# changelog

author: Beniamino Galvani <bgalvani@redhat.com> - 1.45.8-1
changelog:
  - Update to 1.45.8 (development)
  - Introduce "stable-ssid" option for wifi.cloned-mac-address property (RHEL-16470)


author: Ján Václav <jvaclav@redhat.com> - 1.45.9-1
changelog:
  - Update to 1.45.9 (development)
  - Add support for PRP/HSR interface (RHEL-5852)
  - Drop support for the 'slaves-order' option in NetworkManager.conf (RHEL-19437)
  - Return error when setting invalid IP addresses or properties via D-Bus (RHEL-19315)
  - Fix extra route being created besides ECMP route (RHEL-1682)


author: Stanislas FAYE <sfaye@redhat.com> - 1.45.10-1
changelog:
  - Update to 1.45.10 (development)
  - Deprecate and Replace connection.master in libnm-core and libnm (RHEL-17619)


author: Stanislas FAYE <sfaye@redhat.com> - 1.45.90-1
changelog:
  - Update to 1.45.90 release (release candidate)
  - Deprecate and Replace connection.slave-type in libnm-core and libnm (RHEL-17620)
  - [RFE] Support assigning IPv4 static route to interface without IPv4 address (RHEL-5098)


author: Íñigo Huguet <ihuguet@redhat.com> - 1.45.91-1
changelog:
  - Update to 1.45.91 release (release candidate)
  - Support changing the DSCP header field for DHCP packets, and set the default to CS0 (RHEL-16040)
  - Deprecate connection.autoconnect-slaves in favour of autoconnect-ports (RHEL-17621)
  - Don't reset bridge's PVID in reapply if it didn't change (RHEL-21576)


author: Stanislas FAYE <sfaye@redhat.com> - 1.46.0-1
changelog:
  - Update to 1.46.0 release
  - Fix DHCPv4 lease can't be renewed after it expires (RHEL-24127)
  - Support the MACsec offload mode (RHEL-24337)
  - Support creating generic devices via external "device-handler" dispatcher (RHEL-1567)
  - Support changing the eswitch mode (RHEL-1441)


author: Fernando Fernandez Mancera <ferferna@redhat.com> - 1.46.0-2
changelog:
  - Drop PrivateUser directive from nm-cloud-setup service (RHEL-27503)
  - Support rollback on global DNS (RHEL-29725)
  - Do not allow OVS bridge or port to be parent (RHEL-28545)


author: Al Stone <ahs3@redhat.com> - 20200925-1
changelog:
  - Update to 20200925 source tree
  - Completely revamp the old big-endian patches (maintainability was the goal).
    This results in a much larger patch set, but each patch is more clearly used
    for a specific purpose.
  - The acpinames command has been deprecated upstream; acpiexec provides 
    replacement functionality.


author: Dean Nelson <dnelson@redhat.com> - 20210604-1
changelog:
  - Update to 20210604 source tree.
  - Bring the big-endian patches up-to-date with what has been submitted
    upstream by Al Stone <ahs3@redhat.com> (not accepted currently).


author: Al Stone <ahs3@redhat.com> - 20210604-2
changelog:
  - Running 'iasl -T all' would segfault when dumping the PHAT template;
    fixed AcpiDmDumpPhat() by removing unnecessary assignments from patch
  - Borrowed a patch from upstream to fix Unicode usage in WPBTs


author: Dean Nelson <dnelson@redhat.com> - 20210604-4
changelog:
  - Add in big-endian patches for PRMT, RGRT and SVKL tables.
  - Fix big-endian related prmt.asl compiler errors.


author: Dean Nelson <dnelson@redhat.com> - 20210604-5
changelog:
  - Backport 19b11f91660b ("Add the subtable CFMWS to the CEDT table").
  - Backport d9798f5275bb ("Fix Compile issue with CEDT and add template").
  - Backport 0914618b553d ("Automated cleanup; No functional changes").
  - Backport 7021087eedb0 ("Remove a duplicate of ACPI_SIG_CEDT").
  - Add in big-endian patch for CEDT tble.


author: Sumit Bose <sbose@redhat.com> - 0.9.0-6
changelog:
  - Include the latest upstream patches with use-ldaps fixes, man page
    improvements and a new sub-command to create managed service accounts


author: Jan Macku <jamacku@redhat.com> - 1.16-1
changelog:
  - alternatives: add --keep-foreign (#57)
  - Translations update from Weblate
  - ci: Onboard chkconfig to Packit
  - zanata: remove zanata related stuff
  - Use make macros
  - alternatives: use one function for path cleaning
  - CI: specify more closely when to run CI
  - Add basic CI and README
  - spec: sync specfile with Fedora


author: Jan Macku <jamacku@redhat.com> - 1.21-1
changelog:
  - ci: Add CodeQL to replace LGTM
  - alternatives: replace master/slave with leader/follower
  - chkconfig: use correct cmp function
  - Bump redhat-plumbers-in-action/differential-shellcheck from 2 to 3
  - ci: Add Shell linter - Differential ShellCheck
  - ci: Use more inclusive terminology in workflows
  - ci: Update workflows, packit and dependabot
  - Translated using Weblate (Friulian)
  - Translated using Weblate (Swedish)
  - Translated using Weblate (Estonian)
  - Translated using Weblate (Georgian)
  - Translated using Weblate (Polish)
  - Translated using Weblate (Korean)
  - Translated using Weblate (Czech)
  - Translations update from Fedora Weblate (#77)
  - Translations update from Fedora Weblate (#75)
  - Translations update from Fedora Weblate (#74)
  - Translations update from Fedora Weblate (#73)
  - Translated using Weblate (Ukrainian)
  - Update translation files
  - Family mentioned for --set in both man and help
  - Translated using Weblate (French)
  - build-sys: Ensure `systemd-sysv-install` symlink does not have `//`
  - Translated using Weblate (German)
  - Add LGTM badges to README
  - Merge remote-tracking branch 'weblate/master'
  - Translated using Weblate (Indonesian)
  - Translated using Weblate (Finnish)
  - Translated using Weblate (Korean)
  - Translated using Weblate (Ukrainian)
  - Translated using Weblate (Turkish)
  - Translated using Weblate (Polish)
  - Translated using Weblate (Norwegian Nynorsk)
  - Update translation files
  - Translated using Weblate (Finnish)
  - Translated using Weblate (Czech)
  - Translated using Weblate (Swedish)
  - Translated using Weblate (Italian)
  - Translated using Weblate (Spanish)
  - Translated using Weblate (Chinese (Simplified))


author: Jan Macku <jamacku@redhat.com> - 1.22-1
changelog:
  - migrate to SPDX license
  - Translated using Weblate (English (United Kingdom))
  - Translated using Weblate (Japanese)
  - ci: Add locale linter
  - ci: update workflows
  - test: fix ShellCheck error[SC2070]
  - Bump redhat-plumbers-in-action/differential-shellcheck from 3 to 4 (#94)
  - releng: Packit remove extra job trigger
  - releng: Enable Packit to handle Fedora updates
  - releng: Convert to rpmautospec


author: Jan Macku <jamacku@redhat.com> - 1.23-1
changelog:
  - Translated using Weblate (Korean)
  - Translated using Weblate (English (United Kingdom))
  - alternatives: --keep-foreign incorrectly handles non-existent files
  - alternatives: isLink should return 0 in case of lstat error
  - Translated using Weblate (Swedish)
  - Translated using Weblate (Korean)
  - Translated using Weblate (Georgian)
  - Translated using Weblate (Finnish)
  - Translated using Weblate (Ukrainian)
  - Translated using Weblate (Polish)
  - Update translation files
  - Translated using Weblate (German)
  - doc: update translations
  - spec: remote changelog


author: Jan Macku <jamacku@redhat.com> - 1.24-1
changelog:
  - ci: fix `NEXT_VERSION` in Makefile
  - revert: releng: Enable Packit to handle Fedora updates
  - revert: releng: Convert to rpmautospec


author: Jakub Martisko <jamartis@redhat.com> - 3.10.3.13
changelog:
  - Sync with rhel 8.3 + cleanup
  - Add new subpackages - z{14,15}
  - Unlike in rhel8, the base subpackage still needs to be build for z12.
  - Covscan related bugfixes
  - Spec and git cleanup (remove unused patches/sources)


author: Sergio Correia <scorreia@redhat.com> - 3.0.7-100
changelog:
  - New upstream release, 3.0.7
    Resolves: rhbz#2019929 - capability=unknown-capability(39) in audit messages


author: Sergio Correia <scorreia@redhat.com> - 3.0.7-101
changelog:
  - Adjust sample-rules dir permissions
    Resolves: rhbz#2054432 - /usr/share/audit/sample-rules is no longer readable by non-root users


author: Sergio Correia <scorreia@redhat.com> - 3.0.7-102
changelog:
  - Fix path normalization in auparse
    Resolves: rhbz#2062824 - auparse missing information when used with --format-text


author: Sergio Correia <scorreia@redhat.com> - 3.0.7-103
changelog:
  - Drop ProtectHome from auditd.service as it interferes with rules
    Resolves: rhbz#2071725 - Default systemd service config blocks audit watch rules in some directories [rhel-9.1.0]


author: Sergio Correia <scorreia@redhat.com> - 3.1.2-2
changelog:
  - Remove 
   
  if [ $1 -eq 0 ] && [ -x "/usr/lib/systemd/systemd-update-helper" ]; then 
          /usr/lib/systemd/systemd-update-helper remove-system-units from %preun scriptlet, as it was causing troubles when removing audit || : 
  fi 

    Related: RHEL-14896


author: Pavel Březina <pbrezina@redhat.com> - 1.2.5-1
changelog:
  - Rebase to 1.2.5 (RHBZ #2080239)
  - backup-restore now works correctly (RHBZ #2070541)
  - add with-subid to sssd profile (RHBZ #2075192)
  - add with-gssapi to sssd profile (RHBZ #2077893)


author: Pavel Březina <pbrezina@redhat.com> - 1.2.6-1
changelog:
  - Rebase to 1.2.6 (RHBZ #2142805)
  - update translations (RHBZ #2139642)
  - Change password hashing algorithm from yescrypt back to sha512 (RHBZ #2151145)


author: Pavel Březina <pbrezina@redhat.com> - 1.2.6-2
changelog:
  - Fix Japanese translations (RHBZ #2153364)
  - Update translations (RHBZ #2189498)
  - Do not prompt for password twice when changing password of local user (RHBZ #2228098)


author: Ian Kent <ikent@redhat.com> - 1:5.1.7-38
changelog:
  - bz2170287 - Autofs reports can't connect to sssd, retry for 10
    seconds when real problem is empty LDAP object
    - improve handling of ENOENT in sss setautomntent().
    - dont immediately call function when waiting.
  - Resolves: rhbz#2170287


author: Ian Kent <ikent@redhat.com> - 1:5.1.7-50
changelog:
  - bz2179753 - deadlock while reading amd maps
    - fix return status of mount_autofs().
    - don't close lookup at umount.
    - fix deadlock in lookups.
    - dont delay expire.
    - make amd mapent search function name clear.
    - rename statemachine() to signal_handler().
    - make signal handling consistent.
    - fix incorrect print format specifiers in get_pkt().
    - eliminate last remaining state_pipe usage.
    - add function master_find_mapent_by_devid().
    - use device id to locate autofs_point when setting log priotity.
    - add command pipe handling functions.
    - switch to application wide command pipe.
    - get rid of unused field submnt_count.
    - fix mount tree startup reconnect.
    - fix unterminated read in handle_cmd_pipe_fifo_message() (Coverity).
  - Resolves: rhbz#2179753


author: Ian Kent <ikent@redhat.com> - 1:5.1.7-51
changelog:
  - bz2210161 - autofs fails to start with combination of +auto.master and
    local direct map lookups after upgrading to 5.1.4-93.el8
    - fix memory leak in sasl_do_kinit() (Coverity).
    - fix fix mount tree startup reconnect.
  - Resolves: rhbz#2210161


author: Ian Kent <ikent@redhat.com> - 1:5.1.7-52
changelog:
  - bz2210899 - amd map format netgoup selector function not working
    - fix use_ignore_mount_option description.
    - include addtional log info for mounts.
    - fix amd selector function matching.
    - get rid entry thid field.
    - continue expire immediately after submount check.
    - add buffer length checks to autofs mount_mount().
    - eliminate realpath from mount of submount.
    - eliminate root param from autofs mount and umount.
    - remove redundant fstat from do_mount_direct().
    - get rid of strlen call in handle_packet_missing_direct().
    - remove redundant stat call in lookup_ghost().
    - set mapent dev and ino before adding to index.
    - change to use printf functions in amd parser.
    - dont call umount_subtree_mounts() on parent at umount.
    - dont take parent source lock at mount shutdown.
    - eliminate buffer usage from handle_mounts_cleanup().
    - fix possible use after free in handle_mounts_exit().
    - make submount cleanup the same as top level mounts.
    - add soucre parameter to module functions.
    - add ioctlfd open helper.
    - make open files limit configurable.
  - Resolves: rhbz#2210899


author: Ian Kent <ikent@redhat.com> - 1:5.1.7-53
changelog:
  - bz2215661 - The sss lookup modules handles error return incorrectly in
    some cases
    - fix some sss error return cases.
  - Resolves: rhbz#2215661


author: Ian Kent <ikent@redhat.com> - 1:5.1.7-54
changelog:
  - bz2223236 - When looking up included maps, sometimes autofs does not
    consult all the included files in order
    - fix incorrect matching of cached wildcard key.
  - Resolves: rhbz#2223236


author: Ian Kent <ikent@redhat.com> - 1:5.1.7-55
changelog:
  - bz2223252 - filesystems mount and expire immediately
    - fix expire retry looping.
    - correct day in changelog entry for revision 53.
  - Resolves: rhbz#2223252


author: Ian Kent <ikent@redhat.com> - 1:5.1.7-56
changelog:
  - RHEL-13083 - autofs attempts to mount nonexistant ".hidden" filesystems
    - allow -null map in indirect maps.
  - Resolves: RHEL-13083


author: Ian Kent <ikent@redhat.com> - 1:5.1.7-57
changelog:
  - RHEL-13084 - multi mount detection fails for share with blank+dash causing
    SEGV crash
    - fix multi-mount check.
  - Resolves: RHEL-13084


author: Ian Kent <ikent@redhat.com> - 1:5.1.7-58
changelog:
  - RHEL-19731 - SIGSEGV using hierarchical map entries on reload with
    autofs-5.1.4-109
    - fix get parent multi-mount check in try_remount().
    - fix deadlock in remount.
  - Resolves: RHEL-19731


author: Siteshwar Vashisht <svashisht@redhat.com> - 5.1.8-9
changelog:
  - Fix a performance regression while using large number of environment variables
    Resolves: RHEL-20020


author: Yara Ahmad <yahmad@redhat.com> - 2.35.2-40
changelog:
  - Fix an illegal memory access when parsing an ELF file containing corrupt symbol version information.  (#2164701)


author: Hans de Goede <hdegoede@redhat.com> - 5.56-3
changelog:
  - Drop obsolete udev rule + systemd service to call btattach on BT-HCIs
    connected via UART from userspace, this is all handled in the kernel now
  - Add the btmgmt util to the packaged files


author: Scott Weaver <scweaver@redhat.com> [5.14.0-427.4.1.el9_4]
changelog:
  - redhat/configs: enable pwr-mlxbf (Nirmala Dalvi) [RHEL-21119]
  - power: reset: pwr-mlxbf: support graceful reboot instead of emergency reset (Nirmala Dalvi) [RHEL-21119]
  - power: reset: use capital "OR" for multiple licenses in SPDX (Nirmala Dalvi) [RHEL-21119]
  - power: reset: pwr-mlxbf: change rst_pwr_hid and low_pwr_hid from global to local variables (Nirmala Dalvi) [RHEL-21119]
  - power: reset: pwr-mlxbf: add missing include (Nirmala Dalvi) [RHEL-21119]
  - power: reset: pwr-mlxbf: add BlueField SoC power control driver (Nirmala Dalvi) [RHEL-21119]
  - redhat/configs: enable pinctrl_mlxbf3 This driver is required to support the pinctrl device on the Bluefield-3 card. (Nirmala Dalvi) [RHEL-21115]
  - pinctrl: mlxbf3: Remove gpio_disable_free() (Nirmala Dalvi) [RHEL-21115]
  - pinctrl: use capital "OR" for multiple licenses in SPDX (Nirmala Dalvi) [RHEL-21115]
  - pinctrl: mlxbf3: set varaiable mlxbf3_pmx_funcs storage-class-specifier to static (Nirmala Dalvi) [RHEL-21115]
  - pinctrl: mlxbf3: Add pinctrl driver support (Nirmala Dalvi) [RHEL-21115]
  - redhat/configs: enable gpio_mlxbf3 (Nirmala Dalvi) [RHEL-21113]
  - gpio: mlxbf3: add an error code check in mlxbf3_gpio_probe (Nirmala Dalvi) [RHEL-21113]
  - gpio: mlxbf3: use capital "OR" for multiple licenses in SPDX (Nirmala Dalvi) [RHEL-21113]
  - gpio: mlxbf3: Support add_pin_ranges() (Nirmala Dalvi) [RHEL-21113]
  - gpio: mlxbf3: Add gpio driver support (Nirmala Dalvi) [RHEL-21113]
  - redhat/configs: enable mlxbf-pmc (Luiz Capitulino) [RHEL-21122]
  - platform/mellanox: mlxbf-pmc: Ignore unsupported performance blocks (Luiz Capitulino) [RHEL-21122]
  - platform/mellanox: mlxbf-pmc: mlxbf_pmc_event_list(): make size ptr optional (Luiz Capitulino) [RHEL-21122]
  - platform/mellanox: mlxbf-pmc: Cleanup signed/unsigned mix-up (Luiz Capitulino) [RHEL-21122]
  - platform/mellanox: mlxbf-pmc: Replace uintN_t with kernel-style types (Luiz Capitulino) [RHEL-21122]
  - platform/mellanox: mlxbf-pmc: Fix offset calculation for crspace events (Luiz Capitulino) [RHEL-21122]
  - platform/mellanox: Check devm_hwmon_device_register_with_groups() return value (Luiz Capitulino) [RHEL-21122]
  - platform/mellanox: Add null pointer checks for devm_kasprintf() (Luiz Capitulino) [RHEL-21122]
  - platform/mellanox: mlxbf-pmc: Add support for BlueField-3 (Luiz Capitulino) [RHEL-21122]
  - platform/mellanox: mlxbf-pmc: Fix reading of unprogrammed events (Luiz Capitulino) [RHEL-21122]
  - platform/mellanox: mlxbf-pmc: Fix potential buffer overflows (Luiz Capitulino) [RHEL-21122]
  - platform/mellanox: mlxbf-pmc: fix sscanf() error checking (Luiz Capitulino) [RHEL-21122]
  - platform/mellanox: mlxbf-pmc: fix kernel-doc notation (Luiz Capitulino) [RHEL-21122]
  - SUNRPC: Remove stale comments (Jeffrey Layton) [RHEL-22860]
  - NFSD: Remove BUG_ON in nfsd4_process_cb_update() (Jeffrey Layton) [RHEL-22860]
  - NFSD: Replace comment with lockdep assertion (Jeffrey Layton) [RHEL-22860]
  - NFSD: Remove unused @reason argument (Jeffrey Layton) [RHEL-22860]
  - NFSD: Add callback operation lifetime trace points (Jeffrey Layton) [RHEL-22860]
  - NFSD: Rename nfsd_cb_state trace point (Jeffrey Layton) [RHEL-22860]
  - NFSD: Replace dprintks in nfsd4_cb_sequence_done() (Jeffrey Layton) [RHEL-22860]
  - NFSD: Add nfsd_seq4_status trace event (Jeffrey Layton) [RHEL-22860]
  - NFSD: Retransmit callbacks after client reconnects (Jeffrey Layton) [RHEL-22860]
  - NFSD: Reschedule CB operations when backchannel rpc_clnt is shut down (Jeffrey Layton) [RHEL-22860]
  - NFSD: Convert the callback workqueue to use delayed_work (Jeffrey Layton) [RHEL-22860]
  - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Jeffrey Layton) [RHEL-22860]
  - NFSv4, NFSD: move enum nfs_cb_opnum4 to include/linux/nfs4.h (Jeffrey Layton) [RHEL-22860]
  - tls: fix use-after-free on failed backlog decryption (Sabrina Dubroca) [RHEL-26410 RHEL-26415] {CVE-2024-26584}
  - tls: separate no-async decryption request handling from async (Sabrina Dubroca) [RHEL-26410 RHEL-26415] {CVE-2024-26584}
  - tls: decrement decrypt_pending if no async completion will be called (Sabrina Dubroca) [RHEL-26416 RHEL-26421] {CVE-2024-26583}
  - net: tls: fix use-after-free with partial reads and async decrypt (Sabrina Dubroca) [RHEL-26398 RHEL-26401] {CVE-2024-26582}
  - net: tls: handle backlogging of crypto requests (Sabrina Dubroca) [RHEL-26410 RHEL-26415] {CVE-2024-26584}
  - tls: fix race between tx work scheduling and socket close (Sabrina Dubroca) [RHEL-26361 RHEL-26363] {CVE-2024-26585}
  - tls: fix race between async notify and socket close (Sabrina Dubroca) [RHEL-26416 RHEL-26421] {CVE-2024-26583}
  - net: tls: factor out tls_*crypt_async_wait() (Sabrina Dubroca) [RHEL-26416 RHEL-26421] {CVE-2024-26583}
  - i2c: mlxbf: Use devm_platform_get_and_ioremap_resource() (Luiz Capitulino) [RHEL-21116]
  - I2C: Explicitly include correct DT includes (Luiz Capitulino) [RHEL-21116]
  - i2c: mlxbf: Use dev_err_probe in probe function (Luiz Capitulino) [RHEL-21116]
  - i2c: Convert to platform remove callback returning void (Luiz Capitulino) [RHEL-21116]
  - i2c: mlxbf: depend on ACPI; clean away ifdeffage (Luiz Capitulino) [RHEL-21116]
  - i2c: mlxbf: remove device tree support (Luiz Capitulino) [RHEL-21116]
  - i2c: mlxbf: support BlueField-3 SoC (Luiz Capitulino) [RHEL-21116]
  - i2c: mlxbf: add multi slave functionality (Luiz Capitulino) [RHEL-21116]
  - i2c: mlxbf: support lock mechanism (Luiz Capitulino) [RHEL-21116]
  - i2c: mlxbf: Fix frequency calculation (Luiz Capitulino) [RHEL-21116]
  - i2c: mlxbf: Refactor _UID handling to use acpi_dev_uid_to_integer() (Luiz Capitulino) [RHEL-21116]
  - i2c: mlxbf: remove IRQF_ONESHOT (Luiz Capitulino) [RHEL-21116]
  - i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction() (Luiz Capitulino) [RHEL-21116]
  - i2c: mlxbf: incorrect base address passed during io write (Luiz Capitulino) [RHEL-21116]


author: Scott Weaver <scweaver@redhat.com> [5.14.0-427.5.1.el9_4]
changelog:
  - i2c: i801: Fix block process call transactions (David Arcari) [RHEL-26479 RHEL-26481] {CVE-2024-26593}
  - sched/membarrier: reduce the ability to hammer on sys_membarrier (Wander Lairson Costa) [RHEL-23428 RHEL-23429] {CVE-2024-26602}


author: Scott Weaver <scweaver@redhat.com> [5.14.0-427.6.1.el9_4]
changelog:
  - IB/hfi1: Fix sdma.h tx->num_descs off-by-one error (Daniel Vacek) [RHEL-26063]
  - ASoC: Intel: soc-acpi: rt713+rt1316, no sdw-dmic config (Jaroslav Kysela) [RHEL-26456]
  - hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed (Maxim Levitsky) [RHEL-26435]
  - hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove (Maxim Levitsky) [RHEL-26435]
  - mlxsw: spectrum_acl_tcam: Fix stack corruption (Ivan Vecera) [RHEL-26463 RHEL-26465] {CVE-2024-26586}


author: Scott Weaver <scweaver@redhat.com> [5.14.0-427.7.1.el9_4]
changelog:
  - NFS: Read unlock folio on nfs_page_create_from_folio() error (Benjamin Coddington) [RHEL-18029]
  - i40e: Fix VF MAC filter removal (Ivan Vecera) [RHEL-15701]
  - i40e: Fix firmware version comparison function (Ivan Vecera) [RHEL-15701]
  - i40e: disable NAPI right after disabling irqs when handling xsk_pool (Ivan Vecera) [RHEL-15701]
  - i40e: take into account XDP Tx queues when stopping rings (Ivan Vecera) [RHEL-15701]
  - i40e: avoid double calling i40e_pf_rxq_wait() (Ivan Vecera) [RHEL-15701]
  - i40e: Fix wrong mask used during DCB config (Ivan Vecera) [RHEL-15701]
  - i40e: Fix waiting for queues of all VSIs to be disabled (Ivan Vecera) [RHEL-15701]
  - i40e: Do not allow untrusted VF to remove administratively set MAC (Ivan Vecera) [RHEL-15701]
  - net: intel: fix old compiler regressions (Ivan Vecera) [RHEL-15701]
  - i40e: update xdp_rxq_info::frag_size for ZC enabled Rx queue (Ivan Vecera) [RHEL-15701]
  - i40e: set xdp_rxq_info::frag_size (Ivan Vecera) [RHEL-15701]
  - intel: xsk: initialize skb_frag_t::bv_offset in ZC drivers (Ivan Vecera) [RHEL-15701]
  - i40e: handle multi-buffer packets that are shrunk by xdp prog (Ivan Vecera) [RHEL-15701]
  - i40e: Include types.h to some headers (Ivan Vecera) [RHEL-15701]
  - i40e: Restore VF MSI-X state during PCI reset (Ivan Vecera) [RHEL-15701]
  - i40e: fix use-after-free in i40e_aqc_add_filters() (Ivan Vecera) [RHEL-15701]
  - i40e: Avoid unnecessary use of comma operator (Ivan Vecera) [RHEL-15701]
  - i40e: Fix VF disable behavior to block all traffic (Ivan Vecera) [RHEL-15701]
  - i40e: Fix filter input checks to prevent config with invalid values (Ivan Vecera) [RHEL-15701]
  - i40e: field get conversion (Ivan Vecera) [RHEL-15701]
  - i40e: field prep conversion (Ivan Vecera) [RHEL-15701]
  - intel: add bit macro includes where needed (Ivan Vecera) [RHEL-15701]
  - i40e: remove fake support of rx-frames-irq (Ivan Vecera) [RHEL-15701]
  - i40e: Fix ST code value for Clause 45 (Ivan Vecera) [RHEL-15701]
  - i40e: Fix unexpected MFS warning message (Ivan Vecera) [RHEL-15701]
  - i40e: Remove queue tracking fields from i40e_adminq_ring (Ivan Vecera) [RHEL-15701]
  - i40e: Remove AQ register definitions for VF types (Ivan Vecera) [RHEL-15701]
  - i40e: Delete unused and useless i40e_pf fields (Ivan Vecera) [RHEL-15701]
  - i40e: Fix adding unsupported cloud filters (Ivan Vecera) [RHEL-15701]
  - i40e: Delete unused i40e_mac_info fields (Ivan Vecera) [RHEL-15701]
  - i40e: Move inline helpers to i40e_prototype.h (Ivan Vecera) [RHEL-15701]
  - i40e: Remove VF MAC types (Ivan Vecera) [RHEL-15701]
  - i40e: Use helpers to check running FW and AQ API versions (Ivan Vecera) [RHEL-15701]
  - i40e: Add other helpers to check version of running firmware and AQ API (Ivan Vecera) [RHEL-15701]
  - i40e: Move i40e_is_aq_api_ver_ge helper (Ivan Vecera) [RHEL-15701]
  - i40e: Initialize hardware capabilities at single place (Ivan Vecera) [RHEL-15701]
  - i40e: Consolidate hardware capabilities (Ivan Vecera) [RHEL-15701]
  - i40e: Use DECLARE_BITMAP for flags field in i40e_hw (Ivan Vecera) [RHEL-15701]
  - i40e: Use DECLARE_BITMAP for flags and hw_features fields in i40e_pf (Ivan Vecera) [RHEL-15701]
  - i40e: Remove _t suffix from enum type names (Ivan Vecera) [RHEL-15701]
  - i40e: Remove unused flags (Ivan Vecera) [RHEL-15701]
  - i40e: add an error code check in i40e_vsi_setup (Ivan Vecera) [RHEL-15701]
  - i40e: increase max descriptors for XL710 (Ivan Vecera) [RHEL-15701]
  - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (Ivan Vecera) [RHEL-15701]
  - i40e: sync next_to_clean and next_to_process for programming status desc (Ivan Vecera) [RHEL-15701]
  - i40e: Fix I40E_FLAG_VF_VLAN_PRUNING value (Ivan Vecera) [RHEL-15701]
  - i40e: xsk: remove count_mask (Ivan Vecera) [RHEL-15701]
  - i40e: use scnprintf over strncpy+strncat (Ivan Vecera) [RHEL-15701]
  - intel: fix format warnings (Ivan Vecera) [RHEL-15701]
  - i40e: Refactor and rename i40e_read_pba_string() (Ivan Vecera) [RHEL-15701]
  - i40e: Split and refactor i40e_nvm_version_str() (Ivan Vecera) [RHEL-15701]
  - i40e: prevent crash on probe if hw registers have invalid values (Ivan Vecera) [RHEL-15701]
  - i40e: Move DDP specific macros and structures to i40e_ddp.c (Ivan Vecera) [RHEL-15701]
  - i40e: Remove circular header dependencies and fix headers (Ivan Vecera) [RHEL-15701]
  - i40e: Split i40e_osdep.h (Ivan Vecera) [RHEL-15701]
  - i40e: Move memory allocation structures to i40e_alloc.h (Ivan Vecera) [RHEL-15701]
  - i40e: Simplify memory allocation functions (Ivan Vecera) [RHEL-15701]
  - i40e: Refactor I40E_MDIO_CLAUSE* macros (Ivan Vecera) [RHEL-15701]
  - i40e: Move I40E_MASK macro to i40e_register.h (Ivan Vecera) [RHEL-15701]
  - i40e: Remove back pointer from i40e_hw structure (Ivan Vecera) [RHEL-15701]
  - i40e: Add rx_missed_errors for buffer exhaustion (Ivan Vecera) [RHEL-15701]
  - net: Tree wide: Replace xdp_do_flush_map() with xdp_do_flush(). (Ivan Vecera) [RHEL-15701]
  - i40e: fix potential memory leaks in i40e_remove() (Ivan Vecera) [RHEL-15701]
  - i40e: fix potential NULL pointer dereferencing of pf->vf i40e_sync_vsi_filters() (Ivan Vecera) [RHEL-15701]
  - i40e: fix misleading debug logs (Ivan Vecera) [RHEL-15701]
  - i40e: Replace one-element array with flex-array member in struct i40e_profile_aq_section (Ivan Vecera) [RHEL-15701]
  - i40e: Replace one-element array with flex-array member in struct i40e_section_table (Ivan Vecera) [RHEL-15701]
  - i40e: Replace one-element array with flex-array member in struct i40e_profile_segment (Ivan Vecera) [RHEL-15701]
  - i40e: Replace one-element array with flex-array member in struct i40e_package_header (Ivan Vecera) [RHEL-15701]
  - i40e: Remove unused function declarations (Ivan Vecera) [RHEL-15701]
  - i40e: remove i40e_status (Ivan Vecera) [RHEL-15701]
  - i40e: Fix an NULL vs IS_ERR() bug for debugfs_create_dir() (Ivan Vecera) [RHEL-15701]
  - i40e: xsk: add TX multi-buffer support (Ivan Vecera) [RHEL-15701]
  - i40e: xsk: add RX multi-buffer support (Ivan Vecera) [RHEL-15701]
  - i40e, xsk: fix comment typo (Ivan Vecera) [RHEL-15701]
  - i40e: remove unnecessary check for old MAC == new MAC (Ivan Vecera) [RHEL-15701]
  - i40e: fix i40e_setup_misc_vector() error handling (Ivan Vecera) [RHEL-15701]
  - i40e: fix accessing vsi->active_filters without holding lock (Ivan Vecera) [RHEL-15701]
  - i40e: Add support for VF to specify its primary MAC address (Ivan Vecera) [RHEL-15701]
  - i40e: fix registers dump after run ethtool adapter self test (Ivan Vecera) [RHEL-15701]
  - i40e: fix flow director packet filter programming (Ivan Vecera) [RHEL-15701]
  - i40e: add support for XDP multi-buffer Rx (Ivan Vecera) [RHEL-15701]
  - i40e: add xdp_buff to i40e_ring struct (Ivan Vecera) [RHEL-15701]
  - i40e: introduce next_to_process to i40e_ring (Ivan Vecera) [RHEL-15701]
  - i40e: use frame_sz instead of recalculating truesize for building skb (Ivan Vecera) [RHEL-15701]
  - i40e: Change size to truesize when using i40e_rx_buffer_flip() (Ivan Vecera) [RHEL-15701]
  - i40e: add pre-xdp page_count in rx_buffer (Ivan Vecera) [RHEL-15701]
  - i40e: change Rx buffer size for legacy-rx to support XDP multi-buffer (Ivan Vecera) [RHEL-15701]
  - i40e: consolidate maximum frame size calculation for vsi (Ivan Vecera) [RHEL-15701]
  - i40e: check vsi type before setting xdp_features flag (Ivan Vecera) [RHEL-15701]
  - drivers: net: turn on XDP features (Ivan Vecera) [RHEL-15701]
  - i40e: add xdp frags support to ndo_xdp_xmit (Ivan Vecera) [RHEL-15701]
  - dmaengine: idxd: Ensure safe user copy of completion record (Jerry Snitselaar) [RHEL-28511]
  - dmaengine: idxd: Remove shadow Event Log head stored in idxd (Jerry Snitselaar) [RHEL-28511]
  - dmaengine: idxd: Move dma_free_coherent() out of spinlocked context (Jerry Snitselaar) [RHEL-28511]


author: Scott Weaver <scweaver@redhat.com> [5.14.0-427.8.1.el9_4]
changelog:
  - dm-integrity: align the outgoing bio in integrity_recheck (Benjamin Marzinski) [RHEL-29679]
  - dm-integrity: fix a memory leak when rechecking the data (Benjamin Marzinski) [RHEL-29679]
  - NFSv4: fairly test all delegations on a SEQ4_ revocation (Benjamin Coddington) [RHEL-7976]


author: Scott Weaver <scweaver@redhat.com> [5.14.0-427.10.1.el9_4]
changelog:
  - NFS: remove sync_mode test from nfs_writepage_locked() (Jeffrey Layton) [RHEL-28630]
  - nfs: Remove writepage (Jeffrey Layton) [RHEL-28630]


author: Scott Weaver <scweaver@redhat.com> [5.14.0-427.12.1.el9_4]
changelog:
  - mm/sparsemem: fix race in accessing memory_section->usage (Waiman Long) [RHEL-28877 RHEL-28878] {CVE-2023-52489}
  - Revert "[redhat] kabi: add symbol __scsi_execute to stablelist" (Ewan D. Milne) [RHEL-30725]


author: Scott Weaver <scweaver@redhat.com> [5.14.0-427.14.1.el9_4]
changelog:
  - crypto: dh - implement FIPS PCT (Vladis Dronov) [RHEL-27009 RHEL-25845]
  - crypto: tcrypt - add ffdhe2048(dh) test (Vladis Dronov) [RHEL-27009 RHEL-25845]
  - crypto: dh - Make public key test FIPS-only (Vladis Dronov) [RHEL-27009 RHEL-25845]
  - printk: allow disabling printk per-console device kthreads at boot (Luis Claudio R. Goncalves) [RHEL-30678 RHEL-17709]
  - mm, vmscan: remove ISOLATE_UNMAPPED (Nico Pache) [RHEL-29235 RHEL-28667]
  - trace-vmscan-postprocess: sync with tracepoints updates (Nico Pache) [RHEL-29235 RHEL-28667]
  - tracing: incorrect isolate_mote_t cast in mm_vmscan_lru_isolate (Nico Pache) [RHEL-29235 RHEL-28667]
  - mm/mglru: skip special VMAs in lru_gen_look_around() (Nico Pache) [RHEL-29235 RHEL-28667]
  - mm/mglru: reclaim offlined memcgs harder (Nico Pache) [RHEL-29235 RHEL-28667]
  - mm/mglru: try to stop at high watermarks (Nico Pache) [RHEL-29235 RHEL-28667]
  - mm/mglru: fix underprotected page cache (Nico Pache) [RHEL-29235 RHEL-28667]
  - mm: multi-gen LRU: reuse some legacy trace events (Nico Pache) [RHEL-29235 RHEL-28667]
  - mm: multi-gen LRU: improve design doc (Nico Pache) [RHEL-29235 RHEL-28667]
  - mm: multi-gen LRU: clean up sysfs code (Nico Pache) [RHEL-29235 RHEL-28667]
  - cpu/hotplug: Do not bail-out in DYING/STARTING sections (David Arcari) [RHEL-29673 RHEL-19514]
  - crypto: akcipher - Disable signing and decryption (Herbert Xu) [RHEL-29079 RHEL-17113] {CVE-2023-6240}


author: Scott Weaver <scweaver@redhat.com> [5.14.0-427.15.1.el9_4]
changelog:
  - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-30110 RHEL-19000]
  - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-30110 RHEL-19000]
  - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-30110 RHEL-19000]
  - crypto: iaa - mark tech preview (Vladis Dronov) [RHEL-32242 RHEL-29685]
  - crypto: iaa - Fix nr_cpus < nr_iaa case (Vladis Dronov) [RHEL-32242 RHEL-29685]
  - crypto: iaa - fix the missing CRYPTO_ALG_ASYNC in cra_flags (Vladis Dronov) [RHEL-32242 RHEL-29685]
  - crypto: iaa - Fix comp/decomp delay statistics (Vladis Dronov) [RHEL-32242 RHEL-29685]
  - crypto: iaa - Fix async_disable descriptor leak (Vladis Dronov) [RHEL-32242 RHEL-29685]
  - crypto: iaa - Remove unnecessary debugfs_create_dir() error check in iaa_crypto_debugfs_init() (Vladis Dronov) [RHEL-32242 RHEL-29685]
  - crypto: iaa - Remove header table code (Vladis Dronov) [RHEL-32242 RHEL-29685]
  - cgroup: cgroup-v1: do not exclude cgrp_dfl_root (Laurent Vivier) [RHEL-32716 RHEL-31381]
  - x86/sev: Harden #VC instruction emulation somewhat (Vitaly Kuznetsov) [RHEL-30030 RHEL-30031] {CVE-2024-25743 CVE-2024-25742}


author: Scott Weaver <scweaver@redhat.com> [5.14.0-427.16.1.el9_4]
changelog:
  - memory: tegra: Skip SID programming if SID registers aren't set (Robert Foss) [RHEL-32675 RHEL-23656]
  - memory: tegra: Add SID override programming for MC clients (Robert Foss) [RHEL-32675 RHEL-23656]
  - iommu: Don't reserve 0-length IOVA region (Robert Foss) [RHEL-32675 RHEL-23656]


author: Scott Weaver <scweaver@redhat.com> [5.14.0-427.17.1.el9_4]
changelog:
  - ceph: switch to use cap_delay_lock for the unlink delay list (Jay Shin) [RHEL-33003 RHEL-32997]
  - ceph: remove useless session parameter for check_caps() (Xiubo Li) [RHEL-33003 RHEL-19813]
  - ceph: flush the dirty caps immediatelly when quota is approaching (Xiubo Li) [RHEL-33003 RHEL-19813]
  - vhost: Add smp_rmb() in vhost_enable_notify() (Gavin Shan) [RHEL-31839 RHEL-26104]
  - vhost: Add smp_rmb() in vhost_vq_avail_empty() (Gavin Shan) [RHEL-31839 RHEL-26104]
  - iommu/vt-d: Support enforce_cache_coherency only for empty domains (Jerry Snitselaar) [RHEL-32793 RHEL-31083]
  - iommu/vt-d: Add MTL to quirk list to skip TE disabling (Jerry Snitselaar) [RHEL-32793 RHEL-31083]
  - iommu/vt-d: Make context clearing consistent with context mapping (Jerry Snitselaar) [RHEL-32793 RHEL-31083]
  - iommu/vt-d: Disable PCI ATS in legacy passthrough mode (Jerry Snitselaar) [RHEL-32793 RHEL-31083]
  - iommu/vt-d: Omit devTLB invalidation requests when TES=0 (Jerry Snitselaar) [RHEL-32793 RHEL-31083]
  - PCI/MSI: Prevent MSI hardware interrupt number truncation (Myron Stowe) [RHEL-33656 RHEL-21453]


author: Scott Weaver <scweaver@redhat.com> [5.14.0-427.18.1.el9_4]
changelog:
  - netfilter: nf_tables: disallow anonymous set with timeout flag (Phil Sutter) [RHEL-32971 RHEL-30082] {CVE-2024-26642}
  - netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (Phil Sutter) [RHEL-33070 RHEL-30078] {CVE-2024-26643}
  - netfilter: nft_ct: fix l3num expectations with inet pseudo family (Phil Sutter) [RHEL-32963 RHEL-31345] {CVE-2024-26673}
  - netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations (Phil Sutter) [RHEL-32963 RHEL-31345] {CVE-2024-26673}
  - arm64: tlb: Fix TLBI RANGE operand (Shaoqin Huang) [RHEL-33412 RHEL-26259]
  - arm64/mm: Modify range-based tlbi to decrement scale (Shaoqin Huang) [RHEL-33412 RHEL-26259]
  - rh_messages.h: mark mlx5 on Bluefield-3 as unmaintained (Scott Weaver) [RHEL-35878 RHEL-33061]
  - net: ip_tunnel: prevent perpetual headroom growth (Guillaume Nault) [RHEL-33934 RHEL-31816] {CVE-2024-26804}
  - gitlab-ci: use zstream builder container image (Michael Hofmann)
  - selftests: net: gro fwd: update vxlan GRO test expectations (Antoine Tenart) [RHEL-30910 RHEL-19729]
  - udp: prevent local UDP tunnel packets from being GROed (Antoine Tenart) [RHEL-30910 RHEL-19729]
  - udp: do not transition UDP GRO fraglist partial checksums to unnecessary (Antoine Tenart) [RHEL-30910 RHEL-19729]
  - gro: fix ownership transfer (Antoine Tenart) [RHEL-30910 RHEL-19729]
  - udp: do not accept non-tunnel GSO skbs landing in a tunnel (Antoine Tenart) [RHEL-30910 RHEL-19729]
  - bpf, tcx: Get rid of tcx_link_const (Felix Maurer) [RHEL-33062 RHEL-28590]
  - selftests/bpf: Add additional mprog query test coverage (Felix Maurer) [RHEL-33062 RHEL-28590]
  - selftests/bpf: Make seen_tc* variable tests more robust (Felix Maurer) [RHEL-33062 RHEL-28590]
  - selftests/bpf: Test query on empty mprog and pass revision into attach (Felix Maurer) [RHEL-33062 RHEL-28590]
  - selftests/bpf: Adapt assert_mprog_count to always expect 0 count (Felix Maurer) [RHEL-33062 RHEL-28590]
  - selftests/bpf: Test bpf_mprog query API via libbpf and raw syscall (Felix Maurer) [RHEL-33062 RHEL-28590]
  - selftest/bpf: Add various selftests for program limits (Felix Maurer) [RHEL-33062 RHEL-28590]
  - bpf: Refuse unused attributes in bpf_prog_{attach,detach} (Felix Maurer) [RHEL-33062 RHEL-28590]
  - bpf: Handle bpf_mprog_query with NULL entry (Felix Maurer) [RHEL-33062 RHEL-28590]
  - net: Fix skb consume leak in sch_handle_egress (Felix Maurer) [RHEL-33062 RHEL-28590]
  - selftests/bpf: Add various more tcx test cases (Felix Maurer) [RHEL-33062 RHEL-28590]
  - selftests/bpf: Add test for detachment on empty mprog entry (Felix Maurer) [RHEL-33062 RHEL-28590]
  - tcx: Fix splat during dev unregister (Felix Maurer) [RHEL-33062 RHEL-28590]
  - tcx: Fix splat in ingress_destroy upon tcx_entry_free (Felix Maurer) [RHEL-33062 RHEL-28590]
  - selftests/bpf: Add mprog API tests for BPF tcx links (Felix Maurer) [RHEL-33062 RHEL-28590]
  - selftests/bpf: Add mprog API tests for BPF tcx opts (Felix Maurer) [RHEL-33062 RHEL-28590]
  - bpf: Add fd-based tcx multi-prog infra with link support (Felix Maurer) [RHEL-33062 RHEL-28590]
  - bpftool: Implement link show support for tcx (Artem Savkov) [RHEL-33062 RHEL-23643]
  - bpftool: Extend net dump with tcx progs (Artem Savkov) [RHEL-33062 RHEL-23643]
  - bpf: fix precision backtracking instruction iteration (Jay Shin) [RHEL-35230 RHEL-23643]


author: Scott Weaver <scweaver@redhat.com> [5.14.0-427.19.1.el9_4]
changelog:
  - x86/mce: Cleanup mce_usable_address() (Prarit Bhargava) [RHEL-33810 RHEL-25415]
  - x86/mce: Define amd_mce_usable_address() (Prarit Bhargava) [RHEL-33810 RHEL-25415]
  - x86/MCE/AMD: Split amd_mce_is_memory_error() (Prarit Bhargava) [RHEL-33810 RHEL-25415]
  - fs: sysfs: Fix reference leak in sysfs_break_active_protection() (Ewan D. Milne) [RHEL-35302 RHEL-35078] {CVE-2024-26993}


author: Scott Weaver <scweaver@redhat.com> [5.14.0-427.20.1.el9_4]
changelog:
  - ipv6: sr: fix possible use-after-free and null-ptr-deref (Hangbin Liu) [RHEL-33968 RHEL-31732] {CVE-2024-26735}
  - idpf: fix kernel panic on unknown packet types (Michal Schmidt) [RHEL-36145 RHEL-29035]
  - idpf: refactor some missing field get/prep conversions (Michal Schmidt) [RHEL-36145 RHEL-29035]
  - PCI: Fix pci_rh_check_status() call semantics (Luiz Capitulino) [RHEL-36541 RHEL-35032]
  - cxgb4: Properly lock TX queue for the selftest. (John B. Wyatt IV) [RHEL-36530 RHEL-31990 RHEL-9354]


author: Scott Weaver <scweaver@redhat.com> [5.14.0-427.21.1.el9_4]
changelog:
  - drm/i915/display: Increase number of fast wake precharge pulses (Mika Penttilä) [RHEL-36534 RHEL-20439]
  - drm/i915/psr: Improve fast and IO wake lines calculation (Mika Penttilä) [RHEL-36534 RHEL-20439]
  - drm/i915/display: Make intel_dp_aux_fw_sync_len available for PSR code (Mika Penttilä) [RHEL-36534 RHEL-20439]
  - smb: client: improve DFS mount check (Jay Shin) [RHEL-36743 RHEL-28739]
  - net: mana: Fix Rx DMA datasize and skb_over_panic (Cathy Avery) [RHEL-37622 RHEL-9872]


author: Scott Weaver <scweaver@redhat.com> [5.14.0-427.22.1.el9_4]
changelog:
  - dpll: fix dpll_pin_on_pin_register() for multiple parent pins (Petr Oros) [RHEL-36572 RHEL-32098]
  - dpll: indent DPLL option type by a tab (Petr Oros) [RHEL-36572 RHEL-32098]
  - dpll: fix dpll_xa_ref_*_del() for multiple registrations (Petr Oros) [RHEL-36572 RHEL-32098]
  - dpll: spec: use proper enum for pin capabilities attribute (Petr Oros) [RHEL-36572 RHEL-32098]
  - dpll: move all dpll<>netdev helpers to dpll code (Petr Oros) [RHEL-36572 RHEL-32098]
  - dpll: fix build failure due to rcu_dereference_check() on unknown type (Petr Oros) [RHEL-36572 RHEL-32098]
  - dpll: rely on rcu for netdev_dpll_pin() (Petr Oros) [RHEL-36572 RHEL-32098]
  - dpll: fix possible deadlock during netlink dump operation (Petr Oros) [RHEL-36572 RHEL-32098]
  - dpll: check that pin is registered in __dpll_pin_unregister() (Petr Oros) [RHEL-36572 RHEL-32098]
  - dpll: move xa_erase() call in to match dpll_pin_alloc() error path order (Petr Oros) [RHEL-36572 RHEL-32098]
  - dpll: expose fractional frequency offset value to user (Petr Oros) [RHEL-36572 RHEL-32098]
  - dpll: allocate pin ids in cycle (Petr Oros) [RHEL-36572 RHEL-32098]
  - dpll: remove leftover mode_supported() op and use mode_get() instead (Petr Oros) [RHEL-36572 RHEL-32098]
  - Documentation: dpll: wrap DPLL_CMD_PIN_GET output in a code block (Petr Oros) [RHEL-36572 RHEL-32098]
  - Documentation: dpll: Fix code blocks (Petr Oros) [RHEL-36572 RHEL-32098]
  - MAINTAINERS: adjust header file entry in DPLL SUBSYSTEM (Petr Oros) [RHEL-36572 RHEL-32098]
  - netdev: Remove unneeded semicolon (Petr Oros) [RHEL-36572 RHEL-32098]
  - netlink: add variable-length / auto integers (Petr Oros) [RHEL-36572 RHEL-30145]
  - netlink: allow be16 and be32 types in all uint policy checks (Ivan Vecera) [RHEL-36572 RHEL-30656]
  - net: netlink: recommend policy range validation (Ivan Vecera) [RHEL-36572 RHEL-30344]
  - netlink: add nla be16/32 types to minlen array (Ivan Vecera) [RHEL-36572 RHEL-30344]
  - netlink: introduce bigendian integer types (Michal Schmidt) [RHEL-36572 RHEL-30344]
  - netlink: introduce NLA_POLICY_MAX_BE (Ivan Vecera) [RHEL-36572 RHEL-30344]
  - ice: use irq_update_affinity_hint() (Michal Schmidt) [RHEL-38512 RHEL-35293]
  - x86/tsc: Defer marking TSC unstable to a worker (Wander Lairson Costa) [RHEL-9296 RHEL-19514]
  - x86/smpboot: Make TSC synchronization function call based (David Arcari) [RHEL-9296 RHEL-19514]
  - Bluetooth: hci_core: Remove le_restart_scan work (David Marlin) [RHEL-38524 RHEL-30099]
  - hwmon: (coretemp) Enlarge per package core count limit (David Arcari) [RHEL-35447 RHEL-22705]
  - hwmon: (coretemp) Fix bogus core_id to attr name mapping (David Arcari) [RHEL-35447 RHEL-22705]
  - hwmon: (coretemp) Fix out-of-bounds memory access (David Arcari) [RHEL-35447 RHEL-22705]
  - perf: arm_cspmu: Reject events meant for other PMUs (Michael Petlan) [RHEL-34991 RHEL-25824]
  - smb: client: refresh referral without acquiring refpath_lock (Jay Shin) [RHEL-38904 RHEL-7986]
  - smb: client: guarantee refcounted children from parent session (Jay Shin) [RHEL-38904 RHEL-7986]
  - smb3: show beginning time for per share stats (Jay Shin) [RHEL-38904 RHEL-31245]
  - smb: client: fix mount when dns_resolver key is not available (Jay Shin) [RHEL-38904 RHEL-31245]
  - smb: client: get rid of dfs code dep in namespace.c (Jay Shin) [RHEL-38904 RHEL-31245]
  - smb: client: get rid of dfs naming in automount code (Jay Shin) [RHEL-38904 RHEL-31245]
  - smb: client: rename cifs_dfs_ref.c to namespace.c (Jay Shin) [RHEL-38904 RHEL-31245]
  - smb: client: ensure to try all targets when finding nested links (Jay Shin) [RHEL-38904 RHEL-31245]
  - smb: client: introduce DFS_CACHE_TGT_LIST() (Jay Shin) [RHEL-38904 RHEL-31245]
  - smb: client: remove redundant pointer 'server' (Jay Shin) [RHEL-38904 RHEL-28739]
  - smb: client: fix parsing of source mount option (Jay Shin) [RHEL-38904 RHEL-28739]
  - integrity: eliminate unnecessary "Problem loading X.509 certificate" msg (Coiby Xu) [RHEL-39933 RHEL-12346]


author: Scott Weaver <scweaver@redhat.com> [5.14.0-427.23.1.el9_4]
changelog:
  - net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context (Kamal Heib) [RHEL-34050 RHEL-30492] {CVE-2023-52626}
  - blk-mq: add helper for checking if one CPU is mapped to specified hctx (Ming Lei) [RHEL-38595 RHEL-36684]
  - net/sched: flower: Add lock protection when remove filter handle (Petr Oros) [RHEL-35672 RHEL-33379]
  - Bluetooth: Avoid potential use-after-free in hci_error_reset (David Marlin) [RHEL-33913 RHEL-31828] {CVE-2024-26801}
  - net: hns3: do not allow call hns3_nic_net_open repeatedly (Jose Ignacio Tornos Martinez) [RHEL-38933 RHEL-37707] {CVE-2021-47400}
  - tmpfs: fix Documentation of noswap and huge mount options (Nico Pache) [RHEL-38252 RHEL-31975]
  - shmem: add support to ignore swap (Chris von Recklinghausen) [RHEL-38252 RHEL-31975]
  - shmem: update documentation (Chris von Recklinghausen) [RHEL-38252 RHEL-31975]
  - shmem: skip page split if we're not reclaiming (Chris von Recklinghausen) [RHEL-38252 RHEL-31975]
  - shmem: move reclaim check early on writepages() (Chris von Recklinghausen) [RHEL-38252 RHEL-31975]
  - shmem: set shmem_writepage() variables early (Chris von Recklinghausen) [RHEL-38252 RHEL-31975]
  - shmem: remove check for folio lock on writepage() (Chris von Recklinghausen) [RHEL-38252 RHEL-31975]
  - ice: Add automatic VF reset on Tx MDD events (Petr Oros) [RHEL-39083 RHEL-36317]
  - net/ipv6: SKB symmetric hash should incorporate transport ports (Ivan Vecera) [RHEL-37641 RHEL-36218]
  - ipv6: sr: fix memleak in seg6_hmac_init_algo (Hangbin Liu) [RHEL-37669 RHEL-37511]
  - ipv6: sr: fix missing sk_buff release in seg6_input_core (Hangbin Liu) [RHEL-37669 RHEL-37511]
  - ipv6: sr: fix invalid unregister error path (Hangbin Liu) [RHEL-37669 RHEL-37511]
  - ipv6: sr: fix incorrect unregister order (Hangbin Liu) [RHEL-37669 RHEL-37511]
  - ipv6: sr: add missing seg6_local_exit (Hangbin Liu) [RHEL-37669 RHEL-37511]
  - block: fix q->blkg_list corruption during disk rebind (Ming Lei) [RHEL-36687 RHEL-33577]
  - ice: fix uninitialized dplls mutex usage (Petr Oros) [RHEL-36716 RHEL-36283]
  - ice: fix pin phase adjust updates on PF reset (Petr Oros) [RHEL-36716 RHEL-36283]
  - ice: fix dpll periodic work data updates on PF reset (Petr Oros) [RHEL-36716 RHEL-36283]
  - ice: fix dpll and dpll_pin data access on PF reset (Petr Oros) [RHEL-36716 RHEL-36283]
  - ice: fix dpll input pin phase_adjust value updates (Petr Oros) [RHEL-36716 RHEL-36283]
  - ice: fix connection state of DPLL and out pin (Petr Oros) [RHEL-36716 RHEL-36283]
  - redhat: remove the merge subtrees script (Derek Barbosa)
  - redhat: rhdocs: delete .get_maintainer.conf (Derek Barbosa)
  - redhat: rhdocs: Remove the rhdocs directory (Derek Barbosa)
  - net/mlx5: Properly link new fs rules into the tree (Kamal Heib) [RHEL-38954 RHEL-37422] {CVE-2024-35960}
  - smb: client: fix UAF in smb2_reconnect_server() (Jay Shin) [RHEL-28943 RHEL-40177 RHEL-37273 RHEL-7986] {CVE-2024-35870}
  - smb: client: remove extra @chan_count check in __cifs_put_smb_ses() (Jay Shin) [RHEL-28943 RHEL-31245]
  - RHEL: enable CONFIG_AMD_ATL (Aristeu Rozanski) [RHEL-36220 RHEL-26704]
  - EDAC/amd64: Use new AMD Address Translation Library (Aristeu Rozanski) [RHEL-36220 RHEL-26704]
  - RAS: Introduce AMD Address Translation Library (Aristeu Rozanski) [RHEL-36220 RHEL-26704]


author: Scott Weaver <scweaver@redhat.com> [5.14.0-427.24.1.el9_4]
changelog:
  - net/bnx2x: Prevent access to a freed page in page_pool (Michal Schmidt) [RHEL-43272 RHEL-23117]
  - bnx2x: new flag for track HW resource allocation (Michal Schmidt) [RHEL-43272 RHEL-23117]
  - bnx2x: fix page fault following EEH recovery (Michal Schmidt) [RHEL-43272 RHEL-23117]
  - bnx2x: fix pci device refcount leak in bnx2x_vf_is_pcie_pending() (Michal Schmidt) [RHEL-43272 RHEL-23117]
  - bnx2x: fix potential memory leak in bnx2x_tpa_stop() (Michal Schmidt) [RHEL-43272 RHEL-23117]
  - xen-netfront: Add missing skb_mark_for_recycle (Vitaly Kuznetsov) [RHEL-37626 RHEL-36573] {CVE-2024-27393}
  - tools/power/turbostat: Fix uncore frequency file string (David Arcari) [RHEL-34953 RHEL-29239]
  - tools/power turbostat: Expand probe_intel_uncore_frequency() (David Arcari) [RHEL-34953 RHEL-29239]
  - net/mlx5e: fix a potential double-free in fs_any_create_groups (Kamal Heib) [RHEL-38972 RHEL-37093] {CVE-2023-52667}
  - crypto: qat - Fix typo (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak (Vladis Dronov) [RHEL-38546 RHEL-35816] {CVE-2024-26974}
  - crypto: qat - specify firmware files for 402xx (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - validate slices count returned by FW (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - improve error logging to be consistent across features (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - improve error message in adf_get_arbiter_mapping() (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - implement dh fallback for primes > 4K (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - Fix spelling mistake "Invalide" -> "Invalid" (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - Avoid -Wflex-array-member-not-at-end warnings (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - implement interface for live migration (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - add interface for live migration (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - add bank save and restore flows (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - expand CSR operations for QAT GEN4 devices (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - rename get_sla_arr_of_type() (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - relocate CSR access code (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - move PFVF compat checker to a function (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - relocate and rename 4xxx PF2VM definitions (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - adf_get_etr_base() helper (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - redhat/configs: Add CONFIG_CRYPTO_DEV_QAT_420XX (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - make ring to service map common for QAT GEN4 (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - fix ring to service map for dcc in 420xx (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - fix ring to service map for dcc in 4xxx (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - fix comment structure (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - remove unnecessary description from comment (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - remove double initialization of value (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - avoid division by zero (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - removed unused macro in adf_cnv_dbgfs.c (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - remove unused macros in qat_comp_alg.c (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - uninitialized variable in adf_hb_error_inject_write() (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - Documentation: qat: fix auto_reset section (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - resolve race condition during AER recovery (Vladis Dronov) [RHEL-38546 RHEL-35816] {CVE-2024-26974}
  - crypto: qat - change SLAs cleanup flow at shutdown (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - improve aer error reset handling (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - limit heartbeat notifications (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - add auto reset on error (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - add fatal error notification (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - re-enable sriov after pf reset (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - update PFVF protocol for recovery (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - disable arbitration before reset (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - add fatal error notify method (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - add heartbeat error simulator (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - use kcalloc_node() instead of kzalloc_node() (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - avoid memcpy() overflow warning (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - fix arbiter mapping generation algorithm for QAT 402xx (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - generate dynamically arbiter mappings (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - add support for ring pair level telemetry (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - add support for device telemetry (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - add admin msgs for telemetry (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - include pci.h for GET_DEV() (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - add support for 420xx devices (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - move fw config related structures (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - relocate portions of qat_4xxx code (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - change signature of uof_get_num_objs() (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - crypto: qat - relocate and rename get_service_enabled() (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - seq_file: add helper macro to define attribute for rw file (Vladis Dronov) [RHEL-38546 RHEL-35816]
  - minmax: Introduce {min,max}_array() (Vladis Dronov) [RHEL-38546 RHEL-35816]


author: Scott Weaver <scweaver@redhat.com> [5.14.0-427.25.1.el9_4]
changelog:
  - nvme: fix reconnection fail due to reserved tag allocation (Maurizio Lombardi) [RHEL-42896 RHEL-36896] {CVE-2024-27435}
  - net: hns3: fix use-after-free bug in hclgevf_send_mbx_msg (cki-backport-bot) [RHEL-43625] {CVE-2021-47596}
  - scsi: sg: Avoid race in error handling & drop bogus warn (Ewan D. Milne) [RHEL-36106 RHEL-35659]
  - scsi: sg: Avoid sg device teardown race (Ewan D. Milne) [RHEL-36106 RHEL-35659]
  - netfilter: nf_tables: use timestamp to check for set element timeout (Florian Westphal) [RHEL-38032 RHEL-33985] {CVE-2024-27397}
  - netfilter: nft_set_rbtree: Remove unused variable nft_net (Florian Westphal) [RHEL-38032 RHEL-33985]
  - netfilter: nft_set_rbtree: prefer sync gc to async worker (Florian Westphal) [RHEL-38032 RHEL-33985]
  - netfilter: nft_set_rbtree: rename gc deactivate+erase function (Florian Westphal) [RHEL-38032 RHEL-33985]
  - netfilter: nf_tables: de-constify set commit ops function argument (Florian Westphal) [RHEL-38032 RHEL-33985]
  - octeontx2-af: avoid off-by-one read from userspace (Kamal Heib) [RHEL-40486 RHEL-39873] {CVE-2024-36957}


author: Scott Weaver <scweaver@redhat.com> [5.14.0-427.26.1.el9_4]
changelog:
  - net: ena: Fix incorrect descriptor free behavior (Kamal Heib) [RHEL-39217 RHEL-37430] {CVE-2024-35958}
  - tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). (Guillaume Nault) [RHEL-41749 RHEL-39837] {CVE-2024-36904}
  - mm/mglru: Revert "don't sync disk for each aging cycle" (Waiman Long) [RHEL-44418]
  - tipc: fix UAF in error path (Xin Long) [RHEL-34848 RHEL-34280] {CVE-2024-36886}
  - selftest/cgroup: Update test_cpuset_prs.sh to match changes (Waiman Long) [RHEL-45139]
  - cgroup/cpuset: Make cpuset.cpus.exclusive independent of cpuset.cpus (Waiman Long) [RHEL-45139]
  - cgroup/cpuset: Delay setting of CS_CPU_EXCLUSIVE until valid partition (Waiman Long) [RHEL-45139]
  - selftest/cgroup: Fix test_cpuset_prs.sh problems reported by test robot (Waiman Long) [RHEL-45139]
  - cgroup/cpuset: Fix remote root partition creation problem (Waiman Long) [RHEL-45139]
  - cgroup/cpuset: Optimize isolated partition only generate_sched_domains() calls (Waiman Long) [RHEL-45139]
  - cgroup/cpuset: Fix retval in update_cpumask() (Waiman Long) [RHEL-45139]
  - cgroup/cpuset: Fix a memory leak in update_exclusive_cpumask() (Waiman Long) [RHEL-45139]
  - ice: implement AQ download pkg retry (Petr Oros) [RHEL-38907 RHEL-17318]
  - redhat: include resolve_btfids in kernel-devel (Viktor Malik) [RHEL-43426 RHEL-40707]
  - blk-cgroup: fix list corruption from resetting io stat (cki-backport-bot) [RHEL-44977] {CVE-2024-38663}
  - misc: rtsx: do clear express reg every SD_INT (David Arcari) [RHEL-39985 RHEL-33706]
  - misc: rtsx: Fix rts5264 driver status incorrect when card removed (David Arcari) [RHEL-39985 RHEL-33706]
  - netfilter: tproxy: bail out if IP has been disabled on the device (cki-backport-bot) [RHEL-44371] {CVE-2024-36270}
  - lib/test_hmm.c: handle src_pfns and dst_pfns allocation failure (cki-backport-bot) [RHEL-44263 RHEL-44261] {CVE-2024-38543}
  - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (cki-backport-bot) [RHEL-44039] {CVE-2024-38586}
  - net: micrel: Fix receiving the timestamp in the frame for lan8841 (cki-backport-bot) [RHEL-43996] {CVE-2024-38593}
  - vt: fix memory overlapping when deleting chars in the buffer (Waiman Long) [RHEL-43379 RHEL-27780] {CVE-2022-48627}
  - net/mlx5e: Use a memory barrier to enforce PTP WQ xmit submission tracking occurs after populating the metadata_map (Kamal Heib) [RHEL-42728 RHEL-34192] {CVE-2024-26858}
  - locking/atomic: Make test_and_*_bit() ordered on failure (Paolo Bonzini) [RHEL-45896]
  - mm/vmscan: fix a bug calling wakeup_kswapd() with a wrong zone index (Rafael Aquini) [RHEL-42659 RHEL-31840] {CVE-2024-26783}
  - can: j1939: prevent deadlock by changing j1939_socks_lock to rwlock (Jose Ignacio Tornos Martinez) [RHEL-42379 RHEL-31530] {CVE-2023-52638}
  - ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() (Ken Cox) [RHEL-42226 RHEL-38715] {CVE-2021-47548}


author: Scott Weaver <scweaver@redhat.com> [5.14.0-427.27.1.el9_4]
changelog:
  - drm/ast: Fix soft lockup (CKI Backport Bot) [RHEL-45716]
  - dm: call the resume method on internal suspend (Benjamin Marzinski) [RHEL-41838 RHEL-33217] {CVE-2024-26880}
  - KVM: arm64: Do not re-initialize the KVM lock (Sebastian Ott) [RHEL-37528 RHEL-36279]
  - KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr() (Sebastian Ott) [RHEL-37528 RHEL-36279]
  - KVM: arm64: Fix host-programmed guest events in nVHE (Sebastian Ott) [RHEL-37528 RHEL-36279]
  - KVM: arm64: vgic-its: Test for valid IRQ in MOVALL handler (Sebastian Ott) [RHEL-37528 RHEL-36279]
  - KVM: arm64: vgic-its: Test for valid IRQ in its_sync_lpi_pending_table() (Sebastian Ott) [RHEL-37528 RHEL-36279]
  - KVM: arm64: Fix double-free following kvm_pgtable_stage2_free_unlinked() (Sebastian Ott) [RHEL-37528 RHEL-36279]
  - octeontx2-af: Use separate handlers for interrupts (Kamal Heib) [RHEL-42846 RHEL-35170] {CVE-2024-27030}
  - Squashfs: check the inode number is not the invalid value of zero (Abhi Das) [RHEL-42811 RHEL-35098] {CVE-2024-26982}
  - net: fix sk_memory_allocated_{add|sub} vs softirqs (Paolo Abeni) [RHEL-36773 RHEL-34070]
  - tcp: sk_forced_mem_schedule() optimization (Paolo Abeni) [RHEL-36773 RHEL-34070]
  - net: make SK_MEMORY_PCPU_RESERV tunable (Paolo Abeni) [RHEL-36773 RHEL-34070]
  - ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() (Pavel Reichl) [RHEL-42655 RHEL-31690] {CVE-2024-26773}
  - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (John Meneghini) [RHEL-42528 RHEL-38200] {CVE-2023-52809}
  - KVM: x86/mmu: Retry fault before acquiring mmu_lock if mapping is changing (Maxim Levitsky) [RHEL-43388]
  - s390/cpum_cf: make crypto counters upward compatible across machine types (Tobias Huschle) [RHEL-40398 RHEL-36047]
  - RAS: enable CONFIG_RAS_FMPM (Aristeu Rozanski) [RHEL-36212 RHEL-17008]
  - RAS: Avoid build errors when CONFIG_DEBUG_FS=n (Aristeu Rozanski) [RHEL-36212 RHEL-17008]
  - RAS/AMD/FMPM: Safely handle saved records of various sizes (Aristeu Rozanski) [RHEL-36212 RHEL-17008]
  - RAS/AMD/FMPM: Avoid NULL ptr deref in get_saved_records() (Aristeu Rozanski) [RHEL-36212 RHEL-17008]
  - Merge tag 'edac_updates_for_v6.9' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras (Aristeu Rozanski) [RHEL-36212 RHEL-17008]
  - RAS/AMD/FMPM: Fix off by one when unwinding on error (Aristeu Rozanski) [RHEL-36212 RHEL-17008]
  - RAS/AMD/FMPM: Add debugfs interface to print record entries (Aristeu Rozanski) [RHEL-36212 RHEL-17008]
  - RAS/AMD/FMPM: Save SPA values (Aristeu Rozanski) [RHEL-36212 RHEL-17008]
  - RAS: Export helper to get ras_debugfs_dir (Aristeu Rozanski) [RHEL-36212 RHEL-17008]
  - RAS/AMD/ATL: Fix bit overflow in denorm_addr_df4_np2() (Aristeu Rozanski) [RHEL-36212 RHEL-17008]
  - RAS: Introduce a FRU memory poison manager (Aristeu Rozanski) [RHEL-36212 RHEL-17008]
  - x86/cpu/amd: Provide a separate accessor for Node ID (Aristeu Rozanski) [RHEL-36212 RHEL-17008]
  - RAS/AMD/ATL: Add MI300 row retirement support (Aristeu Rozanski) [RHEL-36212 RHEL-17008]
  - Documentation: Move RAS section to admin-guide (Aristeu Rozanski) [RHEL-36212 RHEL-17008]
  - RAS/AMD/ATL: Add MI300 DRAM to normalized address translation support (Aristeu Rozanski) [RHEL-36212 RHEL-17008]
  - RAS/AMD/ATL: Fix array overflow in get_logical_coh_st_fabric_id_mi300() (Aristeu Rozanski) [RHEL-36212 RHEL-17008]
  - RAS/AMD/ATL: Add MI300 support (Aristeu Rozanski) [RHEL-36212 RHEL-17008]
  - Documentation: RAS: Add index and address translation section (Aristeu Rozanski) [RHEL-36212 RHEL-17008]
  - cpu/SMT: Make SMT control more robust against enumeration failures (Aristeu Rozanski) [RHEL-36212 RHEL-17008]


author: Scott Weaver <scweaver@redhat.com> [5.14.0-427.28.1.el9_4]
changelog:
  - mlxbf_gige: call request_irq() after NAPI initialized (Kamal Heib) [RHEL-43012 RHEL-37179] {CVE-2024-35907}
  - mlxbf_gige: stop PHY during open() error paths (Kamal Heib) [RHEL-43012 RHEL-37179] {CVE-2024-35907}
  - mlxbf_gige: stop interface during shutdown (Kamal Heib) [RHEL-41708 RHEL-37244] {CVE-2024-35885}
  - net: amd-xgbe: Fix skb data length underflow (Ken Cox) [RHEL-43796 RHEL-43794] {CVE-2022-48743}
  - nfp: flower: handle acti_netdevs allocation failure (Ken Cox) [RHEL-42852 RHEL-35158] {CVE-2024-27046}
  - block: add check that partition length needs to be aligned with block size (Ming Lei) [RHEL-45501 RHEL-26616] {CVE-2023-52458}
  - nfsd: hold a lighter-weight client reference over CB_RECALL_ANY (Benjamin Coddington) [RHEL-45517 RHEL-31513]
  - NFSD: CREATE_SESSION must never cache NFS4ERR_DELAY replies (Benjamin Coddington) [RHEL-45517 RHEL-31513]
  - NFSD: Document the phases of CREATE_SESSION (Benjamin Coddington) [RHEL-45517 RHEL-31513]
  - NFSD: Fix the NFSv4.1 CREATE_SESSION operation (Benjamin Coddington) [RHEL-45517 RHEL-31513]
  - icmp: prevent possible NULL dereferences from icmp_build_probe() (Antoine Tenart) [RHEL-42974 RHEL-37002] {CVE-2024-35857}
  - NFSv4.1: fix handling NFS4ERR_DELAY when testing for session trunking (Scott Mayhew) [RHEL-45360 RHEL-24133]
  - RAS/AMD/ATL: Use system settings for MI300 DRAM to normalized address translation (Aristeu Rozanski) [RHEL-46335 RHEL-38634]
  - RAS/AMD/ATL: Fix MI300 bank hash (Aristeu Rozanski) [RHEL-46335 RHEL-38634]
  - net/ipv6: avoid possible UAF in ip6_route_mpath_notify() (Hangbin Liu) [RHEL-42689 RHEL-33271] {CVE-2024-26852}
  - epoll: be better about file lifetimes (Pavel Reichl) [RHEL-44091 RHEL-44083] {CVE-2024-38580}
  - scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (Dick Kennedy) [RHEL-40659 RHEL-40665 RHEL-24508 RHEL-39793] {CVE-2024-36924}
  - scsi: lpfc: Move NPIV's transport unregistration to after resource clean up (Dick Kennedy) [RHEL-40659 RHEL-40669 RHEL-24508 RHEL-39887] {CVE-2024-36952}
  - bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel (Viktor Malik) [RHEL-42640 RHEL-31726] {CVE-2024-26737}
  - can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv (Ken Cox) [RHEL-41489 RHEL-38415] {CVE-2021-47459}
  - wifi: ath11k: restore country code during resume (Jose Ignacio Tornos Martinez) [RHEL-46230 RHEL-12349]
  - wifi: ath11k: refactor setting country code logic (Jose Ignacio Tornos Martinez) [RHEL-46230 RHEL-12349]
  - bus: mhi: host: Add mhi_power_down_keep_dev() API to support system suspend/hibernation (Jose Ignacio Tornos Martinez) [RHEL-46230 RHEL-12349]
  - net: qrtr: support suspend/hibernation (Jose Ignacio Tornos Martinez) [RHEL-46230 RHEL-12349]
  - wifi: ath11k: support hibernation (Jose Ignacio Tornos Martinez) [RHEL-46230 RHEL-12349]
  - wifi: ath11k: thermal: don't try to register multiple times (Jose Ignacio Tornos Martinez) [RHEL-46230 RHEL-12349]
  - wifi: ath11k: fix warning on DMA ring capabilities event (Jose Ignacio Tornos Martinez) [RHEL-46230 RHEL-12349]
  - wifi: ath11k: do not dump SRNG statistics during resume (Jose Ignacio Tornos Martinez) [RHEL-46230 RHEL-12349]
  - wifi: ath11k: remove MHI LOOPBACK channels (Jose Ignacio Tornos Martinez) [RHEL-46230 RHEL-12349]
  - wifi: ath11k: rearrange IRQ enable/disable in reset path (Jose Ignacio Tornos Martinez) [RHEL-46230 RHEL-12349]


author: Scott Weaver <scweaver@redhat.com> [5.14.0-427.29.1.el9_4]
changelog:
  - net: Avoid address overwrite in kernel_connect (Davide Caratti) [RHEL-45728 RHEL-30875]
  - net: replace calls to sock->ops->connect() with kernel_connect() (Davide Caratti) [RHEL-45728 RHEL-33410]
  - i40e: fix vf may be used uninitialized in this function warning (Kamal Heib) [RHEL-41638 RHEL-39704] {CVE-2024-36020}
  - cifs: translate network errors on send to -ECONNABORTED (Jay Shin) [RHEL-47047 RHEL-31245]
  - wifi: brcmfmac: pcie: handle randbuf allocation failure (Jose Ignacio Tornos Martinez) [RHEL-44132] {CVE-2024-38575}
  - wifi: iwlwifi: mvm: guard against invalid STA ID on removal (Jose Ignacio Tornos Martinez) [RHEL-43208 RHEL-39803] {CVE-2024-36921}
  - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes (Jose Ignacio Tornos Martinez) [RHEL-42906 RHEL-36809] {CVE-2024-35789}
  - wifi: iwlwifi: mvm: don't set the MFP flag for the GTK (Jose Ignacio Tornos Martinez) [RHEL-42886 RHEL-36900] {CVE-2024-27434}
  - wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work (Jose Ignacio Tornos Martinez) [RHEL-42860 RHEL-35142] {CVE-2024-27052}
  - wifi: mt76: mt7925e: fix use-after-free in free_irq() (Jose Ignacio Tornos Martinez) [RHEL-42856 RHEL-35148] {CVE-2024-27049}
  - wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete (Jose Ignacio Tornos Martinez) [RHEL-42743 RHEL-34187] {CVE-2024-26897}
  - wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() (Jose Ignacio Tornos Martinez) [RHEL-42383 RHEL-35199] {CVE-2023-52651}
  - net: core: reject skb_copy(_expand) for fraglist GSO skbs (Xin Long) [RHEL-41402 RHEL-39781] {CVE-2024-36929}


author: Scott Weaver <scweaver@redhat.com> [5.14.0-427.30.1.el9_4]
changelog:
  - dmaengine: idxd: add a write() method for applications to submit work (Jerry Snitselaar) [RHEL-35840] {CVE-2024-21823}
  - dmaengine: idxd: add a new security check to deal with a hardware erratum (Jerry Snitselaar) [RHEL-35840] {CVE-2024-21823}
  - VFIO: Add the SPR_DSA and SPR_IAX devices to the denylist (Jerry Snitselaar) [RHEL-35840] {CVE-2024-21823}
  - tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer buffer (Mark Salter) [RHEL-49538 RHEL-39308]
  - virtio: delete vq in vp_find_vqs_msix() when request_irq() fails (Jon Maloy) [RHEL-44467] {CVE-2024-37353}
  - phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP (Izabela Bakollari) [RHEL-36271 RHEL-26682] {CVE-2024-26600}
  - eeprom: at24: fix memory corruption race condition (CKI Backport Bot) [RHEL-42970] {CVE-2024-35848}
  - eeprom: at24: Probe for DDR3 thermal sensor in the SPD case (CKI Backport Bot) [RHEL-42970] {CVE-2024-35848}
  - eeprom: at24: Use dev_err_probe for nvmem register failure (CKI Backport Bot) [RHEL-42970] {CVE-2024-35848}
  - eeprom: at24: Add support for 24c1025 EEPROM (CKI Backport Bot) [RHEL-42970] {CVE-2024-35848}
  - eeprom: at24: remove struct at24_client (CKI Backport Bot) [RHEL-42970] {CVE-2024-35848}
  - at24: Support probing while in non-zero ACPI D state (CKI Backport Bot) [RHEL-42970] {CVE-2024-35848}
  - tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). (CKI Backport Bot) [RHEL-44439] {CVE-2024-37356}
  - cxl/region: Fix cxlr_pmem leaks (cki-backport-bot) [RHEL-44486] {CVE-2024-38391}
  - tls: fix missing memory barrier in tls_init (cki-backport-bot) [RHEL-44480] {CVE-2024-36489}
  - igc: avoid returning frame twice in XDP_REDIRECT (Corinna Vinschen) [RHEL-42714 RHEL-33266] {CVE-2024-26853}
  - ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound (Hangbin Liu) [RHEL-44404 RHEL-44402] {CVE-2024-33621}
  - ipvlan: add ipvlan_route_v6_outbound() helper (Davide Caratti) [RHEL-44404 RHEL-32205]
  - ipvlan: properly track tx_errors (Davide Caratti) [RHEL-44404 RHEL-32205]
  - wifi: nl80211: don't free NULL coalescing rule (Jose Ignacio Tornos Martinez) [RHEL-41698 RHEL-39754] {CVE-2024-36941}
  - wifi: iwlwifi: dbg-tlv: ensure NUL termination (Jose Ignacio Tornos Martinez) [RHEL-41658 RHEL-37028] {CVE-2024-35845}
  - mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work (Ivan Vecera) [RHEL-41556 RHEL-37018] {CVE-2024-35852}
  - net: openvswitch: fix overwriting ct original tuple for ICMPv6 (cki-backport-bot) [RHEL-44215] {CVE-2024-38558}
  - wifi: iwlwifi: read txq->read_ptr under lock (Jose Ignacio Tornos Martinez) [RHEL-41520 RHEL-39799] {CVE-2024-36922}
  - wifi: cfg80211: check A-MSDU format more carefully (Jose Ignacio Tornos Martinez) [RHEL-38754 RHEL-37345] {CVE-2024-35937}
  - ice: fix memory corruption bug with suspend and rebuild (Petr Oros) [RHEL-49858 RHEL-17486] {CVE-2024-35911}
  - ipv6: prevent possible NULL deref in fib6_nh_init() (Hangbin Liu) [RHEL-48182 RHEL-45826] {CVE-2024-40961}
  - netns: Make get_net_ns() handle zero refcount net (Paolo Abeni) [RHEL-48117 RHEL-46610] {CVE-2024-40958}
  - net: do not leave a dangling sk pointer, when socket creation fails (Paolo Abeni) [RHEL-48072 RHEL-46610] {CVE-2024-40954}
  - net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool() (CKI Backport Bot) [RHEL-47902] {CVE-2024-40928}
  - net: netlink: af_netlink: Prevent empty skb by adding a check on len. (Ivan Vecera) [RHEL-43619 RHEL-30344] {CVE-2021-47606}
  - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (CKI Backport Bot) [RHEL-46921] {CVE-2024-39487}
  - nfs: fix panic when nfs4_ff_layout_prepare_ds() fails (Benjamin Coddington) [RHEL-42732 RHEL-34875] {CVE-2024-26868}
  - efi: fix panic in kdump kernel (Steve Best) [RHEL-42920 RHEL-36998] {CVE-2024-35800}
  - ipv6: fix potential "struct net" leak in inet6_rtm_getaddr() (Hangbin Liu) [RHEL-41735 RHEL-31050] {CVE-2024-27417}
  - netfilter: nf_tables: do not compare internal table flags on updates (Florian Westphal) [RHEL-41682 RHEL-33985] {CVE-2024-27065}
  - ipv6: Fix potential uninit-value access in __ip6_make_skb() (Antoine Tenart) [RHEL-41466 RHEL-39786] {CVE-2024-36903}
  - netfilter: nf_tables: honor table dormant flag from netdev release event path (Florian Westphal) [RHEL-40056 RHEL-33985] {CVE-2024-36005}
  - cifs: fix underflow in parse_server_interfaces() (Paulo Alcantara) [RHEL-34636 RHEL-31245] {CVE-2024-26828}
  - drm/i915/audio: Fix audio time stamp programming for DP (CKI Backport Bot) [RHEL-45843]
  - platform/x86: wmi: Fix opening of char device (David Arcari) [RHEL-42548 RHEL-38260] {CVE-2023-52864}
  - platform/x86: wmi: remove unnecessary initializations (David Arcari) [RHEL-42548 RHEL-38260] {CVE-2023-52864}
  - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation (CKI Backport Bot) [RHEL-43170] {CVE-2024-36017}
  - netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain (Florian Westphal) [RHEL-40062 RHEL-33985] {CVE-2024-26808}
  - ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr (Jiri Benc) [RHEL-39017 RHEL-32372] {CVE-2024-35969}
  - netfilter: nf_tables: flush pending destroy work before exit_net release (Florian Westphal) [RHEL-38765 RHEL-33985] {CVE-2024-35899}
  - vt: fix unicode buffer corruption when deleting characters (Andrew Halaney) [RHEL-42947 RHEL-24205] {CVE-2024-35823}


author: Scott Weaver <scweaver@redhat.com> [5.14.0-427.31.1.el9_4]
changelog:
  - net: fix __dst_negative_advice() race (CKI Backport Bot) [RHEL-46798] {CVE-2024-36971}
  - net: annotate data-races around sk->sk_dst_pending_confirm (CKI Backport Bot) [RHEL-46798] {CVE-2024-36971}


author: Alexey Tikhonov <atikhono@redhat.com> - 1.17.1-5
changelog:
  - Resolves: rhbz#2014523 - c-ares: missing input validation of host names may lead to Domain Hijacking [rhel-9]


author: Alexey Tikhonov <atikhono@redhat.com> - 1.17.1-6
changelog:
  - Resolves: rhbz#2170868 - c-ares: buffer overflow in config_sortlist() due to missing string length check [rhel-9]


author: Alexey Tikhonov <atikhono@redhat.com> - 1.19.1-1
changelog:
  - Resolves: rhbz#2209564 - CVE-2023-31124 c-ares: AutoTools does not set CARES_RANDOM_FILE during cross compilation [rhel-9]
  - Resolves: rhbz#2209556 - CVE-2023-31130 c-ares: Buffer Underwrite in ares_inet_net_pton() [rhel-9]
  - Resolves: rhbz#2209550 - CVE-2023-31147 c-ares: Insufficient randomness in generation of DNS query IDs [rhel-9]
  - Resolves: rhbz#2209520 - CVE-2023-32067 c-ares: 0-byte UDP payload Denial of Service [rhel-9.3.0]
  - Resolves: rhbz#2210370 - Rebase c-ares for RHEL 9.3


author: Bob Relyea <rrelyea@redhat.com> - 2022.2.54-90.0
changelog:
  - Update to CKBI 2.54 from NSS 3.79
  -    Removing:
  -     # Certificate "GlobalSign Root CA - R2"
  -     # Certificate "DST Root CA X3"
  -     # Certificate "Explicitly Distrusted DigiNotar PKIoverheid G2"
  -    Adding:
  -     # Certificate "TunTrust Root CA"
  -     # Certificate "HARICA TLS RSA Root CA 2021"
  -     # Certificate "HARICA TLS ECC Root CA 2021"
  -     # Certificate "HARICA Client RSA Root CA 2021"
  -     # Certificate "HARICA Client ECC Root CA 2021"
  -     # Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068"
  -     # Certificate "vTrus ECC Root CA"
  -     # Certificate "vTrus Root CA"
  -     # Certificate "ISRG Root X2"
  -     # Certificate "HiPKI Root CA - G1"
  -     # Certificate "Telia Root CA v2"
  -     # Certificate "D-TRUST BR Root CA 1 2020"
  -     # Certificate "D-TRUST EV Root CA 1 2020"
  -     # Certificate "CAEDICOM Root"
  -     # Certificate "I.CA Root CA/RSA"
  -     # Certificate "MULTICERT Root Certification Authority 01"
  -     # Certificate "Certification Authority of WoSign G2"
  -     # Certificate "CA WoSign ECC Root"
  -     # Certificate "CCA India 2015 SPL"
  -     # Certificate "Swedish Government Root Authority v3"
  -     # Certificate "Swedish Government Root Authority v2"
  -     # Certificate "Tunisian Root Certificate Authority - TunRootCA2"
  -     # Certificate "OpenTrust Root CA G1"
  -     # Certificate "OpenTrust Root CA G2"
  -     # Certificate "OpenTrust Root CA G3"
  -     # Certificate "Certplus Root CA G1"
  -     # Certificate "Certplus Root CA G2"
  -     # Certificate "Government Root Certification Authority"
  -     # Certificate "A-Trust-Qual-02"
  -     # Certificate "Thailand National Root Certification Authority - G1"
  -     # Certificate "TrustCor ECA-1"
  -     # Certificate "TrustCor RootCert CA-2"
  -     # Certificate "TrustCor RootCert CA-1"
  -     # Certificate "Certification Authority of WoSign"
  -     # Certificate "CA 沃通根证书"
  -     # Certificate "SSC GDL CA Root B"
  -     # Certificate "SAPO Class 2 Root CA"
  -     # Certificate "SAPO Class 3 Root CA"
  -     # Certificate "SAPO Class 4 Root CA"
  -     # Certificate "CA Disig Root R1"
  -     # Certificate "Autoridad Certificadora Raíz Nacional de Uruguay"
  -     # Certificate "ApplicationCA2 Root"
  -     # Certificate "GlobalSign"
  -     # Certificate "Symantec Class 3 Public Primary Certification Authority - G6"
  -     # Certificate "Symantec Class 3 Public Primary Certification Authority - G4"
  -     # Certificate "Halcom Root CA"
  -     # Certificate "Swisscom Root EV CA 2"
  -     # Certificate "CFCA GT CA"
  -     # Certificate "Digidentity L3 Root CA - G2"
  -     # Certificate "SITHS Root CA v1"
  -     # Certificate "Macao Post eSignTrust Root Certification Authority (G02)"
  -     # Certificate "Autoridade Certificadora Raiz Brasileira v2"
  -     # Certificate "Swisscom Root CA 2"
  -     # Certificate "IGC/A AC racine Etat francais"
  -     # Certificate "PersonalID Trustworthy RootCA 2011"
  -     # Certificate "Swedish Government Root Authority v1"
  -     # Certificate "Swiss Government Root CA II"
  -     # Certificate "Swiss Government Root CA I"
  -     # Certificate "Network Solutions Certificate Authority"
  -     # Certificate "COMODO Certification Authority"
  -     # Certificate "LuxTrust Global Root"
  -     # Certificate "AC1 RAIZ MTIN"
  -     # Certificate "Microsoft Root Certificate Authority 2011"
  -     # Certificate "CCA India 2011"
  -     # Certificate "ANCERT Certificados Notariales V2"
  -     # Certificate "ANCERT Certificados CGN V2"
  -     # Certificate "EE Certification Centre Root CA"
  -     # Certificate "DigiNotar Root CA G2"
  -     # Certificate "Federal Common Policy CA"
  -     # Certificate "Autoridad de Certificacion Raiz del Estado Venezolano"
  -     # Certificate "Autoridad de Certificacion Raiz del Estado Venezolano"
  -     # Certificate "China Internet Network Information Center EV Certificates Root"
  -     # Certificate "Verizon Global Root CA"
  -     # Certificate "SwissSign Silver Root CA - G3"
  -     # Certificate "SwissSign Platinum Root CA - G3"
  -     # Certificate "SwissSign Gold Root CA - G3"
  -     # Certificate "Microsec e-Szigno Root CA 2009"
  -     # Certificate "SITHS CA v3"
  -     # Certificate "Certinomis - Autorité Racine"
  -     # Certificate "ANF Server CA"
  -     # Certificate "Thawte Premium Server CA"
  -     # Certificate "Thawte Server CA"
  -     # Certificate "TC TrustCenter Universal CA III"
  -     # Certificate "KEYNECTIS ROOT CA"
  -     # Certificate "I.CA - Standard Certification Authority, 09/2009"
  -     # Certificate "I.CA - Qualified Certification Authority, 09/2009"
  -     # Certificate "VI Registru Centras RCSC (RootCA)"
  -     # Certificate "CCA India 2007"
  -     # Certificate "Autoridade Certificadora Raiz Brasileira v1"
  -     # Certificate "ipsCA Global CA Root"
  -     # Certificate "ipsCA Main CA Root"
  -     # Certificate "Actalis Authentication CA G1"
  -     # Certificate "A-Trust-Qual-03"
  -     # Certificate "AddTrust External CA Root"
  -     # Certificate "ECRaizEstado"
  -     # Certificate "Configuration"
  -     # Certificate "FNMT-RCM"
  -     # Certificate "StartCom Certification Authority"
  -     # Certificate "TWCA Root Certification Authority"
  -     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G4"
  -     # Certificate "thawte Primary Root CA - G2"
  -     # Certificate "GeoTrust Primary Certification Authority - G2"
  -     # Certificate "VeriSign Universal Root Certification Authority"
  -     # Certificate "thawte Primary Root CA - G3"
  -     # Certificate "GeoTrust Primary Certification Authority - G3"
  -     # Certificate "E-ME SSI (RCA)"
  -     # Certificate "ACEDICOM Root"
  -     # Certificate "Autoridad Certificadora Raiz de la Secretaria de Economia"
  -     # Certificate "Correo Uruguayo - Root CA"
  -     # Certificate "CNNIC ROOT"
  -     # Certificate "Common Policy"
  -     # Certificate "Macao Post eSignTrust Root Certification Authority"
  -     # Certificate "Staat der Nederlanden Root CA - G2"
  -     # Certificate "NetLock Platina (Class Platinum) Főtanúsítvány"
  -     # Certificate "AC Raíz Certicámara S.A."
  -     # Certificate "Cisco Root CA 2048"
  -     # Certificate "CA Disig"
  -     # Certificate "InfoNotary CSP Root"
  -     # Certificate "UCA Global Root"
  -     # Certificate "UCA Root"
  -     # Certificate "DigiNotar Root CA"
  -     # Certificate "Starfield Services Root Certificate Authority"
  -     # Certificate "I.CA - Qualified root certificate"
  -     # Certificate "I.CA - Standard root certificate"
  -     # Certificate "e-Guven Kok Elektronik Sertifika Hizmet Saglayicisi"
  -     # Certificate "Japanese Government"
  -     # Certificate "AdminCA-CD-T01"
  -     # Certificate "Admin-Root-CA"
  -     # Certificate "Izenpe.com"
  -     # Certificate "TÜBİTAK UEKAE Kök Sertifika Hizmet Sağlayıcısı - Sürüm 3"
  -     # Certificate "Halcom CA FO"
  -     # Certificate "Halcom CA PO 2"
  -     # Certificate "Root CA"
  -     # Certificate "GPKIRootCA"
  -     # Certificate "ACNLB"
  -     # Certificate "state-institutions"
  -     # Certificate "state-institutions"
  -     # Certificate "SECOM Trust Systems CO.,LTD."
  -     # Certificate "D-TRUST Qualified Root CA 1 2007:PN"
  -     # Certificate "D-TRUST Root Class 2 CA 2007"
  -     # Certificate "D-TRUST Root Class 3 CA 2007"
  -     # Certificate "SSC Root CA A"
  -     # Certificate "SSC Root CA B"
  -     # Certificate "SSC Root CA C"
  -     # Certificate "Autoridad de Certificacion de la Abogacia"
  -     # Certificate "Root CA Generalitat Valenciana"
  -     # Certificate "VAS Latvijas Pasts SSI(RCA)"
  -     # Certificate "ANCERT Certificados CGN"
  -     # Certificate "ANCERT Certificados Notariales"
  -     # Certificate "ANCERT Corporaciones de Derecho Publico"
  -     # Certificate "GLOBALTRUST"
  -     # Certificate "Certipost E-Trust TOP Root CA"
  -     # Certificate "Certipost E-Trust Primary Qualified CA"
  -     # Certificate "Certipost E-Trust Primary Normalised CA"
  -     # Certificate "GlobalSign"
  -     # Certificate "IGC/A"
  -     # Certificate "S-TRUST Authentication and Encryption Root CA 2005:PN"
  -     # Certificate "TC TrustCenter Universal CA I"
  -     # Certificate "TC TrustCenter Universal CA II"
  -     # Certificate "TC TrustCenter Class 2 CA II"
  -     # Certificate "TC TrustCenter Class 4 CA II"
  -     # Certificate "Swisscom Root CA 1"
  -     # Certificate "Microsec e-Szigno Root CA"
  -     # Certificate "LGPKI"
  -     # Certificate "AC RAIZ DNIE"
  -     # Certificate "Common Policy"
  -     # Certificate "TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı"
  -     # Certificate "A-Trust-nQual-03"
  -     # Certificate "A-Trust-nQual-03"
  -     # Certificate "CertRSA01"
  -     # Certificate "KISA RootCA 1"
  -     # Certificate "KISA RootCA 3"
  -     # Certificate "NetLock Minositett Kozjegyzoi (Class QA) Tanusitvanykiado"
  -     # Certificate "A-CERT ADVANCED"
  -     # Certificate "A-Trust-Qual-01"
  -     # Certificate "A-Trust-nQual-01"
  -     # Certificate "A-Trust-Qual-02"
  -     # Certificate "Staat der Nederlanden Root CA"
  -     # Certificate "Serasa Certificate Authority II"
  -     # Certificate "TDC Internet"
  -     # Certificate "America Online Root Certification Authority 2"
  -     # Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068"
  -     # Certificate "Government Root Certification Authority"
  -     # Certificate "RSA Security Inc"
  -     # Certificate "Public Notary Root"
  -     # Certificate "GeoTrust Global CA"
  -     # Certificate "GeoTrust Global CA 2"
  -     # Certificate "GeoTrust Universal CA"
  -     # Certificate "GeoTrust Universal CA 2"
  -     # Certificate "QuoVadis Root Certification Authority"
  -     # Certificate "Autoridade Certificadora Raiz Brasileira"
  -     # Certificate "Post.Trust Root CA"
  -     # Certificate "Microsoft Root Authority"
  -     # Certificate "Microsoft Root Certificate Authority"
  -     # Certificate "Microsoft Root Certificate Authority 2010"
  -     # Certificate "Entrust.net Secure Server Certification Authority"
  -     # Certificate "UTN-USERFirst-Object"
  -     # Certificate "BYTE Root Certification Authority 001"
  -     # Certificate "CISRCA1"
  -     # Certificate "ePKI Root Certification Authority - G2"
  -     # Certificate "ePKI EV SSL Certification Authority - G1"
  -     # Certificate "AC Raíz Certicámara S.A."
  -     # Certificate "SSL.com EV Root Certification Authority RSA"
  -     # Certificate "LuxTrust Global Root 2"
  -     # Certificate "ACA ROOT"
  -     # Certificate "Security Communication ECC RootCA1"
  -     # Certificate "Security Communication RootCA3"
  -     # Certificate "CHAMBERS OF COMMERCE ROOT - 2016"
  -     # Certificate "Network Solutions RSA Certificate Authority"
  -     # Certificate "Network Solutions ECC Certificate Authority"
  -     # Certificate "Australian Defence Public Root CA"
  -     # Certificate "SI-TRUST Root"
  -     # Certificate "Halcom Root Certificate Authority"
  -     # Certificate "Application CA G3 Root"
  -     # Certificate "GLOBALTRUST 2015"
  -     # Certificate "Microsoft ECC Product Root Certificate Authority 2018"
  -     # Certificate "emSign Root CA - G2"
  -     # Certificate "emSign Root CA - C2"
  -     # Certificate "Microsoft ECC TS Root Certificate Authority 2018"
  -     # Certificate "DigiCert CS ECC P384 Root G5"
  -     # Certificate "DigiCert CS RSA4096 Root G5"
  -     # Certificate "DigiCert RSA4096 Root G5"
  -     # Certificate "DigiCert ECC P384 Root G5"
  -     # Certificate "HARICA Code Signing RSA Root CA 2021"
  -     # Certificate "HARICA Code Signing ECC Root CA 2021"
  -     # Certificate "Microsoft Identity Verification Root Certificate Authority 2020"


author: Bob Relyea <rrelyea@redhat.com> - 2022.2.54-90.2
changelog:
  - Update to CKBI 2.54 from NSS 3.79
  -    Removing:
  -     # Certificate "TrustCor ECA-1"
  -     # Certificate "TrustCor RootCert CA-2"
  -     # Certificate "TrustCor RootCert CA-1"
  -     # Certificate "Network Solutions Certificate Authority"
  -     # Certificate "COMODO Certification Authority"
  -     # Certificate "Autoridad de Certificacion Raiz del Estado Venezolano"
  -     # Certificate "Microsec e-Szigno Root CA 2009"
  -     # Certificate "TWCA Root Certification Authority"
  -     # Certificate "Izenpe.com"
  -     # Certificate "state-institutions"
  -     # Certificate "GlobalSign"
  -     # Certificate "Common Policy"
  -     # Certificate "A-Trust-nQual-03"
  -     # Certificate "A-Trust-Qual-02"
  -     # Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068"
  -     # Certificate "Government Root Certification Authority"
  -     # Certificate "AC Raíz Certicámara S.A."


author: Robert Relyea <rrelyea@redhat.com> - 2023.2.60_v7.0.306-90.0
changelog:
  - Update to CKBI 2.60_v7.0.306 from NSS 3.91
  -    Removing:
  -     # Certificate "Camerfirma Global Chambersign Root"
  -     # Certificate "Staat der Nederlanden EV Root CA"
  -     # Certificate "OpenTrust Root CA G1"
  -     # Certificate "Swedish Government Root Authority v1"
  -     # Certificate "DigiNotar Root CA G2"
  -     # Certificate "Federal Common Policy CA"
  -     # Certificate "TC TrustCenter Universal CA III"
  -     # Certificate "CCA India 2007"
  -     # Certificate "ipsCA Global CA Root"
  -     # Certificate "ipsCA Main CA Root"
  -     # Certificate "Macao Post eSignTrust Root Certification Authority"
  -     # Certificate "InfoNotary CSP Root"
  -     # Certificate "DigiNotar Root CA"
  -     # Certificate "Root CA"
  -     # Certificate "GPKIRootCA"
  -     # Certificate "D-TRUST Qualified Root CA 1 2007:PN"
  -     # Certificate "TC TrustCenter Universal CA I"
  -     # Certificate "TC TrustCenter Universal CA II"
  -     # Certificate "TC TrustCenter Class 2 CA II"
  -     # Certificate "TC TrustCenter Class 4 CA II"
  -     # Certificate "TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı"
  -     # Certificate "CertRSA01"
  -     # Certificate "KISA RootCA 3"
  -     # Certificate "A-CERT ADVANCED"
  -     # Certificate "A-Trust-Qual-01"
  -     # Certificate "A-Trust-nQual-01"
  -     # Certificate "Serasa Certificate Authority II"
  -     # Certificate "TDC Internet"
  -     # Certificate "America Online Root Certification Authority 2"
  -     # Certificate "RSA Security Inc"
  -     # Certificate "Public Notary Root"
  -     # Certificate "Autoridade Certificadora Raiz Brasileira"
  -     # Certificate "Post.Trust Root CA"
  -     # Certificate "Entrust.net Secure Server Certification Authority"
  -     # Certificate "ePKI EV SSL Certification Authority - G1"
  -    Adding:
  -     # Certificate "DigiCert TLS ECC P384 Root G5"
  -     # Certificate "DigiCert TLS RSA4096 Root G5"
  -     # Certificate "DigiCert SMIME ECC P384 Root G5"
  -     # Certificate "DigiCert SMIME RSA4096 Root G5"
  -     # Certificate "Certainly Root R1"
  -     # Certificate "Certainly Root E1"
  -     # Certificate "E-Tugra Global Root CA RSA v3"
  -     # Certificate "E-Tugra Global Root CA ECC v3"
  -     # Certificate "DIGITALSIGN GLOBAL ROOT RSA CA"
  -     # Certificate "DIGITALSIGN GLOBAL ROOT ECDSA CA"
  -     # Certificate "BJCA Global Root CA1"
  -     # Certificate "BJCA Global Root CA2"
  -     # Certificate "Symantec Enterprise Mobile Root for Microsoft"
  -     # Certificate "A-Trust-Root-05"
  -     # Certificate "ADOCA02"
  -     # Certificate "StartCom Certification Authority G2"
  -     # Certificate "ATHEX Root CA"
  -     # Certificate "EBG Elektronik Sertifika Hizmet Sağlayıcısı"
  -     # Certificate "GeoTrust Primary Certification Authority"
  -     # Certificate "thawte Primary Root CA"
  -     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G5"
  -     # Certificate "America Online Root Certification Authority 1"
  -     # Certificate "Juur-SK"
  -     # Certificate "ComSign CA"
  -     # Certificate "ComSign Secured CA"
  -     # Certificate "ComSign Advanced Security CA"
  -     # Certificate "Global Chambersign Root"
  -     # Certificate "Sonera Class2 CA"
  -     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G3"
  -     # Certificate "VeriSign, Inc."
  -     # Certificate "GTE CyberTrust Global Root"
  -     # Certificate "Equifax Secure Global eBusiness CA-1"
  -     # Certificate "Equifax"
  -     # Certificate "Class 1 Primary CA"
  -     # Certificate "Swiss Government Root CA III"
  -     # Certificate "Application CA G4 Root"
  -     # Certificate "SSC GDL CA Root A"
  -     # Certificate "GlobalSign Code Signing Root E45"
  -     # Certificate "GlobalSign Code Signing Root R45"
  -     # Certificate "Entrust Code Signing Root Certification Authority - CSBR1"


author: Ding-Yi Chen <dchen@redhat.com> - 0.3.5-6
changelog:
  - Review comment #16 addressed
  - It make more sense that -selinux and -certmonger depends on main package,
    Not the other round
  - Recommends: logrotate
  - Supplements: -selinux, -certmonger


author: Rob Crittenden <rcritten@redhat.com> - 0.79.14-6
changelog:
  - Certificate format validation when adding the SCEP server's CA
    (#1492112)
  - Replace some SHA1 usages with SHA256 in the unit tests


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2-1
changelog:
  - update to 4.2 (#2051441)
  - fully switch from nettle to gnutls (#1953463 #1954483)
  - use NTP servers from DHCPv6 NTP server option (#2047415)
  - drop obsolete workaround in scriptlet


author: Miroslav Lichvar <mlichvar@redhat.com> 4.5-1
changelog:
  - update to 4.5 (RHEL-6522 RHEL-6520 RHEL-9969 RHEL-9971 RHEL-9973 RHEL-9975
    RHEL-12411)
  - add chronyd-restricted service (RHEL-9972)


author: Alexander Sosedkin <asosedkin@redhat.com> - 20230731-1.git94f0e2c
changelog:
  - krb5: sort enctypes mac-first, cipher-second, prioritize SHA-2 ones
  - FIPS: enforce EMS in FIPS mode
  - NO-ENFORCE-EMS: add subpolicy to undo the EMS enforcement in FIPS mode
  - nss: implement EMS enforcement in FIPS mode (disabled in ELN)
  - openssl: implement EMS enforcement in FIPS mode
  - gnutls: implement EMS enforcement in FIPS mode (disabled in ELN)
  - docs: replace `FIPS 140-2` with just `FIPS 140`


author: Alexander Sosedkin <asosedkin@redhat.com> - 20230920-1.git8dcf74d
changelog:
  - OSPP subpolicy: tighten beyond reason for OSPP 4.3
  - fips-mode-setup: more thorough --disable, still unsupported


author: Alexander Sosedkin <asosedkin@redhat.com> - 20231016-1.git77ceb0b
changelog:
  - openssl: fix SHA1 and NO-ENFORCE-EMS interaction
  - bind: fix a typo that led to duplication of ECDSAPxxxSHAxxx


author: Clemens Lang <cllang@redhat.com> - 20231108-1.git994ae09
changelog:
  - turn ssh_etm into an etm@SSH tri-state (RHEL-15925)
  - fips-mode-setup: increase chroot-friendliness (RHEL-11350)
  - fips-mode-setup: Fix usage with --no-bootcfg (RHEL-11350)


author: Clemens Lang <cllang@redhat.com> - 20231109-1.git0ceff7f
changelog:
  - Restore support for scoped ssh_etm directives (RHEL-15925)
  - Print matches in syntax deprecation warnings (RHEL-15925)


author: Clemens Lang <cllang@redhat.com> - 20231113-1.gite9247c2
changelog:
  - fips-mode-setup: Fix test for empty /boot (RHEL-11350)
  - fips-mode-setup: Avoid 'boot=UUID=' if /boot == / (RHEL-11350)


author: Alexander Sosedkin <asosedkin@redhat.com> - 20240202-1.git283706d
changelog:
  - fips-finish-install: make sure ostree is detected in chroot
  - fips-mode-setup: make sure ostree is detected in chroot
  - fips-finish-install: Create/remove /etc/system-fips on ostree systems
  - java: disable ChaCha20-Poly1305 where applicable


author: Ondrej Kozina <okozina@redhat.com> - 2.4.3-1
changelog:
  - Update to cryptsetup 2.4.3.
  - patch: Fix typo in repair command prompt.
    Resolves: #2022309 #2023316 #2032782


author: Daniel Zatovic <dzatovic@redhat.com> - 2.6.0-2
changelog:
  - Fix FIPS related bugs.
  - Abort encryption when header and data devices are same.
  - Resolves: #2150251 #2148841


author: Daniel Zatovic <dzatovic@redhat.com> - 2.6.0-3
changelog:
  - patch: Disallow use of internal kenrel crypto driver names in "capi"
  - patch: Also disallow active devices with internal kernel names
  - patch: Fix init_by_name to allow unknown cipher format in dm-crypt
  - patch: Fix reencryption to fail properly for unknown cipher
  - patch: Fix activation of LUKS2 with capi format cipher and kernel
  - Resolves: #2212771


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.3.3op2-19
changelog:
  - 2217177 - Delays printing to lpd when reserved ports are exhausted
  - 2217284 - The command "cancel -x <job>" does not remove job files
  - 2217954 - Enlarge backlog queue for listen() in cupsd


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.3.3op2-19
changelog:
  - CVE-2023-34241 cups: use-after-free in cupsdAcceptClient() in scheduler/client.c
  - CVE-2023-32324 cups: heap buffer overflow may lead to DoS


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.3.3op2-22
changelog:
  - RHEL-14931 cupsd memory leak in cupsdDeleteJob() with "PreserveJobHistory Off"
  - RHEL-15308 cupsd fails to open cups-files.conf and the resulting error message is lost


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.3.3op2-23
changelog:
  - RHEL-19205 Recommend new cups-filters subpackages with weak dep for better upgrade exp
  - RHEL-19495 cupsGetJobs fails to connect if poll() gets POLLOUT|POLLHUP in revents


author: Pavol Zacik <pzacik@redhat.com> - 1:2.3.3op2-26
changelog:
  - RHEL-40388 cups: Cupsd Listen arbitrary chmod 0140777
  - Delete the domain socket file after stopping the cups.socket service
  - Fix cupsd Listener checks


author: Kamil Dudka <kdudka@redhat.com> - 7.76.1-24
changelog:
  - fix SSH connection too eager reuse still (CVE-2023-27538)
  - fix GSS delegation too eager connection re-use (CVE-2023-27536)
  - fix FTP too eager connection reuse (CVE-2023-27535)
  - fix SFTP path ~ resolving discrepancy (CVE-2023-27534)
  - fix TELNET option IAC injection (CVE-2023-27533)


author: Jacek Migacz <jmigacz@redhat.com> - 7.76.1-26
changelog:
  - unify the upload/method handling (CVE-2023-28322)
  - fix host name wildcard checking (CVE-2023-28321)


author: Jacek Migacz <jmigacz@redhat.com> - 7.76.1-28
changelog:
  - return error if hostname too long for remote resolve (CVE-2023-38545)
  - fix cookie injection with none file (CVE-2023-38546)
  - cap SFTP packet size sent (RHEL-14697)
  - lowercase the domain names before PSL checks (CVE-2023-46218)


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 2.1.27-12
changelog:
  - Incorporate the upstream gdbm specific patch from
    https://github.com/cyrusimap/cyrus-sasl/pull/554
  - Resolves rhbz#1947971


author: Bryan Gurney <bgurney@redhat.com> - 71.1-7
changelog:
  - Pull in fixes from upstream v72 and v73 (Jeff Moyer)
  - Fix enable-namespace all reporting errors incorrectly
  - Add support for inject-smart on papr scm
  - Related: rhbz#2040075
  - Related: rhbz#1873851
  - Related: rhbz#1880578
  - Related: rhbz#1922538
  - Related: rhbz#2087707


author: Jeff Moyer <jmoyer@redhat.com> - 71.1-8
changelog:
  - Backport changes up to v74, excluding the config file changes. (Jeff Moyer)
    This includes support for the CXL commands, and adds the following
    packages: cxl-cli, cxl-devel, cxl-libs
  - Resolves: rhbz#2132167


author: Jakub Martisko <jamartis@redhat.com> - 28-6
changelog:
  - Fix a stack buffer over-read in the c-shquote library
  - Fix null pointer reference when supplying a malformed XML config file
  Resolves: CVE-2022-31212
  Resolves: CVE-2022-31213


author: Marian Csontos <mcsontos@redhat.com> - 2.03.17-6
changelog:
  - Fix lvresize resizing LUKS device only when resizing FS is enabled.
  - Improve lvresize handling of renamed volumes.
  - Fix random unmount when resizing volume backed by thin pool.


author: Marian Csontos <mcsontos@redhat.com> - 2.03.21-3
changelog:
  - Fix lvresize fail in case of multiple mountpoints.
  - Fix allocator for RAID LVs allocating multiple legs on single device.
  - Fix device id handling of WWIDs with trailing spaces.


author: Marian Csontos <mcsontos@redhat.com> - 2.03.23-2
changelog:
  - Add warning message when mirror images have (r)efresh bit set.
  - Document lv_attr volume type bit (g) for raid+integrity in lvs(8).


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.8.7-18
changelog:
  - Add 0079-libmultipath-use-select_reload_action-in-select_acti.patch
  - Add 0080-libmultipath-select-resize-action-even-if-reload-is-.patch
  - Add 0081-libmultipath-cleanup-ACT_CREATE-code-in-select_actio.patch
  - Add 0082-libmultipath-keep-renames-from-stopping-other-multip.patch
  - Resolves: bz #2166467


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.8.7-19
changelog:
  - Fix bugzilla linked to the changes (was previously linked to
    the wrong bug, 2162536)
  - Resolves: bz #2166467


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.8.7-20
changelog:
  - Add 0083-multipath.rules-fix-smart-bug-with-failed-valid-path.patch
  - Add 0084-libmultipath-limit-paths-that-can-get-wwid-from-envi.patch
  - Change how the installation dir for kpartx_id is specified
  - Resolves: bz #1926147


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.8.7-21
changelog:
  - Add 0085-multipathd-make-pr-registration-consistent.patch
  - Add 0086-libmultipath-make-prflag-an-enum.patch
  - Add 0087-multipathd-handle-no-active-paths-in-update_map_pr.patch
  - Add 0088-libmpathpersist-fix-resource-leak-in-update_map_pr.patch
  - Resolves: bz #2164869


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.8.7-22
changelog:
  - Add 0089-RH-Add-mpathcleanup.patch
    * Fixes RHEL-782
  - Add 0090-RH-make-listing-return-an-error-if-the-config-file-i.patch
  - Install mpathcleanup
    * Fixes RHEL-781
  - Resolves: #781, #782


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.8.7-23
changelog:
  - Add 0091-multipathd-Added-support-to-handle-FPIN-Li-events-fo.patch
    * Fixes RHEL-6678 (Add support in multipathd for NVMe to listen for FPIN-Li
      events and mark effected paths as marginal)
  - Add 0092-multipath-tools-add-HPE-Alletra-9000-NVMe-to-hardwar.patch
    * Fixes RHEL-1830 (Changes to Arcus NVMeoFC multipath.conf settings for RHEL
      9.x to be included in kernel by default)
  - Resolves: RHEL-6678
  - Resolves: RHEL-1830


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.8.7-24
changelog:
  - Add 0093-RH-multipath-add-mpathcleanup-man-page.patch
    * Fixes RHEL-1266 ("There is no man page for mpathcleanup")
  - Resolves: RHEL-1266


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.8.7-25
changelog:
  - Add 0094-libmultipath-Add-max_retries-config-option.patch
    * Fixes RHEL-1729 ("Allow multipathd to set the max_retries of the
      scsi_device for paths")
  - Add 0095-libmutipath-Retain-device-size-if-sysfs_get_size-fai.patch
  - Add 0096-multipathd-check-and-update-all-paths-when-in-cli_re.patch
  - Add 0097-multipathd-move-post-reloading-commands-into-resize_.patch
  - Add 0098-multipathd-move-resize_map-to-multipathd-main.c.patch
  - Add 0099-multipathd-Add-auto_resize-config-option.patch
    * Fixes RHEL-986 ("Add option to allow multipathd to detect device
      resizes and autoresize.")
  - Resolves: RHEL-986
  - Resolves: RHEL-1729


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.8.7-26
changelog:
  - Add 0100-libmultipath-avoid-temporarily-enabling-queueing-on-.patch
  - Add 0101-multipathd-Make-sure-to-disable-queueing-if-recovery.patch
    * Fixes RHEL-17234 ("RHEL9 dm-multipath no_path_retry [retry number] is
      undone if paths are later lost for an open map.")
  - Add 0102-multipathd-remove-nopath-flushing-code-from-flush_ma.patch
  - Add 0103-multipathd-make-flush_map-delete-maps-like-the-multi.patch
  - Add 0104-multipathd-disable-queueing-when-removing-unknown-ma.patch
    * Fixes RHEL-4998 ("When remove external lun from host, rescan lun status
      will cause the OS hang and no response")
  - Resolves: RHEL-4998
  - Resolves: RHEL-17234


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.8.7-27
changelog:
  - Add 0105-multipathd-fix-null-pointer-dereference-in-uev_updat.patch
  - Add 0106-multipathd-fix-auto-resize-configuration.patch
  - Add 0107-libmultipath-fix-displaying-auto_resize-config-setti.patch
    * Fixes RHEL-986 ("Add option to allow multipathd to detect device
      resizes and autoresize.")
  - Resolves: RHEL-986


author: Marian Csontos <mcsontos@redhat.com> - 1.0.9-2
changelog:
  - Allow non-zero values in unused index block entries.
  - Fix boundary check on the bitset for cached blocks.
  - Fix incorrect index_entry.nr_free on expansion affecting free space estimate.
  - Fix thin_repair checking keys on a node with a zero key.
  - Enhance error message in cache_check suggesting fix when applicable.


author: Marian Csontos <mcsontos@redhat.com> - 1.0.9-3
changelog:
  - Fix --version string compatibility with LVM tools.
  - Fix confusing Broken pipe warning when used in lvconvert --repair.


author: Martin Osvald <mosvald@redhat.com> - 12:4.4.2-18.b1
changelog:
  - Fix for CVE-2022-2928
  - Fix for CVE-2022-2929
  - Use systemd-sysusers for dhcp user and group (#2095396)


author: Lukas Hrazky <lhrazky@redhat.com> - 4.14.0-1
changelog:
  - Update to 4.14.0
  - Add doc related to --destdir and --downloadonly options (RhBug:2100811)
  - Fix broken dependencies error reporting (RhBug:2088422)
  - Add support for group upgrade rollback (RhBug:2016070)
  - Expose plugin unload method to API (RhBug:2047251)
  - Fix upgrade from file to noarch pkg (RhBug:2006018)
  - Allow passing plugin parameters with dashes in names (RhBug:1980712)
  - Don't include resolved advisories for obsoletes with sec. filters (RhBug:2101421)
  - Add only relevant pkgs to upgrade transaction (RhBug:2097757)
  - doc: Describe how gpg keys are stored for `repo_ggpcheck` (RhBug:2020678)
  - bash-completion: use sqlite cache when available


author: Nicola Sella <nsella@redhat.com> - 4.14.0-3
changelog:
  - Move system-upgrade plugin to core (RhBug:2131288)
  - offline-upgrade: add support for security filters (RhBug:1939975,2139326)
  - Fix plugins unit tests + unload plugins upon their deletion


author: Jaroslav Rohel <jrohel@redhat.com> - 4.14.0-6
changelog:
  - Add reboot option to DNF Automatic (RhBug:2124793)
  - Omit src RPMs from check-update (RhBug:2151910,2203069)
  - automatic: Fix online detection with proxy (RhBug:2022440,2189851)


author: Jaroslav Rohel <jrohel@redhat.com> - 4.14.0-8
changelog:
  - Return an error when transaction fails (RhBug:2170093,2212262)
  - Document symbols in `dnf history list` output (RhBug:2172067,2218113)


author: Jaroslav Rohel <jrohel@redhat.com> - 4.14.0-9
changelog:
  - Fix japanese translations (RHEL-11345)
  - Fix substitution in kay-value-pair list in add_new_repo (RHEL-6396)
  - base: Add obsoleters of only latest versions (RHEL-6304)


author: Jaroslav Rohel <jrohel@redhat.com> - 4.3.0-6
changelog:
  - Fix boot time derivation for systems with no rtc (RhBug:2166444,2182157)
  - system-upgrade: Add --poweroff option to reboot subcommand (RhBug:2157844)
  - Doc update for reposync (RhBug:2132383,2182004)
  - reposync: Implement --safe-write-path option (RhBug:1898089,2203766)
  - Enable the leaves and show-leaves DNF plugins (RhBug:2134638)


author: Jaroslav Rohel <jrohel@redhat.com> - 4.3.0-7
changelog:
  - Remove patch: "reposync: Implement --safe-write-path option (RhBug:1898089,2203766)" (RhBug:2207946)


author: Jaroslav Rohel <jrohel@redhat.com> - 4.3.0-12
changelog:
  - Fix incorrect spanish translation file (RHEL-6394)
  - Fix for strange issue with binary garbage in smaps files (RHEL-6420, RhBug:2231923)


author: Pavel Valena <pvalena@redhat.com> - 057-20.git20221213
changelog:
  - refactor(url-lib): write curl output directly to file
  - fix(dracut-initramfs-restore.sh): initramfs detection not
  - fix(90kernel-modules): install blk modules using symbol
  - fix(squash): build ld cache for squash loader
  - test(16-DMSQUASH): make it pass on arch
  - feat(dmsquash-live): add new dmsquash-live-autooverlay module


author: Pavel Valena <pvalena@redhat.com> - 057-38.git20230725
changelog:
  - fix(dracut.sh): use dynamically uefi's sections offset
  - fix(dracut.sh): handle imagebase for uefi
  - fix(dracut.sh): use gawk for strtonum
  - fix(rngd): install system service file
  - fix(nvmf): nvme list-subsys prints the address using commas
  - fix(nvmf): don't try to validate network connections in
  - fix(nvmf): no need to load the nvme module
  - fix(nvmf): don't create did-setup file
  - fix(nvmf): don't use "finished" queue for autoconnect
  - fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes
  - fix(nvmf): avoid calling "exit" in a cmdline hook
  - fix(nvmf): run cmdline hook before parse-ip-opts.sh
  - feat(nvmf): set rd.neednet=1 if tcp records encountered
  - fix(nvmf): install 8021q module unconditionally
  - fix(nvmf): support /etc/nvme/config.json
  - feat(nvmf): add code for parsing the NBFT


author: Pavel Valena <pvalena@redhat.com> - 057-43.git20230816
changelog:
  - feat(spec): include modules for IMA
  - fix(dracut): there can be \ at the end on line in awk script
  - fix(rngd): spacing
  - fix(integrity): do not enable EVM if there is no key
  - fix(fips): include openssl's fips.so and openssl.cnf


author: Pavel Valena <pvalena@redhat.com> - 057-51.git20231114
changelog:
  - fix(dracut.sh): correct wrong systemd variable paths
  - fix(hwdb): follow shfmt-recommended format
  - feat(dracut): add --sbat option to add sbat policy to UKI
  - feat(systemd): install systemd-sysroot-fstab-check
  - fix(dracut.spec): add jq dependency to network subpackage
  - fix(fcoe-uefi): exit early on empty vlan


author: Mark Wielaard <mjw@redhat.com> - 0.187-4
changelog:
  - Upgrade to elfutils 0.187
    - debuginfod: Support -C option for connection thread pooling.
    - debuginfod-client: Negative cache file are now zero sized instead
      of no-permission files.
    - addr2line: The -A, --absolute option, which shows file names
      includingthe full compilation directory is now the
      default.  To get theold behavior use the new option --relative.
    - readelf, elflint: Recognize FDO Packaging Metadata ELF notes
    - libdw, debuginfo-client: Load libcurl lazily only when files need
      to be fetched remotely. libcurl is now never loaded when
      DEBUGINFOD_URLS is unset. And whenDEBUGINFOD_URLS is set,
      libcurl is only loaded when the debuginfod_begin function is
      called.
  - Add elfutils-0.187-csh-profile.patch
  - Add elfutils-0.187-debuginfod-client-fd-leak.patch
  - Add elfutils-0.187-mhd_no_dual_stack.patch
  - Add elfutils-0.187-mhd_epoll.patch


author: Frank Ch. Eigler <fche@redhat.com> - 0.187-5
changelog:
  - rhbz2088774: ship /etc/profile.d/debuginfod* files even without
                 default DEBUGINFOD_URLS.


author: Mark Wielaard <mjw@redhat.com> - 0.189-3
changelog:
  - Add elfutils-0.189-elf_getdata_rawchunk.patch
  - Add elfutils-0.189-debuginfod_config_cache-double-close.patch


author: Mark Wielaard <mjw@redhat.com> - 0.190-1
changelog:
  - Upgrade to upstream elfutils 0.190
  - Add eu-srcfiles
  - Drop upstreamed patches
    elfutils-0.189-debuginfod_config_cache-double-close.patch
    elfutils-0.189-elf_getdata_rawchunk.patch
    elfutils-0.189-elfcompress.patch
  - Only package debuginfod-client-config.7 manpage for debuginfod-client


author: Lukáš Zaoral <lzaoral@redhat.com> - 5.0.0-0.1.alpha
changelog:
  - Update to 5.0.0-alpha (#1989523)
    + Based on spec by Xavier Delaruelle in Fedora Rawhide. Thanks a lot!
  - Remove createmodule.sh and createmodule.py utilities ('module sh-to-mod'
    should be used instead)
  - Remove configure options that have been made default starting version 5.0
  - Remove compat subpackage
  - Run non-regression tests in quick mode


author: Lukáš Zaoral <lzaoral@redhat.com> - 5.0.0-1
changelog:
  - Update to 5.0.0 (#2004402)
    + Based on spec by Xavier Delaruelle in Fedora Rawhide. Thanks a lot!
  - Configuration guide example.txt is replaced by more up to date INSTALL.txt
    document


author: Tomas Korbar <tkorbar@redhat.com> - 2.2.10-10
changelog:
  - Fix multiple CVEs
  - CVE-2022-25236 expat: namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution
  - CVE-2022-25235 expat: malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution
  - CVE-2022-25315 expat: integer overflow in storeRawNames()
  - Resolves: CVE-2022-25236
  - Resolves: CVE-2022-25235
  - Resolves: CVE-2022-25315


author: Tomas Korbar <tkorbar@redhat.com> - 2.4.7-1
changelog:
  - Rebase to version 2.4.7
  - Resolves: rhbz#2067201
  - Resolves: CVE-2022-25313
  - Resolves: CVE-2022-25314
  - Resolves: CVE-2022-25236


author: Tomas Korbar <tkorbar@redhat.com> - 2.5.0-2
changelog:
  - Fix parsing of large tokens
  - Reject direct parameter entity recursion
  - Resolves: RHEL-29699
  - Resolves: RHEL-29696


author: Chris Leech <cleech@redhat.com> - 1.0.34-0.git14ef0d2
changelog:
  - upstream 1.0.34
  - drop gcc warning diabling patch, upstream fixes exist for these issues now
  - #1961180 FCoE interface name regressions


author: Pavel Raiskup <praiskup@redhat.com> - 3.14-4
changelog:
  - /proc and /sys made %ghost to allow filesystem package updates in rootless
    container environments (rhbz#1548403)


author: Nicolas Mailhot <nim@fedoraproject.org>
changelog:
  - 3.0.3-1
  🐞 Fix bugs in the 3.0.2 refactoring
  - 3.0.2-1
  🐞 Workaround Fedora problems created by rpm commit 93604e2
     harder


author: Marek Kasik <mkasik@redhat.com> - 2.10.4-1
changelog:
  - Update to 2.10.4
  - Test bitmap size earlier for PNGs
  - Fix memory leak in pngshim.c
  - Enable man pages for demos
  - Resolves: #1887084, #1890211


author: Akira TAGOH <tagoh@redhat.com> - 2.10.4-3
changelog:
  - Enable HarfBuzz support
  - Add bootstrap without HarfBuzz
  - Resolves: #1853937
  - Resolves: #1906714


author: Richard Hughes <richard@hughsie.com> 1.8.10-1
changelog:
  - Rebase to latest upstream release to fix multiple ESP detection problems
  - Resolves: rhbz#2128384, needed for rhbz#2119436 and rhbz#2128384


author: Richard Hughes <richard@hughsie.com> 1.8.10-2
changelog:
  - Rebuild because distrobaker did entirely the wrong thing.
  - Resolves: rhbz#2128384, needed for rhbz#2119436 and rhbz#2128384


author: Filip Januš <fjanus@redhat.com> - 1.18.1-3
changelog:
  - Resolves: #1799391
  - After upgrade GCC to version gcc version 10.0.1 build fails
  - Patch gdbm_gcc_10.patch was added


author: Sundeep Anand <suanand@redhat.com> - 0.21-6
changelog:
  - Add gettext-0.21-covscan.patch to fix issues detected by static analyzers
    Add gettext-0.21-disable-libtextstyle.patch
    Do not build libtextstyle, as it depends on libcroco
    which is now unmaintained and has known security bugs.
    Obsolete libtextstyle and libtextstyle-devel packages.


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.68.4-8
changelog:
  - Resolve use after free introduced by fixes for CVE-2023-24593/CVE-2023-25180
  - Related: #2181196
  - Related: #2181200


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.68.4-9
changelog:
  - Resolve s390x crashes introduced by fixes for CVE-2023-24593/CVE-2023-25180
  - Related: #2181196
  - Related: #2181200


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.68.4-11
changelog:
  - Really fix authentication failures when sd-bus clients connect to GDBus servers
  - Resolves: #2217771


author: Florian Weimer <fweimer@redhat.com> - 2.34-100.2
changelog:
  - CVE-2024-33599: nscd: buffer overflow in netgroup cache (RHEL-34318)
  - CVE-2024-33600: nscd: null pointer dereferences in netgroup cache
  - CVE-2024-33601: nscd: crash on out-of-memory condition
  - CVE-2024-33602: nscd: memory corruption with NSS netgroup modules


author: Andrew Lukoshko <alukoshko@almalinux.org> - 2.34-100.2.alma.2
changelog:
  - elf: Avoid some free (NULL) calls in _dl_update_slotinfo
  - elf: Support recursive use of dynamic TLS in interposed malloc (RHEL-39992)


author: Jakub Martisko <jamartis@redhat.com> - 1:6.2.0-9
changelog:
  - Move the .hmac files to the fipscheck subfolder
  - Make symlinks from their original location (Fedora contains the .hmac files there) pointing to their new location
  Resolves: rhbz#1980758


author: Jakub Martisko <jamartis@redhat.com> - 1:6.2.0-13
changelog:
  - Fix: previous commit removed one function from the library and thus broke the ABI
  - function gmpn_preinv_divrem_1 should now not be removed
  Related: rhbz#2044216


author: Jakub Jelen <jjelen@redhat.com> - 2.3.3-3
changelog:
  - Mark SHA-1 digest as weak to follow SHA-1 disablement in RHEL9 (#2070722)
  - Fix interaction with SSH by not requiring the MD5 digest (#2073567)
  - Fix creation of AEAD packets (#2128058)


author: Daiki Ueno <dueno@redhat.com> - 3.8.2-2
changelog:
  - Bump nettle dependency to 3.9.1
  - Skip KTLS test exercising ChaCha20-Poly1305 in TLS 1.2 (RHEL-18498)


author: Daiki Ueno <dueno@redhat.com> - 3.8.3-2
changelog:
  - Fix timing side-channel in deterministic ECDSA (RHEL-28959)
  - Fix potential crash during chain building/verification (RHEL-28954)


author: David King <amigadave@amigadave.com> - 1.68.0-6
changelog:
  - Add Requires on python-markdown for g-ir-doc-tool (#1979144)
  - Add license texts and documentation files (#1979144)


author: Adam Williamson <awilliam@redhat.com> - 3.4-5
changelog:
  - Backport fix for upstream #28105 to fix zgrep
    Resolves: rhbz#1872913
  - Remove some non-portable tests that fail on armv7hl (Paul Eggert)
    Resolves: rhbz#1863830


author: Nicolas Frayer <nfrayer@redhat.com> - 2.06-69
changelog:
  - grub2-mkconfig: dont overwrite BLS cmdline if BLSCFG is true
  - This is an updated version of the 2.06-67 patch
  - Resolves: #2203203
  - Resolves: #2212320
  - Resolves: #2221543


author: Nicolas Frayer <nfrayer@redhat.com> - 2.06-73
changelog:
  - search command: add flag to only search root dev
  - Resolves: #RHEL-20526
  - Resolves: #CVE-2023-4001


author: Tomas Popela <tpopela@redhat.com> - 40.0-6
changelog:
  - Require the Source Code Pro font instead of only recommending it to not break
    systems updated from 9.0.0.
    Resolves: rhbz#2093975


author: Julien Rische <jrische@redhat.com> - 0.8.4-5
changelog:
  - Add an option for minimum lifetime
  - Resolves: rhbz#2184333
  - Remove unused patch files
  - Fix date typographical error in changelog


author: Jakub Martisko <jamartis@redhat.com> - 1.12-1
changelog:
  - Rebase to gzip 1.12
  - Resolves an arbitrary-file-write vulnerability in zgrep
    Resolves: rhbz#2073343
    Resolves: rhbz#1870675


author: Parag Nemade <pnemade AT redhat DOT com> - 2.7.4-6
changelog:
  - Resolves:rh#2103849 CVE-2022-33068
    harfbuzz: integer overflow in the component hb-ot-shape-fallback.c


author: Parag Nemade <pnemade AT redhat DOT com> - 2.7.4-7
changelog:
  - Resolves:rh#2103849 CVE-2022-33068
  - Fix Covscan compiler warning for inclusion of parenthesis
  - Update tests.yaml


author: Kamal Heib <kheib@redhat.com> - 46.0-1
changelog:
  - Rebase to upstream release v46.0
  - Resolves: rhbz#2159650, rhbz#2167513, rhbz#2170367, rhbz#2189721 rhbz#2209688


author: Bruno Meneguele <bmeneg@redhat.com> - 1.3.2-9
changelog:
  - Use upstream accepted patch for the memory leak
  - Make SHA-256 the default hash algorithm (rhbz#1934949)


author: Bruno Meneguele <bmeneg@redhat.com> - 1.4-1
changelog:
  - Modify some pieces to get closer to Fedora's specfile
  - Remove patch handling memory leak: solved in the rebase
  - Remove patch handling SHA-256 default hash: solved in the rebase
  - Rebase to upstream release v1.4 (rhbz#2026028)


author: Jan Macku <jamacku@redhat.com> - 10.11.3-1
changelog:
  - Drop unnecessary obsoletes
  - spec: Move rename_device to subpackage `initscripts-rename-device`
  - ci: Update `.packit.yml` to run on `c9s`
  - ci: Use Differential ShellCheck action


author: Andrea Claudi <aclaudi@redhat.com> - 6.2.0-2.el9
changelog:
  - macvlan: Add bclim parameter (Andrea Claudi) [2186945]
  - Update kernel headers (Andrea Claudi) [2186945]


author: Andrea Claudi <aclaudi@redhat.com> - 6.2.0-5.1.el9
changelog:
  - man: ip-link.8: add a note for gso_ipv4_max_size (Andrea Claudi)
  - iplink: add gso and gro max_size attributes for ipv4 (Andrea Claudi)
  - Update kernel headers (Andrea Claudi)
  - ss: Add support for dumping TCP bound-inactive sockets. (Andrea Claudi)


author: Phil Sutter <psutter@redhat.com> - 7.11-8
changelog:
  - Ship iptables-translate utility with ipset package
  - Add missing function to libipset.map and bump library version
  - Fix all debug mode warnings
  - ipset-translate: allow invoking with a path name
  - Fix IPv6 sets nftables translation
  - Fix typo in ipset-translate man page
  - tests: add tests ipset to nftables
  - add ipset to nftables translation infrastructure
  - lib: Detach restore routine from parser
  - lib: split parser from command execution


author: Phil Sutter <psutter@redhat.com> - 1.8.7-29
changelog:
  - libxtables: Boost rule target checks by announcing chain names
  - libxtables: Implement notargets hash table
  - nft: Reject standard targets as chain names when restoring
  - xshared: Merge and share parse_chain()
  - xshared: Prefer xtables_chain_protos lookup over getprotoent
  - nft: Speed up immediate parsing
  - nft: Simplify immediate parsing


author: Phil Sutter <psutter@redhat.com> - 1.8.8-5
changelog:
  - nft: un-break among match with concatenation
  - nft: fix ebtables among match when mac+ip addresses are used


author: Phil Sutter <psutter@redhat.com> [1.8.10-1.el9]
changelog:
  - spec: Support for _excludedocs macro in alternatives installation (Phil Sutter) [RHEL-5810]
  - Rebase onto version 1.8.10 (Phil Sutter) [RHEL-14147]


author: Phil Cameron <pcameron@redhat.com> - 1.2.1-1
changelog:
  - Makefile: protect mandatory compile flags
  - packet capture: don't reuse socket for multiple receive functions
  - TPACKET_V[23]: continue even if mlock() fails
  - ipmon: fix division by zero
  - fix: detstats(), ifstats(): handle packets with incorrect header checksum
  - fix: positionptr(): properly allocate newly created interfaces
  - fix: detstats(): properly account non-IP packets
  - fix: properly init curses (fixes view on some utf-8 terminals)
  - fix: cidr_split_address(): fix buffer overflow
  - ipmon: printentry(): fix printing of huge values
  - build: use correct libraries (wide version of -lpanel)
  - fix unsafe handling of printf() args (RedHat Bugzilla: 1842690)
  - fix the CPU hog if the interface gets removed (RedHat Bugzilla: 1572750)
  - introduce packet capturing abstraction: add recvmmsg(), TPACKET_V2 and TPACKET_V3 mmap()ed capturing modules: this allow us to capture in multigigabit speeds
  - add partial support for IPoIB interfaces (full support cannot be done because the kernel interface doesn't give us source address) (RedHat Bugzilla: 1140211)
  - merge rvnamed-ng into iptraf-ng
  - allow scrolling with Home, End, PageUp and PageDown keys
  - show dropped packet count
  - pktsize: print in and out counters
  - ifstats: show total packet rate and packet drop across all interfaces
  - ipmon: show OSPF protocol version
  - hostmon, ipmon: update screen only when needed (vastly reduces CPU usage and also reduces packet drops)
  - update source code to compile cleanly on modern gcc
  - numerous code refactoring/cleaning up all over the source tree


author: Kairui Song <kasong@redhat.com> - 2:1.8.0-2
changelog:
  - Disable the communication socket when UI is disabled. Resolves: rhbz1951292
  - drop NoNewPrivs from irqbalance service. Resolves: rhbz1963152


author: Tao Liu <ltao@redhat.com> - 2:1.8.0-5
changelog:
  - Document migrateval. Resolves: rhbz2071959
  - Confine irqbalance to systems where it is useful. Resolves: rhbz2063930
  - Wrong EnvironmentFile in irqbalance.service. Resolves: rhbz2058509


author: Tao Liu <ltao@redhat.com> - 2:1.9.2-3
changelog:
  - Use misc/irqbalance.env as irqbalance.sysconfig
  - Use new rpm macros: autosetup and make_build
  - Use irqbalance-1.9.0-environment-file
  - Remove _hardened_build
  - Remove triggerun -- irqbalance < 2:0.56-3
  - Use SPDX licence


author: Chris Leech <cleech@redhat.com> - 6.2.1.9-18.gita65a472
changelog:
  - rebase to upstream 2.1.9+ with iscsiuio 0.7.8.8
  - new meson build system, sync with fedora packaging


author: Chris Leech <cleech@redhat.com> - 0.101-1
changelog:
  - update to 0.101
  - bz#1958038 disabled Werror, which fixes the build with OpenSSL 3 while still using deprecated functions
  - setup new upstream tests as gating


author: Jan Stancek <jstancek@redhat.com> - 20230525-135
changelog:
  - Update to upstream 20230525 release (rhbz 2178579).
    Changes since the last update are noted on items below, copied from
    the git changelog of upstream linux-firmware repository.
  - amdgpu: update yellow carp firmware for amd.5.5 release
  - amdgpu: update navi14 firmware for amd.5.5 release
  - amdgpu: update navi12 firmware for amd.5.5 release
  - amdgpu: update vega20 firmware for amd.5.5 release
  - amdgpu: update vega12 firmware for amd.5.5 release
  - amdgpu: update navi10 firmware for amd.5.5 release
  - amdgpu: update vega10 firmware for amd.5.5 release
  - amdgpu: update PSP 13.0.11 firmware for amd.5.5 release
  - amdgpu: update GC 11.0.4 firmware for amd.5.5 release
  - amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release
  - amdgpu: update PSP 13.0.4 firmware for amd.5.5 release
  - amdgpu: update GC 11.0.1 firmware for amd.5.5 release
  - amdgpu: update 13.0.8 firmware for amd.5.5 release
  - amdgpu: update GC 10.3.7 firmware for amd.5.5 release
  - amdgpu: update vangogh firmware for amd.5.5 release
  - amdgpu: update VCN 4.0.4 firmware for amd.5.5 release
  - amdgpu: update SMU 13.0.7 firmware for amd.5.5 release
  - amdgpu: update PSP 13.0.7 firmware for amd.5.5 release
  - amdgpu: update GC 11.0.2 firmware for amd.5.5 release
  - amdgpu: update renoir firmware for amd.5.5 release
  - amdgpu: update VCN 4.0.0 firmware for amd.5.5 release
  - amdgpu: update SMU 13.0.0 firmware for amd.5.5 release
  - amdgpu: update PSP 13.0.0 firmware for amd.5.5 release
  - amdgpu: update GC 11.0.0 firmware for amd.5.5 release
  - amdgpu: update green sardine firmware for amd.5.5 release
  - amdgpu: update beige goby firmware for amd.5.5 release
  - amdgpu: update dimgrey cavefish firmware for amd.5.5 release
  - amdgpu: update arcturus firmware for amd.5.5 release
  - amdgpu: update vcn 3.1.2 firmware for amd.5.5 release
  - amdgpu: update psp 13.0.5 firmware for amd.5.5 release
  - amdgpu: update GC 10.3.6 firmware for amd.5.5 release
  - amdgpu: update navy flounder firmware for amd.5.5 release
  - amdgpu: update sienna cichlid firmware for amd.5.5 release
  - amdgpu: update aldebaran firmware for amd.5.5 release
  - amdgpu: DMCUB updates for various AMDGPU asics
  - ice: update ice DDP comms package to 1.3.40.0
  - rtlwifi: Add firmware v6.0 for RTL8192FU
  - rtlwifi: Update firmware for RTL8188EU to v28.0
  - cirrus: Add firmware and tuning files for HP G10 series laptops
  - linux-firmware: update firmware for mediatek bluetooth chip (MT7922)
  - WHENCE: comment out duplicate MediaTek firmware
  - i915: Add GuC v70.6.6 for MTL
  - amdgpu: update DCN 3.1.6 DMCUB firmware
  - rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F
  - rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922
  - rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922
  - Group all Conexant V4L devices together
  - rtl_nic: update firmware of USB devices
  - linux-firmware: Update firmware file for Intel Bluetooth AX200
  - linux-firmware: Update firmware file for Intel Bluetooth AX201
  - linux-firmware: Update firmware file for Intel Bluetooth AX203
  - linux-firmware: Update firmware file for Intel Bluetooth AX203
  - linux-firmware: Update firmware file for Intel Bluetooth AX211
  - linux-firmware: Update firmware file for Intel Bluetooth AX211
  - linux-firmware: Update firmware file for Intel Bluetooth AX210
  - linux-firmware: update firmware for MT7981
  - qca: Update firmware files for BT chip WCN6750
  - mt76xx: Move the old Mediatek WiFi firmware to mediatek
  - rtl_bt: Add firmware and config files for RTL8851B
  - linux-firmware: Update AMD cpu microcode
  - linux-firmware: add firmware for MT7981
  - linux-firmware: update firmware for MT7921 WiFi device
  - linux-firmware: update firmware for mediatek bluetooth chip (MT7921)
  - linux-firmware: update qat firmware
  - linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops
  - linux-firmware: update firmware for MT7916
  - rtw89: 8852b: update format-1 fw to v0.29.29.1
  - rtw89: 8852c: update fw to v0.27.56.13
  - ath11k: WCN6855 hw2.0: update board-2.bin
  - ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1
  - ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
  - ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
  - ath11k: IPQ8074 hw2.0: update board-2.bin
  - ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
  - ath11k: IPQ6018 hw1.0: update board-2.bin
  - ath10k: QCA99X0 hw2.0: update board-2.bin
  - ath10k: QCA9984 hw1.0: update board-2.bin
  - ath10k: QCA9888 hw2.0: update board-2.bin
  - ath10k: QCA6174 hw3.0: update board-2.bin
  - ath10k: QCA4019 hw1.0: update board-2.bin


author: Jan Stancek <jstancek@redhat.com> - 20230625-137
changelog:
  - Fix PSR-SU issues with kernel 6.2 or later (rhbz 2218668)
  - Update to upstream 20230625 release.
    Changes since the last update are noted on items below, copied from
    the git changelog of upstream linux-firmware repository.
  - Makefile, copy-firmware: support xz/zstd compressed firmware
  - copy-firmware: silence the last shellcheck warnings
  - copy-firmware: drop obsolete backticks, quote
  - copy-firmware: tweak sed invocation
  - copy-firmware: quote deskdir and dirname
  - check_whence: error if symlinks are in-tree
  - check_whence: error if File: is actually a link
  - check_whence: strip quotation marks
  - linux-firmware: wilc1000: update WILC1000 firmware to v16.0
  - ice: update ice DDP wireless_edge package to 1.3.10.0
  - amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5
  - amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs
  - fix broken cirrus firmware symlinks
  - qcom: Update the microcode files for Adreno a630 GPUs.
  - qcom: sdm845: rename the modem firmware
  - qcom: sdm845: update remoteproc firmware
  - rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D
  - rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225
  - amdgpu: DMCUB updates for various AMDGPU asics
  - linux-firmware: update firmware for MT7922 WiFi device
  - linux-firmware: update firmware for MT7921 WiFi device
  - linux-firmware: update firmware for mediatek bluetooth chip (MT7922)
  - linux-firmware: update firmware for mediatek bluetooth chip (MT7921)
  - i915: Add HuC v8.5.0 for MTL
  - mediatek: Update mt8195 SCP firmware to support hevc
  - qcom: apq8016: add Dragonboard 410c WiFi and modem firmware
  - cirrus: Add firmware for new Asus ROG Laptops
  - brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt
  - amdgpu: Update GC 11.0.1 and 11.0.4
  - rtw89: 8851b: add firmware v0.29.41.0
  - ice: update ice DDP comms package to 1.3.40.0
  - cxgb4: Update firmware to revision 1.27.3.0


author: Jan Stancek <jstancek@redhat.com> - 20230726-138
changelog:
  - Navi32 dGPU firmware (rhbz 2047486)
  - CVE-2023-20593 linux-firmware: hw: amd: Cross-Process Information Leak (rhbz 2227156)
  - Update to upstream 20230726 release.
    Changes since the last update are noted on items below, copied from
    the git changelog of upstream linux-firmware repository.
  - copy-firmware: Fix linking directories when using compression
  - copy-firmware: Fix test: unexpected operator
  - qcom: sc8280xp: LENOVO: remove directory sym link
  - qcom: sc8280xp: LENOVO: Remove execute bits
  - amdgpu: update VCN 4.0.0 firmware
  - amdgpu: add initial SMU 13.0.10 firmware
  - amdgpu: add initial SDMA 6.0.3 firmware
  - amdgpu: add initial PSP 13.0.10 firmware
  - amdgpu: add initial GC 11.0.3 firmware
  - linux-firmware: Update AMD fam17h cpu microcode
  - linux-firmware: Update AMD cpu microcode
  - amdgpu: update green sardine VCN firmware
  - amdgpu: update renoir VCN firmware
  - amdgpu: update raven VCN firmware
  - amdgpu: update raven2 VCN firmware
  - amdgpu: update Picasso VCN firmware
  - amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs
  - Updated NXP SR150 UWB firmware
  - wfx: update to firmware 3.16.1
  - mediatek: Update mt8195 SCP firmware to support 10bit mode
  - i915: update DG2 GuC to v70.8.0
  - i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL
  - cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models
  - Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5"
  - linux-firmware: update firmware for mediatek bluetooth chip (MT7922)
  - linux-firmware: update firmware for MT7922 WiFi device
  - linux-firmware: Update firmware file for Intel Bluetooth AX203
  - linux-firmware: Update firmware file for Intel Bluetooth AX203
  - linux-firmware: Update firmware file for Intel Bluetooth AX211
  - linux-firmware: Update firmware file for Intel Bluetooth AX211
  - linux-firmware: Update firmware file for Intel Bluetooth AX210
  - linux-firmware: Update firmware file for Intel Bluetooth AX200
  - linux-firmware: Update firmware file for Intel Bluetooth AX201
  - Fix qcom ASoC tglp WHENCE entry
  - check_whence: Check link targets are valid
  - iwlwifi: add new FWs from core80-39 release
  - iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release
  - qcom: Add Audio firmware for SC8280XP X13s


author: Jan Stancek <jstancek@redhat.com> - 20230814-139
changelog:
  - CVE-2023-20569 linux-firmware: hw amd: Return Address Predictor velunerability leading to information disclosure (rhbz 2230418)
  - [AMDCLIENT 9.3 Bug] Linux FW update to fix multi monitor behind TBT3 dock & random flickers (rhbz 2227845)
  - amdgpu: partially revert firmware for GC 11.0.0 and GC 11.0.2
  - linux-firmware: Update AMD cpu microcode
  - Merge branch 'for-upstream' of http://git.chelsio.net/pub/git/linux-firmware
  - rtl_bt: Add firmware v2 file for RTL8852C
  - Revert "rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225"
  - amdgpu: DMCUB updates for various AMDGPU asics
  - cxgb4: Update firmware to revision 1.27.4.0
  - Merge branch 'rb3-update' of https://github.com/lumag/linux-firmware
  - Merge https://github.com/pkshih/linux-firmware
  - Mellanox: Add new mlxsw_spectrum firmware xx.2012.1012
  - linux-firmware: Add URL for latest FW binaries for NXP BT chipsets
  - rtw89: 8851b: update firmware to v0.29.41.1
  - qcom: sdm845: add RB3 sensors DSP firmware
  - amdgpu: Update DMCUB for DCN314 & Yellow Carp
  - Merge branch 'dmc-adlp_2.20-mtl_2.13' of git://anongit.freedesktop.org/drm/drm-firmware
  - Merge branch 'for-upstream' of https://github.com/CirrusLogic/linux-firmware
  - ice: add LAG-supporting DDP package
  - i915: Update MTL DMC to v2.13
  - i915: Update ADLP DMC to v2.20
  - cirrus: Add CS35L41 firmware for Dell Oasis Models


author: Scott Weaver <scweaver@redhat.com> - 20230926-140
changelog:
  - [Intel 9.4 FEAT] [SPR][EMR] QAT firmware update available (rhbz 2238636)
  - [AMDCLIENT 9.4 Feature] Sub-Feature: AMD PMF Linux FW (rhbz 2227340)
    Changes since the last update are noted on items below, copied from
    the git changelog of upstream linux-firmware repository.
  - amd_pmf: Add initial PMF TA for Smart PC Solution Builder
  - linux-firmware: Update FW files for MRVL PCIE 8997 chipsets
  - rtl_bt: Update RTL8851B BT USB firmware to 0x048A_D230
  - iwlwifi: add new FWs from core81-65 release
  - iwlwifi: update cc/Qu/QuZ firmwares for core81-65 release
  - linux-firmware: amd-ucode: Add note on fam19h warnings
  - i915: update MTL HuC to version 8.5.4
  - amdgpu: update DMCUB to 0.0.183.0 for various AMDGPU ASICs
  - linux-firmware: add link to sc8280xp audioreach firmware
  - qcom: sm8250: add RB5 sensors DSP firmware
  - qcom: Update vpu-1.0 firmware
  - qcom: sm8250: update DSP firmware
  - qcom: add firmware for the onboard WiFi on qcm2290 / qrb4210
  - qcom: add venus firmware files for v6.0
  - qcom: add firmware for QRB4210 platforms
  - qcom: add firmware for QCM2290 platforms
  - qcom: add GPU firmware for QCM2290 / QRB2210
  - ath10k/WCN3990: move wlanmdsp to qcom/sdm845
  - WHENCE: Don't compress qcom json files
  - WHENCE: amd-ucode: Use new RawFile keyword
  - Create symlinks for all firmware that is duplicate using rdfind
  - QCA: Update Bluetooth WCN685x 2.1 firmware to 2.1.0-00605
  - Fix carl9170fw shell scripts for shellcheck errors
  - i915: Update MTL DMC to v2.16
  - copy-firmware: Introduce 'RawFile' keyword
  - copy-firmware: Support additional compressor options
  - linux-firmware: Update firmware file for Intel Bluetooth AX203
  - linux-firmware: Update firmware file for Intel Bluetooth AX203
  - linux-firmware: Update firmware file for Intel Bluetooth AX211
  - linux-firmware: Update firmware file for Intel Bluetooth AX211
  - linux-firmware: Update firmware file for Intel Bluetooth AX210
  - linux-firmware: Update firmware file for Intel Bluetooth AX200
  - linux-firmware: Update firmware file for Intel Bluetooth AX201
  - linux-firmware: update firmware for qat_4xxx devices
  - linux-firmware: Update AMD SEV firmware
  - amdgpu: update DMCUB to 0.0.181.0 for various AMDGPU ASICs
  - rtw89: 8852b: update fw to v0.29.29.3
  - rtw89: 8851b: update fw to v0.29.41.2
  - i915: add GSC 102.0.0.1655 for MTL
  - amdgpu: DMCUB updates for various AMDGPU asics
  - amdgpu: DMCUB updates for various AMDGPU asics
  - cirrus: Add CS35L41 firmware for HP G11 models


author: Scott Weaver <scweaver@redhat.com> - 20231030-141
changelog:
  - CVE-2022-46329 linux-firmware: hw: intel: Protection mechanism failure for some Intel(R) PROSet/Wireless WiFi (RHEL-14264)
  - amd-ucode early loading broken [RHEL-15387]
  - Update to upstream 20231030 release.
    Changes since the last update are noted on items below, copied from
    the git changelog of upstream linux-firmware repository.
  - Intel Bluetooth: Update firmware file for Intel Bluetooth AX211
  - Intel Bluetooth: Update firmware file for Intel Bluetooth AX210
  - Intel Bluetooth: Update firmware file for Intel Bluetooth Magnetor AX101
  - Intel Bluetooth: Update firmware file for Intel Bluetooth AX203
  - Intel Bluetooth: Update firmware file for Intel Bluetooth Magnetor AX201
  - Intel Bluetooth: Update firmware file for Intel Bluetooth Magnetor AX211
  - Intel Bluetooth: Update firmware file for Intel Bluetooth BE200
  - rtl_nic: update firmware of RTL8156B
  - linux-firmware: Update AMD cpu microcode
  - amdgpu: update SMU 13.0.0 firmware
  - linux-firmware: add Amlogic bluetooth firmware
  - i915: Add GuC v70.13.1 for DG2, TGL, ADL-P and MTL
  - iwlwifi: add a missing FW from core80-39 release
  - WHENCE: add symlink for BananaPi M64
  - linux-firmware: Add firmware file for Intel Bluetooth AX211
  - linux-firmware: Update firmware file for Intel Bluetooth AX201
  - linux-firmware: Update firmware file for Intel Bluetooth AX211
  - linux-firmware: Update firmware file for Intel Bluetooth AX210
  - linux-firmware: Update firmware file for Intel Bluetooth 9560
  - linux-firmware: Update firmware file for Intel Bluetooth 9260
  - i915: Update MTL DMC to v2.17
  - amdgpu: update raven firmware from 5.7 branch
  - amdgpu: update SDMA 5.2.7 firmware from 5.7 branch
  - amdgpu: update PSP 13.0.8 firmware from 5.7 branch
  - amdgpu: update GC 10.3.7 firmware from 5.7 branch
  - amdgpu: update DCN 3.1.6 firmware from 5.7 branch
  - amdgpu: update SDMA 5.2.6 firmware from 5.7 branch
  - amdgpu: update PSP 13.0.5 firmware from 5.7 branch
  - amdgpu: update GC 10.3.6 firmware from 5.7 branch
  - amdgpu: update VCN 4.0.0 firmware from 5.7 branch
  - amdgpu: update SMU 13.0.0 firmware from 5.7 branch
  - amdgpu: update SDMA 6.0.0 firmware from 5.7 branch
  - amdgpu: update PSP 13.0.0 firmware from 5.7 branch
  - amdgpu: update GC 11.0.0 firmware from 5.7 branch
  - amdgpu: update vega20 firmware from 5.7 branch
  - amdgpu: update beige goby firmware from 5.7 branch
  - amdgpu: update vega12 firmware from 5.7 branch
  - amdgpu: update vega10 firmware from 5.7 branch
  - amdgpu: update dimgrey cavefish firmware from 5.7 branch
  - amdgpu: update picasso firmware from 5.7 branch
  - amdgpu: update navy flounder firmware from 5.7 branch
  - amdgpu: update vangogh firmware from 5.7 branch
  - amdgpu: update green sardine firmware from 5.7 branch
  - amdgpu: update sienna cichlid firmware from 5.7 branch
  - amdgpu: update PSP 13.0.11 firmware from 5.7 branch
  - amdgpu: update GC 11.0.4 firmware from 5.7 branch
  - amdgpu: update SDMA 6.0.1 firmware from 5.7 branch
  - amdgpu: update PSP 13.0.4 firmware from 5.7 branch
  - amdgpu: update GC 11.0.1 firmware from 5.7 branch
  - amdgpu: update navi14 firmware from 5.7 branch
  - amdgpu: update renoir firmware from 5.7 branch
  - amdgpu: update navi12 firmware from 5.7 branch
  - amdgpu: update VCN 4.0.4 firmware from 5.7 branch
  - amdgpu: update SMU 13.0.7 firmware from 5.7 branch
  - amdgpu: update SDMA 6.0.2 firmware from 5.7 branch
  - amdgpu: update PSP 13.0.7 firmware from 5.7 branch
  - amdgpu: update GC 11.0.2 firmware from 5.7 branch
  - amdgpu: update yellow carp firmware from 5.7 branch
  - amdgpu: update navi10 firmware from 5.7 branch
  - amdgpu: update raven2 firmware from 5.7 branch
  - amdgpu: update SMU 13.0.10 firmware from 5.7 branch
  - amdgpu: update PSP 13.0.10 firmware from 5.7 branch
  - amdgpu: update GC 11.0.3 firmware from 5.7 branch
  - amdgpu: update aldebaran firmware from 5.7 branch
  - iwlwifi: add FWs for new GL and MA device types with multiple RF modules


author: Scott Weaver <scweaver@redhat.com> - 20240109-142
changelog:
  - [DELL 9.3 BUG]System resume failed from suspend and auto reboot with WCN6856 (1/10 fail rate) (RHEL-4431)
  - [DELL 9.3 FEAT] - linux-firmware: Include to support QCA WIFI-7 WCN7850 Module: wifi firmware support (RHEL-10212)
    Changes since the last update are noted on items below, copied from
    the git changelog of upstream linux-firmware repository.
  - linux-firmware: update firmware for w1u_uart
  - amdgpu: DMCUB updates for DCN314
  - Intel Bluetooth: Update firmware file for Magnetor Intel Bluetooth AX211
  - Intel Bluetooth: Update firmware file for Solar Intel Bluetooth AX101
  - Intel Bluetooth: Update firmware file for Solar Intel Bluetooth AX203
  - Intel Bluetooth: Update firmware file for Solar Intel Bluetooth AX210
  - amlogic/bluetooth: add firmware bin of W1 serial soc(w1u_uart)
  - linux-firmware: add firmware for mediatek bluetooth chip (MT7925)
  - linux-firmware: add firmware for MT7925
  - ASoC: tas2563: Add dsp firmware for laptops or other mobile devices
  - rtl_bt: Add firmware and config files for RTL8852BT/RTL8852BE-VT
  - ASoC: tas2781: Add dsp firmware for different laptops
  - ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.36
  - ath11k: WCN6855 hw2.0: update board-2.bin
  - ath11k: WCN6750 hw1.0: update board-2.bin
  - ath11k: IPQ8074 hw2.0: update board-2.bin
  - ath10k: WCN3990 hw1.0: update board-2.bin
  - ath10k: QCA9888 hw2.0: update board-2.bin
  - ath10k: QCA4019 hw1.0: update board-2.bin
  - ath10k: QCA6174 hw3.0: update firmware-6.bin to WLAN.RM.4.4.1-00309-
  - ath12k: add new driver and firmware for WCN7850
  - iwlwifi: update gl FW for core80-165 release
  - intel: vsc: Add firmware for Visual Sensing Controller
  - cirrus: Add CS35L41 firmware and tunings for ASUS Zenbook 2023 Models
  - cirrus: Add CS35L41 firmware and tunings for ASUS Zenbook 2022 Models
  - QCA: Add bluetooth firmware nvm files for QCA2066
  - QCA: Update Bluetooth QCA2066 firmware to 2.1.0-00629
  - amdgpu: DMCUB updates for various AMDGPU ASICs
  - qcom: Add Audio firmware for SM8650 QRD
  - qcom: Add Audio firmware for SM8550 QRD
  - wfx: update to firmware 3.17
  - wfx: fix broken firmware
  - linux-firmware: Update AMD cpu microcode
  - cxgb4: Update firmware to revision 1.27.5.0
  - linux-firmware: add firmware for en8811h 2.5G ethernet phy
  - s5p-mfc: Add MFC v12 Firmware
  - rtl_bt: Update RTL8852A BT USB firmware to 0xDFC8_145F
  - ice: update ice DDP wireless_edge package to 1.3.13.0
  - linux-firmware: update firmware for mediatek bluetooth chip (MT7922)
  - linux-firmware: update firmware for mediatek bluetooth chip (MT7921)
  - linux-firmware: update firmware for MT7922 WiFi device
  - linux-firmware: update firmware for MT7921 WiFi device
  - amdgpu: update DMCUB firmware to 0.0.194.0 for DCN321 and DCN32
  - qcom: update qrb4210 firmware
  - qcom: update qcm2290 firmware
  - qcom: update qcm2290/qrb4210 WiFi firmware file
  - qcom: update Venus firmware file for v6.0
  - powervr: add firmware for Imagination Technologies AXE-1-16M GPU
  - ice: update ice DDP comms package to 1.3.45.0
  - ice: update ice DDP package to 1.3.35.0
  - mediatek: Remove an unused packed library
  - mediatek: Sync shared memory structure changes
  - Intel Bluetooth: Update firmware file for Intel Bluetooth BE200
  - amdgpu: update DMCUB firmware to 0.0.193.0 for DCN31 and DCN314
  - i915: Update MTL DMC to v2.19
  - iwlwifi: fix for the new FWs from core83-55 release
  - iwlwifi: add new FWs from core83-55 release
  - iwlwifi: update cc/Qu/QuZ firmwares for core83-55 release
  - linux-firmware: Add firmware for Cirrus CS35L41 on HP G11 Laptops
  - linux-firmware: Add firmware for Cirrus CS35L41 on 2024 ASUS Zenbook Laptops
  - linux-firmware: add firmware for mt7988 internal 2.5G ethernet phy
  - Intel Bluetooth: Update firmware file for Magnetor Intel Bluetooth AX101
  - Intel Bluetooth: Update firmware file for Magnetor Intel Bluetooth AX203
  - Intel Bluetooth: Update firmware file for SolarF Intel Bluetooth AX101
  - Intel Bluetooth: Update firmware file for SolarF Intel Bluetooth AX203
  - Intel Bluetooth: Update firmware file for SolarF Intel Bluetooth AX211
  - Intel Bluetooth: Update firmware file for Solar Intel Bluetooth AX211
  - amdgpu: DMCUB updates for various AMDGPU ASICs
  - nvidia: add GSP-RM version 535.113.01 firmware images
  - Intel Bluetooth: Update firmware file for Intel Bluetooth BE200
  - amdgpu: DMCUB updates for various AMDGPU ASICs
  - qca: add bluetooth firmware for WCN3988
  - linux-firmware: ixp4xx: Add the IXP4xx firmware
  - rtw89: 8852b: update fw to v0.29.29.5
  - rtw89: 8852b: update fw to v0.29.29.4
  - rtw89: 8851b: update fw to v0.29.41.3


author: Scott Weaver <scweaver@redhat.com> - 20240219-143
changelog:
  - [AMDCLIENT 9.4 Bug] Update PHX 1/2 firmware to fix some PSR related issues (RHEL-25408)
    Changes since the last update are noted on items below, copied from
    the git changelog of upstream linux-firmware repository.
  - xe: First GuC release for LNL and Xe
  - i915: Add GuC v70.20.0 for ADL-P, DG1, DG2, MTL and TGL
  - linux-firmware: Add CS35L41 firmware for Lenovo Legion 7i gen7 laptop (16IAX7)
  - brcm: Add nvram for the Asus Memo Pad 7 ME176C tablet
  - ice: update ice DDP package to 1.3.36.0
  - Intel IPU3 ImgU: Move firmware file under intel/ipu
  - Intel IPU6: Move firmware binaries under ipu/
  - linux-firmware: Add CS35L41 firmware for additional ASUS Zenbook 2023 models
  - panthor: Add initial firmware for Gen10 Arm Mali GPUs
  - amdgpu: DMCUB Updates for DCN321: 7.0.38.0
  - amdgpu: DMCUB updates for Yellow Carp: 4.0.68.0
  - qcom: update venus firmware file for v5.4
  - Montage: add firmware for Mont-TSSE
  - amdgpu: update DMCUB to v0.0.203.0 for DCN314 and DCN32
  - linux-firmware: Remove 2 HP laptops using CS35L41 Audio Firmware
  - linux-firmware: Fix filenames for some CS35L41 firmwares for HP
  - linux-firmware: wilc1000: update WILC1000 firmware to v16.1.2
  - rtl_nic: add firmware for RTL8126A
  - linux-firmware: intel: Add IPU6 firmware binaries
  - ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.37
  - qcom: Add Audio firmware for SM8550 HDK
  - Revert "amdgpu: DMCUB updates for various AMDGPU ASICs"
  - amdgpu: update SMU 13.0.0 firmware
  - amdgpu: update PSP 13.0.0 firmware
  - amdgpu: update GC 11.0.0 firmware
  - brcm: Add brcmfmac43430-sdio.xxx.txt nvram for the Chuwi Hi8 (CWI509) tablet
  - amdgpu: DMCUB updates for various AMDGPU ASICs
  - qcom: Add Audio firmware for SM8650 MTP
  - linux-firmware: Add firmware for Cirrus CS35L41 on HP Consumer Laptops
  - amdgpu: update raven2 firmware
  - amdgpu: update raven firmware
  - amdgpu: update SDMA 5.2.7 firmware
  - amdgpu: update PSP 13.0.8 firmware
  - amdgpu: update VCN 3.1.2 firmware
  - amdgpu: update SDMA 5.2.6 firmware
  - amdgpu: update PSP 13.0.5 firmware
  - amdgpu: update GC 10.3.6 firmware
  - amdgpu: add GC 11.0.1 rlc_1 firmware
  - amdgpu: update vega20 firmware
  - amdgpu: update VCN 4.0.0 firmware
  - amdgpu: update SMU 13.0.0 firmware
  - amdgpu: update PSP 13.0.0 firmware
  - amdgpu: update GC 11.0.0 firmware
  - amdgpu: update vega12 firmware
  - amdgpu: update vega10 firmware
  - amdgpu: update beige goby firmware
  - amdgpu: update picasso firmware
  - amdgpu: update dimgrey cavefish firmware
  - amdgpu: update vangogh firmware
  - amdgpu: update navy flounder firmware
  - amdgpu: update green sardine firmware
  - amdgpu: update sienna cichlid firmware
  - amdgpu: update PSP 13.0.11 firmware
  - amdgpu: update GC 11.0.4 firmware
  - amdgpu: update VCN 4.0.2 firmware
  - amdgpu: update PSP 13.0.4 firmware
  - amdgpu: update GC 11.0.1 firmware
  - amdgpu: update arcturus firmware
  - amdgpu: update navi14 firmware
  - amdgpu: add VCN 4.0.3 firmware
  - amdgpu: add SDMA 4.4.2 firmware
  - amdgpu: add SMU 13.0.6 firmware
  - amdgpu: add PSP 13.0.6 firmware
  - amdgpu: Add GC 9.4.3 firmware
  - amdgpu: update renoir firmware
  - amdgpu: update VCN 4.0.4 firmware
  - amdgpu: update SMU 13.0.7 firmware
  - amdgpu: update PSP 13.0.7 firmware
  - amdgpu: update GC 11.0.2 firmware
  - amdgpu: update navi12 firmware
  - amdgpu: update yellow carp firmware
  - amdgpu: update SMU 13.0.10 firmware
  - amdgpu: update SDMA 6.0.3 firmware
  - amdgpu: update PSP 13.0.10 firmware
  - amdgpu: update GC 11.0.3 firmware
  - amdgpu: update navi10 firmware
  - amdgpu: update aldebaran firmware
  - linux-firmware: Update AMD cpu microcode
  - RTL8192E: Remove old realtek WiFi firmware
  - Intel Bluetooth: Update firmware file for Magnetor Intel Bluetooth AX101
  - Intel Bluetooth: Update firmware file for Magnetor Intel Bluetooth AX203
  - Intel Bluetooth: Update firmware file for SolarF Intel Bluetooth AX203
  - Intel Bluetooth: Update firmware file for SolarF Intel Bluetooth AX211
  - Intel Bluetooth: Update firmware file for Solar Intel Bluetooth AX211
  - amdgpu: DMCUB updates for DCN314
  - qcom: Update the firmware for Adreno a630 family of GPUs
  - cirrus: Add CS35L41 firmware for Legion Slim 7 Gen 8 laptops
  - linux-firmware: Add firmware for Cirrus CS35L41 for various Dell laptops
  - linux-firmware: update firmware for qat_4xxx devices
  - cirrus: Add firmware file for cs42l43
  - amdgpu: DMCUB updates for DCN312
  - amdgpu: DMCUB updates for DCN314
  - Intel Bluetooth: Update firmware file for Magnetor Intel Bluetooth AX211
  - Intel Bluetooth: Update firmware file for Solar Intel Bluetooth AX101
  - Intel Bluetooth: Update firmware file for Solar Intel Bluetooth AX203
  - Intel Bluetooth: Update firmware file for Solar Intel Bluetooth AX210


author: Denys Vlasenko <dvlasenk@redhat.com> - 20240603-143.1
changelog:
  - [AMD 9.3 FEAT]: MI300 GPU firmware (RHEL-10056)
  - CVE-2023-31346 linux-firmware: kernel: Reserved fields in guest message responses may not be zero initialized [rhel-9.4.z] (RHEL-35597)
  - linux-firmware ships encrypted zip files (named *.ncf) (RHEL-32145)
    Changes since the last update are noted on items below, copied from
    the git changelog of upstream linux-firmware repository.
  - amdgpu: add support for PSP 14.0.1
  - amdgpu: add support for VPE 6.1.1
  - amdgpu: add support for VCN 4.0.6
  - amdgpu: add support for SDMA 6.1.1
  - amdgpu: add support for GC 11.5.1
  - amdgpu: Add support for DCN 3.5.1
  - cnm: update chips&media wave521c firmware.
  - linux-firmware: Add ordinary firmware for RTL8821AU device
  - amdgpu: add new ISP 4.1.1 firmware
  - amdgpu: DMCUB updates for various AMDGPU ASICs
  - linux-firmware: Amphion: Update vpu firmware
  - linux-firmware: Update firmware file for Intel BlazarU core
  - linux-firmware: Update firmware file for Intel Bluetooth Magnetor core
  - linux-firmware: Update firmware file for Intel Bluetooth Solar core
  - linux-firmware: Update firmware file for Intel Bluetooth Solar core
  - i915: Add BMG DMC v2.06
  - linux-firmware: Add CS35L41 HDA Firmware for Asus HN7306
  - linux-firmware: Update firmware tuning for HP Consumer Laptop
  - amdgpu: DMCUB updates for various AMDGPU ASICs
  - rtl_bt: Update RTL8822C BT UART firmware to 0x0FD6_407B
  - rtl_bt: Update RTL8822C BT USB firmware to 0x0ED6_407B
  - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various ASUS laptops
  - linux-firmware: Add firmware and tuning for Lenovo Y770S
  - amdgpu: DMCUB updates for various AMDGPU ASICs
  - linux-firmware: Add firmware for Cirrus CS35L56 for various HP laptops
  - i915: Update Xe2LPD DMC to v2.20
  - linux-firmware: Remove Calibration Firmware and Tuning for CS35L41
  - linux-firmware: Add firmware for Lenovo Thinkbook 13X
  - ASoC: tas2781: Add dsp firmware for Thinkpad ICE-1 laptop
  - amdgpu: add DMCUB 3.5 firmware
  - amdgpu: add VPE 6.1.0 firmware
  - amdgpu: add VCN 4.0.5 firmware
  - amdgpu: add UMSCH 4.0.0 firmware
  - amdgpu: add SDMA 6.1.0 firmware
  - amdgpu: add PSP 14.0.0  firmware
  - amdgpu: add GC 11.5.0 firmware
  - amdgpu: update license date
  - Montage: update firmware for Mont-TSSE
  - linux-firmware: Add tuning parameter configs for CS35L41 Firmware
  - linux-firmware: Fix firmware names for Laptop SSID 104316a3
  - linux-firmware: Add CS35L41 HDA Firmware for Lenovo Legion Slim 7 16ARHA7
  - linux-firmware: update firmware for mediatek bluetooth chip (MT7922)
  - linux-firmware: update firmware for MT7922 WiFi device
  - iwlwifi: add gl FW for core87-44 release
  - iwlwifi: add ty/So/Ma firmwares for core87-44 release
  - iwlwifi: update cc/Qu/QuZ firmwares for core87-44 release
  - nvidia: Update Tegra210 XUSB firmware to v50.29
  - amdgpu: update beige goby firmware
  - amdgpu: update dimgrey cavefish firmware
  - amdgpu: update psp 13.0.11 firmware
  - amdgpu: update gc 11.0.4 firmware
  - amdgpu: update navy flounder firmware
  - amdgpu: update renoir firmware
  - amdgpu: update vcn 4.0.2 firmware
  - amdgpu: update sdma 6.0.1 firmware
  - amdgpu: update psp 13.0.4 firmware
  - amdgpu: update gc 11.0.1 firmware
  - amdgpu: update sienna cichlid firmware
  - amdgpu: update vega20 firmware
  - amdgpu: update yellow carp firmware
  - amdgpu: update green sardine firmware
  - amdgpu: update vega12 firmware
  - amdgpu: update raven2 firmware
  - amdgpu: update vcn 4.0.4 firmware
  - amdgpu: update smu 13.0.7 firmware
  - amdgpu: update sdma 6.0.2 firmware
  - amdgpu: update ipsp 13.0.7 firmware
  - amdgpu: update gc 11.0.2 firmware
  - amdgpu: update vega10 firmware
  - amdgpu: update raven firmware
  - amdgpu: update navi14 firmware
  - amdgpu: update smu 13.0.10 firmware
  - amdgpu: update sdma 6.0.3 firmware
  - amdgpu: update psp 13.0.10 firmware
  - amdgpu: update gc 11.0.3 firmware
  - amdgpu: update vcn 3.1.2 firmware
  - amdgpu: update psp 13.0.5 firmware
  - amdgpu: update gc 10.3.6 firmware
  - amdgpu: update navi12 firmware
  - amdgpu: update arcturus firmware
  - amdgpu: update vangogh firmware
  - amdgpu: update navi10 firmware
  - amdgpu: update vcn 4.0.3 firmware
  - amdgpu: update smu 13.0.6 firmware
  - amdgpu: update psp 13.0.6 firmware
  - amdgpu: update gc 9.4.3 firmware
  - amdgpu: update vcn 4.0.0 firmware
  - amdgpu: update smu 13.0.0 firmware
  - amdgpu: update sdma 6.0.0 firmware
  - amdgpu: update psp 13.0.0 firmware
  - amdgpu: update gc 11.0.0 firmware
  - amdgpu: update  firmware
  - amdgpu: update aldebaran firmware
  - amdgpu: update psp 13.0.8 firmware
  - amdgpu: update gc 10.3.7 firmware
  - linux-firmware: mediatek: Update MT8173 VPU firmware to v1.1.9
  - Merge https://github.com/pkshih/linux-firmware into rtw
  - ath10k: WCN3990: hw1.0: add qcm2290 firmware API file
  - ath10k: WCN3990: hw1.0: move firmware back from qcom/ location
  - i915: Add DG2 HuC 7.10.15
  - amdgpu: DMCUB updates for various AMDGPU ASICs
  - linux-firmware: update firmware for en8811h 2.5G ethernet phy
  - mekdiatek: Update mt8186 SOF firmware to v2.0.1
  - rtw89: 8852c: update fw to v0.27.56.14
  - rtw89: 8922a: add firmware v0.35.18.0
  - rtw88: Add RTL8703B firmware v11.0.0
  - linux-firmware: Add firmware for Cirrus CS35L56 for Dell laptops
  - Montage: update firmware for Mont-TSSE
  - WHENCE: Link the Raspberry Pi CM4 and 5B to the 4B
  - Intel Bluetooth: Update firmware file for Intel Bluetooth BE200
  - Intel Bluetooth: Update firmware file for Magnetor Intel Bluetooth AX101
  - Intel Bluetooth: Update firmware file for Magnetor Intel Bluetooth AX203
  - Intel Bluetooth: Update firmware file for Magnetor Intel Bluetooth AX211
  - Intel Bluetooth: Update firmware file for SolarF Intel Bluetooth AX101
  - Intel Bluetooth: Update firmware file for Solar Intel Bluetooth AX101
  - Intel Bluetooth: Update firmware file for SolarF Intel Bluetooth AX203
  - Intel Bluetooth: Update firmware file for Solar Intel Bluetooth AX203
  - Intel Bluetooth: Update firmware file for SolarF Intel Bluetooth AX211
  - Intel Bluetooth: Update firmware file for Solar Intel Bluetooth AX211
  - Intel Bluetooth: Update firmware file for Solar Intel Bluetooth AX210
  - Intel Bluetooth: Update firmware file for Intel Bluetooth AX200
  - Intel Bluetooth: Update firmware file for Intel Bluetooth AX201
  - Intel Bluetooth: Update firmware file for Intel Bluetooth 9560
  - Intel Bluetooth: Update firmware file for Intel Bluetooth 9260
  - amdgpu: DMCUB updates for various AMDGPU ASICs
  - linux-firmware: mediatek: Update MT8173 VPU firmware to v1.1.8
  - imx: sdma: update firmware to v3.6/v4.6
  - linux-firmware: update firmware for mediatek bluetooth chip (MT7921)
  - iwlwifi: update 9000-family firmwares to core85-89
  - rtl_bt: Update RTL8852A BT USB firmware to 0xD9D6_17DA
  - linux-firmware: update firmware for MT7921 WiFi device
  - linux-firmware: update firmware for mediatek bluetooth chip (MT7922)
  - linux-firmware: update firmware for MT7922 WiFi device
  - linux-firmware: Add CS35L41 HDA Firmware for Lenovo Thinkbook 16P Laptops
  - amdgpu: Update VCN firmware binaries
  - Intel IPU2: Add firmware files
  - brcm: Add nvram for the Acer Iconia One 7 B1-750 tablet
  - i915: Add Xe2LPD DMC v2.18
  - i915: Update MTL DMC v2.21
  - linux-firmware: update firmware for en8811h 2.5G ethernet phy
  - linux-firmware: add firmware for MT7996


author: Jan Stancek <jstancek@redhat.com> - 20230404-134
changelog:
  - Update to upstream 20230404 release (rhbz 2183603).
    Changes since the last update are noted on items below, copied from
    the git changelog of upstream linux-firmware repository.
  - nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW
  - linux-firmware: update firmware for MT7922 WiFi device
  - linux-firmware: update firmware for mediatek bluetooth chip (MT7922)
  - linux-firmware: Amphion: Update vpu firmware
  - iwlwifi: add new FWs from core78-32 release
  - iwlwifi: update 9000-family firmwares to core78-32
  - amdgpu: Update SDMA 6.0.1 firmware
  - amdgpu: Add PSP 13.0.11 firmware
  - amdgpu: Update PSP 13.0.4 firmware
  - amdgpu: Update GC 11.0.1 firmware
  - amdgpu: Update DCN 3.1.4 firmware
  - amdgpu: Add GC 11.0.4 firmware
  - rtw88: 8822c: Update normal firmware to v9.9.15
  - linux-firmware: Update firmware file for Intel Bluetooth AX101
  - linux-firmware: Update firmware file for Intel Bluetooth 9462
  - linux-firmware: Update firmware file for Intel Bluetooth 9462
  - linux-firmware: Update firmware file for Intel Bluetooth 9560
  - linux-firmware: Update firmware file for Intel Bluetooth 9560
  - linux-firmware: Update firmware file for Intel Bluetooth AX203
  - linux-firmware: Update firmware file for Intel Bluetooth AX203
  - linux-firmware: Update firmware file for Intel Bluetooth AX211
  - linux-firmware: Update firmware file for Intel Bluetooth AX211
  - linux-firmware: Update firmware file for Intel Bluetooth AX210
  - linux-firmware: add firmware files for NXP BT chipsets
  - rtw89: 8852b: update format-1 fw to v0.29.29.0
  - rtw89: 8852b: add format-1 fw v0.29.26.0
  - rtw89: 8852b: rollback firmware to v0.27.32.1
  - i915: Update MTL DMC to v2.12
  - i915: Update ADLP DMC to v2.19
  - mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21
  - iwlwifi: update core69 and core72 firmwares for So device


author: Charalampos Stratakis <cstratak@redhat.com> - 2.13.1-1
changelog:
  - Update to 2.13.1 (#1831402)
  - Fix docs build failures with Sphinx 3 (#1823532)
  - Use make macros: https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro


author: Vladis Dronov <vdronov@redhat.com> - 3.0.2.git.d18d5863-1
changelog:
  - Update to the upstream v3.0.2 + tip of origin/master
    with fixes for an important issue:
    https://github.com/nhorman/rng-tools/pull/123
    https://github.com/smuellerDD/jitterentropy-library/issues/37
  - Add important upstream fixes for the one CPU case (bz 1974132)


author: Vladis Dronov <vdronov@redhat.com> - 3.0.2-2.git.409828cf
changelog:
  - Update to the latest upstream commits upto 409828cf (bz 1973157)
  - Add clock_gettime() software time source
  - Add a code for choosing between software and hardware time sources
    https://github.com/smuellerDD/jitterentropy-library/pull/57
    https://bugzilla.redhat.com/show_bug.cgi?id=1974132


author: Vladis Dronov <vdronov@redhat.com> - 3.3.1-2
changelog:
  - Update to the upstream v3.3.1 @ 887c9871 (bz 2015560)
  - Fix a security issue found by a covscan in jitterentropy library


author: Björn Esser <besser82@fedoraproject.org> - 0.14-2
changelog:
  - Add a patch to backport fixes applied on upstream master branch
  - Re-enable RDRAND as json-c can detect broken implementations in CPUs now
  - Disable -Werror during build


author: Björn Esser <besser82@fedoraproject.org> - 0.14-6
changelog:
  - Build using Ninja instead of Make
  - Add a patch to move Doxyfile into doc subdir
  - Remove pre-built html documentation
  - Update Doxyfile during %prep
  - Add a patch to apply some optimizations to arraylist
  - Hardlink the files in %_pkgdocdir


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.4.0-4
changelog:
  - Fix layout->keymap conversion broken by change in xkeyboard-config
    (patch by Peter Hutterer)
    Resolves: #1950406


author: Tao Liu <ltao@redhat.com> - 2.0.26-7
changelog:
  - kdumpctl: Fix temporary directory location
  - kdump-lib: Match 64k debug kernel in prepare_kdump_bootinfo()


author: Tao Liu <ltao@redhat.com> - 2.0.26-9
changelog:
  - Introduce a function to get reserved memory size
  - powerpc: update fadump sysfs node path
  - kdumpctl: merge check_current_{kdump,fadump}_status
  - kdumpctl: remove unnecessary uses of $?


author: Tao Liu <ltao@redhat.com> - 2.0.27-3
changelog:
  - Rebase makedumpfile to v1.7.4
  - powerpc: update kdumpctl to load kernel signing key for fadump
  - powerpc: update kdumpctl to remove deletion of kernel signing key once loaded


author: Tao Liu <ltao@redhat.com> - 2.0.27-4
changelog:
  - kdump-lib.sh: add extra 64M to default crashkernel if sme/sev is active
  - Allow _crashkernel_add to address larger memory ranges
  - kdump-lib: Harden _crashkernel_add


author: Tao Liu <ltao@redhat.com> - 2.0.27-7
changelog:
  - Explain the auto_reset_crashkernel option in more details
  - Use the same /etc/resolve.conf in kdump initrd if it's managed manually


author: Tao Liu <ltao@redhat.com> - 2.0.27-8.1
changelog:
  - kexec_file: add kexec_file flag to support debug printing
  - mkdumprd: Fix makedumpfile parameter check.


author: Tao Liu <ltao@redhat.com> - 2.0.27-8.2
changelog:
  - Install the driver of physical device for a SR-IOV virtual device
  - Try to install PHY and MDIO bus drivers explicitly


author: Julien Rische <jrische@redhat.com> - 1.20.1-1
changelog:
  - Make tests compatible with sssd-client
    Resolves: rhbz#2151513
  - Remove invalid password expiry warning
    Resolves: rhbz#2121099
  - Update error checking for OpenSSL CMS_verify
    Resolves: rhbz#2063838
  - New upstream version (1.20.1)
    Resolves: rhbz#2016312
  - Fix integer overflows in PAC parsing (CVE-2022-42898)
    Resolves: rhbz#2140971


author: Julien Rische <jrische@redhat.com> - 1.20.1-4
changelog:
  - Set aes256-cts-hmac-sha384-192 as EXAMLE.COM master key in kdc.conf
  - Add AES SHA-2 HMAC family as EXAMPLE.COM supported etypes in kdc.conf
    Resolves: rhbz#2068535


author: Julien Rische <jrische@redhat.com> - 1.20.1-5
changelog:
  - Bypass FIPS restrictions to use KRB5KDF in case AES SHA-1 HMAC is enabled
  - Lazily load MD4/5 from OpenSSL if using RADIUS or RC4 enctype in FIPS mode
    Resolves: rhbz#2162461


author: Julien Rische <jrische@redhat.com> - 1.20.1-9
changelog:
  - Do not disable PKINIT if some of the well-known DH groups are unavailable
    Resolves: rhbz#2187722
  - Make PKINIT CMS SHA-1 signature verification available in FIPS mode
    Resolves: rhbz#2155607
  - Allow to set PAC ticket signature as optional
    Resolves: rhbz#2178298


author: Julien Rische <jrische@redhat.com> - 1.21.1-1
changelog:
  - New upstream version (1.21.1)
  - Fix double-free in KDC TGS processing (CVE-2023-39975)
  - Add support for "pac_privsvr_enctype" KDB string attribute
    Resolves: rhbz#2060421


author: Honza Horak <hhorak@redhat.com> - 590-1
changelog:
  - Update to the version 590
  - Also solves the "message overlay" in the terminal
    Resolves: #2062188


author: Marek Polacek <polacek@redhat.com> 11.4.1-2
changelog:
  - update from releases/gcc-11-branch (#2193180)
    - GCC 11.4 release
    - PRs bootstrap/90543, c++/53932, c++/69410, c++/92752, c++/98056,
  	c++/98821, c++/100295, c++/100474, c++/101118, c++/101869,
  	c++/102780, c++/103871, c++/104527, c++/105406, c++/105996,
  	c++/106188, c++/106675, c++/106713, c++/106740, c++/107065,
  	c++/107163, c++/107179, c++/107558, c++/107579, c++/107864,
  	c++/108138, c++/108180, c++/108365, c++/108468, c++/108474,
  	c++/108607, c++/108975, c++/108998, c++/109096, c++/109164, c/107127,
  	c/107465, c/109151, d/107592, d/108050, d/108877, d/109108,
  	debug/106719, debug/108573, debug/108716, debug/108967, driver/106624,
  	fortran/85877, fortran/95107, fortran/96024, fortran/96025,
  	fortran/99036, fortran/103259, fortran/104332, fortran/106209,
  	fortran/106945, fortran/107576, fortran/107872, fortran/108131,
  	fortran/108349, fortran/108420, fortran/108421, fortran/108451,
  	fortran/108453, fortran/108501, fortran/108502, fortran/108527,
  	fortran/108529, fortran/108609, fortran/108937, fortran/109186,
  	fortran/109511, fortran/109846, ipa/105685, ipa/106124, ipa/107944,
  	libquadmath/87204, libquadmath/94756, libstdc++/91456,
  	libstdc++/103934, libstdc++/104866, libstdc++/104875,
  	libstdc++/105844, libstdc++/106183, libstdc++/107801,
  	libstdc++/107814, libstdc++/108030, libstdc++/108118,
  	libstdc++/108265, libstdc++/108636, libstdc++/108856,
  	libstdc++/108952, libstdc++/109064, libstdc++/109261,
  	libstdc++/109949, lto/109263, middle-end/104450, middle-end/104464,
  	middle-end/106190, middle-end/107317, middle-end/108237,
  	middle-end/108264, middle-end/108435, middle-end/108459,
  	middle-end/108546, middle-end/108625, middle-end/108685,
  	middle-end/108854, other/108560, other/109306,
  	rtl-optimization/106751, rtl-optimization/107482,
  	rtl-optimization/108193, rtl-optimization/108596,
  	rtl-optimization/109585, target/70243, target/90458, target/96373,
  	target/98776, target/100758, target/104871, target/104921,
  	target/105554, target/105599, target/106736, target/106875,
  	target/107568, target/107714, target/107863, target/108272,
  	target/108348, target/108589, target/108699, target/108807,
  	target/108812, target/108881, target/109067, target/109140,
  	target/109276, testsuite/47334, testsuite/103823, testsuite/108151,
  	testsuite/108973, testsuite/108985, tree-optimization/105484,
  	tree-optimization/106809, tree-optimization/107107,
  	tree-optimization/107212, tree-optimization/107254,
  	tree-optimization/107323, tree-optimization/107451,
  	tree-optimization/107554, tree-optimization/107898,
  	tree-optimization/107997, tree-optimization/108068,
  	tree-optimization/108076, tree-optimization/108095,
  	tree-optimization/108199, tree-optimization/108498,
  	tree-optimization/108688, tree-optimization/108692,
  	tree-optimization/108821, tree-optimization/108950,
  	tree-optimization/109176, tree-optimization/109410,
  	tree-optimization/109473, tree-optimization/109491,
  	tree-optimization/109502, tree-optimization/109573,
  	tree-optimization/109724, tree-optimization/109778
    - PRs fortran/100607, libstdc++/109822, target/109954,
  	tree-optimization/109505


author: Marek Polacek <polacek@redhat.com> 11.4.1-2.1
changelog:
  - fix ICE on pr96024.f90 on big-endian hosts (PR fortran/96024, #2213211)
  - use -fno-stack-protector to fix bit-field aarch64 tests (#2213221)


author: Marek Polacek <polacek@redhat.com> 11.4.1-3
changelog:
  - update from releases/gcc-11-branch (RHEL-17638)
    - PRs c++/106310, c++/106890, c++/109666, c++/109761, c++/111357,
  	c++/111512, c++/112795, d/108842, d/110359, d/110511, d/110516,
  	debug/110295, fortran/95947, fortran/103506, fortran/107397,
  	fortran/110288, fortran/110585, fortran/110658, fortran/111837,
  	fortran/111880, libstdc++/95048, libstdc++/99327, libstdc++/104161,
  	libstdc++/104242, libstdc++/108178, libstdc++/111050,
  	libstdc++/111511, libstdc++/112314, libstdc++/112491,
  	middle-end/110200, middle-end/111699, middle-end/111818,
  	middle-end/112733, rtl-optimization/110237, sanitizer/112727,
  	target/96762, target/101177, target/101469, target/105325,
  	target/109800, target/109932, target/110011, target/110044,
  	target/110170, target/110309, target/110741, target/111001,
  	target/111340, target/111367, target/111408, target/111815,
  	target/112672, target/112816, target/112837, target/112845,
  	target/112891, testsuite/66005, tree-optimization/110298,
  	tree-optimization/110731, tree-optimization/110914,
  	tree-optimization/111015, tree-optimization/111614,
  	tree-optimization/111764, tree-optimization/111917
  - use -fno-stack-protector in some aarch64 tests


author: Alexey Tikhonov <atikhono@redhat.com> - 0.6.1-51
changelog:
  - Resolves: rhbz#1938708 - review of important potential issues detected by static analyzers in ding-libs-0.6.1-47.el9


author: Karel Zak <kzak@redhat.com> 2.37.4-10
changelog:
  - fix #2165981 - fstrim -av fails to trim root filesystem on Red Hat Coreos
  - fix #2141970 - add --cont-clock feature for libuuid and uuidd
  - fix #2133385 - uuidd returns time-based UUIDs when asked for random UUIDs.
  - fix #2156946 - agetty does not handle the \l sequence in /etc/issue correctly
  - fix #2166653 - last(1) should be more robust with work with strings
  - fix #2120246 - use {_tmpfilesdir} also in install section
  - fix #2134143 - publish libsmartcols-devel subpackages to C9S yum repos


author: Karel Zak <kzak@redhat.com> 2.37.4-12
changelog:
  - fix #2133396 - Internal testsuite for cramfs fails on s390x
  - fix #2174748 - enable uuidd cont-clock by default
  - fix #2182169 - lscpu: backport ARM human-readable names from upstream
  - fix #2189947 - libuuid - downport cache related patch
  - fix #2203324 - zram module does not have algorithms mentioned in zramctl command
  - fix #2209267 - Add additional documentation on devices being auto-mounted if a device exists within fstab.
  - fix #2215082 - For the 'sfdisk' man page to further clarify the expected behavior and intended use of the -d option


author: Karel Zak <kzak@redhat.com> 2.37.4-16
changelog:
  - fix RHEL-16048 - uninitialized memory in SCM_CREDENTIALS in logger(1)
  - fix RHEL-21257 - logger sending process start time not current time with log messages
  - fix RHEL-16071 - issues in libblkid
  - fix RHEL-12783 - lscpu -e doesn't show the current real frequency value
  - fix RHEL-14612 - Userspace mount options are not preserved for NFS


author: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> - 2.48-9
changelog:
  - Fix integer overflow in _libcap_strdup() (CVE-2023-2603)
    Resolves: rhbz#2210638
  - Correctly check pthread_create() return value to avoid memory leak (CVE-2023-2602)
    Resolves: rhbz#2222198


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.1.16-1
changelog:
  - Update to 0.1.16
  - Fix a crash when clearing COMPS_ObjRTree (RhBug:1888343)
  - Fix memory leaks and resource leaks


author: Lukas Hrazky <lhrazky@redhat.com> - 0.69.0-1
changelog:
  - Update to 0.69.0
  - Expose librepo max_downloads_per_mirror configuration
  - Fix listing a repository without cpeid (RhBug:2066334)
  - Gracefully handle failure to open repo primary file
  - context: Fix doc dnf_context_install/remove/update/distrosync
  - context: dnf_context_remove accepts `<package-spec>` as dnf, unify code
  - dnf-context: Disconnect signal handler before dropping file monitor ref


author: Jaroslav Rohel <jrohel@redhat.com> - 0.69.0-7
changelog:
  - filterAdvisory: match installed_solvables sort with lower_bound (RhBug:2212838, RHEL-12123)
  - hawkey.subject: get_best_selectors only obsoleters of latest (RhBug:2183279, RHEL-6304)
  - Avoid reinstalling installonly packages marked for ERASE (RhBug:2163474, RHEL-12124)


author: Pino Toscano <ptoscano@redhat.com> 1.29.32-1
changelog:
  - Translated using Weblate (French) (ljanda@redhat.com)
  - Translated using Weblate (Chinese (Simplified) (zh_CN)) (suanand@redhat.com)
  - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com)
  - Translated using Weblate (Korean) (simmon@nplob.com)
  - Update translation files (noreply@weblate.org)
  - utils: import pkg_resources only when needed (ptoscano@redhat.com)
  - ENT-5536: Fix FileMonitor tests (mhorky@redhat.com)
  - Alter import of rhsm.config functions (mhorky@redhat.com)
  - Handle tests in containers better (mhorky@redhat.com)
  - Call parent methods in DBusServerStubProvider (mhorky@redhat.com)
  - Base D-Bus tests on SubManFixture (mhorky@redhat.com)
  - ENT-5532: Call rhsm-package-profile-uploader with --force-upload
    (jhnidek@redhat.com)
  - 2108549: do not detect containers in OCP as such (ptoscano@redhat.com)
  - tests: extend InContainerTests for path checks (ptoscano@redhat.com)
  - Resolved issues in PR feedback (jajerome@redhat.com)
  - Updated request handling in connection.py (jajerome@redhat.com)
  - Resolve issues from PR review (jajerome@redhat.com)
  - Removed fixme since activateMachine() is still used (jajerome@redhat.com)
  - Black/flake8 fixes (jajerome@redhat.com)
  - FIXME: renamed default argument to not shadow inbuilt type
    (jajerome@redhat.com)
  - FIXME: removed Restlib and using only BaseRestLib (jajerome@redhat.com)
  - FIXME: updated unregisterConsumer() to return True if status code is 204
    (jajerome@redhat.com)
  - FIXME: changed unbindBySerial/unbindByPoolId to return bool
    (jajerome@redhat.com)
  - FIXME: changed default value of facts in updateConsumerFacts()
    (jajerome@redhat.com)
  - FIXME: sanitized email/lang variables in activateMachine()
    (jajerome@redhat.com)
  - FIXME: made email argument required in activatemachine()
    (jajerome@redhat.com)
  - FIXME: changed default value of serials argument to None
    (jajerome@redhat.com)
  - FIXME: removed unused username/password arguments (jajerome@redhat.com)
  - FIXME: raise exceptions where sanitizing guest Id returns None
    (jajerome@redhat.com)
  - FIXME: renamed response argument to result in validateResponse()
    (jajerome@redhat.com)
  - FIXME: rename info argument to params in _request() (jajerome@redhat.com)
  - FIXME: added error message when redeeming subscription fails
    (jajerome@redhat.com)
  - FIXME: removed unused UEPConnection class methods (jajerome@redhat.com)
  - Fixed profile tests setting Package release numbers as int instead of str
    (jajerome@redhat.com)
  - FIXME: changed epoch data type to str in Package class (jajerome@redhat.com)
  - FIXME: added null-checks for stdout/stderr wrapper (jajerome@redhat.com)
  - FIXME: re-iterated a fix is not needed for urlparse (jajerome@redhat.com)
  - FIXME: added exception messages to parse_url() (jajerome@redhat.com)
  - FIXME: changed  lists to tuples in StatusSpinnerStyle class
    (jajerome@redhat.com)
  - FIXME: fixed type hints for _normalize_string() (jajerome@redhat.com)
  - FIXME: use super() instead of class name (jajerome@redhat.com)
  - FIXME: fixed strings not being translated in is_log_level_valid()
    (jajerome@redhat.com)
  - FIXME: resolved improper use of tempfile in save() (jajerome@redhat.com)
  - FIXME: fixed config_file argument not being used in save()
    (jajerome@redhat.com)
  - FIXME: updated default value for files_name argument in read()
    (jajerome@redhat.com)
  - FIXME: fixed minor typo in bogus() (jajerome@redhat.com)
  - FIXME: changed read() to return self instead of None (jajerome@redhat.com)
  - FIXME: set default argument 'facts' to None in registerConsumer()
    (jajerome@redhat.com)
  - FIXME: renamed argument 'type' to 'consumer_type' in registerConsumer()
    (jajerome@redhat.com)
  - FIXME: ping() resolved in rhsm/connection.py (jajerome@redhat.com)
  - Remove test dependency 'mock' (mhorky@redhat.com)
  - Fix failures of D-Bus' Register tests (mhorky@redhat.com)
  - Mark D-Bus tests (mhorky@redhat.com)
  - 2131789: Outsource uploading DNF profile to rhsmcertd (jhnidek@redhat.com)
  - Catch generic OSError during HTTPSConnection.connect() (ptoscano@redhat.com)
  - New extraction for translatable strings (ptoscano@redhat.com)
  - Translated using Weblate (French) (vincent.lefebvre59@gmail.com)
  - Translated using Weblate (Korean) (simmon@nplob.com)
  - Fix formatting of proxy errors w/o errno (ptoscano@redhat.com)
  - Catch also CertificateLoadingError for identity cert loading
    (ptoscano@redhat.com)
  - ENT-4286: Additional fix for exception handling (jajerome@redhat.com)
  - Remove D-Bus env vars from container and CI files (mhorky@redhat.com)
  - 2121350: Implement "force" register option in rhsm dbus python binding
    (jajerome@redhat.com)
  - Show locals in pytest output (mhorky@redhat.com)
  - Improve formatting of CertificateLoadingError (ptoscano@redhat.com)
  - Raise a new CertificateLoadingError on X.509 loading failures
    (ptoscano@redhat.com)
  - Improve formatting of UnknownContentException (ptoscano@redhat.com)
  - connection: improve the internal UnknownContentException
    (ptoscano@redhat.com)
  - utils: add terminal_printable_content (ptoscano@redhat.com)
  - connection: rename NetworkException to UnknownContentException
    (ptoscano@redhat.com)
  - Improve formatting of ProxyException (ptoscano@redhat.com)
  - connection: improve the internal ProxyException (ptoscano@redhat.com)
  - Improve formatting of socket.gaierror (ptoscano@redhat.com)
  - Improve formatting of ConnectionError (ptoscano@redhat.com)
  - Improve formatting of BadCertificateException (ptoscano@redhat.com)
  - connection: extend BadCertificateException w/ SSL exception
    (ptoscano@redhat.com)
  - connection: drop dead code (ptoscano@redhat.com)
  - ENT-4286: Simplify exception reporting with system_exit()
    (jajerome@redhat.com)
  - 2136694: Clear progress messages properly (mhorky@redhat.com)
  - rhsmcertd reads default_log_level from rhsm.conf (jhnidek@redhat.com)
  - 2097679: Additional fix for non-interactive parameters (jajerome@redhat.com)
  - 2097679: Fixed script hang in non-interactive execution (jajerome@redhat.com)


author: Pino Toscano <ptoscano@redhat.com> 1.29.33-1
changelog:
  - Translated using Weblate (French) (ljanda@redhat.com)
  - Translated using Weblate (Chinese (Simplified) (zh_CN)) (suanand@redhat.com)
  - Translated using Weblate (Japanese) (suanand@redhat.com)
  - Translated using Weblate (Japanese) (ljanda@redhat.com)
  - Translated using Weblate (French) (suanand@redhat.com)
  - Translated using Weblate (Korean) (simmon@nplob.com)
  - Update translation files (noreply@weblate.org)
  - Translated using Weblate (Korean) (jsefler@redhat.com)
  - ENT-5542: Build package using GitHub Actions (mhorky@redhat.com)
  - Test libdnf plugin using GitHub Actions (mhorky@redhat.com)
  - libdnf: fix return value of findProductId() (ptoscano@redhat.com)
  - ENT-5541: Publish PR coverage (mhorky@redhat.com)
  - New extraction for translatable strings (ptoscano@redhat.com)
  - Translated using Weblate (Kannada) (jsefler@redhat.com)
  - Translated using Weblate (Spanish) (ptoscano@redhat.com)
  - Simplify test setup for D-Bus fact collection (mhorky@redhat.com)
  - ENT-3759: Test on GitHub Actions (mhorky@redhat.com)


author: Pino Toscano <ptoscano@redhat.com> 1.29.34-1
changelog:
  - Update TESTING.md (mhorky@redhat.com)
  - Improved debug print of http traffic, when proxy is used (jhnidek@redhat.com)
  - ENT-5544: Remove Jenkins jobs, Containers (mhorky@redhat.com)
  - ENT-5549: Remove unused code from entcertlib (mhorky@redhat.com)
  - ENT-5549: Fix issues found when type-hinting (mhorky@redhat.com)
  - ENT-5549: Fix return code handling of CLI (mhorky@redhat.com)
  - ENT-5549: Fix found type hint issues (mhorky@redhat.com)
  - ENT-5549: Fix object instantiation in EntitlementDirectory
    (mhorky@redhat.com)
  - ENT-5549: Refactor ProductDirectory (mhorky@redhat.com)
  - ENT-5549: Change internal implementation for some Cache methods
    (mhorky@redhat.com)
  - ENT-5549: Clean up _sync_with_server arguments of cache objects
    (mhorky@redhat.com)
  - ENT-5549: Remove 'autoheal' argument from Action clients (mhorky@redhat.com)
  - Refactored code a little bit (jhnidek@redhat.com)
  - 2093291: Make locking more reliable (jhnidek@redhat.com)
  - test: add simple test for 2178610 (ptoscano@redhat.com)
  - Small improvement of debugging of http traffic (jhnidek@redhat.com)
  - 2093883: Fix issue with race condition in rhsm.service (jhnidek@redhat.com)
  - 2178610: do not collect unentitled products in SCA mode (ptoscano@redhat.com)
  - 2174297: register: do a simple strip() on environment(s) input
    (ptoscano@redhat.com)
  - Stop subclassing 'object' (ptoscano@redhat.com)
  - Remove pytest arguments for CentOS 9 Stream image (mhorky@redhat.com)
  - tests: Install dnf-plugins-core every time (mhorky@redhat.com)
  - 2169251: connection: restore UEPConnection.getJob() (ptoscano@redhat.com)
  - ENT-5106: Type-hint subscription_manager/ files (mhorky@redhat.com)


author: Pino Toscano <ptoscano@redhat.com> 1.29.35-1
changelog:
  - Translated using Weblate (Italian) (toscano.pino@tiscali.it)
  - Clean up tests using Cloud What detectors properly (mhorky@redhat.com)
  - spec: Obsolete subscription-manager-migration (ptoscano@redhat.com)
  - Translated using Weblate (Chinese (Simplified) (zh_CN)) (ljanda@redhat.com)
  - Translated using Weblate (Korean) (simmon@nplob.com)
  - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com)
  - Translated using Weblate (Italian) (toscano.pino@tiscali.it)
  - Update translation files (noreply@weblate.org)
  - New extraction for translatable strings (ptoscano@redhat.com)
  - Translated using Weblate (Italian) (toscano.pino@tiscali.it)
  - Typo fixes (ptoscano@redhat.com)
  - Avoid string puzzle (ptoscano@redhat.com)
  - Properly use ungettext for plural forms (ptoscano@redhat.com)
  - 2189664: cache: fix SyspurposeComplianceStatusCache on failed load
    (ptoscano@redhat.com)
  - dbus: don't catch exceptions in DomainSocketServer.run()
    (ptoscano@redhat.com)
  - cli: directly exit on InvalidCLIOptionError (ptoscano@redhat.com)
  - Revert "ENT-5549: Fix return code handling of CLI" (ptoscano@redhat.com)
  - ci: add dependabot config for GitHub Actions (ptoscano@redhat.com)
  - Update .git-blame-ignore-revs (mhorky@redhat.com)
  - Format code with black==23.3.0 (mhorky@redhat.com)
  - ENT-5535: Update black to version 23.3.0 (mhorky@redhat.com)


author: Pino Toscano <ptoscano@redhat.com> 1.29.36-1
changelog:
  - Translated using Weblate (Korean) (simmon@nplob.com)
  - ENT-5581: Update messaging around the "container mode" (mhorky@redhat.com)
  - Remove 'dbus' marker for pytest (mhorky@redhat.com)
  - Rewrite D-Bus tests to be testable without pytest-forked (mhorky@redhat.com)
  - Drop further ethtool dependency mentions (mhorky@redhat.com)
  - tests: fix test_file_monitor without pyinotify (ptoscano@redhat.com)
  - tests: switch from imp to importlib (ptoscano@redhat.com)
  - Fix the order of user env var checking for translations.
    (tkuratom@redhat.com)
  - 2215974: Collect network facts using 'ip' (mhorky@redhat.com)
  - ENT-5582: Remove container detection envvar overwrite (mhorky@redhat.com)
  - ENT-5603: Explicitly check for provided entitlement certificates
    (mhorky@redhat.com)
  - fix test case (chambrid@redhat.com)
  - Collect GCP Project information as cloud facts (chambrid@redhat.com)
  - Collect Azure Subscription ID as a cloud fact (#3285) (chambrid@redhat.com)
  - ENT-5580: Disable the proper container detection (mhorky@redhat.com)
  - spec: convert License to SPDX (ptoscano@redhat.com)
  - 2093291: Make reading of cache file more reliable (jhnidek@redhat.com)
  - 2093291: Make code of DNF plugins testable (jhnidek@redhat.com)
  - spec: change subscription-manager dnf dep (ptoscano@redhat.com)
  - spec: update libdnf-plugin-subscription-manager deps (ptoscano@redhat.com)
  - tests: repair attach cases in SCA mode (ptoscano@redhat.com)


author: Pino Toscano <ptoscano@redhat.com> 1.29.37-1
changelog:
  - Translated using Weblate (Korean) (simmon@nplob.com)
  - Update translation files (noreply@weblate.org)
  - 2225446: Hotfix of D-Bus policy (jhnidek@redhat.com)
  - TESTING: Update testing requirements (mhorky@redhat.com)
  - Use Fedora registry to pull container images (mhorky@redhat.com)
  - 2232316: dbus: check "force" again from the registration option
    (ptoscano@redhat.com)
  - dbus: run EntCertActionInvoker on PoolAttach (ptoscano@redhat.com)
  - ENT-5624: Properly translate error strings (mhorky@redhat.com)
  - Mock IOError for Insights fact collection tests (mhorky@redhat.com)
  - New extraction for translatable strings (ptoscano@redhat.com)


author: Pino Toscano <ptoscano@redhat.com> 1.29.38-1
changelog:
  - Translated using Weblate (Chinese (Simplified) (zh_CN)) (ptoscano@redhat.com)
  - ci: bump actions/checkout from 3 to 4
    (49699333+dependabot[bot]@users.noreply.github.com)
  - ENT-5603: Fix a typo in a comment (mhorky@redhat.com)


author: Pino Toscano <ptoscano@redhat.com> 1.29.39-1
changelog:
  - tito: drop bz requirement (ptoscano@redhat.com)
  - Translated using Weblate (Chinese (Simplified) (zh_CN)) (jsefler@redhat.com)
  - RHEL-7206: Small change of message printed by dnf plugin (jhnidek@redhat.com)
  - CCT-118: Fix flake8 error E721 (mhorky@redhat.com)
  - Fix type hint in rhsm (mhorky@redhat.com)
  - Simplify autoregistration test setup (mhorky@redhat.com)
  - RHEL-9435: Get AWS metadata via IMDSv2 (mhorky@redhat.com)
  - Fixed inappropriate logical expression (ataf@openrefactory.com)
  - CCT-71: Try to ping server, when --proxy is used (jhnidek@redhat.com)
  - CCT-10: Ensure IPv6-based URLs are properly formatted (mhorky@redhat.com)
  - RPM: Avoid needless runtime requirement on python3-setuptools
    (miro@hroncok.cz)
  - cli: normalize hostname in error message (ptoscano@redhat.com)
  - connection: normalize hostname in ConnectionOSErrorException
    (ptoscano@redhat.com)
  - Improved printing of addresses and URLs (jhnidek@redhat.com)
  - Use username and password from --proxy=URL (jhnidek@redhat.com)
  - Use parse_url() from utils.py for parsing URL, when --proxy is used.
    (jhnidek@redhat.com)
  - 2225403: Parse URL properly (jhnidek@redhat.com)


author: Pino Toscano <ptoscano@redhat.com> 1.29.40-1
changelog:
  - Translated using Weblate (Korean) (simmon@nplob.com)
  - Translated using Weblate (Chinese (Simplified) (zh_CN))
    (mariocanfly@hotmail.com)
  - spec: Add missing GLib dependency when building without DNF
    (debarshir@gnome.org)
  - Remove deprecated `locale.*()` functions (mhorky@redhat.com)
  - Remove version constraint of pytest (mhorky@redhat.com)
  - RHEL-15110: RegisterServer is stopped, when not needed (jhnidek@redhat.com)
  - RHEL-15110: Fix issue with registration using gsd-subman (jhnidek@redhat.com)
  - Fix an error in debug logging of cloud-what (mhorky@redhat.com)
  - ci: bump actions/upload-artifact from 3 to 4
    (49699333+dependabot[bot]@users.noreply.github.com)
  - Improve debug logging to make it faster to understand (mhorky@redhat.com)


author: DJ Delorie <dj@redhat.com> - 3.4.2-8
changelog:
  - Use /etc/sysconfig/libffi-force-shared-memory-check-first to
    override selinux permissions check for shared memory access (#2152228)


author: Jakub Jelen <jjelen@redhat.com> - 1.10.0-4
changelog:
  - Backport ppc hardware flags detection (#2051307)
  - Disable PKCS#1.5 encryption in FIPS mode (#2061328)


author: Jakub Jelen <jjelen@redhat.com> - 1.10.0-5
changelog:
  - Allow signature verification with smaller RSA keys (#2083846)
  - Allow short salt for KDF (#2114870)
  - Reseed the kernel DRBG by using GRND_RANDOM (#2118695)
  - Address FIPS review comments around selftests (#2118695)
  - Disable RSA-OAEP in FIPS mode (#2118695)


author: Jakub Jelen <jjelen@redhat.com> - 1.10.0-6
changelog:
  - Fix SHA3 digests with large inputs (#2129150)
  - Fix FIPS RSA PCT (#2128455)
  - Fix RSA FIPS Keygen that non-deterministically fails (#2130275)
  - Get max 32B from getrandom in FIPS mode (#2130275)


author: Jakub Jelen <jjelen@redhat.com> - 1.10.0-7
changelog:
  - Properly enforce KDF limits in FIPS mode (#2130275)
  - Fix memory leak in large digest test (#2129150)
  - Fix function name FIPS service indicator by disabling PK encryption and decryption (#2130275)
  - Skip RSA encryption/decryption selftest in FIPS mode (#2130275)


author: Jakub Jelen <jjelen@redhat.com> - 1.10.0-8
changelog:
  - Fix unneeded PBKDF2 passphrase length limitation in FIPS mode
  - Enforce HMAC key lengths in MD API in FIPS mode


author: Jakub Jelen <jjelen@redhat.com> - 1.10.0-9
changelog:
  - Avoid usage of invalid arguments sizes for PBKDF2 in FIPS mode
  - Do not allow large salt lengths with RSA-PSS padding
  - Disable X9.31 key generation in FIPS mode
  - Update the FIPS integrity checking code to upstream version
  - Update cipher modes FIPS indicators for AES WRAP and GCM
  - Disable jitter entropy generator


author: Jakub Jelen <jjelen@redhat.com> - 1.10.0-10
changelog:
  - Provide FIPS indicators for MD and HMACs
  - Improve PCT tests for ECDSA and always run them after key is generated
  - Add missing guards for FIPS status in md_sign/verify function
  - Provider FIPS indicators for public key operation flags


author: Richard Hughes <richard@hughsie.com> 0.3.8-1
changelog:
  - New upstream version
  - Add new API requested by fwupd
  - Add the GUsbEndpoint methods to the docs
  - Fix hotplug handling and signal emission during enumerate
  - Do not double-reference USB devices
  - Resolves: rhbz#1965885


author: Jeff Law <law@redhat.com> - 2.3.0-3
changelog:
  - Touch a couple autoconf related files to prevent undesired rebuilding
    if %configure changes one or more configure files.


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.3-1
changelog:
  - Resolves: RHEL-2632 - Rebase SSSD for RHEL 9.4
  - Resolves: RHEL-14427 - Expected cn in RDN, got uid
  - Resolves: RHEL-12229 - HANA validation on RHEL 9.2 issue possibly related to libc/nss_sss behaviour
  - Resolves: RHEL-3925 - SSSD goes offline when, while reading a single user, misses a required attribute (i.e. SID)
  - Resolves: RHEL-2319 - Passkey authentication for centrally managed users
  - Resolves: RHEL-4146 - Incorrect handling of reverse IPv6 update results in update failure
  - Resolves: RHEL-4971 - sssd-kcm does not appear to expire Kerberos tickets (RFE: sssd_kcm should have the option to automatically delete the expired tickets)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-1
changelog:
  - Resolves: RHEL-2632 - Rebase SSSD for RHEL 9.4
  - Resolves: RHEL-18395 - latest sssd breaks logging in via XDMCP for LDAP/Kerberos users
  - Resolves: RHEL-17498 - New sssd.conf seems not to be backwards compatible (wrt SmartCard auth of local users using 'files provider') [rhel-9]
  - Resolves: RHEL-21079 - SSSD GPO lacks group resolution on hosts [rhel-9]
  - Resolves: RHEL-19211 - Excessive logging to sssd_nss and sssd_be in multi-domain AD forest [rhel-9]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-2
changelog:
  - Resolves: RHEL-12503 - AD users are unable to log in due to case sensitivity of user because the domain is found as an alias to the email address. 
  - Resolves: RHEL-22288 - ssh pubkey stored in ldap/AD no longer works to authenticate via sssd
  - Resolves: RHEL-22194 - gdm smartcard login fails with sssd-2.9.3 in case of multiple identities


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-6
changelog:
  - Resolves: RHEL-27209 - Race condition during authorization leads to GPO policies functioning inconsistently [rhel-9.4.0]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.2-1
changelog:
  - Resolves: RHEL-2632 - Rebase SSSD for RHEL 9.4
  - Resolves: RHEL-2319 - Passkey authentication for centrally managed users
  - Resolves: rhbz#2234829 - SSSD runs multiples lookup search for each NFS request (SBUS req chaining stopped working)
  - Resolves: rhbz#2236119 - dbus and crond getting terminated with SIGBUS in sss_client code


author: Richard Hughes <richard@hughsie.com> 0.1.6-1
changelog:
  - New upstream release
  - Fall back to the AliasId for validation
  - Fix jcat_context_verify_blob() to use self verify for checksums


author: Zoltan Fridrich <zfridric@redhat.com> - 1.4.0-1
changelog:
  - Update to new upstream release 1.4.0
    Resolves: RHEL-5367
  - Add a patch to fix auxiliary tests in FIPS mode
    Resolves: RHEL-2405
  - Add a patch to zeroize kcapi-hasher for FIPS 140-3
    Resolves: RHEL-15112
  - Add a patch to allow overriding target file in kcapi-hasher
    Resolves: RHEL-15298


author: Zoltan Fridrich <zfridric@redhat.com> - 1.4.0-2
changelog:
  - Backport fixes for kcapi-hasher target option
    Related: RHEL-15298
  - Fix kcapi tests in FIPS mode
    Resolves: RHEL-2405


author: Wen Liang <wenliang@redhat.com> - 1.26.0-2
changelog:
  - Add Conflicts tag because the bash-completion scripts moved from the main package
    to the utils sub package causing a file conflict on multilib systems between the
    old 32 bit main package and the new 64 bit utils sub package.


author: Stephen Gallagher <sgallagh@redhat.com> - 2.11.1-1
changelog:
  - Release 2.11.1
  - Ignore Packager documents when running ModuleIndex.update_from_*()
  - Add python overrides for XMD in PackagerV3
  - Add python override to ignore the GType return when reading packager files
  - Add PackagerV3.get_mdversion()


author: Stephen Gallagher <sgallagh@redhat.com> - 2.11.2-1
changelog:
  - Release 2.11.2
  - Extend read_packager_[file|string]() to support overriding the module name
    and stream.


author: Stephen Gallagher <sgallagh@redhat.com> - 2.11.2-2
changelog:
  - Fix issue with ModuleIndex when input contains only Obsoletes documents
  - Fix import issue when built with Python 2 support


author: Hangbin Liu <haliu@redhat.com> - 1.8-1
changelog:
  - 1.8 release (rhbz#1958933)
  - libndp,ndptool: use poll() instead of select()
  - libndp: avoid static buffer for debug string in ndp_sock_recv()
  - ndptool: avoid static buffer for string in ndptool
  - libndp: use thread local variables for static return arguments
  - ndptool: don't use static variable for local context in msgrcv_handler_func()
  - ndptool: fix printing dnssl lifetime in ndptool
  - ndptool: fix potential memory leak caused by strdup
  - ndptool: add -D dest support
  - libndp: fix nd_msg typo when setting target address
  - libndp: close sockfd after using to avoid handle leak
  - ndptool: fix target parameter typo
  - ndptool: add -T target support


author: Pavel Filipenský <pfilipen@redhat.com> - 4.18.4-101
changelog:
  - resolves: rhbz#2216712 - Fix broken symlink for libwbclient
  - resolves: rhbz#2214327 - Fix segfault of winbind child when listing users with `winbind scan trusted domains = yes`
  - resolves: rhbz#2211605 - Fix access of Samba share with veto files = /.*/
  - resolves: rhbz#2207692 - Fix Python tarfile extraction to avoid a warning


author: Pavel Filipenský <pfilipen@redhat.com> - 4.18.5-100
changelog:
  - resolves: rhbz#2222895 - Fix CVE-2022-2127 CVE-2023-3347 CVE-2023-34966 CVE-2023-34967 CVE-2023-34968


author: Andreas Schneider <asn@redhat.com> - 4.18.6-100
changelog:
  - related: rhbz#2190415 - Update to version 4.18.6
  - resolves: rhbz#2211617 - Fix the rpcclient dfsgetinfo command


author: Andreas Schneider <asn@redhat.com> - 4.19.3-100
changelog:
  - resolves: RHEL-16476 - Update to version 4.19.3
  - resolves: RHEL-11362 - Fix security issues:
    CVE-2023-4091 CVE-2023-42669
  - resolves: RHEL-18030 - Logging Format Enhancement
  - resolves: RHEL-1960 - Fix smbget issues with DFS shares
  - resolves: RHEL-2118 - Fix force user/group issues with 'allow trusted domains = yes'
  - resolves: RHEL-16875 - Fix memory corruption in libnss_winbind
  - resolves: RHEL-19243 - Fix smbget password interactive authentication


author: Andreas Schneider <asn@redhat.com> - 4.19.4-100
changelog:
  - related: RHEL-16476 - Update to version 4.19.4
  - resolves: RHEL-2109 - Add support for certificate auto enrollment
  - resolves: RHEL-20761 - Add missing requirements for samba-gpupdate
  - resolves: RHEL-19566 - Fix smbget interactive authentication
  - resolves: RHEL-21001 - Fix samba-gpupdate paths for RHEL


author: Andreas Schneider <asn@redhat.com> - 4.19.4-102
changelog:
  - resolves: RHEL-22157 - Don't require NDES for samba-gpupdate
  - resolves: RHEL-20897 - Fix site name fetching for samba-gpupdate


author: Phil Sutter <psutter@redhat.com> - 1.0.9-1
changelog:
  - expect/conntrack: Avoid spurious covscan overrun warning
  - conntrack: fix build with kernel 5.15 and musl
  - New version 1.0.9


author: Steve Dickson <steved@redhat.com> 2.5.4-16
changelog:
  - nfsd.man: Explain that setting nfsv4=n turns off all v4 versions (bz 2042362)
  - mount.nfs: fix NULL pointer derefernce in nfs_parse_square_bracket (bz 2136807)


author: Steve Dickson <steved@redhat.com> 2.5.4-19
changelog:
  - Don't allow junction tests to trigger automounts (bz 2148353)
  - Fix typo in man page nfs.conf.man (bz 2203092)


author: Steve Dickson <steved@redhat.com> 2.5.4-21
changelog:
  - gssd: fix handling DNS lookup failure (RHEL-15035)
  - gssd: handle KRB5_AP_ERR_BAD_INTEGRITY errors (RHEL-15034)


author: Steve Dickson <steved@redhat.com> 2.5.4-22
changelog:
  - nfsmount.conf: Fix typo of the attribute name (RHEL-7904)
  - Update to support for the NFS RPC-with-TLS (RHEL-14754)


author: Steve Dickson <steved@redhat.com> 2.5.4-23
changelog:
  - Typos and documentation fixes (RHEL-22654)
  - blkmapd: fix coredump in bl_add_disk (RHEL-7941)
  - rpcdebug: avoid buffer underflow (RHEL-7931)


author: Phil Sutter <psutter@redhat.com> [1.2.6-1.el9]
changelog:
  - set: Do not leave free'd expr_list elements in place (Phil Sutter) [RHEL-14149]
  - Rebase onto version 1.2.6 (Phil Sutter) [RHEL-14149]


author: Nikola Forró <nforro@redhat.com> - 2:1.6.37-10
changelog:
  - Remove the aarch64 test workaround, the patches causing the failures
    have been dropped in zlib-1.2.11-25


author: Tomáš Mráz <tmraz@redhat.com> 1.4.3-1
changelog:
  - Multiple translation updates
  - Add usersubstr check for substrings of N characters from the username
    patch by Danny Sauer


author: Paul Wouters <pwouters@redhat.com> - 1.4.4-2
changelog:
  - Resolves rhbz#1919026 libpwquaily rpm requires cracklib-dict to function but RPM missing requirement


author: Lukas Hrazky <lhrazky@redhat.com> - 1.14.5-1
changelog:
  - Update to 1.14.5
  - Detailed error message when using non-existing TMPDIR (RhBug:2019993)
  - Make error messages about repodata and rpm mismatch more user friendly


author: Eduard Abdullin <eabdullin@almalinux.org> - 2.15.2-6.alma
changelog:
  - Add support for AlmaLinux Bug Tracker
  - Remove libreport-rhel-bugzilla and libreport-rhel-anaconda-bugzilla


author: Petr Pisar <ppisar@redhat.com> - 0.0.3-7.1
changelog:
  - Correct a License tag to LGPLv2+ (RHEL-21336)
  - Fix relocating certificate paths to /etc/rhsm-host (RHEL-21335)


author: Neal Gompa <ngompa13@gmail.com> - 2.4.2-2
changelog:
  - Modernize spec
  - Backport fix for missing __SNR_ppoll symbol (#1777889)
  - Refresh patch to build on aarch64 with upstream version


author: Petr Lautrbach <plautrba@redhat.com> - 3.3-3
changelog:
  - allow spaces in user/group names (#2049665)
  - Fall back to semanage_copy_dir when rename() fails (#2068085)


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.7.20-1
changelog:
  - Update to 0.7.20
  - new SOLVER_EXCLUDEFROMWEAK job to ignore pkgs for weak dependencies
  - support for environments in comps parser
  - fix misparsing of '&' in attributes with libxml2
  - choice rules: treat orphaned packages as newest
  - fix compatibility with Python 3.10


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.7.22-1
changelog:
  - Update to 0.7.22
  - support strict repository priorities new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY
  - support zstd compressed control files in debian packages
  - add an ifdef allowing to rename Solvable dependency members ("requires" is a keyword in C++20)
  - support setting/reading userdata in solv files new functions: repowriter_set_userdata, solv_read_userdata
  - support queying of the custom vendor check function new function: pool_get_custom_vendorcheck
  - support solv files with an idarray block
  - allow accessing the toolversion at runtime
  - support parsing of Debian's Multi-Arch indicator
  - fix segfault on conflict resolution when using bindings
  - fix split provides not working if the update includes a forbidden vendor change
  - reworked choice rule generation to cover more usecases
  - support SOLVABLE_PREREQ_IGNOREINST in the ordering code


author: Jaroslav Rohel <jrohel@redhat.com> - 0.7.24-1
changelog:
  - Update to 0.7.24
  - Backport Treat condition both as positive and negative literal in pool_add_pos_literals_complex_dep
    (RhBug:2185061,2190136)


author: Norbert Pocs <npocs@redhat.com> - 0.10.4-4
changelog:
  - Move loglevel closer to openssh loglevel
  - Add openssh config feature of +,-,^ for algorithm lists
  - Fix memory leaks of bignum
  - Prevent multiple expansion of escape characters
  - Resolves: rhbz#2132407, rhbz#2137839, rhbz#2144795, rhbz#2136824


author: Norbert Pocs <npocs@redhat.com> - 0.10.4-6
changelog:
  - Fix covscan error
  - Remove unwanted test with yet unimplemented feature
  - Related: rhbz#2137839, rhbz#2136824


author: Norbert Pocs <npocs@redhat.com> - 0.10.4-9
changelog:
  - Fix CVE-2023-1667 and CVE-2023-2283
  - Fix issues found by cosvcan
  - Resolves: rhbz#2182252, rhbz#2189740


author: Sahana Prasad <sahana@redhat.com> - 0.10.4-12
changelog:
  - Fix CVE-2023-48795 Prefix truncation attack on Binary Packet Protocol (BPP)
  - Fix CVE-2023-6918 Missing checks for return values for digests
  - Fix CVE-2023-6004 ProxyCommand/ProxyJump features allow injection
    of malicious code through hostname
  - Resolves: RHEL-19310, RHEL-19691, RHEL-17245


author: Sahana Prasad <sahana@redhat.com> - 0.10.4-13
changelog:
  - Bump up the version so that the version in 9.3 is lower.
  - Resolves: RHEL-19310, RHEL-19691, RHEL-17245


author: Christopher Engelhard <ce@lcts.de> - 2.1.1-1
changelog:
  - Update to 2.1.1
  - Remove all patches merged upstream
  - Switched build to autotools
  - Include upstream pkgconfig module
  - Sysfsutils no longer includes /usr/bin/get_module


author: Hangbin Liu <haliu@redhat.com> - 1.31-8
changelog:
  - Build util team2bond in teamd rpm [1986788]
  - Add some cautions to util team2bond [1986788]
  - Add team2bond man doc [1986788]


author: Long Xin <lxin@redhat.com> - 1.31-16
changelog:
  - fix the Requires package name for teamd-devel
  - teamd: stop iterating callbacks when a loop restart is requested (rhbz#2148852)


author: Steve Dickson <steved@redhat.com> - 1.3.3-1
changelog:
  - bindresvport.c: fix a potential resource leakage (bz 2135405)
  - clnt_raw.c: fix a possible null pointer dereference (bz 2138317)


author: Mike FABIAN <mfabian@redhat.com> - 0.9.10-12
changelog:
  - Fix memory leak in vasnprint. Resolves: rhbz#1938800
    (Backported from upstream: https://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=4d288a80bf7ebe29334b9805cdcc70eacb6059c1)


author: Benjamin Berg <bberg@redhat.com> - 1.0.25-1
changelog:
  - Update to 1.0.25
  - Fix a crash after libusb_exit API has been misused
  - Add patchset to fix covscan reports
    Resolves: #1938801


author: Benjamin Berg <bberg@redhat.com> - 1.0.26
changelog:
  - Pull in new upstream libusb containing important regression fixes
    Resolves: #2058730
    Resolves: #1938801


author: Richard Hughes <richard@hughsie.com> 0.3.0-1
changelog:
  - New upstream release
  - Add a new object to contain query context data
  - Allow collapsing empty XML tags if no children or text
  - Allow marking elements as tokenized from xb-tool
  - Allow optimized searching when comparing tokens
  - Cancel the GFileMonitor before unreffing it
  - Do not allocate a 128Mb buffer for each xb_builder_source_ctx_get_bytes()
  - Do not error when creating a query if the element doesn’t exist
  - Fix a parse failure for a double comment
  - Fix various errors or missing annotations in docs
  - Make handling of single-result queries more robust
  - Support mmap()ing the source file to get bytes
  - Support query caching with xb_silo_lookup_query()
  - Support UTF-8 for upper-case() and lower-case()
  - Use g_str_match_string() for non-ASCII search queries
  - Write search tokens into the built silo


author: Richard Hughes <richard@hughsie.com> 0.3.3-1
changelog:
  - New upstream release
  - Add locking for file monitors
  - Add support for LZMA decompression
  - Clarify GMainContext usage and signal emission
  - Respect XB_BUILDER_NODE_FLAG_IGNORE when exporting
  - Use the chosen chunk size when reading from a stream
  - Use the correct pkgconfig export package name in the GIR file
  - Always run xb-tool queries with the optimizer
  - Ensure tokens handling works when XbOpcode is not zero-inited
  - Use stack-allocated XbStack instances for running a machine
  - Resolves: rhbz#1965891


author: Neal Gompa <ngompa@centosproject.org> - 0.3.10-1
changelog:
  - New upstream release
  - Fix dumping and exporting multiple files from the CLI
  - Watch files before loading them into the builder
  - Fix potential double free when filtering by language
  - Fix the crash for when the root tree has no children
  - Fix the crash when getting the element for the [empty] root
  - Install xb-tool into bindir
  - Ensure reproducible results when importing a node
  - Ignore all hidden files when using _WATCH_DIRECTORY
  - Show the value bindings when using XB_SILO_PROFILE_FLAG_XPATH
  - Ensure _IS_TOKENIZED is set if tokens are added manually
  - Ensure we never add too many tokens to the silo
  - Put tail after the node when exporting XbBuilderNode
  - Remove the G_ALIGNOF checks to fix compile with old GLib versions
  - Add a flag to require the XbBuilderSource to have no siblings
  - Add iterator for XbNode attributes and children
  - Allow removing XbBuilderNode text
  - Allow stripping builder node inner text
  - Resolves: rhbz#2134794


author: John Eckersberg <jeckersb@redhat.com> - 0.2.5-4
changelog:
  - Add BuildRequires for make
    (re: https://fedoraproject.org/wiki/Changes/Remove_make_from_BuildRoot)


author: Michel Alexandre Salim <salimma@centosproject.org> - 1.5.1-1
changelog:
  - Rebase to the latest upstream version
  - Enable optional gz, xz/lzma, and lz4 support in the zstd tool
  - Disable amd64 assembly on non-x86_64 architectures (rhbz#2035802)
    this should avoid the issue where an executable stack is created
  - Re-enable CET protections (rhbz#2039353)
    Resolves: rhbz#2039488


author: Kamil Dudka <kdudka@redhat.com> - 3.18.0-4
changelog:
  - make `renamecopy` and `copytruncate` override each other (#1934601)
  - unify documentation of copy/copytruncate/renamecopy (#1934629)
  - fix resource leaks reported by Coverity


author: Than Ngo <than@redhat.com> - 1.7.14-3
changelog:
  - Resolves: #2181241, lsvpd is not reporting the correct I/O microcode
    for HBA, PCIe, SAS adapters, HDD, etc


author: Than Ngo <than@redhat.com> - 1.7.14-4
changelog:
  - Related: #2181241, backport upstream patch to update update nvme_templates
    with logpage format for 0005 and 0006 versions


author: Xiao Ni <xni@redhat.com> - 4.2-7
changelog:
  - Update to latest upstream and keep udev rule close to upstream
  - Resolves rhbz#2107147, rhbz#2129087, rhbz#2126428


author: Xiao Ni <xni@redhat.com> - 4.2-8
changelog:
  - Update to latest upstream
  - Resolves rhbz#2127101, rhbz#2139789, rhbz#2149292, rhbz#2151209, rhbz#2148945


author: Xiao Ni <xni@redhat.com> - 4.2-9
changelog:
  - Update to latest upstream and fix mdcheck service bug
  - Resolves rhbz#2159923, rhbz#2150865, rhbz#2124071, rhbz#2203859


author: Nicola Sella <nsella@redhat.com> - 3.6.0-1
changelog:
  - Update to 3.6.0
  - spec: Sync summary and description from openSUSE
  - Add support for setting a platform module ID
  - Add dependency for DNF configurations skeleton
  - Add support for setting allow_vendor_change


author: Nicola Sella <nsella@redhat.com> - 3.7.1-1
changelog:
  - Update to 3.7.1
  - [download] fix: unwanted dependency on newer glib 
  - [download] Support for "--resolve" and "--alldeps" arguments 
  - [download] New get_packages_query function
  - Support "--setopt=keepcache=0/1"
  - [download] Support "--archlist=" argument
  - [download] Move package download code to "download_packages" function
  - [download] several optimizations
  - Don't set default value of "assumeyes" to TRUE 
  - Support for user confirmation and assumeyes, assumeno, defaultyes
  - Extend "--setopt" to support repository options 
  - Added alias "update" to "upgrade" command
  - Command "update" renamed to "upgrade"
  - Add support for command aliases
  - dnf-data requirement only for Fedora and future RHEL
  - Relicense to GPLv2+ [errata corrige: not in 3.5.1-1]
  - Sync summary and description from openSUSE [errata corrige: not in 3.6.0-1]


author: Pavla Kratochvilova <pkratoch@redhat.com> - 3.8.0-1
changelog:
  - Update to 3.8.0
  - distrosync: Fix style issues and plugin build with Meson 
  - Add distro-sync subcommand
  - Add "makecache" command


author: Lukas Hrazky <lhrazky@redhat.com> - 3.9.1-1
changelog:
  - Update to 3.9.1
  - leaves: Treat recommends as dependencies when install_weak_deps=True
  - Add leaves command
  - Remove non-breaking space from "Size" column (RhBug:2010676)


author: Nicola Sella <nsella@redhat.com> - 3.9.1-2
changelog:
  - Revert: leaves: Treat recommends as dependencies when install_weak_deps=True
  - Revert: Add leaves command


author: Tomas Popela <tpopela@redhat.com> - 0.26-27
changelog:
  - Don't prune bind mounts on ostree based systems, prune the deployments folder
    there to avoid duplications.
  - Fixes: https://github.com/fedora-silverblue/issue-tracker/issues/76


author: Pavel Cahyna <pcahyna@redhat.com> - 4.0.26-4
changelog:
  - Add dependency on glibc-gconv-extra
    mtools need codepage 850, which was split from glibc into a subpackage.
    (Fedora bug #2021637, RHEL bug #2073843)


author: Robert Scheck <robert@fedoraproject.org> - 2:0.94-1
changelog:
  - Rebase to 0.94 (#1742473, #1840079)
  - Drop policykit wrapper for xmtr due to libcap (#1488417, #1488418)


author: Miroslav Lichvar <mlichvar@redhat.com> 6.2-9.20210508
changelog:
  - fix buffer overflow on terminfo with too many capabilities (CVE-2023-29491)
  - ignore TERMINFO and HOME environment variables if running as root (#2211666)


author: Phil Sutter <psutter@redhat.com> [1.0.4-8.el9]
changelog:
  - monitor: Sanitize startup race condition (Phil Sutter) [2130721]
  - evaluate: set eval ctx for add/update statements with integer constants (Phil Sutter) [2094894]
  - src: allow anon set concatenation with ether and vlan (Phil Sutter) [2094887]
  - evaluate: search stacked header list for matching payload dep (Phil Sutter) [2094887]
  - netlink_delinearize: also postprocess OP_AND in set element context (Phil Sutter) [2094887]
  - tests: add a test case for ether and vlan listing (Phil Sutter) [2094887]
  - debug: dump the l2 protocol stack (Phil Sutter) [2094887]
  - proto: track full stack of seen l2 protocols, not just cumulative offset (Phil Sutter) [2094887]
  - netlink_delinearize: postprocess binary ands in concatenations (Phil Sutter) [2094887]
  - netlink_delinearize: allow postprocessing on concatenated elements (Phil Sutter) [2094887]
  - intervals: check for EXPR_F_REMOVE in case of element mismatch (Phil Sutter) [2115627]
  - intervals: fix crash when trying to remove element in empty set (Phil Sutter) [2115627]
  - scanner: don't pop active flex scanner scope (Phil Sutter) [2113874]
  - parser: add missing synproxy scope closure (Phil Sutter) [2113874]
  - tests/py: Add a test for failing ipsec after counter (Phil Sutter) [2113874]
  - doc: Document limitations of ipsec expression with xfrm_interface (Phil Sutter) [1806431]


author: Phil Sutter <psutter@redhat.com> [1.0.4-9.el9]
changelog:
  - tests: add a test case for map update from packet path with concat (Phil Sutter) [2094894]
  - netlink_linearize: fix timeout with map updates (Phil Sutter) [2094894]
  - netlink_delinearize: fix decoding of concat data element (Phil Sutter) [2094894]


author: Phil Sutter <psutter@redhat.com> [1.0.4-10.el9]
changelog:
  - netlink_delinearize: Sanitize concat data element decoding (Phil Sutter) [2160049]
  - optimize: Clarify chain_optimize() array allocations (Phil Sutter) [2160049]
  - optimize: Do not return garbage from stack (Phil Sutter) [2160049]
  - netlink: Fix for potential NULL-pointer deref (Phil Sutter) [2160049]
  - meta: parse_iso_date() returns boolean (Phil Sutter) [2160049]
  - mnl: dump_nf_hooks() leaks memory in error path (Phil Sutter) [2160049]
  - owner: Fix potential array out of bounds access (Phil Sutter) [2160049]


author: Phil Sutter <psutter@redhat.com> [1.0.4-11.el9]
changelog:
  - rule: check address family in set collapse (Phil Sutter) [RHEL-5908]
  - spec: Rename variables to avoid a clash (Phil Sutter) [INTERNAL]


author: Phil Sutter <psutter@redhat.com> [1.0.9-1.el9]
changelog:
  - spec: Utilize pyproject-rpm-macros for the python sub-package (Phil Sutter) [RHEL-14191]
  - Rebase onto version 1.0.9 (Phil Sutter) [RHEL-14191]


author: Bob Relyea <rrelyea@redhat.com> - 3.90.0-1
changelog:
  - Rebase to NSS-3.90
  - Rebase to NSPR-3.35
  - fix incorrect version values in the NSS spec file for FIPS


author: Bob Relyea <rrelyea@redhat.com> - 3.90.0-4
changelog:
  - FIPS review changes
  -   add PORT_SafeZero to avoid compiler optimizing a way zeroing memory.
  -   update the indicators for this release
  -   allow hashing of longer than int32 values in a single PKCS #11 call.


author: Bob Relyea <rrelyea@redhat.com> - 3.90.0-5
changelog:
  - Pick up validated constant time implementations of p256, p384, and p521
    from upsream
  - More Fips indicator changes


author: Mamoru TASAKA <mtasaka@fedoraproject.org> - 6.9.6-0.3.rc3
changelog:
  - Apply upstream patch for upstream bug 221
    - Revert change for false CVE-2020-26159 issue
      https://github.com/kkos/oniguruma/issues/221


author: Than Ngo <than@redhat.com> - 3.18.0-4
changelog:
  - Related: #2044179, do not touch opencryptoki.conf if it is in place already and even if it is unchanged


author: Than Ngo <than@redhat.com> - 3.19.0-1
changelog:
  - Resolves: #2126294, opencryptoki fails after generating > 500 RSA keys
  - Resolves: #2110314, rebase to 3.19.0
  - Resolves: #2110989, openCryptoki key generation with expected MKVP only on CCA and EP11 tokens
  - Resolves: #2110476, openCryptoki ep11 token: master key consistency
  - Resolves: #2018458, openCryptoki ep11 token: vendor specific key derivation


author: Than Ngo <than@redhat.com> - 3.21.0-3
changelog:
  - Resolves: #2110497, concurrent MK rotation for cca token
  - Resolves: #2110498, concurrent MK rotation for ep11 token
  - Resolves: #2110499, ep11 token: PKCS #11 3.0 - support AES_XTS
  - Resolves: #2111010, cca token: protected key support 
  - Resolves: #2160061, rebase to 3.21.0
  - Resolves: #2160105, pkcsslotd hardening
  - Resolves: #2160107, p11sak support Dilithium and Kyber keys
  - Resolves: #2160109, ica and soft tokens: PKCS #11 3.0 - support AES_XTS


author: Than Ngo <than@redhat.com> - 3.21.0-8
changelog:
  - Resolves: #2222592, p11sak tool: slot option does not accept argument 0 for slot index 0
  - Resolves: #2222596, p11sak fails as soon as there reside non-key objects


author: Than Ngo <than@redhat.com> - 3.22.0-2
changelog:
  - timing side-channel in handling of RSA PKCS#1 v1.5 padded ciphertexts (Marvin)
  Resolves: RHEL-22792


author: Simon Pichugin <spichugi@redhat.com> - 2.6.2-1
changelog:
  - Update to new major release OpenLDAP 2.6.2
  - The client tools parameters '-h' and '-p' are officially deprecated,
    please, use '-H' parameter instead.
    Related: rhbz#2094159


author: Simon Pichugin <spichugi@redhat.com> - 2.6.6-2
changelog:
  - The client tools parameters '-h' and '-p' are still deprecated,
    but this release brings back the client tools options that
    were removed during the previous rebase.
    Resolves: RHEL-19384


author: Simon Pichugin <spichugi@redhat.com> - 2.6.6-3
changelog:
  - Use systemd-sysusers for ldap user and group
    Replace License with SPDX identifier
    Resolves: RHEL-5140


author: Jakub Jelen <jjelen@redhat.com> - 0.23.0-1
changelog:
  - Rebase to latest 0.23.0 release (#2100409)
  - Use separate OpenSSL context to work better from inside of OpenSSL providers


author: Jakub Jelen <jjelen@redhat.com> - 0.23.0-2
changelog:
  - Fix regression in handling OpenPGP cards
  - Fix CVE-2023-2977: buffer overrun in pkcs15init for cardos


author: Jakub Jelen <jjelen@redhat.com> - 0.23.0-3
changelog:
  - Fix file caching with different offsets (RHEL-4079)
  - Fix CVE-2023-40660: Potential PIN bypass
  - Fix CVE-2023-40661: Dynamic analyzers reports in pkcs15init
  - Fix CVE-2023-4535: Out-of-bounds read in MyEID driver handling encryption using symmetric keys
  - Fix CVE-2023-5992: Side-channel leaks while stripping encryption PKCS#1.5 padding


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-30
changelog:
  - Some non-terminating processes were listening on ports.
    Resolves: rhbz#2177768
  - On sshd startup, we check whether signing using the SHA1 for signing is
    available and don't use it when it isn't.
  - On ssh private key conversion we explicitly use SHA2 for testing RSA keys.
  - In sshd, when SHA1 signatures are unavailable, we fallback (fall forward :) )
    to SHA2 on host keys proof confirmation.
  - On a client side we permit SHA2-based proofs from server when requested SHA1
    proof (or didn't specify the hash algorithm that implies SHA1 on the client
    side). It is aligned with already present exception for RSA certificates.
  - We fallback to SHA2 if SHA1 signatures is not available on the client side
    (file sshconnect2.c).
  - We skip dss-related tests (they don't work without SHA1).
    Resolves: rhbz#2070163
  - FIPS compliance efforts for dh, ecdh and signing
    Resolves: rhbz#2091694


author: Norbert Pocs <npocs@redhat.com> - 8.7p1-31
changelog:
  - Fix minor issues with openssh-8.7p1-evp-fips-compl-dh.patch:
  - Check return values
  - Use EVP API to get the size of DH
  - Add some log debug lines
  - Related: rhbz#2091694


author: Norbert Pocs <npocs@redhat.com> - 8.7p1-32
changelog:
  - Fix pkcs11 issue with the recent changes
  - Delete unnecessary log messages from previous compl-dh patch
  - Add ssh_config man page explanation on rhbz#2068423
  - Resolves: rhbz#2207793, rhbz#2209096


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-35
changelog:
  - Relax OpenSSH checks for OpenSSL version
    Resolves: RHEL-4734
  - Limit artificial delays in sshd while login using AD user
    Resolves: RHEL-2469
  - Move users/groups creation logic to sysusers.d fragments
    Resolves: RHEL-5222


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-36
changelog:
  - Fix Terrapin attack
    Resolves: CVE-2023-48795
  - Relax OpenSSH build-time checks for OpenSSL version
    Related: RHEL-4734
  - Forbid shell metasymbols in username/hostname
    Resolves: CVE-2023-51385


author: Clemens Lang <cllang@redhat.com> - 1:3.0.7-19
changelog:
  - Re-enable DHX keys in FIPS mode, disable FIPS 186-4 parameter validation and generation in FIPS mode
    Resolves: rhbz#2169757


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.7-20
changelog:
  - Fix possible DoS translating ASN.1 object identifiers
    Resolves: CVE-2023-2650
  - Release the DRBG in global default libctx early
    Resolves: rhbz#2211340


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.7-25
changelog:
  - Provide relevant diagnostics when FIPS checksum is corrupted
    Resolves: RHEL-5317
  - Don't limit using SHA1 in KDFs in non-FIPS mode.
    Resolves: RHEL-5295
  - Provide empty evp_properties section in main OpenSSL configuration file
    Resolves: RHEL-11439
  - Avoid implicit function declaration when building openssl
    Resolves: RHEL-1780
  - Forbid explicit curves when created via EVP_PKEY_fromdata
    Resolves: RHEL-5304
  - AES-SIV cipher implementation contains a bug that causes it to ignore empty
    associated data entries (CVE-2023-2975)
    Resolves: RHEL-5302
  - Excessive time spent checking DH keys and parameters (CVE-2023-3446)
    Resolves: RHEL-5306
  - Excessive time spent checking DH q parameter value (CVE-2023-3817)
    Resolves: RHEL-5308
  - Fix incorrect cipher key and IV length processing (CVE-2023-5363)
    Resolves: RHEL-13251
  - Switch explicit FIPS indicator for RSA-OAEP to approved following
    clarification with CMVP
    Resolves: RHEL-14083
  - Backport the check required by SP800-56Br2 6.4.1.2.1 (3.c)
    Resolves: RHEL-14083
  - Add missing ECDH Public Key Check in FIPS mode
    Resolves: RHEL-15990
  - Excessive time spent in DH check/generation with large Q parameter value (CVE-2023-5678)
    Resolves: RHEL-15954


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.7-26
changelog:
  - Avoid implicit function declaration when building openssl
    Related: RHEL-1780
  - In FIPS mode, prevent any other operations when rsa_keygen_pairwise_test fails
    Resolves: RHEL-17104
  - Add a directory for OpenSSL providers configuration
    Resolves: RHEL-17193
  - Eliminate memory leak in OpenSSL when setting elliptic curves on SSL context
    Resolves: RHEL-19515
  - POLY1305 MAC implementation corrupts vector registers on PowerPC (CVE-2023-6129)
    Resolves: RHEL-21151
  - Excessive time spent checking invalid RSA public keys (CVE-2023-6237)
    Resolves: RHEL-21654
  - SSL ECDHE Kex fails when pkcs11 engine is set in config file
    Resolves: RHEL-20249
  - Denial of service via null dereference in PKCS#12
    Resolves: RHEL-22486
  - Use certified FIPS module instead of freshly built one in Red Hat distribution
    Resolves: RHEL-23474


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.7-27
changelog:
  - Use certified FIPS module instead of freshly built one in Red Hat distribution
    Related: RHEL-23474


author: Jakub Jelen <jjelen@redhat.com> - 0.4.11-8
changelog:
  - Fix sending parameters for RSA-OAEP operations (#2063378)
  - Improve logging and fix selection of expired certificates (#2029834)


author: Packit Service <user-cont-team+packit-service@redhat.com> - 0.24.1-1
changelog:
  - Release 0.24.1 (Daiki Ueno)
  - common: Support copying attribute array recursively (Daiki Ueno)
  - common: Add assert_ptr_cmp (Daiki Ueno)
  - gtkdoc: remove dependencies on custom target files (Eli Schwartz)
  - doc: Replace occurrence of black list with blocklist (Daiki Ueno)
  - build: Suppress cppcheck false-positive on array bounds (Daiki Ueno)
  - ci: Use Docker image from the same repository (Daiki Ueno)
  - ci: Integrate Docker image building to GitHub workflow (Daiki Ueno)
  - rpc: Fallback to version 0 if server does not support negotiation (Daiki Ueno)
  - build: Port e850e03be65ed573d0b69ee0408e776c08fad8a3 to meson (Daiki Ueno)
  - Link libp11-kit so that it cannot unload (Emmanuel Dreyfus)
  - trust: Use dngettext for plurals (Daiki Ueno)
  - rpc: Support protocol version negotiation (Daiki Ueno)
  - rpc: Separate authentication step from transaction (Daiki Ueno)
  - Meson: p11_system_config_modules instead of p11_package_config_modules (Issam E. Maghni)
  - shell: test -a|o is not POSIX (Issam E. Maghni)
  - Meson: Add libtasn1 to trust programs (Issam E. Maghni)
  - meson: optionalise glib's development files for gtk_doc (Đoàn Trần Công Danh)


author: Zoltan Fridrich <zfridric@redhat.com> - 0.25.2-1
changelog:
  - Update to new upstream release 0.25.2
    Resolves: RHEL-14834
  - Add IBM specific mechanisms and attributes
    Resolves: RHEL-10570


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.5.1-14
changelog:
  - pam_lastlog: check localtime_r() return value. Resolves: #2130124
  - pam_faillock: clarify missing user faillock files after reboot. Resolves: #2126632
  - pam_faillock: avoid logging an erroneous consecutive login failure message. Resolves: #2126648


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.5.1-16
changelog:
  - libpam: use close_range() to close file descriptors. Resolves: RHEL-5099
  - fix formatting of audit messages. Resolves: RHEL-5100


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.3.1-18
changelog:
  - libpam: use getlogin() from libc and not utmp. Resolves: RHEL-16727
  - pam_access: handle hostnames in access.conf. Resolves: RHEL-22300


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.3.1-19
changelog:
  - pam_namespace: protect_dir(): use O_DIRECTORY to prevent local DoS
    situations. CVE-2024-22365. Resolves: RHEL-21244


author: Brian C. Lane <bcl@redhat.com> - 3.4-4
changelog:
  - Fix issues that covscan classifies as important
    Resolves: rhbz#1938836
  - Work around a mkswap bug


author: Brian C. Lane <bcl@redhat.com> - 3.5-1
changelog:
  - Rebase to upstream release 3.5
  - Drop patches included in new upstream tar
  - Add upstream patches for new type command
  - Add upstream patch for swap flag on DASD
    Resolves: rhbz#1999333


author: Petr Pisar <ppisar@redhat.com> - 8.43-3
changelog:
  - Make erroroffset initializion in a POSIX wrapper thread-safe
    (upstream bug #2447)
  - Fix an integer overflow when parsing numbers after "(?C" (upstream bug #2463)
  - Fix shifting integer bits and a NULL pointer dereferce in pcretest tool
    (upstream bug #2380)


author: Jakub Jelen <jjelen@redhat.com> - 1.9.4-1
changelog:
  - Rebase to current version from Fedora (#2017828)
  - Use of upstrea polkit policy preventing unneeded prompts


author: Petr Lautrbach <lautrbach@redhat.com> - 3.5-2
changelog:
  - Improve man pages (RHEL-672)
  - Unwrap strings - remove hard returns and initial white spaces from strings (RHEL-606)


author: Than Ngo <than@redhat.com> - 1.3.10-1
changelog:
  - Resolves: #1920964, P10 Power Mode Reporting
  - Resolves: #2050893, Linux Hybrid Network Virtualizatio
  - Resolves: #2065169, bootloader fails to update boot order after OS install
  - Resolves: #2071862, Fix NM HNV setting primary slave
  - Resolves: #2089106, smtstate --save command failed


author: Than Ngo <than@redhat.com> - 1.3.10-3
changelog:
  - Resolves: #2111991, Add udev rule for the nx-gzip in to the core subpackage
  - Resolves: #2121470, Fix lsslot -c mem output when using 4GB LMB size
  - Resolves: #2110129, Add NVMf-FC boot support for Power


author: Than Ngo <than@redhat.com> - 1.3.10-4
changelog:
  - Resolves: #2150698, handle nsid of nvmf device as hexadecimal number
  - Resolves: #2150697, setup multiple device path for a nvmf boot device


author: Than Ngo <than@redhat.com> - 1.3.10-6
changelog:
  - Resolves: #2166870, lparstat: Fix display of mode for dedicated-donating partition
  - Resolves: #2169269, lparstat: Fix negative values seen while running lparstat with -E option


author: Than Ngo <than@redhat.com> - 1.3.10-7
changelog:
  - Fix negative values seen while running lpar
  - Fix lparstat error with mixed SMT state
  Resolves: #2225371


author: Than Ngo <than@redhat.com> - 1.3.10-8
changelog:
  - Resolves: RHEL-16045, Support partial SMT level through SYS FS smt/control files
  - Resolves: RHEL-11456, LPM hooks


author: Than Ngo <than@redhat.com> - 1.3.10-9
changelog:
  - Resolves: RHEL-20350, getting larger Negative value while running rtas_dbg -l
  - Resolves: RHEL-19076, installation fails if nsid of nvme device is greater than 10
  - Resolves: RHEL-11456, add new /etc/drmgr.d/pmig hierarchy


author: Jan Rybar <jrybar@redhat.com> - 3.3.17-6
changelog:
  - free: backport new 'used' calculation
  - sysctl: backport support of systemd glob patterns
  - Resolves: rhbz#2003033
  - Resolves: rhbz#2052536


author: Jan Rybar <jrybar@redhat.com> - 3.3.17-7
changelog:
  - sysctl: backport - keys with dots instead of slashes again
  - Resolves: rhbz#2116977
  - Related: rhbz#2052536


author: Charalampos Stratakis <cstratak@redhat.com> - 3.9.14-1
changelog:
  - Update to 3.9.14
  - Security fixes for CVE-2020-10735 and CVE-2021-28861
  Resolves: rhbz#2120642, rhbz#1834423, rhbz#2128249


author: Charalampos Stratakis <cstratak@redhat.com> - 3.9.16-1
changelog:
  - Update to 3.9.16
  - Security fixes for CVE-2022-42919 and CVE-2022-45061
  Resolves: rhbz#2138705, rhbz#2144072


author: Charalampos Stratakis <cstratak@redhat.com> - 3.9.18-3.1
changelog:
  - Security fixes for CVE-2023-6597 and CVE-2024-0450
  - Fix tests for XMLPullParser with Expat with fixed CVE
  Resolves: RHEL-33887, RHEL-34287


author: Tomas Orsava <torsava@redhat.com> - 1.14.5-5
changelog:
  - Add automatically generated Obsoletes tag with the python39- prefix
    for smoother upgrade from RHEL8
  - Related: rhbz#1990421


author: Christian Heimes <cheimes@redhat.com> - 36.0.1-6
changelog:
  - Rebase to 36.0.1, related: rhbz#2059630, rhbz#2060787
  - OpenSSL 3.0 FIPS mode is now detected correctly, related: rhbz#2054785
  - Fix error check from EVP_PKEY_CTX_set_signature_md, related: rhbz#2060343
  - Block 3DES in FIPS mode, related: rhbz#2055209
  - Disable DSA tests in FIPS mode
  - Enable SHA1 signatures in test suite
  - Fix serialization of keyusage ext with no bits
  - Re-enable tests that are passing again


author: Christian Heimes <cheimes@redhat.com> - 36.0.1-3
changelog:
  - Fix CVE-2023-23931: Don't allow update_into to mutate immutable objects, resolves rhbz#2172399
  - Fix FTBFS due to failing test_load_invalid_ec_key_from_pem and test_decrypt_invalid_decrypt


author: Miro Hrončok <mhroncok@redhat.com> - 1.2.8-9
changelog:
  - Subpackage python2-dbus has been removed
    See https://fedoraproject.org/wiki/Changes/RetirePython2


author: Miro Hrončok <mhroncok@redhat.com> - 4.4.0-5
changelog:
  - Subpackage python2-decorator has been removed
    See https://fedoraproject.org/wiki/Changes/RetirePython2


author: Rafael Jeffman <rjeffman@redhat.com> - 2.2.1-1
changelog:
  - Rebase to version 2.2.1
    Resolves: rhbz#2088661
  - Disable DNSSEC tests using SHA1 due to crypto policies
    Resolves: rhbz#2107651


author: Tomas Popela <tpopela@redhat.com> - 3.40.1-6
changelog:
  - Fix the multilib problems by backporting fixes done by mhroncok from Fedora:
  - Move pure Python modules to a noarch subpackage
  - Ensure Python bytecode installed in multilib packages is bit-to-bit identical
    Resolves: rhbz#1915764


author: Miro Hrončok <mhroncok@redhat.com> - 0.4-39
changelog:
  - Subpackage python2-iniparse has been removed
    See https://fedoraproject.org/wiki/Changes/RetirePython2


author: Miro Hrončok <mhroncok@redhat.com> - 0.9.6-19
changelog:
  - Subpackages python2-inotify, python2-inotify-examples have been removed
    See https://fedoraproject.org/wiki/Changes/RetirePython2


author: John Kacur <jkacur@redhat.com> - 0.6.3-5
changelog:
  - various clean-ups including using 'with' context managers in try-except
  - Fix to ignore UnicodeDecodeError when it occurs
  Resolves: rhbz#2031717


author: John Kacur <jkacur@redhat.com> - 0.7.3-1
changelog:
  - Rebase to upstream python-linux-procfs-0.7.3
  - This rebase removes upstream spec files and
  - syncs the git tag with version
  Resolves: RHEL-7614


author: Thomas Moschny <thomas.moschny@gmx.de> - 3.3.4-2
changelog:
  - Apply PR6 by Igor Raits <ignatenkobrain@fedoraproject.org>: Support
    for building on EPEL8 + upstream tests invocation.
  - Remove unused BR on python3-tidy (we'd need pytidylib instead, which
    doesn't seem to be packaged).


author: Dan Radez <dradez@redhat.com> - 4.8.0-6
changelog:
  - adding workaround for https://bugzilla.redhat.com/show_bug.cgi?id=1914843
  - while we wait for upstream fix: https://github.com/pexpect/pexpect/issues/669


author: Miro Hrončok <mhroncok@redhat.com> - 0.6.0-8
changelog:
  - Subpackage python2-ptyprocess has been removed
    See https://fedoraproject.org/wiki/Changes/Mass_Python_2_Package_Removal


author: Miro Hrončok <mhroncok@redhat.com> - 5.4.1-6
changelog:
  - Remove some outdated Obsoletes and Provides,
    but keep providing python3-yaml and python3-PyYAML for users
  - Related: rhbz#1990421


author: Florian Festi <ffesti@redhat.com> - 4.16.1.3-20
changelog:
  - Add bcond macros (#2129060)
  - Fix db queries with carets (#2129468)
  - Remove spurious Python rpm module (#2135731)
  - Handle SELinux log messages (#2123719)
  - Add --nocompression to rpm2archive (#2150804)


author: Florian Festi <ffesti@redhat.com> - 4.16.1.3-25
changelog:
  - Followup on #2166383
  - Add compat scripts calling external find-debug, sepdebugcrcfix and debugedit
  - Add %__find_debuginfo macro


author: Florian Festi <ffesti@redhat.com> - 4.16.1.3-26
changelog:
  - Backport file handling code from rpm-4.19 to fix CVE-2021-35937,
    CVE-2021-35938 and CVE-2021-35939


author: Florian Festi <ffesti@redhat.com> - 4.16.1.3-27
changelog:
  - Fix short circuiting of version strings in expressions (RHEL-15688)
  - Fix description of whatconflicts in the man page (RHEL-6303)
  - Expose and document rpmdb --verifydb operation (RHEL-14591)
  - Fixes to the file handling backport


author: Florian Festi <ffesti@redhat.com> - 4.16.1.3-29
changelog:
  - Actually add --verifydb to the man page (RHEL-14591)
  - Don't warn about missing user/group on skipped files (RHEL-18037)


author: Petr Lautrbach <lautrbach@redhat.com> - 4.4.3-1
changelog:
  - SETools 4.4.3 release
  - Improve man pages
  - seinfoflow: Add -r option to get flows into the source type.
  - seinfoflow.1: Remove references to sepolgen permission map.
  - AVRule/AVRuleXperm: Treat rules with no permissions as invalid policy.
  - SELinuxPolicy: Add explicit cast for libspol message


author: Tomas Orsava <torsava@redhat.com> - 53.0.0-5
changelog:
  - Provide the platform-python-setuptools name for backwards compatibility
    with RHEL 8
  - Related: rhbz#1891487


author: Tomas Orsava <torsava@redhat.com> - 53.0.0-7
changelog:
  - Make the python-setuptools-wheel subpackage versioned (python3-setuptools-wheel),
    and move its contents to a versioned directory /usr/share/python3-wheels
  - Resolves: rhbz#1982668


author: Tomas Orsava <torsava@redhat.com> - 53.0.0-8
changelog:
  - Conflict with old Python versions that use the old unversioned wheel location
  - Resolves: rhbz#1982668


author: Miro Hrončok <mhroncok@redhat.com> - 234-11
changelog:
  - Subpackage python2-systemd has been removed
    See https://fedoraproject.org/wiki/Changes/Mass_Python_2_Package_Removal


author: Petr Pisar <ppisar@redhat.com> - 1:4.05-17
changelog:
  - Support grace period expirations past 2038 year for XFS
  - Add a synopsis for a project quota option in the quota tool
  - Add a --filesystem option to the quota tool
  - Complain that ext4 external quota files are deprecated


author: Petr Pisar <ppisar@redhat.com> - 1:4.06-2
changelog:
  - Remove a dead code from process_file() (upstream bug #54)
  - Fix a compilation warning in quotaops.c
  - Warn when kernel XFS large time stamp does fit into (32-bit) user-space
    time_t
  - Do not use a pointless compiler-internal __P() macro


author: Sumit Bose <sbose@redhat.com>
changelog:
  - Use make macros https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
  - migrated to SPDX license
  - allow multiple names and _srv_ ad_server option
    Resolves: jira#RHEL-12112
  - fix ccache handling for leave operation
    Resolves: jira#RHEL-5104


author: Fedora Release Engineering <releng@fedoraproject.org> - 1:0.4-0.44.b46
changelog:
  - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
  - Use standard make_build and make_install macros in spec file.


author: Jeff Makey <jeff@makey.net> - 1:0.4-0.46.b47
changelog:
  - New upstream release 0.4b47
  - Update main URL.
  - Drop dump-glibc_xattr patch, now applied upstream.
  - Drop documentation conversion from ISO-8859-1 to UTF-8, now applied upstream.
  - Print correct name of archive table of contents file (#1727392).


author: Josef Ridky <jridky@redhat.com> - 1:0.4-0.51.b47
changelog:
  - rename spec file to restore
  - add gating.yaml
  - changes between .47 and .51 had to be stripped due of wrong sync
    between centos and dist-git


author: systemd maintenance team <systemd-maint@redhat.com> - 252-30
changelog:
  - resolved: limit the number of signature validations in a transaction (RHEL-26643)
  - resolved: reduce the maximum nsec3 iterations to 100 (RHEL-26643)
  - efi: alignment of the PE file has to be at least 512 bytes (RHEL-26133)
  - units: change assert to condition to skip running in initrd/os (RHEL-16182)
  - ci: add configuration for regression sniffer GA (RHEL-1086)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-31
changelog:
  - bootctl: rework random seed logic to use open_mkdir_at() and openat() (RHEL-16952)
  - bootctl: properly sync fs before/after moving random seed file into place (RHEL-16952)
  - bootctl: when updating EFI random seed file, hash old seed with new one (RHEL-16952)
  - sha256: add helper than hashes a buffer *and* its size (RHEL-16952)
  - random-seed: don't refresh EFI random seed from random-seed.c anymore (RHEL-16952)
  - bootctl: downgrade graceful messages to LOG_NOTICE (RHEL-16952)
  - units: rename/rework systemd-boot-system-token.service → systemd-boot-random-seed.service (RHEL-16952)
  - bootctl: split out setting of system token into function of its own (RHEL-16952)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-32.2
changelog:
  - coredump: generate stacktraces also for processes running in containers w/o coredump forwarding (RHEL-34061)
  - test: add a couple of tests for systemd-coredump (RHEL-34061)
  - test: don't expand the subshell expression prematurely (RHEL-34061)
  - coredump filter: fix stack overflow with =all (RHEL-34061)
  - coredump filter: add mask for 'all' using UINT32_MAX, not UINT64_MAX (RHEL-34061)
  - test: add coverage for CoredumpFilter=all (RHEL-34061)
  - test: rotate journal before storing coredumps (RHEL-34061)
  - test: sync with the fake binary before killing it (RHEL-34061)
  - test: check coredump handling in containers & namespaces (RHEL-34061)
  - ukify: make the test happy with the latest OpenSSL (RHEL-34061)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-32.6
changelog:
  - cryptsetup: do not assert when unsealing token without salt (RHEL-40119)
  - cryptsetup: check the existence of salt by salt_size > 0 (RHEL-40119)
  - bootspec: fix null-dereference-read (RHEL-40119)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-24
changelog:
  - ci: use source-git-automation composite Action (RHEL-1086)
  - ci: increase the cron interval to 45 minutes (RHEL-1086)
  - ci: add all Z-Stream versions to array of allowed versions (RHEL-1086)
  - udev/net_id: introduce naming scheme for RHEL-9.4 (RHEL-22427)
  - basic/errno-util: add wrappers which only accept negative errno (RHEL-22443)
  - errno-util: allow ERRNO_IS_* to accept types wider than int (RHEL-22443)
  - udev: add new builtin net_driver (RHEL-22443)
  - udev/net_id: introduce naming scheme for RHEL-8.10 (RHEL-22427)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-27
changelog:
  - test: merge TEST-20-MAINPIDGAMES into TEST-07-PID1 (fixup) (RHEL-1086)
  - test: use the default nsec3-iterations value (RHEL-1086)
  - test: explicitly set nsec3-iterations to 0 (RHEL-1086)
  - core: mount namespaces: Remove auxiliary bind mounts directory after unit termination (RHEL-19483)
  - ci: deploy systemd man to GitHub Pages (RHEL-1086)
  - doc: add missing `<listitem>` to `systemd.net-naming-scheme.xml` (RHEL-7026)
  - man: reorder the list of supported naming schemes (RHEL-7026)
  - tree-wide: fix return value handling of base64mem() (RHEL-16182)
  - Consolidate various TAKE_* into TAKE_GENERIC(), add TAKE_STRUCT() (RHEL-16182)
  - pcrphase: add $SYSTEMD_PCRPHASE_STUB_VERIFY env var for overriding stub check (RHEL-16182)
  - pcrphase: gracefully exit if TPM2 support is incomplete (RHEL-16182)
  - tpm2-util: split out code that derives "good" TPM2 banks into an strv from pcrphase and generalize it in tpm2-util.c (RHEL-16182)
  - tpm2-util: split out code that extends a PCR from pcrphase (RHEL-16182)
  - tpm2-util: optionally do HMAC in tpm2_extend_bytes() in case we process sensitive data (RHEL-16182)
  - cryptsetup: add tpm2-measure-pcr= and tpm2-measure-bank= crypttab options (RHEL-16182)
  - man: document the new crypttab measurement options (RHEL-16182)
  - gpt-auto-generator: automatically measure root/var volume keys into PCR 15 (RHEL-16182)
  - blkid-util: define enum for blkid_do_safeprobe() return values (RHEL-16182)
  - pcrphase: make tool more generic, reuse for measuring machine id/fs uuids (RHEL-16182)
  - units: measure /etc/machine-id into PCR 15 during early boot (RHEL-16182)
  - generators: optionally, measure file systems at boot (RHEL-16182)
  - tpm2: add common helper for checking if we are running on UKI with TPM measurements (RHEL-16182)
  - man: document new machine-id/fs measurement options (RHEL-16182)
  - test: add simple integration test for checking PCR extension works as it should (RHEL-16182)
  - update TODO (RHEL-16182)
  - cryptsetup: retry TPM2 unseal operation if it fails with TPM2_RC_PCR_CHANGED (RHEL-16182)
  - boot: Simplify object erasure (RHEL-16182)
  - tree-wide: use CLEANUP_ERASE() at various places (RHEL-16182)
  - dlfcn: add new safe_dclose() helper (RHEL-16182)
  - tpm2: rename tpm2 alg id<->string functions (RHEL-16182)
  - tpm2: rename struct tpm2_context to Tpm2Context (RHEL-16182)
  - tpm2: use ref counter for Tpm2Context (RHEL-16182)
  - tpm2: use Tpm2Context* instead of ESYS_CONTEXT* (RHEL-16182)
  - tpm2: add Tpm2Handle with automatic cleanup (RHEL-16182)
  - tpm2: simplify tpm2_seal() blob creation (RHEL-16182)
  - tpm2: add salt to pin (RHEL-16182)
  - basic/macro: add macro to iterate variadic args (RHEL-16182)
  - test/test-macro: add tests for FOREACH_VA_ARGS() (RHEL-16182)
  - basic/bitfield: add bitfield operations (RHEL-16182)
  - test/test-bitfield: add tests for bitfield macros (RHEL-16182)
  - tpm2: add tpm2_get_policy_digest() (RHEL-16182)
  - tpm2: add TPM2_PCR_VALID() (RHEL-16182)
  - tpm2: add/rename functions to manage pcr selections (RHEL-16182)
  - test/test-tpm2: add tests for pcr selection functions (RHEL-16182)
  - tpm2: add tpm2_pcr_read() (RHEL-16182)
  - tpm2: move openssl-required ifdef code out of policy-building function (RHEL-16182)
  - tpm2: add tpm2_is_encryption_session() (RHEL-16182)
  - tpm2: move policy building out of policy session creation (RHEL-16182)
  - tpm2: add support for a trusted SRK (RHEL-16182)
  - tpm2: fix nits from PR #26185 (RHEL-16182)
  - tpm2: replace magic number (RHEL-16182)
  - tpm2: add tpm2_digest_*() functions (RHEL-16182)
  - tpm2: replace hash_pin() with tpm2_digest_*() functions (RHEL-16182)
  - tpm2: add tpm2_set_auth() (RHEL-16182)
  - tpm2: add tpm2_get_name() (RHEL-16182)
  - tpm2: rename pcr_values_size vars to n_pcr_values (RHEL-16182)
  - tpm2: add tpm2_policy_pcr() (RHEL-16182)
  - tpm2: add tpm2_policy_auth_value() (RHEL-16182)
  - tpm2: add tpm2_policy_authorize() (RHEL-16182)
  - tpm2: use tpm2_policy_authorize() (RHEL-16182)
  - tpm2: add tpm2_calculate_sealing_policy() (RHEL-16182)
  - tpm: remove external calls to dlopen_tpm2() (RHEL-16182)
  - tpm2: remove all extern tpm2-tss symbols (RHEL-16182)
  - tpm2: add tpm2_get_capability(), tpm2_cache_capabilities(), tpm2_capability_pcrs() (RHEL-16182)
  - tpm2: verify symmetric parms in tpm2_context_new() (RHEL-16182)
  - tpm2: replace _cleanup_tpm2_* macros with _cleanup_() (RHEL-16182)
  - tpm2-util: use compound initialization when allocating tpm2 objects (RHEL-16182)
  - tpm2: add tpm2_get_capability_handle(), tpm2_esys_handle_from_tpm_handle() (RHEL-16182)
  - tpm2: add tpm2_read_public() (RHEL-16182)
  - tpm2: add tpm2_get_legacy_template() and tpm2_get_srk_template() (RHEL-16182)
  - tpm2: add tpm2_load() (RHEL-16182)
  - tpm2: add tpm2_load_external() (RHEL-16182)
  - tpm2: move local vars in tpm2_seal() to point of use (RHEL-16182)
  - tpm2: replace magic number in hmac_sensitive initialization (RHEL-16182)
  - tpm2: add tpm2_create() (RHEL-16182)
  - tpm2: replace tpm2_capability_pcrs() macro with direct c->capaiblity_pcrs use (RHEL-16182)
  - basic/alloc-util: add greedy_realloc_append() (RHEL-16182)
  - tpm2: cache the TPM supported commands, add tpm2_supports_command() (RHEL-16182)
  - tpm2: cache TPM algorithms (RHEL-16182)
  - tpm2: add tpm2_persist_handle() (RHEL-16182)
  - tpm2: add tpm2_get_or_create_srk() (RHEL-16182)
  - tpm2: move local vars in tpm2_unseal() to point of use (RHEL-16182)
  - tpm2: remove tpm2_make_primary() (RHEL-16182)
  - tpm2: use CreatePrimary() to create primary keys instead of Create() (RHEL-16182)
  - cryptsetup: downgrade a bunch of log messages that to LOG_WARNING (RHEL-16182)
  - boot/measure: replace TPM PolicyPCR session with calculation (RHEL-16182)
  - core: imply DeviceAllow=/dev/tpmrm0 with LoadCredentialEncrypted (RHEL-16182)
  - added more test cases (RHEL-16182)
  - test: fixed negative checks in TEST-70-TPM2. Use in-line error handling rather than redirections. Follow up on #27020 (RHEL-16182)
  - systemd-cryptenroll: add string aliases for tpm2 PCRs Fixes #26697. RFE. (RHEL-16182)
  - cryptenroll: fix an assertion with weak passwords (RHEL-16182)
  - man/systemd-cryptenroll: update list of PCRs, link to uapi docs (RHEL-16182)
  - tpm2: add debug logging to functions converting hash or asym algs to/from strings or ids (RHEL-16182)
  - tpm2: add tpm2_hash_alg_to_size() (RHEL-16182)
  - tpm2: change tpm2_tpm*_pcr_selection_to_mask() to return mask (RHEL-16182)
  - tpm2: add more helper functions for managing TPML_PCR_SELECTION and TPMS_PCR_SELECTION (RHEL-16182)
  - tpm2: add Tpm2PCRValue struct and associated functions (RHEL-16182)
  - tpm2: move declared functions in header lower down (RHEL-16182)
  - tpm2: declare tpm2_log_debug_*() functions in tpm2_util.h (RHEL-16182)
  - tpm2: change tpm2_calculate_policy_pcr(), tpm2_calculate_sealing_policy() to use Tpm2PCRValue array (RHEL-16182)
  - tpm2: change tpm2_parse_pcr_argument() parameters to parse to Tpm2PCRValue array (RHEL-16182)
  - tpm2: add TPM2B_*_MAKE(), TPM2B_*_CHECK_SIZE() macros (RHEL-16182)
  - tpm2: add tpm2_pcr_read_missing_values() (RHEL-16182)
  - openssl: add openssl_pkey_from_pem() (RHEL-16182)
  - openssl: add rsa_pkey_new(), rsa_pkey_from_n_e(), rsa_pkey_to_n_e() (RHEL-16182)
  - openssl: add ecc_pkey_new(), ecc_pkey_from_curve_x_y(), ecc_pkey_to_curve_x_y() (RHEL-16182)
  - test: add DEFINE_HEX_PTR() helper function (RHEL-16182)
  - openssl: add test-openssl (RHEL-16182)
  - tpm2: add functions to convert TPM2B_PUBLIC to/from openssl pkey or PEM (RHEL-16182)
  - tpm2: move policy calculation out of tpm2_seal() (RHEL-16182)
  - man: update systemd-cryptenroll man page with details on --tpm2-pcrs format change (RHEL-16182)
  - tpm2: update TEST-70-TPM2 to test passing PCR value to systemd-cryptenroll (RHEL-16182)
  - tpm2: change *alg_to_* functions to use switch() (RHEL-16182)
  - tpm2: lowercase TPM2_PCR_VALUE[S]_VALID functions (RHEL-16182)
  - tpm2: move cast from lhs to rhs in uint16_t/int comparison (RHEL-16182)
  - tpm2: in validator functions, return false instead of assert failure (RHEL-16182)
  - tpm2: in tpm2_pcr_values_valid() use FOREACH_ARRAY() (RHEL-16182)
  - tpm2: use SIZE_MAX instead of strlen() for unhexmem() (RHEL-16182)
  - tpm2: put !isempty() check inside previous !isempty() check (RHEL-16182)
  - tpm2: simplify call to asprintf() (RHEL-16182)
  - tpm2: check pcr value hash != 0 before looking up hash algorithm name (RHEL-16182)
  - tpm2: use strempty() (RHEL-16182)
  - tpm2: split TPM2_PCR_VALUE_MAKE() over multiple lines (RHEL-16182)
  - tpm2: remove ret_ prefix from input/output params (RHEL-16182)
  - tpm2: use memcpy_safe() instead of memcpy() (RHEL-16182)
  - openssl: use new(char, size) instead of malloc(size) (RHEL-16182)
  - tpm2: use table for openssl<->tpm2 ecc curve id mappings (RHEL-16182)
  - tpm2: use switch() instead of if-else (RHEL-16182)
  - tpm2: make logging level consistent at debug for some functions (RHEL-16182)
  - tpm2: remove unnecessary void* cast (RHEL-16182)
  - tpm2: add tpm2_pcr_values_has_(any|all)_values() functions (RHEL-16182)
  - tpm2: wrap (7) in UINT32_C() (RHEL-16182)
  - cryptenroll: change man page example to remove leading 0x and lowercase hex (RHEL-16182)
  - openssl: add log_openssl_errors() (RHEL-16182)
  - openssl: add openssl_digest_size() (RHEL-16182)
  - openssl: add openssl_digest_many() (RHEL-16182)
  - openssl: replace openssl_hash() with openssl_digest() (RHEL-16182)
  - openssl: add openssl_hmac_many() (RHEL-16182)
  - openssl: add rsa_oaep_encrypt_bytes() (RHEL-16182)
  - openssl: add kdf_kb_hmac_derive() (RHEL-16182)
  - openssl: add openssl_cipher_many() (RHEL-16182)
  - openssl: add ecc_edch() (RHEL-16182)
  - openssl: add kdf_ss_derive() (RHEL-16182)
  - dlfcn-util: add static asserts ensuring our sym_xyz() func ptrs match the types from the official headers (RHEL-16182)
  - tpm2: add tpm2_marshal_blob() and tpm2_unmarshal_blob() (RHEL-16182)
  - tpm2: add tpm2_serialize() and tpm2_deserialize() (RHEL-16182)
  - tpm2: add tpm2_index_to_handle() and tpm2_index_from_handle() (RHEL-16182)
  - tpm2: fix build failure without openssl (RHEL-16182)
  - tpm2-util: look for tpm2-pcr-signature.json directly in /.extra/ (RHEL-16182)
  - tpm2: downgrade most log functions from error to debug (RHEL-16182)
  - tpm2: handle older tpm enrollments without a saved pcr bank (RHEL-16182)
  - tpm2: allow tpm2_make_encryption_session() without bind key (RHEL-16182)
  - tpm2: update tpm2 test for supported commands (RHEL-16182)
  - tpm2: use GREEDY_REALLOC_APPEND() in tpm2_get_capability_handles(), cap max value (RHEL-16182)
  - tpm2: change tpm2_unseal() to accept Tpm2Context instead of device string (RHEL-16182)
  - tpm2: cache TPM's supported ECC curves (RHEL-16182)
  - tpm2-util: make tpm2_marshal_blob()/tpm2_unmarshal_blob() static (RHEL-16182)
  - tpm2-util: make tpm2_read_public() static, as we use it only internally in tpm2-util.c (RHEL-16182)
  - cryptenroll: allow specifying handle index of key to use for sealing (RHEL-16182)
  - test: add tests for systemd-cryptenroll --tpm2-seal-key-handle (RHEL-16182)
  - tpm2: do not call Esys_TR_Close() (RHEL-16182)
  - tpm2: don't use GetCapability() to check transient handles (RHEL-16182)
  - tpm2-util: pick up a few new symbols from tpm2-tss (RHEL-16182)
  - tpm2: add tpm2_get_pin_auth() (RHEL-16182)
  - tpm2: instead of adjusting authValue trailing 0(s), trim them as required by tpm spec (RHEL-16182)
  - tpm2-util: rename tpm2_calculate_name() → tpm2_calculate_pubkey_name() (RHEL-16182)
  - cryptenroll: do not implicitly verify with default tpm policy signature (RHEL-16182)
  - cryptenroll: drop deadcode (RHEL-16182)
  - tpm2: allow using tpm2_get_srk_template() without tpm (RHEL-16182)
  - tpm2: add test to verify srk templates (RHEL-16182)
  - tpm2: add tpm2_sym_alg_*_string() and tpm2_sym_mode_*_string() (RHEL-16182)
  - tpm2: add tpm2_calculate_seal() and helper functions (RHEL-16182)
  - tpm2: update test-tpm2 for tpm2_calculate_seal() (RHEL-16182)
  - cryptenroll: add support for calculated TPM2 enrollment (RHEL-16182)
  - test: update TEST-70 with systemd-cryptenroll calculated TPM2 enrollment (RHEL-16182)
  - openssl-util: avoid freeing invalid pointer (RHEL-16182)
  - creds-util: check for CAP_DAC_READ_SEARCH (RHEL-16182)
  - creds-util: do not try TPM2 if there is not support (RHEL-16182)
  - creds-util: merge the TPM2 detection for initrd (RHEL-16182)
  - cryptenroll: fix a memory leak (RHEL-16182)
  - sd-journal: introduce sd_journal_step_one() (RHEL-11591)
  - test: modernize test-journal-flush (RHEL-11591)
  - journal-file-util: do not fail when journal_file_set_offline() called more than once (RHEL-11591)
  - journal-file-util: Prefer punching holes instead of truncating (RHEL-11591)
  - test: add reproducer for SIGBUS issue caused by journal truncation (RHEL-11591)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-28
changelog:
  - random-seed: shorten a bit may_credit() (RHEL-16952)
  - random-seed: make one more use of random_write_entropy() (RHEL-16952)
  - random-seed: use getopt() (RHEL-16952)
  - random-seed: make the logic to calculate the number of bytes read from the random seed file clearer (RHEL-16952)
  - random-seed: no need to pass 'mode' argument when opening /dev/urandom (RHEL-16952)
  - random-seed: split out run() (RHEL-16952)
  - random_seed: minor improvement in run() (RHEL-16952)
  - random-seed: downgrade some messages (RHEL-16952)
  - random-seed: clarify one comment (RHEL-16952)
  - random-seed: make sure to load machine id even if the seed file is missing (RHEL-16952)
  - chase-symlinks: add new flag for prohibiting any following of symlinks (RHEL-16952)
  - bootctl,bootspec: make use of CHASE_PROHIBIT_SYMLINKS whenever we access the ESP/XBOOTLDR (RHEL-16952)
  - boot: implement kernel EFI RNG seed protocol with proper hashing (RHEL-16952)
  - random-seed: refresh EFI boot seed when writing a new seed (RHEL-16952)
  - random-seed: handle post-merge review nits (RHEL-16952)
  - boot: do not truncate random seed file (RHEL-16952)
  - bootctl: install system token on virtualized systems (RHEL-16952)
  - boot: remove random-seed-mode (RHEL-16952)
  - stub: handle random seed like sd-boot does (RHEL-16952)
  - efi: add efi_guid_equal() helper (RHEL-16952)
  - efi: add common implementation for loop finding EFI configuration tables (RHEL-16952)
  - boot: Detect hypervisors using SMBIOS info (RHEL-16952)
  - boot: Skip soft-brick warning when in a VM (RHEL-16952)
  - boot: Replace UINTN with size_t (RHEL-16952)
  - boot: Use unsigned for beep counting (RHEL-16952)
  - boot: Use unicode literals (RHEL-16952)
  - macro: add generic IS_ALIGNED32() anf friends (RHEL-16952)
  - meson: use 0|1 for SD_BOOT (RHEL-16952)
  - boot: Add printf functions (RHEL-16952)
  - boot: Use printf for error logging (RHEL-16952)
  - boot: Introduce log_wait (RHEL-16952)
  - boot: Add log_trace debugging helper (RHEL-16952)
  - tree-wide: Use __func__ in asserts (RHEL-16952)
  - boot: Drop use of xpool_print/SPrint (RHEL-16952)
  - boot: Drop use of Print (RHEL-16952)
  - boot: Rework GUID handling (RHEL-16952)
  - efi-string: Fix strchr() null byte handling (RHEL-16952)
  - efi-string: Add startswith8() (RHEL-16952)
  - efi-string: Add efi_memchr() (RHEL-16952)
  - vmm: Add more const (RHEL-16952)
  - vmm: Add smbios_find_oem_string() (RHEL-16952)
  - stub: Read extra kernel command line items from SMBIOS (RHEL-16952)
  - vmm: Modernize get_smbios_table() (RHEL-16952)
  - stub: measure SMBIOS kernel-cmdline-extra in PCR12 (RHEL-16952)
  - efi: support passing empty cmdline to mangle_stub_cmdline() (RHEL-16952)
  - efi: set EFIVAR to stop Shim from uninstalling its protocol (RHEL-16952)
  - ukify: use empty stub for addons (RHEL-16952)
  - stub: allow loading and verifying cmdline addons (RHEL-16952)
  - TODO: remove fixed item (RHEL-16952)
  - fix: do not check/verify slice units if recursive errors are to be ignored (RHEL-1086)


author: Pavel Raiskup <praiskup@redhat.com> - 1.6-1
changelog:
  - new upstream release
  - drop WITH_SELINUX knob and selinux patches, there's built-in support now
  - drop several patches which were incorporated upstream, except for
    changewarnSegv patch (did not apply, and not needed nowadays)


author: Vladis Dronov <vdronov@redhat.com> - 6.13-3
changelog:
  - Adjust rngd-wake-threshold.service and post section so udevadm
    is not run in a container (bz 1965318)


author: Vladis Dronov <vdronov@redhat.com> - 6.13-4.git.d207e0b6
changelog:
  - Update to the upstream v6.13 + tip of origin/master + onecpu
    branch + revert of 2ce93190 (bz 1965318)
  - Rebuild rng-tools against the latest jitterentropy library
    3.0.2-2.git.409828cf with fixes for an important issue
  - Adjust Source0 to a more proper one


author: Vladis Dronov <vdronov@redhat.com> - 6.15-1
changelog:
  - Update to the upstream v6.15 @ 172bf0e3 (bz 2075977)
  - Allow rngd process to drop privileges with "-D user:group"
  - Fix an error building with jitterentropy-3.4.0
  - Add a requirement for selinux-policy of a certain version
  - Fix a build failure on ppc64
  - Small edits in test scripts


author: Vladis Dronov <vdronov@redhat.com> - 6.15-2
changelog:
  - Update to the upstream v6.15 + tip of origin/master @ 6dcc9ec2 (bz 2124605)
  - Do not require selinux-policy if it is not present


author: Vladis Dronov <vdronov@redhat.com> - 6.15-3
changelog:
  - Update to the upstream v6.15 + tip of origin/master @ cb8cc624 (bz 2156554)
  - Fix a number of issues found by covscan code scanner
  - Add a jitter init timeout for tests
  - Add a start condition for the FIPS mode (bz 2154804)


author: Vladis Dronov <vdronov@redhat.com> - 6.16-1
changelog:
  - Update to the upstream v6.16 + tip of origin/master @ 0e560296 (bz 2174916)
  - Get rid of text relocations in -fPIE build
  - Add a hint for opensc package (bz 1845854)


author: Till Maas <opensource@till.name> - 8.1-26
changelog:
  - Sync in current files from bash package:
    https://src.fedoraproject.org/rpms/bash/c/739b272e5f5d10cf27a847a44d09eb7f4b6ec89b?branch=master
    https://src.fedoraproject.org/rpms/bash/c/329df36f8bbc303be618f06562ec2c4eebfd1d29?branch=master
    https://src.fedoraproject.org/rpms/bash/c/e3b3cd9cec4a3bd12a792536c0ea131f5ba5bd72?branch=master


author: Steve Dickson <steved@redhat.com> - 1.2.6-4
changelog:
  - Use 
  %setup       -q




  /usr/bin/cat /builddir/build/SOURCES/rpcbind-1.2.6-double-free.patch | 
  /usr/bin/patch -p1 -s --fuzz=0 --no-backup-if-mismatch


  /usr/bin/cat /builddir/build/SOURCES/rpcbind-0.2.3-systemd-envfile.patch | 
  /usr/bin/patch -p1 -s --fuzz=0 --no-backup-if-mismatch


  /usr/bin/cat /builddir/build/SOURCES/rpcbind-0.2.3-systemd-tmpfiles.patch | 
  /usr/bin/patch -p1 -s --fuzz=0 --no-backup-if-mismatch


  /usr/bin/cat /builddir/build/SOURCES/rpcbind-0.2.4-runstatdir.patch | 
  /usr/bin/patch -p1 -s --fuzz=0 --no-backup-if-mismatch


  /usr/bin/cat /builddir/build/SOURCES/rpcbind-1.2.6-systemd-service.patch | 
  /usr/bin/patch -p1 -s --fuzz=0 --no-backup-if-mismatch


  /usr/bin/cat /builddir/build/SOURCES/rpcbind-0.2.4-systemd-rundir.patch | 
  /usr/bin/patch -p1 -s --fuzz=0 --no-backup-if-mismatch


author: Michal Ruprich <mruprich@redhat.com> - 3.2.3-17
changelog:
  - Resolves: #2116669 - zlib: a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field


author: Juraj Marcin <jmarcin@redhat.com> - 38.1.29-1
changelog:
  - Add init_explicit_domain() interface
  Resolves: RHEL-18219
  - Allow dovecot_auth_t connect to postgresql using UNIX socket
  Resolves: RHEL-16850
  - Allow keepalived_t to use sys_ptrace of cap_userns
  Resolves: RHEL-17156
  - Make `bootc` be `install_exec_t`
  Resolves: RHEL-19199
  - Add support for chronyd-restricted
  Resolves: RHEL-18219
  - Label /dev/vas with vas_device_t
  Resolves: RHEL-17336
  - Allow gpsd use /dev/gnss devices
  Resolves: RHEL-16676
  - Allow sendmail manage its runtime files
  Resolves: RHEL-15175
  - Add support for syslogd unconfined scripts
  Resolves: RHEL-11174


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.30-1
changelog:
  - Allow sysadm execute traceroute in sysadm_t domain using sudo
  Resolves: RHEL-14077
  - Allow qatlib set attributes of vfio device files
  Resolves: RHEL-19051
  - Allow qatlib load kernel modules
  Resolves: RHEL-19051
  - Allow qatlib run lspci
  Resolves: RHEL-19051
  - Allow qatlib manage its private runtime socket files
  Resolves: RHEL-19051
  - Allow qatlib read/write vfio devices
  Resolves: RHEL-19051
  - Allow syslog to run unconfined scripts conditionally
  Resolves: RHEL-11174
  - Allow syslogd_t nnp_transition to syslogd_unconfined_script_t
  Resolves: RHEL-11174
  - Allow sendmail MTA connect to sendmail LDA
  Resolves: RHEL-15175
  - Allow sysadm execute tcpdump in sysadm_t domain using sudo
  Resolves: RHEL-15432
  - Allow opafm search nfs directories
  Resolves: RHEL-17820
  - Allow mdadm list stratisd data directories
  Resolves: RHEL-19276
  - Update cyrus_stream_connect() to use sockets in /run
  Resolves: RHEL-19282
  - Allow collectd connect to statsd port
  Resolves: RHEL-21044
  - Allow insights-client transition to sap unconfined domain
  Resolves: RHEL-21452
  - Create the sap module
  Resolves: RHEL-21452


author: Juraj Marcin <jmarcin@redhat.com> - 38.1.31-1
changelog:
  - Allow chronyd-restricted read chronyd key files
  Resolves: RHEL-18219
  - Allow conntrackd_t to use bpf capability2
  Resolves: RHEL-22277
  - Allow smbd_t to watch user_home_dir_t if samba_enable_home_dirs is on
  Resolves: RHEL-14735
  - Allow hypervkvp_t write access to NetworkManager_etc_rw_t
  Resolves: RHEL-14505
  - Add interface for write-only access to NetworkManager rw conf
  Resolves: RHEL-14505
  - Allow unconfined_domain_type use IORING_OP_URING_CMD on all device nodes
  Resolves: RHEL-11792


author: Juraj Marcin <jmarcin@redhat.com> - 38.1.32-1
changelog:
  - Dontaudit subscription manager setfscreate and read file contexts
  Resolves: RHEL-21635
  - Allow xdm_t to watch and watch_reads mount_var_run_t
  Resolves: RHEL-24841
  - Allow unix dgram sendto between exim processes
  Resolves: RHEL-21902
  - Allow utempter_t use ptmx
  Resolves: RHEL-24946
  - Only allow confined user domains to login locally without unconfined_login
  Resolves: RHEL-1551
  - Add userdom_spec_domtrans_confined_admin_users interface
  Resolves: RHEL-1551
  - Only allow admindomain to execute shell via ssh with ssh_sysadm_login
  Resolves: RHEL-1551
  - Add userdom_spec_domtrans_admin_users interface
  Resolves: RHEL-1551
  - Move ssh dyntrans to unconfined inside unconfined_login tunable policy
  Resolves: RHEL-1551


author: Juraj Marcin <jmarcin@redhat.com> - 38.1.33-1
changelog:
  - Allow thumb_t to watch and watch_reads mount_var_run_t
  Resolves: RHEL-26073
  - Allow opafm create NFS files and directories
  Resolves: RHEL-17820
  - Label /tmp/libdnf.* with user_tmp_t
  Resolves: RHEL-11250


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.34-1
changelog:
  - Allow wdmd list the contents of the sysfs directories
  Resolves: RHEL-26663
  - Allow linuxptp configure phc2sys and chronyd over a unix domain socket
  Resolves: RHEL-26660


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.35-2.1
changelog:
  - Allow svirt_t read vm sysctls
  Resolves: RHEL-36154
  - Allow qemu-ga read vm sysctls
  Resolves: RHEL-36291


author: Juraj Marcin <jmarcin@redhat.com> - 38.1.27-1
changelog:
  - Remove glusterd module
  Resolves: RHEL-1548
  - Improve default file context(None) of /var/lib/authselect/backups
  Resolves: RHEL-15220
  - Set default file context of /var/lib/authselect/backups to <<none>>
  Resolves: RHEL-15220
  - Create policy for afterburn
  Resolves: RHEL-12591
  - Allow unconfined_domain_type use io_uring cmd on domain
  Resolves: RHEL-11792
  - Add policy for coreos installer
  Resovles: RHEL-5164
  - Add policy for nvme-stas
  Resolves: RHEL-1557
  - Label /var/run/auditd.state as auditd_var_run_t
  Resolves: RHEL-14374
  - Allow ntp to bind and connect to ntske port.
  Resolves: RHEL-15085
  - Allow ip an explicit domain transition to other domains
  Resolves: RHEL-14246
  - Label /usr/libexec/selinux/selinux-autorelabel with semanage_exec_t
  Resolves: RHEL-14289
  - Allow sssd domain transition on passkey_child execution conditionally
  Resolves: RHEL-14014
  - Allow sssd use usb devices conditionally
  Resolves: RHEL-14014
  - Allow kdump create and use its memfd: objects
  Resolves: RHEL-14413


author: Juraj Marcin <jmarcin@redhat.com> - 38.1.28-1
changelog:
  - Create interface selinux_watch_config and add it to SELinux users
  Resolves: RHEL-1555
  - Allow  winbind_rpcd_t processes access when samba_export_all_* is on
  Resolves: RHEL-16273
  - Allow samba-dcerpcd connect to systemd_machined over a unix socket
  Resolves: RHEL-16273
  - Allow winbind-rpcd make a TCP connection to the ldap port
  Resolves: RHEL-16273
  - Allow sudodomain read var auth files
  Resolves: RHEL-16708
  - Allow auditd read all domains process state
  Resolves: RHEL-14285
  - Allow rsync read network sysctls
  Resolves: RHEL-14638
  - Add dhcpcd bpf capability to run bpf programs
  Resolves: RHEL-15326
  - Allow systemd-localed create Xserver config dirs
  Resolves: RHEL-16716
  - Label /var/run/tmpfiles.d/static-nodes.conf with kmod_var_run_t
  Resolves: RHEL-1553
  - Update sendmail policy module for opensmtpd
  Resolves: RHEL-15175


author: Martin Osvald <mosvald@redhat.com> - 2.13.7-7
changelog:
  - Move /var/log/lastlog ownership to systemd (#2066753)
  - tcsh sets variable p to /usr/sbin from /etc/csh.login (#2066767)
  - bashrc: Don't set up VTE-specific PROMPT_COMMAND (#2026892)


author: Tomas Bzatek <tbzatek@redhat.com> - 1.47-7
changelog:
  - Fix sg_inq parsing in rescan-scsi-bus.sh (#2036005,#2035362)
  - Fix rescan-scsi-bus.sh summary print (#2035382)
  - sg_readcap --zbc man page switch fix (#2036718)
  - Various Covscan fixes (#2044433)


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-1
changelog:
  - Rebase to version 4.9. Resolves: #1989556
  - usermod: allow all group types with -G option. Resolves: #1975329
  - useradd: avoid generating an empty subid range
  - Clean spec file


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-3
changelog:
  - getsubids: provide system binary and man page. Resolves: #2013015
  - useradd: generate home and mail directories with selinux user attribute. Resolves: #1993081
  - useradd: revert fix memleak of grp. Resolves: #2020238
  - groupdel: fix SIGSEGV when passwd does not exist. Resolves: #2024834
  - pwck: fix segfault when calling fprintf()
  - newgrp: fix segmentation fault
  - Clean spec file: organize dependencies and move License location


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-4
changelog:
  - useradd: modify check ID range for system users. Resolves: #2004911
  - Fix release sources
  - Add subid requirement for subid-devel


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-7
changelog:
  - useradd: check if subid range exists for user. Resolves: #2179987
  - find_new_[gu]id: Skip over IDs that are reserved for legacy reasons. Resolves: #2179988


author: Martin Gieseking <martin.gieseking@uos.de> - 1.1.8-1
changelog:
  - Updated to new release.
  - Dropped version-related patch which has been applied upstream (BZ #1527850).


author: Jan Jansky <jjansky@redhat.com> = 4.6.0-1
changelog:
  - [ultrapath] Add new plugin for Huawei UltraPath
    Resolves: bz2187407
  - [cleaner] Use data filter for extraction
    Resolves: bz2217906
  - [discovery] Enable the plugin by containers
    Resolves: bz2222134


author: Pavel Moravec <pmoravec@redhat.com> = 4.6.1-1
changelog:
  - rebase to upstream 4.6.1
    Resolves: RHEL-21174
  - [redhat] Change authentication method for RHEL
    Resolves: RHEL-21178


author: Abhi Das <adas@redhat.com> - 4.4-9.git1
changelog:
  - CVE-2021-40153 squashfs-tools: unvalidated filepaths allow writing outside of destination
    rhbz#2000638


author: Abhi Das <adas@redhat.com> - 4.4-10.git1
changelog:
  - CVE-2021-41072 squashfs-tools: additional write outside destination directory exploit fix
    rhbz#2007304


author: Eugene Syromiatnikov <esyr@redhat.com> - 5.13-3
changelog:
  - Address some issues reported by covscan (#1996691).
  - Replace 0141-tests-disable-sockopt-timestamp-on-new-glibc-with-__.patch
    with upstream v5.13-10-g0211fdc "tests: change sockopt-timestamp test
    to use syscall(__NR_recvmsg)"
    and 0154-tests-call-setsockopt-directly-in-sockopt-timestamp.patch.
  - Undo forceful injection of -m64 into CFLAGS/CPPFLAGS to avoid breaking
    mpers and its tests (#1996676).


author: Eugene Syromiatnikov <esyr@redhat.com> - 5.18-2
changelog:
  - Fix the issues reported by covscan (#2103068).
  - Fix SELinux context matching for the deleted paths (#2087693).
  - Fix sloppy FD usage in the bpf test (#2103137).
  - Cater for RHEL 9 license requirement idiosyncrasies (#2103032).


author: Clemens Lang <cllang@redhat.com> - 5.62-2
changelog:
  - Fix stunnel in FIPS mode
    Resolves: rhbz#2050617
  - Fail build if tests fail
    Resolves: rhbz#2051083


author: Clemens Lang <cllang@redhat.com> - 5.71-1
changelog:
  - New upstream release 5.71
    Resolves: RHEL-2468
  - Enable socket activation support
  - verify upstream source in %prep
  - clean up stale conditionals


author: Jiri Hnidek <jhnidek@redhat.com> 20220608-1
changelog:
  - New package built with tito
  - Using new version pattern for subscription-manager-rhsm-certificates


author: Radovan Sroka <rsroka@redhat.com> - 1.9.5p2-8
changelog:
  RHEL 9.2.0 ERRATUM
  - sudo digest check fails incorrectly for certain file sizes (SHA512/SHA384)
  Resolves: rhbz#2115789


author: Radovan Sroka <rsroka@redhat.com> - 1.9.5p2-9
changelog:
  RHEL 9.2.0 ERRATUM
  - CVE-2023-22809 sudo: arbitrary file write with privileges of the RunAs user
  Resolves: rhbz#2161225


author: Radovan Sroka <rsroka@redhat.com> - 1.9.5p2-10
changelog:
  RHEL 9.3.0.Z ERRATUM
  - CVE-2023-28487 sudo: Sudo does not escape control characters in sudoreplay output
  Resolves: RHEL-21834
  - CVE-2023-28486 sudo: Sudo does not escape control characters in log messages
  Resolves: RHEL-21828
  - CVE-2023-42465 sudo: Targeted Corruption of Register and Stack Variables
  Resolves: RHEL-21821


author: Lukas Javorsky <ljavorsk@redhat.com> - 2:1.34-4
changelog:
  - added "padding with zeros" info message (#2089298)
  - do not report disk error as file shrank (#2089316)


author: Štěpán Horáček <shoracek@redhat.com> - 3.2.2-1
changelog:
  - Rebase to 3.2.2
  - Use systemd-sysusers to create user
    Resolves: CVE-2023-22745
    Resolves: rhbz#2095479
    Resolves: rhbz#2160307
    Resolves: rhbz#2162613


author: Leah Leshchinsky <lleshchi@redhat.com> - 0.18-9
changelog:
  - Remove import and fix help message
  - Update manpages for argparse CLI changes
  Resolves: rhbz#2138692


author: John Kacur <jkacur@redhat.com> - 0.19-3
changelog:
  - Don't start the gui if a display is not available
  - Change to SPDX licence tag in the specfile
  Resolves: RHEL-8859


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.19.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#2057609
    - fixed parsing of inline comments
    - added support for quotes in isolated_cores specification
    - spec: reduced weak dependencies
      resolves: rhbz#2093841
    - recommend: do not ignore syspurpose_role if there is no syspurpose
      resolves: rhbz#2030580
    - added support for initial autosetup of isolated_cores
      resolves: rhbz#2093847


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.20.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#2133815
    - systemd: relax polkit requirement
    - sysvinit: fixed path
      resolves: rhbz#2118301
    - plugin_cpu: added support for pm_qos_resume_latency_us
      resolves: rhbz#2118786
    - do not exit on duplicate config lines
    - profiles: new cpu-partitioning-powersave profile
    - profiles: new profile for AWS EC2
    - API: add support for moving devices between instances
      resolves: rhbz#2113925
    - D-Bus: send tracebacks through D-Bus only in debug mode
      resolves: rhbz#2159680
    - Makefile: added fix for python-3.12
    - throughput-performance: set net.core.somaxconn to at least 2048
    - plugin_scheduler: do not leak FDs from the perf
    - plugin_cpu: added support for intel_pstate scaling driver
      resolves: rhbz#2095829
    - added support for the API access through the Unix Domain Socket
      resolves: rhbz#2113900


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.20.0-0.2.rc1
changelog:
  - post RC.1 fixes
    related: rhbz#2133815
  - fixed possible traceback on SIGHUP
    resolves: rhbz#2169712


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.21.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#2182117
    - plugin_scheduler: fix perf fd leaks
      resolves: rhbz#2173938
    - allow skipping rollback when restarting TuneD or switching profile
      resolves: rhbz#2203142
    - function_calc_isolated_cores: no errors for offline CPUs
      resolves: rhbz#2217015


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.22.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: RHEL-17121
    - print all arguments of failing commands in error messages
      resolves: RHEL-3689
    - plugin_sysctl: added support for sysctl names with slash
      resolves: RHEL-3707
    - tuned-adm: added support for moving devices between plugin instances
      resolves: RHEL-15141
    - api: added methods for retrieval of plugin instances and devices
      resolves: RHEL-15137
    - plugin_cpu: amd-pstate mentioned instead of just intel_pstate
      resolves: RHEL-16469
    - hotplug: do not report ENOENT errors on device remove
      resolves: RHEL-11342
    - plugin_sysctl: expand variables when reporting overrides
      resolves: RHEL-18972
    - plugin_acpi: new plugin which handles ACPI platform_profile
      resolves: RHEL-16966
    - plugin_bootloader: skip calling rpm-ostree kargs in no-op case
      resolves: RHEL-20767
    - plugin_cpu: support cstate settings of pm_qos_resume_latency_us
      resolves: RHEL-21129
    - scheduler: add option for ignoring IRQs affinity
      resolves: RHEL-21923
    - plugin_intel_uncore: new plugin for uncore setting


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.22.1-1
changelog:
  - new release
    - rebased tuned to latest upstream
      related: RHEL-17121
    - renamed intel_uncore plugin to uncore
    - network-throughput: increased net.ipv4.tcp_rmem default value
      resolves: RHEL-25847


author: Patsy Griffin <patsy@redhat.com> - 2022e-1
changelog:
  - Rebase to tzdata-2022e
    - Jordan and Syria cancelled the DST transition planned
      for 2022-10-28, remaining at +03 permanently.


author: Patsy Griffin <patsy@redhat.com> - 2022f-1
changelog:
  - Rebase to tzdata-2022f
    - Mexico will stop observing DST except near the US border.
    - Chihuahua moved to -06 year round starting on 2022-10-30.
    - Fiji no longer observes DST.


author: Patsy Griffin <patsy@redhat.com> - 2022g-1
changelog:
  - Rebase to tzdata-2022g
    - The northern edge of the Mexican state of Chihuahua will
      change time zone to agree with nearby US locations on
      2022-11-30.
    - Added a new Zone America/Ciudad_Juarez that splits from
      America/Ojinaga.


author: Patsy Griffin <patsy@redhat.com> - 2023a-1
changelog:
  - Rebase to tzdata-2023a
    - Egypt reintroduced DST, from April through October.
    - Morocco springs forward April 23, not April 30.
    - Palestine delayed the start of DST this year.


author: Patsy Griffin <patsy@redhat.com> - 2023d-1
changelog:
  - Rebase to tzdata-2023d
    - Include time zone changes for Ittoqqortoormiit, Greenland
      and Vostok, Antarctica.
    - Update the expiration date for the leap-seconds.list file.
      No new leap seconds were added.


author: Patsy Griffin <patsy@redhat.com> - 2024a-1
changelog:
  - Rebase to tzdata-2024a
    - Kazakhstan will transition from UTC+6 to UTC+5 on 2024-03-01.
    - Palestine will spring forward a week later than previously
      predicted.


author: Jakub Martisko <jamartis@redhat.com> - 6.0-56
changelog:
  - Use the C crc implementation instead of the asm (i686 only, other arches already use C)
  Related: rhbz#2045075


author: Sérgio Basto <sergio@serjux.com> - 2.6.0-3
changelog:
  - Use make macros (https://src.fedoraproject.org/rpms/usb_modeswitch/pull-request/1)
  - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro


author: Sérgio Basto <sergio@serjux.com> - 2.6.1-1
changelog:
  - Update usb_modeswitch to 2.6.1
  - Drop patch1, http://www.draisberghof.de/usb_modeswitch/bb/viewtopic.php?f=2&t=2733
  - Drop BR jimtcl-devel, if we don't install dynlink-dispatcher


author: Jiri Kucera <jkucera@redhat.com> - 1.114-3
changelog:
  - Do not use fexecve
    Script executed via fexecve has a file descriptor number in
    argv[0]. This results in unexpected output: when displaying
    the script help, a user see "Usage: <number> [options]"
    instead of "Usage: <scriptname> [options]".
    Resolves: #1984417


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.12.1-5
changelog:
  - Replace arch-dependent /usr/include/urcu/config.h with arch-independent
    stub when needed. (bz# 1951223)
  - Added CI gating tests
  - Resolves: bz #1951223


author: - Andy Walsh <awalsh@redhat.com> - 8.1.0.316-1
changelog:
  - Rebased to upstream candidate.
  - Resolves: rhbz#1955374
  - Removed all python based tools, and all management should now be done with
    LVM.
  - Resolves: rhbz#1949159
  - vdostats is now a C program
  - Resolves: rhbz#1972302


author: - Andy Walsh <awalsh@redhat.com> - 8.1.1.287-1
changelog:
  - Fixed off-by-one issue in vdostats.
  - Resolves: rhbz#1999056
  - Improved error handling and path validation in vdostats.
  - Resolves: rhbz#2004576


author: - Andy Walsh <awalsh@redhat.com> - 8.1.1.360-1
changelog:
  - Fixed vdostats output issues.
  - Resolves: rhbz#2004576
  - Removed incorrect assumptions about major device numbers in vdostats.
  - Resolves: rhbz#2045885
  - Made improvements to the vdorecover script.
  - Resolves: rhbz#2047543
  - Added a tool to make LVMVDO pools read/write so that support and
    debugging tools may access them.
  - Resolves: rhbz#2047543


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.2.2637-12
changelog:
  - CVE-2022-0368 vim: Out-of-bounds Read in vim
  - CVE-2022-0417 vim: heap-based-buffer-overflow in ex_retab() of src/indent.c
  - CVE-2022-0408 vim: Stack-based Buffer Overflow in spellsuggest.c


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.2.2637-12
changelog:
  - CVE-2022-0413 vim: use after free in src/ex_cmds.c
  - CVE-2022-0443 vim: heap-use-after-free in enter_buffer() of src/buffer.c
  - CVE-2022-0392 vim: heap-based buffer overflow in getexmodeline() in ex_getln.c


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.2.2637-16
changelog:
  - CVE-2022-0554 vim: Use of Out-of-range Pointer Offset in vim prior
  - CVE-2022-0943 vim: Heap-based Buffer Overflow occurs in vim


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.2.2637-17
changelog:
  - CVE-2022-1154 vim: use after free in utf_ptr2char
  - CVE-2022-1420 vim: Out-of-range Pointer Offset


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.2.2637-19
changelog:
  - CVE-2022-1785 vim: Out-of-bounds Write
  - CVE-2022-1897 vim: out-of-bounds write in vim_regsub_both() in regexp.c
  - CVE-2022-1927 vim: buffer over-read in utf_ptr2char() in mbyte.c


author: Davide Caratti <dcaratti@redhat.com> - 1:2.10-4
changelog:
  - Explicitly allow/disallow unsafe legacy renegotiation on configuration base.
    Resolves: rhbz#2077973


author: Pavel Reichl <preichl@redhat.com> - 3.1.12-3
changelog:
  - xfsdump: restoring inventory prevents non-directory files being restored from tape,
  - actually fixed by rebase to 3.1.12
  - related: bz#2166557
  - xfsrestore: Files from the backup go to orphanage dir because of xfsdump issue
  - related: bz#2034327


author: Pavel Reichl <preichl@redhat.com> - 3.1.12-4
changelog:
  - xfsdump/xfsrestore: suggest recovery for false roots may be possible using -x
  - Related: RHEL-8000


author: Pavel Reichl <preichl@redhat.com> - 5.19.0-1
changelog:
  - New upstream release
  - Tolerate tiny (<300MB) filesystems
  - Rename xfsprogs-5.12.0-default-bigtime-inobtcnt-on.patch to
      xfsprogs-5.19.0-disable-old-kernel-bigtime-inobtcnt-on.patch
      and amend it to reflect upstream changes
  - Backport all "Fixing" patches relevant to 5.19
    Related: rhbz#2142910


author: Pavel Reichl <preichl@redhat.com> - 6.3.0-1
changelog:
  - Rebase to upstream version 6.3.0
  -
  - Following is a list of dropped backported patches which
  - are contained in the current rebase:
  - xfsprogs-5.19.0-xfs-hoist-refcount-record-merge-predicates.patch (v6.2.0)
  - xfsprogs-5.19.0-xfs_db-fix-dir3-block-magic-check.patch (v6.1.0)
  - xfsprogs-5.19.0-xfs-estimate-post-merge-refcounts-correctly.patch (v6.2.0)
  - xfsprogs-5.19.0-xfs-get-rid-of-assert-from-xfs_btree_islastblock.patch (v6.2.0)
  - xfsprogs-5.19.0-xfs-fix-off-by-one-error-in-xfs_btree_space_to_heigh.patch (v6.2.0)
  - xfsprogs-5.19.0-xfs-fix-sb-write-verify-for-lazysbcount.patch (v6.1.0)
  - xfsprogs-5.19.0-xfs-removed-useless-condition-in-function-xfs_attr_n.patch (v6.0.0)
  - xfsprogs-5.19.0-xfs_repair-retain-superblock-buffer-to-avoid-write-h.patch (v6.1.0)
  -
  - Rename the remaining patches so the name contains upstream version in which
  - they are implemented, or "rhelonly".
  -
  - Drop Eric Sandeen's public key used to check tarball signature and replace it by
  - Carlos Maiolino's (current upstream xfsprogs maintainer).
  -
  - Following is a list of newly backported patches from versions released after 6.3
  - which are fixing patches present in version 6.3:
  - xfsprogs-6.4.0-xfs_repair-don-t-add-junked-entries-to-the-rebuilt-d.patch
  - xfsprogs-6.4.0-xfs_repair-don-t-spray-correcting-imap-all-by-itself.patch
  - xfsprogs-6.4.0-xfs_repair-fix-messaging-when-fixing-imap-due-to-spa.patch
  - xfsprogs-6.4.0-xfs_repair-fix-messaging-when-shortform_dir2_junk-is.patch
  -
  - Backport:
  - xfsprogs-6.4.0-xfs_db-move-obfuscate_name-assertion-to-callers.patch
  - xfsprogs-6.4.0-xfs_db-fix-metadump-name-obfuscation-for-ascii-ci-fi.patch
  - xfsprogs-6.4.0-xfs-stabilize-the-dirent-name-transformation-functio.patch
  - to implement RHEL-RHEL-8284
  -
  - Backport xfsprogs-rhelonly-xfs_quota-fix-missing-mount-point-warning.patch
  - to implement RHEL-7900
  -
  - Related: RHEL-15399
  - Related: RHEL-8284
  - Related: RHEL-7900


author: Jakub Martisko <jamartis@redhat.com> - 3.0-31
changelog:
  - Add the missing linker flags
  - Add the patch that allows to configure the linker flags from the spec file
    Resolves: rhbz #2044902


author: Jakub Martisko <jamartis@redhat.com> - 3.0-33
changelog:
  - Disable the asm implementation of some functions and use the C instead
  - This should fix some of the annocheck issues
    Related: rhbz#2044902


author: Jakub Martisko <jamartis@redhat.com> - 3.0-34
changelog:
  - Fix the regression introduced in 3.0-33 that caused some of the zip build flags to be dropped
  Resolves: rhbz#2162688


author: Jakub Martisko <jamartis@redhat.com> - 3.0-35
changelog:
  - Fix the annocheck issus from 3-0-33 without reintroducing the regression from 3.0-34
  Related: rhbz#2162688


author: Matej Mužila <mmuzila@redhat.com> - 1.2.11-34
changelog:
  - Fix heap-based buffer over-read or buffer overflow in inflate in inflate.c
  - Resolves: CVE-2022-37434


author: Lukas Javorsky <ljavorsk@redhat.com> - 1.2.11-37
changelog:
  - Rebased Power 8 optimization patches
  - Fix for Unnecessary IFUNC resolver for crc32_z
  - Fix for python3.11 broken libxml2 and lxml on s390x


