizek@suse.com
changelog:
  - Use the newly build libcrypto shared library when computing the hmac
    checksums in order to avoid a bootstrapping issue by BuildRequiring
    libopenssl1_1 (bsc#1164102)


author: vcizek@suse.com
changelog:
  - Run FIPS DRBG selftests against the crypto/rand DRBG implementation
    (bsc#1164557)
    * add openssl-fips_selftest_upstream_drbg.patch


author: vcizek@suse.com
changelog:
  - Limit the DRBG selftests to not deplete entropy (bsc#1165274)
    * update openssl-fips_selftest_upstream_drbg.patch


author: vcizek@suse.com
changelog:
  - openssl dgst: default to SHA256 only when called without a digest,
    not when it couldn't be found (bsc#1166189)
    * add openssl-unknown_dgst.patch


author: pmonrealgonzalez@suse.com
changelog:
  - Security fix: [bsc#1169407, CVE-2020-1967]
    * Segmentation fault in SSL_check_chain: Server applications that
      call the SSL_check_chain() function during or after a TLS handshake
      may crash due to a NULL pointer dereference as a result of incorrect
      handling of the signature_algorithms_cert TLS extension.
  - Add patches:
    * openssl-CVE-2020-1967.patch
    * openssl-CVE-2020-1967-test1.patch
    * openssl-CVE-2020-1967-test2.patch
    * openssl-CVE-2020-1967-test3.patch


author: pmonreal@suse.com
changelog:
  - Include ECDH/DH Requirements from SP800-56Arev3 [bsc#1175844, bsc#1173470]
  - Add patches:
    * openssl-DH.patch
    * openssl-kdf-selftest.patch
    * openssl-kdf-tls-selftest.patch
    * openssl-kdf-ssh-selftest.patch


author: vcizek@suse.com
changelog:
  - Add shared secret KAT to FIPS DH selftest [bsc#1175844]
    * add openssl-fips-DH_selftest_shared_secret_KAT.patch


author: vcizek@suse.com
changelog:
  - Fix EDIPARTYNAME NULL pointer dereference
    (CVE-2020-1971, bsc#1179491)
    * add openssl-CVE-2020-1971.patch


author: pmonreal@suse.com
changelog:
  - Security fixes:
    * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
      protection [bsc#1182333, CVE-2021-23840]
    * Null pointer deref in X509_issuer_and_serial_hash()
      [bsc#1182331, CVE-2021-23841]
  - Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch


author: jsikes@suse.com
changelog:
  - Fix NULL pointer deref in signature_algorithms
    * CVE-2021-3449
    * bsc#1183852
    * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch


author: jsikes@suse.com
changelog:
  - Don't list disapproved cipher algorithms while in FIPS mode
    * openssl-1.1.1-fips_list_ciphers.patch
    * bsc#1161276


author: jsikes@suse.com
changelog:
  - A bug in the implementation of the SM2 decryption code means that the
    calculation of the buffer size required to hold the plaintext returned by the
    first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
    the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
    called by the application a second time with a buffer that is too small.
    * CVE-2021-3711
    * bsc#1189520
    * Add:
      CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
      CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
      CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
  - The function X509_aux_print() has a bug which may cause a read buffer overrun
    when printing certificate details. A malicious actor could construct a
    certificate to deliberately hit this bug, which may result in a crash of the
    application (causing a Denial of Service attack).
    * CVE-2021-3712
    * bsc#1189521
    * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch


author: jsikes@suse.com
changelog:
  - Other OpenSSL functions that print ASN.1 data have been found to assume that
    the ASN1_STRING byte array will be NUL terminated, even though this is not
    guaranteed for strings that have been directly constructed. Where an application
    requests an ASN.1 structure to be printed, and where that ASN.1 structure
    contains ASN1_STRINGs that have been directly constructed by the application
    without NUL terminating the "data" field, then a read buffer overrun can occur.
    * CVE-2021-3712 continued
    * bsc#1189521
    * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
    * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
      2021-08-24 00:47 PDT by Marcus Meissner


author: jsikes@suse.com
changelog:
  - Update to openssl-1.1.1l ('L' as in 'Lima') for SUSE-SLE-15-SP4
    * jsc#SLE-19640, jsc#PM-2816
  - Changes in 1.1.1l:
    * [bsc#1189520, CVE-2021-3711] Fixed an SM2 Decryption Buffer Overflow.
    * [bsc#1189521, CVE-2021-3712] Fixed various read buffer overruns
      processing ASN.1 strings
  - Changes in 1.1.1k
    * Fixed a problem with verifying a certificate chain when using
      the X509_V_FLAG_X509_STRICT flag. This flag enables additional
      security checks of the certificates present in a certificate
      chain. It is not set by default. ([CVE-2021-3450])
      [bsc#1183851]
    * Fixed an issue where an OpenSSL TLS server may crash if sent a
      maliciously crafted renegotiation ClientHello message from a
      client. If a TLSv1.2 renegotiation ClientHello omits the
      signature_algorithms extension (where it was present in the
      initial ClientHello), but includes a signature_algorithms_cert
      extension then a NULL pointer dereference will result, leading
      to a crash and a denial of service attack.
      A server is only vulnerable if it has TLSv1.2 and renegotiation
      enabled (which is the default configuration). OpenSSL TLS
      clients are not impacted by this issue. ([CVE-2021-3449])
      [bsc#1183852]
  - Changes in 1.1.1j
    * Fixed the X509_issuer_and_serial_hash() function. It attempts
      to create a unique hash value based on the issuer and serial
      number data contained within an X509 certificate. However it
      was failing to correctly handle any errors that may occur
      while parsing the issuer field [bsc#1182331, CVE-2021-23841]
    * Fixed the RSA_padding_check_SSLv23() function and the
      RSA_SSLV23_PADDING padding mode to correctly check for
      rollback attacks.
    * Fixed the EVP_CipherUpdate, EVP_EncryptUpdate and
      EVP_DecryptUpdate functions. Previously they could overflow the
      output length argument in some cases where the input length is
      close to the maximum permissable length for an integer on the
      platform. In such cases the return value from the function call
      would be 1 (indicating success), but the output length value
      would be negative. This could cause applications to behave
      incorrectly or crash. [bsc#1182333, CVE-2021-23840]
    * Fixed SRP_Calc_client_key so that it runs in constant time.
      The previous implementation called BN_mod_exp without setting
      BN_FLG_CONSTTIME. This could be exploited in a side channel
      attack to recover the password. Since the attack is local host
      only this is outside of the current OpenSSL threat model and
      therefore no CVE is assigned.
  - Changes in 1.1.1i
    * Fixed NULL pointer deref in GENERAL_NAME_cmp
    * bsc#1179491, CVE-2020-1971
  - Changes in 1.1.1h
    * Disallow explicit curve parameters in verifications chains when X509_V_FLAG_X509_STRICT is used
    * Enable 'MinProtocol' and 'MaxProtocol' to configure both TLS and DTLS contexts
  - Changes in 1.1.1g
    * Fixed segmentation fault in SSL_check_chain (CVE-2020-1967, bsc#1169407)
      Server or client applications that call the SSL_check_chain() function
      during or after a TLS 1.3 handshake may crash due to a NULL pointer
      dereference as a result of incorrect handling of the
      "signature_algorithms_cert" TLS extension. The crash occurs if an invalid
      or unrecognised signature algorithm is received from the peer. This could
      be exploited by a malicious peer in a Denial of Service attack.
    * Added AES consttime code for no-asm configurations
      an optional constant time support for AES was added
      when building openssl for no-asm.
  - Changes in 1.1.1f
    * Revert the unexpected EOF reporting via SSL_ERROR_SSL
  - Changes in 1.1.1e
    * Properly detect EOF while reading in libssl. Previously if we hit an EOF
      while reading in libssl then we would report an error back to the
      application (SSL_ERROR_SYSCALL) but errno would be 0. We now add
      an error to the stack (which means we instead return SSL_ERROR_SSL) and
      therefore give a hint as to what went wrong.
    * Check that ed25519 and ed448 are allowed by the security level. Previously
      signature algorithms not using an MD were not being checked that they were
      allowed by the security level.
    * Fixed SSL_get_servername() behaviour. The behaviour of SSL_get_servername()
      was not quite right. The behaviour was not consistent between resumption
      and normal handshakes, and also not quite consistent with historical
      behaviour. The behaviour in various scenarios has been clarified and
      it has been updated to make it match historical behaviour as closely as
      possible.
    * Corrected the documentation of the return values from the EVP_DigestSign*
      set of functions.  The documentation mentioned negative values for some
      errors, but this was never the case, so the mention of negative values
      was removed.
    * Added a new method to gather entropy on VMS, based on SYS$GET_ENTROPY.
      The presence of this system service is determined at run-time.
    * Added newline escaping functionality to a filename when using openssl dgst.
      This output format is to replicate the output format found in the '*sum'
      checksum programs. This aims to preserve backward compatibility.
    * Print all values for a PKCS#12 attribute with 'openssl pkcs12', not just
      the first value.
  - Dropped the following patches:
    * openssl-1_1-CVE-2019-1551.patch
    * openssl-fips-dont_run_FIPS_module_installed.patch
    * openssl-fips_fix_selftests_return_value.patch
    * openssl-CVE-2020-1967.patch
    * openssl-CVE-2020-1967-test1.patch
    * openssl-CVE-2020-1967-test2.patch
    * openssl-CVE-2020-1967-test3.patch
    * openssl-CVE-2020-1971.patch
    * openssl-CVE-2021-23840.patch
    * openssl-CVE-2021-23841.patch
    * openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch
    * openssl-1.1.1-fips_list_ciphers.patch
    * CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    * CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    * CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
    * CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch
    * CVE-2021-3712-other-ASN1_STRING-issues.patch
  - Rebased the following patches:
    * 0002-crypto-chacha-asm-chacha-s390x.pl-add-vx-code-path.patch
    * 0003-crypto-poly1305-asm-poly1305-s390x.pl-add-vx-code-pa.patch
    * openssl-1.1.0-issuer-hash.patch
    * openssl-1.1.0-no-html.patch
    * openssl-1.1.1-evp-kdf.patch
    * openssl-1.1.1-fips-crng-test.patch
    * openssl-1.1.1-fips-post-rand.patch
    * openssl-1.1.1-fips.patch
    * openssl-1.1.1-ssh-kdf.patch
    * openssl-DH.patch
    * openssl-Enable-curve-spefific-ECDSA-implementations-via-EC_M.patch
    * openssl-assembly-pack-accelerate-scalar-multiplication.patch
    * openssl-fips_selftest_upstream_drbg.patch
    * openssl-kdf-selftest.patch
    * openssl-kdf-ssh-selftest.patch
    * openssl-kdf-tls-selftest.patch
    * openssl-s390x-assembly-pack-accelerate-ECDSA.patch
    * openssl-s390x-assembly-pack-accelerate-X25519-X448-Ed25519-and-Ed448.patch
    * openssl-s390x-assembly-pack-add-OPENSSL_s390xcap-environment.patch
    * openssl-s390x-fix-x448-and-x448-test-vector-ctime-for-x25519-and-x448.patch


author: jsikes@suse.com
changelog:
  - Import centralized crypto policy profile from Factory [jsc#SLE-15832]
    * openssl-1.1.1-system-cipherlist.patch
    * openssl-1_1-disable-test_srp-sslapi.patch
    * openssl-1_1-seclevel.patch
    * openssl-1_1-use-seclevel2-in-tests.patch


author: pmonreal@suse.com
changelog:
  - POWER10 performance enhancements for cryptography [jsc#SLE-18136]
    * openssl-1_1-Optimize-ppc64.patch


author: pmonreal@suse.com
changelog:
  - Add support for livepatches (jsc#SLE-20049).
  - Generate ipa-clones tarball artifact when livepatching is enabled.


author: pmonreal@suse.com
changelog:
  - Backport cryptographic improvements from OpenSSL 3 [jsc#SLE-19742]
    * Optimize RSA on armv8: openssl-1_1-Optimize-RSA-armv8.patch
    * Optimize AES-XTS mode for aarch64:
      openssl-1_1-Optimize-AES-XTS-aarch64.patch
    * Optimize AES-GCM for uarchs with unroll and new instructions:
      openssl-1_1-Optimize-AES-GCM-uarchs.patch


author: pmonreal@suse.com
changelog:
  - FIPS: Add missing KAT for HKDF/TLS 1.3/IPSEC IKEv2 [bsc#1192442]
    * Add openssl-fips-kdf-hkdf-selftest.patch


author: pmonreal@suse.com
changelog:
  - FIPS: Move the HMAC-SHA2-256 used for integrity test [bsc#1185320]
    * Add openssl-FIPS-KAT-before-integrity-tests.patch


author: pmonreal@suse.com
changelog:
  - Remove the openssl-has-RSA_get0_pss_params provides as it is
    now fixed in the nodejs16 side [bsc#1192489]


author: pmonreal@suse.com
changelog:
  - FIPS: Fix function and reason error codes [bsc#1182959]
    * Add openssl-1_1-FIPS-fix-error-reason-codes.patch


author: pmonreal@suse.com
changelog:
  - FIPS: Fix sn_objs and ln_objs in crypto/objects/obj_mac.num
    * Rebase openssl-DH.patch [bsc#1194327]
  - Merge openssl-keep_EVP_KDF_functions_version.patch into
    openssl-1.1.1-evp-kdf.patch
  - Add function codes for pbkdf2, hkdf, tls and ssh selftests.
    Rebase patches:
    * openssl-fips-kdf-hkdf-selftest.patch
    * openssl-kdf-selftest.patch
    * openssl-kdf-ssh-selftest.patch
    * openssl-kdf-tls-selftest.patch


author: pmonreal@suse.com
changelog:
  - FIPS: Reintroduce the FFC and ECC checks in openssl-DH.patch
    that were removed in the update to 1.1.1l [bsc#1185313]


author: pmonreal@suse.com
changelog:
  - Security fix: [bsc#1192820, CVE-2002-20001]
    * Fix DHEATER: The Diffie-Hellman Key Agreement Protocol allows
      remote attackers (from the client side) to send arbitrary
      numbers that are actually not public keys, and trigger
      expensive server-side DHE calculation.
    * Stop recommending the DHE in SSL_DEFAULT_SUSE_CIPHER_LIST
    * Rebase openssl-DEFAULT_SUSE_cipher.patch


author: jsikes@suse.com
changelog:
  - FIPS: add openssl-1_1-fips-bsc1190652_release_num_in_version_string.patch
    * bsc#1190652 - Provide a service to output module name/identifier
      and version


author: pmonreal@suse.com
changelog:
  - Added openssl-1_1-use-include-directive.patch so that the default
    /etc/ssl/openssl.cnf file will include any configuration files that
    other packages might place into /etc/ssl/engines.d/ and
    /etc/ssl/engdef.d/ This is a fix for bsc#1004463 where scripting was
    being used to modify the openssl.cnf file. The scripting would fail
    if either the default openssl.cnf file, or the sample openssl-ibmca
    configuration file would be changed by upstream.
  - Updated spec file to create the two new necessary directores for
    the above patch. [bsc#1194187, bsc#1004463]


author: pmonreal@suse.com
changelog:
  - Security Fix: [bsc#1196877, CVE-2022-0778]
    * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
    * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch


author: pmonreal@suse.com
changelog:
  - FIPS: Additional PBKDF2 requirements for KAT [bsc#1197280]
    * The IG 10.3.A and SP800-132 require some minimum parameters for
      the salt length, password length and iteration count. These
      parameters should be also used in the KAT.
    * Add openssl-1_1-FIPS-PBKDF2-KAT-requirements.patch


author: jsikes@suse.com
changelog:
  - FIPS: add bsc1185319-FIPS-KAT-for-ECDSA.patch
    * Known answer test for ECDSA
    * bsc#1185319
  - FIPS: add bsc1198207-FIPS-add-hash_hmac-drbg-kat.patch
    * Enable tests for Deterministic Random Bit Generator
    * bsc#1198207
  - Bypass a regression test that fails in FIPS mode.
    * [openssl-1_1-shortcut-test_afalg_aes_cbc.patch]


author: jsikes@suse.com
changelog:
  - Security fix: [bsc#1199166, CVE-2022-1292]
    * Added: openssl-CVE-2022-1292.patch
    * properly sanitise shell metacharacters in c_rehash script.


author: jsikes@suse.com
changelog:
  - Added openssl-update_expired_certificates.patch
    * Openssl failed tests because of expired certificates.
    * bsc#1185637
    * Sourced from https://github.com/openssl/openssl/pull/18446/commits


author: jsikes@suse.com
changelog:
  - Added openssl-1_1-Fix-file-operations-in-c_rehash.patch
    * bsc#1200550
    * CVE-2022-2068
    * Fixed more shell code injection issues in c_rehash


author: jsikes@suse.com
changelog:
  - Encrypt the sixteen bytes that were unencrypted in some circumstances
    on 32-bit x86 platforms.
    * [bsc#1201099, CVE-2022-2097]
    * added openssl-CVE-2022-2097.patch


author: pmonreal@suse.com
changelog:
  - FIPS: Add zeroization of temporary variables to the hmac integrity
    function FIPSCHECK_verify(). [bsc#1190653]
    * Add openssl-1_1-Zeroization.patch


author: pmonreal@suse.com
changelog:
  - FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
    * Add patches:
    - openssl-1_1-ossl-sli-000-fix-build-error.patch
    - openssl-1_1-ossl-sli-001-fix-faults-preventing-make-update.patch
    - openssl-1_1-ossl-sli-002-ran-make-update.patch
    - openssl-1_1-ossl-sli-003-add-sli.patch


author: otto.hollmann@suse.com
changelog:
  - FIPS: OpenSSL: Port openssl to use jitterentropy
    [bsc#1202148, jsc#SLE-24941]
    * Add openssl-1_1-jitterentropy-3.4.0.patch
    * Add build dependency on jitterentropy-devel >= 3.4.0 and
      libjitterentropy3 >= 3.4.0


author: otto.hollmann@suse.com
changelog:
  - Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
    * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch


author: pmonreal@suse.com
changelog:
  - FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
    * The FIPS_drbg implementation is not FIPS validated anymore. To
      provide backwards compatibility for applications that need FIPS
      compliant RNG number generation and use FIPS_drbg_generate,
      this function was re-wired to call the FIPS validated DRBG
      instance instead through the RAND_bytes() call.
    * Add openssl-1_1-FIPS_drbg-rewire.patch


author: pmonreal@suse.com
changelog:
  - FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
    * Add openssl-1_1-fips-drbg-selftest.patch


author: otto.hollmann@suse.com
changelog:
  - FIPS: list only FIPS approved digest and public key algorithms
    [bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
    * Add openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
    * Disabled test 15-test_ec.t in FIPS mode


author: pmonreal@suse.com
changelog:
  - FIPS: Default to RFC-7919 groups for genparam and dhparam
    * Add openssl-1_1-FIPS-default-RFC7919.patch [bsc#1180995]


author: otto.hollmann@suse.com
changelog:
  - FIPS: OpenSSL service-level indicator - Allow AES XTS 256 [bsc#1190651]
    * Add patches: openssl-1_1-ossl-sli-004-allow-aes-xts-256.patch


author: pmonreal@suse.com
changelog:
  - FIPS: Service-level indicator [bsc#1190651]
    * Return the correct indicator for a given EC group order bits
    * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch


author: pmonreal@suse.com
changelog:
  - FIPS: Service-level indicator [bsc#1190651]
    * Consider RSA siggen/sigver with PKCS1 padding also approved
    * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch


author: pmonreal@suse.com
changelog:
  - FIPS: Service-level indicator [bsc#1190651]
    * Mark PBKDF2 with key shorter than 112 bits as non-approved
    * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch


author: otto.hollmann@suse.com
changelog:
  - POWER10 performance enhancements for cryptography [jsc#PED-512]
    * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch
    * openssl-1_1-Fixed-counter-overflow.patch
    * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch
    * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch
    * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch


author: pmonreal@suse.com
changelog:
  - Security Fix: [bsc#1207534, CVE-2022-4304]
    * Timing Oracle in RSA Decryption
    * Add patches:
    - openssl-CVE-2022-4304-1of2.patch
    - openssl-CVE-2022-4304-2of2.patch


author: pmonreal@suse.com
changelog:
  - Security Fix: [bsc#1207538, CVE-2022-4450]
    * Double free after calling PEM_read_bio_ex()
    * Add patches:
    - openssl-CVE-2022-4450-1of2.patch
    - openssl-CVE-2022-4450-2of2.patch


author: pmonreal@suse.com
changelog:
  - Security Fix: [bsc#1207536, CVE-2023-0215]
    * Use-after-free following BIO_new_NDEF()
    * Add patches:
    - openssl-CVE-2023-0215-1of4.patch
    - openssl-CVE-2023-0215-2of4.patch
    - openssl-CVE-2023-0215-3of4.patch
    - openssl-CVE-2023-0215-4of4.patch


author: pmonreal@suse.com
changelog:
  - Security Fix: [bsc#1207533, CVE-2023-0286]
    * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
      for x400Address
    * Add openssl-CVE-2023-0286.patch


author: otto.hollmann@suse.com
changelog:
  - FIPS: Serialize jitterentropy calls [bsc#1207994]
    * Add openssl-1_1-serialize-jitterentropy-calls.patch


author: otto.hollmann@suse.com
changelog:
  - FIPS: Service-level indicator [bsc#1208998]
    * Add additional check required by FIPS 140-3. Minimum values for
      PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for
      iteration count and 20 characters for password.
    * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch


author: otto.hollmann@suse.com
changelog:
  - Security Fix: [CVE-2023-0464, bsc#1209624]
    * Excessive Resource Usage Verifying X.509 Policy Constraints
    * Add openssl-CVE-2023-0464.patch


author: otto.hollmann@suse.com
changelog:
  - Security Fix: [CVE-2023-0465, bsc#1209878]
    * Invalid certificate policies in leaf certificates are silently ignored
    * Add openssl-CVE-2023-0465.patch
  - Security Fix: [CVE-2023-0466, bsc#1209873]
    * Certificate policy check not enabled
    * Add openssl-CVE-2023-0466.patch


author: otto.hollmann@suse.com
changelog:
  - Security Fix: [CVE-2023-2650, bsc#1211430]
    * Possible DoS translating ASN.1 object identifiers
    * Add openssl-CVE-2023-2650.patch


author: otto.hollmann@suse.com
changelog:
  - Update further expiring certificates that affect tests [bsc#1201627]
    * Add openssl-Update-further-expiring-certificates.patch


author: otto.hollmann@suse.com
changelog:
  - Security Fix: [bsc#1207534, CVE-2022-4304]
    * Reworked the Fix for the Timing Oracle in RSA Decryption
      The previous fix for this timing side channel turned out to cause
      a severe 2-3x performance regression in the typical use case
      compared to 1.1.1s.
    * Add openssl-CVE-2022-4304.patch
    * Removed patches:
    - openssl-CVE-2022-4304-1of2.patch
    - openssl-CVE-2022-4304-2of2.patch
    * Refreshed patches:
    - openssl-CVE-2023-0464.patch
    - openssl-CVE-2023-0465.patch


author: pmonreal@suse.com
changelog:
  - Security fix: [bsc#1213487, CVE-2023-3446]
    * Fix DH_check() excessive time with over sized modulus.
    * The function DH_check() performs various checks on DH parameters.
      One of those checks confirms that the modulus ("p" parameter) is
      not too large. Trying to use a very large modulus is slow and
      OpenSSL will not normally use a modulus which is over 10,000 bits
      in length.
      However the DH_check() function checks numerous aspects of the
      key or parameters that have been supplied. Some of those checks
      use the supplied modulus value even if it has already been found
      to be too large.
      A new limit has been added to DH_check of 32,768 bits. Supplying
      a key/parameters with a modulus over this size will simply cause
      DH_check() to fail.
    * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch


author: otto.hollmann@suse.com
changelog:
  - Dont pass zero length input to EVP_Cipher because assembler
    optimized AES cannot handle zero size. [bsc#1213517]
    * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch


author: pmonreal@suse.com
changelog:
  - Security fix: (bsc#1213853, CVE-2023-3817)
    * Fix excessive time spent checking DH q parameter value
      (bsc#1213853, CVE-2023-3817). The function DH_check() performs
      various checks on DH parameters. After fixing CVE-2023-3446 it
      was discovered that a large q parameter value can also trigger
      an overly long computation during some of these checks. A
      correct q value, if present, cannot be larger than the modulus
      p parameter, thus it is unnecessary to perform these checks if
      q is larger than p. If DH_check() is called with such q parameter
      value, DH_CHECK_INVALID_Q_VALUE return flag is set and the
      computationally intensive checks are skipped.
    * Add openssl-1_1-CVE-2023-3817.patch


author: otto.hollmann@suse.com
changelog:
  - Displays "fips" in the version string (bsc#1215215)
    * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch


author: otto.hollmann@suse.com
changelog:
  - Security fix: [bsc#1216922, CVE-2023-5678]
    * Fix excessive time spent in DH check / generation with large Q
      parameter value.
    * Applications that use the functions DH_generate_key() to generate
      an X9.42 DH key may experience long delays. Likewise,
      applications that use DH_check_pub_key(), DH_check_pub_key_ex
      () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42
      DH parameters may experience long delays. Where the key or
      parameters that are being checked have been obtained from an
      untrusted source this may lead to a Denial of Service.
    * Add openssl-CVE-2023-5678.patch


author: otto.hollmann@suse.com
changelog:
  - Security fix: [bsc#1219243, CVE-2024-0727]
    * Add NULL checks where ContentInfo data can be NULL
    * Add openssl-CVE-2024-0727.patch


author: otto.hollmann@suse.com
changelog:
  - Security fix: [bsc#1222548, CVE-2024-2511]
    * Fix unconstrained session cache growth in TLSv1.3
    * Add openssl-CVE-2024-2511.patch


author: psimons@suse.com
changelog:
  - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free
    security vulnerability. Calling the function SSL_free_buffers()
    potentially caused memory to be accessed that was previously
    freed in some situations and a malicious attacker could attempt
    to engineer a stituation where this occurs to facilitate a
    denial-of-service attack. [CVE-2024-4741, bsc#1225551]


author: pmonreal@suse.com
changelog:
  - Security fix: [bsc#1227138, CVE-2024-5535]
    * SSL_select_next_proto buffer overread
    * Add openssl-CVE-2024-5535.patch


author: tchvatal@suse.com
changelog:
  - Prepare to split to various subpackages converting main one to
    dummy package
  - Reduce to only provide main pkg and devel and depend on proper
    soversioned package
  - Version in this package needs to be synced with the one provided
    by the split package
  - Remove all the patches, now in the proper versioned namespace:
    * merge_from_0.9.8k.patch
    * openssl-1.0.0-c_rehash-compat.diff
    * bug610223.patch
    * openssl-ocloexec.patch
    * openssl-1.0.2a-padlock64.patch
    * openssl-fix-pod-syntax.diff
    * openssl-truststore.patch
    * compression_methods_switch.patch
    * 0005-libssl-Hide-library-private-symbols.patch
    * openssl-1.0.2a-default-paths.patch
    * openssl-pkgconfig.patch
    * openssl-1.0.2a-ipv6-apps.patch
    * 0001-libcrypto-Hide-library-private-symbols.patch
    * openssl-1.0.2i-fips.patch
    * openssl-1.0.2a-fips-ec.patch
    * openssl-1.0.2a-fips-ctor.patch
    * openssl-1.0.2i-new-fips-reqs.patch
    * openssl-gcc-attributes.patch
    * 0001-Axe-builtin-printf-implementation-use-glibc-instead.patch
    * openssl-no-egd.patch
    * openssl-fips-hidden.patch
    * openssl-1.0.1e-add-suse-default-cipher.patch
    * openssl-1.0.1e-add-test-suse-default-cipher-suite.patch
    * openssl-missing_FIPS_ec_group_new_by_curve_name.patch
    * openssl-fips-dont_run_FIPS_module_installed.patch
    * openssl-fips_disallow_x931_rand_method.patch
    * openssl-fips_disallow_ENGINE_loading.patch
    * openssl-rsakeygen-minimum-distance.patch
    * openssl-urandom-reseeding.patch
    * openssl-fips-rsagen-d-bits.patch
    * openssl-fips-selftests_in_nonfips_mode.patch
    * openssl-fips-fix-odd-rsakeybits.patch
    * openssl-fips-clearerror.patch
    * openssl-fips-dont-fall-back-to-default-digest.patch
    * openssl-fipslocking.patch
    * openssl-print_notice-NULL_crash.patch
    * openssl-randfile_fread_interrupt.patch


author: tchvatal@suse.com
changelog:
  - Fix typo in openssl requires
  - Add dependency on the branched devel package
  - Provide all pkgconfig symbols to hide them in versioned subpkgs
  - This allows us to propagate only the preffered version of openssl
    while allowing us to add extra openssl only as additional dependency


author: tchvatal@suse.com
changelog:
  - Provide basic baselibs.conf for 32bit subpackages
  - Specify this package as noarch (as we just provide README files)


author: vcizek@suse.com
changelog:
  - Obsolete openssl-debuginfo
    * the package doesn't exist any more, has been replaced by
      openssl-{so_version}-debuginfo (bsc#1040172)


author: vcizek@suse.com
changelog:
  - Revert version back to 1.0.2m to get security fixes quickly to
    Tumbleweed
    * OpenSSL Security Advisory [02 Nov 2017] (bsc#1066242,bsc#1056058)


author: vcizek@suse.com
changelog:
  - change the sonum to 1.1, as all the minor versions keep ABI
    compatibility (bsc#1081335)
  - update baselibs.conf


author: lnussel@suse.de
changelog:
  - remove patches:
    * trust-Print-label-of-certificate-when-complaining-.patch
    * trust-Dont-use-invalid-public-keys-for-looking-up-.patch
  - new version 0.20.7 (stable)
    * New public pkcs11x.h header containing extensions [fdo#83495]
    * Export necessary defines to lookup attached extensions [fdo#83495]
    * Build fixes
  - new version 0.20.6 (stable)
    * Make the p11-kit-proxy.so module respect critical = no [fdo#83651]
    * Build fix for FreeBSD [fdo#75674]
  - new version 0.20.5 (stable)
    * Don't use invalid keys for looking up stapled extensions [fdo#82328]
    * Better error messages when invalid certificate extensions
    * Fix parsing of some odd OpenSSL TRUSTED CERTIFICATE files
    * Fix some leaks, and memory issues
    * Silence some clang scanner warnings
  - new version 0.20.4 (stable)
    * Don't complain about C_Finalize after a fork
    * Fix typo


author: p.drouand@gmail.com
changelog:
  - Update to version 0.23.1 (stable)
    * Use new PKCS#11 URI draft fields for URIs [fdo#86474 fdo#87582]
    * Add pem-directory-hash extract format
    * Build fixes
  - Remove 0001-trust-allow-to-also-add-openssl-style-hashes-to-pem-d.diff;
    fixed on upstream release
  - Remove autoconf, automake and libtool require; unneeded dependencies
  - Add gtk-doc require; needed to build html documentation
  - Remove redundant %clean section


author: mpluskal@suse.com
changelog:
  - Update to 0.23.2
    * Fix forking issues with libffi
    * Fix various crashes in corner cases
    * Updated translations
    * Build fixes
  - Make building more verbose
  - Enable tests
  - Small spec file cleanup with spec-cleaner


author: sbrabec@suse.com
changelog:
  - 32-bit compatibility fixes:
    * Add PKCS11 module to p11-kit-32bit (bsc#996047#c39)
    * Add p11-kit-nss-trust-32bit NSS module
    * Fix potential bi-arch issue with private binaries
      (fdo#98817, p11-kit-biarch.patch)


author: lnussel@suse.de
changelog:
  - support loading NSS attribute CKA_NSS_MOZILLA_CA_POLICY so Firefox
    detects built in certificates (boo#1154871,
    0001-Fix-a-typo-in-x-cetrificate-value-see-also-https-bug.patch,
    0001-Support-loading-new-NSS-attribute-CKA_NSS_MOZILLA_CA.patch)


author: scabrero@suse.de
changelog:
  - Update to version 0.23.22 (bsc#1180064, bsc#1180065, bsc#1180066):
    * Fix memory-safety issues that affect the RPC protocol
    (CVE-2020-29361, CVE-2020-29362, and CVE-2020-29363), discovered
    and fixed by David Cook
    * anchor: Prefer persistent format when storing anchor [PR#329]
    * common: Fix infloop in p11_path_build [PR#326, PR#327]
    * proxy: C_CloseAllSessions: Make sure that calloc args are non-zero [PR#325]
    * common: Check for a NULL locale before freeing it [PR#321]
    * Build and test fixes [PR#313, PR#315, PR#317, PR#318, PR#319, PR#323,
    PR#330, PR#333, PR#334, PR#335, PR#338, PR#339]
  - Changes for version 0.23.21
    * proxy: Do not assign duplicate slot IDs [PR#282]
    * common: Get program name based on executable path if possible [PR#307]
    * anchor: Exit with non-zero code, if any error occurs [PR#304]
    * Build and test fixes [PR#283, PR#290, PR#291, PR#292, PR#296, PR#299,
    PR#305, PR#306, PR#309, PR#311]
  - Changes for version 0.23.20:
    * Revert "Fix RPC when length-s are 0" changes [PR#276]
  - Changes for version 0.23.19:
    * common: add Russian PKCS#11 extensions to pkcs11x.h header [PR#255]
    * Add simple bash completion for provided commands [PR#258]
    * Unbreak list matching in enable-in and disable-in [PR#262]
    * Fix RPC when length-s are 0 [PR#259]
    * rpc: Add vsock transport support [PR#270]
    * trust: Support CKA_NSS_{SERVER,EMAIL}_DISTRUST_AFTER [PR#265]
    * Build fixes [PR#271, PR#272, PR#273, ...]
  - Changes for version 0.23.18:
    * rpc: Allow empty CK_DATE value [PR#253]
    * build: Meson fixes [PR#245]
    * build: Adjust feature parity between meson and autotools [PR#247]
  - Changes for version 0.23.17:
    * common: Fix uClibc-ng compilation [PR#237]
    * trust: do not allow daylight to invalidate date validation [PR#236]
    * build: Port to meson build system [PR#231, PR#234]
    * rpc: On UNIX wait on condition variable instead of FD if header is for a different thread [PR#232]
    * doc: Add 'server' command in help [PR#229]
    * Build and test fixes [PR#230]
  - Changes for version 0.23.16:
    * proxy: Support C_WaitForSlotEvent() if CKF_DONT_BLOCK is specified [PR#225]
    * conf: Ignore user configuration if the program is running as root [PR#226]
    * proxy: Refresh slot list on every C_GetSlotList call [PR#224]
    * modules: Fix index used in call to p11_dict_remove() [PR#219]
    * Fix Win32 p11_dl_error crash [PR#218]
    * modules: check gl.modules before iterates on it when freeing [PR#217]
    * trust: Ignore unreadable content in anchors [PR#215]
    * extract-jks: Prefer _p11_extract_jks_timestamp to SOURCE_DATE_EPOCH [PR#213]
  - Changes for version 0.23.15:
    * trust: Improve error handling if backed trust file is corrupted [PR#206]
    * url: Prefer upper-case letters in hex characters when encoding [PR#193]
    * trust/extract-jks.c: also honor SOURCE_DATE_EPOCH time [PR#202]
    * virtual: Prefer fixed closures to libffi closures [PR#196]
    * Fix issues spotted by coverity and cppcheck [PR#194, PR#204]
    * Build and test fixes [PR#164, PR#191, PR#199, PR#201]
  - Changes for version 0.23.14:
    * proxy: Avoid invalid memory access when unloading proxy module [PR#180]
    * Update pkcs11 header to allow SoftHSMv2 to compile [PR#181]
    * build: Restore libpthread dependency [PR#183]
    * Build fixes [PR#188]
  - Changes for version 0.23.13:
    * server: Enable socket activation through systemd [PR#173]
    * rpc-server: p11_kit_remote_serve_tokens: Allow exporting all modules
      [PR#174]
    * proxy: Fail early if there is no slot mapping [PR#175]
    * Remove hard dependency on libpthread [PR#177]
    * Build fixes [PR#170, PR#176]
  - Changes for version 0.23.12
    * Fix compile error when PKCS#11 GNU calling convention is enabled [PR#160]
    * Fix getauxval() and secure_getenv() emulation on macOS and FreeBSD [PR#167]
    * Build and test fixes on macOS [PR#162, PR#168]
  - Changes for version 0.23.11
    * trust: Add extractor for edk2/cacerts.bin [PR#139]
    * modules: Add option to control module visibility from proxy [PR#140]
    * trust: Prevent trust module being loaded by proxy module [PR#142]
    * library: Use dedicated locale object for printing error [PR#148]
    * Treat CKR_CRYPTOKI_ALREADY_INITIALIZED correctly [PR#134]
    * Improve const correctness for P11KitUri [PR#152]
    * PKCS#11 URI scheme comparison is now case insensitive [PR#156]
    * Build and test fixes [PR#151, PR#149, PR#141, PR#138, PR#135]
  - Changes for version 0.23.10
    * filter: Respect "write-protected" vendor-specific attribute in
      PKCS#11 URI [PR#129]
    * server: Improve shell integration and documentation [PR#107, PR#108]
    * proxy: Reuse existing slot ID mapping in after fork() [PR#120]
    * trust: Forcibly mark "Default Trust" read-only [PR#123]
    * New function p11_kit_override_system_files() which can be used for
      testing [PR#110]
    * trust: Filter out duplicate extensions [PR#69]
    * Update translations [PR#128]
    * Bug fixes [PR#125, PR#126]
  - Changes for version 0.23.9
    * Fix p11-kit server regressions [PR#103, PR#104]
    * trust: Respect anyExtendedKeyUsage in CA certificates [PR#99]
    * Build fixes related to reallocarray [PR#96, PR#98, PR#100]
  - Changes for version 0.23.8
    * Improve vendor query attributes handling in PKCS#11 URI [PR#92]
    * Add OTP and GOST mechanisms to pkcs11.h [PR#90, PR#91]
    * New envvar P11_KIT_NO_USER_CONFIG to stop looking at user
      configurations [PR#87]
    * Build fixes for Solaris and 32-bit big-endian platforms [PR#81, PR#86]
  - Changes for version 0.23.7
    * Fix memory issues with "p11-kit server" [PR#78]
    * Build fixes [PR#77 ...]
  - Changes for version 0.23.6
    * Port "p11-kit server" to Windows and portability fixes of the RPC
      protocol [PR#67, PR#72, PR#74]
    * Recover the old behavior of "trust anchor --remove" [PR#70, PR#71]
    * Build fixes [PR#63 ...]
  - Changes for version 0.23.5
    * Fix license notice of common/unix-peer.c [PR#58]
    * Remove systemd unit files for now [PR#60]
    * Build fixes for FreeBSD [PR#56]
  - Changes for version 0.23.4
    * Recognize query attributes defined in PKCS#11 URI (RFC7512) [PR#31,
      PR#37, PR#52]
    * The trust policy module now recognizes CKA_NSS_MOZILLA_CA_POLICY
      attribute, used by Firefox [#99453, PR#46]
    * Add 'trust dump' command to dump all PKCS#11 objects in the
      persistence format [PR#44]
    * New experimental 'p11-kit server' command that allows PKCS#11
      forwarding through a Unix domain socket.  A client-side module
      p11-kit-client.so is also provided [PR#15]
    * Add systemd unit files for exporting the proxy module through a
      Unix domain socket [PR#35]
    * New P11KitIter API to iterate over slots, tokens, and modules in
      addition to objects [PR#28]
    * libffi dependency is now optional [PR#9]
    * Build fixes for FreeBSD, macOS, and Windows [PR#32, PR#39, PR#45]
  - Changes for version 0.23.3
    * Install private executables in libexecdir [fdo#98817]
    * Fix link error of proxy module on macOS [fdo#98022]
    * Use new PKCS#11 URI specification for URIs [fdo#97245]
    * Support x-init-reserved argument of C_Initialize() in remote modules
      [fdo#80519]
    * Incorporate changes from PKCS#11 2.40 specification
    * Bump libtool library version
    * Documentation fixes
    * Build fixes [fdo#87192 ...]
  - Move RPM macros to %_rpmmacrodir.
  - New server subpackage
  - Change keyring to new maintainer Daiki Ueno
  - Avoid bareword to fix build failure
  - Remove obsolete patches:
    * p11-kit-biarch.patch
    * 0001-Support-loading-new-NSS-attribute-CKA_NSS_MOZILLA_CA.patch
    * 0001-Fix-a-typo-in-x-cetrificate-value-see-also-https-bug.patch


author: lnussel@suse.com
changelog:
  - Backport IBM specific mechanism and attributes (Jira#PED-584)
    0001-Add-IBM-specific-mechanism-and-attributes.patch
    0002-Add-support-for-serializing-CK_ECDH1_DERIVE_PARAMS-m.patch
    0003-client-Allow-zero-part-length-at-C_SignUpdate.patch
    0004-Fix-support-of-CKA_DERIVE_TEMPLATE.patch
    0005-Add-other-SHA-variants-also-for-RSA-and-EC-signature.patch
    0006-Add-support-for-missing-AES-and-DES-DES3-mechanisms.patch
    0007-Add-support-for-MAC-and-HMAC-general-mechanisms.patch
    0008-Add-support-for-CKM_DH_PKCS_DERIVE.patch
    0009-rpc-Handle-special-cases-for-buffer-and-length.patch
    0010-Add-support-for-CKM_AES_CTR.patch
    0011-Add-support-for-CKM_AES_GCM.patch
    0012-common-pkcs11x.h-Support-CRYPTOKI_GNU-for-IBM-vendor.patch


author: pmonreal@suse.com
changelog:
  - Ensure that programs using <p11-kit/pkcs11x.h> can be compiled
    with CRYPTOKI_GNU. Fixes GnuTLS builds. [jsc#PED-6705]
    * Add p11-kit-pkcs11-gnu-Enable-testing-with-p11-kit-pkcs11x.h.patch


author: jengelh@inai.de
changelog:
  - Update to new upstream release 2.2.0
    * Added support for aarch64, mips, mips64, mips64n32 (BE/LE).
    * Added support for using the new seccomp() syscall and the thread
    sync functionality.
    * Added Python bindings
  - Remove 0001-build-use-autotools-as-build-system.patch
    (merged). Add no-static.diff.
    Add 0001-tools-add-the-missing-elf.h-header-file.patch


author: jengelh@inai.de
changelog:
  - Update to new upstream release 2.2.1
    * Fix a problem with syscall argument filtering on 64-bit systems
    * Fix some problems with the 32-bit ARM syscall table
  - Drop 0001-tools-add-the-missing-elf.h-header-file.patch,
    libseccomp-arm-syscall-fixes.patch
    (applied upstream)


author: jengelh@inai.de
changelog:
  - Update to new upstream release 2.2.3
    * Fix a problem with the masked equality operator
    * Fix a problem on x86_64/x32 involving invalid architectures
    * Fix a problem with the ARM specific syscalls


author: jengelh@inai.de
changelog:
  - Update to git snapshot 2.3.0~g96
    * have libseccomp build with newer linux-glibc-devel;
    "multiplexed and direct socket syscalls"
  - Drop libseccomp-s390x-support.patch, libseccomp-ppc64le.patch
    (no longer apply - merged upstream)
  - Add builderror-k316.diff


author: meissner@suse.com
changelog:
  - updated to final 2.3.0 release
  - builderror-k316.diff: fixed upstream
  - i586 testsuite fails, disable for now


author: jengelh@inai.de
changelog:
  - Update to new upstream release 2.3.1
    * arch: fix the multiplexed ipc() syscalls
    * s390: handle multiplexed syscalls correctly
  - Remove 0001-arch-fix-a-number-of-32-bit-x86-failures-related-to-.patch,
    0001-tests-replace-socket-syscall-references-in-15-basic-.patch
    (fixed upstream)


author: tchvatal@suse.com
changelog:
  - Update to release 2.3.2:
    * Achieved full compliance with the CII Best Practices program
    * Added Travis CI builds to the GitHub repository
    * Added code coverage reporting with the "--enable-code-coverage" configure
      flag and added Coveralls to the GitHub repository
    * Updated the syscall tables to match Linux v4.10-rc6+
    * Support for building with Python v3.x
    * Allow rules with the -1 syscall if the SCMP\_FLTATR\_API\_TSKIP attribute is
      set to true
    * Several small documentation fixes
  - Remove service file as we are not based on git


author: meissner@suse.com
changelog:
  - updated to 2.4.0 (bsc#1128828 CVE-2019-9893)
    - Update the syscall table for Linux v5.0-rc5
    - Added support for the SCMP_ACT_KILL_PROCESS action
    - Added support for the SCMP_ACT_LOG action and SCMP_FLTATR_CTL_LOG attribute
    - Added explicit 32-bit (SCMP_AX_32(...)) and 64-bit (SCMP_AX_64(...)) argument comparison macros to help protect against unexpected sign extension
    - Added support for the parisc and parisc64 architectures
    - Added the ability to query and set the libseccomp API level via seccomp_api_get(3) and seccomp_api_set(3)
    - Return -EDOM on an endian mismatch when adding an architecture to a filter
    - Renumber the pseudo syscall number for subpage_prot() so it no longer conflicts with spu_run()
    - Fix PFC generation when a syscall is prioritized, but no rule exists
    - Numerous fixes to the seccomp-bpf filter generation code
    - Switch our internal hashing function to jhash/Lookup3 to MurmurHash3
    - Numerous tests added to the included test suite, coverage now at ~92%
    - Update our Travis CI configuration to use Ubuntu 16.04
    - Numerous documentation fixes and updates
  - now gpg signed, added key of Paul Moore from keyserver.


author: jengelh@inai.de
changelog:
  - Update to new upstream release 2.4.1
    * Fix a BPF generation bug where the optimizer mistakenly
      identified duplicate BPF code blocks.


author: jengelh@inai.de
changelog:
  - Update to release 2.4.3
    * Add list of authorized release signatures to README.md
    * Fix multiplexing issue with s390/s390x shm* syscalls
    * Remove the static flag from libseccomp tools compilation
    * Add define for __SNR_ppoll
    * Fix potential memory leak identified by clang in the
      scmp_bpf_sim tool
  - Drop no-static.diff, libseccomp-fix_aarch64-test.patch,
    SNR_ppoll.patch (merged)


author: rhafer@suse.com
changelog:
  - Update to release 2.5.0
    * Add support for the seccomp user notifications, see the
      seccomp_notify_alloc(3), seccomp_notify_receive(3),
      seccomp_notify_respond(3) manpages for more information
    * Add support for new filter optimization approaches, including a balanced
      tree optimization, see the SCMP_FLTATR_CTL_OPTIMIZE filter attribute for
      more information
    * Add support for the 64-bit RISC-V architecture
    * Performance improvements when adding new rules to a filter thanks to the
      use of internal shadow transactions and improved syscall lookup tables
    * Properly document the libseccomp API return values and include them in the
      stable API promise
    * Improvements to the s390 and s390x multiplexed syscall handling
    * Multiple fixes and improvements to the libseccomp manpages
    * Moved from manually maintained syscall tables to an automatically generated
      syscall table in CSV format
    * Update the syscall tables to Linux v5.8.0-rc5
    * Python bindings and build now default to Python 3.x
    * Improvements to the tests have boosted code coverage to over 93%
  - libseccomp.keyring: replaced by Paul Moore <pmoore@redhat.com> key.


author: schwab@suse.de
changelog:
  - testsuite-riscv64-missing-syscalls.patch: Fix testsuite failure on
    riscv64
  - Ignore failure of tests/52-basic-load on qemu linux-user emulation


author: dimstar@opensuse.org
changelog:
  - Do not rely on gperf: pass GPERF=/bin/true to configure and
    remove gperf BuildRequires. The syscalls.perf file it would
    generate is part of the tarball already.


author: dmueller@suse.com
changelog:
  - update to 2.5.1:
    * Fix a bug where seccomp_load() could only be called once
    * Change the notification fd handling to only request a notification fd if
    * the filter has a _NOTIFY action
    * Add documentation about SCMP_ACT_NOTIFY to the seccomp_add_rule(3) manpage
    * Clarify the maintainers' GPG keys
  - remove testsuite-riscv64-missing-syscalls.patch


author: jengelh@inai.de
changelog:
  - Update to release 2.5.2
    * Update the syscall table for Linux v5.14-rc7
    * Add a function, get_notify_fd(), to the Python bindings to
      get the nofication file descriptor.
    * Consolidate multiplexed syscall handling for all
      architectures into one location.
    * Add multiplexed syscall support to PPC and MIPS
    * The meaning of SECCOMP_IOCTL_NOTIF_ID_VALID changed within
      the kernel. libseccomp's fd notification logic was modified
      to support the kernel's previous and new usage of
      SECCOMP_IOCTL_NOTIF_ID_VALID.


author: jengelh@inai.de
changelog:
  - Update to release 2.5.3
    * Update the syscall table for Linux v5.15
    * Fix issues with multiplexed syscalls on mipsel introduced in v2.5.2
    * Document that seccomp_rule_add() may return -EACCES


author: mrueckert@suse.de
changelog:
  - reenable python bindings at least for the distro default python3
    package:
    - adds make-python-build.patch


author: i@marguerite.su
changelog:
  - add patch: python-selinux-swig-3.10.patch, fixed boo#985368
    * swig-3.10 in Factory use importlib instead of imp to find
      _selinux.so. imp searched the same directory as __init__.py
      is while importlib searchs only standard paths. so we have
      to move _selinux.so. fixed by upstream
  - update version 2.5
    * Add selinux_restorecon function
    * read_spec_entry: fail on non-ascii
    * Add man information about thread specific functions
    * Don't wrap rpm_execcon with DISABLE_RPM with SWIG
    * Correct line count for property and service context files
    * label_file: fix memory leaks and uninitialized jump
    * Replace selabel_digest hash function
    * Fix selabel_open(3) services if no digest requested
    * Add selabel_digest function
    * Flush the class/perm string mapping cache on policy reload
    * Fix restorecon when path has no context
    * Free memory when processing media and x specfiles
    * Fix mmap memory release for file labeling
    * Add policy context validation to sefcontext_compile
    * Do not treat an empty file_contexts(.local) as an error
    * Fail hard on invalid property_contexts entries
    * Fail hard on invalid file_contexts entries
    * Support context validation on file_contexts.bin
    * Add selabel_cmp interface and label_file backend
    * Support specifying file_contexts.bin file path
    * Support file_contexts.bin without file_contexts
    * Simplify procattr cache
    * Use /proc/thread-self when available
    * Add const to selinux_opt for label backends
    * Fix binary file labels for regexes with metachars
    * Fix file labels for regexes with metachars
    * Fix if file_contexts not '\n' terminated
    * Enhance file context support
    * Fix property processing and cleanup formatting
    * Add read_spec_entries function to replace sscanf
    * Support consistent mode size for bin files
    * Fix more bin file processing core dumps
    * add selinux_openssh_contexts_path()
    * setrans_client: minimize overhead when mcstransd is not present
    * Ensure selabel_lookup_best_match links NULL terminated
    * Fix core dumps with corrupt *.bin files
    * Add selabel partial and best match APIs
    * Use os.walk() instead of the deprecated os.path.walk()
    * Remove deprecated mudflap option
    * Mount procfs before checking /proc/filesystems
    * Fix -Wformat errors with gcc-5.0.0
    * label_file:  handle newlines in file names
    * Fix audit2why error handling if SELinux is disabled
    * pcre_study can return NULL without error
    * Only check SELinux enabled status once in selinux_check_access
  - changes in 2.4
    * Remove assumption that SHLIBDIR is ../../ relative to LIBDIR
    * Fix bugs found by hardened gcc flags
    * Set the system to permissive if failing to disable SELinux because
      policy has already been loaded
    * Add db_exception and db_datatype support to label_db backend
    * Log an error on unknown classes and permissions
    * Add pcre version string to the compiled file_contexts format
    * Deprecate use of flask.h and av_permissions.h
    * Compiled file_context files and the original should have the same DAC
      permissions


author: crrodriguez@opensuse.org
changelog:
  - Avoid mounting /proc outside of selinux_init_load_policy().
    (Stephen Smalley) reverts upstream 5a8d8c4, 9df4988, fixes
    among other things systemd seccomp sandboxing otherwise all
    filters must allow mount(2)
    (libselinux-proc-mount-only-if-needed.patch)


author: jsegitz@suse.com
changelog:
  - Update to version 2.6. Notable changes:
    * selinux_restorecon: fix realpath logic
    * sefcontext_compile: invert semantics of "-r" flag
    * sefcontext_compile: Add "-i" flag
    * Introduce configurable backends
    * Add function to find security.restorecon_last entries
    * Add openrc_contexts functions
    * Add support for pcre2
    * Handle NULL pcre study data
    * Add setfiles support to selinux_restorecon(3)
    * Evaluate inodes in selinux_restorecon(3)
    * Change the location of _selinux.so
    * Explain how to free policy type from selinux_getpolicytype()
    * Compare absolute pathname in matchpathcon -V
    * Add selinux_snapperd_contexts_path()
    * Modify audit2why analyze function to use loaded policy
    * Avoid mounting /proc outside of selinux_init_load_policy()
    * Fix location of selinuxfs mount point
    * Only mount /proc if necessary
    * procattr: return einval for <= 0 pid args
    * procattr: return error on invalid pid_t input
  - Dropped
    * libselinux-2.2-ruby.patch
    * libselinux-proc-mount-only-if-needed.patch
    * python-selinux-swig-3.10.patch


author: mcepl@cepl.eu
changelog:
  - Update to version 2.7.
    * %files needed to be heavily modified
    * Based expressly on python3, not just python
    For changes please see
    https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20170804/RELEASE-20170804.txt


author: jsegitz@suse.com
changelog:
  - Update to version 2.8 (bsc#1111732)
    For changes please see
    https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20180524/RELEASE-20180524.txt
  - ran spec-cleaner on spec files


author: jsegitz@suse.com
changelog:
  - Update to version 2.9
    * Add security_reject_unknown(3) man page
    * Change matchpathcon usage to match with matchpathcon manpage
    * Do not define gettid() if glibc >= 2.30 is used
    * Fix RESOURCE_LEAK defects reported by coverity scan
    * Fix line wrapping in selabel_file.5
    * Do not dereference symlink with statfs in selinux_restorecon
    * Fix overly strict validation of file_contexts.bin
    * Fix selinux_restorecon() on non-SELinux hosts
    * Fix the whatis line for the selinux_boolean_sub.3 manpage
    * Fix printf format string specifier for uint64_t
    * Fix handling of unknown classes/perms
    * Set an appropriate errno in booleans.c
  - Dropped python3.patch, is now upstream


author: jsegitz@suse.com
changelog:
  - In selinux-ready
    * Removed check for selinux-policy package as we don't ship one
      (bsc#1136845)
    * Add check that restorecond is installed and enabled


author: jsegitz@suse.de
changelog:
  - Added Use-Python-distutils-to-install-SELinux.patch to use
    Python's distutils instead of building and installing python
    bindings manually


author: jsegitz@suse.de
changelog:
  - Update to version 3.0
    * Ignore the stem when looking up all matches in file context
    * Save digest of all partial matches for directory
    * Use Python distutils to install SELinux python bindings
    * ensure that digest_len is not zero
    * fix string conversion of unknown perms
    * mark all exported function "extern"
    Dropped Use-Python-distutils-to-install-SELinux.patch, included
    upstream


author: jsegitz@suse.com
changelog:
  - Update to version 3.1:
    * selinux/flask.h, selinux/av_permissions.h and sepol/policydb/flask.h were
      removed. All userspace object managers should have been updated to use the
      dynamic class/perm mapping support.
      Use string_to_security_class(3) and string_to_av_perm(3) to map the class
      and permission names to their policy values, or selinux_set_mapping(3) to
      create a mapping from class and permission index values used by the
      application to the policy values.
    * Removed restrictions in libsepol and checkpolicy that required all declared
      initial SIDs to be assigned a context.
    * Support for new policy capability genfs_seclabel_symlinks
    * selinuxfs is mounted with noexec and nosuid
    * `security_compute_user()` was deprecated


author: kukuk@suse.de
changelog:
  - Update to version 0.89
    - Includes pam_google_authenticator.patch
    - Better check for dual-arch PAM stack


author: kukuk@suse.de
changelog:
  - Update to version 0.91
    - Adjust for Linux-PAM 1.3.0
    - Automatically replace obsolete PAM modules no longer installed
    - Extend error messages


author: kukuk@suse.de
changelog:
  - Update to version 0.92
    - add pam_kwallet5 support
    - move pam_systemd before pam_krb5 [bsc#1014995]
    - obsoletes gcc7-Add-break-to-a-case-label.patch


author: kukuk@suse.de
changelog:
  - Update to version 0.93: Teach pam_cracklib module about
    enforce_for_root [bnc#929079, FATE#312643].


author: kukuk@suse.de
changelog:
  - Update to version 1.0:
    - Add search in different locations for config files
    - Add support for pam_mktemp [bsc#1123878]


author: josef.moellers@suse.com
changelog:
  - prior to writing an service-specific config file, the main function
    calls access() on the destination file in /etc/pam.d.
    This will fail and no config file will be written when the original
    config file was installed in /usr/etc/pam.d.
    A similar problem exists when creating the new service file:
    create_service_file() wants to give the new service file the same
    user, group and mode as the old one, but the old one may not exist.
    In that case, set these to 0(root), 0(root), and 0644.
    [pam-config-remove-bad-access-call.patch, bsc#1187091]


author: josef.moellers@suse.com
changelog:
  - Add "revoke" to the option list for pam_keyinit
    (Remove some leftover debugs while we're at it)
    [pam-config-fix-pam_keyinit-options.patch]


author: valentin.lefebvre@suse.com
changelog:
  - Add pam_systemd_home module for the version 254 of systemd
    [pam-config-add-systemd_home-support.patch, bsc#1216318]


author: valentin.lefebvre@suse.com
changelog:
  - Change check for existence of modules.
    If we have a biarch architecture, we check that the 64bit
    PAM module is there and report an error if not. For the 32bit
    variant, we only issue a warning.
    [pam-config-change-check-for-existence-of-modules.patch, bsc#1227216]


author: snwint@suse.com
changelog:
  - started pbl-yaml testsuite
  - added test cases for various utf8/non-utf8/really broken config files
  - rewrite file-io to do some utf8 processing that keeps non-utf8 files intact as much as possible
  - use only WriteFileRaw() to actually write files
  - use ReadFileRaw() to read grub2 config (bnc#899921)
  - rewrite ReadFile() to handle utf8 properly (bnc#899921)
  - export more pbl functions via yaml interface to allow easier testing
  - 0.832


author: snwint@suse.com
changelog:
  - allow empty distributor, which for new grub2 means use os-release (bsc#942519)
  - more fixes in grub2-efi
  - fix empty distributor handling for grub2-efi (bsc#942519)
  - 0.842


author: snwint@suse.com
changelog:
  - make grub_installdevice parsing more robust
  - continue after wrong entries in grub_install_device
  - move bootloader scripts into separate subdirectories
  - updated doc
  - introduce separate per-bootloader scripts
  - add documentation
  - some minor corrections
  - support --reinit option to force grub2 install
  - adjust Makefile
  - add new wrapper script to get rid of old perl-Bootloader code for grub2
  - 0.900


author: snwint@suse.com
changelog:
  - grub2-efi: Allow fallback to removable booting
  - grub2-efi: Make 32bit arm be a wildcard match
  - 0.907


author: snwint@suse.com
changelog:
  - also clear LC_ALL when setting locale
  - run grub in RC_LANG locale taken from sysconfig (bsc#985946)
  - 0.915


author: mchang@suse.com
changelog:
  - merge gh#openSUSE/perl-bootloader#112
  - implemented trusted boot/TPM support in UEFI mode (bsc#1036735,
    fate#315831)
  - 0.918


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#116
  - add --get-option to pbl (bsc#1033776, bsc#1050349)
  - 0.921


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#117
  - work without /etc/default/grub_installdevice (bsc#1079321,
    bsc#994322)
  - removed unused function


author: jreidinger@suse.cz
changelog:
  - merge gh#openSUSE/perl-bootloader#121
  - Fix secureboot on aarch64 (boo#1136601)
  - [RFC] Fix secureboot on aarch64 (boo#1136601)
  - 0.924


author: jreidinger@suse.cz
changelog:
  - merge gh#openSUSE/perl-bootloader#122
  - Replace --suse-signed-grub by --suse-force-signed to follow
    update from boo#1136601
  - 0.925


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#126
  - always install EFI fallback boot for aarch64 (bsc#1167015)
  - 0.927


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#129
  - Check tpm.mod in the new grub2 directory (bsc#1174320)
  - 0.931


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#131
  - grub2 install: honor UPDATE_NVRAM in /etc/sysconfig/bootloader
    (bsc#1157550 jsc#SLE-11500).
  - 0.932


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#133
  - use shim on aarch64 (jsc#SLE-15823, jsc#SLE-15020)
  - 0.933


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#134
  - install with --removable if efivars are not writable
    (bsc#1182749, bsc#1174111, bsc#1184160)
  - fix whitespace
  - 0.934


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#136
  - report error if config file could not be updated (bsc#1188768)
  - 0.936


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#137
  - grub2 install: Support secure boot on powerpc (bsc#1192764
    jsc#SLE-18271).
  - 0.937


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#138
  - grub2/install: reset error code when passing through recover code
    (bsc#1198197)
  - 0.938


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#142
  - use fw_platform_size to distinguish between 32 bit and 64 bit
    UEFI platforms (bsc#1208003)
  - 0.942


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#147
  - UEFI: update also default location, if it is controlled by SUSE
    (bsc#1210799, bsc#1201399)
  - 0.943


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#152
  - use signed grub EFI binary when updating grub in default EFI
    location (bsc#1210799)
  - check whether grub2-install supports --suse-force-signed option
  - 0.944


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#157
  - bootloader_entry script can have an optional 'force-default'
    argument (bsc#1215064)
  - skip warning about unsupported options when in compat mode
  - 0.945


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#161
  - support old grub versions (<= 2.02) that used /usr/lib
    (bsc#1218842)
  - create EFI boot fallback directory if necessary
  - 0.946


author: schubi@suse.com
changelog:
  - Moved logrotate files from user specific directory /etc/logrotate.d
    to vendor specific directory /usr/etc/logrotate.d.


author: lnussel@suse.de
changelog:
  - move binaries from /sbin to /usr/sbin (boo#1191088)
  - remove /boot/boot.readme while at it so we stay out of there


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#143
  - adjust Makefile for usrmerge and legacy package split
  - move obs spec file to git repo
  - split off old perl code to perl-Bootloader-legacy package
  - remove legacy part completely
  - 1.0


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#144
  - add default-settings script
  - add new kexec-bootloader
  - add --default-settings option (bsc#1211082)


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#148
  - UEFI: update also default location, if it is controlled by SUSE
    (bsc#1210799, bsc#1201399)
  - 1.2


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#149
  - use signed grub EFI binary when updating grub in default EFI
    location (bsc#1210799)
  - 1.3


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#151
  - default-settings: support non-x86 architectures
  - add man pages for all commands
  - 1.4


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#153
  - check whether grub2-install supports --suse-force-signed option
  - 1.5


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#154
  - move kexec-bootloader from kexec-tools to perl-Bootloader
  - 1.6


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#156
  - bootloader_entry script can have an optional 'force-default'
    argument (bsc#1215064)
  - 1.7


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#158
  - skip warning about unsupported options when in compat mode
  - 1.8


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#176
  - handle missing grub_installdevice on powerpc (bsc#1230070)
  - 1.8.2


author: sweet_f_a@gmx.de
changelog:
  - update to 2.2.5:
    * add --rsyncable functionality
    * many bug fixes
  - remove all suse patches:
    * pigz-dictzip.patch, large and unmaintained patch. If somebody
      really needs that then we should rebase and test it. In this
      case --dictzip should be probably also added to original gzip.
    * pigz-always-thread.patch was a folloup of pigz-dictzip.patch
    * pigz-do-symlinks.patch added IMO dangerous and stupid behaviour
      for symlinks. The original behaviour is now again like we know
      it from gzip, bzip2 and xz.
    * pigz-spl.patch, why we hacked in special handling of .spl
      files?
    * Generally we want to have pigz to replace gzip (and vice versa)
      so better avoiding interface incompatibilities.
  - cleanup spec file


author: adam@mizerski.pl
changelog:
  - update to 2.3
    * Don't complain about missing suffix when not writing output file
    * Put all global variables in one global structure for readability
    * Do not decompress concatenated zlib streams -- only gzip streams
    * Add option for compression level 11 to use zopfli
    * Fix handling of junk after compressed data
  - added pigz-lm.patch
    * adds missing "-lm"
  - provide unpigz binary and manpage as symlink, not copy.
  - removed fake cc script - build system honors CC
  - cleanup spec file


author: p.drouand@gmail.com
changelog:
  - Update to version 2.3.3
    * Portability improvements
    * Update copyright years in documentation
  - Add build fix patches
    * pigz-fix-wrong-include.patch
    * pigz-fix-missing-linker.patch
  - Remove pigz-lm.patch; fixed
  - Use download Url as source


author: kukuk@suse.de
changelog:
  - Disable rpcgen sub-package and install header files in tirpc
    sub-directory until we deprecate sunrpc in glibc


author: kukuk@suse.de
changelog:
  - Update to version 1.3.1
    - fix autogen.sh script
  - Revert renames to tirpc, make it directly useable. glibc no
    longer contains this files.


author: mmarek@suse.cz
changelog:
  - Only handle KMPs that are built using the %kernel_module_package
    macro (preparatory work for fate#319339).


author: trenn@suse.de
changelog:
  - Use /run instead of deprecated /var/run
    This can have sever consequences if this package uses /var/run. It may
    be installed before filesystem package generating the /run tmpfs and
    predict it to generate the link /var/run -> /run. Later dracut convertfs
    kicks in to generate it, but it has issues. bsc#922676


author: mmarek@suse.cz
changelog:
  - Revert change for fate#319339, as some 3rd party KMPs are built
    with a modified template (bsc#949862).


author: jlee@suse.com
changelog:
  - Add modhash tool to calculate hash of signed module.
    It strips X.509 or PKCS#7 signature before hash kernel module.
    (fate#319460)


author: tchvatal@suse.com
changelog:
  - Set url to github project and repack using obs service
  - Cleanup a bit with spec-cleaner
  - Grep os-release and not deprecated SuSE-release


author: mwilck@suse.com
changelog:
  - version 15.0 (git 6ce3011)
  - modsign-verify: support for parsing PKCS#7 signatures
    (bsc#1111300, bsc#1105495)
  - Fix logic for unsupported modules (bsc#1111183)
    * SLES15: allow unsupported modules only if kernel-default-extra
    from SLE-WE module is installed
    * Always allow unsupported modules on Leap 15 and Factory
    * No change for SLE12 / Leap 42.x and below
    * 10-unsupported-modules.conf: improved comments
    * fix %config(noreplace) logic for 10-unsupported-modules.conf
  - added udev rule 81-sg.rules to make sure the sg module is
    always loaded (bsc#1036463)


author: mwilck@suse.com
changelog:
  - Update to version 15.0.1 (git 5c63319):
  - Use /etc/modules-load.d/sg.conf for sg driver autoloading
    (bsc#1036463)
    * added /etc/modules-load.d/sg.conf


author: adrian@suse.de
changelog:
  - Require mkinitrd (provided also by dracut) directly instead of
    file requires. This is fixing image build failures


author: mwilck@suse.com
changelog:
  - Update to version 15.0.20 (git 1396df5):
  - Fix driver-check.sh (boo#1123697, boo#1123704)
  - add /etc/modprobe.d/50-blacklist.conf from sysconfig package
    (boo#1107611)
  - Remove hard dependency on mkinitrd (boo#1123721)
  - Make sure code works also without kmod-compat
  - Replace file dependency on /sbin/depmod by weak package dependency


author: mwilck@suse.com
changelog:
  - Update to version 15.1.0 (git 6b07b88):
    * 50-blacklist.conf is not added in Leap before 15.1.
    fix conditionals and bump version accordingly.


author: mwilck@suse.com
changelog:
  - Update to version 15.1.10 (git b28b13d):
  - implemented fs blacklisting logic (jsc#SLES-4085, fate#326832)


author: mwilck@suse.com
changelog:
  - Update to version 15.1.11 (git 54df192):
    * spec file: use more gentle wording in blacklist files
    * spec file: drop jffs2 and ubifs from blacklist


author: mwilck@suse.com
changelog:
  - Update to version 15.1.12 (git 1ab0b84):
    * modprobe.conf.common: add csiostor->cxgb4 dependency
      (bsc#1100989)
    * Load fbcon together with virtio_gpu on s390 (bsc#1121996,
      fate#327159)


author: dimstar@opensuse.org
changelog:
  - Only ship RPM macros up to suse_version 1500: after that, the
    macros can be found in the rpm-config-SUSE package.


author: mwilck@suse.com
changelog:
  - Update to version 15.2.0:
    * weak-modules2: emit "inconsistent" warning only if replacement fails
    (bsc#1127155)


author: mwilck@suse.com
changelog:
  - Update to version 15.2.1:
  - Install sg.conf under /usr/lib/modules-load.d (bsc#1036463)
    * sg.conf: avoid file conflict with systemd


author: mwilck@suse.com
changelog:
  - Update to version 15.2.2:
    * kmp-install, driver-check.sh, weak-modules2:
      Support for compressed kernel modules (bsc#1135854)


author: mwilck@suse.com
changelog:
  - Update to version 15.2.6:
    * modprobe.conf: add dependency of papr_scm on libnvdimm
      (bsc#1142152, ltc#176292, FATE#327775).


author: mwilck@suse.com
changelog:
  - Update to version 15.2.9:
    * 00-system.conf: move br_netfilter softdep to separate file
      (boo#1158817)


author: mwilck@suse.com
changelog:
  - Update to version 15.2.10:
    * ppc64le: fix dependency of papr_scm
      (bsc#1142152, ltc#176292, FATE#327775).


author: mwilck@suse.com
changelog:
  - Update to version 15.3.2:
    * modprobe.conf.common: eliminate circular uas/usb-storage dependency
    (bsc#1168661)


author: mwilck@suse.com
changelog:
  - Update to version 15.3.3:
    * spec: remove SLE/openSUSE difference in allow_unsupported_modules
    (jsc#SLE-12255)
    * spec: use same fs_blacklist on SLE and openSUSE
    (jsc#SLE-12255, jsc#SLE-3926)
    * spec: use br_netfilter softdep only for SLE12
    (jsc#SLE-12255, bsc#1166531, boo#1158817, bsc#937216)


author: mwilck@suse.com
changelog:
  - Update to version 15.3.6:
    * dm-crypt requires essiv in SLE15 SP3 (boo#1183063 bsc#1184134 ltc#192244).


author: mwilck@suse.com
changelog:
  - Update to version 15.3.8:
    * modprobe.d: Remove dma=none setting for parport_pc
      (bsc#1177695)


author: mwilck@suse.com
changelog:
  - Update to version 15.4.2
  - Move config files to /lib/modprobe.d and /lib/depmod.d
    (jsc#SLE-20639)
    * "modprobe $FS" for a blacklisted file system now offers to
      unblacklist the module permanently
    * disabled automatic un-blacklisting of filesystem modules loaded
      at installation time
  - Replace mkinitrd with dracut everywhere (jsc#SLE-20348)
  - Add faster substitute for lsinitrd to speed up weak-modules2
    (jsc#SLE-9078)
  - Enable f2fs
  - Add a "Supplements" dependency on dkms to the "legacy" submodule
    (dkms needs "weak-modules")
  - modprobe.d cleanups and fixes:
    * Unify ppc64 and ppc64le
    * Delete files for obsolete architectures
    * Remove obsolete SUSE_INITRD statements (bsc#1161343)
    * Remove dma=none setting for parport_pc (bsc#1177695)
  - Add README.md


author: mwilck@suse.com
changelog:
  - Update to version 15.4.3:
    * fix problem that initrd may not be rebuilt after installing
      kernel-$flavor-extra (bsc#1189441)


author: mwilck@suse.com
changelog:
  - Update to version 15.4.4:
    * Import kernel scriptlets from kernel-source
      (bsc#1189841, bsc#1190598)
    * Provide "suse-kernel-rpm-scriptlets"


author: mwilck@suse.com
changelog:
  - Update to version 15.4.5:
    * inkmp-script(postun): don't pass  existing files to weak-modules2
      (boo#1191200)
    * kernel-scriptlets: skip cert scriptlet on non-UEFI systems
      (boo#1191260)


author: mwilck@suse.com
changelog:
  - Update to version 15.4.6:
    * rpm-script: fix bad exit status in OpenQA (bsc#1191922)
    * cert-script: Deal with existing $cert.delete file (bsc#1191804).
    * cert-script: Ignore kernel keyring for kernel certificates (bsc#1191480).
    * cert-script: Only print mokutil output in verbose mode.


author: mwilck@suse.com
changelog:
  - Update to version 15.4.8:
    * Same as Factory version 16.0.14
    * add udev rules from udev-extra-rules (formerly system-tuning-common-SUSE).
      Both packages are now both obsoleted by suse-module-tools.
      (jsc#SLE-21032)
    * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
      (jsc#SLE-21032, bsc#1192161)
    * 60-io-scheduler.rules: use "none" for multipath components
      (bsc#1192161)


author: mwilck@suse.com
changelog:
  - Update to version 15.4.9:
    * same as Factory version 16.0.16
    * modprobe.d: split conf files (jsc#SLE-21626, boo#1193059)
    - Rather than shipping two large files with modprobe.d options
      (00-system.conf and 50-blacklist.conf), ship multiple small
      per-module files. This makes it easier for users to override
      distribution defaults.
    * blacklist isst_if_mbox_msr (bsc#1187196)
    * boot-sysctl: make sure file exists (fix for containers)
    * remove blacklist entry for snd_bt87x (bsc#1192974, bsc#51718)


author: mwilck@suse.com
changelog:
  - Update to version 15.4.10:
    * same as Factory version 16.0.17
    * 60-io-scheduler.rules: add rules for virtual devices
      (boo#1193759)
    * 60-io-scheduler.rules: enforce "none" for loop devices
      (boo#1193759)
    * install some modprobe.d files only for relevant architectures
      (apm_bios, sonypi, toshiba, legacy rtc) (bsc#1192974)


author: mwilck@suse.com
changelog:
  - Update to version 15.4.11:
    * cdrom: Disable autoclose by default (boo#1165047).
    * Make regenerate-initrd-posttrans compatible with Dracut's
      UEFI mode (unified kernel image)


author: mwilck@suse.com
changelog:
  - Update to version 15.4.12:
    * Add /etc/modprobe.d/README on SLE/Leap (bsc#1195051)
    * rpm-script: force-copy kernel to /boot (boo#1194501)


author: mwilck@suse.com
changelog:
  - Update to version 15.4.13:
    * 80-hotplug-cpu-mem.rules: restrict cpu rule to x86_64 (bsc#1204423)


author: mwilck@suse.com
changelog:
  - Update to version 15.4.15: Backport bug fixes from factory
    * driver-check.sh, unblacklist: convert egrep to grep -E (bsc#1203092)
    * kernel-scriptlets: don't pass flags to weak-modules2 (bsc#1195391)
    * driver-check.sh: avoid false positive error messages (boo#1200107)


author: mwilck@suse.com
changelog:
  - Update to version 15.5.2:
    * rpm-script: update bootloader after creating initramfs
      (boo#1213822)
    * rpm-script: check for regenerate-initrd-posttrans in %posttrans
      (boo#1212957)
    * cert-script: skip cert handling if efivarfs is not writable
      (bsc#1213428, bsc#1201066)


author: mwilck@suse.com
changelog:
  - Update to version 15.5.3:
    * blacklist RNDIS modules (bsc#1205767, jsc#PED-5731, CVE-2023-23559)
    * modprobe.d: Blacklist cls_tcindex module (bsc#1210335, CVE-2023-1829)
      (note: this is not a full fix for that CVE)


author: mwilck@suse.com
changelog:
  - Update to version 15.5.5:
    * Include unblacklist in initramfs (bsc#1224320)
    * regenerate-initrd-posttrans: run update-bootloader --refresh for XEN
    (bsc#1223278)
    * 60-io-scheduler.rules: test for "scheduler" sysfs attribute (boo#1216717)


author: mwilck@suse.com
changelog:
  - Update to version 15.6.1:
    * change wording in filesystem blacklist files
      (gh#openSUSE/suse-module-tools#71)
    * rpm-script: update bootloader after creating initramfs
      (boo#1213822)
    * Drop support for usrmerged distro (boo#1206798)
    * rpm-script: check for regenerate-initrd-posttrans in %posttrans
      (boo#1212957)
    * rpm-script: skip run_bootloader check (boo#1208117)
    * get rid of weak-modules (bsc#1202353)
    * Remove last mentions of mkinitrd
    * cert-script: skip cert handling if efivarfs is not writable
      (bsc#1201066, bsc#1213428)
    * weak-modules2: only use kernel version under /run/regenerate-initrd
      (boo#1201387)


author: mwilck@suse.com
changelog:
  - Update to version 15.6.2:
    * Revert "weak-modules2: only use kernel version under /run/regenerate-initrd"
      (bsc#1214877)


author: mwilck@suse.com
changelog:
  - Update to version 15.6.3:
    * blacklist RNDIS modules (bsc#1205767, jsc#PED-5731, CVE-2023-23559)
    * modprobe.d: Blacklist cls_tcindex module (bsc#1210335, CVE-2023-1829)


author: mwilck@suse.com
changelog:
  - Update to version 15.6.5:
    * Add more modules to file system blacklist (jsc#PED-6167)
      Blacklisted filesystem modules that aren't officially supported
      by SUSE: f2fs, hfsplus, jfss2, kafs, ntfs3, orangefs, pstore, romfs, zonefs.
      This affects Leap and SLED only, as these modules aren't shipped
      for SLE anyway. As usual, the blacklist entries can be removed
      by running an explicit "modrobe $FS_MODULE" command.


author: mwilck@suse.com
changelog:
  - Update to version 15.6.8:
    * macros.initrd: %regenerate_initrd_post: don't fail if mkdir is unavailable
      (boo#1217979)
    * Don't rebuild existing initramfs images if the environment variable
      SKIP_REGENERATE_ALL=1 is set (boo#1192014)


author: mwilck@suse.com
changelog:
  - Update to version 15.6.9:
    * Include unblacklist in initramfs (bsc#1224320)
    * regenerate-initrd-posttrans: run update-bootloader --refresh for XEN
      (bsc#1223278)
    * 60-io-scheduler.rules: test for "scheduler" sysfs attribute (boo#1216717)
    * README: Update blacklist description (gh#openSUSE/suse-module-tools#71)


author: kukuk@suse.de
changelog:
  - Add hardware access groups: kmem, lock, tty, audio, cdrom,
    dialout, disk, input, tape, video
  - Add group wheel


author: dimstar@opensuse.org
changelog:
  - BuildRequire pkgconfig(systemd) instead of systemd: this allows
    OBS to pick systemd-mini, which is still good enough. And
    ultimately it helps us break a build cycle
    (system-users - libssh2_org - curl - systemd - system-users).


author: kukuk@suse.de
changelog:
  - Add utmp to system-group-hardware.conf like systemd has
  - Create new system-user-root sub-package creating passwd, group
    and shadow files with root user.


author: dimstar@opensuse.org
changelog:
  - Drop pkgconfig(systemd) BuildRequires: we no longer depend on
    systemd-sysusers, but converted to shadow toolset.


author: kukuk@suse.de
changelog:
  - udev needs groups kvm and lp: [bsc#1058703]
    - Add group kvm to system-group-hardware
    - Move group lp from system-user-lp to system-group-hardware


author: kukuk@suse.de
changelog:
  - Change home directory of user man to /var/lib/empty. Home
    directories below /var/cache are by definition insecure and a
    bad idea.


author: fbui@suse.com
changelog:
  - Add "render" group in system-group-hardware (bsc#1085847)
    "uaccess" tag has been dropped from /dev/dri/renderD* and these devices
    now have 0666 permsions by default is owned by the render group.


author: max@suse.com
changelog:
  - Add system-user-tftp subpackage with tftp user and group and
    /srv/tftpboot as home directory [bsc#1143454].


author: jfehlig@suse.com
changelog:
  - Add system account and groups for kvm, qemu, and libvirt
    (jsc#SLE-11629)
    New files: system-group-kvm.conf, system-group-libvirt.conf,
    system-user-qemu.conf


author: fbui@suse.com
changelog:
  - Add default hardware group for 'sgx' enclave access
    Since udev v248, a default rule for /dev/sgx_enclave is provided to
    give rw access to the new group hopefully making 'sgx' the standard
    group name for such devices. [bsc#1190572]


author: msuchanek@suse.com
changelog:
  - system-user-tss.conf: Remove group entry, not needed and did
    contain syntax errors (bsc#1190401).


author: werner@suse.de
changelog:
  - Add upstream patches
    0001-logind-add-support-for-Triton2-Power-Button.patch
    0002-logind-add-support-for-TPS65217-Power-Button.patch
  - Add upstream patches
    0001-shutdownd-clean-up-initialization-of-struct.patch
    0003-bootchart-parse-userinput-with-safe_atoi.patch
    0004-bootchart-check-return-of-strftime.patch
    0005-bootchart-Do-not-try-to-access-data-for-non-existing.patch


author: werner@suse.de
changelog:
  - Add upstream patches
    0001-journalctl-do-not-output-reboot-markers-when-running.patch
    0002-udev-hwdb-New-Entry-for-Dell-XPS12-9Q33-keyboard.patch


author: werner@suse.de
changelog:
  - Add upstream patches
    0001-core-swap-only-make-configured-units-part-of-swap.ta.patch
    0009-hwdb-Update-database-of-Bluetooth-company-identifier.patch


author: werner@suse.de
changelog:
  - Add upstream patches
    0001-virt-detect-that-we-are-running-inside-the-docker-co.patch
    0002-bootchart-use-n-a-if-PRETTY_NAME-is-not-found.patch
    0003-fileio-label-return-error-when-writing-fails.patch
    0001-sd-event-don-t-require-a-signal-event-source-to-be-e.patch
    0004-sd-event-check-the-value-of-received-signal.patch
    0005-sd-id128-do-stricter-checking-of-random-boot-id.patch


author: werner@suse.de
changelog:
  - Add upstream patches
    0001-keymap-Fix-touchpad-toggle-on-Toshiba-Satellite-P75-.patch
    0001-units-introduce-network-pre.target-as-place-to-hook-.patch
    0002-keymap-Fix-touchpad-toggle-key-on-Asus-laptops.patch
    0003-sd-bus-check-return-value-of-vasprintf.patch
    0004-core-map-the-rescue-argument-to-rescue.target.patch
    0005-util-avoid-double-close-of-fd.patch


author: werner@suse.de
changelog:
  - Add upstream patches
    0001-systemctl-when-mangle-unit-names-for-the-isolate-suf.patch
    0001-tmpfiles-compare-return-against-correct-errno.patch


author: werner@suse.de
changelog:
  - Adapt patch
    rules-add-lid-switch-of-ARM-based-Chromebook-as-a-power-sw.patch
    to make it work even with patch #438 and #439


author: werner@suse.de
changelog:
  - Add upstream patches
    0001-shell-completion-fix-completion-of-inactive-units.patch
    0002-shell-completion-propose-templates-for-disable-re-en.patch
    0003-man-we-don-t-have-Wanted-dependency.patch
    0004-selinux-fix-potential-double-free-crash-in-child-pro.patch


author: werner@suse.de
changelog:
  - Add upstream patches
    0001-systemd-continue-switch-root-even-if-umount-fails.patch
    0002-systemd-try-harder-to-bind-to-notify-socket.patch
  - Add patch avoid-leaking-socket-descriptors.patch to close
    file descriptors if an incomming connection can not be handled
    due e.g. short memory. Could be related to bsc #901481


author: werner@suse.de
changelog:
  - Modify patch avoid-leaking-socket-descriptors.patch to close
    file descriptors for incomming connections in pam module in case
    of short memory.


author: werner@suse.de
changelog:
  - Add upstream patch 1089-fix-cgroup-device-controller.patch
    to avoid trouble on existing /dev/console with nspawn (bsc#902240)


author: werner@suse.de
changelog:
  - Add upstream patches
    0001-strv-add-an-additional-overflow-check-when-enlarging.patch
    0002-hwdb-Add-mapping-for-special-keys-on-compaq-ku-0133-.patch
    0003-journald-add-CAP_MAC_OVERRIDE-in-journald-for-SMACK-.patch
    0004-journal-do-server_vacuum-for-sigusr1.patch
    0005-cryptsetup-fix-an-OOM-check.patch


author: werner@suse.de
changelog:
  - Add upstream patch
    0002-shutdown-pass-own-argv-to-run-initramfs-shutdown.patch
  - Add patch journald-advice-about-use-of-memory.patch to use mmap()
    flags as well as madvise(2) for journal files.


author: werner@suse.de
changelog:
  - Add upstream patches
    0001-manager-Linux-on-hppa-has-fewer-rtsigs-hence-avoid-u.patch
    0002-time-also-support-infinity-syntax-in-parse_nsec.patch
    0003-time-earlier-exit-from-format_timestamp_relative-on-.patch
    0004-sd-bus-if-we-don-t-manage-to-properly-allocate-the-e.patch
    0005-journalctl-correct-help-text-for-until.patch
    0006-calendarspec-fix-typo-in-annually.patch
    0007-systemctl-do-not-ignore-errors-in-symlink-removal.patch
    0008-util-introduce-sethostname_idempotent.patch
    0009-util-fix-copy-paste-error-and-actually-set-the-new-h.patch
    0010-shutdown-do-final-unmounting-only-if-not-running-ins.patch
    0011-selinux-make-sure-we-do-not-try-to-print-missing-fie.patch
  - Replace patch
    keep-crypt-password-prompt.patch as this with
    upstream patch
    0012-manager-do-not-print-anything-while-passwords-are-be.patch


author: werner@suse.de
changelog:
  - Add upstream patches
    1090-udev-path_id-set-supported_parent-for-well-known-SCS.patch
    1091-udev-path_id-update-comments.patch
    which will be applied if patch
    1090-udev-path_id-set-supported_parent-for-well-known-SCS.patch
    is applied a this may fix the trouble with iSCSI (bnc#898233)


author: werner@suse.de
changelog:
  - Add upstream patches
    0001-sd-bus-properly-handle-removals-of-non-existing-matc.patch
    0002-keymap-Ignore-brightness-keys-on-Dell-Inspiron-1520-.patch


author: werner@suse.de
changelog:
  - Add patch watch_resolv.conf_for_become_changed.patch to add an
    inotify watch on /etc/resolv.conf which enables the reload of
    a changed resolver configuration on the fly (bsc#902901)
  - Do not apply patch 0022-systemd-tmpfiles-ownerkeep.patch in case
    if the script /usr/bin/systemd-tmpfiles-keep is missed


author: werner@suse.de
changelog:
  - Add upstream patches
    1092-libudev-do-not-accept-invalid-log-levels.patch
    1093-udev-Fix-parsing-of-udev.event-timeout-kernel-parame.patch
    1094-udev-avoid-magic-constants-in-kernel-cmdline-parsers.patch


author: werner@suse.de
changelog:
  - Add upstream patches
    0001-core-don-t-allow-enabling-if-unit-is-masked.patch
    0002-snapshot-return-error-when-snapshot-exists.patch
    0003-shared-install-avoid-prematurely-rejecting-missing-u.patch
    0004-Raise-level-of-Found-dependency.-lines.patch
    0005-units-order-sd-journal-flush-after-sd-remount-fs.patch
    0006-journald-fix-minor-memory-leak.patch
    0007-journald-also-check-journal-file-size-to-deduce-if-i.patch
    0008-journald-fix-memory-leak-on-error-path.patch
    0009-units-make-systemd-journald.service-Type-notify.patch
    0010-hwdb-Update-database-of-Bluetooth-company-identifier.patch


author: werner@suse.de
changelog:
  - Add upstream patches
    0001-login-rerun-vconsole-setup-when-switching-from-vgaco.patch
    0002-shutdown-fix-arguments-to-run-initramfs-shutdown.patch
    0003-utf8-when-looking-at-the-next-unichar-honour-the-siz.patch


author: rmilasan@suse.com
changelog:
  - Create rule to set I/O scheduler to deadline if device attribute
    'rotational' equals 0, usually SSDs (bnc#904517).
    Add 1095-set-ssd-disk-to-use-deadline-scheduler.patch


author: werner@suse.de
changelog:
  - Change patch 0001-add-hdflush-for-reboot-or-hddown-for-poweroff.patch
    to skip hdflush as well as hddown but only use halt as fallback
    for poweroff as well as synch in systemctl before any reboot command
    (compare with commit 4a3ad39957399c4a30fc472a804e72907ecaa4f9)


author: rmilasan@suse.com
changelog:
  - New root symlink rule generator
    Add 1096-new-udev-root-symlink-generator.patch
  - Remove write_dev_root_rule and systemd-udev-root-symlink


author: werner@suse.de
changelog:
  - Add upstream patches
    0001-keymap-Add-support-for-IBM-ThinkPad-X41-Tablet.patch
    0002-keymap-Fix-special-keys-on-ThinkPad-X60-X61-Tablet.patch


author: werner@suse.de
changelog:
  - Add upstream patches
    0001-systemctl-let-list-units-unit-files-honour-type.patch
    0002-systemctl-obey-state-in-list-unit-files.patch
    which allows to use --type in the systemctl command list-units
    and list-unit-files.


author: ledest@gmail.com
changelog:
  - fix bashisms in write_net_rules script
  - update patches:
    * 1053-better-checks-in-write_net_rules.patch


author: gber@opensuse.org
changelog:
  - remove pm-utils-hooks-compat.sh again, pm-utils built-in hooks
    partially duplicate hooks run by systemd which may potentially
    lead to problems, instead temporarily re-enable
    Forward-suspend-hibernate-calls-to-pm-utils.patch until
    boo#904828 can be addressed properly


author: werner@suse.de
changelog:
  - Add upstream patches
    0001-systemd-logind.service-set-Type-notify.patch
    0002-core-watchdog-bus-properties-cannot-be-both-writable.patch
    0003-sd-bus-refuse-properties-that-claim-to-be-both-writa.patch


author: werner@suse.de
changelog:
  - Remove upstream patch
    0001-systemd-logind.service-set-Type-notify.patch
    as systemd-logind.service is already from DBus type, compare with
    upstream commit eab459bc0639b81b32735f36d3e929e4bfa2cb4b


author: rmilasan@suse.com
changelog:
  - Increase number of children/workers to CPU_COUNT * 256 to avoid
    'maximum number of children reached' (bnc#907393).
    Add 1097-udevd-increase-maximum-number-of-children.patch


author: rmilasan@suse.com
changelog:
  - Change the maximum number of children from CPU_COUNT * 256 to
    CPU_COUNT * 64.
    Update 1097-udevd-increase-maximum-number-of-children.patch


author: werner@suse.de
changelog:
  - Add upstream patches
    0001-units-make-sure-rfkill-service-is-bount-to-the-actua.patch
    0002-rfkill-rework-how-we-generate-file-names-from-rfkill.patch


author: werner@suse.de
changelog:
  - Add upstream patch
    1098-udev-link_setup-respect-kernel-name-assign-policy.patch
    which may solve bsc#907318


author: werner@suse.de
changelog:
  - Add upstream patches
    0001-selinux-access-fix-broken-ternary-operator.patch
    0002-systemctl-show-BindsTo-BoundBy-in-list-dependencies.patch
    0003-cryptsetup-default-to-no-hash-when-keyfile-is-specif.patch
    0004-core-fix-transaction-destructiveness-check-once-more.patch
  - Avoid old net devices naming scheme on openSUSE 13.2 and less
    maybe caused by patch
    1098-udev-link_setup-respect-kernel-name-assign-policy.patch


author: thomas.blume@suse.com
changelog:
  - use --boot option in systemd-tmpfiles-setup-dev.service (bnc#908476)
    add upstream patches:
    0001-units-tmpfiles-setup-dev-allow-unsafe-file-creation-.patch
    0002-man-tmpfiles.d-recommend-using-b-and-c.patch (adapted)


author: thomas.blume@suse.com
changelog:
  - remove 0022-systemd-tmpfiles-ownerkeep.patch since this is now
    implemented into the systemd-tmpfiles binary
  - add user based ignore statements in tmpfiles removal directives
    (bnc#903009)
    add systemd-add-user-keep.patch


author: werner@suse.de
changelog:
  - Use Robert's latest patch
    1098-udev-link_setup-respect-kernel-name-assign-policy.patch
    which drops NAMEPOLICY_KERNEL as this breaks all on current
    systems out there


author: arvidjaar@gmail.com
changelog:
  - update set-and-use-default-logconsole.patch - fix comparison of
    console log facility that caused journald to skip output to console
    (boo#912030)


author: jengelh@inai.de
changelog:
  - Update to new upstream release 218
    * New utilities: systemd-timesyncd (SNTP client),
    systemd-resolved, systemd-networkd, networkctl,
    systemd-sysusers
    * machinectl gained a "poweroff" command for clean container shutdown
    * The udev hwdb now contains DPI information for mice.
    * Userspace firmware loading support has been removed and
    the minimum supported kernel version is thus bumped to 3.7.
  - Remove patches:
    G=gone locally, is upstream;
    D=dropped: no longer needed;
    N=no longer applies to source nor is it deemed needed;
    K=killed: no longer applicable and too complex to resolve:
    - ---
    G 0002-rfkill-rework-how-we-generate-file-names-from-rfkill.patch
    G avoid-assertion-if-invalid-address-familily-is-passed-to-g.patch
    K service-flags-sysv-service-with-detected-pid-as-RemainAfte.patch
    K remain_after_exit-initscript-heuristic-and-add-new-LSB-hea.patch
    K handle-SYSTEMCTL_OPTIONS-environment-variable.patch
    K 0018-Make-LSB-Skripts-know-about-Required-and-Should.patch
    K log-target-null-instead-kmsg.patch
    K tty-ask-password-agent-on-console.patch
    K 513-nspawn-veth.patch
    K 1087-infinit-timeout-for-kmod-loaded-modules.patch
    D module-load-handle-SUSE-etc-sysconfig-kernel-module-list.patch
    D avoid-leaking-socket-descriptors.patch
    D 0001-make-fortify-happy-with-ppoll.patch
    N fix-owner-of-var-log-btmp.patch
    N disable-nss-myhostname-warning-bnc-783841.patch
    N Revert-service-drop-support-for-SysV-scripts-for-the-early.patch
    N 0001-make-209-working-on-older-dist.patch
    N 0001-Don-t-snprintf-a-potentially-NULL-pointer.patch
    N tmpfiles-do-not-clean-for-mandb-index-files.patch
    G 0001-sd-bus-don-t-look-for-a-64bit-value-when-we-only-hav.patch
    G avoid-assertion-if-invalid-address-familily-is-passed-to-g.patc
    G optionally-warn-if-nss-myhostname-is-called.patch
    G 0001-units-systemd-sysctl.service.in-run-after-load-modul.patch
    G 0004-getty-generator-properly-escape-instance-names.patch
    G rules-add-lid-switch-of-ARM-based-Chromebook-as-a-power-sw.patch
    G 0008-Reset-signal-mask-on-re-exec-to-init.patch
    G 0001-login-fix-pos-array-allocation.patch
    G 0002-login-set-pos-slot-to-fallback-on-pos-eviction.patch
    G 0003-login-Allow-calling-org.freedesktop.login1.Seat.Swit.patch
    G 0004-fix-typo-in-iDRAC-network-interface-name-irdac-idrac.patch
    G 0005-Replace-var-run-with-run-in-remaining-places.patch
    G 0006-Revert-back-to-var-run-at-a-couple-of-problems.patch
    G 0007-README-document-that-var-run-must-be-a-symlink-run.patch
    G 0008-Use-var-run-dbus-system_bus_socket-for-the-D-Bus-soc.patch
    G 0009-mount-don-t-send-out-PropertiesChanged-message-if-ac.patch
    G 0010-mount-don-t-fire-PropertiesChanged-signals-for-mount.patch
    G 0011-logs-show-fix-corrupt-output-with-empty-messages.patch
    G 0012-journalctl-refuse-extra-arguments-with-verify-and-si.patch
    G 0014-nspawn-fix-detection-of-missing-proc-self-loginuid.patch
    G 0001-Fix-systemd-stdio-bridge-symlink.patch
    G 0002-execute-free-directory-path-if-we-fail-to-remove-it-.patch
    G 0003-Do-not-print-invalid-UTF-8-in-error-messages.patch
    G 0004-man-document-missing-options-of-systemd-run.patch
    G 0005-systemd-run-add-some-extra-safety-checks.patch
    G 0006-journal-assume-that-next-entry-is-after-previous-ent.patch
    G 0007-journal-forget-file-after-encountering-an-error.patch
    G 0008-core-correctly-unregister-PIDs-from-PID-hashtables.patch
    G 0009-logind-fix-reference-to-systemd-user-sessions.servic.patch
    G 0010-man-update-link-to-LSB.patch
    G 0011-man-systemd-bootchart-fix-spacing-in-command.patch
    G 0012-man-add-missing-comma.patch
    G 0013-units-Do-not-unescape-instance-name-in-systemd-backl.patch
    G 0001-core-busname-add-lookup-string-for-BUSNAME_FAILURE_S.patch
    G 0002-manager-flush-memory-stream-before-using-the-buffer.patch
    G 0003-busname-don-t-drop-service-from-the-result-string.patch
    G 0004-fix-off-by-one-error-in-array-index-assertion.patch
    G 0005-logind-fix-policykit-checks.patch
    G 0006-rules-mark-loop-device-as-SYSTEMD_READY-0-if-no-file.patch
    G 0008-man-multiple-sleep-modes-are-to-be-separated-by-whit.patch
    G 0001-gpt-auto-generator-don-t-return-OOM-on-parentless-de.patch
    G 0002-bus-fix-memory-leak-when-kdbus-is-not-enabled.patch
    G 0006-Do-not-return-1-EINVAL-on-allocation-error.patch
    G 0007-networkd-fix-typo.patch
    G 0008-sd-bus-don-t-access-invalid-memory-if-a-signal-match.patch
    G 0009-sd-bus-don-t-choke-if-somebody-sends-us-a-message-wi.patch
    G 0012-journald-remove-stray-reset-of-error-return-value.patch
    G 0013-core-libsystemd-systemd-timedate-udev-spelling-fixes.patch
    G 0001-cgroup-it-s-not-OK-to-invoke-alloca-in-loops.patch
    G 0002-machined-fix-Kill-bus-call-on-machine-objects-when-w.patch
    G 0003-sd-bus-don-t-use-assert_return-to-check-for-disconne.patch
    G 0004-core-don-t-try-to-relabel-mounts-before-we-loaded-th.patch
    G 0005-sd-daemon-fix-incorrect-variable-access.patch
    G 0006-sd-event-initialization-perturbation-value-right-bef.patch
    G 0007-sd-event-don-t-accidentally-turn-of-watchdog-timer-e.patch
    G 0008-systemctl-kill-mode-is-long-long-gone-don-t-mention-.patch
    G 0009-ask-password-when-the-user-types-a-overly-long-passw.patch
    G 0001-journal-fix-export-of-messages-containing-newlines.patch
    G 0002-systemctl-update-NAME-to-PATTERN-in-help.patch
    G 0003-tty-ask-password-agent-return-negative-errno.patch
    G 0004-systemd-python-use-.hex-instead-of-.get_hex.patch
    G 0005-systemd-python-fix-failing-assert.patch
    G 0007-dbus-suppress-duplicate-and-misleading-messages.patch
    G 0001-reduce-the-amount-of-messages-logged-to-dev-kmsg-whe.patch
    G 0001-bash-completion-fix-__get_startable_units.patch
    G 0002-sysctl-replaces-some-slashes-with-dots.patch
    G 0003-delta-do-not-use-unicode-chars-in-C-locale.patch
    G 0004-implement-a-union-to-pad-out-file_handle.patch
    G shut-up-annoying-assertion-monotonic-clock-message.patch
    G 0001-sd-rtnl-message-append-fix-uninitialized-memory.patch
    G 0001-tmpfiles-fix-permissions-on-new-journal-files.patch
    G 0001-errno-make-sure-to-handle-the-3-errnos-that-are-alia.patch
    G 0003-analyze-fix-plot-with-bad-y-size.patch
    G 0004-job-add-waiting-jobs-to-run-queue-in-unit_coldplug.patch
    G 0005-job-always-add-waiting-jobs-to-run-queue-during-cold.patch
    G 0001-backlight-Avoid-restoring-brightness-to-an-unreadabl.patch
    G 0002-backlight-do-nothing-if-max_brightness-is-0.patch
    G 0003-backlight-unify-error-messages.patch
    G 0004-backlight-warn-if-kernel-exposes-backlight-device-wi.patch
    G 0005-backlight-handle-saved-brightness-exceeding-max-brig.patch
    G 0001-replace-more-dup-by-F_DUPFD_CLOEXEC.patch
    G 0002-pam_systemd-use-F_DUPFD_CLOEXEC-when-dupping-session.patch
    G 0001-core-close-socket-fds-asynchronously.patch
    G 0002-logind-bring-polkit-policy-for-hibernate-in-line-wit.patch
    G 0003-core-make-sure-to-serialize-jobs-for-all-units.patch
    G 0001-logind-ignore-lid-switch-if-more-than-1-display-is-c.patch
    G 0002-logind-fix-printf-format.patch
    G 0003-logind-ignore-lid-switch-events-for-30s-after-each-s.patch
    G 0004-logind-Do-not-fail-display-count-if-a-device-has-no-.patch
    G 0005-logind-move-lid-switch-handling-from-logind-main-to-.patch
    G 0006-man-clarify-that-the-ExecReload-command-should-be-sy.patch
    G 0007-man-readahead-fix-cmdline-switch-inconsistency-betwe.patch
    G 0008-man-update-journald-rate-limit-defaults.patch
    G 0009-nspawn-properly-format-container_uuid-in-UUID-format.patch
    G 0010-logind-allow-suspending-if-there-are-no-displays.patch
    G 0001-hwdb-Update-database-of-Bluetooth-company-identifier.patch
    G 0002-hwdb-Update-database-of-Bluetooth-company-identifier.patch
    G 0003-hwdb-Update-database-of-Bluetooth-company-identifier.patch
    G 0004-hwdb-Update-database-of-Bluetooth-company-identifier.patch
    G 0005-hwdb-Update-database-of-Bluetooth-company-identifier.patch
    G 0001-conf-parser-silently-ignore-sections-starting-with-X.patch
    G 0002-man-note-that-entire-sections-can-now-be-ignored.patch
    G 0004-machined-make-sure-GetMachineAddresses-is-available-.patch
    G 0005-core-Filter-by-state-behind-the-D-Bus-API-not-in-the.patch
    G 0006-login-add-mir-to-the-list-of-session-types.patch
    G 0007-logind-fix-Display-property-of-user-objects.patch
    G 0001-hwdb-update.patch
    G 0002-hwdb-update.patch
    G 0003-hwdb-PCI-include-primary-model-string-in-subsystem-m.patch
    G 0004-hwdb-update.patch
    G 0005-hwdb-update.patch
    G 0001-journal-cleanup-up-error-handling-in-update_catalog.patch
    G 0002-journal-properly-detect-language-specified-in-line.patch
    G 0003-man-mention-XDG_CONFIG_HOME-in-systemd.unit.patch
    G 0001-keymap-Add-Lenovo-Enhanced-USB-Keyboard.patch
    G 0002-keymap-Asus-EeePC-touchpad-toggle-key.patch
    G 0001-nspawn-allow-to-bind-mount-journal-on-top-of-a-non-e.patch
    G 0002-nspawn-restore-journal-directory-is-empty-check.patch
    G 0003-core-never-consider-failure-when-reading-drop-ins-fa.patch
    G 0004-socket-properly-handle-if-our-service-vanished-durin.patch
    G 0001-Do-not-unescape-unit-names-in-Install-section.patch
    G 0002-analyze-run-use-bus_open_transport_systemd-instead-o.patch
    G 0001-virt-rework-container-detection-logic.patch
    G 0002-fsck-include-device-name-in-the-message-about-missin.patch
    G 0003-units-use-KillMode-mixed-for-systemd-nspawn-.service.patch
    G 0004-util-ignore_file-should-not-allow-files-ending-with.patch
    G 0006-tty-ask-password-agent-Do-tell-what-directory-we-fai.patch
    G 0007-keyboard-add-Plantronics-.Audio-mute-button.patch
    G 0001-build-sys-use-glibc-s-xattr-support-instead-of-requi.patch
    G 0001-hwdb-fix-case-sensitive-match.patch
    G 0001-sd-event-restore-correct-timeout-behaviour.patch
    G 0002-bus-make-use-of-sd_bus_try_close-in-exit-on-idle-ser.patch
    G 0001-umount-modernizations.patch
    G 0002-namespace-when-setting-up-an-inaccessible-mount-poin.patch
    G 0003-core-allow-transient-mount-units.patch
    G 0004-systemd-detect-virt-only-discover-Xen-domU.patch
    G 0005-backlight-Do-not-clamp-brightness-for-LEDs.patch
    G 0006-log-honour-the-kernel-s-quiet-cmdline-argument.patch
    G 0001-core-fix-invalid-free-in-killall.patch
    G 0003-install-fix-invalid-free-in-unit_file_mask.patch
    G 0001-systemd-detect-virt-detect-s390-virtualization.patch
    G 0001-core-sysvcompat-network-should-be-equivalent-to-netw.patch
    G 0002-units-add-missing-caps-so-that-GetAddresses-can-work.patch
    G 0003-units-order-systemd-tmpfiles-clean.service-after-tim.patch
    G 0005-po-add-Greek-translation.patch
    G 0006-hwdb-Update-database-of-Bluetooth-company-identifier.patch
    G 0007-po-add-German-translation.patch
    G 0009-core-clean-up-signal-reset-logic-when-reexec.patch
    G 0010-util-treat-fuse.sshfs-as-a-network-filesystem.patch
    G 0011-build-sys-add-pthread-flag-for-libsystemd-shared.patch
    G 0012-core-transaction-avoid-misleading-error-message-when.patch
    G 0001-vconsole-also-copy-character-maps-not-just-fonts-fro.patch
    G 0002-core-make-sure-Environment-fields-passed-in-for-tran.patch
    G 0003-core-You-can-not-put-the-cached-result-of-use_smack-.patch
    G 0004-cryptsetup-don-t-add-unit-dependency-on-dev-null-dev.patch
    G 0005-man-fix-path-in-crypttab-5.patch
    G 0001-units-order-network-online.target-after-network.targ.patch
    G 0001-core-use-correct-format-string-for-UIDs.patch
    G 0002-core-transaction-fix-cycle-break-attempts-outside-tr.patch
    G 0003-fsck-consider-a-fsck-implementation-linked-to-bin-tr.patch
    G 0001-main-uid_to_name-might-fail-due-to-OOM-protect-again.patch
    G 0002-journald-make-MaxFileSec-really-default-to-1month.patch
    G 0003-units-remove-RefuseManualStart-from-units-which-are-.patch
    G 0004-util-refuse-considering-UID-0xFFFF-and-0xFFFFFFFF-va.patch
    G 0005-nspawn-block-open_by_handle_at-and-others-via-seccom.patch
    G 0006-tmpfiles-don-t-do-automatic-cleanup-in-XDG_RUNTIME_D.patch
    G 0007-units-skip-mounting-tmp-if-it-is-a-symlink.patch
    G 0001-parse_uid-return-ENXIO-for-1-uids.patch
    G 0002-util-when-unescaping-strings-don-t-allow-smuggling-i.patch
    G 0003-localed-consider-an-unset-model-as-a-wildcard.patch
    G 0004-sd-bus-when-an-event-loop-terminates-explicitly-clos.patch
    G 0005-bus-close-a-bus-that-failed-to-connect.patch
    G 0006-hwdb-update.patch
    G 0007-hwdb-Update-database-of-Bluetooth-company-identifier.patch
    G 0001-architecture-Add-tilegx.patch
    G 0002-architecture-Add-cris.patch
    G 0003-arch-add-crisv32-to-uname-check.patch
    G 0004-architecture-remove-cris-from-uname-list.patch
    G 0003-namespace-make-sure-tmp-var-tmp-and-dev-are-writable.patch
    G 0002-namespace-fix-uninitialized-memory-access.patch
    G 0001-machine-don-t-return-uninitialized-variable.patch
    G 0002-vconsole-setup-run-setfont-before-loadkeys.patch
    G 0001-util-consider-0x7F-a-control-chracter-which-it-is-DE.patch
    G 0002-util-don-t-consider-tabs-special-in-string_has_cc-an.patch
    G 0003-architecture-add-string-table-entries-for-mips-le-ar.patch
    G 0004-core-Added-support-for-ERRNO-NOTIFY_SOCKET-message-p.patch
    G 0005-service-don-t-accept-negative-ERRNO-notification-mes.patch
    G 0006-systemctl-show-StatusErrno-value-in-systemctl-status.patch
    G 0007-service-flush-status-text-and-errno-values-each-time.patch
    G 0001-journal-compress-return-early-in-uncompress_startswi.patch
    G 0002-journal-compress-improve-xz-compression-performance.patch
    G 0001-logind-allow-switching-to-unused-VTs-via-SwitchTo.patch
    G 0002-hostnamed-add-a-new-chassis-type-for-watches.patch
    G 0001-units-make-ExecStopPost-action-part-of-ExecStart.patch
    G 0001-event-pull-in-sd-event.h-from-event-util.h.patch
    G 0002-util-fix-has-cc-check-and-add-test.patch
    G 0003-sd-event-always-call-epoll_ctl-on-mask-updates-if-ed.patch
    G 0004-fileio-quote-more-shell-characters-in-envfiles.patch
    G 0001-Clear-up-confusion-wrt.-ENTRY_SIZE_MAX-and-DATA_SIZE.patch
    G 0002-units-serial-getty-.service-use-the-default-RestartS.patch
    G 0001-po-add-Ukrainian-translation.patch
    G 0002-man-document-yearly-and-annually-in-systemd.time-7.patch
    G 0003-core-nicer-message-when-inotify-watches-are-exhauste.patch
    G 0001-detect-virt-Fix-Xen-domU-discovery.patch
    G 0002-Be-more-verbose-when-bind-or-listen-fails.patch
    G 0003-Add-quotes-to-warning-message.patch
    G 0004-systemd-return-the-first-error-from-manager_startup.patch
    G 0001-bash-completion-p-option-for-journalctl.patch
    G 0002-journalctl-man-allow-only-between-terms.patch
    G 0003-systemd-use-pager-for-test-and-help.patch
    G 0001-bus-proxyd-fix-incorrect-comparison.patch
    G 0002-shell-completion-prevent-mangling-unit-names.patch
    G 0003-Always-check-asprintf-return-code.patch
    G 0004-bash-completion-use-list-unit-files-to-get-all-units.patch
    G 0005-core-only-set-the-kernel-s-timezone-when-the-RTC-run.patch
    G 0006-parse_boolean-require-exact-matches.patch
    G 0007-drop_duplicates-copy-full-BindMount-struct.patch
    G 0008-shell-completion-prevent-mangling-unit-names-bash.patch
    G 0009-journald-always-add-syslog-facility-for-messages-com.patch
    G 0001-sysv-order-initscripts-which-provide-network-before-.patch
    G 0002-keymap-Add-microphone-mute-keymap-for-Dell-Latitude.patch
    G 0003-keymap-Annotate-all-micmute-workarounds.patch
    G 0007-hwdb-update.patch
    G 0001-nspawn-fix-truncation-of-machine-names-in-interface-.patch
    G 0002-switch-root-umount-the-old-root-correctly.patch
    G 0003-bootchart-it-s-not-OK-to-return-1-from-a-main-progra.patch
    G 0004-login-set_controller-should-fail-if-prepare_vt-fails.patch
    G 0005-sd-resolve-fix-allocation-if-query-ids-never-reuse-t.patch
    G 0006-login-share-VT-signal-handler-between-sessions.patch
    G 0007-journald-also-increase-the-SendBuffer-of-dev-log-to-.patch
    G 0008-mount-setup-fix-counting-of-early-mounts-without-SMA.patch
    G 0009-journald-Fix-off-by-one-error-in-Missed-X-kernel-mes.patch
    G 0010-machine_kill-Don-t-kill-the-unit-when-killing-the-le.patch
    G 0011-units-fix-BindsTo-logic-when-applied-relative-to-ser.patch
    G 0012-util-try-to-be-a-bit-more-NFS-compatible-when-checki.patch
    G 0001-hwdb-keymaps-for-Samsung-900X3E-900X3F.patch
    G 0002-Add-hwdb-entry-for-Samsung-Series-7-Ultra.patch
    G 0003-keymap-Fix-HP-Pavillon-DV7.patch
    G 0004-hwdb-update-format-description-and-document-reloadin.patch
    G 0008-hwdb-update.patch
    G 0001-systemctl-Correct-error-message-printed-when-bus_pro.patch
    G 0002-units-order-systemd-fsck-.service-after-local-fs-pre.patch
    G 0003-keymap-Adjust-for-more-Samsung-900X4-series.patch
    G 0001-login-fix-memory-leak-on-DropController.patch
    G 0002-util-fix-minimal-race-where-we-might-miss-SIGTERMs-w.patch
    G 0003-sd-journal-properly-convert-object-size-on-big-endia.patch
    G 0004-sd-journal-verify-that-object-start-with-the-field-n.patch
    G 0001-nspawn-fix-network-interface.patch
    G 0001-completion-filter-templates-from-restartable-units.patch
    G 0002-systemd-fix-error-message.patch
    G 0003-Quote-unit-names-in-suggested-systemctl-commandlines.patch
    G 0004-config-parser-fix-mem-leak.patch
    G 0005-login-fix-mem-leak.patch
    G 0001-login-simplify-controller-handling.patch
    G 0001-initrd-parse-etc.service-ignore-return-code-of-daemo.patch
    G 0008-hwdb-Update-database-of-Bluetooth-company-identifier.patch
    G 0009-hwdb-update.patch
    G 0001-systemctl-allow-to-change-the-default-target-without.patch
    G 0001-activate-fix-fd-leak-in-do_accept.patch
    G 0002-analyze-avoid-a-null-dereference.patch
    G 0003-analyze-fix-mem-leak.patch
    G 0004-backlight-Avoid-error-when-state-restore-is-disabled.patch
    G 0005-bus-avoid-using-m-kdbus-after-freeing-it.patch
    G 0006-bus-unref-buscreds-on-failure.patch
    G 0007-core-fix-a-potential-mem-leak.patch
    G 0008-core-smack-setup-Actually-allow-for-succesfully-load.patch
    G 0009-journal-do-not-leak-mmaps-on-OOM.patch
    G 0010-manager-use-correct-cleanup-function.patch
    G 0001-core-fix-resource-leak-in-manager_environment_add.patch
    G 0002-util-remove-a-unnecessary-check.patch
    G 0003-udev-event-explicitly-don-t-read-from-invalid-fd.patch
    G 0004-shared-conf-parser.patch
    G 0005-logind-fix-typo.patch
    G 0006-systemctl-fix-resource-leak-CID-1237747.patch
    G 0007-libudev-monitor-warn-if-we-fail-to-request-SO_PASSCR.patch
    G 0008-shared-conf-parser-don-t-leak-memory-on-error-in-DEF.patch
    G 0009-bus-fix-bus_print_property-to-use-int-for-booleans.patch
    G 0001-journal-Do-not-count-on-the-compiler-initializing-fo.patch
    G 0002-include-fcntl.h-rather-than-sys-fcntl.h.patch
    G 0003-mount-order-options-before-other-arguments-to-mount.patch
    G 0004-shared-wtmp-utmp-don-t-clear-store_wtmp-in-utmp_put_.patch
    G 0005-shared-label.h-add-missing-stdio.h-include.patch
    G 0006-shared-sparse-endian.h-add-missing-byteswap.h-includ.patch
    G 0001-login-pause-devices-before-acknowledging-VT-switches.patch
    G 0001-nspawn-don-t-try-to-create-veth-link-with-too-long-i.patch
    G 0001-socket-introduce-SELinuxContextFromNet-option.patch
    G 0002-util-avoid-non-portable-__WORDSIZE.patch
    G 0001-Fix-warning-about-unused-variable-with-SELINUX.patch
    G 0002-bus-remove-unused-check.patch
    G 0001-systemd-tmpfiles-Fix-IGNORE_DIRECTORY_PATH-age-handl.patch
    G 0001-logind-add-support-for-Triton2-Power-Button.patch
    G 0002-logind-add-support-for-TPS65217-Power-Button.patch
    G 0001-shutdownd-clean-up-initialization-of-struct.patch
    G 0003-bootchart-parse-userinput-with-safe_atoi.patch
    G 0004-bootchart-check-return-of-strftime.patch
    G 0005-bootchart-Do-not-try-to-access-data-for-non-existing.patch
    G 0001-journalctl-do-not-output-reboot-markers-when-running.patch
    G 0002-udev-hwdb-New-Entry-for-Dell-XPS12-9Q33-keyboard.patch
    G 0001-core-swap-only-make-configured-units-part-of-swap.ta.patch
    G 0009-hwdb-Update-database-of-Bluetooth-company-identifier.patch
    G 0001-virt-detect-that-we-are-running-inside-the-docker-co.patch
    G 0002-bootchart-use-n-a-if-PRETTY_NAME-is-not-found.patch
    G 0003-fileio-label-return-error-when-writing-fails.patch
    G 0001-sd-event-don-t-require-a-signal-event-source-to-be-e.patch
    G 0004-sd-event-check-the-value-of-received-signal.patch
    G 0005-sd-id128-do-stricter-checking-of-random-boot-id.patch
    G 0001-keymap-Fix-touchpad-toggle-on-Toshiba-Satellite-P75-.patch
    G 0001-units-introduce-network-pre.target-as-place-to-hook-.patch
    G 0002-keymap-Fix-touchpad-toggle-key-on-Asus-laptops.patch
    G 0003-sd-bus-check-return-value-of-vasprintf.patch
    G 0004-core-map-the-rescue-argument-to-rescue.target.patch
    G 0005-util-avoid-double-close-of-fd.patch
    G 0001-systemctl-when-mangle-unit-names-for-the-isolate-suf.patch
    G 0001-tmpfiles-compare-return-against-correct-errno.patch
    G 0001-shell-completion-fix-completion-of-inactive-units.patch
    G 0002-shell-completion-propose-templates-for-disable-re-en.patch
    G 0003-man-we-don-t-have-Wanted-dependency.patch
    G 0004-selinux-fix-potential-double-free-crash-in-child-pro.patch
    G 0001-systemd-continue-switch-root-even-if-umount-fails.patch
    G 0002-systemd-try-harder-to-bind-to-notify-socket.patch
    G 0001-strv-add-an-additional-overflow-check-when-enlarging.patch
    G 0002-hwdb-Add-mapping-for-special-keys-on-compaq-ku-0133-.patch
    G 0003-journald-add-CAP_MAC_OVERRIDE-in-journald-for-SMACK-.patch
    G 0004-journal-do-server_vacuum-for-sigusr1.patch
    G 0005-cryptsetup-fix-an-OOM-check.patch
    G 0002-shutdown-pass-own-argv-to-run-initramfs-shutdown.patch
    G 0001-manager-Linux-on-hppa-has-fewer-rtsigs-hence-avoid-u.patch
    G 0002-time-also-support-infinity-syntax-in-parse_nsec.patch
    G 0003-time-earlier-exit-from-format_timestamp_relative-on-.patch
    G 0004-sd-bus-if-we-don-t-manage-to-properly-allocate-the-e.patch
    G 0005-journalctl-correct-help-text-for-until.patch
    G 0006-calendarspec-fix-typo-in-annually.patch
    G 0007-systemctl-do-not-ignore-errors-in-symlink-removal.patch
    G 0008-util-introduce-sethostname_idempotent.patch
    G 0009-util-fix-copy-paste-error-and-actually-set-the-new-h.patch
    G 0010-shutdown-do-final-unmounting-only-if-not-running-ins.patch
    G 0011-selinux-make-sure-we-do-not-try-to-print-missing-fie.patch
    G 0012-manager-do-not-print-anything-while-passwords-are-be.patch
    G 0001-sd-bus-properly-handle-removals-of-non-existing-matc.patch
    G 0002-keymap-Ignore-brightness-keys-on-Dell-Inspiron-1520-.patch
    G 0001-core-don-t-allow-enabling-if-unit-is-masked.patch
    G 0002-snapshot-return-error-when-snapshot-exists.patch
    G 0003-shared-install-avoid-prematurely-rejecting-missing-u.patch
    G 0004-Raise-level-of-Found-dependency.-lines.patch
    G 0005-units-order-sd-journal-flush-after-sd-remount-fs.patch
    G 0006-journald-fix-minor-memory-leak.patch
    G 0007-journald-also-check-journal-file-size-to-deduce-if-i.patch
    G 0008-journald-fix-memory-leak-on-error-path.patch
    G 0009-units-make-systemd-journald.service-Type-notify.patch
    G 0010-hwdb-Update-database-of-Bluetooth-company-identifier.patch
    G 0001-login-rerun-vconsole-setup-when-switching-from-vgaco.patch
    G 0002-shutdown-fix-arguments-to-run-initramfs-shutdown.patch
    G 0003-utf8-when-looking-at-the-next-unichar-honour-the-siz.patch
    G 0001-keymap-Add-support-for-IBM-ThinkPad-X41-Tablet.patch
    G 0002-keymap-Fix-special-keys-on-ThinkPad-X60-X61-Tablet.patch
    G 0001-systemctl-let-list-units-unit-files-honour-type.patch
    G 0002-systemctl-obey-state-in-list-unit-files.patch
    G 0002-core-watchdog-bus-properties-cannot-be-both-writable.patch
    G 0003-sd-bus-refuse-properties-that-claim-to-be-both-writa.patch
    G 0001-units-make-sure-rfkill-service-is-bount-to-the-actua.patch
    G 0001-selinux-access-fix-broken-ternary-operator.patch
    G 0002-systemctl-show-BindsTo-BoundBy-in-list-dependencies.patch
    G 0003-cryptsetup-default-to-no-hash-when-keyfile-is-specif.patch
    G 0004-core-fix-transaction-destructiveness-check-once-more.patch
    G 0001-units-tmpfiles-setup-dev-allow-unsafe-file-creation-.patch
    G 0002-man-tmpfiles.d-recommend-using-b-and-c.patch
    G 1009-cdrom_id-use-the-old-MMC-fallback.patch
    G 1010-udev-increase-result-size-for-programs.patch
    G 1014-udev-update-net_id-comments.patch
    G 1015-udev-persistent-naming-we-cannot-use-virtio-numbers-.patch
    G 1016-udev-warn-when-name_to_handle_at-is-not-implemented.patch
    G 1017-udev-serialize-synchronize-block-device-event-handli.patch
    G 1018-udev-do-not-skip-the-execution-of-RUN-when-renaming-.patch
    G 1019-udev-avoid-use-of-uninitialized-err.patch
    G 1020-udev-keyboard-also-hook-into-change-events.patch
    G 1022-udev-remove-seqnum-API-and-all-assumptions-about-seq.patch
    G 1023-udev-builtin-keyboard-do-tell-on-which-device-EVIOCS.patch
    G 1024-udev-always-close-lock-file-descriptor.patch
    G 1025-udev-exclude-device-mapper-from-block-device-ownersh.patch
    G 1026-udevd-inotify-modernizations.patch
    G 1027-udev-synthesize-change-events-for-partitions-when-to.patch
    G 1028-udev-link-config-fix-mem-leak.patch
    G 1029-udev-try-first-re-reading-the-partition-table.patch
    G 1030-udev-guard-REREADP-logic-with-open-O_ECXL.patch
    G 1031-udev-make-sure-we-always-get-change-for-the-disk.patch
    G 1032-udev-guard-REREADPT-by-exclusive-lock-instead-of-O_E.patch
    G 1033-udev-really-exclude-device-mapper-from-block-device.patch
    G 1034-udev-check-the-return-value-from-udev_enumerate_scan.patch
    G 1038-udev-fix-invalid-free-in-enable_name_policy.patch
    G 1039-udevadm-settle-fixed-return-code-for-empty-queue.patch
    G 1041-libudev-fix-udev_queue_get_queue_is_empty-logic.patch
    G 1042-libudev-queue-provide-file-descriptor-to-watch-busy-.patch
    G 1043-libudev-queue-watch-entire-directory-to-allow-the-re.patch
    G 1044-rules-update-qemu-hid-rules.patch
    G 1045-rules-don-t-enable-usb-pm-for-Avocent-devices.patch
    G 1047-udev-net_setup_link-builtin-should-print-the-reason-.patch
    G 1048-udev-net_setup_link-add-a-bit-more-logging.patch
    G 1049-udev-link_config-ignore-errors-due-to-missing-MAC-ad.patch
    G 1052-rules-uaccess-add-ID_SOFTWARE_RADIO.patch
    G 1054-udev-exclude-MD-from-block-device-ownership-event-lo.patch
    G 1056-udevd-add-event-timeout-commandline-option.patch
    G 1057-udev-unify-event-timeout-handling.patch
    G 1058-udev-unify-event-timeout-handling.patch
    G 1059-udev-fixup-commit-dd5eddd28a74a49607a8fffcaf960040db.patch
    G 1061-rules-allow-systemd-to-manage-loop-device-partitions.patch
    G 1063-udev-path_id-suppress-ID_PATH-for-devices-with-an-un.patch
    G 1064-udev-hwdb-do-not-look-at-usb_device-parents.patch
    G 1065-udev-bump-event-timeout-to-60-seconds.patch
    G 1067-udev-always-resolve-correctly-database-names-on-chan.patch
    G 1068-udev-net_setup_link-export-the-.link-filename-applie.patch
    G 1069-rules-net-setup-link-preserve-ID_NET_LINK_FILE-and-I.patch
    G 1070-rules-net-setup-link-remove-stray-linebreak.patch
    G 1071-udev-import-the-full-db-on-MOVE-events-for-devices-w.patch
    G 1072-udev-netif_rename-don-t-log-to-kmsg.patch
    G 1073-udev-drop-print_kmsg.patch
    G 1074-udev-fix-copy-paste-error-in-log-message.patch
    G 1075-udev-timeout-increase-timeout.patch
    G 1076-udev-timeout-warn-after-a-third-of-the-timeout-befor.patch
    G 1077-udev-timeout-warn-after-a-third-of-the-timeout-befor.patch
    G 1078-udev-remove-userspace-firmware-loading-support.patch
    G 1079-udev-remove-userspace-firmware-loading-support.patch
    G 1080-udevd-parse_argv-warn-if-argumens-are-invalid.patch
    G 1081-udevd-check-return-of-various-functions.patch
    G 1082-udevadm-hwdb-check-return-value-of-fseeko.patch
    G 1083-udev-node-warn-if-chmod-chown-fails.patch
    G 1084-udev-ctrl-log-if-setting-SO_PASSCRED-fails.patch
    G 1085-udev-fix-typos.patch
    G 1086-udevd-don-t-fail-if-run-udev-exists.patch
    G 1089-fix-cgroup-device-controller.patch
    G 1090-udev-path_id-set-supported_parent-for-well-known-SCS.patch
    G 1091-udev-path_id-update-comments.patch
    G 1092-libudev-do-not-accept-invalid-log-levels.patch
    G 1093-udev-Fix-parsing-of-udev.event-timeout-kernel-parame.patch
    G 1094-udev-avoid-magic-constants-in-kernel-cmdline-parsers.patch
    G 1098-udev-link_setup-respect-kernel-name-assign-policy.patch


author: werner@suse.de
changelog:
  - Add patch kbd-model-map.patch to add missed keyboard layouts
    which are offered by YaST2 (bsc#910643 and boo#897803)


author: meissner@suse.com
changelog:
  - disable systemd-resolved for now as it interacts not well with
    our methods and security has concerns regarding spoofing. bsc#917781


author: jengelh@inai.de
changelog:
  - Update to systemd v218-1050-g38ab096
  - Remove patches
    use-usr-sbin-sulogin-for-emergency-service.patch (upstream fixed it)
  - Reinstate and improve (remove huge indents from)
    tty-ask-password-agent-on-console.patch,
    0014-journald-with-journaling-FS.patch, rootsymlink_generator.


author: jengelh@inai.de
changelog:
  - Add suse-sysv-bootd-support.diff (reinstate old
    Revert-service-drop-support-for-SysV-scripts-for-the-early.patch)


author: jengelh@inai.de
changelog:
  - Update to new upstream release 219
    * systemd units can now be "unsupported" (like, for example,
    .device in a containers), similar to the "skipped" state in
    SUSE's prior sysvinit scripts.
    * tmpfiles gained the 'v' type for creating btrfs subvolumes.
    * tmpfiles gained the 'a' type for setting ACLs.
    * systemd-nspawn gained new switches: --ephemeral, --template
    * The /var/lib/containers location is deprecated and replaced by
    /var/lib/machines.
    * machinectl gained the copy-from and copy-to commands.
    * machinectl now knows a "bind" command (for use with nspawn)
    * new "systemd-importd" daemon to download container images and run
    them as nspawn containers.
    * networkd collects LLDP network announcements, if available, and
    so shown in networkctl.
    * The fallback terminal type was changed from "vt102" to "vt220",
    allowing PgUp/PgDn keys to work.
    * Pressing Ctrl-Alt-Del 7x in 2 seconds forces a umount+reboot now,
    useful should the regular shutdown hang.
    * Removing storage will cause systemd to unmount the associated
    mountpoints so that they don't linger around.


author: crrodriguez@opensuse.org
changelog:
  - spec : remove --with-firmware-path, firmware loader was removed in v217
  - spec: remove --disable-multi-seat-x, gone.(fixed in xorg)
  - spec: Do not enable systemd-readahead-collect.service and
    systemd-readahead-replay.service as these do not exist anymore.
  - spec: drop timedate-add-support-for-openSUSE-version-of-etc-sysconfig.patch
    Yast was fixed to write all timezone changes exactly how timedated expects
    things to be done.
  - spec: remove handle-etc-HOSTNAME.patch, since late 2014 the netcfg
    package handles the migration from /etc/HOSTNAME to /etc/hostname
    and owns both files.
  -spec: remove boot.udev and systemd-journald.init as they currently
    serve no purpose.
  - suse-sysv-bootd-support.diff: Remove HAVE_SYSVINIT conditions, we
    are in sysvcompat-only codepath, also remove the code targetting other
    distributions, never compiled as the TARGET_$DISTRO macros are never defined.
  - systemd-powerd-initctl-support.patch guard with HAVE_SYSV_COMPAT
  - set-and-use-default-logconsole.patch: fix HAVE_SYSV_COMPAT guards
  - insserv-generator.patch: Only build when sysvcompat is enabled
  - vhangup-on-all-consoles.patch add a comment indicating this is a workaround
    for a kernel bug.
  - spec: Add option to allow disabling sysvinit compat at build time.
  - spec: Add option to enable resolved at build time.
  - spec: Remove all %ifs for !factory products, current systemd releases can
    neither be built nor installed in older products without upgrading
    several components of the base system.
    (removed: 1008-add-msft-compability-rules.patch was only for =< 13.1)
  - spec: remove all dummy "aliases" to /etc/init.d, that made sense only when
    those init scripts still existed. (dummy localfs.service source: gone)
  - systemd-sleep-grub: moved to the grub2 package where it belongs as a
    suspend/resume hook (SR#286533) (drops prepare-suspend-to-disk.patch)
  - remove LFS_CFLAGS from CFLAGS, never needed in systemd as it force feds
    config.h everywhere in the preprocessor cmdline.


author: werner@suse.de
changelog:
  - Add upstream patch
    0001-core-don-t-change-removed-devices-to-state-tentative.patch
    to fix the fix of the last backport (bsc#921898)


author: jengelh@inai.de
changelog:
  - Drop 1021-udev-re-add-persistent-net-rules.patch,
    1036-rules-disable-usage-of-dev_id-in-persistent-rules.patch,
    1040-re-enable-dev_id-conditionally-in-persistent-rules.patch,
    1046-fix-duplicated-rules-with-layer3-interfaces.patch,
    1050-only-rename-SRIOV-VF-devices-when-name-starts-with-eth.patch,
    1051-check-if-NAME-has-a-value.patch,
    1053-better-checks-in-write_net_rules.patch,
    1088-drop-renaming-of-virtual-interfaces-in-guest.patch.
    1021 originally broke parsing of net.ifnames=0 [bnc#931165],
    and given that neither the kernel command line needs to be
    touched nor the source be patched to reach the unpredictable
    naming setup for SLE, all these parts are moved to a separate
    package.


author: werner@suse.de
changelog:
  - Modify patch 1021-udev-re-add-persistent-net-rules.patch to use
    the new return values of proc_cmdline() in enable_name_policy()
    this should fix boo#931165


author: pwieczorkiewicz@suse.com
changelog:
  - Add 1098-systemd-networkd-alias-network-service.patch to alias
    network.service the same way NetworkManager and wicked does.
    This is needed by yast2 and other parts of the system. boo#933092


author: werner@suse.de
changelog:
  - Drop 1055-let-9719859c07aa13539ed2cd4b31972cd30f678543-apply.patch
    as now upstream code
  - Add 0001-Let-some-boolean-survive-a-daemon-reload.patch to fix
    bsc#933365 and boo#934077


author: jengelh@inai.de
changelog:
  - Update to new upstream release 221
    * From 220:
    * libgudev was moved into a package of its own
    * Runlevels 2, 3 and 4 are no longer distinct, they all map to
    multi-user.target.
    * The EFI System Partition mounted to /boot will be unmounted
    2 minutes after boot.
    * systemd does not support direct live-upgrades (via `systemctl
    daemon-reexec`) from versions older than v44 anymore.
    * systemd-nspawn may now be called as part of a shell pipeline.
    * systemd-shutdownd has been removed. This service was
    previously responsible for implementing scheduled shutdowns
    as exposed in /usr/bin/shutdown's time parameter. This
    functionality has now been moved into systemd-logind and is
    accessible via a bus interface.
    * udev will no longer call blkid and create symlinks for all
    block devices, but merely those from a whitelist
    (cf. 60-persistent-storage.rules).
    * /usr/lib/os-release gained a new optional field VARIANT=
    * Details at
    http://lists.freedesktop.org/archives/systemd-devel/2015-May/032147.html
    * From 221:
    * New sd-bus and sd-event APIs in libsystemd
    * If there is both a systemd unit and a SysV init script for the
    same service name, and `systemctl enable` or other operation is
    run, both will now be enabled (or execute the related operation
    on both), not just the unit.
  - Split libsystemd0 to support systemd-less nspawn containers
  - Redo manpage file lists without %exclude, tends to hide
    unpackaged files.
  - hwdb belongs to udev
  - Resolve memory leak and add missing _cleanup_free_ to
    0001-On_s390_con3270_disable_ANSI_colour_esc.patch
  - Remove systemd-powerd-initctl-support.patch
    (no longer builds because shutdownd is gone)
  - Remove quilt-patches/0001-core-rework-device-state-logic.patch,
    0001-Let-some-boolean-survive-a-daemon-reload.patch
    (merged upstream),
    0001-Let-some-boolean-survive-a-daemon-reload.patch
    (obsolete)


author: mpluskal@suse.com
changelog:
  - Install 50-coredump.conf as coredumpctl is now installed by
    default and does not use journal anymore as default storage


author: hrvoje.senjan@gmail.com
changelog:
  - Fix bootstrap build by guarding filelists (man pages don't get
    built in bootstrap mode)
  - Drop commented sections from baselibs.conf, allows format_spec_file
    to have a successful run


author: crrodriguez@opensuse.org
changelog:
  - fix build when resolved is enabled
  - remove fsck -l test in spec file, systemd requires util-linux
    2.26 or later where this feature is already available.


author: crrodriguez@opensuse.org
changelog:
  - sysctl-handle-boot-sysctl.conf-kernel_release.patch dropped,
    replaced by a tmpfiles.d snippet "current-kernel-sysctl.conf"
    (feature implemented in v220 just for our usecase)


author: crrodriguez@opensuse.org
changelog:
  - 1032-ata_id-unbotch-format-specifier.patch: fix udev ata_id
    output.
  - 0023-core-fix-reversed-dependency-check-in-unit_check_unn.patch
    fix StopWhenUnneeded=true in combination with a Requisite=
    dependency.
  - 0031-install-fix-bad-memory-access.patch: Fix Bad memory access
  -  0006-pam_systemd-Properly-check-kdbus-availability.patch: if
    kdbus is enabled (i.e boot with kdbus=1) DBUS_SESSION_BUS_ADDRESS
    must not be exported.
  - spec: add a min_kernel_version macro to ensure the package
    conflicts with kernel versions in which systemd cannot run.


author: sbrabec@suse.com
changelog:
  - Obsolete pm-utils and suspend (boo#925873).
  - Remove pm-utils support
    (remove Forward-suspend-hibernate-calls-to-pm-utils.patch).


author: crrodriguez@opensuse.org
changelog:
  - change the default fallback ntp servers to the opensuse
    pool.ntp.org vendor zone.
  - We still need to run systemd-sysctl.service after local-fs.target
    otherwise it works only when /boot is in the root filesystem but
    not when it is a separate partition.


author: crrodriguez@opensuse.org
changelog:
  - remove SysVStartPriority= from after-local.service,
    unsupported since v218.
    Note that this option was only parsed and that's it. the logic
    to give "start priority" was never implemented.


author: werner@suse.de
changelog:
  - Rework patch  tty-ask-password-agent-on-console.patch to fit the
    requisition of https://bugs.freedesktop.org/show_bug.cgi?id=82004


author: jengelh@inai.de
changelog:
  - Avoid restarting logind [bnc#934901]
  - Do not suppress errors in any case, even if they are ignored


author: crrodriguez@opensuse.org
changelog:
  - Systemd v222, bugfix release.
  - Drop upstream patches
    0006-pam_systemd-Properly-check-kdbus-availability.patch
    0023-core-fix-reversed-dependency-check-in-unit_check_unn.patch
    0031-install-fix-bad-memory-access.patch
    1032-ata_id-unbotch-format-specifier.patch
  - Drop SUSE patch 1013-no-runtime-PM-for-IBM-consoles.patch
    udev does no longer enable USB HID power management at all.
  - The udev accelerometer helper was removed, obsoleted by
    iio-sensor-proxy package.
  - networkd gained a new configuration option IPv6PrivacyExtensions.
  - udev does not longer support the WAIT_FOR_SYSFS= key in udev
    rules. There are no known issues with current sysfs,
    and udev does not need or should be used to work around such bugs.


author: jengelh@inai.de
changelog:
  - Remove udev-generate-rules.sh, apparently not used by anything in
    the systemd nor udev-persistent-ifnames package.


author: werner@suse.de
changelog:
  - Add Correct_assert_on_unexpected_error_code.patch to work around
    a problem of an assert on ENODEV for closing fd on an input
    event device (boo#939571)


author: meissner@suse.com
changelog:
  - hostname-NULL.patch: Work around a crash on XEN hosts
    in OBS. /etc/hostname is not present and systemd then does
    strchr(hostname,soemthing) with hostname NULL.


author: sndirsch@suse.com
changelog:
  - /usr/share/systemd/kbd-model-map: added entries for
    xkeyboard-config converted keymaps; mappings, which already
    exist in original systemd mapping table are being ignored
    though, i.e. not overwritten; needs kbd in buildrequires
    (FATE#318426)


author: jengelh@inai.de
changelog:
  - Update to new upstream release 224
    * systemd-networkd gained a number of new configuration options
    for DHCP, tunnels and bridges
    * systemd-efi-boot-generator functionality was merged into
    systemd-gpt-auto-generator.


author: jengelh@inai.de
changelog:
  - Use Obsolete/Provides strategy from
    windows:mingw:mingw64/mingw64-cross-gcc to do the bootstrap
    cycle and kick out -mini afterwards.


author: fbui@suse.com
changelog:
  - Drop 0009-make-xsltproc-use-correct-ROFF-links.patch
    This patch was initialy added to workaround bsc#842844. But it
    appears that man(1) was fixed (included since 13.2 at least) to
    handle manual pages that consist only of a .so directive such as
    '.so <page>'.


author: fbui@suse.com
changelog:
  - cleanup specfile by removing commands that were dealing with systemd
    pre-generated files: we're now using systemd tarball generated directly
    from the git repo which doesn't contain any of these files.
  - there's no point in using LUA in %pretrans


author: werner@suse.de
changelog:
  - Try to generate the systemd users and groups always in same order
    to avoid republish other packages (boo#944660)


author: werner@suse.de
changelog:
  - Add patch let-vconsole-setup-get-properties-only-once-to-copy-them.patch
    to avoid broken virtual console mapping due stressed ioctl API
    for the virtual consoles (boo#904214)


author: werner@suse.de
changelog:
  - Fix patch tty-ask-password-agent-on-console.patch not to crash
    away but enable it to ask on all devices of /dev/console


author: jengelh@inai.de
changelog:
  - Undo Obsoletes/Provides (from Aug 11), creates too big a cycle.
  - Provide systemd-sysv-install program/link [bnc#948353]


author: werner@suse.de
changelog:
  - Modify patch tty-ask-password-agent-on-console.patch to reflect
    the changes done for pull request 1432


author: fbui@suse.com
changelog:
  - Fix UEFI detection logic: basically we let configure.ac figure out
    if UEFI is supported by the current build environment. No need to
    clutter the spec file with a new conditionnal %has_efi.
  - Provide systemd-bootx64.efi (aka gummiboot)


author: fbui@suse.com
changelog:
  - Disable systemd-boot on aarch64 since it fails to build.
    Error while compiling src/boot/efi/util.o is:
    usr/include/efi/aarch64/efibind.h:2:20: fatal error: stdint.h: No such file or directory


author: fbui@suse.com
changelog:
  - Add 2 upstream patches to fix boo#949574 and bsc#932284
    0001-Make-sure-the-mount-units-pulled-by-RequiresMountsFo.patch
    0002-units-enable-waiting-for-unit-termination-in-certain.patch


author: jengelh@inai.de
changelog:
  - Drop one more undesirable Obsoletes/Provides. This should have
    been a Conflicts. (There was already a Conflicts, and since
    Conflicts go both ways, we won't need a second one.)


author: werner@suse.de
changelog:
  - Modify patch handle-root_uses_lang-value-in-etc-sysconfig-language.patch
    to handle locale at boot time well (boo#927250)
  - Be able to use build service environments several times


author: sor.alexei@meowr.ru
changelog:
  - Update to 227.
  - Rebase systemd-pam_config.patch,
    handle-root_uses_lang-value-in-etc-sysconfig-language.patch,
    0001-add-hdflush-for-reboot-or-hddown-for-poweroff.patch,
    0001-On_s390_con3270_disable_ANSI_colour_esc.patch,
    0014-journald-with-journaling-FS.patch,
    0019-make-completion-smart-to-be-able-to-redirect.patch,
    avoid-divide-by-zero-sigtrap.patch, systemd-add-user-keep.patch,
    set-and-use-default-logconsole.patch,
    tty-ask-password-agent-on-console.patch,
    0001-bnc888612-logind-polkit-acpi.patch,
    watch_resolv.conf_for_become_changed.patch,
    1097-udevd-increase-maximum-number-of-children.patch.
  - Remove
    0002-units-enable-waiting-for-unit-termination-in-certain.patch,
    1001-re-enable-by_path-links-for-ata-devices.patch,
    rules-add-lid-switch-of-ARM-based-Chromebook-as-a-power-sw.patch:
    fixed upstream.


author: jengelh@inai.de
changelog:
  - Update to new upstream release 228
    * The various memory-related resource limit settings (such as
    LimitAS=) now understand the usual K, M, G, ... suffixes to
    the base of 1024 (IEC). Similar, the time-related settings
    understand the usual min, h, day, ... suffixes now.
    * CPUAffinity= now takes CPU index ranges in addition to just
    individual indexes.
    * A number of properties previously only settable in unit
    files are now also available as properties to set when
    creating transient units programmatically via the bus.
  - Remove 0001-Make-sure-the-mount-units-pulled-by-RequiresMountsFo.patch
    (merged upstream)


author: thomas.blume@suse.com
changelog:
  - fix CVE-2015-7510: Stack overflow in nss-mymachines (boo#956712)
    Add 0001-nss-mymachines-do-not-allow-overlong-machine-names.patch


author: tchvatal@suse.com
changelog:
  - Add patch to enable working steam controller:
    * 1099-Add-default-rules-for-valve-steam-controller-to-work.patch


author: jengelh@inai.de
changelog:
  - Avoid enabling readahead services; they have been removed.
  - In %install, only process kbd-model-map.xkb-generated if it
    exists. Resolves a build failure in 13.2/42.1.


author: lnussel@suse.de
changelog:
  - require curl and bzip2 to build importd
  - curl also causes building of journal-upload. That one has rather
    unusal certificate usage, set it's ca root to /etc/pki/systemd
    instead of the built-in default /etc/ssl as journal-remote and
    journal-upload think they kan put stuff in /etc/ssl/certs then but
    that directory is managed by p11-kit and doesn't serve the purpose
    those programs think.
  - /var/lib/systemd/random-seed is a file
  - own /var/lib/machines
  - add systemd-228-nspawn-make-journal-linking-non-fatal-in-try-and-auto.diff


author: werner@suse.de
changelog:
  - Add upstream patch
    0001-core-exclude-.slice-units-from-systemctl-isolate.patch
    this fixes forced logouts on isolate target aka changing runlevel
    (boo#966535)


author: werner@suse.de
changelog:
  - Modify patch handle-numlock-value-in-etc-sysconfig-keyboard.patch
    to allow that open, seek, and read of /dev/mem may fail e.g.
    on XEN based virtual guests (bsc#961120)


author: fbui@suse.com
changelog:
  - drop all compiler/linker option customizations:
    - -pipe option is used by default since day 0
    - get rid of cflags() function which is not needed
    - --hash-size has no impact specially in runtime
    IOW, use the default options for the compiler and the linker,
    there's no point in making systemd different from other package in
    this regards.


author: jengelh@inai.de
changelog:
  - Add two patches which address logind/networkd disappearing from
    dbus (and busctl) even while the units and processes continue
    running.
    0001-core-fix-bus-name-synchronization-after-daemon-reloa.patch
    0001-core-re-sync-bus-name-list-after-deserializing-durin.patch


author: werner@suse.de
changelog:
  - Fix patch patch handle-numlock-value-in-etc-sysconfig-keyboard.patch
    that is do not close a file descriptor twice (boo#973907)


author: Thomas.Blume@suse.com
changelog:
  - fix warning about missing install info during preset (boo#970293)
    0001-systemctl-pid1-do-not-warn-about-missing-install-inf.patch


author: arvidjaar@gmail.com
changelog:
  - drop 1060-udev-use-device-mapper-target-name-for-btrfs-device-ready.patch
    it breaks btrfs on multiple device-mapper devices (boo#984516). The problem
    it tried to fix is already fixed in rule shipped with btrfsprogs (see
    boo#912170).


author: asarai@suse.com
changelog:
  - Backport unified_cgroup_hierarchy fix for Linux >= 4.4. boo#989276
    + systemd-230-cgroup2-use-new-fstype-for-unified-hierarchy.patch


author: develop7@develop7.info
changelog:
  - Fix 1099-Add-default-rules-for-valve-steam-controller-to-work.patch
    to enable missing functionality of Steam Controller


author: fbui@suse.com
changelog:
  - Add rules: block: add support for pmem devices (#3683) (bsc#988119)
    0001-rules-block-add-support-for-pmem-devices-3683.patch


author: fbui@suse.com
changelog:
  - Build require python and python-lxml in order to generate
    systemd.directives man page (bsc#986952)


author: fbui@suse.com
changelog:
  - udev: don't require nsserv and fillup (bsc#999841)
    udev has no LSB init scripts nor fillup templates anymore.


author: fbui@suse.com
changelog:
  - Added patches to fix journal with FSS protection enabled (bsc#1000435)
    0001-journal-fix-HMAC-calculation-when-appending-a-data-o.patch
    0001-journal-set-STATE_ARCHIVED-as-part-of-offlining-2740.patch
    0001-journal-warn-when-we-fail-to-append-a-tag-to-a-journ.patch


author: fbui@suse.com
changelog:
  - systemd-sysv-convert: make sure that
    /var/lib/systemd/sysv-convert/database is always initialized (bsc#982211)
    If "--save" command was used and the sysv init script wasn't enabled
    at all the database file wasn't created at all. This makes the
    subsequent call to "--apply" fail even though this should not
    considered as an error.


author: fbui@suse.com
changelog:
  - Revert "udev: don't require nsserv and fillup"
    It's been judged too late for being part of SLE12 final release.
    Nevertheless it's part of Factory and will be reintroduced after the
    final release is out (ie through an update).


author: fbui@suse.com
changelog:
  - Added 2 patches to fix bsc#1001765
    0001-If-the-notification-message-length-is-0-ignore-the-m.patch
    0001-pid1-don-t-return-any-error-in-manager_dispatch_noti.patch


author: fbui@suse.com
changelog:
  - Re add back "udev: don't require nsserv and fillup"
    Did this in the wrong project... it was a complicated day today ;)


author: fbui@suse.com
changelog:
  - Import a better fix from upstream for bsc#1001765
    - Added:
      0001-pid1-more-informative-error-message-for-ignored-noti.patch
      0001-pid1-process-zero-length-notification-messages-again.patch
    - Updated (no code changes, only patch metadata)
      0001-If-the-notification-message-length-is-0-ignore-the-m.patch
      0001-pid1-don-t-return-any-error-in-manager_dispatch_noti.patch


author: fbui@suse.com
changelog:
  - Migrating to the Suse Systemd git repo:
    First step: drop all patches and drop the tar ball.
    The dropped patches are:
      fix-support-for-boot-prefixed-initscript-bnc-746506.patch
      set-and-use-default-logconsole.patch
      ensure-ask-password-wall-starts-after-getty-tty1.patch
      0001-rules-block-add-support-for-pmem-devices-3683.patch
      Fix-run-lock-directories-permissions-to-follow-openSUSE-po.patch
      1007-physical-hotplug-cpu-and-memory.patch
      1066-udev-add-compatibility-links-for-truncated-by-id-links.patch
      watch_resolv.conf_for_become_changed.patch
      0019-make-completion-smart-to-be-able-to-redirect.patch
      systemd-add-user-keep.patch
      0001-core-re-sync-bus-name-list-after-deserializing-durin.patch
      systemd-228-nspawn-make-journal-linking-non-fatal-in-try-and-auto.diff
      avoid-random-hangs-on-timeouts-due-lost-cwd.patch
      1037-udev-exclude-cd-dvd-from-block-device.patch
      0001-add-network-device-after-NFS-mount-units.patch
      journald-advice-about-use-of-memory.patch
      1011-64-btrfs.rules-skip-btrfs-check-if-devices-are-not-r.patch
      1006-udev-always-rename-network.patch
      handle-numlock-value-in-etc-sysconfig-keyboard.patch
      use-rndaddentropy-ioctl-to-load-random-seed.patch
      0001-pid1-don-t-return-any-error-in-manager_dispatch_noti.patch
      0001-add-hdflush-for-reboot-or-hddown-for-poweroff.patch
      0001-pam_systemd_do_override_XDG_RUNTIME_DIR_of_the_original_user.patch
      0001-bnc888612-logind-polkit-acpi.patch
      avoid-divide-by-zero-sigtrap.patch
      1035-99-systemd.rules-Ignore-devices-with-SYSTEMD_READY-0.patch
      suse-sysv-bootd-support.diff
      ensure-shortname-is-set-as-hostname-bnc-820213.patch
      parse-crypttab-for-noauto-option.patch
      tty-ask-password-agent-on-console.patch
      0001-pid1-process-zero-length-notification-messages-again.patch
      handle-root_uses_lang-value-in-etc-sysconfig-language.patch
      0001-core-exclude-.slice-units-from-systemctl-isolate.patch
      vhangup-on-all-consoles.patch
      0001-systemctl-pid1-do-not-warn-about-missing-install-inf.patch
      apply-ACL-for-nvidia-device-nodes.patch
      make-emergency.service-conflict-with-syslog.socket.patch
      0001-journal-warn-when-we-fail-to-append-a-tag-to-a-journ.patch
      1096-new-udev-root-symlink-generator.patch
      1099-Add-default-rules-for-valve-steam-controller-to-work.patch
      0001-journal-set-STATE_ARCHIVED-as-part-of-offlining-2740.patch
      systemd-install-compat_pkgconfig-always.patch
      1012-Skip-persistent-device-link-creation-on-multipath-de.patch
      0001-avoid-abort-due-timeout-at-user-service.patch
      insserv-generator.patch
      apply-ACL-for-nvidia-uvm-device-node.patch
      restore-var-run-and-var-lock-bind-mount-if-they-aren-t-sym.patch
      systemd-pam_config.patch
      systemd-dbus-system-bus-address.patch
      let-linker-find-libudev-for-libdevmapper.patch
      1098-systemd-networkd-alias-network-service.patch
      0001-let-systemctl-completion-ignore-at-names.patch
      boot-local-start.patch
      1095-set-ssd-disk-to-use-deadline-scheduler.patch
      tomcat6-var-lock-subsys-legacy.patch
      let-vconsole-setup-get-properties-only-once-to-copy-them.patch
      plymouth-quit-and-wait-for-emergency-service.patch
      respect-nfs-bg-option.patch
      0001-If-the-notification-message-length-is-0-ignore-the-m.patch
      1062-rules-set-default-permissions-for-GenWQE-devices.patch
      rescue-emergency-target-conflicts.patch
      Correct_assert_on_unexpected_error_code.patch
      1097-udevd-increase-maximum-number-of-children.patch
      0001-core-fix-bus-name-synchronization-after-daemon-reloa.patch
      1005-create-default-links-for-primary-cd_dvd-drive.patch
      allow-multiple-sulogin-to-be-started.patch
      systemd-230-cgroup2-use-new-fstype-for-unified-hierarchy.patch
      0010-do-not-install-sulogin-unit-with-poweroff.patch
      1003-udev-netlink-null-rules.patch
      1002-rules-create-by-id-scsi-links-for-ATA-devices.patch
      0001-nss-mymachines-do-not-allow-overlong-machine-names.patch
      shut-up-rpmlint-on-var-log-journal.patch
      systemd-tmp-safe-defaults.patch
      portmap-wants-rpcbind-socket.patch
      hostname-NULL.patch
      0001-pid1-more-informative-error-message-for-ignored-noti.patch
      0001-journal-fix-HMAC-calculation-when-appending-a-data-o.patch
      handle-disable_caplock-and-compose_table-and-kbd_rate.patch
      kbd-model-map.patch
      systemctl-set-default-target.patch
      0014-journald-with-journaling-FS.patch
      0001-On_s390_con3270_disable_ANSI_colour_esc.patch


author: fbui@suse.com
changelog:
  - Migrating to the Suse Systemd git repo:
    Second step:
    - Import the specfile
    - Import the tarball generated from the git repo
    - Import lastest changes for the different scripts


author: fbui@suse.com
changelog:
  - Migrating to the Suse Systemd git repo:
    Third step:
    - Re-enable networkd (disabled by default in SLE12)


author: fbui@suse.com
changelog:
  - Imported e251b8d7fb5c801fdfa3a023257ba0e4d514f3b0
    - Re-add back /dev/root symlink generation (although this must be
      deprecated and finally removed).


author: fbui@suse.com
changelog:
  - Add kbd-model-map-extra file which contains the additional legacy
    keymaps needed by yast.
    This was previously directly patched in the systemd source code.


author: fbui@suse.com
changelog:
  - Package rootsymlink-generator helper. It was forgotten when
    switching to the git repo but re-added back.
    That said this thing should be removed as it's broken as soon as
    there's no direct link between the root fs and its backend device
    node (i.e. BTRFS).


author: fbui@suse.com
changelog:
  - Import from factory:
    - Thu Feb  4 11:05:37 UTC 2016 - lnussel@suse.de
    - curl also causes building of journal-upload. That one has rather
      unusal certificate usage, set it's ca root to /etc/pki/systemd
      instead of the built-in default /etc/ssl as journal-remote and
      journal-upload think they can put stuff in /etc/ssl/certs then
      but that directory is managed by p11-kit and doesn't serve the
      purpose those programs think.


author: fbui@suse.com
changelog:
  - Stop providing udevd.8
    systemd-udevd has replaced udevd for some time already and usage of
    udevd should be avoided. Therefore don't encourage this and stop
    documenting it.


author: fbui@suse.com
changelog:
  - Specfile cleanup:
    - break overly long and unreadable line using mkdir
    - gather directory creations


author: fbui@suse.com
changelog:
  - Specfile cleanup:
    - remove explicit call to make for building man pages. This is not
      needed and was maybe useful when generated doc was pre-built and
      shipped in the tarball.


author: fbui@suse.com
changelog:
  - Specfile cleanup:
    - There's no point in listing all generators in %file
      explicitly. The default is to include all of them and if for some
      reason one must be excluded then it should be done explicitly.


author: fbui@suse.com
changelog:
  - Specfile cleanup:
    - only specify once %{_prefix}/lib/systemd/system-shutdown in %file
    - no need to list the content of %{_prefix}/lib/systemd/user-generators in %file
    - machined is not built when %bootstrap = 1


author: fbui@suse.com
changelog:
  - Rework systemd-gatewayd package:
    - some gateway's files were still in the main package
    - it now includes all progs dealing with remote journals
    - it can be turned off (SP2 does that currently)
    - it's been renamed systemd-journal-remote to reflect that


author: fbui@suse.com
changelog:
  - Specfile cleanup:
    - reorganize some files in %files by types
    - some config files were missing the "noreplace" attribute


author: fbui@suse.com
changelog:
  - fix nss-resolve sub package:
    - add a %files section
    - add a package description
    - libnss_resolve.so.2 is now part of this subpackage
    - add %post and %postun sections


author: fbui@suse.com
changelog:
  - Specfile cleanup: no need to protect the manpages with %bootstrap
    condition in nss-myhostname package since the package itself is
    already protected.


author: fbui@suse.com
changelog:
  - Specfile cleanup:
    - %ghost files doesn't need (anymore) to be created in %builroot
    - do not own /etc/X11/xorg.conf.d and /etc/X11/xinit


author: fbui@suse.com
changelog:
  - specfile:
    - do not own /usr/share/zsh directory
    - do not own /etc/dbus-1 and /etc/dbus-1/system.d dirs
    - do not own /usr/share/dbus-1 dir


author: fbui@suse.com
changelog:
  - remove all dummy "aliases" to /etc/init.d (as it was already done by
    factory more than 1 year ago).
    Even if a sysvinit script is still requiring one of those dummy
    symlinks this should not be an issue since this is requirement is
    translated into a weak dependency.


author: fbui@suse.com
changelog:
  - Remove tcpd-devel build requirement.
    tcpwrap support has been removed since v212, see commit
    7f8aa67131cfc03ddcbd31c0420754864fc122f0


author: fbui@suse.com
changelog:
  - Import commit a1c145e6ad6588555dca64402f9103fb1e02b1a0
    7f34037 man: explain that *KeyIgnoreInhibited only apply to a subset of locks
    df5798b Revert "logind: really handle *KeyIgnoreInhibited options in logind.conf" (bsc#1001790 bsc#1005404)
    f79fee7 Revert "kbd-model-map: add more mappings offered by Yast"
    3760c10 manager: tighten incoming notification message checks
    d6efd71 core: only warn on short reads on signal fd
    6eebd91 manager: be stricter with incomining notifications, warn properly about too large ones
    fdf2dc3 manager: don't ever busy loop when we get a notification message we can't process


author: fbui@suse.com
changelog:
  - systemd-journal-{gatewayd,remote,upload} units are only part of
    "systemd-journal-remote" package.
    So exclude them from the main package.


author: fbui@suse.com
changelog:
  - %{_libexecdir}/{tmpfiles.d,sysusers.d}/systemd-remote.conf are
    part of systemd-journal-remote package (only).


author: fbui@suse.com
changelog:
  - %sysusers_create and %tmpfiles_create must be called in %post
    Calling %pre is broken since the respective conf files are not yet
    installed.


author: fbui@suse.com
changelog:
  - Import commit
    15ea716 journal-remote: change owner of /var/log/journal/remote and create /var/lib/systemd/journal-upload (bsc#1006372)


author: fbui@suse.com
changelog:
  - Own a couple of directories even if they don't belong to systemd
    otherwise the build system will complain.
    Some directories (owned by others packages) are simply used by
    systemd to ship some scripts or config files to customize others
    * optional* components. Since thos components are not build required
    by systemd those directories are not owned by any packages and the
    BS complains...


author: fbui@suse.com
changelog:
  - specfile: remove the following warnings:
    [  256s] warning: File listed twice: /usr/lib/systemd/system/dbus.target.wants
    [  256s] warning: File listed twice: /usr/lib/systemd/system/default.target.wants


author: fbui@suse.com
changelog:
  - specfile: no need to create systemd-update-utmp-runlevel.service symlinks anymore
    The symlinks in /usr/lib/systemd/system/<target>.target.wants/systemd-update-utmp-runlevel.service
    are created in Makefile.am since commit d5d8429a12c4b1.
    'reboot' and 'poweroff' targets initially had the symlinks but
    there's not point since the latter conflicts shutdown.target whereas
    the 2 targets pull it in.
    See: https://github.com/systemd/systemd/pull/4429


author: fbui@suse.com
changelog:
  - specfile: clean up nss-* plugins descriptions and drop
    nss-myhostname-config script for now.
    Currently /etc/nsswitch.conf is supposed to be edited by the
    sysadmin to enable the modules. However for some reasons only
    nss-myhostname is removed from the conf file when the corresponding
    package is uninstalled. This is inconsistent so let's remove it.
    Actually I'm wondering if we shouldn't make those NSS plugins part
    of the main package and get rid of all those sub-packages...


author: fbui@suse.com
changelog:
  - specfile: conflict systemd-bash-completion and systemd-mini-bash-completion
    Otherwise the build system detects that systemd-bash-completion and
    its mini variant are conflicting at files level even though those
    packages can't be installed on the same system.


author: fbui@suse.com
changelog:
  - Upgrade to v232, commit c5c3445825981e2a5c3ed71214127d5b1b9de802:
    - Dropped backported commits which has been merged
    - Forward-port Suse specific patches
    - Added --disable-lto option to ./configure
    - Added systemd-mount
    - Removed in %file /usr/lib/systemd/user/*.socket: since
      798c486fbcdce3346cd86 units/systemd-bus-proxyd.socket has been
      removed.
    - Removed in %file %{_sysconfdir}/systemd/bootchart.conf
      since commit 232c84b2d22f2d96982b3c bootchart is not part of systemd
      anymore.
    - Backward compat libs have been disabled since it's been dropped from
      the source code.
    - Added /usr/bin/systemd-socket-activate in %file
    - Added --without-kill-user-processes ./configure option
    - Bump libseccomp build require (>= 2.3.1) as described in README
    - Specifiy version of libmount as required in the README


author: fbui@suse.com
changelog:
  - Drop /usr/lib/systemd/libsystemd-shared-%{version}.so from the 32bit package
    This shared library is not for public use, and is neither API nor
    ABI stable, but is likely to change with every new released
    update. Only systemd binaries are supposed to link against it.
    This also prevents from the 32bit package to conflit with the 64bit
    one if this lib was installed by both packages.


author: fbui@suse.com
changelog:
  - Good by compatlibs support
    There's no longer need for enabling/disabling the support for the
    compatlibs as it's been dropped from the source code.


author: fbui@suse.com
changelog:
  - Enable lz4 (which becomes the default)
    It's much faster than xz and thus should be more appropriate to
    compress journals and coredumps.
    The LZ4 logic is now officially supported and no longer considered
    experimental.
    The new frame api was released in v125.


author: fbui@suse.com
changelog:
  - Really include legacy kbd maps in kbd-model-map (bsc#1015515)
    Instead of fix-machines-subvol-for-rollbacks.sh...


author: fbui@suse.com
changelog:
  - Upgrade to v232, commit de62e96da6a62ac61a7dea45cc558f5fa4342032
    - a4dff165d nspawn: resolv.conf might not be created initially (#4799)
    - b543fe907 nspawn: fix condition for mounting resolv.conf (#4622)
    - 1aed89e55 core: make mount units from /proc/self/mountinfo possibly bind to a device (#4515) (boo#909418 bsc#912715 bsc#945340)
    - bfb54ecdc coredumpctl: let gdb handle the SIGINT signal (#4901) (bsc#1012591)


author: fbui@suse.com
changelog:
  - Import commit 3edb876e3b80437a95502aa5d31d454606ea94bd
    27b544224 core: make sure to not call device_is_bound_by_mounts() when dev is null (#5033) (bsc#1018399)


author: fbui@suse.com
changelog:
  - Fix permissions set on permanent timer timestamp files (bsc#1020601) (CVE-2016-10156)
    This change makes sure to fix the permissions of the timestamp files
    which could have been created by an affected version of systemd.
    Local unprivileged users could have run arbitrary code as root if
    systemd previously created world writable suid root files such as
    permanent timer stamp files.


author: fbui@suse.com
changelog:
  - Fix permission set on /var/lib/systemd/linger/*
    Those files are created by logind which run with umask(0022), so
    they are not world writable and shouldn't be affected by
    bsc#1020601. But it's cleaner to not let files forever with their
    setuid bit set for no good reason.


author: fbui@suse.com
changelog:
  - Import commit 2559bc0c076b58f0a649056e79ca90fe5f1d556c
    9c4a759ab systemctl: 'show' don't exit with a failure status if the requested property does not exist [SUSE] (bsc#1021062)
    f9194193b systemctl: remove duplicate entries showed by list-dependencies (#5049) (bsc#1012266)
    2a6653335 rule: don't automatically online standby memory on s390x (bsc#997682)


author: fbui@suse.com
changelog:
  - Be more consistent with indentation (*no* functional changes)
    Indentation should use 8 spaces now (no tabs).


author: fbui@suse.com
changelog:
  - Don't ship ldconfig.service anymore
    This service was introduced to support stateless systems that
    support offline /usr updates properly.
    AFAIK we don't support any such system for now, so disable it. If
    it's wrong it's easy enough to restore it back.
    Related to bsc#1019470.


author: fbui@suse.com
changelog:
  - Ship systemd-resolved but it's disabled by default (bsc#1018387)
    The NSS plugin will also be disabled, users need to enable it
    manually.


author: fbui@suse.com
changelog:
  - Import commit 028fd9b60580976dffb09b3576a2b652ee35137c
    cc2ca55ff build-sys: do not install ctrl-alt-del.target symlink twice
    ececae77a device: Avoid calling unit_free(NULL) in device setup logic (#4748)


author: fbui@suse.com
changelog:
  - Move fix for permission set on /var/lib/systemd/linger/* (no functional changes)
    Move that part after the fix on timer timestamp files otherwise the
    comment doesn't make sense.


author: fbui@suse.com
changelog:
  - Import commit cd97d5d5fef79ab9d957bf6504d085c0faca6bfc
    e587b6ce0 disable RestrictAddressFamilies on all architectures but x86_64 one (bsc#1023460)
    c8ae05632 journald: don't flush to /var/log/journal before we get asked to (bsc#1004094)
    7261eaf3e sd-event: fix sd_event_source_get_priority() (#4712)


author: fbui@suse.com
changelog:
  - Don't ship systemd-resolved for now (bsc#1024897)
    If resolved is enabled , systemd-tmpfiles creates a wrong symlink in
    /etc/resolv.conf which confuses the network manager actually used.


author: fbui@suse.com
changelog:
  - Import commit 103259b3226251d06f79ca627f7b0ba0bd49f4bc
    0ee7890dd automount: if an automount unit is masked, don't react to activation anymore (#5445)
    99865a181 core: make sure to destroy all name watching bus slots when we are kicked off the bus (#5294) (bsc#1006687)
    f34234c54 build-sys: add check for gperf lookup function signature (#5055)
    44e39538f sd-event: "when exiting no signal event are pending" is a wrong assertion (#5271) (boo#995936 bsc#1022014)
    471b26807 sd-event: when an event source fails, don't assume the type of it is still set


author: fbui@suse.com
changelog:
  - Import commit 68fc0a749a83d16d4cde8471d5030bc6254ffd96
    76d4d05fb udev: fix variable assignment
    473df8cc4 udev-rules: perform whitespace replacement for symlink subst values (bsc#1025886)
    d6c3ff647 udev-event: add replace_whitespace param to udev_event_apply_format
    30ad15f7c libudev-util: change util_replace_whitespace to return number of chars in dest


author: fbui@suse.com
changelog:
  - Initialize /etc/machine-id during the first boot (bsc#1024740)
    Previously that was done at package installation but it didn't fit
    well for appliance builds.


author: fbui@suse.com
changelog:
  - Import commit f0325620d23a247682c629d28883a364e4a7a8c4
    327814841 core: when a unit's SourcePath points to API VFS pretend we are never out-of-date (#5487)
    f4b9fb58e units: move Before deps for quota services to remote-fs.target (#5627) (bsc#1028263)
    44b9d27f8 udev: net_id - support predictable ifnames on vio buses (#5675) (bnc#1029183)
    64f4761c9 units: apply plymouth warning fix to in rescue mode as well (#5615)
    77607b887 units: do not throw a warning in emergency mode if plymouth is not installed (#5528) (bsc#1025398)
    336d6016c core: downgrade "Time has been changed" to debug (#4906) (bsc#1028610)


author: fbui@suse.com
changelog:
  - Silent %tmpfiles_create in %post (bsc#1034938)
    Due to bsc#1024740, we stopped generating /etc/machine-id during
    systemd package installation making the specifier '%m' unavailable
    in the tmpfiles.d configuration files at this time.
    Make it simple for now and silent %tmpfiles_create, after all that's
    how the macro was implemented originally.


author: fbui@suse.com
changelog:
  - Don't call /sbin/ldconfig in %post of the main package
    systemd main package doesn't ship any shared libs so there's no
    point in calling ldconfig in %post/%postun


author: fbui@suse.com
changelog:
  - Don't buildrequire pam-config, it's not used at this step.
    Also drop the use of it in %postun as it can't realistically
    happen...


author: fbui@suse.com
changelog:
  - Restart a couple of systemd services on package update
    Those services (most notably journald) should support restarting
    these days. However logind still doesn't but that should be fixed
    pretty soon, well I hope :)


author: fbui@suse.com
changelog:
  - Import commit 9e33c2ae69fbb705e8ad143536e419a231e93020
    04ef0eab8 importd: support SUSE style checksums supplementary (#5800)
    fb601ad9a importd: support SUSE style checksums (#5206) (fate#322054)
    b76b27c76 hwdb: fix warning "atkbd serio0: Unknown key pressed" (#5772) (boo#1010220)
    cb0d991f6 loginctl: fix typo causing ignoring multiple session IDs (#5732)


author: fbui@suse.com
changelog:
  - Drop %preun section
    Currently the only use of this section is to remove the symlinks
    enabling systemd services on package removal. Those symlinks were
    initially installed by the systemd package installation but could
    have been overriden by the sysadmin later. If so the symlinks
    shouldn't be uninstalled.
    Also in a near futur disabling services will install a symlink to
    /dev/null.


author: fbui@suse.com
changelog:
  - Ship /var/log/README
    Unfortunately it's not possible to also ship /etc/init.d/README
    because of rpm "sanity" checks that prevent executable in
    /etc/init.d


author: fbui@suse.com
changelog:
  - Disable group shadow support (bsc#1029516)
    The new configure option will be imported during the next tarball
    update.


author: fbui@suse.com
changelog:
  - Fix indentation in systemd-sysv-convert
    While at it, strip trailing whitespaces.
    No functional changes.


author: fbui@suse.com
changelog:
  - Fix systemd-sysv-convert when a package starts shipping service units (bsc#982303)
    The database might be missing when upgrading a package which was
    shipping no sysv init scripts nor unit files (at the time --save was
    called) but the new version start shipping unit files.


author: fbui@suse.com
changelog:
  - Upgrade to v233 (commit 330b55d5e28d17f361062dba66426e46fb7d7857)
    - package new systemd-umount binary
    - package new environment generator stuff
    - drop /dev/root symlink support
    - /etc/pam.d/systemd-user is not patched anymore but we ship a
      dedicated file for SUSE now.
    - manage compat symlink generation in a dedicated branch (bsc#1040153)


author: fbui@suse.com
changelog:
  - Make sure dracut (if installed) will embed the new compat rule
    The new compat rule must be embedded in the initramfs so make sure
    that the installed dracut supports it.


author: fbui@suse.com
changelog:
  - Make sure "lock" group is created
    On SUSE distros, /run/lock must be owned by "lock" group (see
    boo#733523).
    This group was previously created by another package but since a
    recent changes it doesn't seem to be true anymore or at least this
    package isn't pulled in anymore when building the rescue system.
    For now make systemd creates the group by adding
    "Requires: group(lock)".
    I'm currently not sure why we don't use sysusers.d stuff for that
    purpose and if the "lock" group on /run/lock is still
    mandatory. This should be revisited later.


author: fbui@suse.com
changelog:
  - Stop shipping /usr/lib/sysusers.d/basic.conf (bsc#1006978)
    Ok looks like the previous change was the right thing to do and we
    continue to follow this path by relying on the new user/group scheme
    Therefore the basic system user/group are now managed and created by
    system-sysusers and udev also relies on this for the groups it uses
    in its rule files.
    Ideally we should have listed all of the groups in the deps (with
    "Requires: group(disk)" but the list of the groups is rather long
    and the risk for those groups to be re-organized is probably low, so
    currently we simply use "Requires: system-group-hardware" as a
    shortcut.


author: fbui@suse.com
changelog:
  - Don't try to restart networkd/resolved if they're disabled (boo#1045521)
    "systemctl try-restart/preset" wants the unit files exist.


author: fbui@suse.com
changelog:
  - Add minimal support for boot.d/* scripts in systemd-sysv-convert (boo#1046750)
    While at it, the handling of the symlink priorities is also removed
    since it doesn't appear to be used at all.


author: fbui@suse.com
changelog:
  - Import commit 21827ea0875ff197e16e72003b2bfaa1c6e8daad
    1ad06735f core: fail when syntactically invalid values for User=/Group= fields are detected (bsc#1047023)
    d563972e2 timesyncd: don't use compiled-in list if FallbackNTP has been configured explicitly
    f4e0c16f5 gpt-auto-generator: fix the handling of the value returned by fstab_has_fstype() in add_swap() (#6280)
    e1345aac5 fix add_esp() in the gpt-auto-generator.c (#6251)
    c591ece9a automount: don't lstat(2) upon umount request (#6086) (bsc#1040968)
    643ab2eea gpt-auto-generator: disable gpt auto logic for swaps if at least one is defined in fstab
    f07d2022f fstab-util: introduce fstab_has_fstype() helper
    bf735bb35 fstab-util: don't eat up errors in fstab_is_mount_point()
    a4b40fbed resolved: simplify alloc size calculation (bsc#1045290 CVE-2017-9445)
    8b960bec0 only check signature job error if signature job exists (#6118) (boo#1043758)
    1418bfb5b job: Ensure JobRunningTimeoutSec= survives serialization (#6128) (bsc#1004995)
    19b6d5f08 udev: turn off -Wformat-nonliteral for one safe case
    717ace439 udev: net_id add support for platform bus (ACPI, mostly arm64) devices (#5933)
    a3bf2e6b5 core/mount: pass "-c" flag to /bin/umount (#6093)


author: fbui@suse.com
changelog:
  - Added 0001-core-disable-session-keyring-per-system-sevice-entir.patch (bnc#1045886)
    Temporary patch to disable the session keyring stuff as it's
    currently broken and may introduce some security holes.


author: fbui@suse.com
changelog:
  - Upgrade to v234 (commit 78af11131da1b2760778206806c0ebe8616a5284)
    - package /etc/systemd/system/dbus-org.freedesktop.network1.service
    - /usr/lib/systemd/resolv.conf is not installed if resolved is disabled


author: fbui@suse.com
changelog:
  - Drop support of compression from the mini package
    Hence remove the relevant build-requires from the mini package.


author: fbui@suse.com
changelog:
  - Import commit 06bed720274d9436405a7c27c8238d7d1aefca2b
    66fffdf12 build-sys: don't hook var-lib-machined.mount to remote-fs.target when machined is disabled
    96c232066 Revert "core: don't load dropin data multiple times for the same unit (#5139)"


author: fbui@suse.com
changelog:
  - Import commit c5705e01800bdadd6a4fa7dc50d47b13eb697211
    8ea065d44 compat-rules: don't rely on ID_SERIAL when generating 'by-id' symlinks for NVMe devices (bsc#1048679)


author: fbui@suse.com
changelog:
  - Remove the unneeded hack forcing systemd-crypsetup binary to be linked against the just built libudev
    I don't remember why it was added but it looks unnecessary: most of
    all systemd components are linked againt libsystemd-shared.so which
    includes all the just built symbols.
    Also I don't see why it was done only for systemd-cryptsetup since
    all other binaries should have had suffered from the same issue.


author: fbui@suse.com
changelog:
  - Import commit 986e98fd5a75470ba17e21fea12d7d4e966c1ecc
    4706ebc62 call chase_symlinks without the /sysroot prefix (#6411) (boo#1051172)


author: fbui@suse.com
changelog:
  - Import commit 6887cc21f23e33ac37801a01d76176e5c16fd8ea
    9dcc6c04e pid1: forward port console specificities handling for s390 arch to v234


author: fbui@suse.com
changelog:
  - Import commit 2bed4bf99cf7f24eafda490f778ed5e109f8d7f1
    7a4935268 compat-rules: drop the boggus 'import everything' rule (bsc#1046268)


author: fbui@suse.com
changelog:
  - Add 0001-Revert-core-device-Use-JobRunningTimeoutSec-for-devi.patch (bsc#1048605)
    It's a temporary but urgent fix for a regression discovered in bug
    1048605. The fix is still under discussion with upstream but we need
    to make progress here and limit the number of affected users.
    Consequently this fix reintroduces bsc#1004995 (the bug report has
    been re-opened) but this one is far less critical and a workaround
    was provided.
    The final solution will fix both bugs.


author: fbui@suse.com
changelog:
  - Move scripts for packaging workaround/fixes in /usr/lib/systemd/scripts
    It also renames fix-machines-subvol-for-rollbacks.sh into
    scripts-systemd-fix-machines-btrfs-subvol.sh
    Note that the "scripts-systemd-" prefix is used for those scripts so
    we can gather them. Why not using a directory instead ? because osc
    doesn't allow that.


author: fbui@suse.com
changelog:
  - Introduce scripts-systemd-upgrade-from-pre-210.sh
    It collects all existing hacks done in %post to fix old/deprecated
    settings in systemd older than 210. This includes hacks needed to
    fix system that are migrating from SysV.
    There shouldn't be any functional changes.


author: fbui@suse.com
changelog:
  - Add scripts-udev-convert-lib-udev-path.sh (bsc#1050152)
    This script takes care of converting /lib/udev into a symlink
    pointing to /usr/lib/udev when upgrading a distro using an old
    version of udev.


author: fbui@suse.com
changelog:
  - Import commit 58ea3c819cca1639ef8c922505c573ba5e262b3d
    334945091 shutdown: fix incorrect fscanf() result check (#6806)
    027202892 shutdown: don't remount,ro network filesystems. (#6588) (bsc#1035386)
    bc77b53a5 shutdown: don't be fooled when detaching DM devices with BTRFS (boo#1055641)
    d9d293847 util: make get_block_device() available
    421ce7382 tmpfiles: silently ignore any path that passes through autofs (#6506) (bsc#1045472)
    ca8f90e62 device: make sure to remove all device units sharing the same sysfs path (#6679)


author: fbui@suse.com
changelog:
  - Update scripts-systemd-upgrade-from-pre-210.sh script
    - drop dependency on awk
    - fallback to runlevel #3 if something goes wrong
    Note: I'm not sure how this is supposed to work as /etc/inittab is
    likely to be missing in my understanding. Indeed this file is part
    of the aaa_base package which might be upgraded before systemd is
    installed...


author: fbui@suse.com
changelog:
  - Import commit 9e0985dc330b1cf04bc44049962343bdf4ba851a
    4fd7cd041 pam_logind: skip leading /dev/ from PAM_TTY field before passing it on
    dd6312828 logind: make sure we don't process the same method call twice (#6583)


author: fbui@suse.com
changelog:
  - Import commit c1e8af7d1e8b09c2878a5b17f513bfc41ae46dc6
    982754275 build-sys: make sure 61-persitent-storage-compat.rules is installed with meson
    9ac2e8b9b udev: proc_cmdline_get_key() FTW! (#6925)


author: fbui@suse.com
changelog:
  - Import commit 93688f8e53b4e482a55a7d4aba2d927ddedebdde
    c53522be3 compat-rules: allow to specify the generation number through the kernel cmdline


author: fbui@suse.com
changelog:
  - Import commit 6dea894131d78b20b9e0482f75afa6ee4dec8627
    1cdd944b0 unit: when JobTimeoutSec= is turned off, implicitly turn off JobRunningTimeoutSec= too (bsc#1004995)
    This make 0001-Revert-core-device-Use-JobRunningTimeoutSec-for-devi.patch
    not needed anymore.


author: fbui@suse.com
changelog:
  - Damn forgot to drop 0001-Revert-core-device-Use-JobRunningTimeoutSec-for-devi.patch in
    the spec file


author: fbui@suse.com
changelog:
  - Add 0001-systemd-firstboot-add-vconsole-keymap-support.patch (bsc#1046436)
    Temporary patch until it's been merged by upstream, see
    https://github.com/systemd/systemd/pull/7035


author: fbui@suse.com
changelog:
  - Import commit e44237e76f6e133e62ff6c681d3fd06ebf12f66d
    a4e02c099 udev-rules: all values can contain escaped double quotes now (#6890)
    d2b767a76 tmpfiles: remove old ICE and X11 sockets at boot (#6979)


author: fbui@suse.com
changelog:
  - Import commit b9a41367b6c1164318443491cc3dae0e8208e15c
    86804326f systemd-firstboot: add vconsole keymap support (#7035) (bsc#1046436)
    9b64225e9 resolved: fix loop on packets with pseudo dns types (bsc#1065276 CVE-2017-15908)
  - Drop 0001-systemd-firstboot-add-vconsole-keymap-support.patch since
    it's been merged upstream and backported to SUSE/v234 (see above).


author: fbui@suse.com
changelog:
  - Import commit 4b9afa11f918796184e1264d618b4ff5d18e481b
    22dcb1d04 tmpfiles: when /etc is not fully initialized, some specifiers are expected to be unresolvable (#6860) (bsc#1055664)
    216beb768 tmpfiles: Allow create symlink on directories (#6039)
    baf85eb79 udev: net_setup_link: don't error out when we couldn't apply link config (#7328)
  - Remove stderr redirection to /dev/null when calling %tmpfiles_create
    since it's not needed anymore due to commit 22dcb1d04. Indeed the
    messages are no more emitted at LOG_WARN but LOG_NOTICE.


author: fbui@suse.com
changelog:
  - Add 0001-compat-rules-get-rid-of-scsi_id-when-generating-comp.patch (bsc#1051465)
    This patch is not yet merged in the 'compats/udev-compat-symlinks'
    branch: we asked to upstream if it would be possible to introduce a
    new specifier that wouldn't strip trailing whitespaces , see
    https://github.com/systemd/systemd/issues/7462
    Also this allows to give the patch more testing before merging it in
    the git repo.


author: fbui@suse.com
changelog:
  - Import commit e30f1b10e276fb18db10ea2463fbd7146ae778f6
    63481b24b firstboot: do not write vconsole.conf when arg_keymap is empty (bsc#1070124)


author: fbui@suse.com
changelog:
  - Import commit 82dbe8a2ae56649231111eaadd4c302a2d2175ee
    8c7f0c449 service: Don't stop unneeded units needed by restarted service (bsc#1066156)
    869be64ce sysctl: use raw file descriptor in sysctl_write (#7753)
    0c2400810 sysctl: disable buffer while writing to /proc (bsc#1071558)
    9eb1f30b8 Use read_line() and LONG_LINE_MAX to read values configuration files. (bsc#1071558)
    4dbea654f def: add new constant LONG_LINE_MAX
    48f14cd71 fileio: add new helper call read_line() as bounded getline() replacement
    861e1a222 build-sys: udevadm should have LOG_REALM=LOG_REALM_UDEV
    8ed5cf3fb meson: libudev_core and udevadm should have LOG_REALM=LOG_REALM_UDEV (#7666)
    a9f93f1d0 virt: use XENFEAT_dom0 to detect the hardware domain (#6442, #6662) (#7581) (bsc#1048510)
    fe56abdf9 seccomp: arm64/x32 do not have _sysctl
    c9194fe37 seccomp: arm64 does not have mmap2
    31d9b3c32 fs-util: small tweak in chase_symlinks()
    9dd0bc7a3 meson: do not include man/meson.build if xsltproc not found
    7e29e2b07 analyze: replace --no-man with --man=no in the man page (bsc#1068251)


author: rbrown@suse.com
changelog:
  - Edit scripts-systemd-fix-machines-btrfs-subvol.sh
    We shouldn't be creating a /var/lib/machines subvolume if /var is
    already a seperate partition or subvolume. /var/lib/machines will
    already be excluded from snapper & similar tooling in this case.


author: fbui@suse.com
changelog:
  - Import commit cc94ce8513221061898c83f57862544b16021f0e
    aa3eba828 delta: don't ignore PREFIX when the given argument is PREFIX/SUFFIX
    b1ea0173a delta: extend skip logic to work on full directory paths (prefix+suffix) (bsc#1070428)
    77c5065f9 delta: check if a prefix needs to be skipped only once
    db32866d1 Fix parsing of features in detect_vm_xen_dom0 (#7890) (bsc#1048510)
    11d40461a sd-bus: use -- when passing arguments to ssh (#6706)
    1148d99f6 tmpfiles: consider /etc uninitialized also when /etc/machine-id is present but empty (#7849) (bsc#1075179)
    3a95f69bf tmpfiles: downgrade warning about duplicate line


author: fbui@suse.com
changelog:
  - Import commit 83067827cc891ddc90def200fdbe725917ec9fa3
    3d60486f7 core/timer: Prevent timer looping when unit cannot start (bsc#1068588)
    460bd0cd6 Revert "handle SYSTEMCTL_OPTIONS environment variable" (fate#323393)


author: fbui@suse.com
changelog:
  - Do not optionally remove /usr/lib/systemd/system/tmp.mnt anymore (bsc#1071224)
    This was done to make sure that tmpfs wouldn't be used for /tmp by
    defaut in case the dir layout created by the installer did not
    create a customized tmp.mount.
    But it had the bad side effect to break "rpm -V systemd" and updates
    of systemd via delta-RPMs.
    Now instead of removing tmp.mount unit file, we mask it (still only
    if no other tmp.mount would override the default one). It's the
    official way to disable tmpfs on /tmp after all.
    Since we cannot rely on the presence of fstab during package
    installations, we introduced a service which is run once on the
    first boot and which figures out if tmpfs would be used. If so it
    masks the unit.
    We also handle the upgrade path and make sure to preserve admin's
    settings (if any).
    Another advantage of this is that we will only need to remove the
    introduced service the day when tmpfs will be the default for SUSE
    distros.


author: fbui@suse.com
changelog:
  - Import commit 2087a80d56bb6f8c7fb74a19172259bc9d9af866
    2b8971b8a tmpfiles: refuse to chown()/chmod() files which are hardlinked, unless protected_hardlinks sysctl is on (bsc#1077925 CVE-2017-18078)
    8c2bcac25 tmpfiles: change ownership of symlinks too


author: fbui@suse.com
changelog:
  - Drop 0001-core-disable-session-keyring-per-system-sevice-entir.patch
    It's been merged in branch "SUSE/v234".


author: fbui@suse.com
changelog:
  - Import commit c516268845b0fd0683cef2e491b84077371e8f01
    37da1facb core: disable session keyring per system sevice entirely for now (bnc#1045886)
    8a1ae0449 strv: fix buffer size calculation in strv_join_quoted()


author: fbui@suse.com
changelog:
  - Drop 0001-compat-rules-get-rid-of-scsi_id-when-generating-comp.patch
    It's been imported in branch "compats/udev-compat-symlinks" which
    has been merged in branch "openSUSE-Factory" in its turn.


author: fbui@suse.com
changelog:
  - Import commit 8ec9f58d334c76e736957812d9e57151502a6f63
    07c6ee3eb compat-rules: get rid of scsi_id when generating compat symlinks for NVMe devices (bsc#1051465)
    261a4ef38 compat-rules: generate compat by-id symlinks with 'nvme' prefix missing (bsc#1063249)


author: fbui@suse.com
changelog:
  - Import commit 3f421e4fbf6fcb31d74caf729435868ba8824483
    7fb9ea39a Revert "restore /var/run and /var/lock bind mount if they aren't symlink"
    23ce1207a meson.build: make docdir configurable (#8068)


author: fbui@suse.com
changelog:
  - Import commit 846d838c37865da60eba48090e570e959291399f
    b1e0a348d fileio: include sys/mman.h
    f1fa784cb meson: update header file to detect memfd_create()
    8838ba7ec meson: define _GNU_SOURCE to detect copy_file_range() (#7734)
    531a00c84 Restore "restore /var/run and /var/lock bind mount if they aren't symlink""
    (the 3 first commits make systemd build against glibc 2.27)


author: fbui@suse.com
changelog:
  - Drop libgcrypt.m4
    The mini package builds fine without it so it doesn't seem necessary
    anymore.


author: fbui@suse.com
changelog:
  - Import commit 0a5600eb7f8263c7c79fec0d85cc159d54aba636
    2a181fc6f insserv-generator: make it build with meson
    7b0401da4 build-sys: don't build networkctl if networkd is disabled


author: fbui@suse.com
changelog:
  - Switch to Meson build system
    Some rearrangement in the file list was also needed. That was
    probably due to the upgrade of rpm.


author: fbui@suse.com
changelog:
  - Don't ship /usr/lib/systemd/system/tmp.mnt at all (bsc#1071224)
    The previous fix couldn't work on platforms using a RO
    rootfs. Therefore we don't ship /usr/lib/systemd/system/tmp.mnt but
    we still ship a copy in /usr/share/systemd.
    Users who want to use tmpfs on /tmp are supposed to add a symlink in
    /etc/ pointing to the copy shipped in /usr/share/systemd.
    To support the update path we automatically create the symlink if
    tmp.mount in use is located in /usr/lib/systemd.


author: fbui@suse.com
changelog:
  - Import commit 4a6a1e4f0b02e6cedf7eba93b85a6dd968f875c7
    db1d8eacd compat-rules: make path_id_compat build with meson
  - Drop 0001-compat-rules-make-path_id_compat-build-with-meson.patch
    which is now part of the git repo (see above).


author: fbui@suse.com
changelog:
  - Make systemd-timesyncd use the openSUSE NTP servers by default
    Previously systemd-timesyncd used the Google Public NTP servers
    time{1..4}.google.com


author: fbui@suse.com
changelog:
  - Import commit 295ead0f396beb2b5199abd99a17e274c2581f95
    f4f94ab2e meson: install rules/80-hotplug-cpu-mem.rules
    2901aa9b9 meson: install rules/60-ssd-scheduler.rules
    1293c0056 core: use id unit when retrieving unit file state (#8038) (bsc#1075801)
    596b2b241 Revert "vconsole-setup: add SUSE specific settings for font/keyboard in sysconfig"
    0b595da04 Revert "locale-setup: handle locale at boot time well"


author: fbui@suse.com
changelog:
  - Split systemd-container sub-package off (fate#325469)
    Other distros already do it and it seems a good idea to not install
    this stuff on new installations by default. At least
    /var/lib/machines subvol is not created anymore at boot even if it
    wasn't used at all.


author: fbui@suse.com
changelog:
  - Fix build errors due to the split-off of systemd-containe:
    found conflict of systemd-234-33.1.x86_64 with systemd-container-234-33.1.x86_64:
    - /usr/share/man/man5/systemd.nspawn.5.gz
    - /usr/share/man/man1/systemd-nspawn.1.gz
    found conflict of systemd-container-234-33.1.x86_64 with systemd-mini-container-234-33.1.x86_64:
    - /usr/bin/systemd-nspawn
    - /usr/lib/systemd/system/systemd-nspawn@.service
    - /usr/lib/tmpfiles.d/systemd-nspawn.conf


author: fbui@suse.com
changelog:
  - Don't call "pam-config --systemd"
    pam_systemd.so has been integrated directly in the PAM stack since
    bsc#812462. So there's no need to call pam-config.


author: Thomas.Blume@suse.com
changelog:
  - add basic user space support for suspend to idle (fate#323814)
      add 99-wakeup-from-idle.rules
      Currently this only covers the power button and usb/AT keyboards
      as wakeup devices. It is planned to make that configurable in
      the future.


author: fbui@suse.com
changelog:
  - Upgrade to v237 (commit 78221ca750a9c266f9f8497dda59d7ee44000a6c)
    Udev rules 60-ssd-scheduler.rules and 80-hotplug-cpu-mem.rules have
    been removed from the git repo and are now maintained at the package
    level. Those rules have been rejected by upstream as they seem to be
    written to workaround some kernel shortcomings...
    This includes the following bug fix:
    - upstream commit 3d083b2245b0b8e52f2d8ccc3e55246f41f1f544 (bsc#1102908)
    This also includes the following bug fixes released in v235:
    - upstream commit 2e64e8f46d726689a44d4084226fe3e0ea255c29 (bsc#1069239)
    - upstream commit 79873bc850177050baa0c5165b119adafeebb891 (bsc#1069239)
    - upstream commit 4bc5d27b942afa83cc3d95debd2ad48d42ac07a8 (bsc#1089376)
    - upstream commit e9ea4526a3a3b41eced29b8d742498cc36750424 (bsc#1089693)
    - upstream commit d75b31837c93dbb9b20067719026ad0fb7cdfadd (bsc#1117025)
    - upstream commit 0e8856d25ab71764a279c2377ae593c0f2460d8f (bsc#1117025)
    - upstream commit 048dd629c4590eefb2ebd6a316c7350ed3a6ff19 (bsc#1119971)
    - upstream commit 9b32afa9f241fe8febc0a754850f1e7331caf6e3 (bsc#1126056)
    - upstream commit e6dde451a51dc5aaa7f4d98d39b8fe735f73d2af (bsc#1137053)
    - upstream commit 0864d311766498563331f486909a0d950ba7de87 (bsc#1158336)
    - upstream commit d60cb656fc63c24b430421764b7d0322857d34fd (bsc#1161262)
    - upstream commit e2be442e791fa1150aa835c684acc6d7189de3e1 (bsc#1165011)
    - upstream commit 64a36ae4b1dd23474dd7ea261381ac437b24fac2 (bsc#1172072)
    - upstream commit b001ad61e91b6499897f0c977045c7608c233bfa (jsc#SLE-7687)
    - includes IP filtering feature (jsc#SLE-7743)
    This also includes the following bug fixes released in v236:
    - upstream commit b3b4ebab02395933cde554b5a5d5c363dae3920d (bsc#1083571)
    - upstream commit 3e3852b3c6c61506963112fd218a86b673fc61e6 (bsc#1110445)
    - upstream commit 4050e4797603d3644707d58edfd9742b5311c7cf (bsc#1124153)
    - upstream commit 8cb83266062b383cdd4a57301ef559d64b491c51 (bsc#1125604)
    - upstream commit 19a44dfe4525ab01caf593a9c2beada4b412910d (bsc#1156482)


author: fbui@suse.com
changelog:
  - BS forces us to own %{_prefix}/lib/modprobe.d
    This seems wrong but that's how the SUSE BS works.


author: fbui@suse.com
changelog:
  - Fix hotplug memory in 80-hotplug-cpu-mem.rules
    When new memory was hotplugged, the rule was supposed to call an
    external script (udev-remount-tmpfs) to remount all tmpfs. However
    the script was broken since its introduction (commit rev=715,
    14/07/2014) and had no effects... this makes me wonder if we
    shouldn't get rid of this...


author: fbui@suse.com
changelog:
  - Import commit 46d6bc9c4f1c05f3b4fcfca754cc59963bd86ce3
    2a79f4e78 units: delegate "memory" instead of "cpu" by default for user instances (#8320) (bsc#954765 bnc#953241 fate#320421)
    88174ae85 compat-rules: fix syntax errors spotted by test/rule-syntax-check.py


author: fbui@suse.com
changelog:
  - Remove dropin that was used to turn delegation off for user instances
    Upstream now enables "memory" and "pids" controllers only which
    should have a very limited impact on performance compare to the
    "cpu" controller.


author: fbui@suse.com
changelog:
  - Restore (maybe temporarly) "pam_config --add systemd"
    During its installation pam-config seems to overwrite the defaults
    shipped by "pam" for "some" reasons (see bsc#1084924)
    No idea why but since pam_systemd is not part of the "pam-config"
    defaults, we need to restore pam_systemd in common-session
    manually...


author: fbui@suse.com
changelog:
  - Turn off the IP sandboxing for systemd-logind
    Since v235 logind run inside an IPv4/IPv6 sandbox by default. This
    creates incompatibilites for systems using NIS.


author: fbui@suse.com
changelog:
  - Add 0001-basic-macros-rename-noreturn-into-_noreturn_.patch
    This fix a build error triggered by the introduction of the new
    version of libgpg-error package. Patch submitted to upsream:
    https://github.com/systemd/systemd/pull/8456


author: fbui@suse.com
changelog:
  - Run migrate-sysconfig-i18n.sh also during package installation (bsc#1086164)
    This is needed when we upgrade from SLE11.


author: fbui@suse.com
changelog:
  - Build a mini variant of systemd-container
    So we don't have to manually track and remove all files that should
    be shipped by systemd-container in the case of a bootstrap build.


author: fbui@suse.com
changelog:
  - Don't ship machines.target in systemd-container but in systemd main package
    machines.target is supposed to be a standard target for
    starting/stopping all containers. systemd-nspawn is the main user of
    it but other container managers could also make use of it.


author: develop7@develop7.info
changelog:
  - Enhance IO scheduler tweaking rules to support blk-mq as well
    * Set optimal blk-mq schedulers (bfq and mq-deadline for HDD and
      SSD respectively)
    * Explicitly set CFQ for rotational disks when no `elevator`
      is specified
    * Verbose comments explaining what is going on
    * Rename the rules file since it is not ssd-only anymore


author: fbui@suse.com
changelog:
  - Rename the tarball (bsc#1087323)
    So it's clear that it contains some additional patches on top of the
    upstream version. Use the commit hash in the name so the exact
    version can easily be identified.
    Provide _service file which can be used to retrieve the tarball from
    the git repo (with "osc service disabledrun").


author: fbui@suse.com
changelog:
  - Import commit 14b3e00c3ccb8c1c82c8a2e99a9534750880a09e
    e0a8285e2 pid1: when creating service directories, don't chown existing files (#8181) (boo#1085971)
    fb25886b1 Fix format-truncation compile failure by typecasting USB IDs (#8250) (bsc#1084638)
    5a6e9c92e sysusers: make sure to reset errno before calling fget*ent()
    c2e1ee488 sysusers: also add support for NIS entries in /etc/shadow
    51cb94fa1 sysusers: do not append entries after the NIS ones (bsc#1085062 bsc#1045092)
    783f3d368 basic/macros: rename noreturn into _noreturn_ (#8456)
  - Drop 0001-basic-macros-rename-noreturn-into-_noreturn_.patch
    It's been merged in the git repo.


author: fbui@suse.com
changelog:
  - stat(1) as well as systemctl are not use in %post section of udev
    So remove stat(1) from the list of dep and move systemctl to the
    requirements of %postun since it's called from there.


author: fbui@suse.com
changelog:
  - Drop systemd-bash-completion sub-package
    Now we directly ship the completion scripts from the main package as
    we already do for zsh. I couldn't see any advantages in this split.


author: fbui@suse.com
changelog:
  - Be consistent in 60-io-scheduler.rules
    And use "?*" when checking for the non empty string (instead of "*?").


author: fbui@suse.com
changelog:
  - Ship 99-sysctl.conf instead of creating it during package installation/update (bsc#1088769)
    Previously this symlink was created in /etc/sysctl.d during %post
    which made the symlink not owned and more importantly it was created
    only if /etc/sysctl.conf is already installed which is not always
    the case during the installation process it seems.
    So ship the symlink unconditionally and put it in /usr/lib/sysctl.d
    instead since it's a distro default behavior that might be overriden
    by sysadmin later.


author: fbui@suse.com
changelog:
  - Import commit d8196805089566ecd846b7c627ff2f3c42588c50
    621b247f3 device: skip deserialization of device units when udevd is not running
    a7da5bdbc device: make sure to always retroactively start device dependencies (bsc#1088052)
    303624f6f systemd-udevd: limit children-max by available memory (#8668) (bsc#1086785 bsc#1066422)
    76acf3ae9 tmpfiles: fix directory removal with force symlink (#8619)


author: fbui@suse.com
changelog:
  - Move 80-container-v[ez].network in systemd-container sub-package
  - Move 80-container-host0.network from udev to systemd


author: Thomas.Blume@suse.com
changelog:
  - align permissions of /etc/machine-id to upstream code (bsc#1092269)
    world writeable machine-id is a security issue


author: fbui@suse.com
changelog:
  - Add 0001-resolved-create-etc-resolv.conf-symlink-at-runtime.patch (boo#1024897)
  - Ship systemd-resolved (but disabled by default) (bsc#1018387)


author: fbui@suse.com
changelog:
  - Import commit f63623c1fc0eb01b8efc2037d004f42ed8328356
    6a161916f device: make sure to always retroactively start device dependencies (take #2) (bsc#1088052)
    e4402648c Fix pattern to detect distribution
    ad59c7970 install: "user" and "global" scopes are equivalent for user presets (boo#1093851)
    b1876c81a rpm: remove confusing --user before --global
    00ea8a214 man: updated systemd-analyze blame description for service-units with Type=simple (#8834) (bsc#1091265)
    a9b587e2f fileio.c: fix incorrect mtime


author: fbui@suse.com
changelog:
  - Drop runtime dependency on dracut (bsc#1098569)
    Otherwise systemd pulls in tools to generate the initrd even in
    container/chroot installations that don't have a kernel anyways.
    For environments where initrd matters, dracut should be pulled via a
    pattern.


author: fbui@suse.com
changelog:
  - Import commit 0350f62a8cf7f151951b6b78337fe3c198b8bf6a
    fbf43a697 core: don't freeze OnCalendar= timer units when the clock goes back a lot (bsc#1090944)
    4134ba8b6 man: SystemMaxUse= clarification in journald.conf(5) (bnc#1101040)
    78bb2a0c4 socket-util: fix getpeergroups() assert(fd) (#8080) (bsc#1096516)
    1753d0420 systemctl: mask always reports the same unit names when different unknown units are passed (bsc#1095973)
    50ebf79d7 scsi_id: Fixup prefix for pre-SPC inquiry reply (bsc#1039099)
    570f7655b locale-util: on overlayfs FTW_MOUNT causes nftw(3) to not list *any* files


author: fbui@suse.com
changelog:
  - Import commit bb5a925bcefd4743873cae3f748ae1a426e92d44
    8983bd246 core: don't include libmount.h in a header file (#8580)
    3e4156a8f tmpfiles: don't adjust qgroups on existing subvolumes (bsc#1093753)
    42edc93ac core/service: rework the hold-off time over message


author: fbui@suse.com
changelog:
  - Import commit 6ac2232d88f4b64428511a4692a51bd00d610b32
    6247696db nspawn: always use mode 555 for /sys (bsc#1107640)
    72f558b57 cryptsetup: do not define arg_sector_size if libgcrypt is v1.x (#9990)
    cfcd97cf2 cryptsetup: add support for sector-size= option (#9936) (fate#325634)


author: fbui@suse.com
changelog:
  - Import commit cc55f1ea9e1c1ccab5b9fb97e10e08830d02b282
    962b38aaf user@.service: don't kill user manager at runlevel switch (bsc#1091677)
    3986c4d82 units: make sure user@.service runs with dbus still up
    5e68aa0f2 Revert "udevd: increase maximum number of children" (bsc#1107617)
    099138fd9 fix race between daemon-reload and other commands (v237) (bsc#1105031)


author: Thomas.Blume@suse.com
changelog:
  - split off SUSE specific udev rules from systemd package (fate#325478)
    * remove 60-io-scheduler.rules
    * remove 80-hotplug-cpu-mem.rules
    * remove 99-wakeup-from-idle.rules
    * remove /usr/lib/modules-load.d/sg.conf (see bsc#1036463 for details)
    these are now maintained in the new package system-tuning-common-SUSE


author: fbui@suse.com
changelog:
  - Import commit a67b516d49115a5be0f2ac27a2874cee6c59a7ae
    f8457adf9d emergency: make sure console password agents don't interfere with the emergency shell
    b8bbb50634 man: document that 'nofail' also has an effect on ordering
    a5410b2229 journald: take leading spaces into account in syslog_parse_identifier
    b793c312c7 journal: do not remove multiple spaces after identifier in syslog message
    f9595f0481 syslog: fix segfault in syslog_parse_priority()
    d464f06934 journal: fix syslog_parse_identifier()
    e70422883a socket-util: attempt SO_RCVBUFFORCE/SO_SNDBUFFORCE only if SO_RCVBUF/SO_SNDBUF fails (bsc#991901)


author: fbui@suse.com
changelog:
  - Import commit 19b3868d32af20f1ecc86fe3c997144ff456fd65
    06c2284d64 core: introduce systemd.early_core_pattern= kernel cmdline option
    479b002083 core: add missing 'continue' statement
    c7fbccc62e journald: don't ship systemd-journald-audit.socket (bsc#1109252)
    f17a6c790c detect-virt: do not try to read all of /proc/cpuinfo (bsc#1109197)
    5a1aa84544 compat-rules: generate more compat by-id symlinks for NVMe devices (bsc#1095096)


author: fbui@suse.com
changelog:
  - Ship systemd-sysv-install helper via the main package
    This script was part of systemd-sysvinit sub-package but it was
    wrong since systemd-sysv-install is a script used to redirect
    enable/disable operations to chkconfig when the unit targets are
    sysv init scripts. Therefore it's never been a SySV init tool.
    While at it, don't ship this script (as well as
    systemd-sysv-convert) when sysvcompat is not defined.


author: fbui@suse.com
changelog:
  - Upgrade to v239 (commit 6d8584e7e8e5d13d2bab49b9e6f6d2ec39759978)
    This includes the following bug fixes:
    - upstream commit 0722b359342d2a9f9e0d453875624387a0ba1be2 (bsc#1045723)
    - upstream commit 2f2e14b251b9929e84e8b690d0187b766dfbae20 (bsc#1124122)
    - upstream commit c839b729c5f7b08f6d91bf9567d0b1f91d17e0f7 (bsc#1155207)
    - upstream commit 8eebb6a9e5e74ec0ef40902e2da53d24559b94a4 (bsc#1168076)
    This also includes the following bug fixes released in v238:
    - upstream commit e8a3144ec4ff332bd63644e468a98e1a7e06e7e4 (bsc#1112024)
    - upstream commit 4d219f5343b1924e7c519c2c178aeb5d1a5ab924 (bsc#1123727)
    - upstream commit 43b7f24b5e0dd048452112bfb344739764c58694 (bsc#1146991)
    - upstream commit bf443be99565e4327f1c8c12b79d98b4c1529cf1 (bsc#1156213)


author: fbui@suse.com
changelog:
  - Dont ship /usr/sbin/resolvconf symlink for now
    It conflicts with the bin shipped by openresolv and provides
    limited compat only.


author: fbui@suse.com
changelog:
  - Drop duplicated %{?mini} suffix for systemd-{container,coredump} subpackages
    "-mini" is already part of the name of the main package so there's
    no need to append it again for those sub packages. It's only needed
    when the name of a subpackage is completely redefined, IOW when '-n'
    option is used with the %package directive.


author: fbui@suse.com
changelog:
  - Import commit b54f5d7a8b41898ce98f43cd1a6cc92c0071806d
    5def29d24 coredump: only install coredump.conf when ENABLED_COREDUMP=true
    9133e2d6e dhcp6: make sure we have enough space for the DHCP6 option header (bsc#1113632 CVE-2018-15688)
    ebc3fa418 dhcp6: split assert_return() to be more debuggable when hit
    51eefb6ac chown-recursive: let's rework the recursive logic to use O_PATH (bsc#1113666 CVE-2018-15687)
    e1e1aa237 core: skip unit deserialization and move to the next one when unit_deserialize() fails
    1c726c87d core: when deserializing state always use read_line(?, LONG_LINE_MAX, ?) (bsc#1113665 CVE-2018-15686)
    4cd7d11ac core: don't create Requires for workdir if "missing ok" (bsc#1113083)


author: fbui@suse.com
changelog:
  - Drop a Conflicts: in systemd-coredump
    It not needed anymore since the mini variant of systemd-coredump is
    not built anymore.


author: fbui@suse.com
changelog:
  - Own %{_libexecdir}/modules-load.d (again)
    This was incorrectly dropped during the split of the SUSE specific
    configurations.


author: fbui@suse.com
changelog:
  - Import commit f39674d6d114d999c50672c7bea8cad21e1eaed9
    7d1e04e85 units: use =yes rather than =true everywhere
    185ce0d34 units: assign user-runtime-dir@.service to user-%i.slice
    a051f5e41 units: make sure user-runtime-dir@.service is Type=oneshot
    30c6842c3 units: set StopWhenUnneeded= for the user slice units too
    e74de046e login: fix typo in log message


author: fbui@suse.com
changelog:
  - Add 0001-logind-keep-backward-compatibility-with-UserTasksMax.patch
    We have to keep support for UserTasksMax= for a while before
    dropping it. This patch is supposed to do that and also to make
    users aware of this change. It also hints how to configure that
    differently.


author: fbui@suse.com
changelog:
  - Make systemd-mini-sysvinit provides systemd-sysvinit
    Some packages (such as shepherd-bins) want to conflicts with
    systemd-sysvinit: they should also conflict with
    systemd-mini-sysvinit.


author: fbui@suse.com
changelog:
  - Import commit 69f9f79e1b03e3d23df25b61cbcc9304af3e358f (bsc#1080919 CVE-2018-6954)
    f3615ce49 tmpfiles: don't adjust qgroups on existing subvolumes (bsc#1093753)
    7165e92f4 tmpfiles: use fd_get_path() even less excessively
    c2c531c1d test: make TEST-22 easier to debug, by outputting to /dev/console
    621b78317 test: don't use "nobody:nogroup" for tests
    1f9c7acad tmpfiles: return correct error variable after fd_reopen()
    2236280c1 tmpfiles: reindent one comment less weirdly
    f6bdfb889 tmpfiles: use correct error variable
    bc75127cd tmpfiles: clarify that we ignore file attribute setting errors
    621c8b1fe tmpfiles: add log message where we previously failed silently
    bc9229630 tmpfiles: use fd_get_path() less excessively
    5a1106039 tmpfiles: add more tests
    c974086cc tmpfiles: don't follow unsafe transitions in path_set_*()
    e64a510eb fs-util: add new CHASE_NOFOLLOW flag to chase_symlinks()
    7480154d0 tmpfiles: make create_fifo() safe
    eb890962c fs-util: introduce mkfifoat_atomic() helper
    653bb81af fileio: make tempfn_random_child() accept empty string as path
    2b1e12bfe tmpfiles: introduce create_fifo()
    6dd80f289 tmpfiles: introduce empty_directory()
    f2c137edf tmpfiles: introduce create_directory() and create_subvolume() and make them safe
    6a76f6dfb basic/stat-util: introduce is_dir_fd()
    38a7f2e81 btrfs-util: unfuck tmpfiles' subvol creation
    26e19b6fe btrfs-util: introduce btrfs_subvol_make_fd()
    5fb5bdf5d basic/label: introduce mkdirat_label()/mkdirat_errno_wrapper() helpers
    390b767da selinux: introduce mac_selinux_create_file_prepare_at()
    0f72fadba smack: introduce mac_smack_fix_at()
    f2838154b tmpfiles: introduce create_directory_or_subvolume()
    2de697fb8 tmpfiles: make create_device() safe
    558c5fec7 tmpfiles: introduce create_device()
    dee986b1d tmpfiles: make copy_files() safe
    cacb14d3f tmpfiles: introduce copy_files() routine
    81c85ce17 tmpfiles: make write_one_file() safe
    9ec6b92ab tmpfiles: make truncate_file() safe
    8dde36e03 tmpfiles: introduce truncate_file() which deals with 'F' exclusively
    481134a93 tmpfiles: introduce create_file() which deals with 'f'/'F' exclusively
    057861560 tmpfiles: make the stat struct parameter in fd_set_*() optional
    f37caffda tmpfiles: stat file in item_do() rather than in its callers
    86f1362d4 tmpfiles: set only default acls to folders #9545 (#9599)


author: fbui@suse.com
changelog:
  - Move systemd-sysv-convert from /usr/sbin to /usr/lib/systemd (bsc#1178156)
    This tool is not supposed to be run by users.


author: fbui@suse.com
changelog:
  - Fix the test for figuring out if /etc/machine-id is writable in %post (bsc#1117063)
    "test -w" always returns true for root user even if the writable
    mode bits are not set. Fix this by testing the file mode bit value
    instead.


author: fbui@suse.com
changelog:
  - Import commit 8ae56af7802ef8f91fac64fa244d62a4468fbbd5
    4474878178 udev-builtin-kmod: adjust logging
    805534aff5 core: use the generic module_load() function
    ac7e902530 shared/module-util: fix preexisting mixup with errno sign
    415aa40793 udev-builtin-kmod: use the generic module_load() function
    8a36b4bac6 Move module-util.h to src/shared/ and load_module() to libshared
    999b910752 core/kmod-setup: restore comments
    1f2b822a21 logind: stop managing VT switches if no sessions are registered on that VT
    5ad8d374c5 terminal-util: introduce vt_release() helper
    145d492490 logind: become the controlling terminal process before restoring VT (bsc#1101591)
    d4b5dbc033 terminal-util: introduce vt_restore() helper
    2e8af185f0 logind: make session_restore_vt() static
    ff3048364f udev: downgrade message when we fail to set inotify watch up (bsc#1005023)


author: fbui@suse.com
changelog:
  - Import commit a3b059a8c60622e4ec30aabda93c6b41d0953dc4
    9dbe9f12ec journal-remote: set a limit on the number of fields in a message (CVE-2018-16865 bsc#1120323)
    61d569ab1b journal-remote: verify entry length from header
    a08760b26c httpd: use a cleanup function to call MHD_destroy_response
    43f46a1a3d journal-gateway: use _cleanup_ attribute to stop microhttpd daemon
    437b0b2d01 journald: lower the maximum entry size limit to  for non-sealed fds
    ac9e209710 journald: when processing a native message, bail more quickly on overbig messages
    ce103705b9 journald: set a limit on the number of fields (1k) (CVE-2018-16865 bsc#1120323)
    35538171c2 coredump: fix message when we fail to save a journald coredump
    cfe247b555 basic/process-util: limit command line lengths to _SC_ARG_MAX
    9d59e6f6ee journald: do not store the iovec entry for process commandline on stack (CVE-2018-16864 bsc#1120323)
    8d650a68d4 journald: remove unnecessary {}
    b608f532a4 coredump: remove duplicate MESSAGE= prefix from message
    0dbb2dc066 vconsole-setup: fonts copy will fail if the current terminal is in graphical mode (bsc#1114933)
    e501d65540 Revert "systemctl: when removing enablement or mask symlinks, cover both /run and /etc"
    d3ea69961f fs-util: rename safe_transition() into unsafe_transition()
    338470fdc9 tmpfiles: use CHASE_WARN in addition to CHASE_SAFE
    d9ae1b30da fs-util: make chase_symlink() returns -ENOLINK when unsafe transitions are met
    8b76594d1f fs-util: add new CHASE_WARN flag to chase_symlinks()


author: fbui@suse.com
changelog:
  - Import commit 3bece8a25ae11e8ec132cdecc7e72a00ee790994
    89a9721a47 Revert "logind: become the controlling terminal process before restoring VT" (bsc#1120836)
    c3a8dc821b pam_systemd: reword message about not creating a session
    0ba0f5b3ef pam_systemd: suppress LOG_DEBUG log messages if debugging is off


author: fbui@suse.com
changelog:
  - Import commit ad34cc45f63720ced69960dc66b47bddb146176d
    Import a bunch of fixes from stable/v239-stable:
    c8293f5af4 Revert "network: set DynamicUser= to systemd-networkd.service"
    7f605592e6 Revert "resolve: enable DynamicUser= for systemd-resolved.service"
    5a48e92e06 test: Fix networkd test for an already running service
    36eae1688b Revert "timesyncd: enable DynamicUser="
    3a11f24cf0 Revert "unit: drop After=systemd-sysusers.service from timesyncd"
    23cfd15ce9 machinectl: fix verbosity of import-raw or friends
    ba037daf29 Make bzip2 an optional dependency for systemd-importd
    fb609d2721 pull: initialize libgcrypt before calling any functions provided by libgcrypt
    c50857bc6b hwdb: remove stray 'i' in hwdb match string for the HP Spectre (#9571)
    9a12fd17f5 man: Mention that paths in unit files must be fully normalized.
    76fc2ab4a6 tree-wide: use  instead of #ifdef for HAVE_*
    fcc699c093 network: update log message
    a4f497b2cd Use #if instead of #ifdef for ENABLE_GSHADOW
    121c662eb8 man: add missing option for system.conf
    564341146e core: add missing option and drop nonexistent option in system.conf
    7082a3599f journal: add missing option in journald.conf
    3c15efa9c1 basic: add missing comma in raw_clone assembly for sparc
    4c210b6dce cryptsetup: Add dependency on loopback setup to generated units
    c777fbbe3e journal-gateway: use localStorage["cursor"] only when it has valid value
    c5b1bef639 journal-gateway: explicitly declare local variables
    2361522ca6 analyze: actually select longest activated-time of services
    3e810d92d9 sd-bus: fix implicit downcast of bitfield reported by LGTM
    aef660a4cf resolvconf: fixes for the compatibility interface
    06b3f54f50 install: fix error handling in is_symlink_with_known_name()
    f70ab9a468 portable: fix error handling
    d2c40d4e80 resolve: fix return value type of dns_answer_has_dname_for_cname()
    6f684e0670 resolve: dns_scope_network_good() does not returns negative errno
    15d83e1138 bus-util: fix error handling
    ba0a1f3384 core: free lines after reading them


author: fbui@suse.com
changelog:
  - Import commit 01b4746d3c6f6cbf969fa2176c77ac3f616a7eda
    7af53e005b sd-bus: if we receive an invalid dbus message, ignore and proceeed
    92dcbfdd7f bus: move BUS_DONT_DESTROY calls after asserts
    a83e7b3b43 automount: don't pass non-blocking pipe to kernel.
    726127ea1d units: make sure initrd-cleanup.service terminates before switching to rootfs (bsc#1123333)
    a6347a3cb6 core: Fix use after free case in load_from_path() (bsc#1121563)
    22e2550222 strv: rework FOREACH_STRING() macro (bsc#1121563)
    2ddd38f41a test,systemctl,nspawn: use "const char*" instead of "char*" as iterator for FOREACH_STRING()
    c2c8333e0b strv: add new macro STARTSWITH_SET()
    1db243a601 Update systemd-system.conf.xml (bsc#1122000)


author: fbui@suse.com
changelog:
  - Import commit a1d86af7ed49dacef671e8ec8dae9472a8fa47f5
    92d860fc12 sysctl: Don't pass null directive argument to '%s' (bsc#1121563)
    1379e30d59 Allocate temporary strings to hold dbus paths on the heap (bsc#1125352 CVE-2019-6454)
    b5569a03ae Refuse dbus message paths longer than BUS_PATH_SIZE_MAX limit. (bsc#1125352 CVE-2019-6454)


author: fbui@suse.com
changelog:
  - Upgrade to v241 (commit 15a1b4d58f1d2bc9c21c7cbab6fe63b58e48bda1)
    This includes the following bug fixes:
    - upstream commit c0d76959080e3ba6534bce1c7053c750668e8b55 (bsc#1160595)
    - upstream commit 7334ade4a7e103b1a01d1c8fe1ea7c7a854a1c31 (bsc#1123892)
    - upstream commit c7e93c4d15019323973baf12daa76357c83892c4 (boo#1111498)
    This also includes the following bug fixes released in v240:
    - upstream commit 2675747f3cdd6f1e6236bbb2f79abfa53fb307f1 (boo#1111498)
    - upstream commit 9eb0fc32d6cb63e71f2cfc1e7dd34c3ede4b48a3 (bsc#1140631)
    - upstream commit 1432d2dbdfa90963272a9b581dc4b55dd3ac514f (bsc#1155574)
    - upstream commit 26e35b164b8d0603629b3d394554cfa728e8c3e4 (bsc#1169488)
    - upstream commit a9fc640671ef60ac949f1ace6fa687ff242fc233 (fate#325697)


author: fbui@suse.com
changelog:
  - systemd-mini: explicitly disable some of the systemd components
    For some reasons, some build requirements get pulled in for the mini
    variant now, enabling some parts of the code that were expected to
    be turned OFF.


author: fbui@suse.com
changelog:
  - Include the SUSE version along with the major version of systemd
    $ systemctl --version
    systemd 241 (+suse.42.g15a1b4d58)
    Note that the SUSE version format maybe subject to change and as
    such scripts should not try to parse it.


author: fbui@suse.com
changelog:
  - Stop installing macros.systemd
    There're no points in installing this file if we remove it right
    after.


author: fbui@suse.com
changelog:
  - systemd-coredump: generate a stack trace of all core dumps (bsc#1128832 jsc#SLE-5933)
    This stack trace is logged to the journal.


author: fbui@suse.com
changelog:
  - Import commit 4e6e66ea94cf5125f9044f0869939a86801ed2d8
    430877e794 pam-systemd: use secure_getenv() rather than getenv() (bsc#1132348 CVE-2019-3842)
    3cff2e6514 man: document that if the main process exits after SIGTERM we go directly to SIGKILL
    26c4f7191c bus: fix memleak on invalid message


author: fbui@suse.com
changelog:
  - Drop "BuildRequires:  -post-build-checks" from the specfile (bsc#1130230)
    The syntax of this directive is obsolete and should be replaced by
    "#!BuildIgnore: post-build-checks".
    However there's no good reasons to disable these SUSE extra checks,
    so let's re-enable them and fix the few errors it detected.


author: fbui@suse.com
changelog:
  - Upgrade to v242 (commit 071c380dcc434dca2a0c8b6de0519cc9e816c6d6)
    See https://github.com/openSUSE/systemd/blob/SUSE/v242/NEWS for
    details.
    This includes the following bug fixes:
    - upstream commit bf65b7e0c9fc215897b676ab9a7c9d1c688143ba (CVE-2019-3843)
    - upstream commit bf65b7e0c9fc215897b676ab9a7c9d1c688143ba (CVE-2019-3844)
    - upstream commit 37ed15d7edaf59a1fc7c9e3552cd93a83f3814ef (bsc#1124122)
    - upstream commit bf65b7e0c9fc215897b676ab9a7c9d1c688143ba (bsc#1133506)
    - upstream commit bf65b7e0c9fc215897b676ab9a7c9d1c688143ba (bsc#1133509)
    - upstream commit 1f82f5bb4237ed5f015daf93f818e9db95e764b8 (bsc#1150595)
    - upstream commit e55bdf9b6c5f72475b258a7a4585a0480551cb60 (bsc#1173422)


author: fbui@suse.com
changelog:
  - preset remote-cryptsetup.target during package installation
    This target is supposed to be part of the targets that should be
    enabled (or not depending on the presets) at package installation.


author: fbui@suse.com
changelog:
  - Add a comment explaining why static enablement symlinks in /etc are suppressed
    Also remove any /etc/systemd/system/*.requires/ symlinks for the
    same reason.


author: fbui@suse.com
changelog:
  - Add debug-only-remove-new-policies.patch
    A temporary patch to suppress the new DBUS methods introduced by
    v242 until they are reviewed and whitelisted by the secteam.


author: fbui@suse.com
changelog:
  - Buildrequire polkit so /usr/share/polkit-1/rules.d has an owner (bsc#1145023)
    Otherwise the "post build checks" would complain and would force
    systemd to own this directory. The owner should still be "polkit"
    and the perms should be in sync with the perm set by polkit
    itself.


author: fbui@suse.com
changelog:
  - Import commit 9984a86d0d2259d54c7060f9c09f214202b4efa7
    f2459bf373 random-util: eat up bad RDRAND values seen on AMD CPUs
    c90a2e9793 util-lib: fix a typo in rdrand
    4db1cc9d46 random-util: rename "err" to "success"
    981a62a102 random-util: hash AT_RANDOM getauxval() value before using it
    64a9c3d918 random-util: use gcc's bit_RDRND definition if it exists
    c5d6ecfdca random-util: rename RANDOM_DONT_DRAIN ? RANDOM_MAY_FAIL
    298d13df7e network: remove redunant link name in message
    77cbde31f2 hwdb: Align airplane mode toggle key mapping for all Acer series
    460f03794e Revert "hwdb: Apply Acer mappings to all Gateway and Packard Bell models"
    fe9271ad84 test: return a non-zero return code when 'nobody' user doesn't exist
    29d355e755 fstab-generator: Prevent double free of reused FILE*
    f30f1adc11 meson: make source files including nspawn-settings.h depend on libseccomp
    84bab914b8 alloc-util: don't use malloc_usable_size() to determine allocated size
    5240972d8d units: drop reference to sushell man page
    0a26de5e33 codespell: fix spelling errors
    582de105c8 nspawn-expose-ports: fix a typo in error message


author: fbui@suse.com
changelog:
  - Drop debug-only-remove-new-policies.patch
    The new DBUS methods have been reviewed by the security team.


author: fbui@suse.com
changelog:
  - Add 0001-Revert-insserv.conf-generator.patch (bsc#1052837)
    All remaining packages have been fixed so they don't rely on the
    insser-generator to generate proper deps. So let's drop it as all
    services should carry the proper dependencies itself.


author: fbui@suse.com
changelog:
  - Add 0001-rc-local-generator-deprecate-halt.local-support.patch
    /etc/init.d/halt.local support will removed from the next systemd
    version (v243) so for now on warn (hopefully the few) users who rely
    on this script so they have a chance to switch to systemd-shutdown
    interface.


author: fbui@suse.com
changelog:
  - Import commit eaa7b8b148927d471609de75e542dffcc1b36df4
    7e58b89136 udevd: change the default value of udev.children-max (again) (bsc#1107617)


author: fbui@suse.com
changelog:
  - State directory of systemd-timesync might become inaccessible after upgrading to v240+ (bsc#1137341)
    This happens for users who had previously used systemd-timesync with
    DynamicUser=true, ie the ones who upgraded from a systemd version
    between v235 and v239 to systemd v240 and later (v240 was the
    version where DynamicUser was switched back to OFF).


author: fbui@suse.com
changelog:
  - Import commit 0f9271c1336c5c9055e75389732a44745d796851 (changes from v242-stable)
    07f0549ffe network: do not send ipv6 token to kernel
    9d34e79ae8 systemd-mount: don't check for non-normalized WHAT for network FS
    5af677680c core: set fs.file-max sysctl to LONG_MAX rather than ULONG_MAX (bsc#1142099)
    29dda7597a random-util: eat up bad RDRAND values seen on AMD CPUs
    eb6c17c178 util-lib: fix a typo in rdrand
    829c20dc8e random-util: rename "err" to "success"
    5442366fbf man: rework the description of Aliases and .wants/.requires directories
    ae71c6f634 docs: typo in arg name replace-irreversible -> replace-irreversibly
    09774a5fcb meson: make nologin path build time configurable
    69ffeeb0b1 man: add note about systemctl stop return value
    4cf14b5513 shared/conf-parser: say "key name" not "lvalue", add dot
    4481ca7f86 shared/conf-parser: emit a nicer warning for something like "======"
    46f3db894b shared/conf-parser: be nice and ignore lines without "="
    7d928995f7 nspawn: fix memleak in argument parsing
    7727e6c0ae resolve: fix memleak
    7f32a81976 journal: properly read unaligned le64 integers
    fa419099e5 activate: move array allocation to heap
    815a9fef2a systemctl: print non-elapsing timers as "n/a" not "(null)"
    a4fc3c88f1 factory: include pam_keyinit.so in PAM factory configuration
    a453d63315 factory: add comment to PAM file, explaining that the defaults are not useful
    d9a5a70a59 factory: tighten PAM configuration
    5e2d3bf80b test: make sure colors don't confuse our test
    5fe3be1334 wait-online: change log level
    c49b6959d5 systemctl: emit warning when we get an invalid process entry from pid1 and continue
    3c9f43eb03 systemctl: do not suggest passing --all if the user passed --state=
    5964d1474e man: offline-updates: make dependence on system-update.target explicit
    a04dd26e03 alloc-util: drop _alloc_ decorator from memdup_suffix0()
    7c46a694ca man: add example for setting multiple properties at once
    1d72789271 man: CPUShares= is so 2015
    45da304673 man: document that WakeSystem= requires privs
    bed58a06e4 man: document that "systemd-analyze blame/critical-chain" is not useful to track down job latency
    c5461f31b3 man: be more explicit that Type=oneshot services are not "active" after starting
    455ee07abe man: document that the supplementary groups list is initialized from User='s database entry
    5f0cb2616a alloc-util: drop _alloc_(2, 3) decorator from memdup_suffix0_multiply()
    7bc336794d generator: downgrade Requires= ? Wants= of fsck from /usr mount unit
    66465c4381 systemctl: allow "cat" on units with bad settings
    ca937b49da pid1: fix serialization/deserialization of commmands with spaces
    4bb3113023 growfs: call crypt_set_debug_level() correctly, skip if not needed
    0db716771e cryptsetup: enable libcryptsetup debug logging if we want it
    c8b9b3956f cryptsetup: set libcryptsetup global log callback too
    679b3f6b7f basic/log: fix SYSTEMD_LOG_* parsing error messages
    8d6b5158aa units: add SystemCallErrorNumber=EPERM to systemd-portabled.service
    6681fcd445 network: fix the initial value of the counter for brvlan
    853ec5f458 man: Add some notes about variable $prefix for StateDirectory=
    e6d23358e9 sd-netlink: fix inverted log message
    6feb862407 blockdev: filter out invalid block devices early
    9f7c0dbc75 blockdev-util: propagate actual error
    3f5355bcb9 man: document tmpfiles.d/ user/group resolvability needs
    c15b92cd98 man: fix wrong udev property name
    9768a900d6 meson: drop duplicated source
    15194f22ed cryptsetup-generator: fix luks-* entry parsing from crypttab
    c2475390b4 core: skip whitespace after "|" and "!" in the condition parser
    fdc754aeb7 shared/condition: fix printing of ConditionNull=
    572385e135 test: add testcase for issue #12883
    9aa1edddb0 conf-parser: fix continuation handling
    8fbc72f45f networkd: fix link_up() (#12505)


author: fbui@suse.com
changelog:
  - Upgrade to v243 (commit e0b24c4356aa0c1c56ff274ff72228f33482a5be)
    See https://github.com/openSUSE/systemd/blob/SUSE/v243/NEWS for
    details.
    This includes the following bug fixes:
    - upstream commit b2774a3ae692113e1f47a336a6c09bac9cfb49ad (CVE-2019-20386 bsc#1161436)
    - upstream commit 5406c36844b35504a64e9f05fc74b8e5e5a09143 (bsc#1132400)
    - upstream commit 83a32ea7b03d6707b8e5bb90a0b3a6eb868ef633 (bsc#1132721)
    - upstream commit 7cc5ef5f1811c539ae7f20255c2a093f413cc64f (bsc#1172824 bsc#1142733)
    - upstream commit 83cb24ac20baf19f7834931dcf6e03486b4c9c30 (bsc#1156213)
    - upstream commit a2dcb1d78737d3daa301ee63fbdd02837acb71a8 (bsc#1158485)
    - upstream commit 08185cff19efcb1d7d9fb7b546e7f516ab6dae91 (bsc#1165011)
    - upstream commit 59c55e73eaee345e1ee67c23eace8895ed499693 (bsc#1177510)
    Drop 0001-Revert-insserv.conf-generator.patch as it's been dropped
    from branch SUSE/v243 while we were rebasing.
    Drop 0001-rc-local-generator-deprecate-halt.local-support.patch as
    this functionality had been deprecated during the previous release
    and now have been dropped by upstream.


author: fbui@suse.com
changelog:
  - Track 0001-resolved-create-etc-resolv.conf-symlink-at-runtime.patch
    in the git repo
    This patch has been in the quarantine area long enough, so let's
    move it in the git repo.


author: fbui@suse.com
changelog:
  - Import commit 9e41d7ec3572d8d5ea1e00f683e9fbf8108e85b4
    fb1b9d54f9 tty-ask-pwd-agent: fix message forwarded to wall(1)
    dd14da3bb6 core: restore initialization of u->source_mtime
    d62f30f647 resolved: create /etc/resolv.conf symlink at runtime


author: lnussel@suse.de
changelog:
  - split off networkd and resolved into separate network subpackage
  - use separate lang package for translations


author: fbui@suse.com
changelog:
  - Import commit ed81f69153488279957268e247a5c81b678da491 (changes from v243-stable)
    fab6f010ac dhcp6: use unaligned_read_be32()
    f2d9af4322 dhcp6: add missing option length check
    ccf797511e ndisc: make first solicit delayed randomly
    f2275b6e12 dhcp6: read OPTION_INFORMATION_REFRESH_TIME option
    6dfbe58ee7 l10n: update Czech Translation
    d4cd0e9d32 sd-radv: if lifetime < SD_RADV_DEFAULT_MAX_TIMEOUT_USEC, adjust timeout (#13491)
    dbefe59259 polkit: fix typo
    a321507476 sd-netlink: fix invalid assertion
    45dca7fe86 network: do not enter failed state if device's sysfs entry does not exist yet
    dd83d58796 network: add missing link->network checks
    b294305888 path: stop watching path specs once we triggered the target unit
    2cd636c437 hwdb: add Medion Akoya E2292 (#13498)
    d133bdd1fa po: update Brazilian Portuguese translation
    530e09b594 po: update Polish translation
    0c5c3e34c1 polkit: change "revert settings" to "reset settings"
    73e0f372d8 man: fix description of ARPIntervalSec= units
    5412cc54a1 hwdb: axis override for Dell 9360 touchpad
    9d4e658529 test: drop the missed || exit 1 expression
    7ed7ea82f6 udevadm: use usec_add()
    477bf86c91 udevadm: missing initialization of descriptor
    19ac31c989 networkd: unbreak routing_policy_rule_compare_func()
    a20a2157a8 core: coldplug possible nop_job
    eb55241742 tty-ask-pwd-agent: fix message forwarded to wall(1)
    1a3c53c06c core: Fix setting StatusUnitFormat from config files
    91db81e4dd network DHCP4: Dont mislead the logs.
    6af590838b Update m4 for selective utmp support.	modified:   tmpfiles.d/systemd.conf.m4
    6823c907cf core: restore initialization of u->source_mtime
    29308bcc13 mount-setup: relabel items mentioned directly in relabel-extra.d
    8ca1e56165 Call getgroups() to know size of supplementary groups array to allocate
    5d84a7ad1c test: add test cases for empty string match
    1536348cc8 udev: fix multi match
    3ccafef0ad man: move TimeoutCleanSec= entry from .service to .exec
    8c0c30a820 zsh: udpate bootctl completions
    0556c247a2 resolved: fix abort when recv() returns 0
    9a25d75520 man: remove repeated words
    be3be29347 hwdb: Also mark lis3lv02d sensors in "HP" laptops as being in the base
    4b92ffccaa udev: also logs file permission
    75a2845e5a udev: add missing flag for OPTIONS=static_node
    19e9fc4262 network: do not abort execution when a config file cannot be loaded
    3e1267cf50 fileio: update warning message
    1b3156edd2 pstore: fix use after free
    f500d2fa81 journal: Make the output of --update-catalog deterministic
    64d0f7042d travis: protect the systemd organization on Fuzzit from forks
    4247938ee1 hwdb: Mark lis3lv02d sensors in HP laptops as being in the base
    379158684a po: update Japanese translation
    31e1bbd1ca docs: fix push recipe in RELEASE.md
    f06530d86b man/systemctl.xml: fix missing "not"
    22aba2b969 docs: fix typo in boot loader doc
    000e08ca70 pstore: fix typo in error message - directoy -> directory
    f7f9c69ac5 Fix typo in comment: overide -> override
    ca8ba8f8c0 po: update Polish translation


author: fbui@suse.com
changelog:
  - Import commit 428b937f917ae177f2315e8469800941885e441a
    0026b58744 pid1: fix DefaultTasksMax initialization


author: fbui@suse.com
changelog:
  - Add 0001-compat-rules-escape-when-used-for-shell-expansion.patch (bsc#1153648)
    Added to the quaratine area to avoid uploading a new tar ball just
    for that single change. It will be dropped during the next import.


author: stefan.bruens@rwth-aachen.de
changelog:
  - Remove intltool BuildRequires, not needed since v237
  - Use python3-base BuildRequires instead of full python3


author: fbui@suse.com
changelog:
  - Import commit 5df9000899ef7d45ddbcacd0fdf73afa07a40f6b
    f0ed7237e4 udev/cdrom_id: Do not open CD-rom in exclusive mode. (bsc#1154256)
    b37054aa5a compat-rules: escape '$' when used for shell expansion
    Changes from the v243-stable:
    ef677436aa test: Pass personality test even when i686 userland runs on x86_64 kernel
    3f6398c450 docs: fix inadvertent change in uid range
    25bb377a73 cgroup: fix typo in BPF firewall support warning message
    6d97aca0d5 fix build with compilers with default stack-protector enabled
    fbad077cec nspawn: surrender controlling terminal to PID2 when using the PID1 stub
    0553c3c668 pid1: fix DefaultTasksMax initialization
    f406a691a7 src/core/automount: use DirectoryMode when calling mkdir -p
    20438f96c3 udevadm trigger: do not propagate EACCES and ENODEV
    6480630bc3 hwdb: Correct WWWW Pattern In Documentation Comment
    9d8e889810 nspawn: consistenly fail if parsing the environment fails
    40e169b304 nspawn: default to unified hierarchy if --as-pid2 is used
    b5df1037a0 cgroup: Mark memory protections as explicitly set in transient units
    f14e3e02cc cgroup: Respect DefaultMemoryMin when setting memory.min
    ea248e53bf cgroup: Check ancestor memory min for unified memory config
    de1d25a506 cgroup: docs: memory.high doc fixups
    2ab45f38d8 cgroup: docs: Mention unbounded protection for memory.{low,min}
    19a43dc38a Consider smb3 as remote filesystem
    5c0224c7bf Handle d_type == DT_UNKNOWN correctly
    8282bc61df util-lib: Don't propagate EACCES from find_binary PATH lookup to caller
    9d0ae987a6 network: drop noisy log message
    f67f0e4ec4 Updated log message when the timesync happens for the first time (#13624)
    e151bf4674 units: make systemd-binfmt.service easier to work with no autofs
    2b8e574d82 Corect man page reference in systemd-nologin.conf comments
    a0577353f1 man: Add a missing space in machinectl(1)
    693e983988 log: Add missing "%" in "%m" log format strings
    ea7151b8c4 pid1: do not warn if /run/systemd/relabel-extra.d/ doesn't exist
    b90549290e man: fix typo


author: fbui@suse.com
changelog:
  - Import commit b7467b7b553d6d0d6f92758d966b69f1a88b6b42
    441f44f371 fileio: introduce read_full_virtual_file() for reading virtual files in sysfs, procfs (bsc#1133495)
    8a1bb5c66b swap: do not make swap units wanted by its device unit anymore


author: fbui@suse.com
changelog:
  - Drop 0001-compat-rules-escape-when-used-for-shell-expansion.patch
    It's part of the previous import.


author: fbui@suse.com
changelog:
  - Import commit 0b715187a87907e18edf98eab9d0a50fced4a424
    9dbdbc2f10 logind: fix (again) the race that might happen when logind restores VT (bsc#1101591 bsc#1140081)
    c848bec110 libblkid: open device in nonblock mode. (bsc#1084671)
    b70ad6c927 resolved: check for IP in certificate when using DoT with GnuTLS (bsc#1155539 CVE-2018-21029)
    bbedf3d557 resolved: require at least version 3.6.0 of GnuTLS for DNS-over-TLS
    eb732c2e29 resolved: fix connection failures with TLS 1.3 and GnuTLS
    4e45084ac5 shared/install: failing with -ELOOP can be due to the use of an alias in install_error()
    2e297f0d87 shared/install: fix error codes returned by install_context_apply()
    dd29d70d32 man: alias names can't be used with enable command


author: fbui@suse.com
changelog:
  - Import commit dbb1d4734daffa62e0eddecfa4f784c84a9d8e76
    1439d72a72 udevd: don't use monitor after manager_exit()
    99288dd778 Revert "udevd: fix crash when workers time out after exit is signal caught"
    152577d6d0 udevd: fix crash when workers time out after exit is signal caught
    f854991504 udevd: wait for workers to finish when exiting (bsc#1106383)
    Changes from the v243-stable (84 commits):
    e51d9bf9e5 man: add entry about SpeedMeter=
    aa1fc791c7 udev: silence warning about PROGRAM+= or IMPORT+= rules
    b9a619bb67 udevadm: ignore EROFS and return earlier
    1ec5b9f80c basic: add vmware hypervisor detection from device-tree
    7fa7080248 umount: be happy if /proc/swaps doesn't exist
    [...]
    47d0e23d26 udev: fix memleak caused by wrong cleanup function
    a6fb0542c5 parse_hwdb: fix compatibility with pyparsing 2.4.*
    cb1d892f17 parse_hwdb: process files in order


author: fbui@suse.com
changelog:
  - Upgrade to v244 (commit 090da85161ceb1ba0b4c208963c7156a8fdf10c6)
    See https://github.com/openSUSE/systemd/blob/SUSE/v244/NEWS for
    details.
    This includes the following bug fixes:
    - upstream commit b49e14d5f3081dfcd363d8199a14c0924ae9152f (bsc#1139459)
    - upstream commit 22683674716fd0e5b016ce5a7d8fd90df5f9f9e7 (bsc#1151377)
    - upstream commit faf205de3ba9a11b0ba17682123d7f3fedc7da24 (bsc#1151377)
    - upstream commit 27c3112dcbd1b5f171c36c32550d9c6331375b0b (bsc#1155574)
    - upstream commit 21b40f16622f171a9969dc334d74fb5eb2f575c2 (bsc#1159814)
    - upstream commit 9b88bb5023dfa3cea406c14fdaa3d8e3e320907a (jsc#SLE-7689)
    - upstream commit bc9ecd484f1ebfe0de8b567c90f6cd867fbd5894 (bsc#1141597)
    Legacy and obsolete symlinks have been finally dropped.
    Dropped 0001-logind-keep-backward-compatibility-with-UserTasksMax.patch.
    Users were notified about the deprecation of UserTasksMax option and
    how to move to the new mechanism. The dropin replacement for
    UserTasksMax is therefore no more generated but its use still
    produces a warning.
    Added 0001-SUSE-policy-do-not-clean-tmp-by-default.patch and
    0001-Fix-run-lock-group-to-follow-openSUSE-policy.patch.
    These patches were extracted from the git repo because it's not
    clear where the SUSE tmpfiles specificities should be located.


author: fbui@suse.com
changelog:
  - Import commit d8f6a204858bff68b8e0e7be86b418c36087ab2e
    6c5e492a65 cryptsetup: umount encrypted devices before detaching it during shutdown


author: fbui@suse.com
changelog:
  - Manually set system-uid-max and system-gid-max to 499
    It used to be detected automatically by meson but it's been broken
    by the migration of login.defs from /etc to /usr/etc.


author: fbui@suse.com
changelog:
  - Import commit 8254b8d9646f3e0f5f8057d1ffb5d6c20f079aaa (merge v244.1)
    639dc9f4bf network: set ipv6 mtu after link-up or device mtu change
    cbced49daa man: fix typo in net-naming-scheme man page
    7dd04c99b0 network: tc: drop unused element
    bf4b7d07ba man: fix typos (#14304)
    1ba2e7a730 ipv4ll: do not reset conflict counter on restart
    49806bb310 macro: avoid subtraction overflow in ALIGN_POWER2()
    c4c1600689 test-network: add a test case for SendOption=
    6f15b45949 network: fix segfault in parsing SendOption=
    2e531b830d seccomp: real syscall numbers are >= 0
    f7616ed52b network: fix copy and paste mistake
    e8b53300c4 network: do not drop foreign config if interface is in initialized state
    00f05813bf seccomp: mmap test results depend on kernel/libseccomp/glibc
    4de1909e61 seccomp: use per arch shmat_syscall
    d83010521d seccomp: ensure rules are loaded in seccomp_memory_deny_write_execute
    2c6568221a seccomp: fix multiplexed system calls
    bcf0aa02bf Fix typo (duplicate "or")
    96d7083c54 network: if /sys is rw, then udev should be around
    e874419902 nspawn: do not fail if udev is not running
    29c9144655 Create parent directories when creating systemd-private subdirs
    9cbb8b5254 network: do not return error but return UINT64_MAX if speed meter is disabled
    c08429ae33 core: swap priority can be negative
    f25c0be335 networkctl: fix to show BSSID
    65fd2fce59 systemctl: enhance message about kexec missing kernel
    bdd0af5f81 Fixup typo in NEWS


author: fbui@suse.com
changelog:
  - Temporarily restore /sbin/{udevd,udevadm) obsolete symlinks
    They're restored until YaST stop using them (see boo#1160890)


author: fbui@suse.com
changelog:
  - Import commit f8adabc2b1f3e3ad150e7a3bfa88341eda5a8a57 (merge v244.2)
    77c04ce5c2 hwdb: update to v245-rc1
    b4eb884824 Fix typo in function name
    e2d4cb9843 polkit: when authorizing via PK let's re-resolve callback/userdata instead of caching it
    83bfc0d8dd sd-bus: introduce API for re-enqueuing incoming messages
    5926f9f172 polkit: use structured initialization
    0697d0d972 polkit: on async pk requests, re-validate action/details
    2589995acd polkit: reuse some common bus message appending code
    5b2442d5c3 bus-polkit: rename return error parameter to ret_error
    0a19ff7004 shared: split out polkit stuff from bus-util.c ? bus-polkit.c
    1325dfb577 test: adapt to the new capsh format
    3538fafb47 meson: update efi path detection to gnu-efi-3.0.11
    3034855a5b presets: "disable" all passive targets by default
    c2e3046819 shared/sysctl-util: normalize repeated slashes or dots to a single value
    6f4364046f dhcp6: do not use T1 and T2 longer than one provided by the lease
    0ed6cda28d network: fix implicit type conversion warning by GCC-10
    f6a5c02d26 bootspec: parse random-seed-mode line in loader.conf
    ddc5dca8a7 sd-boot: fix typo
    2bbbe9ae41 test: Synchronize journal before reading from it
    072485d661 sd-bus: fix introspection bug in signal parameter names
    80af3cf5e3 efi: fix build.
    [...]


author: lnussel@suse.de
changelog:
  - move html documentation to sparate package to save space
  - move networkd and resolved binaries into correct subpackage


author: fbui@suse.com
changelog:
  - Upgrade to v245 (commit 74e2e834b4282c9bbdc12014f6ccf8d86e542b8d)
    See https://github.com/openSUSE/systemd/blob/SUSE/v245/NEWS for
    details.
    This includes the following bug fixes:
    - upstream commit 7f56982289275ce84e20f0554475864953e6aaab (CVE-2020-1712)
    - upstream commit 66a19d85a533b15ed32f4066ec880b5a8c06babd (bsc#1157315)
    - upstream commit 7f56982289275ce84e20f0554475864953e6aaab (bsc#1162108)
    The new tools provided by systemd repart, userdb, homed, fdisk,
    pwquality, p11kit feature have been disabled for now as they require
    reviews first.
    Default to the "unified" cgroup hierarchy. Indeed most prominent
    users of cgroup (such as libvirt, kubic) should be ready for such
    change. It's still possible to switch back to the old "hybrid"
    hierarchy by passing "systemd.unified_cgroup_hierarchy=0" option to
    the kernel command line though.
    Added 0001-Revert-job-Don-t-mark-as-redundant-if-deps-are-relev.patch:
    upstream commit 097537f07a2fab3cb73aef7bc59f2a66aa93f533 has been
    reverted for now on as it introduced a behavior change which has
    impacted plymouth at least.


author: fbui@suse.com
changelog:
  - Import commit 31f82b39c811b4f731c80c2c2e7c56a0ca924a5b (merge v245.2)
    d1d3f2aa15 docs: Add syntax for templated units to systemd.preset man page
    3c69813c69 man: add a tiny bit of markup
    bf595e788c home: fix segfault when parsing arguments in PAM module
    e110f4dacb test: wait a bit after starting the test service
    e8df08cfdb fix journalctl regression (#15099)
    eb3a38cc23 NEWS: add late note about job trimming issue
    405f0fcfdd systemctl: hide the 'glyph' column when --no-legend is requested
    1c7de81f89 format-table: allow hiding a specific column
    b7f2308bda core: transition to FINAL_SIGTERM state after ExecStopPost=
    2867dfbf70 journalctl: show duplicate entries if they are from the same file (#14898)
    [...]


author: fbui@suse.com
changelog:
  - Switch back to the hybrid hierarchy
    Unfortunately Kubernetes and runc are not yet ready for
    cgroupsv2. Let's reconsider the unified hierarchy in a couple of
    months.


author: fbui@suse.com
changelog:
  - Drop 0001-meson-fix-build-of-udev-path_id_compat-builtin-with-.patch
    It's been merged in 'openSUSE-Factory' branch otherwise this branch
    won't build anymore since meson has been upgraded to version 0.54 in
    Factory.


author: fbui@suse.com
changelog:
  - Import commit 08cd65ac385c884ed6e4bd71128a0796f56ecd17 (include merge of v245.5)
    1ceedf8535 meson: fix build of udev 'path_id_compat' builtin with meson 0.54
    e61569d4a9 pid1: by default make user units inherit their umask from the user manager (bsc#1162698)
    64fdacd5f1 user-util: rework how we validate user names (bsc#1170272)
    [...]
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/c5aa158173ced05201182d1cc18632a25cf43b94...08cd65ac385c884ed6e4bd71128a0796f56ecd17


author: fbui@suse.com
changelog:
  - Drop %tmpfiles_create portables.conf from %post of networkd sub-package
    It was probably mistakenly added because systemd-portable served as
    template for systemd-network.


author: fbui@suse.com
changelog:
  - Drop most of the tmpfiles that deal with generic paths (bsc#1078466 bsc#1181831)
    They are problematic because some of them conflict with SUSE
    defaults. Therefore it seems better to let the revelant packages
    owning these paths to provide their own definitions instead.
    Meanwhile we still keep the homeless definitions in suse.conf until
    a better place is found for them.
    Drop 0001-Fix-run-lock-group-to-follow-openSUSE-policy.patch
    Drop 0001-SUSE-policy-do-not-clean-tmp-by-default.patch


author: fbui@suse.com
changelog:
  - Drop content of /usr/share/factory/ (bsc#1170146)
    systemd ships several files in /usr/share/factory/etc that are
    copied to /etc in case those files are missing there. Unfortunately
    the content does not match the openSUSE defaults.


author: fbui@suse.com
changelog:
  - Drop legacy /sbin/{udevd,udevadm) symlinks hopefully for good
    Since boo#1160890 has been fixed since a couple of months now.


author: fbui@suse.com
changelog:
  - Disable bump of /proc/sys/fs/nr-open
    Hopefully a _temporary_ workaround until bsc#1165351 is fixed
    otherwise user instances crashes the system is using NIS (and the
    nscd cache is empty).


author: fbui@suse.com
changelog:
  - Import commit a6d31d1a02c2718a064bbbc40d003668acf72769
    bb6e2f7906 pid1: update manager settings on reload too (bsc#1163109)
    e9e8907b06 watchdog: reduce watchdog pings in timeout interval
    385a8f9846 udev: rename the persistent link for ATA devices (bsc#1164538)
    66018a12ae tmpfiles: remove unnecessary assert (bsc#1171145)


author: matthias.gerstner@suse.com
changelog:
  - no longer explicitly package setgid directory /var/log/journal (bsc#1172550).
    The bit will be set during %post by way of the systemd-tmpfiles invocation.
    This avoids a conflict with the permissions package and an rpmlint error
    popping up.


author: fbui@suse.com
changelog:
  - Import commit b12cd8b89b4bccfcf972b47153a2b01cd7775932 (include merge of v245.6)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/a6d31d1a02c2718a064bbbc40d003668acf72769...b12cd8b89b4bccfcf972b47153a2b01cd7775932


author: fbui@suse.com
changelog:
  - Don't restart udevd sockets during package update
    Otherwise we might miss kernel events as the daemon need to be
    stopped as well.


author: fbui@suse.com
changelog:
  - Include in the package version the stable minor (if any).
    Also update the version shown by various command such as 'systemctl
    - -version' to show the stable number.


author: fbui@suse.com
changelog:
  - Fix inconsistent file modes for some ghost files (bsc#1173227)
    Ghost files are assumed by rpm to have mode 000 by default which is
    not consistent with file permissions set at runtime.
    Also /var/lib/systemd/random-seed was tracked wrongly as a
    directory.
    Also don't track (ghost) /etc/systemd/system/runlevel*.target
    aliases since we're not supposed to track units or aliases user
    might define/override.


author: fbui@suse.com
changelog:
  - migrate-sysconfig-i18n.sh: fix marker handling  (bsc#1173229)
    The marker is used to make sure the script is run only once. Instead
    of storing it in /usr, use /var which is more appropriate for such
    file.
    Also make it owned by systemd package.


author: fbui@suse.com
changelog:
  - Import commit 6d6d92930acad63f9b9029c305a672c32c550d2d (include merge of v245.7)
    797ad47d3e vconsole-setup: downgrade log message when setting font fails on dummy console (bsc#1172195 bsc#1173539)
    [...]
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/b12cd8b89b4bccfcf972b47153a2b01cd7775932...6d6d92930acad63f9b9029c305a672c32c550d2d
  - Drop 0001-Revert-job-Don-t-mark-as-redundant-if-deps-are-relev.patch
    Upstream finally reverted it and it's part of both v245.7 and master.


author: fbui@suse.com
changelog:
  - Drop requirement on 'sysvinit-tools'
    It was used to workaround bug #886599 by explicitly calling
    vhangup(8) from getty@.service so when this service was stopped a
    virtually hangup on the specified terminal when were stopped to give
    the shell a few seconds to save its history.
    But this workaround was dropped since it had no effect (SLE12-GM was
    released with it but was still suffering from the bug) and was
    replaced by commit e9db43d5910717a108, which was released from v226
    and backported to SLE12/SLE12-SP1.


author: fbui@suse.com
changelog:
  - Import commit a4e393eecb9dbe140a6c7d57419c291d786155cf
    d8e3bd4e22 Revert "core: don't send SIGKILL to user@.service immediatly during shutdown"


author: fbui@suse.com
changelog:
  - Upgrade to v246.4 (commit f1344d5b7f31e98aedb01e606f41d74d3caaf446)
    See https://github.com/openSUSE/systemd/blob/SUSE/v246/NEWS for
    details.
    Now that the number of SUSE specific patches has been shrinked and
    is pretty low (12 at the time of this writing), they are no more
    tracked by the git repo and are now handled at the package
    level. Hence It is easier to maintain and identify them. This
    effectively means that SUSE/v246 will contain upstream commits only.
    Added 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch
    Added 0002-rc-local-fix-ordering-startup-for-etc-init.d-boot.lo.patch
    Added 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch
    Added 0004-tmpfiles-support-exclude-statements-based-on-file-ow.patch
    Added 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch
    Added 0006-sysv-generator-add-back-support-for-SysV-scripts-for.patch
    Added 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch
    Added 0008-sysv-generator-translate-Required-Start-into-a-Wants.patch
    Added 0009-pid1-handle-console-specificities-weirdness-for-s390.patch
    Added 0010-journald-disable-audit-support-completely-from-the-j.patch
    Added 0011-core-disable-session-keyring-per-system-sevice-entir.patch
    Added 0012-resolved-create-etc-resolv.conf-symlink-at-runtime.patch


author: fbui@suse.com
changelog:
  - Enable audit support (bsc#1175883)
    Enabling audit support in systemd will only make PID1 (and some of
    its services) to generate some audit records for certain events. But
    it doesn't affect journald, which has been prevented from recording
    audit messages in the journal (SUSE specific behavior).


author: fbui@suse.com
changelog:
  - Rework how we prevent journald from both enabling auditd and
    recording audit messages
    journald.conf gained a new setting Audit= to control whether
    journald enables audit during the boot process. So let's use it and
    make sure it's disabled by default by shipping a drop-in that
    overrides upstream default.
    Also we used to patch systemd to prevent journald from reading the
    audit messages. There's still no way for downstream to configure
    that properly (we would need to mask systemd-journald-audit.socket
    meaning shipping a symlink in /etc) but I think dropping
    systemd-journald-audit.socket from the package is a nicer way to do
    that as some users might choose to reenable this setting (by
    reintroducing the socket unit in /etc).


author: fbui@suse.com
changelog:
  - Add 0001-udev-temporarly-restore-the-creation-a-few-symlinks-.patch
    A temporary patch until the installer environment is updated to
    create some of the symlinks that udevd used to create during its
    startup but now udevd relies on the init system to do so.


author: fbui@suse.com
changelog:
  - Drop 0001-udev-temporarly-restore-the-creation-a-few-symlinks-.patch
    linuxrc has already been fixed.


author: fbui@suse.com
changelog:
  - Import commit 1cab0d44584687ace92d1df30eadf264231e3b65 (include v246.5)
    304ec2c7ab fstab-generator: add 'nofail' when  NFS 'bg' option is used (bsc#1176513)
    6ae277fb37 test: adapt TEST-21-SYSUSERS for SUSE
    acd8bfd2cc test: adapt TEST-13-NSPAWN-SMOKE for SUSE
    [...]
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/a4e393eecb9dbe140a6c7d57419c291d786155cf...1cab0d44584687ace92d1df30eadf264231e3b65


author: fbui@suse.com
changelog:
  - Remove dangling symlink
    /usr/lib/systemd/system/sockets.target.wants/systemd-journald-audit.socket
    Otherwise the build system complains.


author: fbui@suse.com
changelog:
  - Ship {/usr/lib,/etc}/systemd/network directories in the main package
    These directories can be used by both udevd and networkd.


author: fbui@suse.com
changelog:
  - Import commit d7b5ac76dc95ddf30e707d26998e36303e9f52a7 (merge of v246.6)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/1cab0d44584687ace92d1df30eadf264231e3b65...d7b5ac76dc95ddf30e707d26998e36303e9f52a7


author: fbui@suse.com
changelog:
  - Rely on systemd-default-settings for overriding system default settings (bsc#1172517)
    The new branding packages now ships the drop-ins to customize
    systemd either for an openSUSE or a SLE ditro.


author: fbui@suse.com
changelog:
  - Do not include %{release} in a few places where we explicitly mention package versions
    It's usually not a good idea especially when used with conflicts.


author: fbui@suse.com
changelog:
  - Explicitly list files in /usr/lib/sysusers.d shipped by the main package
    Currently only one config file is shipped in this directory and we
    want to check any new files that may be added in the future.


author: fbui@suse.com
changelog:
  - No more need to clean the journal-upload stuff with --without=journal_remote
    Since -Dremote build option has been introduced with meson, this
    workaround is no more needed.


author: fbui@suse.com
changelog:
  - Simplify systemd-sysv-convert
    - the previous code incorrectly assumed that the sysv init scripts
      were uninstalled before %post get executed. It therefore save the
      enablement state in %pre and restore it in %post. Now all is done
      in %post (making --save option useless) and there's no more need
      to remember the enablement state.
    - "--save" option is a NOP but is still kept for backward
      compatibility.
    - the previous simplifcation made /var/lib/systemd/migrated no more
      used.
    - we do not search for units in /lib/systemd anymore, this shouldn't
      be needed anymore these days especially since this path was only
      used when systemd was introduced in openSUSE and it was never used
      in SLE (checked SLE12-GA).
    - the option --show has been dropped. It's never been used even
      internally.
    - the DB is populated only once even if the script was enabled at
      multiple runlevels. The runlevel info was never used. A dummy
      value is still added to keep the same format just in case.


author: fbui@suse.com
changelog:
  - Import commit fdce77ce2067f9dd90d816bad28b51efed0b6dc1
    05fff5bd02 generator: use kmsg in system-level generators, journal otherwise
    ecc07954de log: normalize log target condition check
    d32ceea42b log: update comment
    2ebad02b60 basic/virt: Detect PowerVM hypervisor (bsc#1176800)


author: fbui@suse.com
changelog:
  - Revert the change that dropped %{release} from the package version
    constraints used in Requires:
    The release number is actually relevant since it can be increased
    when some patches, which might touch multiple sub-packages of
    systemd, are added/modified.
    However the %{release} is still no more used in conflicts.


author: fbui@suse.com
changelog:
  - Import commit 49caf8e37aba04841e5493ccc25e7edab462d95b
    f8f7286527 units: restore sysfs conditions in sys-fs-fuse-connections.mount and sys-kernel-config.mount
    e9c7158dc7 units: wait until some fs modules are entirely loaded before mounting their corresponding filesystem (bsc#1178631)
    ac7ddc4201 Revert "units: skip modprobe@.service if the unit appears to be already loaded"
    17310a1d19 core: serialize u->pids until the processes have been moved to the scope cgroup (bsc#1174436)
    1416965614 meson: add option to skip installing to $sysconfdir
    f71a1ef5d0 systemctl: give a nice hint about org.freedesktop.LogControl1 when applicable
    20a3f9fd95 systemctl: immediately reject invalid log levels
    9f67d2e57b systemctl: merge log_target(), log_level(), service_log_setting()
    ddf7cf4872 systemctl: add service-log-{level,target} verbs
    026d7d156d systemctl: list unit introspection verbs first, modification second


author: fbui@suse.com
changelog:
  - Don't post-require systemd-default-settings-branding anymore
    This is actually not needed now that the branding package issues a
    PID1 reloading every times it's being updated.


author: fbui@suse.com
changelog:
  - Import commit f6104ea5f554233e34b94ffd92da8332c3bd7d8f
    617aed9236 scope: on unified, make sure to unwatch all PIDs once they've been moved to the cgroup scope


author: fbui@suse.com
changelog:
  - Import commit d5e7958d35dc7758fe2e87e0a8193b93ce1a1b15 (merge of v246.7)
    450792497e sd-event: fix delays assert brain-o (#17790)
    1040a19d08 udevadm: rename option '--log-priority' into '--log-level'
    a7b41e19bd udev: rename kernel option 'log_priority' into 'log_level'
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/f6104ea5f554233e34b94ffd92da8332c3bd7d8f...d5e7958d35dc7758fe2e87e0a8193b93ce1a1b15


author: dimstar@opensuse.org
changelog:
  - Explicitly require group(kvm) by udev: the group used to be
    created by system-users-hardware, but has been split/moved to
    qemu/kvm, where it is more logical. The file
    /usr/lib/udev/rules.d/50-udev-default.rules references this
    group, thus we should make sure the group exists. Otherwise there
    are errors in the journal in the form of:
    /usr/lib/udev/rules.d/50-udev-default.rules:86 Unknown group 'kvm', ignoring


