<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="219">
<package pkgid="62179929170ee1c83bdce4c7c0e10d016526dc8034784e47bb969096cadc32c2" name="apparmor" arch="src">
  <version epoch="0" ver="2.13.6" rel="150300.3.15.1"/>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
  <changelog author="nopower@suse.com" date="1641384000">- add add-samba-bgqd.diff: add profile for samba-bgqd;
  (bsc#1191532).</changelog>
  <changelog author="nopower@suse.com" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb;
  (bsc#1192684).</changelog>
  <changelog author="nopower@suse.com" date="1648555200">- update add-samba-bgqd.diff:  to add new rule to fix 'DENIED' open on
  /proc/{pid}/fd for samba-bgqd (bnc#1196850).
- Add update-usr-sbin-smbd.diff to add new rule to allow reading of
  openssl.cnf (bnc#1195463).</changelog>
</package>
<package pkgid="739ba6f7c3a7ab330ee1592a71023ae80e92c272586620f2f014dfc895c5c402" name="apparmor-parser" arch="aarch64">
  <version epoch="0" ver="2.13.6" rel="150300.3.15.1"/>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
  <changelog author="nopower@suse.com" date="1641384000">- add add-samba-bgqd.diff: add profile for samba-bgqd;
  (bsc#1191532).</changelog>
  <changelog author="nopower@suse.com" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb;
  (bsc#1192684).</changelog>
  <changelog author="nopower@suse.com" date="1648555200">- update add-samba-bgqd.diff:  to add new rule to fix 'DENIED' open on
  /proc/{pid}/fd for samba-bgqd (bnc#1196850).
- Add update-usr-sbin-smbd.diff to add new rule to allow reading of
  openssl.cnf (bnc#1195463).</changelog>
</package>
<package pkgid="00aadc46dfa2a1a94297a1e1cf56c3c05bb978a73619e9e8640ea3aa579bf282" name="apparmor-parser" arch="x86_64">
  <version epoch="0" ver="2.13.6" rel="150300.3.15.1"/>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
  <changelog author="nopower@suse.com" date="1641384000">- add add-samba-bgqd.diff: add profile for samba-bgqd;
  (bsc#1191532).</changelog>
  <changelog author="nopower@suse.com" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb;
  (bsc#1192684).</changelog>
  <changelog author="nopower@suse.com" date="1648555200">- update add-samba-bgqd.diff:  to add new rule to fix 'DENIED' open on
  /proc/{pid}/fd for samba-bgqd (bnc#1196850).
- Add update-usr-sbin-smbd.diff to add new rule to allow reading of
  openssl.cnf (bnc#1195463).</changelog>
</package>
<package pkgid="c1291f2eb9f38651c49462ef7ef2cbf16d1ba9b13252aa33385c4286976d8f34" name="curl" arch="aarch64">
  <version epoch="0" ver="7.66.0" rel="150200.4.36.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1573732800">- Fix segfault in zypper ref: [bsc#1156481]
  * remove_handle: clear expire timers after multi_done()
  * Add patch curl-expire-clear.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395200">- Security fix: [bsc#1173026, CVE-2020-8169]
  * Partial password leak over DNS on HTTP redirect
- Add curl-CVE-2020-8169.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395201">- Security fix: [bsc#1173027, CVE-2020-8177]
  * curl can be tricked my a malicious server to overwrite a local
    file when using '-J' ('--remote-header-name') and '-i' ('--head')
    in the same command line.
- Add curl-CVE-2020-8177.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1597320000">- Security fix: [bsc#1175109, CVE-2020-8231]
  * An application that performs multiple requests with libcurl's
    multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in
    rare circumstances experience that when subsequently using the
    setup connect-only transfer, libcurl will pick and use the wrong
    connection and instead pick another one the application has
    created since then.
- Add curl-CVE-2020-8231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342400">- Security fix: [bsc#1179398, CVE-2020-8284]
  * Trusting FTP PASV responses: When curl performs a passive FTP
    transfer, it first tries the 'EPSV' command and if that is not
    supported, it falls back to using 'PASV'. A malicious server
    can use the 'PASV' response to trick curl into connecting
    back to a given IP address and port, and this way potentially
    make curl extract information about services that are otherwise
    private and not disclosed.
  * The IP address part of the response is now ignored by default,
    by making 'CURLOPT_FTP_SKIP_PASV_IP' default to '1L'. The same
    goes for the command line tool, which then might need
    '--no-ftp-skip-pasv-ip' set to prevent curl from ignoring the
    address in the server response.
- Add curl-CVE-2020-8284.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342401">- Security fix: [bsc#1179399, CVE-2020-8285]
  * FTP wildcard stack overflow: The wc_statemach() internal
    function has been rewritten to use an ordinary loop instead of
    the recursive approach.
- Add curl-CVE-2020-8285.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342402">- Security fix: [bsc#1179593, CVE-2020-8286]
  * Inferior OCSP verification: libcurl offers "OCSP stapling" via
    the 'CURLOPT_SSL_VERIFYSTATUS' option that, when set, verifies
    the OCSP response that a server responds with as part of the TLS
    handshake. It then aborts the TLS negotiation if something is
    wrong with the response. The same feature can be enabled with
    '--cert-status' using the curl tool.
  * As part of the OCSP response verification, a client should verify
    that the response is indeed set out for the correct certificate.
    This step was not performed by libcurl when built or told to use
    OpenSSL as TLS backend.
- Add curl-CVE-2020-8286.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616587200">- Security fix: [bsc#1183933, CVE-2021-22876]
  * The automatic referer leaks credentials
- Add curl-CVE-2021-22876.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616760000">- Security fix: [bsc#1183934, CVE-2021-22890]
  * When using a HTTPS proxy and TLS 1.3, libcurl can confuse
    session tickets arriving from the HTTPS proxy but work as
    if they arrived from the remote server and then wrongly
    "short-cut" the host handshake.
- Add curl-CVE-2021-22890.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620907200">- Allow partial chain verification [jsc#SLE-17956]
  * Have intermediate certificates in the trust store be treated
    as trust-anchors, in the same way as self-signed root CA
    certificates are. This allows users to verify servers using
    the intermediate cert only, instead of needing the whole chain.
  * Set FLAG_TRUSTED_FIRST unconditionally.
  * Do not check partial chains with CRL check.
- Add curl-X509_V_FLAG_PARTIAL_CHAIN.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: Disable the metalink feature:
  * Insufficiently Protected Credentials [bsc#1188218, CVE-2021-22923]
  * Wrong content via metalink not discarded [bsc#1188217, CVE-2021-22922]</changelog>
  <changelog author="pmonreal@suse.com" date="1626091201">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534400">- Security fix: [bsc#1190373, CVE-2021-22946]
  * Protocol downgrade required TLS bypassed
  * Add curl-CVE-2021-22946.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534401">- Security fix: [bsc#1190374, CVE-2021-22947]
  * STARTTLS protocol injection via MITM
  * Add curl-CVE-2021-22947.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1632312000">- MIME: Properly check Content-Type even if it has parameters
  * Add curl-check-content-type.patch [bsc#1190153]</changelog>
  <changelog author="david.anes@suse.com" date="1650628800">- Security fix: [bsc#1198766, CVE-2022-27776]
  * Auth/cookie leak on redirect
  * Add backported curl-CVE-2022-27776.patch
- Security fix: [bsc#1198723, CVE-2022-27775]
  * Bad local IPv6 connection reuse
  * Add backported curl-CVE-2022-27775.patch
- Security fix: [bsc#1198614, CVE-2022-22576]
  * OAUTH2 bearer bypass in connection re-use
  * Add backported curl-CVE-2022-22576.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651752000">- Securiy fix: [bsc#1199223, CVE-2022-27781]
  * CERTINFO never-ending busy-loop
  * Add curl-CVE-2022-27781.patch
- Securiy fix: [bsc#1199224, CVE-2022-27782]
  * TLS and SSH connection too eager reuse
  * Add curl-CVE-2022-27782.patch</changelog>
  <changelog author="david.anes@suse.com" date="1656331200">- Security fix: [bsc#1200735, CVE-2022-32206]
  * HTTP compression denial of service
  * Add curl-CVE-2022-32206.patch
- Security fix: [bsc#1200737, CVE-2022-32208]
  * FTP-KRB bad message verification
  * Add curl-CVE-2022-32208.patch</changelog>
</package>
<package pkgid="7b68bdb9d3f5d02f6d9633985d184a5be2644463174f1cbe75dade36a81e30f7" name="curl" arch="src">
  <version epoch="0" ver="7.66.0" rel="150200.4.36.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1573732800">- Fix segfault in zypper ref: [bsc#1156481]
  * remove_handle: clear expire timers after multi_done()
  * Add patch curl-expire-clear.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395200">- Security fix: [bsc#1173026, CVE-2020-8169]
  * Partial password leak over DNS on HTTP redirect
- Add curl-CVE-2020-8169.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395201">- Security fix: [bsc#1173027, CVE-2020-8177]
  * curl can be tricked my a malicious server to overwrite a local
    file when using '-J' ('--remote-header-name') and '-i' ('--head')
    in the same command line.
- Add curl-CVE-2020-8177.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1597320000">- Security fix: [bsc#1175109, CVE-2020-8231]
  * An application that performs multiple requests with libcurl's
    multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in
    rare circumstances experience that when subsequently using the
    setup connect-only transfer, libcurl will pick and use the wrong
    connection and instead pick another one the application has
    created since then.
- Add curl-CVE-2020-8231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342400">- Security fix: [bsc#1179398, CVE-2020-8284]
  * Trusting FTP PASV responses: When curl performs a passive FTP
    transfer, it first tries the 'EPSV' command and if that is not
    supported, it falls back to using 'PASV'. A malicious server
    can use the 'PASV' response to trick curl into connecting
    back to a given IP address and port, and this way potentially
    make curl extract information about services that are otherwise
    private and not disclosed.
  * The IP address part of the response is now ignored by default,
    by making 'CURLOPT_FTP_SKIP_PASV_IP' default to '1L'. The same
    goes for the command line tool, which then might need
    '--no-ftp-skip-pasv-ip' set to prevent curl from ignoring the
    address in the server response.
- Add curl-CVE-2020-8284.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342401">- Security fix: [bsc#1179399, CVE-2020-8285]
  * FTP wildcard stack overflow: The wc_statemach() internal
    function has been rewritten to use an ordinary loop instead of
    the recursive approach.
- Add curl-CVE-2020-8285.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342402">- Security fix: [bsc#1179593, CVE-2020-8286]
  * Inferior OCSP verification: libcurl offers "OCSP stapling" via
    the 'CURLOPT_SSL_VERIFYSTATUS' option that, when set, verifies
    the OCSP response that a server responds with as part of the TLS
    handshake. It then aborts the TLS negotiation if something is
    wrong with the response. The same feature can be enabled with
    '--cert-status' using the curl tool.
  * As part of the OCSP response verification, a client should verify
    that the response is indeed set out for the correct certificate.
    This step was not performed by libcurl when built or told to use
    OpenSSL as TLS backend.
- Add curl-CVE-2020-8286.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616587200">- Security fix: [bsc#1183933, CVE-2021-22876]
  * The automatic referer leaks credentials
- Add curl-CVE-2021-22876.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616760000">- Security fix: [bsc#1183934, CVE-2021-22890]
  * When using a HTTPS proxy and TLS 1.3, libcurl can confuse
    session tickets arriving from the HTTPS proxy but work as
    if they arrived from the remote server and then wrongly
    "short-cut" the host handshake.
- Add curl-CVE-2021-22890.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620907200">- Allow partial chain verification [jsc#SLE-17956]
  * Have intermediate certificates in the trust store be treated
    as trust-anchors, in the same way as self-signed root CA
    certificates are. This allows users to verify servers using
    the intermediate cert only, instead of needing the whole chain.
  * Set FLAG_TRUSTED_FIRST unconditionally.
  * Do not check partial chains with CRL check.
- Add curl-X509_V_FLAG_PARTIAL_CHAIN.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: Disable the metalink feature:
  * Insufficiently Protected Credentials [bsc#1188218, CVE-2021-22923]
  * Wrong content via metalink not discarded [bsc#1188217, CVE-2021-22922]</changelog>
  <changelog author="pmonreal@suse.com" date="1626091201">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534400">- Security fix: [bsc#1190373, CVE-2021-22946]
  * Protocol downgrade required TLS bypassed
  * Add curl-CVE-2021-22946.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534401">- Security fix: [bsc#1190374, CVE-2021-22947]
  * STARTTLS protocol injection via MITM
  * Add curl-CVE-2021-22947.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1632312000">- MIME: Properly check Content-Type even if it has parameters
  * Add curl-check-content-type.patch [bsc#1190153]</changelog>
  <changelog author="david.anes@suse.com" date="1650628800">- Security fix: [bsc#1198766, CVE-2022-27776]
  * Auth/cookie leak on redirect
  * Add backported curl-CVE-2022-27776.patch
- Security fix: [bsc#1198723, CVE-2022-27775]
  * Bad local IPv6 connection reuse
  * Add backported curl-CVE-2022-27775.patch
- Security fix: [bsc#1198614, CVE-2022-22576]
  * OAUTH2 bearer bypass in connection re-use
  * Add backported curl-CVE-2022-22576.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651752000">- Securiy fix: [bsc#1199223, CVE-2022-27781]
  * CERTINFO never-ending busy-loop
  * Add curl-CVE-2022-27781.patch
- Securiy fix: [bsc#1199224, CVE-2022-27782]
  * TLS and SSH connection too eager reuse
  * Add curl-CVE-2022-27782.patch</changelog>
  <changelog author="david.anes@suse.com" date="1656331200">- Security fix: [bsc#1200735, CVE-2022-32206]
  * HTTP compression denial of service
  * Add curl-CVE-2022-32206.patch
- Security fix: [bsc#1200737, CVE-2022-32208]
  * FTP-KRB bad message verification
  * Add curl-CVE-2022-32208.patch</changelog>
</package>
<package pkgid="0965395a2f8f6d530f447b6da9e08295feb655acd7aa723f969e504f58965428" name="curl" arch="x86_64">
  <version epoch="0" ver="7.66.0" rel="150200.4.36.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1573732800">- Fix segfault in zypper ref: [bsc#1156481]
  * remove_handle: clear expire timers after multi_done()
  * Add patch curl-expire-clear.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395200">- Security fix: [bsc#1173026, CVE-2020-8169]
  * Partial password leak over DNS on HTTP redirect
- Add curl-CVE-2020-8169.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395201">- Security fix: [bsc#1173027, CVE-2020-8177]
  * curl can be tricked my a malicious server to overwrite a local
    file when using '-J' ('--remote-header-name') and '-i' ('--head')
    in the same command line.
- Add curl-CVE-2020-8177.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1597320000">- Security fix: [bsc#1175109, CVE-2020-8231]
  * An application that performs multiple requests with libcurl's
    multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in
    rare circumstances experience that when subsequently using the
    setup connect-only transfer, libcurl will pick and use the wrong
    connection and instead pick another one the application has
    created since then.
- Add curl-CVE-2020-8231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342400">- Security fix: [bsc#1179398, CVE-2020-8284]
  * Trusting FTP PASV responses: When curl performs a passive FTP
    transfer, it first tries the 'EPSV' command and if that is not
    supported, it falls back to using 'PASV'. A malicious server
    can use the 'PASV' response to trick curl into connecting
    back to a given IP address and port, and this way potentially
    make curl extract information about services that are otherwise
    private and not disclosed.
  * The IP address part of the response is now ignored by default,
    by making 'CURLOPT_FTP_SKIP_PASV_IP' default to '1L'. The same
    goes for the command line tool, which then might need
    '--no-ftp-skip-pasv-ip' set to prevent curl from ignoring the
    address in the server response.
- Add curl-CVE-2020-8284.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342401">- Security fix: [bsc#1179399, CVE-2020-8285]
  * FTP wildcard stack overflow: The wc_statemach() internal
    function has been rewritten to use an ordinary loop instead of
    the recursive approach.
- Add curl-CVE-2020-8285.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342402">- Security fix: [bsc#1179593, CVE-2020-8286]
  * Inferior OCSP verification: libcurl offers "OCSP stapling" via
    the 'CURLOPT_SSL_VERIFYSTATUS' option that, when set, verifies
    the OCSP response that a server responds with as part of the TLS
    handshake. It then aborts the TLS negotiation if something is
    wrong with the response. The same feature can be enabled with
    '--cert-status' using the curl tool.
  * As part of the OCSP response verification, a client should verify
    that the response is indeed set out for the correct certificate.
    This step was not performed by libcurl when built or told to use
    OpenSSL as TLS backend.
- Add curl-CVE-2020-8286.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616587200">- Security fix: [bsc#1183933, CVE-2021-22876]
  * The automatic referer leaks credentials
- Add curl-CVE-2021-22876.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616760000">- Security fix: [bsc#1183934, CVE-2021-22890]
  * When using a HTTPS proxy and TLS 1.3, libcurl can confuse
    session tickets arriving from the HTTPS proxy but work as
    if they arrived from the remote server and then wrongly
    "short-cut" the host handshake.
- Add curl-CVE-2021-22890.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620907200">- Allow partial chain verification [jsc#SLE-17956]
  * Have intermediate certificates in the trust store be treated
    as trust-anchors, in the same way as self-signed root CA
    certificates are. This allows users to verify servers using
    the intermediate cert only, instead of needing the whole chain.
  * Set FLAG_TRUSTED_FIRST unconditionally.
  * Do not check partial chains with CRL check.
- Add curl-X509_V_FLAG_PARTIAL_CHAIN.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: Disable the metalink feature:
  * Insufficiently Protected Credentials [bsc#1188218, CVE-2021-22923]
  * Wrong content via metalink not discarded [bsc#1188217, CVE-2021-22922]</changelog>
  <changelog author="pmonreal@suse.com" date="1626091201">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534400">- Security fix: [bsc#1190373, CVE-2021-22946]
  * Protocol downgrade required TLS bypassed
  * Add curl-CVE-2021-22946.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534401">- Security fix: [bsc#1190374, CVE-2021-22947]
  * STARTTLS protocol injection via MITM
  * Add curl-CVE-2021-22947.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1632312000">- MIME: Properly check Content-Type even if it has parameters
  * Add curl-check-content-type.patch [bsc#1190153]</changelog>
  <changelog author="david.anes@suse.com" date="1650628800">- Security fix: [bsc#1198766, CVE-2022-27776]
  * Auth/cookie leak on redirect
  * Add backported curl-CVE-2022-27776.patch
- Security fix: [bsc#1198723, CVE-2022-27775]
  * Bad local IPv6 connection reuse
  * Add backported curl-CVE-2022-27775.patch
- Security fix: [bsc#1198614, CVE-2022-22576]
  * OAUTH2 bearer bypass in connection re-use
  * Add backported curl-CVE-2022-22576.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651752000">- Securiy fix: [bsc#1199223, CVE-2022-27781]
  * CERTINFO never-ending busy-loop
  * Add curl-CVE-2022-27781.patch
- Securiy fix: [bsc#1199224, CVE-2022-27782]
  * TLS and SSH connection too eager reuse
  * Add curl-CVE-2022-27782.patch</changelog>
  <changelog author="david.anes@suse.com" date="1656331200">- Security fix: [bsc#1200735, CVE-2022-32206]
  * HTTP compression denial of service
  * Add curl-CVE-2022-32206.patch
- Security fix: [bsc#1200737, CVE-2022-32208]
  * FTP-KRB bad message verification
  * Add curl-CVE-2022-32208.patch</changelog>
</package>
<package pkgid="dc97de06f389dce55f25e9538302681ac8e67373fa4a61031cb815ead7592b7e" name="dracut-transactional-update" arch="noarch">
  <version epoch="0" ver="4.0.0~rc3" rel="150300.3.3.1"/>
  <changelog author="iforster@suse.com" date="1615377600">- Version 3.2.1
  - t-u: Forward --quiet option to tukit
  - Regression: Add /opt as bind mount into update environment
  - Remove output indicators of the called command to not tamper
    the result line
  - Fix /etc syncing with --drop-if-no-change</changelog>
  <changelog author="iforster@suse.com" date="1615550400">- Version 3.2.2
  - Don't skip patches with rebootSuggested flag [bsc#1183442]</changelog>
  <changelog author="iforster@suse.com" date="1615550401">- Revert inotify-tools dependency: The package is not available in
  SLE. This will probably have to be implemented as a native C
  version.</changelog>
  <changelog author="iforster@suse.com" date="1616673600">- Version 3.3.0
  - Add support for more package managers by bind mounting their directories
  - Support snapshots without dedicated overlay [boo#1183539], [bsc#1183539]
  - Link RPM database correctly with older zypper versions [boo#1183521]
  - Don't discard manual changes in fstab [boo#1183856], [bsc#1192302]</changelog>
  <changelog author="iforster@suse.com" date="1623585600">- Version 3.4.0
  - Apply SElinux context on /etc in transaction [boo#1185625], [boo#1185766]
    [bsc#1186842], [boo#1186775]
  - Implement inotify handling in C instead of Bash; this makes the
  - -drop-if-no-change option work on SLE Micro [bsc#1184529]
  - Use `tukit call` for up, dup and patch to allow resuming an update after
    zypper updated itself in the snapshot [bsc#1185226]
  - Fix obsolete output type messages in initrd [boo#1177149]
  - Make different base snapshot warning more visible [bsc#1185224]</changelog>
  <changelog author="iforster@suse.com" date="1627905600">- Version 3.5.0
  - Add alias setDiscardIfUnchanged for setDiscard. The old method name
    wasn't really clear and will be removed if we should have an API break
    in the future
  - Replace mkinitrd with direct dracut call [boo#1186213]
  - tukit: Add configuration file support (/etc/tukit.conf)
  - Allow users to configure additional bind mounts (see /usr/etc/tukit.conf
    for an example and limitations) [bsc#1188322]
  - Add 'transactional-update status' call. This is a POC for obtaining a
    hash of a system to verify its integrity. The functionality is still
    experimental!
  - Internal bugfixes / optimizations</changelog>
  <changelog author="iforster@suse.com" date="1627992000">- Add tukit.conf to spec file</changelog>
  <changelog author="iforster@suse.com" date="1627992001">- Version 3.5.1
  - t-u: Disable status file generation by default
    The new experimental `status` command requires the availability of
    /etc/YaST2/control.xml, which is not present on all systems. Hide the
    creation of the corresponding status file behind a new EXPERIMENTAL_STATUS
    option to try out this functionality.
  - Increase library version</changelog>
  <changelog author="iforster@suse.com" date="1630324800">- Version 3.5.2
  - tukit: Fix overlay syncing errors with SELinux [bsc#1188648]
  - Don't print message for `shell` with --quiet
    [gh#openSUSE/transactional-update#69]</changelog>
  <changelog author="iforster@suse.com" date="1630929600">- Version 3.5.3
  - t-u: Purge kernels as part of package operations
    Required for live patching support [bsc#1189728]</changelog>
  <changelog author="iforster@suse.com" date="1631361600">- Version 3.5.4
  - tukit: Fix resolved support [boo#1190383]</changelog>
  <changelog author="iforster@suse.com" date="1631880000">- Version 3.5.5
  - t-u: Use tukit for SUSEConnect call [bsc#1190574]
    Correctly registers repositories</changelog>
  <changelog author="iforster@suse.com" date="1632398400">- Version 3.5.6
  - tukit: Add S/390 bootloader support [bsc#1189807]
  - t-u: support purge-kernels with t-u patch [bsc#1190788]</changelog>
  <changelog author="iforster@suse.com" date="1634040000">- Version 3.5.7
  Various fixes affecting Salt support:
  - t-u: Don't squash stderr messages into stdout
  - t-u: Correctly handle case when the snapshot has been deleted due to
    using --drop-if-no-change: Don't show reboot messages and avoid an awk
    error message [bsc#1191475]
  - tukit: Make inotify handler less sensitive / ignore more directories
    [bsc#1191475]</changelog>
  <changelog author="iforster@suse.com" date="1634904000">- Version 3.6.0
  - Simplify mount hierarchy by just using a single slave bind
    mount as the root of the update environment; this may avoid the
    error messages of failed unmounts
    May fix [boo#1191945]</changelog>
  <changelog author="iforster@suse.com" date="1636545600">- Version 3.6.1
  - Fix rsyncing /etc into the running system with
  - -drop-if-no-change [bsc#1192242]</changelog>
  <changelog author="iforster@suse.com" date="1637323200">- Version 3.6.2
  - Bind mount root file system snapshot on itself, this makes the
    temporary directory in /tmp unnecessary; also fixes [boo#1188110]
    to return the correct snapshot's working directory via API call.
  - Use separate mount namespace for transactional-update; this should
    fix several applications that fail to run if a mount point has the
    'unbindable' mount flag set</changelog>
  <changelog author="iforster@suse.com" date="1637582400">- Version 4.0.0~rc1
  This release is API, but not ABI compatible with previous releases;
  existing applications will have to be recompiled against this new version.
  Major features:
  - Introduces a D-Bus service to access the libtukit API via the
    org.opensuse.tukit.Transaction interface
  - Introduces a C binding via libtukit.h.
  Other changes:
  - t-u: Rework --quiet handling to make sure no output is shown even in
    error cases; this is necessary for automation, e.g. with Salt.
    [gh#openSUSE/transactional-update#73]
  - tukit: Allow storing command output into variable by introducing a new
    optional parameter for "execute" and "callExt".
  - Replace multiple and non-standalone occurenses of {} in "callExt"
    argument.
  - Split transactional-update.timer into transactional-update.timer
    and transactional-update-cleanup.timer; the later will clean up
    old snapshots even when the system does not do automatic updates.
  - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged".
  - Throw exception if snapshot is not found.
  - Fix various compiler warnings
- Update spec file:
  - Include tukitd D-Bus daemon
  - Only install one version of the library (as there are no breaking API
    changes yet)
  - Add %pre scriplets for systemd services
  - Replace %systemd_postun scriptlets with %systemd_postun_with_restart
    to satisfy rpmlint checks
  - Add transactional-update log file as %ghost file</changelog>
  <changelog author="iforster@suse.com" date="1646568000">- Version 4.0.0~rc2
  - Fix missing prompt in "shell" command [bsc#1196580]
  - Add output of tukit commands to log file
  - Fix compilation error with GCC12 [boo#1194876]
  - Fixed (non-critical) security review comments [boo#1196149]
  - Fixed selfupdate
  - Code cleanup</changelog>
  <changelog author="iforster@suse.com" date="1651579200">- Version 4.0.0~rc3
  - Add Snapshot interface
  - Reworked signal handling: All public signals are sent from the
    main thread now, keeping the same sender for everything
  - Implement D-Bus call "Execute" for Transactions
  - Implement interface for listing Snapshots
  - Implement Reboot interface
  - Fix bug when using --continue on old snapshots
  - Fix hypothetical integer overflow in snapshot list [bsc#1196826]
  - Fix wrong sort order in status command
    [gh#openSUSE/transactional-update#80]</changelog>
</package>
<package pkgid="cfa2a0a8f01e2212800d30a298b15592bebce5e8a844591c448cd201b81fc092" name="dwarves" arch="aarch64">
  <version epoch="0" ver="1.22" rel="150300.7.3.1"/>
  <changelog author="jengelh@inai.de" date="1584273600">- Update to release 1.17
  * Support raw BTF as available in /sys/kernel/btf/vmlinux.
  * Make --find_pointers_to consider unions.
  * Make --contains and --find_pointers_to honour --unions.
  * Add support for finding pointers to void.
  * Make --contains and --find_pointers_to to work with base types.</changelog>
  <changelog author="idonmez@suse.com" date="1589889600">- Don't require libebl-plugins on suse_version &gt;= 1550</changelog>
  <changelog author="jslaby@suse.com" date="1599048000">- add libbpf-Fix-libbpf-hashmap-on-I-LP32-architectures.patch</changelog>
  <changelog author="tdevries@suse.com" date="1600689600">- Backport fixes for segfault when processing dwz-ed kernel
  [bsc#1176095,https://github.com/acmel/dwarves/issues/10].
  * dwarves-dwarf_loader-Bail-out-at-DW_TAG_imported_unit-tags.patch
  * dwarves-dwarf_loader-Ignore-entries-in-a-DW_TAG_partial_unit-for-now.patch</changelog>
  <changelog author="jengelh@inai.de" date="1601640000">- Update to release 1.18
  * pahole now should be segfault free when handling gdb test
    suit DWARF files, including ADA, FORTRAN, rust and dwp
    compressed files (the latter is refused).
  * Bail out on partial units for now, avoiding segfaults.
- Drop
  dwarves-dwarf_loader-Ignore-entries-in-a-DW_TAG_partial_unit-for-now.patch,
  dwarves-dwarf_loader-Bail-out-at-DW_TAG_imported_unit-tags.patch
  (merged)
- Add forced ELF symvers because of ABI breaks</changelog>
  <changelog author="dmueller@suse.com" date="1603800000">- update to 1.18_15g040fd7f (bsc#1177921):
  * btf_encoder: Support cross-compiled ELF binaries with different endianness
  * strings: use BTF's string APIs for strings management
  * strings: Rename strings.h to avoid clashing with /usr/include/strings.h
  * dwarf_loader: increase the size of lookup hash map
  * btf_encoder: revamp how per-CPU variables are encoded
  * btf_encoder: Discard CUs after BTF encoding
  * btf_encoder: Fix emitting __ARRAY_SIZE_TYPE__ as index range type
  * btf_encoder: Use libbpf APIs to encode BTF type info
  * btf_loader: Use libbpf to load BTF
  * dwarves: Expose and maintain active debug info loader operations
  * btf_encoder: detect BTF encoding errors and exit
  * libbpf: Update to latest libbpf version
  * dwarf_loader: Conditionally define DW_AT_alignment
  * pahole: Implement --packed
  * man-pages: Fix 'coimbine' typo
- remove libbpf-Fix-libbpf-hashmap-on-I-LP32-architectures.patch (upstream)</changelog>
  <changelog author="jengelh@inai.de" date="1603800001">- Add _service file / move to 1.18.g19 (863e6f0f)
  * btf_encoder: Ignore zero-sized ELF symbols</changelog>
  <changelog author="jengelh@inai.de" date="1606219200">- Update to release 1.19
  * Support for split BTF.
  * Support cross-compiled ELF binaries with different endianness.
  * Support for showing typedefs for anonymous types, like structs,
    unions and enums.</changelog>
  <changelog author="glin@suse.com" date="1609934400">- Drop the version requirement of libdw-devel
  + DW_AT_alignment is defined in 1.19 so dwarves now is compatible
    with older libdw.</changelog>
  <changelog author="jengelh@inai.de" date="1612526400">- Update to release 1.20
  * Addresses problems related to gcc 11 defaulting to DWARF5
    for -g.
  * Support SHN_XINDEX in st_shndx symbol indexes, to handle ELF
    objects with more than 65534 sections, for instance, which
    happens with kernels built with KCFLAGS="-ffunction-sections
  - fdata-sections", Other cases may include when using FG-ASLR,
    LTO.
  * Fix BTF variable generation for kernel modules, not skipping
    variables at offset zero.
  * Fix address size to match what is in the ELF file being
    processed, to fix using a 64-bit pahole binary to generate
    BTF for a 32-bit vmlinux image.</changelog>
  <changelog author="jengelh@inai.de" date="1618228800">- Update to release 1.21
  * Handle DWARF5 DW_OP_addrx and
    subprogram ret type with abstract_origin properly.</changelog>
  <changelog author="jengelh@inai.de" date="1619092800">- Codify build requirement on elfutils &gt;= 0.171</changelog>
  <changelog author="jslaby@suse.cz" date="1620043200">- add remove-ftrace-filter.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1622548800">- Handle zero sized per-cpu veriables in Linux BTF.
  + btf_encoder-fix-and-complete-filtering-out-zero-sized-per-CPU-variables.patch</changelog>
  <changelog author="dmueller@suse.com" date="1622635200">- use https for url (and more beautification changes from spec-cleaner)</changelog>
  <changelog author="msuchanek@suse.com" date="1626350400">- Update to version 1.21+git175.1ef87b2 (jsc#SLE-17288):
  * libbpf: bump dependency to &gt;= 0.4.0
  * CMakeLists.txt: Enable SHARED and STATIC lib creation
  * libbpf: Allow to use packaged version
  * btfdiff: Support diffing DWARF vs detached BTF
  * pahole: Allow encoding BTF into a detached file
  * pahole: Add --kabi_prefix flag
  * btf_encoder: fix and complete filtering out zero-sized per-CPU variables
  * btf: Remove ftrace filter
  * pahole: Introduce --with_flexible_array option to show just types ending in a flexible array
  * Many updates to btf_encoder and bug fixes
- Remove upstreamed patches
  - btf_encoder-fix-and-complete-filtering-out-zero-sized-per-CPU-variables.patch
  - remove-ftrace-filter.patch
- Pretend version 1.22 to make kernel happy
  + dwarves-Prep-1.22.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1626523200">- Use system libbpf when available (bsc#1188420 bsc#1188419 jsc#SLE-17288 jsc#SLE-18805).</changelog>
  <changelog author="msuchanek@suse.com" date="1628856000">- 15.4 has new elfutils, drop libebl-plugins dependency.
- Update to version 1.21+git177.1ef87b2:
  * Fix crash with split BTF debuginfo
  * CMakeList.txt: Bump version to the upcoming 1.22 release, not out of the door yet
  - Remove upstreamed patch dwarves-Prep-1.22.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1629288000">- When building with system libbpf depend also on new enough Linux headers.</changelog>
  <changelog author="jengelh@inai.de" date="1629720000">- Update to release 1.22 (bsc#1190340).
  * Ability to encode BTF to a separate file
  * Multithreaded DWARF loading
  * Details at https://marc.info/?l=dwarves&amp;m=162975403628056&amp;w=2</changelog>
</package>
<package pkgid="5db678ff93c3709257fe8e1ed7364a3d9ffcbf8ad40da4ae9b71bcf26f4f603b" name="dwarves" arch="src">
  <version epoch="0" ver="1.22" rel="150300.7.3.1"/>
  <changelog author="jengelh@inai.de" date="1584273600">- Update to release 1.17
  * Support raw BTF as available in /sys/kernel/btf/vmlinux.
  * Make --find_pointers_to consider unions.
  * Make --contains and --find_pointers_to honour --unions.
  * Add support for finding pointers to void.
  * Make --contains and --find_pointers_to to work with base types.</changelog>
  <changelog author="idonmez@suse.com" date="1589889600">- Don't require libebl-plugins on suse_version &gt;= 1550</changelog>
  <changelog author="jslaby@suse.com" date="1599048000">- add libbpf-Fix-libbpf-hashmap-on-I-LP32-architectures.patch</changelog>
  <changelog author="tdevries@suse.com" date="1600689600">- Backport fixes for segfault when processing dwz-ed kernel
  [bsc#1176095,https://github.com/acmel/dwarves/issues/10].
  * dwarves-dwarf_loader-Bail-out-at-DW_TAG_imported_unit-tags.patch
  * dwarves-dwarf_loader-Ignore-entries-in-a-DW_TAG_partial_unit-for-now.patch</changelog>
  <changelog author="jengelh@inai.de" date="1601640000">- Update to release 1.18
  * pahole now should be segfault free when handling gdb test
    suit DWARF files, including ADA, FORTRAN, rust and dwp
    compressed files (the latter is refused).
  * Bail out on partial units for now, avoiding segfaults.
- Drop
  dwarves-dwarf_loader-Ignore-entries-in-a-DW_TAG_partial_unit-for-now.patch,
  dwarves-dwarf_loader-Bail-out-at-DW_TAG_imported_unit-tags.patch
  (merged)
- Add forced ELF symvers because of ABI breaks</changelog>
  <changelog author="dmueller@suse.com" date="1603800000">- update to 1.18_15g040fd7f (bsc#1177921):
  * btf_encoder: Support cross-compiled ELF binaries with different endianness
  * strings: use BTF's string APIs for strings management
  * strings: Rename strings.h to avoid clashing with /usr/include/strings.h
  * dwarf_loader: increase the size of lookup hash map
  * btf_encoder: revamp how per-CPU variables are encoded
  * btf_encoder: Discard CUs after BTF encoding
  * btf_encoder: Fix emitting __ARRAY_SIZE_TYPE__ as index range type
  * btf_encoder: Use libbpf APIs to encode BTF type info
  * btf_loader: Use libbpf to load BTF
  * dwarves: Expose and maintain active debug info loader operations
  * btf_encoder: detect BTF encoding errors and exit
  * libbpf: Update to latest libbpf version
  * dwarf_loader: Conditionally define DW_AT_alignment
  * pahole: Implement --packed
  * man-pages: Fix 'coimbine' typo
- remove libbpf-Fix-libbpf-hashmap-on-I-LP32-architectures.patch (upstream)</changelog>
  <changelog author="jengelh@inai.de" date="1603800001">- Add _service file / move to 1.18.g19 (863e6f0f)
  * btf_encoder: Ignore zero-sized ELF symbols</changelog>
  <changelog author="jengelh@inai.de" date="1606219200">- Update to release 1.19
  * Support for split BTF.
  * Support cross-compiled ELF binaries with different endianness.
  * Support for showing typedefs for anonymous types, like structs,
    unions and enums.</changelog>
  <changelog author="glin@suse.com" date="1609934400">- Drop the version requirement of libdw-devel
  + DW_AT_alignment is defined in 1.19 so dwarves now is compatible
    with older libdw.</changelog>
  <changelog author="jengelh@inai.de" date="1612526400">- Update to release 1.20
  * Addresses problems related to gcc 11 defaulting to DWARF5
    for -g.
  * Support SHN_XINDEX in st_shndx symbol indexes, to handle ELF
    objects with more than 65534 sections, for instance, which
    happens with kernels built with KCFLAGS="-ffunction-sections
  - fdata-sections", Other cases may include when using FG-ASLR,
    LTO.
  * Fix BTF variable generation for kernel modules, not skipping
    variables at offset zero.
  * Fix address size to match what is in the ELF file being
    processed, to fix using a 64-bit pahole binary to generate
    BTF for a 32-bit vmlinux image.</changelog>
  <changelog author="jengelh@inai.de" date="1618228800">- Update to release 1.21
  * Handle DWARF5 DW_OP_addrx and
    subprogram ret type with abstract_origin properly.</changelog>
  <changelog author="jengelh@inai.de" date="1619092800">- Codify build requirement on elfutils &gt;= 0.171</changelog>
  <changelog author="jslaby@suse.cz" date="1620043200">- add remove-ftrace-filter.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1622548800">- Handle zero sized per-cpu veriables in Linux BTF.
  + btf_encoder-fix-and-complete-filtering-out-zero-sized-per-CPU-variables.patch</changelog>
  <changelog author="dmueller@suse.com" date="1622635200">- use https for url (and more beautification changes from spec-cleaner)</changelog>
  <changelog author="msuchanek@suse.com" date="1626350400">- Update to version 1.21+git175.1ef87b2 (jsc#SLE-17288):
  * libbpf: bump dependency to &gt;= 0.4.0
  * CMakeLists.txt: Enable SHARED and STATIC lib creation
  * libbpf: Allow to use packaged version
  * btfdiff: Support diffing DWARF vs detached BTF
  * pahole: Allow encoding BTF into a detached file
  * pahole: Add --kabi_prefix flag
  * btf_encoder: fix and complete filtering out zero-sized per-CPU variables
  * btf: Remove ftrace filter
  * pahole: Introduce --with_flexible_array option to show just types ending in a flexible array
  * Many updates to btf_encoder and bug fixes
- Remove upstreamed patches
  - btf_encoder-fix-and-complete-filtering-out-zero-sized-per-CPU-variables.patch
  - remove-ftrace-filter.patch
- Pretend version 1.22 to make kernel happy
  + dwarves-Prep-1.22.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1626523200">- Use system libbpf when available (bsc#1188420 bsc#1188419 jsc#SLE-17288 jsc#SLE-18805).</changelog>
  <changelog author="msuchanek@suse.com" date="1628856000">- 15.4 has new elfutils, drop libebl-plugins dependency.
- Update to version 1.21+git177.1ef87b2:
  * Fix crash with split BTF debuginfo
  * CMakeList.txt: Bump version to the upcoming 1.22 release, not out of the door yet
  - Remove upstreamed patch dwarves-Prep-1.22.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1629288000">- When building with system libbpf depend also on new enough Linux headers.</changelog>
  <changelog author="jengelh@inai.de" date="1629720000">- Update to release 1.22 (bsc#1190340).
  * Ability to encode BTF to a separate file
  * Multithreaded DWARF loading
  * Details at https://marc.info/?l=dwarves&amp;m=162975403628056&amp;w=2</changelog>
</package>
<package pkgid="9c6e03f62459f08e7a40d1f94358a4d2c88431f705a7320b4c1c5c1dfaa01954" name="dwarves" arch="x86_64">
  <version epoch="0" ver="1.22" rel="150300.7.3.1"/>
  <changelog author="jengelh@inai.de" date="1584273600">- Update to release 1.17
  * Support raw BTF as available in /sys/kernel/btf/vmlinux.
  * Make --find_pointers_to consider unions.
  * Make --contains and --find_pointers_to honour --unions.
  * Add support for finding pointers to void.
  * Make --contains and --find_pointers_to to work with base types.</changelog>
  <changelog author="idonmez@suse.com" date="1589889600">- Don't require libebl-plugins on suse_version &gt;= 1550</changelog>
  <changelog author="jslaby@suse.com" date="1599048000">- add libbpf-Fix-libbpf-hashmap-on-I-LP32-architectures.patch</changelog>
  <changelog author="tdevries@suse.com" date="1600689600">- Backport fixes for segfault when processing dwz-ed kernel
  [bsc#1176095,https://github.com/acmel/dwarves/issues/10].
  * dwarves-dwarf_loader-Bail-out-at-DW_TAG_imported_unit-tags.patch
  * dwarves-dwarf_loader-Ignore-entries-in-a-DW_TAG_partial_unit-for-now.patch</changelog>
  <changelog author="jengelh@inai.de" date="1601640000">- Update to release 1.18
  * pahole now should be segfault free when handling gdb test
    suit DWARF files, including ADA, FORTRAN, rust and dwp
    compressed files (the latter is refused).
  * Bail out on partial units for now, avoiding segfaults.
- Drop
  dwarves-dwarf_loader-Ignore-entries-in-a-DW_TAG_partial_unit-for-now.patch,
  dwarves-dwarf_loader-Bail-out-at-DW_TAG_imported_unit-tags.patch
  (merged)
- Add forced ELF symvers because of ABI breaks</changelog>
  <changelog author="dmueller@suse.com" date="1603800000">- update to 1.18_15g040fd7f (bsc#1177921):
  * btf_encoder: Support cross-compiled ELF binaries with different endianness
  * strings: use BTF's string APIs for strings management
  * strings: Rename strings.h to avoid clashing with /usr/include/strings.h
  * dwarf_loader: increase the size of lookup hash map
  * btf_encoder: revamp how per-CPU variables are encoded
  * btf_encoder: Discard CUs after BTF encoding
  * btf_encoder: Fix emitting __ARRAY_SIZE_TYPE__ as index range type
  * btf_encoder: Use libbpf APIs to encode BTF type info
  * btf_loader: Use libbpf to load BTF
  * dwarves: Expose and maintain active debug info loader operations
  * btf_encoder: detect BTF encoding errors and exit
  * libbpf: Update to latest libbpf version
  * dwarf_loader: Conditionally define DW_AT_alignment
  * pahole: Implement --packed
  * man-pages: Fix 'coimbine' typo
- remove libbpf-Fix-libbpf-hashmap-on-I-LP32-architectures.patch (upstream)</changelog>
  <changelog author="jengelh@inai.de" date="1603800001">- Add _service file / move to 1.18.g19 (863e6f0f)
  * btf_encoder: Ignore zero-sized ELF symbols</changelog>
  <changelog author="jengelh@inai.de" date="1606219200">- Update to release 1.19
  * Support for split BTF.
  * Support cross-compiled ELF binaries with different endianness.
  * Support for showing typedefs for anonymous types, like structs,
    unions and enums.</changelog>
  <changelog author="glin@suse.com" date="1609934400">- Drop the version requirement of libdw-devel
  + DW_AT_alignment is defined in 1.19 so dwarves now is compatible
    with older libdw.</changelog>
  <changelog author="jengelh@inai.de" date="1612526400">- Update to release 1.20
  * Addresses problems related to gcc 11 defaulting to DWARF5
    for -g.
  * Support SHN_XINDEX in st_shndx symbol indexes, to handle ELF
    objects with more than 65534 sections, for instance, which
    happens with kernels built with KCFLAGS="-ffunction-sections
  - fdata-sections", Other cases may include when using FG-ASLR,
    LTO.
  * Fix BTF variable generation for kernel modules, not skipping
    variables at offset zero.
  * Fix address size to match what is in the ELF file being
    processed, to fix using a 64-bit pahole binary to generate
    BTF for a 32-bit vmlinux image.</changelog>
  <changelog author="jengelh@inai.de" date="1618228800">- Update to release 1.21
  * Handle DWARF5 DW_OP_addrx and
    subprogram ret type with abstract_origin properly.</changelog>
  <changelog author="jengelh@inai.de" date="1619092800">- Codify build requirement on elfutils &gt;= 0.171</changelog>
  <changelog author="jslaby@suse.cz" date="1620043200">- add remove-ftrace-filter.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1622548800">- Handle zero sized per-cpu veriables in Linux BTF.
  + btf_encoder-fix-and-complete-filtering-out-zero-sized-per-CPU-variables.patch</changelog>
  <changelog author="dmueller@suse.com" date="1622635200">- use https for url (and more beautification changes from spec-cleaner)</changelog>
  <changelog author="msuchanek@suse.com" date="1626350400">- Update to version 1.21+git175.1ef87b2 (jsc#SLE-17288):
  * libbpf: bump dependency to &gt;= 0.4.0
  * CMakeLists.txt: Enable SHARED and STATIC lib creation
  * libbpf: Allow to use packaged version
  * btfdiff: Support diffing DWARF vs detached BTF
  * pahole: Allow encoding BTF into a detached file
  * pahole: Add --kabi_prefix flag
  * btf_encoder: fix and complete filtering out zero-sized per-CPU variables
  * btf: Remove ftrace filter
  * pahole: Introduce --with_flexible_array option to show just types ending in a flexible array
  * Many updates to btf_encoder and bug fixes
- Remove upstreamed patches
  - btf_encoder-fix-and-complete-filtering-out-zero-sized-per-CPU-variables.patch
  - remove-ftrace-filter.patch
- Pretend version 1.22 to make kernel happy
  + dwarves-Prep-1.22.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1626523200">- Use system libbpf when available (bsc#1188420 bsc#1188419 jsc#SLE-17288 jsc#SLE-18805).</changelog>
  <changelog author="msuchanek@suse.com" date="1628856000">- 15.4 has new elfutils, drop libebl-plugins dependency.
- Update to version 1.21+git177.1ef87b2:
  * Fix crash with split BTF debuginfo
  * CMakeList.txt: Bump version to the upcoming 1.22 release, not out of the door yet
  - Remove upstreamed patch dwarves-Prep-1.22.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1629288000">- When building with system libbpf depend also on new enough Linux headers.</changelog>
  <changelog author="jengelh@inai.de" date="1629720000">- Update to release 1.22 (bsc#1190340).
  * Ability to encode BTF to a separate file
  * Multithreaded DWARF loading
  * Details at https://marc.info/?l=dwarves&amp;m=162975403628056&amp;w=2</changelog>
</package>
<package pkgid="043b64f2ddd56b2af8f4f4dfe96fb5b3f18e8462998c5923247f4db287f42e7c" name="elfutils" arch="aarch64">
  <version epoch="0" ver="0.177" rel="150300.11.3.1"/>
  <changelog author="normand@linux.vnet.ibm.com" date="1456574400">- rename dt-ppc-opt.patch as elfutils-0.164-dt-ppc-opt.patch
  and add reference to upstream commit id</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1460808000">-  add elfutils-0.164-gcc6.patch</changelog>
  <changelog author="fcrozat@suse.com" date="1467028800">- Update to version 0.166:
  + config: The default program prefix for the installed tools is now
  eu-. Use configure --program-prefix="" to not use a program
  prefix.
  + Various bugfixes.
- Drop elfutils-0.164-dt-ppc-opt.patch and
  elfutils-0.164-gcc6.patch (merged upstream)
- Add patch elfutils-0.166-elfcmp-comp-gcc6.patch: fix
  self-comparison error with GCC 6.
- Changes from 0.165:
  + Add eu-elfcompress
  + Add pkg-config files for libelf and libdw.</changelog>
  <changelog author="schwab@suse.de" date="1468238400">- disable-tests-with-ptrace.patch: disable tests that use ptrace when
  running under qemu-linux-user</changelog>
  <changelog author="matz@suse.com" date="1472558400">- Update to version 0.167:
  libasm: Add eBPF disassembler for EM_BPF files.
  backends: Add m68k and BPF backends.
  ld: Removed.
  dwelf: Add ELF/DWARF string table creation functions. dwelf_strtab_init,
    dwelf_strtab_add, dwelf_strtab_add_len, dwelf_strtab_finalize,
    dwelf_strent_off, dwelf_strent_str and dwelf_strtab_free.
  Support compressed sections from binutils 2.27.
- Remove patch elfutils-0.166-elfcmp-comp-gcc6.patch: included upstream.</changelog>
  <changelog author="mliska@suse.cz" date="1481284800">- Add 0001-Add-GCC7-Wimplicit-fallthrough-support-fixes.patch: fix
  new warning introduced in GCC 7.
- Add 0001-ar-Fix-GCC7-Wformat-length-issues.patch: fix -Wformat-length
  warning introduced in GCC 7.</changelog>
  <changelog author="rguenther@suse.com" date="1490875200">- Update to version 0.168:
  libelf: gelf_newehdr and gelf_newehdr now return void *.
  libdw: dwarf.h corrected the DW_LANG_PLI constant name (was DW_LANG_PL1).
  readelf: Add optional --symbols[=SECTION] argument to select section name.
- Includes changes from 0001-Add-GCC7-Wimplicit-fallthrough-support-fixes.patch
  and 0001-ar-Fix-GCC7-Wformat-length-issues.patch.
- Remove elfutils-0.137-dwarf-header-check-fix.diff which is no longer
  required after a debugedit fix.</changelog>
  <changelog author="bwiedemann@suse.com" date="1490961600">- make tests pass when user does not want debuginfo (boo#1031556)</changelog>
  <changelog author="jengelh@inai.de" date="1491566400">- Add missing ldconfig calls for libasm1</changelog>
  <changelog author="mliska@suse.cz" date="1493121600">- Add 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch:
  fix .gnu.attributes checking on ppc64{,le}.</changelog>
  <changelog author="mliska@suse.cz" date="1493294400">- Add 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch
  unconditionally in the spec file. As we can't support binary diff,
  a newly added test-case is removed from the patch.</changelog>
  <changelog author="jengelh@inai.de" date="1495972800">- Update Git-Clone URL</changelog>
  <changelog author="schwab@linux-m68k.org" date="1497787200">- ppc-machine-flags.patch: support EM_PPC machine flags
- disable-tests-with-ptrace.patch: disable more tests</changelog>
  <changelog author="jengelh@inai.de" date="1501588800">- Update package descriptions.
- Rename libebl1 to libebl-plugins as these are not linked,
  but dlopened using their unversioned libebl_$ARCH.so name.
- Have libelf1 require libebl-plugins (libebl.a, which does the
  dlopen call, is staticly built into libelf1). This is necessary
  for pahole to display its results. [boo#1049871]</changelog>
  <changelog author="jengelh@inai.de" date="1503748800">- Restore obsolete on libebl.</changelog>
  <changelog author="jmoreira@suse.com" date="1537876800">- CVE-2017-7613: elfutils: denial of service (memory consumption)
  via a crafted ELF file (bnc#1033090)
  Add patch:
  elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
- CVE-2017-7612: elfutils: denial of service (heap-based buffer
  over-read and application crash) via a crafted ELF file
  (bnc#1033089)
  Add patch: elfutils-dont-trust-sh_entsize.patch</changelog>
  <changelog author="jmoreira@suse.com" date="1558526400">- CVE-2018-16402: libelf: denial of service/double free on an
  attempt to decompress the same section twice (bnc#1107066)
  Add patch:
  libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
- CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the
  function arlib_add_symbols() used by eu-ranlib (bnc#1112723)
  Add patch:
  arlib-check-that-sh_entsize-isnt-zero.patch
- CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and
  application crash) via a crafted ELF file (bnc#1033088)
  Add patch:
  elflint-check-symbol-table-data-is-big-enough-before-check.patch
- CVE-2017-7610: elflint: heap-based buffer overflow in check_group
  (bnc#1033087)
  Add patch:
  elflint-dont-check-section-group-without-flags-word.patch
- CVE-2018-16403: heap buffer overflow in readelf (bnc#1107067)
  Add patch:
  libdw-check-end-of-attributes-list-consistently.patch
- CVE-2018-16062: heap-buffer-overflow in
  /elfutils/libdw/dwarf_getaranges.c:156 (bnc#1106390)
  Add patch:
  libdw-readelf-make-sure-there-is-enough-data-to-read.patch
- CVE-2018-18310: Invalid Address Read problem in
  dwfl_segment_report_module.c (bnc#1111973)
  Add patch:
  libdwfl-sanity-check-partial-core-file-data-reads.patch
- CVE-2019-7150: dwfl_segment_report_module doesn't check whether
  the dyn data read from core file is truncated (bnc#1123685)
  Add patch:
  libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
- CVE-2019-7665: NT_PLATFORM core file note should be a zero
  terminated string (CVE is a bit misleading, as this is not a bug
  in libelf as described) (bnc#1125007)
  Add patch:
  libebl-check-NT_PLATFORM-core-notes.patch
- CVE-2017-7609: memory allocation failure in __libelf_decompress
  (bnc#1033086)
  Add patch:
  libelf-check-compression-before-allocate-output-buffer.patch
- CVE-2018-16402: Double-free crash in nm and readelf (bnc#1107066)
  Add patch:
  libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
- CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi
  (readelf.c) (bnc#1033084)
  Add patch:
  readelf-fix-off-by-one-sanity-check.patch
- CVE-2018-18520: eu-size: Bad handling of ar files inside are
  files (bnc#1112726)
  Add patch:
  size-handle-recursive-elf-ar-files.patch
- CVE-2017-7608: heap-based buffer overflow in
  ebl_object_note_type_name (eblobjnotetypename.c) (bnc#1033085)
  Add patch:
  use-the-empty-string-for-note-names-with-zero-size.patch</changelog>
  <changelog author="schwab@suse.de" date="1573732800">- disable-tests-with-ptrace.patch: Remove, set XFAIL_TESTS instead
- dwelf_elf_e_machine_string.patch: Avoid spurious failure</changelog>
  <changelog author="jeffm@suse.com" date="1657108800">- Update to version 0.177 (Martin Li?ka):
    elfclassify: New tool to analyze ELF objects.
    readelf: Print DW_AT_data_member_location as decimal offset.
    Decode DW_AT_discr_list block attributes.
    libdw: Add DW_AT_GNU_numerator, DW_AT_GNU_denominator and DW_AT_GNU_bias.
    libdwelf: Add dwelf_elf_e_machine_string.
    dwelf_elf_begin now only returns NULL when there is an error
    reading or decompressing a file. If the file is not an ELF file
    an ELF handle of type ELF_K_NONE is returned.
    backends: Add support for C-SKY.
  - Update to version 0.176
    build: Add new --enable-install-elfh option.
    Do NOT use this for system installs (it overrides glibc elf.h).
    backends: riscv improved core file and return value location support.
    Fixes CVE-2019-7146, CVE-2019-7148, CVE-2019-7149, CVE-2019-7664
  - CVE-2019-7150: dwfl_segment_report_module doesn't check whether
    the dyn data read from core file is truncated (bnc#1123685)
  - CVE-2019-7665: NT_PLATFORM core file note should be a zero
    terminated string (CVE is a bit misleading, as this is not a bug
    in libelf as described) (bnc#1125007)
  - Removed patches:
  - libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
  - libebl-check-NT_PLATFORM-core-notes.patch
  - Update to version 0.175 (Martin Li?ka):
    readelf: Handle mutliple .debug_macro sections.
    Recognize and parse GNU Property, NT_VERSION and
    GNU Build Attribute ELF Notes.
    strip: Handle SHT_GROUP correctly.
    Add strip --reloc-debug-sections-only option.
    Handle relocations against GNU compressed sections.
    libdwelf: New function dwelf_elf_begin.
    libcpu: Recognize bpf jump variants BPF_JLT, BPF_JLE, BPF_JSLT
    and BPF_JSLE.
    backends: RISCV handles ADD/SUB relocations.
    Handle SHT_X86_64_UNWIND.
  - CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the
    function arlib_add_symbols() used by eu-ranlib (bnc#1112723)
  - CVE-2018-18310: Invalid Address Read problem in
    dwfl_segment_report_module.c (bnc#1111973)
  - CVE-2018-18520: eu-size: Bad handling of ar files inside are
    files (bnc#1112726)
  - Removed patches:
  - arlib-check-that-sh_entsize-isnt-zero.patch
  - libdwfl-sanity-check-partial-core-file-data-reads.patch
  - size-handle-recursive-elf-ar-files.patch
  - Update to version 0.174 (Martin Li?ka):
    libelf, libdw and all tools now handle extended shnum and
    shstrndx correctly.
    elfcompress: Don't rewrite input file if no section data needs
    updating. Try harder to keep same file mode bits
    (suid) on rewrite.
    strip: Handle mixed (out of order) allocated/non-allocated
    sections.
    unstrip: Handle SHT_GROUP sections.
    backends: RISCV and M68K now have backend implementations to
    generate CFI based backtraces.
  - CVE-2018-16402: libelf: denial of service/double free on an
    attempt to decompress the same section twice (bnc#1107066)
    Double-free crash in nm and readelf
  - CVE-2018-16403: heap buffer overflow in readelf (bnc#1107067)
  - CVE-2018-16062: heap-buffer-overflow in
    /elfutils/libdw/dwarf_getaranges.c:156 (bnc#1106390)
    Removed patches:
    libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
    libdw-check-end-of-attributes-list-consistently.patch
    libdw-readelf-make-sure-there-is-enough-data-to-read.patch
  - Update to version 0.173 (Martin Li?ka):
    More fixes for crashes and hangs found by afl-fuzz. In particular various
    functions now detect and break infinite loops caused by bad DIE tree cycles.
    readelf: Will now lookup the size and signedness of constant value types
    to display them correctly (and not just how they were encoded).
    libdw: New function dwarf_next_lines to read CU-less .debug_line data.
    dwarf_begin_elf now accepts ELF files containing just .debug_line
    or .debug_frame sections (which can be read without needing a DIE
    tree from the .debug_info section).
    Removed dwarf_getscn_info, which was never implemented.
    backends: Handle BPF simple relocations.
    The RISCV backends now handles ABI specific CFI and knows about
    RISCV register types and names.
  - Update to version 0.172 (Martin Li?ka):
    No functional changes compared to 0.171.
    Various bug fixes in libdw and eu-readelf dealing with bad DWARF5 data.
    Thanks to running the afl fuzzer on eu-readelf and various testcases.
  - Update to version 0.171 (Martin Li?ka):
    DWARF5 and split dwarf, including GNU DebugFission, are supported now.
    Data can be read from the new DWARF sections .debug_addr, .debug_line_str,
    .debug_loclists, .debug_str_offsets and .debug_rnglists.  Plus the new
    DWARF5 and GNU DebugFission encodings of the existing .debug sections.
    Also in split DWARF .dwo (DWARF object) files.  This support is mostly
    handled by existing functions (dwarf_getlocation*, dwarf_getsrclines,
    dwarf_ranges, dwarf_form*, etc.) now returning the data from the new
    sections and data formats.  But some new functions have been added
    to more easily get information about skeleton and split compile units
    (dwarf_get_units and dwarf_cu_info), handle new attribute data
    (dwarf_getabbrevattr_data) and to keep references to Dwarf_Dies
    that might come from different sections or files (dwarf_die_addr_die).
    Not yet supported are .dwp (Dwarf Package) and .sup (Dwarf Supplementary)
    files, the .debug_names index, the .debug_cu_index and .debug_tu_index
    sections. Only a single .debug_info (and .debug_types) section are
    currently handled.
    readelf: Handle all new DWARF5 sections.
  - -debug-dump=info+ will show split unit DIEs when found.
  - -dwarf-skeleton can be used when inspecting a .dwo file.
    Recognizes GNU locviews with --debug-dump=loc.
    libdw: New functions dwarf_die_addr_die, dwarf_get_units,
    dwarf_getabbrevattr_data and dwarf_cu_info.
    libdw will now try to resolve the alt file on first use of
    an alt attribute FORM when not set yet with dwarf_set_alt.
    dwarf_aggregate_size() now works with multi-dimensional arrays.
    libdwfl: Use process_vm_readv when available instead of ptrace.
    backends: Add a RISC-V backend.
    There were various improvements to build on Windows.
    The sha1 and md5 implementations have been removed, they weren't used.
  - Update to version 0.170 (Martin Li?ka):
    libdw: Added new DWARF5 attribute, tag, character encoding, language code,
    calling convention, defaulted member function and macro constants
    to dwarf.h.
  New functions dwarf_default_lower_bound and dwarf_line_file.
  dwarf_peel_type now handles DWARF5 immutable, packed and shared tags.
  dwarf_getmacros now handles DWARF5 .debug_macro sections.
    strip: Add -R, --remove-section=SECTION and --keep-section=SECTION.
    backends: The bpf disassembler is now always build on all platforms.
  - Includes changes in 0.169
    backends: Add support for EM_PPC64 GNU_ATTRIBUTES.
    Frame pointer unwinding fallback support for i386, x86_64, aarch64.
    translations: Update Polish translation.
  - CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and
    application crash) via a crafted ELF file (bnc#1033088)
  - CVE-2017-7610: elflint: heap-based buffer overflow in check_group
    (bnc#1033087)
  - CVE-2017-7609: memory allocation failure in __libelf_decompress
    (bnc#1033086)
  - CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi
    (readelf.c) (bnc#1033084)
  - CVE-2017-7608: heap-based buffer overflow in
    ebl_object_note_type_name (eblobjnotetypename.c) (bnc#1033085)
  - CVE-2017-7613: elfutils: denial of service (memory consumption)
    via a crafted ELF file (bnc#1033090)
  - CVE-2017-7612: elfutils: denial of service (heap-based buffer
    over-read and application crash) via a crafted ELF file (bnc#1033089)
  - Removed patches:
  - obsolete 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch
  - ppc-machine-flags.patch
  - elflint-check-symbol-table-data-is-big-enough-before-check.patch
  - elflint-dont-check-section-group-without-flags-word.patch
  - libelf-check-compression-before-allocate-output-buffer.patch
  - readelf-fix-off-by-one-sanity-check.patch
  - use-the-empty-string-for-note-names-with-zero-size.patch
  - elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
  - elfutils-dont-trust-sh_entsize.patch
- Packaging cleanups:
  - Modernize specfile and metadata. (Jan Engelhardt)
  - Use %make_build (Martin Li?ka)
  - Update License tag to GPL-3.0-or-later, as requested by legal
    review. (Dominique Leuenberger)
  - Don't make elfutils recommend elfutils-lang as elfutils-lang
    already supplements elfutils. (Antoine Belvire)
  - Fix typo in the recommends name bsc#1104264 (Tomas Chvatal)
  - Use %license (boo#1082318) (Fabian Vogt)
- Test fixes (Andreas Schwab):
  - disable-tests-with-ptrace.patch: Remove, set XFAIL_TESTS instead
  - dwelf_elf_e_machine_string.patch: Avoid spurious failure</changelog>
  <changelog author="jeffm@suse.com" date="1657627200">- Added 4G memory build constraint for aarch64 to pass testing.</changelog>
</package>
<package pkgid="bee29b3563d6c7d81856ad625a45cc0c4079b26eae00061eca472e9fb1dd9973" name="elfutils" arch="src">
  <version epoch="0" ver="0.177" rel="150300.11.3.1"/>
  <changelog author="normand@linux.vnet.ibm.com" date="1456574400">- rename dt-ppc-opt.patch as elfutils-0.164-dt-ppc-opt.patch
  and add reference to upstream commit id</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1460808000">-  add elfutils-0.164-gcc6.patch</changelog>
  <changelog author="fcrozat@suse.com" date="1467028800">- Update to version 0.166:
  + config: The default program prefix for the installed tools is now
  eu-. Use configure --program-prefix="" to not use a program
  prefix.
  + Various bugfixes.
- Drop elfutils-0.164-dt-ppc-opt.patch and
  elfutils-0.164-gcc6.patch (merged upstream)
- Add patch elfutils-0.166-elfcmp-comp-gcc6.patch: fix
  self-comparison error with GCC 6.
- Changes from 0.165:
  + Add eu-elfcompress
  + Add pkg-config files for libelf and libdw.</changelog>
  <changelog author="schwab@suse.de" date="1468238400">- disable-tests-with-ptrace.patch: disable tests that use ptrace when
  running under qemu-linux-user</changelog>
  <changelog author="matz@suse.com" date="1472558400">- Update to version 0.167:
  libasm: Add eBPF disassembler for EM_BPF files.
  backends: Add m68k and BPF backends.
  ld: Removed.
  dwelf: Add ELF/DWARF string table creation functions. dwelf_strtab_init,
    dwelf_strtab_add, dwelf_strtab_add_len, dwelf_strtab_finalize,
    dwelf_strent_off, dwelf_strent_str and dwelf_strtab_free.
  Support compressed sections from binutils 2.27.
- Remove patch elfutils-0.166-elfcmp-comp-gcc6.patch: included upstream.</changelog>
  <changelog author="mliska@suse.cz" date="1481284800">- Add 0001-Add-GCC7-Wimplicit-fallthrough-support-fixes.patch: fix
  new warning introduced in GCC 7.
- Add 0001-ar-Fix-GCC7-Wformat-length-issues.patch: fix -Wformat-length
  warning introduced in GCC 7.</changelog>
  <changelog author="rguenther@suse.com" date="1490875200">- Update to version 0.168:
  libelf: gelf_newehdr and gelf_newehdr now return void *.
  libdw: dwarf.h corrected the DW_LANG_PLI constant name (was DW_LANG_PL1).
  readelf: Add optional --symbols[=SECTION] argument to select section name.
- Includes changes from 0001-Add-GCC7-Wimplicit-fallthrough-support-fixes.patch
  and 0001-ar-Fix-GCC7-Wformat-length-issues.patch.
- Remove elfutils-0.137-dwarf-header-check-fix.diff which is no longer
  required after a debugedit fix.</changelog>
  <changelog author="bwiedemann@suse.com" date="1490961600">- make tests pass when user does not want debuginfo (boo#1031556)</changelog>
  <changelog author="jengelh@inai.de" date="1491566400">- Add missing ldconfig calls for libasm1</changelog>
  <changelog author="mliska@suse.cz" date="1493121600">- Add 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch:
  fix .gnu.attributes checking on ppc64{,le}.</changelog>
  <changelog author="mliska@suse.cz" date="1493294400">- Add 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch
  unconditionally in the spec file. As we can't support binary diff,
  a newly added test-case is removed from the patch.</changelog>
  <changelog author="jengelh@inai.de" date="1495972800">- Update Git-Clone URL</changelog>
  <changelog author="schwab@linux-m68k.org" date="1497787200">- ppc-machine-flags.patch: support EM_PPC machine flags
- disable-tests-with-ptrace.patch: disable more tests</changelog>
  <changelog author="jengelh@inai.de" date="1501588800">- Update package descriptions.
- Rename libebl1 to libebl-plugins as these are not linked,
  but dlopened using their unversioned libebl_$ARCH.so name.
- Have libelf1 require libebl-plugins (libebl.a, which does the
  dlopen call, is staticly built into libelf1). This is necessary
  for pahole to display its results. [boo#1049871]</changelog>
  <changelog author="jengelh@inai.de" date="1503748800">- Restore obsolete on libebl.</changelog>
  <changelog author="jmoreira@suse.com" date="1537876800">- CVE-2017-7613: elfutils: denial of service (memory consumption)
  via a crafted ELF file (bnc#1033090)
  Add patch:
  elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
- CVE-2017-7612: elfutils: denial of service (heap-based buffer
  over-read and application crash) via a crafted ELF file
  (bnc#1033089)
  Add patch: elfutils-dont-trust-sh_entsize.patch</changelog>
  <changelog author="jmoreira@suse.com" date="1558526400">- CVE-2018-16402: libelf: denial of service/double free on an
  attempt to decompress the same section twice (bnc#1107066)
  Add patch:
  libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
- CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the
  function arlib_add_symbols() used by eu-ranlib (bnc#1112723)
  Add patch:
  arlib-check-that-sh_entsize-isnt-zero.patch
- CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and
  application crash) via a crafted ELF file (bnc#1033088)
  Add patch:
  elflint-check-symbol-table-data-is-big-enough-before-check.patch
- CVE-2017-7610: elflint: heap-based buffer overflow in check_group
  (bnc#1033087)
  Add patch:
  elflint-dont-check-section-group-without-flags-word.patch
- CVE-2018-16403: heap buffer overflow in readelf (bnc#1107067)
  Add patch:
  libdw-check-end-of-attributes-list-consistently.patch
- CVE-2018-16062: heap-buffer-overflow in
  /elfutils/libdw/dwarf_getaranges.c:156 (bnc#1106390)
  Add patch:
  libdw-readelf-make-sure-there-is-enough-data-to-read.patch
- CVE-2018-18310: Invalid Address Read problem in
  dwfl_segment_report_module.c (bnc#1111973)
  Add patch:
  libdwfl-sanity-check-partial-core-file-data-reads.patch
- CVE-2019-7150: dwfl_segment_report_module doesn't check whether
  the dyn data read from core file is truncated (bnc#1123685)
  Add patch:
  libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
- CVE-2019-7665: NT_PLATFORM core file note should be a zero
  terminated string (CVE is a bit misleading, as this is not a bug
  in libelf as described) (bnc#1125007)
  Add patch:
  libebl-check-NT_PLATFORM-core-notes.patch
- CVE-2017-7609: memory allocation failure in __libelf_decompress
  (bnc#1033086)
  Add patch:
  libelf-check-compression-before-allocate-output-buffer.patch
- CVE-2018-16402: Double-free crash in nm and readelf (bnc#1107066)
  Add patch:
  libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
- CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi
  (readelf.c) (bnc#1033084)
  Add patch:
  readelf-fix-off-by-one-sanity-check.patch
- CVE-2018-18520: eu-size: Bad handling of ar files inside are
  files (bnc#1112726)
  Add patch:
  size-handle-recursive-elf-ar-files.patch
- CVE-2017-7608: heap-based buffer overflow in
  ebl_object_note_type_name (eblobjnotetypename.c) (bnc#1033085)
  Add patch:
  use-the-empty-string-for-note-names-with-zero-size.patch</changelog>
  <changelog author="schwab@suse.de" date="1573732800">- disable-tests-with-ptrace.patch: Remove, set XFAIL_TESTS instead
- dwelf_elf_e_machine_string.patch: Avoid spurious failure</changelog>
  <changelog author="jeffm@suse.com" date="1657108800">- Update to version 0.177 (Martin Li?ka):
    elfclassify: New tool to analyze ELF objects.
    readelf: Print DW_AT_data_member_location as decimal offset.
    Decode DW_AT_discr_list block attributes.
    libdw: Add DW_AT_GNU_numerator, DW_AT_GNU_denominator and DW_AT_GNU_bias.
    libdwelf: Add dwelf_elf_e_machine_string.
    dwelf_elf_begin now only returns NULL when there is an error
    reading or decompressing a file. If the file is not an ELF file
    an ELF handle of type ELF_K_NONE is returned.
    backends: Add support for C-SKY.
  - Update to version 0.176
    build: Add new --enable-install-elfh option.
    Do NOT use this for system installs (it overrides glibc elf.h).
    backends: riscv improved core file and return value location support.
    Fixes CVE-2019-7146, CVE-2019-7148, CVE-2019-7149, CVE-2019-7664
  - CVE-2019-7150: dwfl_segment_report_module doesn't check whether
    the dyn data read from core file is truncated (bnc#1123685)
  - CVE-2019-7665: NT_PLATFORM core file note should be a zero
    terminated string (CVE is a bit misleading, as this is not a bug
    in libelf as described) (bnc#1125007)
  - Removed patches:
  - libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
  - libebl-check-NT_PLATFORM-core-notes.patch
  - Update to version 0.175 (Martin Li?ka):
    readelf: Handle mutliple .debug_macro sections.
    Recognize and parse GNU Property, NT_VERSION and
    GNU Build Attribute ELF Notes.
    strip: Handle SHT_GROUP correctly.
    Add strip --reloc-debug-sections-only option.
    Handle relocations against GNU compressed sections.
    libdwelf: New function dwelf_elf_begin.
    libcpu: Recognize bpf jump variants BPF_JLT, BPF_JLE, BPF_JSLT
    and BPF_JSLE.
    backends: RISCV handles ADD/SUB relocations.
    Handle SHT_X86_64_UNWIND.
  - CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the
    function arlib_add_symbols() used by eu-ranlib (bnc#1112723)
  - CVE-2018-18310: Invalid Address Read problem in
    dwfl_segment_report_module.c (bnc#1111973)
  - CVE-2018-18520: eu-size: Bad handling of ar files inside are
    files (bnc#1112726)
  - Removed patches:
  - arlib-check-that-sh_entsize-isnt-zero.patch
  - libdwfl-sanity-check-partial-core-file-data-reads.patch
  - size-handle-recursive-elf-ar-files.patch
  - Update to version 0.174 (Martin Li?ka):
    libelf, libdw and all tools now handle extended shnum and
    shstrndx correctly.
    elfcompress: Don't rewrite input file if no section data needs
    updating. Try harder to keep same file mode bits
    (suid) on rewrite.
    strip: Handle mixed (out of order) allocated/non-allocated
    sections.
    unstrip: Handle SHT_GROUP sections.
    backends: RISCV and M68K now have backend implementations to
    generate CFI based backtraces.
  - CVE-2018-16402: libelf: denial of service/double free on an
    attempt to decompress the same section twice (bnc#1107066)
    Double-free crash in nm and readelf
  - CVE-2018-16403: heap buffer overflow in readelf (bnc#1107067)
  - CVE-2018-16062: heap-buffer-overflow in
    /elfutils/libdw/dwarf_getaranges.c:156 (bnc#1106390)
    Removed patches:
    libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
    libdw-check-end-of-attributes-list-consistently.patch
    libdw-readelf-make-sure-there-is-enough-data-to-read.patch
  - Update to version 0.173 (Martin Li?ka):
    More fixes for crashes and hangs found by afl-fuzz. In particular various
    functions now detect and break infinite loops caused by bad DIE tree cycles.
    readelf: Will now lookup the size and signedness of constant value types
    to display them correctly (and not just how they were encoded).
    libdw: New function dwarf_next_lines to read CU-less .debug_line data.
    dwarf_begin_elf now accepts ELF files containing just .debug_line
    or .debug_frame sections (which can be read without needing a DIE
    tree from the .debug_info section).
    Removed dwarf_getscn_info, which was never implemented.
    backends: Handle BPF simple relocations.
    The RISCV backends now handles ABI specific CFI and knows about
    RISCV register types and names.
  - Update to version 0.172 (Martin Li?ka):
    No functional changes compared to 0.171.
    Various bug fixes in libdw and eu-readelf dealing with bad DWARF5 data.
    Thanks to running the afl fuzzer on eu-readelf and various testcases.
  - Update to version 0.171 (Martin Li?ka):
    DWARF5 and split dwarf, including GNU DebugFission, are supported now.
    Data can be read from the new DWARF sections .debug_addr, .debug_line_str,
    .debug_loclists, .debug_str_offsets and .debug_rnglists.  Plus the new
    DWARF5 and GNU DebugFission encodings of the existing .debug sections.
    Also in split DWARF .dwo (DWARF object) files.  This support is mostly
    handled by existing functions (dwarf_getlocation*, dwarf_getsrclines,
    dwarf_ranges, dwarf_form*, etc.) now returning the data from the new
    sections and data formats.  But some new functions have been added
    to more easily get information about skeleton and split compile units
    (dwarf_get_units and dwarf_cu_info), handle new attribute data
    (dwarf_getabbrevattr_data) and to keep references to Dwarf_Dies
    that might come from different sections or files (dwarf_die_addr_die).
    Not yet supported are .dwp (Dwarf Package) and .sup (Dwarf Supplementary)
    files, the .debug_names index, the .debug_cu_index and .debug_tu_index
    sections. Only a single .debug_info (and .debug_types) section are
    currently handled.
    readelf: Handle all new DWARF5 sections.
  - -debug-dump=info+ will show split unit DIEs when found.
  - -dwarf-skeleton can be used when inspecting a .dwo file.
    Recognizes GNU locviews with --debug-dump=loc.
    libdw: New functions dwarf_die_addr_die, dwarf_get_units,
    dwarf_getabbrevattr_data and dwarf_cu_info.
    libdw will now try to resolve the alt file on first use of
    an alt attribute FORM when not set yet with dwarf_set_alt.
    dwarf_aggregate_size() now works with multi-dimensional arrays.
    libdwfl: Use process_vm_readv when available instead of ptrace.
    backends: Add a RISC-V backend.
    There were various improvements to build on Windows.
    The sha1 and md5 implementations have been removed, they weren't used.
  - Update to version 0.170 (Martin Li?ka):
    libdw: Added new DWARF5 attribute, tag, character encoding, language code,
    calling convention, defaulted member function and macro constants
    to dwarf.h.
  New functions dwarf_default_lower_bound and dwarf_line_file.
  dwarf_peel_type now handles DWARF5 immutable, packed and shared tags.
  dwarf_getmacros now handles DWARF5 .debug_macro sections.
    strip: Add -R, --remove-section=SECTION and --keep-section=SECTION.
    backends: The bpf disassembler is now always build on all platforms.
  - Includes changes in 0.169
    backends: Add support for EM_PPC64 GNU_ATTRIBUTES.
    Frame pointer unwinding fallback support for i386, x86_64, aarch64.
    translations: Update Polish translation.
  - CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and
    application crash) via a crafted ELF file (bnc#1033088)
  - CVE-2017-7610: elflint: heap-based buffer overflow in check_group
    (bnc#1033087)
  - CVE-2017-7609: memory allocation failure in __libelf_decompress
    (bnc#1033086)
  - CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi
    (readelf.c) (bnc#1033084)
  - CVE-2017-7608: heap-based buffer overflow in
    ebl_object_note_type_name (eblobjnotetypename.c) (bnc#1033085)
  - CVE-2017-7613: elfutils: denial of service (memory consumption)
    via a crafted ELF file (bnc#1033090)
  - CVE-2017-7612: elfutils: denial of service (heap-based buffer
    over-read and application crash) via a crafted ELF file (bnc#1033089)
  - Removed patches:
  - obsolete 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch
  - ppc-machine-flags.patch
  - elflint-check-symbol-table-data-is-big-enough-before-check.patch
  - elflint-dont-check-section-group-without-flags-word.patch
  - libelf-check-compression-before-allocate-output-buffer.patch
  - readelf-fix-off-by-one-sanity-check.patch
  - use-the-empty-string-for-note-names-with-zero-size.patch
  - elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
  - elfutils-dont-trust-sh_entsize.patch
- Packaging cleanups:
  - Modernize specfile and metadata. (Jan Engelhardt)
  - Use %make_build (Martin Li?ka)
  - Update License tag to GPL-3.0-or-later, as requested by legal
    review. (Dominique Leuenberger)
  - Don't make elfutils recommend elfutils-lang as elfutils-lang
    already supplements elfutils. (Antoine Belvire)
  - Fix typo in the recommends name bsc#1104264 (Tomas Chvatal)
  - Use %license (boo#1082318) (Fabian Vogt)
- Test fixes (Andreas Schwab):
  - disable-tests-with-ptrace.patch: Remove, set XFAIL_TESTS instead
  - dwelf_elf_e_machine_string.patch: Avoid spurious failure</changelog>
  <changelog author="jeffm@suse.com" date="1657627200">- Added 4G memory build constraint for aarch64 to pass testing.</changelog>
</package>
<package pkgid="7ec5a70242c9c157d1225288e92ce6089f5807bb093664337f0a78c858005a1f" name="elfutils" arch="x86_64">
  <version epoch="0" ver="0.177" rel="150300.11.3.1"/>
  <changelog author="normand@linux.vnet.ibm.com" date="1456574400">- rename dt-ppc-opt.patch as elfutils-0.164-dt-ppc-opt.patch
  and add reference to upstream commit id</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1460808000">-  add elfutils-0.164-gcc6.patch</changelog>
  <changelog author="fcrozat@suse.com" date="1467028800">- Update to version 0.166:
  + config: The default program prefix for the installed tools is now
  eu-. Use configure --program-prefix="" to not use a program
  prefix.
  + Various bugfixes.
- Drop elfutils-0.164-dt-ppc-opt.patch and
  elfutils-0.164-gcc6.patch (merged upstream)
- Add patch elfutils-0.166-elfcmp-comp-gcc6.patch: fix
  self-comparison error with GCC 6.
- Changes from 0.165:
  + Add eu-elfcompress
  + Add pkg-config files for libelf and libdw.</changelog>
  <changelog author="schwab@suse.de" date="1468238400">- disable-tests-with-ptrace.patch: disable tests that use ptrace when
  running under qemu-linux-user</changelog>
  <changelog author="matz@suse.com" date="1472558400">- Update to version 0.167:
  libasm: Add eBPF disassembler for EM_BPF files.
  backends: Add m68k and BPF backends.
  ld: Removed.
  dwelf: Add ELF/DWARF string table creation functions. dwelf_strtab_init,
    dwelf_strtab_add, dwelf_strtab_add_len, dwelf_strtab_finalize,
    dwelf_strent_off, dwelf_strent_str and dwelf_strtab_free.
  Support compressed sections from binutils 2.27.
- Remove patch elfutils-0.166-elfcmp-comp-gcc6.patch: included upstream.</changelog>
  <changelog author="mliska@suse.cz" date="1481284800">- Add 0001-Add-GCC7-Wimplicit-fallthrough-support-fixes.patch: fix
  new warning introduced in GCC 7.
- Add 0001-ar-Fix-GCC7-Wformat-length-issues.patch: fix -Wformat-length
  warning introduced in GCC 7.</changelog>
  <changelog author="rguenther@suse.com" date="1490875200">- Update to version 0.168:
  libelf: gelf_newehdr and gelf_newehdr now return void *.
  libdw: dwarf.h corrected the DW_LANG_PLI constant name (was DW_LANG_PL1).
  readelf: Add optional --symbols[=SECTION] argument to select section name.
- Includes changes from 0001-Add-GCC7-Wimplicit-fallthrough-support-fixes.patch
  and 0001-ar-Fix-GCC7-Wformat-length-issues.patch.
- Remove elfutils-0.137-dwarf-header-check-fix.diff which is no longer
  required after a debugedit fix.</changelog>
  <changelog author="bwiedemann@suse.com" date="1490961600">- make tests pass when user does not want debuginfo (boo#1031556)</changelog>
  <changelog author="jengelh@inai.de" date="1491566400">- Add missing ldconfig calls for libasm1</changelog>
  <changelog author="mliska@suse.cz" date="1493121600">- Add 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch:
  fix .gnu.attributes checking on ppc64{,le}.</changelog>
  <changelog author="mliska@suse.cz" date="1493294400">- Add 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch
  unconditionally in the spec file. As we can't support binary diff,
  a newly added test-case is removed from the patch.</changelog>
  <changelog author="jengelh@inai.de" date="1495972800">- Update Git-Clone URL</changelog>
  <changelog author="schwab@linux-m68k.org" date="1497787200">- ppc-machine-flags.patch: support EM_PPC machine flags
- disable-tests-with-ptrace.patch: disable more tests</changelog>
  <changelog author="jengelh@inai.de" date="1501588800">- Update package descriptions.
- Rename libebl1 to libebl-plugins as these are not linked,
  but dlopened using their unversioned libebl_$ARCH.so name.
- Have libelf1 require libebl-plugins (libebl.a, which does the
  dlopen call, is staticly built into libelf1). This is necessary
  for pahole to display its results. [boo#1049871]</changelog>
  <changelog author="jengelh@inai.de" date="1503748800">- Restore obsolete on libebl.</changelog>
  <changelog author="jmoreira@suse.com" date="1537876800">- CVE-2017-7613: elfutils: denial of service (memory consumption)
  via a crafted ELF file (bnc#1033090)
  Add patch:
  elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
- CVE-2017-7612: elfutils: denial of service (heap-based buffer
  over-read and application crash) via a crafted ELF file
  (bnc#1033089)
  Add patch: elfutils-dont-trust-sh_entsize.patch</changelog>
  <changelog author="jmoreira@suse.com" date="1558526400">- CVE-2018-16402: libelf: denial of service/double free on an
  attempt to decompress the same section twice (bnc#1107066)
  Add patch:
  libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
- CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the
  function arlib_add_symbols() used by eu-ranlib (bnc#1112723)
  Add patch:
  arlib-check-that-sh_entsize-isnt-zero.patch
- CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and
  application crash) via a crafted ELF file (bnc#1033088)
  Add patch:
  elflint-check-symbol-table-data-is-big-enough-before-check.patch
- CVE-2017-7610: elflint: heap-based buffer overflow in check_group
  (bnc#1033087)
  Add patch:
  elflint-dont-check-section-group-without-flags-word.patch
- CVE-2018-16403: heap buffer overflow in readelf (bnc#1107067)
  Add patch:
  libdw-check-end-of-attributes-list-consistently.patch
- CVE-2018-16062: heap-buffer-overflow in
  /elfutils/libdw/dwarf_getaranges.c:156 (bnc#1106390)
  Add patch:
  libdw-readelf-make-sure-there-is-enough-data-to-read.patch
- CVE-2018-18310: Invalid Address Read problem in
  dwfl_segment_report_module.c (bnc#1111973)
  Add patch:
  libdwfl-sanity-check-partial-core-file-data-reads.patch
- CVE-2019-7150: dwfl_segment_report_module doesn't check whether
  the dyn data read from core file is truncated (bnc#1123685)
  Add patch:
  libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
- CVE-2019-7665: NT_PLATFORM core file note should be a zero
  terminated string (CVE is a bit misleading, as this is not a bug
  in libelf as described) (bnc#1125007)
  Add patch:
  libebl-check-NT_PLATFORM-core-notes.patch
- CVE-2017-7609: memory allocation failure in __libelf_decompress
  (bnc#1033086)
  Add patch:
  libelf-check-compression-before-allocate-output-buffer.patch
- CVE-2018-16402: Double-free crash in nm and readelf (bnc#1107066)
  Add patch:
  libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
- CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi
  (readelf.c) (bnc#1033084)
  Add patch:
  readelf-fix-off-by-one-sanity-check.patch
- CVE-2018-18520: eu-size: Bad handling of ar files inside are
  files (bnc#1112726)
  Add patch:
  size-handle-recursive-elf-ar-files.patch
- CVE-2017-7608: heap-based buffer overflow in
  ebl_object_note_type_name (eblobjnotetypename.c) (bnc#1033085)
  Add patch:
  use-the-empty-string-for-note-names-with-zero-size.patch</changelog>
  <changelog author="schwab@suse.de" date="1573732800">- disable-tests-with-ptrace.patch: Remove, set XFAIL_TESTS instead
- dwelf_elf_e_machine_string.patch: Avoid spurious failure</changelog>
  <changelog author="jeffm@suse.com" date="1657108800">- Update to version 0.177 (Martin Li?ka):
    elfclassify: New tool to analyze ELF objects.
    readelf: Print DW_AT_data_member_location as decimal offset.
    Decode DW_AT_discr_list block attributes.
    libdw: Add DW_AT_GNU_numerator, DW_AT_GNU_denominator and DW_AT_GNU_bias.
    libdwelf: Add dwelf_elf_e_machine_string.
    dwelf_elf_begin now only returns NULL when there is an error
    reading or decompressing a file. If the file is not an ELF file
    an ELF handle of type ELF_K_NONE is returned.
    backends: Add support for C-SKY.
  - Update to version 0.176
    build: Add new --enable-install-elfh option.
    Do NOT use this for system installs (it overrides glibc elf.h).
    backends: riscv improved core file and return value location support.
    Fixes CVE-2019-7146, CVE-2019-7148, CVE-2019-7149, CVE-2019-7664
  - CVE-2019-7150: dwfl_segment_report_module doesn't check whether
    the dyn data read from core file is truncated (bnc#1123685)
  - CVE-2019-7665: NT_PLATFORM core file note should be a zero
    terminated string (CVE is a bit misleading, as this is not a bug
    in libelf as described) (bnc#1125007)
  - Removed patches:
  - libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
  - libebl-check-NT_PLATFORM-core-notes.patch
  - Update to version 0.175 (Martin Li?ka):
    readelf: Handle mutliple .debug_macro sections.
    Recognize and parse GNU Property, NT_VERSION and
    GNU Build Attribute ELF Notes.
    strip: Handle SHT_GROUP correctly.
    Add strip --reloc-debug-sections-only option.
    Handle relocations against GNU compressed sections.
    libdwelf: New function dwelf_elf_begin.
    libcpu: Recognize bpf jump variants BPF_JLT, BPF_JLE, BPF_JSLT
    and BPF_JSLE.
    backends: RISCV handles ADD/SUB relocations.
    Handle SHT_X86_64_UNWIND.
  - CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the
    function arlib_add_symbols() used by eu-ranlib (bnc#1112723)
  - CVE-2018-18310: Invalid Address Read problem in
    dwfl_segment_report_module.c (bnc#1111973)
  - CVE-2018-18520: eu-size: Bad handling of ar files inside are
    files (bnc#1112726)
  - Removed patches:
  - arlib-check-that-sh_entsize-isnt-zero.patch
  - libdwfl-sanity-check-partial-core-file-data-reads.patch
  - size-handle-recursive-elf-ar-files.patch
  - Update to version 0.174 (Martin Li?ka):
    libelf, libdw and all tools now handle extended shnum and
    shstrndx correctly.
    elfcompress: Don't rewrite input file if no section data needs
    updating. Try harder to keep same file mode bits
    (suid) on rewrite.
    strip: Handle mixed (out of order) allocated/non-allocated
    sections.
    unstrip: Handle SHT_GROUP sections.
    backends: RISCV and M68K now have backend implementations to
    generate CFI based backtraces.
  - CVE-2018-16402: libelf: denial of service/double free on an
    attempt to decompress the same section twice (bnc#1107066)
    Double-free crash in nm and readelf
  - CVE-2018-16403: heap buffer overflow in readelf (bnc#1107067)
  - CVE-2018-16062: heap-buffer-overflow in
    /elfutils/libdw/dwarf_getaranges.c:156 (bnc#1106390)
    Removed patches:
    libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
    libdw-check-end-of-attributes-list-consistently.patch
    libdw-readelf-make-sure-there-is-enough-data-to-read.patch
  - Update to version 0.173 (Martin Li?ka):
    More fixes for crashes and hangs found by afl-fuzz. In particular various
    functions now detect and break infinite loops caused by bad DIE tree cycles.
    readelf: Will now lookup the size and signedness of constant value types
    to display them correctly (and not just how they were encoded).
    libdw: New function dwarf_next_lines to read CU-less .debug_line data.
    dwarf_begin_elf now accepts ELF files containing just .debug_line
    or .debug_frame sections (which can be read without needing a DIE
    tree from the .debug_info section).
    Removed dwarf_getscn_info, which was never implemented.
    backends: Handle BPF simple relocations.
    The RISCV backends now handles ABI specific CFI and knows about
    RISCV register types and names.
  - Update to version 0.172 (Martin Li?ka):
    No functional changes compared to 0.171.
    Various bug fixes in libdw and eu-readelf dealing with bad DWARF5 data.
    Thanks to running the afl fuzzer on eu-readelf and various testcases.
  - Update to version 0.171 (Martin Li?ka):
    DWARF5 and split dwarf, including GNU DebugFission, are supported now.
    Data can be read from the new DWARF sections .debug_addr, .debug_line_str,
    .debug_loclists, .debug_str_offsets and .debug_rnglists.  Plus the new
    DWARF5 and GNU DebugFission encodings of the existing .debug sections.
    Also in split DWARF .dwo (DWARF object) files.  This support is mostly
    handled by existing functions (dwarf_getlocation*, dwarf_getsrclines,
    dwarf_ranges, dwarf_form*, etc.) now returning the data from the new
    sections and data formats.  But some new functions have been added
    to more easily get information about skeleton and split compile units
    (dwarf_get_units and dwarf_cu_info), handle new attribute data
    (dwarf_getabbrevattr_data) and to keep references to Dwarf_Dies
    that might come from different sections or files (dwarf_die_addr_die).
    Not yet supported are .dwp (Dwarf Package) and .sup (Dwarf Supplementary)
    files, the .debug_names index, the .debug_cu_index and .debug_tu_index
    sections. Only a single .debug_info (and .debug_types) section are
    currently handled.
    readelf: Handle all new DWARF5 sections.
  - -debug-dump=info+ will show split unit DIEs when found.
  - -dwarf-skeleton can be used when inspecting a .dwo file.
    Recognizes GNU locviews with --debug-dump=loc.
    libdw: New functions dwarf_die_addr_die, dwarf_get_units,
    dwarf_getabbrevattr_data and dwarf_cu_info.
    libdw will now try to resolve the alt file on first use of
    an alt attribute FORM when not set yet with dwarf_set_alt.
    dwarf_aggregate_size() now works with multi-dimensional arrays.
    libdwfl: Use process_vm_readv when available instead of ptrace.
    backends: Add a RISC-V backend.
    There were various improvements to build on Windows.
    The sha1 and md5 implementations have been removed, they weren't used.
  - Update to version 0.170 (Martin Li?ka):
    libdw: Added new DWARF5 attribute, tag, character encoding, language code,
    calling convention, defaulted member function and macro constants
    to dwarf.h.
  New functions dwarf_default_lower_bound and dwarf_line_file.
  dwarf_peel_type now handles DWARF5 immutable, packed and shared tags.
  dwarf_getmacros now handles DWARF5 .debug_macro sections.
    strip: Add -R, --remove-section=SECTION and --keep-section=SECTION.
    backends: The bpf disassembler is now always build on all platforms.
  - Includes changes in 0.169
    backends: Add support for EM_PPC64 GNU_ATTRIBUTES.
    Frame pointer unwinding fallback support for i386, x86_64, aarch64.
    translations: Update Polish translation.
  - CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and
    application crash) via a crafted ELF file (bnc#1033088)
  - CVE-2017-7610: elflint: heap-based buffer overflow in check_group
    (bnc#1033087)
  - CVE-2017-7609: memory allocation failure in __libelf_decompress
    (bnc#1033086)
  - CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi
    (readelf.c) (bnc#1033084)
  - CVE-2017-7608: heap-based buffer overflow in
    ebl_object_note_type_name (eblobjnotetypename.c) (bnc#1033085)
  - CVE-2017-7613: elfutils: denial of service (memory consumption)
    via a crafted ELF file (bnc#1033090)
  - CVE-2017-7612: elfutils: denial of service (heap-based buffer
    over-read and application crash) via a crafted ELF file (bnc#1033089)
  - Removed patches:
  - obsolete 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch
  - ppc-machine-flags.patch
  - elflint-check-symbol-table-data-is-big-enough-before-check.patch
  - elflint-dont-check-section-group-without-flags-word.patch
  - libelf-check-compression-before-allocate-output-buffer.patch
  - readelf-fix-off-by-one-sanity-check.patch
  - use-the-empty-string-for-note-names-with-zero-size.patch
  - elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
  - elfutils-dont-trust-sh_entsize.patch
- Packaging cleanups:
  - Modernize specfile and metadata. (Jan Engelhardt)
  - Use %make_build (Martin Li?ka)
  - Update License tag to GPL-3.0-or-later, as requested by legal
    review. (Dominique Leuenberger)
  - Don't make elfutils recommend elfutils-lang as elfutils-lang
    already supplements elfutils. (Antoine Belvire)
  - Fix typo in the recommends name bsc#1104264 (Tomas Chvatal)
  - Use %license (boo#1082318) (Fabian Vogt)
- Test fixes (Andreas Schwab):
  - disable-tests-with-ptrace.patch: Remove, set XFAIL_TESTS instead
  - dwelf_elf_e_machine_string.patch: Avoid spurious failure</changelog>
  <changelog author="jeffm@suse.com" date="1657627200">- Added 4G memory build constraint for aarch64 to pass testing.</changelog>
</package>
<package pkgid="794998108c1889046d81224b9f68adc4465a39d4586910d2c795b00924c18c36" name="glibc" arch="aarch64">
  <version epoch="0" ver="2.31" rel="150300.31.2"/>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
  <changelog author="matz@suse.com" date="1650888000">- Add s390-add-z16-name.diff for bsc#1198751.</changelog>
  <changelog author="schwab@suse.de" date="1652702400">- selinux-deprecated.patch: Disable warnings due to deprecated libselinux
  symbols used by nss and nscd (bsc#1197718)
- systemtap-altmacro.patch: i386: Remove broken CAN_USE_REGISTER_ASM_EBP
  (bsc#1197718, BZ #28771)</changelog>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
</package>
<package pkgid="580c72c60506fbca92eb4e44364d3fe026c7bdcff3d7d928736645f8653014c9" name="glibc" arch="src">
  <version epoch="0" ver="2.31" rel="150300.31.2"/>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
  <changelog author="matz@suse.com" date="1650888000">- Add s390-add-z16-name.diff for bsc#1198751.</changelog>
  <changelog author="schwab@suse.de" date="1652702400">- selinux-deprecated.patch: Disable warnings due to deprecated libselinux
  symbols used by nss and nscd (bsc#1197718)
- systemtap-altmacro.patch: i386: Remove broken CAN_USE_REGISTER_ASM_EBP
  (bsc#1197718, BZ #28771)</changelog>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
</package>
<package pkgid="c6d01675fd675d9b5de8afbafc8a8cae445aaa834ab313dd662b104d02d625ba" name="glibc" arch="x86_64">
  <version epoch="0" ver="2.31" rel="150300.31.2"/>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
  <changelog author="matz@suse.com" date="1650888000">- Add s390-add-z16-name.diff for bsc#1198751.</changelog>
  <changelog author="schwab@suse.de" date="1652702400">- selinux-deprecated.patch: Disable warnings due to deprecated libselinux
  symbols used by nss and nscd (bsc#1197718)
- systemtap-altmacro.patch: i386: Remove broken CAN_USE_REGISTER_ASM_EBP
  (bsc#1197718, BZ #28771)</changelog>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
</package>
<package pkgid="994d27f41087ff158ca7caf1dbe41c7ee76b7c4ed1636585a9f4019bfb3d746f" name="glibc" arch="aarch64">
  <version epoch="0" ver="2.31" rel="150300.37.1"/>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
  <changelog author="matz@suse.com" date="1650888000">- Add s390-add-z16-name.diff for bsc#1198751.</changelog>
  <changelog author="schwab@suse.de" date="1652702400">- selinux-deprecated.patch: Disable warnings due to deprecated libselinux
  symbols used by nss and nscd (bsc#1197718)
- systemtap-altmacro.patch: i386: Remove broken CAN_USE_REGISTER_ASM_EBP
  (bsc#1197718, BZ #28771)</changelog>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
  <changelog author="schwab@suse.de" date="1658232000">- static-tls-surplus.patch: Remove tunables (bsc#1201560)</changelog>
  <changelog author="schwab@suse.de" date="1658318400">- disable-check-consistency.patch: i386: Disable check_consistency for GCC
  5 and above (bsc#1201640, BZ #25788)</changelog>
</package>
<package pkgid="27c92147aa7c0eac6e4ef9802c9bdf8e5308dd451337716b031558a3bc4f5b59" name="glibc" arch="src">
  <version epoch="0" ver="2.31" rel="150300.37.1"/>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
  <changelog author="matz@suse.com" date="1650888000">- Add s390-add-z16-name.diff for bsc#1198751.</changelog>
  <changelog author="schwab@suse.de" date="1652702400">- selinux-deprecated.patch: Disable warnings due to deprecated libselinux
  symbols used by nss and nscd (bsc#1197718)
- systemtap-altmacro.patch: i386: Remove broken CAN_USE_REGISTER_ASM_EBP
  (bsc#1197718, BZ #28771)</changelog>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
  <changelog author="schwab@suse.de" date="1658232000">- static-tls-surplus.patch: Remove tunables (bsc#1201560)</changelog>
  <changelog author="schwab@suse.de" date="1658318400">- disable-check-consistency.patch: i386: Disable check_consistency for GCC
  5 and above (bsc#1201640, BZ #25788)</changelog>
</package>
<package pkgid="fddf74776c64fa4097dd7df0a481b60f113c8aefb49d25373269eb2ba2e9736d" name="glibc" arch="x86_64">
  <version epoch="0" ver="2.31" rel="150300.37.1"/>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
  <changelog author="matz@suse.com" date="1650888000">- Add s390-add-z16-name.diff for bsc#1198751.</changelog>
  <changelog author="schwab@suse.de" date="1652702400">- selinux-deprecated.patch: Disable warnings due to deprecated libselinux
  symbols used by nss and nscd (bsc#1197718)
- systemtap-altmacro.patch: i386: Remove broken CAN_USE_REGISTER_ASM_EBP
  (bsc#1197718, BZ #28771)</changelog>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
  <changelog author="schwab@suse.de" date="1658232000">- static-tls-surplus.patch: Remove tunables (bsc#1201560)</changelog>
  <changelog author="schwab@suse.de" date="1658318400">- disable-check-consistency.patch: i386: Disable check_consistency for GCC
  5 and above (bsc#1201640, BZ #25788)</changelog>
</package>
<package pkgid="e97531bae9dd8fc5cb6dbe4eea76bc7b709b21f7388ed5f60518833abf0e5e6d" name="glibc-locale" arch="aarch64">
  <version epoch="0" ver="2.31" rel="150300.31.2"/>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
  <changelog author="matz@suse.com" date="1650888000">- Add s390-add-z16-name.diff for bsc#1198751.</changelog>
  <changelog author="schwab@suse.de" date="1652702400">- selinux-deprecated.patch: Disable warnings due to deprecated libselinux
  symbols used by nss and nscd (bsc#1197718)
- systemtap-altmacro.patch: i386: Remove broken CAN_USE_REGISTER_ASM_EBP
  (bsc#1197718, BZ #28771)</changelog>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
</package>
<package pkgid="dba03abcf9940a9b7e14f60b45865b4e28c16e2d54b269062dca5236ea294470" name="glibc-locale" arch="x86_64">
  <version epoch="0" ver="2.31" rel="150300.31.2"/>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
  <changelog author="matz@suse.com" date="1650888000">- Add s390-add-z16-name.diff for bsc#1198751.</changelog>
  <changelog author="schwab@suse.de" date="1652702400">- selinux-deprecated.patch: Disable warnings due to deprecated libselinux
  symbols used by nss and nscd (bsc#1197718)
- systemtap-altmacro.patch: i386: Remove broken CAN_USE_REGISTER_ASM_EBP
  (bsc#1197718, BZ #28771)</changelog>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
</package>
<package pkgid="7b5a52ac647c5f3ee086debf80262ef3385f1e1028670498fbb926d7f858e574" name="glibc-locale" arch="aarch64">
  <version epoch="0" ver="2.31" rel="150300.37.1"/>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
  <changelog author="matz@suse.com" date="1650888000">- Add s390-add-z16-name.diff for bsc#1198751.</changelog>
  <changelog author="schwab@suse.de" date="1652702400">- selinux-deprecated.patch: Disable warnings due to deprecated libselinux
  symbols used by nss and nscd (bsc#1197718)
- systemtap-altmacro.patch: i386: Remove broken CAN_USE_REGISTER_ASM_EBP
  (bsc#1197718, BZ #28771)</changelog>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
  <changelog author="schwab@suse.de" date="1658232000">- static-tls-surplus.patch: Remove tunables (bsc#1201560)</changelog>
  <changelog author="schwab@suse.de" date="1658318400">- disable-check-consistency.patch: i386: Disable check_consistency for GCC
  5 and above (bsc#1201640, BZ #25788)</changelog>
</package>
<package pkgid="9dc0243baffdea4a252f59598a208858cd5b5856ca7681f073e70706c0d56f37" name="glibc-locale" arch="x86_64">
  <version epoch="0" ver="2.31" rel="150300.37.1"/>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
  <changelog author="matz@suse.com" date="1650888000">- Add s390-add-z16-name.diff for bsc#1198751.</changelog>
  <changelog author="schwab@suse.de" date="1652702400">- selinux-deprecated.patch: Disable warnings due to deprecated libselinux
  symbols used by nss and nscd (bsc#1197718)
- systemtap-altmacro.patch: i386: Remove broken CAN_USE_REGISTER_ASM_EBP
  (bsc#1197718, BZ #28771)</changelog>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
  <changelog author="schwab@suse.de" date="1658232000">- static-tls-surplus.patch: Remove tunables (bsc#1201560)</changelog>
  <changelog author="schwab@suse.de" date="1658318400">- disable-check-consistency.patch: i386: Disable check_consistency for GCC
  5 and above (bsc#1201640, BZ #25788)</changelog>
</package>
<package pkgid="6cdbcfae3db1edb1e75ccad1effe13f3035dbc5a553e1a0983ef2f22f90b5560" name="glibc-locale-base" arch="aarch64">
  <version epoch="0" ver="2.31" rel="150300.31.2"/>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
  <changelog author="matz@suse.com" date="1650888000">- Add s390-add-z16-name.diff for bsc#1198751.</changelog>
  <changelog author="schwab@suse.de" date="1652702400">- selinux-deprecated.patch: Disable warnings due to deprecated libselinux
  symbols used by nss and nscd (bsc#1197718)
- systemtap-altmacro.patch: i386: Remove broken CAN_USE_REGISTER_ASM_EBP
  (bsc#1197718, BZ #28771)</changelog>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
</package>
<package pkgid="67d29014a25dce63d48d8b9ddfb83b6e200744004344129f75409e3b5c6dbfd9" name="glibc-locale-base" arch="x86_64">
  <version epoch="0" ver="2.31" rel="150300.31.2"/>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
  <changelog author="matz@suse.com" date="1650888000">- Add s390-add-z16-name.diff for bsc#1198751.</changelog>
  <changelog author="schwab@suse.de" date="1652702400">- selinux-deprecated.patch: Disable warnings due to deprecated libselinux
  symbols used by nss and nscd (bsc#1197718)
- systemtap-altmacro.patch: i386: Remove broken CAN_USE_REGISTER_ASM_EBP
  (bsc#1197718, BZ #28771)</changelog>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
</package>
<package pkgid="fc5232f229db493963d698fecf3350324b874ce1c5511f59e54a027dfe571078" name="glibc-locale-base" arch="aarch64">
  <version epoch="0" ver="2.31" rel="150300.37.1"/>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
  <changelog author="matz@suse.com" date="1650888000">- Add s390-add-z16-name.diff for bsc#1198751.</changelog>
  <changelog author="schwab@suse.de" date="1652702400">- selinux-deprecated.patch: Disable warnings due to deprecated libselinux
  symbols used by nss and nscd (bsc#1197718)
- systemtap-altmacro.patch: i386: Remove broken CAN_USE_REGISTER_ASM_EBP
  (bsc#1197718, BZ #28771)</changelog>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
  <changelog author="schwab@suse.de" date="1658232000">- static-tls-surplus.patch: Remove tunables (bsc#1201560)</changelog>
  <changelog author="schwab@suse.de" date="1658318400">- disable-check-consistency.patch: i386: Disable check_consistency for GCC
  5 and above (bsc#1201640, BZ #25788)</changelog>
</package>
<package pkgid="e13d47fd5e6a0cc73f5c469d16360b40c7c77ae560425c34c96e5fd67e8edae6" name="glibc-locale-base" arch="x86_64">
  <version epoch="0" ver="2.31" rel="150300.37.1"/>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
  <changelog author="matz@suse.com" date="1650888000">- Add s390-add-z16-name.diff for bsc#1198751.</changelog>
  <changelog author="schwab@suse.de" date="1652702400">- selinux-deprecated.patch: Disable warnings due to deprecated libselinux
  symbols used by nss and nscd (bsc#1197718)
- systemtap-altmacro.patch: i386: Remove broken CAN_USE_REGISTER_ASM_EBP
  (bsc#1197718, BZ #28771)</changelog>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
  <changelog author="schwab@suse.de" date="1658232000">- static-tls-surplus.patch: Remove tunables (bsc#1201560)</changelog>
  <changelog author="schwab@suse.de" date="1658318400">- disable-check-consistency.patch: i386: Disable check_consistency for GCC
  5 and above (bsc#1201640, BZ #25788)</changelog>
</package>
<package pkgid="3b2925399447577f2e652ef0b666fa80a75d1038b0dfd078a10a5b82901979a3" name="gpg2" arch="aarch64">
  <version epoch="0" ver="2.2.27" rel="150300.3.5.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1574856000">- Update to 2.2.18 [bsc#1157900, CVE-2019-14855]
  * gpg: Changed the way keys are detected on a smartcards; this
    allows the use of non-OpenPGP cards.  In the case of a not very
    likely regression the new option --use-only-openpgp-card is
    available.  [#4681]
  * gpg: The commands --full-gen-key and --quick-gen-key now allow
    direct key generation from supported cards.  [#4681]
  * gpg: Prepare against chosen-prefix SHA-1 collisions in key
    signatures.  This change removes all SHA-1 based key signature
    newer than 2019-01-19 from the web-of-trust.  Note that this
    includes all key signature created with dsa1024 keys.  The new
    option --allow-weak-key-signatues can be used to override the new
    and safer behaviour.  [#4755,CVE-2019-14855]
  * gpg: Improve performance for import of large keyblocks.  [#4592]
  * gpg: Implement a keybox compression run.  [#4644]
  * gpg: Show warnings from dirmngr about redirect and certificate
    problems (details require --verbose as usual).
  * gpg: Allow to pass the empty string for the passphrase if the
    '--passphase=' syntax is used.  [#4633]
  * gpg: Fix printing of the KDF object attributes.
  * gpg: Avoid surprises with --locate-external-key and certain
  - -auto-key-locate settings.  [#4662]
  * gpg: Improve selection of best matching key.  [#4713]
  * gpg: Delete key binding signature when deletring a subkey.
    [#4665,#4457]
  * gpg: Fix a potential loss of key sigantures during import with
    self-sigs-only active.  [#4628]
  * gpg: Silence "marked as ultimately trusted" diagnostics if
    option --quiet is used.  [#4634]
  * gpg: Silence some diagnostics during in key listsing even with
    option --verbose.  [#4627]
  * gpg, gpgsm: Change parsing of agent's pkdecrypt results.  [#4652]
  * gpgsm: Support AES-256 keys.
  * gpgsm: Fix a bug in triggering a keybox compression run if
  - -faked-system-time is used.
  * dirmngr: System CA certificates are no longer used for the SKS
    pool if GNUTLS instead of NTBTLS is used as TLS library.  [#4594]
  * dirmngr: On Windows detect usability of IPv4 and IPv6 interfaces
    to avoid long timeouts.  [#4165]
  * scd: Fix BWI value for APDU level transfers to make Gemalto Ezio
    Shield and Trustica Cryptoucan work.  [#4654,#4566]
  * wkd: gpg-wks-client --install-key now installs the required policy
    file.
- Rebase patches:
  * gnupg-2.2.8-files-are-digests.patch
  * gnupg-add_legacy_FIPS_mode_option.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1575720000">- update to 2.2.19:
  * gpg: Fix double free when decrypting for hidden recipients
  * gpg: Use auto-key-locate for encryption even for mail addressed
    given with angle brackets
  * gpgsm: Add special case for certain expired intermediate
    certificates</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1578571200">- Security fix: [bsc#1157900, CVE-2019-14855, jsc#SLE-16534]
  * Web of Trust forgeries using collisions in SHA-1 signatures
  * Ignore all SHA-1 signatures in 3rd party key signatures.
  * Forbid the creation of SHA-1 third-party key signatures.
  * Add option --allow-weak-key-signatures
- Add gnupg-CVE-2019-14855.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1578657600">- Accept key updates even without UIDs [bsc#1143158]
- Add patches:
  * gnupg-allow-import-of-previously-known-keys-even-without-UIDs.patch
  * gnupg-accept_subkeys_with_a_good_revocation_but_no_self-sig_during_import.patch
  * gnupg-add-test-cases-for-import-without-uid.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1582113600">- Fix build with GCC-10: [bsc#1160394]
  * Always use EXTERN_UNLESS_MAIN_MODULE pattern
  * In GCC-10, the default option -fcommon will change to -fno-common
- Add gpg2-gcc10-build-fno-common.patch</changelog>
  <changelog author="fvogt@suse.com" date="1584100800">- Split dirmngr into a subpackage to avoid a hard dependency of
  gpg2 on libgnutls</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1584705600">- GnuPG 2.2.20:
  * Protect the error counter against overflow to guarantee that the
    tools can't be tricked into returning success after an error
  * gpg: Make really sure that --verify-files always returns an error
  * gpg: Fix key listing --with-secret if a pattern is given
  * gpg: Fix detection of certain keys used as default-key
  * gpg: Fix default-key selection when a card is available
  * gpg: Fix key expiration and key usage for keys created with a
    creation date of zero
  * gpgsm: Fix import of some CR,LF terminated certificates
  * gpg: New options --include-key-block and --auto-key-import to
    allow encrypted replies after an initial signed message
  * gpg: Allow the use of a fingerprint with --trusted-key
  * gpg: New property "fpr" for use by --export-filter
  * scdaemon: Disable the pinpad if a KDF DO is used
  * dirmngr: Improve finding OCSP certificates
- drop gpg2-gcc10-build-fno-common.patch, upstream</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588248000">- Fix gpgme and gpgme-qt builds on gpg2 2.2.20 update [bsc#1170811]
- Refresh patches:
  * gnupg-2.2.8-files-are-digests.patch
  * gnupg-add_legacy_FIPS_mode_option.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1590062400">- Fix warning: agent returned different signature type ssh-rsa
  * The gpg-agent's ssh-agent does not handle flags in signing
    requests properly [bsc#1161268, bsc#1172308]
  * Add gnupg-gpg-agent-ssh-agent.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1594296000">- GnuPG 2.2.21:
  * gpg: Improve symmetric decryption speed by about 25%
  * gpg: Support decryption of AEAD encrypted data packets
  * gpg: Add option --no-include-key-block
  * gpg: Allow for extra padding in ECDH
  * gpg: Only a single pinentry is shown for symmetric encryption if
    the pinentry supports this
  * gpg: Print a note if no keys are given to --delete-key
  * gpg,gpgsm: The ridiculous passphrase quality bar is not anymore
    shown
  * gpgsm: Certificates without a CRL distribution point are now
    considered valid without looking up a CRL. The new option
  - -enable-issuer-based-crl-check can be used to revert to the
    former behaviour
  * gpgsm: Support rsaPSS signature verification
  * gpgsm: Unless CRL checking is disabled lookup a missing issuer
    certificate using the certificate's authorityInfoAccess
  * gpgsm: Print the certificate's serial number also in decimal
    notation
  * gpgsm: Fix possible NULL-deref in messages of --gen-key
  * scd: Support the CardOS 5 based D-Trust Card 3.1
  * dirmngr: Allow http URLs with "LOOKUP --url"
  * wkd: Take name of sendmail from configure. Fixes an OpenBSD
    specific bug</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1594728000">- Fix regression in latest gpg2 that makes gpgme fail to build [bsc#1174007]
- Add gnupg-gpgme-t-encrypt-sym.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1598961600">- GnuPG 2.2.22:
  * gpg: Change the default key algorithm to rsa3072
  * gpg: Add regular expression support for Trust Signatures on
    all platforms
  * gpg: Ignore --personal-digest-prefs for ECDSA keys
  * gpgsm: Make rsaPSS a de-vs compliant scheme
  * gpgsm: Show also the SHA256 fingerprint in key listings
  * gpgsm: Do not require a default keyring for --gpgconf-list
  * gpg-agent: Default to extended key format and record the
    creation time of keys
    Add new option --disable-extended-key-format
  * gpg-agent: Support the WAYLAND_DISPLAY envvar
  * gpg-agent: Allow using --gpgconf-list even if HOME does not
    exist
  * gpg-agent: Make the Pinentry work even if the envvar TERM is
    set to the empty string
  * scdaemon: Add a workaround for Gnuk tokens &lt;= 2.15 which
    wrongly incremented the error counter when using the
    "verify" command of "gpg --edit-key" with only the signature
    key being present
  * dirmngr: Better handle systems with disabled IPv6
  * gpgpslit: Install tool.  It was not installed in the past to
    avoid conflicts with the version installed by GnuPG 1.4
  * gpgtar: Make --files-from and --null work as documented
- drop gnupg-gpgme-t-encrypt-sym.patch, upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1599048000">- Fix segv importing certain keys (e.g. ed25519). [bsc#1176034]
- Add gnupg-2.2.22-fix-segv-import-keys.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1599134400">- GnuPG 2.2.23:
  * gpg: fix AHEAD preference list overflow boo#1176034 /  CVE-2020-25125
  * gpg: fix possible segv in the key cleaning code
  * gpgsm: fix a minor RFC2253 parser gub
  * scdaemon: Fix a PIN verify failure on certain OpenPGP card
    implementations</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1605614400">- GnuPG 2.2.24:
  * gpg: New command --quick-revoke-sig
  * gpg: Do not use weak digest algos if selected by recipient
    preference during sign+encrypt
  * gpg: Switch to AES256 for symmetric encryption in de-vs mode
  * gpg: Silence weak digest warnings with --quiet
  * gpg: Print new status line CANCELED_BY_USER for a cancel during
    symmetric encryption
  * gpg: Fix the encrypt+sign hash algo preference selection for
    ECDSA.  This is in particular needed for keys created from
    existing smartcard based keys
  * agent: Fix secret key import of GnuPG 2.3 generated Ed25519
    keys
  * agent: Keep some permissions of private-keys-v1.d
  * dirmngr: Align sks-keyservers.netCA.pem use between ntbtls and
    gnutls builds
  * dirmngr: Fix the pool keyserver case for a single host in the
    pool
  * scd: Fix the use case of verify_chv2 by CHECKPIN
  * scd: Various improvements to the ccid-driver
  * scd: Minor fixes for Yubikey
  * gpgconf: New option --show-versions
  * i18n: Complete overhaul and completion of the Italian
    translation</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1606132800">- GnuPG 2.2.25:
  * scd: Fix regression in 2.2.24 requiring gpg --card-status
    before signing or decrypting
  * gpgsm: Using Libksba 1.5.0 signatures with a rarely used
    combination of attributes can now be verified</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1610452800">- GnuPG 2.2.27:
  * gpgconf: Fix case with neither local nor global gpg.conf
  * gpgconf: Fix description of two new options
- includes changes from 2.2.26:
  * gpg: New AKL method "ntds"
  * gpg: Fix --trusted-key with fingerprint arg
  * scd: Fix writing of ECC keys to an OpenPGP card
  * scd: Make an USB error fix specific to SPR532 readers
  * dirmngr: With new LDAP keyservers store the new attributes.
    Never store the useless pgpSignerID. Fix a long standing
    bug storing some keys on an ldap server.
  * dirmngr: Support the new Active Direcory LDAP schema for
    keyservers
  * dirmngr: Allow LDAP OpenPGP searches via fingerprint
  * dirmngr: Do not block other threads during keyserver LDAP calls
  * Support global configuration files
  * Fix the iconv fallback handling to UTF-8</changelog>
  <changelog author="pmonreal@suse.com" date="1613995200">- Update gpg2 for SLE15-SP3 [jsc#SLE-17559, bsc#1182572]
- Remove patches fixed upstream:
  * gnupg-gpg-agent-ssh-agent.patch
  * gnupg-2.2.22-fix-segv-import-keys.patch
  * gnupg-Allow-redirection-from-https-to-http-for-CRLs.patch
  * gnupg-CRL-fetching-via-https.patch
  * gnupg-CVE-2018-1000858.patch
  * gnupg-CVE-2018-12020.patch
  * gnupg-CVE-2019-13050_0_of_5.patch
  * gnupg-CVE-2019-13050_1_of_5.patch
  * gnupg-CVE-2019-13050_2_of_5.patch
  * gnupg-CVE-2019-13050_3_of_5.patch
  * gnupg-CVE-2019-13050_4_of_5.patch
  * gnupg-CVE-2019-13050_5_of_5.patch
  * gnupg-CVE-2019-14855.patch
- Update gpg2.keyring</changelog>
  <changelog author="meissner@suse.com" date="1654689600">- gnupg-detect_FIPS_mode.patch: use AES as default cipher instead
  of 3DES if we are in FIPS mode. (bsc#1196125)</changelog>
  <changelog author="david.anes@suse.com" date="1658145600">- Security fix [CVE-2022-34903, bsc#1201225]
  - Vulnerable to status injection
  - Added patch gnupg-CVE-2022-34903.patch</changelog>
</package>
<package pkgid="e846a7625d5483b08424630435f2a3cceb1c948f60f447c6200f58ce27ab8020" name="gpg2" arch="src">
  <version epoch="0" ver="2.2.27" rel="150300.3.5.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1574856000">- Update to 2.2.18 [bsc#1157900, CVE-2019-14855]
  * gpg: Changed the way keys are detected on a smartcards; this
    allows the use of non-OpenPGP cards.  In the case of a not very
    likely regression the new option --use-only-openpgp-card is
    available.  [#4681]
  * gpg: The commands --full-gen-key and --quick-gen-key now allow
    direct key generation from supported cards.  [#4681]
  * gpg: Prepare against chosen-prefix SHA-1 collisions in key
    signatures.  This change removes all SHA-1 based key signature
    newer than 2019-01-19 from the web-of-trust.  Note that this
    includes all key signature created with dsa1024 keys.  The new
    option --allow-weak-key-signatues can be used to override the new
    and safer behaviour.  [#4755,CVE-2019-14855]
  * gpg: Improve performance for import of large keyblocks.  [#4592]
  * gpg: Implement a keybox compression run.  [#4644]
  * gpg: Show warnings from dirmngr about redirect and certificate
    problems (details require --verbose as usual).
  * gpg: Allow to pass the empty string for the passphrase if the
    '--passphase=' syntax is used.  [#4633]
  * gpg: Fix printing of the KDF object attributes.
  * gpg: Avoid surprises with --locate-external-key and certain
  - -auto-key-locate settings.  [#4662]
  * gpg: Improve selection of best matching key.  [#4713]
  * gpg: Delete key binding signature when deletring a subkey.
    [#4665,#4457]
  * gpg: Fix a potential loss of key sigantures during import with
    self-sigs-only active.  [#4628]
  * gpg: Silence "marked as ultimately trusted" diagnostics if
    option --quiet is used.  [#4634]
  * gpg: Silence some diagnostics during in key listsing even with
    option --verbose.  [#4627]
  * gpg, gpgsm: Change parsing of agent's pkdecrypt results.  [#4652]
  * gpgsm: Support AES-256 keys.
  * gpgsm: Fix a bug in triggering a keybox compression run if
  - -faked-system-time is used.
  * dirmngr: System CA certificates are no longer used for the SKS
    pool if GNUTLS instead of NTBTLS is used as TLS library.  [#4594]
  * dirmngr: On Windows detect usability of IPv4 and IPv6 interfaces
    to avoid long timeouts.  [#4165]
  * scd: Fix BWI value for APDU level transfers to make Gemalto Ezio
    Shield and Trustica Cryptoucan work.  [#4654,#4566]
  * wkd: gpg-wks-client --install-key now installs the required policy
    file.
- Rebase patches:
  * gnupg-2.2.8-files-are-digests.patch
  * gnupg-add_legacy_FIPS_mode_option.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1575720000">- update to 2.2.19:
  * gpg: Fix double free when decrypting for hidden recipients
  * gpg: Use auto-key-locate for encryption even for mail addressed
    given with angle brackets
  * gpgsm: Add special case for certain expired intermediate
    certificates</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1578571200">- Security fix: [bsc#1157900, CVE-2019-14855, jsc#SLE-16534]
  * Web of Trust forgeries using collisions in SHA-1 signatures
  * Ignore all SHA-1 signatures in 3rd party key signatures.
  * Forbid the creation of SHA-1 third-party key signatures.
  * Add option --allow-weak-key-signatures
- Add gnupg-CVE-2019-14855.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1578657600">- Accept key updates even without UIDs [bsc#1143158]
- Add patches:
  * gnupg-allow-import-of-previously-known-keys-even-without-UIDs.patch
  * gnupg-accept_subkeys_with_a_good_revocation_but_no_self-sig_during_import.patch
  * gnupg-add-test-cases-for-import-without-uid.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1582113600">- Fix build with GCC-10: [bsc#1160394]
  * Always use EXTERN_UNLESS_MAIN_MODULE pattern
  * In GCC-10, the default option -fcommon will change to -fno-common
- Add gpg2-gcc10-build-fno-common.patch</changelog>
  <changelog author="fvogt@suse.com" date="1584100800">- Split dirmngr into a subpackage to avoid a hard dependency of
  gpg2 on libgnutls</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1584705600">- GnuPG 2.2.20:
  * Protect the error counter against overflow to guarantee that the
    tools can't be tricked into returning success after an error
  * gpg: Make really sure that --verify-files always returns an error
  * gpg: Fix key listing --with-secret if a pattern is given
  * gpg: Fix detection of certain keys used as default-key
  * gpg: Fix default-key selection when a card is available
  * gpg: Fix key expiration and key usage for keys created with a
    creation date of zero
  * gpgsm: Fix import of some CR,LF terminated certificates
  * gpg: New options --include-key-block and --auto-key-import to
    allow encrypted replies after an initial signed message
  * gpg: Allow the use of a fingerprint with --trusted-key
  * gpg: New property "fpr" for use by --export-filter
  * scdaemon: Disable the pinpad if a KDF DO is used
  * dirmngr: Improve finding OCSP certificates
- drop gpg2-gcc10-build-fno-common.patch, upstream</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588248000">- Fix gpgme and gpgme-qt builds on gpg2 2.2.20 update [bsc#1170811]
- Refresh patches:
  * gnupg-2.2.8-files-are-digests.patch
  * gnupg-add_legacy_FIPS_mode_option.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1590062400">- Fix warning: agent returned different signature type ssh-rsa
  * The gpg-agent's ssh-agent does not handle flags in signing
    requests properly [bsc#1161268, bsc#1172308]
  * Add gnupg-gpg-agent-ssh-agent.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1594296000">- GnuPG 2.2.21:
  * gpg: Improve symmetric decryption speed by about 25%
  * gpg: Support decryption of AEAD encrypted data packets
  * gpg: Add option --no-include-key-block
  * gpg: Allow for extra padding in ECDH
  * gpg: Only a single pinentry is shown for symmetric encryption if
    the pinentry supports this
  * gpg: Print a note if no keys are given to --delete-key
  * gpg,gpgsm: The ridiculous passphrase quality bar is not anymore
    shown
  * gpgsm: Certificates without a CRL distribution point are now
    considered valid without looking up a CRL. The new option
  - -enable-issuer-based-crl-check can be used to revert to the
    former behaviour
  * gpgsm: Support rsaPSS signature verification
  * gpgsm: Unless CRL checking is disabled lookup a missing issuer
    certificate using the certificate's authorityInfoAccess
  * gpgsm: Print the certificate's serial number also in decimal
    notation
  * gpgsm: Fix possible NULL-deref in messages of --gen-key
  * scd: Support the CardOS 5 based D-Trust Card 3.1
  * dirmngr: Allow http URLs with "LOOKUP --url"
  * wkd: Take name of sendmail from configure. Fixes an OpenBSD
    specific bug</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1594728000">- Fix regression in latest gpg2 that makes gpgme fail to build [bsc#1174007]
- Add gnupg-gpgme-t-encrypt-sym.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1598961600">- GnuPG 2.2.22:
  * gpg: Change the default key algorithm to rsa3072
  * gpg: Add regular expression support for Trust Signatures on
    all platforms
  * gpg: Ignore --personal-digest-prefs for ECDSA keys
  * gpgsm: Make rsaPSS a de-vs compliant scheme
  * gpgsm: Show also the SHA256 fingerprint in key listings
  * gpgsm: Do not require a default keyring for --gpgconf-list
  * gpg-agent: Default to extended key format and record the
    creation time of keys
    Add new option --disable-extended-key-format
  * gpg-agent: Support the WAYLAND_DISPLAY envvar
  * gpg-agent: Allow using --gpgconf-list even if HOME does not
    exist
  * gpg-agent: Make the Pinentry work even if the envvar TERM is
    set to the empty string
  * scdaemon: Add a workaround for Gnuk tokens &lt;= 2.15 which
    wrongly incremented the error counter when using the
    "verify" command of "gpg --edit-key" with only the signature
    key being present
  * dirmngr: Better handle systems with disabled IPv6
  * gpgpslit: Install tool.  It was not installed in the past to
    avoid conflicts with the version installed by GnuPG 1.4
  * gpgtar: Make --files-from and --null work as documented
- drop gnupg-gpgme-t-encrypt-sym.patch, upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1599048000">- Fix segv importing certain keys (e.g. ed25519). [bsc#1176034]
- Add gnupg-2.2.22-fix-segv-import-keys.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1599134400">- GnuPG 2.2.23:
  * gpg: fix AHEAD preference list overflow boo#1176034 /  CVE-2020-25125
  * gpg: fix possible segv in the key cleaning code
  * gpgsm: fix a minor RFC2253 parser gub
  * scdaemon: Fix a PIN verify failure on certain OpenPGP card
    implementations</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1605614400">- GnuPG 2.2.24:
  * gpg: New command --quick-revoke-sig
  * gpg: Do not use weak digest algos if selected by recipient
    preference during sign+encrypt
  * gpg: Switch to AES256 for symmetric encryption in de-vs mode
  * gpg: Silence weak digest warnings with --quiet
  * gpg: Print new status line CANCELED_BY_USER for a cancel during
    symmetric encryption
  * gpg: Fix the encrypt+sign hash algo preference selection for
    ECDSA.  This is in particular needed for keys created from
    existing smartcard based keys
  * agent: Fix secret key import of GnuPG 2.3 generated Ed25519
    keys
  * agent: Keep some permissions of private-keys-v1.d
  * dirmngr: Align sks-keyservers.netCA.pem use between ntbtls and
    gnutls builds
  * dirmngr: Fix the pool keyserver case for a single host in the
    pool
  * scd: Fix the use case of verify_chv2 by CHECKPIN
  * scd: Various improvements to the ccid-driver
  * scd: Minor fixes for Yubikey
  * gpgconf: New option --show-versions
  * i18n: Complete overhaul and completion of the Italian
    translation</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1606132800">- GnuPG 2.2.25:
  * scd: Fix regression in 2.2.24 requiring gpg --card-status
    before signing or decrypting
  * gpgsm: Using Libksba 1.5.0 signatures with a rarely used
    combination of attributes can now be verified</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1610452800">- GnuPG 2.2.27:
  * gpgconf: Fix case with neither local nor global gpg.conf
  * gpgconf: Fix description of two new options
- includes changes from 2.2.26:
  * gpg: New AKL method "ntds"
  * gpg: Fix --trusted-key with fingerprint arg
  * scd: Fix writing of ECC keys to an OpenPGP card
  * scd: Make an USB error fix specific to SPR532 readers
  * dirmngr: With new LDAP keyservers store the new attributes.
    Never store the useless pgpSignerID. Fix a long standing
    bug storing some keys on an ldap server.
  * dirmngr: Support the new Active Direcory LDAP schema for
    keyservers
  * dirmngr: Allow LDAP OpenPGP searches via fingerprint
  * dirmngr: Do not block other threads during keyserver LDAP calls
  * Support global configuration files
  * Fix the iconv fallback handling to UTF-8</changelog>
  <changelog author="pmonreal@suse.com" date="1613995200">- Update gpg2 for SLE15-SP3 [jsc#SLE-17559, bsc#1182572]
- Remove patches fixed upstream:
  * gnupg-gpg-agent-ssh-agent.patch
  * gnupg-2.2.22-fix-segv-import-keys.patch
  * gnupg-Allow-redirection-from-https-to-http-for-CRLs.patch
  * gnupg-CRL-fetching-via-https.patch
  * gnupg-CVE-2018-1000858.patch
  * gnupg-CVE-2018-12020.patch
  * gnupg-CVE-2019-13050_0_of_5.patch
  * gnupg-CVE-2019-13050_1_of_5.patch
  * gnupg-CVE-2019-13050_2_of_5.patch
  * gnupg-CVE-2019-13050_3_of_5.patch
  * gnupg-CVE-2019-13050_4_of_5.patch
  * gnupg-CVE-2019-13050_5_of_5.patch
  * gnupg-CVE-2019-14855.patch
- Update gpg2.keyring</changelog>
  <changelog author="meissner@suse.com" date="1654689600">- gnupg-detect_FIPS_mode.patch: use AES as default cipher instead
  of 3DES if we are in FIPS mode. (bsc#1196125)</changelog>
  <changelog author="david.anes@suse.com" date="1658145600">- Security fix [CVE-2022-34903, bsc#1201225]
  - Vulnerable to status injection
  - Added patch gnupg-CVE-2022-34903.patch</changelog>
</package>
<package pkgid="ae0837de302a651edd446f0ca4fe79e94ef7af86ff59cc029a5e0c858f41c11c" name="gpg2" arch="x86_64">
  <version epoch="0" ver="2.2.27" rel="150300.3.5.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1574856000">- Update to 2.2.18 [bsc#1157900, CVE-2019-14855]
  * gpg: Changed the way keys are detected on a smartcards; this
    allows the use of non-OpenPGP cards.  In the case of a not very
    likely regression the new option --use-only-openpgp-card is
    available.  [#4681]
  * gpg: The commands --full-gen-key and --quick-gen-key now allow
    direct key generation from supported cards.  [#4681]
  * gpg: Prepare against chosen-prefix SHA-1 collisions in key
    signatures.  This change removes all SHA-1 based key signature
    newer than 2019-01-19 from the web-of-trust.  Note that this
    includes all key signature created with dsa1024 keys.  The new
    option --allow-weak-key-signatues can be used to override the new
    and safer behaviour.  [#4755,CVE-2019-14855]
  * gpg: Improve performance for import of large keyblocks.  [#4592]
  * gpg: Implement a keybox compression run.  [#4644]
  * gpg: Show warnings from dirmngr about redirect and certificate
    problems (details require --verbose as usual).
  * gpg: Allow to pass the empty string for the passphrase if the
    '--passphase=' syntax is used.  [#4633]
  * gpg: Fix printing of the KDF object attributes.
  * gpg: Avoid surprises with --locate-external-key and certain
  - -auto-key-locate settings.  [#4662]
  * gpg: Improve selection of best matching key.  [#4713]
  * gpg: Delete key binding signature when deletring a subkey.
    [#4665,#4457]
  * gpg: Fix a potential loss of key sigantures during import with
    self-sigs-only active.  [#4628]
  * gpg: Silence "marked as ultimately trusted" diagnostics if
    option --quiet is used.  [#4634]
  * gpg: Silence some diagnostics during in key listsing even with
    option --verbose.  [#4627]
  * gpg, gpgsm: Change parsing of agent's pkdecrypt results.  [#4652]
  * gpgsm: Support AES-256 keys.
  * gpgsm: Fix a bug in triggering a keybox compression run if
  - -faked-system-time is used.
  * dirmngr: System CA certificates are no longer used for the SKS
    pool if GNUTLS instead of NTBTLS is used as TLS library.  [#4594]
  * dirmngr: On Windows detect usability of IPv4 and IPv6 interfaces
    to avoid long timeouts.  [#4165]
  * scd: Fix BWI value for APDU level transfers to make Gemalto Ezio
    Shield and Trustica Cryptoucan work.  [#4654,#4566]
  * wkd: gpg-wks-client --install-key now installs the required policy
    file.
- Rebase patches:
  * gnupg-2.2.8-files-are-digests.patch
  * gnupg-add_legacy_FIPS_mode_option.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1575720000">- update to 2.2.19:
  * gpg: Fix double free when decrypting for hidden recipients
  * gpg: Use auto-key-locate for encryption even for mail addressed
    given with angle brackets
  * gpgsm: Add special case for certain expired intermediate
    certificates</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1578571200">- Security fix: [bsc#1157900, CVE-2019-14855, jsc#SLE-16534]
  * Web of Trust forgeries using collisions in SHA-1 signatures
  * Ignore all SHA-1 signatures in 3rd party key signatures.
  * Forbid the creation of SHA-1 third-party key signatures.
  * Add option --allow-weak-key-signatures
- Add gnupg-CVE-2019-14855.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1578657600">- Accept key updates even without UIDs [bsc#1143158]
- Add patches:
  * gnupg-allow-import-of-previously-known-keys-even-without-UIDs.patch
  * gnupg-accept_subkeys_with_a_good_revocation_but_no_self-sig_during_import.patch
  * gnupg-add-test-cases-for-import-without-uid.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1582113600">- Fix build with GCC-10: [bsc#1160394]
  * Always use EXTERN_UNLESS_MAIN_MODULE pattern
  * In GCC-10, the default option -fcommon will change to -fno-common
- Add gpg2-gcc10-build-fno-common.patch</changelog>
  <changelog author="fvogt@suse.com" date="1584100800">- Split dirmngr into a subpackage to avoid a hard dependency of
  gpg2 on libgnutls</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1584705600">- GnuPG 2.2.20:
  * Protect the error counter against overflow to guarantee that the
    tools can't be tricked into returning success after an error
  * gpg: Make really sure that --verify-files always returns an error
  * gpg: Fix key listing --with-secret if a pattern is given
  * gpg: Fix detection of certain keys used as default-key
  * gpg: Fix default-key selection when a card is available
  * gpg: Fix key expiration and key usage for keys created with a
    creation date of zero
  * gpgsm: Fix import of some CR,LF terminated certificates
  * gpg: New options --include-key-block and --auto-key-import to
    allow encrypted replies after an initial signed message
  * gpg: Allow the use of a fingerprint with --trusted-key
  * gpg: New property "fpr" for use by --export-filter
  * scdaemon: Disable the pinpad if a KDF DO is used
  * dirmngr: Improve finding OCSP certificates
- drop gpg2-gcc10-build-fno-common.patch, upstream</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588248000">- Fix gpgme and gpgme-qt builds on gpg2 2.2.20 update [bsc#1170811]
- Refresh patches:
  * gnupg-2.2.8-files-are-digests.patch
  * gnupg-add_legacy_FIPS_mode_option.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1590062400">- Fix warning: agent returned different signature type ssh-rsa
  * The gpg-agent's ssh-agent does not handle flags in signing
    requests properly [bsc#1161268, bsc#1172308]
  * Add gnupg-gpg-agent-ssh-agent.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1594296000">- GnuPG 2.2.21:
  * gpg: Improve symmetric decryption speed by about 25%
  * gpg: Support decryption of AEAD encrypted data packets
  * gpg: Add option --no-include-key-block
  * gpg: Allow for extra padding in ECDH
  * gpg: Only a single pinentry is shown for symmetric encryption if
    the pinentry supports this
  * gpg: Print a note if no keys are given to --delete-key
  * gpg,gpgsm: The ridiculous passphrase quality bar is not anymore
    shown
  * gpgsm: Certificates without a CRL distribution point are now
    considered valid without looking up a CRL. The new option
  - -enable-issuer-based-crl-check can be used to revert to the
    former behaviour
  * gpgsm: Support rsaPSS signature verification
  * gpgsm: Unless CRL checking is disabled lookup a missing issuer
    certificate using the certificate's authorityInfoAccess
  * gpgsm: Print the certificate's serial number also in decimal
    notation
  * gpgsm: Fix possible NULL-deref in messages of --gen-key
  * scd: Support the CardOS 5 based D-Trust Card 3.1
  * dirmngr: Allow http URLs with "LOOKUP --url"
  * wkd: Take name of sendmail from configure. Fixes an OpenBSD
    specific bug</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1594728000">- Fix regression in latest gpg2 that makes gpgme fail to build [bsc#1174007]
- Add gnupg-gpgme-t-encrypt-sym.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1598961600">- GnuPG 2.2.22:
  * gpg: Change the default key algorithm to rsa3072
  * gpg: Add regular expression support for Trust Signatures on
    all platforms
  * gpg: Ignore --personal-digest-prefs for ECDSA keys
  * gpgsm: Make rsaPSS a de-vs compliant scheme
  * gpgsm: Show also the SHA256 fingerprint in key listings
  * gpgsm: Do not require a default keyring for --gpgconf-list
  * gpg-agent: Default to extended key format and record the
    creation time of keys
    Add new option --disable-extended-key-format
  * gpg-agent: Support the WAYLAND_DISPLAY envvar
  * gpg-agent: Allow using --gpgconf-list even if HOME does not
    exist
  * gpg-agent: Make the Pinentry work even if the envvar TERM is
    set to the empty string
  * scdaemon: Add a workaround for Gnuk tokens &lt;= 2.15 which
    wrongly incremented the error counter when using the
    "verify" command of "gpg --edit-key" with only the signature
    key being present
  * dirmngr: Better handle systems with disabled IPv6
  * gpgpslit: Install tool.  It was not installed in the past to
    avoid conflicts with the version installed by GnuPG 1.4
  * gpgtar: Make --files-from and --null work as documented
- drop gnupg-gpgme-t-encrypt-sym.patch, upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1599048000">- Fix segv importing certain keys (e.g. ed25519). [bsc#1176034]
- Add gnupg-2.2.22-fix-segv-import-keys.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1599134400">- GnuPG 2.2.23:
  * gpg: fix AHEAD preference list overflow boo#1176034 /  CVE-2020-25125
  * gpg: fix possible segv in the key cleaning code
  * gpgsm: fix a minor RFC2253 parser gub
  * scdaemon: Fix a PIN verify failure on certain OpenPGP card
    implementations</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1605614400">- GnuPG 2.2.24:
  * gpg: New command --quick-revoke-sig
  * gpg: Do not use weak digest algos if selected by recipient
    preference during sign+encrypt
  * gpg: Switch to AES256 for symmetric encryption in de-vs mode
  * gpg: Silence weak digest warnings with --quiet
  * gpg: Print new status line CANCELED_BY_USER for a cancel during
    symmetric encryption
  * gpg: Fix the encrypt+sign hash algo preference selection for
    ECDSA.  This is in particular needed for keys created from
    existing smartcard based keys
  * agent: Fix secret key import of GnuPG 2.3 generated Ed25519
    keys
  * agent: Keep some permissions of private-keys-v1.d
  * dirmngr: Align sks-keyservers.netCA.pem use between ntbtls and
    gnutls builds
  * dirmngr: Fix the pool keyserver case for a single host in the
    pool
  * scd: Fix the use case of verify_chv2 by CHECKPIN
  * scd: Various improvements to the ccid-driver
  * scd: Minor fixes for Yubikey
  * gpgconf: New option --show-versions
  * i18n: Complete overhaul and completion of the Italian
    translation</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1606132800">- GnuPG 2.2.25:
  * scd: Fix regression in 2.2.24 requiring gpg --card-status
    before signing or decrypting
  * gpgsm: Using Libksba 1.5.0 signatures with a rarely used
    combination of attributes can now be verified</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1610452800">- GnuPG 2.2.27:
  * gpgconf: Fix case with neither local nor global gpg.conf
  * gpgconf: Fix description of two new options
- includes changes from 2.2.26:
  * gpg: New AKL method "ntds"
  * gpg: Fix --trusted-key with fingerprint arg
  * scd: Fix writing of ECC keys to an OpenPGP card
  * scd: Make an USB error fix specific to SPR532 readers
  * dirmngr: With new LDAP keyservers store the new attributes.
    Never store the useless pgpSignerID. Fix a long standing
    bug storing some keys on an ldap server.
  * dirmngr: Support the new Active Direcory LDAP schema for
    keyservers
  * dirmngr: Allow LDAP OpenPGP searches via fingerprint
  * dirmngr: Do not block other threads during keyserver LDAP calls
  * Support global configuration files
  * Fix the iconv fallback handling to UTF-8</changelog>
  <changelog author="pmonreal@suse.com" date="1613995200">- Update gpg2 for SLE15-SP3 [jsc#SLE-17559, bsc#1182572]
- Remove patches fixed upstream:
  * gnupg-gpg-agent-ssh-agent.patch
  * gnupg-2.2.22-fix-segv-import-keys.patch
  * gnupg-Allow-redirection-from-https-to-http-for-CRLs.patch
  * gnupg-CRL-fetching-via-https.patch
  * gnupg-CVE-2018-1000858.patch
  * gnupg-CVE-2018-12020.patch
  * gnupg-CVE-2019-13050_0_of_5.patch
  * gnupg-CVE-2019-13050_1_of_5.patch
  * gnupg-CVE-2019-13050_2_of_5.patch
  * gnupg-CVE-2019-13050_3_of_5.patch
  * gnupg-CVE-2019-13050_4_of_5.patch
  * gnupg-CVE-2019-13050_5_of_5.patch
  * gnupg-CVE-2019-14855.patch
- Update gpg2.keyring</changelog>
  <changelog author="meissner@suse.com" date="1654689600">- gnupg-detect_FIPS_mode.patch: use AES as default cipher instead
  of 3DES if we are in FIPS mode. (bsc#1196125)</changelog>
  <changelog author="david.anes@suse.com" date="1658145600">- Security fix [CVE-2022-34903, bsc#1201225]
  - Vulnerable to status injection
  - Added patch gnupg-CVE-2022-34903.patch</changelog>
</package>
<package pkgid="9b3b58b007a8869686f76d832eb2c39523f6727bc755a63c2b8639a2af7779ff" name="harfbuzz" arch="src">
  <version epoch="0" ver="2.6.4" rel="150200.3.3.1"/>
  <changelog author="zaitor@opensuse.org" date="1512907200">- Update to version 1.7.2:
  + Optimize hb_set_add_range().
  + Misc fixes.
  + New API: hb_coretext_font_create().</changelog>
  <changelog author="zaitor@opensuse.org" date="1513771200">- Update to version 1.7.4:
  + Fix collect_glyphs() regression caused by hb_set_t changes.
- Changes from version 1.7.3:
  + hb_set_t performance tuning and optimizations.
  + Speed up collect_glyphs() and reject garbage data.
  + In hb_coretext_font_create() set font point-size (ptem).
  + Misc fixes.</changelog>
  <changelog author="zaitor@opensuse.org" date="1515499200">- Add pkgconfig(gobject-2.0) and
  pkgconfig(gobject-introspection-1.0) BuildRequires, and pass
  with-gobject=yes to configure, build GObject and Introspection
  support.
- Following this, package the new sub-packages libharfbuzz-gobject0
  and typelib-1_0-HarfBuzz-0_0.
- Clean up spec, use autosetup and make_build macros.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1515585600">- harfbuzz-devel hb-ft.h requires pkgconfig(freetype2) but it is
  not automatically added by the dependency generator.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1518177600">- Update to version 1.7.5:
  + Separate Khmer shaper from Indic.
  + First stab at AAT morx. Not hooked up.
  + Misc bug fixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="astieger@suse.com" date="1520596800">- Fix build on Leap 42.3: don't use make_build.</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1520769600">- Fix broken libharbuzz-gobject.so symlink by requiring Harfbuzz's
  Gobject library for the devel package.
- Add missing GI bindings requirement for the devel package.</changelog>
  <changelog author="jengelh@inai.de" date="1520942400">- Update summaries.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1520942401">- Update to version 1.7.6:
  + Fix to hb_set_t binary operations. Ouch.
  + New experimental harfbuzz-subset library. All of hb-subset.h is
    experimental right now and API WILL change.
  + New API:
  - hb_blob_copy_writable_or_fail().
  - HB_OT_TAG_BASE.
  - hb_set_previous().
  - hb_set_previous_range().
- Split out new sub-package libharfbuzz-subset0.
- Add libharfbuzz-gobject0 and libharfbuzz-subset0 to baselibs.
- Use make_build macro.</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1529150400">- Update to version 1.8.1:
  + Add correctness bug in hb_set_t operations, introduced in
    1.7.7.
- Changes from version 1.8.0:
  + Update to Unicode 11.0.0.
- Changes from version 1.7.7:
  + All HarfBuzz objects are significantly smaller in size now.
  + Sinhala: Position repha on top of post-consonant, not base.
  + Significant libharfbuzz-subset changes. API subject to change.
  + New API in libharfbuzz: hb_blob_create_from_file() and
    hb_face_count().
- Add missing post(un) ldconfig scriptlets for libharfbuzz-subset
  shared library.</changelog>
  <changelog author="tchvatal@suse.com" date="1538654400">- Update to 1.9.0:
  * Various gcc warning fixes
  * New Face-builder API
  * Internal source header name changes
  * Major Khmer shaper improvements
  * Couple of Indic bugfixes</changelog>
  <changelog author="tchvatal@suse.com" date="1552910400">- Update to 2.3.1:
  * too many changes to ever iterate, see NEWS for the details</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563019200">- Update to version 2.5.3:
  + Fix UCD script data for Unicode 10+ scripts. This was broken
    since 2.5.0.
  + More optimizations for HB_TINY.
- Changes from version 2.5.2:
  + More hb-config.hh facilities to shrink library size, namely
    when built as HB_TINY.
  + New documentation of custom configurations in CONFIG.md.
  + Fix build on gcc 4.8. That's supported again.
  + Universal Shaping Engine improvements.
  + API Changes: Undeprecate some horizontal-kerning API and
    re-enable in hb-ft, such that Type1 fonts will continue
    kerning.
- Changes from version 2.5.1:
  + Fix build with various versions of Visual Studio.
  + Improved documentation.
  + Bugfix in subsetting glyf table.
  + Improved scripts for cross-compiling for Windows using mingw.
  + Rename HB_MATH_GLYPH_PART_FLAG_EXTENDER to
    HB_OT_MATH_GLYPH_PART_FLAG_EXTENDER. A deprecated macro is
    added for backwards-compatibility.
- Changes from version 2.5.0:
  + This release does not include much functional changes, but
    includes major internal code-base changes. We now require
    C++11. Support for gcc 4.8 and earlier has been dropped.
  + New hb-config.hh facility for compiling smaller library for
    embedded and web usecases.
  + New Unicode Character Databse implementation that is half the
    size of previously-used UCDN.
  + Subsetter improvements.
  + Improved documentation.
  + isc shaping fixes.
- Changes from version 2.4.0:
  + Unicode 12.
  + Misc fixes.
  + Subsetter improvements.
  + New API: HB_BUFFER_FLAG_DO_NOT_INSERT_DOTTED_CIRCLE and
    hb_directwrite_face_create().</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1568376000">- Update to version 2.6.1:
  + Fix regression with hb_font_create_sub_font scaling introduced
    in 2.6.0.
  + Change interpretation of font PTEM size / CoreText font size
    handling.
  + hb-ot-font: Prefer symbol cmap subtable if present.
  + Apply 'dist'/'abvm'/'blwm' features to all scripts.
  + Drop experimental DirectWrite API.
- Changes from version 2.6.0:
  + New OpenType metrics, baseline, and metadata table access APIs.
  + New API to set font variations to a named-instance.
  + New hb-gdi.h header and API for creating hb_face_t from HFONT.
  + Amalgam: Provide a single-file harfbuzz.cc file for easier
    alternate building.
  + More size-reduction configurable options, enabled by HB_TINY.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570104000">- Update to version 2.6.2:
  + Misc small fixes, mostly to build-related issues.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1570363200">- add upstream sigining keyring and verify source signature</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1572350400">- update to 2.6.3:
  + Misc small fixes, mostly to build-related issues
  + New API: hb_font_get_nominal_glyphs()</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1574596800">- update to 2.6.4:
  + small bug fixes and build fixes</changelog>
  <changelog author="mgorse@suse.com" date="1657886400">- Add harfbuzz-CVE-2022-33068.patch: sbix: limit glyph extents
  (boo#1200900 CVE-2022-33068).</changelog>
</package>
<package pkgid="70eaab6d2409e030632b5f27ccf51d241b96f449ebc30beaf206a173e46bcd39" name="hwinfo" arch="aarch64">
  <version epoch="0" ver="21.82" rel="150300.3.3.1"/>
  <changelog author="wfeldt@opensuse.org" date="1558612800">- merge gh#openSUSE/hwinfo#79
- return BIOS UUID in decoded (with '-'s) form (bsc#1135819)
- 21.65</changelog>
  <changelog author="wfeldt@opensuse.org" date="1558612801">- merge gh#openSUSE/hwinfo#80
- fix Makefile and allow building for old distros
- 21.66</changelog>
  <changelog author="wfeldt@opensuse.org" date="1563537600">- merge gh#openSUSE/hwinfo#81
- fix DASD detection (bsc#1136475)
- don't include bcache devices
- 21.67</changelog>
  <changelog author="mliska@suse.cz" date="1564747200">- Use FAT LTO objects in order to provide proper static library.</changelog>
  <changelog author="wfeldt@opensuse.org" date="1579003200">- merge gh#openSUSE/hwinfo#84
- the /sbin/udevadm compat symlink is gone
- 21.68</changelog>
  <changelog author="dimstar@opensuse.org" date="1579780800">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavor.</changelog>
  <changelog author="wfeldt@opensuse.org" date="1585051200">- merge gh#openSUSE/hwinfo#85
- fix xen detection (bsc#1167561)
- add link to cpuid doc
- 21.69</changelog>
  <changelog author="wfeldt@opensuse.org" date="1587470400">- merge gh#openSUSE/hwinfo#86
- update pci and usb ids (bsc#1169682)
- fix compiler warnings
- 21.70</changelog>
  <changelog author="wfeldt@opensuse.org" date="1605873600">- merge gh#openSUSE/hwinfo#89
- rework network device detection on aarch64 (bsc#1177600,
  bsc#1177261)
- 21.71</changelog>
  <changelog author="wfeldt@opensuse.org" date="1611748800">- merge gh#openSUSE/hwinfo#92
- improve getting video mode info (bsc#1181101)
- try harder to break out of infinite I/O loops
- 21.72</changelog>
  <changelog author="wfeldt@opensuse.org" date="1618315200">- merge gh#openSUSE/hwinfo#95
- don't rely on select() updating its timeout arg (bsc#1184339)
- 21.73</changelog>
  <changelog author="wfeldt@opensuse.org" date="1621339200">- merge gh#openSUSE/hwinfo#98
- update pci and usb ids
- 21.74</changelog>
  <changelog author="wfeldt@opensuse.org" date="1625227200">- merge gh#openSUSE/hwinfo#100
- recognize loongarch64 architecture
- 21.75</changelog>
  <changelog author="wfeldt@opensuse.org" date="1627041600">- merge gh#openSUSE/hwinfo#104
- Fix timezone issue in SOURCE_DATE_EPOCH code
- 21.76</changelog>
  <changelog author="wfeldt@opensuse.org" date="1633089600">- merge gh#openSUSE/hwinfo#105
- Use license file from gnu.org
- Fix spelling
- Add missing final newline
- Trim excess whitespace
- Simple maintenance improvements
- 21.77</changelog>
  <changelog author="wfeldt@opensuse.org" date="1636632000">- merge gh#openSUSE/hwinfo#106
- Always read numerical 32bit serial number from EDID header.
  Override this with ASCII serial number from display descriptor,
  if available.
- Display numerical 32bit serial number for monitors without serial
  number display descriptor
- 21.78</changelog>
  <changelog author="wfeldt@opensuse.org" date="1639483200">- merge gh#openSUSE/hwinfo#108
- Donot close the open tray after read_cdrom_info.
- Donot close the open tray after read.
- 21.79</changelog>
  <changelog author="wfeldt@opensuse.org" date="1639742400">- merge gh#openSUSE/hwinfo#109
- fix logic around cdrom detection
- 21.80</changelog>
  <changelog author="wfeldt@opensuse.org" date="1649851200">- merge gh#openSUSE/hwinfo#112
- fix bug in determining serial console device name (bsc#1198043)
- 21.81</changelog>
  <changelog author="wfeldt@opensuse.org" date="1655985600">- merge gh#openSUSE/hwinfo#113
- Keep NVMe's namespace output consistency when
  nvme_core.multipath=1 (bsc#1199948)
- 21.82</changelog>
</package>
<package pkgid="bf2423fc974d94680d907d24a277f3bd1636aa33e693f0c521f4f2bbc818c671" name="hwinfo" arch="src">
  <version epoch="0" ver="21.82" rel="150300.3.3.1"/>
  <changelog author="wfeldt@opensuse.org" date="1558612800">- merge gh#openSUSE/hwinfo#79
- return BIOS UUID in decoded (with '-'s) form (bsc#1135819)
- 21.65</changelog>
  <changelog author="wfeldt@opensuse.org" date="1558612801">- merge gh#openSUSE/hwinfo#80
- fix Makefile and allow building for old distros
- 21.66</changelog>
  <changelog author="wfeldt@opensuse.org" date="1563537600">- merge gh#openSUSE/hwinfo#81
- fix DASD detection (bsc#1136475)
- don't include bcache devices
- 21.67</changelog>
  <changelog author="mliska@suse.cz" date="1564747200">- Use FAT LTO objects in order to provide proper static library.</changelog>
  <changelog author="wfeldt@opensuse.org" date="1579003200">- merge gh#openSUSE/hwinfo#84
- the /sbin/udevadm compat symlink is gone
- 21.68</changelog>
  <changelog author="dimstar@opensuse.org" date="1579780800">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavor.</changelog>
  <changelog author="wfeldt@opensuse.org" date="1585051200">- merge gh#openSUSE/hwinfo#85
- fix xen detection (bsc#1167561)
- add link to cpuid doc
- 21.69</changelog>
  <changelog author="wfeldt@opensuse.org" date="1587470400">- merge gh#openSUSE/hwinfo#86
- update pci and usb ids (bsc#1169682)
- fix compiler warnings
- 21.70</changelog>
  <changelog author="wfeldt@opensuse.org" date="1605873600">- merge gh#openSUSE/hwinfo#89
- rework network device detection on aarch64 (bsc#1177600,
  bsc#1177261)
- 21.71</changelog>
  <changelog author="wfeldt@opensuse.org" date="1611748800">- merge gh#openSUSE/hwinfo#92
- improve getting video mode info (bsc#1181101)
- try harder to break out of infinite I/O loops
- 21.72</changelog>
  <changelog author="wfeldt@opensuse.org" date="1618315200">- merge gh#openSUSE/hwinfo#95
- don't rely on select() updating its timeout arg (bsc#1184339)
- 21.73</changelog>
  <changelog author="wfeldt@opensuse.org" date="1621339200">- merge gh#openSUSE/hwinfo#98
- update pci and usb ids
- 21.74</changelog>
  <changelog author="wfeldt@opensuse.org" date="1625227200">- merge gh#openSUSE/hwinfo#100
- recognize loongarch64 architecture
- 21.75</changelog>
  <changelog author="wfeldt@opensuse.org" date="1627041600">- merge gh#openSUSE/hwinfo#104
- Fix timezone issue in SOURCE_DATE_EPOCH code
- 21.76</changelog>
  <changelog author="wfeldt@opensuse.org" date="1633089600">- merge gh#openSUSE/hwinfo#105
- Use license file from gnu.org
- Fix spelling
- Add missing final newline
- Trim excess whitespace
- Simple maintenance improvements
- 21.77</changelog>
  <changelog author="wfeldt@opensuse.org" date="1636632000">- merge gh#openSUSE/hwinfo#106
- Always read numerical 32bit serial number from EDID header.
  Override this with ASCII serial number from display descriptor,
  if available.
- Display numerical 32bit serial number for monitors without serial
  number display descriptor
- 21.78</changelog>
  <changelog author="wfeldt@opensuse.org" date="1639483200">- merge gh#openSUSE/hwinfo#108
- Donot close the open tray after read_cdrom_info.
- Donot close the open tray after read.
- 21.79</changelog>
  <changelog author="wfeldt@opensuse.org" date="1639742400">- merge gh#openSUSE/hwinfo#109
- fix logic around cdrom detection
- 21.80</changelog>
  <changelog author="wfeldt@opensuse.org" date="1649851200">- merge gh#openSUSE/hwinfo#112
- fix bug in determining serial console device name (bsc#1198043)
- 21.81</changelog>
  <changelog author="wfeldt@opensuse.org" date="1655985600">- merge gh#openSUSE/hwinfo#113
- Keep NVMe's namespace output consistency when
  nvme_core.multipath=1 (bsc#1199948)
- 21.82</changelog>
</package>
<package pkgid="4cb0aad9e2148b3290877e3903a9792bfb31bfc7b9cb883a5088b6e04387d682" name="hwinfo" arch="x86_64">
  <version epoch="0" ver="21.82" rel="150300.3.3.1"/>
  <changelog author="wfeldt@opensuse.org" date="1558612800">- merge gh#openSUSE/hwinfo#79
- return BIOS UUID in decoded (with '-'s) form (bsc#1135819)
- 21.65</changelog>
  <changelog author="wfeldt@opensuse.org" date="1558612801">- merge gh#openSUSE/hwinfo#80
- fix Makefile and allow building for old distros
- 21.66</changelog>
  <changelog author="wfeldt@opensuse.org" date="1563537600">- merge gh#openSUSE/hwinfo#81
- fix DASD detection (bsc#1136475)
- don't include bcache devices
- 21.67</changelog>
  <changelog author="mliska@suse.cz" date="1564747200">- Use FAT LTO objects in order to provide proper static library.</changelog>
  <changelog author="wfeldt@opensuse.org" date="1579003200">- merge gh#openSUSE/hwinfo#84
- the /sbin/udevadm compat symlink is gone
- 21.68</changelog>
  <changelog author="dimstar@opensuse.org" date="1579780800">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavor.</changelog>
  <changelog author="wfeldt@opensuse.org" date="1585051200">- merge gh#openSUSE/hwinfo#85
- fix xen detection (bsc#1167561)
- add link to cpuid doc
- 21.69</changelog>
  <changelog author="wfeldt@opensuse.org" date="1587470400">- merge gh#openSUSE/hwinfo#86
- update pci and usb ids (bsc#1169682)
- fix compiler warnings
- 21.70</changelog>
  <changelog author="wfeldt@opensuse.org" date="1605873600">- merge gh#openSUSE/hwinfo#89
- rework network device detection on aarch64 (bsc#1177600,
  bsc#1177261)
- 21.71</changelog>
  <changelog author="wfeldt@opensuse.org" date="1611748800">- merge gh#openSUSE/hwinfo#92
- improve getting video mode info (bsc#1181101)
- try harder to break out of infinite I/O loops
- 21.72</changelog>
  <changelog author="wfeldt@opensuse.org" date="1618315200">- merge gh#openSUSE/hwinfo#95
- don't rely on select() updating its timeout arg (bsc#1184339)
- 21.73</changelog>
  <changelog author="wfeldt@opensuse.org" date="1621339200">- merge gh#openSUSE/hwinfo#98
- update pci and usb ids
- 21.74</changelog>
  <changelog author="wfeldt@opensuse.org" date="1625227200">- merge gh#openSUSE/hwinfo#100
- recognize loongarch64 architecture
- 21.75</changelog>
  <changelog author="wfeldt@opensuse.org" date="1627041600">- merge gh#openSUSE/hwinfo#104
- Fix timezone issue in SOURCE_DATE_EPOCH code
- 21.76</changelog>
  <changelog author="wfeldt@opensuse.org" date="1633089600">- merge gh#openSUSE/hwinfo#105
- Use license file from gnu.org
- Fix spelling
- Add missing final newline
- Trim excess whitespace
- Simple maintenance improvements
- 21.77</changelog>
  <changelog author="wfeldt@opensuse.org" date="1636632000">- merge gh#openSUSE/hwinfo#106
- Always read numerical 32bit serial number from EDID header.
  Override this with ASCII serial number from display descriptor,
  if available.
- Display numerical 32bit serial number for monitors without serial
  number display descriptor
- 21.78</changelog>
  <changelog author="wfeldt@opensuse.org" date="1639483200">- merge gh#openSUSE/hwinfo#108
- Donot close the open tray after read_cdrom_info.
- Donot close the open tray after read.
- 21.79</changelog>
  <changelog author="wfeldt@opensuse.org" date="1639742400">- merge gh#openSUSE/hwinfo#109
- fix logic around cdrom detection
- 21.80</changelog>
  <changelog author="wfeldt@opensuse.org" date="1649851200">- merge gh#openSUSE/hwinfo#112
- fix bug in determining serial console device name (bsc#1198043)
- 21.81</changelog>
  <changelog author="wfeldt@opensuse.org" date="1655985600">- merge gh#openSUSE/hwinfo#113
- Keep NVMe's namespace output consistency when
  nvme_core.multipath=1 (bsc#1199948)
- 21.82</changelog>
</package>
<package pkgid="4e87d8993e55d3a34af66cd0fbae34dda5e4d364f39aeae489ffb17ae36fef5e" name="ignition" arch="aarch64">
  <version epoch="0" ver="2.14.0" rel="150300.6.7.1"/>
  <changelog author="iforster@suse.de" date="1603108800">- Update to version 2.7.0:
  * news: add notes for 2.7.0
  * docs: stabilize spec
  * gomod: bump go.opencensus.io to v0.22.5
  * docs: add section to spec stabilization for failing external tests
  * news: fix error in 2.3.0 changelog
  * tests: update for spec stabilization
  * internal: update for new experimental spec
  * config/v3_3_experimental: create new experimental package
  * config/v3_2_experimental: mark stable
  * interal/providers/*stack: drop timeout for config fetch
  * internal/providers/*stack: exit early if all configs error out
  * internal/providers/*stack: make ErrNotFound authoritative
  * doc: add clevis custom documentation
  * internal/exec/stages: add clevis custom support
  * config: add custom options for clevis devices
  * fetch-offline: immediately return ErrNeedNet on OpenStack
  * ci: unfreeze kernel
  * tests/*: add test for resizing an existing partition
  * docs/*: add resize partition info
  * stages/disks: support resizing an existing partition
  * config: add resize to schema
  * README: Minor changes for consistency
  * test: Use alternative marker for testing ignition config examples
  * docs: Convert and improve formatting for INI sections
  * docs: Add spec ordering instructions for new stable releases
  * docs: Add ToC for some long pages
  * docs: Rename Migrating ... to Upgrading Configs
  * docs: Fix link in Development page
  * docs: Add specs reference page
  * docs: Add index page inspired from README
  * docs: Add Config Validation example from README
  * docs: Add Jekyll front matter for existing pages
  * docs: Add Jekyll and theme config
  * internal: fix S3 region detection
  * docs: Follow-up for doc-&gt;docs renaming
  * docs: Rename doc to docs for GitHub Pages support
  * docs/getting-started: tiny cleanups
  * README: drop stray link target
  * doc: drop references to Container Linux
  * doc/development: drop section on running blackbox tests on CL
  * doc: add gs url scheme for bare metal platform
  * fetch: don't run if fetch-offline fetched a config
  * doc: fix LUKS indentation for configuration-v3_2_experimental docs
  * doc: Add shouldExist for users and groups
  * engine: fix logging interactions with fetch-offline
  * AzureStack: fix unfortunate typo of iso9660
  * *: add wipeVolume LUKS field
  * types: Use "path" instead of "path/filepath"
  * Add support for building 32 bit ARM version
  * Install Dracut modules with correct permissions
  * Add support for building 32 bit x86 version
  * doc: add LUKS examples &amp; operator notes
  * internal/stages/disks: allow LUKS device re-use
  * internal: use device aliases for LUKS
  * tests: fix partition.number0 partition size specification
  * blkid: drop some unsafe pointer casts
  * blkid: fix invalid pointer cast in DumpDisk()
  * {sgdisk,blkid}: use int64 for sector counts
  * sgdisk: stop putting sector counts in MiB fields
  * README: note that spec2x is unmaintained
  * release-checklist: drop support for Ignition 0.x
  * release-checklist: minor updates
- Remove upstreamed patches
  * 0001-fix-install-permissions.patch
  * 0003-fix-i386-build.patch
  * ignition-fix-arm32-installation.patch
- Refreshed to match new Ignition spec
  * 0002-allow-multiple-mounts-of-same-device.patch</changelog>
  <changelog author="fbui@suse.com" date="1604404800">- Replace  '%service_del_postun -n' with '%service_del_postun_without_restart'
  '-n' is deprecated and will be removed in the future.</changelog>
  <changelog author="hello@anthonyrabbito.com" date="1617192000">- Update to version 2.9.0:
  * news: add notes for 2.9.0
  * internal/providers: Run platform Init function before fetching config
  * internal/providers/aws: fix panic when an IMDSv2 token is present
  * internal/resource/http: re-order initial backoff ramping
  * internal/providers/util: drop dead code
  * ci: move Travis jobs to GitHub actions
  * *: fix errcheck warnings
  * internal/log: drop the error return to appease golanci-lint
  * internal/providers/packet: fix ineffassign warning
  * internal/exec/stages/files: fix the EntrySort test
  * internal: support IMDSv2 for AWS metadata service
  * config/*: require filesystems.format with wipeFilesystem or mountOptions
  * docs: make storage.filesystems.path field optional
  * aws: Log if we fail to determine the EC2 region
  * docs: move systemd.units.name uniqueness constraint to units
  * *: fix gosimple warnings
  * *: fix deadcode warnings
  * *: fix staticcheck warnings
  * config/*: fix nil deref on partitions with no number or label
  * config: add specs newer than 3.0 to TestConfigStructure
  * news: add notes for 2.8.1
  * config/merge: support struct pointers
  * test: drop stale comment
  * tests: Remove unused checkOnStrings
  * news: add notes for 2.8.0
  * config: deprecate MergeStruct()
  * config/merge: allow obtaining a transcript of merge operations
  * config/merge: access field name as fieldMeta.Name
  * config/merge: test primitive list items in slice case 1
  * config/merge: fix typo
  * config/merge: fix comments and add a couple more
  * config/util: remove stray print when parsing invalid JSON
  * vendor: update vcontext
  * docs/development: update dep list for blackbox tests
  * tests/positive: Add tests for masking and unmasking units
  * units: add support for unmasking systemd units
  * release-checklist: minor updates to the release instructions
  * tests/positive/general: add test for merging multiple base configs
  * tests/positive/general: update base config reference
  * docs/development: update spec stabilization to avoid CI breakage
  * release-checklist: drop download_ignition.sh
  * providers/system: support .d directory for base config fragments
  * docs/migrating-configs: spell out Google Cloud Storage
  * release-checklist: update packaging section</changelog>
  <changelog author="rpm@fthiessen.de" date="1622462400">- Update to version 2.10.1:
  * Breaking Changes:
  * Rename Custom struct to ClevisCustom
  * Embed Clevis and ClevisCustom structs in parents
  * Always include interior nodes in merge transcript
  * Add kernel argument support
  * Fix fetching userdata on AWS when IMDSv1 is disabled
  * Fix creating Tang-based LUKS volumes before network is up
  * Document storage.filesystems.wipeFilesystem default
  * Fix file mode of ignition-kargs-helper script
- Fix Go dependency, 1.13+ is required</changelog>
  <changelog author="iforster@suse.com" date="1625659200">- Implement missing ignition-kargs-helper script for kernel
  argument support</changelog>
  <changelog author="iforster@suse.com" date="1625659201">- Update to version 2.11.0:
  * news: add notes for 2.11.0
  * Upgraded docs
  * config/*: return report from previous parser when chaining
  * config/*: re-order testcases by version
  * tree: update for stable v3.3.0 and new v3.4.0-experimental
  * config/v3_4_experimental: adapt for experimental
  * config/v3_4_experimental: copy from config/v3_3
  * config/v3_3: adapt for stabilization
  * config/v3_3_experimental: rename to config/v3_3
  * config/v3_3_exp: pointerify ClevisCustom Config and Pin
  * config/v3_3_exp: pointerify Raid.Level
  * config/v3_3_exp: pointerify LinkEmbedded1.Target
  * stages/disks: simplify a check
  * config/v3_1/translate: don't point to field from input struct
  * config/v3_3_exp: drop devices from schema "required" field
  * config/*: validate that storage.raid.devices is non-empty
  * config/*/types: add RAID validation tests
  * config/shared/errors: fix ErrSparesUnsupportedForLevel message
  * config: fix comment
  * *: formally bump Go to 1.13
  * platform: add powervs platform
  * internal/providers/*stack: drop dead timeout code
  * stages/disks: improve error reporting for LUKS device reuse
  * ignition-setup-user.service: drop Before=multipathd.service
  * Dockerfile: build ignition-validate container using Fedora
  * workflows: test on Go 1.16
  * tests/*: verify deletion of block device w/o creating a FS
  * *: allow erasing block device without creating a filesystem
  * *: rename other projects' master branches to main
  * *: rename master branch to main
  * config/*: add export functions for parsing any config version &lt; N
  * config/*: refactor config.go's Parse() to use GetConfigVersion
  * config/* : minor cleanup
- Refreshed to match new Ignition spec
  * 0002-allow-multiple-mounts-of-same-device.patch</changelog>
  <changelog author="iforster@suse.com" date="1625745600">- If a Combustion device was mounted, then unmount it in
  ignition-kargs-helper - the replacement script will be put on
  the same location</changelog>
  <changelog author="iforster@suse.com" date="1626868800">- Ignore error return code if no virtualization environment
  detected. [bsc#1188479]
  This makes it possible to use Ignition also on bare metal (e.g.
  when dumping images directly to disk) without adding a
  ignition.platform.id parameter.</changelog>
  <changelog author="kukuk@suse.com" date="1627473600">- Include vfat and nls kernel modules into initrd so that we can
  read the ignition configuration from USB drives [bsc#1184202]</changelog>
  <changelog author="iforster@suse.com" date="1628510400">- Update to version 2.12.0:
  * news: add notes for 2.12.0
  * stages/files: add previousReport to result report
  * tests: fix linter warning
  * workflows: limit permissions to reading repo contents
  * workflows: bump linter version
  * go.mod: revendor
  * Drop EOL Go versions
  * internal/distro: drop DiskByIDDir
  * providers/azure: add support for azure gen2 VMs [bsc#1196679]
  * stages/mount: correctly relabel the root of a fresh ext4 filesystem
  * exec: fix permissions for mountpoints in home dirs
  * tests: drop os.ModeDir requirement in mode of output directories
  * examples: reboot with --force
  * exec/util: add blkid API to query block devices based on FSTYPE
  * stages/files: use IntToPtr() in createCrypttabEntries()
  * stages/files: write result report to /var/lib/ignition
  * engine: persist fetched config summaries in State
  * stages/disks: use State to persist keyfiles for files stage
  * *: add general mechanism for persisting state between stages
  * main: drop -clear-cache flag
  * engine: don't hardcode neednet path
  * fetch-offline: return ErrNeedNet if we need net
  * engine: switch Engine.logReport() to pointer receiver
  * engine: fix incorrect error in log message
  * dracut: drop ignition-setup-user.service
  * dracut: drop reference to ignition-setup-base.service
  * providers/gcp: access GCP metadata service by IP address
  * Remove ignition-firstboot-complete.service
  * OWNERS: remove
  * internal/exec/util: drop device argument from cResultToErr()
  * docs/config*: document storage.luks.clevis.threshold default
  * ci: disable spec bump external test workaround
  * docs: Add Ignition release / Spec version table
  * templates: update example releng signing ticket
  * templates: don't update %gotest lines
  * Provide ignition-firstboot-complete.service (removed by upstream
  due to correctly being considered distro spcific), based on the
  old upstream version; removed all non-SUSE specific stuff and
  integrated our own changes
  * Removed change-ignition-firstboot-path.conf (changes are
  integrated into ignition-firstboot-complete.service now).
  * Provide ignition-setup-user.service  (removed by upstream due
  to correctly being considered distro spcific), based on the old
  upstream version.
  * Renamed ignition-setup-user-suse.sh to ignition-setup-user.sh
  * Adapted ignition-generator-suse and module-setup.sh to use the
  custom ignition-setup-user.service (no overriding of parts of the
  service file necessary any more).
  * Synced ignition-kargs-helper script with upstream example
  * Raising minimum Go version to 1.15 as required by upstream</changelog>
  <changelog author="iforster@suse.com" date="1628769600">- is-live-image doesn't exist on *SUSE, and our live images don't
  use Ignition, so just add the Ignition device dependency to the
  service file directly.</changelog>
  <changelog author="iforster@suse.com" date="1629720000">- Make sure to create /boot/writable (may not be present in some
  images)</changelog>
  <changelog author="iforster@suse.com" date="1638360000">- Update to version 2.13.0:
  * news: add notes for 2.13.0
  * config/v3_4_exp: noProxy entries cannot be null
  * config/v3_4_exp: mark ignition.version as required
  * docs/supported-platforms: add some description about Nutanix
  * providers/nutanix: add Nutanix platform
  * tests: use umountPath as a thin wrapper around umountPartition
  * internal/providers: refactor handling of unmounting the mount path
  * tests: address gostatic-check warning
  * tests: Add base64 decoding test
  * Dockerfile.validate: build with Fedora 35
  * go.mod: update dataurl to 1.0.0
  * ci: give blackbox tests two hours to run
  * tests/filesystem: fix umountPartition retry loop
  * templates: skip vendoring the new version in favor of dependabot
  * go.mod: update vcontext
  * providers/virtualbox: read config from /Ignition/Config guest property
  * stages/filesystems: use mkfs.fat instead of mkfs.vfat
  * docs/supported-platforms: switch to Afterburn docs URL
  * docs/supported-platforms: drop reference to platform-specific agents
  * test: ensure all platforms are documented
  * docs/supported-platforms: add missing platforms
  * stages/files: rename `relabelDirsForFile` and add docstring
  * stages/files: make variable name follow Go convention
  * docs/supported-platforms: update platform names and URLs
  * docs/supported-platforms: sort by platform ID
  * docs/supported-platforms: add platform IDs
  * docs: Remove default layout from front matter
  * docs: Do not convert -- &amp; --- to en/em-dash
  * internal/*: change the location of Ignition report
  * internal/exec/util: rename FindFirstMissingDirForFile and tweak docs
  * providers/qemu: start reporting progress reading fw_cfg after 10 s
  * providers/qemu: optimize fw_cfg read size
  * ci: use coreos-ci-lib helper for kola testiso
  * *: gofmt 1.17
  * workflows: bump Go and golangci-lint
  * config: update versions in comments
- Removed obsolete ignition-rpmlintrc</changelog>
  <changelog author="fvogt@suse.com" date="1646395200">- Add support for NetworkManager in dracut:
  * ignition-enable-network.service, ignition-enable-network.sh</changelog>
  <changelog author="fvogt@suse.com" date="1646395201">- Remove /var/lib/YaST2/reconfig_system if a config was provided:
  * ignition-remove-reconfig_system.service</changelog>
  <changelog author="iforster@suse.com" date="1648209600">- Add ignition-touch-selinux-autorelabel.conf:
  Trigger SELinux autorelabel after Ignition runs; Ignition would
  support SELinux itself, however this is a compile time option, so
  it can't be used here.
- Filter commented lines in ignition-mount-initrd-fstab.service</changelog>
  <changelog author="iforster@suse.com" date="1649073600">- Don't include non-MarkDown files in documentation</changelog>
  <changelog author="iforster@suse.com" date="1649160000">- ignition-mount-initrd-fstab.service:
  - Don't ignore errors in loops
  - Unmount mount points recursively - a new submount may have
    appeared
  - Split umount part into own service file:
- ignition-umount-initrd-fstab.service:
  - Unmounts the additional mounts as soon as they are not
    required for Ignition any more; the ExecStop operation is
    running quite late in initrd and may unmount essential mount
    points flagged with "x-initrd.mount" (e.g. when storing /usr on
    a separate mount point). In theory this will also affect
    Ignition itself, but it hasn't been reported as a problem so
    far.</changelog>
  <changelog author="iforster@suse.com" date="1649419200">- Use /bin/sh instead of /usr/bin/sh (for backwards compatibility
  with SLE Micro 5.1) [bsc#1196679]</changelog>
  <changelog author="iforster@suse.com" date="1652875200">- Update to version 2.14.0:
  * NEWS: update v2.14.0
  * docs/operator-notes: add section on provisioning secrets
  * Dockerfile.validate: build with Fedora 36
  * internal/resource: fix gs:// fetches in GCE without a service account
  * docs/operator-notes: document supported S3 URL formats
  * internal/resource: fix S3 access point object ARNs
  * exec/util: fix infinite loop in Depth() if -root is relative
  * Add ignition-delete-config.service and ignition-rmcfg symlink
  * providers/virtualbox: support deleting Ignition configs
  * providers/virtualbox: add comment referencing VirtualBox source
  * providers/virtualbox: add define for GUEST_PROP_FN_GET_PROP
  * providers/virtualbox: add helper to set up hypervisor connection
  * providers/vmware: support deleting Ignition configs
  * main: add ignition-rmcfg multicall binary
  * go.mod: add github.com/beevik/etree
  * providers/vmware: switch to internal copy of OVF parser
  * internal/resource: fix bucket field in error message
  * internal/resource: derive AWS region hint from ARN partition field
  * internal/resource: simplify test
  * internal/resource: fix minor nits
  * provider/azure: try to fetch userdata from IMDS
  * providers/vmware: convert OVF tests to testify
  * providers/vmware: drop vmw-ovflib docs
  * providers/vmware: add verbatim copy of vmw-ovflib
  * providers/vmware: add constants for guestinfo and OVF property names
  * providers/virtualbox: fix reading properties with flags
  * internal/resource: support S3 access point URLs
- Update fixes CVE-2022-1706 from [bsc#1199524]; this introduces a new
  service "ignition-delete-config.service"
- Add ignition-rmcfg-suse.conf dropin to adapt to SUSE environment
- Use fixed paths in spec file for hardcoded installation paths</changelog>
</package>
<package pkgid="a5a04fc99879def108512c83cb3a9a44a9059c72b20242771121069caafad956" name="ignition" arch="src">
  <version epoch="0" ver="2.14.0" rel="150300.6.7.1"/>
  <changelog author="iforster@suse.de" date="1603108800">- Update to version 2.7.0:
  * news: add notes for 2.7.0
  * docs: stabilize spec
  * gomod: bump go.opencensus.io to v0.22.5
  * docs: add section to spec stabilization for failing external tests
  * news: fix error in 2.3.0 changelog
  * tests: update for spec stabilization
  * internal: update for new experimental spec
  * config/v3_3_experimental: create new experimental package
  * config/v3_2_experimental: mark stable
  * interal/providers/*stack: drop timeout for config fetch
  * internal/providers/*stack: exit early if all configs error out
  * internal/providers/*stack: make ErrNotFound authoritative
  * doc: add clevis custom documentation
  * internal/exec/stages: add clevis custom support
  * config: add custom options for clevis devices
  * fetch-offline: immediately return ErrNeedNet on OpenStack
  * ci: unfreeze kernel
  * tests/*: add test for resizing an existing partition
  * docs/*: add resize partition info
  * stages/disks: support resizing an existing partition
  * config: add resize to schema
  * README: Minor changes for consistency
  * test: Use alternative marker for testing ignition config examples
  * docs: Convert and improve formatting for INI sections
  * docs: Add spec ordering instructions for new stable releases
  * docs: Add ToC for some long pages
  * docs: Rename Migrating ... to Upgrading Configs
  * docs: Fix link in Development page
  * docs: Add specs reference page
  * docs: Add index page inspired from README
  * docs: Add Config Validation example from README
  * docs: Add Jekyll front matter for existing pages
  * docs: Add Jekyll and theme config
  * internal: fix S3 region detection
  * docs: Follow-up for doc-&gt;docs renaming
  * docs: Rename doc to docs for GitHub Pages support
  * docs/getting-started: tiny cleanups
  * README: drop stray link target
  * doc: drop references to Container Linux
  * doc/development: drop section on running blackbox tests on CL
  * doc: add gs url scheme for bare metal platform
  * fetch: don't run if fetch-offline fetched a config
  * doc: fix LUKS indentation for configuration-v3_2_experimental docs
  * doc: Add shouldExist for users and groups
  * engine: fix logging interactions with fetch-offline
  * AzureStack: fix unfortunate typo of iso9660
  * *: add wipeVolume LUKS field
  * types: Use "path" instead of "path/filepath"
  * Add support for building 32 bit ARM version
  * Install Dracut modules with correct permissions
  * Add support for building 32 bit x86 version
  * doc: add LUKS examples &amp; operator notes
  * internal/stages/disks: allow LUKS device re-use
  * internal: use device aliases for LUKS
  * tests: fix partition.number0 partition size specification
  * blkid: drop some unsafe pointer casts
  * blkid: fix invalid pointer cast in DumpDisk()
  * {sgdisk,blkid}: use int64 for sector counts
  * sgdisk: stop putting sector counts in MiB fields
  * README: note that spec2x is unmaintained
  * release-checklist: drop support for Ignition 0.x
  * release-checklist: minor updates
- Remove upstreamed patches
  * 0001-fix-install-permissions.patch
  * 0003-fix-i386-build.patch
  * ignition-fix-arm32-installation.patch
- Refreshed to match new Ignition spec
  * 0002-allow-multiple-mounts-of-same-device.patch</changelog>
  <changelog author="fbui@suse.com" date="1604404800">- Replace  '%service_del_postun -n' with '%service_del_postun_without_restart'
  '-n' is deprecated and will be removed in the future.</changelog>
  <changelog author="hello@anthonyrabbito.com" date="1617192000">- Update to version 2.9.0:
  * news: add notes for 2.9.0
  * internal/providers: Run platform Init function before fetching config
  * internal/providers/aws: fix panic when an IMDSv2 token is present
  * internal/resource/http: re-order initial backoff ramping
  * internal/providers/util: drop dead code
  * ci: move Travis jobs to GitHub actions
  * *: fix errcheck warnings
  * internal/log: drop the error return to appease golanci-lint
  * internal/providers/packet: fix ineffassign warning
  * internal/exec/stages/files: fix the EntrySort test
  * internal: support IMDSv2 for AWS metadata service
  * config/*: require filesystems.format with wipeFilesystem or mountOptions
  * docs: make storage.filesystems.path field optional
  * aws: Log if we fail to determine the EC2 region
  * docs: move systemd.units.name uniqueness constraint to units
  * *: fix gosimple warnings
  * *: fix deadcode warnings
  * *: fix staticcheck warnings
  * config/*: fix nil deref on partitions with no number or label
  * config: add specs newer than 3.0 to TestConfigStructure
  * news: add notes for 2.8.1
  * config/merge: support struct pointers
  * test: drop stale comment
  * tests: Remove unused checkOnStrings
  * news: add notes for 2.8.0
  * config: deprecate MergeStruct()
  * config/merge: allow obtaining a transcript of merge operations
  * config/merge: access field name as fieldMeta.Name
  * config/merge: test primitive list items in slice case 1
  * config/merge: fix typo
  * config/merge: fix comments and add a couple more
  * config/util: remove stray print when parsing invalid JSON
  * vendor: update vcontext
  * docs/development: update dep list for blackbox tests
  * tests/positive: Add tests for masking and unmasking units
  * units: add support for unmasking systemd units
  * release-checklist: minor updates to the release instructions
  * tests/positive/general: add test for merging multiple base configs
  * tests/positive/general: update base config reference
  * docs/development: update spec stabilization to avoid CI breakage
  * release-checklist: drop download_ignition.sh
  * providers/system: support .d directory for base config fragments
  * docs/migrating-configs: spell out Google Cloud Storage
  * release-checklist: update packaging section</changelog>
  <changelog author="rpm@fthiessen.de" date="1622462400">- Update to version 2.10.1:
  * Breaking Changes:
  * Rename Custom struct to ClevisCustom
  * Embed Clevis and ClevisCustom structs in parents
  * Always include interior nodes in merge transcript
  * Add kernel argument support
  * Fix fetching userdata on AWS when IMDSv1 is disabled
  * Fix creating Tang-based LUKS volumes before network is up
  * Document storage.filesystems.wipeFilesystem default
  * Fix file mode of ignition-kargs-helper script
- Fix Go dependency, 1.13+ is required</changelog>
  <changelog author="iforster@suse.com" date="1625659200">- Implement missing ignition-kargs-helper script for kernel
  argument support</changelog>
  <changelog author="iforster@suse.com" date="1625659201">- Update to version 2.11.0:
  * news: add notes for 2.11.0
  * Upgraded docs
  * config/*: return report from previous parser when chaining
  * config/*: re-order testcases by version
  * tree: update for stable v3.3.0 and new v3.4.0-experimental
  * config/v3_4_experimental: adapt for experimental
  * config/v3_4_experimental: copy from config/v3_3
  * config/v3_3: adapt for stabilization
  * config/v3_3_experimental: rename to config/v3_3
  * config/v3_3_exp: pointerify ClevisCustom Config and Pin
  * config/v3_3_exp: pointerify Raid.Level
  * config/v3_3_exp: pointerify LinkEmbedded1.Target
  * stages/disks: simplify a check
  * config/v3_1/translate: don't point to field from input struct
  * config/v3_3_exp: drop devices from schema "required" field
  * config/*: validate that storage.raid.devices is non-empty
  * config/*/types: add RAID validation tests
  * config/shared/errors: fix ErrSparesUnsupportedForLevel message
  * config: fix comment
  * *: formally bump Go to 1.13
  * platform: add powervs platform
  * internal/providers/*stack: drop dead timeout code
  * stages/disks: improve error reporting for LUKS device reuse
  * ignition-setup-user.service: drop Before=multipathd.service
  * Dockerfile: build ignition-validate container using Fedora
  * workflows: test on Go 1.16
  * tests/*: verify deletion of block device w/o creating a FS
  * *: allow erasing block device without creating a filesystem
  * *: rename other projects' master branches to main
  * *: rename master branch to main
  * config/*: add export functions for parsing any config version &lt; N
  * config/*: refactor config.go's Parse() to use GetConfigVersion
  * config/* : minor cleanup
- Refreshed to match new Ignition spec
  * 0002-allow-multiple-mounts-of-same-device.patch</changelog>
  <changelog author="iforster@suse.com" date="1625745600">- If a Combustion device was mounted, then unmount it in
  ignition-kargs-helper - the replacement script will be put on
  the same location</changelog>
  <changelog author="iforster@suse.com" date="1626868800">- Ignore error return code if no virtualization environment
  detected. [bsc#1188479]
  This makes it possible to use Ignition also on bare metal (e.g.
  when dumping images directly to disk) without adding a
  ignition.platform.id parameter.</changelog>
  <changelog author="kukuk@suse.com" date="1627473600">- Include vfat and nls kernel modules into initrd so that we can
  read the ignition configuration from USB drives [bsc#1184202]</changelog>
  <changelog author="iforster@suse.com" date="1628510400">- Update to version 2.12.0:
  * news: add notes for 2.12.0
  * stages/files: add previousReport to result report
  * tests: fix linter warning
  * workflows: limit permissions to reading repo contents
  * workflows: bump linter version
  * go.mod: revendor
  * Drop EOL Go versions
  * internal/distro: drop DiskByIDDir
  * providers/azure: add support for azure gen2 VMs [bsc#1196679]
  * stages/mount: correctly relabel the root of a fresh ext4 filesystem
  * exec: fix permissions for mountpoints in home dirs
  * tests: drop os.ModeDir requirement in mode of output directories
  * examples: reboot with --force
  * exec/util: add blkid API to query block devices based on FSTYPE
  * stages/files: use IntToPtr() in createCrypttabEntries()
  * stages/files: write result report to /var/lib/ignition
  * engine: persist fetched config summaries in State
  * stages/disks: use State to persist keyfiles for files stage
  * *: add general mechanism for persisting state between stages
  * main: drop -clear-cache flag
  * engine: don't hardcode neednet path
  * fetch-offline: return ErrNeedNet if we need net
  * engine: switch Engine.logReport() to pointer receiver
  * engine: fix incorrect error in log message
  * dracut: drop ignition-setup-user.service
  * dracut: drop reference to ignition-setup-base.service
  * providers/gcp: access GCP metadata service by IP address
  * Remove ignition-firstboot-complete.service
  * OWNERS: remove
  * internal/exec/util: drop device argument from cResultToErr()
  * docs/config*: document storage.luks.clevis.threshold default
  * ci: disable spec bump external test workaround
  * docs: Add Ignition release / Spec version table
  * templates: update example releng signing ticket
  * templates: don't update %gotest lines
  * Provide ignition-firstboot-complete.service (removed by upstream
  due to correctly being considered distro spcific), based on the
  old upstream version; removed all non-SUSE specific stuff and
  integrated our own changes
  * Removed change-ignition-firstboot-path.conf (changes are
  integrated into ignition-firstboot-complete.service now).
  * Provide ignition-setup-user.service  (removed by upstream due
  to correctly being considered distro spcific), based on the old
  upstream version.
  * Renamed ignition-setup-user-suse.sh to ignition-setup-user.sh
  * Adapted ignition-generator-suse and module-setup.sh to use the
  custom ignition-setup-user.service (no overriding of parts of the
  service file necessary any more).
  * Synced ignition-kargs-helper script with upstream example
  * Raising minimum Go version to 1.15 as required by upstream</changelog>
  <changelog author="iforster@suse.com" date="1628769600">- is-live-image doesn't exist on *SUSE, and our live images don't
  use Ignition, so just add the Ignition device dependency to the
  service file directly.</changelog>
  <changelog author="iforster@suse.com" date="1629720000">- Make sure to create /boot/writable (may not be present in some
  images)</changelog>
  <changelog author="iforster@suse.com" date="1638360000">- Update to version 2.13.0:
  * news: add notes for 2.13.0
  * config/v3_4_exp: noProxy entries cannot be null
  * config/v3_4_exp: mark ignition.version as required
  * docs/supported-platforms: add some description about Nutanix
  * providers/nutanix: add Nutanix platform
  * tests: use umountPath as a thin wrapper around umountPartition
  * internal/providers: refactor handling of unmounting the mount path
  * tests: address gostatic-check warning
  * tests: Add base64 decoding test
  * Dockerfile.validate: build with Fedora 35
  * go.mod: update dataurl to 1.0.0
  * ci: give blackbox tests two hours to run
  * tests/filesystem: fix umountPartition retry loop
  * templates: skip vendoring the new version in favor of dependabot
  * go.mod: update vcontext
  * providers/virtualbox: read config from /Ignition/Config guest property
  * stages/filesystems: use mkfs.fat instead of mkfs.vfat
  * docs/supported-platforms: switch to Afterburn docs URL
  * docs/supported-platforms: drop reference to platform-specific agents
  * test: ensure all platforms are documented
  * docs/supported-platforms: add missing platforms
  * stages/files: rename `relabelDirsForFile` and add docstring
  * stages/files: make variable name follow Go convention
  * docs/supported-platforms: update platform names and URLs
  * docs/supported-platforms: sort by platform ID
  * docs/supported-platforms: add platform IDs
  * docs: Remove default layout from front matter
  * docs: Do not convert -- &amp; --- to en/em-dash
  * internal/*: change the location of Ignition report
  * internal/exec/util: rename FindFirstMissingDirForFile and tweak docs
  * providers/qemu: start reporting progress reading fw_cfg after 10 s
  * providers/qemu: optimize fw_cfg read size
  * ci: use coreos-ci-lib helper for kola testiso
  * *: gofmt 1.17
  * workflows: bump Go and golangci-lint
  * config: update versions in comments
- Removed obsolete ignition-rpmlintrc</changelog>
  <changelog author="fvogt@suse.com" date="1646395200">- Add support for NetworkManager in dracut:
  * ignition-enable-network.service, ignition-enable-network.sh</changelog>
  <changelog author="fvogt@suse.com" date="1646395201">- Remove /var/lib/YaST2/reconfig_system if a config was provided:
  * ignition-remove-reconfig_system.service</changelog>
  <changelog author="iforster@suse.com" date="1648209600">- Add ignition-touch-selinux-autorelabel.conf:
  Trigger SELinux autorelabel after Ignition runs; Ignition would
  support SELinux itself, however this is a compile time option, so
  it can't be used here.
- Filter commented lines in ignition-mount-initrd-fstab.service</changelog>
  <changelog author="iforster@suse.com" date="1649073600">- Don't include non-MarkDown files in documentation</changelog>
  <changelog author="iforster@suse.com" date="1649160000">- ignition-mount-initrd-fstab.service:
  - Don't ignore errors in loops
  - Unmount mount points recursively - a new submount may have
    appeared
  - Split umount part into own service file:
- ignition-umount-initrd-fstab.service:
  - Unmounts the additional mounts as soon as they are not
    required for Ignition any more; the ExecStop operation is
    running quite late in initrd and may unmount essential mount
    points flagged with "x-initrd.mount" (e.g. when storing /usr on
    a separate mount point). In theory this will also affect
    Ignition itself, but it hasn't been reported as a problem so
    far.</changelog>
  <changelog author="iforster@suse.com" date="1649419200">- Use /bin/sh instead of /usr/bin/sh (for backwards compatibility
  with SLE Micro 5.1) [bsc#1196679]</changelog>
  <changelog author="iforster@suse.com" date="1652875200">- Update to version 2.14.0:
  * NEWS: update v2.14.0
  * docs/operator-notes: add section on provisioning secrets
  * Dockerfile.validate: build with Fedora 36
  * internal/resource: fix gs:// fetches in GCE without a service account
  * docs/operator-notes: document supported S3 URL formats
  * internal/resource: fix S3 access point object ARNs
  * exec/util: fix infinite loop in Depth() if -root is relative
  * Add ignition-delete-config.service and ignition-rmcfg symlink
  * providers/virtualbox: support deleting Ignition configs
  * providers/virtualbox: add comment referencing VirtualBox source
  * providers/virtualbox: add define for GUEST_PROP_FN_GET_PROP
  * providers/virtualbox: add helper to set up hypervisor connection
  * providers/vmware: support deleting Ignition configs
  * main: add ignition-rmcfg multicall binary
  * go.mod: add github.com/beevik/etree
  * providers/vmware: switch to internal copy of OVF parser
  * internal/resource: fix bucket field in error message
  * internal/resource: derive AWS region hint from ARN partition field
  * internal/resource: simplify test
  * internal/resource: fix minor nits
  * provider/azure: try to fetch userdata from IMDS
  * providers/vmware: convert OVF tests to testify
  * providers/vmware: drop vmw-ovflib docs
  * providers/vmware: add verbatim copy of vmw-ovflib
  * providers/vmware: add constants for guestinfo and OVF property names
  * providers/virtualbox: fix reading properties with flags
  * internal/resource: support S3 access point URLs
- Update fixes CVE-2022-1706 from [bsc#1199524]; this introduces a new
  service "ignition-delete-config.service"
- Add ignition-rmcfg-suse.conf dropin to adapt to SUSE environment
- Use fixed paths in spec file for hardcoded installation paths</changelog>
</package>
<package pkgid="0bc626a1719c1026daa0c348264649049948bcbfb672871ae74d4e74d9508bf6" name="ignition" arch="x86_64">
  <version epoch="0" ver="2.14.0" rel="150300.6.7.1"/>
  <changelog author="iforster@suse.de" date="1603108800">- Update to version 2.7.0:
  * news: add notes for 2.7.0
  * docs: stabilize spec
  * gomod: bump go.opencensus.io to v0.22.5
  * docs: add section to spec stabilization for failing external tests
  * news: fix error in 2.3.0 changelog
  * tests: update for spec stabilization
  * internal: update for new experimental spec
  * config/v3_3_experimental: create new experimental package
  * config/v3_2_experimental: mark stable
  * interal/providers/*stack: drop timeout for config fetch
  * internal/providers/*stack: exit early if all configs error out
  * internal/providers/*stack: make ErrNotFound authoritative
  * doc: add clevis custom documentation
  * internal/exec/stages: add clevis custom support
  * config: add custom options for clevis devices
  * fetch-offline: immediately return ErrNeedNet on OpenStack
  * ci: unfreeze kernel
  * tests/*: add test for resizing an existing partition
  * docs/*: add resize partition info
  * stages/disks: support resizing an existing partition
  * config: add resize to schema
  * README: Minor changes for consistency
  * test: Use alternative marker for testing ignition config examples
  * docs: Convert and improve formatting for INI sections
  * docs: Add spec ordering instructions for new stable releases
  * docs: Add ToC for some long pages
  * docs: Rename Migrating ... to Upgrading Configs
  * docs: Fix link in Development page
  * docs: Add specs reference page
  * docs: Add index page inspired from README
  * docs: Add Config Validation example from README
  * docs: Add Jekyll front matter for existing pages
  * docs: Add Jekyll and theme config
  * internal: fix S3 region detection
  * docs: Follow-up for doc-&gt;docs renaming
  * docs: Rename doc to docs for GitHub Pages support
  * docs/getting-started: tiny cleanups
  * README: drop stray link target
  * doc: drop references to Container Linux
  * doc/development: drop section on running blackbox tests on CL
  * doc: add gs url scheme for bare metal platform
  * fetch: don't run if fetch-offline fetched a config
  * doc: fix LUKS indentation for configuration-v3_2_experimental docs
  * doc: Add shouldExist for users and groups
  * engine: fix logging interactions with fetch-offline
  * AzureStack: fix unfortunate typo of iso9660
  * *: add wipeVolume LUKS field
  * types: Use "path" instead of "path/filepath"
  * Add support for building 32 bit ARM version
  * Install Dracut modules with correct permissions
  * Add support for building 32 bit x86 version
  * doc: add LUKS examples &amp; operator notes
  * internal/stages/disks: allow LUKS device re-use
  * internal: use device aliases for LUKS
  * tests: fix partition.number0 partition size specification
  * blkid: drop some unsafe pointer casts
  * blkid: fix invalid pointer cast in DumpDisk()
  * {sgdisk,blkid}: use int64 for sector counts
  * sgdisk: stop putting sector counts in MiB fields
  * README: note that spec2x is unmaintained
  * release-checklist: drop support for Ignition 0.x
  * release-checklist: minor updates
- Remove upstreamed patches
  * 0001-fix-install-permissions.patch
  * 0003-fix-i386-build.patch
  * ignition-fix-arm32-installation.patch
- Refreshed to match new Ignition spec
  * 0002-allow-multiple-mounts-of-same-device.patch</changelog>
  <changelog author="fbui@suse.com" date="1604404800">- Replace  '%service_del_postun -n' with '%service_del_postun_without_restart'
  '-n' is deprecated and will be removed in the future.</changelog>
  <changelog author="hello@anthonyrabbito.com" date="1617192000">- Update to version 2.9.0:
  * news: add notes for 2.9.0
  * internal/providers: Run platform Init function before fetching config
  * internal/providers/aws: fix panic when an IMDSv2 token is present
  * internal/resource/http: re-order initial backoff ramping
  * internal/providers/util: drop dead code
  * ci: move Travis jobs to GitHub actions
  * *: fix errcheck warnings
  * internal/log: drop the error return to appease golanci-lint
  * internal/providers/packet: fix ineffassign warning
  * internal/exec/stages/files: fix the EntrySort test
  * internal: support IMDSv2 for AWS metadata service
  * config/*: require filesystems.format with wipeFilesystem or mountOptions
  * docs: make storage.filesystems.path field optional
  * aws: Log if we fail to determine the EC2 region
  * docs: move systemd.units.name uniqueness constraint to units
  * *: fix gosimple warnings
  * *: fix deadcode warnings
  * *: fix staticcheck warnings
  * config/*: fix nil deref on partitions with no number or label
  * config: add specs newer than 3.0 to TestConfigStructure
  * news: add notes for 2.8.1
  * config/merge: support struct pointers
  * test: drop stale comment
  * tests: Remove unused checkOnStrings
  * news: add notes for 2.8.0
  * config: deprecate MergeStruct()
  * config/merge: allow obtaining a transcript of merge operations
  * config/merge: access field name as fieldMeta.Name
  * config/merge: test primitive list items in slice case 1
  * config/merge: fix typo
  * config/merge: fix comments and add a couple more
  * config/util: remove stray print when parsing invalid JSON
  * vendor: update vcontext
  * docs/development: update dep list for blackbox tests
  * tests/positive: Add tests for masking and unmasking units
  * units: add support for unmasking systemd units
  * release-checklist: minor updates to the release instructions
  * tests/positive/general: add test for merging multiple base configs
  * tests/positive/general: update base config reference
  * docs/development: update spec stabilization to avoid CI breakage
  * release-checklist: drop download_ignition.sh
  * providers/system: support .d directory for base config fragments
  * docs/migrating-configs: spell out Google Cloud Storage
  * release-checklist: update packaging section</changelog>
  <changelog author="rpm@fthiessen.de" date="1622462400">- Update to version 2.10.1:
  * Breaking Changes:
  * Rename Custom struct to ClevisCustom
  * Embed Clevis and ClevisCustom structs in parents
  * Always include interior nodes in merge transcript
  * Add kernel argument support
  * Fix fetching userdata on AWS when IMDSv1 is disabled
  * Fix creating Tang-based LUKS volumes before network is up
  * Document storage.filesystems.wipeFilesystem default
  * Fix file mode of ignition-kargs-helper script
- Fix Go dependency, 1.13+ is required</changelog>
  <changelog author="iforster@suse.com" date="1625659200">- Implement missing ignition-kargs-helper script for kernel
  argument support</changelog>
  <changelog author="iforster@suse.com" date="1625659201">- Update to version 2.11.0:
  * news: add notes for 2.11.0
  * Upgraded docs
  * config/*: return report from previous parser when chaining
  * config/*: re-order testcases by version
  * tree: update for stable v3.3.0 and new v3.4.0-experimental
  * config/v3_4_experimental: adapt for experimental
  * config/v3_4_experimental: copy from config/v3_3
  * config/v3_3: adapt for stabilization
  * config/v3_3_experimental: rename to config/v3_3
  * config/v3_3_exp: pointerify ClevisCustom Config and Pin
  * config/v3_3_exp: pointerify Raid.Level
  * config/v3_3_exp: pointerify LinkEmbedded1.Target
  * stages/disks: simplify a check
  * config/v3_1/translate: don't point to field from input struct
  * config/v3_3_exp: drop devices from schema "required" field
  * config/*: validate that storage.raid.devices is non-empty
  * config/*/types: add RAID validation tests
  * config/shared/errors: fix ErrSparesUnsupportedForLevel message
  * config: fix comment
  * *: formally bump Go to 1.13
  * platform: add powervs platform
  * internal/providers/*stack: drop dead timeout code
  * stages/disks: improve error reporting for LUKS device reuse
  * ignition-setup-user.service: drop Before=multipathd.service
  * Dockerfile: build ignition-validate container using Fedora
  * workflows: test on Go 1.16
  * tests/*: verify deletion of block device w/o creating a FS
  * *: allow erasing block device without creating a filesystem
  * *: rename other projects' master branches to main
  * *: rename master branch to main
  * config/*: add export functions for parsing any config version &lt; N
  * config/*: refactor config.go's Parse() to use GetConfigVersion
  * config/* : minor cleanup
- Refreshed to match new Ignition spec
  * 0002-allow-multiple-mounts-of-same-device.patch</changelog>
  <changelog author="iforster@suse.com" date="1625745600">- If a Combustion device was mounted, then unmount it in
  ignition-kargs-helper - the replacement script will be put on
  the same location</changelog>
  <changelog author="iforster@suse.com" date="1626868800">- Ignore error return code if no virtualization environment
  detected. [bsc#1188479]
  This makes it possible to use Ignition also on bare metal (e.g.
  when dumping images directly to disk) without adding a
  ignition.platform.id parameter.</changelog>
  <changelog author="kukuk@suse.com" date="1627473600">- Include vfat and nls kernel modules into initrd so that we can
  read the ignition configuration from USB drives [bsc#1184202]</changelog>
  <changelog author="iforster@suse.com" date="1628510400">- Update to version 2.12.0:
  * news: add notes for 2.12.0
  * stages/files: add previousReport to result report
  * tests: fix linter warning
  * workflows: limit permissions to reading repo contents
  * workflows: bump linter version
  * go.mod: revendor
  * Drop EOL Go versions
  * internal/distro: drop DiskByIDDir
  * providers/azure: add support for azure gen2 VMs [bsc#1196679]
  * stages/mount: correctly relabel the root of a fresh ext4 filesystem
  * exec: fix permissions for mountpoints in home dirs
  * tests: drop os.ModeDir requirement in mode of output directories
  * examples: reboot with --force
  * exec/util: add blkid API to query block devices based on FSTYPE
  * stages/files: use IntToPtr() in createCrypttabEntries()
  * stages/files: write result report to /var/lib/ignition
  * engine: persist fetched config summaries in State
  * stages/disks: use State to persist keyfiles for files stage
  * *: add general mechanism for persisting state between stages
  * main: drop -clear-cache flag
  * engine: don't hardcode neednet path
  * fetch-offline: return ErrNeedNet if we need net
  * engine: switch Engine.logReport() to pointer receiver
  * engine: fix incorrect error in log message
  * dracut: drop ignition-setup-user.service
  * dracut: drop reference to ignition-setup-base.service
  * providers/gcp: access GCP metadata service by IP address
  * Remove ignition-firstboot-complete.service
  * OWNERS: remove
  * internal/exec/util: drop device argument from cResultToErr()
  * docs/config*: document storage.luks.clevis.threshold default
  * ci: disable spec bump external test workaround
  * docs: Add Ignition release / Spec version table
  * templates: update example releng signing ticket
  * templates: don't update %gotest lines
  * Provide ignition-firstboot-complete.service (removed by upstream
  due to correctly being considered distro spcific), based on the
  old upstream version; removed all non-SUSE specific stuff and
  integrated our own changes
  * Removed change-ignition-firstboot-path.conf (changes are
  integrated into ignition-firstboot-complete.service now).
  * Provide ignition-setup-user.service  (removed by upstream due
  to correctly being considered distro spcific), based on the old
  upstream version.
  * Renamed ignition-setup-user-suse.sh to ignition-setup-user.sh
  * Adapted ignition-generator-suse and module-setup.sh to use the
  custom ignition-setup-user.service (no overriding of parts of the
  service file necessary any more).
  * Synced ignition-kargs-helper script with upstream example
  * Raising minimum Go version to 1.15 as required by upstream</changelog>
  <changelog author="iforster@suse.com" date="1628769600">- is-live-image doesn't exist on *SUSE, and our live images don't
  use Ignition, so just add the Ignition device dependency to the
  service file directly.</changelog>
  <changelog author="iforster@suse.com" date="1629720000">- Make sure to create /boot/writable (may not be present in some
  images)</changelog>
  <changelog author="iforster@suse.com" date="1638360000">- Update to version 2.13.0:
  * news: add notes for 2.13.0
  * config/v3_4_exp: noProxy entries cannot be null
  * config/v3_4_exp: mark ignition.version as required
  * docs/supported-platforms: add some description about Nutanix
  * providers/nutanix: add Nutanix platform
  * tests: use umountPath as a thin wrapper around umountPartition
  * internal/providers: refactor handling of unmounting the mount path
  * tests: address gostatic-check warning
  * tests: Add base64 decoding test
  * Dockerfile.validate: build with Fedora 35
  * go.mod: update dataurl to 1.0.0
  * ci: give blackbox tests two hours to run
  * tests/filesystem: fix umountPartition retry loop
  * templates: skip vendoring the new version in favor of dependabot
  * go.mod: update vcontext
  * providers/virtualbox: read config from /Ignition/Config guest property
  * stages/filesystems: use mkfs.fat instead of mkfs.vfat
  * docs/supported-platforms: switch to Afterburn docs URL
  * docs/supported-platforms: drop reference to platform-specific agents
  * test: ensure all platforms are documented
  * docs/supported-platforms: add missing platforms
  * stages/files: rename `relabelDirsForFile` and add docstring
  * stages/files: make variable name follow Go convention
  * docs/supported-platforms: update platform names and URLs
  * docs/supported-platforms: sort by platform ID
  * docs/supported-platforms: add platform IDs
  * docs: Remove default layout from front matter
  * docs: Do not convert -- &amp; --- to en/em-dash
  * internal/*: change the location of Ignition report
  * internal/exec/util: rename FindFirstMissingDirForFile and tweak docs
  * providers/qemu: start reporting progress reading fw_cfg after 10 s
  * providers/qemu: optimize fw_cfg read size
  * ci: use coreos-ci-lib helper for kola testiso
  * *: gofmt 1.17
  * workflows: bump Go and golangci-lint
  * config: update versions in comments
- Removed obsolete ignition-rpmlintrc</changelog>
  <changelog author="fvogt@suse.com" date="1646395200">- Add support for NetworkManager in dracut:
  * ignition-enable-network.service, ignition-enable-network.sh</changelog>
  <changelog author="fvogt@suse.com" date="1646395201">- Remove /var/lib/YaST2/reconfig_system if a config was provided:
  * ignition-remove-reconfig_system.service</changelog>
  <changelog author="iforster@suse.com" date="1648209600">- Add ignition-touch-selinux-autorelabel.conf:
  Trigger SELinux autorelabel after Ignition runs; Ignition would
  support SELinux itself, however this is a compile time option, so
  it can't be used here.
- Filter commented lines in ignition-mount-initrd-fstab.service</changelog>
  <changelog author="iforster@suse.com" date="1649073600">- Don't include non-MarkDown files in documentation</changelog>
  <changelog author="iforster@suse.com" date="1649160000">- ignition-mount-initrd-fstab.service:
  - Don't ignore errors in loops
  - Unmount mount points recursively - a new submount may have
    appeared
  - Split umount part into own service file:
- ignition-umount-initrd-fstab.service:
  - Unmounts the additional mounts as soon as they are not
    required for Ignition any more; the ExecStop operation is
    running quite late in initrd and may unmount essential mount
    points flagged with "x-initrd.mount" (e.g. when storing /usr on
    a separate mount point). In theory this will also affect
    Ignition itself, but it hasn't been reported as a problem so
    far.</changelog>
  <changelog author="iforster@suse.com" date="1649419200">- Use /bin/sh instead of /usr/bin/sh (for backwards compatibility
  with SLE Micro 5.1) [bsc#1196679]</changelog>
  <changelog author="iforster@suse.com" date="1652875200">- Update to version 2.14.0:
  * NEWS: update v2.14.0
  * docs/operator-notes: add section on provisioning secrets
  * Dockerfile.validate: build with Fedora 36
  * internal/resource: fix gs:// fetches in GCE without a service account
  * docs/operator-notes: document supported S3 URL formats
  * internal/resource: fix S3 access point object ARNs
  * exec/util: fix infinite loop in Depth() if -root is relative
  * Add ignition-delete-config.service and ignition-rmcfg symlink
  * providers/virtualbox: support deleting Ignition configs
  * providers/virtualbox: add comment referencing VirtualBox source
  * providers/virtualbox: add define for GUEST_PROP_FN_GET_PROP
  * providers/virtualbox: add helper to set up hypervisor connection
  * providers/vmware: support deleting Ignition configs
  * main: add ignition-rmcfg multicall binary
  * go.mod: add github.com/beevik/etree
  * providers/vmware: switch to internal copy of OVF parser
  * internal/resource: fix bucket field in error message
  * internal/resource: derive AWS region hint from ARN partition field
  * internal/resource: simplify test
  * internal/resource: fix minor nits
  * provider/azure: try to fetch userdata from IMDS
  * providers/vmware: convert OVF tests to testify
  * providers/vmware: drop vmw-ovflib docs
  * providers/vmware: add verbatim copy of vmw-ovflib
  * providers/vmware: add constants for guestinfo and OVF property names
  * providers/virtualbox: fix reading properties with flags
  * internal/resource: support S3 access point URLs
- Update fixes CVE-2022-1706 from [bsc#1199524]; this introduces a new
  service "ignition-delete-config.service"
- Add ignition-rmcfg-suse.conf dropin to adapt to SUSE environment
- Use fixed paths in spec file for hardcoded installation paths</changelog>
</package>
<package pkgid="c6430653fe131607cf560c6bd41ef07b5864fc053dac0f8ae6f370412bfa21db" name="ignition-dracut-grub2" arch="aarch64">
  <version epoch="0" ver="2.14.0" rel="150300.6.7.1"/>
  <changelog author="iforster@suse.de" date="1603108800">- Update to version 2.7.0:
  * news: add notes for 2.7.0
  * docs: stabilize spec
  * gomod: bump go.opencensus.io to v0.22.5
  * docs: add section to spec stabilization for failing external tests
  * news: fix error in 2.3.0 changelog
  * tests: update for spec stabilization
  * internal: update for new experimental spec
  * config/v3_3_experimental: create new experimental package
  * config/v3_2_experimental: mark stable
  * interal/providers/*stack: drop timeout for config fetch
  * internal/providers/*stack: exit early if all configs error out
  * internal/providers/*stack: make ErrNotFound authoritative
  * doc: add clevis custom documentation
  * internal/exec/stages: add clevis custom support
  * config: add custom options for clevis devices
  * fetch-offline: immediately return ErrNeedNet on OpenStack
  * ci: unfreeze kernel
  * tests/*: add test for resizing an existing partition
  * docs/*: add resize partition info
  * stages/disks: support resizing an existing partition
  * config: add resize to schema
  * README: Minor changes for consistency
  * test: Use alternative marker for testing ignition config examples
  * docs: Convert and improve formatting for INI sections
  * docs: Add spec ordering instructions for new stable releases
  * docs: Add ToC for some long pages
  * docs: Rename Migrating ... to Upgrading Configs
  * docs: Fix link in Development page
  * docs: Add specs reference page
  * docs: Add index page inspired from README
  * docs: Add Config Validation example from README
  * docs: Add Jekyll front matter for existing pages
  * docs: Add Jekyll and theme config
  * internal: fix S3 region detection
  * docs: Follow-up for doc-&gt;docs renaming
  * docs: Rename doc to docs for GitHub Pages support
  * docs/getting-started: tiny cleanups
  * README: drop stray link target
  * doc: drop references to Container Linux
  * doc/development: drop section on running blackbox tests on CL
  * doc: add gs url scheme for bare metal platform
  * fetch: don't run if fetch-offline fetched a config
  * doc: fix LUKS indentation for configuration-v3_2_experimental docs
  * doc: Add shouldExist for users and groups
  * engine: fix logging interactions with fetch-offline
  * AzureStack: fix unfortunate typo of iso9660
  * *: add wipeVolume LUKS field
  * types: Use "path" instead of "path/filepath"
  * Add support for building 32 bit ARM version
  * Install Dracut modules with correct permissions
  * Add support for building 32 bit x86 version
  * doc: add LUKS examples &amp; operator notes
  * internal/stages/disks: allow LUKS device re-use
  * internal: use device aliases for LUKS
  * tests: fix partition.number0 partition size specification
  * blkid: drop some unsafe pointer casts
  * blkid: fix invalid pointer cast in DumpDisk()
  * {sgdisk,blkid}: use int64 for sector counts
  * sgdisk: stop putting sector counts in MiB fields
  * README: note that spec2x is unmaintained
  * release-checklist: drop support for Ignition 0.x
  * release-checklist: minor updates
- Remove upstreamed patches
  * 0001-fix-install-permissions.patch
  * 0003-fix-i386-build.patch
  * ignition-fix-arm32-installation.patch
- Refreshed to match new Ignition spec
  * 0002-allow-multiple-mounts-of-same-device.patch</changelog>
  <changelog author="fbui@suse.com" date="1604404800">- Replace  '%service_del_postun -n' with '%service_del_postun_without_restart'
  '-n' is deprecated and will be removed in the future.</changelog>
  <changelog author="hello@anthonyrabbito.com" date="1617192000">- Update to version 2.9.0:
  * news: add notes for 2.9.0
  * internal/providers: Run platform Init function before fetching config
  * internal/providers/aws: fix panic when an IMDSv2 token is present
  * internal/resource/http: re-order initial backoff ramping
  * internal/providers/util: drop dead code
  * ci: move Travis jobs to GitHub actions
  * *: fix errcheck warnings
  * internal/log: drop the error return to appease golanci-lint
  * internal/providers/packet: fix ineffassign warning
  * internal/exec/stages/files: fix the EntrySort test
  * internal: support IMDSv2 for AWS metadata service
  * config/*: require filesystems.format with wipeFilesystem or mountOptions
  * docs: make storage.filesystems.path field optional
  * aws: Log if we fail to determine the EC2 region
  * docs: move systemd.units.name uniqueness constraint to units
  * *: fix gosimple warnings
  * *: fix deadcode warnings
  * *: fix staticcheck warnings
  * config/*: fix nil deref on partitions with no number or label
  * config: add specs newer than 3.0 to TestConfigStructure
  * news: add notes for 2.8.1
  * config/merge: support struct pointers
  * test: drop stale comment
  * tests: Remove unused checkOnStrings
  * news: add notes for 2.8.0
  * config: deprecate MergeStruct()
  * config/merge: allow obtaining a transcript of merge operations
  * config/merge: access field name as fieldMeta.Name
  * config/merge: test primitive list items in slice case 1
  * config/merge: fix typo
  * config/merge: fix comments and add a couple more
  * config/util: remove stray print when parsing invalid JSON
  * vendor: update vcontext
  * docs/development: update dep list for blackbox tests
  * tests/positive: Add tests for masking and unmasking units
  * units: add support for unmasking systemd units
  * release-checklist: minor updates to the release instructions
  * tests/positive/general: add test for merging multiple base configs
  * tests/positive/general: update base config reference
  * docs/development: update spec stabilization to avoid CI breakage
  * release-checklist: drop download_ignition.sh
  * providers/system: support .d directory for base config fragments
  * docs/migrating-configs: spell out Google Cloud Storage
  * release-checklist: update packaging section</changelog>
  <changelog author="rpm@fthiessen.de" date="1622462400">- Update to version 2.10.1:
  * Breaking Changes:
  * Rename Custom struct to ClevisCustom
  * Embed Clevis and ClevisCustom structs in parents
  * Always include interior nodes in merge transcript
  * Add kernel argument support
  * Fix fetching userdata on AWS when IMDSv1 is disabled
  * Fix creating Tang-based LUKS volumes before network is up
  * Document storage.filesystems.wipeFilesystem default
  * Fix file mode of ignition-kargs-helper script
- Fix Go dependency, 1.13+ is required</changelog>
  <changelog author="iforster@suse.com" date="1625659200">- Implement missing ignition-kargs-helper script for kernel
  argument support</changelog>
  <changelog author="iforster@suse.com" date="1625659201">- Update to version 2.11.0:
  * news: add notes for 2.11.0
  * Upgraded docs
  * config/*: return report from previous parser when chaining
  * config/*: re-order testcases by version
  * tree: update for stable v3.3.0 and new v3.4.0-experimental
  * config/v3_4_experimental: adapt for experimental
  * config/v3_4_experimental: copy from config/v3_3
  * config/v3_3: adapt for stabilization
  * config/v3_3_experimental: rename to config/v3_3
  * config/v3_3_exp: pointerify ClevisCustom Config and Pin
  * config/v3_3_exp: pointerify Raid.Level
  * config/v3_3_exp: pointerify LinkEmbedded1.Target
  * stages/disks: simplify a check
  * config/v3_1/translate: don't point to field from input struct
  * config/v3_3_exp: drop devices from schema "required" field
  * config/*: validate that storage.raid.devices is non-empty
  * config/*/types: add RAID validation tests
  * config/shared/errors: fix ErrSparesUnsupportedForLevel message
  * config: fix comment
  * *: formally bump Go to 1.13
  * platform: add powervs platform
  * internal/providers/*stack: drop dead timeout code
  * stages/disks: improve error reporting for LUKS device reuse
  * ignition-setup-user.service: drop Before=multipathd.service
  * Dockerfile: build ignition-validate container using Fedora
  * workflows: test on Go 1.16
  * tests/*: verify deletion of block device w/o creating a FS
  * *: allow erasing block device without creating a filesystem
  * *: rename other projects' master branches to main
  * *: rename master branch to main
  * config/*: add export functions for parsing any config version &lt; N
  * config/*: refactor config.go's Parse() to use GetConfigVersion
  * config/* : minor cleanup
- Refreshed to match new Ignition spec
  * 0002-allow-multiple-mounts-of-same-device.patch</changelog>
  <changelog author="iforster@suse.com" date="1625745600">- If a Combustion device was mounted, then unmount it in
  ignition-kargs-helper - the replacement script will be put on
  the same location</changelog>
  <changelog author="iforster@suse.com" date="1626868800">- Ignore error return code if no virtualization environment
  detected. [bsc#1188479]
  This makes it possible to use Ignition also on bare metal (e.g.
  when dumping images directly to disk) without adding a
  ignition.platform.id parameter.</changelog>
  <changelog author="kukuk@suse.com" date="1627473600">- Include vfat and nls kernel modules into initrd so that we can
  read the ignition configuration from USB drives [bsc#1184202]</changelog>
  <changelog author="iforster@suse.com" date="1628510400">- Update to version 2.12.0:
  * news: add notes for 2.12.0
  * stages/files: add previousReport to result report
  * tests: fix linter warning
  * workflows: limit permissions to reading repo contents
  * workflows: bump linter version
  * go.mod: revendor
  * Drop EOL Go versions
  * internal/distro: drop DiskByIDDir
  * providers/azure: add support for azure gen2 VMs [bsc#1196679]
  * stages/mount: correctly relabel the root of a fresh ext4 filesystem
  * exec: fix permissions for mountpoints in home dirs
  * tests: drop os.ModeDir requirement in mode of output directories
  * examples: reboot with --force
  * exec/util: add blkid API to query block devices based on FSTYPE
  * stages/files: use IntToPtr() in createCrypttabEntries()
  * stages/files: write result report to /var/lib/ignition
  * engine: persist fetched config summaries in State
  * stages/disks: use State to persist keyfiles for files stage
  * *: add general mechanism for persisting state between stages
  * main: drop -clear-cache flag
  * engine: don't hardcode neednet path
  * fetch-offline: return ErrNeedNet if we need net
  * engine: switch Engine.logReport() to pointer receiver
  * engine: fix incorrect error in log message
  * dracut: drop ignition-setup-user.service
  * dracut: drop reference to ignition-setup-base.service
  * providers/gcp: access GCP metadata service by IP address
  * Remove ignition-firstboot-complete.service
  * OWNERS: remove
  * internal/exec/util: drop device argument from cResultToErr()
  * docs/config*: document storage.luks.clevis.threshold default
  * ci: disable spec bump external test workaround
  * docs: Add Ignition release / Spec version table
  * templates: update example releng signing ticket
  * templates: don't update %gotest lines
  * Provide ignition-firstboot-complete.service (removed by upstream
  due to correctly being considered distro spcific), based on the
  old upstream version; removed all non-SUSE specific stuff and
  integrated our own changes
  * Removed change-ignition-firstboot-path.conf (changes are
  integrated into ignition-firstboot-complete.service now).
  * Provide ignition-setup-user.service  (removed by upstream due
  to correctly being considered distro spcific), based on the old
  upstream version.
  * Renamed ignition-setup-user-suse.sh to ignition-setup-user.sh
  * Adapted ignition-generator-suse and module-setup.sh to use the
  custom ignition-setup-user.service (no overriding of parts of the
  service file necessary any more).
  * Synced ignition-kargs-helper script with upstream example
  * Raising minimum Go version to 1.15 as required by upstream</changelog>
  <changelog author="iforster@suse.com" date="1628769600">- is-live-image doesn't exist on *SUSE, and our live images don't
  use Ignition, so just add the Ignition device dependency to the
  service file directly.</changelog>
  <changelog author="iforster@suse.com" date="1629720000">- Make sure to create /boot/writable (may not be present in some
  images)</changelog>
  <changelog author="iforster@suse.com" date="1638360000">- Update to version 2.13.0:
  * news: add notes for 2.13.0
  * config/v3_4_exp: noProxy entries cannot be null
  * config/v3_4_exp: mark ignition.version as required
  * docs/supported-platforms: add some description about Nutanix
  * providers/nutanix: add Nutanix platform
  * tests: use umountPath as a thin wrapper around umountPartition
  * internal/providers: refactor handling of unmounting the mount path
  * tests: address gostatic-check warning
  * tests: Add base64 decoding test
  * Dockerfile.validate: build with Fedora 35
  * go.mod: update dataurl to 1.0.0
  * ci: give blackbox tests two hours to run
  * tests/filesystem: fix umountPartition retry loop
  * templates: skip vendoring the new version in favor of dependabot
  * go.mod: update vcontext
  * providers/virtualbox: read config from /Ignition/Config guest property
  * stages/filesystems: use mkfs.fat instead of mkfs.vfat
  * docs/supported-platforms: switch to Afterburn docs URL
  * docs/supported-platforms: drop reference to platform-specific agents
  * test: ensure all platforms are documented
  * docs/supported-platforms: add missing platforms
  * stages/files: rename `relabelDirsForFile` and add docstring
  * stages/files: make variable name follow Go convention
  * docs/supported-platforms: update platform names and URLs
  * docs/supported-platforms: sort by platform ID
  * docs/supported-platforms: add platform IDs
  * docs: Remove default layout from front matter
  * docs: Do not convert -- &amp; --- to en/em-dash
  * internal/*: change the location of Ignition report
  * internal/exec/util: rename FindFirstMissingDirForFile and tweak docs
  * providers/qemu: start reporting progress reading fw_cfg after 10 s
  * providers/qemu: optimize fw_cfg read size
  * ci: use coreos-ci-lib helper for kola testiso
  * *: gofmt 1.17
  * workflows: bump Go and golangci-lint
  * config: update versions in comments
- Removed obsolete ignition-rpmlintrc</changelog>
  <changelog author="fvogt@suse.com" date="1646395200">- Add support for NetworkManager in dracut:
  * ignition-enable-network.service, ignition-enable-network.sh</changelog>
  <changelog author="fvogt@suse.com" date="1646395201">- Remove /var/lib/YaST2/reconfig_system if a config was provided:
  * ignition-remove-reconfig_system.service</changelog>
  <changelog author="iforster@suse.com" date="1648209600">- Add ignition-touch-selinux-autorelabel.conf:
  Trigger SELinux autorelabel after Ignition runs; Ignition would
  support SELinux itself, however this is a compile time option, so
  it can't be used here.
- Filter commented lines in ignition-mount-initrd-fstab.service</changelog>
  <changelog author="iforster@suse.com" date="1649073600">- Don't include non-MarkDown files in documentation</changelog>
  <changelog author="iforster@suse.com" date="1649160000">- ignition-mount-initrd-fstab.service:
  - Don't ignore errors in loops
  - Unmount mount points recursively - a new submount may have
    appeared
  - Split umount part into own service file:
- ignition-umount-initrd-fstab.service:
  - Unmounts the additional mounts as soon as they are not
    required for Ignition any more; the ExecStop operation is
    running quite late in initrd and may unmount essential mount
    points flagged with "x-initrd.mount" (e.g. when storing /usr on
    a separate mount point). In theory this will also affect
    Ignition itself, but it hasn't been reported as a problem so
    far.</changelog>
  <changelog author="iforster@suse.com" date="1649419200">- Use /bin/sh instead of /usr/bin/sh (for backwards compatibility
  with SLE Micro 5.1) [bsc#1196679]</changelog>
  <changelog author="iforster@suse.com" date="1652875200">- Update to version 2.14.0:
  * NEWS: update v2.14.0
  * docs/operator-notes: add section on provisioning secrets
  * Dockerfile.validate: build with Fedora 36
  * internal/resource: fix gs:// fetches in GCE without a service account
  * docs/operator-notes: document supported S3 URL formats
  * internal/resource: fix S3 access point object ARNs
  * exec/util: fix infinite loop in Depth() if -root is relative
  * Add ignition-delete-config.service and ignition-rmcfg symlink
  * providers/virtualbox: support deleting Ignition configs
  * providers/virtualbox: add comment referencing VirtualBox source
  * providers/virtualbox: add define for GUEST_PROP_FN_GET_PROP
  * providers/virtualbox: add helper to set up hypervisor connection
  * providers/vmware: support deleting Ignition configs
  * main: add ignition-rmcfg multicall binary
  * go.mod: add github.com/beevik/etree
  * providers/vmware: switch to internal copy of OVF parser
  * internal/resource: fix bucket field in error message
  * internal/resource: derive AWS region hint from ARN partition field
  * internal/resource: simplify test
  * internal/resource: fix minor nits
  * provider/azure: try to fetch userdata from IMDS
  * providers/vmware: convert OVF tests to testify
  * providers/vmware: drop vmw-ovflib docs
  * providers/vmware: add verbatim copy of vmw-ovflib
  * providers/vmware: add constants for guestinfo and OVF property names
  * providers/virtualbox: fix reading properties with flags
  * internal/resource: support S3 access point URLs
- Update fixes CVE-2022-1706 from [bsc#1199524]; this introduces a new
  service "ignition-delete-config.service"
- Add ignition-rmcfg-suse.conf dropin to adapt to SUSE environment
- Use fixed paths in spec file for hardcoded installation paths</changelog>
</package>
<package pkgid="3d9c4e6e95fe38cd7e92a6ba96af1d3f2bdb97d8b223e7cf37328b6a6147ced5" name="ignition-dracut-grub2" arch="x86_64">
  <version epoch="0" ver="2.14.0" rel="150300.6.7.1"/>
  <changelog author="iforster@suse.de" date="1603108800">- Update to version 2.7.0:
  * news: add notes for 2.7.0
  * docs: stabilize spec
  * gomod: bump go.opencensus.io to v0.22.5
  * docs: add section to spec stabilization for failing external tests
  * news: fix error in 2.3.0 changelog
  * tests: update for spec stabilization
  * internal: update for new experimental spec
  * config/v3_3_experimental: create new experimental package
  * config/v3_2_experimental: mark stable
  * interal/providers/*stack: drop timeout for config fetch
  * internal/providers/*stack: exit early if all configs error out
  * internal/providers/*stack: make ErrNotFound authoritative
  * doc: add clevis custom documentation
  * internal/exec/stages: add clevis custom support
  * config: add custom options for clevis devices
  * fetch-offline: immediately return ErrNeedNet on OpenStack
  * ci: unfreeze kernel
  * tests/*: add test for resizing an existing partition
  * docs/*: add resize partition info
  * stages/disks: support resizing an existing partition
  * config: add resize to schema
  * README: Minor changes for consistency
  * test: Use alternative marker for testing ignition config examples
  * docs: Convert and improve formatting for INI sections
  * docs: Add spec ordering instructions for new stable releases
  * docs: Add ToC for some long pages
  * docs: Rename Migrating ... to Upgrading Configs
  * docs: Fix link in Development page
  * docs: Add specs reference page
  * docs: Add index page inspired from README
  * docs: Add Config Validation example from README
  * docs: Add Jekyll front matter for existing pages
  * docs: Add Jekyll and theme config
  * internal: fix S3 region detection
  * docs: Follow-up for doc-&gt;docs renaming
  * docs: Rename doc to docs for GitHub Pages support
  * docs/getting-started: tiny cleanups
  * README: drop stray link target
  * doc: drop references to Container Linux
  * doc/development: drop section on running blackbox tests on CL
  * doc: add gs url scheme for bare metal platform
  * fetch: don't run if fetch-offline fetched a config
  * doc: fix LUKS indentation for configuration-v3_2_experimental docs
  * doc: Add shouldExist for users and groups
  * engine: fix logging interactions with fetch-offline
  * AzureStack: fix unfortunate typo of iso9660
  * *: add wipeVolume LUKS field
  * types: Use "path" instead of "path/filepath"
  * Add support for building 32 bit ARM version
  * Install Dracut modules with correct permissions
  * Add support for building 32 bit x86 version
  * doc: add LUKS examples &amp; operator notes
  * internal/stages/disks: allow LUKS device re-use
  * internal: use device aliases for LUKS
  * tests: fix partition.number0 partition size specification
  * blkid: drop some unsafe pointer casts
  * blkid: fix invalid pointer cast in DumpDisk()
  * {sgdisk,blkid}: use int64 for sector counts
  * sgdisk: stop putting sector counts in MiB fields
  * README: note that spec2x is unmaintained
  * release-checklist: drop support for Ignition 0.x
  * release-checklist: minor updates
- Remove upstreamed patches
  * 0001-fix-install-permissions.patch
  * 0003-fix-i386-build.patch
  * ignition-fix-arm32-installation.patch
- Refreshed to match new Ignition spec
  * 0002-allow-multiple-mounts-of-same-device.patch</changelog>
  <changelog author="fbui@suse.com" date="1604404800">- Replace  '%service_del_postun -n' with '%service_del_postun_without_restart'
  '-n' is deprecated and will be removed in the future.</changelog>
  <changelog author="hello@anthonyrabbito.com" date="1617192000">- Update to version 2.9.0:
  * news: add notes for 2.9.0
  * internal/providers: Run platform Init function before fetching config
  * internal/providers/aws: fix panic when an IMDSv2 token is present
  * internal/resource/http: re-order initial backoff ramping
  * internal/providers/util: drop dead code
  * ci: move Travis jobs to GitHub actions
  * *: fix errcheck warnings
  * internal/log: drop the error return to appease golanci-lint
  * internal/providers/packet: fix ineffassign warning
  * internal/exec/stages/files: fix the EntrySort test
  * internal: support IMDSv2 for AWS metadata service
  * config/*: require filesystems.format with wipeFilesystem or mountOptions
  * docs: make storage.filesystems.path field optional
  * aws: Log if we fail to determine the EC2 region
  * docs: move systemd.units.name uniqueness constraint to units
  * *: fix gosimple warnings
  * *: fix deadcode warnings
  * *: fix staticcheck warnings
  * config/*: fix nil deref on partitions with no number or label
  * config: add specs newer than 3.0 to TestConfigStructure
  * news: add notes for 2.8.1
  * config/merge: support struct pointers
  * test: drop stale comment
  * tests: Remove unused checkOnStrings
  * news: add notes for 2.8.0
  * config: deprecate MergeStruct()
  * config/merge: allow obtaining a transcript of merge operations
  * config/merge: access field name as fieldMeta.Name
  * config/merge: test primitive list items in slice case 1
  * config/merge: fix typo
  * config/merge: fix comments and add a couple more
  * config/util: remove stray print when parsing invalid JSON
  * vendor: update vcontext
  * docs/development: update dep list for blackbox tests
  * tests/positive: Add tests for masking and unmasking units
  * units: add support for unmasking systemd units
  * release-checklist: minor updates to the release instructions
  * tests/positive/general: add test for merging multiple base configs
  * tests/positive/general: update base config reference
  * docs/development: update spec stabilization to avoid CI breakage
  * release-checklist: drop download_ignition.sh
  * providers/system: support .d directory for base config fragments
  * docs/migrating-configs: spell out Google Cloud Storage
  * release-checklist: update packaging section</changelog>
  <changelog author="rpm@fthiessen.de" date="1622462400">- Update to version 2.10.1:
  * Breaking Changes:
  * Rename Custom struct to ClevisCustom
  * Embed Clevis and ClevisCustom structs in parents
  * Always include interior nodes in merge transcript
  * Add kernel argument support
  * Fix fetching userdata on AWS when IMDSv1 is disabled
  * Fix creating Tang-based LUKS volumes before network is up
  * Document storage.filesystems.wipeFilesystem default
  * Fix file mode of ignition-kargs-helper script
- Fix Go dependency, 1.13+ is required</changelog>
  <changelog author="iforster@suse.com" date="1625659200">- Implement missing ignition-kargs-helper script for kernel
  argument support</changelog>
  <changelog author="iforster@suse.com" date="1625659201">- Update to version 2.11.0:
  * news: add notes for 2.11.0
  * Upgraded docs
  * config/*: return report from previous parser when chaining
  * config/*: re-order testcases by version
  * tree: update for stable v3.3.0 and new v3.4.0-experimental
  * config/v3_4_experimental: adapt for experimental
  * config/v3_4_experimental: copy from config/v3_3
  * config/v3_3: adapt for stabilization
  * config/v3_3_experimental: rename to config/v3_3
  * config/v3_3_exp: pointerify ClevisCustom Config and Pin
  * config/v3_3_exp: pointerify Raid.Level
  * config/v3_3_exp: pointerify LinkEmbedded1.Target
  * stages/disks: simplify a check
  * config/v3_1/translate: don't point to field from input struct
  * config/v3_3_exp: drop devices from schema "required" field
  * config/*: validate that storage.raid.devices is non-empty
  * config/*/types: add RAID validation tests
  * config/shared/errors: fix ErrSparesUnsupportedForLevel message
  * config: fix comment
  * *: formally bump Go to 1.13
  * platform: add powervs platform
  * internal/providers/*stack: drop dead timeout code
  * stages/disks: improve error reporting for LUKS device reuse
  * ignition-setup-user.service: drop Before=multipathd.service
  * Dockerfile: build ignition-validate container using Fedora
  * workflows: test on Go 1.16
  * tests/*: verify deletion of block device w/o creating a FS
  * *: allow erasing block device without creating a filesystem
  * *: rename other projects' master branches to main
  * *: rename master branch to main
  * config/*: add export functions for parsing any config version &lt; N
  * config/*: refactor config.go's Parse() to use GetConfigVersion
  * config/* : minor cleanup
- Refreshed to match new Ignition spec
  * 0002-allow-multiple-mounts-of-same-device.patch</changelog>
  <changelog author="iforster@suse.com" date="1625745600">- If a Combustion device was mounted, then unmount it in
  ignition-kargs-helper - the replacement script will be put on
  the same location</changelog>
  <changelog author="iforster@suse.com" date="1626868800">- Ignore error return code if no virtualization environment
  detected. [bsc#1188479]
  This makes it possible to use Ignition also on bare metal (e.g.
  when dumping images directly to disk) without adding a
  ignition.platform.id parameter.</changelog>
  <changelog author="kukuk@suse.com" date="1627473600">- Include vfat and nls kernel modules into initrd so that we can
  read the ignition configuration from USB drives [bsc#1184202]</changelog>
  <changelog author="iforster@suse.com" date="1628510400">- Update to version 2.12.0:
  * news: add notes for 2.12.0
  * stages/files: add previousReport to result report
  * tests: fix linter warning
  * workflows: limit permissions to reading repo contents
  * workflows: bump linter version
  * go.mod: revendor
  * Drop EOL Go versions
  * internal/distro: drop DiskByIDDir
  * providers/azure: add support for azure gen2 VMs [bsc#1196679]
  * stages/mount: correctly relabel the root of a fresh ext4 filesystem
  * exec: fix permissions for mountpoints in home dirs
  * tests: drop os.ModeDir requirement in mode of output directories
  * examples: reboot with --force
  * exec/util: add blkid API to query block devices based on FSTYPE
  * stages/files: use IntToPtr() in createCrypttabEntries()
  * stages/files: write result report to /var/lib/ignition
  * engine: persist fetched config summaries in State
  * stages/disks: use State to persist keyfiles for files stage
  * *: add general mechanism for persisting state between stages
  * main: drop -clear-cache flag
  * engine: don't hardcode neednet path
  * fetch-offline: return ErrNeedNet if we need net
  * engine: switch Engine.logReport() to pointer receiver
  * engine: fix incorrect error in log message
  * dracut: drop ignition-setup-user.service
  * dracut: drop reference to ignition-setup-base.service
  * providers/gcp: access GCP metadata service by IP address
  * Remove ignition-firstboot-complete.service
  * OWNERS: remove
  * internal/exec/util: drop device argument from cResultToErr()
  * docs/config*: document storage.luks.clevis.threshold default
  * ci: disable spec bump external test workaround
  * docs: Add Ignition release / Spec version table
  * templates: update example releng signing ticket
  * templates: don't update %gotest lines
  * Provide ignition-firstboot-complete.service (removed by upstream
  due to correctly being considered distro spcific), based on the
  old upstream version; removed all non-SUSE specific stuff and
  integrated our own changes
  * Removed change-ignition-firstboot-path.conf (changes are
  integrated into ignition-firstboot-complete.service now).
  * Provide ignition-setup-user.service  (removed by upstream due
  to correctly being considered distro spcific), based on the old
  upstream version.
  * Renamed ignition-setup-user-suse.sh to ignition-setup-user.sh
  * Adapted ignition-generator-suse and module-setup.sh to use the
  custom ignition-setup-user.service (no overriding of parts of the
  service file necessary any more).
  * Synced ignition-kargs-helper script with upstream example
  * Raising minimum Go version to 1.15 as required by upstream</changelog>
  <changelog author="iforster@suse.com" date="1628769600">- is-live-image doesn't exist on *SUSE, and our live images don't
  use Ignition, so just add the Ignition device dependency to the
  service file directly.</changelog>
  <changelog author="iforster@suse.com" date="1629720000">- Make sure to create /boot/writable (may not be present in some
  images)</changelog>
  <changelog author="iforster@suse.com" date="1638360000">- Update to version 2.13.0:
  * news: add notes for 2.13.0
  * config/v3_4_exp: noProxy entries cannot be null
  * config/v3_4_exp: mark ignition.version as required
  * docs/supported-platforms: add some description about Nutanix
  * providers/nutanix: add Nutanix platform
  * tests: use umountPath as a thin wrapper around umountPartition
  * internal/providers: refactor handling of unmounting the mount path
  * tests: address gostatic-check warning
  * tests: Add base64 decoding test
  * Dockerfile.validate: build with Fedora 35
  * go.mod: update dataurl to 1.0.0
  * ci: give blackbox tests two hours to run
  * tests/filesystem: fix umountPartition retry loop
  * templates: skip vendoring the new version in favor of dependabot
  * go.mod: update vcontext
  * providers/virtualbox: read config from /Ignition/Config guest property
  * stages/filesystems: use mkfs.fat instead of mkfs.vfat
  * docs/supported-platforms: switch to Afterburn docs URL
  * docs/supported-platforms: drop reference to platform-specific agents
  * test: ensure all platforms are documented
  * docs/supported-platforms: add missing platforms
  * stages/files: rename `relabelDirsForFile` and add docstring
  * stages/files: make variable name follow Go convention
  * docs/supported-platforms: update platform names and URLs
  * docs/supported-platforms: sort by platform ID
  * docs/supported-platforms: add platform IDs
  * docs: Remove default layout from front matter
  * docs: Do not convert -- &amp; --- to en/em-dash
  * internal/*: change the location of Ignition report
  * internal/exec/util: rename FindFirstMissingDirForFile and tweak docs
  * providers/qemu: start reporting progress reading fw_cfg after 10 s
  * providers/qemu: optimize fw_cfg read size
  * ci: use coreos-ci-lib helper for kola testiso
  * *: gofmt 1.17
  * workflows: bump Go and golangci-lint
  * config: update versions in comments
- Removed obsolete ignition-rpmlintrc</changelog>
  <changelog author="fvogt@suse.com" date="1646395200">- Add support for NetworkManager in dracut:
  * ignition-enable-network.service, ignition-enable-network.sh</changelog>
  <changelog author="fvogt@suse.com" date="1646395201">- Remove /var/lib/YaST2/reconfig_system if a config was provided:
  * ignition-remove-reconfig_system.service</changelog>
  <changelog author="iforster@suse.com" date="1648209600">- Add ignition-touch-selinux-autorelabel.conf:
  Trigger SELinux autorelabel after Ignition runs; Ignition would
  support SELinux itself, however this is a compile time option, so
  it can't be used here.
- Filter commented lines in ignition-mount-initrd-fstab.service</changelog>
  <changelog author="iforster@suse.com" date="1649073600">- Don't include non-MarkDown files in documentation</changelog>
  <changelog author="iforster@suse.com" date="1649160000">- ignition-mount-initrd-fstab.service:
  - Don't ignore errors in loops
  - Unmount mount points recursively - a new submount may have
    appeared
  - Split umount part into own service file:
- ignition-umount-initrd-fstab.service:
  - Unmounts the additional mounts as soon as they are not
    required for Ignition any more; the ExecStop operation is
    running quite late in initrd and may unmount essential mount
    points flagged with "x-initrd.mount" (e.g. when storing /usr on
    a separate mount point). In theory this will also affect
    Ignition itself, but it hasn't been reported as a problem so
    far.</changelog>
  <changelog author="iforster@suse.com" date="1649419200">- Use /bin/sh instead of /usr/bin/sh (for backwards compatibility
  with SLE Micro 5.1) [bsc#1196679]</changelog>
  <changelog author="iforster@suse.com" date="1652875200">- Update to version 2.14.0:
  * NEWS: update v2.14.0
  * docs/operator-notes: add section on provisioning secrets
  * Dockerfile.validate: build with Fedora 36
  * internal/resource: fix gs:// fetches in GCE without a service account
  * docs/operator-notes: document supported S3 URL formats
  * internal/resource: fix S3 access point object ARNs
  * exec/util: fix infinite loop in Depth() if -root is relative
  * Add ignition-delete-config.service and ignition-rmcfg symlink
  * providers/virtualbox: support deleting Ignition configs
  * providers/virtualbox: add comment referencing VirtualBox source
  * providers/virtualbox: add define for GUEST_PROP_FN_GET_PROP
  * providers/virtualbox: add helper to set up hypervisor connection
  * providers/vmware: support deleting Ignition configs
  * main: add ignition-rmcfg multicall binary
  * go.mod: add github.com/beevik/etree
  * providers/vmware: switch to internal copy of OVF parser
  * internal/resource: fix bucket field in error message
  * internal/resource: derive AWS region hint from ARN partition field
  * internal/resource: simplify test
  * internal/resource: fix minor nits
  * provider/azure: try to fetch userdata from IMDS
  * providers/vmware: convert OVF tests to testify
  * providers/vmware: drop vmw-ovflib docs
  * providers/vmware: add verbatim copy of vmw-ovflib
  * providers/vmware: add constants for guestinfo and OVF property names
  * providers/virtualbox: fix reading properties with flags
  * internal/resource: support S3 access point URLs
- Update fixes CVE-2022-1706 from [bsc#1199524]; this introduces a new
  service "ignition-delete-config.service"
- Add ignition-rmcfg-suse.conf dropin to adapt to SUSE environment
- Use fixed paths in spec file for hardcoded installation paths</changelog>
</package>
<package pkgid="833e0c6bd293aea11c09fc851a03fde0a61987ac30c7515d7eec77a218cd716f" name="kernel-default" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="150300.59.76.1"/>
  <changelog author="jgross@suse.com" date="1654862400">- kvm: fix wrong exception emulation in check_rdtsc (git-fixes).
- commit 5797afc</changelog>
  <changelog author="jgross@suse.com" date="1654862401">- KVM: nVMX: Query current VMCS when determining if MSR bitmaps
  are in use (git-fixes).
- commit d008aa3</changelog>
  <changelog author="jgross@suse.com" date="1654862402">- KVM: x86: Fix emulation in writing cr8 (git-fixes).
- commit a28f4e5</changelog>
  <changelog author="jgross@suse.com" date="1654862403">- KVM: x86/emulator: Defer not-present segment check in
  __load_segment_descriptor() (git-fixes).
- commit 27bee90</changelog>
  <changelog author="jgross@suse.com" date="1654862404">- kvm: x86/cpuid: Only provide CPUID leaf 0xA if host has
  architectural PMU (git-fixes).
- commit b46bf26</changelog>
  <changelog author="ohering@suse.de" date="1655121600">- PCI: hv: Fix NUMA node assignment when kernel boots with custom
  NUMA topology (bsc#1199365).
- commit 533234b</changelog>
  <changelog author="jack@suse.cz" date="1655121601">- blk-mq: fix tag_get wait task can't be awakened (bsc#1200263).
- commit 0a1fb57</changelog>
  <changelog author="jack@suse.cz" date="1655121602">- blk-mq: Fix wrong wakeup batch configuration which will cause
  hang (bsc#1200263).
- commit d25a54b</changelog>
  <changelog author="osalvador@suse.de" date="1655208000">- Rename colliding patches before the next origin/cve/linux-5.3 -&gt; SLE15-SP3 merge
- commit 070ca14</changelog>
  <changelog author="neilb@suse.de" date="1655208001">- NFS: Don't report ENOSPC write errors twice (git-fixes).
- nfsd: Fix null-ptr-deref in nfsd_fill_super() (git-fixes).
- md: fix an incorrect NULL check in md_reload_sb (git-fixes).
- md: fix an incorrect NULL check in does_sb_need_changing
  (git-fixes).
- raid5: introduce MD_BROKEN (git-fixes).
- commit a49fc21</changelog>
  <changelog author="ptesarik@suse.cz" date="1655208002">- s390/mcck: isolate SIE instruction when setting CIF_MCCK_GUEST
  flag (git-fixes).
- s390/crypto: fix scatterwalk_unmap() callers in AES-GCM
  (git-fixes).
- s390/lcs: fix variable dereferenced before check (git-fixes).
- s390/ctcm: fix potential memory leak (git-fixes).
- s390/ctcm: fix variable dereferenced before check (git-fixes).
- s390/dasd: Fix read inconsistency for ESE DASD devices
  (bsc#1200206 LTC#198455).
- s390/dasd: Fix read for ESE with blksize &lt; 4k (bsc#1200206
  LTC#198455).
- s390/dasd: prevent double format of tracks for ESE devices
  (bsc#1200207 LTC#198454).
- s390/dasd: fix data corruption for ESE devices (bsc#1200207
  LTC#198454).
- KVM: s390: vsie/gmap: reduce gmap_rmap overhead (git-fixes).
- s390/nmi: handle vector validity failures for KVM guests
  (git-fixes).
- s390/nmi: handle guarded storage validity failures for KVM
  guests (git-fixes).
- vfio/ccw: Remove unneeded GFP_DMA (git-fixes).
- KVM: s390: pv: avoid stalls for kvm_s390_pv_init_vm (git-fixes).
- KVM: s390: pv: avoid double free of sida page (git-fixes).
- KVM: s390: pv: add macros for UVC CC values (git-fixes).
- s390: fix strrchr() implementation (git-fixes).
- s390/pv: fix the forcing of the swiotlb (git-fixes).
- s390/qdio: cancel the ESTABLISH ccw after timeout (git-fixes).
- s390/qdio: fix roll-back after timeout on ESTABLISH ccw
  (git-fixes).
- s390/ftrace: fix ftrace_update_ftrace_func implementation
  (git-fixes).
- s390/cio: dont call css_wait_for_slow_path() inside a lock
  (git-fixes).
- s390/cio: Fix the "type" field in s390_cio_tpi tracepoint
  (git-fixes).
- s390/mcck: fix invalid KVM guest condition check (git-fixes).
- vfio-ccw: Check initialized flag in cp_init() (git-fixes).
- s390: fix detection of vector enhancements facility 1 vs. vector
  packed decimal facility (git-fixes).
- s390/vfio-ap: fix circular lockdep when setting/clearing crypto
  masks (git-fixes).
- virtio/s390: implement virtio-ccw revision 2 correctly
  (git-fixes).
- commit 61a09d5</changelog>
  <changelog author="osalvador@suse.de" date="1655208003">- Update config files
- commit 0d6e862</changelog>
  <changelog author="oneukum@suse.com" date="1655208004">- platform/x86: wmi: Replace read_takes_no_args with a flags field
  (git-fixes).
- commit 2771a0e</changelog>
  <changelog author="oneukum@suse.com" date="1655208005">- platform/x86: wmi: Fix driver-&gt;notify() vs -&gt;probe() race
  (git-fixes).
- commit e932131</changelog>
  <changelog author="osalvador@suse.de" date="1655208006">- Refresh 0002-PKCS-7-Check-codeSigning-EKU-for-kernel-module-and-k.patch
- commit 4835ae7</changelog>
  <changelog author="tiwai@suse.de" date="1655294400">- ata: libata-transport: fix {dma|pio|xfer}_mode sysfs files
  (git-fixes).
- ALSA: hda/conexant - Fix loopback issue with CX20632
  (git-fixes).
- ALSA: usb-audio: Set up (implicit) sync for Saffire 6
  (git-fixes).
- ALSA: usb-audio: Skip generic sync EP parse for secondary EP
  (git-fixes).
- clocksource/drivers/oxnas-rps: Fix irq_of_parse_and_map()
  return value (git-fixes).
- clocksource/drivers/sp804: Avoid error on multiple instances
  (git-fixes).
- dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size
  data type (git-fixes).
- ASoC: max98357a: remove dependency on GPIOLIB (git-fixes).
- ASoC: rt5645: Fix errorenous cleanup order (git-fixes).
- ASoC: tscs454: Add endianness flag in snd_soc_component_driver
  (git-fixes).
- ASoC: dapm: Don't fold register value changes into notifications
  (git-fixes).
- ALSA: usb-audio: Workaround for clock setup on TEAC devices
  (git-fixes).
- ath9k: fix QCA9561 PA bias level (git-fixes).
- b43: Fix assigning negative value to unsigned variable
  (git-fixes).
- b43legacy: Fix assigning negative value to unsigned variable
  (git-fixes).
- ACPI: sysfs: Fix BERT error region memory mapping (git-fixes).
- ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default
  (git-fixes).
- cfg80211: set custom regdomain after wiphy registration
  (git-fixes).
- ACPI: sysfs: Make sparse happy about address space in use
  (git-fixes).
- commit d8922a7</changelog>
  <changelog author="tiwai@suse.de" date="1655294401">- drm/atomic: Force bridge self-refresh-exit on CRTC switch
  (git-fixes).
- drm/bridge: analogix_dp: Support PSR-exit to disable transition
  (git-fixes).
- Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag
  (git-fixes).
- iio: dummy: iio_simple_dummy: check the return value of
  kstrdup() (git-fixes).
- drm/amdgpu/cs: make commands with 0 chunks illegal behaviour
  (git-fixes).
- drm/radeon: fix a possible null pointer dereference (git-fixes).
- i2c: cadence: Increase timeout per message if necessary
  (git-fixes).
- drm/amdgpu/ucode: Remove firmware load type check in
  amdgpu_ucode_free_bo (git-fixes).
- drm: msm: fix error check return value of irq_of_parse_and_map()
  (git-fixes).
- drm/plane: Move range check for format_count earlier
  (git-fixes).
- drm/komeda: return early if drm_universal_plane_init() fails
  (git-fixes).
- fbcon: Consistently protect deferred_takeover with
  console_lock() (git-fixes).
- drm/virtio: fix NULL pointer dereference in
  virtio_gpu_conn_get_modes (git-fixes).
- drm/i915: Fix -Wstringop-overflow warning in call to
  intel_read_wm_latency() (git-fixes).
- iwlwifi: mvm: fix assert 1F04 upon reconfig (git-fixes).
- mac80211: upgrade passive scan to active scan on DFS channels
  after beacon rx (git-fixes).
- ipw2x00: Fix potential NULL dereference in libipw_xmit()
  (git-fixes).
- HID: bigben: fix slab-out-of-bounds Write in bigben_probe
  (git-fixes).
- HID: multitouch: Add support for Google Whiskers Touchpad
  (git-fixes).
- hwmon: Make chip parameter for with_info API mandatory
  (git-fixes).
- irqchip: irq-xtensa-mx: fix initial IRQ affinity (git-fixes).
- irqchip/armada-370-xp: Do not touch Performance Counter Overflow
  on A375, A38x, A39x (git-fixes).
- irqchip/aspeed-i2c-ic: Fix irq_of_parse_and_map() return value
  (git-fixes).
- irqchip/exiu: Fix acknowledgment of edge triggered interrupts
  (git-fixes).
- efi: Add missing prototype for efi_capsule_setup_info
  (git-fixes).
- drivers: i2c: thunderx: Allow driver to work with ACPI defined
  TWSI controllers (git-fixes).
- i2c: ismt: Provide a DMA buffer for Interrupt Cause Logging
  (git-fixes).
- Input: goodix - fix spurious key release events (git-fixes).
- commit 71b82f0</changelog>
  <changelog author="tiwai@suse.de" date="1655294402">- efi: Do not import certificates from UEFI Secure Boot for T2
  Macs (git-fixes).
- Refresh
  patches.suse/0003-MODSIGN-load-blacklist-from-MOKx.patch.
- commit 316d54d</changelog>
  <changelog author="tiwai@suse.de" date="1655294403">- vringh: Fix loop descriptors check in the indirect cases
  (git-fixes).
- mmc: block: Fix CQE recovery reset success (git-fixes).
- modpost: fix undefined behavior of is_arm_mapping_symbol()
  (git-fixes).
- modpost: fix removing numeric suffixes (git-fixes).
- misc: rtsx: set NULL intfdata when probe fails (git-fixes).
- USB: new quirk for Dell Gen 2 devices (git-fixes).
- USB: serial: option: add Quectel BG95 modem (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- usb: dwc2: gadget: don't reset gadget's driver-&gt;bus (git-fixes).
- USB: hcd-pci: Fully suspend across freeze/thaw cycle
  (git-fixes).
- drivers: usb: host: Fix deadlock in oxu_bus_suspend()
  (git-fixes).
- USB: host: isp116x: check return value after calling
  platform_get_resource() (git-fixes).
- serial: msm_serial: disable interrupts in __msm_console_write()
  (git-fixes).
- drivers: tty: serial: Fix deadlock in sa1100_set_termios()
  (git-fixes).
- tty: Fix a possible resource leak in icom_probe (git-fixes).
- tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
  (git-fixes).
- staging: rtl8712: fix uninit-value in r871xu_drv_init()
  (git-fixes).
- staging: rtl8712: fix uninit-value in usb_read8() and friends
  (git-fixes).
- drivers: staging: rtl8192e: Fix deadlock in
  rtllib_beacons_stop() (git-fixes).
- drivers: staging: rtl8192u: Fix deadlock in
  ieee80211_beacons_stop() (git-fixes).
- watchdog: wdat_wdt: Stop watchdog when rebooting the system
  (git-fixes).
- pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards (git-fixes).
- video: fbdev: pxa3xx-gcu: release the resources correctly in
  pxa3xx_gcu_probe/remove() (git-fixes).
- rtlwifi: Use pr_warn instead of WARN_ONCE (git-fixes).
- rtl818x: Prevent using not initialized queues (git-fixes).
- mwifiex: add mutex lock for call in
  mwifiex_dfs_chan_sw_work_queue (git-fixes).
- media: cx25821: Fix the warning when removing the module
  (git-fixes).
- media: pci: cx23885: Fix the error handling in cx23885_initdev()
  (git-fixes).
- media: venus: hfi: avoid null dereference in deinit (git-fixes).
- PM / devfreq: rk3399_dmc: Disable edev on remove() (git-fixes).
- spi: stm32-qspi: Fix wait_cmd timeout in APM mode (git-fixes).
- spi: spi-rspi: Remove setting {src,dst}_{addr,addr_width}
  based on DMA direction (git-fixes).
- mmc: jz4740: Apply DMA engine limits to maximum segment size
  (git-fixes).
- pinctrl: sunxi: fix f1c100s uart2 function (git-fixes).
- platform/chrome: cros_ec_proto: Send command again when timeout
  occurs (git-fixes).
- commit f8749e6</changelog>
  <changelog author="tiwai@suse.de" date="1655294404">- ALSA: usb-audio: Optimize TEAC clock quirk (git-fixes).
- commit 4bfd1c5</changelog>
</package>
<package pkgid="e8fc9d381de60fc7f0ec22a9341e535b4a6f61800c62eadeab359ad94e0eecc0" name="kernel-default" arch="src">
  <version epoch="0" ver="5.3.18" rel="150300.59.76.1"/>
  <changelog author="jgross@suse.com" date="1654862400">- kvm: fix wrong exception emulation in check_rdtsc (git-fixes).
- commit 5797afc</changelog>
  <changelog author="jgross@suse.com" date="1654862401">- KVM: nVMX: Query current VMCS when determining if MSR bitmaps
  are in use (git-fixes).
- commit d008aa3</changelog>
  <changelog author="jgross@suse.com" date="1654862402">- KVM: x86: Fix emulation in writing cr8 (git-fixes).
- commit a28f4e5</changelog>
  <changelog author="jgross@suse.com" date="1654862403">- KVM: x86/emulator: Defer not-present segment check in
  __load_segment_descriptor() (git-fixes).
- commit 27bee90</changelog>
  <changelog author="jgross@suse.com" date="1654862404">- kvm: x86/cpuid: Only provide CPUID leaf 0xA if host has
  architectural PMU (git-fixes).
- commit b46bf26</changelog>
  <changelog author="ohering@suse.de" date="1655121600">- PCI: hv: Fix NUMA node assignment when kernel boots with custom
  NUMA topology (bsc#1199365).
- commit 533234b</changelog>
  <changelog author="jack@suse.cz" date="1655121601">- blk-mq: fix tag_get wait task can't be awakened (bsc#1200263).
- commit 0a1fb57</changelog>
  <changelog author="jack@suse.cz" date="1655121602">- blk-mq: Fix wrong wakeup batch configuration which will cause
  hang (bsc#1200263).
- commit d25a54b</changelog>
  <changelog author="osalvador@suse.de" date="1655208000">- Rename colliding patches before the next origin/cve/linux-5.3 -&gt; SLE15-SP3 merge
- commit 070ca14</changelog>
  <changelog author="neilb@suse.de" date="1655208001">- NFS: Don't report ENOSPC write errors twice (git-fixes).
- nfsd: Fix null-ptr-deref in nfsd_fill_super() (git-fixes).
- md: fix an incorrect NULL check in md_reload_sb (git-fixes).
- md: fix an incorrect NULL check in does_sb_need_changing
  (git-fixes).
- raid5: introduce MD_BROKEN (git-fixes).
- commit a49fc21</changelog>
  <changelog author="ptesarik@suse.cz" date="1655208002">- s390/mcck: isolate SIE instruction when setting CIF_MCCK_GUEST
  flag (git-fixes).
- s390/crypto: fix scatterwalk_unmap() callers in AES-GCM
  (git-fixes).
- s390/lcs: fix variable dereferenced before check (git-fixes).
- s390/ctcm: fix potential memory leak (git-fixes).
- s390/ctcm: fix variable dereferenced before check (git-fixes).
- s390/dasd: Fix read inconsistency for ESE DASD devices
  (bsc#1200206 LTC#198455).
- s390/dasd: Fix read for ESE with blksize &lt; 4k (bsc#1200206
  LTC#198455).
- s390/dasd: prevent double format of tracks for ESE devices
  (bsc#1200207 LTC#198454).
- s390/dasd: fix data corruption for ESE devices (bsc#1200207
  LTC#198454).
- KVM: s390: vsie/gmap: reduce gmap_rmap overhead (git-fixes).
- s390/nmi: handle vector validity failures for KVM guests
  (git-fixes).
- s390/nmi: handle guarded storage validity failures for KVM
  guests (git-fixes).
- vfio/ccw: Remove unneeded GFP_DMA (git-fixes).
- KVM: s390: pv: avoid stalls for kvm_s390_pv_init_vm (git-fixes).
- KVM: s390: pv: avoid double free of sida page (git-fixes).
- KVM: s390: pv: add macros for UVC CC values (git-fixes).
- s390: fix strrchr() implementation (git-fixes).
- s390/pv: fix the forcing of the swiotlb (git-fixes).
- s390/qdio: cancel the ESTABLISH ccw after timeout (git-fixes).
- s390/qdio: fix roll-back after timeout on ESTABLISH ccw
  (git-fixes).
- s390/ftrace: fix ftrace_update_ftrace_func implementation
  (git-fixes).
- s390/cio: dont call css_wait_for_slow_path() inside a lock
  (git-fixes).
- s390/cio: Fix the "type" field in s390_cio_tpi tracepoint
  (git-fixes).
- s390/mcck: fix invalid KVM guest condition check (git-fixes).
- vfio-ccw: Check initialized flag in cp_init() (git-fixes).
- s390: fix detection of vector enhancements facility 1 vs. vector
  packed decimal facility (git-fixes).
- s390/vfio-ap: fix circular lockdep when setting/clearing crypto
  masks (git-fixes).
- virtio/s390: implement virtio-ccw revision 2 correctly
  (git-fixes).
- commit 61a09d5</changelog>
  <changelog author="osalvador@suse.de" date="1655208003">- Update config files
- commit 0d6e862</changelog>
  <changelog author="oneukum@suse.com" date="1655208004">- platform/x86: wmi: Replace read_takes_no_args with a flags field
  (git-fixes).
- commit 2771a0e</changelog>
  <changelog author="oneukum@suse.com" date="1655208005">- platform/x86: wmi: Fix driver-&gt;notify() vs -&gt;probe() race
  (git-fixes).
- commit e932131</changelog>
  <changelog author="osalvador@suse.de" date="1655208006">- Refresh 0002-PKCS-7-Check-codeSigning-EKU-for-kernel-module-and-k.patch
- commit 4835ae7</changelog>
  <changelog author="tiwai@suse.de" date="1655294400">- ata: libata-transport: fix {dma|pio|xfer}_mode sysfs files
  (git-fixes).
- ALSA: hda/conexant - Fix loopback issue with CX20632
  (git-fixes).
- ALSA: usb-audio: Set up (implicit) sync for Saffire 6
  (git-fixes).
- ALSA: usb-audio: Skip generic sync EP parse for secondary EP
  (git-fixes).
- clocksource/drivers/oxnas-rps: Fix irq_of_parse_and_map()
  return value (git-fixes).
- clocksource/drivers/sp804: Avoid error on multiple instances
  (git-fixes).
- dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size
  data type (git-fixes).
- ASoC: max98357a: remove dependency on GPIOLIB (git-fixes).
- ASoC: rt5645: Fix errorenous cleanup order (git-fixes).
- ASoC: tscs454: Add endianness flag in snd_soc_component_driver
  (git-fixes).
- ASoC: dapm: Don't fold register value changes into notifications
  (git-fixes).
- ALSA: usb-audio: Workaround for clock setup on TEAC devices
  (git-fixes).
- ath9k: fix QCA9561 PA bias level (git-fixes).
- b43: Fix assigning negative value to unsigned variable
  (git-fixes).
- b43legacy: Fix assigning negative value to unsigned variable
  (git-fixes).
- ACPI: sysfs: Fix BERT error region memory mapping (git-fixes).
- ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default
  (git-fixes).
- cfg80211: set custom regdomain after wiphy registration
  (git-fixes).
- ACPI: sysfs: Make sparse happy about address space in use
  (git-fixes).
- commit d8922a7</changelog>
  <changelog author="tiwai@suse.de" date="1655294401">- drm/atomic: Force bridge self-refresh-exit on CRTC switch
  (git-fixes).
- drm/bridge: analogix_dp: Support PSR-exit to disable transition
  (git-fixes).
- Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag
  (git-fixes).
- iio: dummy: iio_simple_dummy: check the return value of
  kstrdup() (git-fixes).
- drm/amdgpu/cs: make commands with 0 chunks illegal behaviour
  (git-fixes).
- drm/radeon: fix a possible null pointer dereference (git-fixes).
- i2c: cadence: Increase timeout per message if necessary
  (git-fixes).
- drm/amdgpu/ucode: Remove firmware load type check in
  amdgpu_ucode_free_bo (git-fixes).
- drm: msm: fix error check return value of irq_of_parse_and_map()
  (git-fixes).
- drm/plane: Move range check for format_count earlier
  (git-fixes).
- drm/komeda: return early if drm_universal_plane_init() fails
  (git-fixes).
- fbcon: Consistently protect deferred_takeover with
  console_lock() (git-fixes).
- drm/virtio: fix NULL pointer dereference in
  virtio_gpu_conn_get_modes (git-fixes).
- drm/i915: Fix -Wstringop-overflow warning in call to
  intel_read_wm_latency() (git-fixes).
- iwlwifi: mvm: fix assert 1F04 upon reconfig (git-fixes).
- mac80211: upgrade passive scan to active scan on DFS channels
  after beacon rx (git-fixes).
- ipw2x00: Fix potential NULL dereference in libipw_xmit()
  (git-fixes).
- HID: bigben: fix slab-out-of-bounds Write in bigben_probe
  (git-fixes).
- HID: multitouch: Add support for Google Whiskers Touchpad
  (git-fixes).
- hwmon: Make chip parameter for with_info API mandatory
  (git-fixes).
- irqchip: irq-xtensa-mx: fix initial IRQ affinity (git-fixes).
- irqchip/armada-370-xp: Do not touch Performance Counter Overflow
  on A375, A38x, A39x (git-fixes).
- irqchip/aspeed-i2c-ic: Fix irq_of_parse_and_map() return value
  (git-fixes).
- irqchip/exiu: Fix acknowledgment of edge triggered interrupts
  (git-fixes).
- efi: Add missing prototype for efi_capsule_setup_info
  (git-fixes).
- drivers: i2c: thunderx: Allow driver to work with ACPI defined
  TWSI controllers (git-fixes).
- i2c: ismt: Provide a DMA buffer for Interrupt Cause Logging
  (git-fixes).
- Input: goodix - fix spurious key release events (git-fixes).
- commit 71b82f0</changelog>
  <changelog author="tiwai@suse.de" date="1655294402">- efi: Do not import certificates from UEFI Secure Boot for T2
  Macs (git-fixes).
- Refresh
  patches.suse/0003-MODSIGN-load-blacklist-from-MOKx.patch.
- commit 316d54d</changelog>
  <changelog author="tiwai@suse.de" date="1655294403">- vringh: Fix loop descriptors check in the indirect cases
  (git-fixes).
- mmc: block: Fix CQE recovery reset success (git-fixes).
- modpost: fix undefined behavior of is_arm_mapping_symbol()
  (git-fixes).
- modpost: fix removing numeric suffixes (git-fixes).
- misc: rtsx: set NULL intfdata when probe fails (git-fixes).
- USB: new quirk for Dell Gen 2 devices (git-fixes).
- USB: serial: option: add Quectel BG95 modem (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- usb: dwc2: gadget: don't reset gadget's driver-&gt;bus (git-fixes).
- USB: hcd-pci: Fully suspend across freeze/thaw cycle
  (git-fixes).
- drivers: usb: host: Fix deadlock in oxu_bus_suspend()
  (git-fixes).
- USB: host: isp116x: check return value after calling
  platform_get_resource() (git-fixes).
- serial: msm_serial: disable interrupts in __msm_console_write()
  (git-fixes).
- drivers: tty: serial: Fix deadlock in sa1100_set_termios()
  (git-fixes).
- tty: Fix a possible resource leak in icom_probe (git-fixes).
- tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
  (git-fixes).
- staging: rtl8712: fix uninit-value in r871xu_drv_init()
  (git-fixes).
- staging: rtl8712: fix uninit-value in usb_read8() and friends
  (git-fixes).
- drivers: staging: rtl8192e: Fix deadlock in
  rtllib_beacons_stop() (git-fixes).
- drivers: staging: rtl8192u: Fix deadlock in
  ieee80211_beacons_stop() (git-fixes).
- watchdog: wdat_wdt: Stop watchdog when rebooting the system
  (git-fixes).
- pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards (git-fixes).
- video: fbdev: pxa3xx-gcu: release the resources correctly in
  pxa3xx_gcu_probe/remove() (git-fixes).
- rtlwifi: Use pr_warn instead of WARN_ONCE (git-fixes).
- rtl818x: Prevent using not initialized queues (git-fixes).
- mwifiex: add mutex lock for call in
  mwifiex_dfs_chan_sw_work_queue (git-fixes).
- media: cx25821: Fix the warning when removing the module
  (git-fixes).
- media: pci: cx23885: Fix the error handling in cx23885_initdev()
  (git-fixes).
- media: venus: hfi: avoid null dereference in deinit (git-fixes).
- PM / devfreq: rk3399_dmc: Disable edev on remove() (git-fixes).
- spi: stm32-qspi: Fix wait_cmd timeout in APM mode (git-fixes).
- spi: spi-rspi: Remove setting {src,dst}_{addr,addr_width}
  based on DMA direction (git-fixes).
- mmc: jz4740: Apply DMA engine limits to maximum segment size
  (git-fixes).
- pinctrl: sunxi: fix f1c100s uart2 function (git-fixes).
- platform/chrome: cros_ec_proto: Send command again when timeout
  occurs (git-fixes).
- commit f8749e6</changelog>
  <changelog author="tiwai@suse.de" date="1655294404">- ALSA: usb-audio: Optimize TEAC clock quirk (git-fixes).
- commit 4bfd1c5</changelog>
</package>
<package pkgid="297490d3d1976d677dff7cc03d4d793cd78e0945c1eeb08239d19be3b21eb639" name="kernel-default" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.76.1"/>
  <changelog author="jgross@suse.com" date="1654862400">- kvm: fix wrong exception emulation in check_rdtsc (git-fixes).
- commit 5797afc</changelog>
  <changelog author="jgross@suse.com" date="1654862401">- KVM: nVMX: Query current VMCS when determining if MSR bitmaps
  are in use (git-fixes).
- commit d008aa3</changelog>
  <changelog author="jgross@suse.com" date="1654862402">- KVM: x86: Fix emulation in writing cr8 (git-fixes).
- commit a28f4e5</changelog>
  <changelog author="jgross@suse.com" date="1654862403">- KVM: x86/emulator: Defer not-present segment check in
  __load_segment_descriptor() (git-fixes).
- commit 27bee90</changelog>
  <changelog author="jgross@suse.com" date="1654862404">- kvm: x86/cpuid: Only provide CPUID leaf 0xA if host has
  architectural PMU (git-fixes).
- commit b46bf26</changelog>
  <changelog author="ohering@suse.de" date="1655121600">- PCI: hv: Fix NUMA node assignment when kernel boots with custom
  NUMA topology (bsc#1199365).
- commit 533234b</changelog>
  <changelog author="jack@suse.cz" date="1655121601">- blk-mq: fix tag_get wait task can't be awakened (bsc#1200263).
- commit 0a1fb57</changelog>
  <changelog author="jack@suse.cz" date="1655121602">- blk-mq: Fix wrong wakeup batch configuration which will cause
  hang (bsc#1200263).
- commit d25a54b</changelog>
  <changelog author="osalvador@suse.de" date="1655208000">- Rename colliding patches before the next origin/cve/linux-5.3 -&gt; SLE15-SP3 merge
- commit 070ca14</changelog>
  <changelog author="neilb@suse.de" date="1655208001">- NFS: Don't report ENOSPC write errors twice (git-fixes).
- nfsd: Fix null-ptr-deref in nfsd_fill_super() (git-fixes).
- md: fix an incorrect NULL check in md_reload_sb (git-fixes).
- md: fix an incorrect NULL check in does_sb_need_changing
  (git-fixes).
- raid5: introduce MD_BROKEN (git-fixes).
- commit a49fc21</changelog>
  <changelog author="ptesarik@suse.cz" date="1655208002">- s390/mcck: isolate SIE instruction when setting CIF_MCCK_GUEST
  flag (git-fixes).
- s390/crypto: fix scatterwalk_unmap() callers in AES-GCM
  (git-fixes).
- s390/lcs: fix variable dereferenced before check (git-fixes).
- s390/ctcm: fix potential memory leak (git-fixes).
- s390/ctcm: fix variable dereferenced before check (git-fixes).
- s390/dasd: Fix read inconsistency for ESE DASD devices
  (bsc#1200206 LTC#198455).
- s390/dasd: Fix read for ESE with blksize &lt; 4k (bsc#1200206
  LTC#198455).
- s390/dasd: prevent double format of tracks for ESE devices
  (bsc#1200207 LTC#198454).
- s390/dasd: fix data corruption for ESE devices (bsc#1200207
  LTC#198454).
- KVM: s390: vsie/gmap: reduce gmap_rmap overhead (git-fixes).
- s390/nmi: handle vector validity failures for KVM guests
  (git-fixes).
- s390/nmi: handle guarded storage validity failures for KVM
  guests (git-fixes).
- vfio/ccw: Remove unneeded GFP_DMA (git-fixes).
- KVM: s390: pv: avoid stalls for kvm_s390_pv_init_vm (git-fixes).
- KVM: s390: pv: avoid double free of sida page (git-fixes).
- KVM: s390: pv: add macros for UVC CC values (git-fixes).
- s390: fix strrchr() implementation (git-fixes).
- s390/pv: fix the forcing of the swiotlb (git-fixes).
- s390/qdio: cancel the ESTABLISH ccw after timeout (git-fixes).
- s390/qdio: fix roll-back after timeout on ESTABLISH ccw
  (git-fixes).
- s390/ftrace: fix ftrace_update_ftrace_func implementation
  (git-fixes).
- s390/cio: dont call css_wait_for_slow_path() inside a lock
  (git-fixes).
- s390/cio: Fix the "type" field in s390_cio_tpi tracepoint
  (git-fixes).
- s390/mcck: fix invalid KVM guest condition check (git-fixes).
- vfio-ccw: Check initialized flag in cp_init() (git-fixes).
- s390: fix detection of vector enhancements facility 1 vs. vector
  packed decimal facility (git-fixes).
- s390/vfio-ap: fix circular lockdep when setting/clearing crypto
  masks (git-fixes).
- virtio/s390: implement virtio-ccw revision 2 correctly
  (git-fixes).
- commit 61a09d5</changelog>
  <changelog author="osalvador@suse.de" date="1655208003">- Update config files
- commit 0d6e862</changelog>
  <changelog author="oneukum@suse.com" date="1655208004">- platform/x86: wmi: Replace read_takes_no_args with a flags field
  (git-fixes).
- commit 2771a0e</changelog>
  <changelog author="oneukum@suse.com" date="1655208005">- platform/x86: wmi: Fix driver-&gt;notify() vs -&gt;probe() race
  (git-fixes).
- commit e932131</changelog>
  <changelog author="osalvador@suse.de" date="1655208006">- Refresh 0002-PKCS-7-Check-codeSigning-EKU-for-kernel-module-and-k.patch
- commit 4835ae7</changelog>
  <changelog author="tiwai@suse.de" date="1655294400">- ata: libata-transport: fix {dma|pio|xfer}_mode sysfs files
  (git-fixes).
- ALSA: hda/conexant - Fix loopback issue with CX20632
  (git-fixes).
- ALSA: usb-audio: Set up (implicit) sync for Saffire 6
  (git-fixes).
- ALSA: usb-audio: Skip generic sync EP parse for secondary EP
  (git-fixes).
- clocksource/drivers/oxnas-rps: Fix irq_of_parse_and_map()
  return value (git-fixes).
- clocksource/drivers/sp804: Avoid error on multiple instances
  (git-fixes).
- dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size
  data type (git-fixes).
- ASoC: max98357a: remove dependency on GPIOLIB (git-fixes).
- ASoC: rt5645: Fix errorenous cleanup order (git-fixes).
- ASoC: tscs454: Add endianness flag in snd_soc_component_driver
  (git-fixes).
- ASoC: dapm: Don't fold register value changes into notifications
  (git-fixes).
- ALSA: usb-audio: Workaround for clock setup on TEAC devices
  (git-fixes).
- ath9k: fix QCA9561 PA bias level (git-fixes).
- b43: Fix assigning negative value to unsigned variable
  (git-fixes).
- b43legacy: Fix assigning negative value to unsigned variable
  (git-fixes).
- ACPI: sysfs: Fix BERT error region memory mapping (git-fixes).
- ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default
  (git-fixes).
- cfg80211: set custom regdomain after wiphy registration
  (git-fixes).
- ACPI: sysfs: Make sparse happy about address space in use
  (git-fixes).
- commit d8922a7</changelog>
  <changelog author="tiwai@suse.de" date="1655294401">- drm/atomic: Force bridge self-refresh-exit on CRTC switch
  (git-fixes).
- drm/bridge: analogix_dp: Support PSR-exit to disable transition
  (git-fixes).
- Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag
  (git-fixes).
- iio: dummy: iio_simple_dummy: check the return value of
  kstrdup() (git-fixes).
- drm/amdgpu/cs: make commands with 0 chunks illegal behaviour
  (git-fixes).
- drm/radeon: fix a possible null pointer dereference (git-fixes).
- i2c: cadence: Increase timeout per message if necessary
  (git-fixes).
- drm/amdgpu/ucode: Remove firmware load type check in
  amdgpu_ucode_free_bo (git-fixes).
- drm: msm: fix error check return value of irq_of_parse_and_map()
  (git-fixes).
- drm/plane: Move range check for format_count earlier
  (git-fixes).
- drm/komeda: return early if drm_universal_plane_init() fails
  (git-fixes).
- fbcon: Consistently protect deferred_takeover with
  console_lock() (git-fixes).
- drm/virtio: fix NULL pointer dereference in
  virtio_gpu_conn_get_modes (git-fixes).
- drm/i915: Fix -Wstringop-overflow warning in call to
  intel_read_wm_latency() (git-fixes).
- iwlwifi: mvm: fix assert 1F04 upon reconfig (git-fixes).
- mac80211: upgrade passive scan to active scan on DFS channels
  after beacon rx (git-fixes).
- ipw2x00: Fix potential NULL dereference in libipw_xmit()
  (git-fixes).
- HID: bigben: fix slab-out-of-bounds Write in bigben_probe
  (git-fixes).
- HID: multitouch: Add support for Google Whiskers Touchpad
  (git-fixes).
- hwmon: Make chip parameter for with_info API mandatory
  (git-fixes).
- irqchip: irq-xtensa-mx: fix initial IRQ affinity (git-fixes).
- irqchip/armada-370-xp: Do not touch Performance Counter Overflow
  on A375, A38x, A39x (git-fixes).
- irqchip/aspeed-i2c-ic: Fix irq_of_parse_and_map() return value
  (git-fixes).
- irqchip/exiu: Fix acknowledgment of edge triggered interrupts
  (git-fixes).
- efi: Add missing prototype for efi_capsule_setup_info
  (git-fixes).
- drivers: i2c: thunderx: Allow driver to work with ACPI defined
  TWSI controllers (git-fixes).
- i2c: ismt: Provide a DMA buffer for Interrupt Cause Logging
  (git-fixes).
- Input: goodix - fix spurious key release events (git-fixes).
- commit 71b82f0</changelog>
  <changelog author="tiwai@suse.de" date="1655294402">- efi: Do not import certificates from UEFI Secure Boot for T2
  Macs (git-fixes).
- Refresh
  patches.suse/0003-MODSIGN-load-blacklist-from-MOKx.patch.
- commit 316d54d</changelog>
  <changelog author="tiwai@suse.de" date="1655294403">- vringh: Fix loop descriptors check in the indirect cases
  (git-fixes).
- mmc: block: Fix CQE recovery reset success (git-fixes).
- modpost: fix undefined behavior of is_arm_mapping_symbol()
  (git-fixes).
- modpost: fix removing numeric suffixes (git-fixes).
- misc: rtsx: set NULL intfdata when probe fails (git-fixes).
- USB: new quirk for Dell Gen 2 devices (git-fixes).
- USB: serial: option: add Quectel BG95 modem (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- usb: dwc2: gadget: don't reset gadget's driver-&gt;bus (git-fixes).
- USB: hcd-pci: Fully suspend across freeze/thaw cycle
  (git-fixes).
- drivers: usb: host: Fix deadlock in oxu_bus_suspend()
  (git-fixes).
- USB: host: isp116x: check return value after calling
  platform_get_resource() (git-fixes).
- serial: msm_serial: disable interrupts in __msm_console_write()
  (git-fixes).
- drivers: tty: serial: Fix deadlock in sa1100_set_termios()
  (git-fixes).
- tty: Fix a possible resource leak in icom_probe (git-fixes).
- tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
  (git-fixes).
- staging: rtl8712: fix uninit-value in r871xu_drv_init()
  (git-fixes).
- staging: rtl8712: fix uninit-value in usb_read8() and friends
  (git-fixes).
- drivers: staging: rtl8192e: Fix deadlock in
  rtllib_beacons_stop() (git-fixes).
- drivers: staging: rtl8192u: Fix deadlock in
  ieee80211_beacons_stop() (git-fixes).
- watchdog: wdat_wdt: Stop watchdog when rebooting the system
  (git-fixes).
- pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards (git-fixes).
- video: fbdev: pxa3xx-gcu: release the resources correctly in
  pxa3xx_gcu_probe/remove() (git-fixes).
- rtlwifi: Use pr_warn instead of WARN_ONCE (git-fixes).
- rtl818x: Prevent using not initialized queues (git-fixes).
- mwifiex: add mutex lock for call in
  mwifiex_dfs_chan_sw_work_queue (git-fixes).
- media: cx25821: Fix the warning when removing the module
  (git-fixes).
- media: pci: cx23885: Fix the error handling in cx23885_initdev()
  (git-fixes).
- media: venus: hfi: avoid null dereference in deinit (git-fixes).
- PM / devfreq: rk3399_dmc: Disable edev on remove() (git-fixes).
- spi: stm32-qspi: Fix wait_cmd timeout in APM mode (git-fixes).
- spi: spi-rspi: Remove setting {src,dst}_{addr,addr_width}
  based on DMA direction (git-fixes).
- mmc: jz4740: Apply DMA engine limits to maximum segment size
  (git-fixes).
- pinctrl: sunxi: fix f1c100s uart2 function (git-fixes).
- platform/chrome: cros_ec_proto: Send command again when timeout
  occurs (git-fixes).
- commit f8749e6</changelog>
  <changelog author="tiwai@suse.de" date="1655294404">- ALSA: usb-audio: Optimize TEAC clock quirk (git-fixes).
- commit 4bfd1c5</changelog>
</package>
<package pkgid="1189a05930473437bf6026bc0d06ebf8511e0fc8c716f5e410ec458e12a3a61a" name="kernel-default" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="150300.59.81.1"/>
  <changelog author="bp@suse.de" date="1657022400">- x86/bugs: Add retbleed=ibpb (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit 0636a43</changelog>
  <changelog author="bp@suse.de" date="1657022401">- x86/bugs: Do IBPB fallback check only once (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 914bf03</changelog>
  <changelog author="bp@suse.de" date="1657022402">- x86/cpu/amd: Add Spectral Chicken (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit 3ed82bb</changelog>
  <changelog author="bp@suse.de" date="1657022403">- x86/speculation: Fix firmware entry SPEC_CTRL handling
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 410bedf</changelog>
  <changelog author="bp@suse.de" date="1657022404">- x86/speculation: Fix SPEC_CTRL write on SMT state change
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 43488f5</changelog>
  <changelog author="bp@suse.de" date="1657022405">- x86/speculation: Use cached host SPEC_CTRL value for guest
  entry/exit (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 140d756</changelog>
  <changelog author="bp@suse.de" date="1657022406">- x86/speculation: Remove x86_spec_ctrl_mask (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 4f79cdb</changelog>
  <changelog author="bp@suse.de" date="1657022407">- KVM: VMX: Flatten __vmx_vcpu_run() (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit 5c70c82</changelog>
  <changelog author="bp@suse.de" date="1657022408">- KVM/nVMX: Use __vmx_vcpu_run in nested_vmx_check_vmentry_hw
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 528b21e</changelog>
  <changelog author="bp@suse.de" date="1657022409">- KVM: VMX: Convert launched argument to flags (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit e0dd694</changelog>
  <changelog author="bp@suse.de" date="1657022410">- KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit f625aa5</changelog>
  <changelog author="bp@suse.de" date="1657022411">- KVM: VMX: Fix IBRS handling after vmexit (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 79152af</changelog>
  <changelog author="bp@suse.de" date="1657022412">- x86/speculation: Fill RSB on vmexit for IBRS (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit fd58624</changelog>
  <changelog author="bp@suse.de" date="1657022413">- KVM: VMX: Prevent RSB underflow before vmenter (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit a2b7d09</changelog>
  <changelog author="bp@suse.de" date="1657022414">- x86/common: Stamp out the stepping madness (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 3962a01</changelog>
  <changelog author="bp@suse.de" date="1657022415">- x86/cpu/amd: Enumerate BTC_NO (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit b7a3331</changelog>
  <changelog author="aabdallah@suse.de" date="1657281600">- ibmvnic: Properly dispose of all skbs during a failover
  (bsc#1200925).
- commit 06221e8</changelog>
  <changelog author="bp@suse.de" date="1657281601">- x86/bugs: Add Cannon lake to RETBleed affected CPU list
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 6b54061</changelog>
  <changelog author="bp@suse.de" date="1657281602">- x86/bugs: Do not enable IBPB-on-entry when IBPB is not supported
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 41afdd9</changelog>
  <changelog author="bp@suse.de" date="1657281603">- x86/kexec: Disable RET on kexec (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit ef1c2ca</changelog>
</package>
<package pkgid="d877793ed83dc1dfb69867984cf3816b69c3ee0767be49e2e5f68263886c4eb7" name="kernel-default" arch="src">
  <version epoch="0" ver="5.3.18" rel="150300.59.81.1"/>
  <changelog author="bp@suse.de" date="1657022400">- x86/bugs: Add retbleed=ibpb (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit 0636a43</changelog>
  <changelog author="bp@suse.de" date="1657022401">- x86/bugs: Do IBPB fallback check only once (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 914bf03</changelog>
  <changelog author="bp@suse.de" date="1657022402">- x86/cpu/amd: Add Spectral Chicken (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit 3ed82bb</changelog>
  <changelog author="bp@suse.de" date="1657022403">- x86/speculation: Fix firmware entry SPEC_CTRL handling
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 410bedf</changelog>
  <changelog author="bp@suse.de" date="1657022404">- x86/speculation: Fix SPEC_CTRL write on SMT state change
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 43488f5</changelog>
  <changelog author="bp@suse.de" date="1657022405">- x86/speculation: Use cached host SPEC_CTRL value for guest
  entry/exit (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 140d756</changelog>
  <changelog author="bp@suse.de" date="1657022406">- x86/speculation: Remove x86_spec_ctrl_mask (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 4f79cdb</changelog>
  <changelog author="bp@suse.de" date="1657022407">- KVM: VMX: Flatten __vmx_vcpu_run() (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit 5c70c82</changelog>
  <changelog author="bp@suse.de" date="1657022408">- KVM/nVMX: Use __vmx_vcpu_run in nested_vmx_check_vmentry_hw
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 528b21e</changelog>
  <changelog author="bp@suse.de" date="1657022409">- KVM: VMX: Convert launched argument to flags (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit e0dd694</changelog>
  <changelog author="bp@suse.de" date="1657022410">- KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit f625aa5</changelog>
  <changelog author="bp@suse.de" date="1657022411">- KVM: VMX: Fix IBRS handling after vmexit (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 79152af</changelog>
  <changelog author="bp@suse.de" date="1657022412">- x86/speculation: Fill RSB on vmexit for IBRS (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit fd58624</changelog>
  <changelog author="bp@suse.de" date="1657022413">- KVM: VMX: Prevent RSB underflow before vmenter (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit a2b7d09</changelog>
  <changelog author="bp@suse.de" date="1657022414">- x86/common: Stamp out the stepping madness (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 3962a01</changelog>
  <changelog author="bp@suse.de" date="1657022415">- x86/cpu/amd: Enumerate BTC_NO (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit b7a3331</changelog>
  <changelog author="aabdallah@suse.de" date="1657281600">- ibmvnic: Properly dispose of all skbs during a failover
  (bsc#1200925).
- commit 06221e8</changelog>
  <changelog author="bp@suse.de" date="1657281601">- x86/bugs: Add Cannon lake to RETBleed affected CPU list
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 6b54061</changelog>
  <changelog author="bp@suse.de" date="1657281602">- x86/bugs: Do not enable IBPB-on-entry when IBPB is not supported
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 41afdd9</changelog>
  <changelog author="bp@suse.de" date="1657281603">- x86/kexec: Disable RET on kexec (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit ef1c2ca</changelog>
</package>
<package pkgid="c2055d0d7767a073780c76efdf1b1f81e43ab82b4bff7cc238b49a0a4db8e56f" name="kernel-default" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.81.1"/>
  <changelog author="bp@suse.de" date="1657022400">- x86/bugs: Add retbleed=ibpb (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit 0636a43</changelog>
  <changelog author="bp@suse.de" date="1657022401">- x86/bugs: Do IBPB fallback check only once (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 914bf03</changelog>
  <changelog author="bp@suse.de" date="1657022402">- x86/cpu/amd: Add Spectral Chicken (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit 3ed82bb</changelog>
  <changelog author="bp@suse.de" date="1657022403">- x86/speculation: Fix firmware entry SPEC_CTRL handling
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 410bedf</changelog>
  <changelog author="bp@suse.de" date="1657022404">- x86/speculation: Fix SPEC_CTRL write on SMT state change
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 43488f5</changelog>
  <changelog author="bp@suse.de" date="1657022405">- x86/speculation: Use cached host SPEC_CTRL value for guest
  entry/exit (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 140d756</changelog>
  <changelog author="bp@suse.de" date="1657022406">- x86/speculation: Remove x86_spec_ctrl_mask (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 4f79cdb</changelog>
  <changelog author="bp@suse.de" date="1657022407">- KVM: VMX: Flatten __vmx_vcpu_run() (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit 5c70c82</changelog>
  <changelog author="bp@suse.de" date="1657022408">- KVM/nVMX: Use __vmx_vcpu_run in nested_vmx_check_vmentry_hw
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 528b21e</changelog>
  <changelog author="bp@suse.de" date="1657022409">- KVM: VMX: Convert launched argument to flags (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit e0dd694</changelog>
  <changelog author="bp@suse.de" date="1657022410">- KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit f625aa5</changelog>
  <changelog author="bp@suse.de" date="1657022411">- KVM: VMX: Fix IBRS handling after vmexit (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 79152af</changelog>
  <changelog author="bp@suse.de" date="1657022412">- x86/speculation: Fill RSB on vmexit for IBRS (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit fd58624</changelog>
  <changelog author="bp@suse.de" date="1657022413">- KVM: VMX: Prevent RSB underflow before vmenter (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit a2b7d09</changelog>
  <changelog author="bp@suse.de" date="1657022414">- x86/common: Stamp out the stepping madness (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 3962a01</changelog>
  <changelog author="bp@suse.de" date="1657022415">- x86/cpu/amd: Enumerate BTC_NO (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit b7a3331</changelog>
  <changelog author="aabdallah@suse.de" date="1657281600">- ibmvnic: Properly dispose of all skbs during a failover
  (bsc#1200925).
- commit 06221e8</changelog>
  <changelog author="bp@suse.de" date="1657281601">- x86/bugs: Add Cannon lake to RETBleed affected CPU list
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 6b54061</changelog>
  <changelog author="bp@suse.de" date="1657281602">- x86/bugs: Do not enable IBPB-on-entry when IBPB is not supported
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 41afdd9</changelog>
  <changelog author="bp@suse.de" date="1657281603">- x86/kexec: Disable RET on kexec (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit ef1c2ca</changelog>
</package>
<package pkgid="b849130733416bf4ce2654a7acf7fc4d4b20bfd935ea77b8488a2fc05bc372fd" name="kernel-default" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="150300.59.87.1"/>
  <changelog author="bp@suse.de" date="1657022400">- x86/speculation: Fix firmware entry SPEC_CTRL handling
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 410bedf</changelog>
  <changelog author="bp@suse.de" date="1657022401">- x86/speculation: Fix SPEC_CTRL write on SMT state change
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 43488f5</changelog>
  <changelog author="bp@suse.de" date="1657022402">- x86/speculation: Use cached host SPEC_CTRL value for guest
  entry/exit (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 140d756</changelog>
  <changelog author="bp@suse.de" date="1657022403">- x86/speculation: Remove x86_spec_ctrl_mask (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 4f79cdb</changelog>
  <changelog author="bp@suse.de" date="1657022404">- KVM: VMX: Flatten __vmx_vcpu_run() (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit 5c70c82</changelog>
  <changelog author="bp@suse.de" date="1657022405">- KVM/nVMX: Use __vmx_vcpu_run in nested_vmx_check_vmentry_hw
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 528b21e</changelog>
  <changelog author="bp@suse.de" date="1657022406">- KVM: VMX: Convert launched argument to flags (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit e0dd694</changelog>
  <changelog author="bp@suse.de" date="1657022407">- KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit f625aa5</changelog>
  <changelog author="bp@suse.de" date="1657022408">- KVM: VMX: Fix IBRS handling after vmexit (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 79152af</changelog>
  <changelog author="bp@suse.de" date="1657022409">- x86/speculation: Fill RSB on vmexit for IBRS (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit fd58624</changelog>
  <changelog author="bp@suse.de" date="1657022410">- KVM: VMX: Prevent RSB underflow before vmenter (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit a2b7d09</changelog>
  <changelog author="bp@suse.de" date="1657022411">- x86/common: Stamp out the stepping madness (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 3962a01</changelog>
  <changelog author="bp@suse.de" date="1657022412">- x86/cpu/amd: Enumerate BTC_NO (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit b7a3331</changelog>
  <changelog author="aabdallah@suse.de" date="1657281600">- ibmvnic: Properly dispose of all skbs during a failover
  (bsc#1200925).
- commit 06221e8</changelog>
  <changelog author="bp@suse.de" date="1657281601">- x86/bugs: Add Cannon lake to RETBleed affected CPU list
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 6b54061</changelog>
  <changelog author="bp@suse.de" date="1657281602">- x86/bugs: Do not enable IBPB-on-entry when IBPB is not supported
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 41afdd9</changelog>
  <changelog author="bp@suse.de" date="1657281603">- x86/kexec: Disable RET on kexec (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit ef1c2ca</changelog>
  <changelog author="bp@suse.de" date="1658318400">- x86/entry: Remove skip_r11rcx (bsc#1201644).
- Refresh
  patches.suse/x86-entry-Add-kernel-IBRS-implementation.patch.
- commit b81e242</changelog>
  <changelog author="bp@suse.de" date="1658318401">- Refresh
  patches.suse/x86-bugs-Do-not-enable-IBPB-on-entry-when-IBPB-is-not-supp.patch.
- commit 9493568</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1658404800">-  Fix 1201644, 1201664, 1201672, 1201673, 1201676
  All are reports of the same problem - the IBRS_* regs push/popping was
  wrong but it needs
  1b331eeea7b8 ("x86/entry: Remove skip_r11rcx")
  too.
- commit cc90276</changelog>
</package>
<package pkgid="e7d8f8c88cedf0f6b1e2c397c304c244102963cae52b887d4c28dddd269b79f5" name="kernel-default" arch="src">
  <version epoch="0" ver="5.3.18" rel="150300.59.87.1"/>
  <changelog author="bp@suse.de" date="1657022400">- x86/speculation: Fix firmware entry SPEC_CTRL handling
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 410bedf</changelog>
  <changelog author="bp@suse.de" date="1657022401">- x86/speculation: Fix SPEC_CTRL write on SMT state change
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 43488f5</changelog>
  <changelog author="bp@suse.de" date="1657022402">- x86/speculation: Use cached host SPEC_CTRL value for guest
  entry/exit (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 140d756</changelog>
  <changelog author="bp@suse.de" date="1657022403">- x86/speculation: Remove x86_spec_ctrl_mask (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 4f79cdb</changelog>
  <changelog author="bp@suse.de" date="1657022404">- KVM: VMX: Flatten __vmx_vcpu_run() (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit 5c70c82</changelog>
  <changelog author="bp@suse.de" date="1657022405">- KVM/nVMX: Use __vmx_vcpu_run in nested_vmx_check_vmentry_hw
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 528b21e</changelog>
  <changelog author="bp@suse.de" date="1657022406">- KVM: VMX: Convert launched argument to flags (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit e0dd694</changelog>
  <changelog author="bp@suse.de" date="1657022407">- KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit f625aa5</changelog>
  <changelog author="bp@suse.de" date="1657022408">- KVM: VMX: Fix IBRS handling after vmexit (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 79152af</changelog>
  <changelog author="bp@suse.de" date="1657022409">- x86/speculation: Fill RSB on vmexit for IBRS (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit fd58624</changelog>
  <changelog author="bp@suse.de" date="1657022410">- KVM: VMX: Prevent RSB underflow before vmenter (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit a2b7d09</changelog>
  <changelog author="bp@suse.de" date="1657022411">- x86/common: Stamp out the stepping madness (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 3962a01</changelog>
  <changelog author="bp@suse.de" date="1657022412">- x86/cpu/amd: Enumerate BTC_NO (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit b7a3331</changelog>
  <changelog author="aabdallah@suse.de" date="1657281600">- ibmvnic: Properly dispose of all skbs during a failover
  (bsc#1200925).
- commit 06221e8</changelog>
  <changelog author="bp@suse.de" date="1657281601">- x86/bugs: Add Cannon lake to RETBleed affected CPU list
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 6b54061</changelog>
  <changelog author="bp@suse.de" date="1657281602">- x86/bugs: Do not enable IBPB-on-entry when IBPB is not supported
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 41afdd9</changelog>
  <changelog author="bp@suse.de" date="1657281603">- x86/kexec: Disable RET on kexec (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit ef1c2ca</changelog>
  <changelog author="bp@suse.de" date="1658318400">- x86/entry: Remove skip_r11rcx (bsc#1201644).
- Refresh
  patches.suse/x86-entry-Add-kernel-IBRS-implementation.patch.
- commit b81e242</changelog>
  <changelog author="bp@suse.de" date="1658318401">- Refresh
  patches.suse/x86-bugs-Do-not-enable-IBPB-on-entry-when-IBPB-is-not-supp.patch.
- commit 9493568</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1658404800">-  Fix 1201644, 1201664, 1201672, 1201673, 1201676
  All are reports of the same problem - the IBRS_* regs push/popping was
  wrong but it needs
  1b331eeea7b8 ("x86/entry: Remove skip_r11rcx")
  too.
- commit cc90276</changelog>
</package>
<package pkgid="7aa239f4d1633748448076f3bf9877e4b103ffb2e0b89862a31c8646821255cb" name="kernel-default" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.87.1"/>
  <changelog author="bp@suse.de" date="1657022400">- x86/speculation: Fix firmware entry SPEC_CTRL handling
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 410bedf</changelog>
  <changelog author="bp@suse.de" date="1657022401">- x86/speculation: Fix SPEC_CTRL write on SMT state change
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 43488f5</changelog>
  <changelog author="bp@suse.de" date="1657022402">- x86/speculation: Use cached host SPEC_CTRL value for guest
  entry/exit (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 140d756</changelog>
  <changelog author="bp@suse.de" date="1657022403">- x86/speculation: Remove x86_spec_ctrl_mask (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 4f79cdb</changelog>
  <changelog author="bp@suse.de" date="1657022404">- KVM: VMX: Flatten __vmx_vcpu_run() (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit 5c70c82</changelog>
  <changelog author="bp@suse.de" date="1657022405">- KVM/nVMX: Use __vmx_vcpu_run in nested_vmx_check_vmentry_hw
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 528b21e</changelog>
  <changelog author="bp@suse.de" date="1657022406">- KVM: VMX: Convert launched argument to flags (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit e0dd694</changelog>
  <changelog author="bp@suse.de" date="1657022407">- KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit f625aa5</changelog>
  <changelog author="bp@suse.de" date="1657022408">- KVM: VMX: Fix IBRS handling after vmexit (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 79152af</changelog>
  <changelog author="bp@suse.de" date="1657022409">- x86/speculation: Fill RSB on vmexit for IBRS (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit fd58624</changelog>
  <changelog author="bp@suse.de" date="1657022410">- KVM: VMX: Prevent RSB underflow before vmenter (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit a2b7d09</changelog>
  <changelog author="bp@suse.de" date="1657022411">- x86/common: Stamp out the stepping madness (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 3962a01</changelog>
  <changelog author="bp@suse.de" date="1657022412">- x86/cpu/amd: Enumerate BTC_NO (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit b7a3331</changelog>
  <changelog author="aabdallah@suse.de" date="1657281600">- ibmvnic: Properly dispose of all skbs during a failover
  (bsc#1200925).
- commit 06221e8</changelog>
  <changelog author="bp@suse.de" date="1657281601">- x86/bugs: Add Cannon lake to RETBleed affected CPU list
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 6b54061</changelog>
  <changelog author="bp@suse.de" date="1657281602">- x86/bugs: Do not enable IBPB-on-entry when IBPB is not supported
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 41afdd9</changelog>
  <changelog author="bp@suse.de" date="1657281603">- x86/kexec: Disable RET on kexec (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit ef1c2ca</changelog>
  <changelog author="bp@suse.de" date="1658318400">- x86/entry: Remove skip_r11rcx (bsc#1201644).
- Refresh
  patches.suse/x86-entry-Add-kernel-IBRS-implementation.patch.
- commit b81e242</changelog>
  <changelog author="bp@suse.de" date="1658318401">- Refresh
  patches.suse/x86-bugs-Do-not-enable-IBPB-on-entry-when-IBPB-is-not-supp.patch.
- commit 9493568</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1658404800">-  Fix 1201644, 1201664, 1201672, 1201673, 1201676
  All are reports of the same problem - the IBRS_* regs push/popping was
  wrong but it needs
  1b331eeea7b8 ("x86/entry: Remove skip_r11rcx")
  too.
- commit cc90276</changelog>
</package>
<package pkgid="d9e7335115de1a03b0ed528713f24f1e46937731ef6baca08e95598460b9dd20" name="kernel-default-base" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="150300.59.76.1.150300.18.45.2"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="db70ea78cbc1ed0b61847636d2b10413a589d884776ccff0c3b2307a548885e8" name="kernel-default-base" arch="src">
  <version epoch="0" ver="5.3.18" rel="150300.59.76.1.150300.18.45.2"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="fa19f7d643cc539cc7ff7b3c166bc539e31adb4d5d5ac53a51501569f035dce2" name="kernel-default-base" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.76.1.150300.18.45.2"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="34ba08043c254bb68af2d9aa6c9169bf393e8641855b3ced53fe3248564c29b6" name="kernel-default-base" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="150300.59.81.1.150300.18.47.2"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="80ccb11912a07d7add839f5c3b2eb3d6f312e4e6c93e7648474fe8143a463dd7" name="kernel-default-base" arch="src">
  <version epoch="0" ver="5.3.18" rel="150300.59.81.1.150300.18.47.2"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="35d7e785ac2cb88b89f4f229251c47434f0c710e3421c038d961b52ce40a8918" name="kernel-default-base" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.81.1.150300.18.47.2"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="8c88817f03db0373a3d1a63e4aa55259224ec26015428fa798d34ce762557692" name="kernel-default-base" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="150300.59.87.1.150300.18.50.2"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="a103f4ad7798f3a74c81500b0182ae36bb1d6aa14cb458a32d1492da4c0802fa" name="kernel-default-base" arch="src">
  <version epoch="0" ver="5.3.18" rel="150300.59.87.1.150300.18.50.2"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="6fcbd8fa522f0ff1de0ff807187ebed7242c1e76837fa5f798eb232ad6fd3f96" name="kernel-default-base" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.87.1.150300.18.50.2"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="3286d9d2b35f966caafee7e20357c762a120be7ace74dde56cdbb1503afcb3d3" name="kernel-rt" arch="src">
  <version epoch="0" ver="5.3.18" rel="150300.93.1"/>
  <changelog author="jgross@suse.com" date="1654862400">- KVM: x86: Fix emulation in writing cr8 (git-fixes).
- commit a28f4e5</changelog>
  <changelog author="jgross@suse.com" date="1654862401">- KVM: x86/emulator: Defer not-present segment check in
  __load_segment_descriptor() (git-fixes).
- commit 27bee90</changelog>
  <changelog author="jgross@suse.com" date="1654862402">- kvm: x86/cpuid: Only provide CPUID leaf 0xA if host has
  architectural PMU (git-fixes).
- commit b46bf26</changelog>
  <changelog author="ohering@suse.de" date="1655121600">- PCI: hv: Fix NUMA node assignment when kernel boots with custom
  NUMA topology (bsc#1199365).
- commit 533234b</changelog>
  <changelog author="jack@suse.cz" date="1655121601">- blk-mq: fix tag_get wait task can't be awakened (bsc#1200263).
- commit 0a1fb57</changelog>
  <changelog author="jack@suse.cz" date="1655121602">- blk-mq: Fix wrong wakeup batch configuration which will cause
  hang (bsc#1200263).
- commit d25a54b</changelog>
  <changelog author="osalvador@suse.de" date="1655208000">- Rename colliding patches before the next origin/cve/linux-5.3 -&gt; SLE15-SP3 merge
- commit 070ca14</changelog>
  <changelog author="neilb@suse.de" date="1655208001">- NFS: Don't report ENOSPC write errors twice (git-fixes).
- nfsd: Fix null-ptr-deref in nfsd_fill_super() (git-fixes).
- md: fix an incorrect NULL check in md_reload_sb (git-fixes).
- md: fix an incorrect NULL check in does_sb_need_changing
  (git-fixes).
- raid5: introduce MD_BROKEN (git-fixes).
- commit a49fc21</changelog>
  <changelog author="ptesarik@suse.cz" date="1655208002">- s390/mcck: isolate SIE instruction when setting CIF_MCCK_GUEST
  flag (git-fixes).
- s390/crypto: fix scatterwalk_unmap() callers in AES-GCM
  (git-fixes).
- s390/lcs: fix variable dereferenced before check (git-fixes).
- s390/ctcm: fix potential memory leak (git-fixes).
- s390/ctcm: fix variable dereferenced before check (git-fixes).
- s390/dasd: Fix read inconsistency for ESE DASD devices
  (bsc#1200206 LTC#198455).
- s390/dasd: Fix read for ESE with blksize &lt; 4k (bsc#1200206
  LTC#198455).
- s390/dasd: prevent double format of tracks for ESE devices
  (bsc#1200207 LTC#198454).
- s390/dasd: fix data corruption for ESE devices (bsc#1200207
  LTC#198454).
- KVM: s390: vsie/gmap: reduce gmap_rmap overhead (git-fixes).
- s390/nmi: handle vector validity failures for KVM guests
  (git-fixes).
- s390/nmi: handle guarded storage validity failures for KVM
  guests (git-fixes).
- vfio/ccw: Remove unneeded GFP_DMA (git-fixes).
- KVM: s390: pv: avoid stalls for kvm_s390_pv_init_vm (git-fixes).
- KVM: s390: pv: avoid double free of sida page (git-fixes).
- KVM: s390: pv: add macros for UVC CC values (git-fixes).
- s390: fix strrchr() implementation (git-fixes).
- s390/pv: fix the forcing of the swiotlb (git-fixes).
- s390/qdio: cancel the ESTABLISH ccw after timeout (git-fixes).
- s390/qdio: fix roll-back after timeout on ESTABLISH ccw
  (git-fixes).
- s390/ftrace: fix ftrace_update_ftrace_func implementation
  (git-fixes).
- s390/cio: dont call css_wait_for_slow_path() inside a lock
  (git-fixes).
- s390/cio: Fix the "type" field in s390_cio_tpi tracepoint
  (git-fixes).
- s390/mcck: fix invalid KVM guest condition check (git-fixes).
- vfio-ccw: Check initialized flag in cp_init() (git-fixes).
- s390: fix detection of vector enhancements facility 1 vs. vector
  packed decimal facility (git-fixes).
- s390/vfio-ap: fix circular lockdep when setting/clearing crypto
  masks (git-fixes).
- virtio/s390: implement virtio-ccw revision 2 correctly
  (git-fixes).
- commit 61a09d5</changelog>
  <changelog author="osalvador@suse.de" date="1655208003">- Update config files
- commit 0d6e862</changelog>
  <changelog author="oneukum@suse.com" date="1655208004">- platform/x86: wmi: Replace read_takes_no_args with a flags field
  (git-fixes).
- commit 2771a0e</changelog>
  <changelog author="oneukum@suse.com" date="1655208005">- platform/x86: wmi: Fix driver-&gt;notify() vs -&gt;probe() race
  (git-fixes).
- commit e932131</changelog>
  <changelog author="osalvador@suse.de" date="1655208006">- Refresh 0002-PKCS-7-Check-codeSigning-EKU-for-kernel-module-and-k.patch
- commit 4835ae7</changelog>
  <changelog author="tiwai@suse.de" date="1655294400">- ata: libata-transport: fix {dma|pio|xfer}_mode sysfs files
  (git-fixes).
- ALSA: hda/conexant - Fix loopback issue with CX20632
  (git-fixes).
- ALSA: usb-audio: Set up (implicit) sync for Saffire 6
  (git-fixes).
- ALSA: usb-audio: Skip generic sync EP parse for secondary EP
  (git-fixes).
- clocksource/drivers/oxnas-rps: Fix irq_of_parse_and_map()
  return value (git-fixes).
- clocksource/drivers/sp804: Avoid error on multiple instances
  (git-fixes).
- dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size
  data type (git-fixes).
- ASoC: max98357a: remove dependency on GPIOLIB (git-fixes).
- ASoC: rt5645: Fix errorenous cleanup order (git-fixes).
- ASoC: tscs454: Add endianness flag in snd_soc_component_driver
  (git-fixes).
- ASoC: dapm: Don't fold register value changes into notifications
  (git-fixes).
- ALSA: usb-audio: Workaround for clock setup on TEAC devices
  (git-fixes).
- ath9k: fix QCA9561 PA bias level (git-fixes).
- b43: Fix assigning negative value to unsigned variable
  (git-fixes).
- b43legacy: Fix assigning negative value to unsigned variable
  (git-fixes).
- ACPI: sysfs: Fix BERT error region memory mapping (git-fixes).
- ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default
  (git-fixes).
- cfg80211: set custom regdomain after wiphy registration
  (git-fixes).
- ACPI: sysfs: Make sparse happy about address space in use
  (git-fixes).
- commit d8922a7</changelog>
  <changelog author="tiwai@suse.de" date="1655294401">- drm/atomic: Force bridge self-refresh-exit on CRTC switch
  (git-fixes).
- drm/bridge: analogix_dp: Support PSR-exit to disable transition
  (git-fixes).
- Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag
  (git-fixes).
- iio: dummy: iio_simple_dummy: check the return value of
  kstrdup() (git-fixes).
- drm/amdgpu/cs: make commands with 0 chunks illegal behaviour
  (git-fixes).
- drm/radeon: fix a possible null pointer dereference (git-fixes).
- i2c: cadence: Increase timeout per message if necessary
  (git-fixes).
- drm/amdgpu/ucode: Remove firmware load type check in
  amdgpu_ucode_free_bo (git-fixes).
- drm: msm: fix error check return value of irq_of_parse_and_map()
  (git-fixes).
- drm/plane: Move range check for format_count earlier
  (git-fixes).
- drm/komeda: return early if drm_universal_plane_init() fails
  (git-fixes).
- fbcon: Consistently protect deferred_takeover with
  console_lock() (git-fixes).
- drm/virtio: fix NULL pointer dereference in
  virtio_gpu_conn_get_modes (git-fixes).
- drm/i915: Fix -Wstringop-overflow warning in call to
  intel_read_wm_latency() (git-fixes).
- iwlwifi: mvm: fix assert 1F04 upon reconfig (git-fixes).
- mac80211: upgrade passive scan to active scan on DFS channels
  after beacon rx (git-fixes).
- ipw2x00: Fix potential NULL dereference in libipw_xmit()
  (git-fixes).
- HID: bigben: fix slab-out-of-bounds Write in bigben_probe
  (git-fixes).
- HID: multitouch: Add support for Google Whiskers Touchpad
  (git-fixes).
- hwmon: Make chip parameter for with_info API mandatory
  (git-fixes).
- irqchip: irq-xtensa-mx: fix initial IRQ affinity (git-fixes).
- irqchip/armada-370-xp: Do not touch Performance Counter Overflow
  on A375, A38x, A39x (git-fixes).
- irqchip/aspeed-i2c-ic: Fix irq_of_parse_and_map() return value
  (git-fixes).
- irqchip/exiu: Fix acknowledgment of edge triggered interrupts
  (git-fixes).
- efi: Add missing prototype for efi_capsule_setup_info
  (git-fixes).
- drivers: i2c: thunderx: Allow driver to work with ACPI defined
  TWSI controllers (git-fixes).
- i2c: ismt: Provide a DMA buffer for Interrupt Cause Logging
  (git-fixes).
- Input: goodix - fix spurious key release events (git-fixes).
- commit 71b82f0</changelog>
  <changelog author="tiwai@suse.de" date="1655294402">- efi: Do not import certificates from UEFI Secure Boot for T2
  Macs (git-fixes).
- Refresh
  patches.suse/0003-MODSIGN-load-blacklist-from-MOKx.patch.
- commit 316d54d</changelog>
  <changelog author="tiwai@suse.de" date="1655294403">- vringh: Fix loop descriptors check in the indirect cases
  (git-fixes).
- mmc: block: Fix CQE recovery reset success (git-fixes).
- modpost: fix undefined behavior of is_arm_mapping_symbol()
  (git-fixes).
- modpost: fix removing numeric suffixes (git-fixes).
- misc: rtsx: set NULL intfdata when probe fails (git-fixes).
- USB: new quirk for Dell Gen 2 devices (git-fixes).
- USB: serial: option: add Quectel BG95 modem (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- usb: dwc2: gadget: don't reset gadget's driver-&gt;bus (git-fixes).
- USB: hcd-pci: Fully suspend across freeze/thaw cycle
  (git-fixes).
- drivers: usb: host: Fix deadlock in oxu_bus_suspend()
  (git-fixes).
- USB: host: isp116x: check return value after calling
  platform_get_resource() (git-fixes).
- serial: msm_serial: disable interrupts in __msm_console_write()
  (git-fixes).
- drivers: tty: serial: Fix deadlock in sa1100_set_termios()
  (git-fixes).
- tty: Fix a possible resource leak in icom_probe (git-fixes).
- tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
  (git-fixes).
- staging: rtl8712: fix uninit-value in r871xu_drv_init()
  (git-fixes).
- staging: rtl8712: fix uninit-value in usb_read8() and friends
  (git-fixes).
- drivers: staging: rtl8192e: Fix deadlock in
  rtllib_beacons_stop() (git-fixes).
- drivers: staging: rtl8192u: Fix deadlock in
  ieee80211_beacons_stop() (git-fixes).
- watchdog: wdat_wdt: Stop watchdog when rebooting the system
  (git-fixes).
- pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards (git-fixes).
- video: fbdev: pxa3xx-gcu: release the resources correctly in
  pxa3xx_gcu_probe/remove() (git-fixes).
- rtlwifi: Use pr_warn instead of WARN_ONCE (git-fixes).
- rtl818x: Prevent using not initialized queues (git-fixes).
- mwifiex: add mutex lock for call in
  mwifiex_dfs_chan_sw_work_queue (git-fixes).
- media: cx25821: Fix the warning when removing the module
  (git-fixes).
- media: pci: cx23885: Fix the error handling in cx23885_initdev()
  (git-fixes).
- media: venus: hfi: avoid null dereference in deinit (git-fixes).
- PM / devfreq: rk3399_dmc: Disable edev on remove() (git-fixes).
- spi: stm32-qspi: Fix wait_cmd timeout in APM mode (git-fixes).
- spi: spi-rspi: Remove setting {src,dst}_{addr,addr_width}
  based on DMA direction (git-fixes).
- mmc: jz4740: Apply DMA engine limits to maximum segment size
  (git-fixes).
- pinctrl: sunxi: fix f1c100s uart2 function (git-fixes).
- platform/chrome: cros_ec_proto: Send command again when timeout
  occurs (git-fixes).
- commit f8749e6</changelog>
  <changelog author="tiwai@suse.de" date="1655294404">- ALSA: usb-audio: Optimize TEAC clock quirk (git-fixes).
- commit 4bfd1c5</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1655380800">- igmp: Add ip_mc_list lock in ip_check_mc_rcu (bsc#1200604
  CVE-2022-20141).
- commit 34bf464</changelog>
  <changelog author="mgorman@suse.de" date="1655726400">- Update -rt config files.
- commit b1cf921</changelog>
</package>
<package pkgid="1271b4871098f95028e518e243036dcaf5ec47fc214f513fd2bd2d3bb1630a0e" name="kernel-rt" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.93.1"/>
  <changelog author="jgross@suse.com" date="1654862400">- KVM: x86: Fix emulation in writing cr8 (git-fixes).
- commit a28f4e5</changelog>
  <changelog author="jgross@suse.com" date="1654862401">- KVM: x86/emulator: Defer not-present segment check in
  __load_segment_descriptor() (git-fixes).
- commit 27bee90</changelog>
  <changelog author="jgross@suse.com" date="1654862402">- kvm: x86/cpuid: Only provide CPUID leaf 0xA if host has
  architectural PMU (git-fixes).
- commit b46bf26</changelog>
  <changelog author="ohering@suse.de" date="1655121600">- PCI: hv: Fix NUMA node assignment when kernel boots with custom
  NUMA topology (bsc#1199365).
- commit 533234b</changelog>
  <changelog author="jack@suse.cz" date="1655121601">- blk-mq: fix tag_get wait task can't be awakened (bsc#1200263).
- commit 0a1fb57</changelog>
  <changelog author="jack@suse.cz" date="1655121602">- blk-mq: Fix wrong wakeup batch configuration which will cause
  hang (bsc#1200263).
- commit d25a54b</changelog>
  <changelog author="osalvador@suse.de" date="1655208000">- Rename colliding patches before the next origin/cve/linux-5.3 -&gt; SLE15-SP3 merge
- commit 070ca14</changelog>
  <changelog author="neilb@suse.de" date="1655208001">- NFS: Don't report ENOSPC write errors twice (git-fixes).
- nfsd: Fix null-ptr-deref in nfsd_fill_super() (git-fixes).
- md: fix an incorrect NULL check in md_reload_sb (git-fixes).
- md: fix an incorrect NULL check in does_sb_need_changing
  (git-fixes).
- raid5: introduce MD_BROKEN (git-fixes).
- commit a49fc21</changelog>
  <changelog author="ptesarik@suse.cz" date="1655208002">- s390/mcck: isolate SIE instruction when setting CIF_MCCK_GUEST
  flag (git-fixes).
- s390/crypto: fix scatterwalk_unmap() callers in AES-GCM
  (git-fixes).
- s390/lcs: fix variable dereferenced before check (git-fixes).
- s390/ctcm: fix potential memory leak (git-fixes).
- s390/ctcm: fix variable dereferenced before check (git-fixes).
- s390/dasd: Fix read inconsistency for ESE DASD devices
  (bsc#1200206 LTC#198455).
- s390/dasd: Fix read for ESE with blksize &lt; 4k (bsc#1200206
  LTC#198455).
- s390/dasd: prevent double format of tracks for ESE devices
  (bsc#1200207 LTC#198454).
- s390/dasd: fix data corruption for ESE devices (bsc#1200207
  LTC#198454).
- KVM: s390: vsie/gmap: reduce gmap_rmap overhead (git-fixes).
- s390/nmi: handle vector validity failures for KVM guests
  (git-fixes).
- s390/nmi: handle guarded storage validity failures for KVM
  guests (git-fixes).
- vfio/ccw: Remove unneeded GFP_DMA (git-fixes).
- KVM: s390: pv: avoid stalls for kvm_s390_pv_init_vm (git-fixes).
- KVM: s390: pv: avoid double free of sida page (git-fixes).
- KVM: s390: pv: add macros for UVC CC values (git-fixes).
- s390: fix strrchr() implementation (git-fixes).
- s390/pv: fix the forcing of the swiotlb (git-fixes).
- s390/qdio: cancel the ESTABLISH ccw after timeout (git-fixes).
- s390/qdio: fix roll-back after timeout on ESTABLISH ccw
  (git-fixes).
- s390/ftrace: fix ftrace_update_ftrace_func implementation
  (git-fixes).
- s390/cio: dont call css_wait_for_slow_path() inside a lock
  (git-fixes).
- s390/cio: Fix the "type" field in s390_cio_tpi tracepoint
  (git-fixes).
- s390/mcck: fix invalid KVM guest condition check (git-fixes).
- vfio-ccw: Check initialized flag in cp_init() (git-fixes).
- s390: fix detection of vector enhancements facility 1 vs. vector
  packed decimal facility (git-fixes).
- s390/vfio-ap: fix circular lockdep when setting/clearing crypto
  masks (git-fixes).
- virtio/s390: implement virtio-ccw revision 2 correctly
  (git-fixes).
- commit 61a09d5</changelog>
  <changelog author="osalvador@suse.de" date="1655208003">- Update config files
- commit 0d6e862</changelog>
  <changelog author="oneukum@suse.com" date="1655208004">- platform/x86: wmi: Replace read_takes_no_args with a flags field
  (git-fixes).
- commit 2771a0e</changelog>
  <changelog author="oneukum@suse.com" date="1655208005">- platform/x86: wmi: Fix driver-&gt;notify() vs -&gt;probe() race
  (git-fixes).
- commit e932131</changelog>
  <changelog author="osalvador@suse.de" date="1655208006">- Refresh 0002-PKCS-7-Check-codeSigning-EKU-for-kernel-module-and-k.patch
- commit 4835ae7</changelog>
  <changelog author="tiwai@suse.de" date="1655294400">- ata: libata-transport: fix {dma|pio|xfer}_mode sysfs files
  (git-fixes).
- ALSA: hda/conexant - Fix loopback issue with CX20632
  (git-fixes).
- ALSA: usb-audio: Set up (implicit) sync for Saffire 6
  (git-fixes).
- ALSA: usb-audio: Skip generic sync EP parse for secondary EP
  (git-fixes).
- clocksource/drivers/oxnas-rps: Fix irq_of_parse_and_map()
  return value (git-fixes).
- clocksource/drivers/sp804: Avoid error on multiple instances
  (git-fixes).
- dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size
  data type (git-fixes).
- ASoC: max98357a: remove dependency on GPIOLIB (git-fixes).
- ASoC: rt5645: Fix errorenous cleanup order (git-fixes).
- ASoC: tscs454: Add endianness flag in snd_soc_component_driver
  (git-fixes).
- ASoC: dapm: Don't fold register value changes into notifications
  (git-fixes).
- ALSA: usb-audio: Workaround for clock setup on TEAC devices
  (git-fixes).
- ath9k: fix QCA9561 PA bias level (git-fixes).
- b43: Fix assigning negative value to unsigned variable
  (git-fixes).
- b43legacy: Fix assigning negative value to unsigned variable
  (git-fixes).
- ACPI: sysfs: Fix BERT error region memory mapping (git-fixes).
- ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default
  (git-fixes).
- cfg80211: set custom regdomain after wiphy registration
  (git-fixes).
- ACPI: sysfs: Make sparse happy about address space in use
  (git-fixes).
- commit d8922a7</changelog>
  <changelog author="tiwai@suse.de" date="1655294401">- drm/atomic: Force bridge self-refresh-exit on CRTC switch
  (git-fixes).
- drm/bridge: analogix_dp: Support PSR-exit to disable transition
  (git-fixes).
- Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag
  (git-fixes).
- iio: dummy: iio_simple_dummy: check the return value of
  kstrdup() (git-fixes).
- drm/amdgpu/cs: make commands with 0 chunks illegal behaviour
  (git-fixes).
- drm/radeon: fix a possible null pointer dereference (git-fixes).
- i2c: cadence: Increase timeout per message if necessary
  (git-fixes).
- drm/amdgpu/ucode: Remove firmware load type check in
  amdgpu_ucode_free_bo (git-fixes).
- drm: msm: fix error check return value of irq_of_parse_and_map()
  (git-fixes).
- drm/plane: Move range check for format_count earlier
  (git-fixes).
- drm/komeda: return early if drm_universal_plane_init() fails
  (git-fixes).
- fbcon: Consistently protect deferred_takeover with
  console_lock() (git-fixes).
- drm/virtio: fix NULL pointer dereference in
  virtio_gpu_conn_get_modes (git-fixes).
- drm/i915: Fix -Wstringop-overflow warning in call to
  intel_read_wm_latency() (git-fixes).
- iwlwifi: mvm: fix assert 1F04 upon reconfig (git-fixes).
- mac80211: upgrade passive scan to active scan on DFS channels
  after beacon rx (git-fixes).
- ipw2x00: Fix potential NULL dereference in libipw_xmit()
  (git-fixes).
- HID: bigben: fix slab-out-of-bounds Write in bigben_probe
  (git-fixes).
- HID: multitouch: Add support for Google Whiskers Touchpad
  (git-fixes).
- hwmon: Make chip parameter for with_info API mandatory
  (git-fixes).
- irqchip: irq-xtensa-mx: fix initial IRQ affinity (git-fixes).
- irqchip/armada-370-xp: Do not touch Performance Counter Overflow
  on A375, A38x, A39x (git-fixes).
- irqchip/aspeed-i2c-ic: Fix irq_of_parse_and_map() return value
  (git-fixes).
- irqchip/exiu: Fix acknowledgment of edge triggered interrupts
  (git-fixes).
- efi: Add missing prototype for efi_capsule_setup_info
  (git-fixes).
- drivers: i2c: thunderx: Allow driver to work with ACPI defined
  TWSI controllers (git-fixes).
- i2c: ismt: Provide a DMA buffer for Interrupt Cause Logging
  (git-fixes).
- Input: goodix - fix spurious key release events (git-fixes).
- commit 71b82f0</changelog>
  <changelog author="tiwai@suse.de" date="1655294402">- efi: Do not import certificates from UEFI Secure Boot for T2
  Macs (git-fixes).
- Refresh
  patches.suse/0003-MODSIGN-load-blacklist-from-MOKx.patch.
- commit 316d54d</changelog>
  <changelog author="tiwai@suse.de" date="1655294403">- vringh: Fix loop descriptors check in the indirect cases
  (git-fixes).
- mmc: block: Fix CQE recovery reset success (git-fixes).
- modpost: fix undefined behavior of is_arm_mapping_symbol()
  (git-fixes).
- modpost: fix removing numeric suffixes (git-fixes).
- misc: rtsx: set NULL intfdata when probe fails (git-fixes).
- USB: new quirk for Dell Gen 2 devices (git-fixes).
- USB: serial: option: add Quectel BG95 modem (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- usb: dwc2: gadget: don't reset gadget's driver-&gt;bus (git-fixes).
- USB: hcd-pci: Fully suspend across freeze/thaw cycle
  (git-fixes).
- drivers: usb: host: Fix deadlock in oxu_bus_suspend()
  (git-fixes).
- USB: host: isp116x: check return value after calling
  platform_get_resource() (git-fixes).
- serial: msm_serial: disable interrupts in __msm_console_write()
  (git-fixes).
- drivers: tty: serial: Fix deadlock in sa1100_set_termios()
  (git-fixes).
- tty: Fix a possible resource leak in icom_probe (git-fixes).
- tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
  (git-fixes).
- staging: rtl8712: fix uninit-value in r871xu_drv_init()
  (git-fixes).
- staging: rtl8712: fix uninit-value in usb_read8() and friends
  (git-fixes).
- drivers: staging: rtl8192e: Fix deadlock in
  rtllib_beacons_stop() (git-fixes).
- drivers: staging: rtl8192u: Fix deadlock in
  ieee80211_beacons_stop() (git-fixes).
- watchdog: wdat_wdt: Stop watchdog when rebooting the system
  (git-fixes).
- pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards (git-fixes).
- video: fbdev: pxa3xx-gcu: release the resources correctly in
  pxa3xx_gcu_probe/remove() (git-fixes).
- rtlwifi: Use pr_warn instead of WARN_ONCE (git-fixes).
- rtl818x: Prevent using not initialized queues (git-fixes).
- mwifiex: add mutex lock for call in
  mwifiex_dfs_chan_sw_work_queue (git-fixes).
- media: cx25821: Fix the warning when removing the module
  (git-fixes).
- media: pci: cx23885: Fix the error handling in cx23885_initdev()
  (git-fixes).
- media: venus: hfi: avoid null dereference in deinit (git-fixes).
- PM / devfreq: rk3399_dmc: Disable edev on remove() (git-fixes).
- spi: stm32-qspi: Fix wait_cmd timeout in APM mode (git-fixes).
- spi: spi-rspi: Remove setting {src,dst}_{addr,addr_width}
  based on DMA direction (git-fixes).
- mmc: jz4740: Apply DMA engine limits to maximum segment size
  (git-fixes).
- pinctrl: sunxi: fix f1c100s uart2 function (git-fixes).
- platform/chrome: cros_ec_proto: Send command again when timeout
  occurs (git-fixes).
- commit f8749e6</changelog>
  <changelog author="tiwai@suse.de" date="1655294404">- ALSA: usb-audio: Optimize TEAC clock quirk (git-fixes).
- commit 4bfd1c5</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1655380800">- igmp: Add ip_mc_list lock in ip_check_mc_rcu (bsc#1200604
  CVE-2022-20141).
- commit 34bf464</changelog>
  <changelog author="mgorman@suse.de" date="1655726400">- Update -rt config files.
- commit b1cf921</changelog>
</package>
<package pkgid="7247de67908c1cf2b6615d780d591acb884ba3a17af082b35e8ff655a6ad6288" name="kernel-rt" arch="src">
  <version epoch="0" ver="5.3.18" rel="150300.96.1"/>
  <changelog author="bp@suse.de" date="1657022400">- x86/bugs: Do IBPB fallback check only once (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 914bf03</changelog>
  <changelog author="bp@suse.de" date="1657022401">- x86/cpu/amd: Add Spectral Chicken (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit 3ed82bb</changelog>
  <changelog author="bp@suse.de" date="1657022402">- x86/speculation: Fix firmware entry SPEC_CTRL handling
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 410bedf</changelog>
  <changelog author="bp@suse.de" date="1657022403">- x86/speculation: Fix SPEC_CTRL write on SMT state change
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 43488f5</changelog>
  <changelog author="bp@suse.de" date="1657022404">- x86/speculation: Use cached host SPEC_CTRL value for guest
  entry/exit (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 140d756</changelog>
  <changelog author="bp@suse.de" date="1657022405">- x86/speculation: Remove x86_spec_ctrl_mask (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 4f79cdb</changelog>
  <changelog author="bp@suse.de" date="1657022406">- KVM: VMX: Flatten __vmx_vcpu_run() (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit 5c70c82</changelog>
  <changelog author="bp@suse.de" date="1657022407">- KVM/nVMX: Use __vmx_vcpu_run in nested_vmx_check_vmentry_hw
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 528b21e</changelog>
  <changelog author="bp@suse.de" date="1657022408">- KVM: VMX: Convert launched argument to flags (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit e0dd694</changelog>
  <changelog author="bp@suse.de" date="1657022409">- KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit f625aa5</changelog>
  <changelog author="bp@suse.de" date="1657022410">- KVM: VMX: Fix IBRS handling after vmexit (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 79152af</changelog>
  <changelog author="bp@suse.de" date="1657022411">- x86/speculation: Fill RSB on vmexit for IBRS (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit fd58624</changelog>
  <changelog author="bp@suse.de" date="1657022412">- KVM: VMX: Prevent RSB underflow before vmenter (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit a2b7d09</changelog>
  <changelog author="bp@suse.de" date="1657022413">- x86/common: Stamp out the stepping madness (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 3962a01</changelog>
  <changelog author="bp@suse.de" date="1657022414">- x86/cpu/amd: Enumerate BTC_NO (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit b7a3331</changelog>
  <changelog author="mgorman@suse.de" date="1657195200">- Refresh to adhere to Patch-mainline tag policy
  patches.rt/printk-Don-t-try-to-print-from-IRQ-NMI-region.patch.
  patches.rt/printk-Drop-the-logbuf_lock-more-often.patch.
  patches.rt/printk-Make-rt-aware.patch.
  patches.rt/printk-Switch-to-the-sync-mode-when-an-emergency-mes.patch.
  patches.rt/printk-do-not-wakeup-printk-kthread-directly.patch.
  patches.rt/printk-fix-suspend-hang.patch.
  patches.rt/printk-make-async.patch.
  patches.rt/printk-make-synchronous-param-rw.patch.
  patches.rt/printk-make-wakeup-klogd-async-fixup.patch.
  patches.rt/printk-make-wakeup-klogd-async.patch.
  patches.rt/printk-xen-Force-printk-sync-mode-when-migrating-Xen.patch.
- commit cfedad7</changelog>
  <changelog author="aabdallah@suse.de" date="1657281600">- ibmvnic: Properly dispose of all skbs during a failover
  (bsc#1200925).
- commit 06221e8</changelog>
  <changelog author="bp@suse.de" date="1657281601">- x86/bugs: Add Cannon lake to RETBleed affected CPU list
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 6b54061</changelog>
  <changelog author="bp@suse.de" date="1657281602">- x86/bugs: Do not enable IBPB-on-entry when IBPB is not supported
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 41afdd9</changelog>
  <changelog author="bp@suse.de" date="1657281603">- x86/kexec: Disable RET on kexec (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit ef1c2ca</changelog>
</package>
<package pkgid="59ddda09b81c3586c584a04972953002b6e645bc1fa8e509139616608d4bae12" name="kernel-rt" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.96.1"/>
  <changelog author="bp@suse.de" date="1657022400">- x86/bugs: Do IBPB fallback check only once (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 914bf03</changelog>
  <changelog author="bp@suse.de" date="1657022401">- x86/cpu/amd: Add Spectral Chicken (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit 3ed82bb</changelog>
  <changelog author="bp@suse.de" date="1657022402">- x86/speculation: Fix firmware entry SPEC_CTRL handling
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 410bedf</changelog>
  <changelog author="bp@suse.de" date="1657022403">- x86/speculation: Fix SPEC_CTRL write on SMT state change
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 43488f5</changelog>
  <changelog author="bp@suse.de" date="1657022404">- x86/speculation: Use cached host SPEC_CTRL value for guest
  entry/exit (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 140d756</changelog>
  <changelog author="bp@suse.de" date="1657022405">- x86/speculation: Remove x86_spec_ctrl_mask (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 4f79cdb</changelog>
  <changelog author="bp@suse.de" date="1657022406">- KVM: VMX: Flatten __vmx_vcpu_run() (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit 5c70c82</changelog>
  <changelog author="bp@suse.de" date="1657022407">- KVM/nVMX: Use __vmx_vcpu_run in nested_vmx_check_vmentry_hw
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 528b21e</changelog>
  <changelog author="bp@suse.de" date="1657022408">- KVM: VMX: Convert launched argument to flags (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit e0dd694</changelog>
  <changelog author="bp@suse.de" date="1657022409">- KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit f625aa5</changelog>
  <changelog author="bp@suse.de" date="1657022410">- KVM: VMX: Fix IBRS handling after vmexit (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 79152af</changelog>
  <changelog author="bp@suse.de" date="1657022411">- x86/speculation: Fill RSB on vmexit for IBRS (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit fd58624</changelog>
  <changelog author="bp@suse.de" date="1657022412">- KVM: VMX: Prevent RSB underflow before vmenter (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit a2b7d09</changelog>
  <changelog author="bp@suse.de" date="1657022413">- x86/common: Stamp out the stepping madness (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 3962a01</changelog>
  <changelog author="bp@suse.de" date="1657022414">- x86/cpu/amd: Enumerate BTC_NO (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit b7a3331</changelog>
  <changelog author="mgorman@suse.de" date="1657195200">- Refresh to adhere to Patch-mainline tag policy
  patches.rt/printk-Don-t-try-to-print-from-IRQ-NMI-region.patch.
  patches.rt/printk-Drop-the-logbuf_lock-more-often.patch.
  patches.rt/printk-Make-rt-aware.patch.
  patches.rt/printk-Switch-to-the-sync-mode-when-an-emergency-mes.patch.
  patches.rt/printk-do-not-wakeup-printk-kthread-directly.patch.
  patches.rt/printk-fix-suspend-hang.patch.
  patches.rt/printk-make-async.patch.
  patches.rt/printk-make-synchronous-param-rw.patch.
  patches.rt/printk-make-wakeup-klogd-async-fixup.patch.
  patches.rt/printk-make-wakeup-klogd-async.patch.
  patches.rt/printk-xen-Force-printk-sync-mode-when-migrating-Xen.patch.
- commit cfedad7</changelog>
  <changelog author="aabdallah@suse.de" date="1657281600">- ibmvnic: Properly dispose of all skbs during a failover
  (bsc#1200925).
- commit 06221e8</changelog>
  <changelog author="bp@suse.de" date="1657281601">- x86/bugs: Add Cannon lake to RETBleed affected CPU list
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 6b54061</changelog>
  <changelog author="bp@suse.de" date="1657281602">- x86/bugs: Do not enable IBPB-on-entry when IBPB is not supported
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 41afdd9</changelog>
  <changelog author="bp@suse.de" date="1657281603">- x86/kexec: Disable RET on kexec (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit ef1c2ca</changelog>
</package>
<package pkgid="20c4154a0ee0a9bd204b5793b8d231db88dd8f3e53d40034754a6b3dfa42a28e" name="ldb" arch="src">
  <version epoch="0" ver="2.4.3" rel="150300.3.20.1"/>
  <changelog author="scabrero@suse.de" date="1542024000">- Update to 1.4.3
  + Python: Ensure ldb.Dn can accept utf8 encoded unicode (bug 13616)</changelog>
  <changelog author="dmulder@suse.com" date="1549454400">- Update to 1.5.2
  + dirsync: Allow arbitrary length cookies (bug #13686)
  + The build uses python3 by default: --extra-python would take
    python2 now
  + To build with python2 only use:
    PYTHON=python2 ./configure
    PYTHON=python2 make
    PYTHON=python2 make install</changelog>
  <changelog author="dmulder@suse.com" date="1551787200">- Update to 1.5.4
  + Fix standalone build of ldb.
  + C99 build fixes.
  + CVE-2019-3824 out of bounds read in wildcard compare (bug#13773)
- Update to 1.5.3
  + Avoid inefficient one-level searches (bug#13762)
  + The test api.py should not rely on order of entries in dict (bug#13772)</changelog>
  <changelog author="scabrero@suse.de" date="1564660800">- Update to 1.5.5
  + LDAP_REFERRAL_SCHEME_OPAQUE was added to ldb_module.h; (bso#12478);
  + Skip @ records early in a search full scan; (bso#13893);</changelog>
  <changelog author="jmcdonough@suse.com" date="1570104000">- Update to version 2.0.7
  + Robustness improvements against duplicate attributes in ldb_filter_attrs()
    (bso#13695)
  + Robustness improvements against invalid string DN values (bso#14049)
  + log database repack so users know what is happening (bso#14059)
  + add ldb_options_get
  + add "batch_mode" option.
  + Remove Python 2.x support except to build just the bare C library
  + Remove --extra-python (a build time mode to produce Python2 and Python3
    bindings at the same time)
  + Fix standalone build of ldb.
  + CVE-2019-3824 out of bounds read in wildcard compare (bso#13773)</changelog>
  <changelog author="nopower@suse.com" date="1576756800">- Add obsolete ldb1 directive to baselibs.conf</changelog>
  <changelog author="dmulder@suse.com" date="1579262400">- libldb1 fails to migrate to libldb2 when libldb2 version is less
  than libldb1 version; (bsc#1160341)</changelog>
  <changelog author="david.mulder@suse.com" date="1579694400">ldb: Release ldb 2.0.8
  + Upgrade waf to version 2.0.18 to match the rest of Samba 4.11.x
    (bso#13846)</changelog>
  <changelog author="nopower@suse.com" date="1583496000">- Release ldb 2.1.1
  + Samba 4.11 and later give incorrect results for SCOPE_ONE
    searches; (bso#14270).</changelog>
  <changelog author="nopower@suse.com" date="1588075200">- Release ldb 2.1.2
  + CVE-2020-10700: ldb: Always use ldb_next_request() in
    ASQ module; ;(bso#14331); (bsc#1169850).</changelog>
  <changelog author="david.mulder@suse.com" date="1589976000">ldb: Bump version to 2.1.3; (bso#14330)</changelog>
  <changelog author="nopower@suse.com" date="1593777600">- Release ldb 2.1.4
  + CVE-2020-10730: NULL de-reference in AD DC LDAP server when
    ASQ and VLV combined; (bso#14364); (bsc#1173159)</changelog>
  <changelog author="ddiss@suse.com" date="1599825600">- Release ldb 2.2.0
  + Fix memory leak in ldb_kv_index_dn_ordered(); (bso#14299)
  + Fix off-by-one increment in lldb_add_msg_attr; (bso#14413)</changelog>
  <changelog author="scabrero@suse.de" date="1616587200">- Release ldb 2.2.1
  + CVE-2020-27840: Unauthenticated remote heap corruption via bad DNs;
    (bso#14595); (bsc#1183572);
  + CVE-2021-20277: out of bounds read in ldb_handler_fold; (bso#14655);
    (bsc#1183574);</changelog>
  <changelog author="nopower@suse.com" date="1636027200">- Add ldb-cve-2020-25718.patch &amp;
  CVE-2020-25718-lib-Add-hex_byte-to-replace.h.patch to backport all
  changes from ldb-2.4.1.
  + CVE-2020-25718: samba: An RODC can issue (forge) administrator
    tickets to other servers; (bsc#1192246); (bso#14558)
  + CVE-2021-3738: samba: crash in dsdb stack;
    (bsc#1192215);(bso#14848)
-  Release ldb 2.2.2
  + Corrected python behaviour for 'in' for LDAP attributes
  contained as part of ldb.Message;(bso#14845).
  + Fix memory handling in ldb.msg_diff
  Corrected python docstrings;(bso#14836)
  + Backport bronze bit fixes, tests, and selftest improvements;
  (bso#14881).</changelog>
  <changelog author="nopower@suse.com" date="1641297600">- Update to version 2.4.1; (jsc#SLE-23329);
  - Release 2.4.1
    + Corrected python behaviour for 'in' for LDAP attributes
    contained as part of ldb.Message; (bso#14845);
    + Fix memory handling in ldb.msg_diff; (bso#14836);
    + Corrected python docstrings
  - Release 2.4.0
    + Improve calculate_popt_array_length()
    + Use C99 initializers for builtin_popt_options[]
    + pyldb: Fix Message.items() for a message containing elements
    + pyldb: Add test for Message.items()
    + tests: Use ldbsearch '--scope instead of '-s'
    + pyldb: fix a typo
    + Change page size of guidindexpackv1.ldb
    + Use a 1MiB lmdb so the test also passes on aarch64 CentOS stream
    + attrib_handler casefold: simplify space dropping
    + fix ldb_comparison_fold off-by-one overrun
    + CVE-2020-27840: pytests: move Dn.validate test to ldb
    + CVE-2020-27840 ldb_dn: avoid head corruption in ldb_dn_explode
    + CVE-2021-20277 ldb/attrib_handlers casefold: stay in bounds
    + CVE-2021-20277 ldb tests: ldb_match tests with extra spaces
    + improve comments for ldb_module_connect_backend()
    + test/ldb_tdb: correct introductory comments
    + ldb.h: remove undefined async_ctx function signatures
    + correct comments in attrib_handers val_to_int64
    + dn tests use cmocka print functions
    + ldb_match: remove redundant check
    + add tests for ldb_wildcard_compare
    + ldb_match: trailing chunk must match end of string
    + pyldb: catch potential overflow error in py_timestring
    + ldb: remove some 'if PY3's in tests
    + Add missing break in switch statement
- Drop obsolete patch CVE-2020-25718-lib-Add-hex_byte-to-replace.h.patch
- Drop obsolete patch ldb-cve-2020-25718.patch</changelog>
  <changelog author="scabrero@suse.de" date="1641902400">- Modify packaging to allow parallel installation with libldb1
  (bsc#1192684):
  + Private libraries are installed in %{_libdir}/ldb2/
  + Modules are installed in %{_libdir}/ldb2/modules</changelog>
  <changelog author="scabrero@suse.de" date="1649246400">- Update to version 2.4.2
  + Fix for CVE-2021-3670, ensure that the LDB request has not
    timed out during filter processing as the LDAP server
    MaxQueryDuration is otherwise not honoured (bsc#1198397).</changelog>
  <changelog author="scabrero@suse.de" date="1657281600">- Update to version 2.4.3
  + Fix build problems, waf produces incorrect names for python
    extensions; (bso#15071);</changelog>
  <changelog author="nopower@suse.com" date="1657886400">- Add ldb-memory-bug-15096-4.15-ldbonly.patch to backport all
  changes for ldb-2.4.4.
  + CVE-2022-32745: samba: ldb: AD users can crash the server
    process with an LDAP add or modify request; (bso#15008);
    (bso#15096); (bsc#1201492).
  + CVE-2022-2031: samba, ldb: AD users can bypass certain
    restrictions associated with changing passwords; (bso#15047);
    (bsc#1201495);
  + CVE-2022-32744: samba, ldb: AD users can forge password change
    requests for any user; (bso#15074); (bso#15047); (bsc#1201493).</changelog>
</package>
<package pkgid="ce0acd2103f1bb0dc828c8985519652eedab78a9e7d3de3c5fcc7c05fbffcc6c" name="libapparmor" arch="src">
  <version epoch="0" ver="2.13.6" rel="150300.3.15.1"/>
  <changelog author="suse-beta@cboltz.de" date="1485604800">- split libapparmor into separate spec to get rid of build loop
  involving mariadb, systemd, apparmor, libapr and mariadb again
  (see the discussion in SR 448871 for details)
- libapparmor.spec is based on the AppArmor 2.11 apparmor.spec, but
  with minimum BuildRequires</changelog>
  <changelog author="jengelh@inai.de" date="1486814400">- Fix RPM groups</changelog>
  <changelog author="suse-beta@cboltz.de" date="1508932800">- update to AppArmor 2.11.1
  - mostly test-related changes in libapparmor
  - see http://wiki.apparmor.net/index.php/ReleaseNotes_2_11_1 for
    upstream changelog</changelog>
  <changelog author="suse-beta@cboltz.de" date="1509451200">- update to AppArmor 2.11.95 aka 2.12 beta1
  - no changes in libapparmor
  - see http://wiki.apparmor.net/index.php/ReleaseNotes_2_11_95
    for the detailed upstream changelog</changelog>
  <changelog author="suse-beta@cboltz.de" date="1514203200">- update to AppArmor 2.12
  - preserve errno across aa_*_unref() functions
  - see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.12
    for the detailed upstream changelog
- no longer package static libapparmor.a</changelog>
  <changelog author="suse-beta@cboltz.de" date="1523793600">- update to AppArmor 2.13
  - add support for multiple cache directories and cache overlays
    (boo#1069906, boo#1074429)
  - see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.13
    for the detailed upstream changelog</changelog>
  <changelog author="suse-beta@cboltz.de" date="1539518400">- update to AppArmor 2.13.1
  - several bug fixes
  - see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.13.1
    for the detailed upstream changelog</changelog>
  <changelog author="suse-beta@cboltz.de" date="1545393600">- update to AppArmor 2.13.2
  - no changes in libapparmor
  - see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.13.2
    for the detailed upstream changelog</changelog>
  <changelog author="mliska@suse.cz" date="1556020800">- Disable LTO (boo#1133091).</changelog>
  <changelog author="suse-beta@cboltz.de" date="1560859200">- update to AppArmor 2.13.1
  - some fixes in cache handling
  - see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.13.3
    for the detailed upstream changelog</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - fix log parsing for logs with an embedded newline
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - fix two potential build failures
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
</package>
<package pkgid="d43093cd18eca29e7c5dbac9e0abf6c139d2ee4c8021bfa19226d0e63c8fb28a" name="libapparmor1" arch="aarch64">
  <version epoch="0" ver="2.13.6" rel="150300.3.15.1"/>
  <changelog author="suse-beta@cboltz.de" date="1485604800">- split libapparmor into separate spec to get rid of build loop
  involving mariadb, systemd, apparmor, libapr and mariadb again
  (see the discussion in SR 448871 for details)
- libapparmor.spec is based on the AppArmor 2.11 apparmor.spec, but
  with minimum BuildRequires</changelog>
  <changelog author="jengelh@inai.de" date="1486814400">- Fix RPM groups</changelog>
  <changelog author="suse-beta@cboltz.de" date="1508932800">- update to AppArmor 2.11.1
  - mostly test-related changes in libapparmor
  - see http://wiki.apparmor.net/index.php/ReleaseNotes_2_11_1 for
    upstream changelog</changelog>
  <changelog author="suse-beta@cboltz.de" date="1509451200">- update to AppArmor 2.11.95 aka 2.12 beta1
  - no changes in libapparmor
  - see http://wiki.apparmor.net/index.php/ReleaseNotes_2_11_95
    for the detailed upstream changelog</changelog>
  <changelog author="suse-beta@cboltz.de" date="1514203200">- update to AppArmor 2.12
  - preserve errno across aa_*_unref() functions
  - see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.12
    for the detailed upstream changelog
- no longer package static libapparmor.a</changelog>
  <changelog author="suse-beta@cboltz.de" date="1523793600">- update to AppArmor 2.13
  - add support for multiple cache directories and cache overlays
    (boo#1069906, boo#1074429)
  - see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.13
    for the detailed upstream changelog</changelog>
  <changelog author="suse-beta@cboltz.de" date="1539518400">- update to AppArmor 2.13.1
  - several bug fixes
  - see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.13.1
    for the detailed upstream changelog</changelog>
  <changelog author="suse-beta@cboltz.de" date="1545393600">- update to AppArmor 2.13.2
  - no changes in libapparmor
  - see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.13.2
    for the detailed upstream changelog</changelog>
  <changelog author="mliska@suse.cz" date="1556020800">- Disable LTO (boo#1133091).</changelog>
  <changelog author="suse-beta@cboltz.de" date="1560859200">- update to AppArmor 2.13.1
  - some fixes in cache handling
  - see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.13.3
    for the detailed upstream changelog</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - fix log parsing for logs with an embedded newline
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - fix two potential build failures
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
</package>
<package pkgid="be53d55b76c533d8356afad092e8845fd128e46675dfde838b62ddf204def28e" name="libapparmor1" arch="x86_64">
  <version epoch="0" ver="2.13.6" rel="150300.3.15.1"/>
  <changelog author="suse-beta@cboltz.de" date="1485604800">- split libapparmor into separate spec to get rid of build loop
  involving mariadb, systemd, apparmor, libapr and mariadb again
  (see the discussion in SR 448871 for details)
- libapparmor.spec is based on the AppArmor 2.11 apparmor.spec, but
  with minimum BuildRequires</changelog>
  <changelog author="jengelh@inai.de" date="1486814400">- Fix RPM groups</changelog>
  <changelog author="suse-beta@cboltz.de" date="1508932800">- update to AppArmor 2.11.1
  - mostly test-related changes in libapparmor
  - see http://wiki.apparmor.net/index.php/ReleaseNotes_2_11_1 for
    upstream changelog</changelog>
  <changelog author="suse-beta@cboltz.de" date="1509451200">- update to AppArmor 2.11.95 aka 2.12 beta1
  - no changes in libapparmor
  - see http://wiki.apparmor.net/index.php/ReleaseNotes_2_11_95
    for the detailed upstream changelog</changelog>
  <changelog author="suse-beta@cboltz.de" date="1514203200">- update to AppArmor 2.12
  - preserve errno across aa_*_unref() functions
  - see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.12
    for the detailed upstream changelog
- no longer package static libapparmor.a</changelog>
  <changelog author="suse-beta@cboltz.de" date="1523793600">- update to AppArmor 2.13
  - add support for multiple cache directories and cache overlays
    (boo#1069906, boo#1074429)
  - see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.13
    for the detailed upstream changelog</changelog>
  <changelog author="suse-beta@cboltz.de" date="1539518400">- update to AppArmor 2.13.1
  - several bug fixes
  - see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.13.1
    for the detailed upstream changelog</changelog>
  <changelog author="suse-beta@cboltz.de" date="1545393600">- update to AppArmor 2.13.2
  - no changes in libapparmor
  - see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.13.2
    for the detailed upstream changelog</changelog>
  <changelog author="mliska@suse.cz" date="1556020800">- Disable LTO (boo#1133091).</changelog>
  <changelog author="suse-beta@cboltz.de" date="1560859200">- update to AppArmor 2.13.1
  - some fixes in cache handling
  - see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.13.3
    for the detailed upstream changelog</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - fix log parsing for logs with an embedded newline
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - fix two potential build failures
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
</package>
<package pkgid="c8593bc500657498e108d8f00f0ac7b8bdd5599eb31bedcfbf8a06fa24ff3fbb" name="libasm1" arch="aarch64">
  <version epoch="0" ver="0.177" rel="150300.11.3.1"/>
  <changelog author="normand@linux.vnet.ibm.com" date="1456574400">- rename dt-ppc-opt.patch as elfutils-0.164-dt-ppc-opt.patch
  and add reference to upstream commit id</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1460808000">-  add elfutils-0.164-gcc6.patch</changelog>
  <changelog author="fcrozat@suse.com" date="1467028800">- Update to version 0.166:
  + config: The default program prefix for the installed tools is now
  eu-. Use configure --program-prefix="" to not use a program
  prefix.
  + Various bugfixes.
- Drop elfutils-0.164-dt-ppc-opt.patch and
  elfutils-0.164-gcc6.patch (merged upstream)
- Add patch elfutils-0.166-elfcmp-comp-gcc6.patch: fix
  self-comparison error with GCC 6.
- Changes from 0.165:
  + Add eu-elfcompress
  + Add pkg-config files for libelf and libdw.</changelog>
  <changelog author="schwab@suse.de" date="1468238400">- disable-tests-with-ptrace.patch: disable tests that use ptrace when
  running under qemu-linux-user</changelog>
  <changelog author="matz@suse.com" date="1472558400">- Update to version 0.167:
  libasm: Add eBPF disassembler for EM_BPF files.
  backends: Add m68k and BPF backends.
  ld: Removed.
  dwelf: Add ELF/DWARF string table creation functions. dwelf_strtab_init,
    dwelf_strtab_add, dwelf_strtab_add_len, dwelf_strtab_finalize,
    dwelf_strent_off, dwelf_strent_str and dwelf_strtab_free.
  Support compressed sections from binutils 2.27.
- Remove patch elfutils-0.166-elfcmp-comp-gcc6.patch: included upstream.</changelog>
  <changelog author="mliska@suse.cz" date="1481284800">- Add 0001-Add-GCC7-Wimplicit-fallthrough-support-fixes.patch: fix
  new warning introduced in GCC 7.
- Add 0001-ar-Fix-GCC7-Wformat-length-issues.patch: fix -Wformat-length
  warning introduced in GCC 7.</changelog>
  <changelog author="rguenther@suse.com" date="1490875200">- Update to version 0.168:
  libelf: gelf_newehdr and gelf_newehdr now return void *.
  libdw: dwarf.h corrected the DW_LANG_PLI constant name (was DW_LANG_PL1).
  readelf: Add optional --symbols[=SECTION] argument to select section name.
- Includes changes from 0001-Add-GCC7-Wimplicit-fallthrough-support-fixes.patch
  and 0001-ar-Fix-GCC7-Wformat-length-issues.patch.
- Remove elfutils-0.137-dwarf-header-check-fix.diff which is no longer
  required after a debugedit fix.</changelog>
  <changelog author="bwiedemann@suse.com" date="1490961600">- make tests pass when user does not want debuginfo (boo#1031556)</changelog>
  <changelog author="jengelh@inai.de" date="1491566400">- Add missing ldconfig calls for libasm1</changelog>
  <changelog author="mliska@suse.cz" date="1493121600">- Add 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch:
  fix .gnu.attributes checking on ppc64{,le}.</changelog>
  <changelog author="mliska@suse.cz" date="1493294400">- Add 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch
  unconditionally in the spec file. As we can't support binary diff,
  a newly added test-case is removed from the patch.</changelog>
  <changelog author="jengelh@inai.de" date="1495972800">- Update Git-Clone URL</changelog>
  <changelog author="schwab@linux-m68k.org" date="1497787200">- ppc-machine-flags.patch: support EM_PPC machine flags
- disable-tests-with-ptrace.patch: disable more tests</changelog>
  <changelog author="jengelh@inai.de" date="1501588800">- Update package descriptions.
- Rename libebl1 to libebl-plugins as these are not linked,
  but dlopened using their unversioned libebl_$ARCH.so name.
- Have libelf1 require libebl-plugins (libebl.a, which does the
  dlopen call, is staticly built into libelf1). This is necessary
  for pahole to display its results. [boo#1049871]</changelog>
  <changelog author="jengelh@inai.de" date="1503748800">- Restore obsolete on libebl.</changelog>
  <changelog author="jmoreira@suse.com" date="1537876800">- CVE-2017-7613: elfutils: denial of service (memory consumption)
  via a crafted ELF file (bnc#1033090)
  Add patch:
  elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
- CVE-2017-7612: elfutils: denial of service (heap-based buffer
  over-read and application crash) via a crafted ELF file
  (bnc#1033089)
  Add patch: elfutils-dont-trust-sh_entsize.patch</changelog>
  <changelog author="jmoreira@suse.com" date="1558526400">- CVE-2018-16402: libelf: denial of service/double free on an
  attempt to decompress the same section twice (bnc#1107066)
  Add patch:
  libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
- CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the
  function arlib_add_symbols() used by eu-ranlib (bnc#1112723)
  Add patch:
  arlib-check-that-sh_entsize-isnt-zero.patch
- CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and
  application crash) via a crafted ELF file (bnc#1033088)
  Add patch:
  elflint-check-symbol-table-data-is-big-enough-before-check.patch
- CVE-2017-7610: elflint: heap-based buffer overflow in check_group
  (bnc#1033087)
  Add patch:
  elflint-dont-check-section-group-without-flags-word.patch
- CVE-2018-16403: heap buffer overflow in readelf (bnc#1107067)
  Add patch:
  libdw-check-end-of-attributes-list-consistently.patch
- CVE-2018-16062: heap-buffer-overflow in
  /elfutils/libdw/dwarf_getaranges.c:156 (bnc#1106390)
  Add patch:
  libdw-readelf-make-sure-there-is-enough-data-to-read.patch
- CVE-2018-18310: Invalid Address Read problem in
  dwfl_segment_report_module.c (bnc#1111973)
  Add patch:
  libdwfl-sanity-check-partial-core-file-data-reads.patch
- CVE-2019-7150: dwfl_segment_report_module doesn't check whether
  the dyn data read from core file is truncated (bnc#1123685)
  Add patch:
  libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
- CVE-2019-7665: NT_PLATFORM core file note should be a zero
  terminated string (CVE is a bit misleading, as this is not a bug
  in libelf as described) (bnc#1125007)
  Add patch:
  libebl-check-NT_PLATFORM-core-notes.patch
- CVE-2017-7609: memory allocation failure in __libelf_decompress
  (bnc#1033086)
  Add patch:
  libelf-check-compression-before-allocate-output-buffer.patch
- CVE-2018-16402: Double-free crash in nm and readelf (bnc#1107066)
  Add patch:
  libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
- CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi
  (readelf.c) (bnc#1033084)
  Add patch:
  readelf-fix-off-by-one-sanity-check.patch
- CVE-2018-18520: eu-size: Bad handling of ar files inside are
  files (bnc#1112726)
  Add patch:
  size-handle-recursive-elf-ar-files.patch
- CVE-2017-7608: heap-based buffer overflow in
  ebl_object_note_type_name (eblobjnotetypename.c) (bnc#1033085)
  Add patch:
  use-the-empty-string-for-note-names-with-zero-size.patch</changelog>
  <changelog author="schwab@suse.de" date="1573732800">- disable-tests-with-ptrace.patch: Remove, set XFAIL_TESTS instead
- dwelf_elf_e_machine_string.patch: Avoid spurious failure</changelog>
  <changelog author="jeffm@suse.com" date="1657108800">- Update to version 0.177 (Martin Li?ka):
    elfclassify: New tool to analyze ELF objects.
    readelf: Print DW_AT_data_member_location as decimal offset.
    Decode DW_AT_discr_list block attributes.
    libdw: Add DW_AT_GNU_numerator, DW_AT_GNU_denominator and DW_AT_GNU_bias.
    libdwelf: Add dwelf_elf_e_machine_string.
    dwelf_elf_begin now only returns NULL when there is an error
    reading or decompressing a file. If the file is not an ELF file
    an ELF handle of type ELF_K_NONE is returned.
    backends: Add support for C-SKY.
  - Update to version 0.176
    build: Add new --enable-install-elfh option.
    Do NOT use this for system installs (it overrides glibc elf.h).
    backends: riscv improved core file and return value location support.
    Fixes CVE-2019-7146, CVE-2019-7148, CVE-2019-7149, CVE-2019-7664
  - CVE-2019-7150: dwfl_segment_report_module doesn't check whether
    the dyn data read from core file is truncated (bnc#1123685)
  - CVE-2019-7665: NT_PLATFORM core file note should be a zero
    terminated string (CVE is a bit misleading, as this is not a bug
    in libelf as described) (bnc#1125007)
  - Removed patches:
  - libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
  - libebl-check-NT_PLATFORM-core-notes.patch
  - Update to version 0.175 (Martin Li?ka):
    readelf: Handle mutliple .debug_macro sections.
    Recognize and parse GNU Property, NT_VERSION and
    GNU Build Attribute ELF Notes.
    strip: Handle SHT_GROUP correctly.
    Add strip --reloc-debug-sections-only option.
    Handle relocations against GNU compressed sections.
    libdwelf: New function dwelf_elf_begin.
    libcpu: Recognize bpf jump variants BPF_JLT, BPF_JLE, BPF_JSLT
    and BPF_JSLE.
    backends: RISCV handles ADD/SUB relocations.
    Handle SHT_X86_64_UNWIND.
  - CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the
    function arlib_add_symbols() used by eu-ranlib (bnc#1112723)
  - CVE-2018-18310: Invalid Address Read problem in
    dwfl_segment_report_module.c (bnc#1111973)
  - CVE-2018-18520: eu-size: Bad handling of ar files inside are
    files (bnc#1112726)
  - Removed patches:
  - arlib-check-that-sh_entsize-isnt-zero.patch
  - libdwfl-sanity-check-partial-core-file-data-reads.patch
  - size-handle-recursive-elf-ar-files.patch
  - Update to version 0.174 (Martin Li?ka):
    libelf, libdw and all tools now handle extended shnum and
    shstrndx correctly.
    elfcompress: Don't rewrite input file if no section data needs
    updating. Try harder to keep same file mode bits
    (suid) on rewrite.
    strip: Handle mixed (out of order) allocated/non-allocated
    sections.
    unstrip: Handle SHT_GROUP sections.
    backends: RISCV and M68K now have backend implementations to
    generate CFI based backtraces.
  - CVE-2018-16402: libelf: denial of service/double free on an
    attempt to decompress the same section twice (bnc#1107066)
    Double-free crash in nm and readelf
  - CVE-2018-16403: heap buffer overflow in readelf (bnc#1107067)
  - CVE-2018-16062: heap-buffer-overflow in
    /elfutils/libdw/dwarf_getaranges.c:156 (bnc#1106390)
    Removed patches:
    libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
    libdw-check-end-of-attributes-list-consistently.patch
    libdw-readelf-make-sure-there-is-enough-data-to-read.patch
  - Update to version 0.173 (Martin Li?ka):
    More fixes for crashes and hangs found by afl-fuzz. In particular various
    functions now detect and break infinite loops caused by bad DIE tree cycles.
    readelf: Will now lookup the size and signedness of constant value types
    to display them correctly (and not just how they were encoded).
    libdw: New function dwarf_next_lines to read CU-less .debug_line data.
    dwarf_begin_elf now accepts ELF files containing just .debug_line
    or .debug_frame sections (which can be read without needing a DIE
    tree from the .debug_info section).
    Removed dwarf_getscn_info, which was never implemented.
    backends: Handle BPF simple relocations.
    The RISCV backends now handles ABI specific CFI and knows about
    RISCV register types and names.
  - Update to version 0.172 (Martin Li?ka):
    No functional changes compared to 0.171.
    Various bug fixes in libdw and eu-readelf dealing with bad DWARF5 data.
    Thanks to running the afl fuzzer on eu-readelf and various testcases.
  - Update to version 0.171 (Martin Li?ka):
    DWARF5 and split dwarf, including GNU DebugFission, are supported now.
    Data can be read from the new DWARF sections .debug_addr, .debug_line_str,
    .debug_loclists, .debug_str_offsets and .debug_rnglists.  Plus the new
    DWARF5 and GNU DebugFission encodings of the existing .debug sections.
    Also in split DWARF .dwo (DWARF object) files.  This support is mostly
    handled by existing functions (dwarf_getlocation*, dwarf_getsrclines,
    dwarf_ranges, dwarf_form*, etc.) now returning the data from the new
    sections and data formats.  But some new functions have been added
    to more easily get information about skeleton and split compile units
    (dwarf_get_units and dwarf_cu_info), handle new attribute data
    (dwarf_getabbrevattr_data) and to keep references to Dwarf_Dies
    that might come from different sections or files (dwarf_die_addr_die).
    Not yet supported are .dwp (Dwarf Package) and .sup (Dwarf Supplementary)
    files, the .debug_names index, the .debug_cu_index and .debug_tu_index
    sections. Only a single .debug_info (and .debug_types) section are
    currently handled.
    readelf: Handle all new DWARF5 sections.
  - -debug-dump=info+ will show split unit DIEs when found.
  - -dwarf-skeleton can be used when inspecting a .dwo file.
    Recognizes GNU locviews with --debug-dump=loc.
    libdw: New functions dwarf_die_addr_die, dwarf_get_units,
    dwarf_getabbrevattr_data and dwarf_cu_info.
    libdw will now try to resolve the alt file on first use of
    an alt attribute FORM when not set yet with dwarf_set_alt.
    dwarf_aggregate_size() now works with multi-dimensional arrays.
    libdwfl: Use process_vm_readv when available instead of ptrace.
    backends: Add a RISC-V backend.
    There were various improvements to build on Windows.
    The sha1 and md5 implementations have been removed, they weren't used.
  - Update to version 0.170 (Martin Li?ka):
    libdw: Added new DWARF5 attribute, tag, character encoding, language code,
    calling convention, defaulted member function and macro constants
    to dwarf.h.
  New functions dwarf_default_lower_bound and dwarf_line_file.
  dwarf_peel_type now handles DWARF5 immutable, packed and shared tags.
  dwarf_getmacros now handles DWARF5 .debug_macro sections.
    strip: Add -R, --remove-section=SECTION and --keep-section=SECTION.
    backends: The bpf disassembler is now always build on all platforms.
  - Includes changes in 0.169
    backends: Add support for EM_PPC64 GNU_ATTRIBUTES.
    Frame pointer unwinding fallback support for i386, x86_64, aarch64.
    translations: Update Polish translation.
  - CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and
    application crash) via a crafted ELF file (bnc#1033088)
  - CVE-2017-7610: elflint: heap-based buffer overflow in check_group
    (bnc#1033087)
  - CVE-2017-7609: memory allocation failure in __libelf_decompress
    (bnc#1033086)
  - CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi
    (readelf.c) (bnc#1033084)
  - CVE-2017-7608: heap-based buffer overflow in
    ebl_object_note_type_name (eblobjnotetypename.c) (bnc#1033085)
  - CVE-2017-7613: elfutils: denial of service (memory consumption)
    via a crafted ELF file (bnc#1033090)
  - CVE-2017-7612: elfutils: denial of service (heap-based buffer
    over-read and application crash) via a crafted ELF file (bnc#1033089)
  - Removed patches:
  - obsolete 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch
  - ppc-machine-flags.patch
  - elflint-check-symbol-table-data-is-big-enough-before-check.patch
  - elflint-dont-check-section-group-without-flags-word.patch
  - libelf-check-compression-before-allocate-output-buffer.patch
  - readelf-fix-off-by-one-sanity-check.patch
  - use-the-empty-string-for-note-names-with-zero-size.patch
  - elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
  - elfutils-dont-trust-sh_entsize.patch
- Packaging cleanups:
  - Modernize specfile and metadata. (Jan Engelhardt)
  - Use %make_build (Martin Li?ka)
  - Update License tag to GPL-3.0-or-later, as requested by legal
    review. (Dominique Leuenberger)
  - Don't make elfutils recommend elfutils-lang as elfutils-lang
    already supplements elfutils. (Antoine Belvire)
  - Fix typo in the recommends name bsc#1104264 (Tomas Chvatal)
  - Use %license (boo#1082318) (Fabian Vogt)
- Test fixes (Andreas Schwab):
  - disable-tests-with-ptrace.patch: Remove, set XFAIL_TESTS instead
  - dwelf_elf_e_machine_string.patch: Avoid spurious failure</changelog>
  <changelog author="jeffm@suse.com" date="1657627200">- Added 4G memory build constraint for aarch64 to pass testing.</changelog>
</package>
<package pkgid="4f8eb9d327cf20278a8eaf09efac3f49c0db973a5bb45e849092045413a7738a" name="libasm1" arch="x86_64">
  <version epoch="0" ver="0.177" rel="150300.11.3.1"/>
  <changelog author="normand@linux.vnet.ibm.com" date="1456574400">- rename dt-ppc-opt.patch as elfutils-0.164-dt-ppc-opt.patch
  and add reference to upstream commit id</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1460808000">-  add elfutils-0.164-gcc6.patch</changelog>
  <changelog author="fcrozat@suse.com" date="1467028800">- Update to version 0.166:
  + config: The default program prefix for the installed tools is now
  eu-. Use configure --program-prefix="" to not use a program
  prefix.
  + Various bugfixes.
- Drop elfutils-0.164-dt-ppc-opt.patch and
  elfutils-0.164-gcc6.patch (merged upstream)
- Add patch elfutils-0.166-elfcmp-comp-gcc6.patch: fix
  self-comparison error with GCC 6.
- Changes from 0.165:
  + Add eu-elfcompress
  + Add pkg-config files for libelf and libdw.</changelog>
  <changelog author="schwab@suse.de" date="1468238400">- disable-tests-with-ptrace.patch: disable tests that use ptrace when
  running under qemu-linux-user</changelog>
  <changelog author="matz@suse.com" date="1472558400">- Update to version 0.167:
  libasm: Add eBPF disassembler for EM_BPF files.
  backends: Add m68k and BPF backends.
  ld: Removed.
  dwelf: Add ELF/DWARF string table creation functions. dwelf_strtab_init,
    dwelf_strtab_add, dwelf_strtab_add_len, dwelf_strtab_finalize,
    dwelf_strent_off, dwelf_strent_str and dwelf_strtab_free.
  Support compressed sections from binutils 2.27.
- Remove patch elfutils-0.166-elfcmp-comp-gcc6.patch: included upstream.</changelog>
  <changelog author="mliska@suse.cz" date="1481284800">- Add 0001-Add-GCC7-Wimplicit-fallthrough-support-fixes.patch: fix
  new warning introduced in GCC 7.
- Add 0001-ar-Fix-GCC7-Wformat-length-issues.patch: fix -Wformat-length
  warning introduced in GCC 7.</changelog>
  <changelog author="rguenther@suse.com" date="1490875200">- Update to version 0.168:
  libelf: gelf_newehdr and gelf_newehdr now return void *.
  libdw: dwarf.h corrected the DW_LANG_PLI constant name (was DW_LANG_PL1).
  readelf: Add optional --symbols[=SECTION] argument to select section name.
- Includes changes from 0001-Add-GCC7-Wimplicit-fallthrough-support-fixes.patch
  and 0001-ar-Fix-GCC7-Wformat-length-issues.patch.
- Remove elfutils-0.137-dwarf-header-check-fix.diff which is no longer
  required after a debugedit fix.</changelog>
  <changelog author="bwiedemann@suse.com" date="1490961600">- make tests pass when user does not want debuginfo (boo#1031556)</changelog>
  <changelog author="jengelh@inai.de" date="1491566400">- Add missing ldconfig calls for libasm1</changelog>
  <changelog author="mliska@suse.cz" date="1493121600">- Add 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch:
  fix .gnu.attributes checking on ppc64{,le}.</changelog>
  <changelog author="mliska@suse.cz" date="1493294400">- Add 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch
  unconditionally in the spec file. As we can't support binary diff,
  a newly added test-case is removed from the patch.</changelog>
  <changelog author="jengelh@inai.de" date="1495972800">- Update Git-Clone URL</changelog>
  <changelog author="schwab@linux-m68k.org" date="1497787200">- ppc-machine-flags.patch: support EM_PPC machine flags
- disable-tests-with-ptrace.patch: disable more tests</changelog>
  <changelog author="jengelh@inai.de" date="1501588800">- Update package descriptions.
- Rename libebl1 to libebl-plugins as these are not linked,
  but dlopened using their unversioned libebl_$ARCH.so name.
- Have libelf1 require libebl-plugins (libebl.a, which does the
  dlopen call, is staticly built into libelf1). This is necessary
  for pahole to display its results. [boo#1049871]</changelog>
  <changelog author="jengelh@inai.de" date="1503748800">- Restore obsolete on libebl.</changelog>
  <changelog author="jmoreira@suse.com" date="1537876800">- CVE-2017-7613: elfutils: denial of service (memory consumption)
  via a crafted ELF file (bnc#1033090)
  Add patch:
  elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
- CVE-2017-7612: elfutils: denial of service (heap-based buffer
  over-read and application crash) via a crafted ELF file
  (bnc#1033089)
  Add patch: elfutils-dont-trust-sh_entsize.patch</changelog>
  <changelog author="jmoreira@suse.com" date="1558526400">- CVE-2018-16402: libelf: denial of service/double free on an
  attempt to decompress the same section twice (bnc#1107066)
  Add patch:
  libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
- CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the
  function arlib_add_symbols() used by eu-ranlib (bnc#1112723)
  Add patch:
  arlib-check-that-sh_entsize-isnt-zero.patch
- CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and
  application crash) via a crafted ELF file (bnc#1033088)
  Add patch:
  elflint-check-symbol-table-data-is-big-enough-before-check.patch
- CVE-2017-7610: elflint: heap-based buffer overflow in check_group
  (bnc#1033087)
  Add patch:
  elflint-dont-check-section-group-without-flags-word.patch
- CVE-2018-16403: heap buffer overflow in readelf (bnc#1107067)
  Add patch:
  libdw-check-end-of-attributes-list-consistently.patch
- CVE-2018-16062: heap-buffer-overflow in
  /elfutils/libdw/dwarf_getaranges.c:156 (bnc#1106390)
  Add patch:
  libdw-readelf-make-sure-there-is-enough-data-to-read.patch
- CVE-2018-18310: Invalid Address Read problem in
  dwfl_segment_report_module.c (bnc#1111973)
  Add patch:
  libdwfl-sanity-check-partial-core-file-data-reads.patch
- CVE-2019-7150: dwfl_segment_report_module doesn't check whether
  the dyn data read from core file is truncated (bnc#1123685)
  Add patch:
  libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
- CVE-2019-7665: NT_PLATFORM core file note should be a zero
  terminated string (CVE is a bit misleading, as this is not a bug
  in libelf as described) (bnc#1125007)
  Add patch:
  libebl-check-NT_PLATFORM-core-notes.patch
- CVE-2017-7609: memory allocation failure in __libelf_decompress
  (bnc#1033086)
  Add patch:
  libelf-check-compression-before-allocate-output-buffer.patch
- CVE-2018-16402: Double-free crash in nm and readelf (bnc#1107066)
  Add patch:
  libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
- CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi
  (readelf.c) (bnc#1033084)
  Add patch:
  readelf-fix-off-by-one-sanity-check.patch
- CVE-2018-18520: eu-size: Bad handling of ar files inside are
  files (bnc#1112726)
  Add patch:
  size-handle-recursive-elf-ar-files.patch
- CVE-2017-7608: heap-based buffer overflow in
  ebl_object_note_type_name (eblobjnotetypename.c) (bnc#1033085)
  Add patch:
  use-the-empty-string-for-note-names-with-zero-size.patch</changelog>
  <changelog author="schwab@suse.de" date="1573732800">- disable-tests-with-ptrace.patch: Remove, set XFAIL_TESTS instead
- dwelf_elf_e_machine_string.patch: Avoid spurious failure</changelog>
  <changelog author="jeffm@suse.com" date="1657108800">- Update to version 0.177 (Martin Li?ka):
    elfclassify: New tool to analyze ELF objects.
    readelf: Print DW_AT_data_member_location as decimal offset.
    Decode DW_AT_discr_list block attributes.
    libdw: Add DW_AT_GNU_numerator, DW_AT_GNU_denominator and DW_AT_GNU_bias.
    libdwelf: Add dwelf_elf_e_machine_string.
    dwelf_elf_begin now only returns NULL when there is an error
    reading or decompressing a file. If the file is not an ELF file
    an ELF handle of type ELF_K_NONE is returned.
    backends: Add support for C-SKY.
  - Update to version 0.176
    build: Add new --enable-install-elfh option.
    Do NOT use this for system installs (it overrides glibc elf.h).
    backends: riscv improved core file and return value location support.
    Fixes CVE-2019-7146, CVE-2019-7148, CVE-2019-7149, CVE-2019-7664
  - CVE-2019-7150: dwfl_segment_report_module doesn't check whether
    the dyn data read from core file is truncated (bnc#1123685)
  - CVE-2019-7665: NT_PLATFORM core file note should be a zero
    terminated string (CVE is a bit misleading, as this is not a bug
    in libelf as described) (bnc#1125007)
  - Removed patches:
  - libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
  - libebl-check-NT_PLATFORM-core-notes.patch
  - Update to version 0.175 (Martin Li?ka):
    readelf: Handle mutliple .debug_macro sections.
    Recognize and parse GNU Property, NT_VERSION and
    GNU Build Attribute ELF Notes.
    strip: Handle SHT_GROUP correctly.
    Add strip --reloc-debug-sections-only option.
    Handle relocations against GNU compressed sections.
    libdwelf: New function dwelf_elf_begin.
    libcpu: Recognize bpf jump variants BPF_JLT, BPF_JLE, BPF_JSLT
    and BPF_JSLE.
    backends: RISCV handles ADD/SUB relocations.
    Handle SHT_X86_64_UNWIND.
  - CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the
    function arlib_add_symbols() used by eu-ranlib (bnc#1112723)
  - CVE-2018-18310: Invalid Address Read problem in
    dwfl_segment_report_module.c (bnc#1111973)
  - CVE-2018-18520: eu-size: Bad handling of ar files inside are
    files (bnc#1112726)
  - Removed patches:
  - arlib-check-that-sh_entsize-isnt-zero.patch
  - libdwfl-sanity-check-partial-core-file-data-reads.patch
  - size-handle-recursive-elf-ar-files.patch
  - Update to version 0.174 (Martin Li?ka):
    libelf, libdw and all tools now handle extended shnum and
    shstrndx correctly.
    elfcompress: Don't rewrite input file if no section data needs
    updating. Try harder to keep same file mode bits
    (suid) on rewrite.
    strip: Handle mixed (out of order) allocated/non-allocated
    sections.
    unstrip: Handle SHT_GROUP sections.
    backends: RISCV and M68K now have backend implementations to
    generate CFI based backtraces.
  - CVE-2018-16402: libelf: denial of service/double free on an
    attempt to decompress the same section twice (bnc#1107066)
    Double-free crash in nm and readelf
  - CVE-2018-16403: heap buffer overflow in readelf (bnc#1107067)
  - CVE-2018-16062: heap-buffer-overflow in
    /elfutils/libdw/dwarf_getaranges.c:156 (bnc#1106390)
    Removed patches:
    libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
    libdw-check-end-of-attributes-list-consistently.patch
    libdw-readelf-make-sure-there-is-enough-data-to-read.patch
  - Update to version 0.173 (Martin Li?ka):
    More fixes for crashes and hangs found by afl-fuzz. In particular various
    functions now detect and break infinite loops caused by bad DIE tree cycles.
    readelf: Will now lookup the size and signedness of constant value types
    to display them correctly (and not just how they were encoded).
    libdw: New function dwarf_next_lines to read CU-less .debug_line data.
    dwarf_begin_elf now accepts ELF files containing just .debug_line
    or .debug_frame sections (which can be read without needing a DIE
    tree from the .debug_info section).
    Removed dwarf_getscn_info, which was never implemented.
    backends: Handle BPF simple relocations.
    The RISCV backends now handles ABI specific CFI and knows about
    RISCV register types and names.
  - Update to version 0.172 (Martin Li?ka):
    No functional changes compared to 0.171.
    Various bug fixes in libdw and eu-readelf dealing with bad DWARF5 data.
    Thanks to running the afl fuzzer on eu-readelf and various testcases.
  - Update to version 0.171 (Martin Li?ka):
    DWARF5 and split dwarf, including GNU DebugFission, are supported now.
    Data can be read from the new DWARF sections .debug_addr, .debug_line_str,
    .debug_loclists, .debug_str_offsets and .debug_rnglists.  Plus the new
    DWARF5 and GNU DebugFission encodings of the existing .debug sections.
    Also in split DWARF .dwo (DWARF object) files.  This support is mostly
    handled by existing functions (dwarf_getlocation*, dwarf_getsrclines,
    dwarf_ranges, dwarf_form*, etc.) now returning the data from the new
    sections and data formats.  But some new functions have been added
    to more easily get information about skeleton and split compile units
    (dwarf_get_units and dwarf_cu_info), handle new attribute data
    (dwarf_getabbrevattr_data) and to keep references to Dwarf_Dies
    that might come from different sections or files (dwarf_die_addr_die).
    Not yet supported are .dwp (Dwarf Package) and .sup (Dwarf Supplementary)
    files, the .debug_names index, the .debug_cu_index and .debug_tu_index
    sections. Only a single .debug_info (and .debug_types) section are
    currently handled.
    readelf: Handle all new DWARF5 sections.
  - -debug-dump=info+ will show split unit DIEs when found.
  - -dwarf-skeleton can be used when inspecting a .dwo file.
    Recognizes GNU locviews with --debug-dump=loc.
    libdw: New functions dwarf_die_addr_die, dwarf_get_units,
    dwarf_getabbrevattr_data and dwarf_cu_info.
    libdw will now try to resolve the alt file on first use of
    an alt attribute FORM when not set yet with dwarf_set_alt.
    dwarf_aggregate_size() now works with multi-dimensional arrays.
    libdwfl: Use process_vm_readv when available instead of ptrace.
    backends: Add a RISC-V backend.
    There were various improvements to build on Windows.
    The sha1 and md5 implementations have been removed, they weren't used.
  - Update to version 0.170 (Martin Li?ka):
    libdw: Added new DWARF5 attribute, tag, character encoding, language code,
    calling convention, defaulted member function and macro constants
    to dwarf.h.
  New functions dwarf_default_lower_bound and dwarf_line_file.
  dwarf_peel_type now handles DWARF5 immutable, packed and shared tags.
  dwarf_getmacros now handles DWARF5 .debug_macro sections.
    strip: Add -R, --remove-section=SECTION and --keep-section=SECTION.
    backends: The bpf disassembler is now always build on all platforms.
  - Includes changes in 0.169
    backends: Add support for EM_PPC64 GNU_ATTRIBUTES.
    Frame pointer unwinding fallback support for i386, x86_64, aarch64.
    translations: Update Polish translation.
  - CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and
    application crash) via a crafted ELF file (bnc#1033088)
  - CVE-2017-7610: elflint: heap-based buffer overflow in check_group
    (bnc#1033087)
  - CVE-2017-7609: memory allocation failure in __libelf_decompress
    (bnc#1033086)
  - CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi
    (readelf.c) (bnc#1033084)
  - CVE-2017-7608: heap-based buffer overflow in
    ebl_object_note_type_name (eblobjnotetypename.c) (bnc#1033085)
  - CVE-2017-7613: elfutils: denial of service (memory consumption)
    via a crafted ELF file (bnc#1033090)
  - CVE-2017-7612: elfutils: denial of service (heap-based buffer
    over-read and application crash) via a crafted ELF file (bnc#1033089)
  - Removed patches:
  - obsolete 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch
  - ppc-machine-flags.patch
  - elflint-check-symbol-table-data-is-big-enough-before-check.patch
  - elflint-dont-check-section-group-without-flags-word.patch
  - libelf-check-compression-before-allocate-output-buffer.patch
  - readelf-fix-off-by-one-sanity-check.patch
  - use-the-empty-string-for-note-names-with-zero-size.patch
  - elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
  - elfutils-dont-trust-sh_entsize.patch
- Packaging cleanups:
  - Modernize specfile and metadata. (Jan Engelhardt)
  - Use %make_build (Martin Li?ka)
  - Update License tag to GPL-3.0-or-later, as requested by legal
    review. (Dominique Leuenberger)
  - Don't make elfutils recommend elfutils-lang as elfutils-lang
    already supplements elfutils. (Antoine Belvire)
  - Fix typo in the recommends name bsc#1104264 (Tomas Chvatal)
  - Use %license (boo#1082318) (Fabian Vogt)
- Test fixes (Andreas Schwab):
  - disable-tests-with-ptrace.patch: Remove, set XFAIL_TESTS instead
  - dwelf_elf_e_machine_string.patch: Avoid spurious failure</changelog>
  <changelog author="jeffm@suse.com" date="1657627200">- Added 4G memory build constraint for aarch64 to pass testing.</changelog>
</package>
<package pkgid="b11780f97a63930bc802a3738fb36d47404382ba32d0ce374266152e6a3e0789" name="libcrypt1" arch="aarch64">
  <version epoch="0" ver="4.4.15" rel="150300.4.4.3"/>
  <changelog author="schwab@suse.de" date="1525867200">- ABI compatible replacement for libcypt from glibc</changelog>
  <changelog author="schwab@suse.de" date="1527076800">- Update to libxcrypt 4.0.1</changelog>
  <changelog author="schwab@suse.de" date="1533124800">- Update to libxcrypt 4.1.0
  * Fix spelling of SUSE.
  * Lower the minimum required automake version to 1.14.
  * Fix build with USE_SWAPCONTEXT turned off.
  * Extend --enable-weak-hashes configure option to accept optional
    "glibc" parameter.
  * Fix the leak of obtained random bytes.
  * Check expected output strings for deterministic methods.
  * Fix memory leak in crypt_sha1_rn.
  * Fix read of random bytes out of bounds in gensalt_sha1_rn.
  * Make it possible to disable individual hashes at configure time.
  * Make salt validation pickier.
  * Replace crypt-sunmd5.c with BSD-licensed cleanroom reimplementation.
  * Make crypt_gensalt for $sha1 deterministic.
  * Fix incorrect output-size computation in crypt_sha1_rn.
  * Add docs for SHA1, MD5/Sun, NTHASH.
  * Introduce CRYPT_GENSALT_IMPLEMENTS_* feature test macros.
  * Install libcrypt.pc symlink along with libxcrypt.pc.
  * Extend --enable-obsolete-api configure option.
  * Extend overall test coverage.</changelog>
  <changelog author="jengelh@inai.de" date="1533556800">- Fix RPM groups for Factory.</changelog>
  <changelog author="schwab@suse.de" date="1533729600">- Add conflicts with glibc-devel &lt; 2.28</changelog>
  <changelog author="schwab@suse.de" date="1539086400">- Set compatibility level to suse</changelog>
  <changelog author="mliska@suse.cz" date="1550145600">- Update to version 4.4.3:
  * Add libxcrypt.so, libxcrypt.a and xcrypt.h.
  * Add new man3 manual pages.</changelog>
  <changelog author="schwab@suse.de" date="1550577600">- format-overflow.patch: Fix -Werror=format-overflow</changelog>
  <changelog author="mliska@suse.cz" date="1561032000">- Disable LTO due to symbol versioning (boo#1138833).</changelog>
  <changelog author="schwab@suse.de" date="1575720000">- Update to version 4.4.10
  * Fix alignment problem for GOST 34.11 (Streebog) in gost-yestcrypt.
  * The crypt_* functions will now all fail and set errno to ERANGE if
    their 'phrase' argument is longer than CRYPT_MAX_PASSPHRASE_SIZE
    characters (this is currently 512)
  * The NT hashing method no longer truncates passphrases at 128
    characters; Windows does not do this.
- format-overflow.patch: remove</changelog>
  <changelog author="schwab@suse.de" date="1576152000">- gcc10.patch: fix build with gcc10 (bsc#1158192)</changelog>
  <changelog author="schwab@suse.de" date="1579694400">- Update to version 4.4.11
  * Fixes for GCC v10.x
  * Change how the known-answer tests are parallelized
- gcc10.patch: remove</changelog>
  <changelog author="schwab@suse.de" date="1580385600">- Update to version 4.4.12
  * Another fix for GCC v10.x, which occurs on s390 architectures only.</changelog>
  <changelog author="schwab@suse.de" date="1583150400">- Update to version 4.4.15
  * The compatibility symbols crypt_gensalt_r, xcrypt, xcrypt_r,
    xcrypt_gensalt, and xcrypt_gensalt_r are deprecated further
  * Speed up ka-sunmd5 by skipping most of the test phrases
- Package README.md and TODO.md (bsc#1165389)</changelog>
  <changelog author="schwab@suse.de" date="1598961600">- Add compatibility provides for SLE15</changelog>
  <changelog author="dmueller@suse.com" date="1612612800">- add compatibility provides for Step 15 as well (bsc#1181571)</changelog>
</package>
<package pkgid="5742635fc1daffabdf0397e696ea64447c212e6e608e1cbf88942da01ae006dc" name="libcrypt1" arch="x86_64">
  <version epoch="0" ver="4.4.15" rel="150300.4.4.3"/>
  <changelog author="schwab@suse.de" date="1525867200">- ABI compatible replacement for libcypt from glibc</changelog>
  <changelog author="schwab@suse.de" date="1527076800">- Update to libxcrypt 4.0.1</changelog>
  <changelog author="schwab@suse.de" date="1533124800">- Update to libxcrypt 4.1.0
  * Fix spelling of SUSE.
  * Lower the minimum required automake version to 1.14.
  * Fix build with USE_SWAPCONTEXT turned off.
  * Extend --enable-weak-hashes configure option to accept optional
    "glibc" parameter.
  * Fix the leak of obtained random bytes.
  * Check expected output strings for deterministic methods.
  * Fix memory leak in crypt_sha1_rn.
  * Fix read of random bytes out of bounds in gensalt_sha1_rn.
  * Make it possible to disable individual hashes at configure time.
  * Make salt validation pickier.
  * Replace crypt-sunmd5.c with BSD-licensed cleanroom reimplementation.
  * Make crypt_gensalt for $sha1 deterministic.
  * Fix incorrect output-size computation in crypt_sha1_rn.
  * Add docs for SHA1, MD5/Sun, NTHASH.
  * Introduce CRYPT_GENSALT_IMPLEMENTS_* feature test macros.
  * Install libcrypt.pc symlink along with libxcrypt.pc.
  * Extend --enable-obsolete-api configure option.
  * Extend overall test coverage.</changelog>
  <changelog author="jengelh@inai.de" date="1533556800">- Fix RPM groups for Factory.</changelog>
  <changelog author="schwab@suse.de" date="1533729600">- Add conflicts with glibc-devel &lt; 2.28</changelog>
  <changelog author="schwab@suse.de" date="1539086400">- Set compatibility level to suse</changelog>
  <changelog author="mliska@suse.cz" date="1550145600">- Update to version 4.4.3:
  * Add libxcrypt.so, libxcrypt.a and xcrypt.h.
  * Add new man3 manual pages.</changelog>
  <changelog author="schwab@suse.de" date="1550577600">- format-overflow.patch: Fix -Werror=format-overflow</changelog>
  <changelog author="mliska@suse.cz" date="1561032000">- Disable LTO due to symbol versioning (boo#1138833).</changelog>
  <changelog author="schwab@suse.de" date="1575720000">- Update to version 4.4.10
  * Fix alignment problem for GOST 34.11 (Streebog) in gost-yestcrypt.
  * The crypt_* functions will now all fail and set errno to ERANGE if
    their 'phrase' argument is longer than CRYPT_MAX_PASSPHRASE_SIZE
    characters (this is currently 512)
  * The NT hashing method no longer truncates passphrases at 128
    characters; Windows does not do this.
- format-overflow.patch: remove</changelog>
  <changelog author="schwab@suse.de" date="1576152000">- gcc10.patch: fix build with gcc10 (bsc#1158192)</changelog>
  <changelog author="schwab@suse.de" date="1579694400">- Update to version 4.4.11
  * Fixes for GCC v10.x
  * Change how the known-answer tests are parallelized
- gcc10.patch: remove</changelog>
  <changelog author="schwab@suse.de" date="1580385600">- Update to version 4.4.12
  * Another fix for GCC v10.x, which occurs on s390 architectures only.</changelog>
  <changelog author="schwab@suse.de" date="1583150400">- Update to version 4.4.15
  * The compatibility symbols crypt_gensalt_r, xcrypt, xcrypt_r,
    xcrypt_gensalt, and xcrypt_gensalt_r are deprecated further
  * Speed up ka-sunmd5 by skipping most of the test phrases
- Package README.md and TODO.md (bsc#1165389)</changelog>
  <changelog author="schwab@suse.de" date="1598961600">- Add compatibility provides for SLE15</changelog>
  <changelog author="dmueller@suse.com" date="1612612800">- add compatibility provides for Step 15 as well (bsc#1181571)</changelog>
</package>
<package pkgid="fc2cd4ce948e7e22492a23ed699d359234e4dd2d5d8aae13903bf8db28a51552" name="libcurl4" arch="aarch64">
  <version epoch="0" ver="7.66.0" rel="150200.4.36.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1573732800">- Fix segfault in zypper ref: [bsc#1156481]
  * remove_handle: clear expire timers after multi_done()
  * Add patch curl-expire-clear.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395200">- Security fix: [bsc#1173026, CVE-2020-8169]
  * Partial password leak over DNS on HTTP redirect
- Add curl-CVE-2020-8169.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395201">- Security fix: [bsc#1173027, CVE-2020-8177]
  * curl can be tricked my a malicious server to overwrite a local
    file when using '-J' ('--remote-header-name') and '-i' ('--head')
    in the same command line.
- Add curl-CVE-2020-8177.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1597320000">- Security fix: [bsc#1175109, CVE-2020-8231]
  * An application that performs multiple requests with libcurl's
    multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in
    rare circumstances experience that when subsequently using the
    setup connect-only transfer, libcurl will pick and use the wrong
    connection and instead pick another one the application has
    created since then.
- Add curl-CVE-2020-8231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342400">- Security fix: [bsc#1179398, CVE-2020-8284]
  * Trusting FTP PASV responses: When curl performs a passive FTP
    transfer, it first tries the 'EPSV' command and if that is not
    supported, it falls back to using 'PASV'. A malicious server
    can use the 'PASV' response to trick curl into connecting
    back to a given IP address and port, and this way potentially
    make curl extract information about services that are otherwise
    private and not disclosed.
  * The IP address part of the response is now ignored by default,
    by making 'CURLOPT_FTP_SKIP_PASV_IP' default to '1L'. The same
    goes for the command line tool, which then might need
    '--no-ftp-skip-pasv-ip' set to prevent curl from ignoring the
    address in the server response.
- Add curl-CVE-2020-8284.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342401">- Security fix: [bsc#1179399, CVE-2020-8285]
  * FTP wildcard stack overflow: The wc_statemach() internal
    function has been rewritten to use an ordinary loop instead of
    the recursive approach.
- Add curl-CVE-2020-8285.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342402">- Security fix: [bsc#1179593, CVE-2020-8286]
  * Inferior OCSP verification: libcurl offers "OCSP stapling" via
    the 'CURLOPT_SSL_VERIFYSTATUS' option that, when set, verifies
    the OCSP response that a server responds with as part of the TLS
    handshake. It then aborts the TLS negotiation if something is
    wrong with the response. The same feature can be enabled with
    '--cert-status' using the curl tool.
  * As part of the OCSP response verification, a client should verify
    that the response is indeed set out for the correct certificate.
    This step was not performed by libcurl when built or told to use
    OpenSSL as TLS backend.
- Add curl-CVE-2020-8286.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616587200">- Security fix: [bsc#1183933, CVE-2021-22876]
  * The automatic referer leaks credentials
- Add curl-CVE-2021-22876.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616760000">- Security fix: [bsc#1183934, CVE-2021-22890]
  * When using a HTTPS proxy and TLS 1.3, libcurl can confuse
    session tickets arriving from the HTTPS proxy but work as
    if they arrived from the remote server and then wrongly
    "short-cut" the host handshake.
- Add curl-CVE-2021-22890.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620907200">- Allow partial chain verification [jsc#SLE-17956]
  * Have intermediate certificates in the trust store be treated
    as trust-anchors, in the same way as self-signed root CA
    certificates are. This allows users to verify servers using
    the intermediate cert only, instead of needing the whole chain.
  * Set FLAG_TRUSTED_FIRST unconditionally.
  * Do not check partial chains with CRL check.
- Add curl-X509_V_FLAG_PARTIAL_CHAIN.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: Disable the metalink feature:
  * Insufficiently Protected Credentials [bsc#1188218, CVE-2021-22923]
  * Wrong content via metalink not discarded [bsc#1188217, CVE-2021-22922]</changelog>
  <changelog author="pmonreal@suse.com" date="1626091201">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534400">- Security fix: [bsc#1190373, CVE-2021-22946]
  * Protocol downgrade required TLS bypassed
  * Add curl-CVE-2021-22946.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534401">- Security fix: [bsc#1190374, CVE-2021-22947]
  * STARTTLS protocol injection via MITM
  * Add curl-CVE-2021-22947.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1632312000">- MIME: Properly check Content-Type even if it has parameters
  * Add curl-check-content-type.patch [bsc#1190153]</changelog>
  <changelog author="david.anes@suse.com" date="1650628800">- Security fix: [bsc#1198766, CVE-2022-27776]
  * Auth/cookie leak on redirect
  * Add backported curl-CVE-2022-27776.patch
- Security fix: [bsc#1198723, CVE-2022-27775]
  * Bad local IPv6 connection reuse
  * Add backported curl-CVE-2022-27775.patch
- Security fix: [bsc#1198614, CVE-2022-22576]
  * OAUTH2 bearer bypass in connection re-use
  * Add backported curl-CVE-2022-22576.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651752000">- Securiy fix: [bsc#1199223, CVE-2022-27781]
  * CERTINFO never-ending busy-loop
  * Add curl-CVE-2022-27781.patch
- Securiy fix: [bsc#1199224, CVE-2022-27782]
  * TLS and SSH connection too eager reuse
  * Add curl-CVE-2022-27782.patch</changelog>
  <changelog author="david.anes@suse.com" date="1656331200">- Security fix: [bsc#1200735, CVE-2022-32206]
  * HTTP compression denial of service
  * Add curl-CVE-2022-32206.patch
- Security fix: [bsc#1200737, CVE-2022-32208]
  * FTP-KRB bad message verification
  * Add curl-CVE-2022-32208.patch</changelog>
</package>
<package pkgid="9a835b3873006d312b30a7848536c8944b4fa5699c4634056e36156daedc794a" name="libcurl4" arch="x86_64">
  <version epoch="0" ver="7.66.0" rel="150200.4.36.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1573732800">- Fix segfault in zypper ref: [bsc#1156481]
  * remove_handle: clear expire timers after multi_done()
  * Add patch curl-expire-clear.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395200">- Security fix: [bsc#1173026, CVE-2020-8169]
  * Partial password leak over DNS on HTTP redirect
- Add curl-CVE-2020-8169.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395201">- Security fix: [bsc#1173027, CVE-2020-8177]
  * curl can be tricked my a malicious server to overwrite a local
    file when using '-J' ('--remote-header-name') and '-i' ('--head')
    in the same command line.
- Add curl-CVE-2020-8177.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1597320000">- Security fix: [bsc#1175109, CVE-2020-8231]
  * An application that performs multiple requests with libcurl's
    multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in
    rare circumstances experience that when subsequently using the
    setup connect-only transfer, libcurl will pick and use the wrong
    connection and instead pick another one the application has
    created since then.
- Add curl-CVE-2020-8231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342400">- Security fix: [bsc#1179398, CVE-2020-8284]
  * Trusting FTP PASV responses: When curl performs a passive FTP
    transfer, it first tries the 'EPSV' command and if that is not
    supported, it falls back to using 'PASV'. A malicious server
    can use the 'PASV' response to trick curl into connecting
    back to a given IP address and port, and this way potentially
    make curl extract information about services that are otherwise
    private and not disclosed.
  * The IP address part of the response is now ignored by default,
    by making 'CURLOPT_FTP_SKIP_PASV_IP' default to '1L'. The same
    goes for the command line tool, which then might need
    '--no-ftp-skip-pasv-ip' set to prevent curl from ignoring the
    address in the server response.
- Add curl-CVE-2020-8284.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342401">- Security fix: [bsc#1179399, CVE-2020-8285]
  * FTP wildcard stack overflow: The wc_statemach() internal
    function has been rewritten to use an ordinary loop instead of
    the recursive approach.
- Add curl-CVE-2020-8285.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342402">- Security fix: [bsc#1179593, CVE-2020-8286]
  * Inferior OCSP verification: libcurl offers "OCSP stapling" via
    the 'CURLOPT_SSL_VERIFYSTATUS' option that, when set, verifies
    the OCSP response that a server responds with as part of the TLS
    handshake. It then aborts the TLS negotiation if something is
    wrong with the response. The same feature can be enabled with
    '--cert-status' using the curl tool.
  * As part of the OCSP response verification, a client should verify
    that the response is indeed set out for the correct certificate.
    This step was not performed by libcurl when built or told to use
    OpenSSL as TLS backend.
- Add curl-CVE-2020-8286.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616587200">- Security fix: [bsc#1183933, CVE-2021-22876]
  * The automatic referer leaks credentials
- Add curl-CVE-2021-22876.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616760000">- Security fix: [bsc#1183934, CVE-2021-22890]
  * When using a HTTPS proxy and TLS 1.3, libcurl can confuse
    session tickets arriving from the HTTPS proxy but work as
    if they arrived from the remote server and then wrongly
    "short-cut" the host handshake.
- Add curl-CVE-2021-22890.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620907200">- Allow partial chain verification [jsc#SLE-17956]
  * Have intermediate certificates in the trust store be treated
    as trust-anchors, in the same way as self-signed root CA
    certificates are. This allows users to verify servers using
    the intermediate cert only, instead of needing the whole chain.
  * Set FLAG_TRUSTED_FIRST unconditionally.
  * Do not check partial chains with CRL check.
- Add curl-X509_V_FLAG_PARTIAL_CHAIN.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: Disable the metalink feature:
  * Insufficiently Protected Credentials [bsc#1188218, CVE-2021-22923]
  * Wrong content via metalink not discarded [bsc#1188217, CVE-2021-22922]</changelog>
  <changelog author="pmonreal@suse.com" date="1626091201">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534400">- Security fix: [bsc#1190373, CVE-2021-22946]
  * Protocol downgrade required TLS bypassed
  * Add curl-CVE-2021-22946.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534401">- Security fix: [bsc#1190374, CVE-2021-22947]
  * STARTTLS protocol injection via MITM
  * Add curl-CVE-2021-22947.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1632312000">- MIME: Properly check Content-Type even if it has parameters
  * Add curl-check-content-type.patch [bsc#1190153]</changelog>
  <changelog author="david.anes@suse.com" date="1650628800">- Security fix: [bsc#1198766, CVE-2022-27776]
  * Auth/cookie leak on redirect
  * Add backported curl-CVE-2022-27776.patch
- Security fix: [bsc#1198723, CVE-2022-27775]
  * Bad local IPv6 connection reuse
  * Add backported curl-CVE-2022-27775.patch
- Security fix: [bsc#1198614, CVE-2022-22576]
  * OAUTH2 bearer bypass in connection re-use
  * Add backported curl-CVE-2022-22576.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651752000">- Securiy fix: [bsc#1199223, CVE-2022-27781]
  * CERTINFO never-ending busy-loop
  * Add curl-CVE-2022-27781.patch
- Securiy fix: [bsc#1199224, CVE-2022-27782]
  * TLS and SSH connection too eager reuse
  * Add curl-CVE-2022-27782.patch</changelog>
  <changelog author="david.anes@suse.com" date="1656331200">- Security fix: [bsc#1200735, CVE-2022-32206]
  * HTTP compression denial of service
  * Add curl-CVE-2022-32206.patch
- Security fix: [bsc#1200737, CVE-2022-32208]
  * FTP-KRB bad message verification
  * Add curl-CVE-2022-32208.patch</changelog>
</package>
<package pkgid="b436675b4ba07b62dd030ea89fd59978896f9588968d78fd2b341a77437c6075" name="libdw1" arch="aarch64">
  <version epoch="0" ver="0.177" rel="150300.11.3.1"/>
  <changelog author="normand@linux.vnet.ibm.com" date="1456574400">- rename dt-ppc-opt.patch as elfutils-0.164-dt-ppc-opt.patch
  and add reference to upstream commit id</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1460808000">-  add elfutils-0.164-gcc6.patch</changelog>
  <changelog author="fcrozat@suse.com" date="1467028800">- Update to version 0.166:
  + config: The default program prefix for the installed tools is now
  eu-. Use configure --program-prefix="" to not use a program
  prefix.
  + Various bugfixes.
- Drop elfutils-0.164-dt-ppc-opt.patch and
  elfutils-0.164-gcc6.patch (merged upstream)
- Add patch elfutils-0.166-elfcmp-comp-gcc6.patch: fix
  self-comparison error with GCC 6.
- Changes from 0.165:
  + Add eu-elfcompress
  + Add pkg-config files for libelf and libdw.</changelog>
  <changelog author="schwab@suse.de" date="1468238400">- disable-tests-with-ptrace.patch: disable tests that use ptrace when
  running under qemu-linux-user</changelog>
  <changelog author="matz@suse.com" date="1472558400">- Update to version 0.167:
  libasm: Add eBPF disassembler for EM_BPF files.
  backends: Add m68k and BPF backends.
  ld: Removed.
  dwelf: Add ELF/DWARF string table creation functions. dwelf_strtab_init,
    dwelf_strtab_add, dwelf_strtab_add_len, dwelf_strtab_finalize,
    dwelf_strent_off, dwelf_strent_str and dwelf_strtab_free.
  Support compressed sections from binutils 2.27.
- Remove patch elfutils-0.166-elfcmp-comp-gcc6.patch: included upstream.</changelog>
  <changelog author="mliska@suse.cz" date="1481284800">- Add 0001-Add-GCC7-Wimplicit-fallthrough-support-fixes.patch: fix
  new warning introduced in GCC 7.
- Add 0001-ar-Fix-GCC7-Wformat-length-issues.patch: fix -Wformat-length
  warning introduced in GCC 7.</changelog>
  <changelog author="rguenther@suse.com" date="1490875200">- Update to version 0.168:
  libelf: gelf_newehdr and gelf_newehdr now return void *.
  libdw: dwarf.h corrected the DW_LANG_PLI constant name (was DW_LANG_PL1).
  readelf: Add optional --symbols[=SECTION] argument to select section name.
- Includes changes from 0001-Add-GCC7-Wimplicit-fallthrough-support-fixes.patch
  and 0001-ar-Fix-GCC7-Wformat-length-issues.patch.
- Remove elfutils-0.137-dwarf-header-check-fix.diff which is no longer
  required after a debugedit fix.</changelog>
  <changelog author="bwiedemann@suse.com" date="1490961600">- make tests pass when user does not want debuginfo (boo#1031556)</changelog>
  <changelog author="jengelh@inai.de" date="1491566400">- Add missing ldconfig calls for libasm1</changelog>
  <changelog author="mliska@suse.cz" date="1493121600">- Add 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch:
  fix .gnu.attributes checking on ppc64{,le}.</changelog>
  <changelog author="mliska@suse.cz" date="1493294400">- Add 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch
  unconditionally in the spec file. As we can't support binary diff,
  a newly added test-case is removed from the patch.</changelog>
  <changelog author="jengelh@inai.de" date="1495972800">- Update Git-Clone URL</changelog>
  <changelog author="schwab@linux-m68k.org" date="1497787200">- ppc-machine-flags.patch: support EM_PPC machine flags
- disable-tests-with-ptrace.patch: disable more tests</changelog>
  <changelog author="jengelh@inai.de" date="1501588800">- Update package descriptions.
- Rename libebl1 to libebl-plugins as these are not linked,
  but dlopened using their unversioned libebl_$ARCH.so name.
- Have libelf1 require libebl-plugins (libebl.a, which does the
  dlopen call, is staticly built into libelf1). This is necessary
  for pahole to display its results. [boo#1049871]</changelog>
  <changelog author="jengelh@inai.de" date="1503748800">- Restore obsolete on libebl.</changelog>
  <changelog author="jmoreira@suse.com" date="1537876800">- CVE-2017-7613: elfutils: denial of service (memory consumption)
  via a crafted ELF file (bnc#1033090)
  Add patch:
  elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
- CVE-2017-7612: elfutils: denial of service (heap-based buffer
  over-read and application crash) via a crafted ELF file
  (bnc#1033089)
  Add patch: elfutils-dont-trust-sh_entsize.patch</changelog>
  <changelog author="jmoreira@suse.com" date="1558526400">- CVE-2018-16402: libelf: denial of service/double free on an
  attempt to decompress the same section twice (bnc#1107066)
  Add patch:
  libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
- CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the
  function arlib_add_symbols() used by eu-ranlib (bnc#1112723)
  Add patch:
  arlib-check-that-sh_entsize-isnt-zero.patch
- CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and
  application crash) via a crafted ELF file (bnc#1033088)
  Add patch:
  elflint-check-symbol-table-data-is-big-enough-before-check.patch
- CVE-2017-7610: elflint: heap-based buffer overflow in check_group
  (bnc#1033087)
  Add patch:
  elflint-dont-check-section-group-without-flags-word.patch
- CVE-2018-16403: heap buffer overflow in readelf (bnc#1107067)
  Add patch:
  libdw-check-end-of-attributes-list-consistently.patch
- CVE-2018-16062: heap-buffer-overflow in
  /elfutils/libdw/dwarf_getaranges.c:156 (bnc#1106390)
  Add patch:
  libdw-readelf-make-sure-there-is-enough-data-to-read.patch
- CVE-2018-18310: Invalid Address Read problem in
  dwfl_segment_report_module.c (bnc#1111973)
  Add patch:
  libdwfl-sanity-check-partial-core-file-data-reads.patch
- CVE-2019-7150: dwfl_segment_report_module doesn't check whether
  the dyn data read from core file is truncated (bnc#1123685)
  Add patch:
  libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
- CVE-2019-7665: NT_PLATFORM core file note should be a zero
  terminated string (CVE is a bit misleading, as this is not a bug
  in libelf as described) (bnc#1125007)
  Add patch:
  libebl-check-NT_PLATFORM-core-notes.patch
- CVE-2017-7609: memory allocation failure in __libelf_decompress
  (bnc#1033086)
  Add patch:
  libelf-check-compression-before-allocate-output-buffer.patch
- CVE-2018-16402: Double-free crash in nm and readelf (bnc#1107066)
  Add patch:
  libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
- CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi
  (readelf.c) (bnc#1033084)
  Add patch:
  readelf-fix-off-by-one-sanity-check.patch
- CVE-2018-18520: eu-size: Bad handling of ar files inside are
  files (bnc#1112726)
  Add patch:
  size-handle-recursive-elf-ar-files.patch
- CVE-2017-7608: heap-based buffer overflow in
  ebl_object_note_type_name (eblobjnotetypename.c) (bnc#1033085)
  Add patch:
  use-the-empty-string-for-note-names-with-zero-size.patch</changelog>
  <changelog author="schwab@suse.de" date="1573732800">- disable-tests-with-ptrace.patch: Remove, set XFAIL_TESTS instead
- dwelf_elf_e_machine_string.patch: Avoid spurious failure</changelog>
  <changelog author="jeffm@suse.com" date="1657108800">- Update to version 0.177 (Martin Li?ka):
    elfclassify: New tool to analyze ELF objects.
    readelf: Print DW_AT_data_member_location as decimal offset.
    Decode DW_AT_discr_list block attributes.
    libdw: Add DW_AT_GNU_numerator, DW_AT_GNU_denominator and DW_AT_GNU_bias.
    libdwelf: Add dwelf_elf_e_machine_string.
    dwelf_elf_begin now only returns NULL when there is an error
    reading or decompressing a file. If the file is not an ELF file
    an ELF handle of type ELF_K_NONE is returned.
    backends: Add support for C-SKY.
  - Update to version 0.176
    build: Add new --enable-install-elfh option.
    Do NOT use this for system installs (it overrides glibc elf.h).
    backends: riscv improved core file and return value location support.
    Fixes CVE-2019-7146, CVE-2019-7148, CVE-2019-7149, CVE-2019-7664
  - CVE-2019-7150: dwfl_segment_report_module doesn't check whether
    the dyn data read from core file is truncated (bnc#1123685)
  - CVE-2019-7665: NT_PLATFORM core file note should be a zero
    terminated string (CVE is a bit misleading, as this is not a bug
    in libelf as described) (bnc#1125007)
  - Removed patches:
  - libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
  - libebl-check-NT_PLATFORM-core-notes.patch
  - Update to version 0.175 (Martin Li?ka):
    readelf: Handle mutliple .debug_macro sections.
    Recognize and parse GNU Property, NT_VERSION and
    GNU Build Attribute ELF Notes.
    strip: Handle SHT_GROUP correctly.
    Add strip --reloc-debug-sections-only option.
    Handle relocations against GNU compressed sections.
    libdwelf: New function dwelf_elf_begin.
    libcpu: Recognize bpf jump variants BPF_JLT, BPF_JLE, BPF_JSLT
    and BPF_JSLE.
    backends: RISCV handles ADD/SUB relocations.
    Handle SHT_X86_64_UNWIND.
  - CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the
    function arlib_add_symbols() used by eu-ranlib (bnc#1112723)
  - CVE-2018-18310: Invalid Address Read problem in
    dwfl_segment_report_module.c (bnc#1111973)
  - CVE-2018-18520: eu-size: Bad handling of ar files inside are
    files (bnc#1112726)
  - Removed patches:
  - arlib-check-that-sh_entsize-isnt-zero.patch
  - libdwfl-sanity-check-partial-core-file-data-reads.patch
  - size-handle-recursive-elf-ar-files.patch
  - Update to version 0.174 (Martin Li?ka):
    libelf, libdw and all tools now handle extended shnum and
    shstrndx correctly.
    elfcompress: Don't rewrite input file if no section data needs
    updating. Try harder to keep same file mode bits
    (suid) on rewrite.
    strip: Handle mixed (out of order) allocated/non-allocated
    sections.
    unstrip: Handle SHT_GROUP sections.
    backends: RISCV and M68K now have backend implementations to
    generate CFI based backtraces.
  - CVE-2018-16402: libelf: denial of service/double free on an
    attempt to decompress the same section twice (bnc#1107066)
    Double-free crash in nm and readelf
  - CVE-2018-16403: heap buffer overflow in readelf (bnc#1107067)
  - CVE-2018-16062: heap-buffer-overflow in
    /elfutils/libdw/dwarf_getaranges.c:156 (bnc#1106390)
    Removed patches:
    libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
    libdw-check-end-of-attributes-list-consistently.patch
    libdw-readelf-make-sure-there-is-enough-data-to-read.patch
  - Update to version 0.173 (Martin Li?ka):
    More fixes for crashes and hangs found by afl-fuzz. In particular various
    functions now detect and break infinite loops caused by bad DIE tree cycles.
    readelf: Will now lookup the size and signedness of constant value types
    to display them correctly (and not just how they were encoded).
    libdw: New function dwarf_next_lines to read CU-less .debug_line data.
    dwarf_begin_elf now accepts ELF files containing just .debug_line
    or .debug_frame sections (which can be read without needing a DIE
    tree from the .debug_info section).
    Removed dwarf_getscn_info, which was never implemented.
    backends: Handle BPF simple relocations.
    The RISCV backends now handles ABI specific CFI and knows about
    RISCV register types and names.
  - Update to version 0.172 (Martin Li?ka):
    No functional changes compared to 0.171.
    Various bug fixes in libdw and eu-readelf dealing with bad DWARF5 data.
    Thanks to running the afl fuzzer on eu-readelf and various testcases.
  - Update to version 0.171 (Martin Li?ka):
    DWARF5 and split dwarf, including GNU DebugFission, are supported now.
    Data can be read from the new DWARF sections .debug_addr, .debug_line_str,
    .debug_loclists, .debug_str_offsets and .debug_rnglists.  Plus the new
    DWARF5 and GNU DebugFission encodings of the existing .debug sections.
    Also in split DWARF .dwo (DWARF object) files.  This support is mostly
    handled by existing functions (dwarf_getlocation*, dwarf_getsrclines,
    dwarf_ranges, dwarf_form*, etc.) now returning the data from the new
    sections and data formats.  But some new functions have been added
    to more easily get information about skeleton and split compile units
    (dwarf_get_units and dwarf_cu_info), handle new attribute data
    (dwarf_getabbrevattr_data) and to keep references to Dwarf_Dies
    that might come from different sections or files (dwarf_die_addr_die).
    Not yet supported are .dwp (Dwarf Package) and .sup (Dwarf Supplementary)
    files, the .debug_names index, the .debug_cu_index and .debug_tu_index
    sections. Only a single .debug_info (and .debug_types) section are
    currently handled.
    readelf: Handle all new DWARF5 sections.
  - -debug-dump=info+ will show split unit DIEs when found.
  - -dwarf-skeleton can be used when inspecting a .dwo file.
    Recognizes GNU locviews with --debug-dump=loc.
    libdw: New functions dwarf_die_addr_die, dwarf_get_units,
    dwarf_getabbrevattr_data and dwarf_cu_info.
    libdw will now try to resolve the alt file on first use of
    an alt attribute FORM when not set yet with dwarf_set_alt.
    dwarf_aggregate_size() now works with multi-dimensional arrays.
    libdwfl: Use process_vm_readv when available instead of ptrace.
    backends: Add a RISC-V backend.
    There were various improvements to build on Windows.
    The sha1 and md5 implementations have been removed, they weren't used.
  - Update to version 0.170 (Martin Li?ka):
    libdw: Added new DWARF5 attribute, tag, character encoding, language code,
    calling convention, defaulted member function and macro constants
    to dwarf.h.
  New functions dwarf_default_lower_bound and dwarf_line_file.
  dwarf_peel_type now handles DWARF5 immutable, packed and shared tags.
  dwarf_getmacros now handles DWARF5 .debug_macro sections.
    strip: Add -R, --remove-section=SECTION and --keep-section=SECTION.
    backends: The bpf disassembler is now always build on all platforms.
  - Includes changes in 0.169
    backends: Add support for EM_PPC64 GNU_ATTRIBUTES.
    Frame pointer unwinding fallback support for i386, x86_64, aarch64.
    translations: Update Polish translation.
  - CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and
    application crash) via a crafted ELF file (bnc#1033088)
  - CVE-2017-7610: elflint: heap-based buffer overflow in check_group
    (bnc#1033087)
  - CVE-2017-7609: memory allocation failure in __libelf_decompress
    (bnc#1033086)
  - CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi
    (readelf.c) (bnc#1033084)
  - CVE-2017-7608: heap-based buffer overflow in
    ebl_object_note_type_name (eblobjnotetypename.c) (bnc#1033085)
  - CVE-2017-7613: elfutils: denial of service (memory consumption)
    via a crafted ELF file (bnc#1033090)
  - CVE-2017-7612: elfutils: denial of service (heap-based buffer
    over-read and application crash) via a crafted ELF file (bnc#1033089)
  - Removed patches:
  - obsolete 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch
  - ppc-machine-flags.patch
  - elflint-check-symbol-table-data-is-big-enough-before-check.patch
  - elflint-dont-check-section-group-without-flags-word.patch
  - libelf-check-compression-before-allocate-output-buffer.patch
  - readelf-fix-off-by-one-sanity-check.patch
  - use-the-empty-string-for-note-names-with-zero-size.patch
  - elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
  - elfutils-dont-trust-sh_entsize.patch
- Packaging cleanups:
  - Modernize specfile and metadata. (Jan Engelhardt)
  - Use %make_build (Martin Li?ka)
  - Update License tag to GPL-3.0-or-later, as requested by legal
    review. (Dominique Leuenberger)
  - Don't make elfutils recommend elfutils-lang as elfutils-lang
    already supplements elfutils. (Antoine Belvire)
  - Fix typo in the recommends name bsc#1104264 (Tomas Chvatal)
  - Use %license (boo#1082318) (Fabian Vogt)
- Test fixes (Andreas Schwab):
  - disable-tests-with-ptrace.patch: Remove, set XFAIL_TESTS instead
  - dwelf_elf_e_machine_string.patch: Avoid spurious failure</changelog>
  <changelog author="jeffm@suse.com" date="1657627200">- Added 4G memory build constraint for aarch64 to pass testing.</changelog>
</package>
<package pkgid="9fc4155b084b0f9bf53e853da37033d7e01a6c520b4cfc4f98cb5b93dc17b29b" name="libdw1" arch="x86_64">
  <version epoch="0" ver="0.177" rel="150300.11.3.1"/>
  <changelog author="normand@linux.vnet.ibm.com" date="1456574400">- rename dt-ppc-opt.patch as elfutils-0.164-dt-ppc-opt.patch
  and add reference to upstream commit id</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1460808000">-  add elfutils-0.164-gcc6.patch</changelog>
  <changelog author="fcrozat@suse.com" date="1467028800">- Update to version 0.166:
  + config: The default program prefix for the installed tools is now
  eu-. Use configure --program-prefix="" to not use a program
  prefix.
  + Various bugfixes.
- Drop elfutils-0.164-dt-ppc-opt.patch and
  elfutils-0.164-gcc6.patch (merged upstream)
- Add patch elfutils-0.166-elfcmp-comp-gcc6.patch: fix
  self-comparison error with GCC 6.
- Changes from 0.165:
  + Add eu-elfcompress
  + Add pkg-config files for libelf and libdw.</changelog>
  <changelog author="schwab@suse.de" date="1468238400">- disable-tests-with-ptrace.patch: disable tests that use ptrace when
  running under qemu-linux-user</changelog>
  <changelog author="matz@suse.com" date="1472558400">- Update to version 0.167:
  libasm: Add eBPF disassembler for EM_BPF files.
  backends: Add m68k and BPF backends.
  ld: Removed.
  dwelf: Add ELF/DWARF string table creation functions. dwelf_strtab_init,
    dwelf_strtab_add, dwelf_strtab_add_len, dwelf_strtab_finalize,
    dwelf_strent_off, dwelf_strent_str and dwelf_strtab_free.
  Support compressed sections from binutils 2.27.
- Remove patch elfutils-0.166-elfcmp-comp-gcc6.patch: included upstream.</changelog>
  <changelog author="mliska@suse.cz" date="1481284800">- Add 0001-Add-GCC7-Wimplicit-fallthrough-support-fixes.patch: fix
  new warning introduced in GCC 7.
- Add 0001-ar-Fix-GCC7-Wformat-length-issues.patch: fix -Wformat-length
  warning introduced in GCC 7.</changelog>
  <changelog author="rguenther@suse.com" date="1490875200">- Update to version 0.168:
  libelf: gelf_newehdr and gelf_newehdr now return void *.
  libdw: dwarf.h corrected the DW_LANG_PLI constant name (was DW_LANG_PL1).
  readelf: Add optional --symbols[=SECTION] argument to select section name.
- Includes changes from 0001-Add-GCC7-Wimplicit-fallthrough-support-fixes.patch
  and 0001-ar-Fix-GCC7-Wformat-length-issues.patch.
- Remove elfutils-0.137-dwarf-header-check-fix.diff which is no longer
  required after a debugedit fix.</changelog>
  <changelog author="bwiedemann@suse.com" date="1490961600">- make tests pass when user does not want debuginfo (boo#1031556)</changelog>
  <changelog author="jengelh@inai.de" date="1491566400">- Add missing ldconfig calls for libasm1</changelog>
  <changelog author="mliska@suse.cz" date="1493121600">- Add 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch:
  fix .gnu.attributes checking on ppc64{,le}.</changelog>
  <changelog author="mliska@suse.cz" date="1493294400">- Add 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch
  unconditionally in the spec file. As we can't support binary diff,
  a newly added test-case is removed from the patch.</changelog>
  <changelog author="jengelh@inai.de" date="1495972800">- Update Git-Clone URL</changelog>
  <changelog author="schwab@linux-m68k.org" date="1497787200">- ppc-machine-flags.patch: support EM_PPC machine flags
- disable-tests-with-ptrace.patch: disable more tests</changelog>
  <changelog author="jengelh@inai.de" date="1501588800">- Update package descriptions.
- Rename libebl1 to libebl-plugins as these are not linked,
  but dlopened using their unversioned libebl_$ARCH.so name.
- Have libelf1 require libebl-plugins (libebl.a, which does the
  dlopen call, is staticly built into libelf1). This is necessary
  for pahole to display its results. [boo#1049871]</changelog>
  <changelog author="jengelh@inai.de" date="1503748800">- Restore obsolete on libebl.</changelog>
  <changelog author="jmoreira@suse.com" date="1537876800">- CVE-2017-7613: elfutils: denial of service (memory consumption)
  via a crafted ELF file (bnc#1033090)
  Add patch:
  elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
- CVE-2017-7612: elfutils: denial of service (heap-based buffer
  over-read and application crash) via a crafted ELF file
  (bnc#1033089)
  Add patch: elfutils-dont-trust-sh_entsize.patch</changelog>
  <changelog author="jmoreira@suse.com" date="1558526400">- CVE-2018-16402: libelf: denial of service/double free on an
  attempt to decompress the same section twice (bnc#1107066)
  Add patch:
  libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
- CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the
  function arlib_add_symbols() used by eu-ranlib (bnc#1112723)
  Add patch:
  arlib-check-that-sh_entsize-isnt-zero.patch
- CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and
  application crash) via a crafted ELF file (bnc#1033088)
  Add patch:
  elflint-check-symbol-table-data-is-big-enough-before-check.patch
- CVE-2017-7610: elflint: heap-based buffer overflow in check_group
  (bnc#1033087)
  Add patch:
  elflint-dont-check-section-group-without-flags-word.patch
- CVE-2018-16403: heap buffer overflow in readelf (bnc#1107067)
  Add patch:
  libdw-check-end-of-attributes-list-consistently.patch
- CVE-2018-16062: heap-buffer-overflow in
  /elfutils/libdw/dwarf_getaranges.c:156 (bnc#1106390)
  Add patch:
  libdw-readelf-make-sure-there-is-enough-data-to-read.patch
- CVE-2018-18310: Invalid Address Read problem in
  dwfl_segment_report_module.c (bnc#1111973)
  Add patch:
  libdwfl-sanity-check-partial-core-file-data-reads.patch
- CVE-2019-7150: dwfl_segment_report_module doesn't check whether
  the dyn data read from core file is truncated (bnc#1123685)
  Add patch:
  libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
- CVE-2019-7665: NT_PLATFORM core file note should be a zero
  terminated string (CVE is a bit misleading, as this is not a bug
  in libelf as described) (bnc#1125007)
  Add patch:
  libebl-check-NT_PLATFORM-core-notes.patch
- CVE-2017-7609: memory allocation failure in __libelf_decompress
  (bnc#1033086)
  Add patch:
  libelf-check-compression-before-allocate-output-buffer.patch
- CVE-2018-16402: Double-free crash in nm and readelf (bnc#1107066)
  Add patch:
  libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
- CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi
  (readelf.c) (bnc#1033084)
  Add patch:
  readelf-fix-off-by-one-sanity-check.patch
- CVE-2018-18520: eu-size: Bad handling of ar files inside are
  files (bnc#1112726)
  Add patch:
  size-handle-recursive-elf-ar-files.patch
- CVE-2017-7608: heap-based buffer overflow in
  ebl_object_note_type_name (eblobjnotetypename.c) (bnc#1033085)
  Add patch:
  use-the-empty-string-for-note-names-with-zero-size.patch</changelog>
  <changelog author="schwab@suse.de" date="1573732800">- disable-tests-with-ptrace.patch: Remove, set XFAIL_TESTS instead
- dwelf_elf_e_machine_string.patch: Avoid spurious failure</changelog>
  <changelog author="jeffm@suse.com" date="1657108800">- Update to version 0.177 (Martin Li?ka):
    elfclassify: New tool to analyze ELF objects.
    readelf: Print DW_AT_data_member_location as decimal offset.
    Decode DW_AT_discr_list block attributes.
    libdw: Add DW_AT_GNU_numerator, DW_AT_GNU_denominator and DW_AT_GNU_bias.
    libdwelf: Add dwelf_elf_e_machine_string.
    dwelf_elf_begin now only returns NULL when there is an error
    reading or decompressing a file. If the file is not an ELF file
    an ELF handle of type ELF_K_NONE is returned.
    backends: Add support for C-SKY.
  - Update to version 0.176
    build: Add new --enable-install-elfh option.
    Do NOT use this for system installs (it overrides glibc elf.h).
    backends: riscv improved core file and return value location support.
    Fixes CVE-2019-7146, CVE-2019-7148, CVE-2019-7149, CVE-2019-7664
  - CVE-2019-7150: dwfl_segment_report_module doesn't check whether
    the dyn data read from core file is truncated (bnc#1123685)
  - CVE-2019-7665: NT_PLATFORM core file note should be a zero
    terminated string (CVE is a bit misleading, as this is not a bug
    in libelf as described) (bnc#1125007)
  - Removed patches:
  - libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
  - libebl-check-NT_PLATFORM-core-notes.patch
  - Update to version 0.175 (Martin Li?ka):
    readelf: Handle mutliple .debug_macro sections.
    Recognize and parse GNU Property, NT_VERSION and
    GNU Build Attribute ELF Notes.
    strip: Handle SHT_GROUP correctly.
    Add strip --reloc-debug-sections-only option.
    Handle relocations against GNU compressed sections.
    libdwelf: New function dwelf_elf_begin.
    libcpu: Recognize bpf jump variants BPF_JLT, BPF_JLE, BPF_JSLT
    and BPF_JSLE.
    backends: RISCV handles ADD/SUB relocations.
    Handle SHT_X86_64_UNWIND.
  - CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the
    function arlib_add_symbols() used by eu-ranlib (bnc#1112723)
  - CVE-2018-18310: Invalid Address Read problem in
    dwfl_segment_report_module.c (bnc#1111973)
  - CVE-2018-18520: eu-size: Bad handling of ar files inside are
    files (bnc#1112726)
  - Removed patches:
  - arlib-check-that-sh_entsize-isnt-zero.patch
  - libdwfl-sanity-check-partial-core-file-data-reads.patch
  - size-handle-recursive-elf-ar-files.patch
  - Update to version 0.174 (Martin Li?ka):
    libelf, libdw and all tools now handle extended shnum and
    shstrndx correctly.
    elfcompress: Don't rewrite input file if no section data needs
    updating. Try harder to keep same file mode bits
    (suid) on rewrite.
    strip: Handle mixed (out of order) allocated/non-allocated
    sections.
    unstrip: Handle SHT_GROUP sections.
    backends: RISCV and M68K now have backend implementations to
    generate CFI based backtraces.
  - CVE-2018-16402: libelf: denial of service/double free on an
    attempt to decompress the same section twice (bnc#1107066)
    Double-free crash in nm and readelf
  - CVE-2018-16403: heap buffer overflow in readelf (bnc#1107067)
  - CVE-2018-16062: heap-buffer-overflow in
    /elfutils/libdw/dwarf_getaranges.c:156 (bnc#1106390)
    Removed patches:
    libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
    libdw-check-end-of-attributes-list-consistently.patch
    libdw-readelf-make-sure-there-is-enough-data-to-read.patch
  - Update to version 0.173 (Martin Li?ka):
    More fixes for crashes and hangs found by afl-fuzz. In particular various
    functions now detect and break infinite loops caused by bad DIE tree cycles.
    readelf: Will now lookup the size and signedness of constant value types
    to display them correctly (and not just how they were encoded).
    libdw: New function dwarf_next_lines to read CU-less .debug_line data.
    dwarf_begin_elf now accepts ELF files containing just .debug_line
    or .debug_frame sections (which can be read without needing a DIE
    tree from the .debug_info section).
    Removed dwarf_getscn_info, which was never implemented.
    backends: Handle BPF simple relocations.
    The RISCV backends now handles ABI specific CFI and knows about
    RISCV register types and names.
  - Update to version 0.172 (Martin Li?ka):
    No functional changes compared to 0.171.
    Various bug fixes in libdw and eu-readelf dealing with bad DWARF5 data.
    Thanks to running the afl fuzzer on eu-readelf and various testcases.
  - Update to version 0.171 (Martin Li?ka):
    DWARF5 and split dwarf, including GNU DebugFission, are supported now.
    Data can be read from the new DWARF sections .debug_addr, .debug_line_str,
    .debug_loclists, .debug_str_offsets and .debug_rnglists.  Plus the new
    DWARF5 and GNU DebugFission encodings of the existing .debug sections.
    Also in split DWARF .dwo (DWARF object) files.  This support is mostly
    handled by existing functions (dwarf_getlocation*, dwarf_getsrclines,
    dwarf_ranges, dwarf_form*, etc.) now returning the data from the new
    sections and data formats.  But some new functions have been added
    to more easily get information about skeleton and split compile units
    (dwarf_get_units and dwarf_cu_info), handle new attribute data
    (dwarf_getabbrevattr_data) and to keep references to Dwarf_Dies
    that might come from different sections or files (dwarf_die_addr_die).
    Not yet supported are .dwp (Dwarf Package) and .sup (Dwarf Supplementary)
    files, the .debug_names index, the .debug_cu_index and .debug_tu_index
    sections. Only a single .debug_info (and .debug_types) section are
    currently handled.
    readelf: Handle all new DWARF5 sections.
  - -debug-dump=info+ will show split unit DIEs when found.
  - -dwarf-skeleton can be used when inspecting a .dwo file.
    Recognizes GNU locviews with --debug-dump=loc.
    libdw: New functions dwarf_die_addr_die, dwarf_get_units,
    dwarf_getabbrevattr_data and dwarf_cu_info.
    libdw will now try to resolve the alt file on first use of
    an alt attribute FORM when not set yet with dwarf_set_alt.
    dwarf_aggregate_size() now works with multi-dimensional arrays.
    libdwfl: Use process_vm_readv when available instead of ptrace.
    backends: Add a RISC-V backend.
    There were various improvements to build on Windows.
    The sha1 and md5 implementations have been removed, they weren't used.
  - Update to version 0.170 (Martin Li?ka):
    libdw: Added new DWARF5 attribute, tag, character encoding, language code,
    calling convention, defaulted member function and macro constants
    to dwarf.h.
  New functions dwarf_default_lower_bound and dwarf_line_file.
  dwarf_peel_type now handles DWARF5 immutable, packed and shared tags.
  dwarf_getmacros now handles DWARF5 .debug_macro sections.
    strip: Add -R, --remove-section=SECTION and --keep-section=SECTION.
    backends: The bpf disassembler is now always build on all platforms.
  - Includes changes in 0.169
    backends: Add support for EM_PPC64 GNU_ATTRIBUTES.
    Frame pointer unwinding fallback support for i386, x86_64, aarch64.
    translations: Update Polish translation.
  - CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and
    application crash) via a crafted ELF file (bnc#1033088)
  - CVE-2017-7610: elflint: heap-based buffer overflow in check_group
    (bnc#1033087)
  - CVE-2017-7609: memory allocation failure in __libelf_decompress
    (bnc#1033086)
  - CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi
    (readelf.c) (bnc#1033084)
  - CVE-2017-7608: heap-based buffer overflow in
    ebl_object_note_type_name (eblobjnotetypename.c) (bnc#1033085)
  - CVE-2017-7613: elfutils: denial of service (memory consumption)
    via a crafted ELF file (bnc#1033090)
  - CVE-2017-7612: elfutils: denial of service (heap-based buffer
    over-read and application crash) via a crafted ELF file (bnc#1033089)
  - Removed patches:
  - obsolete 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch
  - ppc-machine-flags.patch
  - elflint-check-symbol-table-data-is-big-enough-before-check.patch
  - elflint-dont-check-section-group-without-flags-word.patch
  - libelf-check-compression-before-allocate-output-buffer.patch
  - readelf-fix-off-by-one-sanity-check.patch
  - use-the-empty-string-for-note-names-with-zero-size.patch
  - elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
  - elfutils-dont-trust-sh_entsize.patch
- Packaging cleanups:
  - Modernize specfile and metadata. (Jan Engelhardt)
  - Use %make_build (Martin Li?ka)
  - Update License tag to GPL-3.0-or-later, as requested by legal
    review. (Dominique Leuenberger)
  - Don't make elfutils recommend elfutils-lang as elfutils-lang
    already supplements elfutils. (Antoine Belvire)
  - Fix typo in the recommends name bsc#1104264 (Tomas Chvatal)
  - Use %license (boo#1082318) (Fabian Vogt)
- Test fixes (Andreas Schwab):
  - disable-tests-with-ptrace.patch: Remove, set XFAIL_TESTS instead
  - dwelf_elf_e_machine_string.patch: Avoid spurious failure</changelog>
  <changelog author="jeffm@suse.com" date="1657627200">- Added 4G memory build constraint for aarch64 to pass testing.</changelog>
</package>
<package pkgid="7aa26617cdb9c11538dccfcd198accf91058e8134ff26a9a00738b1f37cea218" name="libdwarves-devel" arch="aarch64">
  <version epoch="0" ver="1.22" rel="150300.7.3.1"/>
  <changelog author="jengelh@inai.de" date="1584273600">- Update to release 1.17
  * Support raw BTF as available in /sys/kernel/btf/vmlinux.
  * Make --find_pointers_to consider unions.
  * Make --contains and --find_pointers_to honour --unions.
  * Add support for finding pointers to void.
  * Make --contains and --find_pointers_to to work with base types.</changelog>
  <changelog author="idonmez@suse.com" date="1589889600">- Don't require libebl-plugins on suse_version &gt;= 1550</changelog>
  <changelog author="jslaby@suse.com" date="1599048000">- add libbpf-Fix-libbpf-hashmap-on-I-LP32-architectures.patch</changelog>
  <changelog author="tdevries@suse.com" date="1600689600">- Backport fixes for segfault when processing dwz-ed kernel
  [bsc#1176095,https://github.com/acmel/dwarves/issues/10].
  * dwarves-dwarf_loader-Bail-out-at-DW_TAG_imported_unit-tags.patch
  * dwarves-dwarf_loader-Ignore-entries-in-a-DW_TAG_partial_unit-for-now.patch</changelog>
  <changelog author="jengelh@inai.de" date="1601640000">- Update to release 1.18
  * pahole now should be segfault free when handling gdb test
    suit DWARF files, including ADA, FORTRAN, rust and dwp
    compressed files (the latter is refused).
  * Bail out on partial units for now, avoiding segfaults.
- Drop
  dwarves-dwarf_loader-Ignore-entries-in-a-DW_TAG_partial_unit-for-now.patch,
  dwarves-dwarf_loader-Bail-out-at-DW_TAG_imported_unit-tags.patch
  (merged)
- Add forced ELF symvers because of ABI breaks</changelog>
  <changelog author="dmueller@suse.com" date="1603800000">- update to 1.18_15g040fd7f (bsc#1177921):
  * btf_encoder: Support cross-compiled ELF binaries with different endianness
  * strings: use BTF's string APIs for strings management
  * strings: Rename strings.h to avoid clashing with /usr/include/strings.h
  * dwarf_loader: increase the size of lookup hash map
  * btf_encoder: revamp how per-CPU variables are encoded
  * btf_encoder: Discard CUs after BTF encoding
  * btf_encoder: Fix emitting __ARRAY_SIZE_TYPE__ as index range type
  * btf_encoder: Use libbpf APIs to encode BTF type info
  * btf_loader: Use libbpf to load BTF
  * dwarves: Expose and maintain active debug info loader operations
  * btf_encoder: detect BTF encoding errors and exit
  * libbpf: Update to latest libbpf version
  * dwarf_loader: Conditionally define DW_AT_alignment
  * pahole: Implement --packed
  * man-pages: Fix 'coimbine' typo
- remove libbpf-Fix-libbpf-hashmap-on-I-LP32-architectures.patch (upstream)</changelog>
  <changelog author="jengelh@inai.de" date="1603800001">- Add _service file / move to 1.18.g19 (863e6f0f)
  * btf_encoder: Ignore zero-sized ELF symbols</changelog>
  <changelog author="jengelh@inai.de" date="1606219200">- Update to release 1.19
  * Support for split BTF.
  * Support cross-compiled ELF binaries with different endianness.
  * Support for showing typedefs for anonymous types, like structs,
    unions and enums.</changelog>
  <changelog author="glin@suse.com" date="1609934400">- Drop the version requirement of libdw-devel
  + DW_AT_alignment is defined in 1.19 so dwarves now is compatible
    with older libdw.</changelog>
  <changelog author="jengelh@inai.de" date="1612526400">- Update to release 1.20
  * Addresses problems related to gcc 11 defaulting to DWARF5
    for -g.
  * Support SHN_XINDEX in st_shndx symbol indexes, to handle ELF
    objects with more than 65534 sections, for instance, which
    happens with kernels built with KCFLAGS="-ffunction-sections
  - fdata-sections", Other cases may include when using FG-ASLR,
    LTO.
  * Fix BTF variable generation for kernel modules, not skipping
    variables at offset zero.
  * Fix address size to match what is in the ELF file being
    processed, to fix using a 64-bit pahole binary to generate
    BTF for a 32-bit vmlinux image.</changelog>
  <changelog author="jengelh@inai.de" date="1618228800">- Update to release 1.21
  * Handle DWARF5 DW_OP_addrx and
    subprogram ret type with abstract_origin properly.</changelog>
  <changelog author="jengelh@inai.de" date="1619092800">- Codify build requirement on elfutils &gt;= 0.171</changelog>
  <changelog author="jslaby@suse.cz" date="1620043200">- add remove-ftrace-filter.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1622548800">- Handle zero sized per-cpu veriables in Linux BTF.
  + btf_encoder-fix-and-complete-filtering-out-zero-sized-per-CPU-variables.patch</changelog>
  <changelog author="dmueller@suse.com" date="1622635200">- use https for url (and more beautification changes from spec-cleaner)</changelog>
  <changelog author="msuchanek@suse.com" date="1626350400">- Update to version 1.21+git175.1ef87b2 (jsc#SLE-17288):
  * libbpf: bump dependency to &gt;= 0.4.0
  * CMakeLists.txt: Enable SHARED and STATIC lib creation
  * libbpf: Allow to use packaged version
  * btfdiff: Support diffing DWARF vs detached BTF
  * pahole: Allow encoding BTF into a detached file
  * pahole: Add --kabi_prefix flag
  * btf_encoder: fix and complete filtering out zero-sized per-CPU variables
  * btf: Remove ftrace filter
  * pahole: Introduce --with_flexible_array option to show just types ending in a flexible array
  * Many updates to btf_encoder and bug fixes
- Remove upstreamed patches
  - btf_encoder-fix-and-complete-filtering-out-zero-sized-per-CPU-variables.patch
  - remove-ftrace-filter.patch
- Pretend version 1.22 to make kernel happy
  + dwarves-Prep-1.22.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1626523200">- Use system libbpf when available (bsc#1188420 bsc#1188419 jsc#SLE-17288 jsc#SLE-18805).</changelog>
  <changelog author="msuchanek@suse.com" date="1628856000">- 15.4 has new elfutils, drop libebl-plugins dependency.
- Update to version 1.21+git177.1ef87b2:
  * Fix crash with split BTF debuginfo
  * CMakeList.txt: Bump version to the upcoming 1.22 release, not out of the door yet
  - Remove upstreamed patch dwarves-Prep-1.22.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1629288000">- When building with system libbpf depend also on new enough Linux headers.</changelog>
  <changelog author="jengelh@inai.de" date="1629720000">- Update to release 1.22 (bsc#1190340).
  * Ability to encode BTF to a separate file
  * Multithreaded DWARF loading
  * Details at https://marc.info/?l=dwarves&amp;m=162975403628056&amp;w=2</changelog>
</package>
<package pkgid="e5b4a9558162d234eb9ee3d8ecc87159222b958f3cbb04084a29a10d61ae5564" name="libdwarves-devel" arch="x86_64">
  <version epoch="0" ver="1.22" rel="150300.7.3.1"/>
  <changelog author="jengelh@inai.de" date="1584273600">- Update to release 1.17
  * Support raw BTF as available in /sys/kernel/btf/vmlinux.
  * Make --find_pointers_to consider unions.
  * Make --contains and --find_pointers_to honour --unions.
  * Add support for finding pointers to void.
  * Make --contains and --find_pointers_to to work with base types.</changelog>
  <changelog author="idonmez@suse.com" date="1589889600">- Don't require libebl-plugins on suse_version &gt;= 1550</changelog>
  <changelog author="jslaby@suse.com" date="1599048000">- add libbpf-Fix-libbpf-hashmap-on-I-LP32-architectures.patch</changelog>
  <changelog author="tdevries@suse.com" date="1600689600">- Backport fixes for segfault when processing dwz-ed kernel
  [bsc#1176095,https://github.com/acmel/dwarves/issues/10].
  * dwarves-dwarf_loader-Bail-out-at-DW_TAG_imported_unit-tags.patch
  * dwarves-dwarf_loader-Ignore-entries-in-a-DW_TAG_partial_unit-for-now.patch</changelog>
  <changelog author="jengelh@inai.de" date="1601640000">- Update to release 1.18
  * pahole now should be segfault free when handling gdb test
    suit DWARF files, including ADA, FORTRAN, rust and dwp
    compressed files (the latter is refused).
  * Bail out on partial units for now, avoiding segfaults.
- Drop
  dwarves-dwarf_loader-Ignore-entries-in-a-DW_TAG_partial_unit-for-now.patch,
  dwarves-dwarf_loader-Bail-out-at-DW_TAG_imported_unit-tags.patch
  (merged)
- Add forced ELF symvers because of ABI breaks</changelog>
  <changelog author="dmueller@suse.com" date="1603800000">- update to 1.18_15g040fd7f (bsc#1177921):
  * btf_encoder: Support cross-compiled ELF binaries with different endianness
  * strings: use BTF's string APIs for strings management
  * strings: Rename strings.h to avoid clashing with /usr/include/strings.h
  * dwarf_loader: increase the size of lookup hash map
  * btf_encoder: revamp how per-CPU variables are encoded
  * btf_encoder: Discard CUs after BTF encoding
  * btf_encoder: Fix emitting __ARRAY_SIZE_TYPE__ as index range type
  * btf_encoder: Use libbpf APIs to encode BTF type info
  * btf_loader: Use libbpf to load BTF
  * dwarves: Expose and maintain active debug info loader operations
  * btf_encoder: detect BTF encoding errors and exit
  * libbpf: Update to latest libbpf version
  * dwarf_loader: Conditionally define DW_AT_alignment
  * pahole: Implement --packed
  * man-pages: Fix 'coimbine' typo
- remove libbpf-Fix-libbpf-hashmap-on-I-LP32-architectures.patch (upstream)</changelog>
  <changelog author="jengelh@inai.de" date="1603800001">- Add _service file / move to 1.18.g19 (863e6f0f)
  * btf_encoder: Ignore zero-sized ELF symbols</changelog>
  <changelog author="jengelh@inai.de" date="1606219200">- Update to release 1.19
  * Support for split BTF.
  * Support cross-compiled ELF binaries with different endianness.
  * Support for showing typedefs for anonymous types, like structs,
    unions and enums.</changelog>
  <changelog author="glin@suse.com" date="1609934400">- Drop the version requirement of libdw-devel
  + DW_AT_alignment is defined in 1.19 so dwarves now is compatible
    with older libdw.</changelog>
  <changelog author="jengelh@inai.de" date="1612526400">- Update to release 1.20
  * Addresses problems related to gcc 11 defaulting to DWARF5
    for -g.
  * Support SHN_XINDEX in st_shndx symbol indexes, to handle ELF
    objects with more than 65534 sections, for instance, which
    happens with kernels built with KCFLAGS="-ffunction-sections
  - fdata-sections", Other cases may include when using FG-ASLR,
    LTO.
  * Fix BTF variable generation for kernel modules, not skipping
    variables at offset zero.
  * Fix address size to match what is in the ELF file being
    processed, to fix using a 64-bit pahole binary to generate
    BTF for a 32-bit vmlinux image.</changelog>
  <changelog author="jengelh@inai.de" date="1618228800">- Update to release 1.21
  * Handle DWARF5 DW_OP_addrx and
    subprogram ret type with abstract_origin properly.</changelog>
  <changelog author="jengelh@inai.de" date="1619092800">- Codify build requirement on elfutils &gt;= 0.171</changelog>
  <changelog author="jslaby@suse.cz" date="1620043200">- add remove-ftrace-filter.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1622548800">- Handle zero sized per-cpu veriables in Linux BTF.
  + btf_encoder-fix-and-complete-filtering-out-zero-sized-per-CPU-variables.patch</changelog>
  <changelog author="dmueller@suse.com" date="1622635200">- use https for url (and more beautification changes from spec-cleaner)</changelog>
  <changelog author="msuchanek@suse.com" date="1626350400">- Update to version 1.21+git175.1ef87b2 (jsc#SLE-17288):
  * libbpf: bump dependency to &gt;= 0.4.0
  * CMakeLists.txt: Enable SHARED and STATIC lib creation
  * libbpf: Allow to use packaged version
  * btfdiff: Support diffing DWARF vs detached BTF
  * pahole: Allow encoding BTF into a detached file
  * pahole: Add --kabi_prefix flag
  * btf_encoder: fix and complete filtering out zero-sized per-CPU variables
  * btf: Remove ftrace filter
  * pahole: Introduce --with_flexible_array option to show just types ending in a flexible array
  * Many updates to btf_encoder and bug fixes
- Remove upstreamed patches
  - btf_encoder-fix-and-complete-filtering-out-zero-sized-per-CPU-variables.patch
  - remove-ftrace-filter.patch
- Pretend version 1.22 to make kernel happy
  + dwarves-Prep-1.22.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1626523200">- Use system libbpf when available (bsc#1188420 bsc#1188419 jsc#SLE-17288 jsc#SLE-18805).</changelog>
  <changelog author="msuchanek@suse.com" date="1628856000">- 15.4 has new elfutils, drop libebl-plugins dependency.
- Update to version 1.21+git177.1ef87b2:
  * Fix crash with split BTF debuginfo
  * CMakeList.txt: Bump version to the upcoming 1.22 release, not out of the door yet
  - Remove upstreamed patch dwarves-Prep-1.22.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1629288000">- When building with system libbpf depend also on new enough Linux headers.</changelog>
  <changelog author="jengelh@inai.de" date="1629720000">- Update to release 1.22 (bsc#1190340).
  * Ability to encode BTF to a separate file
  * Multithreaded DWARF loading
  * Details at https://marc.info/?l=dwarves&amp;m=162975403628056&amp;w=2</changelog>
</package>
<package pkgid="54197aaf55d5a2059d1208806e7593c657a1d4a1a725942c1a39c74aa8b96216" name="libdwarves1" arch="aarch64">
  <version epoch="0" ver="1.22" rel="150300.7.3.1"/>
  <changelog author="jengelh@inai.de" date="1584273600">- Update to release 1.17
  * Support raw BTF as available in /sys/kernel/btf/vmlinux.
  * Make --find_pointers_to consider unions.
  * Make --contains and --find_pointers_to honour --unions.
  * Add support for finding pointers to void.
  * Make --contains and --find_pointers_to to work with base types.</changelog>
  <changelog author="idonmez@suse.com" date="1589889600">- Don't require libebl-plugins on suse_version &gt;= 1550</changelog>
  <changelog author="jslaby@suse.com" date="1599048000">- add libbpf-Fix-libbpf-hashmap-on-I-LP32-architectures.patch</changelog>
  <changelog author="tdevries@suse.com" date="1600689600">- Backport fixes for segfault when processing dwz-ed kernel
  [bsc#1176095,https://github.com/acmel/dwarves/issues/10].
  * dwarves-dwarf_loader-Bail-out-at-DW_TAG_imported_unit-tags.patch
  * dwarves-dwarf_loader-Ignore-entries-in-a-DW_TAG_partial_unit-for-now.patch</changelog>
  <changelog author="jengelh@inai.de" date="1601640000">- Update to release 1.18
  * pahole now should be segfault free when handling gdb test
    suit DWARF files, including ADA, FORTRAN, rust and dwp
    compressed files (the latter is refused).
  * Bail out on partial units for now, avoiding segfaults.
- Drop
  dwarves-dwarf_loader-Ignore-entries-in-a-DW_TAG_partial_unit-for-now.patch,
  dwarves-dwarf_loader-Bail-out-at-DW_TAG_imported_unit-tags.patch
  (merged)
- Add forced ELF symvers because of ABI breaks</changelog>
  <changelog author="dmueller@suse.com" date="1603800000">- update to 1.18_15g040fd7f (bsc#1177921):
  * btf_encoder: Support cross-compiled ELF binaries with different endianness
  * strings: use BTF's string APIs for strings management
  * strings: Rename strings.h to avoid clashing with /usr/include/strings.h
  * dwarf_loader: increase the size of lookup hash map
  * btf_encoder: revamp how per-CPU variables are encoded
  * btf_encoder: Discard CUs after BTF encoding
  * btf_encoder: Fix emitting __ARRAY_SIZE_TYPE__ as index range type
  * btf_encoder: Use libbpf APIs to encode BTF type info
  * btf_loader: Use libbpf to load BTF
  * dwarves: Expose and maintain active debug info loader operations
  * btf_encoder: detect BTF encoding errors and exit
  * libbpf: Update to latest libbpf version
  * dwarf_loader: Conditionally define DW_AT_alignment
  * pahole: Implement --packed
  * man-pages: Fix 'coimbine' typo
- remove libbpf-Fix-libbpf-hashmap-on-I-LP32-architectures.patch (upstream)</changelog>
  <changelog author="jengelh@inai.de" date="1603800001">- Add _service file / move to 1.18.g19 (863e6f0f)
  * btf_encoder: Ignore zero-sized ELF symbols</changelog>
  <changelog author="jengelh@inai.de" date="1606219200">- Update to release 1.19
  * Support for split BTF.
  * Support cross-compiled ELF binaries with different endianness.
  * Support for showing typedefs for anonymous types, like structs,
    unions and enums.</changelog>
  <changelog author="glin@suse.com" date="1609934400">- Drop the version requirement of libdw-devel
  + DW_AT_alignment is defined in 1.19 so dwarves now is compatible
    with older libdw.</changelog>
  <changelog author="jengelh@inai.de" date="1612526400">- Update to release 1.20
  * Addresses problems related to gcc 11 defaulting to DWARF5
    for -g.
  * Support SHN_XINDEX in st_shndx symbol indexes, to handle ELF
    objects with more than 65534 sections, for instance, which
    happens with kernels built with KCFLAGS="-ffunction-sections
  - fdata-sections", Other cases may include when using FG-ASLR,
    LTO.
  * Fix BTF variable generation for kernel modules, not skipping
    variables at offset zero.
  * Fix address size to match what is in the ELF file being
    processed, to fix using a 64-bit pahole binary to generate
    BTF for a 32-bit vmlinux image.</changelog>
  <changelog author="jengelh@inai.de" date="1618228800">- Update to release 1.21
  * Handle DWARF5 DW_OP_addrx and
    subprogram ret type with abstract_origin properly.</changelog>
  <changelog author="jengelh@inai.de" date="1619092800">- Codify build requirement on elfutils &gt;= 0.171</changelog>
  <changelog author="jslaby@suse.cz" date="1620043200">- add remove-ftrace-filter.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1622548800">- Handle zero sized per-cpu veriables in Linux BTF.
  + btf_encoder-fix-and-complete-filtering-out-zero-sized-per-CPU-variables.patch</changelog>
  <changelog author="dmueller@suse.com" date="1622635200">- use https for url (and more beautification changes from spec-cleaner)</changelog>
  <changelog author="msuchanek@suse.com" date="1626350400">- Update to version 1.21+git175.1ef87b2 (jsc#SLE-17288):
  * libbpf: bump dependency to &gt;= 0.4.0
  * CMakeLists.txt: Enable SHARED and STATIC lib creation
  * libbpf: Allow to use packaged version
  * btfdiff: Support diffing DWARF vs detached BTF
  * pahole: Allow encoding BTF into a detached file
  * pahole: Add --kabi_prefix flag
  * btf_encoder: fix and complete filtering out zero-sized per-CPU variables
  * btf: Remove ftrace filter
  * pahole: Introduce --with_flexible_array option to show just types ending in a flexible array
  * Many updates to btf_encoder and bug fixes
- Remove upstreamed patches
  - btf_encoder-fix-and-complete-filtering-out-zero-sized-per-CPU-variables.patch
  - remove-ftrace-filter.patch
- Pretend version 1.22 to make kernel happy
  + dwarves-Prep-1.22.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1626523200">- Use system libbpf when available (bsc#1188420 bsc#1188419 jsc#SLE-17288 jsc#SLE-18805).</changelog>
  <changelog author="msuchanek@suse.com" date="1628856000">- 15.4 has new elfutils, drop libebl-plugins dependency.
- Update to version 1.21+git177.1ef87b2:
  * Fix crash with split BTF debuginfo
  * CMakeList.txt: Bump version to the upcoming 1.22 release, not out of the door yet
  - Remove upstreamed patch dwarves-Prep-1.22.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1629288000">- When building with system libbpf depend also on new enough Linux headers.</changelog>
  <changelog author="jengelh@inai.de" date="1629720000">- Update to release 1.22 (bsc#1190340).
  * Ability to encode BTF to a separate file
  * Multithreaded DWARF loading
  * Details at https://marc.info/?l=dwarves&amp;m=162975403628056&amp;w=2</changelog>
</package>
<package pkgid="cbece900f91ffdea788df377436144ec9a7a8206f89fc3362dfc837ef99a34a5" name="libdwarves1" arch="x86_64">
  <version epoch="0" ver="1.22" rel="150300.7.3.1"/>
  <changelog author="jengelh@inai.de" date="1584273600">- Update to release 1.17
  * Support raw BTF as available in /sys/kernel/btf/vmlinux.
  * Make --find_pointers_to consider unions.
  * Make --contains and --find_pointers_to honour --unions.
  * Add support for finding pointers to void.
  * Make --contains and --find_pointers_to to work with base types.</changelog>
  <changelog author="idonmez@suse.com" date="1589889600">- Don't require libebl-plugins on suse_version &gt;= 1550</changelog>
  <changelog author="jslaby@suse.com" date="1599048000">- add libbpf-Fix-libbpf-hashmap-on-I-LP32-architectures.patch</changelog>
  <changelog author="tdevries@suse.com" date="1600689600">- Backport fixes for segfault when processing dwz-ed kernel
  [bsc#1176095,https://github.com/acmel/dwarves/issues/10].
  * dwarves-dwarf_loader-Bail-out-at-DW_TAG_imported_unit-tags.patch
  * dwarves-dwarf_loader-Ignore-entries-in-a-DW_TAG_partial_unit-for-now.patch</changelog>
  <changelog author="jengelh@inai.de" date="1601640000">- Update to release 1.18
  * pahole now should be segfault free when handling gdb test
    suit DWARF files, including ADA, FORTRAN, rust and dwp
    compressed files (the latter is refused).
  * Bail out on partial units for now, avoiding segfaults.
- Drop
  dwarves-dwarf_loader-Ignore-entries-in-a-DW_TAG_partial_unit-for-now.patch,
  dwarves-dwarf_loader-Bail-out-at-DW_TAG_imported_unit-tags.patch
  (merged)
- Add forced ELF symvers because of ABI breaks</changelog>
  <changelog author="dmueller@suse.com" date="1603800000">- update to 1.18_15g040fd7f (bsc#1177921):
  * btf_encoder: Support cross-compiled ELF binaries with different endianness
  * strings: use BTF's string APIs for strings management
  * strings: Rename strings.h to avoid clashing with /usr/include/strings.h
  * dwarf_loader: increase the size of lookup hash map
  * btf_encoder: revamp how per-CPU variables are encoded
  * btf_encoder: Discard CUs after BTF encoding
  * btf_encoder: Fix emitting __ARRAY_SIZE_TYPE__ as index range type
  * btf_encoder: Use libbpf APIs to encode BTF type info
  * btf_loader: Use libbpf to load BTF
  * dwarves: Expose and maintain active debug info loader operations
  * btf_encoder: detect BTF encoding errors and exit
  * libbpf: Update to latest libbpf version
  * dwarf_loader: Conditionally define DW_AT_alignment
  * pahole: Implement --packed
  * man-pages: Fix 'coimbine' typo
- remove libbpf-Fix-libbpf-hashmap-on-I-LP32-architectures.patch (upstream)</changelog>
  <changelog author="jengelh@inai.de" date="1603800001">- Add _service file / move to 1.18.g19 (863e6f0f)
  * btf_encoder: Ignore zero-sized ELF symbols</changelog>
  <changelog author="jengelh@inai.de" date="1606219200">- Update to release 1.19
  * Support for split BTF.
  * Support cross-compiled ELF binaries with different endianness.
  * Support for showing typedefs for anonymous types, like structs,
    unions and enums.</changelog>
  <changelog author="glin@suse.com" date="1609934400">- Drop the version requirement of libdw-devel
  + DW_AT_alignment is defined in 1.19 so dwarves now is compatible
    with older libdw.</changelog>
  <changelog author="jengelh@inai.de" date="1612526400">- Update to release 1.20
  * Addresses problems related to gcc 11 defaulting to DWARF5
    for -g.
  * Support SHN_XINDEX in st_shndx symbol indexes, to handle ELF
    objects with more than 65534 sections, for instance, which
    happens with kernels built with KCFLAGS="-ffunction-sections
  - fdata-sections", Other cases may include when using FG-ASLR,
    LTO.
  * Fix BTF variable generation for kernel modules, not skipping
    variables at offset zero.
  * Fix address size to match what is in the ELF file being
    processed, to fix using a 64-bit pahole binary to generate
    BTF for a 32-bit vmlinux image.</changelog>
  <changelog author="jengelh@inai.de" date="1618228800">- Update to release 1.21
  * Handle DWARF5 DW_OP_addrx and
    subprogram ret type with abstract_origin properly.</changelog>
  <changelog author="jengelh@inai.de" date="1619092800">- Codify build requirement on elfutils &gt;= 0.171</changelog>
  <changelog author="jslaby@suse.cz" date="1620043200">- add remove-ftrace-filter.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1622548800">- Handle zero sized per-cpu veriables in Linux BTF.
  + btf_encoder-fix-and-complete-filtering-out-zero-sized-per-CPU-variables.patch</changelog>
  <changelog author="dmueller@suse.com" date="1622635200">- use https for url (and more beautification changes from spec-cleaner)</changelog>
  <changelog author="msuchanek@suse.com" date="1626350400">- Update to version 1.21+git175.1ef87b2 (jsc#SLE-17288):
  * libbpf: bump dependency to &gt;= 0.4.0
  * CMakeLists.txt: Enable SHARED and STATIC lib creation
  * libbpf: Allow to use packaged version
  * btfdiff: Support diffing DWARF vs detached BTF
  * pahole: Allow encoding BTF into a detached file
  * pahole: Add --kabi_prefix flag
  * btf_encoder: fix and complete filtering out zero-sized per-CPU variables
  * btf: Remove ftrace filter
  * pahole: Introduce --with_flexible_array option to show just types ending in a flexible array
  * Many updates to btf_encoder and bug fixes
- Remove upstreamed patches
  - btf_encoder-fix-and-complete-filtering-out-zero-sized-per-CPU-variables.patch
  - remove-ftrace-filter.patch
- Pretend version 1.22 to make kernel happy
  + dwarves-Prep-1.22.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1626523200">- Use system libbpf when available (bsc#1188420 bsc#1188419 jsc#SLE-17288 jsc#SLE-18805).</changelog>
  <changelog author="msuchanek@suse.com" date="1628856000">- 15.4 has new elfutils, drop libebl-plugins dependency.
- Update to version 1.21+git177.1ef87b2:
  * Fix crash with split BTF debuginfo
  * CMakeList.txt: Bump version to the upcoming 1.22 release, not out of the door yet
  - Remove upstreamed patch dwarves-Prep-1.22.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1629288000">- When building with system libbpf depend also on new enough Linux headers.</changelog>
  <changelog author="jengelh@inai.de" date="1629720000">- Update to release 1.22 (bsc#1190340).
  * Ability to encode BTF to a separate file
  * Multithreaded DWARF loading
  * Details at https://marc.info/?l=dwarves&amp;m=162975403628056&amp;w=2</changelog>
</package>
<package pkgid="ccb91cf4c4d17422743404308073c8f25b77b2932cd196ab81796b8db5227ff5" name="libebl-plugins" arch="aarch64">
  <version epoch="0" ver="0.177" rel="150300.11.3.1"/>
  <changelog author="normand@linux.vnet.ibm.com" date="1456574400">- rename dt-ppc-opt.patch as elfutils-0.164-dt-ppc-opt.patch
  and add reference to upstream commit id</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1460808000">-  add elfutils-0.164-gcc6.patch</changelog>
  <changelog author="fcrozat@suse.com" date="1467028800">- Update to version 0.166:
  + config: The default program prefix for the installed tools is now
  eu-. Use configure --program-prefix="" to not use a program
  prefix.
  + Various bugfixes.
- Drop elfutils-0.164-dt-ppc-opt.patch and
  elfutils-0.164-gcc6.patch (merged upstream)
- Add patch elfutils-0.166-elfcmp-comp-gcc6.patch: fix
  self-comparison error with GCC 6.
- Changes from 0.165:
  + Add eu-elfcompress
  + Add pkg-config files for libelf and libdw.</changelog>
  <changelog author="schwab@suse.de" date="1468238400">- disable-tests-with-ptrace.patch: disable tests that use ptrace when
  running under qemu-linux-user</changelog>
  <changelog author="matz@suse.com" date="1472558400">- Update to version 0.167:
  libasm: Add eBPF disassembler for EM_BPF files.
  backends: Add m68k and BPF backends.
  ld: Removed.
  dwelf: Add ELF/DWARF string table creation functions. dwelf_strtab_init,
    dwelf_strtab_add, dwelf_strtab_add_len, dwelf_strtab_finalize,
    dwelf_strent_off, dwelf_strent_str and dwelf_strtab_free.
  Support compressed sections from binutils 2.27.
- Remove patch elfutils-0.166-elfcmp-comp-gcc6.patch: included upstream.</changelog>
  <changelog author="mliska@suse.cz" date="1481284800">- Add 0001-Add-GCC7-Wimplicit-fallthrough-support-fixes.patch: fix
  new warning introduced in GCC 7.
- Add 0001-ar-Fix-GCC7-Wformat-length-issues.patch: fix -Wformat-length
  warning introduced in GCC 7.</changelog>
  <changelog author="rguenther@suse.com" date="1490875200">- Update to version 0.168:
  libelf: gelf_newehdr and gelf_newehdr now return void *.
  libdw: dwarf.h corrected the DW_LANG_PLI constant name (was DW_LANG_PL1).
  readelf: Add optional --symbols[=SECTION] argument to select section name.
- Includes changes from 0001-Add-GCC7-Wimplicit-fallthrough-support-fixes.patch
  and 0001-ar-Fix-GCC7-Wformat-length-issues.patch.
- Remove elfutils-0.137-dwarf-header-check-fix.diff which is no longer
  required after a debugedit fix.</changelog>
  <changelog author="bwiedemann@suse.com" date="1490961600">- make tests pass when user does not want debuginfo (boo#1031556)</changelog>
  <changelog author="jengelh@inai.de" date="1491566400">- Add missing ldconfig calls for libasm1</changelog>
  <changelog author="mliska@suse.cz" date="1493121600">- Add 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch:
  fix .gnu.attributes checking on ppc64{,le}.</changelog>
  <changelog author="mliska@suse.cz" date="1493294400">- Add 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch
  unconditionally in the spec file. As we can't support binary diff,
  a newly added test-case is removed from the patch.</changelog>
  <changelog author="jengelh@inai.de" date="1495972800">- Update Git-Clone URL</changelog>
  <changelog author="schwab@linux-m68k.org" date="1497787200">- ppc-machine-flags.patch: support EM_PPC machine flags
- disable-tests-with-ptrace.patch: disable more tests</changelog>
  <changelog author="jengelh@inai.de" date="1501588800">- Update package descriptions.
- Rename libebl1 to libebl-plugins as these are not linked,
  but dlopened using their unversioned libebl_$ARCH.so name.
- Have libelf1 require libebl-plugins (libebl.a, which does the
  dlopen call, is staticly built into libelf1). This is necessary
  for pahole to display its results. [boo#1049871]</changelog>
  <changelog author="jengelh@inai.de" date="1503748800">- Restore obsolete on libebl.</changelog>
  <changelog author="jmoreira@suse.com" date="1537876800">- CVE-2017-7613: elfutils: denial of service (memory consumption)
  via a crafted ELF file (bnc#1033090)
  Add patch:
  elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
- CVE-2017-7612: elfutils: denial of service (heap-based buffer
  over-read and application crash) via a crafted ELF file
  (bnc#1033089)
  Add patch: elfutils-dont-trust-sh_entsize.patch</changelog>
  <changelog author="jmoreira@suse.com" date="1558526400">- CVE-2018-16402: libelf: denial of service/double free on an
  attempt to decompress the same section twice (bnc#1107066)
  Add patch:
  libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
- CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the
  function arlib_add_symbols() used by eu-ranlib (bnc#1112723)
  Add patch:
  arlib-check-that-sh_entsize-isnt-zero.patch
- CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and
  application crash) via a crafted ELF file (bnc#1033088)
  Add patch:
  elflint-check-symbol-table-data-is-big-enough-before-check.patch
- CVE-2017-7610: elflint: heap-based buffer overflow in check_group
  (bnc#1033087)
  Add patch:
  elflint-dont-check-section-group-without-flags-word.patch
- CVE-2018-16403: heap buffer overflow in readelf (bnc#1107067)
  Add patch:
  libdw-check-end-of-attributes-list-consistently.patch
- CVE-2018-16062: heap-buffer-overflow in
  /elfutils/libdw/dwarf_getaranges.c:156 (bnc#1106390)
  Add patch:
  libdw-readelf-make-sure-there-is-enough-data-to-read.patch
- CVE-2018-18310: Invalid Address Read problem in
  dwfl_segment_report_module.c (bnc#1111973)
  Add patch:
  libdwfl-sanity-check-partial-core-file-data-reads.patch
- CVE-2019-7150: dwfl_segment_report_module doesn't check whether
  the dyn data read from core file is truncated (bnc#1123685)
  Add patch:
  libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
- CVE-2019-7665: NT_PLATFORM core file note should be a zero
  terminated string (CVE is a bit misleading, as this is not a bug
  in libelf as described) (bnc#1125007)
  Add patch:
  libebl-check-NT_PLATFORM-core-notes.patch
- CVE-2017-7609: memory allocation failure in __libelf_decompress
  (bnc#1033086)
  Add patch:
  libelf-check-compression-before-allocate-output-buffer.patch
- CVE-2018-16402: Double-free crash in nm and readelf (bnc#1107066)
  Add patch:
  libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
- CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi
  (readelf.c) (bnc#1033084)
  Add patch:
  readelf-fix-off-by-one-sanity-check.patch
- CVE-2018-18520: eu-size: Bad handling of ar files inside are
  files (bnc#1112726)
  Add patch:
  size-handle-recursive-elf-ar-files.patch
- CVE-2017-7608: heap-based buffer overflow in
  ebl_object_note_type_name (eblobjnotetypename.c) (bnc#1033085)
  Add patch:
  use-the-empty-string-for-note-names-with-zero-size.patch</changelog>
  <changelog author="schwab@suse.de" date="1573732800">- disable-tests-with-ptrace.patch: Remove, set XFAIL_TESTS instead
- dwelf_elf_e_machine_string.patch: Avoid spurious failure</changelog>
  <changelog author="jeffm@suse.com" date="1657108800">- Update to version 0.177 (Martin Li?ka):
    elfclassify: New tool to analyze ELF objects.
    readelf: Print DW_AT_data_member_location as decimal offset.
    Decode DW_AT_discr_list block attributes.
    libdw: Add DW_AT_GNU_numerator, DW_AT_GNU_denominator and DW_AT_GNU_bias.
    libdwelf: Add dwelf_elf_e_machine_string.
    dwelf_elf_begin now only returns NULL when there is an error
    reading or decompressing a file. If the file is not an ELF file
    an ELF handle of type ELF_K_NONE is returned.
    backends: Add support for C-SKY.
  - Update to version 0.176
    build: Add new --enable-install-elfh option.
    Do NOT use this for system installs (it overrides glibc elf.h).
    backends: riscv improved core file and return value location support.
    Fixes CVE-2019-7146, CVE-2019-7148, CVE-2019-7149, CVE-2019-7664
  - CVE-2019-7150: dwfl_segment_report_module doesn't check whether
    the dyn data read from core file is truncated (bnc#1123685)
  - CVE-2019-7665: NT_PLATFORM core file note should be a zero
    terminated string (CVE is a bit misleading, as this is not a bug
    in libelf as described) (bnc#1125007)
  - Removed patches:
  - libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
  - libebl-check-NT_PLATFORM-core-notes.patch
  - Update to version 0.175 (Martin Li?ka):
    readelf: Handle mutliple .debug_macro sections.
    Recognize and parse GNU Property, NT_VERSION and
    GNU Build Attribute ELF Notes.
    strip: Handle SHT_GROUP correctly.
    Add strip --reloc-debug-sections-only option.
    Handle relocations against GNU compressed sections.
    libdwelf: New function dwelf_elf_begin.
    libcpu: Recognize bpf jump variants BPF_JLT, BPF_JLE, BPF_JSLT
    and BPF_JSLE.
    backends: RISCV handles ADD/SUB relocations.
    Handle SHT_X86_64_UNWIND.
  - CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the
    function arlib_add_symbols() used by eu-ranlib (bnc#1112723)
  - CVE-2018-18310: Invalid Address Read problem in
    dwfl_segment_report_module.c (bnc#1111973)
  - CVE-2018-18520: eu-size: Bad handling of ar files inside are
    files (bnc#1112726)
  - Removed patches:
  - arlib-check-that-sh_entsize-isnt-zero.patch
  - libdwfl-sanity-check-partial-core-file-data-reads.patch
  - size-handle-recursive-elf-ar-files.patch
  - Update to version 0.174 (Martin Li?ka):
    libelf, libdw and all tools now handle extended shnum and
    shstrndx correctly.
    elfcompress: Don't rewrite input file if no section data needs
    updating. Try harder to keep same file mode bits
    (suid) on rewrite.
    strip: Handle mixed (out of order) allocated/non-allocated
    sections.
    unstrip: Handle SHT_GROUP sections.
    backends: RISCV and M68K now have backend implementations to
    generate CFI based backtraces.
  - CVE-2018-16402: libelf: denial of service/double free on an
    attempt to decompress the same section twice (bnc#1107066)
    Double-free crash in nm and readelf
  - CVE-2018-16403: heap buffer overflow in readelf (bnc#1107067)
  - CVE-2018-16062: heap-buffer-overflow in
    /elfutils/libdw/dwarf_getaranges.c:156 (bnc#1106390)
    Removed patches:
    libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
    libdw-check-end-of-attributes-list-consistently.patch
    libdw-readelf-make-sure-there-is-enough-data-to-read.patch
  - Update to version 0.173 (Martin Li?ka):
    More fixes for crashes and hangs found by afl-fuzz. In particular various
    functions now detect and break infinite loops caused by bad DIE tree cycles.
    readelf: Will now lookup the size and signedness of constant value types
    to display them correctly (and not just how they were encoded).
    libdw: New function dwarf_next_lines to read CU-less .debug_line data.
    dwarf_begin_elf now accepts ELF files containing just .debug_line
    or .debug_frame sections (which can be read without needing a DIE
    tree from the .debug_info section).
    Removed dwarf_getscn_info, which was never implemented.
    backends: Handle BPF simple relocations.
    The RISCV backends now handles ABI specific CFI and knows about
    RISCV register types and names.
  - Update to version 0.172 (Martin Li?ka):
    No functional changes compared to 0.171.
    Various bug fixes in libdw and eu-readelf dealing with bad DWARF5 data.
    Thanks to running the afl fuzzer on eu-readelf and various testcases.
  - Update to version 0.171 (Martin Li?ka):
    DWARF5 and split dwarf, including GNU DebugFission, are supported now.
    Data can be read from the new DWARF sections .debug_addr, .debug_line_str,
    .debug_loclists, .debug_str_offsets and .debug_rnglists.  Plus the new
    DWARF5 and GNU DebugFission encodings of the existing .debug sections.
    Also in split DWARF .dwo (DWARF object) files.  This support is mostly
    handled by existing functions (dwarf_getlocation*, dwarf_getsrclines,
    dwarf_ranges, dwarf_form*, etc.) now returning the data from the new
    sections and data formats.  But some new functions have been added
    to more easily get information about skeleton and split compile units
    (dwarf_get_units and dwarf_cu_info), handle new attribute data
    (dwarf_getabbrevattr_data) and to keep references to Dwarf_Dies
    that might come from different sections or files (dwarf_die_addr_die).
    Not yet supported are .dwp (Dwarf Package) and .sup (Dwarf Supplementary)
    files, the .debug_names index, the .debug_cu_index and .debug_tu_index
    sections. Only a single .debug_info (and .debug_types) section are
    currently handled.
    readelf: Handle all new DWARF5 sections.
  - -debug-dump=info+ will show split unit DIEs when found.
  - -dwarf-skeleton can be used when inspecting a .dwo file.
    Recognizes GNU locviews with --debug-dump=loc.
    libdw: New functions dwarf_die_addr_die, dwarf_get_units,
    dwarf_getabbrevattr_data and dwarf_cu_info.
    libdw will now try to resolve the alt file on first use of
    an alt attribute FORM when not set yet with dwarf_set_alt.
    dwarf_aggregate_size() now works with multi-dimensional arrays.
    libdwfl: Use process_vm_readv when available instead of ptrace.
    backends: Add a RISC-V backend.
    There were various improvements to build on Windows.
    The sha1 and md5 implementations have been removed, they weren't used.
  - Update to version 0.170 (Martin Li?ka):
    libdw: Added new DWARF5 attribute, tag, character encoding, language code,
    calling convention, defaulted member function and macro constants
    to dwarf.h.
  New functions dwarf_default_lower_bound and dwarf_line_file.
  dwarf_peel_type now handles DWARF5 immutable, packed and shared tags.
  dwarf_getmacros now handles DWARF5 .debug_macro sections.
    strip: Add -R, --remove-section=SECTION and --keep-section=SECTION.
    backends: The bpf disassembler is now always build on all platforms.
  - Includes changes in 0.169
    backends: Add support for EM_PPC64 GNU_ATTRIBUTES.
    Frame pointer unwinding fallback support for i386, x86_64, aarch64.
    translations: Update Polish translation.
  - CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and
    application crash) via a crafted ELF file (bnc#1033088)
  - CVE-2017-7610: elflint: heap-based buffer overflow in check_group
    (bnc#1033087)
  - CVE-2017-7609: memory allocation failure in __libelf_decompress
    (bnc#1033086)
  - CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi
    (readelf.c) (bnc#1033084)
  - CVE-2017-7608: heap-based buffer overflow in
    ebl_object_note_type_name (eblobjnotetypename.c) (bnc#1033085)
  - CVE-2017-7613: elfutils: denial of service (memory consumption)
    via a crafted ELF file (bnc#1033090)
  - CVE-2017-7612: elfutils: denial of service (heap-based buffer
    over-read and application crash) via a crafted ELF file (bnc#1033089)
  - Removed patches:
  - obsolete 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch
  - ppc-machine-flags.patch
  - elflint-check-symbol-table-data-is-big-enough-before-check.patch
  - elflint-dont-check-section-group-without-flags-word.patch
  - libelf-check-compression-before-allocate-output-buffer.patch
  - readelf-fix-off-by-one-sanity-check.patch
  - use-the-empty-string-for-note-names-with-zero-size.patch
  - elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
  - elfutils-dont-trust-sh_entsize.patch
- Packaging cleanups:
  - Modernize specfile and metadata. (Jan Engelhardt)
  - Use %make_build (Martin Li?ka)
  - Update License tag to GPL-3.0-or-later, as requested by legal
    review. (Dominique Leuenberger)
  - Don't make elfutils recommend elfutils-lang as elfutils-lang
    already supplements elfutils. (Antoine Belvire)
  - Fix typo in the recommends name bsc#1104264 (Tomas Chvatal)
  - Use %license (boo#1082318) (Fabian Vogt)
- Test fixes (Andreas Schwab):
  - disable-tests-with-ptrace.patch: Remove, set XFAIL_TESTS instead
  - dwelf_elf_e_machine_string.patch: Avoid spurious failure</changelog>
  <changelog author="jeffm@suse.com" date="1657627200">- Added 4G memory build constraint for aarch64 to pass testing.</changelog>
</package>
<package pkgid="05d3ce96874564dcc13219ed2f9eb3afb6a667353850b2b81c91ccc439e15706" name="libebl-plugins" arch="x86_64">
  <version epoch="0" ver="0.177" rel="150300.11.3.1"/>
  <changelog author="normand@linux.vnet.ibm.com" date="1456574400">- rename dt-ppc-opt.patch as elfutils-0.164-dt-ppc-opt.patch
  and add reference to upstream commit id</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1460808000">-  add elfutils-0.164-gcc6.patch</changelog>
  <changelog author="fcrozat@suse.com" date="1467028800">- Update to version 0.166:
  + config: The default program prefix for the installed tools is now
  eu-. Use configure --program-prefix="" to not use a program
  prefix.
  + Various bugfixes.
- Drop elfutils-0.164-dt-ppc-opt.patch and
  elfutils-0.164-gcc6.patch (merged upstream)
- Add patch elfutils-0.166-elfcmp-comp-gcc6.patch: fix
  self-comparison error with GCC 6.
- Changes from 0.165:
  + Add eu-elfcompress
  + Add pkg-config files for libelf and libdw.</changelog>
  <changelog author="schwab@suse.de" date="1468238400">- disable-tests-with-ptrace.patch: disable tests that use ptrace when
  running under qemu-linux-user</changelog>
  <changelog author="matz@suse.com" date="1472558400">- Update to version 0.167:
  libasm: Add eBPF disassembler for EM_BPF files.
  backends: Add m68k and BPF backends.
  ld: Removed.
  dwelf: Add ELF/DWARF string table creation functions. dwelf_strtab_init,
    dwelf_strtab_add, dwelf_strtab_add_len, dwelf_strtab_finalize,
    dwelf_strent_off, dwelf_strent_str and dwelf_strtab_free.
  Support compressed sections from binutils 2.27.
- Remove patch elfutils-0.166-elfcmp-comp-gcc6.patch: included upstream.</changelog>
  <changelog author="mliska@suse.cz" date="1481284800">- Add 0001-Add-GCC7-Wimplicit-fallthrough-support-fixes.patch: fix
  new warning introduced in GCC 7.
- Add 0001-ar-Fix-GCC7-Wformat-length-issues.patch: fix -Wformat-length
  warning introduced in GCC 7.</changelog>
  <changelog author="rguenther@suse.com" date="1490875200">- Update to version 0.168:
  libelf: gelf_newehdr and gelf_newehdr now return void *.
  libdw: dwarf.h corrected the DW_LANG_PLI constant name (was DW_LANG_PL1).
  readelf: Add optional --symbols[=SECTION] argument to select section name.
- Includes changes from 0001-Add-GCC7-Wimplicit-fallthrough-support-fixes.patch
  and 0001-ar-Fix-GCC7-Wformat-length-issues.patch.
- Remove elfutils-0.137-dwarf-header-check-fix.diff which is no longer
  required after a debugedit fix.</changelog>
  <changelog author="bwiedemann@suse.com" date="1490961600">- make tests pass when user does not want debuginfo (boo#1031556)</changelog>
  <changelog author="jengelh@inai.de" date="1491566400">- Add missing ldconfig calls for libasm1</changelog>
  <changelog author="mliska@suse.cz" date="1493121600">- Add 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch:
  fix .gnu.attributes checking on ppc64{,le}.</changelog>
  <changelog author="mliska@suse.cz" date="1493294400">- Add 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch
  unconditionally in the spec file. As we can't support binary diff,
  a newly added test-case is removed from the patch.</changelog>
  <changelog author="jengelh@inai.de" date="1495972800">- Update Git-Clone URL</changelog>
  <changelog author="schwab@linux-m68k.org" date="1497787200">- ppc-machine-flags.patch: support EM_PPC machine flags
- disable-tests-with-ptrace.patch: disable more tests</changelog>
  <changelog author="jengelh@inai.de" date="1501588800">- Update package descriptions.
- Rename libebl1 to libebl-plugins as these are not linked,
  but dlopened using their unversioned libebl_$ARCH.so name.
- Have libelf1 require libebl-plugins (libebl.a, which does the
  dlopen call, is staticly built into libelf1). This is necessary
  for pahole to display its results. [boo#1049871]</changelog>
  <changelog author="jengelh@inai.de" date="1503748800">- Restore obsolete on libebl.</changelog>
  <changelog author="jmoreira@suse.com" date="1537876800">- CVE-2017-7613: elfutils: denial of service (memory consumption)
  via a crafted ELF file (bnc#1033090)
  Add patch:
  elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
- CVE-2017-7612: elfutils: denial of service (heap-based buffer
  over-read and application crash) via a crafted ELF file
  (bnc#1033089)
  Add patch: elfutils-dont-trust-sh_entsize.patch</changelog>
  <changelog author="jmoreira@suse.com" date="1558526400">- CVE-2018-16402: libelf: denial of service/double free on an
  attempt to decompress the same section twice (bnc#1107066)
  Add patch:
  libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
- CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the
  function arlib_add_symbols() used by eu-ranlib (bnc#1112723)
  Add patch:
  arlib-check-that-sh_entsize-isnt-zero.patch
- CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and
  application crash) via a crafted ELF file (bnc#1033088)
  Add patch:
  elflint-check-symbol-table-data-is-big-enough-before-check.patch
- CVE-2017-7610: elflint: heap-based buffer overflow in check_group
  (bnc#1033087)
  Add patch:
  elflint-dont-check-section-group-without-flags-word.patch
- CVE-2018-16403: heap buffer overflow in readelf (bnc#1107067)
  Add patch:
  libdw-check-end-of-attributes-list-consistently.patch
- CVE-2018-16062: heap-buffer-overflow in
  /elfutils/libdw/dwarf_getaranges.c:156 (bnc#1106390)
  Add patch:
  libdw-readelf-make-sure-there-is-enough-data-to-read.patch
- CVE-2018-18310: Invalid Address Read problem in
  dwfl_segment_report_module.c (bnc#1111973)
  Add patch:
  libdwfl-sanity-check-partial-core-file-data-reads.patch
- CVE-2019-7150: dwfl_segment_report_module doesn't check whether
  the dyn data read from core file is truncated (bnc#1123685)
  Add patch:
  libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
- CVE-2019-7665: NT_PLATFORM core file note should be a zero
  terminated string (CVE is a bit misleading, as this is not a bug
  in libelf as described) (bnc#1125007)
  Add patch:
  libebl-check-NT_PLATFORM-core-notes.patch
- CVE-2017-7609: memory allocation failure in __libelf_decompress
  (bnc#1033086)
  Add patch:
  libelf-check-compression-before-allocate-output-buffer.patch
- CVE-2018-16402: Double-free crash in nm and readelf (bnc#1107066)
  Add patch:
  libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
- CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi
  (readelf.c) (bnc#1033084)
  Add patch:
  readelf-fix-off-by-one-sanity-check.patch
- CVE-2018-18520: eu-size: Bad handling of ar files inside are
  files (bnc#1112726)
  Add patch:
  size-handle-recursive-elf-ar-files.patch
- CVE-2017-7608: heap-based buffer overflow in
  ebl_object_note_type_name (eblobjnotetypename.c) (bnc#1033085)
  Add patch:
  use-the-empty-string-for-note-names-with-zero-size.patch</changelog>
  <changelog author="schwab@suse.de" date="1573732800">- disable-tests-with-ptrace.patch: Remove, set XFAIL_TESTS instead
- dwelf_elf_e_machine_string.patch: Avoid spurious failure</changelog>
  <changelog author="jeffm@suse.com" date="1657108800">- Update to version 0.177 (Martin Li?ka):
    elfclassify: New tool to analyze ELF objects.
    readelf: Print DW_AT_data_member_location as decimal offset.
    Decode DW_AT_discr_list block attributes.
    libdw: Add DW_AT_GNU_numerator, DW_AT_GNU_denominator and DW_AT_GNU_bias.
    libdwelf: Add dwelf_elf_e_machine_string.
    dwelf_elf_begin now only returns NULL when there is an error
    reading or decompressing a file. If the file is not an ELF file
    an ELF handle of type ELF_K_NONE is returned.
    backends: Add support for C-SKY.
  - Update to version 0.176
    build: Add new --enable-install-elfh option.
    Do NOT use this for system installs (it overrides glibc elf.h).
    backends: riscv improved core file and return value location support.
    Fixes CVE-2019-7146, CVE-2019-7148, CVE-2019-7149, CVE-2019-7664
  - CVE-2019-7150: dwfl_segment_report_module doesn't check whether
    the dyn data read from core file is truncated (bnc#1123685)
  - CVE-2019-7665: NT_PLATFORM core file note should be a zero
    terminated string (CVE is a bit misleading, as this is not a bug
    in libelf as described) (bnc#1125007)
  - Removed patches:
  - libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
  - libebl-check-NT_PLATFORM-core-notes.patch
  - Update to version 0.175 (Martin Li?ka):
    readelf: Handle mutliple .debug_macro sections.
    Recognize and parse GNU Property, NT_VERSION and
    GNU Build Attribute ELF Notes.
    strip: Handle SHT_GROUP correctly.
    Add strip --reloc-debug-sections-only option.
    Handle relocations against GNU compressed sections.
    libdwelf: New function dwelf_elf_begin.
    libcpu: Recognize bpf jump variants BPF_JLT, BPF_JLE, BPF_JSLT
    and BPF_JSLE.
    backends: RISCV handles ADD/SUB relocations.
    Handle SHT_X86_64_UNWIND.
  - CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the
    function arlib_add_symbols() used by eu-ranlib (bnc#1112723)
  - CVE-2018-18310: Invalid Address Read problem in
    dwfl_segment_report_module.c (bnc#1111973)
  - CVE-2018-18520: eu-size: Bad handling of ar files inside are
    files (bnc#1112726)
  - Removed patches:
  - arlib-check-that-sh_entsize-isnt-zero.patch
  - libdwfl-sanity-check-partial-core-file-data-reads.patch
  - size-handle-recursive-elf-ar-files.patch
  - Update to version 0.174 (Martin Li?ka):
    libelf, libdw and all tools now handle extended shnum and
    shstrndx correctly.
    elfcompress: Don't rewrite input file if no section data needs
    updating. Try harder to keep same file mode bits
    (suid) on rewrite.
    strip: Handle mixed (out of order) allocated/non-allocated
    sections.
    unstrip: Handle SHT_GROUP sections.
    backends: RISCV and M68K now have backend implementations to
    generate CFI based backtraces.
  - CVE-2018-16402: libelf: denial of service/double free on an
    attempt to decompress the same section twice (bnc#1107066)
    Double-free crash in nm and readelf
  - CVE-2018-16403: heap buffer overflow in readelf (bnc#1107067)
  - CVE-2018-16062: heap-buffer-overflow in
    /elfutils/libdw/dwarf_getaranges.c:156 (bnc#1106390)
    Removed patches:
    libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
    libdw-check-end-of-attributes-list-consistently.patch
    libdw-readelf-make-sure-there-is-enough-data-to-read.patch
  - Update to version 0.173 (Martin Li?ka):
    More fixes for crashes and hangs found by afl-fuzz. In particular various
    functions now detect and break infinite loops caused by bad DIE tree cycles.
    readelf: Will now lookup the size and signedness of constant value types
    to display them correctly (and not just how they were encoded).
    libdw: New function dwarf_next_lines to read CU-less .debug_line data.
    dwarf_begin_elf now accepts ELF files containing just .debug_line
    or .debug_frame sections (which can be read without needing a DIE
    tree from the .debug_info section).
    Removed dwarf_getscn_info, which was never implemented.
    backends: Handle BPF simple relocations.
    The RISCV backends now handles ABI specific CFI and knows about
    RISCV register types and names.
  - Update to version 0.172 (Martin Li?ka):
    No functional changes compared to 0.171.
    Various bug fixes in libdw and eu-readelf dealing with bad DWARF5 data.
    Thanks to running the afl fuzzer on eu-readelf and various testcases.
  - Update to version 0.171 (Martin Li?ka):
    DWARF5 and split dwarf, including GNU DebugFission, are supported now.
    Data can be read from the new DWARF sections .debug_addr, .debug_line_str,
    .debug_loclists, .debug_str_offsets and .debug_rnglists.  Plus the new
    DWARF5 and GNU DebugFission encodings of the existing .debug sections.
    Also in split DWARF .dwo (DWARF object) files.  This support is mostly
    handled by existing functions (dwarf_getlocation*, dwarf_getsrclines,
    dwarf_ranges, dwarf_form*, etc.) now returning the data from the new
    sections and data formats.  But some new functions have been added
    to more easily get information about skeleton and split compile units
    (dwarf_get_units and dwarf_cu_info), handle new attribute data
    (dwarf_getabbrevattr_data) and to keep references to Dwarf_Dies
    that might come from different sections or files (dwarf_die_addr_die).
    Not yet supported are .dwp (Dwarf Package) and .sup (Dwarf Supplementary)
    files, the .debug_names index, the .debug_cu_index and .debug_tu_index
    sections. Only a single .debug_info (and .debug_types) section are
    currently handled.
    readelf: Handle all new DWARF5 sections.
  - -debug-dump=info+ will show split unit DIEs when found.
  - -dwarf-skeleton can be used when inspecting a .dwo file.
    Recognizes GNU locviews with --debug-dump=loc.
    libdw: New functions dwarf_die_addr_die, dwarf_get_units,
    dwarf_getabbrevattr_data and dwarf_cu_info.
    libdw will now try to resolve the alt file on first use of
    an alt attribute FORM when not set yet with dwarf_set_alt.
    dwarf_aggregate_size() now works with multi-dimensional arrays.
    libdwfl: Use process_vm_readv when available instead of ptrace.
    backends: Add a RISC-V backend.
    There were various improvements to build on Windows.
    The sha1 and md5 implementations have been removed, they weren't used.
  - Update to version 0.170 (Martin Li?ka):
    libdw: Added new DWARF5 attribute, tag, character encoding, language code,
    calling convention, defaulted member function and macro constants
    to dwarf.h.
  New functions dwarf_default_lower_bound and dwarf_line_file.
  dwarf_peel_type now handles DWARF5 immutable, packed and shared tags.
  dwarf_getmacros now handles DWARF5 .debug_macro sections.
    strip: Add -R, --remove-section=SECTION and --keep-section=SECTION.
    backends: The bpf disassembler is now always build on all platforms.
  - Includes changes in 0.169
    backends: Add support for EM_PPC64 GNU_ATTRIBUTES.
    Frame pointer unwinding fallback support for i386, x86_64, aarch64.
    translations: Update Polish translation.
  - CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and
    application crash) via a crafted ELF file (bnc#1033088)
  - CVE-2017-7610: elflint: heap-based buffer overflow in check_group
    (bnc#1033087)
  - CVE-2017-7609: memory allocation failure in __libelf_decompress
    (bnc#1033086)
  - CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi
    (readelf.c) (bnc#1033084)
  - CVE-2017-7608: heap-based buffer overflow in
    ebl_object_note_type_name (eblobjnotetypename.c) (bnc#1033085)
  - CVE-2017-7613: elfutils: denial of service (memory consumption)
    via a crafted ELF file (bnc#1033090)
  - CVE-2017-7612: elfutils: denial of service (heap-based buffer
    over-read and application crash) via a crafted ELF file (bnc#1033089)
  - Removed patches:
  - obsolete 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch
  - ppc-machine-flags.patch
  - elflint-check-symbol-table-data-is-big-enough-before-check.patch
  - elflint-dont-check-section-group-without-flags-word.patch
  - libelf-check-compression-before-allocate-output-buffer.patch
  - readelf-fix-off-by-one-sanity-check.patch
  - use-the-empty-string-for-note-names-with-zero-size.patch
  - elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
  - elfutils-dont-trust-sh_entsize.patch
- Packaging cleanups:
  - Modernize specfile and metadata. (Jan Engelhardt)
  - Use %make_build (Martin Li?ka)
  - Update License tag to GPL-3.0-or-later, as requested by legal
    review. (Dominique Leuenberger)
  - Don't make elfutils recommend elfutils-lang as elfutils-lang
    already supplements elfutils. (Antoine Belvire)
  - Fix typo in the recommends name bsc#1104264 (Tomas Chvatal)
  - Use %license (boo#1082318) (Fabian Vogt)
- Test fixes (Andreas Schwab):
  - disable-tests-with-ptrace.patch: Remove, set XFAIL_TESTS instead
  - dwelf_elf_e_machine_string.patch: Avoid spurious failure</changelog>
  <changelog author="jeffm@suse.com" date="1657627200">- Added 4G memory build constraint for aarch64 to pass testing.</changelog>
</package>
<package pkgid="da92b5255d5807d4d25ebfbdc2123cdf568a53cf4bd7711a7643c95d81f6a0c3" name="libelf1" arch="aarch64">
  <version epoch="0" ver="0.177" rel="150300.11.3.1"/>
  <changelog author="normand@linux.vnet.ibm.com" date="1456574400">- rename dt-ppc-opt.patch as elfutils-0.164-dt-ppc-opt.patch
  and add reference to upstream commit id</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1460808000">-  add elfutils-0.164-gcc6.patch</changelog>
  <changelog author="fcrozat@suse.com" date="1467028800">- Update to version 0.166:
  + config: The default program prefix for the installed tools is now
  eu-. Use configure --program-prefix="" to not use a program
  prefix.
  + Various bugfixes.
- Drop elfutils-0.164-dt-ppc-opt.patch and
  elfutils-0.164-gcc6.patch (merged upstream)
- Add patch elfutils-0.166-elfcmp-comp-gcc6.patch: fix
  self-comparison error with GCC 6.
- Changes from 0.165:
  + Add eu-elfcompress
  + Add pkg-config files for libelf and libdw.</changelog>
  <changelog author="schwab@suse.de" date="1468238400">- disable-tests-with-ptrace.patch: disable tests that use ptrace when
  running under qemu-linux-user</changelog>
  <changelog author="matz@suse.com" date="1472558400">- Update to version 0.167:
  libasm: Add eBPF disassembler for EM_BPF files.
  backends: Add m68k and BPF backends.
  ld: Removed.
  dwelf: Add ELF/DWARF string table creation functions. dwelf_strtab_init,
    dwelf_strtab_add, dwelf_strtab_add_len, dwelf_strtab_finalize,
    dwelf_strent_off, dwelf_strent_str and dwelf_strtab_free.
  Support compressed sections from binutils 2.27.
- Remove patch elfutils-0.166-elfcmp-comp-gcc6.patch: included upstream.</changelog>
  <changelog author="mliska@suse.cz" date="1481284800">- Add 0001-Add-GCC7-Wimplicit-fallthrough-support-fixes.patch: fix
  new warning introduced in GCC 7.
- Add 0001-ar-Fix-GCC7-Wformat-length-issues.patch: fix -Wformat-length
  warning introduced in GCC 7.</changelog>
  <changelog author="rguenther@suse.com" date="1490875200">- Update to version 0.168:
  libelf: gelf_newehdr and gelf_newehdr now return void *.
  libdw: dwarf.h corrected the DW_LANG_PLI constant name (was DW_LANG_PL1).
  readelf: Add optional --symbols[=SECTION] argument to select section name.
- Includes changes from 0001-Add-GCC7-Wimplicit-fallthrough-support-fixes.patch
  and 0001-ar-Fix-GCC7-Wformat-length-issues.patch.
- Remove elfutils-0.137-dwarf-header-check-fix.diff which is no longer
  required after a debugedit fix.</changelog>
  <changelog author="bwiedemann@suse.com" date="1490961600">- make tests pass when user does not want debuginfo (boo#1031556)</changelog>
  <changelog author="jengelh@inai.de" date="1491566400">- Add missing ldconfig calls for libasm1</changelog>
  <changelog author="mliska@suse.cz" date="1493121600">- Add 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch:
  fix .gnu.attributes checking on ppc64{,le}.</changelog>
  <changelog author="mliska@suse.cz" date="1493294400">- Add 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch
  unconditionally in the spec file. As we can't support binary diff,
  a newly added test-case is removed from the patch.</changelog>
  <changelog author="jengelh@inai.de" date="1495972800">- Update Git-Clone URL</changelog>
  <changelog author="schwab@linux-m68k.org" date="1497787200">- ppc-machine-flags.patch: support EM_PPC machine flags
- disable-tests-with-ptrace.patch: disable more tests</changelog>
  <changelog author="jengelh@inai.de" date="1501588800">- Update package descriptions.
- Rename libebl1 to libebl-plugins as these are not linked,
  but dlopened using their unversioned libebl_$ARCH.so name.
- Have libelf1 require libebl-plugins (libebl.a, which does the
  dlopen call, is staticly built into libelf1). This is necessary
  for pahole to display its results. [boo#1049871]</changelog>
  <changelog author="jengelh@inai.de" date="1503748800">- Restore obsolete on libebl.</changelog>
  <changelog author="jmoreira@suse.com" date="1537876800">- CVE-2017-7613: elfutils: denial of service (memory consumption)
  via a crafted ELF file (bnc#1033090)
  Add patch:
  elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
- CVE-2017-7612: elfutils: denial of service (heap-based buffer
  over-read and application crash) via a crafted ELF file
  (bnc#1033089)
  Add patch: elfutils-dont-trust-sh_entsize.patch</changelog>
  <changelog author="jmoreira@suse.com" date="1558526400">- CVE-2018-16402: libelf: denial of service/double free on an
  attempt to decompress the same section twice (bnc#1107066)
  Add patch:
  libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
- CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the
  function arlib_add_symbols() used by eu-ranlib (bnc#1112723)
  Add patch:
  arlib-check-that-sh_entsize-isnt-zero.patch
- CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and
  application crash) via a crafted ELF file (bnc#1033088)
  Add patch:
  elflint-check-symbol-table-data-is-big-enough-before-check.patch
- CVE-2017-7610: elflint: heap-based buffer overflow in check_group
  (bnc#1033087)
  Add patch:
  elflint-dont-check-section-group-without-flags-word.patch
- CVE-2018-16403: heap buffer overflow in readelf (bnc#1107067)
  Add patch:
  libdw-check-end-of-attributes-list-consistently.patch
- CVE-2018-16062: heap-buffer-overflow in
  /elfutils/libdw/dwarf_getaranges.c:156 (bnc#1106390)
  Add patch:
  libdw-readelf-make-sure-there-is-enough-data-to-read.patch
- CVE-2018-18310: Invalid Address Read problem in
  dwfl_segment_report_module.c (bnc#1111973)
  Add patch:
  libdwfl-sanity-check-partial-core-file-data-reads.patch
- CVE-2019-7150: dwfl_segment_report_module doesn't check whether
  the dyn data read from core file is truncated (bnc#1123685)
  Add patch:
  libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
- CVE-2019-7665: NT_PLATFORM core file note should be a zero
  terminated string (CVE is a bit misleading, as this is not a bug
  in libelf as described) (bnc#1125007)
  Add patch:
  libebl-check-NT_PLATFORM-core-notes.patch
- CVE-2017-7609: memory allocation failure in __libelf_decompress
  (bnc#1033086)
  Add patch:
  libelf-check-compression-before-allocate-output-buffer.patch
- CVE-2018-16402: Double-free crash in nm and readelf (bnc#1107066)
  Add patch:
  libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
- CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi
  (readelf.c) (bnc#1033084)
  Add patch:
  readelf-fix-off-by-one-sanity-check.patch
- CVE-2018-18520: eu-size: Bad handling of ar files inside are
  files (bnc#1112726)
  Add patch:
  size-handle-recursive-elf-ar-files.patch
- CVE-2017-7608: heap-based buffer overflow in
  ebl_object_note_type_name (eblobjnotetypename.c) (bnc#1033085)
  Add patch:
  use-the-empty-string-for-note-names-with-zero-size.patch</changelog>
  <changelog author="schwab@suse.de" date="1573732800">- disable-tests-with-ptrace.patch: Remove, set XFAIL_TESTS instead
- dwelf_elf_e_machine_string.patch: Avoid spurious failure</changelog>
  <changelog author="jeffm@suse.com" date="1657108800">- Update to version 0.177 (Martin Li?ka):
    elfclassify: New tool to analyze ELF objects.
    readelf: Print DW_AT_data_member_location as decimal offset.
    Decode DW_AT_discr_list block attributes.
    libdw: Add DW_AT_GNU_numerator, DW_AT_GNU_denominator and DW_AT_GNU_bias.
    libdwelf: Add dwelf_elf_e_machine_string.
    dwelf_elf_begin now only returns NULL when there is an error
    reading or decompressing a file. If the file is not an ELF file
    an ELF handle of type ELF_K_NONE is returned.
    backends: Add support for C-SKY.
  - Update to version 0.176
    build: Add new --enable-install-elfh option.
    Do NOT use this for system installs (it overrides glibc elf.h).
    backends: riscv improved core file and return value location support.
    Fixes CVE-2019-7146, CVE-2019-7148, CVE-2019-7149, CVE-2019-7664
  - CVE-2019-7150: dwfl_segment_report_module doesn't check whether
    the dyn data read from core file is truncated (bnc#1123685)
  - CVE-2019-7665: NT_PLATFORM core file note should be a zero
    terminated string (CVE is a bit misleading, as this is not a bug
    in libelf as described) (bnc#1125007)
  - Removed patches:
  - libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
  - libebl-check-NT_PLATFORM-core-notes.patch
  - Update to version 0.175 (Martin Li?ka):
    readelf: Handle mutliple .debug_macro sections.
    Recognize and parse GNU Property, NT_VERSION and
    GNU Build Attribute ELF Notes.
    strip: Handle SHT_GROUP correctly.
    Add strip --reloc-debug-sections-only option.
    Handle relocations against GNU compressed sections.
    libdwelf: New function dwelf_elf_begin.
    libcpu: Recognize bpf jump variants BPF_JLT, BPF_JLE, BPF_JSLT
    and BPF_JSLE.
    backends: RISCV handles ADD/SUB relocations.
    Handle SHT_X86_64_UNWIND.
  - CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the
    function arlib_add_symbols() used by eu-ranlib (bnc#1112723)
  - CVE-2018-18310: Invalid Address Read problem in
    dwfl_segment_report_module.c (bnc#1111973)
  - CVE-2018-18520: eu-size: Bad handling of ar files inside are
    files (bnc#1112726)
  - Removed patches:
  - arlib-check-that-sh_entsize-isnt-zero.patch
  - libdwfl-sanity-check-partial-core-file-data-reads.patch
  - size-handle-recursive-elf-ar-files.patch
  - Update to version 0.174 (Martin Li?ka):
    libelf, libdw and all tools now handle extended shnum and
    shstrndx correctly.
    elfcompress: Don't rewrite input file if no section data needs
    updating. Try harder to keep same file mode bits
    (suid) on rewrite.
    strip: Handle mixed (out of order) allocated/non-allocated
    sections.
    unstrip: Handle SHT_GROUP sections.
    backends: RISCV and M68K now have backend implementations to
    generate CFI based backtraces.
  - CVE-2018-16402: libelf: denial of service/double free on an
    attempt to decompress the same section twice (bnc#1107066)
    Double-free crash in nm and readelf
  - CVE-2018-16403: heap buffer overflow in readelf (bnc#1107067)
  - CVE-2018-16062: heap-buffer-overflow in
    /elfutils/libdw/dwarf_getaranges.c:156 (bnc#1106390)
    Removed patches:
    libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
    libdw-check-end-of-attributes-list-consistently.patch
    libdw-readelf-make-sure-there-is-enough-data-to-read.patch
  - Update to version 0.173 (Martin Li?ka):
    More fixes for crashes and hangs found by afl-fuzz. In particular various
    functions now detect and break infinite loops caused by bad DIE tree cycles.
    readelf: Will now lookup the size and signedness of constant value types
    to display them correctly (and not just how they were encoded).
    libdw: New function dwarf_next_lines to read CU-less .debug_line data.
    dwarf_begin_elf now accepts ELF files containing just .debug_line
    or .debug_frame sections (which can be read without needing a DIE
    tree from the .debug_info section).
    Removed dwarf_getscn_info, which was never implemented.
    backends: Handle BPF simple relocations.
    The RISCV backends now handles ABI specific CFI and knows about
    RISCV register types and names.
  - Update to version 0.172 (Martin Li?ka):
    No functional changes compared to 0.171.
    Various bug fixes in libdw and eu-readelf dealing with bad DWARF5 data.
    Thanks to running the afl fuzzer on eu-readelf and various testcases.
  - Update to version 0.171 (Martin Li?ka):
    DWARF5 and split dwarf, including GNU DebugFission, are supported now.
    Data can be read from the new DWARF sections .debug_addr, .debug_line_str,
    .debug_loclists, .debug_str_offsets and .debug_rnglists.  Plus the new
    DWARF5 and GNU DebugFission encodings of the existing .debug sections.
    Also in split DWARF .dwo (DWARF object) files.  This support is mostly
    handled by existing functions (dwarf_getlocation*, dwarf_getsrclines,
    dwarf_ranges, dwarf_form*, etc.) now returning the data from the new
    sections and data formats.  But some new functions have been added
    to more easily get information about skeleton and split compile units
    (dwarf_get_units and dwarf_cu_info), handle new attribute data
    (dwarf_getabbrevattr_data) and to keep references to Dwarf_Dies
    that might come from different sections or files (dwarf_die_addr_die).
    Not yet supported are .dwp (Dwarf Package) and .sup (Dwarf Supplementary)
    files, the .debug_names index, the .debug_cu_index and .debug_tu_index
    sections. Only a single .debug_info (and .debug_types) section are
    currently handled.
    readelf: Handle all new DWARF5 sections.
  - -debug-dump=info+ will show split unit DIEs when found.
  - -dwarf-skeleton can be used when inspecting a .dwo file.
    Recognizes GNU locviews with --debug-dump=loc.
    libdw: New functions dwarf_die_addr_die, dwarf_get_units,
    dwarf_getabbrevattr_data and dwarf_cu_info.
    libdw will now try to resolve the alt file on first use of
    an alt attribute FORM when not set yet with dwarf_set_alt.
    dwarf_aggregate_size() now works with multi-dimensional arrays.
    libdwfl: Use process_vm_readv when available instead of ptrace.
    backends: Add a RISC-V backend.
    There were various improvements to build on Windows.
    The sha1 and md5 implementations have been removed, they weren't used.
  - Update to version 0.170 (Martin Li?ka):
    libdw: Added new DWARF5 attribute, tag, character encoding, language code,
    calling convention, defaulted member function and macro constants
    to dwarf.h.
  New functions dwarf_default_lower_bound and dwarf_line_file.
  dwarf_peel_type now handles DWARF5 immutable, packed and shared tags.
  dwarf_getmacros now handles DWARF5 .debug_macro sections.
    strip: Add -R, --remove-section=SECTION and --keep-section=SECTION.
    backends: The bpf disassembler is now always build on all platforms.
  - Includes changes in 0.169
    backends: Add support for EM_PPC64 GNU_ATTRIBUTES.
    Frame pointer unwinding fallback support for i386, x86_64, aarch64.
    translations: Update Polish translation.
  - CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and
    application crash) via a crafted ELF file (bnc#1033088)
  - CVE-2017-7610: elflint: heap-based buffer overflow in check_group
    (bnc#1033087)
  - CVE-2017-7609: memory allocation failure in __libelf_decompress
    (bnc#1033086)
  - CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi
    (readelf.c) (bnc#1033084)
  - CVE-2017-7608: heap-based buffer overflow in
    ebl_object_note_type_name (eblobjnotetypename.c) (bnc#1033085)
  - CVE-2017-7613: elfutils: denial of service (memory consumption)
    via a crafted ELF file (bnc#1033090)
  - CVE-2017-7612: elfutils: denial of service (heap-based buffer
    over-read and application crash) via a crafted ELF file (bnc#1033089)
  - Removed patches:
  - obsolete 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch
  - ppc-machine-flags.patch
  - elflint-check-symbol-table-data-is-big-enough-before-check.patch
  - elflint-dont-check-section-group-without-flags-word.patch
  - libelf-check-compression-before-allocate-output-buffer.patch
  - readelf-fix-off-by-one-sanity-check.patch
  - use-the-empty-string-for-note-names-with-zero-size.patch
  - elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
  - elfutils-dont-trust-sh_entsize.patch
- Packaging cleanups:
  - Modernize specfile and metadata. (Jan Engelhardt)
  - Use %make_build (Martin Li?ka)
  - Update License tag to GPL-3.0-or-later, as requested by legal
    review. (Dominique Leuenberger)
  - Don't make elfutils recommend elfutils-lang as elfutils-lang
    already supplements elfutils. (Antoine Belvire)
  - Fix typo in the recommends name bsc#1104264 (Tomas Chvatal)
  - Use %license (boo#1082318) (Fabian Vogt)
- Test fixes (Andreas Schwab):
  - disable-tests-with-ptrace.patch: Remove, set XFAIL_TESTS instead
  - dwelf_elf_e_machine_string.patch: Avoid spurious failure</changelog>
  <changelog author="jeffm@suse.com" date="1657627200">- Added 4G memory build constraint for aarch64 to pass testing.</changelog>
</package>
<package pkgid="57f6ad4a050e3c95f9f1cf29dcacff1cde237fe6aff5292433483425394bfd0f" name="libelf1" arch="x86_64">
  <version epoch="0" ver="0.177" rel="150300.11.3.1"/>
  <changelog author="normand@linux.vnet.ibm.com" date="1456574400">- rename dt-ppc-opt.patch as elfutils-0.164-dt-ppc-opt.patch
  and add reference to upstream commit id</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1460808000">-  add elfutils-0.164-gcc6.patch</changelog>
  <changelog author="fcrozat@suse.com" date="1467028800">- Update to version 0.166:
  + config: The default program prefix for the installed tools is now
  eu-. Use configure --program-prefix="" to not use a program
  prefix.
  + Various bugfixes.
- Drop elfutils-0.164-dt-ppc-opt.patch and
  elfutils-0.164-gcc6.patch (merged upstream)
- Add patch elfutils-0.166-elfcmp-comp-gcc6.patch: fix
  self-comparison error with GCC 6.
- Changes from 0.165:
  + Add eu-elfcompress
  + Add pkg-config files for libelf and libdw.</changelog>
  <changelog author="schwab@suse.de" date="1468238400">- disable-tests-with-ptrace.patch: disable tests that use ptrace when
  running under qemu-linux-user</changelog>
  <changelog author="matz@suse.com" date="1472558400">- Update to version 0.167:
  libasm: Add eBPF disassembler for EM_BPF files.
  backends: Add m68k and BPF backends.
  ld: Removed.
  dwelf: Add ELF/DWARF string table creation functions. dwelf_strtab_init,
    dwelf_strtab_add, dwelf_strtab_add_len, dwelf_strtab_finalize,
    dwelf_strent_off, dwelf_strent_str and dwelf_strtab_free.
  Support compressed sections from binutils 2.27.
- Remove patch elfutils-0.166-elfcmp-comp-gcc6.patch: included upstream.</changelog>
  <changelog author="mliska@suse.cz" date="1481284800">- Add 0001-Add-GCC7-Wimplicit-fallthrough-support-fixes.patch: fix
  new warning introduced in GCC 7.
- Add 0001-ar-Fix-GCC7-Wformat-length-issues.patch: fix -Wformat-length
  warning introduced in GCC 7.</changelog>
  <changelog author="rguenther@suse.com" date="1490875200">- Update to version 0.168:
  libelf: gelf_newehdr and gelf_newehdr now return void *.
  libdw: dwarf.h corrected the DW_LANG_PLI constant name (was DW_LANG_PL1).
  readelf: Add optional --symbols[=SECTION] argument to select section name.
- Includes changes from 0001-Add-GCC7-Wimplicit-fallthrough-support-fixes.patch
  and 0001-ar-Fix-GCC7-Wformat-length-issues.patch.
- Remove elfutils-0.137-dwarf-header-check-fix.diff which is no longer
  required after a debugedit fix.</changelog>
  <changelog author="bwiedemann@suse.com" date="1490961600">- make tests pass when user does not want debuginfo (boo#1031556)</changelog>
  <changelog author="jengelh@inai.de" date="1491566400">- Add missing ldconfig calls for libasm1</changelog>
  <changelog author="mliska@suse.cz" date="1493121600">- Add 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch:
  fix .gnu.attributes checking on ppc64{,le}.</changelog>
  <changelog author="mliska@suse.cz" date="1493294400">- Add 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch
  unconditionally in the spec file. As we can't support binary diff,
  a newly added test-case is removed from the patch.</changelog>
  <changelog author="jengelh@inai.de" date="1495972800">- Update Git-Clone URL</changelog>
  <changelog author="schwab@linux-m68k.org" date="1497787200">- ppc-machine-flags.patch: support EM_PPC machine flags
- disable-tests-with-ptrace.patch: disable more tests</changelog>
  <changelog author="jengelh@inai.de" date="1501588800">- Update package descriptions.
- Rename libebl1 to libebl-plugins as these are not linked,
  but dlopened using their unversioned libebl_$ARCH.so name.
- Have libelf1 require libebl-plugins (libebl.a, which does the
  dlopen call, is staticly built into libelf1). This is necessary
  for pahole to display its results. [boo#1049871]</changelog>
  <changelog author="jengelh@inai.de" date="1503748800">- Restore obsolete on libebl.</changelog>
  <changelog author="jmoreira@suse.com" date="1537876800">- CVE-2017-7613: elfutils: denial of service (memory consumption)
  via a crafted ELF file (bnc#1033090)
  Add patch:
  elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
- CVE-2017-7612: elfutils: denial of service (heap-based buffer
  over-read and application crash) via a crafted ELF file
  (bnc#1033089)
  Add patch: elfutils-dont-trust-sh_entsize.patch</changelog>
  <changelog author="jmoreira@suse.com" date="1558526400">- CVE-2018-16402: libelf: denial of service/double free on an
  attempt to decompress the same section twice (bnc#1107066)
  Add patch:
  libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
- CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the
  function arlib_add_symbols() used by eu-ranlib (bnc#1112723)
  Add patch:
  arlib-check-that-sh_entsize-isnt-zero.patch
- CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and
  application crash) via a crafted ELF file (bnc#1033088)
  Add patch:
  elflint-check-symbol-table-data-is-big-enough-before-check.patch
- CVE-2017-7610: elflint: heap-based buffer overflow in check_group
  (bnc#1033087)
  Add patch:
  elflint-dont-check-section-group-without-flags-word.patch
- CVE-2018-16403: heap buffer overflow in readelf (bnc#1107067)
  Add patch:
  libdw-check-end-of-attributes-list-consistently.patch
- CVE-2018-16062: heap-buffer-overflow in
  /elfutils/libdw/dwarf_getaranges.c:156 (bnc#1106390)
  Add patch:
  libdw-readelf-make-sure-there-is-enough-data-to-read.patch
- CVE-2018-18310: Invalid Address Read problem in
  dwfl_segment_report_module.c (bnc#1111973)
  Add patch:
  libdwfl-sanity-check-partial-core-file-data-reads.patch
- CVE-2019-7150: dwfl_segment_report_module doesn't check whether
  the dyn data read from core file is truncated (bnc#1123685)
  Add patch:
  libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
- CVE-2019-7665: NT_PLATFORM core file note should be a zero
  terminated string (CVE is a bit misleading, as this is not a bug
  in libelf as described) (bnc#1125007)
  Add patch:
  libebl-check-NT_PLATFORM-core-notes.patch
- CVE-2017-7609: memory allocation failure in __libelf_decompress
  (bnc#1033086)
  Add patch:
  libelf-check-compression-before-allocate-output-buffer.patch
- CVE-2018-16402: Double-free crash in nm and readelf (bnc#1107066)
  Add patch:
  libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
- CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi
  (readelf.c) (bnc#1033084)
  Add patch:
  readelf-fix-off-by-one-sanity-check.patch
- CVE-2018-18520: eu-size: Bad handling of ar files inside are
  files (bnc#1112726)
  Add patch:
  size-handle-recursive-elf-ar-files.patch
- CVE-2017-7608: heap-based buffer overflow in
  ebl_object_note_type_name (eblobjnotetypename.c) (bnc#1033085)
  Add patch:
  use-the-empty-string-for-note-names-with-zero-size.patch</changelog>
  <changelog author="schwab@suse.de" date="1573732800">- disable-tests-with-ptrace.patch: Remove, set XFAIL_TESTS instead
- dwelf_elf_e_machine_string.patch: Avoid spurious failure</changelog>
  <changelog author="jeffm@suse.com" date="1657108800">- Update to version 0.177 (Martin Li?ka):
    elfclassify: New tool to analyze ELF objects.
    readelf: Print DW_AT_data_member_location as decimal offset.
    Decode DW_AT_discr_list block attributes.
    libdw: Add DW_AT_GNU_numerator, DW_AT_GNU_denominator and DW_AT_GNU_bias.
    libdwelf: Add dwelf_elf_e_machine_string.
    dwelf_elf_begin now only returns NULL when there is an error
    reading or decompressing a file. If the file is not an ELF file
    an ELF handle of type ELF_K_NONE is returned.
    backends: Add support for C-SKY.
  - Update to version 0.176
    build: Add new --enable-install-elfh option.
    Do NOT use this for system installs (it overrides glibc elf.h).
    backends: riscv improved core file and return value location support.
    Fixes CVE-2019-7146, CVE-2019-7148, CVE-2019-7149, CVE-2019-7664
  - CVE-2019-7150: dwfl_segment_report_module doesn't check whether
    the dyn data read from core file is truncated (bnc#1123685)
  - CVE-2019-7665: NT_PLATFORM core file note should be a zero
    terminated string (CVE is a bit misleading, as this is not a bug
    in libelf as described) (bnc#1125007)
  - Removed patches:
  - libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
  - libebl-check-NT_PLATFORM-core-notes.patch
  - Update to version 0.175 (Martin Li?ka):
    readelf: Handle mutliple .debug_macro sections.
    Recognize and parse GNU Property, NT_VERSION and
    GNU Build Attribute ELF Notes.
    strip: Handle SHT_GROUP correctly.
    Add strip --reloc-debug-sections-only option.
    Handle relocations against GNU compressed sections.
    libdwelf: New function dwelf_elf_begin.
    libcpu: Recognize bpf jump variants BPF_JLT, BPF_JLE, BPF_JSLT
    and BPF_JSLE.
    backends: RISCV handles ADD/SUB relocations.
    Handle SHT_X86_64_UNWIND.
  - CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the
    function arlib_add_symbols() used by eu-ranlib (bnc#1112723)
  - CVE-2018-18310: Invalid Address Read problem in
    dwfl_segment_report_module.c (bnc#1111973)
  - CVE-2018-18520: eu-size: Bad handling of ar files inside are
    files (bnc#1112726)
  - Removed patches:
  - arlib-check-that-sh_entsize-isnt-zero.patch
  - libdwfl-sanity-check-partial-core-file-data-reads.patch
  - size-handle-recursive-elf-ar-files.patch
  - Update to version 0.174 (Martin Li?ka):
    libelf, libdw and all tools now handle extended shnum and
    shstrndx correctly.
    elfcompress: Don't rewrite input file if no section data needs
    updating. Try harder to keep same file mode bits
    (suid) on rewrite.
    strip: Handle mixed (out of order) allocated/non-allocated
    sections.
    unstrip: Handle SHT_GROUP sections.
    backends: RISCV and M68K now have backend implementations to
    generate CFI based backtraces.
  - CVE-2018-16402: libelf: denial of service/double free on an
    attempt to decompress the same section twice (bnc#1107066)
    Double-free crash in nm and readelf
  - CVE-2018-16403: heap buffer overflow in readelf (bnc#1107067)
  - CVE-2018-16062: heap-buffer-overflow in
    /elfutils/libdw/dwarf_getaranges.c:156 (bnc#1106390)
    Removed patches:
    libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
    libdw-check-end-of-attributes-list-consistently.patch
    libdw-readelf-make-sure-there-is-enough-data-to-read.patch
  - Update to version 0.173 (Martin Li?ka):
    More fixes for crashes and hangs found by afl-fuzz. In particular various
    functions now detect and break infinite loops caused by bad DIE tree cycles.
    readelf: Will now lookup the size and signedness of constant value types
    to display them correctly (and not just how they were encoded).
    libdw: New function dwarf_next_lines to read CU-less .debug_line data.
    dwarf_begin_elf now accepts ELF files containing just .debug_line
    or .debug_frame sections (which can be read without needing a DIE
    tree from the .debug_info section).
    Removed dwarf_getscn_info, which was never implemented.
    backends: Handle BPF simple relocations.
    The RISCV backends now handles ABI specific CFI and knows about
    RISCV register types and names.
  - Update to version 0.172 (Martin Li?ka):
    No functional changes compared to 0.171.
    Various bug fixes in libdw and eu-readelf dealing with bad DWARF5 data.
    Thanks to running the afl fuzzer on eu-readelf and various testcases.
  - Update to version 0.171 (Martin Li?ka):
    DWARF5 and split dwarf, including GNU DebugFission, are supported now.
    Data can be read from the new DWARF sections .debug_addr, .debug_line_str,
    .debug_loclists, .debug_str_offsets and .debug_rnglists.  Plus the new
    DWARF5 and GNU DebugFission encodings of the existing .debug sections.
    Also in split DWARF .dwo (DWARF object) files.  This support is mostly
    handled by existing functions (dwarf_getlocation*, dwarf_getsrclines,
    dwarf_ranges, dwarf_form*, etc.) now returning the data from the new
    sections and data formats.  But some new functions have been added
    to more easily get information about skeleton and split compile units
    (dwarf_get_units and dwarf_cu_info), handle new attribute data
    (dwarf_getabbrevattr_data) and to keep references to Dwarf_Dies
    that might come from different sections or files (dwarf_die_addr_die).
    Not yet supported are .dwp (Dwarf Package) and .sup (Dwarf Supplementary)
    files, the .debug_names index, the .debug_cu_index and .debug_tu_index
    sections. Only a single .debug_info (and .debug_types) section are
    currently handled.
    readelf: Handle all new DWARF5 sections.
  - -debug-dump=info+ will show split unit DIEs when found.
  - -dwarf-skeleton can be used when inspecting a .dwo file.
    Recognizes GNU locviews with --debug-dump=loc.
    libdw: New functions dwarf_die_addr_die, dwarf_get_units,
    dwarf_getabbrevattr_data and dwarf_cu_info.
    libdw will now try to resolve the alt file on first use of
    an alt attribute FORM when not set yet with dwarf_set_alt.
    dwarf_aggregate_size() now works with multi-dimensional arrays.
    libdwfl: Use process_vm_readv when available instead of ptrace.
    backends: Add a RISC-V backend.
    There were various improvements to build on Windows.
    The sha1 and md5 implementations have been removed, they weren't used.
  - Update to version 0.170 (Martin Li?ka):
    libdw: Added new DWARF5 attribute, tag, character encoding, language code,
    calling convention, defaulted member function and macro constants
    to dwarf.h.
  New functions dwarf_default_lower_bound and dwarf_line_file.
  dwarf_peel_type now handles DWARF5 immutable, packed and shared tags.
  dwarf_getmacros now handles DWARF5 .debug_macro sections.
    strip: Add -R, --remove-section=SECTION and --keep-section=SECTION.
    backends: The bpf disassembler is now always build on all platforms.
  - Includes changes in 0.169
    backends: Add support for EM_PPC64 GNU_ATTRIBUTES.
    Frame pointer unwinding fallback support for i386, x86_64, aarch64.
    translations: Update Polish translation.
  - CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and
    application crash) via a crafted ELF file (bnc#1033088)
  - CVE-2017-7610: elflint: heap-based buffer overflow in check_group
    (bnc#1033087)
  - CVE-2017-7609: memory allocation failure in __libelf_decompress
    (bnc#1033086)
  - CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi
    (readelf.c) (bnc#1033084)
  - CVE-2017-7608: heap-based buffer overflow in
    ebl_object_note_type_name (eblobjnotetypename.c) (bnc#1033085)
  - CVE-2017-7613: elfutils: denial of service (memory consumption)
    via a crafted ELF file (bnc#1033090)
  - CVE-2017-7612: elfutils: denial of service (heap-based buffer
    over-read and application crash) via a crafted ELF file (bnc#1033089)
  - Removed patches:
  - obsolete 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch
  - ppc-machine-flags.patch
  - elflint-check-symbol-table-data-is-big-enough-before-check.patch
  - elflint-dont-check-section-group-without-flags-word.patch
  - libelf-check-compression-before-allocate-output-buffer.patch
  - readelf-fix-off-by-one-sanity-check.patch
  - use-the-empty-string-for-note-names-with-zero-size.patch
  - elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
  - elfutils-dont-trust-sh_entsize.patch
- Packaging cleanups:
  - Modernize specfile and metadata. (Jan Engelhardt)
  - Use %make_build (Martin Li?ka)
  - Update License tag to GPL-3.0-or-later, as requested by legal
    review. (Dominique Leuenberger)
  - Don't make elfutils recommend elfutils-lang as elfutils-lang
    already supplements elfutils. (Antoine Belvire)
  - Fix typo in the recommends name bsc#1104264 (Tomas Chvatal)
  - Use %license (boo#1082318) (Fabian Vogt)
- Test fixes (Andreas Schwab):
  - disable-tests-with-ptrace.patch: Remove, set XFAIL_TESTS instead
  - dwelf_elf_e_machine_string.patch: Avoid spurious failure</changelog>
  <changelog author="jeffm@suse.com" date="1657627200">- Added 4G memory build constraint for aarch64 to pass testing.</changelog>
</package>
<package pkgid="9173e31cfd5802322c54dd29b156a7655283a1daa8e904dc30911eac09614a7e" name="libfreebl3" arch="aarch64">
  <version epoch="0" ver="3.79" rel="150000.3.74.1"/>
  <changelog author="wr@rosenauer.org" date="1615896000">- update to NSS 3.62
  * bmo#1688374 - Fix parallel build NSS-3.61 with make
  * bmo#1682044 - pkix_Build_GatherCerts() + pkix_CacheCert_Add()
    can corrupt "cachedCertTable"
  * bmo#1690583 - Fix CH padding extension size calculation
  * bmo#1690421 - Adjust 3.62 ABI report formatting for new libabigail
  * bmo#1690421 - Install packaged libabigail in docker-builds image
  * bmo#1689228 - Minor ECH -09 fixes for interop testing, fuzzing
  * bmo#1674819 - Fixup a51fae403328, enum type may be signed
  * bmo#1681585 - Add ECH support to selfserv
  * bmo#1681585 - Update ECH to Draft-09
  * bmo#1678398 - Add Export/Import functions for HPKE context
  * bmo#1678398 - Update HPKE to draft-07
- required for Firefox 87</changelog>
  <changelog author="wr@rosenauer.org" date="1618747200">- update to NSS 3.63.1
  * no upstream release notes for 3.63.1 (yet)
  Fixed in 3.63
  * bmo#1697380 - Make a clang-format run on top of helpful contributions.
  * bmo#1683520 - ECCKiila P384, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-384: allow zero scalars in dual
    scalar multiplication.
  * bmo#1683520 - ECCKiila P521, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-521: allow zero scalars in dual
    scalar multiplication.
  * bmo#1696800 - HACL* update March 2021 - c95ab70fcb2bc21025d8845281bc4bc8987ca683.
  * bmo#1694214 - tstclnt can't enable middlebox compat mode.
  * bmo#1694392 - NSS does not work with PKCS #11 modules not supporting
    profiles.
  * bmo#1685880 - Minor fix to prevent unused variable on early return.
  * bmo#1685880 - Fix for the gcc compiler version 7 to support setenv
    with nss build.
  * bmo#1693217 - Increase nssckbi.h version number for March 2021 batch
    of root CA changes, CA list version 2.48.
  * bmo#1692094 - Set email distrust after to 21-03-01 for Camerfirma's
    'Chambers of Commerce' and 'Global Chambersign' roots.
  * bmo#1618407 - Symantec root certs - Set CKA_NSS_EMAIL_DISTRUST_AFTER.
  * bmo#1693173 - Add GlobalSign R45, E45, R46, and E46 root certs to NSS.
  * bmo#1683738 - Add AC RAIZ FNMT-RCM SERVIDORES SEGUROS root cert to NSS.
  * bmo#1686854 - Remove GeoTrust PCA-G2 and VeriSign Universal root certs
    from NSS.
  * bmo#1687822 - Turn off Websites trust bit for the ?Staat der
    Nederlanden Root CA - G3? root cert in NSS.
  * bmo#1692094 - Turn off Websites Trust Bit for 'Chambers of Commerce
    Root - 2008' and 'Global Chambersign Root - 2008?.
  * bmo#1694291 - Tracing fixes for ECH.
- required for Firefox 88</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to NSS 3.64
  * bmo#1705286 - Properly detect mips64.
  * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and
    disable_crypto_vsx.
  * bmo#1698320 - replace __builtin_cpu_supports("vsx") with
    ppc_crypto_support() for clang.
  * bmo#1613235 - Add POWER ChaCha20 stream cipher vector
    acceleration.</changelog>
  <changelog author="wr@rosenauer.org" date="1625918400">- update to NSS 3.66
  * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  * bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  * bmo#1707097 - Add Certum Trusted Root CA to NSS.
  * bmo#1707097 - Add Certum EC-384 CA to NSS.
  * bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  * bmo#1709291 - Add VerifyCodeSigningCertificateChain.
  * Use GNU tar for the release helper script.
- update to NSS 3.65
  * bmo#1709654 - Update for NetBSD configuration.
  * bmo#1709750 - Disable HPKE test when fuzzing.
  * bmo#1566124 - Optimize AES-GCM for ppc64le.
  * bmo#1699021 - Add AES-256-GCM to HPKE.
  * bmo#1698419 - ECH -10 updates.
  * bmo#1692930 - Update HPKE to final version.
  * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  * bmo#1703936 - New coverity/cpp scanner errors.
  * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.
- refreshed patches
- Firefox 90.0 requires NSS 3.66</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627560000">- update to NSS 3.68
  * bmo#1713562 - Fix test leak.
  * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  * bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  * bmo#1712883 - DTLS 1.3 draft-43.
  * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  * bmo#1713562 - Validate ECH public names.
  * bmo#1717610 - Add function to get seconds from epoch from pkix::Time.
- update to NSS 3.67
  * bmo#1683710 - Add a means to disable ALPN.
  * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.</changelog>
  <changelog author="hpj@suse.com" date="1629288000">- Update nss-fips-constructor-self-tests.patch to fix crashes
  reported by upstream. This was likely affecting WebRTC calls.</changelog>
  <changelog author="cgrobertson@suse.com" date="1630411200">- Removed nss-fips-kdf-self-tests.patch.  This was made
  obsolete by upstream changes. (bmo#1660304)
- Rebase nss-fips-stricter-dh.patch needed due to upstream changes.</changelog>
  <changelog author="hpj@suse.com" date="1635768000">- Update nss-fips-approved-crypto-non-ec.patch to claim 3DES
  unapproved in FIPS mode (bsc#1192080).
- Update nss-fips-constructor-self-tests.patch to allow testing
  of unapproved algorithms (bsc#1192228).
- Add nss-fips-version-indicators.patch (bmo#1729550, bsc#1192086).
  This adds FIPS version indicators.
- Add nss-fips-180-3-csp-clearing.patch (bmo#1697303, bsc#1192087).
  Most of the relevant changes are already upstream since NSS 3.60.</changelog>
  <changelog author="hpj@suse.com" date="1637668800">- Enable NSS_ENABLE_FIPS_INDICATORS and set NSS_FIPS_MODULE_ID
  for build.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
</package>
<package pkgid="662e21c0f74abcd5337f27a42b487b730d7693b74693b60c3ece52c56af9ccb4" name="libfreebl3" arch="x86_64">
  <version epoch="0" ver="3.79" rel="150000.3.74.1"/>
  <changelog author="wr@rosenauer.org" date="1615896000">- update to NSS 3.62
  * bmo#1688374 - Fix parallel build NSS-3.61 with make
  * bmo#1682044 - pkix_Build_GatherCerts() + pkix_CacheCert_Add()
    can corrupt "cachedCertTable"
  * bmo#1690583 - Fix CH padding extension size calculation
  * bmo#1690421 - Adjust 3.62 ABI report formatting for new libabigail
  * bmo#1690421 - Install packaged libabigail in docker-builds image
  * bmo#1689228 - Minor ECH -09 fixes for interop testing, fuzzing
  * bmo#1674819 - Fixup a51fae403328, enum type may be signed
  * bmo#1681585 - Add ECH support to selfserv
  * bmo#1681585 - Update ECH to Draft-09
  * bmo#1678398 - Add Export/Import functions for HPKE context
  * bmo#1678398 - Update HPKE to draft-07
- required for Firefox 87</changelog>
  <changelog author="wr@rosenauer.org" date="1618747200">- update to NSS 3.63.1
  * no upstream release notes for 3.63.1 (yet)
  Fixed in 3.63
  * bmo#1697380 - Make a clang-format run on top of helpful contributions.
  * bmo#1683520 - ECCKiila P384, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-384: allow zero scalars in dual
    scalar multiplication.
  * bmo#1683520 - ECCKiila P521, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-521: allow zero scalars in dual
    scalar multiplication.
  * bmo#1696800 - HACL* update March 2021 - c95ab70fcb2bc21025d8845281bc4bc8987ca683.
  * bmo#1694214 - tstclnt can't enable middlebox compat mode.
  * bmo#1694392 - NSS does not work with PKCS #11 modules not supporting
    profiles.
  * bmo#1685880 - Minor fix to prevent unused variable on early return.
  * bmo#1685880 - Fix for the gcc compiler version 7 to support setenv
    with nss build.
  * bmo#1693217 - Increase nssckbi.h version number for March 2021 batch
    of root CA changes, CA list version 2.48.
  * bmo#1692094 - Set email distrust after to 21-03-01 for Camerfirma's
    'Chambers of Commerce' and 'Global Chambersign' roots.
  * bmo#1618407 - Symantec root certs - Set CKA_NSS_EMAIL_DISTRUST_AFTER.
  * bmo#1693173 - Add GlobalSign R45, E45, R46, and E46 root certs to NSS.
  * bmo#1683738 - Add AC RAIZ FNMT-RCM SERVIDORES SEGUROS root cert to NSS.
  * bmo#1686854 - Remove GeoTrust PCA-G2 and VeriSign Universal root certs
    from NSS.
  * bmo#1687822 - Turn off Websites trust bit for the ?Staat der
    Nederlanden Root CA - G3? root cert in NSS.
  * bmo#1692094 - Turn off Websites Trust Bit for 'Chambers of Commerce
    Root - 2008' and 'Global Chambersign Root - 2008?.
  * bmo#1694291 - Tracing fixes for ECH.
- required for Firefox 88</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to NSS 3.64
  * bmo#1705286 - Properly detect mips64.
  * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and
    disable_crypto_vsx.
  * bmo#1698320 - replace __builtin_cpu_supports("vsx") with
    ppc_crypto_support() for clang.
  * bmo#1613235 - Add POWER ChaCha20 stream cipher vector
    acceleration.</changelog>
  <changelog author="wr@rosenauer.org" date="1625918400">- update to NSS 3.66
  * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  * bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  * bmo#1707097 - Add Certum Trusted Root CA to NSS.
  * bmo#1707097 - Add Certum EC-384 CA to NSS.
  * bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  * bmo#1709291 - Add VerifyCodeSigningCertificateChain.
  * Use GNU tar for the release helper script.
- update to NSS 3.65
  * bmo#1709654 - Update for NetBSD configuration.
  * bmo#1709750 - Disable HPKE test when fuzzing.
  * bmo#1566124 - Optimize AES-GCM for ppc64le.
  * bmo#1699021 - Add AES-256-GCM to HPKE.
  * bmo#1698419 - ECH -10 updates.
  * bmo#1692930 - Update HPKE to final version.
  * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  * bmo#1703936 - New coverity/cpp scanner errors.
  * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.
- refreshed patches
- Firefox 90.0 requires NSS 3.66</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627560000">- update to NSS 3.68
  * bmo#1713562 - Fix test leak.
  * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  * bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  * bmo#1712883 - DTLS 1.3 draft-43.
  * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  * bmo#1713562 - Validate ECH public names.
  * bmo#1717610 - Add function to get seconds from epoch from pkix::Time.
- update to NSS 3.67
  * bmo#1683710 - Add a means to disable ALPN.
  * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.</changelog>
  <changelog author="hpj@suse.com" date="1629288000">- Update nss-fips-constructor-self-tests.patch to fix crashes
  reported by upstream. This was likely affecting WebRTC calls.</changelog>
  <changelog author="cgrobertson@suse.com" date="1630411200">- Removed nss-fips-kdf-self-tests.patch.  This was made
  obsolete by upstream changes. (bmo#1660304)
- Rebase nss-fips-stricter-dh.patch needed due to upstream changes.</changelog>
  <changelog author="hpj@suse.com" date="1635768000">- Update nss-fips-approved-crypto-non-ec.patch to claim 3DES
  unapproved in FIPS mode (bsc#1192080).
- Update nss-fips-constructor-self-tests.patch to allow testing
  of unapproved algorithms (bsc#1192228).
- Add nss-fips-version-indicators.patch (bmo#1729550, bsc#1192086).
  This adds FIPS version indicators.
- Add nss-fips-180-3-csp-clearing.patch (bmo#1697303, bsc#1192087).
  Most of the relevant changes are already upstream since NSS 3.60.</changelog>
  <changelog author="hpj@suse.com" date="1637668800">- Enable NSS_ENABLE_FIPS_INDICATORS and set NSS_FIPS_MODULE_ID
  for build.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
</package>
<package pkgid="25269ee45edf8050996fbabe0a982be69f6a7c22e1396fb7e06c410e29574d16" name="libfreebl3-hmac" arch="aarch64">
  <version epoch="0" ver="3.79" rel="150000.3.74.1"/>
  <changelog author="wr@rosenauer.org" date="1615896000">- update to NSS 3.62
  * bmo#1688374 - Fix parallel build NSS-3.61 with make
  * bmo#1682044 - pkix_Build_GatherCerts() + pkix_CacheCert_Add()
    can corrupt "cachedCertTable"
  * bmo#1690583 - Fix CH padding extension size calculation
  * bmo#1690421 - Adjust 3.62 ABI report formatting for new libabigail
  * bmo#1690421 - Install packaged libabigail in docker-builds image
  * bmo#1689228 - Minor ECH -09 fixes for interop testing, fuzzing
  * bmo#1674819 - Fixup a51fae403328, enum type may be signed
  * bmo#1681585 - Add ECH support to selfserv
  * bmo#1681585 - Update ECH to Draft-09
  * bmo#1678398 - Add Export/Import functions for HPKE context
  * bmo#1678398 - Update HPKE to draft-07
- required for Firefox 87</changelog>
  <changelog author="wr@rosenauer.org" date="1618747200">- update to NSS 3.63.1
  * no upstream release notes for 3.63.1 (yet)
  Fixed in 3.63
  * bmo#1697380 - Make a clang-format run on top of helpful contributions.
  * bmo#1683520 - ECCKiila P384, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-384: allow zero scalars in dual
    scalar multiplication.
  * bmo#1683520 - ECCKiila P521, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-521: allow zero scalars in dual
    scalar multiplication.
  * bmo#1696800 - HACL* update March 2021 - c95ab70fcb2bc21025d8845281bc4bc8987ca683.
  * bmo#1694214 - tstclnt can't enable middlebox compat mode.
  * bmo#1694392 - NSS does not work with PKCS #11 modules not supporting
    profiles.
  * bmo#1685880 - Minor fix to prevent unused variable on early return.
  * bmo#1685880 - Fix for the gcc compiler version 7 to support setenv
    with nss build.
  * bmo#1693217 - Increase nssckbi.h version number for March 2021 batch
    of root CA changes, CA list version 2.48.
  * bmo#1692094 - Set email distrust after to 21-03-01 for Camerfirma's
    'Chambers of Commerce' and 'Global Chambersign' roots.
  * bmo#1618407 - Symantec root certs - Set CKA_NSS_EMAIL_DISTRUST_AFTER.
  * bmo#1693173 - Add GlobalSign R45, E45, R46, and E46 root certs to NSS.
  * bmo#1683738 - Add AC RAIZ FNMT-RCM SERVIDORES SEGUROS root cert to NSS.
  * bmo#1686854 - Remove GeoTrust PCA-G2 and VeriSign Universal root certs
    from NSS.
  * bmo#1687822 - Turn off Websites trust bit for the ?Staat der
    Nederlanden Root CA - G3? root cert in NSS.
  * bmo#1692094 - Turn off Websites Trust Bit for 'Chambers of Commerce
    Root - 2008' and 'Global Chambersign Root - 2008?.
  * bmo#1694291 - Tracing fixes for ECH.
- required for Firefox 88</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to NSS 3.64
  * bmo#1705286 - Properly detect mips64.
  * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and
    disable_crypto_vsx.
  * bmo#1698320 - replace __builtin_cpu_supports("vsx") with
    ppc_crypto_support() for clang.
  * bmo#1613235 - Add POWER ChaCha20 stream cipher vector
    acceleration.</changelog>
  <changelog author="wr@rosenauer.org" date="1625918400">- update to NSS 3.66
  * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  * bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  * bmo#1707097 - Add Certum Trusted Root CA to NSS.
  * bmo#1707097 - Add Certum EC-384 CA to NSS.
  * bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  * bmo#1709291 - Add VerifyCodeSigningCertificateChain.
  * Use GNU tar for the release helper script.
- update to NSS 3.65
  * bmo#1709654 - Update for NetBSD configuration.
  * bmo#1709750 - Disable HPKE test when fuzzing.
  * bmo#1566124 - Optimize AES-GCM for ppc64le.
  * bmo#1699021 - Add AES-256-GCM to HPKE.
  * bmo#1698419 - ECH -10 updates.
  * bmo#1692930 - Update HPKE to final version.
  * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  * bmo#1703936 - New coverity/cpp scanner errors.
  * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.
- refreshed patches
- Firefox 90.0 requires NSS 3.66</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627560000">- update to NSS 3.68
  * bmo#1713562 - Fix test leak.
  * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  * bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  * bmo#1712883 - DTLS 1.3 draft-43.
  * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  * bmo#1713562 - Validate ECH public names.
  * bmo#1717610 - Add function to get seconds from epoch from pkix::Time.
- update to NSS 3.67
  * bmo#1683710 - Add a means to disable ALPN.
  * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.</changelog>
  <changelog author="hpj@suse.com" date="1629288000">- Update nss-fips-constructor-self-tests.patch to fix crashes
  reported by upstream. This was likely affecting WebRTC calls.</changelog>
  <changelog author="cgrobertson@suse.com" date="1630411200">- Removed nss-fips-kdf-self-tests.patch.  This was made
  obsolete by upstream changes. (bmo#1660304)
- Rebase nss-fips-stricter-dh.patch needed due to upstream changes.</changelog>
  <changelog author="hpj@suse.com" date="1635768000">- Update nss-fips-approved-crypto-non-ec.patch to claim 3DES
  unapproved in FIPS mode (bsc#1192080).
- Update nss-fips-constructor-self-tests.patch to allow testing
  of unapproved algorithms (bsc#1192228).
- Add nss-fips-version-indicators.patch (bmo#1729550, bsc#1192086).
  This adds FIPS version indicators.
- Add nss-fips-180-3-csp-clearing.patch (bmo#1697303, bsc#1192087).
  Most of the relevant changes are already upstream since NSS 3.60.</changelog>
  <changelog author="hpj@suse.com" date="1637668800">- Enable NSS_ENABLE_FIPS_INDICATORS and set NSS_FIPS_MODULE_ID
  for build.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
</package>
<package pkgid="51c4a81ecd4ad23012fbd911291f2274811e5ff97d03d6dc4055645a275f3758" name="libfreebl3-hmac" arch="x86_64">
  <version epoch="0" ver="3.79" rel="150000.3.74.1"/>
  <changelog author="wr@rosenauer.org" date="1615896000">- update to NSS 3.62
  * bmo#1688374 - Fix parallel build NSS-3.61 with make
  * bmo#1682044 - pkix_Build_GatherCerts() + pkix_CacheCert_Add()
    can corrupt "cachedCertTable"
  * bmo#1690583 - Fix CH padding extension size calculation
  * bmo#1690421 - Adjust 3.62 ABI report formatting for new libabigail
  * bmo#1690421 - Install packaged libabigail in docker-builds image
  * bmo#1689228 - Minor ECH -09 fixes for interop testing, fuzzing
  * bmo#1674819 - Fixup a51fae403328, enum type may be signed
  * bmo#1681585 - Add ECH support to selfserv
  * bmo#1681585 - Update ECH to Draft-09
  * bmo#1678398 - Add Export/Import functions for HPKE context
  * bmo#1678398 - Update HPKE to draft-07
- required for Firefox 87</changelog>
  <changelog author="wr@rosenauer.org" date="1618747200">- update to NSS 3.63.1
  * no upstream release notes for 3.63.1 (yet)
  Fixed in 3.63
  * bmo#1697380 - Make a clang-format run on top of helpful contributions.
  * bmo#1683520 - ECCKiila P384, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-384: allow zero scalars in dual
    scalar multiplication.
  * bmo#1683520 - ECCKiila P521, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-521: allow zero scalars in dual
    scalar multiplication.
  * bmo#1696800 - HACL* update March 2021 - c95ab70fcb2bc21025d8845281bc4bc8987ca683.
  * bmo#1694214 - tstclnt can't enable middlebox compat mode.
  * bmo#1694392 - NSS does not work with PKCS #11 modules not supporting
    profiles.
  * bmo#1685880 - Minor fix to prevent unused variable on early return.
  * bmo#1685880 - Fix for the gcc compiler version 7 to support setenv
    with nss build.
  * bmo#1693217 - Increase nssckbi.h version number for March 2021 batch
    of root CA changes, CA list version 2.48.
  * bmo#1692094 - Set email distrust after to 21-03-01 for Camerfirma's
    'Chambers of Commerce' and 'Global Chambersign' roots.
  * bmo#1618407 - Symantec root certs - Set CKA_NSS_EMAIL_DISTRUST_AFTER.
  * bmo#1693173 - Add GlobalSign R45, E45, R46, and E46 root certs to NSS.
  * bmo#1683738 - Add AC RAIZ FNMT-RCM SERVIDORES SEGUROS root cert to NSS.
  * bmo#1686854 - Remove GeoTrust PCA-G2 and VeriSign Universal root certs
    from NSS.
  * bmo#1687822 - Turn off Websites trust bit for the ?Staat der
    Nederlanden Root CA - G3? root cert in NSS.
  * bmo#1692094 - Turn off Websites Trust Bit for 'Chambers of Commerce
    Root - 2008' and 'Global Chambersign Root - 2008?.
  * bmo#1694291 - Tracing fixes for ECH.
- required for Firefox 88</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to NSS 3.64
  * bmo#1705286 - Properly detect mips64.
  * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and
    disable_crypto_vsx.
  * bmo#1698320 - replace __builtin_cpu_supports("vsx") with
    ppc_crypto_support() for clang.
  * bmo#1613235 - Add POWER ChaCha20 stream cipher vector
    acceleration.</changelog>
  <changelog author="wr@rosenauer.org" date="1625918400">- update to NSS 3.66
  * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  * bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  * bmo#1707097 - Add Certum Trusted Root CA to NSS.
  * bmo#1707097 - Add Certum EC-384 CA to NSS.
  * bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  * bmo#1709291 - Add VerifyCodeSigningCertificateChain.
  * Use GNU tar for the release helper script.
- update to NSS 3.65
  * bmo#1709654 - Update for NetBSD configuration.
  * bmo#1709750 - Disable HPKE test when fuzzing.
  * bmo#1566124 - Optimize AES-GCM for ppc64le.
  * bmo#1699021 - Add AES-256-GCM to HPKE.
  * bmo#1698419 - ECH -10 updates.
  * bmo#1692930 - Update HPKE to final version.
  * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  * bmo#1703936 - New coverity/cpp scanner errors.
  * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.
- refreshed patches
- Firefox 90.0 requires NSS 3.66</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627560000">- update to NSS 3.68
  * bmo#1713562 - Fix test leak.
  * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  * bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  * bmo#1712883 - DTLS 1.3 draft-43.
  * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  * bmo#1713562 - Validate ECH public names.
  * bmo#1717610 - Add function to get seconds from epoch from pkix::Time.
- update to NSS 3.67
  * bmo#1683710 - Add a means to disable ALPN.
  * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.</changelog>
  <changelog author="hpj@suse.com" date="1629288000">- Update nss-fips-constructor-self-tests.patch to fix crashes
  reported by upstream. This was likely affecting WebRTC calls.</changelog>
  <changelog author="cgrobertson@suse.com" date="1630411200">- Removed nss-fips-kdf-self-tests.patch.  This was made
  obsolete by upstream changes. (bmo#1660304)
- Rebase nss-fips-stricter-dh.patch needed due to upstream changes.</changelog>
  <changelog author="hpj@suse.com" date="1635768000">- Update nss-fips-approved-crypto-non-ec.patch to claim 3DES
  unapproved in FIPS mode (bsc#1192080).
- Update nss-fips-constructor-self-tests.patch to allow testing
  of unapproved algorithms (bsc#1192228).
- Add nss-fips-version-indicators.patch (bmo#1729550, bsc#1192086).
  This adds FIPS version indicators.
- Add nss-fips-180-3-csp-clearing.patch (bmo#1697303, bsc#1192087).
  Most of the relevant changes are already upstream since NSS 3.60.</changelog>
  <changelog author="hpj@suse.com" date="1637668800">- Enable NSS_ENABLE_FIPS_INDICATORS and set NSS_FIPS_MODULE_ID
  for build.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
</package>
<package pkgid="0282d2f9b0dd2389155f627a83d0129d00f8be586b305c987dee5f56b03645e3" name="libharfbuzz0" arch="aarch64">
  <version epoch="0" ver="2.6.4" rel="150200.3.3.1"/>
  <changelog author="zaitor@opensuse.org" date="1512907200">- Update to version 1.7.2:
  + Optimize hb_set_add_range().
  + Misc fixes.
  + New API: hb_coretext_font_create().</changelog>
  <changelog author="zaitor@opensuse.org" date="1513771200">- Update to version 1.7.4:
  + Fix collect_glyphs() regression caused by hb_set_t changes.
- Changes from version 1.7.3:
  + hb_set_t performance tuning and optimizations.
  + Speed up collect_glyphs() and reject garbage data.
  + In hb_coretext_font_create() set font point-size (ptem).
  + Misc fixes.</changelog>
  <changelog author="zaitor@opensuse.org" date="1515499200">- Add pkgconfig(gobject-2.0) and
  pkgconfig(gobject-introspection-1.0) BuildRequires, and pass
  with-gobject=yes to configure, build GObject and Introspection
  support.
- Following this, package the new sub-packages libharfbuzz-gobject0
  and typelib-1_0-HarfBuzz-0_0.
- Clean up spec, use autosetup and make_build macros.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1515585600">- harfbuzz-devel hb-ft.h requires pkgconfig(freetype2) but it is
  not automatically added by the dependency generator.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1518177600">- Update to version 1.7.5:
  + Separate Khmer shaper from Indic.
  + First stab at AAT morx. Not hooked up.
  + Misc bug fixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="astieger@suse.com" date="1520596800">- Fix build on Leap 42.3: don't use make_build.</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1520769600">- Fix broken libharbuzz-gobject.so symlink by requiring Harfbuzz's
  Gobject library for the devel package.
- Add missing GI bindings requirement for the devel package.</changelog>
  <changelog author="jengelh@inai.de" date="1520942400">- Update summaries.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1520942401">- Update to version 1.7.6:
  + Fix to hb_set_t binary operations. Ouch.
  + New experimental harfbuzz-subset library. All of hb-subset.h is
    experimental right now and API WILL change.
  + New API:
  - hb_blob_copy_writable_or_fail().
  - HB_OT_TAG_BASE.
  - hb_set_previous().
  - hb_set_previous_range().
- Split out new sub-package libharfbuzz-subset0.
- Add libharfbuzz-gobject0 and libharfbuzz-subset0 to baselibs.
- Use make_build macro.</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1529150400">- Update to version 1.8.1:
  + Add correctness bug in hb_set_t operations, introduced in
    1.7.7.
- Changes from version 1.8.0:
  + Update to Unicode 11.0.0.
- Changes from version 1.7.7:
  + All HarfBuzz objects are significantly smaller in size now.
  + Sinhala: Position repha on top of post-consonant, not base.
  + Significant libharfbuzz-subset changes. API subject to change.
  + New API in libharfbuzz: hb_blob_create_from_file() and
    hb_face_count().
- Add missing post(un) ldconfig scriptlets for libharfbuzz-subset
  shared library.</changelog>
  <changelog author="tchvatal@suse.com" date="1538654400">- Update to 1.9.0:
  * Various gcc warning fixes
  * New Face-builder API
  * Internal source header name changes
  * Major Khmer shaper improvements
  * Couple of Indic bugfixes</changelog>
  <changelog author="tchvatal@suse.com" date="1552910400">- Update to 2.3.1:
  * too many changes to ever iterate, see NEWS for the details</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563019200">- Update to version 2.5.3:
  + Fix UCD script data for Unicode 10+ scripts. This was broken
    since 2.5.0.
  + More optimizations for HB_TINY.
- Changes from version 2.5.2:
  + More hb-config.hh facilities to shrink library size, namely
    when built as HB_TINY.
  + New documentation of custom configurations in CONFIG.md.
  + Fix build on gcc 4.8. That's supported again.
  + Universal Shaping Engine improvements.
  + API Changes: Undeprecate some horizontal-kerning API and
    re-enable in hb-ft, such that Type1 fonts will continue
    kerning.
- Changes from version 2.5.1:
  + Fix build with various versions of Visual Studio.
  + Improved documentation.
  + Bugfix in subsetting glyf table.
  + Improved scripts for cross-compiling for Windows using mingw.
  + Rename HB_MATH_GLYPH_PART_FLAG_EXTENDER to
    HB_OT_MATH_GLYPH_PART_FLAG_EXTENDER. A deprecated macro is
    added for backwards-compatibility.
- Changes from version 2.5.0:
  + This release does not include much functional changes, but
    includes major internal code-base changes. We now require
    C++11. Support for gcc 4.8 and earlier has been dropped.
  + New hb-config.hh facility for compiling smaller library for
    embedded and web usecases.
  + New Unicode Character Databse implementation that is half the
    size of previously-used UCDN.
  + Subsetter improvements.
  + Improved documentation.
  + isc shaping fixes.
- Changes from version 2.4.0:
  + Unicode 12.
  + Misc fixes.
  + Subsetter improvements.
  + New API: HB_BUFFER_FLAG_DO_NOT_INSERT_DOTTED_CIRCLE and
    hb_directwrite_face_create().</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1568376000">- Update to version 2.6.1:
  + Fix regression with hb_font_create_sub_font scaling introduced
    in 2.6.0.
  + Change interpretation of font PTEM size / CoreText font size
    handling.
  + hb-ot-font: Prefer symbol cmap subtable if present.
  + Apply 'dist'/'abvm'/'blwm' features to all scripts.
  + Drop experimental DirectWrite API.
- Changes from version 2.6.0:
  + New OpenType metrics, baseline, and metadata table access APIs.
  + New API to set font variations to a named-instance.
  + New hb-gdi.h header and API for creating hb_face_t from HFONT.
  + Amalgam: Provide a single-file harfbuzz.cc file for easier
    alternate building.
  + More size-reduction configurable options, enabled by HB_TINY.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570104000">- Update to version 2.6.2:
  + Misc small fixes, mostly to build-related issues.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1570363200">- add upstream sigining keyring and verify source signature</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1572350400">- update to 2.6.3:
  + Misc small fixes, mostly to build-related issues
  + New API: hb_font_get_nominal_glyphs()</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1574596800">- update to 2.6.4:
  + small bug fixes and build fixes</changelog>
  <changelog author="mgorse@suse.com" date="1657886400">- Add harfbuzz-CVE-2022-33068.patch: sbix: limit glyph extents
  (boo#1200900 CVE-2022-33068).</changelog>
</package>
<package pkgid="2c2bff4a4fe0a7e3f461af777d914c8aa6e51212cb5b857d2f89282666b9a419" name="libharfbuzz0" arch="x86_64">
  <version epoch="0" ver="2.6.4" rel="150200.3.3.1"/>
  <changelog author="zaitor@opensuse.org" date="1512907200">- Update to version 1.7.2:
  + Optimize hb_set_add_range().
  + Misc fixes.
  + New API: hb_coretext_font_create().</changelog>
  <changelog author="zaitor@opensuse.org" date="1513771200">- Update to version 1.7.4:
  + Fix collect_glyphs() regression caused by hb_set_t changes.
- Changes from version 1.7.3:
  + hb_set_t performance tuning and optimizations.
  + Speed up collect_glyphs() and reject garbage data.
  + In hb_coretext_font_create() set font point-size (ptem).
  + Misc fixes.</changelog>
  <changelog author="zaitor@opensuse.org" date="1515499200">- Add pkgconfig(gobject-2.0) and
  pkgconfig(gobject-introspection-1.0) BuildRequires, and pass
  with-gobject=yes to configure, build GObject and Introspection
  support.
- Following this, package the new sub-packages libharfbuzz-gobject0
  and typelib-1_0-HarfBuzz-0_0.
- Clean up spec, use autosetup and make_build macros.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1515585600">- harfbuzz-devel hb-ft.h requires pkgconfig(freetype2) but it is
  not automatically added by the dependency generator.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1518177600">- Update to version 1.7.5:
  + Separate Khmer shaper from Indic.
  + First stab at AAT morx. Not hooked up.
  + Misc bug fixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="astieger@suse.com" date="1520596800">- Fix build on Leap 42.3: don't use make_build.</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1520769600">- Fix broken libharbuzz-gobject.so symlink by requiring Harfbuzz's
  Gobject library for the devel package.
- Add missing GI bindings requirement for the devel package.</changelog>
  <changelog author="jengelh@inai.de" date="1520942400">- Update summaries.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1520942401">- Update to version 1.7.6:
  + Fix to hb_set_t binary operations. Ouch.
  + New experimental harfbuzz-subset library. All of hb-subset.h is
    experimental right now and API WILL change.
  + New API:
  - hb_blob_copy_writable_or_fail().
  - HB_OT_TAG_BASE.
  - hb_set_previous().
  - hb_set_previous_range().
- Split out new sub-package libharfbuzz-subset0.
- Add libharfbuzz-gobject0 and libharfbuzz-subset0 to baselibs.
- Use make_build macro.</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1529150400">- Update to version 1.8.1:
  + Add correctness bug in hb_set_t operations, introduced in
    1.7.7.
- Changes from version 1.8.0:
  + Update to Unicode 11.0.0.
- Changes from version 1.7.7:
  + All HarfBuzz objects are significantly smaller in size now.
  + Sinhala: Position repha on top of post-consonant, not base.
  + Significant libharfbuzz-subset changes. API subject to change.
  + New API in libharfbuzz: hb_blob_create_from_file() and
    hb_face_count().
- Add missing post(un) ldconfig scriptlets for libharfbuzz-subset
  shared library.</changelog>
  <changelog author="tchvatal@suse.com" date="1538654400">- Update to 1.9.0:
  * Various gcc warning fixes
  * New Face-builder API
  * Internal source header name changes
  * Major Khmer shaper improvements
  * Couple of Indic bugfixes</changelog>
  <changelog author="tchvatal@suse.com" date="1552910400">- Update to 2.3.1:
  * too many changes to ever iterate, see NEWS for the details</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563019200">- Update to version 2.5.3:
  + Fix UCD script data for Unicode 10+ scripts. This was broken
    since 2.5.0.
  + More optimizations for HB_TINY.
- Changes from version 2.5.2:
  + More hb-config.hh facilities to shrink library size, namely
    when built as HB_TINY.
  + New documentation of custom configurations in CONFIG.md.
  + Fix build on gcc 4.8. That's supported again.
  + Universal Shaping Engine improvements.
  + API Changes: Undeprecate some horizontal-kerning API and
    re-enable in hb-ft, such that Type1 fonts will continue
    kerning.
- Changes from version 2.5.1:
  + Fix build with various versions of Visual Studio.
  + Improved documentation.
  + Bugfix in subsetting glyf table.
  + Improved scripts for cross-compiling for Windows using mingw.
  + Rename HB_MATH_GLYPH_PART_FLAG_EXTENDER to
    HB_OT_MATH_GLYPH_PART_FLAG_EXTENDER. A deprecated macro is
    added for backwards-compatibility.
- Changes from version 2.5.0:
  + This release does not include much functional changes, but
    includes major internal code-base changes. We now require
    C++11. Support for gcc 4.8 and earlier has been dropped.
  + New hb-config.hh facility for compiling smaller library for
    embedded and web usecases.
  + New Unicode Character Databse implementation that is half the
    size of previously-used UCDN.
  + Subsetter improvements.
  + Improved documentation.
  + isc shaping fixes.
- Changes from version 2.4.0:
  + Unicode 12.
  + Misc fixes.
  + Subsetter improvements.
  + New API: HB_BUFFER_FLAG_DO_NOT_INSERT_DOTTED_CIRCLE and
    hb_directwrite_face_create().</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1568376000">- Update to version 2.6.1:
  + Fix regression with hb_font_create_sub_font scaling introduced
    in 2.6.0.
  + Change interpretation of font PTEM size / CoreText font size
    handling.
  + hb-ot-font: Prefer symbol cmap subtable if present.
  + Apply 'dist'/'abvm'/'blwm' features to all scripts.
  + Drop experimental DirectWrite API.
- Changes from version 2.6.0:
  + New OpenType metrics, baseline, and metadata table access APIs.
  + New API to set font variations to a named-instance.
  + New hb-gdi.h header and API for creating hb_face_t from HFONT.
  + Amalgam: Provide a single-file harfbuzz.cc file for easier
    alternate building.
  + More size-reduction configurable options, enabled by HB_TINY.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570104000">- Update to version 2.6.2:
  + Misc small fixes, mostly to build-related issues.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1570363200">- add upstream sigining keyring and verify source signature</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1572350400">- update to 2.6.3:
  + Misc small fixes, mostly to build-related issues
  + New API: hb_font_get_nominal_glyphs()</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1574596800">- update to 2.6.4:
  + small bug fixes and build fixes</changelog>
  <changelog author="mgorse@suse.com" date="1657886400">- Add harfbuzz-CVE-2022-33068.patch: sbix: limit glyph extents
  (boo#1200900 CVE-2022-33068).</changelog>
</package>
<package pkgid="10182030cc01c1023c0db04aae8bf11162ab7bbe604e5239cc781f172beaade1" name="libldb2" arch="aarch64">
  <version epoch="0" ver="2.4.3" rel="150300.3.20.1"/>
  <changelog author="scabrero@suse.de" date="1542024000">- Update to 1.4.3
  + Python: Ensure ldb.Dn can accept utf8 encoded unicode (bug 13616)</changelog>
  <changelog author="dmulder@suse.com" date="1549454400">- Update to 1.5.2
  + dirsync: Allow arbitrary length cookies (bug #13686)
  + The build uses python3 by default: --extra-python would take
    python2 now
  + To build with python2 only use:
    PYTHON=python2 ./configure
    PYTHON=python2 make
    PYTHON=python2 make install</changelog>
  <changelog author="dmulder@suse.com" date="1551787200">- Update to 1.5.4
  + Fix standalone build of ldb.
  + C99 build fixes.
  + CVE-2019-3824 out of bounds read in wildcard compare (bug#13773)
- Update to 1.5.3
  + Avoid inefficient one-level searches (bug#13762)
  + The test api.py should not rely on order of entries in dict (bug#13772)</changelog>
  <changelog author="scabrero@suse.de" date="1564660800">- Update to 1.5.5
  + LDAP_REFERRAL_SCHEME_OPAQUE was added to ldb_module.h; (bso#12478);
  + Skip @ records early in a search full scan; (bso#13893);</changelog>
  <changelog author="jmcdonough@suse.com" date="1570104000">- Update to version 2.0.7
  + Robustness improvements against duplicate attributes in ldb_filter_attrs()
    (bso#13695)
  + Robustness improvements against invalid string DN values (bso#14049)
  + log database repack so users know what is happening (bso#14059)
  + add ldb_options_get
  + add "batch_mode" option.
  + Remove Python 2.x support except to build just the bare C library
  + Remove --extra-python (a build time mode to produce Python2 and Python3
    bindings at the same time)
  + Fix standalone build of ldb.
  + CVE-2019-3824 out of bounds read in wildcard compare (bso#13773)</changelog>
  <changelog author="nopower@suse.com" date="1576756800">- Add obsolete ldb1 directive to baselibs.conf</changelog>
  <changelog author="dmulder@suse.com" date="1579262400">- libldb1 fails to migrate to libldb2 when libldb2 version is less
  than libldb1 version; (bsc#1160341)</changelog>
  <changelog author="david.mulder@suse.com" date="1579694400">ldb: Release ldb 2.0.8
  + Upgrade waf to version 2.0.18 to match the rest of Samba 4.11.x
    (bso#13846)</changelog>
  <changelog author="nopower@suse.com" date="1583496000">- Release ldb 2.1.1
  + Samba 4.11 and later give incorrect results for SCOPE_ONE
    searches; (bso#14270).</changelog>
  <changelog author="nopower@suse.com" date="1588075200">- Release ldb 2.1.2
  + CVE-2020-10700: ldb: Always use ldb_next_request() in
    ASQ module; ;(bso#14331); (bsc#1169850).</changelog>
  <changelog author="david.mulder@suse.com" date="1589976000">ldb: Bump version to 2.1.3; (bso#14330)</changelog>
  <changelog author="nopower@suse.com" date="1593777600">- Release ldb 2.1.4
  + CVE-2020-10730: NULL de-reference in AD DC LDAP server when
    ASQ and VLV combined; (bso#14364); (bsc#1173159)</changelog>
  <changelog author="ddiss@suse.com" date="1599825600">- Release ldb 2.2.0
  + Fix memory leak in ldb_kv_index_dn_ordered(); (bso#14299)
  + Fix off-by-one increment in lldb_add_msg_attr; (bso#14413)</changelog>
  <changelog author="scabrero@suse.de" date="1616587200">- Release ldb 2.2.1
  + CVE-2020-27840: Unauthenticated remote heap corruption via bad DNs;
    (bso#14595); (bsc#1183572);
  + CVE-2021-20277: out of bounds read in ldb_handler_fold; (bso#14655);
    (bsc#1183574);</changelog>
  <changelog author="nopower@suse.com" date="1636027200">- Add ldb-cve-2020-25718.patch &amp;
  CVE-2020-25718-lib-Add-hex_byte-to-replace.h.patch to backport all
  changes from ldb-2.4.1.
  + CVE-2020-25718: samba: An RODC can issue (forge) administrator
    tickets to other servers; (bsc#1192246); (bso#14558)
  + CVE-2021-3738: samba: crash in dsdb stack;
    (bsc#1192215);(bso#14848)
-  Release ldb 2.2.2
  + Corrected python behaviour for 'in' for LDAP attributes
  contained as part of ldb.Message;(bso#14845).
  + Fix memory handling in ldb.msg_diff
  Corrected python docstrings;(bso#14836)
  + Backport bronze bit fixes, tests, and selftest improvements;
  (bso#14881).</changelog>
  <changelog author="nopower@suse.com" date="1641297600">- Update to version 2.4.1; (jsc#SLE-23329);
  - Release 2.4.1
    + Corrected python behaviour for 'in' for LDAP attributes
    contained as part of ldb.Message; (bso#14845);
    + Fix memory handling in ldb.msg_diff; (bso#14836);
    + Corrected python docstrings
  - Release 2.4.0
    + Improve calculate_popt_array_length()
    + Use C99 initializers for builtin_popt_options[]
    + pyldb: Fix Message.items() for a message containing elements
    + pyldb: Add test for Message.items()
    + tests: Use ldbsearch '--scope instead of '-s'
    + pyldb: fix a typo
    + Change page size of guidindexpackv1.ldb
    + Use a 1MiB lmdb so the test also passes on aarch64 CentOS stream
    + attrib_handler casefold: simplify space dropping
    + fix ldb_comparison_fold off-by-one overrun
    + CVE-2020-27840: pytests: move Dn.validate test to ldb
    + CVE-2020-27840 ldb_dn: avoid head corruption in ldb_dn_explode
    + CVE-2021-20277 ldb/attrib_handlers casefold: stay in bounds
    + CVE-2021-20277 ldb tests: ldb_match tests with extra spaces
    + improve comments for ldb_module_connect_backend()
    + test/ldb_tdb: correct introductory comments
    + ldb.h: remove undefined async_ctx function signatures
    + correct comments in attrib_handers val_to_int64
    + dn tests use cmocka print functions
    + ldb_match: remove redundant check
    + add tests for ldb_wildcard_compare
    + ldb_match: trailing chunk must match end of string
    + pyldb: catch potential overflow error in py_timestring
    + ldb: remove some 'if PY3's in tests
    + Add missing break in switch statement
- Drop obsolete patch CVE-2020-25718-lib-Add-hex_byte-to-replace.h.patch
- Drop obsolete patch ldb-cve-2020-25718.patch</changelog>
  <changelog author="scabrero@suse.de" date="1641902400">- Modify packaging to allow parallel installation with libldb1
  (bsc#1192684):
  + Private libraries are installed in %{_libdir}/ldb2/
  + Modules are installed in %{_libdir}/ldb2/modules</changelog>
  <changelog author="scabrero@suse.de" date="1649246400">- Update to version 2.4.2
  + Fix for CVE-2021-3670, ensure that the LDB request has not
    timed out during filter processing as the LDAP server
    MaxQueryDuration is otherwise not honoured (bsc#1198397).</changelog>
  <changelog author="scabrero@suse.de" date="1657281600">- Update to version 2.4.3
  + Fix build problems, waf produces incorrect names for python
    extensions; (bso#15071);</changelog>
  <changelog author="nopower@suse.com" date="1657886400">- Add ldb-memory-bug-15096-4.15-ldbonly.patch to backport all
  changes for ldb-2.4.4.
  + CVE-2022-32745: samba: ldb: AD users can crash the server
    process with an LDAP add or modify request; (bso#15008);
    (bso#15096); (bsc#1201492).
  + CVE-2022-2031: samba, ldb: AD users can bypass certain
    restrictions associated with changing passwords; (bso#15047);
    (bsc#1201495);
  + CVE-2022-32744: samba, ldb: AD users can forge password change
    requests for any user; (bso#15074); (bso#15047); (bsc#1201493).</changelog>
</package>
<package pkgid="d911a2dd1c3807dcd2763512829ab5f3fc0d0bdac2cabd9b33d529a1d4491951" name="libldb2" arch="x86_64">
  <version epoch="0" ver="2.4.3" rel="150300.3.20.1"/>
  <changelog author="scabrero@suse.de" date="1542024000">- Update to 1.4.3
  + Python: Ensure ldb.Dn can accept utf8 encoded unicode (bug 13616)</changelog>
  <changelog author="dmulder@suse.com" date="1549454400">- Update to 1.5.2
  + dirsync: Allow arbitrary length cookies (bug #13686)
  + The build uses python3 by default: --extra-python would take
    python2 now
  + To build with python2 only use:
    PYTHON=python2 ./configure
    PYTHON=python2 make
    PYTHON=python2 make install</changelog>
  <changelog author="dmulder@suse.com" date="1551787200">- Update to 1.5.4
  + Fix standalone build of ldb.
  + C99 build fixes.
  + CVE-2019-3824 out of bounds read in wildcard compare (bug#13773)
- Update to 1.5.3
  + Avoid inefficient one-level searches (bug#13762)
  + The test api.py should not rely on order of entries in dict (bug#13772)</changelog>
  <changelog author="scabrero@suse.de" date="1564660800">- Update to 1.5.5
  + LDAP_REFERRAL_SCHEME_OPAQUE was added to ldb_module.h; (bso#12478);
  + Skip @ records early in a search full scan; (bso#13893);</changelog>
  <changelog author="jmcdonough@suse.com" date="1570104000">- Update to version 2.0.7
  + Robustness improvements against duplicate attributes in ldb_filter_attrs()
    (bso#13695)
  + Robustness improvements against invalid string DN values (bso#14049)
  + log database repack so users know what is happening (bso#14059)
  + add ldb_options_get
  + add "batch_mode" option.
  + Remove Python 2.x support except to build just the bare C library
  + Remove --extra-python (a build time mode to produce Python2 and Python3
    bindings at the same time)
  + Fix standalone build of ldb.
  + CVE-2019-3824 out of bounds read in wildcard compare (bso#13773)</changelog>
  <changelog author="nopower@suse.com" date="1576756800">- Add obsolete ldb1 directive to baselibs.conf</changelog>
  <changelog author="dmulder@suse.com" date="1579262400">- libldb1 fails to migrate to libldb2 when libldb2 version is less
  than libldb1 version; (bsc#1160341)</changelog>
  <changelog author="david.mulder@suse.com" date="1579694400">ldb: Release ldb 2.0.8
  + Upgrade waf to version 2.0.18 to match the rest of Samba 4.11.x
    (bso#13846)</changelog>
  <changelog author="nopower@suse.com" date="1583496000">- Release ldb 2.1.1
  + Samba 4.11 and later give incorrect results for SCOPE_ONE
    searches; (bso#14270).</changelog>
  <changelog author="nopower@suse.com" date="1588075200">- Release ldb 2.1.2
  + CVE-2020-10700: ldb: Always use ldb_next_request() in
    ASQ module; ;(bso#14331); (bsc#1169850).</changelog>
  <changelog author="david.mulder@suse.com" date="1589976000">ldb: Bump version to 2.1.3; (bso#14330)</changelog>
  <changelog author="nopower@suse.com" date="1593777600">- Release ldb 2.1.4
  + CVE-2020-10730: NULL de-reference in AD DC LDAP server when
    ASQ and VLV combined; (bso#14364); (bsc#1173159)</changelog>
  <changelog author="ddiss@suse.com" date="1599825600">- Release ldb 2.2.0
  + Fix memory leak in ldb_kv_index_dn_ordered(); (bso#14299)
  + Fix off-by-one increment in lldb_add_msg_attr; (bso#14413)</changelog>
  <changelog author="scabrero@suse.de" date="1616587200">- Release ldb 2.2.1
  + CVE-2020-27840: Unauthenticated remote heap corruption via bad DNs;
    (bso#14595); (bsc#1183572);
  + CVE-2021-20277: out of bounds read in ldb_handler_fold; (bso#14655);
    (bsc#1183574);</changelog>
  <changelog author="nopower@suse.com" date="1636027200">- Add ldb-cve-2020-25718.patch &amp;
  CVE-2020-25718-lib-Add-hex_byte-to-replace.h.patch to backport all
  changes from ldb-2.4.1.
  + CVE-2020-25718: samba: An RODC can issue (forge) administrator
    tickets to other servers; (bsc#1192246); (bso#14558)
  + CVE-2021-3738: samba: crash in dsdb stack;
    (bsc#1192215);(bso#14848)
-  Release ldb 2.2.2
  + Corrected python behaviour for 'in' for LDAP attributes
  contained as part of ldb.Message;(bso#14845).
  + Fix memory handling in ldb.msg_diff
  Corrected python docstrings;(bso#14836)
  + Backport bronze bit fixes, tests, and selftest improvements;
  (bso#14881).</changelog>
  <changelog author="nopower@suse.com" date="1641297600">- Update to version 2.4.1; (jsc#SLE-23329);
  - Release 2.4.1
    + Corrected python behaviour for 'in' for LDAP attributes
    contained as part of ldb.Message; (bso#14845);
    + Fix memory handling in ldb.msg_diff; (bso#14836);
    + Corrected python docstrings
  - Release 2.4.0
    + Improve calculate_popt_array_length()
    + Use C99 initializers for builtin_popt_options[]
    + pyldb: Fix Message.items() for a message containing elements
    + pyldb: Add test for Message.items()
    + tests: Use ldbsearch '--scope instead of '-s'
    + pyldb: fix a typo
    + Change page size of guidindexpackv1.ldb
    + Use a 1MiB lmdb so the test also passes on aarch64 CentOS stream
    + attrib_handler casefold: simplify space dropping
    + fix ldb_comparison_fold off-by-one overrun
    + CVE-2020-27840: pytests: move Dn.validate test to ldb
    + CVE-2020-27840 ldb_dn: avoid head corruption in ldb_dn_explode
    + CVE-2021-20277 ldb/attrib_handlers casefold: stay in bounds
    + CVE-2021-20277 ldb tests: ldb_match tests with extra spaces
    + improve comments for ldb_module_connect_backend()
    + test/ldb_tdb: correct introductory comments
    + ldb.h: remove undefined async_ctx function signatures
    + correct comments in attrib_handers val_to_int64
    + dn tests use cmocka print functions
    + ldb_match: remove redundant check
    + add tests for ldb_wildcard_compare
    + ldb_match: trailing chunk must match end of string
    + pyldb: catch potential overflow error in py_timestring
    + ldb: remove some 'if PY3's in tests
    + Add missing break in switch statement
- Drop obsolete patch CVE-2020-25718-lib-Add-hex_byte-to-replace.h.patch
- Drop obsolete patch ldb-cve-2020-25718.patch</changelog>
  <changelog author="scabrero@suse.de" date="1641902400">- Modify packaging to allow parallel installation with libldb1
  (bsc#1192684):
  + Private libraries are installed in %{_libdir}/ldb2/
  + Modules are installed in %{_libdir}/ldb2/modules</changelog>
  <changelog author="scabrero@suse.de" date="1649246400">- Update to version 2.4.2
  + Fix for CVE-2021-3670, ensure that the LDB request has not
    timed out during filter processing as the LDAP server
    MaxQueryDuration is otherwise not honoured (bsc#1198397).</changelog>
  <changelog author="scabrero@suse.de" date="1657281600">- Update to version 2.4.3
  + Fix build problems, waf produces incorrect names for python
    extensions; (bso#15071);</changelog>
  <changelog author="nopower@suse.com" date="1657886400">- Add ldb-memory-bug-15096-4.15-ldbonly.patch to backport all
  changes for ldb-2.4.4.
  + CVE-2022-32745: samba: ldb: AD users can crash the server
    process with an LDAP add or modify request; (bso#15008);
    (bso#15096); (bsc#1201492).
  + CVE-2022-2031: samba, ldb: AD users can bypass certain
    restrictions associated with changing passwords; (bso#15047);
    (bsc#1201495);
  + CVE-2022-32744: samba, ldb: AD users can forge password change
    requests for any user; (bso#15074); (bso#15047); (bsc#1201493).</changelog>
</package>
<package pkgid="06dde86725a56598ad89d126bb3d73aa988dd2baf099dfe57852f191e3a3671d" name="libopenssl-1_1-devel" arch="aarch64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.48.1"/>
  <changelog author="pmonreal@suse.com" date="1598529600">- Include ECDH/DH Requirements from SP800-56Arev3 [bsc#1175844, bsc#1173470]
- Add patches:
  * openssl-DH.patch
  * openssl-kdf-selftest.patch
  * openssl-kdf-tls-selftest.patch
  * openssl-kdf-ssh-selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1599566400">- Add shared secret KAT to FIPS DH selftest [bsc#1175844]
  * add openssl-fips-DH_selftest_shared_secret_KAT.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1602158400">- Restore private key check in EC_KEY_check_key [bsc#1177479]
  * Update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614686400">- Fix unresolved error codes [bsc#1182959]
- Update openssl-1.1.1-fips.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
</package>
<package pkgid="e38837b1adfcd49eed1d014fc014e3d30ec7e9e03da2688a1458789067206d5d" name="libopenssl-1_1-devel" arch="x86_64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.48.1"/>
  <changelog author="pmonreal@suse.com" date="1598529600">- Include ECDH/DH Requirements from SP800-56Arev3 [bsc#1175844, bsc#1173470]
- Add patches:
  * openssl-DH.patch
  * openssl-kdf-selftest.patch
  * openssl-kdf-tls-selftest.patch
  * openssl-kdf-ssh-selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1599566400">- Add shared secret KAT to FIPS DH selftest [bsc#1175844]
  * add openssl-fips-DH_selftest_shared_secret_KAT.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1602158400">- Restore private key check in EC_KEY_check_key [bsc#1177479]
  * Update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614686400">- Fix unresolved error codes [bsc#1182959]
- Update openssl-1.1.1-fips.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
</package>
<package pkgid="8fff34089ea6b9925eeb727213b13bd64966bfef35dbd8e73de82133d374eca2" name="libopenssl-1_1-devel" arch="aarch64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.51.1"/>
  <changelog author="vcizek@suse.com" date="1599566400">- Add shared secret KAT to FIPS DH selftest [bsc#1175844]
  * add openssl-fips-DH_selftest_shared_secret_KAT.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1602158400">- Restore private key check in EC_KEY_check_key [bsc#1177479]
  * Update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614686400">- Fix unresolved error codes [bsc#1182959]
- Update openssl-1.1.1-fips.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
</package>
<package pkgid="8a076299e3462f47acea26adc4146c58b40ecfde396d2aa49bd8ff515b7da8d5" name="libopenssl-1_1-devel" arch="x86_64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.51.1"/>
  <changelog author="vcizek@suse.com" date="1599566400">- Add shared secret KAT to FIPS DH selftest [bsc#1175844]
  * add openssl-fips-DH_selftest_shared_secret_KAT.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1602158400">- Restore private key check in EC_KEY_check_key [bsc#1177479]
  * Update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614686400">- Fix unresolved error codes [bsc#1182959]
- Update openssl-1.1.1-fips.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
</package>
<package pkgid="9ebd926d3f830f19a4bce29156a8053cb238f9af6f531837c012ba8d2bfefc52" name="libopenssl1_1" arch="aarch64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.48.1"/>
  <changelog author="pmonreal@suse.com" date="1598529600">- Include ECDH/DH Requirements from SP800-56Arev3 [bsc#1175844, bsc#1173470]
- Add patches:
  * openssl-DH.patch
  * openssl-kdf-selftest.patch
  * openssl-kdf-tls-selftest.patch
  * openssl-kdf-ssh-selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1599566400">- Add shared secret KAT to FIPS DH selftest [bsc#1175844]
  * add openssl-fips-DH_selftest_shared_secret_KAT.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1602158400">- Restore private key check in EC_KEY_check_key [bsc#1177479]
  * Update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614686400">- Fix unresolved error codes [bsc#1182959]
- Update openssl-1.1.1-fips.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
</package>
<package pkgid="a365c108bd4f8563afc422b312c31ea11f32bde7d31d2a744825084f3ad3cbca" name="libopenssl1_1" arch="x86_64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.48.1"/>
  <changelog author="pmonreal@suse.com" date="1598529600">- Include ECDH/DH Requirements from SP800-56Arev3 [bsc#1175844, bsc#1173470]
- Add patches:
  * openssl-DH.patch
  * openssl-kdf-selftest.patch
  * openssl-kdf-tls-selftest.patch
  * openssl-kdf-ssh-selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1599566400">- Add shared secret KAT to FIPS DH selftest [bsc#1175844]
  * add openssl-fips-DH_selftest_shared_secret_KAT.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1602158400">- Restore private key check in EC_KEY_check_key [bsc#1177479]
  * Update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614686400">- Fix unresolved error codes [bsc#1182959]
- Update openssl-1.1.1-fips.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
</package>
<package pkgid="7c3acd1db20f413fa0b31473fa682b6d2813791c993e605634e24a891b169a10" name="libopenssl1_1" arch="aarch64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.51.1"/>
  <changelog author="vcizek@suse.com" date="1599566400">- Add shared secret KAT to FIPS DH selftest [bsc#1175844]
  * add openssl-fips-DH_selftest_shared_secret_KAT.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1602158400">- Restore private key check in EC_KEY_check_key [bsc#1177479]
  * Update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614686400">- Fix unresolved error codes [bsc#1182959]
- Update openssl-1.1.1-fips.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
</package>
<package pkgid="8ad86e13e121e1f8bb30eca4e0d3a3b6c7aa60b25aa0c262c0168e577a91f24b" name="libopenssl1_1" arch="x86_64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.51.1"/>
  <changelog author="vcizek@suse.com" date="1599566400">- Add shared secret KAT to FIPS DH selftest [bsc#1175844]
  * add openssl-fips-DH_selftest_shared_secret_KAT.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1602158400">- Restore private key check in EC_KEY_check_key [bsc#1177479]
  * Update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614686400">- Fix unresolved error codes [bsc#1182959]
- Update openssl-1.1.1-fips.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
</package>
<package pkgid="8a6f6ee0e4bdc9f257b287f378cb735e1cddb75b5dfea29260a247540ed9cda9" name="libopenssl1_1-hmac" arch="aarch64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.48.1"/>
  <changelog author="pmonreal@suse.com" date="1598529600">- Include ECDH/DH Requirements from SP800-56Arev3 [bsc#1175844, bsc#1173470]
- Add patches:
  * openssl-DH.patch
  * openssl-kdf-selftest.patch
  * openssl-kdf-tls-selftest.patch
  * openssl-kdf-ssh-selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1599566400">- Add shared secret KAT to FIPS DH selftest [bsc#1175844]
  * add openssl-fips-DH_selftest_shared_secret_KAT.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1602158400">- Restore private key check in EC_KEY_check_key [bsc#1177479]
  * Update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614686400">- Fix unresolved error codes [bsc#1182959]
- Update openssl-1.1.1-fips.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
</package>
<package pkgid="21975e8495542f9a45d706e79d5b92048f1673e28b88782b1042736e66887c6b" name="libopenssl1_1-hmac" arch="x86_64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.48.1"/>
  <changelog author="pmonreal@suse.com" date="1598529600">- Include ECDH/DH Requirements from SP800-56Arev3 [bsc#1175844, bsc#1173470]
- Add patches:
  * openssl-DH.patch
  * openssl-kdf-selftest.patch
  * openssl-kdf-tls-selftest.patch
  * openssl-kdf-ssh-selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1599566400">- Add shared secret KAT to FIPS DH selftest [bsc#1175844]
  * add openssl-fips-DH_selftest_shared_secret_KAT.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1602158400">- Restore private key check in EC_KEY_check_key [bsc#1177479]
  * Update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614686400">- Fix unresolved error codes [bsc#1182959]
- Update openssl-1.1.1-fips.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
</package>
<package pkgid="8031867f6098e6a48691bfa1c1f739602eaabb0212a30aaa59e7ef66b081582f" name="libopenssl1_1-hmac" arch="aarch64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.51.1"/>
  <changelog author="vcizek@suse.com" date="1599566400">- Add shared secret KAT to FIPS DH selftest [bsc#1175844]
  * add openssl-fips-DH_selftest_shared_secret_KAT.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1602158400">- Restore private key check in EC_KEY_check_key [bsc#1177479]
  * Update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614686400">- Fix unresolved error codes [bsc#1182959]
- Update openssl-1.1.1-fips.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
</package>
<package pkgid="87ba4bbdc9b2febfe438752c096c61cd4898b52935fbb76636dc61a927c85534" name="libopenssl1_1-hmac" arch="x86_64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.51.1"/>
  <changelog author="vcizek@suse.com" date="1599566400">- Add shared secret KAT to FIPS DH selftest [bsc#1175844]
  * add openssl-fips-DH_selftest_shared_secret_KAT.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1602158400">- Restore private key check in EC_KEY_check_key [bsc#1177479]
  * Update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614686400">- Fix unresolved error codes [bsc#1182959]
- Update openssl-1.1.1-fips.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
</package>
<package pkgid="44baf160c75e035604aef0227eac67c0c468a545b5ca1493d1528ebf9069794a" name="libp11-kit0" arch="aarch64">
  <version epoch="0" ver="0.23.2" rel="150000.4.16.1"/>
  <changelog author="lnussel@suse.de" date="1413201600">- remove patches:
  * trust-Print-label-of-certificate-when-complaining-.patch
  * trust-Dont-use-invalid-public-keys-for-looking-up-.patch
- new version 0.20.7 (stable)
  * New public pkcs11x.h header containing extensions [fdo#83495]
  * Export necessary defines to lookup attached extensions [fdo#83495]
  * Build fixes
- new version 0.20.6 (stable)
  * Make the p11-kit-proxy.so module respect critical = no [fdo#83651]
  * Build fix for FreeBSD [fdo#75674]
- new version 0.20.5 (stable)
  * Don't use invalid keys for looking up stapled extensions [fdo#82328]
  * Better error messages when invalid certificate extensions
  * Fix parsing of some odd OpenSSL TRUSTED CERTIFICATE files
  * Fix some leaks, and memory issues
  * Silence some clang scanner warnings
- new version 0.20.4 (stable)
  * Don't complain about C_Finalize after a fork
  * Fix typo</changelog>
  <changelog author="p.drouand@gmail.com" date="1425816000">- Update to version 0.23.1 (stable)
  * Use new PKCS#11 URI draft fields for URIs [fdo#86474 fdo#87582]
  * Add pem-directory-hash extract format
  * Build fixes
- Remove 0001-trust-allow-to-also-add-openssl-style-hashes-to-pem-d.diff;
  fixed on upstream release
- Remove autoconf, automake and libtool require; unneeded dependencies
- Add gtk-doc require; needed to build html documentation
- Remove redundant %clean section</changelog>
  <changelog author="mpluskal@suse.com" date="1454932800">- Update to 0.23.2
  * Fix forking issues with libffi
  * Fix various crashes in corner cases
  * Updated translations
  * Build fixes
- Make building more verbose
- Enable tests
- Small spec file cleanup with spec-cleaner</changelog>
  <changelog author="sbrabec@suse.com" date="1479816000">- 32-bit compatibility fixes:
  * Add PKCS11 module to p11-kit-32bit (bsc#996047#c39)
  * Add p11-kit-nss-trust-32bit NSS module
  * Fix potential bi-arch issue with private binaries
    (fdo#98817, p11-kit-biarch.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1521547200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="lnussel@suse.de" date="1573819200">- support loading NSS attribute CKA_NSS_MOZILLA_CA_POLICY so Firefox
  detects built in certificates (boo#1154871,
  0001-Fix-a-typo-in-x-cetrificate-value-see-also-https-bug.patch,
  0001-Support-loading-new-NSS-attribute-CKA_NSS_MOZILLA_CA.patch)</changelog>
  <changelog author="lnussel@suse.de" date="1577102400">- Also build documentation (boo#1013125)</changelog>
  <changelog author="lnussel@suse.de" date="1626782400">- Add support for CKA_NSS_{SERVER,EMAIL}_DISTRUST_AFTER (bsc#1187993,
  0001-trust-Support-CKA_NSS_-SERVER-EMAIL-_DISTRUST_AFTER.patch)
- add bcond to spec file to enable debug easily</changelog>
  <changelog author="meissner@suse.com" date="1638878400">- 0001-common-Use-reallocarray-instead-of-realloc-as-approp.patch
  0001-Check-for-arithmetic-overflows-before-allocating.patch
  0001-Follow-up-to-arithmetic-overflow-fix.patch:
  Fixed multiple integer overflows in rpc code (bsc#1180064
  CVE-2020-29361)</changelog>
  <changelog author="meissner@suse.com" date="1657800000">- CVE-2020-29362: Fixed a 4 byte overread (bsc#1180065)
  Added p11-kit-CVE-2020-29362.patch:</changelog>
</package>
<package pkgid="91f832cd113d3ad981496eb7aa8b9182ad211bc8a12d14f840d913d4781319bc" name="libp11-kit0" arch="x86_64">
  <version epoch="0" ver="0.23.2" rel="150000.4.16.1"/>
  <changelog author="lnussel@suse.de" date="1413201600">- remove patches:
  * trust-Print-label-of-certificate-when-complaining-.patch
  * trust-Dont-use-invalid-public-keys-for-looking-up-.patch
- new version 0.20.7 (stable)
  * New public pkcs11x.h header containing extensions [fdo#83495]
  * Export necessary defines to lookup attached extensions [fdo#83495]
  * Build fixes
- new version 0.20.6 (stable)
  * Make the p11-kit-proxy.so module respect critical = no [fdo#83651]
  * Build fix for FreeBSD [fdo#75674]
- new version 0.20.5 (stable)
  * Don't use invalid keys for looking up stapled extensions [fdo#82328]
  * Better error messages when invalid certificate extensions
  * Fix parsing of some odd OpenSSL TRUSTED CERTIFICATE files
  * Fix some leaks, and memory issues
  * Silence some clang scanner warnings
- new version 0.20.4 (stable)
  * Don't complain about C_Finalize after a fork
  * Fix typo</changelog>
  <changelog author="p.drouand@gmail.com" date="1425816000">- Update to version 0.23.1 (stable)
  * Use new PKCS#11 URI draft fields for URIs [fdo#86474 fdo#87582]
  * Add pem-directory-hash extract format
  * Build fixes
- Remove 0001-trust-allow-to-also-add-openssl-style-hashes-to-pem-d.diff;
  fixed on upstream release
- Remove autoconf, automake and libtool require; unneeded dependencies
- Add gtk-doc require; needed to build html documentation
- Remove redundant %clean section</changelog>
  <changelog author="mpluskal@suse.com" date="1454932800">- Update to 0.23.2
  * Fix forking issues with libffi
  * Fix various crashes in corner cases
  * Updated translations
  * Build fixes
- Make building more verbose
- Enable tests
- Small spec file cleanup with spec-cleaner</changelog>
  <changelog author="sbrabec@suse.com" date="1479816000">- 32-bit compatibility fixes:
  * Add PKCS11 module to p11-kit-32bit (bsc#996047#c39)
  * Add p11-kit-nss-trust-32bit NSS module
  * Fix potential bi-arch issue with private binaries
    (fdo#98817, p11-kit-biarch.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1521547200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="lnussel@suse.de" date="1573819200">- support loading NSS attribute CKA_NSS_MOZILLA_CA_POLICY so Firefox
  detects built in certificates (boo#1154871,
  0001-Fix-a-typo-in-x-cetrificate-value-see-also-https-bug.patch,
  0001-Support-loading-new-NSS-attribute-CKA_NSS_MOZILLA_CA.patch)</changelog>
  <changelog author="lnussel@suse.de" date="1577102400">- Also build documentation (boo#1013125)</changelog>
  <changelog author="lnussel@suse.de" date="1626782400">- Add support for CKA_NSS_{SERVER,EMAIL}_DISTRUST_AFTER (bsc#1187993,
  0001-trust-Support-CKA_NSS_-SERVER-EMAIL-_DISTRUST_AFTER.patch)
- add bcond to spec file to enable debug easily</changelog>
  <changelog author="meissner@suse.com" date="1638878400">- 0001-common-Use-reallocarray-instead-of-realloc-as-approp.patch
  0001-Check-for-arithmetic-overflows-before-allocating.patch
  0001-Follow-up-to-arithmetic-overflow-fix.patch:
  Fixed multiple integer overflows in rpc code (bsc#1180064
  CVE-2020-29361)</changelog>
  <changelog author="meissner@suse.com" date="1657800000">- CVE-2020-29362: Fixed a 4 byte overread (bsc#1180065)
  Added p11-kit-CVE-2020-29362.patch:</changelog>
</package>
<package pkgid="1a5b73f0df7e61b0e73f4241291abb1911c61ad17fbb40f3e6401daa4fdef51c" name="libpcre1" arch="aarch64">
  <version epoch="0" ver="8.45" rel="150000.20.13.1"/>
  <changelog author="p.drouand@gmail.com" date="1425902400">- Update to version 3.16
  * This is primarily a bug-fix release.
  * The Unicode data tables have been updated to Unicode 7.0.0.
- Remove pcre-commit1472.patch; fixed on upstream release
- Remove obsolete "Obsoletes" tag</changelog>
  <changelog author="astieger@suse.com" date="1430395200">- pcre 8.37:
  * CVE-2015-2325: Patterns with certain groups specifying a zero
    minimum quantifier caused incorrect code to be compiled,
    leading to an incorrect memory read. [boo#924960]
  * CVE-2015-2326: Specific patterns containing a forward reference
    with subroutine calls caused incorrect code to be compiled
    [boo#924961]
  * CVE-2014-8964: If an assertion condition was quantified with a
    minimum of zero, SIGSEGV or other misbehaviour could occur.
    [boo#906574]
  * further bug fixes as listed in ChangeLog</changelog>
  <changelog author="astieger@suse.com" date="1448539200">- pcre 8.38:
  * CVE-2015-3217: Call Stack Overflow Vulnerability in match()
    bsc#933878
  * Other fixes to assertions, crashes, buffer overflows and
    performance issues found by fuzzer, affecting applications
    accepting regular expression from untrusted sources</changelog>
  <changelog author="mpluskal@suse.com" date="1465992000">- Update to version 8.39:
  * Some appropriate PCRE2 JIT improvements have been retro-fitted
    to PCRE1.
  * CVE-2016-3191: workspace overflow for (*ACCEPT) with deeply
    nested parentheses (boo#971741)
  * CVE-2016-1283: Heap buffer overflow DoS (boo#960837)
  * Apart from that, this is another bug-fix release.</changelog>
  <changelog author="astieger@suse.com" date="1470052800">- record minor vulnerabilities fixed in 8.39</changelog>
  <changelog author="dimstar@opensuse.org" date="1486468800">- Explicitly package %{_docdir}/%{name} to fix build with RPM 4.13.</changelog>
  <changelog author="astieger@suse.com" date="1486641600">- pcre 8.40:
  * Using -o with -M in pcregrep could cause unnecessary repeated
    output when the match extended over a line boundary.
  * Fix register overwite in JIT when SSE2 acceleration is enabled.
  * Ignore "show all captures" (/=) for DFA matching.
  * Fix JIT unaligned accesses on x86
  * In any wide-character mode (8-bit UTF or any 16-bit or 32-bit
    mode), without PCRE_UCP set, a negative character type such as
    \D in a positive class should cause all characters greater than
    255 to match, whatever else is in the class. There was a bug
    that caused this not to happen if a Unicode property item was
    added to such a class, for example [\D\P{Nd}] or [\W\pL].
  * When pcretest was outputing information from a callout, the
    caret indicator for the current position in the subject line
    was incorrect if it was after an escape sequence for a
    character whose code point was greater than \x{ff}.
  * A pattern such as (?&lt;RA&gt;abc)(?(R)xyz) was incorrectly compiled
    such that the conditional was interpreted as a reference to
    capturing group 1 instead of a test for recursion. Any group
    whose name began with R was misinterpreted in this way. (The
    reference interpretation should only happen if the group's name
    is precisely "R".)
  * A number of bugs have been mended relating to match start-up
    optimizations when the first thing in a pattern is a positive
    lookahead. These all applied only when PCRE_NO_START_OPTIMIZE
    was *not* set:
    + A pattern such as (?=.*X)X$ was incorrectly optimized as if
    it needed both an initial 'X' and a following 'X'.
    + Some patterns starting with an assertion that started with
    .* were incorrectly optimized as having to match at the start
    of the subject or after a newline. There are cases where this
    is not true, for example, (?=.*[A-Z])(?=.{8,16})(?!.*[\s])
    matches after the start in lines that start with spaces.
    Starting .* in an assertion is no longer taken as an
    indication of matching at the start (or after a newline).</changelog>
  <changelog author="mpluskal@suse.com" date="1496404800">- Enable jit on aarch64
- Enable profiled building</changelog>
  <changelog author="astieger@suse.com" date="1500984000">- pcre 8.41:
  * If pcregrep in multiline mode with --only-matching matched
    several lines, it restarted scanning at the next line instead
    of moving on to the end of the matched string, which can be
    several lines after the start.
  * Fix a missing else in the JIT compiler reported by 'idaifish'.
    CVE-2017-6004 bsc#1025709
  * A (?# style comment is now ignored between a basic quantifier
    and a following '+' or '?' (example: /X+(?#comment)?Y/.
  * Avoid use of a potentially overflowing buffer in pcregrep
  * Fix issues reported by fuzzers in pcretest:
  - Check for values &lt; 256 when calling isprint() in pcretest.
  - Give an error for too big a number after \O.
  * In the 32-bit library in non-UTF mode, an attempt to find a
    Unicode property for a character with a code point greater than
    0x10ffff (the Unicode maximum) caused a crash.
    CVE-2017-7186 bsc#1030066, CVE-2017-7244 bsc#1030807
  * The alternative matching function, pcre_dfa_exec() misbehaved
    if it encountered a character class with a possessive repeat,
    for example [a-f]{3}+.
  * When pcretest called pcre_copy_substring() in 32-bit mode, it
    set the buffer length incorrectly, which could result in buffer
    overflow. CVE-2017-7245 bsc#1030805, CVE-2017-7246 bsc#1030803</changelog>
  <changelog author="matz@suse.com" date="1505217600">- RunTest needs much stack, on s390x more than the default
  8 MB.  [bnc#1046102]</changelog>
  <changelog author="kstreitova@suse.com" date="1509537600">- add pcre-8.41-stack_frame_size_detection.patch to fix pcre stack
  frame size detection because modern compilers broke it by cloning
  and inlining pcre match() function [bsc#1058722]</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="bwiedemann@suse.com" date="1620734400">- Do not run profiling 'check' in parallel
  to make package build reproducible (boo#1040589)</changelog>
  <changelog author="coolo@suse.com" date="1634644800">- pcre 8.45 (the final release)
  * Fixed a small (*MARK) bug in the interpreter (Bugzilla #2771).
- pcre 8.44
  * Small patch to pcreposix.c to set the erroroffset field to -1 immediately
  after a successful compile, instead of at the start of matching to avoid a
  sanitizer complaint (regexec is supposed to be thread safe).
  * Check the size of the number after (?C as it is read, in order to avoid
  integer overflow. (bsc#1172974, CVE-2020-14155)
  * Tidy up left shifts to avoid sanitize warnings; also fix one NULL deference
  in pcretest.
- pcre 8.43
  * In a pattern such as /[^\x{100}-\x{ffff}]*[\x80-\xff]/ which has a repeated
  negative class with no characters less than 0x100 followed by a positive class
  with only characters less than 0x100, the first class was incorrectly being
  auto-possessified, causing incorrect match failures.
  * If the only branch in a conditional subpattern was anchored, the whole
  subpattern was treated as anchored, when it should not have been, since the
  assumed empty second branch cannot be anchored. Demonstrated by test patterns
  such as /(?(1)^())b/ or /(?(?=^))b/.
  * Fix subject buffer overread in JIT when UTF is disabled and \X or \R has
  a greater than 1 fixed quantifier. This issue was found by Yunho Kim.
  (bsc#1172973 CVE-2019-20838)
  * If a pattern started with a subroutine call that had a quantifier with a
  minimum of zero, an incorrect "match must start with this character" could be
  recorded. Example: /(?&amp;xxx)*ABC(?&lt;xxx&gt;XYZ)/ would (incorrectly) expect 'A' to
  be the first character of a match.
- pcre 8.42
  * If a backreference with a minimum repeat count of zero was first in a
  pattern, apart from assertions, an incorrect first matching character could be
  recorded. For example, for the pattern /(?=(a))\1?b/, "b" was incorrectly set
  as the first character of a match.
  * Fix out-of-bounds read for partial matching of /./ against an empty string
  when the newline type is CRLF.
  * When matching using the the REG_STARTEND feature of the POSIX API with a
  non-zero starting offset, unset capturing groups with lower numbers than a
  group that did capture something were not being correctly returned as "unset"
  (that is, with offset values of -1).
  * Matching the pattern /(*UTF)\C[^\v]+\x80/ against an 8-bit string
  containing multi-code-unit characters caused bad behaviour and possibly a
  crash. This issue was fixed for other kinds of repeat in release 8.37 by change
  38, but repeating character classes were overlooked.</changelog>
  <changelog author="jsikes@suse.com" date="1652270400">- Added pcre-8.45-bsc1199232-unicode-property-matching.patch
  * bsc#1199232
  * CVE-2022-1586
  * Fixes unicode property matching issue</changelog>
</package>
<package pkgid="7ec244571a2a1237e11f045b60341a955c7bd3c96d98e7d1aa993edd236b8dfe" name="libpcre1" arch="x86_64">
  <version epoch="0" ver="8.45" rel="150000.20.13.1"/>
  <changelog author="p.drouand@gmail.com" date="1425902400">- Update to version 3.16
  * This is primarily a bug-fix release.
  * The Unicode data tables have been updated to Unicode 7.0.0.
- Remove pcre-commit1472.patch; fixed on upstream release
- Remove obsolete "Obsoletes" tag</changelog>
  <changelog author="astieger@suse.com" date="1430395200">- pcre 8.37:
  * CVE-2015-2325: Patterns with certain groups specifying a zero
    minimum quantifier caused incorrect code to be compiled,
    leading to an incorrect memory read. [boo#924960]
  * CVE-2015-2326: Specific patterns containing a forward reference
    with subroutine calls caused incorrect code to be compiled
    [boo#924961]
  * CVE-2014-8964: If an assertion condition was quantified with a
    minimum of zero, SIGSEGV or other misbehaviour could occur.
    [boo#906574]
  * further bug fixes as listed in ChangeLog</changelog>
  <changelog author="astieger@suse.com" date="1448539200">- pcre 8.38:
  * CVE-2015-3217: Call Stack Overflow Vulnerability in match()
    bsc#933878
  * Other fixes to assertions, crashes, buffer overflows and
    performance issues found by fuzzer, affecting applications
    accepting regular expression from untrusted sources</changelog>
  <changelog author="mpluskal@suse.com" date="1465992000">- Update to version 8.39:
  * Some appropriate PCRE2 JIT improvements have been retro-fitted
    to PCRE1.
  * CVE-2016-3191: workspace overflow for (*ACCEPT) with deeply
    nested parentheses (boo#971741)
  * CVE-2016-1283: Heap buffer overflow DoS (boo#960837)
  * Apart from that, this is another bug-fix release.</changelog>
  <changelog author="astieger@suse.com" date="1470052800">- record minor vulnerabilities fixed in 8.39</changelog>
  <changelog author="dimstar@opensuse.org" date="1486468800">- Explicitly package %{_docdir}/%{name} to fix build with RPM 4.13.</changelog>
  <changelog author="astieger@suse.com" date="1486641600">- pcre 8.40:
  * Using -o with -M in pcregrep could cause unnecessary repeated
    output when the match extended over a line boundary.
  * Fix register overwite in JIT when SSE2 acceleration is enabled.
  * Ignore "show all captures" (/=) for DFA matching.
  * Fix JIT unaligned accesses on x86
  * In any wide-character mode (8-bit UTF or any 16-bit or 32-bit
    mode), without PCRE_UCP set, a negative character type such as
    \D in a positive class should cause all characters greater than
    255 to match, whatever else is in the class. There was a bug
    that caused this not to happen if a Unicode property item was
    added to such a class, for example [\D\P{Nd}] or [\W\pL].
  * When pcretest was outputing information from a callout, the
    caret indicator for the current position in the subject line
    was incorrect if it was after an escape sequence for a
    character whose code point was greater than \x{ff}.
  * A pattern such as (?&lt;RA&gt;abc)(?(R)xyz) was incorrectly compiled
    such that the conditional was interpreted as a reference to
    capturing group 1 instead of a test for recursion. Any group
    whose name began with R was misinterpreted in this way. (The
    reference interpretation should only happen if the group's name
    is precisely "R".)
  * A number of bugs have been mended relating to match start-up
    optimizations when the first thing in a pattern is a positive
    lookahead. These all applied only when PCRE_NO_START_OPTIMIZE
    was *not* set:
    + A pattern such as (?=.*X)X$ was incorrectly optimized as if
    it needed both an initial 'X' and a following 'X'.
    + Some patterns starting with an assertion that started with
    .* were incorrectly optimized as having to match at the start
    of the subject or after a newline. There are cases where this
    is not true, for example, (?=.*[A-Z])(?=.{8,16})(?!.*[\s])
    matches after the start in lines that start with spaces.
    Starting .* in an assertion is no longer taken as an
    indication of matching at the start (or after a newline).</changelog>
  <changelog author="mpluskal@suse.com" date="1496404800">- Enable jit on aarch64
- Enable profiled building</changelog>
  <changelog author="astieger@suse.com" date="1500984000">- pcre 8.41:
  * If pcregrep in multiline mode with --only-matching matched
    several lines, it restarted scanning at the next line instead
    of moving on to the end of the matched string, which can be
    several lines after the start.
  * Fix a missing else in the JIT compiler reported by 'idaifish'.
    CVE-2017-6004 bsc#1025709
  * A (?# style comment is now ignored between a basic quantifier
    and a following '+' or '?' (example: /X+(?#comment)?Y/.
  * Avoid use of a potentially overflowing buffer in pcregrep
  * Fix issues reported by fuzzers in pcretest:
  - Check for values &lt; 256 when calling isprint() in pcretest.
  - Give an error for too big a number after \O.
  * In the 32-bit library in non-UTF mode, an attempt to find a
    Unicode property for a character with a code point greater than
    0x10ffff (the Unicode maximum) caused a crash.
    CVE-2017-7186 bsc#1030066, CVE-2017-7244 bsc#1030807
  * The alternative matching function, pcre_dfa_exec() misbehaved
    if it encountered a character class with a possessive repeat,
    for example [a-f]{3}+.
  * When pcretest called pcre_copy_substring() in 32-bit mode, it
    set the buffer length incorrectly, which could result in buffer
    overflow. CVE-2017-7245 bsc#1030805, CVE-2017-7246 bsc#1030803</changelog>
  <changelog author="matz@suse.com" date="1505217600">- RunTest needs much stack, on s390x more than the default
  8 MB.  [bnc#1046102]</changelog>
  <changelog author="kstreitova@suse.com" date="1509537600">- add pcre-8.41-stack_frame_size_detection.patch to fix pcre stack
  frame size detection because modern compilers broke it by cloning
  and inlining pcre match() function [bsc#1058722]</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="bwiedemann@suse.com" date="1620734400">- Do not run profiling 'check' in parallel
  to make package build reproducible (boo#1040589)</changelog>
  <changelog author="coolo@suse.com" date="1634644800">- pcre 8.45 (the final release)
  * Fixed a small (*MARK) bug in the interpreter (Bugzilla #2771).
- pcre 8.44
  * Small patch to pcreposix.c to set the erroroffset field to -1 immediately
  after a successful compile, instead of at the start of matching to avoid a
  sanitizer complaint (regexec is supposed to be thread safe).
  * Check the size of the number after (?C as it is read, in order to avoid
  integer overflow. (bsc#1172974, CVE-2020-14155)
  * Tidy up left shifts to avoid sanitize warnings; also fix one NULL deference
  in pcretest.
- pcre 8.43
  * In a pattern such as /[^\x{100}-\x{ffff}]*[\x80-\xff]/ which has a repeated
  negative class with no characters less than 0x100 followed by a positive class
  with only characters less than 0x100, the first class was incorrectly being
  auto-possessified, causing incorrect match failures.
  * If the only branch in a conditional subpattern was anchored, the whole
  subpattern was treated as anchored, when it should not have been, since the
  assumed empty second branch cannot be anchored. Demonstrated by test patterns
  such as /(?(1)^())b/ or /(?(?=^))b/.
  * Fix subject buffer overread in JIT when UTF is disabled and \X or \R has
  a greater than 1 fixed quantifier. This issue was found by Yunho Kim.
  (bsc#1172973 CVE-2019-20838)
  * If a pattern started with a subroutine call that had a quantifier with a
  minimum of zero, an incorrect "match must start with this character" could be
  recorded. Example: /(?&amp;xxx)*ABC(?&lt;xxx&gt;XYZ)/ would (incorrectly) expect 'A' to
  be the first character of a match.
- pcre 8.42
  * If a backreference with a minimum repeat count of zero was first in a
  pattern, apart from assertions, an incorrect first matching character could be
  recorded. For example, for the pattern /(?=(a))\1?b/, "b" was incorrectly set
  as the first character of a match.
  * Fix out-of-bounds read for partial matching of /./ against an empty string
  when the newline type is CRLF.
  * When matching using the the REG_STARTEND feature of the POSIX API with a
  non-zero starting offset, unset capturing groups with lower numbers than a
  group that did capture something were not being correctly returned as "unset"
  (that is, with offset values of -1).
  * Matching the pattern /(*UTF)\C[^\v]+\x80/ against an 8-bit string
  containing multi-code-unit characters caused bad behaviour and possibly a
  crash. This issue was fixed for other kinds of repeat in release 8.37 by change
  38, but repeating character classes were overlooked.</changelog>
  <changelog author="jsikes@suse.com" date="1652270400">- Added pcre-8.45-bsc1199232-unicode-property-matching.patch
  * bsc#1199232
  * CVE-2022-1586
  * Fixes unicode property matching issue</changelog>
</package>
<package pkgid="734d6768f8e20914ccec6ff39ed3e10a244a4b6047d90dddfbc8c6cde568832b" name="libpcre2-8-0" arch="aarch64">
  <version epoch="0" ver="10.31" rel="150000.3.12.1"/>
  <changelog author="p.drouand@gmail.com" date="1425902400">- Update to version 3.16
  * This is primarily a bug-fix release.
  * The Unicode data tables have been updated to Unicode 7.0.0.
- Remove pcre-commit1472.patch; fixed on upstream release
- Remove obsolete "Obsoletes" tag</changelog>
  <changelog author="astieger@suse.com" date="1430395200">- pcre 8.37:
  * CVE-2015-2325: Patterns with certain groups specifying a zero
    minimum quantifier caused incorrect code to be compiled,
    leading to an incorrect memory read. [boo#924960]
  * CVE-2015-2326: Specific patterns containing a forward reference
    with subroutine calls caused incorrect code to be compiled
    [boo#924961]
  * CVE-2014-8964: If an assertion condition was quantified with a
    minimum of zero, SIGSEGV or other misbehaviour could occur.
    [boo#906574]
  * further bug fixes as listed in ChangeLog</changelog>
  <changelog author="astieger@suse.com" date="1434628800">- PCRE2, a re-working of the original PCRE library to provide an
  entirely new API, version 10.10. Not source compatible.
- copy of the pcre package, with the following adjustments:
  * required name changes
  * adjust pcre-8.21-multilib.patch to pcre2-10.10-multilib.patch
  * drop upstreamed pcre-8.32-visibility.patch
  * --enable-{utf8,unicode-properties} became --enable-unicode
  * drop cpp subpackage
  * make test -&gt; check
  * enable 32 bit character support</changelog>
  <changelog author="astieger@suse.com" date="1436875200">- PCRE2 10.20:
  * Callouts with string arguments and the
    pcre2_callout_enumerate() function have been implemented.
  * The PCRE2_NEVER_BACKSLASH_C option, which locks out the use of
    \C, is added.
  * The PCRE2_ALT_CIRCUMFLEX option lets ^ match after a newline at
    the end of a subject in multiline mode.
  * The way named subpatterns are handled has been refactored. The
    previous approach had several bugs.
  * The handling of \c in EBCDIC environments has been changed to
    conform to the perlebcdic document. (Incompatible change)
  * Bugs have been mended, many of them discovered by fuzzers.</changelog>
  <changelog author="jengelh@inai.de" date="1453032000">- Update to new upstream release 10.21
  * Improve JIT matching speed of patterns starting with + or *.
  * Use memchr() to find the first character in an unanchored match
  in 8-bit mode in the interpreter. This gives a significant speed
  improvement.
  * 10.20 broke the handling of [[:&gt;:]] and [[:&lt;:]] in that
  processing them could involve a buffer overflow if the
  following character was an opening parenthesis.
  * 10.20 also introduced a bug in processing this pattern:
  /((?x)(*:0))#(?'/, which was fixed.
  * A callout with a string argument containing an opening square
  bracket, for example /(?C$[$)(?&lt;]/, was incorrectly processed and
  could provoke a buffer overflow.
  * A possessively repeated conditional group that could match an empty
  string, for example, /(?(R))*+/, was incorrectly compiled.
  * The Unicode tables have been updated to Unicode 8.0.0.
  * An empty comment (?#) in a pattern was incorrectly processed and
  could provoke a buffer overflow.
  * Fix infinite recursion in the JIT compiler when certain patterns
  /such as (?:|a|){100}x/ are analysed.
  * Some patterns with character classes involving [: and \\ were
  incorrectly compiled and could cause reading from uninitialized
  memory or an incorrect error diagnosis. Examples are:
  /[[:\\](?&lt;[::]/ and /[[:\\](?'abc')[a:].
  * A missing closing parenthesis for a callout with a string argument
  was not being diagnosed, possibly leading to a buffer overflow.
  * If (?R was followed by - or + incorrect behaviour happened instead
  of a diagnostic.
  * Fixed an issue when \p{Any} inside an xclass did not read the current
  character.
  * About 80 more fixes, which you can read about in the ChangeLog
  shipped with the libpcre2-8-0 package.</changelog>
  <changelog author="astieger@suse.com" date="1470052800">- pcre2 10.22:
  * The POSIX wrapper function regcomp() did not used to
    support back references and subroutine calls if called with the
    REG_NOSUB option. It now does.
  * A new function, pcre2_code_copy(), is added, to make a copy of a
    compiled pattern.
  * Support for string callouts is added to pcre2grep.
  * Added the PCRE2_NO_JIT option to pcre2_match().
  * The pcre2_get_error_message() function now returns with a
    negative error code if the error number it is given is unknown.
  * Several updates have been made to pcre2test and test scripts
  * Fix CVE-2016-3191: workspace overflow for (*ACCEPT) with deeply
    nested parentheses (boo#971741)</changelog>
  <changelog author="dimstar@opensuse.org" date="1486468800">- Explicitly package %{_docdir}/%{name} to fix build with RPM 4.13.</changelog>
  <changelog author="astieger@suse.com" date="1487246400">- pcre2 10.23:
  * major re-factoring of the pcre2_compile.c file
  * Back references are now permitted in lookbehind assertions when
    there are no duplicated group numbers (that is, (?| has not
    been used), and, if the reference is by name, there is only one
    group of that name. The referenced group must, of course be of
    fixed length.
  * \g{+&lt;number&gt;} (e.g. \g{+2} ) is now supported. It is a "forward
    back reference" and can be useful in repetitions
    (compare \g{-&lt;number&gt;} ). Perl does not recognize this syntax.
  * pcre2grep now automatically expands its buffer up to a maximum
    set by --max-buffer-size.
  * The -t option (grand total) has been added to pcre2grep.
  * A new function called pcre2_code_copy_with_tables() exists to
    copy a compiled pattern along with a private copy of the
    character tables that is uses.</changelog>
  <changelog author="astieger@suse.com" date="1493726400">- pcre2grep can now read .gz and .bz2 files directly
- pcre2test is now built to support line editing</changelog>
  <changelog author="astieger@suse.com" date="1501934400">- fix SLE 11 build</changelog>
  <changelog author="jengelh@inai.de" date="1505131200">- Update to new upstream release 10.30
  * The main interpreter, pcre2_match(), has been refactored into
    a new version that does not use recursive function calls for
    remembering backtracking positions. The new implementation
    allows backtracking into recursive group calls in patterns,
    making it more compatible with Perl. For patterns that have a
    lot of backtracking, the heap is now used, and there is
    explicit limit on the amount, settable by
    pcre2_set_heap_limit(). The "recursion limit" is retained,
    but is renamed as "depth limit".
  * The new option PCRE2_ENDANCHORED insists that a pattern match
    must end at the end of the subject.
  * The new option PCRE2_EXTENDED_MORE implements Perl's /xx
    feature, and pcre2test is upgraded to support it. Setting
    within the pattern by (?xx) is Also supported.
  * (?n) can be used to set PCRE2_NO_AUTO_CAPTURE, because Perl
    now has this.
  * Additional pattern compile options in the compile context are
    now available: PCRE2_EXTRA_ALLOW_SURROGATE_ESCAPES and
    PCRE2_EXTRA_BAD_ESCAPE_IS LITERAL.
  * The newline type PCRE2_NEWLINE_NUL is now available.
  * The match limit value now also applies to pcre2_dfa_match()
    as there are patterns that can use up a lot of resources
    without necessarily recursing very deeply.
  * Various minor security fixes found by fuzzers:
    + bsc#1037165: crash for forward reference in lookbehind with
    PCRE2_ANCHORED
    + CVE-2017-8786: heap-based buffer overflow write in pcre2test
    (bsc#1036942)
    + CVE-2017-7186: DoS by triggering an invalid Unicode property
    lookup (bsc#1030066)
- Switch source URLs to use HTTP.</changelog>
  <changelog author="avindra@opensuse.org" date="1518955200">- Update to new upstream release 10.31
  * New pcre2_config() options: PCRE2_CONFIG_NEVER_BACKSLASH_C and
    PCRE2_CONFIG_COMPILED_WIDTHS.
  * New pcre2_pattern_info() option PCRE2_INFO_EXTRAOPTIONS to
    retrieve the extra compile time options.
  * Public names for all pcre2_compile() error numbers.
  * Added PCRE2_CALLOUT_STARTMATCH and PCRE2_CALLOUT_BACKTRACK
    bits to a new field callout_flags in callout blocks.
- use https for main site
- cleanup with spec-cleaner</changelog>
  <changelog author="jsikes@suse.com" date="1627128000">- Added 0001-Fixed-atomic-group-backtracking-bug.patch
  * bsc#1187937
  * PHP 7.6.4 on s390x returns different results for preg_match
    function as compared to older PHP versions and x86
  * Sourced from upstream subversion commit:
    $ svn log -r965 svn://vcs.pcre.org/pcre2/code/trunk</changelog>
  <changelog author="jsikes@suse.com" date="1651924800">- Added pcre2-10.31-bsc1199232-unicode-property-matching.patch
  * bsc#1199232 / CVE-2022-1586
  * Fixes unicode property matching issue</changelog>
  <changelog author="jsikes@suse.com" date="1658232000">- Added pcre2-Fix_crash_when_X_is_used_without_UTF_in_JIT.patch
  * CVE-2019-20454 / bsc#1164384
  * Fix crash when \X is used in non-UTF mode on certain inputs.
  * Sourced from:
  - https://github.com/PCRE2Project/pcre2/commit/342c16ecd31bd12fc350ee31d2dcc041832ebb3f
  - https://github.com/PCRE2Project/pcre2/commit/e118e60a68f03f38dd2ff3d16ca2e2e0d800e1d9</changelog>
  <changelog author="jsikes@suse.com" date="1658318400">- Added pcre2-bsc1199235-CVE-2022-1587.patch
  * CVE-2022-1587 / bsc#1199235
  * Fix out-of-bounds read due to bug in recursions
  * Sourced from:
  - https://github.com/PCRE2Project/pcre2/commit/03654e751e7f0700693526b67dfcadda6b42c9d0</changelog>
</package>
<package pkgid="c5107e90142763060eeafd0ceaf0111e3d0352baefdf0457205679fca24fa989" name="libpcre2-8-0" arch="x86_64">
  <version epoch="0" ver="10.31" rel="150000.3.12.1"/>
  <changelog author="p.drouand@gmail.com" date="1425902400">- Update to version 3.16
  * This is primarily a bug-fix release.
  * The Unicode data tables have been updated to Unicode 7.0.0.
- Remove pcre-commit1472.patch; fixed on upstream release
- Remove obsolete "Obsoletes" tag</changelog>
  <changelog author="astieger@suse.com" date="1430395200">- pcre 8.37:
  * CVE-2015-2325: Patterns with certain groups specifying a zero
    minimum quantifier caused incorrect code to be compiled,
    leading to an incorrect memory read. [boo#924960]
  * CVE-2015-2326: Specific patterns containing a forward reference
    with subroutine calls caused incorrect code to be compiled
    [boo#924961]
  * CVE-2014-8964: If an assertion condition was quantified with a
    minimum of zero, SIGSEGV or other misbehaviour could occur.
    [boo#906574]
  * further bug fixes as listed in ChangeLog</changelog>
  <changelog author="astieger@suse.com" date="1434628800">- PCRE2, a re-working of the original PCRE library to provide an
  entirely new API, version 10.10. Not source compatible.
- copy of the pcre package, with the following adjustments:
  * required name changes
  * adjust pcre-8.21-multilib.patch to pcre2-10.10-multilib.patch
  * drop upstreamed pcre-8.32-visibility.patch
  * --enable-{utf8,unicode-properties} became --enable-unicode
  * drop cpp subpackage
  * make test -&gt; check
  * enable 32 bit character support</changelog>
  <changelog author="astieger@suse.com" date="1436875200">- PCRE2 10.20:
  * Callouts with string arguments and the
    pcre2_callout_enumerate() function have been implemented.
  * The PCRE2_NEVER_BACKSLASH_C option, which locks out the use of
    \C, is added.
  * The PCRE2_ALT_CIRCUMFLEX option lets ^ match after a newline at
    the end of a subject in multiline mode.
  * The way named subpatterns are handled has been refactored. The
    previous approach had several bugs.
  * The handling of \c in EBCDIC environments has been changed to
    conform to the perlebcdic document. (Incompatible change)
  * Bugs have been mended, many of them discovered by fuzzers.</changelog>
  <changelog author="jengelh@inai.de" date="1453032000">- Update to new upstream release 10.21
  * Improve JIT matching speed of patterns starting with + or *.
  * Use memchr() to find the first character in an unanchored match
  in 8-bit mode in the interpreter. This gives a significant speed
  improvement.
  * 10.20 broke the handling of [[:&gt;:]] and [[:&lt;:]] in that
  processing them could involve a buffer overflow if the
  following character was an opening parenthesis.
  * 10.20 also introduced a bug in processing this pattern:
  /((?x)(*:0))#(?'/, which was fixed.
  * A callout with a string argument containing an opening square
  bracket, for example /(?C$[$)(?&lt;]/, was incorrectly processed and
  could provoke a buffer overflow.
  * A possessively repeated conditional group that could match an empty
  string, for example, /(?(R))*+/, was incorrectly compiled.
  * The Unicode tables have been updated to Unicode 8.0.0.
  * An empty comment (?#) in a pattern was incorrectly processed and
  could provoke a buffer overflow.
  * Fix infinite recursion in the JIT compiler when certain patterns
  /such as (?:|a|){100}x/ are analysed.
  * Some patterns with character classes involving [: and \\ were
  incorrectly compiled and could cause reading from uninitialized
  memory or an incorrect error diagnosis. Examples are:
  /[[:\\](?&lt;[::]/ and /[[:\\](?'abc')[a:].
  * A missing closing parenthesis for a callout with a string argument
  was not being diagnosed, possibly leading to a buffer overflow.
  * If (?R was followed by - or + incorrect behaviour happened instead
  of a diagnostic.
  * Fixed an issue when \p{Any} inside an xclass did not read the current
  character.
  * About 80 more fixes, which you can read about in the ChangeLog
  shipped with the libpcre2-8-0 package.</changelog>
  <changelog author="astieger@suse.com" date="1470052800">- pcre2 10.22:
  * The POSIX wrapper function regcomp() did not used to
    support back references and subroutine calls if called with the
    REG_NOSUB option. It now does.
  * A new function, pcre2_code_copy(), is added, to make a copy of a
    compiled pattern.
  * Support for string callouts is added to pcre2grep.
  * Added the PCRE2_NO_JIT option to pcre2_match().
  * The pcre2_get_error_message() function now returns with a
    negative error code if the error number it is given is unknown.
  * Several updates have been made to pcre2test and test scripts
  * Fix CVE-2016-3191: workspace overflow for (*ACCEPT) with deeply
    nested parentheses (boo#971741)</changelog>
  <changelog author="dimstar@opensuse.org" date="1486468800">- Explicitly package %{_docdir}/%{name} to fix build with RPM 4.13.</changelog>
  <changelog author="astieger@suse.com" date="1487246400">- pcre2 10.23:
  * major re-factoring of the pcre2_compile.c file
  * Back references are now permitted in lookbehind assertions when
    there are no duplicated group numbers (that is, (?| has not
    been used), and, if the reference is by name, there is only one
    group of that name. The referenced group must, of course be of
    fixed length.
  * \g{+&lt;number&gt;} (e.g. \g{+2} ) is now supported. It is a "forward
    back reference" and can be useful in repetitions
    (compare \g{-&lt;number&gt;} ). Perl does not recognize this syntax.
  * pcre2grep now automatically expands its buffer up to a maximum
    set by --max-buffer-size.
  * The -t option (grand total) has been added to pcre2grep.
  * A new function called pcre2_code_copy_with_tables() exists to
    copy a compiled pattern along with a private copy of the
    character tables that is uses.</changelog>
  <changelog author="astieger@suse.com" date="1493726400">- pcre2grep can now read .gz and .bz2 files directly
- pcre2test is now built to support line editing</changelog>
  <changelog author="astieger@suse.com" date="1501934400">- fix SLE 11 build</changelog>
  <changelog author="jengelh@inai.de" date="1505131200">- Update to new upstream release 10.30
  * The main interpreter, pcre2_match(), has been refactored into
    a new version that does not use recursive function calls for
    remembering backtracking positions. The new implementation
    allows backtracking into recursive group calls in patterns,
    making it more compatible with Perl. For patterns that have a
    lot of backtracking, the heap is now used, and there is
    explicit limit on the amount, settable by
    pcre2_set_heap_limit(). The "recursion limit" is retained,
    but is renamed as "depth limit".
  * The new option PCRE2_ENDANCHORED insists that a pattern match
    must end at the end of the subject.
  * The new option PCRE2_EXTENDED_MORE implements Perl's /xx
    feature, and pcre2test is upgraded to support it. Setting
    within the pattern by (?xx) is Also supported.
  * (?n) can be used to set PCRE2_NO_AUTO_CAPTURE, because Perl
    now has this.
  * Additional pattern compile options in the compile context are
    now available: PCRE2_EXTRA_ALLOW_SURROGATE_ESCAPES and
    PCRE2_EXTRA_BAD_ESCAPE_IS LITERAL.
  * The newline type PCRE2_NEWLINE_NUL is now available.
  * The match limit value now also applies to pcre2_dfa_match()
    as there are patterns that can use up a lot of resources
    without necessarily recursing very deeply.
  * Various minor security fixes found by fuzzers:
    + bsc#1037165: crash for forward reference in lookbehind with
    PCRE2_ANCHORED
    + CVE-2017-8786: heap-based buffer overflow write in pcre2test
    (bsc#1036942)
    + CVE-2017-7186: DoS by triggering an invalid Unicode property
    lookup (bsc#1030066)
- Switch source URLs to use HTTP.</changelog>
  <changelog author="avindra@opensuse.org" date="1518955200">- Update to new upstream release 10.31
  * New pcre2_config() options: PCRE2_CONFIG_NEVER_BACKSLASH_C and
    PCRE2_CONFIG_COMPILED_WIDTHS.
  * New pcre2_pattern_info() option PCRE2_INFO_EXTRAOPTIONS to
    retrieve the extra compile time options.
  * Public names for all pcre2_compile() error numbers.
  * Added PCRE2_CALLOUT_STARTMATCH and PCRE2_CALLOUT_BACKTRACK
    bits to a new field callout_flags in callout blocks.
- use https for main site
- cleanup with spec-cleaner</changelog>
  <changelog author="jsikes@suse.com" date="1627128000">- Added 0001-Fixed-atomic-group-backtracking-bug.patch
  * bsc#1187937
  * PHP 7.6.4 on s390x returns different results for preg_match
    function as compared to older PHP versions and x86
  * Sourced from upstream subversion commit:
    $ svn log -r965 svn://vcs.pcre.org/pcre2/code/trunk</changelog>
  <changelog author="jsikes@suse.com" date="1651924800">- Added pcre2-10.31-bsc1199232-unicode-property-matching.patch
  * bsc#1199232 / CVE-2022-1586
  * Fixes unicode property matching issue</changelog>
  <changelog author="jsikes@suse.com" date="1658232000">- Added pcre2-Fix_crash_when_X_is_used_without_UTF_in_JIT.patch
  * CVE-2019-20454 / bsc#1164384
  * Fix crash when \X is used in non-UTF mode on certain inputs.
  * Sourced from:
  - https://github.com/PCRE2Project/pcre2/commit/342c16ecd31bd12fc350ee31d2dcc041832ebb3f
  - https://github.com/PCRE2Project/pcre2/commit/e118e60a68f03f38dd2ff3d16ca2e2e0d800e1d9</changelog>
  <changelog author="jsikes@suse.com" date="1658318400">- Added pcre2-bsc1199235-CVE-2022-1587.patch
  * CVE-2022-1587 / bsc#1199235
  * Fix out-of-bounds read due to bug in recursions
  * Sourced from:
  - https://github.com/PCRE2Project/pcre2/commit/03654e751e7f0700693526b67dfcadda6b42c9d0</changelog>
</package>
<package pkgid="ab7fa5af3cf1b10698722e63d1a0b122ea67c399599710913647da0e84bba857" name="libpython3_6m1_0" arch="aarch64">
  <version epoch="0" ver="3.6.15" rel="150300.10.27.1"/>
  <changelog author="mcepl@suse.com" date="1626782400">- Use versioned python-Sphinx to avoid dependency on other
  version of Python (bsc#1183858).</changelog>
  <changelog author="mcepl@suse.com" date="1627300800">- Rebuild to get new headers, avoid building in support for
  stropts.h (bsc#1187338).</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1628596800">- Update to 3.6.14:
  * Security
  - bpo-44022 (bsc#1189241, CVE-2021-3737): mod:http.client now
    avoids infinitely reading potential HTTP headers after
    a 100 Continue status response from the server.
  - bpo-43882: The presence of newline or tab characters in parts
    of a URL could allow some forms of attacks.
    Following the controlling specification for URLs defined by
    WHATWG urllib.parse() now removes ASCII newlines and tabs
    from URLs, preventing such attacks.
  - bpo-42988 (CVE-2021-3426, bsc#1183374): Remove the getfile feature
    of the pydoc module which could be abused to read arbitrary files
    on the disk (directory traversal vulnerability). Moreover, even
    source code of Python modules can contain sensitive data like
    passwords. Vulnerability reported by David Schwörer.
  - bpo-43285: ftplib no longer trusts the IP address value
    returned from the server in response to the PASV command by
    default. This prevents a malicious FTP server from using the
    response to probe IPv4 address and port combinations on the
    client network.
    Code that requires the former vulnerable behavior may set a
    trust_server_pasv_ipv4_address attribute on their ftplib.FTP
    instances to True to re-enable it.
  - bpo-43075 (CVE-2021-3733, bsc#1189287): Fix Regular Expression
    Denial of Service (ReDoS) vulnerability in
    urllib.request.AbstractBasicAuthHandler. The ReDoS-vulnerable
    regex has quadratic worst-case complexity and it allows cause
    a denial of service when identifying crafted invalid RFCs. This
    ReDoS issue is on the client side and needs remote attackers to
    control the HTTP server.
- Upstreamed patches were removed:
  - CVE-2021-3426-inf-disclosure-pydoc-getfile.patch
  - CVE-2021-3733-ReDoS-urllib-AbstractBasicAuthHandler.patch
- Refreshed patches:
  - python3-sorted_tar.patch
  - riscv64-ctypes.patch</changelog>
  <changelog author="schwab@suse.de" date="1629979200">- test_faulthandler is still problematic under qemu linux-user emulation,
  disable it there</changelog>
  <changelog author="mcepl@suse.com" date="1631707200">- Update to 3.6.15:
  - bpo-43124: Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection. Library
  - bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header. Patch
    by Wouter Bolsterlee. Tests
  - bpo-38965: Fix test_faulthandler on GCC 10. Use the
    ?volatile? keyword in faulthandler._stack_overflow() to
    prevent tail call optimization on any compiler, rather than
    relying on compiler specific pragma.
- Remove upstreamed patches:
  - faulthandler_stack_overflow_on_GCC10.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632398400">- Make build working even on older SLEs.</changelog>
  <changelog author="mcepl@suse.com" date="1632398401">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
</package>
<package pkgid="f2eead501ecf53d21ba809a274e2931f26a6d22efb16b00a779cde7e101137af" name="libpython3_6m1_0" arch="x86_64">
  <version epoch="0" ver="3.6.15" rel="150300.10.27.1"/>
  <changelog author="mcepl@suse.com" date="1626782400">- Use versioned python-Sphinx to avoid dependency on other
  version of Python (bsc#1183858).</changelog>
  <changelog author="mcepl@suse.com" date="1627300800">- Rebuild to get new headers, avoid building in support for
  stropts.h (bsc#1187338).</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1628596800">- Update to 3.6.14:
  * Security
  - bpo-44022 (bsc#1189241, CVE-2021-3737): mod:http.client now
    avoids infinitely reading potential HTTP headers after
    a 100 Continue status response from the server.
  - bpo-43882: The presence of newline or tab characters in parts
    of a URL could allow some forms of attacks.
    Following the controlling specification for URLs defined by
    WHATWG urllib.parse() now removes ASCII newlines and tabs
    from URLs, preventing such attacks.
  - bpo-42988 (CVE-2021-3426, bsc#1183374): Remove the getfile feature
    of the pydoc module which could be abused to read arbitrary files
    on the disk (directory traversal vulnerability). Moreover, even
    source code of Python modules can contain sensitive data like
    passwords. Vulnerability reported by David Schwörer.
  - bpo-43285: ftplib no longer trusts the IP address value
    returned from the server in response to the PASV command by
    default. This prevents a malicious FTP server from using the
    response to probe IPv4 address and port combinations on the
    client network.
    Code that requires the former vulnerable behavior may set a
    trust_server_pasv_ipv4_address attribute on their ftplib.FTP
    instances to True to re-enable it.
  - bpo-43075 (CVE-2021-3733, bsc#1189287): Fix Regular Expression
    Denial of Service (ReDoS) vulnerability in
    urllib.request.AbstractBasicAuthHandler. The ReDoS-vulnerable
    regex has quadratic worst-case complexity and it allows cause
    a denial of service when identifying crafted invalid RFCs. This
    ReDoS issue is on the client side and needs remote attackers to
    control the HTTP server.
- Upstreamed patches were removed:
  - CVE-2021-3426-inf-disclosure-pydoc-getfile.patch
  - CVE-2021-3733-ReDoS-urllib-AbstractBasicAuthHandler.patch
- Refreshed patches:
  - python3-sorted_tar.patch
  - riscv64-ctypes.patch</changelog>
  <changelog author="schwab@suse.de" date="1629979200">- test_faulthandler is still problematic under qemu linux-user emulation,
  disable it there</changelog>
  <changelog author="mcepl@suse.com" date="1631707200">- Update to 3.6.15:
  - bpo-43124: Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection. Library
  - bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header. Patch
    by Wouter Bolsterlee. Tests
  - bpo-38965: Fix test_faulthandler on GCC 10. Use the
    ?volatile? keyword in faulthandler._stack_overflow() to
    prevent tail call optimization on any compiler, rather than
    relying on compiler specific pragma.
- Remove upstreamed patches:
  - faulthandler_stack_overflow_on_GCC10.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632398400">- Make build working even on older SLEs.</changelog>
  <changelog author="mcepl@suse.com" date="1632398401">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
</package>
<package pkgid="6e6ce012590d071b34547ec8fb9978d087fc01d09f3b948be7bc50df4bf66a51" name="libsoftokn3" arch="aarch64">
  <version epoch="0" ver="3.79" rel="150000.3.74.1"/>
  <changelog author="wr@rosenauer.org" date="1615896000">- update to NSS 3.62
  * bmo#1688374 - Fix parallel build NSS-3.61 with make
  * bmo#1682044 - pkix_Build_GatherCerts() + pkix_CacheCert_Add()
    can corrupt "cachedCertTable"
  * bmo#1690583 - Fix CH padding extension size calculation
  * bmo#1690421 - Adjust 3.62 ABI report formatting for new libabigail
  * bmo#1690421 - Install packaged libabigail in docker-builds image
  * bmo#1689228 - Minor ECH -09 fixes for interop testing, fuzzing
  * bmo#1674819 - Fixup a51fae403328, enum type may be signed
  * bmo#1681585 - Add ECH support to selfserv
  * bmo#1681585 - Update ECH to Draft-09
  * bmo#1678398 - Add Export/Import functions for HPKE context
  * bmo#1678398 - Update HPKE to draft-07
- required for Firefox 87</changelog>
  <changelog author="wr@rosenauer.org" date="1618747200">- update to NSS 3.63.1
  * no upstream release notes for 3.63.1 (yet)
  Fixed in 3.63
  * bmo#1697380 - Make a clang-format run on top of helpful contributions.
  * bmo#1683520 - ECCKiila P384, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-384: allow zero scalars in dual
    scalar multiplication.
  * bmo#1683520 - ECCKiila P521, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-521: allow zero scalars in dual
    scalar multiplication.
  * bmo#1696800 - HACL* update March 2021 - c95ab70fcb2bc21025d8845281bc4bc8987ca683.
  * bmo#1694214 - tstclnt can't enable middlebox compat mode.
  * bmo#1694392 - NSS does not work with PKCS #11 modules not supporting
    profiles.
  * bmo#1685880 - Minor fix to prevent unused variable on early return.
  * bmo#1685880 - Fix for the gcc compiler version 7 to support setenv
    with nss build.
  * bmo#1693217 - Increase nssckbi.h version number for March 2021 batch
    of root CA changes, CA list version 2.48.
  * bmo#1692094 - Set email distrust after to 21-03-01 for Camerfirma's
    'Chambers of Commerce' and 'Global Chambersign' roots.
  * bmo#1618407 - Symantec root certs - Set CKA_NSS_EMAIL_DISTRUST_AFTER.
  * bmo#1693173 - Add GlobalSign R45, E45, R46, and E46 root certs to NSS.
  * bmo#1683738 - Add AC RAIZ FNMT-RCM SERVIDORES SEGUROS root cert to NSS.
  * bmo#1686854 - Remove GeoTrust PCA-G2 and VeriSign Universal root certs
    from NSS.
  * bmo#1687822 - Turn off Websites trust bit for the ?Staat der
    Nederlanden Root CA - G3? root cert in NSS.
  * bmo#1692094 - Turn off Websites Trust Bit for 'Chambers of Commerce
    Root - 2008' and 'Global Chambersign Root - 2008?.
  * bmo#1694291 - Tracing fixes for ECH.
- required for Firefox 88</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to NSS 3.64
  * bmo#1705286 - Properly detect mips64.
  * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and
    disable_crypto_vsx.
  * bmo#1698320 - replace __builtin_cpu_supports("vsx") with
    ppc_crypto_support() for clang.
  * bmo#1613235 - Add POWER ChaCha20 stream cipher vector
    acceleration.</changelog>
  <changelog author="wr@rosenauer.org" date="1625918400">- update to NSS 3.66
  * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  * bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  * bmo#1707097 - Add Certum Trusted Root CA to NSS.
  * bmo#1707097 - Add Certum EC-384 CA to NSS.
  * bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  * bmo#1709291 - Add VerifyCodeSigningCertificateChain.
  * Use GNU tar for the release helper script.
- update to NSS 3.65
  * bmo#1709654 - Update for NetBSD configuration.
  * bmo#1709750 - Disable HPKE test when fuzzing.
  * bmo#1566124 - Optimize AES-GCM for ppc64le.
  * bmo#1699021 - Add AES-256-GCM to HPKE.
  * bmo#1698419 - ECH -10 updates.
  * bmo#1692930 - Update HPKE to final version.
  * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  * bmo#1703936 - New coverity/cpp scanner errors.
  * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.
- refreshed patches
- Firefox 90.0 requires NSS 3.66</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627560000">- update to NSS 3.68
  * bmo#1713562 - Fix test leak.
  * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  * bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  * bmo#1712883 - DTLS 1.3 draft-43.
  * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  * bmo#1713562 - Validate ECH public names.
  * bmo#1717610 - Add function to get seconds from epoch from pkix::Time.
- update to NSS 3.67
  * bmo#1683710 - Add a means to disable ALPN.
  * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.</changelog>
  <changelog author="hpj@suse.com" date="1629288000">- Update nss-fips-constructor-self-tests.patch to fix crashes
  reported by upstream. This was likely affecting WebRTC calls.</changelog>
  <changelog author="cgrobertson@suse.com" date="1630411200">- Removed nss-fips-kdf-self-tests.patch.  This was made
  obsolete by upstream changes. (bmo#1660304)
- Rebase nss-fips-stricter-dh.patch needed due to upstream changes.</changelog>
  <changelog author="hpj@suse.com" date="1635768000">- Update nss-fips-approved-crypto-non-ec.patch to claim 3DES
  unapproved in FIPS mode (bsc#1192080).
- Update nss-fips-constructor-self-tests.patch to allow testing
  of unapproved algorithms (bsc#1192228).
- Add nss-fips-version-indicators.patch (bmo#1729550, bsc#1192086).
  This adds FIPS version indicators.
- Add nss-fips-180-3-csp-clearing.patch (bmo#1697303, bsc#1192087).
  Most of the relevant changes are already upstream since NSS 3.60.</changelog>
  <changelog author="hpj@suse.com" date="1637668800">- Enable NSS_ENABLE_FIPS_INDICATORS and set NSS_FIPS_MODULE_ID
  for build.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
</package>
<package pkgid="2ceddc1d734cd0ff8dbbfc518e41d028695ac317f099d5788ab822dc04d4c303" name="libsoftokn3" arch="x86_64">
  <version epoch="0" ver="3.79" rel="150000.3.74.1"/>
  <changelog author="wr@rosenauer.org" date="1615896000">- update to NSS 3.62
  * bmo#1688374 - Fix parallel build NSS-3.61 with make
  * bmo#1682044 - pkix_Build_GatherCerts() + pkix_CacheCert_Add()
    can corrupt "cachedCertTable"
  * bmo#1690583 - Fix CH padding extension size calculation
  * bmo#1690421 - Adjust 3.62 ABI report formatting for new libabigail
  * bmo#1690421 - Install packaged libabigail in docker-builds image
  * bmo#1689228 - Minor ECH -09 fixes for interop testing, fuzzing
  * bmo#1674819 - Fixup a51fae403328, enum type may be signed
  * bmo#1681585 - Add ECH support to selfserv
  * bmo#1681585 - Update ECH to Draft-09
  * bmo#1678398 - Add Export/Import functions for HPKE context
  * bmo#1678398 - Update HPKE to draft-07
- required for Firefox 87</changelog>
  <changelog author="wr@rosenauer.org" date="1618747200">- update to NSS 3.63.1
  * no upstream release notes for 3.63.1 (yet)
  Fixed in 3.63
  * bmo#1697380 - Make a clang-format run on top of helpful contributions.
  * bmo#1683520 - ECCKiila P384, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-384: allow zero scalars in dual
    scalar multiplication.
  * bmo#1683520 - ECCKiila P521, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-521: allow zero scalars in dual
    scalar multiplication.
  * bmo#1696800 - HACL* update March 2021 - c95ab70fcb2bc21025d8845281bc4bc8987ca683.
  * bmo#1694214 - tstclnt can't enable middlebox compat mode.
  * bmo#1694392 - NSS does not work with PKCS #11 modules not supporting
    profiles.
  * bmo#1685880 - Minor fix to prevent unused variable on early return.
  * bmo#1685880 - Fix for the gcc compiler version 7 to support setenv
    with nss build.
  * bmo#1693217 - Increase nssckbi.h version number for March 2021 batch
    of root CA changes, CA list version 2.48.
  * bmo#1692094 - Set email distrust after to 21-03-01 for Camerfirma's
    'Chambers of Commerce' and 'Global Chambersign' roots.
  * bmo#1618407 - Symantec root certs - Set CKA_NSS_EMAIL_DISTRUST_AFTER.
  * bmo#1693173 - Add GlobalSign R45, E45, R46, and E46 root certs to NSS.
  * bmo#1683738 - Add AC RAIZ FNMT-RCM SERVIDORES SEGUROS root cert to NSS.
  * bmo#1686854 - Remove GeoTrust PCA-G2 and VeriSign Universal root certs
    from NSS.
  * bmo#1687822 - Turn off Websites trust bit for the ?Staat der
    Nederlanden Root CA - G3? root cert in NSS.
  * bmo#1692094 - Turn off Websites Trust Bit for 'Chambers of Commerce
    Root - 2008' and 'Global Chambersign Root - 2008?.
  * bmo#1694291 - Tracing fixes for ECH.
- required for Firefox 88</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to NSS 3.64
  * bmo#1705286 - Properly detect mips64.
  * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and
    disable_crypto_vsx.
  * bmo#1698320 - replace __builtin_cpu_supports("vsx") with
    ppc_crypto_support() for clang.
  * bmo#1613235 - Add POWER ChaCha20 stream cipher vector
    acceleration.</changelog>
  <changelog author="wr@rosenauer.org" date="1625918400">- update to NSS 3.66
  * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  * bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  * bmo#1707097 - Add Certum Trusted Root CA to NSS.
  * bmo#1707097 - Add Certum EC-384 CA to NSS.
  * bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  * bmo#1709291 - Add VerifyCodeSigningCertificateChain.
  * Use GNU tar for the release helper script.
- update to NSS 3.65
  * bmo#1709654 - Update for NetBSD configuration.
  * bmo#1709750 - Disable HPKE test when fuzzing.
  * bmo#1566124 - Optimize AES-GCM for ppc64le.
  * bmo#1699021 - Add AES-256-GCM to HPKE.
  * bmo#1698419 - ECH -10 updates.
  * bmo#1692930 - Update HPKE to final version.
  * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  * bmo#1703936 - New coverity/cpp scanner errors.
  * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.
- refreshed patches
- Firefox 90.0 requires NSS 3.66</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627560000">- update to NSS 3.68
  * bmo#1713562 - Fix test leak.
  * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  * bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  * bmo#1712883 - DTLS 1.3 draft-43.
  * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  * bmo#1713562 - Validate ECH public names.
  * bmo#1717610 - Add function to get seconds from epoch from pkix::Time.
- update to NSS 3.67
  * bmo#1683710 - Add a means to disable ALPN.
  * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.</changelog>
  <changelog author="hpj@suse.com" date="1629288000">- Update nss-fips-constructor-self-tests.patch to fix crashes
  reported by upstream. This was likely affecting WebRTC calls.</changelog>
  <changelog author="cgrobertson@suse.com" date="1630411200">- Removed nss-fips-kdf-self-tests.patch.  This was made
  obsolete by upstream changes. (bmo#1660304)
- Rebase nss-fips-stricter-dh.patch needed due to upstream changes.</changelog>
  <changelog author="hpj@suse.com" date="1635768000">- Update nss-fips-approved-crypto-non-ec.patch to claim 3DES
  unapproved in FIPS mode (bsc#1192080).
- Update nss-fips-constructor-self-tests.patch to allow testing
  of unapproved algorithms (bsc#1192228).
- Add nss-fips-version-indicators.patch (bmo#1729550, bsc#1192086).
  This adds FIPS version indicators.
- Add nss-fips-180-3-csp-clearing.patch (bmo#1697303, bsc#1192087).
  Most of the relevant changes are already upstream since NSS 3.60.</changelog>
  <changelog author="hpj@suse.com" date="1637668800">- Enable NSS_ENABLE_FIPS_INDICATORS and set NSS_FIPS_MODULE_ID
  for build.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
</package>
<package pkgid="165f651bc162815f62cfdb5334f2f5a3795cd1cfb4a8faecd9612eba545ff83e" name="libsoftokn3-hmac" arch="aarch64">
  <version epoch="0" ver="3.79" rel="150000.3.74.1"/>
  <changelog author="wr@rosenauer.org" date="1615896000">- update to NSS 3.62
  * bmo#1688374 - Fix parallel build NSS-3.61 with make
  * bmo#1682044 - pkix_Build_GatherCerts() + pkix_CacheCert_Add()
    can corrupt "cachedCertTable"
  * bmo#1690583 - Fix CH padding extension size calculation
  * bmo#1690421 - Adjust 3.62 ABI report formatting for new libabigail
  * bmo#1690421 - Install packaged libabigail in docker-builds image
  * bmo#1689228 - Minor ECH -09 fixes for interop testing, fuzzing
  * bmo#1674819 - Fixup a51fae403328, enum type may be signed
  * bmo#1681585 - Add ECH support to selfserv
  * bmo#1681585 - Update ECH to Draft-09
  * bmo#1678398 - Add Export/Import functions for HPKE context
  * bmo#1678398 - Update HPKE to draft-07
- required for Firefox 87</changelog>
  <changelog author="wr@rosenauer.org" date="1618747200">- update to NSS 3.63.1
  * no upstream release notes for 3.63.1 (yet)
  Fixed in 3.63
  * bmo#1697380 - Make a clang-format run on top of helpful contributions.
  * bmo#1683520 - ECCKiila P384, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-384: allow zero scalars in dual
    scalar multiplication.
  * bmo#1683520 - ECCKiila P521, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-521: allow zero scalars in dual
    scalar multiplication.
  * bmo#1696800 - HACL* update March 2021 - c95ab70fcb2bc21025d8845281bc4bc8987ca683.
  * bmo#1694214 - tstclnt can't enable middlebox compat mode.
  * bmo#1694392 - NSS does not work with PKCS #11 modules not supporting
    profiles.
  * bmo#1685880 - Minor fix to prevent unused variable on early return.
  * bmo#1685880 - Fix for the gcc compiler version 7 to support setenv
    with nss build.
  * bmo#1693217 - Increase nssckbi.h version number for March 2021 batch
    of root CA changes, CA list version 2.48.
  * bmo#1692094 - Set email distrust after to 21-03-01 for Camerfirma's
    'Chambers of Commerce' and 'Global Chambersign' roots.
  * bmo#1618407 - Symantec root certs - Set CKA_NSS_EMAIL_DISTRUST_AFTER.
  * bmo#1693173 - Add GlobalSign R45, E45, R46, and E46 root certs to NSS.
  * bmo#1683738 - Add AC RAIZ FNMT-RCM SERVIDORES SEGUROS root cert to NSS.
  * bmo#1686854 - Remove GeoTrust PCA-G2 and VeriSign Universal root certs
    from NSS.
  * bmo#1687822 - Turn off Websites trust bit for the ?Staat der
    Nederlanden Root CA - G3? root cert in NSS.
  * bmo#1692094 - Turn off Websites Trust Bit for 'Chambers of Commerce
    Root - 2008' and 'Global Chambersign Root - 2008?.
  * bmo#1694291 - Tracing fixes for ECH.
- required for Firefox 88</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to NSS 3.64
  * bmo#1705286 - Properly detect mips64.
  * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and
    disable_crypto_vsx.
  * bmo#1698320 - replace __builtin_cpu_supports("vsx") with
    ppc_crypto_support() for clang.
  * bmo#1613235 - Add POWER ChaCha20 stream cipher vector
    acceleration.</changelog>
  <changelog author="wr@rosenauer.org" date="1625918400">- update to NSS 3.66
  * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  * bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  * bmo#1707097 - Add Certum Trusted Root CA to NSS.
  * bmo#1707097 - Add Certum EC-384 CA to NSS.
  * bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  * bmo#1709291 - Add VerifyCodeSigningCertificateChain.
  * Use GNU tar for the release helper script.
- update to NSS 3.65
  * bmo#1709654 - Update for NetBSD configuration.
  * bmo#1709750 - Disable HPKE test when fuzzing.
  * bmo#1566124 - Optimize AES-GCM for ppc64le.
  * bmo#1699021 - Add AES-256-GCM to HPKE.
  * bmo#1698419 - ECH -10 updates.
  * bmo#1692930 - Update HPKE to final version.
  * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  * bmo#1703936 - New coverity/cpp scanner errors.
  * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.
- refreshed patches
- Firefox 90.0 requires NSS 3.66</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627560000">- update to NSS 3.68
  * bmo#1713562 - Fix test leak.
  * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  * bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  * bmo#1712883 - DTLS 1.3 draft-43.
  * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  * bmo#1713562 - Validate ECH public names.
  * bmo#1717610 - Add function to get seconds from epoch from pkix::Time.
- update to NSS 3.67
  * bmo#1683710 - Add a means to disable ALPN.
  * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.</changelog>
  <changelog author="hpj@suse.com" date="1629288000">- Update nss-fips-constructor-self-tests.patch to fix crashes
  reported by upstream. This was likely affecting WebRTC calls.</changelog>
  <changelog author="cgrobertson@suse.com" date="1630411200">- Removed nss-fips-kdf-self-tests.patch.  This was made
  obsolete by upstream changes. (bmo#1660304)
- Rebase nss-fips-stricter-dh.patch needed due to upstream changes.</changelog>
  <changelog author="hpj@suse.com" date="1635768000">- Update nss-fips-approved-crypto-non-ec.patch to claim 3DES
  unapproved in FIPS mode (bsc#1192080).
- Update nss-fips-constructor-self-tests.patch to allow testing
  of unapproved algorithms (bsc#1192228).
- Add nss-fips-version-indicators.patch (bmo#1729550, bsc#1192086).
  This adds FIPS version indicators.
- Add nss-fips-180-3-csp-clearing.patch (bmo#1697303, bsc#1192087).
  Most of the relevant changes are already upstream since NSS 3.60.</changelog>
  <changelog author="hpj@suse.com" date="1637668800">- Enable NSS_ENABLE_FIPS_INDICATORS and set NSS_FIPS_MODULE_ID
  for build.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
</package>
<package pkgid="1941a3b04e5f860722898105547749c74713e8ea889ff85cbd0d3d24ce5b712b" name="libsoftokn3-hmac" arch="x86_64">
  <version epoch="0" ver="3.79" rel="150000.3.74.1"/>
  <changelog author="wr@rosenauer.org" date="1615896000">- update to NSS 3.62
  * bmo#1688374 - Fix parallel build NSS-3.61 with make
  * bmo#1682044 - pkix_Build_GatherCerts() + pkix_CacheCert_Add()
    can corrupt "cachedCertTable"
  * bmo#1690583 - Fix CH padding extension size calculation
  * bmo#1690421 - Adjust 3.62 ABI report formatting for new libabigail
  * bmo#1690421 - Install packaged libabigail in docker-builds image
  * bmo#1689228 - Minor ECH -09 fixes for interop testing, fuzzing
  * bmo#1674819 - Fixup a51fae403328, enum type may be signed
  * bmo#1681585 - Add ECH support to selfserv
  * bmo#1681585 - Update ECH to Draft-09
  * bmo#1678398 - Add Export/Import functions for HPKE context
  * bmo#1678398 - Update HPKE to draft-07
- required for Firefox 87</changelog>
  <changelog author="wr@rosenauer.org" date="1618747200">- update to NSS 3.63.1
  * no upstream release notes for 3.63.1 (yet)
  Fixed in 3.63
  * bmo#1697380 - Make a clang-format run on top of helpful contributions.
  * bmo#1683520 - ECCKiila P384, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-384: allow zero scalars in dual
    scalar multiplication.
  * bmo#1683520 - ECCKiila P521, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-521: allow zero scalars in dual
    scalar multiplication.
  * bmo#1696800 - HACL* update March 2021 - c95ab70fcb2bc21025d8845281bc4bc8987ca683.
  * bmo#1694214 - tstclnt can't enable middlebox compat mode.
  * bmo#1694392 - NSS does not work with PKCS #11 modules not supporting
    profiles.
  * bmo#1685880 - Minor fix to prevent unused variable on early return.
  * bmo#1685880 - Fix for the gcc compiler version 7 to support setenv
    with nss build.
  * bmo#1693217 - Increase nssckbi.h version number for March 2021 batch
    of root CA changes, CA list version 2.48.
  * bmo#1692094 - Set email distrust after to 21-03-01 for Camerfirma's
    'Chambers of Commerce' and 'Global Chambersign' roots.
  * bmo#1618407 - Symantec root certs - Set CKA_NSS_EMAIL_DISTRUST_AFTER.
  * bmo#1693173 - Add GlobalSign R45, E45, R46, and E46 root certs to NSS.
  * bmo#1683738 - Add AC RAIZ FNMT-RCM SERVIDORES SEGUROS root cert to NSS.
  * bmo#1686854 - Remove GeoTrust PCA-G2 and VeriSign Universal root certs
    from NSS.
  * bmo#1687822 - Turn off Websites trust bit for the ?Staat der
    Nederlanden Root CA - G3? root cert in NSS.
  * bmo#1692094 - Turn off Websites Trust Bit for 'Chambers of Commerce
    Root - 2008' and 'Global Chambersign Root - 2008?.
  * bmo#1694291 - Tracing fixes for ECH.
- required for Firefox 88</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to NSS 3.64
  * bmo#1705286 - Properly detect mips64.
  * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and
    disable_crypto_vsx.
  * bmo#1698320 - replace __builtin_cpu_supports("vsx") with
    ppc_crypto_support() for clang.
  * bmo#1613235 - Add POWER ChaCha20 stream cipher vector
    acceleration.</changelog>
  <changelog author="wr@rosenauer.org" date="1625918400">- update to NSS 3.66
  * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  * bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  * bmo#1707097 - Add Certum Trusted Root CA to NSS.
  * bmo#1707097 - Add Certum EC-384 CA to NSS.
  * bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  * bmo#1709291 - Add VerifyCodeSigningCertificateChain.
  * Use GNU tar for the release helper script.
- update to NSS 3.65
  * bmo#1709654 - Update for NetBSD configuration.
  * bmo#1709750 - Disable HPKE test when fuzzing.
  * bmo#1566124 - Optimize AES-GCM for ppc64le.
  * bmo#1699021 - Add AES-256-GCM to HPKE.
  * bmo#1698419 - ECH -10 updates.
  * bmo#1692930 - Update HPKE to final version.
  * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  * bmo#1703936 - New coverity/cpp scanner errors.
  * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.
- refreshed patches
- Firefox 90.0 requires NSS 3.66</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627560000">- update to NSS 3.68
  * bmo#1713562 - Fix test leak.
  * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  * bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  * bmo#1712883 - DTLS 1.3 draft-43.
  * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  * bmo#1713562 - Validate ECH public names.
  * bmo#1717610 - Add function to get seconds from epoch from pkix::Time.
- update to NSS 3.67
  * bmo#1683710 - Add a means to disable ALPN.
  * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.</changelog>
  <changelog author="hpj@suse.com" date="1629288000">- Update nss-fips-constructor-self-tests.patch to fix crashes
  reported by upstream. This was likely affecting WebRTC calls.</changelog>
  <changelog author="cgrobertson@suse.com" date="1630411200">- Removed nss-fips-kdf-self-tests.patch.  This was made
  obsolete by upstream changes. (bmo#1660304)
- Rebase nss-fips-stricter-dh.patch needed due to upstream changes.</changelog>
  <changelog author="hpj@suse.com" date="1635768000">- Update nss-fips-approved-crypto-non-ec.patch to claim 3DES
  unapproved in FIPS mode (bsc#1192080).
- Update nss-fips-constructor-self-tests.patch to allow testing
  of unapproved algorithms (bsc#1192228).
- Add nss-fips-version-indicators.patch (bmo#1729550, bsc#1192086).
  This adds FIPS version indicators.
- Add nss-fips-180-3-csp-clearing.patch (bmo#1697303, bsc#1192087).
  Most of the relevant changes are already upstream since NSS 3.60.</changelog>
  <changelog author="hpj@suse.com" date="1637668800">- Enable NSS_ENABLE_FIPS_INDICATORS and set NSS_FIPS_MODULE_ID
  for build.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
</package>
<package pkgid="6fcd43a346d4845b2067c6db49feb1421fd5dfa174b3ba67b7a5292c7bf21279" name="libsolv" arch="src">
  <version epoch="0" ver="0.7.22" rel="150200.12.1"/>
  <changelog author="mls@suse.de" date="1574337600">- support conda constrains dependencies
- bump version to 0.7.9</changelog>
  <changelog author="mls@suse.de" date="1575979200">- added two new function to make libzypp independent of the rpm
  database format
- bump version to 0.7.10</changelog>
  <changelog author="mls@suse.de" date="1575979201">- build with -DENABLE_RPMDB_LIBRPM=1 on SUSE to support
  multiple rpm database backends</changelog>
  <changelog author="mls@suse.de" date="1576756800">- fix solv_zchunk decoding error if large chunks are used
  [bnc#1159314]</changelog>
  <changelog author="mls@suse.de" date="1579694400">- fixed solv_zchunk decoding error if large chunks are used
- treat retracted pathes as irrelevant
- made add_update_target work with multiversion installs
- bump version to 0.7.11</changelog>
  <changelog author="mls@suse.de" date="1587384000">- fix ruleinfo of complex dependencies returning the wrong origin
- bump version to 0.7.12</changelog>
  <changelog author="mls@suse.de" date="1587729600">- Fix solvable swapping messing up idarrays
- bump version to 0.7.13</changelog>
  <changelog author="mls@suse.de" date="1590580800">- Support blacklisted packages in solver_findproblemrule()
  [bnc#1172135]
- Support rules with multiple negative literals in choice rule
  generation
- bump version to 0.7.14</changelog>
  <changelog author="mls@suse.de" date="1590667200">- Enable zstd compression support for sle15-sp2</changelog>
  <changelog author="ma@suse.de" date="1592913600">- Enable zstd compression support for sle15</changelog>
  <changelog author="mls@suse.de" date="1599825600">- fix deduceq2addedmap clearing bits outside of the map
- conda: feature depriorization first
- conda: fix startswith implementation
- move find_update_seeds() call in cleandeps calculation
- set SOLVABLE_BUILDHOST in rpm and rpmmd parsers
- new testcase_mangle_repo_names() function
- new solv_fmemopen() function
- bump version to 0.7.15</changelog>
  <changelog author="mls@suse.de" date="1601899200">- make testcase_mangle_repo_names deal correctly with freed repos
  [bnc#1177238]</changelog>
  <changelog author="mls@suse.de" date="1603195200">- do not ask the namespace callback for splitprovides when writing
  a testcase
- fix add_complex_recommends() selecting conflicted packages in
  rare cases leading to crashes
- improve choicerule generation so that package updates are
  prefered in more cases
- bump version to 0.7.16</changelog>
  <changelog author="mls@suse.de" date="1611057600">- repo_write: fix handling of nested flexarray
- improve choicerule generation a bit more to cover more cases
- harden testcase parser against repos being added too late
- support python-3.10
- check %_dbpath macro in rpmdb code
- handle default/visible/langonly attributes in comps parser
- support multiple collections in updateinfo parser
- add '-D' option in rpmdb2solv to set the dbpath
- bump version to 0.7.17</changelog>
  <changelog author="mls@suse.de" date="1616760000">- fixed regex code on win32
- fixed memory leak in choice rule generation
- repo_add_conda: add flag to skip v2 packages
- bump version to 0.7.18</changelog>
  <changelog author="mls@suse.de" date="1617796800">- fix rare segfault in resolve_jobrules() that could happen
  if new rules are learnt
- fix a couple of memory leaks in error cases
- fix error handling in solv_xfopen_fd()
- bump version to 0.7.19</changelog>
  <changelog author="dimstar@opensuse.org" date="1627646400">- Disable python2 usage on suse_version &gt;= 1550 by default (still
  possible to use osc build --with=python).</changelog>
  <changelog author="mls@suse.de" date="1632571200">- fix misparsing of '&amp;' in attributes with libxml2
- choice rules: treat orphaned packages as newest [bsc#1190465]
- fix compatibility with Python 3.10
- new SOLVER_EXCLUDEFROMWEAK job type
- support for environments in comps parser
- bump version to 0.7.20</changelog>
  <changelog author="mls@suse.de" date="1645790400">- fix segfault on conflict resolution when using bindings
- fix split provides not working if the update includes a forbidden
  vendor change
- support strict repository priorities
  new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY
- support zstd compressed control files in debian packages
- add an ifdef allowing to rename Solvable dependency members
  ("requires" is a keyword in C++20)
- support setting/reading userdata in solv files
  new functions: repowriter_set_userdata, solv_read_userdata
- support queying of the custom vendor check function
  new function: pool_get_custom_vendorcheck
- support solv files with an idarray block
- allow accessing the toolversion at runtime
- bump version to 0.7.21</changelog>
  <changelog author="mls@suse.de" date="1647864000">- reworked choice rule generation to cover more usecases
- support SOLVABLE_PREREQ_IGNOREINST in the ordering code
  [bsc#1196514]
- support parsing of Debian's Multi-Arch indicator
- bump version to 0.7.22</changelog>
</package>
<package pkgid="23fd1ef571609fa816fafa08c1190ff21c357ad27a7599a5450bb3677d8b9245" name="libsolv-tools" arch="aarch64">
  <version epoch="0" ver="0.7.22" rel="150200.12.1"/>
  <changelog author="mls@suse.de" date="1574337600">- support conda constrains dependencies
- bump version to 0.7.9</changelog>
  <changelog author="mls@suse.de" date="1575979200">- added two new function to make libzypp independent of the rpm
  database format
- bump version to 0.7.10</changelog>
  <changelog author="mls@suse.de" date="1575979201">- build with -DENABLE_RPMDB_LIBRPM=1 on SUSE to support
  multiple rpm database backends</changelog>
  <changelog author="mls@suse.de" date="1576756800">- fix solv_zchunk decoding error if large chunks are used
  [bnc#1159314]</changelog>
  <changelog author="mls@suse.de" date="1579694400">- fixed solv_zchunk decoding error if large chunks are used
- treat retracted pathes as irrelevant
- made add_update_target work with multiversion installs
- bump version to 0.7.11</changelog>
  <changelog author="mls@suse.de" date="1587384000">- fix ruleinfo of complex dependencies returning the wrong origin
- bump version to 0.7.12</changelog>
  <changelog author="mls@suse.de" date="1587729600">- Fix solvable swapping messing up idarrays
- bump version to 0.7.13</changelog>
  <changelog author="mls@suse.de" date="1590580800">- Support blacklisted packages in solver_findproblemrule()
  [bnc#1172135]
- Support rules with multiple negative literals in choice rule
  generation
- bump version to 0.7.14</changelog>
  <changelog author="mls@suse.de" date="1590667200">- Enable zstd compression support for sle15-sp2</changelog>
  <changelog author="ma@suse.de" date="1592913600">- Enable zstd compression support for sle15</changelog>
  <changelog author="mls@suse.de" date="1599825600">- fix deduceq2addedmap clearing bits outside of the map
- conda: feature depriorization first
- conda: fix startswith implementation
- move find_update_seeds() call in cleandeps calculation
- set SOLVABLE_BUILDHOST in rpm and rpmmd parsers
- new testcase_mangle_repo_names() function
- new solv_fmemopen() function
- bump version to 0.7.15</changelog>
  <changelog author="mls@suse.de" date="1601899200">- make testcase_mangle_repo_names deal correctly with freed repos
  [bnc#1177238]</changelog>
  <changelog author="mls@suse.de" date="1603195200">- do not ask the namespace callback for splitprovides when writing
  a testcase
- fix add_complex_recommends() selecting conflicted packages in
  rare cases leading to crashes
- improve choicerule generation so that package updates are
  prefered in more cases
- bump version to 0.7.16</changelog>
  <changelog author="mls@suse.de" date="1611057600">- repo_write: fix handling of nested flexarray
- improve choicerule generation a bit more to cover more cases
- harden testcase parser against repos being added too late
- support python-3.10
- check %_dbpath macro in rpmdb code
- handle default/visible/langonly attributes in comps parser
- support multiple collections in updateinfo parser
- add '-D' option in rpmdb2solv to set the dbpath
- bump version to 0.7.17</changelog>
  <changelog author="mls@suse.de" date="1616760000">- fixed regex code on win32
- fixed memory leak in choice rule generation
- repo_add_conda: add flag to skip v2 packages
- bump version to 0.7.18</changelog>
  <changelog author="mls@suse.de" date="1617796800">- fix rare segfault in resolve_jobrules() that could happen
  if new rules are learnt
- fix a couple of memory leaks in error cases
- fix error handling in solv_xfopen_fd()
- bump version to 0.7.19</changelog>
  <changelog author="dimstar@opensuse.org" date="1627646400">- Disable python2 usage on suse_version &gt;= 1550 by default (still
  possible to use osc build --with=python).</changelog>
  <changelog author="mls@suse.de" date="1632571200">- fix misparsing of '&amp;' in attributes with libxml2
- choice rules: treat orphaned packages as newest [bsc#1190465]
- fix compatibility with Python 3.10
- new SOLVER_EXCLUDEFROMWEAK job type
- support for environments in comps parser
- bump version to 0.7.20</changelog>
  <changelog author="mls@suse.de" date="1645790400">- fix segfault on conflict resolution when using bindings
- fix split provides not working if the update includes a forbidden
  vendor change
- support strict repository priorities
  new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY
- support zstd compressed control files in debian packages
- add an ifdef allowing to rename Solvable dependency members
  ("requires" is a keyword in C++20)
- support setting/reading userdata in solv files
  new functions: repowriter_set_userdata, solv_read_userdata
- support queying of the custom vendor check function
  new function: pool_get_custom_vendorcheck
- support solv files with an idarray block
- allow accessing the toolversion at runtime
- bump version to 0.7.21</changelog>
  <changelog author="mls@suse.de" date="1647864000">- reworked choice rule generation to cover more usecases
- support SOLVABLE_PREREQ_IGNOREINST in the ordering code
  [bsc#1196514]
- support parsing of Debian's Multi-Arch indicator
- bump version to 0.7.22</changelog>
</package>
<package pkgid="957d2b25602712806532d78591dcb922725936e7b78f1a805fd419d547a01923" name="libsolv-tools" arch="x86_64">
  <version epoch="0" ver="0.7.22" rel="150200.12.1"/>
  <changelog author="mls@suse.de" date="1574337600">- support conda constrains dependencies
- bump version to 0.7.9</changelog>
  <changelog author="mls@suse.de" date="1575979200">- added two new function to make libzypp independent of the rpm
  database format
- bump version to 0.7.10</changelog>
  <changelog author="mls@suse.de" date="1575979201">- build with -DENABLE_RPMDB_LIBRPM=1 on SUSE to support
  multiple rpm database backends</changelog>
  <changelog author="mls@suse.de" date="1576756800">- fix solv_zchunk decoding error if large chunks are used
  [bnc#1159314]</changelog>
  <changelog author="mls@suse.de" date="1579694400">- fixed solv_zchunk decoding error if large chunks are used
- treat retracted pathes as irrelevant
- made add_update_target work with multiversion installs
- bump version to 0.7.11</changelog>
  <changelog author="mls@suse.de" date="1587384000">- fix ruleinfo of complex dependencies returning the wrong origin
- bump version to 0.7.12</changelog>
  <changelog author="mls@suse.de" date="1587729600">- Fix solvable swapping messing up idarrays
- bump version to 0.7.13</changelog>
  <changelog author="mls@suse.de" date="1590580800">- Support blacklisted packages in solver_findproblemrule()
  [bnc#1172135]
- Support rules with multiple negative literals in choice rule
  generation
- bump version to 0.7.14</changelog>
  <changelog author="mls@suse.de" date="1590667200">- Enable zstd compression support for sle15-sp2</changelog>
  <changelog author="ma@suse.de" date="1592913600">- Enable zstd compression support for sle15</changelog>
  <changelog author="mls@suse.de" date="1599825600">- fix deduceq2addedmap clearing bits outside of the map
- conda: feature depriorization first
- conda: fix startswith implementation
- move find_update_seeds() call in cleandeps calculation
- set SOLVABLE_BUILDHOST in rpm and rpmmd parsers
- new testcase_mangle_repo_names() function
- new solv_fmemopen() function
- bump version to 0.7.15</changelog>
  <changelog author="mls@suse.de" date="1601899200">- make testcase_mangle_repo_names deal correctly with freed repos
  [bnc#1177238]</changelog>
  <changelog author="mls@suse.de" date="1603195200">- do not ask the namespace callback for splitprovides when writing
  a testcase
- fix add_complex_recommends() selecting conflicted packages in
  rare cases leading to crashes
- improve choicerule generation so that package updates are
  prefered in more cases
- bump version to 0.7.16</changelog>
  <changelog author="mls@suse.de" date="1611057600">- repo_write: fix handling of nested flexarray
- improve choicerule generation a bit more to cover more cases
- harden testcase parser against repos being added too late
- support python-3.10
- check %_dbpath macro in rpmdb code
- handle default/visible/langonly attributes in comps parser
- support multiple collections in updateinfo parser
- add '-D' option in rpmdb2solv to set the dbpath
- bump version to 0.7.17</changelog>
  <changelog author="mls@suse.de" date="1616760000">- fixed regex code on win32
- fixed memory leak in choice rule generation
- repo_add_conda: add flag to skip v2 packages
- bump version to 0.7.18</changelog>
  <changelog author="mls@suse.de" date="1617796800">- fix rare segfault in resolve_jobrules() that could happen
  if new rules are learnt
- fix a couple of memory leaks in error cases
- fix error handling in solv_xfopen_fd()
- bump version to 0.7.19</changelog>
  <changelog author="dimstar@opensuse.org" date="1627646400">- Disable python2 usage on suse_version &gt;= 1550 by default (still
  possible to use osc build --with=python).</changelog>
  <changelog author="mls@suse.de" date="1632571200">- fix misparsing of '&amp;' in attributes with libxml2
- choice rules: treat orphaned packages as newest [bsc#1190465]
- fix compatibility with Python 3.10
- new SOLVER_EXCLUDEFROMWEAK job type
- support for environments in comps parser
- bump version to 0.7.20</changelog>
  <changelog author="mls@suse.de" date="1645790400">- fix segfault on conflict resolution when using bindings
- fix split provides not working if the update includes a forbidden
  vendor change
- support strict repository priorities
  new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY
- support zstd compressed control files in debian packages
- add an ifdef allowing to rename Solvable dependency members
  ("requires" is a keyword in C++20)
- support setting/reading userdata in solv files
  new functions: repowriter_set_userdata, solv_read_userdata
- support queying of the custom vendor check function
  new function: pool_get_custom_vendorcheck
- support solv files with an idarray block
- allow accessing the toolversion at runtime
- bump version to 0.7.21</changelog>
  <changelog author="mls@suse.de" date="1647864000">- reworked choice rule generation to cover more usecases
- support SOLVABLE_PREREQ_IGNOREINST in the ordering code
  [bsc#1196514]
- support parsing of Debian's Multi-Arch indicator
- bump version to 0.7.22</changelog>
</package>
<package pkgid="f71e886ae0e6c31264ade16ab115dfc95fd76a643c0aff72cf665eecee937133" name="libsystemd0" arch="aarch64">
  <version epoch="0" ver="246.16" rel="150300.7.48.1"/>
  <changelog author="fbui@suse.com" date="1635422400">- Import commit f2f061f1da064bfd47e2201967a854bb9281ca5b
  98e87fc3fd busctl: use usec granularity for the timestamp printed by the busctl monitor command (jsc#SLE-17798)</changelog>
  <changelog author="mwilck@suse.com" date="1636459200">- Fix IO scheduler udev rules
  * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
    (jsc#SLE-21032, bsc#1192161)
  * 60-io-scheduler.rules: use "none" for multipath components
    (bsc#1192161)</changelog>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
</package>
<package pkgid="41c1531c60f7a42a6ba075c3c058563cd745e240c9d390410ab1f472dd13a638" name="libsystemd0" arch="x86_64">
  <version epoch="0" ver="246.16" rel="150300.7.48.1"/>
  <changelog author="fbui@suse.com" date="1635422400">- Import commit f2f061f1da064bfd47e2201967a854bb9281ca5b
  98e87fc3fd busctl: use usec granularity for the timestamp printed by the busctl monitor command (jsc#SLE-17798)</changelog>
  <changelog author="mwilck@suse.com" date="1636459200">- Fix IO scheduler udev rules
  * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
    (jsc#SLE-21032, bsc#1192161)
  * 60-io-scheduler.rules: use "none" for multipath components
    (bsc#1192161)</changelog>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
</package>
<package pkgid="3367c401f5898e5d2686ee9a2889c3b4af13c38b0729cd09ae7c40d56f13ca46" name="libtiff5" arch="aarch64">
  <version epoch="0" ver="4.0.9" rel="150000.45.11.1"/>
  <changelog author="mvetter@suse.com" date="1519128000">- bsc#1081690: Add tiff-4.0.9-bsc1081690-CVE-2018-5784.patch
  Fix uncontrolled resource consumption in TIFFSetDirectory</changelog>
  <changelog author="pgajdos@suse.com" date="1526385600">- security update
  * CVE-2018-10963 [bsc#1092949]
    + tiff-CVE-2018-10963.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1526644800">- security update
  * CVE-2017-18013 [bsc#1074317]
    + tiff-CVE-2017-18013.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528113600">- security update
  * CVE-2018-7456 [bsc#1082825]
    + tiff-CVE-2018-7456.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528113601">- security update
  * CVE-2017-11613 [bsc#1082332]
    + tiff-CVE-2017-11613.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528200000">- security update
  * CVE-2018-8905 [bsc#1086408]
    + tiff-CVE-2018-8905.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1534334400">- security update
  * CVE-2018-10779 [bsc#1092480]
    + tiff-CVE-2018-10779.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838400">- security update
  * CVE-2022-1056 [bsc#1197631]
  * CVE-2022-0891 [bsc#1197068]
    + tiff-CVE-2022-1056,CVE-2022-0891.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838401">- security update
  * CVE-2022-0561 [bsc#1195964]
    + tiff-CVE-2022-0561.patch
  * CVE-2022-0562 [bsc#1195965]
    + tiff-CVE-2022-0562.patch
  * CVE-2022-0865 [bsc#1197066]
    + tiff-CVE-2022-0865.patch
  * CVE-2022-0909 [bsc#1197072]
    + tiff-CVE-2022-0909.patch
  * CVE-2022-0924 [bsc#1197073]
    + tiff-CVE-2022-0924.patch
  * CVE-2022-0908 [bsc#1197074]
    + tiff-CVE-2022-0908.patch</changelog>
  <changelog author="mvetter@suse.com" date="1657108800">- security update
  * CVE-2022-2056 [bsc#1201176]
  * CVE-2022-2057 [bsc#1201175]
  * CVE-2022-2058 [bsc#1201174]
    + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch</changelog>
</package>
<package pkgid="a3e1aeef82fb0a8b829d0d75629f5ac3e2b797ee6eddf0845a78a4e522e8cfdd" name="libtiff5" arch="x86_64">
  <version epoch="0" ver="4.0.9" rel="150000.45.11.1"/>
  <changelog author="mvetter@suse.com" date="1519128000">- bsc#1081690: Add tiff-4.0.9-bsc1081690-CVE-2018-5784.patch
  Fix uncontrolled resource consumption in TIFFSetDirectory</changelog>
  <changelog author="pgajdos@suse.com" date="1526385600">- security update
  * CVE-2018-10963 [bsc#1092949]
    + tiff-CVE-2018-10963.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1526644800">- security update
  * CVE-2017-18013 [bsc#1074317]
    + tiff-CVE-2017-18013.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528113600">- security update
  * CVE-2018-7456 [bsc#1082825]
    + tiff-CVE-2018-7456.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528113601">- security update
  * CVE-2017-11613 [bsc#1082332]
    + tiff-CVE-2017-11613.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528200000">- security update
  * CVE-2018-8905 [bsc#1086408]
    + tiff-CVE-2018-8905.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1534334400">- security update
  * CVE-2018-10779 [bsc#1092480]
    + tiff-CVE-2018-10779.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838400">- security update
  * CVE-2022-1056 [bsc#1197631]
  * CVE-2022-0891 [bsc#1197068]
    + tiff-CVE-2022-1056,CVE-2022-0891.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838401">- security update
  * CVE-2022-0561 [bsc#1195964]
    + tiff-CVE-2022-0561.patch
  * CVE-2022-0562 [bsc#1195965]
    + tiff-CVE-2022-0562.patch
  * CVE-2022-0865 [bsc#1197066]
    + tiff-CVE-2022-0865.patch
  * CVE-2022-0909 [bsc#1197072]
    + tiff-CVE-2022-0909.patch
  * CVE-2022-0924 [bsc#1197073]
    + tiff-CVE-2022-0924.patch
  * CVE-2022-0908 [bsc#1197074]
    + tiff-CVE-2022-0908.patch</changelog>
  <changelog author="mvetter@suse.com" date="1657108800">- security update
  * CVE-2022-2056 [bsc#1201176]
  * CVE-2022-2057 [bsc#1201175]
  * CVE-2022-2058 [bsc#1201174]
    + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch</changelog>
</package>
<package pkgid="6b98a0dd10e3a81a96c5e029d5de8f1586ccf8d6cecf4e09abe3f01c7756d2f3" name="libtukit4" arch="aarch64">
  <version epoch="0" ver="4.0.0~rc3" rel="150300.3.3.1"/>
  <changelog author="iforster@suse.com" date="1615377600">- Version 3.2.1
  - t-u: Forward --quiet option to tukit
  - Regression: Add /opt as bind mount into update environment
  - Remove output indicators of the called command to not tamper
    the result line
  - Fix /etc syncing with --drop-if-no-change</changelog>
  <changelog author="iforster@suse.com" date="1615550400">- Version 3.2.2
  - Don't skip patches with rebootSuggested flag [bsc#1183442]</changelog>
  <changelog author="iforster@suse.com" date="1615550401">- Revert inotify-tools dependency: The package is not available in
  SLE. This will probably have to be implemented as a native C
  version.</changelog>
  <changelog author="iforster@suse.com" date="1616673600">- Version 3.3.0
  - Add support for more package managers by bind mounting their directories
  - Support snapshots without dedicated overlay [boo#1183539], [bsc#1183539]
  - Link RPM database correctly with older zypper versions [boo#1183521]
  - Don't discard manual changes in fstab [boo#1183856], [bsc#1192302]</changelog>
  <changelog author="iforster@suse.com" date="1623585600">- Version 3.4.0
  - Apply SElinux context on /etc in transaction [boo#1185625], [boo#1185766]
    [bsc#1186842], [boo#1186775]
  - Implement inotify handling in C instead of Bash; this makes the
  - -drop-if-no-change option work on SLE Micro [bsc#1184529]
  - Use `tukit call` for up, dup and patch to allow resuming an update after
    zypper updated itself in the snapshot [bsc#1185226]
  - Fix obsolete output type messages in initrd [boo#1177149]
  - Make different base snapshot warning more visible [bsc#1185224]</changelog>
  <changelog author="iforster@suse.com" date="1627905600">- Version 3.5.0
  - Add alias setDiscardIfUnchanged for setDiscard. The old method name
    wasn't really clear and will be removed if we should have an API break
    in the future
  - Replace mkinitrd with direct dracut call [boo#1186213]
  - tukit: Add configuration file support (/etc/tukit.conf)
  - Allow users to configure additional bind mounts (see /usr/etc/tukit.conf
    for an example and limitations) [bsc#1188322]
  - Add 'transactional-update status' call. This is a POC for obtaining a
    hash of a system to verify its integrity. The functionality is still
    experimental!
  - Internal bugfixes / optimizations</changelog>
  <changelog author="iforster@suse.com" date="1627992000">- Add tukit.conf to spec file</changelog>
  <changelog author="iforster@suse.com" date="1627992001">- Version 3.5.1
  - t-u: Disable status file generation by default
    The new experimental `status` command requires the availability of
    /etc/YaST2/control.xml, which is not present on all systems. Hide the
    creation of the corresponding status file behind a new EXPERIMENTAL_STATUS
    option to try out this functionality.
  - Increase library version</changelog>
  <changelog author="iforster@suse.com" date="1630324800">- Version 3.5.2
  - tukit: Fix overlay syncing errors with SELinux [bsc#1188648]
  - Don't print message for `shell` with --quiet
    [gh#openSUSE/transactional-update#69]</changelog>
  <changelog author="iforster@suse.com" date="1630929600">- Version 3.5.3
  - t-u: Purge kernels as part of package operations
    Required for live patching support [bsc#1189728]</changelog>
  <changelog author="iforster@suse.com" date="1631361600">- Version 3.5.4
  - tukit: Fix resolved support [boo#1190383]</changelog>
  <changelog author="iforster@suse.com" date="1631880000">- Version 3.5.5
  - t-u: Use tukit for SUSEConnect call [bsc#1190574]
    Correctly registers repositories</changelog>
  <changelog author="iforster@suse.com" date="1632398400">- Version 3.5.6
  - tukit: Add S/390 bootloader support [bsc#1189807]
  - t-u: support purge-kernels with t-u patch [bsc#1190788]</changelog>
  <changelog author="iforster@suse.com" date="1634040000">- Version 3.5.7
  Various fixes affecting Salt support:
  - t-u: Don't squash stderr messages into stdout
  - t-u: Correctly handle case when the snapshot has been deleted due to
    using --drop-if-no-change: Don't show reboot messages and avoid an awk
    error message [bsc#1191475]
  - tukit: Make inotify handler less sensitive / ignore more directories
    [bsc#1191475]</changelog>
  <changelog author="iforster@suse.com" date="1634904000">- Version 3.6.0
  - Simplify mount hierarchy by just using a single slave bind
    mount as the root of the update environment; this may avoid the
    error messages of failed unmounts
    May fix [boo#1191945]</changelog>
  <changelog author="iforster@suse.com" date="1636545600">- Version 3.6.1
  - Fix rsyncing /etc into the running system with
  - -drop-if-no-change [bsc#1192242]</changelog>
  <changelog author="iforster@suse.com" date="1637323200">- Version 3.6.2
  - Bind mount root file system snapshot on itself, this makes the
    temporary directory in /tmp unnecessary; also fixes [boo#1188110]
    to return the correct snapshot's working directory via API call.
  - Use separate mount namespace for transactional-update; this should
    fix several applications that fail to run if a mount point has the
    'unbindable' mount flag set</changelog>
  <changelog author="iforster@suse.com" date="1637582400">- Version 4.0.0~rc1
  This release is API, but not ABI compatible with previous releases;
  existing applications will have to be recompiled against this new version.
  Major features:
  - Introduces a D-Bus service to access the libtukit API via the
    org.opensuse.tukit.Transaction interface
  - Introduces a C binding via libtukit.h.
  Other changes:
  - t-u: Rework --quiet handling to make sure no output is shown even in
    error cases; this is necessary for automation, e.g. with Salt.
    [gh#openSUSE/transactional-update#73]
  - tukit: Allow storing command output into variable by introducing a new
    optional parameter for "execute" and "callExt".
  - Replace multiple and non-standalone occurenses of {} in "callExt"
    argument.
  - Split transactional-update.timer into transactional-update.timer
    and transactional-update-cleanup.timer; the later will clean up
    old snapshots even when the system does not do automatic updates.
  - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged".
  - Throw exception if snapshot is not found.
  - Fix various compiler warnings
- Update spec file:
  - Include tukitd D-Bus daemon
  - Only install one version of the library (as there are no breaking API
    changes yet)
  - Add %pre scriplets for systemd services
  - Replace %systemd_postun scriptlets with %systemd_postun_with_restart
    to satisfy rpmlint checks
  - Add transactional-update log file as %ghost file</changelog>
  <changelog author="iforster@suse.com" date="1646568000">- Version 4.0.0~rc2
  - Fix missing prompt in "shell" command [bsc#1196580]
  - Add output of tukit commands to log file
  - Fix compilation error with GCC12 [boo#1194876]
  - Fixed (non-critical) security review comments [boo#1196149]
  - Fixed selfupdate
  - Code cleanup</changelog>
  <changelog author="iforster@suse.com" date="1651579200">- Version 4.0.0~rc3
  - Add Snapshot interface
  - Reworked signal handling: All public signals are sent from the
    main thread now, keeping the same sender for everything
  - Implement D-Bus call "Execute" for Transactions
  - Implement interface for listing Snapshots
  - Implement Reboot interface
  - Fix bug when using --continue on old snapshots
  - Fix hypothetical integer overflow in snapshot list [bsc#1196826]
  - Fix wrong sort order in status command
    [gh#openSUSE/transactional-update#80]</changelog>
</package>
<package pkgid="4b813d0a9216562dab105cf619af75a0c9e326a311c2e2c9cf95603b3c9863a6" name="libtukit4" arch="x86_64">
  <version epoch="0" ver="4.0.0~rc3" rel="150300.3.3.1"/>
  <changelog author="iforster@suse.com" date="1615377600">- Version 3.2.1
  - t-u: Forward --quiet option to tukit
  - Regression: Add /opt as bind mount into update environment
  - Remove output indicators of the called command to not tamper
    the result line
  - Fix /etc syncing with --drop-if-no-change</changelog>
  <changelog author="iforster@suse.com" date="1615550400">- Version 3.2.2
  - Don't skip patches with rebootSuggested flag [bsc#1183442]</changelog>
  <changelog author="iforster@suse.com" date="1615550401">- Revert inotify-tools dependency: The package is not available in
  SLE. This will probably have to be implemented as a native C
  version.</changelog>
  <changelog author="iforster@suse.com" date="1616673600">- Version 3.3.0
  - Add support for more package managers by bind mounting their directories
  - Support snapshots without dedicated overlay [boo#1183539], [bsc#1183539]
  - Link RPM database correctly with older zypper versions [boo#1183521]
  - Don't discard manual changes in fstab [boo#1183856], [bsc#1192302]</changelog>
  <changelog author="iforster@suse.com" date="1623585600">- Version 3.4.0
  - Apply SElinux context on /etc in transaction [boo#1185625], [boo#1185766]
    [bsc#1186842], [boo#1186775]
  - Implement inotify handling in C instead of Bash; this makes the
  - -drop-if-no-change option work on SLE Micro [bsc#1184529]
  - Use `tukit call` for up, dup and patch to allow resuming an update after
    zypper updated itself in the snapshot [bsc#1185226]
  - Fix obsolete output type messages in initrd [boo#1177149]
  - Make different base snapshot warning more visible [bsc#1185224]</changelog>
  <changelog author="iforster@suse.com" date="1627905600">- Version 3.5.0
  - Add alias setDiscardIfUnchanged for setDiscard. The old method name
    wasn't really clear and will be removed if we should have an API break
    in the future
  - Replace mkinitrd with direct dracut call [boo#1186213]
  - tukit: Add configuration file support (/etc/tukit.conf)
  - Allow users to configure additional bind mounts (see /usr/etc/tukit.conf
    for an example and limitations) [bsc#1188322]
  - Add 'transactional-update status' call. This is a POC for obtaining a
    hash of a system to verify its integrity. The functionality is still
    experimental!
  - Internal bugfixes / optimizations</changelog>
  <changelog author="iforster@suse.com" date="1627992000">- Add tukit.conf to spec file</changelog>
  <changelog author="iforster@suse.com" date="1627992001">- Version 3.5.1
  - t-u: Disable status file generation by default
    The new experimental `status` command requires the availability of
    /etc/YaST2/control.xml, which is not present on all systems. Hide the
    creation of the corresponding status file behind a new EXPERIMENTAL_STATUS
    option to try out this functionality.
  - Increase library version</changelog>
  <changelog author="iforster@suse.com" date="1630324800">- Version 3.5.2
  - tukit: Fix overlay syncing errors with SELinux [bsc#1188648]
  - Don't print message for `shell` with --quiet
    [gh#openSUSE/transactional-update#69]</changelog>
  <changelog author="iforster@suse.com" date="1630929600">- Version 3.5.3
  - t-u: Purge kernels as part of package operations
    Required for live patching support [bsc#1189728]</changelog>
  <changelog author="iforster@suse.com" date="1631361600">- Version 3.5.4
  - tukit: Fix resolved support [boo#1190383]</changelog>
  <changelog author="iforster@suse.com" date="1631880000">- Version 3.5.5
  - t-u: Use tukit for SUSEConnect call [bsc#1190574]
    Correctly registers repositories</changelog>
  <changelog author="iforster@suse.com" date="1632398400">- Version 3.5.6
  - tukit: Add S/390 bootloader support [bsc#1189807]
  - t-u: support purge-kernels with t-u patch [bsc#1190788]</changelog>
  <changelog author="iforster@suse.com" date="1634040000">- Version 3.5.7
  Various fixes affecting Salt support:
  - t-u: Don't squash stderr messages into stdout
  - t-u: Correctly handle case when the snapshot has been deleted due to
    using --drop-if-no-change: Don't show reboot messages and avoid an awk
    error message [bsc#1191475]
  - tukit: Make inotify handler less sensitive / ignore more directories
    [bsc#1191475]</changelog>
  <changelog author="iforster@suse.com" date="1634904000">- Version 3.6.0
  - Simplify mount hierarchy by just using a single slave bind
    mount as the root of the update environment; this may avoid the
    error messages of failed unmounts
    May fix [boo#1191945]</changelog>
  <changelog author="iforster@suse.com" date="1636545600">- Version 3.6.1
  - Fix rsyncing /etc into the running system with
  - -drop-if-no-change [bsc#1192242]</changelog>
  <changelog author="iforster@suse.com" date="1637323200">- Version 3.6.2
  - Bind mount root file system snapshot on itself, this makes the
    temporary directory in /tmp unnecessary; also fixes [boo#1188110]
    to return the correct snapshot's working directory via API call.
  - Use separate mount namespace for transactional-update; this should
    fix several applications that fail to run if a mount point has the
    'unbindable' mount flag set</changelog>
  <changelog author="iforster@suse.com" date="1637582400">- Version 4.0.0~rc1
  This release is API, but not ABI compatible with previous releases;
  existing applications will have to be recompiled against this new version.
  Major features:
  - Introduces a D-Bus service to access the libtukit API via the
    org.opensuse.tukit.Transaction interface
  - Introduces a C binding via libtukit.h.
  Other changes:
  - t-u: Rework --quiet handling to make sure no output is shown even in
    error cases; this is necessary for automation, e.g. with Salt.
    [gh#openSUSE/transactional-update#73]
  - tukit: Allow storing command output into variable by introducing a new
    optional parameter for "execute" and "callExt".
  - Replace multiple and non-standalone occurenses of {} in "callExt"
    argument.
  - Split transactional-update.timer into transactional-update.timer
    and transactional-update-cleanup.timer; the later will clean up
    old snapshots even when the system does not do automatic updates.
  - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged".
  - Throw exception if snapshot is not found.
  - Fix various compiler warnings
- Update spec file:
  - Include tukitd D-Bus daemon
  - Only install one version of the library (as there are no breaking API
    changes yet)
  - Add %pre scriplets for systemd services
  - Replace %systemd_postun scriptlets with %systemd_postun_with_restart
    to satisfy rpmlint checks
  - Add transactional-update log file as %ghost file</changelog>
  <changelog author="iforster@suse.com" date="1646568000">- Version 4.0.0~rc2
  - Fix missing prompt in "shell" command [bsc#1196580]
  - Add output of tukit commands to log file
  - Fix compilation error with GCC12 [boo#1194876]
  - Fixed (non-critical) security review comments [boo#1196149]
  - Fixed selfupdate
  - Code cleanup</changelog>
  <changelog author="iforster@suse.com" date="1651579200">- Version 4.0.0~rc3
  - Add Snapshot interface
  - Reworked signal handling: All public signals are sent from the
    main thread now, keeping the same sender for everything
  - Implement D-Bus call "Execute" for Transactions
  - Implement interface for listing Snapshots
  - Implement Reboot interface
  - Fix bug when using --continue on old snapshots
  - Fix hypothetical integer overflow in snapshot list [bsc#1196826]
  - Fix wrong sort order in status command
    [gh#openSUSE/transactional-update#80]</changelog>
</package>
<package pkgid="0c88c64476bf263682e944b0db3e155e874968164bf2a907b71a92af29696b6d" name="libudev1" arch="aarch64">
  <version epoch="0" ver="246.16" rel="150300.7.48.1"/>
  <changelog author="fbui@suse.com" date="1635422400">- Import commit f2f061f1da064bfd47e2201967a854bb9281ca5b
  98e87fc3fd busctl: use usec granularity for the timestamp printed by the busctl monitor command (jsc#SLE-17798)</changelog>
  <changelog author="mwilck@suse.com" date="1636459200">- Fix IO scheduler udev rules
  * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
    (jsc#SLE-21032, bsc#1192161)
  * 60-io-scheduler.rules: use "none" for multipath components
    (bsc#1192161)</changelog>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
</package>
<package pkgid="ff0e3c624ace253887cbbe9fbe1be67e7fe69f605e6c8789b678dd9eeccbeda0" name="libudev1" arch="x86_64">
  <version epoch="0" ver="246.16" rel="150300.7.48.1"/>
  <changelog author="fbui@suse.com" date="1635422400">- Import commit f2f061f1da064bfd47e2201967a854bb9281ca5b
  98e87fc3fd busctl: use usec granularity for the timestamp printed by the busctl monitor command (jsc#SLE-17798)</changelog>
  <changelog author="mwilck@suse.com" date="1636459200">- Fix IO scheduler udev rules
  * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
    (jsc#SLE-21032, bsc#1192161)
  * 60-io-scheduler.rules: use "none" for multipath components
    (bsc#1192161)</changelog>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
</package>
<package pkgid="af5cfdaa66d572b410d3b9ad33e03565b14fa9e415c8c99d0ee0c212b4da1c9c" name="libxcrypt" arch="src">
  <version epoch="0" ver="4.4.15" rel="150300.4.4.3"/>
  <changelog author="schwab@suse.de" date="1525867200">- ABI compatible replacement for libcypt from glibc</changelog>
  <changelog author="schwab@suse.de" date="1527076800">- Update to libxcrypt 4.0.1</changelog>
  <changelog author="schwab@suse.de" date="1533124800">- Update to libxcrypt 4.1.0
  * Fix spelling of SUSE.
  * Lower the minimum required automake version to 1.14.
  * Fix build with USE_SWAPCONTEXT turned off.
  * Extend --enable-weak-hashes configure option to accept optional
    "glibc" parameter.
  * Fix the leak of obtained random bytes.
  * Check expected output strings for deterministic methods.
  * Fix memory leak in crypt_sha1_rn.
  * Fix read of random bytes out of bounds in gensalt_sha1_rn.
  * Make it possible to disable individual hashes at configure time.
  * Make salt validation pickier.
  * Replace crypt-sunmd5.c with BSD-licensed cleanroom reimplementation.
  * Make crypt_gensalt for $sha1 deterministic.
  * Fix incorrect output-size computation in crypt_sha1_rn.
  * Add docs for SHA1, MD5/Sun, NTHASH.
  * Introduce CRYPT_GENSALT_IMPLEMENTS_* feature test macros.
  * Install libcrypt.pc symlink along with libxcrypt.pc.
  * Extend --enable-obsolete-api configure option.
  * Extend overall test coverage.</changelog>
  <changelog author="jengelh@inai.de" date="1533556800">- Fix RPM groups for Factory.</changelog>
  <changelog author="schwab@suse.de" date="1533729600">- Add conflicts with glibc-devel &lt; 2.28</changelog>
  <changelog author="schwab@suse.de" date="1539086400">- Set compatibility level to suse</changelog>
  <changelog author="mliska@suse.cz" date="1550145600">- Update to version 4.4.3:
  * Add libxcrypt.so, libxcrypt.a and xcrypt.h.
  * Add new man3 manual pages.</changelog>
  <changelog author="schwab@suse.de" date="1550577600">- format-overflow.patch: Fix -Werror=format-overflow</changelog>
  <changelog author="mliska@suse.cz" date="1561032000">- Disable LTO due to symbol versioning (boo#1138833).</changelog>
  <changelog author="schwab@suse.de" date="1575720000">- Update to version 4.4.10
  * Fix alignment problem for GOST 34.11 (Streebog) in gost-yestcrypt.
  * The crypt_* functions will now all fail and set errno to ERANGE if
    their 'phrase' argument is longer than CRYPT_MAX_PASSPHRASE_SIZE
    characters (this is currently 512)
  * The NT hashing method no longer truncates passphrases at 128
    characters; Windows does not do this.
- format-overflow.patch: remove</changelog>
  <changelog author="schwab@suse.de" date="1576152000">- gcc10.patch: fix build with gcc10 (bsc#1158192)</changelog>
  <changelog author="schwab@suse.de" date="1579694400">- Update to version 4.4.11
  * Fixes for GCC v10.x
  * Change how the known-answer tests are parallelized
- gcc10.patch: remove</changelog>
  <changelog author="schwab@suse.de" date="1580385600">- Update to version 4.4.12
  * Another fix for GCC v10.x, which occurs on s390 architectures only.</changelog>
  <changelog author="schwab@suse.de" date="1583150400">- Update to version 4.4.15
  * The compatibility symbols crypt_gensalt_r, xcrypt, xcrypt_r,
    xcrypt_gensalt, and xcrypt_gensalt_r are deprecated further
  * Speed up ka-sunmd5 by skipping most of the test phrases
- Package README.md and TODO.md (bsc#1165389)</changelog>
  <changelog author="schwab@suse.de" date="1598961600">- Add compatibility provides for SLE15</changelog>
  <changelog author="dmueller@suse.com" date="1612612800">- add compatibility provides for Step 15 as well (bsc#1181571)</changelog>
</package>
<package pkgid="81822e12bad0882737b3459008b615ad96173a877bd2bd63b26f4a639d4d6b71" name="libzypp" arch="aarch64">
  <version epoch="0" ver="17.30.0" rel="150200.36.1"/>
  <changelog author="ma@suse.de" date="1622548800">- Work around download.o.o broken https redirects.
- Allow trusted repos to add additional signing keys (bsc#1184326)
  Repositories signed with a trusted gpg key may import additional
  package signing keys. This is needed if different keys were used
  to sign the the packages shipped by the repository.
- MediaCurl: Fix logging of redirects.
- Use 15.3 resolver problem and solution texts on all distros.
- $ZYPP_LOCK_TIMEOUT: Let negative values wait forever for the
  zypp lock (bsc#1184399)
  Helps boot time services like 'zypper purge-kernels' to wait for
  the zypp lock until other services using zypper have completed.
- Fix purge-kernels is broken in Leap 15.3 (bsc#1185325)
  Leap 15.3 introduces a new kernel package called
  kernel-flavour-extra, which contain kmp's. Currently kmp's are
  detected by name ".*-kmp(-.*)?" but this does not work which
  those new packages. This patch fixes the problem by checking
  packages for kmod(*) and ksym(*) provides and only falls back to
  name checking if the package in question does not provide one of
  those.
- Introduce zypp-runpurge, a tool to run purge-kernels on
  testcases.
- version 17.26.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1623326400">- Enhance XML output of repo GPG options (fixes openSUSE/zypper#390)
  In addition to the effective values, add optional attributes
  showing the raw values actually present in the .repo file.
  (raw_gpgcheck, raw_repo_gpgcheck, raw_pkg_gpgcheck)
- Link all executables with -pie (bsc#1186447)
- Ship an empty /etc/zypp/needreboot per default (fixes #311, jsc#PM-2645)
  If packages want to trigger the reboot-needed hiint upon installation
  they may provide 'installhint(reboot-needed)'.
  Builtin packages triggering the hint without the provides are
  only kernel and kernel-firmware related.
- Add Solvable::isBlacklisted as superset of retracted and ptf
  packages (bsc#1186503)
- Fix segv if ZYPP_FULLOG is set (fixes #317)
- version 17.27.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1627300800">- Rephrase vendor conflict message in case 2 packages are
  involved (bsc#1187760)
  This covers the case where not the packages itself would change
  its vendor, but replaces a package from a different vendor.
- Fix solver jobs for PTFs (bsc#1186503)
- spec: switch to pkgconfig(openssl)
- Show key fpr from signature when signature check fails
  (bsc#1187224)
  Rpm by default only shows the short key ID when checking the
  signature of a package fails. This patch reads the signatures
  from the RPM headers and replaces she short IDs with the key
  fingerprints fetched from the signatures.
- Implement alternative single transaction commit strategy.
  This patch adds a experimental commit strategy that runs all
  operations in a single rpm transaction, speeding up the execution
  a lot.
- Use ZYPP_MEDIANETWORK=1 to enable the experimental new media
  backend.
- Implement zchunk download, refactor Downloader backend.
- Fix purge-kernels fails with kernels from Kernel:HEAD
  (bsc#1187738)
  There recently was a change in the kernel package naming scheme
  in regards to rc kernels. Since kernel upstream uses characters
  in the version that are not allowed in rpm versions a "-rc" was
  previously replaced with ".rc" which broke sorting by version, to
  fix this issue it was replaced with "~rc", which unfortunately
  broke the purge-kernels logic. This patch makes sure purge-kernel
  does apply the same conversion.
- version 17.28.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1629720000">- Fix crashes in logging code when shutting down (bsc#1189031)
- version 17.28.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1630411200">- Workaround Bug 1189788: Don't allow ZYPP_SINGLE_RPMTRANS=1 on a
  not UsrMerged Tumbleweed system.
- version 17.28.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1630670400">- CMake/spec: Add option to force SINGLE_RPMTRANS as default for
  zypper (fixes #340)
- Make sure singleTrans is zypper-only for now.
- Do not double check signatures and keys (bsc#1190059)
- version 17.28.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1631880000">- Make sure to keep states alives while transitioning
  (bsc#1190199)
- May set techpreview variables for testing in /etc/zypp/zypp.conf.
  If environment variables are unhandy one may enable the desired
  techpreview in zypp.conf as well:
    [main]
    techpreview.ZYPP_SINGLE_RPMTRANS=1
    techpreview.ZYPP_MEDIANETWORK=1
- version 17.28.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1633348800">- Downloader does not respect checkExistsOnly flag (bsc#1190712)
  A missing check causes zyppng::Downloader to always download full
  files even if the checkExistsOnly flag is set. This patch adds
  the missing logic.
- Fix kernel-*-livepatch removal in purge-kernels (bsc#1190815)
  The kernel-*-livepatch packages are supposed to serve as a stable
  handle for the ephemeral kernel livepatch packages. See
  FATE#320268 for details. As part of the kernel live patching
  ecosystem, kernel-*-livepatch packages should not block the
  purge-kernels step.
- version 17.28.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Zypper should keep cached files if transaction is aborted
  (bsc#1190356)
  Singletrans mode currently does not keep files around if the
  transaction is aborted. This patch fixes the problem.
- Require a minimum number of mirrors for multicurl (bsc#1191609)
- Use procfs to detect nr of open fd's if rlimit is too high
  (bsc#1191324)
  Especially in a VM iterating over all possible fd's to close open
  ones right before a exec() slows down zypper unnecessarily. This
  patch uses /proc/self/fd to iterate over open fd's in case rlimit
  is above 1024.
- po: Fix some lost '%' signs in positional args (bsc#1191370)
- RepoManager: Don't probe for plaindir repo if URL schema is
  plugin: (bsc#1191286)
- version 17.28.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1636027200">- Check log writer before accessing it (fixes #355, bsc#1192337)
- Save locks: Update an existing locks changed comment string.
- Allow uname-r format in purge kernels keepspec (fixes
  openSUSE/zypper#418)
- version 17.28.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1636632000">- Disable logger in the child after fork (bsc#1192436)
- version 17.28.8 (22)</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Use the default zypp.conf settings if no zypp.conf exists
  (bsc#1193488)
- Fix wrong encoding of iso: URL components (bsc#954813)
- Handle armv8l as armv7hl compatible userland.
- Introduce zypp-curl a sublibrary for CURL related code.
- zypp-rpm: Increase rpm loglevel if ZYPP_RPM_DEBUG is set.
- Save all signatures associated with a public key in its
  PublicKeyData.
- version 17.29.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1641816000">- Fix broken install path for parser compat headers (fixes #372,
  bsc#1194597)
- RepoManager: remember exec errors in exception history
  (bsc#1193007)
- version 17.29.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1642680000">- Fix Legacy include (bsc#1194597)
- version 17.29.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1643716800">- Public header files on older distros must use c++11
  (bsc#1194597)
- Fix exception handling when reading or writing credentials
  (bsc#1194898)
- version 17.29.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1644321600">- Fix handling of redirected command in-/output (bsc#1195326)
  This fixes delays at the end of zypper operations, where
  zypper unintentionally waits for appdata plugin scripts to
  complete.
- version 17.29.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1645704000">- Hint on ptf&lt;&gt;patch resolver conflicts (bsc#1194848)
- version 17.29.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1647259200">- Fix package signature check (bsc#1184501)
  Pay attention that header and payload are secured by a valid
  signature and report more detailed which signature is missing.
- Retry umount if device is busy (bsc#1196061, closes #381)
  A previously released ISO image may need a bit more time to
  release it's loop device. So we wait a bit and retry.
- Fix serializing/deserializing type mismatch in zypp-rpm
  protocol (bsc#1196925)
- Fix handling of ISO media in releaseAll (bsc#1196061)
- Hint on common ptf resolver conflicts (bsc#1194848)
- version 17.29.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1647864000">- Fix possible hang in singletrans mode (bsc#1197134)
- Do 2 retries if mount is still busy.
- version 17.29.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1648209600">- ZConfig: Update solver settings if target changes (bsc#1196368)
- version 17.30.0 (22)</changelog>
</package>
<package pkgid="954af5e24852a65b34aa0a4a62043893034240c8cca7ed5219b50729c974bcc8" name="libzypp" arch="src">
  <version epoch="0" ver="17.30.0" rel="150200.36.1"/>
  <changelog author="ma@suse.de" date="1622548800">- Work around download.o.o broken https redirects.
- Allow trusted repos to add additional signing keys (bsc#1184326)
  Repositories signed with a trusted gpg key may import additional
  package signing keys. This is needed if different keys were used
  to sign the the packages shipped by the repository.
- MediaCurl: Fix logging of redirects.
- Use 15.3 resolver problem and solution texts on all distros.
- $ZYPP_LOCK_TIMEOUT: Let negative values wait forever for the
  zypp lock (bsc#1184399)
  Helps boot time services like 'zypper purge-kernels' to wait for
  the zypp lock until other services using zypper have completed.
- Fix purge-kernels is broken in Leap 15.3 (bsc#1185325)
  Leap 15.3 introduces a new kernel package called
  kernel-flavour-extra, which contain kmp's. Currently kmp's are
  detected by name ".*-kmp(-.*)?" but this does not work which
  those new packages. This patch fixes the problem by checking
  packages for kmod(*) and ksym(*) provides and only falls back to
  name checking if the package in question does not provide one of
  those.
- Introduce zypp-runpurge, a tool to run purge-kernels on
  testcases.
- version 17.26.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1623326400">- Enhance XML output of repo GPG options (fixes openSUSE/zypper#390)
  In addition to the effective values, add optional attributes
  showing the raw values actually present in the .repo file.
  (raw_gpgcheck, raw_repo_gpgcheck, raw_pkg_gpgcheck)
- Link all executables with -pie (bsc#1186447)
- Ship an empty /etc/zypp/needreboot per default (fixes #311, jsc#PM-2645)
  If packages want to trigger the reboot-needed hiint upon installation
  they may provide 'installhint(reboot-needed)'.
  Builtin packages triggering the hint without the provides are
  only kernel and kernel-firmware related.
- Add Solvable::isBlacklisted as superset of retracted and ptf
  packages (bsc#1186503)
- Fix segv if ZYPP_FULLOG is set (fixes #317)
- version 17.27.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1627300800">- Rephrase vendor conflict message in case 2 packages are
  involved (bsc#1187760)
  This covers the case where not the packages itself would change
  its vendor, but replaces a package from a different vendor.
- Fix solver jobs for PTFs (bsc#1186503)
- spec: switch to pkgconfig(openssl)
- Show key fpr from signature when signature check fails
  (bsc#1187224)
  Rpm by default only shows the short key ID when checking the
  signature of a package fails. This patch reads the signatures
  from the RPM headers and replaces she short IDs with the key
  fingerprints fetched from the signatures.
- Implement alternative single transaction commit strategy.
  This patch adds a experimental commit strategy that runs all
  operations in a single rpm transaction, speeding up the execution
  a lot.
- Use ZYPP_MEDIANETWORK=1 to enable the experimental new media
  backend.
- Implement zchunk download, refactor Downloader backend.
- Fix purge-kernels fails with kernels from Kernel:HEAD
  (bsc#1187738)
  There recently was a change in the kernel package naming scheme
  in regards to rc kernels. Since kernel upstream uses characters
  in the version that are not allowed in rpm versions a "-rc" was
  previously replaced with ".rc" which broke sorting by version, to
  fix this issue it was replaced with "~rc", which unfortunately
  broke the purge-kernels logic. This patch makes sure purge-kernel
  does apply the same conversion.
- version 17.28.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1629720000">- Fix crashes in logging code when shutting down (bsc#1189031)
- version 17.28.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1630411200">- Workaround Bug 1189788: Don't allow ZYPP_SINGLE_RPMTRANS=1 on a
  not UsrMerged Tumbleweed system.
- version 17.28.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1630670400">- CMake/spec: Add option to force SINGLE_RPMTRANS as default for
  zypper (fixes #340)
- Make sure singleTrans is zypper-only for now.
- Do not double check signatures and keys (bsc#1190059)
- version 17.28.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1631880000">- Make sure to keep states alives while transitioning
  (bsc#1190199)
- May set techpreview variables for testing in /etc/zypp/zypp.conf.
  If environment variables are unhandy one may enable the desired
  techpreview in zypp.conf as well:
    [main]
    techpreview.ZYPP_SINGLE_RPMTRANS=1
    techpreview.ZYPP_MEDIANETWORK=1
- version 17.28.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1633348800">- Downloader does not respect checkExistsOnly flag (bsc#1190712)
  A missing check causes zyppng::Downloader to always download full
  files even if the checkExistsOnly flag is set. This patch adds
  the missing logic.
- Fix kernel-*-livepatch removal in purge-kernels (bsc#1190815)
  The kernel-*-livepatch packages are supposed to serve as a stable
  handle for the ephemeral kernel livepatch packages. See
  FATE#320268 for details. As part of the kernel live patching
  ecosystem, kernel-*-livepatch packages should not block the
  purge-kernels step.
- version 17.28.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Zypper should keep cached files if transaction is aborted
  (bsc#1190356)
  Singletrans mode currently does not keep files around if the
  transaction is aborted. This patch fixes the problem.
- Require a minimum number of mirrors for multicurl (bsc#1191609)
- Use procfs to detect nr of open fd's if rlimit is too high
  (bsc#1191324)
  Especially in a VM iterating over all possible fd's to close open
  ones right before a exec() slows down zypper unnecessarily. This
  patch uses /proc/self/fd to iterate over open fd's in case rlimit
  is above 1024.
- po: Fix some lost '%' signs in positional args (bsc#1191370)
- RepoManager: Don't probe for plaindir repo if URL schema is
  plugin: (bsc#1191286)
- version 17.28.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1636027200">- Check log writer before accessing it (fixes #355, bsc#1192337)
- Save locks: Update an existing locks changed comment string.
- Allow uname-r format in purge kernels keepspec (fixes
  openSUSE/zypper#418)
- version 17.28.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1636632000">- Disable logger in the child after fork (bsc#1192436)
- version 17.28.8 (22)</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Use the default zypp.conf settings if no zypp.conf exists
  (bsc#1193488)
- Fix wrong encoding of iso: URL components (bsc#954813)
- Handle armv8l as armv7hl compatible userland.
- Introduce zypp-curl a sublibrary for CURL related code.
- zypp-rpm: Increase rpm loglevel if ZYPP_RPM_DEBUG is set.
- Save all signatures associated with a public key in its
  PublicKeyData.
- version 17.29.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1641816000">- Fix broken install path for parser compat headers (fixes #372,
  bsc#1194597)
- RepoManager: remember exec errors in exception history
  (bsc#1193007)
- version 17.29.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1642680000">- Fix Legacy include (bsc#1194597)
- version 17.29.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1643716800">- Public header files on older distros must use c++11
  (bsc#1194597)
- Fix exception handling when reading or writing credentials
  (bsc#1194898)
- version 17.29.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1644321600">- Fix handling of redirected command in-/output (bsc#1195326)
  This fixes delays at the end of zypper operations, where
  zypper unintentionally waits for appdata plugin scripts to
  complete.
- version 17.29.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1645704000">- Hint on ptf&lt;&gt;patch resolver conflicts (bsc#1194848)
- version 17.29.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1647259200">- Fix package signature check (bsc#1184501)
  Pay attention that header and payload are secured by a valid
  signature and report more detailed which signature is missing.
- Retry umount if device is busy (bsc#1196061, closes #381)
  A previously released ISO image may need a bit more time to
  release it's loop device. So we wait a bit and retry.
- Fix serializing/deserializing type mismatch in zypp-rpm
  protocol (bsc#1196925)
- Fix handling of ISO media in releaseAll (bsc#1196061)
- Hint on common ptf resolver conflicts (bsc#1194848)
- version 17.29.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1647864000">- Fix possible hang in singletrans mode (bsc#1197134)
- Do 2 retries if mount is still busy.
- version 17.29.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1648209600">- ZConfig: Update solver settings if target changes (bsc#1196368)
- version 17.30.0 (22)</changelog>
</package>
<package pkgid="96ea6e2271730830a692d715bea3e95f52ead6b36253d11b9cbe3b2ad7f95a6e" name="libzypp" arch="x86_64">
  <version epoch="0" ver="17.30.0" rel="150200.36.1"/>
  <changelog author="ma@suse.de" date="1622548800">- Work around download.o.o broken https redirects.
- Allow trusted repos to add additional signing keys (bsc#1184326)
  Repositories signed with a trusted gpg key may import additional
  package signing keys. This is needed if different keys were used
  to sign the the packages shipped by the repository.
- MediaCurl: Fix logging of redirects.
- Use 15.3 resolver problem and solution texts on all distros.
- $ZYPP_LOCK_TIMEOUT: Let negative values wait forever for the
  zypp lock (bsc#1184399)
  Helps boot time services like 'zypper purge-kernels' to wait for
  the zypp lock until other services using zypper have completed.
- Fix purge-kernels is broken in Leap 15.3 (bsc#1185325)
  Leap 15.3 introduces a new kernel package called
  kernel-flavour-extra, which contain kmp's. Currently kmp's are
  detected by name ".*-kmp(-.*)?" but this does not work which
  those new packages. This patch fixes the problem by checking
  packages for kmod(*) and ksym(*) provides and only falls back to
  name checking if the package in question does not provide one of
  those.
- Introduce zypp-runpurge, a tool to run purge-kernels on
  testcases.
- version 17.26.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1623326400">- Enhance XML output of repo GPG options (fixes openSUSE/zypper#390)
  In addition to the effective values, add optional attributes
  showing the raw values actually present in the .repo file.
  (raw_gpgcheck, raw_repo_gpgcheck, raw_pkg_gpgcheck)
- Link all executables with -pie (bsc#1186447)
- Ship an empty /etc/zypp/needreboot per default (fixes #311, jsc#PM-2645)
  If packages want to trigger the reboot-needed hiint upon installation
  they may provide 'installhint(reboot-needed)'.
  Builtin packages triggering the hint without the provides are
  only kernel and kernel-firmware related.
- Add Solvable::isBlacklisted as superset of retracted and ptf
  packages (bsc#1186503)
- Fix segv if ZYPP_FULLOG is set (fixes #317)
- version 17.27.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1627300800">- Rephrase vendor conflict message in case 2 packages are
  involved (bsc#1187760)
  This covers the case where not the packages itself would change
  its vendor, but replaces a package from a different vendor.
- Fix solver jobs for PTFs (bsc#1186503)
- spec: switch to pkgconfig(openssl)
- Show key fpr from signature when signature check fails
  (bsc#1187224)
  Rpm by default only shows the short key ID when checking the
  signature of a package fails. This patch reads the signatures
  from the RPM headers and replaces she short IDs with the key
  fingerprints fetched from the signatures.
- Implement alternative single transaction commit strategy.
  This patch adds a experimental commit strategy that runs all
  operations in a single rpm transaction, speeding up the execution
  a lot.
- Use ZYPP_MEDIANETWORK=1 to enable the experimental new media
  backend.
- Implement zchunk download, refactor Downloader backend.
- Fix purge-kernels fails with kernels from Kernel:HEAD
  (bsc#1187738)
  There recently was a change in the kernel package naming scheme
  in regards to rc kernels. Since kernel upstream uses characters
  in the version that are not allowed in rpm versions a "-rc" was
  previously replaced with ".rc" which broke sorting by version, to
  fix this issue it was replaced with "~rc", which unfortunately
  broke the purge-kernels logic. This patch makes sure purge-kernel
  does apply the same conversion.
- version 17.28.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1629720000">- Fix crashes in logging code when shutting down (bsc#1189031)
- version 17.28.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1630411200">- Workaround Bug 1189788: Don't allow ZYPP_SINGLE_RPMTRANS=1 on a
  not UsrMerged Tumbleweed system.
- version 17.28.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1630670400">- CMake/spec: Add option to force SINGLE_RPMTRANS as default for
  zypper (fixes #340)
- Make sure singleTrans is zypper-only for now.
- Do not double check signatures and keys (bsc#1190059)
- version 17.28.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1631880000">- Make sure to keep states alives while transitioning
  (bsc#1190199)
- May set techpreview variables for testing in /etc/zypp/zypp.conf.
  If environment variables are unhandy one may enable the desired
  techpreview in zypp.conf as well:
    [main]
    techpreview.ZYPP_SINGLE_RPMTRANS=1
    techpreview.ZYPP_MEDIANETWORK=1
- version 17.28.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1633348800">- Downloader does not respect checkExistsOnly flag (bsc#1190712)
  A missing check causes zyppng::Downloader to always download full
  files even if the checkExistsOnly flag is set. This patch adds
  the missing logic.
- Fix kernel-*-livepatch removal in purge-kernels (bsc#1190815)
  The kernel-*-livepatch packages are supposed to serve as a stable
  handle for the ephemeral kernel livepatch packages. See
  FATE#320268 for details. As part of the kernel live patching
  ecosystem, kernel-*-livepatch packages should not block the
  purge-kernels step.
- version 17.28.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Zypper should keep cached files if transaction is aborted
  (bsc#1190356)
  Singletrans mode currently does not keep files around if the
  transaction is aborted. This patch fixes the problem.
- Require a minimum number of mirrors for multicurl (bsc#1191609)
- Use procfs to detect nr of open fd's if rlimit is too high
  (bsc#1191324)
  Especially in a VM iterating over all possible fd's to close open
  ones right before a exec() slows down zypper unnecessarily. This
  patch uses /proc/self/fd to iterate over open fd's in case rlimit
  is above 1024.
- po: Fix some lost '%' signs in positional args (bsc#1191370)
- RepoManager: Don't probe for plaindir repo if URL schema is
  plugin: (bsc#1191286)
- version 17.28.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1636027200">- Check log writer before accessing it (fixes #355, bsc#1192337)
- Save locks: Update an existing locks changed comment string.
- Allow uname-r format in purge kernels keepspec (fixes
  openSUSE/zypper#418)
- version 17.28.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1636632000">- Disable logger in the child after fork (bsc#1192436)
- version 17.28.8 (22)</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Use the default zypp.conf settings if no zypp.conf exists
  (bsc#1193488)
- Fix wrong encoding of iso: URL components (bsc#954813)
- Handle armv8l as armv7hl compatible userland.
- Introduce zypp-curl a sublibrary for CURL related code.
- zypp-rpm: Increase rpm loglevel if ZYPP_RPM_DEBUG is set.
- Save all signatures associated with a public key in its
  PublicKeyData.
- version 17.29.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1641816000">- Fix broken install path for parser compat headers (fixes #372,
  bsc#1194597)
- RepoManager: remember exec errors in exception history
  (bsc#1193007)
- version 17.29.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1642680000">- Fix Legacy include (bsc#1194597)
- version 17.29.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1643716800">- Public header files on older distros must use c++11
  (bsc#1194597)
- Fix exception handling when reading or writing credentials
  (bsc#1194898)
- version 17.29.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1644321600">- Fix handling of redirected command in-/output (bsc#1195326)
  This fixes delays at the end of zypper operations, where
  zypper unintentionally waits for appdata plugin scripts to
  complete.
- version 17.29.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1645704000">- Hint on ptf&lt;&gt;patch resolver conflicts (bsc#1194848)
- version 17.29.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1647259200">- Fix package signature check (bsc#1184501)
  Pay attention that header and payload are secured by a valid
  signature and report more detailed which signature is missing.
- Retry umount if device is busy (bsc#1196061, closes #381)
  A previously released ISO image may need a bit more time to
  release it's loop device. So we wait a bit and retry.
- Fix serializing/deserializing type mismatch in zypp-rpm
  protocol (bsc#1196925)
- Fix handling of ISO media in releaseAll (bsc#1196061)
- Hint on common ptf resolver conflicts (bsc#1194848)
- version 17.29.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1647864000">- Fix possible hang in singletrans mode (bsc#1197134)
- Do 2 retries if mount is still busy.
- version 17.29.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1648209600">- ZConfig: Update solver settings if target changes (bsc#1196368)
- version 17.30.0 (22)</changelog>
</package>
<package pkgid="9982b90916ca53ba39b9912b80cd34dd7a91f732ca8b7c98c1fde3176baa054d" name="libzypp" arch="aarch64">
  <version epoch="0" ver="17.30.2" rel="150200.39.1"/>
  <changelog author="ma@suse.de" date="1627300800">- Rephrase vendor conflict message in case 2 packages are
  involved (bsc#1187760)
  This covers the case where not the packages itself would change
  its vendor, but replaces a package from a different vendor.
- Fix solver jobs for PTFs (bsc#1186503)
- spec: switch to pkgconfig(openssl)
- Show key fpr from signature when signature check fails
  (bsc#1187224)
  Rpm by default only shows the short key ID when checking the
  signature of a package fails. This patch reads the signatures
  from the RPM headers and replaces she short IDs with the key
  fingerprints fetched from the signatures.
- Implement alternative single transaction commit strategy.
  This patch adds a experimental commit strategy that runs all
  operations in a single rpm transaction, speeding up the execution
  a lot.
- Use ZYPP_MEDIANETWORK=1 to enable the experimental new media
  backend.
- Implement zchunk download, refactor Downloader backend.
- Fix purge-kernels fails with kernels from Kernel:HEAD
  (bsc#1187738)
  There recently was a change in the kernel package naming scheme
  in regards to rc kernels. Since kernel upstream uses characters
  in the version that are not allowed in rpm versions a "-rc" was
  previously replaced with ".rc" which broke sorting by version, to
  fix this issue it was replaced with "~rc", which unfortunately
  broke the purge-kernels logic. This patch makes sure purge-kernel
  does apply the same conversion.
- version 17.28.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1629720000">- Fix crashes in logging code when shutting down (bsc#1189031)
- version 17.28.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1630411200">- Workaround Bug 1189788: Don't allow ZYPP_SINGLE_RPMTRANS=1 on a
  not UsrMerged Tumbleweed system.
- version 17.28.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1630670400">- CMake/spec: Add option to force SINGLE_RPMTRANS as default for
  zypper (fixes #340)
- Make sure singleTrans is zypper-only for now.
- Do not double check signatures and keys (bsc#1190059)
- version 17.28.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1631880000">- Make sure to keep states alives while transitioning
  (bsc#1190199)
- May set techpreview variables for testing in /etc/zypp/zypp.conf.
  If environment variables are unhandy one may enable the desired
  techpreview in zypp.conf as well:
    [main]
    techpreview.ZYPP_SINGLE_RPMTRANS=1
    techpreview.ZYPP_MEDIANETWORK=1
- version 17.28.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1633348800">- Downloader does not respect checkExistsOnly flag (bsc#1190712)
  A missing check causes zyppng::Downloader to always download full
  files even if the checkExistsOnly flag is set. This patch adds
  the missing logic.
- Fix kernel-*-livepatch removal in purge-kernels (bsc#1190815)
  The kernel-*-livepatch packages are supposed to serve as a stable
  handle for the ephemeral kernel livepatch packages. See
  FATE#320268 for details. As part of the kernel live patching
  ecosystem, kernel-*-livepatch packages should not block the
  purge-kernels step.
- version 17.28.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Zypper should keep cached files if transaction is aborted
  (bsc#1190356)
  Singletrans mode currently does not keep files around if the
  transaction is aborted. This patch fixes the problem.
- Require a minimum number of mirrors for multicurl (bsc#1191609)
- Use procfs to detect nr of open fd's if rlimit is too high
  (bsc#1191324)
  Especially in a VM iterating over all possible fd's to close open
  ones right before a exec() slows down zypper unnecessarily. This
  patch uses /proc/self/fd to iterate over open fd's in case rlimit
  is above 1024.
- po: Fix some lost '%' signs in positional args (bsc#1191370)
- RepoManager: Don't probe for plaindir repo if URL schema is
  plugin: (bsc#1191286)
- version 17.28.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1636027200">- Check log writer before accessing it (fixes #355, bsc#1192337)
- Save locks: Update an existing locks changed comment string.
- Allow uname-r format in purge kernels keepspec (fixes
  openSUSE/zypper#418)
- version 17.28.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1636632000">- Disable logger in the child after fork (bsc#1192436)
- version 17.28.8 (22)</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Use the default zypp.conf settings if no zypp.conf exists
  (bsc#1193488)
- Fix wrong encoding of iso: URL components (bsc#954813)
- Handle armv8l as armv7hl compatible userland.
- Introduce zypp-curl a sublibrary for CURL related code.
- zypp-rpm: Increase rpm loglevel if ZYPP_RPM_DEBUG is set.
- Save all signatures associated with a public key in its
  PublicKeyData.
- version 17.29.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1641816000">- Fix broken install path for parser compat headers (fixes #372,
  bsc#1194597)
- RepoManager: remember exec errors in exception history
  (bsc#1193007)
- version 17.29.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1642680000">- Fix Legacy include (bsc#1194597)
- version 17.29.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1643716800">- Public header files on older distros must use c++11
  (bsc#1194597)
- Fix exception handling when reading or writing credentials
  (bsc#1194898)
- version 17.29.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1644321600">- Fix handling of redirected command in-/output (bsc#1195326)
  This fixes delays at the end of zypper operations, where
  zypper unintentionally waits for appdata plugin scripts to
  complete.
- version 17.29.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1645704000">- Hint on ptf&lt;&gt;patch resolver conflicts (bsc#1194848)
- version 17.29.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1647259200">- Fix package signature check (bsc#1184501)
  Pay attention that header and payload are secured by a valid
  signature and report more detailed which signature is missing.
- Retry umount if device is busy (bsc#1196061, closes #381)
  A previously released ISO image may need a bit more time to
  release it's loop device. So we wait a bit and retry.
- Fix serializing/deserializing type mismatch in zypp-rpm
  protocol (bsc#1196925)
- Fix handling of ISO media in releaseAll (bsc#1196061)
- Hint on common ptf resolver conflicts (bsc#1194848)
- version 17.29.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1647864000">- Fix possible hang in singletrans mode (bsc#1197134)
- Do 2 retries if mount is still busy.
- version 17.29.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1648209600">- ZConfig: Update solver settings if target changes (bsc#1196368)
- version 17.30.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1653912000">- PluginRepoverification: initial version hooked into
  repo::Downloader and repo refresh.
- Immediately start monitoring the download.transfer_timeout.
  Do not wait until the first data arrived. (bsc#1199042)
- singletrans: no dry-run commit if doing just download-only.
- Work around cases where sat repo.start points to an invalid
  solvable.  May happen if (wrong arch) solvables were removed
  at the  beginning of the repo.
- fix misplaced #endif SINGLE_RPMTRANS_AS_DEFAULT_FOR_ZYPPER
  (fixes #388)
- version 17.30.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1655294400">- appdata plugin: Pass path to the repodata/ directory inside the
  cache (bsc#1197684)
- zypp-rpm: flush rpm script output buffer before sending
  endOfScriptTag.
- version 17.30.2 (22)</changelog>
</package>
<package pkgid="4202291f3cb14cf4c1b3d6872e96fb97a92af42d7961c9dafb80e3ef06bc3aa2" name="libzypp" arch="src">
  <version epoch="0" ver="17.30.2" rel="150200.39.1"/>
  <changelog author="ma@suse.de" date="1627300800">- Rephrase vendor conflict message in case 2 packages are
  involved (bsc#1187760)
  This covers the case where not the packages itself would change
  its vendor, but replaces a package from a different vendor.
- Fix solver jobs for PTFs (bsc#1186503)
- spec: switch to pkgconfig(openssl)
- Show key fpr from signature when signature check fails
  (bsc#1187224)
  Rpm by default only shows the short key ID when checking the
  signature of a package fails. This patch reads the signatures
  from the RPM headers and replaces she short IDs with the key
  fingerprints fetched from the signatures.
- Implement alternative single transaction commit strategy.
  This patch adds a experimental commit strategy that runs all
  operations in a single rpm transaction, speeding up the execution
  a lot.
- Use ZYPP_MEDIANETWORK=1 to enable the experimental new media
  backend.
- Implement zchunk download, refactor Downloader backend.
- Fix purge-kernels fails with kernels from Kernel:HEAD
  (bsc#1187738)
  There recently was a change in the kernel package naming scheme
  in regards to rc kernels. Since kernel upstream uses characters
  in the version that are not allowed in rpm versions a "-rc" was
  previously replaced with ".rc" which broke sorting by version, to
  fix this issue it was replaced with "~rc", which unfortunately
  broke the purge-kernels logic. This patch makes sure purge-kernel
  does apply the same conversion.
- version 17.28.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1629720000">- Fix crashes in logging code when shutting down (bsc#1189031)
- version 17.28.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1630411200">- Workaround Bug 1189788: Don't allow ZYPP_SINGLE_RPMTRANS=1 on a
  not UsrMerged Tumbleweed system.
- version 17.28.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1630670400">- CMake/spec: Add option to force SINGLE_RPMTRANS as default for
  zypper (fixes #340)
- Make sure singleTrans is zypper-only for now.
- Do not double check signatures and keys (bsc#1190059)
- version 17.28.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1631880000">- Make sure to keep states alives while transitioning
  (bsc#1190199)
- May set techpreview variables for testing in /etc/zypp/zypp.conf.
  If environment variables are unhandy one may enable the desired
  techpreview in zypp.conf as well:
    [main]
    techpreview.ZYPP_SINGLE_RPMTRANS=1
    techpreview.ZYPP_MEDIANETWORK=1
- version 17.28.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1633348800">- Downloader does not respect checkExistsOnly flag (bsc#1190712)
  A missing check causes zyppng::Downloader to always download full
  files even if the checkExistsOnly flag is set. This patch adds
  the missing logic.
- Fix kernel-*-livepatch removal in purge-kernels (bsc#1190815)
  The kernel-*-livepatch packages are supposed to serve as a stable
  handle for the ephemeral kernel livepatch packages. See
  FATE#320268 for details. As part of the kernel live patching
  ecosystem, kernel-*-livepatch packages should not block the
  purge-kernels step.
- version 17.28.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Zypper should keep cached files if transaction is aborted
  (bsc#1190356)
  Singletrans mode currently does not keep files around if the
  transaction is aborted. This patch fixes the problem.
- Require a minimum number of mirrors for multicurl (bsc#1191609)
- Use procfs to detect nr of open fd's if rlimit is too high
  (bsc#1191324)
  Especially in a VM iterating over all possible fd's to close open
  ones right before a exec() slows down zypper unnecessarily. This
  patch uses /proc/self/fd to iterate over open fd's in case rlimit
  is above 1024.
- po: Fix some lost '%' signs in positional args (bsc#1191370)
- RepoManager: Don't probe for plaindir repo if URL schema is
  plugin: (bsc#1191286)
- version 17.28.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1636027200">- Check log writer before accessing it (fixes #355, bsc#1192337)
- Save locks: Update an existing locks changed comment string.
- Allow uname-r format in purge kernels keepspec (fixes
  openSUSE/zypper#418)
- version 17.28.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1636632000">- Disable logger in the child after fork (bsc#1192436)
- version 17.28.8 (22)</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Use the default zypp.conf settings if no zypp.conf exists
  (bsc#1193488)
- Fix wrong encoding of iso: URL components (bsc#954813)
- Handle armv8l as armv7hl compatible userland.
- Introduce zypp-curl a sublibrary for CURL related code.
- zypp-rpm: Increase rpm loglevel if ZYPP_RPM_DEBUG is set.
- Save all signatures associated with a public key in its
  PublicKeyData.
- version 17.29.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1641816000">- Fix broken install path for parser compat headers (fixes #372,
  bsc#1194597)
- RepoManager: remember exec errors in exception history
  (bsc#1193007)
- version 17.29.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1642680000">- Fix Legacy include (bsc#1194597)
- version 17.29.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1643716800">- Public header files on older distros must use c++11
  (bsc#1194597)
- Fix exception handling when reading or writing credentials
  (bsc#1194898)
- version 17.29.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1644321600">- Fix handling of redirected command in-/output (bsc#1195326)
  This fixes delays at the end of zypper operations, where
  zypper unintentionally waits for appdata plugin scripts to
  complete.
- version 17.29.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1645704000">- Hint on ptf&lt;&gt;patch resolver conflicts (bsc#1194848)
- version 17.29.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1647259200">- Fix package signature check (bsc#1184501)
  Pay attention that header and payload are secured by a valid
  signature and report more detailed which signature is missing.
- Retry umount if device is busy (bsc#1196061, closes #381)
  A previously released ISO image may need a bit more time to
  release it's loop device. So we wait a bit and retry.
- Fix serializing/deserializing type mismatch in zypp-rpm
  protocol (bsc#1196925)
- Fix handling of ISO media in releaseAll (bsc#1196061)
- Hint on common ptf resolver conflicts (bsc#1194848)
- version 17.29.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1647864000">- Fix possible hang in singletrans mode (bsc#1197134)
- Do 2 retries if mount is still busy.
- version 17.29.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1648209600">- ZConfig: Update solver settings if target changes (bsc#1196368)
- version 17.30.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1653912000">- PluginRepoverification: initial version hooked into
  repo::Downloader and repo refresh.
- Immediately start monitoring the download.transfer_timeout.
  Do not wait until the first data arrived. (bsc#1199042)
- singletrans: no dry-run commit if doing just download-only.
- Work around cases where sat repo.start points to an invalid
  solvable.  May happen if (wrong arch) solvables were removed
  at the  beginning of the repo.
- fix misplaced #endif SINGLE_RPMTRANS_AS_DEFAULT_FOR_ZYPPER
  (fixes #388)
- version 17.30.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1655294400">- appdata plugin: Pass path to the repodata/ directory inside the
  cache (bsc#1197684)
- zypp-rpm: flush rpm script output buffer before sending
  endOfScriptTag.
- version 17.30.2 (22)</changelog>
</package>
<package pkgid="6d5038e756801965a18c719e645ef3440c50931e78a16db7cd1e0db01a092055" name="libzypp" arch="x86_64">
  <version epoch="0" ver="17.30.2" rel="150200.39.1"/>
  <changelog author="ma@suse.de" date="1627300800">- Rephrase vendor conflict message in case 2 packages are
  involved (bsc#1187760)
  This covers the case where not the packages itself would change
  its vendor, but replaces a package from a different vendor.
- Fix solver jobs for PTFs (bsc#1186503)
- spec: switch to pkgconfig(openssl)
- Show key fpr from signature when signature check fails
  (bsc#1187224)
  Rpm by default only shows the short key ID when checking the
  signature of a package fails. This patch reads the signatures
  from the RPM headers and replaces she short IDs with the key
  fingerprints fetched from the signatures.
- Implement alternative single transaction commit strategy.
  This patch adds a experimental commit strategy that runs all
  operations in a single rpm transaction, speeding up the execution
  a lot.
- Use ZYPP_MEDIANETWORK=1 to enable the experimental new media
  backend.
- Implement zchunk download, refactor Downloader backend.
- Fix purge-kernels fails with kernels from Kernel:HEAD
  (bsc#1187738)
  There recently was a change in the kernel package naming scheme
  in regards to rc kernels. Since kernel upstream uses characters
  in the version that are not allowed in rpm versions a "-rc" was
  previously replaced with ".rc" which broke sorting by version, to
  fix this issue it was replaced with "~rc", which unfortunately
  broke the purge-kernels logic. This patch makes sure purge-kernel
  does apply the same conversion.
- version 17.28.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1629720000">- Fix crashes in logging code when shutting down (bsc#1189031)
- version 17.28.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1630411200">- Workaround Bug 1189788: Don't allow ZYPP_SINGLE_RPMTRANS=1 on a
  not UsrMerged Tumbleweed system.
- version 17.28.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1630670400">- CMake/spec: Add option to force SINGLE_RPMTRANS as default for
  zypper (fixes #340)
- Make sure singleTrans is zypper-only for now.
- Do not double check signatures and keys (bsc#1190059)
- version 17.28.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1631880000">- Make sure to keep states alives while transitioning
  (bsc#1190199)
- May set techpreview variables for testing in /etc/zypp/zypp.conf.
  If environment variables are unhandy one may enable the desired
  techpreview in zypp.conf as well:
    [main]
    techpreview.ZYPP_SINGLE_RPMTRANS=1
    techpreview.ZYPP_MEDIANETWORK=1
- version 17.28.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1633348800">- Downloader does not respect checkExistsOnly flag (bsc#1190712)
  A missing check causes zyppng::Downloader to always download full
  files even if the checkExistsOnly flag is set. This patch adds
  the missing logic.
- Fix kernel-*-livepatch removal in purge-kernels (bsc#1190815)
  The kernel-*-livepatch packages are supposed to serve as a stable
  handle for the ephemeral kernel livepatch packages. See
  FATE#320268 for details. As part of the kernel live patching
  ecosystem, kernel-*-livepatch packages should not block the
  purge-kernels step.
- version 17.28.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Zypper should keep cached files if transaction is aborted
  (bsc#1190356)
  Singletrans mode currently does not keep files around if the
  transaction is aborted. This patch fixes the problem.
- Require a minimum number of mirrors for multicurl (bsc#1191609)
- Use procfs to detect nr of open fd's if rlimit is too high
  (bsc#1191324)
  Especially in a VM iterating over all possible fd's to close open
  ones right before a exec() slows down zypper unnecessarily. This
  patch uses /proc/self/fd to iterate over open fd's in case rlimit
  is above 1024.
- po: Fix some lost '%' signs in positional args (bsc#1191370)
- RepoManager: Don't probe for plaindir repo if URL schema is
  plugin: (bsc#1191286)
- version 17.28.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1636027200">- Check log writer before accessing it (fixes #355, bsc#1192337)
- Save locks: Update an existing locks changed comment string.
- Allow uname-r format in purge kernels keepspec (fixes
  openSUSE/zypper#418)
- version 17.28.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1636632000">- Disable logger in the child after fork (bsc#1192436)
- version 17.28.8 (22)</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Use the default zypp.conf settings if no zypp.conf exists
  (bsc#1193488)
- Fix wrong encoding of iso: URL components (bsc#954813)
- Handle armv8l as armv7hl compatible userland.
- Introduce zypp-curl a sublibrary for CURL related code.
- zypp-rpm: Increase rpm loglevel if ZYPP_RPM_DEBUG is set.
- Save all signatures associated with a public key in its
  PublicKeyData.
- version 17.29.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1641816000">- Fix broken install path for parser compat headers (fixes #372,
  bsc#1194597)
- RepoManager: remember exec errors in exception history
  (bsc#1193007)
- version 17.29.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1642680000">- Fix Legacy include (bsc#1194597)
- version 17.29.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1643716800">- Public header files on older distros must use c++11
  (bsc#1194597)
- Fix exception handling when reading or writing credentials
  (bsc#1194898)
- version 17.29.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1644321600">- Fix handling of redirected command in-/output (bsc#1195326)
  This fixes delays at the end of zypper operations, where
  zypper unintentionally waits for appdata plugin scripts to
  complete.
- version 17.29.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1645704000">- Hint on ptf&lt;&gt;patch resolver conflicts (bsc#1194848)
- version 17.29.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1647259200">- Fix package signature check (bsc#1184501)
  Pay attention that header and payload are secured by a valid
  signature and report more detailed which signature is missing.
- Retry umount if device is busy (bsc#1196061, closes #381)
  A previously released ISO image may need a bit more time to
  release it's loop device. So we wait a bit and retry.
- Fix serializing/deserializing type mismatch in zypp-rpm
  protocol (bsc#1196925)
- Fix handling of ISO media in releaseAll (bsc#1196061)
- Hint on common ptf resolver conflicts (bsc#1194848)
- version 17.29.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1647864000">- Fix possible hang in singletrans mode (bsc#1197134)
- Do 2 retries if mount is still busy.
- version 17.29.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1648209600">- ZConfig: Update solver settings if target changes (bsc#1196368)
- version 17.30.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1653912000">- PluginRepoverification: initial version hooked into
  repo::Downloader and repo refresh.
- Immediately start monitoring the download.transfer_timeout.
  Do not wait until the first data arrived. (bsc#1199042)
- singletrans: no dry-run commit if doing just download-only.
- Work around cases where sat repo.start points to an invalid
  solvable.  May happen if (wrong arch) solvables were removed
  at the  beginning of the repo.
- fix misplaced #endif SINGLE_RPMTRANS_AS_DEFAULT_FOR_ZYPPER
  (fixes #388)
- version 17.30.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1655294400">- appdata plugin: Pass path to the repodata/ directory inside the
  cache (bsc#1197684)
- zypp-rpm: flush rpm script output buffer before sending
  endOfScriptTag.
- version 17.30.2 (22)</changelog>
</package>
<package pkgid="de54c473bb815cc2127fd2f6913e37d8d6f4c98b6d7b69cf5ad28d47587fdf09" name="logrotate" arch="aarch64">
  <version epoch="0" ver="3.13.0" rel="150000.4.7.1"/>
  <changelog author="p.drouand@gmail.com" date="1424433600">- Update to version 3.8.9
  * Add new directive "createolddir" and "nocreateolddir". These directives
    can be used to create the directory specified by olddir with particular
  "mode", "owner" and "group".
  * Continue with rotation even when first log from logset is removed
  during the rotation.
  * Fix crash on BSD systems introduced in 3.8.8 caused by different qsort_r
  function. Function qsort is now used instead.
  * Fix potential buffer overflow in usage of strncat function.
  * Fix compilation with musl-libc.
  * Add experimental 'renamecopy' directive to allow 'olddir' on different
    physical device. See the "man logrotate" for more information.
- Remove logrotate-fail_if_ENOENT_and_nomissingok.patch; merged on
  upstream release
- Updated patches
  * logrotate-3.7.8-addextension.patch &gt; logrotate-addextension.patch
  * logrotate-3.7.8-autoext.patch &gt; logrotate-autoext.patch
  * logrotate-3.7.8-conf.patch &gt; logrotate-conf.patch
  * logrotate-manpage_config_clarification.patch
- Remove redunant %clean section</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1432036800">- Enable Persistent timer since we are now in systemd 219.</changelog>
  <changelog author="kstreitova@suse.com" date="1434974400">- update to 3.9.1
  * 3.9.1
  - Fix off-by-one error which can lead to crash when copytruncate
    is used.
  * 3.9.0
  - Fix crash when using long dateformat. [nmerdan]
  - Add support for %H dateformat. [czchen]
  - Fix regression introduced in 3.8.9 when when rotating multiple
    logs when one of them is missing.
  - In the debug mode, do not skip the code-path which handles the
    case when the last rotation does not exist. [Sergey Vidishev]
  - Show more precise description when "log does not need rotating".
  - Add new -l option to log verbose output to file. The file is
    overwritten on every logrotate execution.
  - Allow rotation of sparse files with copytruncate.
  * update logrotate-addextension.patch
- use spec-cleaner
- remove unused PreReq tags</changelog>
  <changelog author="dimstar@opensuse.org" date="1475496000">- Add logrotate-fix-test62_with_bash-4.4.patch: Fix the test suite
  when running with bash 4.4 (gh#logrotate/logrotate#66).</changelog>
  <changelog author="tchvatal@suse.com" date="1475668800">- Version update to 3.10.0 fate#322037:
  * Update url to point to github
- Remove upstreamed patch:
  * logrotate-3.7.8-mess_err.patch
- Rebase patches:
  * logrotate-3.7.8-suse.patch
  * logrotate-addextension.patch
  * logrotate-autoext.patch
  * logrotate-fix-test62_with_bash-4.4.patch</changelog>
  <changelog author="kukuk@suse.de" date="1478952000">- Move logrotate.status to /var/lib/misc following FHS/LSB and
  making implementing read-only root filesystem much easier.
  [FATE#322036]
- Add patch:
  * logrotate-var-lib-misc.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1479729600">- Fix post scriptlet condition bnc#1011120</changelog>
  <changelog author="tchvatal@suse.com" date="1482926400">- Version update to 3.11.0:
  * Merges from distribution patchsets and small fixes around
- Remove all patches merged upstream:
  * logrotate-addextension.patch
  * logrotate-autoext.patch
  * logrotate-conf.patch
  * logrotate-fix-test62_with_bash-4.4.patch
  * logrotate-manpage_config_clarification.patch
  * logrotate-var-lib-misc.patch
  * logrotate-3.7.8-suse.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1499428800">- Remove aaa_base compat setting that is from 2003, we do not
  support such migration anymore</changelog>
  <changelog author="tchvatal@suse.com" date="1499428801">- Version update to 3.12.3:
  * Fixed accident removal of rotated files with dateext. (#118)
  * Line comments inside globs in config files are now skipped. (#109)
  * logrotate now recovers from a corrupted state file. (#45)
  * createolddir now creates old directory as unprivileged user. (#114)
  * weekly rotations are now predictable and configurable. (#93)
  * Errors in config files are no longer treated as fatal errors. (#81)
  * configure --with-default-mail-command specifies default mail command. (#100)
  * Fixed heap buffer overflow when parsing crafted config file. (#33)
  * build fixes related to -Werror (#119) and -Werror=format= (#108)
  * configure --enable-werror now controls use of the -Werror flag (#123)
  * copy and copytruncate directives now work together again
  * unlink() is no longer preceded by open() unless shred is enabled (#124)
  * compress and uncompress now take commands from $PATH, too (#122)
- By default disable werror while building</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1515153600">- Version update to 3.13.0:
  * make distribution tarballs report logrotate version properly
  * make (un)compress work even if stdin and/or stdout are closed (#154)
  * remove -s from DEFAULT_MAIL_COMMAND and improve its documenation (#152)
  * uncompress logs before mailing them even if delaycompress is enabled (#151)
  * handle unlink of a non-existing log file as a warning only (#144)
  * include compile-time options in the output of logrotate --version (#145)
  * make logrotate --version print to stdout instead of stderr (#145)
  * flush write buffers before syncing state file (#148)
  * specify (un)compress utility explicitly in tests (#137)
  * enable running tests in parallel (#132)
  * explicitly map root UID/GID to 0 on Cygwin (#133)
  * add .dpkg-bak and .dpkg-del to default tabooext list (#134)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="kstreitova@suse.com" date="1528372800">- Add "Environment=HOME=/root" to logrotate.service file in order
  to allow mariadb to rotate its logs when the database has a root
  password defined [bsc#1093617]
- Added patch:
  * logrotate-3.13.0-systemd_add_home_env.patch</changelog>
  <changelog author="manfred.h@gmx.net" date="1654603200">- Fix "logrotate emits unintended warning: keyword size not properly
  separated, found 0x3d" (bsc#1200278, bsc#1200802):
  * Added patch logrotate-dont_warn_on_size=_syntax.patch</changelog>
  <changelog author="david.anes@suse.com" date="1655294400">- Security fix: (bsc#1192449) related to (bsc#1191281, CVE-2021-3864)
  * enforce stricter parsing to avoid CVE-2021-3864
  * Added patch logrotate-enforce-stricter-parsing-and-extra-tests.patch</changelog>
</package>
<package pkgid="c2bbf132fc026494b20058262741f3e4e2c648a4973cf50e3993690446da39fe" name="logrotate" arch="src">
  <version epoch="0" ver="3.13.0" rel="150000.4.7.1"/>
  <changelog author="vcizek@suse.com" date="1396353600">- return error when nomissingok is specified and the log path
  doesn't exist (bnc#871217)
  * added logrotate-fail_if_ENOENT_and_nomissingok.patch</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1396440000">- Migrate from cron to systemd timer units, this is overall
  the most important package to migrate since it is one
  of the very few base components that hard-require cron.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1396526400">- BuildRequire systemd 197 or later.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1396526401">- Also, avoid logrotate unit activation when the system is
  on battery power.</changelog>
  <changelog author="vcizek@suse.com" date="1403784000">- temporarily remove the 'Persistent' option from logrotate.timer
  * our current systemd doesn't support it yet (bnc#884338)</changelog>
  <changelog author="p.drouand@gmail.com" date="1424433600">- Update to version 3.8.9
  * Add new directive "createolddir" and "nocreateolddir". These directives
    can be used to create the directory specified by olddir with particular
  "mode", "owner" and "group".
  * Continue with rotation even when first log from logset is removed
  during the rotation.
  * Fix crash on BSD systems introduced in 3.8.8 caused by different qsort_r
  function. Function qsort is now used instead.
  * Fix potential buffer overflow in usage of strncat function.
  * Fix compilation with musl-libc.
  * Add experimental 'renamecopy' directive to allow 'olddir' on different
    physical device. See the "man logrotate" for more information.
- Remove logrotate-fail_if_ENOENT_and_nomissingok.patch; merged on
  upstream release
- Updated patches
  * logrotate-3.7.8-addextension.patch &gt; logrotate-addextension.patch
  * logrotate-3.7.8-autoext.patch &gt; logrotate-autoext.patch
  * logrotate-3.7.8-conf.patch &gt; logrotate-conf.patch
  * logrotate-manpage_config_clarification.patch
- Remove redunant %clean section</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1432036800">- Enable Persistent timer since we are now in systemd 219.</changelog>
  <changelog author="kstreitova@suse.com" date="1434974400">- update to 3.9.1
  * 3.9.1
  - Fix off-by-one error which can lead to crash when copytruncate
    is used.
  * 3.9.0
  - Fix crash when using long dateformat. [nmerdan]
  - Add support for %H dateformat. [czchen]
  - Fix regression introduced in 3.8.9 when when rotating multiple
    logs when one of them is missing.
  - In the debug mode, do not skip the code-path which handles the
    case when the last rotation does not exist. [Sergey Vidishev]
  - Show more precise description when "log does not need rotating".
  - Add new -l option to log verbose output to file. The file is
    overwritten on every logrotate execution.
  - Allow rotation of sparse files with copytruncate.
  * update logrotate-addextension.patch
- use spec-cleaner
- remove unused PreReq tags</changelog>
  <changelog author="dimstar@opensuse.org" date="1475496000">- Add logrotate-fix-test62_with_bash-4.4.patch: Fix the test suite
  when running with bash 4.4 (gh#logrotate/logrotate#66).</changelog>
  <changelog author="tchvatal@suse.com" date="1475668800">- Version update to 3.10.0 fate#322037:
  * Update url to point to github
- Remove upstreamed patch:
  * logrotate-3.7.8-mess_err.patch
- Rebase patches:
  * logrotate-3.7.8-suse.patch
  * logrotate-addextension.patch
  * logrotate-autoext.patch
  * logrotate-fix-test62_with_bash-4.4.patch</changelog>
  <changelog author="kukuk@suse.de" date="1478952000">- Move logrotate.status to /var/lib/misc following FHS/LSB and
  making implementing read-only root filesystem much easier.
  [FATE#322036]
- Add patch:
  * logrotate-var-lib-misc.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1479729600">- Fix post scriptlet condition bnc#1011120</changelog>
  <changelog author="tchvatal@suse.com" date="1482926400">- Version update to 3.11.0:
  * Merges from distribution patchsets and small fixes around
- Remove all patches merged upstream:
  * logrotate-addextension.patch
  * logrotate-autoext.patch
  * logrotate-conf.patch
  * logrotate-fix-test62_with_bash-4.4.patch
  * logrotate-manpage_config_clarification.patch
  * logrotate-var-lib-misc.patch
  * logrotate-3.7.8-suse.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1499428800">- Remove aaa_base compat setting that is from 2003, we do not
  support such migration anymore</changelog>
  <changelog author="tchvatal@suse.com" date="1499428801">- Version update to 3.12.3:
  * Fixed accident removal of rotated files with dateext. (#118)
  * Line comments inside globs in config files are now skipped. (#109)
  * logrotate now recovers from a corrupted state file. (#45)
  * createolddir now creates old directory as unprivileged user. (#114)
  * weekly rotations are now predictable and configurable. (#93)
  * Errors in config files are no longer treated as fatal errors. (#81)
  * configure --with-default-mail-command specifies default mail command. (#100)
  * Fixed heap buffer overflow when parsing crafted config file. (#33)
  * build fixes related to -Werror (#119) and -Werror=format= (#108)
  * configure --enable-werror now controls use of the -Werror flag (#123)
  * copy and copytruncate directives now work together again
  * unlink() is no longer preceded by open() unless shred is enabled (#124)
  * compress and uncompress now take commands from $PATH, too (#122)
- By default disable werror while building</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1515153600">- Version update to 3.13.0:
  * make distribution tarballs report logrotate version properly
  * make (un)compress work even if stdin and/or stdout are closed (#154)
  * remove -s from DEFAULT_MAIL_COMMAND and improve its documenation (#152)
  * uncompress logs before mailing them even if delaycompress is enabled (#151)
  * handle unlink of a non-existing log file as a warning only (#144)
  * include compile-time options in the output of logrotate --version (#145)
  * make logrotate --version print to stdout instead of stderr (#145)
  * flush write buffers before syncing state file (#148)
  * specify (un)compress utility explicitly in tests (#137)
  * enable running tests in parallel (#132)
  * explicitly map root UID/GID to 0 on Cygwin (#133)
  * add .dpkg-bak and .dpkg-del to default tabooext list (#134)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="kstreitova@suse.com" date="1528372800">- Add "Environment=HOME=/root" to logrotate.service file in order
  to allow mariadb to rotate its logs when the database has a root
  password defined [bsc#1093617]
- Added patch:
  * logrotate-3.13.0-systemd_add_home_env.patch</changelog>
  <changelog author="manfred.h@gmx.net" date="1654603200">- Fix "logrotate emits unintended warning: keyword size not properly
  separated, found 0x3d" (bsc#1200278, bsc#1200802):
  * Added patch logrotate-dont_warn_on_size=_syntax.patch</changelog>
  <changelog author="david.anes@suse.com" date="1655294400">- Security fix: (bsc#1192449) related to (bsc#1191281, CVE-2021-3864)
  * enforce stricter parsing to avoid CVE-2021-3864
  * Added patch logrotate-enforce-stricter-parsing-and-extra-tests.patch</changelog>
</package>
<package pkgid="ee4bb22150400834ed84c797b93943a8e2e9f1b970e7dfae703ba07b7af88746" name="logrotate" arch="x86_64">
  <version epoch="0" ver="3.13.0" rel="150000.4.7.1"/>
  <changelog author="p.drouand@gmail.com" date="1424433600">- Update to version 3.8.9
  * Add new directive "createolddir" and "nocreateolddir". These directives
    can be used to create the directory specified by olddir with particular
  "mode", "owner" and "group".
  * Continue with rotation even when first log from logset is removed
  during the rotation.
  * Fix crash on BSD systems introduced in 3.8.8 caused by different qsort_r
  function. Function qsort is now used instead.
  * Fix potential buffer overflow in usage of strncat function.
  * Fix compilation with musl-libc.
  * Add experimental 'renamecopy' directive to allow 'olddir' on different
    physical device. See the "man logrotate" for more information.
- Remove logrotate-fail_if_ENOENT_and_nomissingok.patch; merged on
  upstream release
- Updated patches
  * logrotate-3.7.8-addextension.patch &gt; logrotate-addextension.patch
  * logrotate-3.7.8-autoext.patch &gt; logrotate-autoext.patch
  * logrotate-3.7.8-conf.patch &gt; logrotate-conf.patch
  * logrotate-manpage_config_clarification.patch
- Remove redunant %clean section</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1432036800">- Enable Persistent timer since we are now in systemd 219.</changelog>
  <changelog author="kstreitova@suse.com" date="1434974400">- update to 3.9.1
  * 3.9.1
  - Fix off-by-one error which can lead to crash when copytruncate
    is used.
  * 3.9.0
  - Fix crash when using long dateformat. [nmerdan]
  - Add support for %H dateformat. [czchen]
  - Fix regression introduced in 3.8.9 when when rotating multiple
    logs when one of them is missing.
  - In the debug mode, do not skip the code-path which handles the
    case when the last rotation does not exist. [Sergey Vidishev]
  - Show more precise description when "log does not need rotating".
  - Add new -l option to log verbose output to file. The file is
    overwritten on every logrotate execution.
  - Allow rotation of sparse files with copytruncate.
  * update logrotate-addextension.patch
- use spec-cleaner
- remove unused PreReq tags</changelog>
  <changelog author="dimstar@opensuse.org" date="1475496000">- Add logrotate-fix-test62_with_bash-4.4.patch: Fix the test suite
  when running with bash 4.4 (gh#logrotate/logrotate#66).</changelog>
  <changelog author="tchvatal@suse.com" date="1475668800">- Version update to 3.10.0 fate#322037:
  * Update url to point to github
- Remove upstreamed patch:
  * logrotate-3.7.8-mess_err.patch
- Rebase patches:
  * logrotate-3.7.8-suse.patch
  * logrotate-addextension.patch
  * logrotate-autoext.patch
  * logrotate-fix-test62_with_bash-4.4.patch</changelog>
  <changelog author="kukuk@suse.de" date="1478952000">- Move logrotate.status to /var/lib/misc following FHS/LSB and
  making implementing read-only root filesystem much easier.
  [FATE#322036]
- Add patch:
  * logrotate-var-lib-misc.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1479729600">- Fix post scriptlet condition bnc#1011120</changelog>
  <changelog author="tchvatal@suse.com" date="1482926400">- Version update to 3.11.0:
  * Merges from distribution patchsets and small fixes around
- Remove all patches merged upstream:
  * logrotate-addextension.patch
  * logrotate-autoext.patch
  * logrotate-conf.patch
  * logrotate-fix-test62_with_bash-4.4.patch
  * logrotate-manpage_config_clarification.patch
  * logrotate-var-lib-misc.patch
  * logrotate-3.7.8-suse.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1499428800">- Remove aaa_base compat setting that is from 2003, we do not
  support such migration anymore</changelog>
  <changelog author="tchvatal@suse.com" date="1499428801">- Version update to 3.12.3:
  * Fixed accident removal of rotated files with dateext. (#118)
  * Line comments inside globs in config files are now skipped. (#109)
  * logrotate now recovers from a corrupted state file. (#45)
  * createolddir now creates old directory as unprivileged user. (#114)
  * weekly rotations are now predictable and configurable. (#93)
  * Errors in config files are no longer treated as fatal errors. (#81)
  * configure --with-default-mail-command specifies default mail command. (#100)
  * Fixed heap buffer overflow when parsing crafted config file. (#33)
  * build fixes related to -Werror (#119) and -Werror=format= (#108)
  * configure --enable-werror now controls use of the -Werror flag (#123)
  * copy and copytruncate directives now work together again
  * unlink() is no longer preceded by open() unless shred is enabled (#124)
  * compress and uncompress now take commands from $PATH, too (#122)
- By default disable werror while building</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1515153600">- Version update to 3.13.0:
  * make distribution tarballs report logrotate version properly
  * make (un)compress work even if stdin and/or stdout are closed (#154)
  * remove -s from DEFAULT_MAIL_COMMAND and improve its documenation (#152)
  * uncompress logs before mailing them even if delaycompress is enabled (#151)
  * handle unlink of a non-existing log file as a warning only (#144)
  * include compile-time options in the output of logrotate --version (#145)
  * make logrotate --version print to stdout instead of stderr (#145)
  * flush write buffers before syncing state file (#148)
  * specify (un)compress utility explicitly in tests (#137)
  * enable running tests in parallel (#132)
  * explicitly map root UID/GID to 0 on Cygwin (#133)
  * add .dpkg-bak and .dpkg-del to default tabooext list (#134)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="kstreitova@suse.com" date="1528372800">- Add "Environment=HOME=/root" to logrotate.service file in order
  to allow mariadb to rotate its logs when the database has a root
  password defined [bsc#1093617]
- Added patch:
  * logrotate-3.13.0-systemd_add_home_env.patch</changelog>
  <changelog author="manfred.h@gmx.net" date="1654603200">- Fix "logrotate emits unintended warning: keyword size not properly
  separated, found 0x3d" (bsc#1200278, bsc#1200802):
  * Added patch logrotate-dont_warn_on_size=_syntax.patch</changelog>
  <changelog author="david.anes@suse.com" date="1655294400">- Security fix: (bsc#1192449) related to (bsc#1191281, CVE-2021-3864)
  * enforce stricter parsing to avoid CVE-2021-3864
  * Added patch logrotate-enforce-stricter-parsing-and-extra-tests.patch</changelog>
</package>
<package pkgid="5935e9ddffe7d07540238d26c986f01da55dfe9b4d6389a8bd19a1aa82d01d0c" name="mdadm" arch="aarch64">
  <version epoch="0" ver="4.1" rel="150300.24.15.1"/>
  <changelog author="colyli@suse.com" date="1553774400">- imsm: finish recovery when drive with rebuild fails (bsc#1126975)
  0010-imsm-finish-recovery-when-drive-with-rebuild-fails.patch
- mdmon: don't attempt to manage new arrays when terminating
  (bsc#1127526)
  0011-mdmon-don-t-attempt-to-manage-new-arrays-when-termin.patch</changelog>
  <changelog author="colyli@suse.com" date="1566820800">- 0012-mdadm-add-no-devices-to-avoid-component-devices-deta.patch
  (bsc#1139709)
  mdadm: add --no-devices to avoid component devices detail
  information
- 0013-udev-add-no-devices-option-for-calling-mdadm-detail.patch
  (bsc#1139709)
  udev: add --no-devices option for calling 'mdadm --detail'</changelog>
  <changelog author="nfbrown@suse.com" date="1572436800">- New patch: 0022-mdcheck-when-mdcheck_start-is-enabled-enable-mdcheck.patch
  New patch: 0023-mdcheck-use-to-pass-variable-to-mdcheck.patch
  New patch: 0024-SUSE-mdadm_env.sh-handle-MDADM_CHECK_DURATION.patch
  Improve systemd units for mdcheck (bsc#1153258)</changelog>
  <changelog author="colyli@suse.com" date="1581076800">- Create: add support for RAID0 layouts. (bsc#1162479)
  0024-Create-add-support-for-RAID0-layouts.patch
- Assemble: add support for RAID0 layouts. (bsc#1162479)
  0025-Assemble-add-support-for-RAID0-layouts.patch
- mdadm.8: add note information for raid0 growing operation
  (bsc#1129900)
  1002-mdadm.8-add-note-information-for-raid0-growing-opera.patch</changelog>
  <changelog author="colyli@suse.com" date="1581076801">- Enable probe_roms to scan more than 6 roms. (bsc#1156040)
  0026-Enable-probe_roms-to-scan-more-than-6-roms.patch</changelog>
  <changelog author="colyli@suse.com" date="1583236800">- Rename the following patches, they will be listed with new
  re-ordered prefix number in following commit,
    0001-Document-PART-POLICY-lines.patch
    0001-Makefile-install-mdadm_env.sh-to-usr-lib-mdadm.patch
    0002-policy-support-devices-with-multiple-paths.patch
    0003-mdcheck-add-systemd-unit-files-to-run-mdcheck.patch
    0004-Monitor-add-system-timer-to-run-oneshot-periodically.patch
    0005-imsm-update-metadata-correctly-while-raid10-double-d.patch
    0006-Grow-avoid-overflow-in-compute_backup_blocks.patch
    0007-Grow-report-correct-new-chunk-size.patch
    0008-policy.c-prevent-NULL-pointer-referencing.patch
    0009-Detail.c-do-not-skip-first-character-when-calling-xs.patch
    0010-imsm-finish-recovery-when-drive-with-rebuild-fails.patch
    0011-mdmon-don-t-attempt-to-manage-new-arrays-when-termin.patch
    0012-mdadm-add-no-devices-to-avoid-component-devices-deta.patch
    0013-udev-add-no-devices-option-for-calling-mdadm-detail.patch
    0021-mdcheck-when-mdcheck_start-is-enabled-enable-mdcheck.patch
    0022-mdcheck-use-to-pass-variable-to-mdcheck.patch
    0023-SUSE-mdadm_env.sh-handle-MDADM_CHECK_DURATION.patch
    0024-Create-add-support-for-RAID0-layouts.patch
    0025-Assemble-add-support-for-RAID0-layouts.patch
    0026-Enable-probe_roms-to-scan-more-than-6-roms.patch
    1002-mdadm.8-add-note-information-for-raid0-growing-opera.patch</changelog>
  <changelog author="colyli@suse.com" date="1583236801">- Update for latest mdadm-4.1+ patches, this is required by
  jsc#SLE-10078 and jsc#SLE-9348. Mostly the purpose is for
  latest Intel IMSM raid support.
  The following patches also include previous patches with
  new re-ordered prefix numbers.
- Makefile: install mdadm_env.sh to /usr/lib/mdadm (bsc#1111960)
  0000-Makefile-install-mdadm_env.sh-to-usr-lib-mdadm.patch
- Assemble: keep MD_DISK_FAILFAST and MD_DISK_WRITEMOSTLY flag
  (jsc#SLE-10078, jsc#SLE-9348)
  0001-Assemble-keep-MD_DISK_FAILFAST-and-MD_DISK_WRITEMOST.patch
- Document PART-POLICY lines (jsc#SLE-10078, jsc#SLE-9348)
  0002-Document-PART-POLICY-lines.patc
- policy: support devices with multiple paths.
  (jsc#SLE-10078, jsc#SLE-9348)
  0003-policy-support-devices-with-multiple-paths.patch
- mdcheck: add systemd unit files to run mdcheck. (bsc#1115407)
  0004-mdcheck-add-systemd-unit-files-to-run-mdcheck.patch
- Monitor: add system timer to run --oneshot periodically (bsc#1115407)
  0005-Monitor-add-system-timer-to-run-oneshot-periodically.patch
- imsm: update metadata correctly while raid10 double
  (jsc#SLE-10078, jsc#SLE-9348)
  0006-imsm-update-metadata-correctly-while-raid10-double-d.patch
- Assemble: mask FAILFAST and WRITEMOSTLY flags when finding
  (jsc#SLE-10078, jsc#SLE-9348)
  0007-Assemble-mask-FAILFAST-and-WRITEMOSTLY-flags-when-fi.patch
- Grow: avoid overflow in compute_backup_blocks()
  (jsc#SLE-10078, jsc#SLE-9348)
  0008-Grow-avoid-overflow-in-compute_backup_blocks.patch
- Grow: report correct new chunk size. (jsc#SLE-10078, jsc#SLE-9348)
  0009-Grow-report-correct-new-chunk-size.patch
- policy.c: prevent NULL pointer referencing (bsc#1106078)
  0010-policy.c-prevent-NULL-pointer-referencing.patch
- policy.c: Fix for compiler error (jsc#SLE-10078, jsc#SLE-9348)
  0012-policy.c-Fix-for-compiler-error.patch
- imsm: finish recovery when drive with rebuild fails (bsc#1126975)
  0013-imsm-finish-recovery-when-drive-with-rebuild-fails.patch
- imsm: fix reshape for &gt;2TB drives (jsc#SLE-10078, jsc#SLE-9348)
  0014-imsm-fix-reshape-for-2TB-drives.patch
- Fix spelling typos. (jsc#SLE-10078, jsc#SLE-9348)
  0015-Fix-spelling-typos.patch
- Detail.c: do not skip first character when calling xstrdup in
  Detail() (bsc#1123814)
  0016-Detail.c-do-not-skip-first-character-when-calling-xs.patch
- Fix reshape for decreasing data offset (jsc#SLE-10078, jsc#SLE-9348)
  0018-Fix-reshape-for-decreasing-data-offset.patch
- mdadm/tests: add one test case for failfast of raid1
  (jsc#SLE-10078, jsc#SLE-9348)
  0019-mdadm-tests-add-one-test-case-for-failfast-of-raid1.patch
- mdmon: don't attempt to manage new arrays when terminating
  (bsc#1127526)
  0020-mdmon-don-t-attempt-to-manage-new-arrays-when-termin.patch
- mdmon: wait for previous mdmon to exit during takeover
  (jsc#SLE-10078, jsc#SLE-9348)
  0021-mdmon-wait-for-previous-mdmon-to-exit-during-takeove.patch
- Assemble: Fix starting array with initial reshape checkpoint
  (jsc#SLE-10078, jsc#SLE-9348)
  0022-Assemble-Fix-starting-array-with-initial-reshape-che.patch
- add missing units to --examine (jsc#SLE-10078, jsc#SLE-9348)
  0023-add-missing-units-to-examine.patch
- imsm: fix spare activation for old matrix arrays
  (jsc#SLE-10078, jsc#SLE-9348)
  0024-imsm-fix-spare-activation-for-old-matrix-arrays.patch
- Create: Block rounding size to max (jsc#SLE-10078, jsc#SLE-9348)
  0025-Create-Block-rounding-size-to-max.patch
- udev: Add udev rules to create by-partuuid for md device
  (jsc#SLE-10078, jsc#SLE-9348)
  0026-udev-Add-udev-rules-to-create-by-partuuid-for-md-dev.patch
- mdmon: fix wrong array state when disk fails during mdmon
  (jsc#SLE-10078, jsc#SLE-9348)
  0027-mdmon-fix-wrong-array-state-when-disk-fails-during-m.patch
- Enable probe_roms to scan more than 6 roms. (bsc#1156040)
  0028-Enable-probe_roms-to-scan-more-than-6-roms.patch
- super-intel: Fix issue with abs() being irrelevant
  (jsc#SLE-10078, jsc#SLE-9348)
  0029-super-intel-Fix-issue-with-abs-being-irrelevant.patch
- mdadm.h: Introduced unaligned {get,put}_unaligned{16,32}()
  (jsc#SLE-10078, jsc#SLE-9348)
  0030-mdadm.h-Introduced-unaligned-get-put-_unaligned-16-3.patch
- super-intel: Use put_unaligned in split_ull
  (jsc#SLE-10078, jsc#SLE-9348)
  0031-super-intel-Use-put_unaligned-in-split_ull.patch
- mdadm: load default sysfs attributes after assemblation
  (jsc#SLE-10078, jsc#SLE-9348)
  0032-mdadm-load-default-sysfs-attributes-after-assemblati.patch
- mdadm.h: include sysmacros.h unconditionally
  (jsc#SLE-10078, jsc#SLE-9348)
  0033-mdadm.h-include-sysmacros.h-unconditionally.patch
- mdadm: add --no-devices to avoid component devices detail
  (bsc#1139709)
  0034-mdadm-add-no-devices-to-avoid-component-devices-deta.patch
- udev: add --no-devices option for calling 'mdadm (bsc#1139709)
  0035-udev-add-no-devices-option-for-calling-mdadm-detail.patch
- imsm: close removed drive fd. (jsc#SLE-10078, jsc#SLE-9348)
  0036-imsm-close-removed-drive-fd.patch
- mdadm: check value returned by snprintf against errors
  (jsc#SLE-10078, jsc#SLE-9348)
  0037-mdadm-check-value-returned-by-snprintf-against-error.patch
- mdadm: Introduce new array state 'broken' for raid0/linear
  (jsc#SLE-10078, jsc#SLE-9348)
  0038-mdadm-Introduce-new-array-state-broken-for-raid0-lin.patch
- mdadm: force a uuid swap on big endian (jsc#SLE-10078, jsc#SLE-9348)
  0039-mdadm-force-a-uuid-swap-on-big-endian.patch
- mdadm/md.4: add the descriptions for bitmap sysfs nodes
  (jsc#SLE-10078, jsc#SLE-9348)
  0040-mdadm-md.4-add-the-descriptions-for-bitmap-sysfs-nod.patch
- Init devlist as an array (jsc#SLE-10078, jsc#SLE-9348)
  0041-Init-devlist-as-an-array.patch
- Don't need to check recovery after re-add when no I/O writes
  (jsc#SLE-10078, jsc#SLE-9348)
  0042-Don-t-need-to-check-recovery-after-re-add-when-no-I-.patch
- udev: allow for udev attribute reading bug.
  (jsc#SLE-10078, jsc#SLE-9348)
  0043-udev-allow-for-udev-attribute-reading-bug.patch
- imsm: save current_vol number (jsc#SLE-10078, jsc#SLE-9348)
  0044-imsm-save-current_vol-number.patch
- imsm: allow to specify second volume size
  (jsc#SLE-10078, jsc#SLE-9348)
  0045-imsm-allow-to-specify-second-volume-size.patch
- mdcheck: when mdcheck_start is enabled, enable (bsc#1153258)
  0046-mdcheck-when-mdcheck_start-is-enabled-enable-mdcheck.patch
- mdcheck: use ${} to pass variable to mdcheck (bsc#1153258)
  0050-mdcheck-use-to-pass-variable-to-mdcheck.patch
- SUSE-mdadm_env.sh: handle MDADM_CHECK_DURATION (bsc#1153258)
  0051-SUSE-mdadm_env.sh-handle-MDADM_CHECK_DURATION.patch
- super-intel: don't mark structs 'packed' unnecessarily
  (jsc#SLE-10078, jsc#SLE-9348)
  0052-super-intel-don-t-mark-structs-packed-unnecessarily.patch
- Manage: Remove the legacy code for md driver prior to 0.90.03
  (jsc#SLE-10078, jsc#SLE-9348)
  0053-Manage-Remove-the-legacy-code-for-md-driver-prior-to.patch
- Remove last traces of HOT_ADD_DISK (jsc#SLE-10078, jsc#SLE-9348)
  0054-Remove-last-traces-of-HOT_ADD_DISK.patch
- Fix up a few formatting issues (jsc#SLE-10078, jsc#SLE-9348)
  0055-Fix-up-a-few-formatting-issues.patch
- Remove unused code (jsc#SLE-10078, jsc#SLE-9348)
  0056-Remove-unused-code.patch
- imsm: return correct uuid for volume in detail
  (jsc#SLE-10078, jsc#SLE-9348)
  0057-imsm-return-correct-uuid-for-volume-in-detail.patch
- imsm: Change the way of printing nvme drives in
  (jsc#SLE-10078, jsc#SLE-9348)
  0058-imsm-Change-the-way-of-printing-nvme-drives-in-detai.patch
- Create: add support for RAID0 layouts. (bsc#1162479)
  0059-Create-add-support-for-RAID0-layouts.patch
- Assemble: add support for RAID0 layouts. (bsc#1162479)
  0060-Assemble-add-support-for-RAID0-layouts.patch
- Respect $(CROSS_COMPILE) when $(CC) is the default
  (jsc#SLE-10078, jsc#SLE-9348)
  0061-Respect-CROSS_COMPILE-when-CC-is-the-default.patch
- Change warning message (jsc#SLE-10078, jsc#SLE-9348)
  0062-Change-warning-message.patch
- mdcheck service can't start succesfully because of syntax
  (jsc#SLE-10078, jsc#SLE-9348)
  0063-mdcheck-service-can-t-start-succesfully-because-of-s.patch
- imsm: Update grow manual. (jsc#SLE-10078, jsc#SLE-9348)
  0064-imsm-Update-grow-manual.patch
- Add support for Tebibytes (jsc#SLE-10078, jsc#SLE-9348)
  0065-Add-support-for-Tebibytes.patch
- imsm: fill working_disks according to metadata.
  (jsc#SLE-10078, jsc#SLE-9348)
  0066-imsm-fill-working_disks-according-to-metadata.patch
- mdadm.8: add note information for raid0 growing operation
  (bsc#1129900)
  0067-mdadm.8-add-note-information-for-raid0-growing-opera.patch
- Remove the legacy whitespace (jsc#SLE-10078, jsc#SLE-9348)
  0068-Remove-the-legacy-whitespace.patch
- imsm: pass subarray id to kill_subarray function
  (jsc#SLE-10078, jsc#SLE-9348)
  0069-imsm-pass-subarray-id-to-kill_subarray-function.patch
- imsm: Remove --dump/--restore implementation
  (jsc#SLE-10078, jsc#SLE-9348)
  0070-imsm-Remove-dump-restore-implementation.patch</changelog>
  <changelog author="colyli@suse.com" date="1592827200">- Detail: adding sync status for cluster device
  (bsc#1163727)
  0072-Detail-adding-sync-status-for-cluster-device.patch
- Monitor: improve check_one_sharer() for checking duplicated process
  (bsc#1168953)
  0071-Monitor-improve-check_one_sharer-for-checking-duplic.patch</changelog>
  <changelog author="colyli@suse.com" date="1592827201">- OnCalendar format fix of mdcheck_start.timer (bsc#1173137)
  1002-OnCalendar-format-fix-of-mdcheck_start-timer.patch</changelog>
  <changelog author="colyli@suse.com" date="1598788800">- mdadm: treat the Dell softraid array as local array (bsc#1175004)
  1003-mdadm-treat-the-Dell-softraid-array-as-local-array.patch</changelog>
  <changelog author="colyli@suse.com" date="1602417600">- Update to latest mdadm which is requested by jsc#SLE-13700 from
  partners. Mostly the purpose is for latest Intel IMSM raid
  support, while some other fixes are important too.
- imsm: Correct minimal device size (jsc#SLE-13700)
  0073-imsm-Correct-minimal-device-size.patch
- Detail: show correct bitmap info for cluster raid device
  (jsc#SLE-13700)
  0074-Detail-show-correct-bitmap-info-for-cluster-raid-dev.patch
- imsm: support the Array Creation Time field in metadata
  (jsc#SLE-13700)
  0075-imsm-support-the-Array-Creation-Time-field-in-metada.patch
- imsm: show Subarray and Volume ID in --examine output
  (jsc#SLE-13700)
  0076-imsm-show-Subarray-and-Volume-ID-in-examine-output.patch
- udev: Ignore change event for imsm (jsc#SLE-13700)
  0077-udev-Ignore-change-event-for-imsm.patch
- Manage, imsm: Write metadata before add (jsc#SLE-13700)
  0078-Manage-imsm-Write-metadata-before-add.patch
- Assemble: print error message if mdadm fails assembling
  with --uuid option (jsc#SLE-13700)
  0079-Assemble-print-error-message-if-mdadm-fails-assembli.patch
- clean up meaning of small typo (jsc#SLE-13700)
  0080-clean-up-meaning-of-small-typo.patch
- Assemble.c: respect force flag (jsc#SLE-13700)
  0081-Assemble.c-respect-force-flag.patch
- mdcheck: Log when done (jsc#SLE-13700)
  0082-mdcheck-Log-when-done.patch
- Makefile: add EXTRAVERSION support (jsc#SLE-13700)
  0083-Makefile-add-EXTRAVERSION-support.patch
- uuid.c: split uuid stuffs from util.c (jsc#SLE-13700)
  0084-uuid.c-split-uuid-stuffs-from-util.c.patch
- Include count for \0 character when using strncpy to
  implement strdup. (jsc#SLE-13700)
  0085-Include-count-for-0-character-when-using-strncpy-to-.patch
- restripe: fix ignoring return value of read and lseek
  (jsc#SLE-13700)
  0086-restripe-fix-ignoring-return-value-of-read-and-lseek.patch
- Block overwriting existing links while manual assembly
  (jsc#SLE-13700)
  0087-Block-overwriting-existing-links-while-manual-assemb.patch
- Detect too-small device: error rather than underflow/crash
  (jsc#SLE-13700)
  0088-Detect-too-small-device-error-rather-than-underflow-.patch
- Use more secure HTTPS URLs  (jsc#SLE-13700)
  0089-Use-more-secure-HTTPS-URLs.patch
- Update link to Intel page for IMSM (jsc#SLE-13700)
  0090-Update-link-to-Intel-page-for-IMSM.patch
- mdadm/Grow: prevent md's fd from being occupied during delayed time
  (jsc#SLE-13700)
  0091-mdadm-Grow-prevent-md-s-fd-from-being-occupied-durin.patch
- Specify nodes number when updating cluster nodes (jsc#SLE-13700)
  0092-Specify-nodes-number-when-updating-cluster-nodes.patch
- mdadm/md.4: update path to in-kernel-tree documentation
  (jsc#SLE-13700)
  0093-mdadm-md.4-update-path-to-in-kernel-tree-documentati.patch
- manual: update --examine-badblocks (jsc#SLE-13700)
  0094-manual-update-examine-badblocks.patch</changelog>
  <changelog author="colyli@suse.com" date="1607169600">- There are some important fixes merged in mdadm upstream which
  should go with jsc#SLE-13700. This is the update from upstream
  mdadm including the important fixes we should have.
- Detail: show correct raid level when the array is inactive
  (jsc#SLE-13700)
  0095-Detail-show-correct-raid-level-when-the-array-is-ina.patch
- Don't create bitmap for raid5 with journal disk
  (jsc#SLE-13700)
  0096-Don-t-create-bitmap-for-raid5-with-journal-disk.patch
- Monitor: refresh mdstat fd after select (jsc#SLE-13700)
  0097-Monitor-refresh-mdstat-fd-after-select.patch
- Monitor: stop notifing about containers.  (jsc#SLE-13700)
  0098-Monitor-stop-notifing-about-containers.patch
- mdmonitor: set small delay once (jsc#SLE-13700)
  0099-mdmonitor-set-small-delay-once.patch
- Check if other Monitor instance running before fork.
  (jsc#SLE-13700)
  0100-Check-if-other-Monitor-instance-running-before-fork.patch
- Super1: allow RAID0 layout setting to be removed.
  (jsc#SLE-13700)
  0101-Super1-allow-RAID0-layout-setting-to-be-removed.patch
- Detail: fix segfault during IMSM raid creation
  (jsc#SLE-13700)
  0102-Detail-fix-segfault-during-IMSM-raid-creation.patch
- Create.c: close mdfd and generate uevent (jsc#SLE-13700)
  0103-Create.c-close-mdfd-and-generate-uevent.patch
- imsm: update num_data_stripes according to dev_size
  (jsc#SLE-13700)
  0104-imsm-update-num_data_stripes-according-to-dev_size.patch
- imsm: remove redundant calls to imsm_get_map (jsc#SLE-13700)
  0105-imsm-remove-redundant-calls-to-imsm_get_map.patch
- Monitor: don't use default modes when creating a file
  (jsc#SLE-13700)
  0106-Monitor-don-t-use-default-modes-when-creating-a-file.patch
- imsm: limit support to first NVMe namespace (jsc#SLE-13700)
  0107-imsm-limit-support-to-first-NVMe-namespace.patch
- mdadm: Unify forks behaviour (jsc#SLE-13700)
  0108-mdadm-Unify-forks-behaviour.patch
- mdadm/Detail: show correct state for clustered array
  (jsc#SLE-13700)
  0109-mdadm-Detail-show-correct-state-for-clustered-array.patch
- Make target to install binaries only (jsc#SLE-13700)
  0110-Make-target-to-install-binaries-only.patch
- udev: start grow service automatically (jsc#SLE-13700)
  0111-udev-start-grow-service-automatically.patch</changelog>
  <changelog author="colyli@suse.com" date="1609848000">- Incremental: Remove redundant spare movement logic
  (jsc#SLE-13700, bsc#1180220)
  0112-Incremental-Remove-redundant-spare-movement-logic.patch
- Dump: get stat from a wrong metadata file when restoring metadata
  (jsc#SLE-13700)
  0113-Dump-get-stat-from-a-wrong-metadata-file-when-restor.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1617278400">- cluster-md/mdadm : avoid useless re-sync (bsc#1181341)
  0114-super1-fix-Floating-point-exception.patch
  0115-super1.c-avoid-useless-sync-when-bitmap-switches-fro.patch</changelog>
  <changelog author="colyli@suse.com" date="1620993600">- imsm: nvme multipath support (bsc#1175758)
  0116-imsm-nvme-multipath-support.patch</changelog>
  <changelog author="colyli@suse.com" date="1620993601">- Grow: be careful of corrupt dev_roles list (bsc#1181619)
  0117-Grow-be-careful-of-corrupt-dev_roles-list.patch</changelog>
  <changelog author="colyli@suse.com" date="1630584000">- Remove Spare drives line from details for external metadata
  (bsc#1180661, bsc#1182642)
  0118-Remove-Spare-drives-line-from-details-for-external-m.patch
- Don't associate spares with other arrays during RAID Examine
  (bsc#1180661, bsc#1182642)
  0119-Don-t-associate-spares-with-other-arrays-during-RAID.patch</changelog>
  <changelog author="colyli@suse.com" date="1645012800">- Monitor: print message before quit for no array to monitor
  (bsc#1183229)
  0120-Monitor-print-message-before-quit-for-no-array-to-mo.patch</changelog>
  <changelog author="mwilck@suse.com" date="1647604800">- skip RAID assembly if DM_UDEV_DISABLE_OTHER_RULES_FLAG (bsc#1196054)
  * Add 0121-udev-md-raid-assembly.rules-skip-if-DM_UDEV_DISABLE_.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1653912000">- resource RAID failed during cluster patch, Mdadm gets floating point error (bsc#1197158)
  1004-mdadm-super1-restore-commit-45a87c2f31335-to-fix-clu.patch</changelog>
</package>
<package pkgid="e21082a0a0a26efe2c056d5dea593fc814d3de3e8bb602544496024a3c9ea66e" name="mdadm" arch="src">
  <version epoch="0" ver="4.1" rel="150300.24.15.1"/>
  <changelog author="colyli@suse.com" date="1553774400">- imsm: finish recovery when drive with rebuild fails (bsc#1126975)
  0010-imsm-finish-recovery-when-drive-with-rebuild-fails.patch
- mdmon: don't attempt to manage new arrays when terminating
  (bsc#1127526)
  0011-mdmon-don-t-attempt-to-manage-new-arrays-when-termin.patch</changelog>
  <changelog author="colyli@suse.com" date="1566820800">- 0012-mdadm-add-no-devices-to-avoid-component-devices-deta.patch
  (bsc#1139709)
  mdadm: add --no-devices to avoid component devices detail
  information
- 0013-udev-add-no-devices-option-for-calling-mdadm-detail.patch
  (bsc#1139709)
  udev: add --no-devices option for calling 'mdadm --detail'</changelog>
  <changelog author="nfbrown@suse.com" date="1572436800">- New patch: 0022-mdcheck-when-mdcheck_start-is-enabled-enable-mdcheck.patch
  New patch: 0023-mdcheck-use-to-pass-variable-to-mdcheck.patch
  New patch: 0024-SUSE-mdadm_env.sh-handle-MDADM_CHECK_DURATION.patch
  Improve systemd units for mdcheck (bsc#1153258)</changelog>
  <changelog author="colyli@suse.com" date="1581076800">- Create: add support for RAID0 layouts. (bsc#1162479)
  0024-Create-add-support-for-RAID0-layouts.patch
- Assemble: add support for RAID0 layouts. (bsc#1162479)
  0025-Assemble-add-support-for-RAID0-layouts.patch
- mdadm.8: add note information for raid0 growing operation
  (bsc#1129900)
  1002-mdadm.8-add-note-information-for-raid0-growing-opera.patch</changelog>
  <changelog author="colyli@suse.com" date="1581076801">- Enable probe_roms to scan more than 6 roms. (bsc#1156040)
  0026-Enable-probe_roms-to-scan-more-than-6-roms.patch</changelog>
  <changelog author="colyli@suse.com" date="1583236800">- Rename the following patches, they will be listed with new
  re-ordered prefix number in following commit,
    0001-Document-PART-POLICY-lines.patch
    0001-Makefile-install-mdadm_env.sh-to-usr-lib-mdadm.patch
    0002-policy-support-devices-with-multiple-paths.patch
    0003-mdcheck-add-systemd-unit-files-to-run-mdcheck.patch
    0004-Monitor-add-system-timer-to-run-oneshot-periodically.patch
    0005-imsm-update-metadata-correctly-while-raid10-double-d.patch
    0006-Grow-avoid-overflow-in-compute_backup_blocks.patch
    0007-Grow-report-correct-new-chunk-size.patch
    0008-policy.c-prevent-NULL-pointer-referencing.patch
    0009-Detail.c-do-not-skip-first-character-when-calling-xs.patch
    0010-imsm-finish-recovery-when-drive-with-rebuild-fails.patch
    0011-mdmon-don-t-attempt-to-manage-new-arrays-when-termin.patch
    0012-mdadm-add-no-devices-to-avoid-component-devices-deta.patch
    0013-udev-add-no-devices-option-for-calling-mdadm-detail.patch
    0021-mdcheck-when-mdcheck_start-is-enabled-enable-mdcheck.patch
    0022-mdcheck-use-to-pass-variable-to-mdcheck.patch
    0023-SUSE-mdadm_env.sh-handle-MDADM_CHECK_DURATION.patch
    0024-Create-add-support-for-RAID0-layouts.patch
    0025-Assemble-add-support-for-RAID0-layouts.patch
    0026-Enable-probe_roms-to-scan-more-than-6-roms.patch
    1002-mdadm.8-add-note-information-for-raid0-growing-opera.patch</changelog>
  <changelog author="colyli@suse.com" date="1583236801">- Update for latest mdadm-4.1+ patches, this is required by
  jsc#SLE-10078 and jsc#SLE-9348. Mostly the purpose is for
  latest Intel IMSM raid support.
  The following patches also include previous patches with
  new re-ordered prefix numbers.
- Makefile: install mdadm_env.sh to /usr/lib/mdadm (bsc#1111960)
  0000-Makefile-install-mdadm_env.sh-to-usr-lib-mdadm.patch
- Assemble: keep MD_DISK_FAILFAST and MD_DISK_WRITEMOSTLY flag
  (jsc#SLE-10078, jsc#SLE-9348)
  0001-Assemble-keep-MD_DISK_FAILFAST-and-MD_DISK_WRITEMOST.patch
- Document PART-POLICY lines (jsc#SLE-10078, jsc#SLE-9348)
  0002-Document-PART-POLICY-lines.patc
- policy: support devices with multiple paths.
  (jsc#SLE-10078, jsc#SLE-9348)
  0003-policy-support-devices-with-multiple-paths.patch
- mdcheck: add systemd unit files to run mdcheck. (bsc#1115407)
  0004-mdcheck-add-systemd-unit-files-to-run-mdcheck.patch
- Monitor: add system timer to run --oneshot periodically (bsc#1115407)
  0005-Monitor-add-system-timer-to-run-oneshot-periodically.patch
- imsm: update metadata correctly while raid10 double
  (jsc#SLE-10078, jsc#SLE-9348)
  0006-imsm-update-metadata-correctly-while-raid10-double-d.patch
- Assemble: mask FAILFAST and WRITEMOSTLY flags when finding
  (jsc#SLE-10078, jsc#SLE-9348)
  0007-Assemble-mask-FAILFAST-and-WRITEMOSTLY-flags-when-fi.patch
- Grow: avoid overflow in compute_backup_blocks()
  (jsc#SLE-10078, jsc#SLE-9348)
  0008-Grow-avoid-overflow-in-compute_backup_blocks.patch
- Grow: report correct new chunk size. (jsc#SLE-10078, jsc#SLE-9348)
  0009-Grow-report-correct-new-chunk-size.patch
- policy.c: prevent NULL pointer referencing (bsc#1106078)
  0010-policy.c-prevent-NULL-pointer-referencing.patch
- policy.c: Fix for compiler error (jsc#SLE-10078, jsc#SLE-9348)
  0012-policy.c-Fix-for-compiler-error.patch
- imsm: finish recovery when drive with rebuild fails (bsc#1126975)
  0013-imsm-finish-recovery-when-drive-with-rebuild-fails.patch
- imsm: fix reshape for &gt;2TB drives (jsc#SLE-10078, jsc#SLE-9348)
  0014-imsm-fix-reshape-for-2TB-drives.patch
- Fix spelling typos. (jsc#SLE-10078, jsc#SLE-9348)
  0015-Fix-spelling-typos.patch
- Detail.c: do not skip first character when calling xstrdup in
  Detail() (bsc#1123814)
  0016-Detail.c-do-not-skip-first-character-when-calling-xs.patch
- Fix reshape for decreasing data offset (jsc#SLE-10078, jsc#SLE-9348)
  0018-Fix-reshape-for-decreasing-data-offset.patch
- mdadm/tests: add one test case for failfast of raid1
  (jsc#SLE-10078, jsc#SLE-9348)
  0019-mdadm-tests-add-one-test-case-for-failfast-of-raid1.patch
- mdmon: don't attempt to manage new arrays when terminating
  (bsc#1127526)
  0020-mdmon-don-t-attempt-to-manage-new-arrays-when-termin.patch
- mdmon: wait for previous mdmon to exit during takeover
  (jsc#SLE-10078, jsc#SLE-9348)
  0021-mdmon-wait-for-previous-mdmon-to-exit-during-takeove.patch
- Assemble: Fix starting array with initial reshape checkpoint
  (jsc#SLE-10078, jsc#SLE-9348)
  0022-Assemble-Fix-starting-array-with-initial-reshape-che.patch
- add missing units to --examine (jsc#SLE-10078, jsc#SLE-9348)
  0023-add-missing-units-to-examine.patch
- imsm: fix spare activation for old matrix arrays
  (jsc#SLE-10078, jsc#SLE-9348)
  0024-imsm-fix-spare-activation-for-old-matrix-arrays.patch
- Create: Block rounding size to max (jsc#SLE-10078, jsc#SLE-9348)
  0025-Create-Block-rounding-size-to-max.patch
- udev: Add udev rules to create by-partuuid for md device
  (jsc#SLE-10078, jsc#SLE-9348)
  0026-udev-Add-udev-rules-to-create-by-partuuid-for-md-dev.patch
- mdmon: fix wrong array state when disk fails during mdmon
  (jsc#SLE-10078, jsc#SLE-9348)
  0027-mdmon-fix-wrong-array-state-when-disk-fails-during-m.patch
- Enable probe_roms to scan more than 6 roms. (bsc#1156040)
  0028-Enable-probe_roms-to-scan-more-than-6-roms.patch
- super-intel: Fix issue with abs() being irrelevant
  (jsc#SLE-10078, jsc#SLE-9348)
  0029-super-intel-Fix-issue-with-abs-being-irrelevant.patch
- mdadm.h: Introduced unaligned {get,put}_unaligned{16,32}()
  (jsc#SLE-10078, jsc#SLE-9348)
  0030-mdadm.h-Introduced-unaligned-get-put-_unaligned-16-3.patch
- super-intel: Use put_unaligned in split_ull
  (jsc#SLE-10078, jsc#SLE-9348)
  0031-super-intel-Use-put_unaligned-in-split_ull.patch
- mdadm: load default sysfs attributes after assemblation
  (jsc#SLE-10078, jsc#SLE-9348)
  0032-mdadm-load-default-sysfs-attributes-after-assemblati.patch
- mdadm.h: include sysmacros.h unconditionally
  (jsc#SLE-10078, jsc#SLE-9348)
  0033-mdadm.h-include-sysmacros.h-unconditionally.patch
- mdadm: add --no-devices to avoid component devices detail
  (bsc#1139709)
  0034-mdadm-add-no-devices-to-avoid-component-devices-deta.patch
- udev: add --no-devices option for calling 'mdadm (bsc#1139709)
  0035-udev-add-no-devices-option-for-calling-mdadm-detail.patch
- imsm: close removed drive fd. (jsc#SLE-10078, jsc#SLE-9348)
  0036-imsm-close-removed-drive-fd.patch
- mdadm: check value returned by snprintf against errors
  (jsc#SLE-10078, jsc#SLE-9348)
  0037-mdadm-check-value-returned-by-snprintf-against-error.patch
- mdadm: Introduce new array state 'broken' for raid0/linear
  (jsc#SLE-10078, jsc#SLE-9348)
  0038-mdadm-Introduce-new-array-state-broken-for-raid0-lin.patch
- mdadm: force a uuid swap on big endian (jsc#SLE-10078, jsc#SLE-9348)
  0039-mdadm-force-a-uuid-swap-on-big-endian.patch
- mdadm/md.4: add the descriptions for bitmap sysfs nodes
  (jsc#SLE-10078, jsc#SLE-9348)
  0040-mdadm-md.4-add-the-descriptions-for-bitmap-sysfs-nod.patch
- Init devlist as an array (jsc#SLE-10078, jsc#SLE-9348)
  0041-Init-devlist-as-an-array.patch
- Don't need to check recovery after re-add when no I/O writes
  (jsc#SLE-10078, jsc#SLE-9348)
  0042-Don-t-need-to-check-recovery-after-re-add-when-no-I-.patch
- udev: allow for udev attribute reading bug.
  (jsc#SLE-10078, jsc#SLE-9348)
  0043-udev-allow-for-udev-attribute-reading-bug.patch
- imsm: save current_vol number (jsc#SLE-10078, jsc#SLE-9348)
  0044-imsm-save-current_vol-number.patch
- imsm: allow to specify second volume size
  (jsc#SLE-10078, jsc#SLE-9348)
  0045-imsm-allow-to-specify-second-volume-size.patch
- mdcheck: when mdcheck_start is enabled, enable (bsc#1153258)
  0046-mdcheck-when-mdcheck_start-is-enabled-enable-mdcheck.patch
- mdcheck: use ${} to pass variable to mdcheck (bsc#1153258)
  0050-mdcheck-use-to-pass-variable-to-mdcheck.patch
- SUSE-mdadm_env.sh: handle MDADM_CHECK_DURATION (bsc#1153258)
  0051-SUSE-mdadm_env.sh-handle-MDADM_CHECK_DURATION.patch
- super-intel: don't mark structs 'packed' unnecessarily
  (jsc#SLE-10078, jsc#SLE-9348)
  0052-super-intel-don-t-mark-structs-packed-unnecessarily.patch
- Manage: Remove the legacy code for md driver prior to 0.90.03
  (jsc#SLE-10078, jsc#SLE-9348)
  0053-Manage-Remove-the-legacy-code-for-md-driver-prior-to.patch
- Remove last traces of HOT_ADD_DISK (jsc#SLE-10078, jsc#SLE-9348)
  0054-Remove-last-traces-of-HOT_ADD_DISK.patch
- Fix up a few formatting issues (jsc#SLE-10078, jsc#SLE-9348)
  0055-Fix-up-a-few-formatting-issues.patch
- Remove unused code (jsc#SLE-10078, jsc#SLE-9348)
  0056-Remove-unused-code.patch
- imsm: return correct uuid for volume in detail
  (jsc#SLE-10078, jsc#SLE-9348)
  0057-imsm-return-correct-uuid-for-volume-in-detail.patch
- imsm: Change the way of printing nvme drives in
  (jsc#SLE-10078, jsc#SLE-9348)
  0058-imsm-Change-the-way-of-printing-nvme-drives-in-detai.patch
- Create: add support for RAID0 layouts. (bsc#1162479)
  0059-Create-add-support-for-RAID0-layouts.patch
- Assemble: add support for RAID0 layouts. (bsc#1162479)
  0060-Assemble-add-support-for-RAID0-layouts.patch
- Respect $(CROSS_COMPILE) when $(CC) is the default
  (jsc#SLE-10078, jsc#SLE-9348)
  0061-Respect-CROSS_COMPILE-when-CC-is-the-default.patch
- Change warning message (jsc#SLE-10078, jsc#SLE-9348)
  0062-Change-warning-message.patch
- mdcheck service can't start succesfully because of syntax
  (jsc#SLE-10078, jsc#SLE-9348)
  0063-mdcheck-service-can-t-start-succesfully-because-of-s.patch
- imsm: Update grow manual. (jsc#SLE-10078, jsc#SLE-9348)
  0064-imsm-Update-grow-manual.patch
- Add support for Tebibytes (jsc#SLE-10078, jsc#SLE-9348)
  0065-Add-support-for-Tebibytes.patch
- imsm: fill working_disks according to metadata.
  (jsc#SLE-10078, jsc#SLE-9348)
  0066-imsm-fill-working_disks-according-to-metadata.patch
- mdadm.8: add note information for raid0 growing operation
  (bsc#1129900)
  0067-mdadm.8-add-note-information-for-raid0-growing-opera.patch
- Remove the legacy whitespace (jsc#SLE-10078, jsc#SLE-9348)
  0068-Remove-the-legacy-whitespace.patch
- imsm: pass subarray id to kill_subarray function
  (jsc#SLE-10078, jsc#SLE-9348)
  0069-imsm-pass-subarray-id-to-kill_subarray-function.patch
- imsm: Remove --dump/--restore implementation
  (jsc#SLE-10078, jsc#SLE-9348)
  0070-imsm-Remove-dump-restore-implementation.patch</changelog>
  <changelog author="colyli@suse.com" date="1592827200">- Detail: adding sync status for cluster device
  (bsc#1163727)
  0072-Detail-adding-sync-status-for-cluster-device.patch
- Monitor: improve check_one_sharer() for checking duplicated process
  (bsc#1168953)
  0071-Monitor-improve-check_one_sharer-for-checking-duplic.patch</changelog>
  <changelog author="colyli@suse.com" date="1592827201">- OnCalendar format fix of mdcheck_start.timer (bsc#1173137)
  1002-OnCalendar-format-fix-of-mdcheck_start-timer.patch</changelog>
  <changelog author="colyli@suse.com" date="1598788800">- mdadm: treat the Dell softraid array as local array (bsc#1175004)
  1003-mdadm-treat-the-Dell-softraid-array-as-local-array.patch</changelog>
  <changelog author="colyli@suse.com" date="1602417600">- Update to latest mdadm which is requested by jsc#SLE-13700 from
  partners. Mostly the purpose is for latest Intel IMSM raid
  support, while some other fixes are important too.
- imsm: Correct minimal device size (jsc#SLE-13700)
  0073-imsm-Correct-minimal-device-size.patch
- Detail: show correct bitmap info for cluster raid device
  (jsc#SLE-13700)
  0074-Detail-show-correct-bitmap-info-for-cluster-raid-dev.patch
- imsm: support the Array Creation Time field in metadata
  (jsc#SLE-13700)
  0075-imsm-support-the-Array-Creation-Time-field-in-metada.patch
- imsm: show Subarray and Volume ID in --examine output
  (jsc#SLE-13700)
  0076-imsm-show-Subarray-and-Volume-ID-in-examine-output.patch
- udev: Ignore change event for imsm (jsc#SLE-13700)
  0077-udev-Ignore-change-event-for-imsm.patch
- Manage, imsm: Write metadata before add (jsc#SLE-13700)
  0078-Manage-imsm-Write-metadata-before-add.patch
- Assemble: print error message if mdadm fails assembling
  with --uuid option (jsc#SLE-13700)
  0079-Assemble-print-error-message-if-mdadm-fails-assembli.patch
- clean up meaning of small typo (jsc#SLE-13700)
  0080-clean-up-meaning-of-small-typo.patch
- Assemble.c: respect force flag (jsc#SLE-13700)
  0081-Assemble.c-respect-force-flag.patch
- mdcheck: Log when done (jsc#SLE-13700)
  0082-mdcheck-Log-when-done.patch
- Makefile: add EXTRAVERSION support (jsc#SLE-13700)
  0083-Makefile-add-EXTRAVERSION-support.patch
- uuid.c: split uuid stuffs from util.c (jsc#SLE-13700)
  0084-uuid.c-split-uuid-stuffs-from-util.c.patch
- Include count for \0 character when using strncpy to
  implement strdup. (jsc#SLE-13700)
  0085-Include-count-for-0-character-when-using-strncpy-to-.patch
- restripe: fix ignoring return value of read and lseek
  (jsc#SLE-13700)
  0086-restripe-fix-ignoring-return-value-of-read-and-lseek.patch
- Block overwriting existing links while manual assembly
  (jsc#SLE-13700)
  0087-Block-overwriting-existing-links-while-manual-assemb.patch
- Detect too-small device: error rather than underflow/crash
  (jsc#SLE-13700)
  0088-Detect-too-small-device-error-rather-than-underflow-.patch
- Use more secure HTTPS URLs  (jsc#SLE-13700)
  0089-Use-more-secure-HTTPS-URLs.patch
- Update link to Intel page for IMSM (jsc#SLE-13700)
  0090-Update-link-to-Intel-page-for-IMSM.patch
- mdadm/Grow: prevent md's fd from being occupied during delayed time
  (jsc#SLE-13700)
  0091-mdadm-Grow-prevent-md-s-fd-from-being-occupied-durin.patch
- Specify nodes number when updating cluster nodes (jsc#SLE-13700)
  0092-Specify-nodes-number-when-updating-cluster-nodes.patch
- mdadm/md.4: update path to in-kernel-tree documentation
  (jsc#SLE-13700)
  0093-mdadm-md.4-update-path-to-in-kernel-tree-documentati.patch
- manual: update --examine-badblocks (jsc#SLE-13700)
  0094-manual-update-examine-badblocks.patch</changelog>
  <changelog author="colyli@suse.com" date="1607169600">- There are some important fixes merged in mdadm upstream which
  should go with jsc#SLE-13700. This is the update from upstream
  mdadm including the important fixes we should have.
- Detail: show correct raid level when the array is inactive
  (jsc#SLE-13700)
  0095-Detail-show-correct-raid-level-when-the-array-is-ina.patch
- Don't create bitmap for raid5 with journal disk
  (jsc#SLE-13700)
  0096-Don-t-create-bitmap-for-raid5-with-journal-disk.patch
- Monitor: refresh mdstat fd after select (jsc#SLE-13700)
  0097-Monitor-refresh-mdstat-fd-after-select.patch
- Monitor: stop notifing about containers.  (jsc#SLE-13700)
  0098-Monitor-stop-notifing-about-containers.patch
- mdmonitor: set small delay once (jsc#SLE-13700)
  0099-mdmonitor-set-small-delay-once.patch
- Check if other Monitor instance running before fork.
  (jsc#SLE-13700)
  0100-Check-if-other-Monitor-instance-running-before-fork.patch
- Super1: allow RAID0 layout setting to be removed.
  (jsc#SLE-13700)
  0101-Super1-allow-RAID0-layout-setting-to-be-removed.patch
- Detail: fix segfault during IMSM raid creation
  (jsc#SLE-13700)
  0102-Detail-fix-segfault-during-IMSM-raid-creation.patch
- Create.c: close mdfd and generate uevent (jsc#SLE-13700)
  0103-Create.c-close-mdfd-and-generate-uevent.patch
- imsm: update num_data_stripes according to dev_size
  (jsc#SLE-13700)
  0104-imsm-update-num_data_stripes-according-to-dev_size.patch
- imsm: remove redundant calls to imsm_get_map (jsc#SLE-13700)
  0105-imsm-remove-redundant-calls-to-imsm_get_map.patch
- Monitor: don't use default modes when creating a file
  (jsc#SLE-13700)
  0106-Monitor-don-t-use-default-modes-when-creating-a-file.patch
- imsm: limit support to first NVMe namespace (jsc#SLE-13700)
  0107-imsm-limit-support-to-first-NVMe-namespace.patch
- mdadm: Unify forks behaviour (jsc#SLE-13700)
  0108-mdadm-Unify-forks-behaviour.patch
- mdadm/Detail: show correct state for clustered array
  (jsc#SLE-13700)
  0109-mdadm-Detail-show-correct-state-for-clustered-array.patch
- Make target to install binaries only (jsc#SLE-13700)
  0110-Make-target-to-install-binaries-only.patch
- udev: start grow service automatically (jsc#SLE-13700)
  0111-udev-start-grow-service-automatically.patch</changelog>
  <changelog author="colyli@suse.com" date="1609848000">- Incremental: Remove redundant spare movement logic
  (jsc#SLE-13700, bsc#1180220)
  0112-Incremental-Remove-redundant-spare-movement-logic.patch
- Dump: get stat from a wrong metadata file when restoring metadata
  (jsc#SLE-13700)
  0113-Dump-get-stat-from-a-wrong-metadata-file-when-restor.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1617278400">- cluster-md/mdadm : avoid useless re-sync (bsc#1181341)
  0114-super1-fix-Floating-point-exception.patch
  0115-super1.c-avoid-useless-sync-when-bitmap-switches-fro.patch</changelog>
  <changelog author="colyli@suse.com" date="1620993600">- imsm: nvme multipath support (bsc#1175758)
  0116-imsm-nvme-multipath-support.patch</changelog>
  <changelog author="colyli@suse.com" date="1620993601">- Grow: be careful of corrupt dev_roles list (bsc#1181619)
  0117-Grow-be-careful-of-corrupt-dev_roles-list.patch</changelog>
  <changelog author="colyli@suse.com" date="1630584000">- Remove Spare drives line from details for external metadata
  (bsc#1180661, bsc#1182642)
  0118-Remove-Spare-drives-line-from-details-for-external-m.patch
- Don't associate spares with other arrays during RAID Examine
  (bsc#1180661, bsc#1182642)
  0119-Don-t-associate-spares-with-other-arrays-during-RAID.patch</changelog>
  <changelog author="colyli@suse.com" date="1645012800">- Monitor: print message before quit for no array to monitor
  (bsc#1183229)
  0120-Monitor-print-message-before-quit-for-no-array-to-mo.patch</changelog>
  <changelog author="mwilck@suse.com" date="1647604800">- skip RAID assembly if DM_UDEV_DISABLE_OTHER_RULES_FLAG (bsc#1196054)
  * Add 0121-udev-md-raid-assembly.rules-skip-if-DM_UDEV_DISABLE_.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1653912000">- resource RAID failed during cluster patch, Mdadm gets floating point error (bsc#1197158)
  1004-mdadm-super1-restore-commit-45a87c2f31335-to-fix-clu.patch</changelog>
</package>
<package pkgid="620b156c4f2714eb184bf6bc8ae81ffe904dc693c9107d60cb9fa52a9c642799" name="mdadm" arch="x86_64">
  <version epoch="0" ver="4.1" rel="150300.24.15.1"/>
  <changelog author="colyli@suse.com" date="1553774400">- imsm: finish recovery when drive with rebuild fails (bsc#1126975)
  0010-imsm-finish-recovery-when-drive-with-rebuild-fails.patch
- mdmon: don't attempt to manage new arrays when terminating
  (bsc#1127526)
  0011-mdmon-don-t-attempt-to-manage-new-arrays-when-termin.patch</changelog>
  <changelog author="colyli@suse.com" date="1566820800">- 0012-mdadm-add-no-devices-to-avoid-component-devices-deta.patch
  (bsc#1139709)
  mdadm: add --no-devices to avoid component devices detail
  information
- 0013-udev-add-no-devices-option-for-calling-mdadm-detail.patch
  (bsc#1139709)
  udev: add --no-devices option for calling 'mdadm --detail'</changelog>
  <changelog author="nfbrown@suse.com" date="1572436800">- New patch: 0022-mdcheck-when-mdcheck_start-is-enabled-enable-mdcheck.patch
  New patch: 0023-mdcheck-use-to-pass-variable-to-mdcheck.patch
  New patch: 0024-SUSE-mdadm_env.sh-handle-MDADM_CHECK_DURATION.patch
  Improve systemd units for mdcheck (bsc#1153258)</changelog>
  <changelog author="colyli@suse.com" date="1581076800">- Create: add support for RAID0 layouts. (bsc#1162479)
  0024-Create-add-support-for-RAID0-layouts.patch
- Assemble: add support for RAID0 layouts. (bsc#1162479)
  0025-Assemble-add-support-for-RAID0-layouts.patch
- mdadm.8: add note information for raid0 growing operation
  (bsc#1129900)
  1002-mdadm.8-add-note-information-for-raid0-growing-opera.patch</changelog>
  <changelog author="colyli@suse.com" date="1581076801">- Enable probe_roms to scan more than 6 roms. (bsc#1156040)
  0026-Enable-probe_roms-to-scan-more-than-6-roms.patch</changelog>
  <changelog author="colyli@suse.com" date="1583236800">- Rename the following patches, they will be listed with new
  re-ordered prefix number in following commit,
    0001-Document-PART-POLICY-lines.patch
    0001-Makefile-install-mdadm_env.sh-to-usr-lib-mdadm.patch
    0002-policy-support-devices-with-multiple-paths.patch
    0003-mdcheck-add-systemd-unit-files-to-run-mdcheck.patch
    0004-Monitor-add-system-timer-to-run-oneshot-periodically.patch
    0005-imsm-update-metadata-correctly-while-raid10-double-d.patch
    0006-Grow-avoid-overflow-in-compute_backup_blocks.patch
    0007-Grow-report-correct-new-chunk-size.patch
    0008-policy.c-prevent-NULL-pointer-referencing.patch
    0009-Detail.c-do-not-skip-first-character-when-calling-xs.patch
    0010-imsm-finish-recovery-when-drive-with-rebuild-fails.patch
    0011-mdmon-don-t-attempt-to-manage-new-arrays-when-termin.patch
    0012-mdadm-add-no-devices-to-avoid-component-devices-deta.patch
    0013-udev-add-no-devices-option-for-calling-mdadm-detail.patch
    0021-mdcheck-when-mdcheck_start-is-enabled-enable-mdcheck.patch
    0022-mdcheck-use-to-pass-variable-to-mdcheck.patch
    0023-SUSE-mdadm_env.sh-handle-MDADM_CHECK_DURATION.patch
    0024-Create-add-support-for-RAID0-layouts.patch
    0025-Assemble-add-support-for-RAID0-layouts.patch
    0026-Enable-probe_roms-to-scan-more-than-6-roms.patch
    1002-mdadm.8-add-note-information-for-raid0-growing-opera.patch</changelog>
  <changelog author="colyli@suse.com" date="1583236801">- Update for latest mdadm-4.1+ patches, this is required by
  jsc#SLE-10078 and jsc#SLE-9348. Mostly the purpose is for
  latest Intel IMSM raid support.
  The following patches also include previous patches with
  new re-ordered prefix numbers.
- Makefile: install mdadm_env.sh to /usr/lib/mdadm (bsc#1111960)
  0000-Makefile-install-mdadm_env.sh-to-usr-lib-mdadm.patch
- Assemble: keep MD_DISK_FAILFAST and MD_DISK_WRITEMOSTLY flag
  (jsc#SLE-10078, jsc#SLE-9348)
  0001-Assemble-keep-MD_DISK_FAILFAST-and-MD_DISK_WRITEMOST.patch
- Document PART-POLICY lines (jsc#SLE-10078, jsc#SLE-9348)
  0002-Document-PART-POLICY-lines.patc
- policy: support devices with multiple paths.
  (jsc#SLE-10078, jsc#SLE-9348)
  0003-policy-support-devices-with-multiple-paths.patch
- mdcheck: add systemd unit files to run mdcheck. (bsc#1115407)
  0004-mdcheck-add-systemd-unit-files-to-run-mdcheck.patch
- Monitor: add system timer to run --oneshot periodically (bsc#1115407)
  0005-Monitor-add-system-timer-to-run-oneshot-periodically.patch
- imsm: update metadata correctly while raid10 double
  (jsc#SLE-10078, jsc#SLE-9348)
  0006-imsm-update-metadata-correctly-while-raid10-double-d.patch
- Assemble: mask FAILFAST and WRITEMOSTLY flags when finding
  (jsc#SLE-10078, jsc#SLE-9348)
  0007-Assemble-mask-FAILFAST-and-WRITEMOSTLY-flags-when-fi.patch
- Grow: avoid overflow in compute_backup_blocks()
  (jsc#SLE-10078, jsc#SLE-9348)
  0008-Grow-avoid-overflow-in-compute_backup_blocks.patch
- Grow: report correct new chunk size. (jsc#SLE-10078, jsc#SLE-9348)
  0009-Grow-report-correct-new-chunk-size.patch
- policy.c: prevent NULL pointer referencing (bsc#1106078)
  0010-policy.c-prevent-NULL-pointer-referencing.patch
- policy.c: Fix for compiler error (jsc#SLE-10078, jsc#SLE-9348)
  0012-policy.c-Fix-for-compiler-error.patch
- imsm: finish recovery when drive with rebuild fails (bsc#1126975)
  0013-imsm-finish-recovery-when-drive-with-rebuild-fails.patch
- imsm: fix reshape for &gt;2TB drives (jsc#SLE-10078, jsc#SLE-9348)
  0014-imsm-fix-reshape-for-2TB-drives.patch
- Fix spelling typos. (jsc#SLE-10078, jsc#SLE-9348)
  0015-Fix-spelling-typos.patch
- Detail.c: do not skip first character when calling xstrdup in
  Detail() (bsc#1123814)
  0016-Detail.c-do-not-skip-first-character-when-calling-xs.patch
- Fix reshape for decreasing data offset (jsc#SLE-10078, jsc#SLE-9348)
  0018-Fix-reshape-for-decreasing-data-offset.patch
- mdadm/tests: add one test case for failfast of raid1
  (jsc#SLE-10078, jsc#SLE-9348)
  0019-mdadm-tests-add-one-test-case-for-failfast-of-raid1.patch
- mdmon: don't attempt to manage new arrays when terminating
  (bsc#1127526)
  0020-mdmon-don-t-attempt-to-manage-new-arrays-when-termin.patch
- mdmon: wait for previous mdmon to exit during takeover
  (jsc#SLE-10078, jsc#SLE-9348)
  0021-mdmon-wait-for-previous-mdmon-to-exit-during-takeove.patch
- Assemble: Fix starting array with initial reshape checkpoint
  (jsc#SLE-10078, jsc#SLE-9348)
  0022-Assemble-Fix-starting-array-with-initial-reshape-che.patch
- add missing units to --examine (jsc#SLE-10078, jsc#SLE-9348)
  0023-add-missing-units-to-examine.patch
- imsm: fix spare activation for old matrix arrays
  (jsc#SLE-10078, jsc#SLE-9348)
  0024-imsm-fix-spare-activation-for-old-matrix-arrays.patch
- Create: Block rounding size to max (jsc#SLE-10078, jsc#SLE-9348)
  0025-Create-Block-rounding-size-to-max.patch
- udev: Add udev rules to create by-partuuid for md device
  (jsc#SLE-10078, jsc#SLE-9348)
  0026-udev-Add-udev-rules-to-create-by-partuuid-for-md-dev.patch
- mdmon: fix wrong array state when disk fails during mdmon
  (jsc#SLE-10078, jsc#SLE-9348)
  0027-mdmon-fix-wrong-array-state-when-disk-fails-during-m.patch
- Enable probe_roms to scan more than 6 roms. (bsc#1156040)
  0028-Enable-probe_roms-to-scan-more-than-6-roms.patch
- super-intel: Fix issue with abs() being irrelevant
  (jsc#SLE-10078, jsc#SLE-9348)
  0029-super-intel-Fix-issue-with-abs-being-irrelevant.patch
- mdadm.h: Introduced unaligned {get,put}_unaligned{16,32}()
  (jsc#SLE-10078, jsc#SLE-9348)
  0030-mdadm.h-Introduced-unaligned-get-put-_unaligned-16-3.patch
- super-intel: Use put_unaligned in split_ull
  (jsc#SLE-10078, jsc#SLE-9348)
  0031-super-intel-Use-put_unaligned-in-split_ull.patch
- mdadm: load default sysfs attributes after assemblation
  (jsc#SLE-10078, jsc#SLE-9348)
  0032-mdadm-load-default-sysfs-attributes-after-assemblati.patch
- mdadm.h: include sysmacros.h unconditionally
  (jsc#SLE-10078, jsc#SLE-9348)
  0033-mdadm.h-include-sysmacros.h-unconditionally.patch
- mdadm: add --no-devices to avoid component devices detail
  (bsc#1139709)
  0034-mdadm-add-no-devices-to-avoid-component-devices-deta.patch
- udev: add --no-devices option for calling 'mdadm (bsc#1139709)
  0035-udev-add-no-devices-option-for-calling-mdadm-detail.patch
- imsm: close removed drive fd. (jsc#SLE-10078, jsc#SLE-9348)
  0036-imsm-close-removed-drive-fd.patch
- mdadm: check value returned by snprintf against errors
  (jsc#SLE-10078, jsc#SLE-9348)
  0037-mdadm-check-value-returned-by-snprintf-against-error.patch
- mdadm: Introduce new array state 'broken' for raid0/linear
  (jsc#SLE-10078, jsc#SLE-9348)
  0038-mdadm-Introduce-new-array-state-broken-for-raid0-lin.patch
- mdadm: force a uuid swap on big endian (jsc#SLE-10078, jsc#SLE-9348)
  0039-mdadm-force-a-uuid-swap-on-big-endian.patch
- mdadm/md.4: add the descriptions for bitmap sysfs nodes
  (jsc#SLE-10078, jsc#SLE-9348)
  0040-mdadm-md.4-add-the-descriptions-for-bitmap-sysfs-nod.patch
- Init devlist as an array (jsc#SLE-10078, jsc#SLE-9348)
  0041-Init-devlist-as-an-array.patch
- Don't need to check recovery after re-add when no I/O writes
  (jsc#SLE-10078, jsc#SLE-9348)
  0042-Don-t-need-to-check-recovery-after-re-add-when-no-I-.patch
- udev: allow for udev attribute reading bug.
  (jsc#SLE-10078, jsc#SLE-9348)
  0043-udev-allow-for-udev-attribute-reading-bug.patch
- imsm: save current_vol number (jsc#SLE-10078, jsc#SLE-9348)
  0044-imsm-save-current_vol-number.patch
- imsm: allow to specify second volume size
  (jsc#SLE-10078, jsc#SLE-9348)
  0045-imsm-allow-to-specify-second-volume-size.patch
- mdcheck: when mdcheck_start is enabled, enable (bsc#1153258)
  0046-mdcheck-when-mdcheck_start-is-enabled-enable-mdcheck.patch
- mdcheck: use ${} to pass variable to mdcheck (bsc#1153258)
  0050-mdcheck-use-to-pass-variable-to-mdcheck.patch
- SUSE-mdadm_env.sh: handle MDADM_CHECK_DURATION (bsc#1153258)
  0051-SUSE-mdadm_env.sh-handle-MDADM_CHECK_DURATION.patch
- super-intel: don't mark structs 'packed' unnecessarily
  (jsc#SLE-10078, jsc#SLE-9348)
  0052-super-intel-don-t-mark-structs-packed-unnecessarily.patch
- Manage: Remove the legacy code for md driver prior to 0.90.03
  (jsc#SLE-10078, jsc#SLE-9348)
  0053-Manage-Remove-the-legacy-code-for-md-driver-prior-to.patch
- Remove last traces of HOT_ADD_DISK (jsc#SLE-10078, jsc#SLE-9348)
  0054-Remove-last-traces-of-HOT_ADD_DISK.patch
- Fix up a few formatting issues (jsc#SLE-10078, jsc#SLE-9348)
  0055-Fix-up-a-few-formatting-issues.patch
- Remove unused code (jsc#SLE-10078, jsc#SLE-9348)
  0056-Remove-unused-code.patch
- imsm: return correct uuid for volume in detail
  (jsc#SLE-10078, jsc#SLE-9348)
  0057-imsm-return-correct-uuid-for-volume-in-detail.patch
- imsm: Change the way of printing nvme drives in
  (jsc#SLE-10078, jsc#SLE-9348)
  0058-imsm-Change-the-way-of-printing-nvme-drives-in-detai.patch
- Create: add support for RAID0 layouts. (bsc#1162479)
  0059-Create-add-support-for-RAID0-layouts.patch
- Assemble: add support for RAID0 layouts. (bsc#1162479)
  0060-Assemble-add-support-for-RAID0-layouts.patch
- Respect $(CROSS_COMPILE) when $(CC) is the default
  (jsc#SLE-10078, jsc#SLE-9348)
  0061-Respect-CROSS_COMPILE-when-CC-is-the-default.patch
- Change warning message (jsc#SLE-10078, jsc#SLE-9348)
  0062-Change-warning-message.patch
- mdcheck service can't start succesfully because of syntax
  (jsc#SLE-10078, jsc#SLE-9348)
  0063-mdcheck-service-can-t-start-succesfully-because-of-s.patch
- imsm: Update grow manual. (jsc#SLE-10078, jsc#SLE-9348)
  0064-imsm-Update-grow-manual.patch
- Add support for Tebibytes (jsc#SLE-10078, jsc#SLE-9348)
  0065-Add-support-for-Tebibytes.patch
- imsm: fill working_disks according to metadata.
  (jsc#SLE-10078, jsc#SLE-9348)
  0066-imsm-fill-working_disks-according-to-metadata.patch
- mdadm.8: add note information for raid0 growing operation
  (bsc#1129900)
  0067-mdadm.8-add-note-information-for-raid0-growing-opera.patch
- Remove the legacy whitespace (jsc#SLE-10078, jsc#SLE-9348)
  0068-Remove-the-legacy-whitespace.patch
- imsm: pass subarray id to kill_subarray function
  (jsc#SLE-10078, jsc#SLE-9348)
  0069-imsm-pass-subarray-id-to-kill_subarray-function.patch
- imsm: Remove --dump/--restore implementation
  (jsc#SLE-10078, jsc#SLE-9348)
  0070-imsm-Remove-dump-restore-implementation.patch</changelog>
  <changelog author="colyli@suse.com" date="1592827200">- Detail: adding sync status for cluster device
  (bsc#1163727)
  0072-Detail-adding-sync-status-for-cluster-device.patch
- Monitor: improve check_one_sharer() for checking duplicated process
  (bsc#1168953)
  0071-Monitor-improve-check_one_sharer-for-checking-duplic.patch</changelog>
  <changelog author="colyli@suse.com" date="1592827201">- OnCalendar format fix of mdcheck_start.timer (bsc#1173137)
  1002-OnCalendar-format-fix-of-mdcheck_start-timer.patch</changelog>
  <changelog author="colyli@suse.com" date="1598788800">- mdadm: treat the Dell softraid array as local array (bsc#1175004)
  1003-mdadm-treat-the-Dell-softraid-array-as-local-array.patch</changelog>
  <changelog author="colyli@suse.com" date="1602417600">- Update to latest mdadm which is requested by jsc#SLE-13700 from
  partners. Mostly the purpose is for latest Intel IMSM raid
  support, while some other fixes are important too.
- imsm: Correct minimal device size (jsc#SLE-13700)
  0073-imsm-Correct-minimal-device-size.patch
- Detail: show correct bitmap info for cluster raid device
  (jsc#SLE-13700)
  0074-Detail-show-correct-bitmap-info-for-cluster-raid-dev.patch
- imsm: support the Array Creation Time field in metadata
  (jsc#SLE-13700)
  0075-imsm-support-the-Array-Creation-Time-field-in-metada.patch
- imsm: show Subarray and Volume ID in --examine output
  (jsc#SLE-13700)
  0076-imsm-show-Subarray-and-Volume-ID-in-examine-output.patch
- udev: Ignore change event for imsm (jsc#SLE-13700)
  0077-udev-Ignore-change-event-for-imsm.patch
- Manage, imsm: Write metadata before add (jsc#SLE-13700)
  0078-Manage-imsm-Write-metadata-before-add.patch
- Assemble: print error message if mdadm fails assembling
  with --uuid option (jsc#SLE-13700)
  0079-Assemble-print-error-message-if-mdadm-fails-assembli.patch
- clean up meaning of small typo (jsc#SLE-13700)
  0080-clean-up-meaning-of-small-typo.patch
- Assemble.c: respect force flag (jsc#SLE-13700)
  0081-Assemble.c-respect-force-flag.patch
- mdcheck: Log when done (jsc#SLE-13700)
  0082-mdcheck-Log-when-done.patch
- Makefile: add EXTRAVERSION support (jsc#SLE-13700)
  0083-Makefile-add-EXTRAVERSION-support.patch
- uuid.c: split uuid stuffs from util.c (jsc#SLE-13700)
  0084-uuid.c-split-uuid-stuffs-from-util.c.patch
- Include count for \0 character when using strncpy to
  implement strdup. (jsc#SLE-13700)
  0085-Include-count-for-0-character-when-using-strncpy-to-.patch
- restripe: fix ignoring return value of read and lseek
  (jsc#SLE-13700)
  0086-restripe-fix-ignoring-return-value-of-read-and-lseek.patch
- Block overwriting existing links while manual assembly
  (jsc#SLE-13700)
  0087-Block-overwriting-existing-links-while-manual-assemb.patch
- Detect too-small device: error rather than underflow/crash
  (jsc#SLE-13700)
  0088-Detect-too-small-device-error-rather-than-underflow-.patch
- Use more secure HTTPS URLs  (jsc#SLE-13700)
  0089-Use-more-secure-HTTPS-URLs.patch
- Update link to Intel page for IMSM (jsc#SLE-13700)
  0090-Update-link-to-Intel-page-for-IMSM.patch
- mdadm/Grow: prevent md's fd from being occupied during delayed time
  (jsc#SLE-13700)
  0091-mdadm-Grow-prevent-md-s-fd-from-being-occupied-durin.patch
- Specify nodes number when updating cluster nodes (jsc#SLE-13700)
  0092-Specify-nodes-number-when-updating-cluster-nodes.patch
- mdadm/md.4: update path to in-kernel-tree documentation
  (jsc#SLE-13700)
  0093-mdadm-md.4-update-path-to-in-kernel-tree-documentati.patch
- manual: update --examine-badblocks (jsc#SLE-13700)
  0094-manual-update-examine-badblocks.patch</changelog>
  <changelog author="colyli@suse.com" date="1607169600">- There are some important fixes merged in mdadm upstream which
  should go with jsc#SLE-13700. This is the update from upstream
  mdadm including the important fixes we should have.
- Detail: show correct raid level when the array is inactive
  (jsc#SLE-13700)
  0095-Detail-show-correct-raid-level-when-the-array-is-ina.patch
- Don't create bitmap for raid5 with journal disk
  (jsc#SLE-13700)
  0096-Don-t-create-bitmap-for-raid5-with-journal-disk.patch
- Monitor: refresh mdstat fd after select (jsc#SLE-13700)
  0097-Monitor-refresh-mdstat-fd-after-select.patch
- Monitor: stop notifing about containers.  (jsc#SLE-13700)
  0098-Monitor-stop-notifing-about-containers.patch
- mdmonitor: set small delay once (jsc#SLE-13700)
  0099-mdmonitor-set-small-delay-once.patch
- Check if other Monitor instance running before fork.
  (jsc#SLE-13700)
  0100-Check-if-other-Monitor-instance-running-before-fork.patch
- Super1: allow RAID0 layout setting to be removed.
  (jsc#SLE-13700)
  0101-Super1-allow-RAID0-layout-setting-to-be-removed.patch
- Detail: fix segfault during IMSM raid creation
  (jsc#SLE-13700)
  0102-Detail-fix-segfault-during-IMSM-raid-creation.patch
- Create.c: close mdfd and generate uevent (jsc#SLE-13700)
  0103-Create.c-close-mdfd-and-generate-uevent.patch
- imsm: update num_data_stripes according to dev_size
  (jsc#SLE-13700)
  0104-imsm-update-num_data_stripes-according-to-dev_size.patch
- imsm: remove redundant calls to imsm_get_map (jsc#SLE-13700)
  0105-imsm-remove-redundant-calls-to-imsm_get_map.patch
- Monitor: don't use default modes when creating a file
  (jsc#SLE-13700)
  0106-Monitor-don-t-use-default-modes-when-creating-a-file.patch
- imsm: limit support to first NVMe namespace (jsc#SLE-13700)
  0107-imsm-limit-support-to-first-NVMe-namespace.patch
- mdadm: Unify forks behaviour (jsc#SLE-13700)
  0108-mdadm-Unify-forks-behaviour.patch
- mdadm/Detail: show correct state for clustered array
  (jsc#SLE-13700)
  0109-mdadm-Detail-show-correct-state-for-clustered-array.patch
- Make target to install binaries only (jsc#SLE-13700)
  0110-Make-target-to-install-binaries-only.patch
- udev: start grow service automatically (jsc#SLE-13700)
  0111-udev-start-grow-service-automatically.patch</changelog>
  <changelog author="colyli@suse.com" date="1609848000">- Incremental: Remove redundant spare movement logic
  (jsc#SLE-13700, bsc#1180220)
  0112-Incremental-Remove-redundant-spare-movement-logic.patch
- Dump: get stat from a wrong metadata file when restoring metadata
  (jsc#SLE-13700)
  0113-Dump-get-stat-from-a-wrong-metadata-file-when-restor.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1617278400">- cluster-md/mdadm : avoid useless re-sync (bsc#1181341)
  0114-super1-fix-Floating-point-exception.patch
  0115-super1.c-avoid-useless-sync-when-bitmap-switches-fro.patch</changelog>
  <changelog author="colyli@suse.com" date="1620993600">- imsm: nvme multipath support (bsc#1175758)
  0116-imsm-nvme-multipath-support.patch</changelog>
  <changelog author="colyli@suse.com" date="1620993601">- Grow: be careful of corrupt dev_roles list (bsc#1181619)
  0117-Grow-be-careful-of-corrupt-dev_roles-list.patch</changelog>
  <changelog author="colyli@suse.com" date="1630584000">- Remove Spare drives line from details for external metadata
  (bsc#1180661, bsc#1182642)
  0118-Remove-Spare-drives-line-from-details-for-external-m.patch
- Don't associate spares with other arrays during RAID Examine
  (bsc#1180661, bsc#1182642)
  0119-Don-t-associate-spares-with-other-arrays-during-RAID.patch</changelog>
  <changelog author="colyli@suse.com" date="1645012800">- Monitor: print message before quit for no array to monitor
  (bsc#1183229)
  0120-Monitor-print-message-before-quit-for-no-array-to-mo.patch</changelog>
  <changelog author="mwilck@suse.com" date="1647604800">- skip RAID assembly if DM_UDEV_DISABLE_OTHER_RULES_FLAG (bsc#1196054)
  * Add 0121-udev-md-raid-assembly.rules-skip-if-DM_UDEV_DISABLE_.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1653912000">- resource RAID failed during cluster patch, Mdadm gets floating point error (bsc#1197158)
  1004-mdadm-super1-restore-commit-45a87c2f31335-to-fix-clu.patch</changelog>
</package>
<package pkgid="c2c5fe56136f9eb7e64292b1c765a4809caa5e344ccce91ffb3b79c5495f6b72" name="mozilla-nspr" arch="aarch64">
  <version epoch="0" ver="4.34" rel="150000.3.23.1"/>
  <changelog author="wr@rosenauer.org" date="1501934400">- update to version 4.15
  * added TCP Fast Open functionality
  * various correctness fixes</changelog>
  <changelog author="wr@rosenauer.org" date="1505217600">- update to version 4.16
  * contains various correctness fixes
    see
    https://bugzilla.mozilla.org/buglist.cgi?resolution=FIXED&amp;query_format=advanced&amp;product=NSPR&amp;target_milestone=4.16
    for details</changelog>
  <changelog author="wr@rosenauer.org" date="1506859200">- update to version 4.17
  * changes to the Windows implementation of the networking code
    required for Firefox 57
  * a FreeBSD build fix (bmo#1391716)</changelog>
  <changelog author="wr@rosenauer.org" date="1518004800">- update to version 4.18
  * removed HP-UX DCE threads support
  * improvements for the Windows implementation of PR_SetCurrentThreadName
  * fixes for the Windows implementation of TCP Fast Open</changelog>
  <changelog author="cgrobertson@suse.com" date="1521115200">- update to version 4.19
  * changed order of shutdown cleanup to avoid a crash on Mac OSX
  * build compatibility with Android NDK r16 and glibc 2.26</changelog>
  <changelog author="alarrosa@suse.com" date="1540814400">- update to version 4.20
  * abstract socket address support for Linux (incl. Android)
  * aarch64 support for Windows
  * support for riscv64</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1563192000">- update to version 4.21
  * Use MAP_SHARED for read-only file mappings on MacOS and
    Android.
  * Changed prbit.h to use builtin function on aarch64.
  * Test program build fixes.
  * Minor fixes to support unified builds.
  * Update library copyright notices.
  * Removed Gonk/B2G references.</changelog>
  <changelog author="cgrobertson@suse.com" date="1574424000">- Use FAT LTO objects in order to provide proper static library</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1575460800">- update to version 4.23
  * fixed a build failure that was introduced in 4.22
  * correctness fix for Win64 socket polling
  * whitespace in C files was cleaned up and no longer uses
    tab characters for indenting
- update to version 4.22
  * added support for the ARC architecture
  * removed support for the following platforms:
    OSF1/Tru64, DGUX, IRIX, Symbian, BeOS
  * correctness and build fixes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1579089600">- update to version 4.24
  * added macro PR_ASSERT_ARG
  * removed some declarations
  * added support for Nios-II, Nds32 and Microblaze architectures</changelog>
  <changelog author="wr@rosenauer.org" date="1583236800">- update to version 4.25
  * fixed reading files larger than 4 GB on Win32
  * added support for Xtensa architecture</changelog>
  <changelog author="wr@rosenauer.org" date="1595505600">- update to version 4.26
  * PR_GetSystemInfo supports a new flag PR_SI_RELEASE_BUILD to get
    information about the operating system build version.
  * Better support parallel building on Windows.
  * The internal release automatic script requires python 3.</changelog>
  <changelog author="wr@rosenauer.org" date="1598097600">- update to version 4.27
  * the macOS platform code for shared library loading was
    changed to support macOS 11.
    If the absolute path parameter given to PR_LoadLibrary
    begins with either /System/ or /usr/lib/ then no test is
    performed if the library exists at a file.
  * An include statement for a Windows system library header
    was added</changelog>
  <changelog author="wr@rosenauer.org" date="1599566400">- update to version 4.28
  * Fix a compiler warning
  * Add rule for cross-compiling with cygwin</changelog>
  <changelog author="wr@rosenauer.org" date="1601467200">- update to version 4.29
  * Remove macOS Code Fragment Manager support code
  * Remove XP_MACOSX and OS_TARGET=MacOSX
  * Refresh config.guess and config.sub
  * Remove NSPR's patch to config.sub
  * Add support for e2k target (64-bit Elbrus 2000)</changelog>
  <changelog author="wr@rosenauer.org" date="1618747200">- update to version 4.30
  * support longer thread names on macOS
  * fix a build failure on OpenBSD</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to version 4.31:
  * Lock access to PRCallOnceType members in PR_CallOnce* for
    thread safety bmo#1686138</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627300800">- update to version 4.32:
  * implement new socket option PR_SockOpt_DontFrag
  * support larger DNS records by increasing the default buffer
    size for DNS queries</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1640779200">- update to 4.33:
  * fixes to build system and export of private symbols</changelog>
  <changelog author="wr@rosenauer.org" date="1653825600">- update to version 4.34
  * add an API that returns a preferred loopback IP on hosts that
    have two IP stacks available.</changelog>
</package>
<package pkgid="dac9f6d2f2955d5488b0277eaaa9196c655d5705e3576cdae7d07c57e8ec4721" name="mozilla-nspr" arch="src">
  <version epoch="0" ver="4.34" rel="150000.3.23.1"/>
  <changelog author="wr@rosenauer.org" date="1501934400">- update to version 4.15
  * added TCP Fast Open functionality
  * various correctness fixes</changelog>
  <changelog author="wr@rosenauer.org" date="1505217600">- update to version 4.16
  * contains various correctness fixes
    see
    https://bugzilla.mozilla.org/buglist.cgi?resolution=FIXED&amp;query_format=advanced&amp;product=NSPR&amp;target_milestone=4.16
    for details</changelog>
  <changelog author="wr@rosenauer.org" date="1506859200">- update to version 4.17
  * changes to the Windows implementation of the networking code
    required for Firefox 57
  * a FreeBSD build fix (bmo#1391716)</changelog>
  <changelog author="wr@rosenauer.org" date="1518004800">- update to version 4.18
  * removed HP-UX DCE threads support
  * improvements for the Windows implementation of PR_SetCurrentThreadName
  * fixes for the Windows implementation of TCP Fast Open</changelog>
  <changelog author="cgrobertson@suse.com" date="1521115200">- update to version 4.19
  * changed order of shutdown cleanup to avoid a crash on Mac OSX
  * build compatibility with Android NDK r16 and glibc 2.26</changelog>
  <changelog author="alarrosa@suse.com" date="1540814400">- update to version 4.20
  * abstract socket address support for Linux (incl. Android)
  * aarch64 support for Windows
  * support for riscv64</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1563192000">- update to version 4.21
  * Use MAP_SHARED for read-only file mappings on MacOS and
    Android.
  * Changed prbit.h to use builtin function on aarch64.
  * Test program build fixes.
  * Minor fixes to support unified builds.
  * Update library copyright notices.
  * Removed Gonk/B2G references.</changelog>
  <changelog author="cgrobertson@suse.com" date="1574424000">- Use FAT LTO objects in order to provide proper static library</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1575460800">- update to version 4.23
  * fixed a build failure that was introduced in 4.22
  * correctness fix for Win64 socket polling
  * whitespace in C files was cleaned up and no longer uses
    tab characters for indenting
- update to version 4.22
  * added support for the ARC architecture
  * removed support for the following platforms:
    OSF1/Tru64, DGUX, IRIX, Symbian, BeOS
  * correctness and build fixes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1579089600">- update to version 4.24
  * added macro PR_ASSERT_ARG
  * removed some declarations
  * added support for Nios-II, Nds32 and Microblaze architectures</changelog>
  <changelog author="wr@rosenauer.org" date="1583236800">- update to version 4.25
  * fixed reading files larger than 4 GB on Win32
  * added support for Xtensa architecture</changelog>
  <changelog author="wr@rosenauer.org" date="1595505600">- update to version 4.26
  * PR_GetSystemInfo supports a new flag PR_SI_RELEASE_BUILD to get
    information about the operating system build version.
  * Better support parallel building on Windows.
  * The internal release automatic script requires python 3.</changelog>
  <changelog author="wr@rosenauer.org" date="1598097600">- update to version 4.27
  * the macOS platform code for shared library loading was
    changed to support macOS 11.
    If the absolute path parameter given to PR_LoadLibrary
    begins with either /System/ or /usr/lib/ then no test is
    performed if the library exists at a file.
  * An include statement for a Windows system library header
    was added</changelog>
  <changelog author="wr@rosenauer.org" date="1599566400">- update to version 4.28
  * Fix a compiler warning
  * Add rule for cross-compiling with cygwin</changelog>
  <changelog author="wr@rosenauer.org" date="1601467200">- update to version 4.29
  * Remove macOS Code Fragment Manager support code
  * Remove XP_MACOSX and OS_TARGET=MacOSX
  * Refresh config.guess and config.sub
  * Remove NSPR's patch to config.sub
  * Add support for e2k target (64-bit Elbrus 2000)</changelog>
  <changelog author="wr@rosenauer.org" date="1618747200">- update to version 4.30
  * support longer thread names on macOS
  * fix a build failure on OpenBSD</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to version 4.31:
  * Lock access to PRCallOnceType members in PR_CallOnce* for
    thread safety bmo#1686138</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627300800">- update to version 4.32:
  * implement new socket option PR_SockOpt_DontFrag
  * support larger DNS records by increasing the default buffer
    size for DNS queries</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1640779200">- update to 4.33:
  * fixes to build system and export of private symbols</changelog>
  <changelog author="wr@rosenauer.org" date="1653825600">- update to version 4.34
  * add an API that returns a preferred loopback IP on hosts that
    have two IP stacks available.</changelog>
</package>
<package pkgid="ebe59609738318394618ccc19f9d6d8c32633ecfb5d73b16be903145c6103fac" name="mozilla-nspr" arch="x86_64">
  <version epoch="0" ver="4.34" rel="150000.3.23.1"/>
  <changelog author="wr@rosenauer.org" date="1501934400">- update to version 4.15
  * added TCP Fast Open functionality
  * various correctness fixes</changelog>
  <changelog author="wr@rosenauer.org" date="1505217600">- update to version 4.16
  * contains various correctness fixes
    see
    https://bugzilla.mozilla.org/buglist.cgi?resolution=FIXED&amp;query_format=advanced&amp;product=NSPR&amp;target_milestone=4.16
    for details</changelog>
  <changelog author="wr@rosenauer.org" date="1506859200">- update to version 4.17
  * changes to the Windows implementation of the networking code
    required for Firefox 57
  * a FreeBSD build fix (bmo#1391716)</changelog>
  <changelog author="wr@rosenauer.org" date="1518004800">- update to version 4.18
  * removed HP-UX DCE threads support
  * improvements for the Windows implementation of PR_SetCurrentThreadName
  * fixes for the Windows implementation of TCP Fast Open</changelog>
  <changelog author="cgrobertson@suse.com" date="1521115200">- update to version 4.19
  * changed order of shutdown cleanup to avoid a crash on Mac OSX
  * build compatibility with Android NDK r16 and glibc 2.26</changelog>
  <changelog author="alarrosa@suse.com" date="1540814400">- update to version 4.20
  * abstract socket address support for Linux (incl. Android)
  * aarch64 support for Windows
  * support for riscv64</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1563192000">- update to version 4.21
  * Use MAP_SHARED for read-only file mappings on MacOS and
    Android.
  * Changed prbit.h to use builtin function on aarch64.
  * Test program build fixes.
  * Minor fixes to support unified builds.
  * Update library copyright notices.
  * Removed Gonk/B2G references.</changelog>
  <changelog author="cgrobertson@suse.com" date="1574424000">- Use FAT LTO objects in order to provide proper static library</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1575460800">- update to version 4.23
  * fixed a build failure that was introduced in 4.22
  * correctness fix for Win64 socket polling
  * whitespace in C files was cleaned up and no longer uses
    tab characters for indenting
- update to version 4.22
  * added support for the ARC architecture
  * removed support for the following platforms:
    OSF1/Tru64, DGUX, IRIX, Symbian, BeOS
  * correctness and build fixes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1579089600">- update to version 4.24
  * added macro PR_ASSERT_ARG
  * removed some declarations
  * added support for Nios-II, Nds32 and Microblaze architectures</changelog>
  <changelog author="wr@rosenauer.org" date="1583236800">- update to version 4.25
  * fixed reading files larger than 4 GB on Win32
  * added support for Xtensa architecture</changelog>
  <changelog author="wr@rosenauer.org" date="1595505600">- update to version 4.26
  * PR_GetSystemInfo supports a new flag PR_SI_RELEASE_BUILD to get
    information about the operating system build version.
  * Better support parallel building on Windows.
  * The internal release automatic script requires python 3.</changelog>
  <changelog author="wr@rosenauer.org" date="1598097600">- update to version 4.27
  * the macOS platform code for shared library loading was
    changed to support macOS 11.
    If the absolute path parameter given to PR_LoadLibrary
    begins with either /System/ or /usr/lib/ then no test is
    performed if the library exists at a file.
  * An include statement for a Windows system library header
    was added</changelog>
  <changelog author="wr@rosenauer.org" date="1599566400">- update to version 4.28
  * Fix a compiler warning
  * Add rule for cross-compiling with cygwin</changelog>
  <changelog author="wr@rosenauer.org" date="1601467200">- update to version 4.29
  * Remove macOS Code Fragment Manager support code
  * Remove XP_MACOSX and OS_TARGET=MacOSX
  * Refresh config.guess and config.sub
  * Remove NSPR's patch to config.sub
  * Add support for e2k target (64-bit Elbrus 2000)</changelog>
  <changelog author="wr@rosenauer.org" date="1618747200">- update to version 4.30
  * support longer thread names on macOS
  * fix a build failure on OpenBSD</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to version 4.31:
  * Lock access to PRCallOnceType members in PR_CallOnce* for
    thread safety bmo#1686138</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627300800">- update to version 4.32:
  * implement new socket option PR_SockOpt_DontFrag
  * support larger DNS records by increasing the default buffer
    size for DNS queries</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1640779200">- update to 4.33:
  * fixes to build system and export of private symbols</changelog>
  <changelog author="wr@rosenauer.org" date="1653825600">- update to version 4.34
  * add an API that returns a preferred loopback IP on hosts that
    have two IP stacks available.</changelog>
</package>
<package pkgid="1b9bd000e649447113c58fe5323b6e6d5f6fb0773059df91156971e30bde373d" name="mozilla-nss" arch="aarch64">
  <version epoch="0" ver="3.79" rel="150000.3.74.1"/>
  <changelog author="wr@rosenauer.org" date="1615896000">- update to NSS 3.62
  * bmo#1688374 - Fix parallel build NSS-3.61 with make
  * bmo#1682044 - pkix_Build_GatherCerts() + pkix_CacheCert_Add()
    can corrupt "cachedCertTable"
  * bmo#1690583 - Fix CH padding extension size calculation
  * bmo#1690421 - Adjust 3.62 ABI report formatting for new libabigail
  * bmo#1690421 - Install packaged libabigail in docker-builds image
  * bmo#1689228 - Minor ECH -09 fixes for interop testing, fuzzing
  * bmo#1674819 - Fixup a51fae403328, enum type may be signed
  * bmo#1681585 - Add ECH support to selfserv
  * bmo#1681585 - Update ECH to Draft-09
  * bmo#1678398 - Add Export/Import functions for HPKE context
  * bmo#1678398 - Update HPKE to draft-07
- required for Firefox 87</changelog>
  <changelog author="wr@rosenauer.org" date="1618747200">- update to NSS 3.63.1
  * no upstream release notes for 3.63.1 (yet)
  Fixed in 3.63
  * bmo#1697380 - Make a clang-format run on top of helpful contributions.
  * bmo#1683520 - ECCKiila P384, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-384: allow zero scalars in dual
    scalar multiplication.
  * bmo#1683520 - ECCKiila P521, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-521: allow zero scalars in dual
    scalar multiplication.
  * bmo#1696800 - HACL* update March 2021 - c95ab70fcb2bc21025d8845281bc4bc8987ca683.
  * bmo#1694214 - tstclnt can't enable middlebox compat mode.
  * bmo#1694392 - NSS does not work with PKCS #11 modules not supporting
    profiles.
  * bmo#1685880 - Minor fix to prevent unused variable on early return.
  * bmo#1685880 - Fix for the gcc compiler version 7 to support setenv
    with nss build.
  * bmo#1693217 - Increase nssckbi.h version number for March 2021 batch
    of root CA changes, CA list version 2.48.
  * bmo#1692094 - Set email distrust after to 21-03-01 for Camerfirma's
    'Chambers of Commerce' and 'Global Chambersign' roots.
  * bmo#1618407 - Symantec root certs - Set CKA_NSS_EMAIL_DISTRUST_AFTER.
  * bmo#1693173 - Add GlobalSign R45, E45, R46, and E46 root certs to NSS.
  * bmo#1683738 - Add AC RAIZ FNMT-RCM SERVIDORES SEGUROS root cert to NSS.
  * bmo#1686854 - Remove GeoTrust PCA-G2 and VeriSign Universal root certs
    from NSS.
  * bmo#1687822 - Turn off Websites trust bit for the ?Staat der
    Nederlanden Root CA - G3? root cert in NSS.
  * bmo#1692094 - Turn off Websites Trust Bit for 'Chambers of Commerce
    Root - 2008' and 'Global Chambersign Root - 2008?.
  * bmo#1694291 - Tracing fixes for ECH.
- required for Firefox 88</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to NSS 3.64
  * bmo#1705286 - Properly detect mips64.
  * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and
    disable_crypto_vsx.
  * bmo#1698320 - replace __builtin_cpu_supports("vsx") with
    ppc_crypto_support() for clang.
  * bmo#1613235 - Add POWER ChaCha20 stream cipher vector
    acceleration.</changelog>
  <changelog author="wr@rosenauer.org" date="1625918400">- update to NSS 3.66
  * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  * bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  * bmo#1707097 - Add Certum Trusted Root CA to NSS.
  * bmo#1707097 - Add Certum EC-384 CA to NSS.
  * bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  * bmo#1709291 - Add VerifyCodeSigningCertificateChain.
  * Use GNU tar for the release helper script.
- update to NSS 3.65
  * bmo#1709654 - Update for NetBSD configuration.
  * bmo#1709750 - Disable HPKE test when fuzzing.
  * bmo#1566124 - Optimize AES-GCM for ppc64le.
  * bmo#1699021 - Add AES-256-GCM to HPKE.
  * bmo#1698419 - ECH -10 updates.
  * bmo#1692930 - Update HPKE to final version.
  * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  * bmo#1703936 - New coverity/cpp scanner errors.
  * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.
- refreshed patches
- Firefox 90.0 requires NSS 3.66</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627560000">- update to NSS 3.68
  * bmo#1713562 - Fix test leak.
  * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  * bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  * bmo#1712883 - DTLS 1.3 draft-43.
  * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  * bmo#1713562 - Validate ECH public names.
  * bmo#1717610 - Add function to get seconds from epoch from pkix::Time.
- update to NSS 3.67
  * bmo#1683710 - Add a means to disable ALPN.
  * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.</changelog>
  <changelog author="hpj@suse.com" date="1629288000">- Update nss-fips-constructor-self-tests.patch to fix crashes
  reported by upstream. This was likely affecting WebRTC calls.</changelog>
  <changelog author="cgrobertson@suse.com" date="1630411200">- Removed nss-fips-kdf-self-tests.patch.  This was made
  obsolete by upstream changes. (bmo#1660304)
- Rebase nss-fips-stricter-dh.patch needed due to upstream changes.</changelog>
  <changelog author="hpj@suse.com" date="1635768000">- Update nss-fips-approved-crypto-non-ec.patch to claim 3DES
  unapproved in FIPS mode (bsc#1192080).
- Update nss-fips-constructor-self-tests.patch to allow testing
  of unapproved algorithms (bsc#1192228).
- Add nss-fips-version-indicators.patch (bmo#1729550, bsc#1192086).
  This adds FIPS version indicators.
- Add nss-fips-180-3-csp-clearing.patch (bmo#1697303, bsc#1192087).
  Most of the relevant changes are already upstream since NSS 3.60.</changelog>
  <changelog author="hpj@suse.com" date="1637668800">- Enable NSS_ENABLE_FIPS_INDICATORS and set NSS_FIPS_MODULE_ID
  for build.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
</package>
<package pkgid="0e6d218cf54060b7c7228b2a9457705e6ea91c201072b5de894f59b80e8274a1" name="mozilla-nss" arch="src">
  <version epoch="0" ver="3.79" rel="150000.3.74.1"/>
  <changelog author="wr@rosenauer.org" date="1615896000">- update to NSS 3.62
  * bmo#1688374 - Fix parallel build NSS-3.61 with make
  * bmo#1682044 - pkix_Build_GatherCerts() + pkix_CacheCert_Add()
    can corrupt "cachedCertTable"
  * bmo#1690583 - Fix CH padding extension size calculation
  * bmo#1690421 - Adjust 3.62 ABI report formatting for new libabigail
  * bmo#1690421 - Install packaged libabigail in docker-builds image
  * bmo#1689228 - Minor ECH -09 fixes for interop testing, fuzzing
  * bmo#1674819 - Fixup a51fae403328, enum type may be signed
  * bmo#1681585 - Add ECH support to selfserv
  * bmo#1681585 - Update ECH to Draft-09
  * bmo#1678398 - Add Export/Import functions for HPKE context
  * bmo#1678398 - Update HPKE to draft-07
- required for Firefox 87</changelog>
  <changelog author="wr@rosenauer.org" date="1618747200">- update to NSS 3.63.1
  * no upstream release notes for 3.63.1 (yet)
  Fixed in 3.63
  * bmo#1697380 - Make a clang-format run on top of helpful contributions.
  * bmo#1683520 - ECCKiila P384, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-384: allow zero scalars in dual
    scalar multiplication.
  * bmo#1683520 - ECCKiila P521, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-521: allow zero scalars in dual
    scalar multiplication.
  * bmo#1696800 - HACL* update March 2021 - c95ab70fcb2bc21025d8845281bc4bc8987ca683.
  * bmo#1694214 - tstclnt can't enable middlebox compat mode.
  * bmo#1694392 - NSS does not work with PKCS #11 modules not supporting
    profiles.
  * bmo#1685880 - Minor fix to prevent unused variable on early return.
  * bmo#1685880 - Fix for the gcc compiler version 7 to support setenv
    with nss build.
  * bmo#1693217 - Increase nssckbi.h version number for March 2021 batch
    of root CA changes, CA list version 2.48.
  * bmo#1692094 - Set email distrust after to 21-03-01 for Camerfirma's
    'Chambers of Commerce' and 'Global Chambersign' roots.
  * bmo#1618407 - Symantec root certs - Set CKA_NSS_EMAIL_DISTRUST_AFTER.
  * bmo#1693173 - Add GlobalSign R45, E45, R46, and E46 root certs to NSS.
  * bmo#1683738 - Add AC RAIZ FNMT-RCM SERVIDORES SEGUROS root cert to NSS.
  * bmo#1686854 - Remove GeoTrust PCA-G2 and VeriSign Universal root certs
    from NSS.
  * bmo#1687822 - Turn off Websites trust bit for the ?Staat der
    Nederlanden Root CA - G3? root cert in NSS.
  * bmo#1692094 - Turn off Websites Trust Bit for 'Chambers of Commerce
    Root - 2008' and 'Global Chambersign Root - 2008?.
  * bmo#1694291 - Tracing fixes for ECH.
- required for Firefox 88</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to NSS 3.64
  * bmo#1705286 - Properly detect mips64.
  * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and
    disable_crypto_vsx.
  * bmo#1698320 - replace __builtin_cpu_supports("vsx") with
    ppc_crypto_support() for clang.
  * bmo#1613235 - Add POWER ChaCha20 stream cipher vector
    acceleration.</changelog>
  <changelog author="wr@rosenauer.org" date="1625918400">- update to NSS 3.66
  * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  * bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  * bmo#1707097 - Add Certum Trusted Root CA to NSS.
  * bmo#1707097 - Add Certum EC-384 CA to NSS.
  * bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  * bmo#1709291 - Add VerifyCodeSigningCertificateChain.
  * Use GNU tar for the release helper script.
- update to NSS 3.65
  * bmo#1709654 - Update for NetBSD configuration.
  * bmo#1709750 - Disable HPKE test when fuzzing.
  * bmo#1566124 - Optimize AES-GCM for ppc64le.
  * bmo#1699021 - Add AES-256-GCM to HPKE.
  * bmo#1698419 - ECH -10 updates.
  * bmo#1692930 - Update HPKE to final version.
  * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  * bmo#1703936 - New coverity/cpp scanner errors.
  * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.
- refreshed patches
- Firefox 90.0 requires NSS 3.66</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627560000">- update to NSS 3.68
  * bmo#1713562 - Fix test leak.
  * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  * bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  * bmo#1712883 - DTLS 1.3 draft-43.
  * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  * bmo#1713562 - Validate ECH public names.
  * bmo#1717610 - Add function to get seconds from epoch from pkix::Time.
- update to NSS 3.67
  * bmo#1683710 - Add a means to disable ALPN.
  * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.</changelog>
  <changelog author="hpj@suse.com" date="1629288000">- Update nss-fips-constructor-self-tests.patch to fix crashes
  reported by upstream. This was likely affecting WebRTC calls.</changelog>
  <changelog author="cgrobertson@suse.com" date="1630411200">- Removed nss-fips-kdf-self-tests.patch.  This was made
  obsolete by upstream changes. (bmo#1660304)
- Rebase nss-fips-stricter-dh.patch needed due to upstream changes.</changelog>
  <changelog author="hpj@suse.com" date="1635768000">- Update nss-fips-approved-crypto-non-ec.patch to claim 3DES
  unapproved in FIPS mode (bsc#1192080).
- Update nss-fips-constructor-self-tests.patch to allow testing
  of unapproved algorithms (bsc#1192228).
- Add nss-fips-version-indicators.patch (bmo#1729550, bsc#1192086).
  This adds FIPS version indicators.
- Add nss-fips-180-3-csp-clearing.patch (bmo#1697303, bsc#1192087).
  Most of the relevant changes are already upstream since NSS 3.60.</changelog>
  <changelog author="hpj@suse.com" date="1637668800">- Enable NSS_ENABLE_FIPS_INDICATORS and set NSS_FIPS_MODULE_ID
  for build.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
</package>
<package pkgid="5ac9be7a1c8e753bfcadd2f3aede6fcedcdcd887937ce57092fdb16b57118779" name="mozilla-nss" arch="x86_64">
  <version epoch="0" ver="3.79" rel="150000.3.74.1"/>
  <changelog author="wr@rosenauer.org" date="1615896000">- update to NSS 3.62
  * bmo#1688374 - Fix parallel build NSS-3.61 with make
  * bmo#1682044 - pkix_Build_GatherCerts() + pkix_CacheCert_Add()
    can corrupt "cachedCertTable"
  * bmo#1690583 - Fix CH padding extension size calculation
  * bmo#1690421 - Adjust 3.62 ABI report formatting for new libabigail
  * bmo#1690421 - Install packaged libabigail in docker-builds image
  * bmo#1689228 - Minor ECH -09 fixes for interop testing, fuzzing
  * bmo#1674819 - Fixup a51fae403328, enum type may be signed
  * bmo#1681585 - Add ECH support to selfserv
  * bmo#1681585 - Update ECH to Draft-09
  * bmo#1678398 - Add Export/Import functions for HPKE context
  * bmo#1678398 - Update HPKE to draft-07
- required for Firefox 87</changelog>
  <changelog author="wr@rosenauer.org" date="1618747200">- update to NSS 3.63.1
  * no upstream release notes for 3.63.1 (yet)
  Fixed in 3.63
  * bmo#1697380 - Make a clang-format run on top of helpful contributions.
  * bmo#1683520 - ECCKiila P384, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-384: allow zero scalars in dual
    scalar multiplication.
  * bmo#1683520 - ECCKiila P521, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-521: allow zero scalars in dual
    scalar multiplication.
  * bmo#1696800 - HACL* update March 2021 - c95ab70fcb2bc21025d8845281bc4bc8987ca683.
  * bmo#1694214 - tstclnt can't enable middlebox compat mode.
  * bmo#1694392 - NSS does not work with PKCS #11 modules not supporting
    profiles.
  * bmo#1685880 - Minor fix to prevent unused variable on early return.
  * bmo#1685880 - Fix for the gcc compiler version 7 to support setenv
    with nss build.
  * bmo#1693217 - Increase nssckbi.h version number for March 2021 batch
    of root CA changes, CA list version 2.48.
  * bmo#1692094 - Set email distrust after to 21-03-01 for Camerfirma's
    'Chambers of Commerce' and 'Global Chambersign' roots.
  * bmo#1618407 - Symantec root certs - Set CKA_NSS_EMAIL_DISTRUST_AFTER.
  * bmo#1693173 - Add GlobalSign R45, E45, R46, and E46 root certs to NSS.
  * bmo#1683738 - Add AC RAIZ FNMT-RCM SERVIDORES SEGUROS root cert to NSS.
  * bmo#1686854 - Remove GeoTrust PCA-G2 and VeriSign Universal root certs
    from NSS.
  * bmo#1687822 - Turn off Websites trust bit for the ?Staat der
    Nederlanden Root CA - G3? root cert in NSS.
  * bmo#1692094 - Turn off Websites Trust Bit for 'Chambers of Commerce
    Root - 2008' and 'Global Chambersign Root - 2008?.
  * bmo#1694291 - Tracing fixes for ECH.
- required for Firefox 88</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to NSS 3.64
  * bmo#1705286 - Properly detect mips64.
  * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and
    disable_crypto_vsx.
  * bmo#1698320 - replace __builtin_cpu_supports("vsx") with
    ppc_crypto_support() for clang.
  * bmo#1613235 - Add POWER ChaCha20 stream cipher vector
    acceleration.</changelog>
  <changelog author="wr@rosenauer.org" date="1625918400">- update to NSS 3.66
  * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  * bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  * bmo#1707097 - Add Certum Trusted Root CA to NSS.
  * bmo#1707097 - Add Certum EC-384 CA to NSS.
  * bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  * bmo#1709291 - Add VerifyCodeSigningCertificateChain.
  * Use GNU tar for the release helper script.
- update to NSS 3.65
  * bmo#1709654 - Update for NetBSD configuration.
  * bmo#1709750 - Disable HPKE test when fuzzing.
  * bmo#1566124 - Optimize AES-GCM for ppc64le.
  * bmo#1699021 - Add AES-256-GCM to HPKE.
  * bmo#1698419 - ECH -10 updates.
  * bmo#1692930 - Update HPKE to final version.
  * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  * bmo#1703936 - New coverity/cpp scanner errors.
  * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.
- refreshed patches
- Firefox 90.0 requires NSS 3.66</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627560000">- update to NSS 3.68
  * bmo#1713562 - Fix test leak.
  * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  * bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  * bmo#1712883 - DTLS 1.3 draft-43.
  * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  * bmo#1713562 - Validate ECH public names.
  * bmo#1717610 - Add function to get seconds from epoch from pkix::Time.
- update to NSS 3.67
  * bmo#1683710 - Add a means to disable ALPN.
  * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.</changelog>
  <changelog author="hpj@suse.com" date="1629288000">- Update nss-fips-constructor-self-tests.patch to fix crashes
  reported by upstream. This was likely affecting WebRTC calls.</changelog>
  <changelog author="cgrobertson@suse.com" date="1630411200">- Removed nss-fips-kdf-self-tests.patch.  This was made
  obsolete by upstream changes. (bmo#1660304)
- Rebase nss-fips-stricter-dh.patch needed due to upstream changes.</changelog>
  <changelog author="hpj@suse.com" date="1635768000">- Update nss-fips-approved-crypto-non-ec.patch to claim 3DES
  unapproved in FIPS mode (bsc#1192080).
- Update nss-fips-constructor-self-tests.patch to allow testing
  of unapproved algorithms (bsc#1192228).
- Add nss-fips-version-indicators.patch (bmo#1729550, bsc#1192086).
  This adds FIPS version indicators.
- Add nss-fips-180-3-csp-clearing.patch (bmo#1697303, bsc#1192087).
  Most of the relevant changes are already upstream since NSS 3.60.</changelog>
  <changelog author="hpj@suse.com" date="1637668800">- Enable NSS_ENABLE_FIPS_INDICATORS and set NSS_FIPS_MODULE_ID
  for build.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
</package>
<package pkgid="c1b55797e226c80548bf5500993a5ef4456538a955298d7c293d9137f161ca2f" name="mozilla-nss-certs" arch="aarch64">
  <version epoch="0" ver="3.79" rel="150000.3.74.1"/>
  <changelog author="wr@rosenauer.org" date="1615896000">- update to NSS 3.62
  * bmo#1688374 - Fix parallel build NSS-3.61 with make
  * bmo#1682044 - pkix_Build_GatherCerts() + pkix_CacheCert_Add()
    can corrupt "cachedCertTable"
  * bmo#1690583 - Fix CH padding extension size calculation
  * bmo#1690421 - Adjust 3.62 ABI report formatting for new libabigail
  * bmo#1690421 - Install packaged libabigail in docker-builds image
  * bmo#1689228 - Minor ECH -09 fixes for interop testing, fuzzing
  * bmo#1674819 - Fixup a51fae403328, enum type may be signed
  * bmo#1681585 - Add ECH support to selfserv
  * bmo#1681585 - Update ECH to Draft-09
  * bmo#1678398 - Add Export/Import functions for HPKE context
  * bmo#1678398 - Update HPKE to draft-07
- required for Firefox 87</changelog>
  <changelog author="wr@rosenauer.org" date="1618747200">- update to NSS 3.63.1
  * no upstream release notes for 3.63.1 (yet)
  Fixed in 3.63
  * bmo#1697380 - Make a clang-format run on top of helpful contributions.
  * bmo#1683520 - ECCKiila P384, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-384: allow zero scalars in dual
    scalar multiplication.
  * bmo#1683520 - ECCKiila P521, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-521: allow zero scalars in dual
    scalar multiplication.
  * bmo#1696800 - HACL* update March 2021 - c95ab70fcb2bc21025d8845281bc4bc8987ca683.
  * bmo#1694214 - tstclnt can't enable middlebox compat mode.
  * bmo#1694392 - NSS does not work with PKCS #11 modules not supporting
    profiles.
  * bmo#1685880 - Minor fix to prevent unused variable on early return.
  * bmo#1685880 - Fix for the gcc compiler version 7 to support setenv
    with nss build.
  * bmo#1693217 - Increase nssckbi.h version number for March 2021 batch
    of root CA changes, CA list version 2.48.
  * bmo#1692094 - Set email distrust after to 21-03-01 for Camerfirma's
    'Chambers of Commerce' and 'Global Chambersign' roots.
  * bmo#1618407 - Symantec root certs - Set CKA_NSS_EMAIL_DISTRUST_AFTER.
  * bmo#1693173 - Add GlobalSign R45, E45, R46, and E46 root certs to NSS.
  * bmo#1683738 - Add AC RAIZ FNMT-RCM SERVIDORES SEGUROS root cert to NSS.
  * bmo#1686854 - Remove GeoTrust PCA-G2 and VeriSign Universal root certs
    from NSS.
  * bmo#1687822 - Turn off Websites trust bit for the ?Staat der
    Nederlanden Root CA - G3? root cert in NSS.
  * bmo#1692094 - Turn off Websites Trust Bit for 'Chambers of Commerce
    Root - 2008' and 'Global Chambersign Root - 2008?.
  * bmo#1694291 - Tracing fixes for ECH.
- required for Firefox 88</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to NSS 3.64
  * bmo#1705286 - Properly detect mips64.
  * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and
    disable_crypto_vsx.
  * bmo#1698320 - replace __builtin_cpu_supports("vsx") with
    ppc_crypto_support() for clang.
  * bmo#1613235 - Add POWER ChaCha20 stream cipher vector
    acceleration.</changelog>
  <changelog author="wr@rosenauer.org" date="1625918400">- update to NSS 3.66
  * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  * bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  * bmo#1707097 - Add Certum Trusted Root CA to NSS.
  * bmo#1707097 - Add Certum EC-384 CA to NSS.
  * bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  * bmo#1709291 - Add VerifyCodeSigningCertificateChain.
  * Use GNU tar for the release helper script.
- update to NSS 3.65
  * bmo#1709654 - Update for NetBSD configuration.
  * bmo#1709750 - Disable HPKE test when fuzzing.
  * bmo#1566124 - Optimize AES-GCM for ppc64le.
  * bmo#1699021 - Add AES-256-GCM to HPKE.
  * bmo#1698419 - ECH -10 updates.
  * bmo#1692930 - Update HPKE to final version.
  * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  * bmo#1703936 - New coverity/cpp scanner errors.
  * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.
- refreshed patches
- Firefox 90.0 requires NSS 3.66</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627560000">- update to NSS 3.68
  * bmo#1713562 - Fix test leak.
  * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  * bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  * bmo#1712883 - DTLS 1.3 draft-43.
  * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  * bmo#1713562 - Validate ECH public names.
  * bmo#1717610 - Add function to get seconds from epoch from pkix::Time.
- update to NSS 3.67
  * bmo#1683710 - Add a means to disable ALPN.
  * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.</changelog>
  <changelog author="hpj@suse.com" date="1629288000">- Update nss-fips-constructor-self-tests.patch to fix crashes
  reported by upstream. This was likely affecting WebRTC calls.</changelog>
  <changelog author="cgrobertson@suse.com" date="1630411200">- Removed nss-fips-kdf-self-tests.patch.  This was made
  obsolete by upstream changes. (bmo#1660304)
- Rebase nss-fips-stricter-dh.patch needed due to upstream changes.</changelog>
  <changelog author="hpj@suse.com" date="1635768000">- Update nss-fips-approved-crypto-non-ec.patch to claim 3DES
  unapproved in FIPS mode (bsc#1192080).
- Update nss-fips-constructor-self-tests.patch to allow testing
  of unapproved algorithms (bsc#1192228).
- Add nss-fips-version-indicators.patch (bmo#1729550, bsc#1192086).
  This adds FIPS version indicators.
- Add nss-fips-180-3-csp-clearing.patch (bmo#1697303, bsc#1192087).
  Most of the relevant changes are already upstream since NSS 3.60.</changelog>
  <changelog author="hpj@suse.com" date="1637668800">- Enable NSS_ENABLE_FIPS_INDICATORS and set NSS_FIPS_MODULE_ID
  for build.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
</package>
<package pkgid="cb982210facf4c61edebb958eb7eb2ae645035453ac26c150ed2f14d6b87d97f" name="mozilla-nss-certs" arch="x86_64">
  <version epoch="0" ver="3.79" rel="150000.3.74.1"/>
  <changelog author="wr@rosenauer.org" date="1615896000">- update to NSS 3.62
  * bmo#1688374 - Fix parallel build NSS-3.61 with make
  * bmo#1682044 - pkix_Build_GatherCerts() + pkix_CacheCert_Add()
    can corrupt "cachedCertTable"
  * bmo#1690583 - Fix CH padding extension size calculation
  * bmo#1690421 - Adjust 3.62 ABI report formatting for new libabigail
  * bmo#1690421 - Install packaged libabigail in docker-builds image
  * bmo#1689228 - Minor ECH -09 fixes for interop testing, fuzzing
  * bmo#1674819 - Fixup a51fae403328, enum type may be signed
  * bmo#1681585 - Add ECH support to selfserv
  * bmo#1681585 - Update ECH to Draft-09
  * bmo#1678398 - Add Export/Import functions for HPKE context
  * bmo#1678398 - Update HPKE to draft-07
- required for Firefox 87</changelog>
  <changelog author="wr@rosenauer.org" date="1618747200">- update to NSS 3.63.1
  * no upstream release notes for 3.63.1 (yet)
  Fixed in 3.63
  * bmo#1697380 - Make a clang-format run on top of helpful contributions.
  * bmo#1683520 - ECCKiila P384, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-384: allow zero scalars in dual
    scalar multiplication.
  * bmo#1683520 - ECCKiila P521, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-521: allow zero scalars in dual
    scalar multiplication.
  * bmo#1696800 - HACL* update March 2021 - c95ab70fcb2bc21025d8845281bc4bc8987ca683.
  * bmo#1694214 - tstclnt can't enable middlebox compat mode.
  * bmo#1694392 - NSS does not work with PKCS #11 modules not supporting
    profiles.
  * bmo#1685880 - Minor fix to prevent unused variable on early return.
  * bmo#1685880 - Fix for the gcc compiler version 7 to support setenv
    with nss build.
  * bmo#1693217 - Increase nssckbi.h version number for March 2021 batch
    of root CA changes, CA list version 2.48.
  * bmo#1692094 - Set email distrust after to 21-03-01 for Camerfirma's
    'Chambers of Commerce' and 'Global Chambersign' roots.
  * bmo#1618407 - Symantec root certs - Set CKA_NSS_EMAIL_DISTRUST_AFTER.
  * bmo#1693173 - Add GlobalSign R45, E45, R46, and E46 root certs to NSS.
  * bmo#1683738 - Add AC RAIZ FNMT-RCM SERVIDORES SEGUROS root cert to NSS.
  * bmo#1686854 - Remove GeoTrust PCA-G2 and VeriSign Universal root certs
    from NSS.
  * bmo#1687822 - Turn off Websites trust bit for the ?Staat der
    Nederlanden Root CA - G3? root cert in NSS.
  * bmo#1692094 - Turn off Websites Trust Bit for 'Chambers of Commerce
    Root - 2008' and 'Global Chambersign Root - 2008?.
  * bmo#1694291 - Tracing fixes for ECH.
- required for Firefox 88</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to NSS 3.64
  * bmo#1705286 - Properly detect mips64.
  * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and
    disable_crypto_vsx.
  * bmo#1698320 - replace __builtin_cpu_supports("vsx") with
    ppc_crypto_support() for clang.
  * bmo#1613235 - Add POWER ChaCha20 stream cipher vector
    acceleration.</changelog>
  <changelog author="wr@rosenauer.org" date="1625918400">- update to NSS 3.66
  * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  * bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  * bmo#1707097 - Add Certum Trusted Root CA to NSS.
  * bmo#1707097 - Add Certum EC-384 CA to NSS.
  * bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  * bmo#1709291 - Add VerifyCodeSigningCertificateChain.
  * Use GNU tar for the release helper script.
- update to NSS 3.65
  * bmo#1709654 - Update for NetBSD configuration.
  * bmo#1709750 - Disable HPKE test when fuzzing.
  * bmo#1566124 - Optimize AES-GCM for ppc64le.
  * bmo#1699021 - Add AES-256-GCM to HPKE.
  * bmo#1698419 - ECH -10 updates.
  * bmo#1692930 - Update HPKE to final version.
  * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  * bmo#1703936 - New coverity/cpp scanner errors.
  * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.
- refreshed patches
- Firefox 90.0 requires NSS 3.66</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627560000">- update to NSS 3.68
  * bmo#1713562 - Fix test leak.
  * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  * bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  * bmo#1712883 - DTLS 1.3 draft-43.
  * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  * bmo#1713562 - Validate ECH public names.
  * bmo#1717610 - Add function to get seconds from epoch from pkix::Time.
- update to NSS 3.67
  * bmo#1683710 - Add a means to disable ALPN.
  * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.</changelog>
  <changelog author="hpj@suse.com" date="1629288000">- Update nss-fips-constructor-self-tests.patch to fix crashes
  reported by upstream. This was likely affecting WebRTC calls.</changelog>
  <changelog author="cgrobertson@suse.com" date="1630411200">- Removed nss-fips-kdf-self-tests.patch.  This was made
  obsolete by upstream changes. (bmo#1660304)
- Rebase nss-fips-stricter-dh.patch needed due to upstream changes.</changelog>
  <changelog author="hpj@suse.com" date="1635768000">- Update nss-fips-approved-crypto-non-ec.patch to claim 3DES
  unapproved in FIPS mode (bsc#1192080).
- Update nss-fips-constructor-self-tests.patch to allow testing
  of unapproved algorithms (bsc#1192228).
- Add nss-fips-version-indicators.patch (bmo#1729550, bsc#1192086).
  This adds FIPS version indicators.
- Add nss-fips-180-3-csp-clearing.patch (bmo#1697303, bsc#1192087).
  Most of the relevant changes are already upstream since NSS 3.60.</changelog>
  <changelog author="hpj@suse.com" date="1637668800">- Enable NSS_ENABLE_FIPS_INDICATORS and set NSS_FIPS_MODULE_ID
  for build.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
</package>
<package pkgid="8c8adf5caa99be73242cf28d3c7dcdb62f3b8c1372d580edd50276dd3ae51849" name="mozilla-nss-tools" arch="aarch64">
  <version epoch="0" ver="3.79" rel="150000.3.74.1"/>
  <changelog author="wr@rosenauer.org" date="1615896000">- update to NSS 3.62
  * bmo#1688374 - Fix parallel build NSS-3.61 with make
  * bmo#1682044 - pkix_Build_GatherCerts() + pkix_CacheCert_Add()
    can corrupt "cachedCertTable"
  * bmo#1690583 - Fix CH padding extension size calculation
  * bmo#1690421 - Adjust 3.62 ABI report formatting for new libabigail
  * bmo#1690421 - Install packaged libabigail in docker-builds image
  * bmo#1689228 - Minor ECH -09 fixes for interop testing, fuzzing
  * bmo#1674819 - Fixup a51fae403328, enum type may be signed
  * bmo#1681585 - Add ECH support to selfserv
  * bmo#1681585 - Update ECH to Draft-09
  * bmo#1678398 - Add Export/Import functions for HPKE context
  * bmo#1678398 - Update HPKE to draft-07
- required for Firefox 87</changelog>
  <changelog author="wr@rosenauer.org" date="1618747200">- update to NSS 3.63.1
  * no upstream release notes for 3.63.1 (yet)
  Fixed in 3.63
  * bmo#1697380 - Make a clang-format run on top of helpful contributions.
  * bmo#1683520 - ECCKiila P384, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-384: allow zero scalars in dual
    scalar multiplication.
  * bmo#1683520 - ECCKiila P521, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-521: allow zero scalars in dual
    scalar multiplication.
  * bmo#1696800 - HACL* update March 2021 - c95ab70fcb2bc21025d8845281bc4bc8987ca683.
  * bmo#1694214 - tstclnt can't enable middlebox compat mode.
  * bmo#1694392 - NSS does not work with PKCS #11 modules not supporting
    profiles.
  * bmo#1685880 - Minor fix to prevent unused variable on early return.
  * bmo#1685880 - Fix for the gcc compiler version 7 to support setenv
    with nss build.
  * bmo#1693217 - Increase nssckbi.h version number for March 2021 batch
    of root CA changes, CA list version 2.48.
  * bmo#1692094 - Set email distrust after to 21-03-01 for Camerfirma's
    'Chambers of Commerce' and 'Global Chambersign' roots.
  * bmo#1618407 - Symantec root certs - Set CKA_NSS_EMAIL_DISTRUST_AFTER.
  * bmo#1693173 - Add GlobalSign R45, E45, R46, and E46 root certs to NSS.
  * bmo#1683738 - Add AC RAIZ FNMT-RCM SERVIDORES SEGUROS root cert to NSS.
  * bmo#1686854 - Remove GeoTrust PCA-G2 and VeriSign Universal root certs
    from NSS.
  * bmo#1687822 - Turn off Websites trust bit for the ?Staat der
    Nederlanden Root CA - G3? root cert in NSS.
  * bmo#1692094 - Turn off Websites Trust Bit for 'Chambers of Commerce
    Root - 2008' and 'Global Chambersign Root - 2008?.
  * bmo#1694291 - Tracing fixes for ECH.
- required for Firefox 88</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to NSS 3.64
  * bmo#1705286 - Properly detect mips64.
  * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and
    disable_crypto_vsx.
  * bmo#1698320 - replace __builtin_cpu_supports("vsx") with
    ppc_crypto_support() for clang.
  * bmo#1613235 - Add POWER ChaCha20 stream cipher vector
    acceleration.</changelog>
  <changelog author="wr@rosenauer.org" date="1625918400">- update to NSS 3.66
  * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  * bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  * bmo#1707097 - Add Certum Trusted Root CA to NSS.
  * bmo#1707097 - Add Certum EC-384 CA to NSS.
  * bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  * bmo#1709291 - Add VerifyCodeSigningCertificateChain.
  * Use GNU tar for the release helper script.
- update to NSS 3.65
  * bmo#1709654 - Update for NetBSD configuration.
  * bmo#1709750 - Disable HPKE test when fuzzing.
  * bmo#1566124 - Optimize AES-GCM for ppc64le.
  * bmo#1699021 - Add AES-256-GCM to HPKE.
  * bmo#1698419 - ECH -10 updates.
  * bmo#1692930 - Update HPKE to final version.
  * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  * bmo#1703936 - New coverity/cpp scanner errors.
  * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.
- refreshed patches
- Firefox 90.0 requires NSS 3.66</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627560000">- update to NSS 3.68
  * bmo#1713562 - Fix test leak.
  * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  * bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  * bmo#1712883 - DTLS 1.3 draft-43.
  * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  * bmo#1713562 - Validate ECH public names.
  * bmo#1717610 - Add function to get seconds from epoch from pkix::Time.
- update to NSS 3.67
  * bmo#1683710 - Add a means to disable ALPN.
  * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.</changelog>
  <changelog author="hpj@suse.com" date="1629288000">- Update nss-fips-constructor-self-tests.patch to fix crashes
  reported by upstream. This was likely affecting WebRTC calls.</changelog>
  <changelog author="cgrobertson@suse.com" date="1630411200">- Removed nss-fips-kdf-self-tests.patch.  This was made
  obsolete by upstream changes. (bmo#1660304)
- Rebase nss-fips-stricter-dh.patch needed due to upstream changes.</changelog>
  <changelog author="hpj@suse.com" date="1635768000">- Update nss-fips-approved-crypto-non-ec.patch to claim 3DES
  unapproved in FIPS mode (bsc#1192080).
- Update nss-fips-constructor-self-tests.patch to allow testing
  of unapproved algorithms (bsc#1192228).
- Add nss-fips-version-indicators.patch (bmo#1729550, bsc#1192086).
  This adds FIPS version indicators.
- Add nss-fips-180-3-csp-clearing.patch (bmo#1697303, bsc#1192087).
  Most of the relevant changes are already upstream since NSS 3.60.</changelog>
  <changelog author="hpj@suse.com" date="1637668800">- Enable NSS_ENABLE_FIPS_INDICATORS and set NSS_FIPS_MODULE_ID
  for build.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
</package>
<package pkgid="4a4de4586d905a13df2ec087e3581ec62995d332da5462a77b711920f65a98db" name="mozilla-nss-tools" arch="x86_64">
  <version epoch="0" ver="3.79" rel="150000.3.74.1"/>
  <changelog author="wr@rosenauer.org" date="1615896000">- update to NSS 3.62
  * bmo#1688374 - Fix parallel build NSS-3.61 with make
  * bmo#1682044 - pkix_Build_GatherCerts() + pkix_CacheCert_Add()
    can corrupt "cachedCertTable"
  * bmo#1690583 - Fix CH padding extension size calculation
  * bmo#1690421 - Adjust 3.62 ABI report formatting for new libabigail
  * bmo#1690421 - Install packaged libabigail in docker-builds image
  * bmo#1689228 - Minor ECH -09 fixes for interop testing, fuzzing
  * bmo#1674819 - Fixup a51fae403328, enum type may be signed
  * bmo#1681585 - Add ECH support to selfserv
  * bmo#1681585 - Update ECH to Draft-09
  * bmo#1678398 - Add Export/Import functions for HPKE context
  * bmo#1678398 - Update HPKE to draft-07
- required for Firefox 87</changelog>
  <changelog author="wr@rosenauer.org" date="1618747200">- update to NSS 3.63.1
  * no upstream release notes for 3.63.1 (yet)
  Fixed in 3.63
  * bmo#1697380 - Make a clang-format run on top of helpful contributions.
  * bmo#1683520 - ECCKiila P384, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-384: allow zero scalars in dual
    scalar multiplication.
  * bmo#1683520 - ECCKiila P521, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-521: allow zero scalars in dual
    scalar multiplication.
  * bmo#1696800 - HACL* update March 2021 - c95ab70fcb2bc21025d8845281bc4bc8987ca683.
  * bmo#1694214 - tstclnt can't enable middlebox compat mode.
  * bmo#1694392 - NSS does not work with PKCS #11 modules not supporting
    profiles.
  * bmo#1685880 - Minor fix to prevent unused variable on early return.
  * bmo#1685880 - Fix for the gcc compiler version 7 to support setenv
    with nss build.
  * bmo#1693217 - Increase nssckbi.h version number for March 2021 batch
    of root CA changes, CA list version 2.48.
  * bmo#1692094 - Set email distrust after to 21-03-01 for Camerfirma's
    'Chambers of Commerce' and 'Global Chambersign' roots.
  * bmo#1618407 - Symantec root certs - Set CKA_NSS_EMAIL_DISTRUST_AFTER.
  * bmo#1693173 - Add GlobalSign R45, E45, R46, and E46 root certs to NSS.
  * bmo#1683738 - Add AC RAIZ FNMT-RCM SERVIDORES SEGUROS root cert to NSS.
  * bmo#1686854 - Remove GeoTrust PCA-G2 and VeriSign Universal root certs
    from NSS.
  * bmo#1687822 - Turn off Websites trust bit for the ?Staat der
    Nederlanden Root CA - G3? root cert in NSS.
  * bmo#1692094 - Turn off Websites Trust Bit for 'Chambers of Commerce
    Root - 2008' and 'Global Chambersign Root - 2008?.
  * bmo#1694291 - Tracing fixes for ECH.
- required for Firefox 88</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to NSS 3.64
  * bmo#1705286 - Properly detect mips64.
  * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and
    disable_crypto_vsx.
  * bmo#1698320 - replace __builtin_cpu_supports("vsx") with
    ppc_crypto_support() for clang.
  * bmo#1613235 - Add POWER ChaCha20 stream cipher vector
    acceleration.</changelog>
  <changelog author="wr@rosenauer.org" date="1625918400">- update to NSS 3.66
  * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  * bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  * bmo#1707097 - Add Certum Trusted Root CA to NSS.
  * bmo#1707097 - Add Certum EC-384 CA to NSS.
  * bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  * bmo#1709291 - Add VerifyCodeSigningCertificateChain.
  * Use GNU tar for the release helper script.
- update to NSS 3.65
  * bmo#1709654 - Update for NetBSD configuration.
  * bmo#1709750 - Disable HPKE test when fuzzing.
  * bmo#1566124 - Optimize AES-GCM for ppc64le.
  * bmo#1699021 - Add AES-256-GCM to HPKE.
  * bmo#1698419 - ECH -10 updates.
  * bmo#1692930 - Update HPKE to final version.
  * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  * bmo#1703936 - New coverity/cpp scanner errors.
  * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.
- refreshed patches
- Firefox 90.0 requires NSS 3.66</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627560000">- update to NSS 3.68
  * bmo#1713562 - Fix test leak.
  * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  * bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  * bmo#1712883 - DTLS 1.3 draft-43.
  * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  * bmo#1713562 - Validate ECH public names.
  * bmo#1717610 - Add function to get seconds from epoch from pkix::Time.
- update to NSS 3.67
  * bmo#1683710 - Add a means to disable ALPN.
  * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.</changelog>
  <changelog author="hpj@suse.com" date="1629288000">- Update nss-fips-constructor-self-tests.patch to fix crashes
  reported by upstream. This was likely affecting WebRTC calls.</changelog>
  <changelog author="cgrobertson@suse.com" date="1630411200">- Removed nss-fips-kdf-self-tests.patch.  This was made
  obsolete by upstream changes. (bmo#1660304)
- Rebase nss-fips-stricter-dh.patch needed due to upstream changes.</changelog>
  <changelog author="hpj@suse.com" date="1635768000">- Update nss-fips-approved-crypto-non-ec.patch to claim 3DES
  unapproved in FIPS mode (bsc#1192080).
- Update nss-fips-constructor-self-tests.patch to allow testing
  of unapproved algorithms (bsc#1192228).
- Add nss-fips-version-indicators.patch (bmo#1729550, bsc#1192086).
  This adds FIPS version indicators.
- Add nss-fips-180-3-csp-clearing.patch (bmo#1697303, bsc#1192087).
  Most of the relevant changes are already upstream since NSS 3.60.</changelog>
  <changelog author="hpj@suse.com" date="1637668800">- Enable NSS_ENABLE_FIPS_INDICATORS and set NSS_FIPS_MODULE_ID
  for build.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
</package>
<package pkgid="29eca6ae263f8e5060be86cf398d0ffc814f620b3b6ede7d63b15badf67756d3" name="openssl-1_1" arch="aarch64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.48.1"/>
  <changelog author="pmonreal@suse.com" date="1598529600">- Include ECDH/DH Requirements from SP800-56Arev3 [bsc#1175844, bsc#1173470]
- Add patches:
  * openssl-DH.patch
  * openssl-kdf-selftest.patch
  * openssl-kdf-tls-selftest.patch
  * openssl-kdf-ssh-selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1599566400">- Add shared secret KAT to FIPS DH selftest [bsc#1175844]
  * add openssl-fips-DH_selftest_shared_secret_KAT.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1602158400">- Restore private key check in EC_KEY_check_key [bsc#1177479]
  * Update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614686400">- Fix unresolved error codes [bsc#1182959]
- Update openssl-1.1.1-fips.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
</package>
<package pkgid="e89a1da40fc819436132b80b1fcfbc5663c97318cf7e3b55fbbaaff15aa060d3" name="openssl-1_1" arch="src">
  <version epoch="0" ver="1.1.1d" rel="150200.11.48.1"/>
  <changelog author="pmonreal@suse.com" date="1598529600">- Include ECDH/DH Requirements from SP800-56Arev3 [bsc#1175844, bsc#1173470]
- Add patches:
  * openssl-DH.patch
  * openssl-kdf-selftest.patch
  * openssl-kdf-tls-selftest.patch
  * openssl-kdf-ssh-selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1599566400">- Add shared secret KAT to FIPS DH selftest [bsc#1175844]
  * add openssl-fips-DH_selftest_shared_secret_KAT.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1602158400">- Restore private key check in EC_KEY_check_key [bsc#1177479]
  * Update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614686400">- Fix unresolved error codes [bsc#1182959]
- Update openssl-1.1.1-fips.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
</package>
<package pkgid="b87d7dd07eec18650acadff4310091058fd3a7f2399d446b1a0db17f4242d250" name="openssl-1_1" arch="x86_64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.48.1"/>
  <changelog author="pmonreal@suse.com" date="1598529600">- Include ECDH/DH Requirements from SP800-56Arev3 [bsc#1175844, bsc#1173470]
- Add patches:
  * openssl-DH.patch
  * openssl-kdf-selftest.patch
  * openssl-kdf-tls-selftest.patch
  * openssl-kdf-ssh-selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1599566400">- Add shared secret KAT to FIPS DH selftest [bsc#1175844]
  * add openssl-fips-DH_selftest_shared_secret_KAT.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1602158400">- Restore private key check in EC_KEY_check_key [bsc#1177479]
  * Update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614686400">- Fix unresolved error codes [bsc#1182959]
- Update openssl-1.1.1-fips.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
</package>
<package pkgid="c4c4ec3028d1d4d7a8668cfe7fe2702f826b6207d2313518f8ae77ebc528e684" name="openssl-1_1" arch="aarch64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.51.1"/>
  <changelog author="vcizek@suse.com" date="1599566400">- Add shared secret KAT to FIPS DH selftest [bsc#1175844]
  * add openssl-fips-DH_selftest_shared_secret_KAT.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1602158400">- Restore private key check in EC_KEY_check_key [bsc#1177479]
  * Update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614686400">- Fix unresolved error codes [bsc#1182959]
- Update openssl-1.1.1-fips.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
</package>
<package pkgid="1b2509089fb3c38f8fb67ffd1fd6aff52c4f94c75b97828b33ce585281c53bd5" name="openssl-1_1" arch="src">
  <version epoch="0" ver="1.1.1d" rel="150200.11.51.1"/>
  <changelog author="vcizek@suse.com" date="1599566400">- Add shared secret KAT to FIPS DH selftest [bsc#1175844]
  * add openssl-fips-DH_selftest_shared_secret_KAT.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1602158400">- Restore private key check in EC_KEY_check_key [bsc#1177479]
  * Update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614686400">- Fix unresolved error codes [bsc#1182959]
- Update openssl-1.1.1-fips.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
</package>
<package pkgid="cf7450bf869f993d3e217aa23d235e7879798a6f16121ef7c5c85eba38193681" name="openssl-1_1" arch="x86_64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.51.1"/>
  <changelog author="vcizek@suse.com" date="1599566400">- Add shared secret KAT to FIPS DH selftest [bsc#1175844]
  * add openssl-fips-DH_selftest_shared_secret_KAT.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1602158400">- Restore private key check in EC_KEY_check_key [bsc#1177479]
  * Update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614686400">- Fix unresolved error codes [bsc#1182959]
- Update openssl-1.1.1-fips.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
</package>
<package pkgid="ee954d1f07ddea4e6ea469f6b1a7b140e66de0463e4e5f91aaafa2d009eb2c26" name="p11-kit" arch="aarch64">
  <version epoch="0" ver="0.23.2" rel="150000.4.16.1"/>
  <changelog author="lnussel@suse.de" date="1413201600">- remove patches:
  * trust-Print-label-of-certificate-when-complaining-.patch
  * trust-Dont-use-invalid-public-keys-for-looking-up-.patch
- new version 0.20.7 (stable)
  * New public pkcs11x.h header containing extensions [fdo#83495]
  * Export necessary defines to lookup attached extensions [fdo#83495]
  * Build fixes
- new version 0.20.6 (stable)
  * Make the p11-kit-proxy.so module respect critical = no [fdo#83651]
  * Build fix for FreeBSD [fdo#75674]
- new version 0.20.5 (stable)
  * Don't use invalid keys for looking up stapled extensions [fdo#82328]
  * Better error messages when invalid certificate extensions
  * Fix parsing of some odd OpenSSL TRUSTED CERTIFICATE files
  * Fix some leaks, and memory issues
  * Silence some clang scanner warnings
- new version 0.20.4 (stable)
  * Don't complain about C_Finalize after a fork
  * Fix typo</changelog>
  <changelog author="p.drouand@gmail.com" date="1425816000">- Update to version 0.23.1 (stable)
  * Use new PKCS#11 URI draft fields for URIs [fdo#86474 fdo#87582]
  * Add pem-directory-hash extract format
  * Build fixes
- Remove 0001-trust-allow-to-also-add-openssl-style-hashes-to-pem-d.diff;
  fixed on upstream release
- Remove autoconf, automake and libtool require; unneeded dependencies
- Add gtk-doc require; needed to build html documentation
- Remove redundant %clean section</changelog>
  <changelog author="mpluskal@suse.com" date="1454932800">- Update to 0.23.2
  * Fix forking issues with libffi
  * Fix various crashes in corner cases
  * Updated translations
  * Build fixes
- Make building more verbose
- Enable tests
- Small spec file cleanup with spec-cleaner</changelog>
  <changelog author="sbrabec@suse.com" date="1479816000">- 32-bit compatibility fixes:
  * Add PKCS11 module to p11-kit-32bit (bsc#996047#c39)
  * Add p11-kit-nss-trust-32bit NSS module
  * Fix potential bi-arch issue with private binaries
    (fdo#98817, p11-kit-biarch.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1521547200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="lnussel@suse.de" date="1573819200">- support loading NSS attribute CKA_NSS_MOZILLA_CA_POLICY so Firefox
  detects built in certificates (boo#1154871,
  0001-Fix-a-typo-in-x-cetrificate-value-see-also-https-bug.patch,
  0001-Support-loading-new-NSS-attribute-CKA_NSS_MOZILLA_CA.patch)</changelog>
  <changelog author="lnussel@suse.de" date="1577102400">- Also build documentation (boo#1013125)</changelog>
  <changelog author="lnussel@suse.de" date="1626782400">- Add support for CKA_NSS_{SERVER,EMAIL}_DISTRUST_AFTER (bsc#1187993,
  0001-trust-Support-CKA_NSS_-SERVER-EMAIL-_DISTRUST_AFTER.patch)
- add bcond to spec file to enable debug easily</changelog>
  <changelog author="meissner@suse.com" date="1638878400">- 0001-common-Use-reallocarray-instead-of-realloc-as-approp.patch
  0001-Check-for-arithmetic-overflows-before-allocating.patch
  0001-Follow-up-to-arithmetic-overflow-fix.patch:
  Fixed multiple integer overflows in rpc code (bsc#1180064
  CVE-2020-29361)</changelog>
  <changelog author="meissner@suse.com" date="1657800000">- CVE-2020-29362: Fixed a 4 byte overread (bsc#1180065)
  Added p11-kit-CVE-2020-29362.patch:</changelog>
</package>
<package pkgid="28823a7518082e5c83349bfd9345fc0b99a238804d25cf0c9dac4250f032ffa5" name="p11-kit" arch="src">
  <version epoch="0" ver="0.23.2" rel="150000.4.16.1"/>
  <changelog author="lnussel@suse.de" date="1372075200">- add p11-kit-nss-trust subpackage that serves as drop-in
  replacement for mozilla-nss-certs</changelog>
  <changelog author="lnussel@suse.de" date="1372420800">- provide libnssckbi.so to replace mozilla-nss-certs</changelog>
  <changelog author="lnussel@suse.de" date="1373025600">- fix 32bit provides of libnssckbi.so
- repace p11-kit-extract-trust with update-ca-certificates</changelog>
  <changelog author="lnussel@suse.de" date="1374753600">- new version 0.19.3
  * Fix up problems with automake testing
  * Fix a bunch of memory leaks in newly refactored code
  * Don't use _GNU_SOURCE and the unportability it brings
  * Add basic 'trust anchor' command to store a new anchor
  * Support for writing out trust token objects
  * Port to use CKA_PUBLIC_KEY_INFO and updated trust store spec
  * Add option to use freebl for hashing
  * Implement reloading of token data
  * Fix warnings and possible minor bugs higlighted by code scanners
  * Don't load configs in home directories when running setuid or setgid
  * Support treating ~/.config as $XDG_CONFIG_HOME
  * Use $XDG_DATA_HOME/pkcs11 as default user config directory
  * Use $TMPDIR instead of $TEMP while testing
  * Open files and fds with O_CLOEXEC
  * Abort initialization if a critical module fails to load
  * Don't use thread-unsafe functions: strerror, getpwuid
  * Fix p11_kit_space_strlen() result when empty string
  * Refactoring of where various components live</changelog>
  <changelog author="lnussel@suse.de" date="1377864000">- new version 0.19.4
  * 'trust anchor' now adds/removes certificate anchors
  * 'trust list' lists trust policy stuff
  * 'p11-kit extract' is now 'trust extract'
  * 'p11-kit extract-trust' is now 'trust extract-compat'
  * Workarounds for working on broken zfsonlinux.org [#68525]
  * Add --with-module-config parameter to the configure script [#68122]
  * Add support for removing stored PKCS#11 objects in trust module</changelog>
  <changelog author="lnussel@suse.de" date="1378814400">- upgrade to 0.20.1 which is 0.19 declared stable
  * Extract compat trust data after we've changes
  * Skip compat extraction if running as non-root
  * Better failure messages when removing anchors</changelog>
  <changelog author="lnussel@suse.de" date="1386331200">- trust: allow to also add openssl style hashes to pem-directory
  0001-trust-allow-to-also-add-openssl-style-hashes-to-pem-d.diff</changelog>
  <changelog author="meissner@suse.com" date="1392120000">- added .sig file. trying to locate source of the keyring.</changelog>
  <changelog author="lnussel@suse.de" date="1400500800">- New version 0.20.2
  * Fix bug where blacklist didn't affect extracted ca-anchors if the anchor
    and blacklist were not in the same trust path (regression) [fdo#73558]
  * Check for race in BasicConstraints stapled extension [fdo#69314]
  * Build fixes and cleanup</changelog>
  <changelog author="lnussel@suse.de" date="1409313600">- new version 0.20.3
  * Fix problems reinitializing managed modules after fork
  * Fix bad bookeeping when fail initializing one of the modules
  * Fix case where module would be unloaded while in use [#74919]
  * Remove assertions when module used before initialized [#74919]
  * Fix handling of mmap failure and mapping empty files [#74773]
  * Stable p11_kit_be_quiet() and p11_kit_be_loud() functions
  * Require automake 1.12 or later
  * Build fixes for Windows [#76594 #74149]
- apply patches to avoid errors from certificates with invalid public key
  (fdo#82328, bnc#890908,
  trust-Dont-use-invalid-public-keys-for-looking-up-.patch,
  trust-Print-label-of-certificate-when-complaining-.patch)</changelog>
  <changelog author="lnussel@suse.de" date="1413201600">- remove patches:
  * trust-Print-label-of-certificate-when-complaining-.patch
  * trust-Dont-use-invalid-public-keys-for-looking-up-.patch
- new version 0.20.7 (stable)
  * New public pkcs11x.h header containing extensions [fdo#83495]
  * Export necessary defines to lookup attached extensions [fdo#83495]
  * Build fixes
- new version 0.20.6 (stable)
  * Make the p11-kit-proxy.so module respect critical = no [fdo#83651]
  * Build fix for FreeBSD [fdo#75674]
- new version 0.20.5 (stable)
  * Don't use invalid keys for looking up stapled extensions [fdo#82328]
  * Better error messages when invalid certificate extensions
  * Fix parsing of some odd OpenSSL TRUSTED CERTIFICATE files
  * Fix some leaks, and memory issues
  * Silence some clang scanner warnings
- new version 0.20.4 (stable)
  * Don't complain about C_Finalize after a fork
  * Fix typo</changelog>
  <changelog author="p.drouand@gmail.com" date="1425816000">- Update to version 0.23.1 (stable)
  * Use new PKCS#11 URI draft fields for URIs [fdo#86474 fdo#87582]
  * Add pem-directory-hash extract format
  * Build fixes
- Remove 0001-trust-allow-to-also-add-openssl-style-hashes-to-pem-d.diff;
  fixed on upstream release
- Remove autoconf, automake and libtool require; unneeded dependencies
- Add gtk-doc require; needed to build html documentation
- Remove redundant %clean section</changelog>
  <changelog author="mpluskal@suse.com" date="1454932800">- Update to 0.23.2
  * Fix forking issues with libffi
  * Fix various crashes in corner cases
  * Updated translations
  * Build fixes
- Make building more verbose
- Enable tests
- Small spec file cleanup with spec-cleaner</changelog>
  <changelog author="sbrabec@suse.com" date="1479816000">- 32-bit compatibility fixes:
  * Add PKCS11 module to p11-kit-32bit (bsc#996047#c39)
  * Add p11-kit-nss-trust-32bit NSS module
  * Fix potential bi-arch issue with private binaries
    (fdo#98817, p11-kit-biarch.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1521547200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="lnussel@suse.de" date="1573819200">- support loading NSS attribute CKA_NSS_MOZILLA_CA_POLICY so Firefox
  detects built in certificates (boo#1154871,
  0001-Fix-a-typo-in-x-cetrificate-value-see-also-https-bug.patch,
  0001-Support-loading-new-NSS-attribute-CKA_NSS_MOZILLA_CA.patch)</changelog>
  <changelog author="lnussel@suse.de" date="1577102400">- Also build documentation (boo#1013125)</changelog>
  <changelog author="lnussel@suse.de" date="1626782400">- Add support for CKA_NSS_{SERVER,EMAIL}_DISTRUST_AFTER (bsc#1187993,
  0001-trust-Support-CKA_NSS_-SERVER-EMAIL-_DISTRUST_AFTER.patch)
- add bcond to spec file to enable debug easily</changelog>
  <changelog author="meissner@suse.com" date="1638878400">- 0001-common-Use-reallocarray-instead-of-realloc-as-approp.patch
  0001-Check-for-arithmetic-overflows-before-allocating.patch
  0001-Follow-up-to-arithmetic-overflow-fix.patch:
  Fixed multiple integer overflows in rpc code (bsc#1180064
  CVE-2020-29361)</changelog>
  <changelog author="meissner@suse.com" date="1657800000">- CVE-2020-29362: Fixed a 4 byte overread (bsc#1180065)
  Added p11-kit-CVE-2020-29362.patch:</changelog>
</package>
<package pkgid="e62d5dbb1c7490438ccc9942543ea4e5940594dcf858c650b3877b7b417a695d" name="p11-kit" arch="x86_64">
  <version epoch="0" ver="0.23.2" rel="150000.4.16.1"/>
  <changelog author="lnussel@suse.de" date="1413201600">- remove patches:
  * trust-Print-label-of-certificate-when-complaining-.patch
  * trust-Dont-use-invalid-public-keys-for-looking-up-.patch
- new version 0.20.7 (stable)
  * New public pkcs11x.h header containing extensions [fdo#83495]
  * Export necessary defines to lookup attached extensions [fdo#83495]
  * Build fixes
- new version 0.20.6 (stable)
  * Make the p11-kit-proxy.so module respect critical = no [fdo#83651]
  * Build fix for FreeBSD [fdo#75674]
- new version 0.20.5 (stable)
  * Don't use invalid keys for looking up stapled extensions [fdo#82328]
  * Better error messages when invalid certificate extensions
  * Fix parsing of some odd OpenSSL TRUSTED CERTIFICATE files
  * Fix some leaks, and memory issues
  * Silence some clang scanner warnings
- new version 0.20.4 (stable)
  * Don't complain about C_Finalize after a fork
  * Fix typo</changelog>
  <changelog author="p.drouand@gmail.com" date="1425816000">- Update to version 0.23.1 (stable)
  * Use new PKCS#11 URI draft fields for URIs [fdo#86474 fdo#87582]
  * Add pem-directory-hash extract format
  * Build fixes
- Remove 0001-trust-allow-to-also-add-openssl-style-hashes-to-pem-d.diff;
  fixed on upstream release
- Remove autoconf, automake and libtool require; unneeded dependencies
- Add gtk-doc require; needed to build html documentation
- Remove redundant %clean section</changelog>
  <changelog author="mpluskal@suse.com" date="1454932800">- Update to 0.23.2
  * Fix forking issues with libffi
  * Fix various crashes in corner cases
  * Updated translations
  * Build fixes
- Make building more verbose
- Enable tests
- Small spec file cleanup with spec-cleaner</changelog>
  <changelog author="sbrabec@suse.com" date="1479816000">- 32-bit compatibility fixes:
  * Add PKCS11 module to p11-kit-32bit (bsc#996047#c39)
  * Add p11-kit-nss-trust-32bit NSS module
  * Fix potential bi-arch issue with private binaries
    (fdo#98817, p11-kit-biarch.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1521547200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="lnussel@suse.de" date="1573819200">- support loading NSS attribute CKA_NSS_MOZILLA_CA_POLICY so Firefox
  detects built in certificates (boo#1154871,
  0001-Fix-a-typo-in-x-cetrificate-value-see-also-https-bug.patch,
  0001-Support-loading-new-NSS-attribute-CKA_NSS_MOZILLA_CA.patch)</changelog>
  <changelog author="lnussel@suse.de" date="1577102400">- Also build documentation (boo#1013125)</changelog>
  <changelog author="lnussel@suse.de" date="1626782400">- Add support for CKA_NSS_{SERVER,EMAIL}_DISTRUST_AFTER (bsc#1187993,
  0001-trust-Support-CKA_NSS_-SERVER-EMAIL-_DISTRUST_AFTER.patch)
- add bcond to spec file to enable debug easily</changelog>
  <changelog author="meissner@suse.com" date="1638878400">- 0001-common-Use-reallocarray-instead-of-realloc-as-approp.patch
  0001-Check-for-arithmetic-overflows-before-allocating.patch
  0001-Follow-up-to-arithmetic-overflow-fix.patch:
  Fixed multiple integer overflows in rpc code (bsc#1180064
  CVE-2020-29361)</changelog>
  <changelog author="meissner@suse.com" date="1657800000">- CVE-2020-29362: Fixed a 4 byte overread (bsc#1180065)
  Added p11-kit-CVE-2020-29362.patch:</changelog>
</package>
<package pkgid="6175ce11481ead85ef4dbd5a092cb40b6fe522f54eee2d880008acc33e9c01f5" name="p11-kit-tools" arch="aarch64">
  <version epoch="0" ver="0.23.2" rel="150000.4.16.1"/>
  <changelog author="lnussel@suse.de" date="1413201600">- remove patches:
  * trust-Print-label-of-certificate-when-complaining-.patch
  * trust-Dont-use-invalid-public-keys-for-looking-up-.patch
- new version 0.20.7 (stable)
  * New public pkcs11x.h header containing extensions [fdo#83495]
  * Export necessary defines to lookup attached extensions [fdo#83495]
  * Build fixes
- new version 0.20.6 (stable)
  * Make the p11-kit-proxy.so module respect critical = no [fdo#83651]
  * Build fix for FreeBSD [fdo#75674]
- new version 0.20.5 (stable)
  * Don't use invalid keys for looking up stapled extensions [fdo#82328]
  * Better error messages when invalid certificate extensions
  * Fix parsing of some odd OpenSSL TRUSTED CERTIFICATE files
  * Fix some leaks, and memory issues
  * Silence some clang scanner warnings
- new version 0.20.4 (stable)
  * Don't complain about C_Finalize after a fork
  * Fix typo</changelog>
  <changelog author="p.drouand@gmail.com" date="1425816000">- Update to version 0.23.1 (stable)
  * Use new PKCS#11 URI draft fields for URIs [fdo#86474 fdo#87582]
  * Add pem-directory-hash extract format
  * Build fixes
- Remove 0001-trust-allow-to-also-add-openssl-style-hashes-to-pem-d.diff;
  fixed on upstream release
- Remove autoconf, automake and libtool require; unneeded dependencies
- Add gtk-doc require; needed to build html documentation
- Remove redundant %clean section</changelog>
  <changelog author="mpluskal@suse.com" date="1454932800">- Update to 0.23.2
  * Fix forking issues with libffi
  * Fix various crashes in corner cases
  * Updated translations
  * Build fixes
- Make building more verbose
- Enable tests
- Small spec file cleanup with spec-cleaner</changelog>
  <changelog author="sbrabec@suse.com" date="1479816000">- 32-bit compatibility fixes:
  * Add PKCS11 module to p11-kit-32bit (bsc#996047#c39)
  * Add p11-kit-nss-trust-32bit NSS module
  * Fix potential bi-arch issue with private binaries
    (fdo#98817, p11-kit-biarch.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1521547200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="lnussel@suse.de" date="1573819200">- support loading NSS attribute CKA_NSS_MOZILLA_CA_POLICY so Firefox
  detects built in certificates (boo#1154871,
  0001-Fix-a-typo-in-x-cetrificate-value-see-also-https-bug.patch,
  0001-Support-loading-new-NSS-attribute-CKA_NSS_MOZILLA_CA.patch)</changelog>
  <changelog author="lnussel@suse.de" date="1577102400">- Also build documentation (boo#1013125)</changelog>
  <changelog author="lnussel@suse.de" date="1626782400">- Add support for CKA_NSS_{SERVER,EMAIL}_DISTRUST_AFTER (bsc#1187993,
  0001-trust-Support-CKA_NSS_-SERVER-EMAIL-_DISTRUST_AFTER.patch)
- add bcond to spec file to enable debug easily</changelog>
  <changelog author="meissner@suse.com" date="1638878400">- 0001-common-Use-reallocarray-instead-of-realloc-as-approp.patch
  0001-Check-for-arithmetic-overflows-before-allocating.patch
  0001-Follow-up-to-arithmetic-overflow-fix.patch:
  Fixed multiple integer overflows in rpc code (bsc#1180064
  CVE-2020-29361)</changelog>
  <changelog author="meissner@suse.com" date="1657800000">- CVE-2020-29362: Fixed a 4 byte overread (bsc#1180065)
  Added p11-kit-CVE-2020-29362.patch:</changelog>
</package>
<package pkgid="2b034162b11f74152460c39653fba29e318ba0a62d62d9915fb5646602525d77" name="p11-kit-tools" arch="x86_64">
  <version epoch="0" ver="0.23.2" rel="150000.4.16.1"/>
  <changelog author="lnussel@suse.de" date="1413201600">- remove patches:
  * trust-Print-label-of-certificate-when-complaining-.patch
  * trust-Dont-use-invalid-public-keys-for-looking-up-.patch
- new version 0.20.7 (stable)
  * New public pkcs11x.h header containing extensions [fdo#83495]
  * Export necessary defines to lookup attached extensions [fdo#83495]
  * Build fixes
- new version 0.20.6 (stable)
  * Make the p11-kit-proxy.so module respect critical = no [fdo#83651]
  * Build fix for FreeBSD [fdo#75674]
- new version 0.20.5 (stable)
  * Don't use invalid keys for looking up stapled extensions [fdo#82328]
  * Better error messages when invalid certificate extensions
  * Fix parsing of some odd OpenSSL TRUSTED CERTIFICATE files
  * Fix some leaks, and memory issues
  * Silence some clang scanner warnings
- new version 0.20.4 (stable)
  * Don't complain about C_Finalize after a fork
  * Fix typo</changelog>
  <changelog author="p.drouand@gmail.com" date="1425816000">- Update to version 0.23.1 (stable)
  * Use new PKCS#11 URI draft fields for URIs [fdo#86474 fdo#87582]
  * Add pem-directory-hash extract format
  * Build fixes
- Remove 0001-trust-allow-to-also-add-openssl-style-hashes-to-pem-d.diff;
  fixed on upstream release
- Remove autoconf, automake and libtool require; unneeded dependencies
- Add gtk-doc require; needed to build html documentation
- Remove redundant %clean section</changelog>
  <changelog author="mpluskal@suse.com" date="1454932800">- Update to 0.23.2
  * Fix forking issues with libffi
  * Fix various crashes in corner cases
  * Updated translations
  * Build fixes
- Make building more verbose
- Enable tests
- Small spec file cleanup with spec-cleaner</changelog>
  <changelog author="sbrabec@suse.com" date="1479816000">- 32-bit compatibility fixes:
  * Add PKCS11 module to p11-kit-32bit (bsc#996047#c39)
  * Add p11-kit-nss-trust-32bit NSS module
  * Fix potential bi-arch issue with private binaries
    (fdo#98817, p11-kit-biarch.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1521547200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="lnussel@suse.de" date="1573819200">- support loading NSS attribute CKA_NSS_MOZILLA_CA_POLICY so Firefox
  detects built in certificates (boo#1154871,
  0001-Fix-a-typo-in-x-cetrificate-value-see-also-https-bug.patch,
  0001-Support-loading-new-NSS-attribute-CKA_NSS_MOZILLA_CA.patch)</changelog>
  <changelog author="lnussel@suse.de" date="1577102400">- Also build documentation (boo#1013125)</changelog>
  <changelog author="lnussel@suse.de" date="1626782400">- Add support for CKA_NSS_{SERVER,EMAIL}_DISTRUST_AFTER (bsc#1187993,
  0001-trust-Support-CKA_NSS_-SERVER-EMAIL-_DISTRUST_AFTER.patch)
- add bcond to spec file to enable debug easily</changelog>
  <changelog author="meissner@suse.com" date="1638878400">- 0001-common-Use-reallocarray-instead-of-realloc-as-approp.patch
  0001-Check-for-arithmetic-overflows-before-allocating.patch
  0001-Follow-up-to-arithmetic-overflow-fix.patch:
  Fixed multiple integer overflows in rpc code (bsc#1180064
  CVE-2020-29361)</changelog>
  <changelog author="meissner@suse.com" date="1657800000">- CVE-2020-29362: Fixed a 4 byte overread (bsc#1180065)
  Added p11-kit-CVE-2020-29362.patch:</changelog>
</package>
<package pkgid="8311ba4ced18a192adef06819518f7df4578621991c567c9bc983cdfbd6adc71" name="pam_apparmor" arch="aarch64">
  <version epoch="0" ver="2.13.6" rel="150300.3.15.1"/>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
  <changelog author="nopower@suse.com" date="1641384000">- add add-samba-bgqd.diff: add profile for samba-bgqd;
  (bsc#1191532).</changelog>
  <changelog author="nopower@suse.com" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb;
  (bsc#1192684).</changelog>
  <changelog author="nopower@suse.com" date="1648555200">- update add-samba-bgqd.diff:  to add new rule to fix 'DENIED' open on
  /proc/{pid}/fd for samba-bgqd (bnc#1196850).
- Add update-usr-sbin-smbd.diff to add new rule to allow reading of
  openssl.cnf (bnc#1195463).</changelog>
</package>
<package pkgid="5f2d52d1450ea8e000ebb321a6cbfedce6d71caf459f99e08f5f907692326a94" name="pam_apparmor" arch="x86_64">
  <version epoch="0" ver="2.13.6" rel="150300.3.15.1"/>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
  <changelog author="nopower@suse.com" date="1641384000">- add add-samba-bgqd.diff: add profile for samba-bgqd;
  (bsc#1191532).</changelog>
  <changelog author="nopower@suse.com" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb;
  (bsc#1192684).</changelog>
  <changelog author="nopower@suse.com" date="1648555200">- update add-samba-bgqd.diff:  to add new rule to fix 'DENIED' open on
  /proc/{pid}/fd for samba-bgqd (bnc#1196850).
- Add update-usr-sbin-smbd.diff to add new rule to allow reading of
  openssl.cnf (bnc#1195463).</changelog>
</package>
<package pkgid="028a4eb3ebb83dcf6a9b9effe9a7c27ed35fd4a2ba1ee4b53dbde33932c00c73" name="pcre" arch="src">
  <version epoch="0" ver="8.45" rel="150000.20.13.1"/>
  <changelog author="tchvatal@suse.com" date="1395576000">- Add automake and autoconf as explicit deps as we run autoreconf</changelog>
  <changelog author="coolo@suse.com" date="1399118400">- update to 0.35:
  There have been performance improvements for classes containing non-ASCII
  characters and the "auto-possessification" feature has been extended. Other
  minor improvements have been implemented and bugs fixed. There is a new callout
  feature to enable applications to do detailed stack checks at compile time, to
  avoid running out of stack for deeply nested parentheses. The JIT compiler has
  been extended with experimental support for ARM-64, MIPS-64, and PPC-LE.
- add pcre-commit1472.patch from SVN to work with gcc49, see
  http://bugs.exim.org/show_bug.cgi?id=1463</changelog>
  <changelog author="dvaleev@suse.com" date="1402920000">- Enable JIT on ppc64le as well</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1409227200">- Harden build with full RELRO as this libraries end linked
  to at least one setuid root executable.</changelog>
  <changelog author="jengelh@inai.de" date="1409659200">- Improve on RPM group classification
- Remove defunct %gpg_verify (replaced by source validators),
  defunct freecode link</changelog>
  <changelog author="p.drouand@gmail.com" date="1425902400">- Update to version 3.16
  * This is primarily a bug-fix release.
  * The Unicode data tables have been updated to Unicode 7.0.0.
- Remove pcre-commit1472.patch; fixed on upstream release
- Remove obsolete "Obsoletes" tag</changelog>
  <changelog author="astieger@suse.com" date="1430395200">- pcre 8.37:
  * CVE-2015-2325: Patterns with certain groups specifying a zero
    minimum quantifier caused incorrect code to be compiled,
    leading to an incorrect memory read. [boo#924960]
  * CVE-2015-2326: Specific patterns containing a forward reference
    with subroutine calls caused incorrect code to be compiled
    [boo#924961]
  * CVE-2014-8964: If an assertion condition was quantified with a
    minimum of zero, SIGSEGV or other misbehaviour could occur.
    [boo#906574]
  * further bug fixes as listed in ChangeLog</changelog>
  <changelog author="astieger@suse.com" date="1448539200">- pcre 8.38:
  * CVE-2015-3217: Call Stack Overflow Vulnerability in match()
    bsc#933878
  * Other fixes to assertions, crashes, buffer overflows and
    performance issues found by fuzzer, affecting applications
    accepting regular expression from untrusted sources</changelog>
  <changelog author="mpluskal@suse.com" date="1465992000">- Update to version 8.39:
  * Some appropriate PCRE2 JIT improvements have been retro-fitted
    to PCRE1.
  * CVE-2016-3191: workspace overflow for (*ACCEPT) with deeply
    nested parentheses (boo#971741)
  * CVE-2016-1283: Heap buffer overflow DoS (boo#960837)
  * Apart from that, this is another bug-fix release.</changelog>
  <changelog author="astieger@suse.com" date="1470052800">- record minor vulnerabilities fixed in 8.39</changelog>
  <changelog author="dimstar@opensuse.org" date="1486468800">- Explicitly package %{_docdir}/%{name} to fix build with RPM 4.13.</changelog>
  <changelog author="astieger@suse.com" date="1486641600">- pcre 8.40:
  * Using -o with -M in pcregrep could cause unnecessary repeated
    output when the match extended over a line boundary.
  * Fix register overwite in JIT when SSE2 acceleration is enabled.
  * Ignore "show all captures" (/=) for DFA matching.
  * Fix JIT unaligned accesses on x86
  * In any wide-character mode (8-bit UTF or any 16-bit or 32-bit
    mode), without PCRE_UCP set, a negative character type such as
    \D in a positive class should cause all characters greater than
    255 to match, whatever else is in the class. There was a bug
    that caused this not to happen if a Unicode property item was
    added to such a class, for example [\D\P{Nd}] or [\W\pL].
  * When pcretest was outputing information from a callout, the
    caret indicator for the current position in the subject line
    was incorrect if it was after an escape sequence for a
    character whose code point was greater than \x{ff}.
  * A pattern such as (?&lt;RA&gt;abc)(?(R)xyz) was incorrectly compiled
    such that the conditional was interpreted as a reference to
    capturing group 1 instead of a test for recursion. Any group
    whose name began with R was misinterpreted in this way. (The
    reference interpretation should only happen if the group's name
    is precisely "R".)
  * A number of bugs have been mended relating to match start-up
    optimizations when the first thing in a pattern is a positive
    lookahead. These all applied only when PCRE_NO_START_OPTIMIZE
    was *not* set:
    + A pattern such as (?=.*X)X$ was incorrectly optimized as if
    it needed both an initial 'X' and a following 'X'.
    + Some patterns starting with an assertion that started with
    .* were incorrectly optimized as having to match at the start
    of the subject or after a newline. There are cases where this
    is not true, for example, (?=.*[A-Z])(?=.{8,16})(?!.*[\s])
    matches after the start in lines that start with spaces.
    Starting .* in an assertion is no longer taken as an
    indication of matching at the start (or after a newline).</changelog>
  <changelog author="mpluskal@suse.com" date="1496404800">- Enable jit on aarch64
- Enable profiled building</changelog>
  <changelog author="astieger@suse.com" date="1500984000">- pcre 8.41:
  * If pcregrep in multiline mode with --only-matching matched
    several lines, it restarted scanning at the next line instead
    of moving on to the end of the matched string, which can be
    several lines after the start.
  * Fix a missing else in the JIT compiler reported by 'idaifish'.
    CVE-2017-6004 bsc#1025709
  * A (?# style comment is now ignored between a basic quantifier
    and a following '+' or '?' (example: /X+(?#comment)?Y/.
  * Avoid use of a potentially overflowing buffer in pcregrep
  * Fix issues reported by fuzzers in pcretest:
  - Check for values &lt; 256 when calling isprint() in pcretest.
  - Give an error for too big a number after \O.
  * In the 32-bit library in non-UTF mode, an attempt to find a
    Unicode property for a character with a code point greater than
    0x10ffff (the Unicode maximum) caused a crash.
    CVE-2017-7186 bsc#1030066, CVE-2017-7244 bsc#1030807
  * The alternative matching function, pcre_dfa_exec() misbehaved
    if it encountered a character class with a possessive repeat,
    for example [a-f]{3}+.
  * When pcretest called pcre_copy_substring() in 32-bit mode, it
    set the buffer length incorrectly, which could result in buffer
    overflow. CVE-2017-7245 bsc#1030805, CVE-2017-7246 bsc#1030803</changelog>
  <changelog author="matz@suse.com" date="1505217600">- RunTest needs much stack, on s390x more than the default
  8 MB.  [bnc#1046102]</changelog>
  <changelog author="kstreitova@suse.com" date="1509537600">- add pcre-8.41-stack_frame_size_detection.patch to fix pcre stack
  frame size detection because modern compilers broke it by cloning
  and inlining pcre match() function [bsc#1058722]</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="bwiedemann@suse.com" date="1620734400">- Do not run profiling 'check' in parallel
  to make package build reproducible (boo#1040589)</changelog>
  <changelog author="coolo@suse.com" date="1634644800">- pcre 8.45 (the final release)
  * Fixed a small (*MARK) bug in the interpreter (Bugzilla #2771).
- pcre 8.44
  * Small patch to pcreposix.c to set the erroroffset field to -1 immediately
  after a successful compile, instead of at the start of matching to avoid a
  sanitizer complaint (regexec is supposed to be thread safe).
  * Check the size of the number after (?C as it is read, in order to avoid
  integer overflow. (bsc#1172974, CVE-2020-14155)
  * Tidy up left shifts to avoid sanitize warnings; also fix one NULL deference
  in pcretest.
- pcre 8.43
  * In a pattern such as /[^\x{100}-\x{ffff}]*[\x80-\xff]/ which has a repeated
  negative class with no characters less than 0x100 followed by a positive class
  with only characters less than 0x100, the first class was incorrectly being
  auto-possessified, causing incorrect match failures.
  * If the only branch in a conditional subpattern was anchored, the whole
  subpattern was treated as anchored, when it should not have been, since the
  assumed empty second branch cannot be anchored. Demonstrated by test patterns
  such as /(?(1)^())b/ or /(?(?=^))b/.
  * Fix subject buffer overread in JIT when UTF is disabled and \X or \R has
  a greater than 1 fixed quantifier. This issue was found by Yunho Kim.
  (bsc#1172973 CVE-2019-20838)
  * If a pattern started with a subroutine call that had a quantifier with a
  minimum of zero, an incorrect "match must start with this character" could be
  recorded. Example: /(?&amp;xxx)*ABC(?&lt;xxx&gt;XYZ)/ would (incorrectly) expect 'A' to
  be the first character of a match.
- pcre 8.42
  * If a backreference with a minimum repeat count of zero was first in a
  pattern, apart from assertions, an incorrect first matching character could be
  recorded. For example, for the pattern /(?=(a))\1?b/, "b" was incorrectly set
  as the first character of a match.
  * Fix out-of-bounds read for partial matching of /./ against an empty string
  when the newline type is CRLF.
  * When matching using the the REG_STARTEND feature of the POSIX API with a
  non-zero starting offset, unset capturing groups with lower numbers than a
  group that did capture something were not being correctly returned as "unset"
  (that is, with offset values of -1).
  * Matching the pattern /(*UTF)\C[^\v]+\x80/ against an 8-bit string
  containing multi-code-unit characters caused bad behaviour and possibly a
  crash. This issue was fixed for other kinds of repeat in release 8.37 by change
  38, but repeating character classes were overlooked.</changelog>
  <changelog author="jsikes@suse.com" date="1652270400">- Added pcre-8.45-bsc1199232-unicode-property-matching.patch
  * bsc#1199232
  * CVE-2022-1586
  * Fixes unicode property matching issue</changelog>
</package>
<package pkgid="52ead39e86ae86597276f98ee6ae54a7b8701f058f3c9ef452beb0d0691ca7cf" name="pcre2" arch="src">
  <version epoch="0" ver="10.31" rel="150000.3.12.1"/>
  <changelog author="coolo@suse.com" date="1399118400">- update to 0.35:
  There have been performance improvements for classes containing non-ASCII
  characters and the "auto-possessification" feature has been extended. Other
  minor improvements have been implemented and bugs fixed. There is a new callout
  feature to enable applications to do detailed stack checks at compile time, to
  avoid running out of stack for deeply nested parentheses. The JIT compiler has
  been extended with experimental support for ARM-64, MIPS-64, and PPC-LE.
- add pcre-commit1472.patch from SVN to work with gcc49, see
  http://bugs.exim.org/show_bug.cgi?id=1463</changelog>
  <changelog author="dvaleev@suse.com" date="1402920000">- Enable JIT on ppc64le as well</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1409227200">- Harden build with full RELRO as this libraries end linked
  to at least one setuid root executable.</changelog>
  <changelog author="jengelh@inai.de" date="1409659200">- Improve on RPM group classification
- Remove defunct %gpg_verify (replaced by source validators),
  defunct freecode link</changelog>
  <changelog author="p.drouand@gmail.com" date="1425902400">- Update to version 3.16
  * This is primarily a bug-fix release.
  * The Unicode data tables have been updated to Unicode 7.0.0.
- Remove pcre-commit1472.patch; fixed on upstream release
- Remove obsolete "Obsoletes" tag</changelog>
  <changelog author="astieger@suse.com" date="1430395200">- pcre 8.37:
  * CVE-2015-2325: Patterns with certain groups specifying a zero
    minimum quantifier caused incorrect code to be compiled,
    leading to an incorrect memory read. [boo#924960]
  * CVE-2015-2326: Specific patterns containing a forward reference
    with subroutine calls caused incorrect code to be compiled
    [boo#924961]
  * CVE-2014-8964: If an assertion condition was quantified with a
    minimum of zero, SIGSEGV or other misbehaviour could occur.
    [boo#906574]
  * further bug fixes as listed in ChangeLog</changelog>
  <changelog author="astieger@suse.com" date="1434628800">- PCRE2, a re-working of the original PCRE library to provide an
  entirely new API, version 10.10. Not source compatible.
- copy of the pcre package, with the following adjustments:
  * required name changes
  * adjust pcre-8.21-multilib.patch to pcre2-10.10-multilib.patch
  * drop upstreamed pcre-8.32-visibility.patch
  * --enable-{utf8,unicode-properties} became --enable-unicode
  * drop cpp subpackage
  * make test -&gt; check
  * enable 32 bit character support</changelog>
  <changelog author="astieger@suse.com" date="1436875200">- PCRE2 10.20:
  * Callouts with string arguments and the
    pcre2_callout_enumerate() function have been implemented.
  * The PCRE2_NEVER_BACKSLASH_C option, which locks out the use of
    \C, is added.
  * The PCRE2_ALT_CIRCUMFLEX option lets ^ match after a newline at
    the end of a subject in multiline mode.
  * The way named subpatterns are handled has been refactored. The
    previous approach had several bugs.
  * The handling of \c in EBCDIC environments has been changed to
    conform to the perlebcdic document. (Incompatible change)
  * Bugs have been mended, many of them discovered by fuzzers.</changelog>
  <changelog author="jengelh@inai.de" date="1453032000">- Update to new upstream release 10.21
  * Improve JIT matching speed of patterns starting with + or *.
  * Use memchr() to find the first character in an unanchored match
  in 8-bit mode in the interpreter. This gives a significant speed
  improvement.
  * 10.20 broke the handling of [[:&gt;:]] and [[:&lt;:]] in that
  processing them could involve a buffer overflow if the
  following character was an opening parenthesis.
  * 10.20 also introduced a bug in processing this pattern:
  /((?x)(*:0))#(?'/, which was fixed.
  * A callout with a string argument containing an opening square
  bracket, for example /(?C$[$)(?&lt;]/, was incorrectly processed and
  could provoke a buffer overflow.
  * A possessively repeated conditional group that could match an empty
  string, for example, /(?(R))*+/, was incorrectly compiled.
  * The Unicode tables have been updated to Unicode 8.0.0.
  * An empty comment (?#) in a pattern was incorrectly processed and
  could provoke a buffer overflow.
  * Fix infinite recursion in the JIT compiler when certain patterns
  /such as (?:|a|){100}x/ are analysed.
  * Some patterns with character classes involving [: and \\ were
  incorrectly compiled and could cause reading from uninitialized
  memory or an incorrect error diagnosis. Examples are:
  /[[:\\](?&lt;[::]/ and /[[:\\](?'abc')[a:].
  * A missing closing parenthesis for a callout with a string argument
  was not being diagnosed, possibly leading to a buffer overflow.
  * If (?R was followed by - or + incorrect behaviour happened instead
  of a diagnostic.
  * Fixed an issue when \p{Any} inside an xclass did not read the current
  character.
  * About 80 more fixes, which you can read about in the ChangeLog
  shipped with the libpcre2-8-0 package.</changelog>
  <changelog author="astieger@suse.com" date="1470052800">- pcre2 10.22:
  * The POSIX wrapper function regcomp() did not used to
    support back references and subroutine calls if called with the
    REG_NOSUB option. It now does.
  * A new function, pcre2_code_copy(), is added, to make a copy of a
    compiled pattern.
  * Support for string callouts is added to pcre2grep.
  * Added the PCRE2_NO_JIT option to pcre2_match().
  * The pcre2_get_error_message() function now returns with a
    negative error code if the error number it is given is unknown.
  * Several updates have been made to pcre2test and test scripts
  * Fix CVE-2016-3191: workspace overflow for (*ACCEPT) with deeply
    nested parentheses (boo#971741)</changelog>
  <changelog author="dimstar@opensuse.org" date="1486468800">- Explicitly package %{_docdir}/%{name} to fix build with RPM 4.13.</changelog>
  <changelog author="astieger@suse.com" date="1487246400">- pcre2 10.23:
  * major re-factoring of the pcre2_compile.c file
  * Back references are now permitted in lookbehind assertions when
    there are no duplicated group numbers (that is, (?| has not
    been used), and, if the reference is by name, there is only one
    group of that name. The referenced group must, of course be of
    fixed length.
  * \g{+&lt;number&gt;} (e.g. \g{+2} ) is now supported. It is a "forward
    back reference" and can be useful in repetitions
    (compare \g{-&lt;number&gt;} ). Perl does not recognize this syntax.
  * pcre2grep now automatically expands its buffer up to a maximum
    set by --max-buffer-size.
  * The -t option (grand total) has been added to pcre2grep.
  * A new function called pcre2_code_copy_with_tables() exists to
    copy a compiled pattern along with a private copy of the
    character tables that is uses.</changelog>
  <changelog author="astieger@suse.com" date="1493726400">- pcre2grep can now read .gz and .bz2 files directly
- pcre2test is now built to support line editing</changelog>
  <changelog author="astieger@suse.com" date="1501934400">- fix SLE 11 build</changelog>
  <changelog author="jengelh@inai.de" date="1505131200">- Update to new upstream release 10.30
  * The main interpreter, pcre2_match(), has been refactored into
    a new version that does not use recursive function calls for
    remembering backtracking positions. The new implementation
    allows backtracking into recursive group calls in patterns,
    making it more compatible with Perl. For patterns that have a
    lot of backtracking, the heap is now used, and there is
    explicit limit on the amount, settable by
    pcre2_set_heap_limit(). The "recursion limit" is retained,
    but is renamed as "depth limit".
  * The new option PCRE2_ENDANCHORED insists that a pattern match
    must end at the end of the subject.
  * The new option PCRE2_EXTENDED_MORE implements Perl's /xx
    feature, and pcre2test is upgraded to support it. Setting
    within the pattern by (?xx) is Also supported.
  * (?n) can be used to set PCRE2_NO_AUTO_CAPTURE, because Perl
    now has this.
  * Additional pattern compile options in the compile context are
    now available: PCRE2_EXTRA_ALLOW_SURROGATE_ESCAPES and
    PCRE2_EXTRA_BAD_ESCAPE_IS LITERAL.
  * The newline type PCRE2_NEWLINE_NUL is now available.
  * The match limit value now also applies to pcre2_dfa_match()
    as there are patterns that can use up a lot of resources
    without necessarily recursing very deeply.
  * Various minor security fixes found by fuzzers:
    + bsc#1037165: crash for forward reference in lookbehind with
    PCRE2_ANCHORED
    + CVE-2017-8786: heap-based buffer overflow write in pcre2test
    (bsc#1036942)
    + CVE-2017-7186: DoS by triggering an invalid Unicode property
    lookup (bsc#1030066)
- Switch source URLs to use HTTP.</changelog>
  <changelog author="avindra@opensuse.org" date="1518955200">- Update to new upstream release 10.31
  * New pcre2_config() options: PCRE2_CONFIG_NEVER_BACKSLASH_C and
    PCRE2_CONFIG_COMPILED_WIDTHS.
  * New pcre2_pattern_info() option PCRE2_INFO_EXTRAOPTIONS to
    retrieve the extra compile time options.
  * Public names for all pcre2_compile() error numbers.
  * Added PCRE2_CALLOUT_STARTMATCH and PCRE2_CALLOUT_BACKTRACK
    bits to a new field callout_flags in callout blocks.
- use https for main site
- cleanup with spec-cleaner</changelog>
  <changelog author="jsikes@suse.com" date="1627128000">- Added 0001-Fixed-atomic-group-backtracking-bug.patch
  * bsc#1187937
  * PHP 7.6.4 on s390x returns different results for preg_match
    function as compared to older PHP versions and x86
  * Sourced from upstream subversion commit:
    $ svn log -r965 svn://vcs.pcre.org/pcre2/code/trunk</changelog>
  <changelog author="jsikes@suse.com" date="1651924800">- Added pcre2-10.31-bsc1199232-unicode-property-matching.patch
  * bsc#1199232 / CVE-2022-1586
  * Fixes unicode property matching issue</changelog>
  <changelog author="jsikes@suse.com" date="1658232000">- Added pcre2-Fix_crash_when_X_is_used_without_UTF_in_JIT.patch
  * CVE-2019-20454 / bsc#1164384
  * Fix crash when \X is used in non-UTF mode on certain inputs.
  * Sourced from:
  - https://github.com/PCRE2Project/pcre2/commit/342c16ecd31bd12fc350ee31d2dcc041832ebb3f
  - https://github.com/PCRE2Project/pcre2/commit/e118e60a68f03f38dd2ff3d16ca2e2e0d800e1d9</changelog>
  <changelog author="jsikes@suse.com" date="1658318400">- Added pcre2-bsc1199235-CVE-2022-1587.patch
  * CVE-2022-1587 / bsc#1199235
  * Fix out-of-bounds read due to bug in recursions
  * Sourced from:
  - https://github.com/PCRE2Project/pcre2/commit/03654e751e7f0700693526b67dfcadda6b42c9d0</changelog>
</package>
<package pkgid="408b5c1de880884dabc785f2f31c9ba7b6c9f22884869885d8d2dc99c32e5491" name="python-M2Crypto" arch="src">
  <version epoch="0" ver="0.35.2" rel="150000.3.11.1"/>
  <changelog author="michael@stroeder.com" date="1469188800">- update to 0.25.1
- set new dependency on package python-typing</changelog>
  <changelog author="dmueller@suse.com" date="1473681600">- use pypi.io as Source URL</changelog>
  <changelog author="toddrme2178@gmail.com" date="1492516800">- Update to 0.26.0
  * No changelog provided
- Implement single-spec version.</changelog>
  <changelog author="alarrosa@suse.com" date="1493208000">- Provide python-m2crypto in the python2 package</changelog>
  <changelog author="alarrosa@suse.com" date="1493294400">- Add python-typing as a dependency</changelog>
  <changelog author="toddrme2178@gmail.com" date="1494072000">- It doesn't look like python3-m2crypto ever existed, so don't
  provide it.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1497873600">- only require python3-typing if necessary</changelog>
  <changelog author="michael@stroeder.com" date="1505995200">- Update to 0.26.2
  * compatibility with OpenSSL 1.1.0</changelog>
  <changelog author="michael@stroeder.com" date="1506081600">- Update to 0.26.3 with fix for a syntax error</changelog>
  <changelog author="michael@stroeder.com" date="1506427200">- Update to 0.26.4 with fix for OpenSSL 1.1.0 and LibreSSL</changelog>
  <changelog author="alarrosa@suse.com" date="1508328000">- Update to 0.27.0
  * Fix licence: it is MIT, not BSD
  * At least minimal support of SNI in httpslib.
  * Small bugfixes and cleanups.
  * More effort to make build system more robust.
  * Restore m2.rsa_set_e() and m2.rsa_set_n().
  * Make sure that every exceptional return throws and exception and viceversa.
- Add patch fix-build-python3.diff to let it build with python3
- Add patch fix-openssl-include-path.diff to fix openssl include path
  (the code already includes the openssl/ part)
- Create a new package python-M2Crypto-doc for documentation since rpmlint
  was complaining around 75% of the package was documentation.</changelog>
  <changelog author="alarrosa@suse.com" date="1508500800">- Remove unnecessary fdupes call</changelog>
  <changelog author="michael@stroeder.com" date="1508932800">- License set to MIT</changelog>
  <changelog author="jmatejek@suse.com" date="1510142400">- use generic way to require python-typing now that python3 provides it</changelog>
  <changelog author="michael@stroeder.com" date="1518091200">- Removed obsolete patches fix-build-python3.diff
  and fix-openssl-include-path.diff
- Update to 0.28.1
  * compability with Python 3
  * building on Mac OS X should be now more reliable and automagic
  * Fix licence in metadata: it is MIT, not BSD
  * Fix and add tests for SWIG/_aes.i module
  * Bundle-in unittest2 for Python 2.6
  * Remove all PGP modules</changelog>
  <changelog author="tchvatal@suse.com" date="1518177600">- Enable tests, fix docu install phase</changelog>
  <changelog author="michael@stroeder.com" date="1518177601">- Update to 0.28.2:
  * Fix ppc builds</changelog>
  <changelog author="mcepl@suse.com" date="1559044800">- Fix use of urlunsplit (bsc#1135009)</changelog>
  <changelog author="mcepl@suse.com" date="1568808000">- bsc#1149792 jsc#SLE-9135 Update to 0.35.2, bugfixes only.
  Changes cumulatively:
  - fix compatibility with OpenSSL 1.1.1c. Thank you,
    Sebastian Andrzej Siewior from the Debian team for resolving it.
  - Stop pretending to support Python 3.4.
  - The project is now Linux-distribution agnostic
  - Replace all old-style classes with the new ones (it shouldn't cause
    any problems, but feel free to file an issue, if it does)
  - Do not by-pass a potential transfer decoding in m2urllib2
  - SSLv3 just removed.
  - Various fixes of the build system and internal errors.
- Patch fix_urlunsplit.patch is removed, because it is included
  in the upstream tarball.</changelog>
  <changelog author="jgonzalez@suse.com" date="1590667200">- Add python3-M2crypto to LTSS channels, to allow using salt even
  when the Server Applications Module is not used (bsc#1172226)</changelog>
</package>
<package pkgid="f536a42c4809e39dd17d0542fbe0956b44372a438726150d4b837f2278a61b1f" name="python-M2Crypto" arch="src">
  <version epoch="0" ver="0.35.2" rel="150000.3.14.1"/>
  <changelog author="dmueller@suse.com" date="1473681600">- use pypi.io as Source URL</changelog>
  <changelog author="toddrme2178@gmail.com" date="1492516800">- Update to 0.26.0
  * No changelog provided
- Implement single-spec version.</changelog>
  <changelog author="alarrosa@suse.com" date="1493208000">- Provide python-m2crypto in the python2 package</changelog>
  <changelog author="alarrosa@suse.com" date="1493294400">- Add python-typing as a dependency</changelog>
  <changelog author="toddrme2178@gmail.com" date="1494072000">- It doesn't look like python3-m2crypto ever existed, so don't
  provide it.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1497873600">- only require python3-typing if necessary</changelog>
  <changelog author="michael@stroeder.com" date="1505995200">- Update to 0.26.2
  * compatibility with OpenSSL 1.1.0</changelog>
  <changelog author="michael@stroeder.com" date="1506081600">- Update to 0.26.3 with fix for a syntax error</changelog>
  <changelog author="michael@stroeder.com" date="1506427200">- Update to 0.26.4 with fix for OpenSSL 1.1.0 and LibreSSL</changelog>
  <changelog author="alarrosa@suse.com" date="1508328000">- Update to 0.27.0
  * Fix licence: it is MIT, not BSD
  * At least minimal support of SNI in httpslib.
  * Small bugfixes and cleanups.
  * More effort to make build system more robust.
  * Restore m2.rsa_set_e() and m2.rsa_set_n().
  * Make sure that every exceptional return throws and exception and viceversa.
- Add patch fix-build-python3.diff to let it build with python3
- Add patch fix-openssl-include-path.diff to fix openssl include path
  (the code already includes the openssl/ part)
- Create a new package python-M2Crypto-doc for documentation since rpmlint
  was complaining around 75% of the package was documentation.</changelog>
  <changelog author="alarrosa@suse.com" date="1508500800">- Remove unnecessary fdupes call</changelog>
  <changelog author="michael@stroeder.com" date="1508932800">- License set to MIT</changelog>
  <changelog author="jmatejek@suse.com" date="1510142400">- use generic way to require python-typing now that python3 provides it</changelog>
  <changelog author="michael@stroeder.com" date="1518091200">- Removed obsolete patches fix-build-python3.diff
  and fix-openssl-include-path.diff
- Update to 0.28.1
  * compability with Python 3
  * building on Mac OS X should be now more reliable and automagic
  * Fix licence in metadata: it is MIT, not BSD
  * Fix and add tests for SWIG/_aes.i module
  * Bundle-in unittest2 for Python 2.6
  * Remove all PGP modules</changelog>
  <changelog author="tchvatal@suse.com" date="1518177600">- Enable tests, fix docu install phase</changelog>
  <changelog author="michael@stroeder.com" date="1518177601">- Update to 0.28.2:
  * Fix ppc builds</changelog>
  <changelog author="mcepl@suse.com" date="1559044800">- Fix use of urlunsplit (bsc#1135009)</changelog>
  <changelog author="mcepl@suse.com" date="1568808000">- bsc#1149792 jsc#SLE-9135 Update to 0.35.2, bugfixes only.
  Changes cumulatively:
  - fix compatibility with OpenSSL 1.1.1c. Thank you,
    Sebastian Andrzej Siewior from the Debian team for resolving it.
  - Stop pretending to support Python 3.4.
  - The project is now Linux-distribution agnostic
  - Replace all old-style classes with the new ones (it shouldn't cause
    any problems, but feel free to file an issue, if it does)
  - Do not by-pass a potential transfer decoding in m2urllib2
  - SSLv3 just removed.
  - Various fixes of the build system and internal errors.
- Patch fix_urlunsplit.patch is removed, because it is included
  in the upstream tarball.</changelog>
  <changelog author="jgonzalez@suse.com" date="1590667200">- Add python3-M2crypto to LTSS channels, to allow using salt even
  when the Server Applications Module is not used (bsc#1172226)</changelog>
  <changelog author="mcepl@suse.com" date="1657627200">- Add CVE-2020-25657-Bleichenbacher-attack.patch (CVE-2020-25657,
  bsc#1178829), which mitigates the Bleichenbacher timing attacks
  in the RSA decryption API.
- Add python-M2Crypto.keyring to verify GPG signature of tarball.</changelog>
</package>
<package pkgid="de871fb33f4aabc98ffe2c0ea9ceeb0e0c460cd9d0887c2343e3f176b31bde86" name="python3" arch="aarch64">
  <version epoch="0" ver="3.6.15" rel="150300.10.27.1"/>
  <changelog author="mcepl@suse.com" date="1626782400">- Use versioned python-Sphinx to avoid dependency on other
  version of Python (bsc#1183858).</changelog>
  <changelog author="mcepl@suse.com" date="1627300800">- Rebuild to get new headers, avoid building in support for
  stropts.h (bsc#1187338).</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1628596800">- Update to 3.6.14:
  * Security
  - bpo-44022 (bsc#1189241, CVE-2021-3737): mod:http.client now
    avoids infinitely reading potential HTTP headers after
    a 100 Continue status response from the server.
  - bpo-43882: The presence of newline or tab characters in parts
    of a URL could allow some forms of attacks.
    Following the controlling specification for URLs defined by
    WHATWG urllib.parse() now removes ASCII newlines and tabs
    from URLs, preventing such attacks.
  - bpo-42988 (CVE-2021-3426, bsc#1183374): Remove the getfile feature
    of the pydoc module which could be abused to read arbitrary files
    on the disk (directory traversal vulnerability). Moreover, even
    source code of Python modules can contain sensitive data like
    passwords. Vulnerability reported by David Schwörer.
  - bpo-43285: ftplib no longer trusts the IP address value
    returned from the server in response to the PASV command by
    default. This prevents a malicious FTP server from using the
    response to probe IPv4 address and port combinations on the
    client network.
    Code that requires the former vulnerable behavior may set a
    trust_server_pasv_ipv4_address attribute on their ftplib.FTP
    instances to True to re-enable it.
  - bpo-43075 (CVE-2021-3733, bsc#1189287): Fix Regular Expression
    Denial of Service (ReDoS) vulnerability in
    urllib.request.AbstractBasicAuthHandler. The ReDoS-vulnerable
    regex has quadratic worst-case complexity and it allows cause
    a denial of service when identifying crafted invalid RFCs. This
    ReDoS issue is on the client side and needs remote attackers to
    control the HTTP server.
- Upstreamed patches were removed:
  - CVE-2021-3426-inf-disclosure-pydoc-getfile.patch
  - CVE-2021-3733-ReDoS-urllib-AbstractBasicAuthHandler.patch
- Refreshed patches:
  - python3-sorted_tar.patch
  - riscv64-ctypes.patch</changelog>
  <changelog author="schwab@suse.de" date="1629979200">- test_faulthandler is still problematic under qemu linux-user emulation,
  disable it there</changelog>
  <changelog author="mcepl@suse.com" date="1631707200">- Update to 3.6.15:
  - bpo-43124: Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection. Library
  - bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header. Patch
    by Wouter Bolsterlee. Tests
  - bpo-38965: Fix test_faulthandler on GCC 10. Use the
    ?volatile? keyword in faulthandler._stack_overflow() to
    prevent tail call optimization on any compiler, rather than
    relying on compiler specific pragma.
- Remove upstreamed patches:
  - faulthandler_stack_overflow_on_GCC10.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632398400">- Make build working even on older SLEs.</changelog>
  <changelog author="mcepl@suse.com" date="1632398401">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
</package>
<package pkgid="721546f631f5231b66a2df6e98c52e2fe96f4f855d08404d2c4d290d3b054111" name="python3" arch="src">
  <version epoch="0" ver="3.6.15" rel="150300.10.27.1"/>
  <changelog author="mcepl@suse.com" date="1626782400">- Use versioned python-Sphinx to avoid dependency on other
  version of Python (bsc#1183858).</changelog>
  <changelog author="mcepl@suse.com" date="1627300800">- Rebuild to get new headers, avoid building in support for
  stropts.h (bsc#1187338).</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1628596800">- Update to 3.6.14:
  * Security
  - bpo-44022 (bsc#1189241, CVE-2021-3737): mod:http.client now
    avoids infinitely reading potential HTTP headers after
    a 100 Continue status response from the server.
  - bpo-43882: The presence of newline or tab characters in parts
    of a URL could allow some forms of attacks.
    Following the controlling specification for URLs defined by
    WHATWG urllib.parse() now removes ASCII newlines and tabs
    from URLs, preventing such attacks.
  - bpo-42988 (CVE-2021-3426, bsc#1183374): Remove the getfile feature
    of the pydoc module which could be abused to read arbitrary files
    on the disk (directory traversal vulnerability). Moreover, even
    source code of Python modules can contain sensitive data like
    passwords. Vulnerability reported by David Schwörer.
  - bpo-43285: ftplib no longer trusts the IP address value
    returned from the server in response to the PASV command by
    default. This prevents a malicious FTP server from using the
    response to probe IPv4 address and port combinations on the
    client network.
    Code that requires the former vulnerable behavior may set a
    trust_server_pasv_ipv4_address attribute on their ftplib.FTP
    instances to True to re-enable it.
  - bpo-43075 (CVE-2021-3733, bsc#1189287): Fix Regular Expression
    Denial of Service (ReDoS) vulnerability in
    urllib.request.AbstractBasicAuthHandler. The ReDoS-vulnerable
    regex has quadratic worst-case complexity and it allows cause
    a denial of service when identifying crafted invalid RFCs. This
    ReDoS issue is on the client side and needs remote attackers to
    control the HTTP server.
- Upstreamed patches were removed:
  - CVE-2021-3426-inf-disclosure-pydoc-getfile.patch
  - CVE-2021-3733-ReDoS-urllib-AbstractBasicAuthHandler.patch
- Refreshed patches:
  - python3-sorted_tar.patch
  - riscv64-ctypes.patch</changelog>
  <changelog author="schwab@suse.de" date="1629979200">- test_faulthandler is still problematic under qemu linux-user emulation,
  disable it there</changelog>
  <changelog author="mcepl@suse.com" date="1631707200">- Update to 3.6.15:
  - bpo-43124: Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection. Library
  - bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header. Patch
    by Wouter Bolsterlee. Tests
  - bpo-38965: Fix test_faulthandler on GCC 10. Use the
    ?volatile? keyword in faulthandler._stack_overflow() to
    prevent tail call optimization on any compiler, rather than
    relying on compiler specific pragma.
- Remove upstreamed patches:
  - faulthandler_stack_overflow_on_GCC10.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632398400">- Make build working even on older SLEs.</changelog>
  <changelog author="mcepl@suse.com" date="1632398401">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
</package>
<package pkgid="e554776bdbcf66f809e2e4c391277eda2cc3e78e8916fb6ed8d09b457d2c6ed2" name="python3" arch="x86_64">
  <version epoch="0" ver="3.6.15" rel="150300.10.27.1"/>
  <changelog author="mcepl@suse.com" date="1626782400">- Use versioned python-Sphinx to avoid dependency on other
  version of Python (bsc#1183858).</changelog>
  <changelog author="mcepl@suse.com" date="1627300800">- Rebuild to get new headers, avoid building in support for
  stropts.h (bsc#1187338).</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1628596800">- Update to 3.6.14:
  * Security
  - bpo-44022 (bsc#1189241, CVE-2021-3737): mod:http.client now
    avoids infinitely reading potential HTTP headers after
    a 100 Continue status response from the server.
  - bpo-43882: The presence of newline or tab characters in parts
    of a URL could allow some forms of attacks.
    Following the controlling specification for URLs defined by
    WHATWG urllib.parse() now removes ASCII newlines and tabs
    from URLs, preventing such attacks.
  - bpo-42988 (CVE-2021-3426, bsc#1183374): Remove the getfile feature
    of the pydoc module which could be abused to read arbitrary files
    on the disk (directory traversal vulnerability). Moreover, even
    source code of Python modules can contain sensitive data like
    passwords. Vulnerability reported by David Schwörer.
  - bpo-43285: ftplib no longer trusts the IP address value
    returned from the server in response to the PASV command by
    default. This prevents a malicious FTP server from using the
    response to probe IPv4 address and port combinations on the
    client network.
    Code that requires the former vulnerable behavior may set a
    trust_server_pasv_ipv4_address attribute on their ftplib.FTP
    instances to True to re-enable it.
  - bpo-43075 (CVE-2021-3733, bsc#1189287): Fix Regular Expression
    Denial of Service (ReDoS) vulnerability in
    urllib.request.AbstractBasicAuthHandler. The ReDoS-vulnerable
    regex has quadratic worst-case complexity and it allows cause
    a denial of service when identifying crafted invalid RFCs. This
    ReDoS issue is on the client side and needs remote attackers to
    control the HTTP server.
- Upstreamed patches were removed:
  - CVE-2021-3426-inf-disclosure-pydoc-getfile.patch
  - CVE-2021-3733-ReDoS-urllib-AbstractBasicAuthHandler.patch
- Refreshed patches:
  - python3-sorted_tar.patch
  - riscv64-ctypes.patch</changelog>
  <changelog author="schwab@suse.de" date="1629979200">- test_faulthandler is still problematic under qemu linux-user emulation,
  disable it there</changelog>
  <changelog author="mcepl@suse.com" date="1631707200">- Update to 3.6.15:
  - bpo-43124: Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection. Library
  - bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header. Patch
    by Wouter Bolsterlee. Tests
  - bpo-38965: Fix test_faulthandler on GCC 10. Use the
    ?volatile? keyword in faulthandler._stack_overflow() to
    prevent tail call optimization on any compiler, rather than
    relying on compiler specific pragma.
- Remove upstreamed patches:
  - faulthandler_stack_overflow_on_GCC10.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632398400">- Make build working even on older SLEs.</changelog>
  <changelog author="mcepl@suse.com" date="1632398401">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
</package>
<package pkgid="851ff39fe4766ce230fa02c1289458996458bc8e7da804d25f73b46f3e45c877" name="python3-M2Crypto" arch="aarch64">
  <version epoch="0" ver="0.35.2" rel="150000.3.11.1"/>
  <changelog author="michael@stroeder.com" date="1469188800">- update to 0.25.1
- set new dependency on package python-typing</changelog>
  <changelog author="dmueller@suse.com" date="1473681600">- use pypi.io as Source URL</changelog>
  <changelog author="toddrme2178@gmail.com" date="1492516800">- Update to 0.26.0
  * No changelog provided
- Implement single-spec version.</changelog>
  <changelog author="alarrosa@suse.com" date="1493208000">- Provide python-m2crypto in the python2 package</changelog>
  <changelog author="alarrosa@suse.com" date="1493294400">- Add python-typing as a dependency</changelog>
  <changelog author="toddrme2178@gmail.com" date="1494072000">- It doesn't look like python3-m2crypto ever existed, so don't
  provide it.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1497873600">- only require python3-typing if necessary</changelog>
  <changelog author="michael@stroeder.com" date="1505995200">- Update to 0.26.2
  * compatibility with OpenSSL 1.1.0</changelog>
  <changelog author="michael@stroeder.com" date="1506081600">- Update to 0.26.3 with fix for a syntax error</changelog>
  <changelog author="michael@stroeder.com" date="1506427200">- Update to 0.26.4 with fix for OpenSSL 1.1.0 and LibreSSL</changelog>
  <changelog author="alarrosa@suse.com" date="1508328000">- Update to 0.27.0
  * Fix licence: it is MIT, not BSD
  * At least minimal support of SNI in httpslib.
  * Small bugfixes and cleanups.
  * More effort to make build system more robust.
  * Restore m2.rsa_set_e() and m2.rsa_set_n().
  * Make sure that every exceptional return throws and exception and viceversa.
- Add patch fix-build-python3.diff to let it build with python3
- Add patch fix-openssl-include-path.diff to fix openssl include path
  (the code already includes the openssl/ part)
- Create a new package python-M2Crypto-doc for documentation since rpmlint
  was complaining around 75% of the package was documentation.</changelog>
  <changelog author="alarrosa@suse.com" date="1508500800">- Remove unnecessary fdupes call</changelog>
  <changelog author="michael@stroeder.com" date="1508932800">- License set to MIT</changelog>
  <changelog author="jmatejek@suse.com" date="1510142400">- use generic way to require python-typing now that python3 provides it</changelog>
  <changelog author="michael@stroeder.com" date="1518091200">- Removed obsolete patches fix-build-python3.diff
  and fix-openssl-include-path.diff
- Update to 0.28.1
  * compability with Python 3
  * building on Mac OS X should be now more reliable and automagic
  * Fix licence in metadata: it is MIT, not BSD
  * Fix and add tests for SWIG/_aes.i module
  * Bundle-in unittest2 for Python 2.6
  * Remove all PGP modules</changelog>
  <changelog author="tchvatal@suse.com" date="1518177600">- Enable tests, fix docu install phase</changelog>
  <changelog author="michael@stroeder.com" date="1518177601">- Update to 0.28.2:
  * Fix ppc builds</changelog>
  <changelog author="mcepl@suse.com" date="1559044800">- Fix use of urlunsplit (bsc#1135009)</changelog>
  <changelog author="mcepl@suse.com" date="1568808000">- bsc#1149792 jsc#SLE-9135 Update to 0.35.2, bugfixes only.
  Changes cumulatively:
  - fix compatibility with OpenSSL 1.1.1c. Thank you,
    Sebastian Andrzej Siewior from the Debian team for resolving it.
  - Stop pretending to support Python 3.4.
  - The project is now Linux-distribution agnostic
  - Replace all old-style classes with the new ones (it shouldn't cause
    any problems, but feel free to file an issue, if it does)
  - Do not by-pass a potential transfer decoding in m2urllib2
  - SSLv3 just removed.
  - Various fixes of the build system and internal errors.
- Patch fix_urlunsplit.patch is removed, because it is included
  in the upstream tarball.</changelog>
  <changelog author="jgonzalez@suse.com" date="1590667200">- Add python3-M2crypto to LTSS channels, to allow using salt even
  when the Server Applications Module is not used (bsc#1172226)</changelog>
</package>
<package pkgid="56b8830b0e65c64706c2058f2f761499f03ef8e64dc7dfe4f7623e4478c9c0fd" name="python3-M2Crypto" arch="x86_64">
  <version epoch="0" ver="0.35.2" rel="150000.3.11.1"/>
  <changelog author="michael@stroeder.com" date="1469188800">- update to 0.25.1
- set new dependency on package python-typing</changelog>
  <changelog author="dmueller@suse.com" date="1473681600">- use pypi.io as Source URL</changelog>
  <changelog author="toddrme2178@gmail.com" date="1492516800">- Update to 0.26.0
  * No changelog provided
- Implement single-spec version.</changelog>
  <changelog author="alarrosa@suse.com" date="1493208000">- Provide python-m2crypto in the python2 package</changelog>
  <changelog author="alarrosa@suse.com" date="1493294400">- Add python-typing as a dependency</changelog>
  <changelog author="toddrme2178@gmail.com" date="1494072000">- It doesn't look like python3-m2crypto ever existed, so don't
  provide it.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1497873600">- only require python3-typing if necessary</changelog>
  <changelog author="michael@stroeder.com" date="1505995200">- Update to 0.26.2
  * compatibility with OpenSSL 1.1.0</changelog>
  <changelog author="michael@stroeder.com" date="1506081600">- Update to 0.26.3 with fix for a syntax error</changelog>
  <changelog author="michael@stroeder.com" date="1506427200">- Update to 0.26.4 with fix for OpenSSL 1.1.0 and LibreSSL</changelog>
  <changelog author="alarrosa@suse.com" date="1508328000">- Update to 0.27.0
  * Fix licence: it is MIT, not BSD
  * At least minimal support of SNI in httpslib.
  * Small bugfixes and cleanups.
  * More effort to make build system more robust.
  * Restore m2.rsa_set_e() and m2.rsa_set_n().
  * Make sure that every exceptional return throws and exception and viceversa.
- Add patch fix-build-python3.diff to let it build with python3
- Add patch fix-openssl-include-path.diff to fix openssl include path
  (the code already includes the openssl/ part)
- Create a new package python-M2Crypto-doc for documentation since rpmlint
  was complaining around 75% of the package was documentation.</changelog>
  <changelog author="alarrosa@suse.com" date="1508500800">- Remove unnecessary fdupes call</changelog>
  <changelog author="michael@stroeder.com" date="1508932800">- License set to MIT</changelog>
  <changelog author="jmatejek@suse.com" date="1510142400">- use generic way to require python-typing now that python3 provides it</changelog>
  <changelog author="michael@stroeder.com" date="1518091200">- Removed obsolete patches fix-build-python3.diff
  and fix-openssl-include-path.diff
- Update to 0.28.1
  * compability with Python 3
  * building on Mac OS X should be now more reliable and automagic
  * Fix licence in metadata: it is MIT, not BSD
  * Fix and add tests for SWIG/_aes.i module
  * Bundle-in unittest2 for Python 2.6
  * Remove all PGP modules</changelog>
  <changelog author="tchvatal@suse.com" date="1518177600">- Enable tests, fix docu install phase</changelog>
  <changelog author="michael@stroeder.com" date="1518177601">- Update to 0.28.2:
  * Fix ppc builds</changelog>
  <changelog author="mcepl@suse.com" date="1559044800">- Fix use of urlunsplit (bsc#1135009)</changelog>
  <changelog author="mcepl@suse.com" date="1568808000">- bsc#1149792 jsc#SLE-9135 Update to 0.35.2, bugfixes only.
  Changes cumulatively:
  - fix compatibility with OpenSSL 1.1.1c. Thank you,
    Sebastian Andrzej Siewior from the Debian team for resolving it.
  - Stop pretending to support Python 3.4.
  - The project is now Linux-distribution agnostic
  - Replace all old-style classes with the new ones (it shouldn't cause
    any problems, but feel free to file an issue, if it does)
  - Do not by-pass a potential transfer decoding in m2urllib2
  - SSLv3 just removed.
  - Various fixes of the build system and internal errors.
- Patch fix_urlunsplit.patch is removed, because it is included
  in the upstream tarball.</changelog>
  <changelog author="jgonzalez@suse.com" date="1590667200">- Add python3-M2crypto to LTSS channels, to allow using salt even
  when the Server Applications Module is not used (bsc#1172226)</changelog>
</package>
<package pkgid="12a7713a400ec85c481255a1f93798ad273f1b42992d4912b167e909aeb23099" name="python3-M2Crypto" arch="aarch64">
  <version epoch="0" ver="0.35.2" rel="150000.3.14.1"/>
  <changelog author="dmueller@suse.com" date="1473681600">- use pypi.io as Source URL</changelog>
  <changelog author="toddrme2178@gmail.com" date="1492516800">- Update to 0.26.0
  * No changelog provided
- Implement single-spec version.</changelog>
  <changelog author="alarrosa@suse.com" date="1493208000">- Provide python-m2crypto in the python2 package</changelog>
  <changelog author="alarrosa@suse.com" date="1493294400">- Add python-typing as a dependency</changelog>
  <changelog author="toddrme2178@gmail.com" date="1494072000">- It doesn't look like python3-m2crypto ever existed, so don't
  provide it.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1497873600">- only require python3-typing if necessary</changelog>
  <changelog author="michael@stroeder.com" date="1505995200">- Update to 0.26.2
  * compatibility with OpenSSL 1.1.0</changelog>
  <changelog author="michael@stroeder.com" date="1506081600">- Update to 0.26.3 with fix for a syntax error</changelog>
  <changelog author="michael@stroeder.com" date="1506427200">- Update to 0.26.4 with fix for OpenSSL 1.1.0 and LibreSSL</changelog>
  <changelog author="alarrosa@suse.com" date="1508328000">- Update to 0.27.0
  * Fix licence: it is MIT, not BSD
  * At least minimal support of SNI in httpslib.
  * Small bugfixes and cleanups.
  * More effort to make build system more robust.
  * Restore m2.rsa_set_e() and m2.rsa_set_n().
  * Make sure that every exceptional return throws and exception and viceversa.
- Add patch fix-build-python3.diff to let it build with python3
- Add patch fix-openssl-include-path.diff to fix openssl include path
  (the code already includes the openssl/ part)
- Create a new package python-M2Crypto-doc for documentation since rpmlint
  was complaining around 75% of the package was documentation.</changelog>
  <changelog author="alarrosa@suse.com" date="1508500800">- Remove unnecessary fdupes call</changelog>
  <changelog author="michael@stroeder.com" date="1508932800">- License set to MIT</changelog>
  <changelog author="jmatejek@suse.com" date="1510142400">- use generic way to require python-typing now that python3 provides it</changelog>
  <changelog author="michael@stroeder.com" date="1518091200">- Removed obsolete patches fix-build-python3.diff
  and fix-openssl-include-path.diff
- Update to 0.28.1
  * compability with Python 3
  * building on Mac OS X should be now more reliable and automagic
  * Fix licence in metadata: it is MIT, not BSD
  * Fix and add tests for SWIG/_aes.i module
  * Bundle-in unittest2 for Python 2.6
  * Remove all PGP modules</changelog>
  <changelog author="tchvatal@suse.com" date="1518177600">- Enable tests, fix docu install phase</changelog>
  <changelog author="michael@stroeder.com" date="1518177601">- Update to 0.28.2:
  * Fix ppc builds</changelog>
  <changelog author="mcepl@suse.com" date="1559044800">- Fix use of urlunsplit (bsc#1135009)</changelog>
  <changelog author="mcepl@suse.com" date="1568808000">- bsc#1149792 jsc#SLE-9135 Update to 0.35.2, bugfixes only.
  Changes cumulatively:
  - fix compatibility with OpenSSL 1.1.1c. Thank you,
    Sebastian Andrzej Siewior from the Debian team for resolving it.
  - Stop pretending to support Python 3.4.
  - The project is now Linux-distribution agnostic
  - Replace all old-style classes with the new ones (it shouldn't cause
    any problems, but feel free to file an issue, if it does)
  - Do not by-pass a potential transfer decoding in m2urllib2
  - SSLv3 just removed.
  - Various fixes of the build system and internal errors.
- Patch fix_urlunsplit.patch is removed, because it is included
  in the upstream tarball.</changelog>
  <changelog author="jgonzalez@suse.com" date="1590667200">- Add python3-M2crypto to LTSS channels, to allow using salt even
  when the Server Applications Module is not used (bsc#1172226)</changelog>
  <changelog author="mcepl@suse.com" date="1657627200">- Add CVE-2020-25657-Bleichenbacher-attack.patch (CVE-2020-25657,
  bsc#1178829), which mitigates the Bleichenbacher timing attacks
  in the RSA decryption API.
- Add python-M2Crypto.keyring to verify GPG signature of tarball.</changelog>
</package>
<package pkgid="ad0d5a8b9d4c2fa4cc4aa9eae830238485c45fc12fcd2272dfd7fe7a9c81330f" name="python3-M2Crypto" arch="x86_64">
  <version epoch="0" ver="0.35.2" rel="150000.3.14.1"/>
  <changelog author="dmueller@suse.com" date="1473681600">- use pypi.io as Source URL</changelog>
  <changelog author="toddrme2178@gmail.com" date="1492516800">- Update to 0.26.0
  * No changelog provided
- Implement single-spec version.</changelog>
  <changelog author="alarrosa@suse.com" date="1493208000">- Provide python-m2crypto in the python2 package</changelog>
  <changelog author="alarrosa@suse.com" date="1493294400">- Add python-typing as a dependency</changelog>
  <changelog author="toddrme2178@gmail.com" date="1494072000">- It doesn't look like python3-m2crypto ever existed, so don't
  provide it.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1497873600">- only require python3-typing if necessary</changelog>
  <changelog author="michael@stroeder.com" date="1505995200">- Update to 0.26.2
  * compatibility with OpenSSL 1.1.0</changelog>
  <changelog author="michael@stroeder.com" date="1506081600">- Update to 0.26.3 with fix for a syntax error</changelog>
  <changelog author="michael@stroeder.com" date="1506427200">- Update to 0.26.4 with fix for OpenSSL 1.1.0 and LibreSSL</changelog>
  <changelog author="alarrosa@suse.com" date="1508328000">- Update to 0.27.0
  * Fix licence: it is MIT, not BSD
  * At least minimal support of SNI in httpslib.
  * Small bugfixes and cleanups.
  * More effort to make build system more robust.
  * Restore m2.rsa_set_e() and m2.rsa_set_n().
  * Make sure that every exceptional return throws and exception and viceversa.
- Add patch fix-build-python3.diff to let it build with python3
- Add patch fix-openssl-include-path.diff to fix openssl include path
  (the code already includes the openssl/ part)
- Create a new package python-M2Crypto-doc for documentation since rpmlint
  was complaining around 75% of the package was documentation.</changelog>
  <changelog author="alarrosa@suse.com" date="1508500800">- Remove unnecessary fdupes call</changelog>
  <changelog author="michael@stroeder.com" date="1508932800">- License set to MIT</changelog>
  <changelog author="jmatejek@suse.com" date="1510142400">- use generic way to require python-typing now that python3 provides it</changelog>
  <changelog author="michael@stroeder.com" date="1518091200">- Removed obsolete patches fix-build-python3.diff
  and fix-openssl-include-path.diff
- Update to 0.28.1
  * compability with Python 3
  * building on Mac OS X should be now more reliable and automagic
  * Fix licence in metadata: it is MIT, not BSD
  * Fix and add tests for SWIG/_aes.i module
  * Bundle-in unittest2 for Python 2.6
  * Remove all PGP modules</changelog>
  <changelog author="tchvatal@suse.com" date="1518177600">- Enable tests, fix docu install phase</changelog>
  <changelog author="michael@stroeder.com" date="1518177601">- Update to 0.28.2:
  * Fix ppc builds</changelog>
  <changelog author="mcepl@suse.com" date="1559044800">- Fix use of urlunsplit (bsc#1135009)</changelog>
  <changelog author="mcepl@suse.com" date="1568808000">- bsc#1149792 jsc#SLE-9135 Update to 0.35.2, bugfixes only.
  Changes cumulatively:
  - fix compatibility with OpenSSL 1.1.1c. Thank you,
    Sebastian Andrzej Siewior from the Debian team for resolving it.
  - Stop pretending to support Python 3.4.
  - The project is now Linux-distribution agnostic
  - Replace all old-style classes with the new ones (it shouldn't cause
    any problems, but feel free to file an issue, if it does)
  - Do not by-pass a potential transfer decoding in m2urllib2
  - SSLv3 just removed.
  - Various fixes of the build system and internal errors.
- Patch fix_urlunsplit.patch is removed, because it is included
  in the upstream tarball.</changelog>
  <changelog author="jgonzalez@suse.com" date="1590667200">- Add python3-M2crypto to LTSS channels, to allow using salt even
  when the Server Applications Module is not used (bsc#1172226)</changelog>
  <changelog author="mcepl@suse.com" date="1657627200">- Add CVE-2020-25657-Bleichenbacher-attack.patch (CVE-2020-25657,
  bsc#1178829), which mitigates the Bleichenbacher timing attacks
  in the RSA decryption API.
- Add python-M2Crypto.keyring to verify GPG signature of tarball.</changelog>
</package>
<package pkgid="6539f230947d6ec829c6890b98683bc1434f925050fa98d0e0ca6febe4d5586e" name="python3-base" arch="aarch64">
  <version epoch="0" ver="3.6.15" rel="150300.10.27.1"/>
  <changelog author="mcepl@suse.com" date="1626782400">- Use versioned python-Sphinx to avoid dependency on other
  version of Python (bsc#1183858).</changelog>
  <changelog author="mcepl@suse.com" date="1627300800">- Rebuild to get new headers, avoid building in support for
  stropts.h (bsc#1187338).</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1628596800">- Update to 3.6.14:
  * Security
  - bpo-44022 (bsc#1189241, CVE-2021-3737): mod:http.client now
    avoids infinitely reading potential HTTP headers after
    a 100 Continue status response from the server.
  - bpo-43882: The presence of newline or tab characters in parts
    of a URL could allow some forms of attacks.
    Following the controlling specification for URLs defined by
    WHATWG urllib.parse() now removes ASCII newlines and tabs
    from URLs, preventing such attacks.
  - bpo-42988 (CVE-2021-3426, bsc#1183374): Remove the getfile feature
    of the pydoc module which could be abused to read arbitrary files
    on the disk (directory traversal vulnerability). Moreover, even
    source code of Python modules can contain sensitive data like
    passwords. Vulnerability reported by David Schwörer.
  - bpo-43285: ftplib no longer trusts the IP address value
    returned from the server in response to the PASV command by
    default. This prevents a malicious FTP server from using the
    response to probe IPv4 address and port combinations on the
    client network.
    Code that requires the former vulnerable behavior may set a
    trust_server_pasv_ipv4_address attribute on their ftplib.FTP
    instances to True to re-enable it.
  - bpo-43075 (CVE-2021-3733, bsc#1189287): Fix Regular Expression
    Denial of Service (ReDoS) vulnerability in
    urllib.request.AbstractBasicAuthHandler. The ReDoS-vulnerable
    regex has quadratic worst-case complexity and it allows cause
    a denial of service when identifying crafted invalid RFCs. This
    ReDoS issue is on the client side and needs remote attackers to
    control the HTTP server.
- Upstreamed patches were removed:
  - CVE-2021-3426-inf-disclosure-pydoc-getfile.patch
  - CVE-2021-3733-ReDoS-urllib-AbstractBasicAuthHandler.patch
- Refreshed patches:
  - python3-sorted_tar.patch
  - riscv64-ctypes.patch</changelog>
  <changelog author="schwab@suse.de" date="1629979200">- test_faulthandler is still problematic under qemu linux-user emulation,
  disable it there</changelog>
  <changelog author="mcepl@suse.com" date="1631707200">- Update to 3.6.15:
  - bpo-43124: Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection. Library
  - bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header. Patch
    by Wouter Bolsterlee. Tests
  - bpo-38965: Fix test_faulthandler on GCC 10. Use the
    ?volatile? keyword in faulthandler._stack_overflow() to
    prevent tail call optimization on any compiler, rather than
    relying on compiler specific pragma.
- Remove upstreamed patches:
  - faulthandler_stack_overflow_on_GCC10.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632398400">- Make build working even on older SLEs.</changelog>
  <changelog author="mcepl@suse.com" date="1632398401">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
</package>
<package pkgid="fb5d6861bbff07a7e936ddfd1db09896582ec31bf0def78bda75939aef72d547" name="python3-base" arch="x86_64">
  <version epoch="0" ver="3.6.15" rel="150300.10.27.1"/>
  <changelog author="mcepl@suse.com" date="1626782400">- Use versioned python-Sphinx to avoid dependency on other
  version of Python (bsc#1183858).</changelog>
  <changelog author="mcepl@suse.com" date="1627300800">- Rebuild to get new headers, avoid building in support for
  stropts.h (bsc#1187338).</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1628596800">- Update to 3.6.14:
  * Security
  - bpo-44022 (bsc#1189241, CVE-2021-3737): mod:http.client now
    avoids infinitely reading potential HTTP headers after
    a 100 Continue status response from the server.
  - bpo-43882: The presence of newline or tab characters in parts
    of a URL could allow some forms of attacks.
    Following the controlling specification for URLs defined by
    WHATWG urllib.parse() now removes ASCII newlines and tabs
    from URLs, preventing such attacks.
  - bpo-42988 (CVE-2021-3426, bsc#1183374): Remove the getfile feature
    of the pydoc module which could be abused to read arbitrary files
    on the disk (directory traversal vulnerability). Moreover, even
    source code of Python modules can contain sensitive data like
    passwords. Vulnerability reported by David Schwörer.
  - bpo-43285: ftplib no longer trusts the IP address value
    returned from the server in response to the PASV command by
    default. This prevents a malicious FTP server from using the
    response to probe IPv4 address and port combinations on the
    client network.
    Code that requires the former vulnerable behavior may set a
    trust_server_pasv_ipv4_address attribute on their ftplib.FTP
    instances to True to re-enable it.
  - bpo-43075 (CVE-2021-3733, bsc#1189287): Fix Regular Expression
    Denial of Service (ReDoS) vulnerability in
    urllib.request.AbstractBasicAuthHandler. The ReDoS-vulnerable
    regex has quadratic worst-case complexity and it allows cause
    a denial of service when identifying crafted invalid RFCs. This
    ReDoS issue is on the client side and needs remote attackers to
    control the HTTP server.
- Upstreamed patches were removed:
  - CVE-2021-3426-inf-disclosure-pydoc-getfile.patch
  - CVE-2021-3733-ReDoS-urllib-AbstractBasicAuthHandler.patch
- Refreshed patches:
  - python3-sorted_tar.patch
  - riscv64-ctypes.patch</changelog>
  <changelog author="schwab@suse.de" date="1629979200">- test_faulthandler is still problematic under qemu linux-user emulation,
  disable it there</changelog>
  <changelog author="mcepl@suse.com" date="1631707200">- Update to 3.6.15:
  - bpo-43124: Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection. Library
  - bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header. Patch
    by Wouter Bolsterlee. Tests
  - bpo-38965: Fix test_faulthandler on GCC 10. Use the
    ?volatile? keyword in faulthandler._stack_overflow() to
    prevent tail call optimization on any compiler, rather than
    relying on compiler specific pragma.
- Remove upstreamed patches:
  - faulthandler_stack_overflow_on_GCC10.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632398400">- Make build working even on older SLEs.</changelog>
  <changelog author="mcepl@suse.com" date="1632398401">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
</package>
<package pkgid="63517b6e7b8f3f9dc4ae7ae5cc25913b30cae4a94396f1fa4826c19ccdd8042f" name="python3-core" arch="src">
  <version epoch="0" ver="3.6.15" rel="150300.10.27.1"/>
  <changelog author="mcepl@suse.com" date="1626782400">- Use versioned python-Sphinx to avoid dependency on other
  version of Python (bsc#1183858).</changelog>
  <changelog author="mcepl@suse.com" date="1627300800">- Rebuild to get new headers, avoid building in support for
  stropts.h (bsc#1187338).</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1628596800">- Update to 3.6.14:
  * Security
  - bpo-44022 (bsc#1189241, CVE-2021-3737): mod:http.client now
    avoids infinitely reading potential HTTP headers after
    a 100 Continue status response from the server.
  - bpo-43882: The presence of newline or tab characters in parts
    of a URL could allow some forms of attacks.
    Following the controlling specification for URLs defined by
    WHATWG urllib.parse() now removes ASCII newlines and tabs
    from URLs, preventing such attacks.
  - bpo-42988 (CVE-2021-3426, bsc#1183374): Remove the getfile feature
    of the pydoc module which could be abused to read arbitrary files
    on the disk (directory traversal vulnerability). Moreover, even
    source code of Python modules can contain sensitive data like
    passwords. Vulnerability reported by David Schwörer.
  - bpo-43285: ftplib no longer trusts the IP address value
    returned from the server in response to the PASV command by
    default. This prevents a malicious FTP server from using the
    response to probe IPv4 address and port combinations on the
    client network.
    Code that requires the former vulnerable behavior may set a
    trust_server_pasv_ipv4_address attribute on their ftplib.FTP
    instances to True to re-enable it.
  - bpo-43075 (CVE-2021-3733, bsc#1189287): Fix Regular Expression
    Denial of Service (ReDoS) vulnerability in
    urllib.request.AbstractBasicAuthHandler. The ReDoS-vulnerable
    regex has quadratic worst-case complexity and it allows cause
    a denial of service when identifying crafted invalid RFCs. This
    ReDoS issue is on the client side and needs remote attackers to
    control the HTTP server.
- Upstreamed patches were removed:
  - CVE-2021-3426-inf-disclosure-pydoc-getfile.patch
  - CVE-2021-3733-ReDoS-urllib-AbstractBasicAuthHandler.patch
- Refreshed patches:
  - python3-sorted_tar.patch
  - riscv64-ctypes.patch</changelog>
  <changelog author="schwab@suse.de" date="1629979200">- test_faulthandler is still problematic under qemu linux-user emulation,
  disable it there</changelog>
  <changelog author="mcepl@suse.com" date="1631707200">- Update to 3.6.15:
  - bpo-43124: Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection. Library
  - bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header. Patch
    by Wouter Bolsterlee. Tests
  - bpo-38965: Fix test_faulthandler on GCC 10. Use the
    ?volatile? keyword in faulthandler._stack_overflow() to
    prevent tail call optimization on any compiler, rather than
    relying on compiler specific pragma.
- Remove upstreamed patches:
  - faulthandler_stack_overflow_on_GCC10.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632398400">- Make build working even on older SLEs.</changelog>
  <changelog author="mcepl@suse.com" date="1632398401">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
</package>
<package pkgid="5e8a78e42590f82fb9bf429aa129739468015b43f770303f5f813e7bc330e13f" name="python3-salt" arch="aarch64">
  <version epoch="0" ver="3004" rel="150300.53.24.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1610539200">- Revert wrong zypper patch to support vendorchanges flags on pkg.install
- Added:
  * revert-add-patch-support-for-allow-vendor-change-opt.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1610539201">- Remove deprecated warning that breaks minion execution when "server_id_use_crc" opts is missing
- Added:
  * remove-deprecated-warning-that-breaks-miniion-execut.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1613131200">- virt: search for grub.xen path
- Xen spicevmc, DNS SRV records backports:
  Fix virtual network generated DNS XML for SRV records
  Don't add spicevmc channel to xen VMs
- virt UEFI fix: virt.update when efi=True
- Do not crash when unexpected cmd output at listing patches (bsc#1181290)
- Fix behavior for "onlyif/unless" when multiple conditions (bsc#1180818)
- Added:
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * open-suse-3002.2-xen-grub-316.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * virt-uefi-fix-backport-312.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1614600000">- Allow extra_filerefs as sanitized kwargs for SSH client
- Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
- Fix for multiple for security issues
  (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144)
  (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197)
  (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560)
  (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
- Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
- Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
- Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
- Always require python-certifi (used by salt.ext.tornado)
- Bring missing part of async batch implementation back (bsc#1182382) (CVE-2021-25315)
- Always require python3-distro (bsc#1182293)
- Added:
  * async-batch-implementation-fix-320.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * fix-for-some-cves-bsc1181550.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * add-sleep-on-exception-handling-on-minion-connection.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix for CVE-2022-22967 (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
</package>
<package pkgid="57a554fa571e51ddc48c08b48d6ec8d799d15d3a2097b908f959fbee24e2f5a0" name="python3-salt" arch="x86_64">
  <version epoch="0" ver="3004" rel="150300.53.24.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1610539200">- Revert wrong zypper patch to support vendorchanges flags on pkg.install
- Added:
  * revert-add-patch-support-for-allow-vendor-change-opt.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1610539201">- Remove deprecated warning that breaks minion execution when "server_id_use_crc" opts is missing
- Added:
  * remove-deprecated-warning-that-breaks-miniion-execut.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1613131200">- virt: search for grub.xen path
- Xen spicevmc, DNS SRV records backports:
  Fix virtual network generated DNS XML for SRV records
  Don't add spicevmc channel to xen VMs
- virt UEFI fix: virt.update when efi=True
- Do not crash when unexpected cmd output at listing patches (bsc#1181290)
- Fix behavior for "onlyif/unless" when multiple conditions (bsc#1180818)
- Added:
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * open-suse-3002.2-xen-grub-316.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * virt-uefi-fix-backport-312.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1614600000">- Allow extra_filerefs as sanitized kwargs for SSH client
- Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
- Fix for multiple for security issues
  (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144)
  (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197)
  (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560)
  (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
- Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
- Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
- Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
- Always require python-certifi (used by salt.ext.tornado)
- Bring missing part of async batch implementation back (bsc#1182382) (CVE-2021-25315)
- Always require python3-distro (bsc#1182293)
- Added:
  * async-batch-implementation-fix-320.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * fix-for-some-cves-bsc1181550.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * add-sleep-on-exception-handling-on-minion-connection.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix for CVE-2022-22967 (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
</package>
<package pkgid="73e2694405deec5c225af8cb80644a54cf46b3055766ea778b1e1097503ff39a" name="salt" arch="aarch64">
  <version epoch="0" ver="3004" rel="150300.53.24.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1610539200">- Revert wrong zypper patch to support vendorchanges flags on pkg.install
- Added:
  * revert-add-patch-support-for-allow-vendor-change-opt.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1610539201">- Remove deprecated warning that breaks minion execution when "server_id_use_crc" opts is missing
- Added:
  * remove-deprecated-warning-that-breaks-miniion-execut.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1613131200">- virt: search for grub.xen path
- Xen spicevmc, DNS SRV records backports:
  Fix virtual network generated DNS XML for SRV records
  Don't add spicevmc channel to xen VMs
- virt UEFI fix: virt.update when efi=True
- Do not crash when unexpected cmd output at listing patches (bsc#1181290)
- Fix behavior for "onlyif/unless" when multiple conditions (bsc#1180818)
- Added:
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * open-suse-3002.2-xen-grub-316.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * virt-uefi-fix-backport-312.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1614600000">- Allow extra_filerefs as sanitized kwargs for SSH client
- Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
- Fix for multiple for security issues
  (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144)
  (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197)
  (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560)
  (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
- Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
- Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
- Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
- Always require python-certifi (used by salt.ext.tornado)
- Bring missing part of async batch implementation back (bsc#1182382) (CVE-2021-25315)
- Always require python3-distro (bsc#1182293)
- Added:
  * async-batch-implementation-fix-320.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * fix-for-some-cves-bsc1181550.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * add-sleep-on-exception-handling-on-minion-connection.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix for CVE-2022-22967 (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
</package>
<package pkgid="07c417f4cf4f7b04c9bdbf679d673268c032dde14f3a89eb5bdbd89607d61bf7" name="salt" arch="src">
  <version epoch="0" ver="3004" rel="150300.53.24.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1610539200">- Revert wrong zypper patch to support vendorchanges flags on pkg.install
- Added:
  * revert-add-patch-support-for-allow-vendor-change-opt.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1610539201">- Remove deprecated warning that breaks minion execution when "server_id_use_crc" opts is missing
- Added:
  * remove-deprecated-warning-that-breaks-miniion-execut.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1613131200">- virt: search for grub.xen path
- Xen spicevmc, DNS SRV records backports:
  Fix virtual network generated DNS XML for SRV records
  Don't add spicevmc channel to xen VMs
- virt UEFI fix: virt.update when efi=True
- Do not crash when unexpected cmd output at listing patches (bsc#1181290)
- Fix behavior for "onlyif/unless" when multiple conditions (bsc#1180818)
- Added:
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * open-suse-3002.2-xen-grub-316.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * virt-uefi-fix-backport-312.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1614600000">- Allow extra_filerefs as sanitized kwargs for SSH client
- Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
- Fix for multiple for security issues
  (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144)
  (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197)
  (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560)
  (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
- Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
- Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
- Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
- Always require python-certifi (used by salt.ext.tornado)
- Bring missing part of async batch implementation back (bsc#1182382) (CVE-2021-25315)
- Always require python3-distro (bsc#1182293)
- Added:
  * async-batch-implementation-fix-320.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * fix-for-some-cves-bsc1181550.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * add-sleep-on-exception-handling-on-minion-connection.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix for CVE-2022-22967 (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
</package>
<package pkgid="582cd74772bfb6ea74402e1d48ba6737b3ce0135b1521787f1aaa164b27ec0dd" name="salt" arch="x86_64">
  <version epoch="0" ver="3004" rel="150300.53.24.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1610539200">- Revert wrong zypper patch to support vendorchanges flags on pkg.install
- Added:
  * revert-add-patch-support-for-allow-vendor-change-opt.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1610539201">- Remove deprecated warning that breaks minion execution when "server_id_use_crc" opts is missing
- Added:
  * remove-deprecated-warning-that-breaks-miniion-execut.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1613131200">- virt: search for grub.xen path
- Xen spicevmc, DNS SRV records backports:
  Fix virtual network generated DNS XML for SRV records
  Don't add spicevmc channel to xen VMs
- virt UEFI fix: virt.update when efi=True
- Do not crash when unexpected cmd output at listing patches (bsc#1181290)
- Fix behavior for "onlyif/unless" when multiple conditions (bsc#1180818)
- Added:
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * open-suse-3002.2-xen-grub-316.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * virt-uefi-fix-backport-312.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1614600000">- Allow extra_filerefs as sanitized kwargs for SSH client
- Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
- Fix for multiple for security issues
  (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144)
  (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197)
  (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560)
  (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
- Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
- Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
- Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
- Always require python-certifi (used by salt.ext.tornado)
- Bring missing part of async batch implementation back (bsc#1182382) (CVE-2021-25315)
- Always require python3-distro (bsc#1182293)
- Added:
  * async-batch-implementation-fix-320.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * fix-for-some-cves-bsc1181550.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * add-sleep-on-exception-handling-on-minion-connection.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix for CVE-2022-22967 (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
</package>
<package pkgid="4046f78850cac3870ed283c8ebcf65bf9e207df7934283bd1cf4586ff43db0c7" name="salt-minion" arch="aarch64">
  <version epoch="0" ver="3004" rel="150300.53.24.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1610539200">- Revert wrong zypper patch to support vendorchanges flags on pkg.install
- Added:
  * revert-add-patch-support-for-allow-vendor-change-opt.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1610539201">- Remove deprecated warning that breaks minion execution when "server_id_use_crc" opts is missing
- Added:
  * remove-deprecated-warning-that-breaks-miniion-execut.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1613131200">- virt: search for grub.xen path
- Xen spicevmc, DNS SRV records backports:
  Fix virtual network generated DNS XML for SRV records
  Don't add spicevmc channel to xen VMs
- virt UEFI fix: virt.update when efi=True
- Do not crash when unexpected cmd output at listing patches (bsc#1181290)
- Fix behavior for "onlyif/unless" when multiple conditions (bsc#1180818)
- Added:
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * open-suse-3002.2-xen-grub-316.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * virt-uefi-fix-backport-312.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1614600000">- Allow extra_filerefs as sanitized kwargs for SSH client
- Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
- Fix for multiple for security issues
  (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144)
  (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197)
  (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560)
  (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
- Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
- Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
- Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
- Always require python-certifi (used by salt.ext.tornado)
- Bring missing part of async batch implementation back (bsc#1182382) (CVE-2021-25315)
- Always require python3-distro (bsc#1182293)
- Added:
  * async-batch-implementation-fix-320.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * fix-for-some-cves-bsc1181550.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * add-sleep-on-exception-handling-on-minion-connection.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix for CVE-2022-22967 (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
</package>
<package pkgid="874c4c8b53a6016d23a24ffd46b28f38e12eb9628294ee27fbcdcde69804897b" name="salt-minion" arch="x86_64">
  <version epoch="0" ver="3004" rel="150300.53.24.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1610539200">- Revert wrong zypper patch to support vendorchanges flags on pkg.install
- Added:
  * revert-add-patch-support-for-allow-vendor-change-opt.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1610539201">- Remove deprecated warning that breaks minion execution when "server_id_use_crc" opts is missing
- Added:
  * remove-deprecated-warning-that-breaks-miniion-execut.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1613131200">- virt: search for grub.xen path
- Xen spicevmc, DNS SRV records backports:
  Fix virtual network generated DNS XML for SRV records
  Don't add spicevmc channel to xen VMs
- virt UEFI fix: virt.update when efi=True
- Do not crash when unexpected cmd output at listing patches (bsc#1181290)
- Fix behavior for "onlyif/unless" when multiple conditions (bsc#1180818)
- Added:
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * open-suse-3002.2-xen-grub-316.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * virt-uefi-fix-backport-312.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1614600000">- Allow extra_filerefs as sanitized kwargs for SSH client
- Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
- Fix for multiple for security issues
  (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144)
  (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197)
  (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560)
  (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
- Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
- Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
- Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
- Always require python-certifi (used by salt.ext.tornado)
- Bring missing part of async batch implementation back (bsc#1182382) (CVE-2021-25315)
- Always require python3-distro (bsc#1182293)
- Added:
  * async-batch-implementation-fix-320.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * fix-for-some-cves-bsc1181550.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * add-sleep-on-exception-handling-on-minion-connection.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix for CVE-2022-22967 (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
</package>
<package pkgid="18f8d4ea5ed90070aaa7c0f14ce54575efd52c9c4cf14bfe90162efb7ecdd69a" name="salt-transactional-update" arch="aarch64">
  <version epoch="0" ver="3004" rel="150300.53.24.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1610539200">- Revert wrong zypper patch to support vendorchanges flags on pkg.install
- Added:
  * revert-add-patch-support-for-allow-vendor-change-opt.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1610539201">- Remove deprecated warning that breaks minion execution when "server_id_use_crc" opts is missing
- Added:
  * remove-deprecated-warning-that-breaks-miniion-execut.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1613131200">- virt: search for grub.xen path
- Xen spicevmc, DNS SRV records backports:
  Fix virtual network generated DNS XML for SRV records
  Don't add spicevmc channel to xen VMs
- virt UEFI fix: virt.update when efi=True
- Do not crash when unexpected cmd output at listing patches (bsc#1181290)
- Fix behavior for "onlyif/unless" when multiple conditions (bsc#1180818)
- Added:
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * open-suse-3002.2-xen-grub-316.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * virt-uefi-fix-backport-312.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1614600000">- Allow extra_filerefs as sanitized kwargs for SSH client
- Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
- Fix for multiple for security issues
  (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144)
  (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197)
  (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560)
  (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
- Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
- Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
- Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
- Always require python-certifi (used by salt.ext.tornado)
- Bring missing part of async batch implementation back (bsc#1182382) (CVE-2021-25315)
- Always require python3-distro (bsc#1182293)
- Added:
  * async-batch-implementation-fix-320.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * fix-for-some-cves-bsc1181550.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * add-sleep-on-exception-handling-on-minion-connection.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix for CVE-2022-22967 (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
</package>
<package pkgid="8ccdf5b0b28661a676aefec67c4988c9a12c76ea2e40085af71c8390cdb55136" name="salt-transactional-update" arch="x86_64">
  <version epoch="0" ver="3004" rel="150300.53.24.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1610539200">- Revert wrong zypper patch to support vendorchanges flags on pkg.install
- Added:
  * revert-add-patch-support-for-allow-vendor-change-opt.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1610539201">- Remove deprecated warning that breaks minion execution when "server_id_use_crc" opts is missing
- Added:
  * remove-deprecated-warning-that-breaks-miniion-execut.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1613131200">- virt: search for grub.xen path
- Xen spicevmc, DNS SRV records backports:
  Fix virtual network generated DNS XML for SRV records
  Don't add spicevmc channel to xen VMs
- virt UEFI fix: virt.update when efi=True
- Do not crash when unexpected cmd output at listing patches (bsc#1181290)
- Fix behavior for "onlyif/unless" when multiple conditions (bsc#1180818)
- Added:
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * open-suse-3002.2-xen-grub-316.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * virt-uefi-fix-backport-312.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1614600000">- Allow extra_filerefs as sanitized kwargs for SSH client
- Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
- Fix for multiple for security issues
  (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144)
  (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197)
  (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560)
  (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
- Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
- Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
- Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
- Always require python-certifi (used by salt.ext.tornado)
- Bring missing part of async batch implementation back (bsc#1182382) (CVE-2021-25315)
- Always require python3-distro (bsc#1182293)
- Added:
  * async-batch-implementation-fix-320.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * fix-for-some-cves-bsc1181550.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * add-sleep-on-exception-handling-on-minion-connection.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix for CVE-2022-22967 (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
</package>
<package pkgid="039b223c20452e92b7e0ad48e7b1e9d4780c303d0d1aa2df92ccfa6faaefa8c4" name="samba" arch="src">
  <version epoch="0" ver="4.15.8+git.500.d5910280cc7" rel="150300.3.37.1"/>
  <changelog author="scabrero@suse.de" date="1642075200">- Update to version 4.15.3; (jsc#SLE-23329);
  + CVE-2021-43566: Symlink race error can allow directory creation
    outside of the exported share; (bso#13979); (bsc#1139519);
  + CVE-2021-20316: Symlink race error can allow metadata read and
    modify outside of the exported share; (bso#14842); (bsc#1191227);
- Reorganize libs packages. Split samba-libs into samba-client-libs,
  samba-libs, samba-winbind-libs and samba-ad-dc-libs, merging samba
  public libraries depending on internal samba libraries into these
  packages as there were dependency problems everytime one of these
  public libraries changed its version (bsc#1192684). The devel
  packages are merged into samba-devel.
- Rename package samba-core-devel to samba-devel
- Add python-rpm-macros to build requirements
- Update the symlink create by samba-dsdb-modules to private samba
  ldb modules following libldb2 changes from /usr/lib64/ldb/samba to
  /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="dimstar@opensuse.org" date="1642507200">- Use pkgconfig(krb5) as dependency for the -devel package: allow
  OBS to pick the right flavor of krb5-devel (full vs mini).
- Do not require the 'krb5' symbol by samba-client-libs: this
  package has an automatic dependency due to linkage on
  libgssapi_krb5.so.2. Automatic deps are always better.
- Do not require the 'krb5' symbol from samba-libs: samba-libs
  requires samba-client-libs, which in turn requires krb5
  libraries. Samba-libs itself has no need for krb5 (but get it
  indirectly anyway).</changelog>
  <changelog author="scabrero@suse.de" date="1642766400">- Update to 4.15.4
  * Duplicate SMB file_ids leading to Windows client cache
    poisoning; (bso#14928);
  * Failed to parse NTLMv2_RESPONSE length 95 - Buffer Size Error -
    NT_STATUS_BUFFER_TOO_SMALL; (bso#14932);
  * kill_tcp_connections does not work; (bso#14934);
  * Can't connect to Windows shares not requiring authentication
    using KDE/Gnome; (bso#14935);
  * smbclient -L doesn't set "client max protocol" to NT1 before
    calling the "Reconnecting with SMB1 for workgroup listing"
    path; (bso#14939);
  * Cross device copy of the crossrename module always fails;
    (bso#14940);
  * symlinkat function from VFS cap module always fails with an
    error; (bso#14941);
  * Fix possible fsp pointer deference; (bso#14942);
  * Missing pop_sec_ctx() in error path inside close_directory();
    (bso#14944);
  * "smbd --build-options" no longer works without an smb.conf file;
    (bso#14945);</changelog>
  <changelog author="scabrero@suse.de" date="1643198400">- CVE-2021-44141: Information leak via symlinks of existance of
  files or directories outside of the exported share; (bso#14911);
  (bsc#1193690);
- CVE-2021-44142: Out-of-bounds heap read/write vulnerability
  in VFS module vfs_fruit allows code execution; (bso#14914);
  (bsc#1194859);
- CVE-2022-0336: Samba AD users with permission to write to an
  account can impersonate arbitrary services; (bso#14950);
  (bsc#1195048);</changelog>
  <changelog author="nopower@suse.com" date="1643630400">- Update to 4.15.5
  * CVE-2021-44141: UNIX extensions in SMB1 disclose whether the
    outside target of a symlink exists; (bso#14911);
    (bsc#1193690).
  * CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit
    module; (bso#14914); (bsc#1194859).
  * CVE-2022-0336:  Re-adding an SPN skips subsequent SPN
    conflict checks; bso#14950); (bsc#1195048).</changelog>
  <changelog author="dmulder@suse.com" date="1644235200">- libldb version mismatch in Samba dsdb component; (bsc#1118508);</changelog>
  <changelog author="dmulder@suse.com" date="1644840000">- Fix samba-ad-dc status warning notification message by disabling
  systemd notifications in bgqd; (bsc#1195896); (bso#14947).</changelog>
  <changelog author="nopower@suse.com" date="1645617600">- Fix ntlm authentications with "winbind use default domain = yes";
  (bso#13126); (bsc#1173429); (bsc#1196308).</changelog>
  <changelog author="ddiss@suse.com" date="1646395200">- Drop obsolete Samba fsrvp v0-&gt;v1 state upgrade functionality;
  (bsc#1080338).</changelog>
  <changelog author="dmulder@suse.com" date="1646654400">- Fix mismatched version of libldb2; (bsc#1196788).
- Drop obsolete SuSEfirewall2 service files.</changelog>
  <changelog author="scabrero@suse.de" date="1647345600">- Update to 4.15.6
  * Renaming file on DFS root fails with
    NT_STATUS_OBJECT_PATH_NOT_FOUND; (bso#14169);
  * Samba does not response STATUS_INVALID_PARAMETER when opening 2
    objects with same lease key; (bso#14737);
  * NT error code is not set when overwriting a file during rename
    in libsmbclient; (bso#14938);
  * Fix ldap simple bind with TLS auditing; (bso#14996);
  * net ads info shows LDAP Server: 0.0.0.0 depending on contacted
    server; (bso#14674);
  * Problem when winbind renews Kerberos; (bso#14979);
    (bsc#1196224);
  * pam_winbind will not allow gdm login if password about to
    expire; (bso#8691);
  * virusfilter_vfs_openat: Not scanned: Directory or special file;
    (bso#14971);
  * DFS fix for AIX broken; (bso#13631);
  * Solaris and AIX acl modules: wrong function arguments;
    (bso#14974);
  * Function aixacl_sys_acl_get_file not declared / coredump;
    (bso#7239);
  * Regression: Samba 4.15.2 on macOS segfaults intermittently
    during strcpy in tdbsam_getsampwnam; (bso#14900);
  * Fix a use-after-free in SMB1 server; (bso#14989);
  * smb2_signing_decrypt_pdu() may not decrypt with
    gnutls_aead_cipher_decrypt() from gnutls before 3.5.2;
    (bso#14968);
  * Changing the machine password against an RODC likely destroys
    the domain join; (bso#14984);
  * authsam_make_user_info_dc() steals memory from its struct
    ldb_message *msg argument; (bso#14993);
  * Use Heimdal 8.0 (pre) rather than an earlier snapshot;
    (bso#14995);
  * Samba autorid fails to map AD users if id rangesize fits in the
    id range only once; (bso#14967);</changelog>
  <changelog author="scabrero@suse.de" date="1649678400">- Add missing samba-libs requirement to samba-winbind package;
  (bsc#1198255);</changelog>
  <changelog author="scabrero@suse.de" date="1651060800">- Add provides to samba-client-libs package to fix upgrades from
  previous versions; (bsc#1197995);</changelog>
  <changelog author="scabrero@suse.de" date="1651060801">- Update to 4.15.7
  * Share and server swapped in smbget password prompt; (bso#14831);
  * Durable handles won't reconnect if the leased file is written
    to; (bso#15022);
  * rmdir silently fails if directory contains unreadable files and
    hide unreadable is yes; (bso#15023);
  * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information
    on renamed file handle; (bso#15038);
  * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback;
    (bso#14957);
  * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes;
    (bso#15035);
  * PAM Kerberos authentication incorrectly fails with a clock skew
    error; (bso#15046);
  * username map - samba erroneously applies unix group memberships
    to user account entries; (bso#15041);
  * NT_STATUS_ACCESS_DENIED translates into EPERM instead of EACCES
    in SMBC_server_internal; (bso#14983);
  * Simple bind doesn't work against an RODC (with non-preloaded users);
    (bso#13879);
  * Crash of winbind on RODC; (bso#14641);
  * uncached logon on RODC always fails once; (bso#14865);
  * KVNO off by 100000; (bso#14951);
  * LDAP simple binds should honour "old password allowed period";
    (bso#15001);
  * wbinfo -a doesn't work reliable with upn names; (bso#15003);
  * Simple bind doesn't work against an RODC (with non-preloaded
    users); (bso#13879);
  * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027);
  * Regression: create krb5 conf = yes doesn't work with a single KDC;
    (bso#15016);</changelog>
  <changelog author="scabrero@suse.de" date="1651233600">- Add missing samba-client requirement to samba-winbind package;
  (bsc#1198255);</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Use requires_eq macro to require the libldb2 version available at
  samba-dsdb-modules build time; (bsc#1199362);</changelog>
  <changelog author="scabrero@suse.de" date="1652702400">- Revert NIS support removal; (bsc#1199247);</changelog>
  <changelog author="nopower@suse.com" date="1655726400">- Fix  smbclient commands del &amp; deltree failing with
  NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
  (bsc#1200556).</changelog>
  <changelog author="scabrero@suse.de" date="1657281600">- Update to 4.15.8
  * Use pathref fd instead of io fd in vfs_default_durable_cookie;
    (bso#15042);
  * Setting fruit:resource = stream in vfs_fruit causes a panic;
    (bso#15099);
  * Add support for bind 9.18; (bso#14986);
  * logging dsdb audit to specific files does not work; (bso#15076);
  * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original
    file had been deleted; (bso#15069);
  * netgroups support removed; (bso#15087); (bsc#1199247);
  * net ads info shows LDAP Server: 0.0.0.0 depending on contacted
    server; (bso#14674); (bsc#1199734);
  * waf produces incorrect names for python extensions with Python
    3.11; (bso#15071);
  * smbclient commands del &amp; deltree fail with
    NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
    (bsc#1200556);
  * vfs_gpfs recalls=no option prevents listing files; (bso#15055);
  * waf produces incorrect names for python extensions with Python
    3.11; (bso#15071);
  * Compile error in source3/utils/regedit_hexedit.c; (bso#15091);
  * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link;
    (bso#15108);
  * smbd doesn't handle UPNs for looking up names; (bso#15054);
  * Out-by-4 error in smbd read reply max_send clamp; (bso#14443);
- Move pdb backends from package samba-libs to package
  samba-client-libs and remove samba-libs requirement from
  samba-winbind; (bsc#1200964); (bsc#1198255);
- Use the canonical realm name to refresh the Kerberos tickets;
  (bsc#1196224); (bso#14979);</changelog>
  <changelog author="nopower@suse.com" date="1657800000">- CVE-2022-32746: samba: Use-after-free occurring in database
  audit logging; (bso#15009); (bso#15096); (bsc#1201490).
- CVE-2022-32745: samba: ldb: AD users can crash the server
  process with an LDAP add or modify request; (bso#15008);
  (bso#15096); (bsc#1201492).
- CVE-2022-2031: samba, ldb: AD users can bypass certain
  restrictions associated with changing passwords; (bso#15047);
  (bsc#1201495);
- CVE-2022-32742:SMB1 code does not correct verify SMB1write,
  SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085);
  (bsc#1201496).
- CVE-2022-32744: samba, ldb: AD users can forge password change
  requests for any user; (bso#15074); (bso#15047); (bsc#1201493).</changelog>
</package>
<package pkgid="284db9b9940733b1df60ccabb1ab4f93d0fa6b17c4d212c7d185d2863ef844a0" name="samba-client-libs" arch="aarch64">
  <version epoch="0" ver="4.15.8+git.500.d5910280cc7" rel="150300.3.37.1"/>
  <changelog author="scabrero@suse.de" date="1642075200">- Update to version 4.15.3; (jsc#SLE-23329);
  + CVE-2021-43566: Symlink race error can allow directory creation
    outside of the exported share; (bso#13979); (bsc#1139519);
  + CVE-2021-20316: Symlink race error can allow metadata read and
    modify outside of the exported share; (bso#14842); (bsc#1191227);
- Reorganize libs packages. Split samba-libs into samba-client-libs,
  samba-libs, samba-winbind-libs and samba-ad-dc-libs, merging samba
  public libraries depending on internal samba libraries into these
  packages as there were dependency problems everytime one of these
  public libraries changed its version (bsc#1192684). The devel
  packages are merged into samba-devel.
- Rename package samba-core-devel to samba-devel
- Add python-rpm-macros to build requirements
- Update the symlink create by samba-dsdb-modules to private samba
  ldb modules following libldb2 changes from /usr/lib64/ldb/samba to
  /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="dimstar@opensuse.org" date="1642507200">- Use pkgconfig(krb5) as dependency for the -devel package: allow
  OBS to pick the right flavor of krb5-devel (full vs mini).
- Do not require the 'krb5' symbol by samba-client-libs: this
  package has an automatic dependency due to linkage on
  libgssapi_krb5.so.2. Automatic deps are always better.
- Do not require the 'krb5' symbol from samba-libs: samba-libs
  requires samba-client-libs, which in turn requires krb5
  libraries. Samba-libs itself has no need for krb5 (but get it
  indirectly anyway).</changelog>
  <changelog author="scabrero@suse.de" date="1642766400">- Update to 4.15.4
  * Duplicate SMB file_ids leading to Windows client cache
    poisoning; (bso#14928);
  * Failed to parse NTLMv2_RESPONSE length 95 - Buffer Size Error -
    NT_STATUS_BUFFER_TOO_SMALL; (bso#14932);
  * kill_tcp_connections does not work; (bso#14934);
  * Can't connect to Windows shares not requiring authentication
    using KDE/Gnome; (bso#14935);
  * smbclient -L doesn't set "client max protocol" to NT1 before
    calling the "Reconnecting with SMB1 for workgroup listing"
    path; (bso#14939);
  * Cross device copy of the crossrename module always fails;
    (bso#14940);
  * symlinkat function from VFS cap module always fails with an
    error; (bso#14941);
  * Fix possible fsp pointer deference; (bso#14942);
  * Missing pop_sec_ctx() in error path inside close_directory();
    (bso#14944);
  * "smbd --build-options" no longer works without an smb.conf file;
    (bso#14945);</changelog>
  <changelog author="scabrero@suse.de" date="1643198400">- CVE-2021-44141: Information leak via symlinks of existance of
  files or directories outside of the exported share; (bso#14911);
  (bsc#1193690);
- CVE-2021-44142: Out-of-bounds heap read/write vulnerability
  in VFS module vfs_fruit allows code execution; (bso#14914);
  (bsc#1194859);
- CVE-2022-0336: Samba AD users with permission to write to an
  account can impersonate arbitrary services; (bso#14950);
  (bsc#1195048);</changelog>
  <changelog author="nopower@suse.com" date="1643630400">- Update to 4.15.5
  * CVE-2021-44141: UNIX extensions in SMB1 disclose whether the
    outside target of a symlink exists; (bso#14911);
    (bsc#1193690).
  * CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit
    module; (bso#14914); (bsc#1194859).
  * CVE-2022-0336:  Re-adding an SPN skips subsequent SPN
    conflict checks; bso#14950); (bsc#1195048).</changelog>
  <changelog author="dmulder@suse.com" date="1644235200">- libldb version mismatch in Samba dsdb component; (bsc#1118508);</changelog>
  <changelog author="dmulder@suse.com" date="1644840000">- Fix samba-ad-dc status warning notification message by disabling
  systemd notifications in bgqd; (bsc#1195896); (bso#14947).</changelog>
  <changelog author="nopower@suse.com" date="1645617600">- Fix ntlm authentications with "winbind use default domain = yes";
  (bso#13126); (bsc#1173429); (bsc#1196308).</changelog>
  <changelog author="ddiss@suse.com" date="1646395200">- Drop obsolete Samba fsrvp v0-&gt;v1 state upgrade functionality;
  (bsc#1080338).</changelog>
  <changelog author="dmulder@suse.com" date="1646654400">- Fix mismatched version of libldb2; (bsc#1196788).
- Drop obsolete SuSEfirewall2 service files.</changelog>
  <changelog author="scabrero@suse.de" date="1647345600">- Update to 4.15.6
  * Renaming file on DFS root fails with
    NT_STATUS_OBJECT_PATH_NOT_FOUND; (bso#14169);
  * Samba does not response STATUS_INVALID_PARAMETER when opening 2
    objects with same lease key; (bso#14737);
  * NT error code is not set when overwriting a file during rename
    in libsmbclient; (bso#14938);
  * Fix ldap simple bind with TLS auditing; (bso#14996);
  * net ads info shows LDAP Server: 0.0.0.0 depending on contacted
    server; (bso#14674);
  * Problem when winbind renews Kerberos; (bso#14979);
    (bsc#1196224);
  * pam_winbind will not allow gdm login if password about to
    expire; (bso#8691);
  * virusfilter_vfs_openat: Not scanned: Directory or special file;
    (bso#14971);
  * DFS fix for AIX broken; (bso#13631);
  * Solaris and AIX acl modules: wrong function arguments;
    (bso#14974);
  * Function aixacl_sys_acl_get_file not declared / coredump;
    (bso#7239);
  * Regression: Samba 4.15.2 on macOS segfaults intermittently
    during strcpy in tdbsam_getsampwnam; (bso#14900);
  * Fix a use-after-free in SMB1 server; (bso#14989);
  * smb2_signing_decrypt_pdu() may not decrypt with
    gnutls_aead_cipher_decrypt() from gnutls before 3.5.2;
    (bso#14968);
  * Changing the machine password against an RODC likely destroys
    the domain join; (bso#14984);
  * authsam_make_user_info_dc() steals memory from its struct
    ldb_message *msg argument; (bso#14993);
  * Use Heimdal 8.0 (pre) rather than an earlier snapshot;
    (bso#14995);
  * Samba autorid fails to map AD users if id rangesize fits in the
    id range only once; (bso#14967);</changelog>
  <changelog author="scabrero@suse.de" date="1649678400">- Add missing samba-libs requirement to samba-winbind package;
  (bsc#1198255);</changelog>
  <changelog author="scabrero@suse.de" date="1651060800">- Add provides to samba-client-libs package to fix upgrades from
  previous versions; (bsc#1197995);</changelog>
  <changelog author="scabrero@suse.de" date="1651060801">- Update to 4.15.7
  * Share and server swapped in smbget password prompt; (bso#14831);
  * Durable handles won't reconnect if the leased file is written
    to; (bso#15022);
  * rmdir silently fails if directory contains unreadable files and
    hide unreadable is yes; (bso#15023);
  * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information
    on renamed file handle; (bso#15038);
  * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback;
    (bso#14957);
  * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes;
    (bso#15035);
  * PAM Kerberos authentication incorrectly fails with a clock skew
    error; (bso#15046);
  * username map - samba erroneously applies unix group memberships
    to user account entries; (bso#15041);
  * NT_STATUS_ACCESS_DENIED translates into EPERM instead of EACCES
    in SMBC_server_internal; (bso#14983);
  * Simple bind doesn't work against an RODC (with non-preloaded users);
    (bso#13879);
  * Crash of winbind on RODC; (bso#14641);
  * uncached logon on RODC always fails once; (bso#14865);
  * KVNO off by 100000; (bso#14951);
  * LDAP simple binds should honour "old password allowed period";
    (bso#15001);
  * wbinfo -a doesn't work reliable with upn names; (bso#15003);
  * Simple bind doesn't work against an RODC (with non-preloaded
    users); (bso#13879);
  * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027);
  * Regression: create krb5 conf = yes doesn't work with a single KDC;
    (bso#15016);</changelog>
  <changelog author="scabrero@suse.de" date="1651233600">- Add missing samba-client requirement to samba-winbind package;
  (bsc#1198255);</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Use requires_eq macro to require the libldb2 version available at
  samba-dsdb-modules build time; (bsc#1199362);</changelog>
  <changelog author="scabrero@suse.de" date="1652702400">- Revert NIS support removal; (bsc#1199247);</changelog>
  <changelog author="nopower@suse.com" date="1655726400">- Fix  smbclient commands del &amp; deltree failing with
  NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
  (bsc#1200556).</changelog>
  <changelog author="scabrero@suse.de" date="1657281600">- Update to 4.15.8
  * Use pathref fd instead of io fd in vfs_default_durable_cookie;
    (bso#15042);
  * Setting fruit:resource = stream in vfs_fruit causes a panic;
    (bso#15099);
  * Add support for bind 9.18; (bso#14986);
  * logging dsdb audit to specific files does not work; (bso#15076);
  * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original
    file had been deleted; (bso#15069);
  * netgroups support removed; (bso#15087); (bsc#1199247);
  * net ads info shows LDAP Server: 0.0.0.0 depending on contacted
    server; (bso#14674); (bsc#1199734);
  * waf produces incorrect names for python extensions with Python
    3.11; (bso#15071);
  * smbclient commands del &amp; deltree fail with
    NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
    (bsc#1200556);
  * vfs_gpfs recalls=no option prevents listing files; (bso#15055);
  * waf produces incorrect names for python extensions with Python
    3.11; (bso#15071);
  * Compile error in source3/utils/regedit_hexedit.c; (bso#15091);
  * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link;
    (bso#15108);
  * smbd doesn't handle UPNs for looking up names; (bso#15054);
  * Out-by-4 error in smbd read reply max_send clamp; (bso#14443);
- Move pdb backends from package samba-libs to package
  samba-client-libs and remove samba-libs requirement from
  samba-winbind; (bsc#1200964); (bsc#1198255);
- Use the canonical realm name to refresh the Kerberos tickets;
  (bsc#1196224); (bso#14979);</changelog>
  <changelog author="nopower@suse.com" date="1657800000">- CVE-2022-32746: samba: Use-after-free occurring in database
  audit logging; (bso#15009); (bso#15096); (bsc#1201490).
- CVE-2022-32745: samba: ldb: AD users can crash the server
  process with an LDAP add or modify request; (bso#15008);
  (bso#15096); (bsc#1201492).
- CVE-2022-2031: samba, ldb: AD users can bypass certain
  restrictions associated with changing passwords; (bso#15047);
  (bsc#1201495);
- CVE-2022-32742:SMB1 code does not correct verify SMB1write,
  SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085);
  (bsc#1201496).
- CVE-2022-32744: samba, ldb: AD users can forge password change
  requests for any user; (bso#15074); (bso#15047); (bsc#1201493).</changelog>
</package>
<package pkgid="58851ccf168135cdd51559acec9e3387928371bbd874b367aa0fb96e4ac8198f" name="samba-client-libs" arch="x86_64">
  <version epoch="0" ver="4.15.8+git.500.d5910280cc7" rel="150300.3.37.1"/>
  <changelog author="scabrero@suse.de" date="1642075200">- Update to version 4.15.3; (jsc#SLE-23329);
  + CVE-2021-43566: Symlink race error can allow directory creation
    outside of the exported share; (bso#13979); (bsc#1139519);
  + CVE-2021-20316: Symlink race error can allow metadata read and
    modify outside of the exported share; (bso#14842); (bsc#1191227);
- Reorganize libs packages. Split samba-libs into samba-client-libs,
  samba-libs, samba-winbind-libs and samba-ad-dc-libs, merging samba
  public libraries depending on internal samba libraries into these
  packages as there were dependency problems everytime one of these
  public libraries changed its version (bsc#1192684). The devel
  packages are merged into samba-devel.
- Rename package samba-core-devel to samba-devel
- Add python-rpm-macros to build requirements
- Update the symlink create by samba-dsdb-modules to private samba
  ldb modules following libldb2 changes from /usr/lib64/ldb/samba to
  /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="dimstar@opensuse.org" date="1642507200">- Use pkgconfig(krb5) as dependency for the -devel package: allow
  OBS to pick the right flavor of krb5-devel (full vs mini).
- Do not require the 'krb5' symbol by samba-client-libs: this
  package has an automatic dependency due to linkage on
  libgssapi_krb5.so.2. Automatic deps are always better.
- Do not require the 'krb5' symbol from samba-libs: samba-libs
  requires samba-client-libs, which in turn requires krb5
  libraries. Samba-libs itself has no need for krb5 (but get it
  indirectly anyway).</changelog>
  <changelog author="scabrero@suse.de" date="1642766400">- Update to 4.15.4
  * Duplicate SMB file_ids leading to Windows client cache
    poisoning; (bso#14928);
  * Failed to parse NTLMv2_RESPONSE length 95 - Buffer Size Error -
    NT_STATUS_BUFFER_TOO_SMALL; (bso#14932);
  * kill_tcp_connections does not work; (bso#14934);
  * Can't connect to Windows shares not requiring authentication
    using KDE/Gnome; (bso#14935);
  * smbclient -L doesn't set "client max protocol" to NT1 before
    calling the "Reconnecting with SMB1 for workgroup listing"
    path; (bso#14939);
  * Cross device copy of the crossrename module always fails;
    (bso#14940);
  * symlinkat function from VFS cap module always fails with an
    error; (bso#14941);
  * Fix possible fsp pointer deference; (bso#14942);
  * Missing pop_sec_ctx() in error path inside close_directory();
    (bso#14944);
  * "smbd --build-options" no longer works without an smb.conf file;
    (bso#14945);</changelog>
  <changelog author="scabrero@suse.de" date="1643198400">- CVE-2021-44141: Information leak via symlinks of existance of
  files or directories outside of the exported share; (bso#14911);
  (bsc#1193690);
- CVE-2021-44142: Out-of-bounds heap read/write vulnerability
  in VFS module vfs_fruit allows code execution; (bso#14914);
  (bsc#1194859);
- CVE-2022-0336: Samba AD users with permission to write to an
  account can impersonate arbitrary services; (bso#14950);
  (bsc#1195048);</changelog>
  <changelog author="nopower@suse.com" date="1643630400">- Update to 4.15.5
  * CVE-2021-44141: UNIX extensions in SMB1 disclose whether the
    outside target of a symlink exists; (bso#14911);
    (bsc#1193690).
  * CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit
    module; (bso#14914); (bsc#1194859).
  * CVE-2022-0336:  Re-adding an SPN skips subsequent SPN
    conflict checks; bso#14950); (bsc#1195048).</changelog>
  <changelog author="dmulder@suse.com" date="1644235200">- libldb version mismatch in Samba dsdb component; (bsc#1118508);</changelog>
  <changelog author="dmulder@suse.com" date="1644840000">- Fix samba-ad-dc status warning notification message by disabling
  systemd notifications in bgqd; (bsc#1195896); (bso#14947).</changelog>
  <changelog author="nopower@suse.com" date="1645617600">- Fix ntlm authentications with "winbind use default domain = yes";
  (bso#13126); (bsc#1173429); (bsc#1196308).</changelog>
  <changelog author="ddiss@suse.com" date="1646395200">- Drop obsolete Samba fsrvp v0-&gt;v1 state upgrade functionality;
  (bsc#1080338).</changelog>
  <changelog author="dmulder@suse.com" date="1646654400">- Fix mismatched version of libldb2; (bsc#1196788).
- Drop obsolete SuSEfirewall2 service files.</changelog>
  <changelog author="scabrero@suse.de" date="1647345600">- Update to 4.15.6
  * Renaming file on DFS root fails with
    NT_STATUS_OBJECT_PATH_NOT_FOUND; (bso#14169);
  * Samba does not response STATUS_INVALID_PARAMETER when opening 2
    objects with same lease key; (bso#14737);
  * NT error code is not set when overwriting a file during rename
    in libsmbclient; (bso#14938);
  * Fix ldap simple bind with TLS auditing; (bso#14996);
  * net ads info shows LDAP Server: 0.0.0.0 depending on contacted
    server; (bso#14674);
  * Problem when winbind renews Kerberos; (bso#14979);
    (bsc#1196224);
  * pam_winbind will not allow gdm login if password about to
    expire; (bso#8691);
  * virusfilter_vfs_openat: Not scanned: Directory or special file;
    (bso#14971);
  * DFS fix for AIX broken; (bso#13631);
  * Solaris and AIX acl modules: wrong function arguments;
    (bso#14974);
  * Function aixacl_sys_acl_get_file not declared / coredump;
    (bso#7239);
  * Regression: Samba 4.15.2 on macOS segfaults intermittently
    during strcpy in tdbsam_getsampwnam; (bso#14900);
  * Fix a use-after-free in SMB1 server; (bso#14989);
  * smb2_signing_decrypt_pdu() may not decrypt with
    gnutls_aead_cipher_decrypt() from gnutls before 3.5.2;
    (bso#14968);
  * Changing the machine password against an RODC likely destroys
    the domain join; (bso#14984);
  * authsam_make_user_info_dc() steals memory from its struct
    ldb_message *msg argument; (bso#14993);
  * Use Heimdal 8.0 (pre) rather than an earlier snapshot;
    (bso#14995);
  * Samba autorid fails to map AD users if id rangesize fits in the
    id range only once; (bso#14967);</changelog>
  <changelog author="scabrero@suse.de" date="1649678400">- Add missing samba-libs requirement to samba-winbind package;
  (bsc#1198255);</changelog>
  <changelog author="scabrero@suse.de" date="1651060800">- Add provides to samba-client-libs package to fix upgrades from
  previous versions; (bsc#1197995);</changelog>
  <changelog author="scabrero@suse.de" date="1651060801">- Update to 4.15.7
  * Share and server swapped in smbget password prompt; (bso#14831);
  * Durable handles won't reconnect if the leased file is written
    to; (bso#15022);
  * rmdir silently fails if directory contains unreadable files and
    hide unreadable is yes; (bso#15023);
  * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information
    on renamed file handle; (bso#15038);
  * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback;
    (bso#14957);
  * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes;
    (bso#15035);
  * PAM Kerberos authentication incorrectly fails with a clock skew
    error; (bso#15046);
  * username map - samba erroneously applies unix group memberships
    to user account entries; (bso#15041);
  * NT_STATUS_ACCESS_DENIED translates into EPERM instead of EACCES
    in SMBC_server_internal; (bso#14983);
  * Simple bind doesn't work against an RODC (with non-preloaded users);
    (bso#13879);
  * Crash of winbind on RODC; (bso#14641);
  * uncached logon on RODC always fails once; (bso#14865);
  * KVNO off by 100000; (bso#14951);
  * LDAP simple binds should honour "old password allowed period";
    (bso#15001);
  * wbinfo -a doesn't work reliable with upn names; (bso#15003);
  * Simple bind doesn't work against an RODC (with non-preloaded
    users); (bso#13879);
  * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027);
  * Regression: create krb5 conf = yes doesn't work with a single KDC;
    (bso#15016);</changelog>
  <changelog author="scabrero@suse.de" date="1651233600">- Add missing samba-client requirement to samba-winbind package;
  (bsc#1198255);</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Use requires_eq macro to require the libldb2 version available at
  samba-dsdb-modules build time; (bsc#1199362);</changelog>
  <changelog author="scabrero@suse.de" date="1652702400">- Revert NIS support removal; (bsc#1199247);</changelog>
  <changelog author="nopower@suse.com" date="1655726400">- Fix  smbclient commands del &amp; deltree failing with
  NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
  (bsc#1200556).</changelog>
  <changelog author="scabrero@suse.de" date="1657281600">- Update to 4.15.8
  * Use pathref fd instead of io fd in vfs_default_durable_cookie;
    (bso#15042);
  * Setting fruit:resource = stream in vfs_fruit causes a panic;
    (bso#15099);
  * Add support for bind 9.18; (bso#14986);
  * logging dsdb audit to specific files does not work; (bso#15076);
  * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original
    file had been deleted; (bso#15069);
  * netgroups support removed; (bso#15087); (bsc#1199247);
  * net ads info shows LDAP Server: 0.0.0.0 depending on contacted
    server; (bso#14674); (bsc#1199734);
  * waf produces incorrect names for python extensions with Python
    3.11; (bso#15071);
  * smbclient commands del &amp; deltree fail with
    NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
    (bsc#1200556);
  * vfs_gpfs recalls=no option prevents listing files; (bso#15055);
  * waf produces incorrect names for python extensions with Python
    3.11; (bso#15071);
  * Compile error in source3/utils/regedit_hexedit.c; (bso#15091);
  * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link;
    (bso#15108);
  * smbd doesn't handle UPNs for looking up names; (bso#15054);
  * Out-by-4 error in smbd read reply max_send clamp; (bso#14443);
- Move pdb backends from package samba-libs to package
  samba-client-libs and remove samba-libs requirement from
  samba-winbind; (bsc#1200964); (bsc#1198255);
- Use the canonical realm name to refresh the Kerberos tickets;
  (bsc#1196224); (bso#14979);</changelog>
  <changelog author="nopower@suse.com" date="1657800000">- CVE-2022-32746: samba: Use-after-free occurring in database
  audit logging; (bso#15009); (bso#15096); (bsc#1201490).
- CVE-2022-32745: samba: ldb: AD users can crash the server
  process with an LDAP add or modify request; (bso#15008);
  (bso#15096); (bsc#1201492).
- CVE-2022-2031: samba, ldb: AD users can bypass certain
  restrictions associated with changing passwords; (bso#15047);
  (bsc#1201495);
- CVE-2022-32742:SMB1 code does not correct verify SMB1write,
  SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085);
  (bsc#1201496).
- CVE-2022-32744: samba, ldb: AD users can forge password change
  requests for any user; (bso#15074); (bso#15047); (bsc#1201493).</changelog>
</package>
<package pkgid="5db703d3f7150a70147b12d0bc253e7cce6e5846693bfd07da88832f3b1ecda1" name="systemd" arch="aarch64">
  <version epoch="0" ver="246.16" rel="150300.7.48.1"/>
  <changelog author="fbui@suse.com" date="1635422400">- Import commit f2f061f1da064bfd47e2201967a854bb9281ca5b
  98e87fc3fd busctl: use usec granularity for the timestamp printed by the busctl monitor command (jsc#SLE-17798)</changelog>
  <changelog author="mwilck@suse.com" date="1636459200">- Fix IO scheduler udev rules
  * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
    (jsc#SLE-21032, bsc#1192161)
  * 60-io-scheduler.rules: use "none" for multipath components
    (bsc#1192161)</changelog>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
</package>
<package pkgid="07dd5dda318658740b3adb816260a1c28c31fd90935fadd1df164c3214eb7cc4" name="systemd" arch="src">
  <version epoch="0" ver="246.16" rel="150300.7.48.1"/>
  <changelog author="fbui@suse.com" date="1635422400">- Import commit f2f061f1da064bfd47e2201967a854bb9281ca5b
  98e87fc3fd busctl: use usec granularity for the timestamp printed by the busctl monitor command (jsc#SLE-17798)</changelog>
  <changelog author="mwilck@suse.com" date="1636459200">- Fix IO scheduler udev rules
  * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
    (jsc#SLE-21032, bsc#1192161)
  * 60-io-scheduler.rules: use "none" for multipath components
    (bsc#1192161)</changelog>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
</package>
<package pkgid="fc59821e156350ef834f9f03f8b22b9f9b75fdc4b074988f87c25778b9f53d34" name="systemd" arch="x86_64">
  <version epoch="0" ver="246.16" rel="150300.7.48.1"/>
  <changelog author="fbui@suse.com" date="1635422400">- Import commit f2f061f1da064bfd47e2201967a854bb9281ca5b
  98e87fc3fd busctl: use usec granularity for the timestamp printed by the busctl monitor command (jsc#SLE-17798)</changelog>
  <changelog author="mwilck@suse.com" date="1636459200">- Fix IO scheduler udev rules
  * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
    (jsc#SLE-21032, bsc#1192161)
  * 60-io-scheduler.rules: use "none" for multipath components
    (bsc#1192161)</changelog>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
</package>
<package pkgid="71876f619656e0b1e8d81e5618709cc8b5e7af6358984d257ce98208839eaaa4" name="systemd-container" arch="aarch64">
  <version epoch="0" ver="246.16" rel="150300.7.48.1"/>
  <changelog author="fbui@suse.com" date="1635422400">- Import commit f2f061f1da064bfd47e2201967a854bb9281ca5b
  98e87fc3fd busctl: use usec granularity for the timestamp printed by the busctl monitor command (jsc#SLE-17798)</changelog>
  <changelog author="mwilck@suse.com" date="1636459200">- Fix IO scheduler udev rules
  * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
    (jsc#SLE-21032, bsc#1192161)
  * 60-io-scheduler.rules: use "none" for multipath components
    (bsc#1192161)</changelog>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
</package>
<package pkgid="520d170b9bf7fed1a8a4b058f80cf6ff628f8eaa6d24f7c8c8ea20127d1d8974" name="systemd-container" arch="x86_64">
  <version epoch="0" ver="246.16" rel="150300.7.48.1"/>
  <changelog author="fbui@suse.com" date="1635422400">- Import commit f2f061f1da064bfd47e2201967a854bb9281ca5b
  98e87fc3fd busctl: use usec granularity for the timestamp printed by the busctl monitor command (jsc#SLE-17798)</changelog>
  <changelog author="mwilck@suse.com" date="1636459200">- Fix IO scheduler udev rules
  * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
    (jsc#SLE-21032, bsc#1192161)
  * 60-io-scheduler.rules: use "none" for multipath components
    (bsc#1192161)</changelog>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
</package>
<package pkgid="f03ab99fc81db7fd9d522728e7fe93622f5c86a73b721069a6067fc0f135685d" name="systemd-journal-remote" arch="aarch64">
  <version epoch="0" ver="246.16" rel="150300.7.48.1"/>
  <changelog author="fbui@suse.com" date="1635422400">- Import commit f2f061f1da064bfd47e2201967a854bb9281ca5b
  98e87fc3fd busctl: use usec granularity for the timestamp printed by the busctl monitor command (jsc#SLE-17798)</changelog>
  <changelog author="mwilck@suse.com" date="1636459200">- Fix IO scheduler udev rules
  * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
    (jsc#SLE-21032, bsc#1192161)
  * 60-io-scheduler.rules: use "none" for multipath components
    (bsc#1192161)</changelog>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
</package>
<package pkgid="2c34d8bf0ea0dd919b80345e1d2a1d67bd0a4fe99069604c1220d23842eef063" name="systemd-journal-remote" arch="x86_64">
  <version epoch="0" ver="246.16" rel="150300.7.48.1"/>
  <changelog author="fbui@suse.com" date="1635422400">- Import commit f2f061f1da064bfd47e2201967a854bb9281ca5b
  98e87fc3fd busctl: use usec granularity for the timestamp printed by the busctl monitor command (jsc#SLE-17798)</changelog>
  <changelog author="mwilck@suse.com" date="1636459200">- Fix IO scheduler udev rules
  * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
    (jsc#SLE-21032, bsc#1192161)
  * 60-io-scheduler.rules: use "none" for multipath components
    (bsc#1192161)</changelog>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
</package>
<package pkgid="3c84dca143a4bbf98d0082b582643fa5a98e4e6522361571ebbec6723127a56f" name="systemd-sysvinit" arch="aarch64">
  <version epoch="0" ver="246.16" rel="150300.7.48.1"/>
  <changelog author="fbui@suse.com" date="1635422400">- Import commit f2f061f1da064bfd47e2201967a854bb9281ca5b
  98e87fc3fd busctl: use usec granularity for the timestamp printed by the busctl monitor command (jsc#SLE-17798)</changelog>
  <changelog author="mwilck@suse.com" date="1636459200">- Fix IO scheduler udev rules
  * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
    (jsc#SLE-21032, bsc#1192161)
  * 60-io-scheduler.rules: use "none" for multipath components
    (bsc#1192161)</changelog>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
</package>
<package pkgid="11a26b28322a0d89766f52be9277b85f4006a0f5736d5e9852abd26ab9b0af01" name="systemd-sysvinit" arch="x86_64">
  <version epoch="0" ver="246.16" rel="150300.7.48.1"/>
  <changelog author="fbui@suse.com" date="1635422400">- Import commit f2f061f1da064bfd47e2201967a854bb9281ca5b
  98e87fc3fd busctl: use usec granularity for the timestamp printed by the busctl monitor command (jsc#SLE-17798)</changelog>
  <changelog author="mwilck@suse.com" date="1636459200">- Fix IO scheduler udev rules
  * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
    (jsc#SLE-21032, bsc#1192161)
  * 60-io-scheduler.rules: use "none" for multipath components
    (bsc#1192161)</changelog>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
</package>
<package pkgid="cf894ad1d9f059f1d5e6fdf7a8c5641170c06aed4bb4bb2fde520ea5e4708e7c" name="tiff" arch="src">
  <version epoch="0" ver="4.0.9" rel="150000.45.11.1"/>
  <changelog author="mvetter@suse.com" date="1519128000">- bsc#1081690: Add tiff-4.0.9-bsc1081690-CVE-2018-5784.patch
  Fix uncontrolled resource consumption in TIFFSetDirectory</changelog>
  <changelog author="pgajdos@suse.com" date="1526385600">- security update
  * CVE-2018-10963 [bsc#1092949]
    + tiff-CVE-2018-10963.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1526644800">- security update
  * CVE-2017-18013 [bsc#1074317]
    + tiff-CVE-2017-18013.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528113600">- security update
  * CVE-2018-7456 [bsc#1082825]
    + tiff-CVE-2018-7456.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528113601">- security update
  * CVE-2017-11613 [bsc#1082332]
    + tiff-CVE-2017-11613.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528200000">- security update
  * CVE-2018-8905 [bsc#1086408]
    + tiff-CVE-2018-8905.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1534334400">- security update
  * CVE-2018-10779 [bsc#1092480]
    + tiff-CVE-2018-10779.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838400">- security update
  * CVE-2022-1056 [bsc#1197631]
  * CVE-2022-0891 [bsc#1197068]
    + tiff-CVE-2022-1056,CVE-2022-0891.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838401">- security update
  * CVE-2022-0561 [bsc#1195964]
    + tiff-CVE-2022-0561.patch
  * CVE-2022-0562 [bsc#1195965]
    + tiff-CVE-2022-0562.patch
  * CVE-2022-0865 [bsc#1197066]
    + tiff-CVE-2022-0865.patch
  * CVE-2022-0909 [bsc#1197072]
    + tiff-CVE-2022-0909.patch
  * CVE-2022-0924 [bsc#1197073]
    + tiff-CVE-2022-0924.patch
  * CVE-2022-0908 [bsc#1197074]
    + tiff-CVE-2022-0908.patch</changelog>
  <changelog author="mvetter@suse.com" date="1657108800">- security update
  * CVE-2022-2056 [bsc#1201176]
  * CVE-2022-2057 [bsc#1201175]
  * CVE-2022-2058 [bsc#1201174]
    + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch</changelog>
</package>
<package pkgid="65cdee6bda5904876f16b6e4b0d70773c3dc501eb01f970614654f6431d91f37" name="transactional-update" arch="aarch64">
  <version epoch="0" ver="4.0.0~rc3" rel="150300.3.3.1"/>
  <changelog author="iforster@suse.com" date="1615377600">- Version 3.2.1
  - t-u: Forward --quiet option to tukit
  - Regression: Add /opt as bind mount into update environment
  - Remove output indicators of the called command to not tamper
    the result line
  - Fix /etc syncing with --drop-if-no-change</changelog>
  <changelog author="iforster@suse.com" date="1615550400">- Version 3.2.2
  - Don't skip patches with rebootSuggested flag [bsc#1183442]</changelog>
  <changelog author="iforster@suse.com" date="1615550401">- Revert inotify-tools dependency: The package is not available in
  SLE. This will probably have to be implemented as a native C
  version.</changelog>
  <changelog author="iforster@suse.com" date="1616673600">- Version 3.3.0
  - Add support for more package managers by bind mounting their directories
  - Support snapshots without dedicated overlay [boo#1183539], [bsc#1183539]
  - Link RPM database correctly with older zypper versions [boo#1183521]
  - Don't discard manual changes in fstab [boo#1183856], [bsc#1192302]</changelog>
  <changelog author="iforster@suse.com" date="1623585600">- Version 3.4.0
  - Apply SElinux context on /etc in transaction [boo#1185625], [boo#1185766]
    [bsc#1186842], [boo#1186775]
  - Implement inotify handling in C instead of Bash; this makes the
  - -drop-if-no-change option work on SLE Micro [bsc#1184529]
  - Use `tukit call` for up, dup and patch to allow resuming an update after
    zypper updated itself in the snapshot [bsc#1185226]
  - Fix obsolete output type messages in initrd [boo#1177149]
  - Make different base snapshot warning more visible [bsc#1185224]</changelog>
  <changelog author="iforster@suse.com" date="1627905600">- Version 3.5.0
  - Add alias setDiscardIfUnchanged for setDiscard. The old method name
    wasn't really clear and will be removed if we should have an API break
    in the future
  - Replace mkinitrd with direct dracut call [boo#1186213]
  - tukit: Add configuration file support (/etc/tukit.conf)
  - Allow users to configure additional bind mounts (see /usr/etc/tukit.conf
    for an example and limitations) [bsc#1188322]
  - Add 'transactional-update status' call. This is a POC for obtaining a
    hash of a system to verify its integrity. The functionality is still
    experimental!
  - Internal bugfixes / optimizations</changelog>
  <changelog author="iforster@suse.com" date="1627992000">- Add tukit.conf to spec file</changelog>
  <changelog author="iforster@suse.com" date="1627992001">- Version 3.5.1
  - t-u: Disable status file generation by default
    The new experimental `status` command requires the availability of
    /etc/YaST2/control.xml, which is not present on all systems. Hide the
    creation of the corresponding status file behind a new EXPERIMENTAL_STATUS
    option to try out this functionality.
  - Increase library version</changelog>
  <changelog author="iforster@suse.com" date="1630324800">- Version 3.5.2
  - tukit: Fix overlay syncing errors with SELinux [bsc#1188648]
  - Don't print message for `shell` with --quiet
    [gh#openSUSE/transactional-update#69]</changelog>
  <changelog author="iforster@suse.com" date="1630929600">- Version 3.5.3
  - t-u: Purge kernels as part of package operations
    Required for live patching support [bsc#1189728]</changelog>
  <changelog author="iforster@suse.com" date="1631361600">- Version 3.5.4
  - tukit: Fix resolved support [boo#1190383]</changelog>
  <changelog author="iforster@suse.com" date="1631880000">- Version 3.5.5
  - t-u: Use tukit for SUSEConnect call [bsc#1190574]
    Correctly registers repositories</changelog>
  <changelog author="iforster@suse.com" date="1632398400">- Version 3.5.6
  - tukit: Add S/390 bootloader support [bsc#1189807]
  - t-u: support purge-kernels with t-u patch [bsc#1190788]</changelog>
  <changelog author="iforster@suse.com" date="1634040000">- Version 3.5.7
  Various fixes affecting Salt support:
  - t-u: Don't squash stderr messages into stdout
  - t-u: Correctly handle case when the snapshot has been deleted due to
    using --drop-if-no-change: Don't show reboot messages and avoid an awk
    error message [bsc#1191475]
  - tukit: Make inotify handler less sensitive / ignore more directories
    [bsc#1191475]</changelog>
  <changelog author="iforster@suse.com" date="1634904000">- Version 3.6.0
  - Simplify mount hierarchy by just using a single slave bind
    mount as the root of the update environment; this may avoid the
    error messages of failed unmounts
    May fix [boo#1191945]</changelog>
  <changelog author="iforster@suse.com" date="1636545600">- Version 3.6.1
  - Fix rsyncing /etc into the running system with
  - -drop-if-no-change [bsc#1192242]</changelog>
  <changelog author="iforster@suse.com" date="1637323200">- Version 3.6.2
  - Bind mount root file system snapshot on itself, this makes the
    temporary directory in /tmp unnecessary; also fixes [boo#1188110]
    to return the correct snapshot's working directory via API call.
  - Use separate mount namespace for transactional-update; this should
    fix several applications that fail to run if a mount point has the
    'unbindable' mount flag set</changelog>
  <changelog author="iforster@suse.com" date="1637582400">- Version 4.0.0~rc1
  This release is API, but not ABI compatible with previous releases;
  existing applications will have to be recompiled against this new version.
  Major features:
  - Introduces a D-Bus service to access the libtukit API via the
    org.opensuse.tukit.Transaction interface
  - Introduces a C binding via libtukit.h.
  Other changes:
  - t-u: Rework --quiet handling to make sure no output is shown even in
    error cases; this is necessary for automation, e.g. with Salt.
    [gh#openSUSE/transactional-update#73]
  - tukit: Allow storing command output into variable by introducing a new
    optional parameter for "execute" and "callExt".
  - Replace multiple and non-standalone occurenses of {} in "callExt"
    argument.
  - Split transactional-update.timer into transactional-update.timer
    and transactional-update-cleanup.timer; the later will clean up
    old snapshots even when the system does not do automatic updates.
  - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged".
  - Throw exception if snapshot is not found.
  - Fix various compiler warnings
- Update spec file:
  - Include tukitd D-Bus daemon
  - Only install one version of the library (as there are no breaking API
    changes yet)
  - Add %pre scriplets for systemd services
  - Replace %systemd_postun scriptlets with %systemd_postun_with_restart
    to satisfy rpmlint checks
  - Add transactional-update log file as %ghost file</changelog>
  <changelog author="iforster@suse.com" date="1646568000">- Version 4.0.0~rc2
  - Fix missing prompt in "shell" command [bsc#1196580]
  - Add output of tukit commands to log file
  - Fix compilation error with GCC12 [boo#1194876]
  - Fixed (non-critical) security review comments [boo#1196149]
  - Fixed selfupdate
  - Code cleanup</changelog>
  <changelog author="iforster@suse.com" date="1651579200">- Version 4.0.0~rc3
  - Add Snapshot interface
  - Reworked signal handling: All public signals are sent from the
    main thread now, keeping the same sender for everything
  - Implement D-Bus call "Execute" for Transactions
  - Implement interface for listing Snapshots
  - Implement Reboot interface
  - Fix bug when using --continue on old snapshots
  - Fix hypothetical integer overflow in snapshot list [bsc#1196826]
  - Fix wrong sort order in status command
    [gh#openSUSE/transactional-update#80]</changelog>
</package>
<package pkgid="f53af137094ad46335c5339cc86b876810dd546a0187edaad68f6928a0becae2" name="transactional-update" arch="src">
  <version epoch="0" ver="4.0.0~rc3" rel="150300.3.3.1"/>
  <changelog author="iforster@suse.com" date="1615377600">- Version 3.2.1
  - t-u: Forward --quiet option to tukit
  - Regression: Add /opt as bind mount into update environment
  - Remove output indicators of the called command to not tamper
    the result line
  - Fix /etc syncing with --drop-if-no-change</changelog>
  <changelog author="iforster@suse.com" date="1615550400">- Version 3.2.2
  - Don't skip patches with rebootSuggested flag [bsc#1183442]</changelog>
  <changelog author="iforster@suse.com" date="1615550401">- Revert inotify-tools dependency: The package is not available in
  SLE. This will probably have to be implemented as a native C
  version.</changelog>
  <changelog author="iforster@suse.com" date="1616673600">- Version 3.3.0
  - Add support for more package managers by bind mounting their directories
  - Support snapshots without dedicated overlay [boo#1183539], [bsc#1183539]
  - Link RPM database correctly with older zypper versions [boo#1183521]
  - Don't discard manual changes in fstab [boo#1183856], [bsc#1192302]</changelog>
  <changelog author="iforster@suse.com" date="1623585600">- Version 3.4.0
  - Apply SElinux context on /etc in transaction [boo#1185625], [boo#1185766]
    [bsc#1186842], [boo#1186775]
  - Implement inotify handling in C instead of Bash; this makes the
  - -drop-if-no-change option work on SLE Micro [bsc#1184529]
  - Use `tukit call` for up, dup and patch to allow resuming an update after
    zypper updated itself in the snapshot [bsc#1185226]
  - Fix obsolete output type messages in initrd [boo#1177149]
  - Make different base snapshot warning more visible [bsc#1185224]</changelog>
  <changelog author="iforster@suse.com" date="1627905600">- Version 3.5.0
  - Add alias setDiscardIfUnchanged for setDiscard. The old method name
    wasn't really clear and will be removed if we should have an API break
    in the future
  - Replace mkinitrd with direct dracut call [boo#1186213]
  - tukit: Add configuration file support (/etc/tukit.conf)
  - Allow users to configure additional bind mounts (see /usr/etc/tukit.conf
    for an example and limitations) [bsc#1188322]
  - Add 'transactional-update status' call. This is a POC for obtaining a
    hash of a system to verify its integrity. The functionality is still
    experimental!
  - Internal bugfixes / optimizations</changelog>
  <changelog author="iforster@suse.com" date="1627992000">- Add tukit.conf to spec file</changelog>
  <changelog author="iforster@suse.com" date="1627992001">- Version 3.5.1
  - t-u: Disable status file generation by default
    The new experimental `status` command requires the availability of
    /etc/YaST2/control.xml, which is not present on all systems. Hide the
    creation of the corresponding status file behind a new EXPERIMENTAL_STATUS
    option to try out this functionality.
  - Increase library version</changelog>
  <changelog author="iforster@suse.com" date="1630324800">- Version 3.5.2
  - tukit: Fix overlay syncing errors with SELinux [bsc#1188648]
  - Don't print message for `shell` with --quiet
    [gh#openSUSE/transactional-update#69]</changelog>
  <changelog author="iforster@suse.com" date="1630929600">- Version 3.5.3
  - t-u: Purge kernels as part of package operations
    Required for live patching support [bsc#1189728]</changelog>
  <changelog author="iforster@suse.com" date="1631361600">- Version 3.5.4
  - tukit: Fix resolved support [boo#1190383]</changelog>
  <changelog author="iforster@suse.com" date="1631880000">- Version 3.5.5
  - t-u: Use tukit for SUSEConnect call [bsc#1190574]
    Correctly registers repositories</changelog>
  <changelog author="iforster@suse.com" date="1632398400">- Version 3.5.6
  - tukit: Add S/390 bootloader support [bsc#1189807]
  - t-u: support purge-kernels with t-u patch [bsc#1190788]</changelog>
  <changelog author="iforster@suse.com" date="1634040000">- Version 3.5.7
  Various fixes affecting Salt support:
  - t-u: Don't squash stderr messages into stdout
  - t-u: Correctly handle case when the snapshot has been deleted due to
    using --drop-if-no-change: Don't show reboot messages and avoid an awk
    error message [bsc#1191475]
  - tukit: Make inotify handler less sensitive / ignore more directories
    [bsc#1191475]</changelog>
  <changelog author="iforster@suse.com" date="1634904000">- Version 3.6.0
  - Simplify mount hierarchy by just using a single slave bind
    mount as the root of the update environment; this may avoid the
    error messages of failed unmounts
    May fix [boo#1191945]</changelog>
  <changelog author="iforster@suse.com" date="1636545600">- Version 3.6.1
  - Fix rsyncing /etc into the running system with
  - -drop-if-no-change [bsc#1192242]</changelog>
  <changelog author="iforster@suse.com" date="1637323200">- Version 3.6.2
  - Bind mount root file system snapshot on itself, this makes the
    temporary directory in /tmp unnecessary; also fixes [boo#1188110]
    to return the correct snapshot's working directory via API call.
  - Use separate mount namespace for transactional-update; this should
    fix several applications that fail to run if a mount point has the
    'unbindable' mount flag set</changelog>
  <changelog author="iforster@suse.com" date="1637582400">- Version 4.0.0~rc1
  This release is API, but not ABI compatible with previous releases;
  existing applications will have to be recompiled against this new version.
  Major features:
  - Introduces a D-Bus service to access the libtukit API via the
    org.opensuse.tukit.Transaction interface
  - Introduces a C binding via libtukit.h.
  Other changes:
  - t-u: Rework --quiet handling to make sure no output is shown even in
    error cases; this is necessary for automation, e.g. with Salt.
    [gh#openSUSE/transactional-update#73]
  - tukit: Allow storing command output into variable by introducing a new
    optional parameter for "execute" and "callExt".
  - Replace multiple and non-standalone occurenses of {} in "callExt"
    argument.
  - Split transactional-update.timer into transactional-update.timer
    and transactional-update-cleanup.timer; the later will clean up
    old snapshots even when the system does not do automatic updates.
  - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged".
  - Throw exception if snapshot is not found.
  - Fix various compiler warnings
- Update spec file:
  - Include tukitd D-Bus daemon
  - Only install one version of the library (as there are no breaking API
    changes yet)
  - Add %pre scriplets for systemd services
  - Replace %systemd_postun scriptlets with %systemd_postun_with_restart
    to satisfy rpmlint checks
  - Add transactional-update log file as %ghost file</changelog>
  <changelog author="iforster@suse.com" date="1646568000">- Version 4.0.0~rc2
  - Fix missing prompt in "shell" command [bsc#1196580]
  - Add output of tukit commands to log file
  - Fix compilation error with GCC12 [boo#1194876]
  - Fixed (non-critical) security review comments [boo#1196149]
  - Fixed selfupdate
  - Code cleanup</changelog>
  <changelog author="iforster@suse.com" date="1651579200">- Version 4.0.0~rc3
  - Add Snapshot interface
  - Reworked signal handling: All public signals are sent from the
    main thread now, keeping the same sender for everything
  - Implement D-Bus call "Execute" for Transactions
  - Implement interface for listing Snapshots
  - Implement Reboot interface
  - Fix bug when using --continue on old snapshots
  - Fix hypothetical integer overflow in snapshot list [bsc#1196826]
  - Fix wrong sort order in status command
    [gh#openSUSE/transactional-update#80]</changelog>
</package>
<package pkgid="503008f85fed6a4579aedba04ae014712c62313b19ee8488350ce486f6b6894d" name="transactional-update" arch="x86_64">
  <version epoch="0" ver="4.0.0~rc3" rel="150300.3.3.1"/>
  <changelog author="iforster@suse.com" date="1615377600">- Version 3.2.1
  - t-u: Forward --quiet option to tukit
  - Regression: Add /opt as bind mount into update environment
  - Remove output indicators of the called command to not tamper
    the result line
  - Fix /etc syncing with --drop-if-no-change</changelog>
  <changelog author="iforster@suse.com" date="1615550400">- Version 3.2.2
  - Don't skip patches with rebootSuggested flag [bsc#1183442]</changelog>
  <changelog author="iforster@suse.com" date="1615550401">- Revert inotify-tools dependency: The package is not available in
  SLE. This will probably have to be implemented as a native C
  version.</changelog>
  <changelog author="iforster@suse.com" date="1616673600">- Version 3.3.0
  - Add support for more package managers by bind mounting their directories
  - Support snapshots without dedicated overlay [boo#1183539], [bsc#1183539]
  - Link RPM database correctly with older zypper versions [boo#1183521]
  - Don't discard manual changes in fstab [boo#1183856], [bsc#1192302]</changelog>
  <changelog author="iforster@suse.com" date="1623585600">- Version 3.4.0
  - Apply SElinux context on /etc in transaction [boo#1185625], [boo#1185766]
    [bsc#1186842], [boo#1186775]
  - Implement inotify handling in C instead of Bash; this makes the
  - -drop-if-no-change option work on SLE Micro [bsc#1184529]
  - Use `tukit call` for up, dup and patch to allow resuming an update after
    zypper updated itself in the snapshot [bsc#1185226]
  - Fix obsolete output type messages in initrd [boo#1177149]
  - Make different base snapshot warning more visible [bsc#1185224]</changelog>
  <changelog author="iforster@suse.com" date="1627905600">- Version 3.5.0
  - Add alias setDiscardIfUnchanged for setDiscard. The old method name
    wasn't really clear and will be removed if we should have an API break
    in the future
  - Replace mkinitrd with direct dracut call [boo#1186213]
  - tukit: Add configuration file support (/etc/tukit.conf)
  - Allow users to configure additional bind mounts (see /usr/etc/tukit.conf
    for an example and limitations) [bsc#1188322]
  - Add 'transactional-update status' call. This is a POC for obtaining a
    hash of a system to verify its integrity. The functionality is still
    experimental!
  - Internal bugfixes / optimizations</changelog>
  <changelog author="iforster@suse.com" date="1627992000">- Add tukit.conf to spec file</changelog>
  <changelog author="iforster@suse.com" date="1627992001">- Version 3.5.1
  - t-u: Disable status file generation by default
    The new experimental `status` command requires the availability of
    /etc/YaST2/control.xml, which is not present on all systems. Hide the
    creation of the corresponding status file behind a new EXPERIMENTAL_STATUS
    option to try out this functionality.
  - Increase library version</changelog>
  <changelog author="iforster@suse.com" date="1630324800">- Version 3.5.2
  - tukit: Fix overlay syncing errors with SELinux [bsc#1188648]
  - Don't print message for `shell` with --quiet
    [gh#openSUSE/transactional-update#69]</changelog>
  <changelog author="iforster@suse.com" date="1630929600">- Version 3.5.3
  - t-u: Purge kernels as part of package operations
    Required for live patching support [bsc#1189728]</changelog>
  <changelog author="iforster@suse.com" date="1631361600">- Version 3.5.4
  - tukit: Fix resolved support [boo#1190383]</changelog>
  <changelog author="iforster@suse.com" date="1631880000">- Version 3.5.5
  - t-u: Use tukit for SUSEConnect call [bsc#1190574]
    Correctly registers repositories</changelog>
  <changelog author="iforster@suse.com" date="1632398400">- Version 3.5.6
  - tukit: Add S/390 bootloader support [bsc#1189807]
  - t-u: support purge-kernels with t-u patch [bsc#1190788]</changelog>
  <changelog author="iforster@suse.com" date="1634040000">- Version 3.5.7
  Various fixes affecting Salt support:
  - t-u: Don't squash stderr messages into stdout
  - t-u: Correctly handle case when the snapshot has been deleted due to
    using --drop-if-no-change: Don't show reboot messages and avoid an awk
    error message [bsc#1191475]
  - tukit: Make inotify handler less sensitive / ignore more directories
    [bsc#1191475]</changelog>
  <changelog author="iforster@suse.com" date="1634904000">- Version 3.6.0
  - Simplify mount hierarchy by just using a single slave bind
    mount as the root of the update environment; this may avoid the
    error messages of failed unmounts
    May fix [boo#1191945]</changelog>
  <changelog author="iforster@suse.com" date="1636545600">- Version 3.6.1
  - Fix rsyncing /etc into the running system with
  - -drop-if-no-change [bsc#1192242]</changelog>
  <changelog author="iforster@suse.com" date="1637323200">- Version 3.6.2
  - Bind mount root file system snapshot on itself, this makes the
    temporary directory in /tmp unnecessary; also fixes [boo#1188110]
    to return the correct snapshot's working directory via API call.
  - Use separate mount namespace for transactional-update; this should
    fix several applications that fail to run if a mount point has the
    'unbindable' mount flag set</changelog>
  <changelog author="iforster@suse.com" date="1637582400">- Version 4.0.0~rc1
  This release is API, but not ABI compatible with previous releases;
  existing applications will have to be recompiled against this new version.
  Major features:
  - Introduces a D-Bus service to access the libtukit API via the
    org.opensuse.tukit.Transaction interface
  - Introduces a C binding via libtukit.h.
  Other changes:
  - t-u: Rework --quiet handling to make sure no output is shown even in
    error cases; this is necessary for automation, e.g. with Salt.
    [gh#openSUSE/transactional-update#73]
  - tukit: Allow storing command output into variable by introducing a new
    optional parameter for "execute" and "callExt".
  - Replace multiple and non-standalone occurenses of {} in "callExt"
    argument.
  - Split transactional-update.timer into transactional-update.timer
    and transactional-update-cleanup.timer; the later will clean up
    old snapshots even when the system does not do automatic updates.
  - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged".
  - Throw exception if snapshot is not found.
  - Fix various compiler warnings
- Update spec file:
  - Include tukitd D-Bus daemon
  - Only install one version of the library (as there are no breaking API
    changes yet)
  - Add %pre scriplets for systemd services
  - Replace %systemd_postun scriptlets with %systemd_postun_with_restart
    to satisfy rpmlint checks
  - Add transactional-update log file as %ghost file</changelog>
  <changelog author="iforster@suse.com" date="1646568000">- Version 4.0.0~rc2
  - Fix missing prompt in "shell" command [bsc#1196580]
  - Add output of tukit commands to log file
  - Fix compilation error with GCC12 [boo#1194876]
  - Fixed (non-critical) security review comments [boo#1196149]
  - Fixed selfupdate
  - Code cleanup</changelog>
  <changelog author="iforster@suse.com" date="1651579200">- Version 4.0.0~rc3
  - Add Snapshot interface
  - Reworked signal handling: All public signals are sent from the
    main thread now, keeping the same sender for everything
  - Implement D-Bus call "Execute" for Transactions
  - Implement interface for listing Snapshots
  - Implement Reboot interface
  - Fix bug when using --continue on old snapshots
  - Fix hypothetical integer overflow in snapshot list [bsc#1196826]
  - Fix wrong sort order in status command
    [gh#openSUSE/transactional-update#80]</changelog>
</package>
<package pkgid="bc9ed64ea8be10792752a871f388fa73f21fdb8cffc141e6df2bbe9769e750d2" name="transactional-update-zypp-config" arch="noarch">
  <version epoch="0" ver="4.0.0~rc3" rel="150300.3.3.1"/>
  <changelog author="iforster@suse.com" date="1615377600">- Version 3.2.1
  - t-u: Forward --quiet option to tukit
  - Regression: Add /opt as bind mount into update environment
  - Remove output indicators of the called command to not tamper
    the result line
  - Fix /etc syncing with --drop-if-no-change</changelog>
  <changelog author="iforster@suse.com" date="1615550400">- Version 3.2.2
  - Don't skip patches with rebootSuggested flag [bsc#1183442]</changelog>
  <changelog author="iforster@suse.com" date="1615550401">- Revert inotify-tools dependency: The package is not available in
  SLE. This will probably have to be implemented as a native C
  version.</changelog>
  <changelog author="iforster@suse.com" date="1616673600">- Version 3.3.0
  - Add support for more package managers by bind mounting their directories
  - Support snapshots without dedicated overlay [boo#1183539], [bsc#1183539]
  - Link RPM database correctly with older zypper versions [boo#1183521]
  - Don't discard manual changes in fstab [boo#1183856], [bsc#1192302]</changelog>
  <changelog author="iforster@suse.com" date="1623585600">- Version 3.4.0
  - Apply SElinux context on /etc in transaction [boo#1185625], [boo#1185766]
    [bsc#1186842], [boo#1186775]
  - Implement inotify handling in C instead of Bash; this makes the
  - -drop-if-no-change option work on SLE Micro [bsc#1184529]
  - Use `tukit call` for up, dup and patch to allow resuming an update after
    zypper updated itself in the snapshot [bsc#1185226]
  - Fix obsolete output type messages in initrd [boo#1177149]
  - Make different base snapshot warning more visible [bsc#1185224]</changelog>
  <changelog author="iforster@suse.com" date="1627905600">- Version 3.5.0
  - Add alias setDiscardIfUnchanged for setDiscard. The old method name
    wasn't really clear and will be removed if we should have an API break
    in the future
  - Replace mkinitrd with direct dracut call [boo#1186213]
  - tukit: Add configuration file support (/etc/tukit.conf)
  - Allow users to configure additional bind mounts (see /usr/etc/tukit.conf
    for an example and limitations) [bsc#1188322]
  - Add 'transactional-update status' call. This is a POC for obtaining a
    hash of a system to verify its integrity. The functionality is still
    experimental!
  - Internal bugfixes / optimizations</changelog>
  <changelog author="iforster@suse.com" date="1627992000">- Add tukit.conf to spec file</changelog>
  <changelog author="iforster@suse.com" date="1627992001">- Version 3.5.1
  - t-u: Disable status file generation by default
    The new experimental `status` command requires the availability of
    /etc/YaST2/control.xml, which is not present on all systems. Hide the
    creation of the corresponding status file behind a new EXPERIMENTAL_STATUS
    option to try out this functionality.
  - Increase library version</changelog>
  <changelog author="iforster@suse.com" date="1630324800">- Version 3.5.2
  - tukit: Fix overlay syncing errors with SELinux [bsc#1188648]
  - Don't print message for `shell` with --quiet
    [gh#openSUSE/transactional-update#69]</changelog>
  <changelog author="iforster@suse.com" date="1630929600">- Version 3.5.3
  - t-u: Purge kernels as part of package operations
    Required for live patching support [bsc#1189728]</changelog>
  <changelog author="iforster@suse.com" date="1631361600">- Version 3.5.4
  - tukit: Fix resolved support [boo#1190383]</changelog>
  <changelog author="iforster@suse.com" date="1631880000">- Version 3.5.5
  - t-u: Use tukit for SUSEConnect call [bsc#1190574]
    Correctly registers repositories</changelog>
  <changelog author="iforster@suse.com" date="1632398400">- Version 3.5.6
  - tukit: Add S/390 bootloader support [bsc#1189807]
  - t-u: support purge-kernels with t-u patch [bsc#1190788]</changelog>
  <changelog author="iforster@suse.com" date="1634040000">- Version 3.5.7
  Various fixes affecting Salt support:
  - t-u: Don't squash stderr messages into stdout
  - t-u: Correctly handle case when the snapshot has been deleted due to
    using --drop-if-no-change: Don't show reboot messages and avoid an awk
    error message [bsc#1191475]
  - tukit: Make inotify handler less sensitive / ignore more directories
    [bsc#1191475]</changelog>
  <changelog author="iforster@suse.com" date="1634904000">- Version 3.6.0
  - Simplify mount hierarchy by just using a single slave bind
    mount as the root of the update environment; this may avoid the
    error messages of failed unmounts
    May fix [boo#1191945]</changelog>
  <changelog author="iforster@suse.com" date="1636545600">- Version 3.6.1
  - Fix rsyncing /etc into the running system with
  - -drop-if-no-change [bsc#1192242]</changelog>
  <changelog author="iforster@suse.com" date="1637323200">- Version 3.6.2
  - Bind mount root file system snapshot on itself, this makes the
    temporary directory in /tmp unnecessary; also fixes [boo#1188110]
    to return the correct snapshot's working directory via API call.
  - Use separate mount namespace for transactional-update; this should
    fix several applications that fail to run if a mount point has the
    'unbindable' mount flag set</changelog>
  <changelog author="iforster@suse.com" date="1637582400">- Version 4.0.0~rc1
  This release is API, but not ABI compatible with previous releases;
  existing applications will have to be recompiled against this new version.
  Major features:
  - Introduces a D-Bus service to access the libtukit API via the
    org.opensuse.tukit.Transaction interface
  - Introduces a C binding via libtukit.h.
  Other changes:
  - t-u: Rework --quiet handling to make sure no output is shown even in
    error cases; this is necessary for automation, e.g. with Salt.
    [gh#openSUSE/transactional-update#73]
  - tukit: Allow storing command output into variable by introducing a new
    optional parameter for "execute" and "callExt".
  - Replace multiple and non-standalone occurenses of {} in "callExt"
    argument.
  - Split transactional-update.timer into transactional-update.timer
    and transactional-update-cleanup.timer; the later will clean up
    old snapshots even when the system does not do automatic updates.
  - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged".
  - Throw exception if snapshot is not found.
  - Fix various compiler warnings
- Update spec file:
  - Include tukitd D-Bus daemon
  - Only install one version of the library (as there are no breaking API
    changes yet)
  - Add %pre scriplets for systemd services
  - Replace %systemd_postun scriptlets with %systemd_postun_with_restart
    to satisfy rpmlint checks
  - Add transactional-update log file as %ghost file</changelog>
  <changelog author="iforster@suse.com" date="1646568000">- Version 4.0.0~rc2
  - Fix missing prompt in "shell" command [bsc#1196580]
  - Add output of tukit commands to log file
  - Fix compilation error with GCC12 [boo#1194876]
  - Fixed (non-critical) security review comments [boo#1196149]
  - Fixed selfupdate
  - Code cleanup</changelog>
  <changelog author="iforster@suse.com" date="1651579200">- Version 4.0.0~rc3
  - Add Snapshot interface
  - Reworked signal handling: All public signals are sent from the
    main thread now, keeping the same sender for everything
  - Implement D-Bus call "Execute" for Transactions
  - Implement interface for listing Snapshots
  - Implement Reboot interface
  - Fix bug when using --continue on old snapshots
  - Fix hypothetical integer overflow in snapshot list [bsc#1196826]
  - Fix wrong sort order in status command
    [gh#openSUSE/transactional-update#80]</changelog>
</package>
<package pkgid="58dfe11f42cae9a32d000e90644691b1b4ab5b164cf3b6e3dae9a63456c768b4" name="tukit" arch="aarch64">
  <version epoch="0" ver="4.0.0~rc3" rel="150300.3.3.1"/>
  <changelog author="iforster@suse.com" date="1615377600">- Version 3.2.1
  - t-u: Forward --quiet option to tukit
  - Regression: Add /opt as bind mount into update environment
  - Remove output indicators of the called command to not tamper
    the result line
  - Fix /etc syncing with --drop-if-no-change</changelog>
  <changelog author="iforster@suse.com" date="1615550400">- Version 3.2.2
  - Don't skip patches with rebootSuggested flag [bsc#1183442]</changelog>
  <changelog author="iforster@suse.com" date="1615550401">- Revert inotify-tools dependency: The package is not available in
  SLE. This will probably have to be implemented as a native C
  version.</changelog>
  <changelog author="iforster@suse.com" date="1616673600">- Version 3.3.0
  - Add support for more package managers by bind mounting their directories
  - Support snapshots without dedicated overlay [boo#1183539], [bsc#1183539]
  - Link RPM database correctly with older zypper versions [boo#1183521]
  - Don't discard manual changes in fstab [boo#1183856], [bsc#1192302]</changelog>
  <changelog author="iforster@suse.com" date="1623585600">- Version 3.4.0
  - Apply SElinux context on /etc in transaction [boo#1185625], [boo#1185766]
    [bsc#1186842], [boo#1186775]
  - Implement inotify handling in C instead of Bash; this makes the
  - -drop-if-no-change option work on SLE Micro [bsc#1184529]
  - Use `tukit call` for up, dup and patch to allow resuming an update after
    zypper updated itself in the snapshot [bsc#1185226]
  - Fix obsolete output type messages in initrd [boo#1177149]
  - Make different base snapshot warning more visible [bsc#1185224]</changelog>
  <changelog author="iforster@suse.com" date="1627905600">- Version 3.5.0
  - Add alias setDiscardIfUnchanged for setDiscard. The old method name
    wasn't really clear and will be removed if we should have an API break
    in the future
  - Replace mkinitrd with direct dracut call [boo#1186213]
  - tukit: Add configuration file support (/etc/tukit.conf)
  - Allow users to configure additional bind mounts (see /usr/etc/tukit.conf
    for an example and limitations) [bsc#1188322]
  - Add 'transactional-update status' call. This is a POC for obtaining a
    hash of a system to verify its integrity. The functionality is still
    experimental!
  - Internal bugfixes / optimizations</changelog>
  <changelog author="iforster@suse.com" date="1627992000">- Add tukit.conf to spec file</changelog>
  <changelog author="iforster@suse.com" date="1627992001">- Version 3.5.1
  - t-u: Disable status file generation by default
    The new experimental `status` command requires the availability of
    /etc/YaST2/control.xml, which is not present on all systems. Hide the
    creation of the corresponding status file behind a new EXPERIMENTAL_STATUS
    option to try out this functionality.
  - Increase library version</changelog>
  <changelog author="iforster@suse.com" date="1630324800">- Version 3.5.2
  - tukit: Fix overlay syncing errors with SELinux [bsc#1188648]
  - Don't print message for `shell` with --quiet
    [gh#openSUSE/transactional-update#69]</changelog>
  <changelog author="iforster@suse.com" date="1630929600">- Version 3.5.3
  - t-u: Purge kernels as part of package operations
    Required for live patching support [bsc#1189728]</changelog>
  <changelog author="iforster@suse.com" date="1631361600">- Version 3.5.4
  - tukit: Fix resolved support [boo#1190383]</changelog>
  <changelog author="iforster@suse.com" date="1631880000">- Version 3.5.5
  - t-u: Use tukit for SUSEConnect call [bsc#1190574]
    Correctly registers repositories</changelog>
  <changelog author="iforster@suse.com" date="1632398400">- Version 3.5.6
  - tukit: Add S/390 bootloader support [bsc#1189807]
  - t-u: support purge-kernels with t-u patch [bsc#1190788]</changelog>
  <changelog author="iforster@suse.com" date="1634040000">- Version 3.5.7
  Various fixes affecting Salt support:
  - t-u: Don't squash stderr messages into stdout
  - t-u: Correctly handle case when the snapshot has been deleted due to
    using --drop-if-no-change: Don't show reboot messages and avoid an awk
    error message [bsc#1191475]
  - tukit: Make inotify handler less sensitive / ignore more directories
    [bsc#1191475]</changelog>
  <changelog author="iforster@suse.com" date="1634904000">- Version 3.6.0
  - Simplify mount hierarchy by just using a single slave bind
    mount as the root of the update environment; this may avoid the
    error messages of failed unmounts
    May fix [boo#1191945]</changelog>
  <changelog author="iforster@suse.com" date="1636545600">- Version 3.6.1
  - Fix rsyncing /etc into the running system with
  - -drop-if-no-change [bsc#1192242]</changelog>
  <changelog author="iforster@suse.com" date="1637323200">- Version 3.6.2
  - Bind mount root file system snapshot on itself, this makes the
    temporary directory in /tmp unnecessary; also fixes [boo#1188110]
    to return the correct snapshot's working directory via API call.
  - Use separate mount namespace for transactional-update; this should
    fix several applications that fail to run if a mount point has the
    'unbindable' mount flag set</changelog>
  <changelog author="iforster@suse.com" date="1637582400">- Version 4.0.0~rc1
  This release is API, but not ABI compatible with previous releases;
  existing applications will have to be recompiled against this new version.
  Major features:
  - Introduces a D-Bus service to access the libtukit API via the
    org.opensuse.tukit.Transaction interface
  - Introduces a C binding via libtukit.h.
  Other changes:
  - t-u: Rework --quiet handling to make sure no output is shown even in
    error cases; this is necessary for automation, e.g. with Salt.
    [gh#openSUSE/transactional-update#73]
  - tukit: Allow storing command output into variable by introducing a new
    optional parameter for "execute" and "callExt".
  - Replace multiple and non-standalone occurenses of {} in "callExt"
    argument.
  - Split transactional-update.timer into transactional-update.timer
    and transactional-update-cleanup.timer; the later will clean up
    old snapshots even when the system does not do automatic updates.
  - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged".
  - Throw exception if snapshot is not found.
  - Fix various compiler warnings
- Update spec file:
  - Include tukitd D-Bus daemon
  - Only install one version of the library (as there are no breaking API
    changes yet)
  - Add %pre scriplets for systemd services
  - Replace %systemd_postun scriptlets with %systemd_postun_with_restart
    to satisfy rpmlint checks
  - Add transactional-update log file as %ghost file</changelog>
  <changelog author="iforster@suse.com" date="1646568000">- Version 4.0.0~rc2
  - Fix missing prompt in "shell" command [bsc#1196580]
  - Add output of tukit commands to log file
  - Fix compilation error with GCC12 [boo#1194876]
  - Fixed (non-critical) security review comments [boo#1196149]
  - Fixed selfupdate
  - Code cleanup</changelog>
  <changelog author="iforster@suse.com" date="1651579200">- Version 4.0.0~rc3
  - Add Snapshot interface
  - Reworked signal handling: All public signals are sent from the
    main thread now, keeping the same sender for everything
  - Implement D-Bus call "Execute" for Transactions
  - Implement interface for listing Snapshots
  - Implement Reboot interface
  - Fix bug when using --continue on old snapshots
  - Fix hypothetical integer overflow in snapshot list [bsc#1196826]
  - Fix wrong sort order in status command
    [gh#openSUSE/transactional-update#80]</changelog>
</package>
<package pkgid="be488c28cf5aae1e40267d73610b4b6cce0d38c3f3c620696c6360d568f89ece" name="tukit" arch="x86_64">
  <version epoch="0" ver="4.0.0~rc3" rel="150300.3.3.1"/>
  <changelog author="iforster@suse.com" date="1615377600">- Version 3.2.1
  - t-u: Forward --quiet option to tukit
  - Regression: Add /opt as bind mount into update environment
  - Remove output indicators of the called command to not tamper
    the result line
  - Fix /etc syncing with --drop-if-no-change</changelog>
  <changelog author="iforster@suse.com" date="1615550400">- Version 3.2.2
  - Don't skip patches with rebootSuggested flag [bsc#1183442]</changelog>
  <changelog author="iforster@suse.com" date="1615550401">- Revert inotify-tools dependency: The package is not available in
  SLE. This will probably have to be implemented as a native C
  version.</changelog>
  <changelog author="iforster@suse.com" date="1616673600">- Version 3.3.0
  - Add support for more package managers by bind mounting their directories
  - Support snapshots without dedicated overlay [boo#1183539], [bsc#1183539]
  - Link RPM database correctly with older zypper versions [boo#1183521]
  - Don't discard manual changes in fstab [boo#1183856], [bsc#1192302]</changelog>
  <changelog author="iforster@suse.com" date="1623585600">- Version 3.4.0
  - Apply SElinux context on /etc in transaction [boo#1185625], [boo#1185766]
    [bsc#1186842], [boo#1186775]
  - Implement inotify handling in C instead of Bash; this makes the
  - -drop-if-no-change option work on SLE Micro [bsc#1184529]
  - Use `tukit call` for up, dup and patch to allow resuming an update after
    zypper updated itself in the snapshot [bsc#1185226]
  - Fix obsolete output type messages in initrd [boo#1177149]
  - Make different base snapshot warning more visible [bsc#1185224]</changelog>
  <changelog author="iforster@suse.com" date="1627905600">- Version 3.5.0
  - Add alias setDiscardIfUnchanged for setDiscard. The old method name
    wasn't really clear and will be removed if we should have an API break
    in the future
  - Replace mkinitrd with direct dracut call [boo#1186213]
  - tukit: Add configuration file support (/etc/tukit.conf)
  - Allow users to configure additional bind mounts (see /usr/etc/tukit.conf
    for an example and limitations) [bsc#1188322]
  - Add 'transactional-update status' call. This is a POC for obtaining a
    hash of a system to verify its integrity. The functionality is still
    experimental!
  - Internal bugfixes / optimizations</changelog>
  <changelog author="iforster@suse.com" date="1627992000">- Add tukit.conf to spec file</changelog>
  <changelog author="iforster@suse.com" date="1627992001">- Version 3.5.1
  - t-u: Disable status file generation by default
    The new experimental `status` command requires the availability of
    /etc/YaST2/control.xml, which is not present on all systems. Hide the
    creation of the corresponding status file behind a new EXPERIMENTAL_STATUS
    option to try out this functionality.
  - Increase library version</changelog>
  <changelog author="iforster@suse.com" date="1630324800">- Version 3.5.2
  - tukit: Fix overlay syncing errors with SELinux [bsc#1188648]
  - Don't print message for `shell` with --quiet
    [gh#openSUSE/transactional-update#69]</changelog>
  <changelog author="iforster@suse.com" date="1630929600">- Version 3.5.3
  - t-u: Purge kernels as part of package operations
    Required for live patching support [bsc#1189728]</changelog>
  <changelog author="iforster@suse.com" date="1631361600">- Version 3.5.4
  - tukit: Fix resolved support [boo#1190383]</changelog>
  <changelog author="iforster@suse.com" date="1631880000">- Version 3.5.5
  - t-u: Use tukit for SUSEConnect call [bsc#1190574]
    Correctly registers repositories</changelog>
  <changelog author="iforster@suse.com" date="1632398400">- Version 3.5.6
  - tukit: Add S/390 bootloader support [bsc#1189807]
  - t-u: support purge-kernels with t-u patch [bsc#1190788]</changelog>
  <changelog author="iforster@suse.com" date="1634040000">- Version 3.5.7
  Various fixes affecting Salt support:
  - t-u: Don't squash stderr messages into stdout
  - t-u: Correctly handle case when the snapshot has been deleted due to
    using --drop-if-no-change: Don't show reboot messages and avoid an awk
    error message [bsc#1191475]
  - tukit: Make inotify handler less sensitive / ignore more directories
    [bsc#1191475]</changelog>
  <changelog author="iforster@suse.com" date="1634904000">- Version 3.6.0
  - Simplify mount hierarchy by just using a single slave bind
    mount as the root of the update environment; this may avoid the
    error messages of failed unmounts
    May fix [boo#1191945]</changelog>
  <changelog author="iforster@suse.com" date="1636545600">- Version 3.6.1
  - Fix rsyncing /etc into the running system with
  - -drop-if-no-change [bsc#1192242]</changelog>
  <changelog author="iforster@suse.com" date="1637323200">- Version 3.6.2
  - Bind mount root file system snapshot on itself, this makes the
    temporary directory in /tmp unnecessary; also fixes [boo#1188110]
    to return the correct snapshot's working directory via API call.
  - Use separate mount namespace for transactional-update; this should
    fix several applications that fail to run if a mount point has the
    'unbindable' mount flag set</changelog>
  <changelog author="iforster@suse.com" date="1637582400">- Version 4.0.0~rc1
  This release is API, but not ABI compatible with previous releases;
  existing applications will have to be recompiled against this new version.
  Major features:
  - Introduces a D-Bus service to access the libtukit API via the
    org.opensuse.tukit.Transaction interface
  - Introduces a C binding via libtukit.h.
  Other changes:
  - t-u: Rework --quiet handling to make sure no output is shown even in
    error cases; this is necessary for automation, e.g. with Salt.
    [gh#openSUSE/transactional-update#73]
  - tukit: Allow storing command output into variable by introducing a new
    optional parameter for "execute" and "callExt".
  - Replace multiple and non-standalone occurenses of {} in "callExt"
    argument.
  - Split transactional-update.timer into transactional-update.timer
    and transactional-update-cleanup.timer; the later will clean up
    old snapshots even when the system does not do automatic updates.
  - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged".
  - Throw exception if snapshot is not found.
  - Fix various compiler warnings
- Update spec file:
  - Include tukitd D-Bus daemon
  - Only install one version of the library (as there are no breaking API
    changes yet)
  - Add %pre scriplets for systemd services
  - Replace %systemd_postun scriptlets with %systemd_postun_with_restart
    to satisfy rpmlint checks
  - Add transactional-update log file as %ghost file</changelog>
  <changelog author="iforster@suse.com" date="1646568000">- Version 4.0.0~rc2
  - Fix missing prompt in "shell" command [bsc#1196580]
  - Add output of tukit commands to log file
  - Fix compilation error with GCC12 [boo#1194876]
  - Fixed (non-critical) security review comments [boo#1196149]
  - Fixed selfupdate
  - Code cleanup</changelog>
  <changelog author="iforster@suse.com" date="1651579200">- Version 4.0.0~rc3
  - Add Snapshot interface
  - Reworked signal handling: All public signals are sent from the
    main thread now, keeping the same sender for everything
  - Implement D-Bus call "Execute" for Transactions
  - Implement interface for listing Snapshots
  - Implement Reboot interface
  - Fix bug when using --continue on old snapshots
  - Fix hypothetical integer overflow in snapshot list [bsc#1196826]
  - Fix wrong sort order in status command
    [gh#openSUSE/transactional-update#80]</changelog>
</package>
<package pkgid="e6846c1e603a09c69811d3e6842715cf2d7950452ba248fff984ca5cb91acd0d" name="tukitd" arch="aarch64">
  <version epoch="0" ver="4.0.0~rc3" rel="150300.3.3.1"/>
  <changelog author="iforster@suse.com" date="1615377600">- Version 3.2.1
  - t-u: Forward --quiet option to tukit
  - Regression: Add /opt as bind mount into update environment
  - Remove output indicators of the called command to not tamper
    the result line
  - Fix /etc syncing with --drop-if-no-change</changelog>
  <changelog author="iforster@suse.com" date="1615550400">- Version 3.2.2
  - Don't skip patches with rebootSuggested flag [bsc#1183442]</changelog>
  <changelog author="iforster@suse.com" date="1615550401">- Revert inotify-tools dependency: The package is not available in
  SLE. This will probably have to be implemented as a native C
  version.</changelog>
  <changelog author="iforster@suse.com" date="1616673600">- Version 3.3.0
  - Add support for more package managers by bind mounting their directories
  - Support snapshots without dedicated overlay [boo#1183539], [bsc#1183539]
  - Link RPM database correctly with older zypper versions [boo#1183521]
  - Don't discard manual changes in fstab [boo#1183856], [bsc#1192302]</changelog>
  <changelog author="iforster@suse.com" date="1623585600">- Version 3.4.0
  - Apply SElinux context on /etc in transaction [boo#1185625], [boo#1185766]
    [bsc#1186842], [boo#1186775]
  - Implement inotify handling in C instead of Bash; this makes the
  - -drop-if-no-change option work on SLE Micro [bsc#1184529]
  - Use `tukit call` for up, dup and patch to allow resuming an update after
    zypper updated itself in the snapshot [bsc#1185226]
  - Fix obsolete output type messages in initrd [boo#1177149]
  - Make different base snapshot warning more visible [bsc#1185224]</changelog>
  <changelog author="iforster@suse.com" date="1627905600">- Version 3.5.0
  - Add alias setDiscardIfUnchanged for setDiscard. The old method name
    wasn't really clear and will be removed if we should have an API break
    in the future
  - Replace mkinitrd with direct dracut call [boo#1186213]
  - tukit: Add configuration file support (/etc/tukit.conf)
  - Allow users to configure additional bind mounts (see /usr/etc/tukit.conf
    for an example and limitations) [bsc#1188322]
  - Add 'transactional-update status' call. This is a POC for obtaining a
    hash of a system to verify its integrity. The functionality is still
    experimental!
  - Internal bugfixes / optimizations</changelog>
  <changelog author="iforster@suse.com" date="1627992000">- Add tukit.conf to spec file</changelog>
  <changelog author="iforster@suse.com" date="1627992001">- Version 3.5.1
  - t-u: Disable status file generation by default
    The new experimental `status` command requires the availability of
    /etc/YaST2/control.xml, which is not present on all systems. Hide the
    creation of the corresponding status file behind a new EXPERIMENTAL_STATUS
    option to try out this functionality.
  - Increase library version</changelog>
  <changelog author="iforster@suse.com" date="1630324800">- Version 3.5.2
  - tukit: Fix overlay syncing errors with SELinux [bsc#1188648]
  - Don't print message for `shell` with --quiet
    [gh#openSUSE/transactional-update#69]</changelog>
  <changelog author="iforster@suse.com" date="1630929600">- Version 3.5.3
  - t-u: Purge kernels as part of package operations
    Required for live patching support [bsc#1189728]</changelog>
  <changelog author="iforster@suse.com" date="1631361600">- Version 3.5.4
  - tukit: Fix resolved support [boo#1190383]</changelog>
  <changelog author="iforster@suse.com" date="1631880000">- Version 3.5.5
  - t-u: Use tukit for SUSEConnect call [bsc#1190574]
    Correctly registers repositories</changelog>
  <changelog author="iforster@suse.com" date="1632398400">- Version 3.5.6
  - tukit: Add S/390 bootloader support [bsc#1189807]
  - t-u: support purge-kernels with t-u patch [bsc#1190788]</changelog>
  <changelog author="iforster@suse.com" date="1634040000">- Version 3.5.7
  Various fixes affecting Salt support:
  - t-u: Don't squash stderr messages into stdout
  - t-u: Correctly handle case when the snapshot has been deleted due to
    using --drop-if-no-change: Don't show reboot messages and avoid an awk
    error message [bsc#1191475]
  - tukit: Make inotify handler less sensitive / ignore more directories
    [bsc#1191475]</changelog>
  <changelog author="iforster@suse.com" date="1634904000">- Version 3.6.0
  - Simplify mount hierarchy by just using a single slave bind
    mount as the root of the update environment; this may avoid the
    error messages of failed unmounts
    May fix [boo#1191945]</changelog>
  <changelog author="iforster@suse.com" date="1636545600">- Version 3.6.1
  - Fix rsyncing /etc into the running system with
  - -drop-if-no-change [bsc#1192242]</changelog>
  <changelog author="iforster@suse.com" date="1637323200">- Version 3.6.2
  - Bind mount root file system snapshot on itself, this makes the
    temporary directory in /tmp unnecessary; also fixes [boo#1188110]
    to return the correct snapshot's working directory via API call.
  - Use separate mount namespace for transactional-update; this should
    fix several applications that fail to run if a mount point has the
    'unbindable' mount flag set</changelog>
  <changelog author="iforster@suse.com" date="1637582400">- Version 4.0.0~rc1
  This release is API, but not ABI compatible with previous releases;
  existing applications will have to be recompiled against this new version.
  Major features:
  - Introduces a D-Bus service to access the libtukit API via the
    org.opensuse.tukit.Transaction interface
  - Introduces a C binding via libtukit.h.
  Other changes:
  - t-u: Rework --quiet handling to make sure no output is shown even in
    error cases; this is necessary for automation, e.g. with Salt.
    [gh#openSUSE/transactional-update#73]
  - tukit: Allow storing command output into variable by introducing a new
    optional parameter for "execute" and "callExt".
  - Replace multiple and non-standalone occurenses of {} in "callExt"
    argument.
  - Split transactional-update.timer into transactional-update.timer
    and transactional-update-cleanup.timer; the later will clean up
    old snapshots even when the system does not do automatic updates.
  - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged".
  - Throw exception if snapshot is not found.
  - Fix various compiler warnings
- Update spec file:
  - Include tukitd D-Bus daemon
  - Only install one version of the library (as there are no breaking API
    changes yet)
  - Add %pre scriplets for systemd services
  - Replace %systemd_postun scriptlets with %systemd_postun_with_restart
    to satisfy rpmlint checks
  - Add transactional-update log file as %ghost file</changelog>
  <changelog author="iforster@suse.com" date="1646568000">- Version 4.0.0~rc2
  - Fix missing prompt in "shell" command [bsc#1196580]
  - Add output of tukit commands to log file
  - Fix compilation error with GCC12 [boo#1194876]
  - Fixed (non-critical) security review comments [boo#1196149]
  - Fixed selfupdate
  - Code cleanup</changelog>
  <changelog author="iforster@suse.com" date="1651579200">- Version 4.0.0~rc3
  - Add Snapshot interface
  - Reworked signal handling: All public signals are sent from the
    main thread now, keeping the same sender for everything
  - Implement D-Bus call "Execute" for Transactions
  - Implement interface for listing Snapshots
  - Implement Reboot interface
  - Fix bug when using --continue on old snapshots
  - Fix hypothetical integer overflow in snapshot list [bsc#1196826]
  - Fix wrong sort order in status command
    [gh#openSUSE/transactional-update#80]</changelog>
</package>
<package pkgid="439592d22214c9fec026423f4bfd560ecef734c9e63e558e818c3d8a0b1ae939" name="tukitd" arch="x86_64">
  <version epoch="0" ver="4.0.0~rc3" rel="150300.3.3.1"/>
  <changelog author="iforster@suse.com" date="1615377600">- Version 3.2.1
  - t-u: Forward --quiet option to tukit
  - Regression: Add /opt as bind mount into update environment
  - Remove output indicators of the called command to not tamper
    the result line
  - Fix /etc syncing with --drop-if-no-change</changelog>
  <changelog author="iforster@suse.com" date="1615550400">- Version 3.2.2
  - Don't skip patches with rebootSuggested flag [bsc#1183442]</changelog>
  <changelog author="iforster@suse.com" date="1615550401">- Revert inotify-tools dependency: The package is not available in
  SLE. This will probably have to be implemented as a native C
  version.</changelog>
  <changelog author="iforster@suse.com" date="1616673600">- Version 3.3.0
  - Add support for more package managers by bind mounting their directories
  - Support snapshots without dedicated overlay [boo#1183539], [bsc#1183539]
  - Link RPM database correctly with older zypper versions [boo#1183521]
  - Don't discard manual changes in fstab [boo#1183856], [bsc#1192302]</changelog>
  <changelog author="iforster@suse.com" date="1623585600">- Version 3.4.0
  - Apply SElinux context on /etc in transaction [boo#1185625], [boo#1185766]
    [bsc#1186842], [boo#1186775]
  - Implement inotify handling in C instead of Bash; this makes the
  - -drop-if-no-change option work on SLE Micro [bsc#1184529]
  - Use `tukit call` for up, dup and patch to allow resuming an update after
    zypper updated itself in the snapshot [bsc#1185226]
  - Fix obsolete output type messages in initrd [boo#1177149]
  - Make different base snapshot warning more visible [bsc#1185224]</changelog>
  <changelog author="iforster@suse.com" date="1627905600">- Version 3.5.0
  - Add alias setDiscardIfUnchanged for setDiscard. The old method name
    wasn't really clear and will be removed if we should have an API break
    in the future
  - Replace mkinitrd with direct dracut call [boo#1186213]
  - tukit: Add configuration file support (/etc/tukit.conf)
  - Allow users to configure additional bind mounts (see /usr/etc/tukit.conf
    for an example and limitations) [bsc#1188322]
  - Add 'transactional-update status' call. This is a POC for obtaining a
    hash of a system to verify its integrity. The functionality is still
    experimental!
  - Internal bugfixes / optimizations</changelog>
  <changelog author="iforster@suse.com" date="1627992000">- Add tukit.conf to spec file</changelog>
  <changelog author="iforster@suse.com" date="1627992001">- Version 3.5.1
  - t-u: Disable status file generation by default
    The new experimental `status` command requires the availability of
    /etc/YaST2/control.xml, which is not present on all systems. Hide the
    creation of the corresponding status file behind a new EXPERIMENTAL_STATUS
    option to try out this functionality.
  - Increase library version</changelog>
  <changelog author="iforster@suse.com" date="1630324800">- Version 3.5.2
  - tukit: Fix overlay syncing errors with SELinux [bsc#1188648]
  - Don't print message for `shell` with --quiet
    [gh#openSUSE/transactional-update#69]</changelog>
  <changelog author="iforster@suse.com" date="1630929600">- Version 3.5.3
  - t-u: Purge kernels as part of package operations
    Required for live patching support [bsc#1189728]</changelog>
  <changelog author="iforster@suse.com" date="1631361600">- Version 3.5.4
  - tukit: Fix resolved support [boo#1190383]</changelog>
  <changelog author="iforster@suse.com" date="1631880000">- Version 3.5.5
  - t-u: Use tukit for SUSEConnect call [bsc#1190574]
    Correctly registers repositories</changelog>
  <changelog author="iforster@suse.com" date="1632398400">- Version 3.5.6
  - tukit: Add S/390 bootloader support [bsc#1189807]
  - t-u: support purge-kernels with t-u patch [bsc#1190788]</changelog>
  <changelog author="iforster@suse.com" date="1634040000">- Version 3.5.7
  Various fixes affecting Salt support:
  - t-u: Don't squash stderr messages into stdout
  - t-u: Correctly handle case when the snapshot has been deleted due to
    using --drop-if-no-change: Don't show reboot messages and avoid an awk
    error message [bsc#1191475]
  - tukit: Make inotify handler less sensitive / ignore more directories
    [bsc#1191475]</changelog>
  <changelog author="iforster@suse.com" date="1634904000">- Version 3.6.0
  - Simplify mount hierarchy by just using a single slave bind
    mount as the root of the update environment; this may avoid the
    error messages of failed unmounts
    May fix [boo#1191945]</changelog>
  <changelog author="iforster@suse.com" date="1636545600">- Version 3.6.1
  - Fix rsyncing /etc into the running system with
  - -drop-if-no-change [bsc#1192242]</changelog>
  <changelog author="iforster@suse.com" date="1637323200">- Version 3.6.2
  - Bind mount root file system snapshot on itself, this makes the
    temporary directory in /tmp unnecessary; also fixes [boo#1188110]
    to return the correct snapshot's working directory via API call.
  - Use separate mount namespace for transactional-update; this should
    fix several applications that fail to run if a mount point has the
    'unbindable' mount flag set</changelog>
  <changelog author="iforster@suse.com" date="1637582400">- Version 4.0.0~rc1
  This release is API, but not ABI compatible with previous releases;
  existing applications will have to be recompiled against this new version.
  Major features:
  - Introduces a D-Bus service to access the libtukit API via the
    org.opensuse.tukit.Transaction interface
  - Introduces a C binding via libtukit.h.
  Other changes:
  - t-u: Rework --quiet handling to make sure no output is shown even in
    error cases; this is necessary for automation, e.g. with Salt.
    [gh#openSUSE/transactional-update#73]
  - tukit: Allow storing command output into variable by introducing a new
    optional parameter for "execute" and "callExt".
  - Replace multiple and non-standalone occurenses of {} in "callExt"
    argument.
  - Split transactional-update.timer into transactional-update.timer
    and transactional-update-cleanup.timer; the later will clean up
    old snapshots even when the system does not do automatic updates.
  - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged".
  - Throw exception if snapshot is not found.
  - Fix various compiler warnings
- Update spec file:
  - Include tukitd D-Bus daemon
  - Only install one version of the library (as there are no breaking API
    changes yet)
  - Add %pre scriplets for systemd services
  - Replace %systemd_postun scriptlets with %systemd_postun_with_restart
    to satisfy rpmlint checks
  - Add transactional-update log file as %ghost file</changelog>
  <changelog author="iforster@suse.com" date="1646568000">- Version 4.0.0~rc2
  - Fix missing prompt in "shell" command [bsc#1196580]
  - Add output of tukit commands to log file
  - Fix compilation error with GCC12 [boo#1194876]
  - Fixed (non-critical) security review comments [boo#1196149]
  - Fixed selfupdate
  - Code cleanup</changelog>
  <changelog author="iforster@suse.com" date="1651579200">- Version 4.0.0~rc3
  - Add Snapshot interface
  - Reworked signal handling: All public signals are sent from the
    main thread now, keeping the same sender for everything
  - Implement D-Bus call "Execute" for Transactions
  - Implement interface for listing Snapshots
  - Implement Reboot interface
  - Fix bug when using --continue on old snapshots
  - Fix hypothetical integer overflow in snapshot list [bsc#1196826]
  - Fix wrong sort order in status command
    [gh#openSUSE/transactional-update#80]</changelog>
</package>
<package pkgid="b5bc538a70bf932a2ea832bc0aa120809f5454d504bc3f409c093efd6308ecd0" name="udev" arch="aarch64">
  <version epoch="0" ver="246.16" rel="150300.7.48.1"/>
  <changelog author="fbui@suse.com" date="1635422400">- Import commit f2f061f1da064bfd47e2201967a854bb9281ca5b
  98e87fc3fd busctl: use usec granularity for the timestamp printed by the busctl monitor command (jsc#SLE-17798)</changelog>
  <changelog author="mwilck@suse.com" date="1636459200">- Fix IO scheduler udev rules
  * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
    (jsc#SLE-21032, bsc#1192161)
  * 60-io-scheduler.rules: use "none" for multipath components
    (bsc#1192161)</changelog>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
</package>
<package pkgid="833abc0653240c11f44249890efe542b8395f2f78c4f3cf2970cb104b84a71b5" name="udev" arch="x86_64">
  <version epoch="0" ver="246.16" rel="150300.7.48.1"/>
  <changelog author="fbui@suse.com" date="1635422400">- Import commit f2f061f1da064bfd47e2201967a854bb9281ca5b
  98e87fc3fd busctl: use usec granularity for the timestamp printed by the busctl monitor command (jsc#SLE-17798)</changelog>
  <changelog author="mwilck@suse.com" date="1636459200">- Fix IO scheduler udev rules
  * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
    (jsc#SLE-21032, bsc#1192161)
  * 60-io-scheduler.rules: use "none" for multipath components
    (bsc#1192161)</changelog>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
</package>
<package pkgid="e3cc79275f06a0bc13fd1676e84eb242cd35de74a83dc179b4d741349451dc78" name="wpa_supplicant" arch="aarch64">
  <version epoch="0" ver="2.9" rel="4.33.1"/>
  <changelog author="kbabioch@suse.com" date="1539259200">- Added rebased-v2.6-0009-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch:
  Ignore unauthenticated encrypted EAPOL-Key data (CVE-2018-14526, bsc#1104205).</changelog>
  <changelog author="kbabioch@suse.com" date="1539345600">- Added wpa-supplicant-log-file-permission.patch: Fixes the default file
  permissions of the debug log file to more sane values, i.e. it is no longer
  world-readable (bsc#1098854).
- Added wpa-supplicant-log-file-cloexec.patch: Open the debug log file with
  O_CLOEXEC, which will prevent file descriptor leaking to child processes
  (bsc#1098854).</changelog>
  <changelog author="ro@suse.de" date="1539604800">- compile eapol_test binary to allow testing via radius proxy and server
  (note: this does not match CONFIG_EAPOL_TEST which sets -Werror
  and activates an assert call inside the code of wpa_supplicant)
  (bsc#1111873), (fate#326725)
- add patch to fix wrong operator precedence in ieee802_11.c
  wpa_supplicant-git-fa67debf4c6ddbc881a212b175faa6d5d0d90c8c.patch
- add patch to avoid redefinition of __bitwise macro
  wpa_supplicant-git-f5b74b966c942feb95a8ddbb7d130540b15b796d.patch</changelog>
  <changelog author="kbabioch@suse.com" date="1539691200">- Renamed patches:
  - wpa-supplicant-log-file-permission.patch -&gt; wpa_supplicant-log-file-permission.patch
  - wpa-supplicant-log-file-cloexec.patch -&gt; wpa_supplicant-log-file-cloexec.patch
- wpa_supplicant-log-file-permission.patch: Using O_WRONLY flag
- Enabled timestamps in log files (bsc#1080798)</changelog>
  <changelog author="ilya@ilya.pp.ua" date="1541160000">- Refresh spec-file: add %license tag.</changelog>
  <changelog author="ilya@ilya.pp.ua" date="1564401600">- Refresh spec-file via spec-cleaner and manual optimizations.
  * Change URL and Source0 to actual project homepage.
  * Remove macro %{?systemd_requires} and rm (not needed).
  * Add %autopatch macro.
  * Add %make_build macro.
- Chenged patch wpa_supplicant-flush-debug-output.patch (to -p1).
- Changed service-files for start after network (systemd-networkd).</changelog>
  <changelog author="tchvatal@suse.com" date="1572868800">- Update to 2.9 release:
  * SAE changes
  - disable use of groups using Brainpool curves
  - improved protection against side channel attacks
    [https://w1.fi/security/2019-6/]
  * EAP-pwd changes
  - disable use of groups using Brainpool curves
  - allow the set of groups to be configured (eap_pwd_groups)
  - improved protection against side channel attacks
    [https://w1.fi/security/2019-6/]
  * fixed FT-EAP initial mobility domain association using PMKSA caching
    (disabled by default for backwards compatibility; can be enabled
    with ft_eap_pmksa_caching=1)
  * fixed a regression in OpenSSL 1.1+ engine loading
  * added validation of RSNE in (Re)Association Response frames
  * fixed DPP bootstrapping URI parser of channel list
  * extended EAP-SIM/AKA fast re-authentication to allow use with FILS
  * extended ca_cert_blob to support PEM format
  * improved robustness of P2P Action frame scheduling
  * added support for EAP-SIM/AKA using anonymous@realm identity
  * fixed Hotspot 2.0 credential selection based on roaming consortium
    to ignore credentials without a specific EAP method
  * added experimental support for EAP-TEAP peer (RFC 7170)
  * added experimental support for EAP-TLS peer with TLS v1.3
  * fixed a regression in WMM parameter configuration for a TDLS peer
  * fixed a regression in operation with drivers that offload 802.1X
    4-way handshake
  * fixed an ECDH operation corner case with OpenSSL
  * SAE changes
  - added support for SAE Password Identifier
  - changed default configuration to enable only groups 19, 20, 21
    (i.e., disable groups 25 and 26) and disable all unsuitable groups
    completely based on REVmd changes
  - do not regenerate PWE unnecessarily when the AP uses the
    anti-clogging token mechanisms
  - fixed some association cases where both SAE and FT-SAE were enabled
    on both the station and the selected AP
  - started to prefer FT-SAE over SAE AKM if both are enabled
  - started to prefer FT-SAE over FT-PSK if both are enabled
  - fixed FT-SAE when SAE PMKSA caching is used
  - reject use of unsuitable groups based on new implementation guidance
    in REVmd (allow only FFC groups with prime &gt;= 3072 bits and ECC
    groups with prime &gt;= 256)
  - minimize timing and memory use differences in PWE derivation
    [https://w1.fi/security/2019-1/] (CVE-2019-9494, bsc#1131868)
  * EAP-pwd changes
  - minimize timing and memory use differences in PWE derivation
    [https://w1.fi/security/2019-2/] (CVE-2019-9495, bsc#1131870)
  - verify server scalar/element
    [https://w1.fi/security/2019-4/] (CVE-2019-9497, CVE-2019-9498,
    CVE-2019-9499, bsc#1131874, bsc#1131872, bsc#1131871, bsc#1131644)
  - fix message reassembly issue with unexpected fragment
    [https://w1.fi/security/2019-5/] (CVE-2019-11555, bsc#1133640)
  - enforce rand,mask generation rules more strictly
  - fix a memory leak in PWE derivation
  - disallow ECC groups with a prime under 256 bits (groups 25, 26, and
    27)
  - SAE/EAP-pwd side-channel attack update
    [https://w1.fi/security/2019-6/] (CVE-2019-13377, bsc#1144443)
  * fixed CONFIG_IEEE80211R=y (FT) build without CONFIG_FILS=y
  * Hotspot 2.0 changes
  - do not indicate release number that is higher than the one
    AP supports
  - added support for release number 3
  - enable PMF automatically for network profiles created from
    credentials
  * fixed OWE network profile saving
  * fixed DPP network profile saving
  * added support for RSN operating channel validation
    (CONFIG_OCV=y and network profile parameter ocv=1)
  * added Multi-AP backhaul STA support
  * fixed build with LibreSSL
  * number of MKA/MACsec fixes and extensions
  * extended domain_match and domain_suffix_match to allow list of values
  * fixed dNSName matching in domain_match and domain_suffix_match when
    using wolfSSL
  * started to prefer FT-EAP-SHA384 over WPA-EAP-SUITE-B-192 AKM if both
    are enabled
  * extended nl80211 Connect and external authentication to support
    SAE, FT-SAE, FT-EAP-SHA384
  * fixed KEK2 derivation for FILS+FT
  * extended client_cert file to allow loading of a chain of PEM
    encoded certificates
  * extended beacon reporting functionality
  * extended D-Bus interface with number of new properties
  * fixed a regression in FT-over-DS with mac80211-based drivers
  * OpenSSL: allow systemwide policies to be overridden
  * extended driver flags indication for separate 802.1X and PSK
    4-way handshake offload capability
  * added support for random P2P Device/Interface Address use
  * extended PEAP to derive EMSK to enable use with ERP/FILS
  * extended WPS to allow SAE configuration to be added automatically
    for PSK (wps_cred_add_sae=1)
  * removed support for the old D-Bus interface (CONFIG_CTRL_IFACE_DBUS)
  * extended domain_match and domain_suffix_match to allow list of values
  * added a RSN workaround for misbehaving PMF APs that advertise
    IGTK/BIP KeyID using incorrect byte order
  * fixed PTK rekeying with FILS and FT
  * fixed WPA packet number reuse with replayed messages and key
    reinstallation
    [https://w1.fi/security/2017-1/] (CVE-2017-13077, CVE-2017-13078,
    CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082,
    CVE-2017-13086, CVE-2017-13087, CVE-2017-13088)
  * fixed unauthenticated EAPOL-Key decryption in wpa_supplicant
    [https://w1.fi/security/2018-1/] (CVE-2018-14526)
  * added support for FILS (IEEE 802.11ai) shared key authentication
  * added support for OWE (Opportunistic Wireless Encryption, RFC 8110;
    and transition mode defined by WFA)
  * added support for DPP (Wi-Fi Device Provisioning Protocol)
  * added support for RSA 3k key case with Suite B 192-bit level
  * fixed Suite B PMKSA caching not to update PMKID during each 4-way
    handshake
  * fixed EAP-pwd pre-processing with PasswordHashHash
  * added EAP-pwd client support for salted passwords
  * fixed a regression in TDLS prohibited bit validation
  * started to use estimated throughput to avoid undesired signal
    strength based roaming decision
  * MACsec/MKA:
  - new macsec_linux driver interface support for the Linux
    kernel macsec module
  - number of fixes and extensions
  * added support for external persistent storage of PMKSA cache
    (PMKSA_GET/PMKSA_ADD control interface commands; and
    MESH_PMKSA_GET/MESH_PMKSA_SET for the mesh case)
  * fixed mesh channel configuration pri/sec switch case
  * added support for beacon report
  * large number of other fixes, cleanup, and extensions
  * added support for randomizing local address for GAS queries
    (gas_rand_mac_addr parameter)
  * fixed EAP-SIM/AKA/AKA' ext auth cases within TLS tunnel
  * added option for using random WPS UUID (auto_uuid=1)
  * added SHA256-hash support for OCSP certificate matching
  * fixed EAP-AKA' to add AT_KDF into Synchronization-Failure
  * fixed a regression in RSN pre-authentication candidate selection
  * added option to configure allowed group management cipher suites
    (group_mgmt network profile parameter)
  * removed all PeerKey functionality
  * fixed nl80211 AP and mesh mode configuration regression with
    Linux 4.15 and newer
  * added ap_isolate configuration option for AP mode
  * added support for nl80211 to offload 4-way handshake into the driver
  * added support for using wolfSSL cryptographic library
  * SAE
  - added support for configuring SAE password separately of the
    WPA2 PSK/passphrase
  - fixed PTK and EAPOL-Key integrity and key-wrap algorithm selection
    for SAE;
    note: this is not backwards compatible, i.e., both the AP and
    station side implementations will need to be update at the same
    time to maintain interoperability
  - added support for Password Identifier
  - fixed FT-SAE PMKID matching
  * Hotspot 2.0
  - added support for fetching of Operator Icon Metadata ANQP-element
  - added support for Roaming Consortium Selection element
  - added support for Terms and Conditions
  - added support for OSEN connection in a shared RSN BSS
  - added support for fetching Venue URL information
  * added support for using OpenSSL 1.1.1
  * FT
  - disabled PMKSA caching with FT since it is not fully functional
  - added support for SHA384 based AKM
  - added support for BIP ciphers BIP-CMAC-256, BIP-GMAC-128,
    BIP-GMAC-256 in addition to previously supported BIP-CMAC-128
  - fixed additional IE inclusion in Reassociation Request frame when
    using FT protocol
- Drop merged patches:
  * rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch
  * rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch
  * rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch
  * rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch
  * rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch
  * rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch
  * rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch
  * rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch
  * rebased-v2.6-0009-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch
  * wpa_supplicant-bnc-1099835-fix-private-key-password.patch
  * wpa_supplicant-bnc-1099835-clear-default_passwd_cb.patch
  * wpa_supplicant-log-file-permission.patch
  * wpa_supplicant-log-file-cloexec.patch
  * wpa_supplicant-git-fa67debf4c6ddbc881a212b175faa6d5d0d90c8c.patch
  * wpa_supplicant-git-f5b74b966c942feb95a8ddbb7d130540b15b796d.patch
- Rebase patches:
  * wpa_supplicant-getrandom.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1582891200">- Adjust the service to start after network.target wrt bsc#1165266</changelog>
  <changelog author="ilya@ilya.pp.ua" date="1585224000">- Change wpa_supplicant.service to ensure wpa_supplicant gets started before
  network. Fix WLAN config on boot with wicked. (boo#1166933)</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1585224001">- With v2.9 fi.epitest.hostap.WPASupplicant.service is obsolete (bsc#1167331)</changelog>
  <changelog author="bwiedemann@suse.com" date="1587124800">- Add restore-old-dbus-interface.patch to fix wicked wlan (boo#1156920)
- Restore fi.epitest.hostap.WPASupplicant.service (bsc#1167331)</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1587643200">- Add CVE-2019-16275.patch -- AP mode PMF disconnection protection bypass
  (bsc#1150934)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600776000">- Enable SAE support(jsc#SLE-14992).</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1600776001">- Fix spec file for SLE12, use make %{?_smp_mflags} instead of %make_build</changelog>
  <changelog author="sp1ritCS@protonmail.com" date="1601985600">- Add wpa_supplicant-p2p_iname_size.diff -- Limit P2P_DEVICE name to appropriate ifname size
  (https://patchwork.ozlabs.org/project/hostap/patch/20200825062902.124600-1-benjamin@sipsolutions.net/)</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1612440000">- Add CVE-2021-0326.patch -- P2P group information processing vulnerability
  (bsc#1181777)</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1614427200">- Add CVE-2021-27803.patch -- P2P provision discovery processing vulnerability
  (bsc#1182805)</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1614772800">- Fix systemd device ready dependencies in wpa_supplicant@.service file.
  (see: https://forums.opensuse.org/showthread.php/547186-wpa_supplicant-service-fails-on-boot-succeeds-on-restart?p=2982844#post2982844)</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1617710400">- Add CVE-2021-30004.patch -- forging attacks may occur because
  AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c
  (bsc#1184348)</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1644494400">- Add CVE-2022-23303_0001.patch, CVE-2022-23303_0002.patch,
  CVE-2022-23303_0003.patch, CVE-2022-23303_0004.patch
  SAE/EAP-pwd side-channel attack update 2
  (CVE-2022-23303, CVE-2022-23304, bsc#1194732, bsc#1194733)</changelog>
</package>
<package pkgid="eda2714b141df8a5b58fc6f2986205f639bd1cb549e20def7dd9bdaed3bff304" name="wpa_supplicant" arch="src">
  <version epoch="0" ver="2.9" rel="4.33.1"/>
  <changelog author="kbabioch@suse.com" date="1539259200">- Added rebased-v2.6-0009-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch:
  Ignore unauthenticated encrypted EAPOL-Key data (CVE-2018-14526, bsc#1104205).</changelog>
  <changelog author="kbabioch@suse.com" date="1539345600">- Added wpa-supplicant-log-file-permission.patch: Fixes the default file
  permissions of the debug log file to more sane values, i.e. it is no longer
  world-readable (bsc#1098854).
- Added wpa-supplicant-log-file-cloexec.patch: Open the debug log file with
  O_CLOEXEC, which will prevent file descriptor leaking to child processes
  (bsc#1098854).</changelog>
  <changelog author="ro@suse.de" date="1539604800">- compile eapol_test binary to allow testing via radius proxy and server
  (note: this does not match CONFIG_EAPOL_TEST which sets -Werror
  and activates an assert call inside the code of wpa_supplicant)
  (bsc#1111873), (fate#326725)
- add patch to fix wrong operator precedence in ieee802_11.c
  wpa_supplicant-git-fa67debf4c6ddbc881a212b175faa6d5d0d90c8c.patch
- add patch to avoid redefinition of __bitwise macro
  wpa_supplicant-git-f5b74b966c942feb95a8ddbb7d130540b15b796d.patch</changelog>
  <changelog author="kbabioch@suse.com" date="1539691200">- Renamed patches:
  - wpa-supplicant-log-file-permission.patch -&gt; wpa_supplicant-log-file-permission.patch
  - wpa-supplicant-log-file-cloexec.patch -&gt; wpa_supplicant-log-file-cloexec.patch
- wpa_supplicant-log-file-permission.patch: Using O_WRONLY flag
- Enabled timestamps in log files (bsc#1080798)</changelog>
  <changelog author="ilya@ilya.pp.ua" date="1541160000">- Refresh spec-file: add %license tag.</changelog>
  <changelog author="ilya@ilya.pp.ua" date="1564401600">- Refresh spec-file via spec-cleaner and manual optimizations.
  * Change URL and Source0 to actual project homepage.
  * Remove macro %{?systemd_requires} and rm (not needed).
  * Add %autopatch macro.
  * Add %make_build macro.
- Chenged patch wpa_supplicant-flush-debug-output.patch (to -p1).
- Changed service-files for start after network (systemd-networkd).</changelog>
  <changelog author="tchvatal@suse.com" date="1572868800">- Update to 2.9 release:
  * SAE changes
  - disable use of groups using Brainpool curves
  - improved protection against side channel attacks
    [https://w1.fi/security/2019-6/]
  * EAP-pwd changes
  - disable use of groups using Brainpool curves
  - allow the set of groups to be configured (eap_pwd_groups)
  - improved protection against side channel attacks
    [https://w1.fi/security/2019-6/]
  * fixed FT-EAP initial mobility domain association using PMKSA caching
    (disabled by default for backwards compatibility; can be enabled
    with ft_eap_pmksa_caching=1)
  * fixed a regression in OpenSSL 1.1+ engine loading
  * added validation of RSNE in (Re)Association Response frames
  * fixed DPP bootstrapping URI parser of channel list
  * extended EAP-SIM/AKA fast re-authentication to allow use with FILS
  * extended ca_cert_blob to support PEM format
  * improved robustness of P2P Action frame scheduling
  * added support for EAP-SIM/AKA using anonymous@realm identity
  * fixed Hotspot 2.0 credential selection based on roaming consortium
    to ignore credentials without a specific EAP method
  * added experimental support for EAP-TEAP peer (RFC 7170)
  * added experimental support for EAP-TLS peer with TLS v1.3
  * fixed a regression in WMM parameter configuration for a TDLS peer
  * fixed a regression in operation with drivers that offload 802.1X
    4-way handshake
  * fixed an ECDH operation corner case with OpenSSL
  * SAE changes
  - added support for SAE Password Identifier
  - changed default configuration to enable only groups 19, 20, 21
    (i.e., disable groups 25 and 26) and disable all unsuitable groups
    completely based on REVmd changes
  - do not regenerate PWE unnecessarily when the AP uses the
    anti-clogging token mechanisms
  - fixed some association cases where both SAE and FT-SAE were enabled
    on both the station and the selected AP
  - started to prefer FT-SAE over SAE AKM if both are enabled
  - started to prefer FT-SAE over FT-PSK if both are enabled
  - fixed FT-SAE when SAE PMKSA caching is used
  - reject use of unsuitable groups based on new implementation guidance
    in REVmd (allow only FFC groups with prime &gt;= 3072 bits and ECC
    groups with prime &gt;= 256)
  - minimize timing and memory use differences in PWE derivation
    [https://w1.fi/security/2019-1/] (CVE-2019-9494, bsc#1131868)
  * EAP-pwd changes
  - minimize timing and memory use differences in PWE derivation
    [https://w1.fi/security/2019-2/] (CVE-2019-9495, bsc#1131870)
  - verify server scalar/element
    [https://w1.fi/security/2019-4/] (CVE-2019-9497, CVE-2019-9498,
    CVE-2019-9499, bsc#1131874, bsc#1131872, bsc#1131871, bsc#1131644)
  - fix message reassembly issue with unexpected fragment
    [https://w1.fi/security/2019-5/] (CVE-2019-11555, bsc#1133640)
  - enforce rand,mask generation rules more strictly
  - fix a memory leak in PWE derivation
  - disallow ECC groups with a prime under 256 bits (groups 25, 26, and
    27)
  - SAE/EAP-pwd side-channel attack update
    [https://w1.fi/security/2019-6/] (CVE-2019-13377, bsc#1144443)
  * fixed CONFIG_IEEE80211R=y (FT) build without CONFIG_FILS=y
  * Hotspot 2.0 changes
  - do not indicate release number that is higher than the one
    AP supports
  - added support for release number 3
  - enable PMF automatically for network profiles created from
    credentials
  * fixed OWE network profile saving
  * fixed DPP network profile saving
  * added support for RSN operating channel validation
    (CONFIG_OCV=y and network profile parameter ocv=1)
  * added Multi-AP backhaul STA support
  * fixed build with LibreSSL
  * number of MKA/MACsec fixes and extensions
  * extended domain_match and domain_suffix_match to allow list of values
  * fixed dNSName matching in domain_match and domain_suffix_match when
    using wolfSSL
  * started to prefer FT-EAP-SHA384 over WPA-EAP-SUITE-B-192 AKM if both
    are enabled
  * extended nl80211 Connect and external authentication to support
    SAE, FT-SAE, FT-EAP-SHA384
  * fixed KEK2 derivation for FILS+FT
  * extended client_cert file to allow loading of a chain of PEM
    encoded certificates
  * extended beacon reporting functionality
  * extended D-Bus interface with number of new properties
  * fixed a regression in FT-over-DS with mac80211-based drivers
  * OpenSSL: allow systemwide policies to be overridden
  * extended driver flags indication for separate 802.1X and PSK
    4-way handshake offload capability
  * added support for random P2P Device/Interface Address use
  * extended PEAP to derive EMSK to enable use with ERP/FILS
  * extended WPS to allow SAE configuration to be added automatically
    for PSK (wps_cred_add_sae=1)
  * removed support for the old D-Bus interface (CONFIG_CTRL_IFACE_DBUS)
  * extended domain_match and domain_suffix_match to allow list of values
  * added a RSN workaround for misbehaving PMF APs that advertise
    IGTK/BIP KeyID using incorrect byte order
  * fixed PTK rekeying with FILS and FT
  * fixed WPA packet number reuse with replayed messages and key
    reinstallation
    [https://w1.fi/security/2017-1/] (CVE-2017-13077, CVE-2017-13078,
    CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082,
    CVE-2017-13086, CVE-2017-13087, CVE-2017-13088)
  * fixed unauthenticated EAPOL-Key decryption in wpa_supplicant
    [https://w1.fi/security/2018-1/] (CVE-2018-14526)
  * added support for FILS (IEEE 802.11ai) shared key authentication
  * added support for OWE (Opportunistic Wireless Encryption, RFC 8110;
    and transition mode defined by WFA)
  * added support for DPP (Wi-Fi Device Provisioning Protocol)
  * added support for RSA 3k key case with Suite B 192-bit level
  * fixed Suite B PMKSA caching not to update PMKID during each 4-way
    handshake
  * fixed EAP-pwd pre-processing with PasswordHashHash
  * added EAP-pwd client support for salted passwords
  * fixed a regression in TDLS prohibited bit validation
  * started to use estimated throughput to avoid undesired signal
    strength based roaming decision
  * MACsec/MKA:
  - new macsec_linux driver interface support for the Linux
    kernel macsec module
  - number of fixes and extensions
  * added support for external persistent storage of PMKSA cache
    (PMKSA_GET/PMKSA_ADD control interface commands; and
    MESH_PMKSA_GET/MESH_PMKSA_SET for the mesh case)
  * fixed mesh channel configuration pri/sec switch case
  * added support for beacon report
  * large number of other fixes, cleanup, and extensions
  * added support for randomizing local address for GAS queries
    (gas_rand_mac_addr parameter)
  * fixed EAP-SIM/AKA/AKA' ext auth cases within TLS tunnel
  * added option for using random WPS UUID (auto_uuid=1)
  * added SHA256-hash support for OCSP certificate matching
  * fixed EAP-AKA' to add AT_KDF into Synchronization-Failure
  * fixed a regression in RSN pre-authentication candidate selection
  * added option to configure allowed group management cipher suites
    (group_mgmt network profile parameter)
  * removed all PeerKey functionality
  * fixed nl80211 AP and mesh mode configuration regression with
    Linux 4.15 and newer
  * added ap_isolate configuration option for AP mode
  * added support for nl80211 to offload 4-way handshake into the driver
  * added support for using wolfSSL cryptographic library
  * SAE
  - added support for configuring SAE password separately of the
    WPA2 PSK/passphrase
  - fixed PTK and EAPOL-Key integrity and key-wrap algorithm selection
    for SAE;
    note: this is not backwards compatible, i.e., both the AP and
    station side implementations will need to be update at the same
    time to maintain interoperability
  - added support for Password Identifier
  - fixed FT-SAE PMKID matching
  * Hotspot 2.0
  - added support for fetching of Operator Icon Metadata ANQP-element
  - added support for Roaming Consortium Selection element
  - added support for Terms and Conditions
  - added support for OSEN connection in a shared RSN BSS
  - added support for fetching Venue URL information
  * added support for using OpenSSL 1.1.1
  * FT
  - disabled PMKSA caching with FT since it is not fully functional
  - added support for SHA384 based AKM
  - added support for BIP ciphers BIP-CMAC-256, BIP-GMAC-128,
    BIP-GMAC-256 in addition to previously supported BIP-CMAC-128
  - fixed additional IE inclusion in Reassociation Request frame when
    using FT protocol
- Drop merged patches:
  * rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch
  * rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch
  * rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch
  * rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch
  * rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch
  * rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch
  * rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch
  * rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch
  * rebased-v2.6-0009-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch
  * wpa_supplicant-bnc-1099835-fix-private-key-password.patch
  * wpa_supplicant-bnc-1099835-clear-default_passwd_cb.patch
  * wpa_supplicant-log-file-permission.patch
  * wpa_supplicant-log-file-cloexec.patch
  * wpa_supplicant-git-fa67debf4c6ddbc881a212b175faa6d5d0d90c8c.patch
  * wpa_supplicant-git-f5b74b966c942feb95a8ddbb7d130540b15b796d.patch
- Rebase patches:
  * wpa_supplicant-getrandom.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1582891200">- Adjust the service to start after network.target wrt bsc#1165266</changelog>
  <changelog author="ilya@ilya.pp.ua" date="1585224000">- Change wpa_supplicant.service to ensure wpa_supplicant gets started before
  network. Fix WLAN config on boot with wicked. (boo#1166933)</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1585224001">- With v2.9 fi.epitest.hostap.WPASupplicant.service is obsolete (bsc#1167331)</changelog>
  <changelog author="bwiedemann@suse.com" date="1587124800">- Add restore-old-dbus-interface.patch to fix wicked wlan (boo#1156920)
- Restore fi.epitest.hostap.WPASupplicant.service (bsc#1167331)</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1587643200">- Add CVE-2019-16275.patch -- AP mode PMF disconnection protection bypass
  (bsc#1150934)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600776000">- Enable SAE support(jsc#SLE-14992).</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1600776001">- Fix spec file for SLE12, use make %{?_smp_mflags} instead of %make_build</changelog>
  <changelog author="sp1ritCS@protonmail.com" date="1601985600">- Add wpa_supplicant-p2p_iname_size.diff -- Limit P2P_DEVICE name to appropriate ifname size
  (https://patchwork.ozlabs.org/project/hostap/patch/20200825062902.124600-1-benjamin@sipsolutions.net/)</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1612440000">- Add CVE-2021-0326.patch -- P2P group information processing vulnerability
  (bsc#1181777)</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1614427200">- Add CVE-2021-27803.patch -- P2P provision discovery processing vulnerability
  (bsc#1182805)</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1614772800">- Fix systemd device ready dependencies in wpa_supplicant@.service file.
  (see: https://forums.opensuse.org/showthread.php/547186-wpa_supplicant-service-fails-on-boot-succeeds-on-restart?p=2982844#post2982844)</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1617710400">- Add CVE-2021-30004.patch -- forging attacks may occur because
  AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c
  (bsc#1184348)</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1644494400">- Add CVE-2022-23303_0001.patch, CVE-2022-23303_0002.patch,
  CVE-2022-23303_0003.patch, CVE-2022-23303_0004.patch
  SAE/EAP-pwd side-channel attack update 2
  (CVE-2022-23303, CVE-2022-23304, bsc#1194732, bsc#1194733)</changelog>
</package>
<package pkgid="cb69726a5bb89c7bdef531ef808b4e68f70a567af597aadf8b3208be76d9e4bf" name="wpa_supplicant" arch="x86_64">
  <version epoch="0" ver="2.9" rel="4.33.1"/>
  <changelog author="kbabioch@suse.com" date="1539259200">- Added rebased-v2.6-0009-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch:
  Ignore unauthenticated encrypted EAPOL-Key data (CVE-2018-14526, bsc#1104205).</changelog>
  <changelog author="kbabioch@suse.com" date="1539345600">- Added wpa-supplicant-log-file-permission.patch: Fixes the default file
  permissions of the debug log file to more sane values, i.e. it is no longer
  world-readable (bsc#1098854).
- Added wpa-supplicant-log-file-cloexec.patch: Open the debug log file with
  O_CLOEXEC, which will prevent file descriptor leaking to child processes
  (bsc#1098854).</changelog>
  <changelog author="ro@suse.de" date="1539604800">- compile eapol_test binary to allow testing via radius proxy and server
  (note: this does not match CONFIG_EAPOL_TEST which sets -Werror
  and activates an assert call inside the code of wpa_supplicant)
  (bsc#1111873), (fate#326725)
- add patch to fix wrong operator precedence in ieee802_11.c
  wpa_supplicant-git-fa67debf4c6ddbc881a212b175faa6d5d0d90c8c.patch
- add patch to avoid redefinition of __bitwise macro
  wpa_supplicant-git-f5b74b966c942feb95a8ddbb7d130540b15b796d.patch</changelog>
  <changelog author="kbabioch@suse.com" date="1539691200">- Renamed patches:
  - wpa-supplicant-log-file-permission.patch -&gt; wpa_supplicant-log-file-permission.patch
  - wpa-supplicant-log-file-cloexec.patch -&gt; wpa_supplicant-log-file-cloexec.patch
- wpa_supplicant-log-file-permission.patch: Using O_WRONLY flag
- Enabled timestamps in log files (bsc#1080798)</changelog>
  <changelog author="ilya@ilya.pp.ua" date="1541160000">- Refresh spec-file: add %license tag.</changelog>
  <changelog author="ilya@ilya.pp.ua" date="1564401600">- Refresh spec-file via spec-cleaner and manual optimizations.
  * Change URL and Source0 to actual project homepage.
  * Remove macro %{?systemd_requires} and rm (not needed).
  * Add %autopatch macro.
  * Add %make_build macro.
- Chenged patch wpa_supplicant-flush-debug-output.patch (to -p1).
- Changed service-files for start after network (systemd-networkd).</changelog>
  <changelog author="tchvatal@suse.com" date="1572868800">- Update to 2.9 release:
  * SAE changes
  - disable use of groups using Brainpool curves
  - improved protection against side channel attacks
    [https://w1.fi/security/2019-6/]
  * EAP-pwd changes
  - disable use of groups using Brainpool curves
  - allow the set of groups to be configured (eap_pwd_groups)
  - improved protection against side channel attacks
    [https://w1.fi/security/2019-6/]
  * fixed FT-EAP initial mobility domain association using PMKSA caching
    (disabled by default for backwards compatibility; can be enabled
    with ft_eap_pmksa_caching=1)
  * fixed a regression in OpenSSL 1.1+ engine loading
  * added validation of RSNE in (Re)Association Response frames
  * fixed DPP bootstrapping URI parser of channel list
  * extended EAP-SIM/AKA fast re-authentication to allow use with FILS
  * extended ca_cert_blob to support PEM format
  * improved robustness of P2P Action frame scheduling
  * added support for EAP-SIM/AKA using anonymous@realm identity
  * fixed Hotspot 2.0 credential selection based on roaming consortium
    to ignore credentials without a specific EAP method
  * added experimental support for EAP-TEAP peer (RFC 7170)
  * added experimental support for EAP-TLS peer with TLS v1.3
  * fixed a regression in WMM parameter configuration for a TDLS peer
  * fixed a regression in operation with drivers that offload 802.1X
    4-way handshake
  * fixed an ECDH operation corner case with OpenSSL
  * SAE changes
  - added support for SAE Password Identifier
  - changed default configuration to enable only groups 19, 20, 21
    (i.e., disable groups 25 and 26) and disable all unsuitable groups
    completely based on REVmd changes
  - do not regenerate PWE unnecessarily when the AP uses the
    anti-clogging token mechanisms
  - fixed some association cases where both SAE and FT-SAE were enabled
    on both the station and the selected AP
  - started to prefer FT-SAE over SAE AKM if both are enabled
  - started to prefer FT-SAE over FT-PSK if both are enabled
  - fixed FT-SAE when SAE PMKSA caching is used
  - reject use of unsuitable groups based on new implementation guidance
    in REVmd (allow only FFC groups with prime &gt;= 3072 bits and ECC
    groups with prime &gt;= 256)
  - minimize timing and memory use differences in PWE derivation
    [https://w1.fi/security/2019-1/] (CVE-2019-9494, bsc#1131868)
  * EAP-pwd changes
  - minimize timing and memory use differences in PWE derivation
    [https://w1.fi/security/2019-2/] (CVE-2019-9495, bsc#1131870)
  - verify server scalar/element
    [https://w1.fi/security/2019-4/] (CVE-2019-9497, CVE-2019-9498,
    CVE-2019-9499, bsc#1131874, bsc#1131872, bsc#1131871, bsc#1131644)
  - fix message reassembly issue with unexpected fragment
    [https://w1.fi/security/2019-5/] (CVE-2019-11555, bsc#1133640)
  - enforce rand,mask generation rules more strictly
  - fix a memory leak in PWE derivation
  - disallow ECC groups with a prime under 256 bits (groups 25, 26, and
    27)
  - SAE/EAP-pwd side-channel attack update
    [https://w1.fi/security/2019-6/] (CVE-2019-13377, bsc#1144443)
  * fixed CONFIG_IEEE80211R=y (FT) build without CONFIG_FILS=y
  * Hotspot 2.0 changes
  - do not indicate release number that is higher than the one
    AP supports
  - added support for release number 3
  - enable PMF automatically for network profiles created from
    credentials
  * fixed OWE network profile saving
  * fixed DPP network profile saving
  * added support for RSN operating channel validation
    (CONFIG_OCV=y and network profile parameter ocv=1)
  * added Multi-AP backhaul STA support
  * fixed build with LibreSSL
  * number of MKA/MACsec fixes and extensions
  * extended domain_match and domain_suffix_match to allow list of values
  * fixed dNSName matching in domain_match and domain_suffix_match when
    using wolfSSL
  * started to prefer FT-EAP-SHA384 over WPA-EAP-SUITE-B-192 AKM if both
    are enabled
  * extended nl80211 Connect and external authentication to support
    SAE, FT-SAE, FT-EAP-SHA384
  * fixed KEK2 derivation for FILS+FT
  * extended client_cert file to allow loading of a chain of PEM
    encoded certificates
  * extended beacon reporting functionality
  * extended D-Bus interface with number of new properties
  * fixed a regression in FT-over-DS with mac80211-based drivers
  * OpenSSL: allow systemwide policies to be overridden
  * extended driver flags indication for separate 802.1X and PSK
    4-way handshake offload capability
  * added support for random P2P Device/Interface Address use
  * extended PEAP to derive EMSK to enable use with ERP/FILS
  * extended WPS to allow SAE configuration to be added automatically
    for PSK (wps_cred_add_sae=1)
  * removed support for the old D-Bus interface (CONFIG_CTRL_IFACE_DBUS)
  * extended domain_match and domain_suffix_match to allow list of values
  * added a RSN workaround for misbehaving PMF APs that advertise
    IGTK/BIP KeyID using incorrect byte order
  * fixed PTK rekeying with FILS and FT
  * fixed WPA packet number reuse with replayed messages and key
    reinstallation
    [https://w1.fi/security/2017-1/] (CVE-2017-13077, CVE-2017-13078,
    CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082,
    CVE-2017-13086, CVE-2017-13087, CVE-2017-13088)
  * fixed unauthenticated EAPOL-Key decryption in wpa_supplicant
    [https://w1.fi/security/2018-1/] (CVE-2018-14526)
  * added support for FILS (IEEE 802.11ai) shared key authentication
  * added support for OWE (Opportunistic Wireless Encryption, RFC 8110;
    and transition mode defined by WFA)
  * added support for DPP (Wi-Fi Device Provisioning Protocol)
  * added support for RSA 3k key case with Suite B 192-bit level
  * fixed Suite B PMKSA caching not to update PMKID during each 4-way
    handshake
  * fixed EAP-pwd pre-processing with PasswordHashHash
  * added EAP-pwd client support for salted passwords
  * fixed a regression in TDLS prohibited bit validation
  * started to use estimated throughput to avoid undesired signal
    strength based roaming decision
  * MACsec/MKA:
  - new macsec_linux driver interface support for the Linux
    kernel macsec module
  - number of fixes and extensions
  * added support for external persistent storage of PMKSA cache
    (PMKSA_GET/PMKSA_ADD control interface commands; and
    MESH_PMKSA_GET/MESH_PMKSA_SET for the mesh case)
  * fixed mesh channel configuration pri/sec switch case
  * added support for beacon report
  * large number of other fixes, cleanup, and extensions
  * added support for randomizing local address for GAS queries
    (gas_rand_mac_addr parameter)
  * fixed EAP-SIM/AKA/AKA' ext auth cases within TLS tunnel
  * added option for using random WPS UUID (auto_uuid=1)
  * added SHA256-hash support for OCSP certificate matching
  * fixed EAP-AKA' to add AT_KDF into Synchronization-Failure
  * fixed a regression in RSN pre-authentication candidate selection
  * added option to configure allowed group management cipher suites
    (group_mgmt network profile parameter)
  * removed all PeerKey functionality
  * fixed nl80211 AP and mesh mode configuration regression with
    Linux 4.15 and newer
  * added ap_isolate configuration option for AP mode
  * added support for nl80211 to offload 4-way handshake into the driver
  * added support for using wolfSSL cryptographic library
  * SAE
  - added support for configuring SAE password separately of the
    WPA2 PSK/passphrase
  - fixed PTK and EAPOL-Key integrity and key-wrap algorithm selection
    for SAE;
    note: this is not backwards compatible, i.e., both the AP and
    station side implementations will need to be update at the same
    time to maintain interoperability
  - added support for Password Identifier
  - fixed FT-SAE PMKID matching
  * Hotspot 2.0
  - added support for fetching of Operator Icon Metadata ANQP-element
  - added support for Roaming Consortium Selection element
  - added support for Terms and Conditions
  - added support for OSEN connection in a shared RSN BSS
  - added support for fetching Venue URL information
  * added support for using OpenSSL 1.1.1
  * FT
  - disabled PMKSA caching with FT since it is not fully functional
  - added support for SHA384 based AKM
  - added support for BIP ciphers BIP-CMAC-256, BIP-GMAC-128,
    BIP-GMAC-256 in addition to previously supported BIP-CMAC-128
  - fixed additional IE inclusion in Reassociation Request frame when
    using FT protocol
- Drop merged patches:
  * rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch
  * rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch
  * rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch
  * rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch
  * rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch
  * rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch
  * rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch
  * rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch
  * rebased-v2.6-0009-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch
  * wpa_supplicant-bnc-1099835-fix-private-key-password.patch
  * wpa_supplicant-bnc-1099835-clear-default_passwd_cb.patch
  * wpa_supplicant-log-file-permission.patch
  * wpa_supplicant-log-file-cloexec.patch
  * wpa_supplicant-git-fa67debf4c6ddbc881a212b175faa6d5d0d90c8c.patch
  * wpa_supplicant-git-f5b74b966c942feb95a8ddbb7d130540b15b796d.patch
- Rebase patches:
  * wpa_supplicant-getrandom.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1582891200">- Adjust the service to start after network.target wrt bsc#1165266</changelog>
  <changelog author="ilya@ilya.pp.ua" date="1585224000">- Change wpa_supplicant.service to ensure wpa_supplicant gets started before
  network. Fix WLAN config on boot with wicked. (boo#1166933)</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1585224001">- With v2.9 fi.epitest.hostap.WPASupplicant.service is obsolete (bsc#1167331)</changelog>
  <changelog author="bwiedemann@suse.com" date="1587124800">- Add restore-old-dbus-interface.patch to fix wicked wlan (boo#1156920)
- Restore fi.epitest.hostap.WPASupplicant.service (bsc#1167331)</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1587643200">- Add CVE-2019-16275.patch -- AP mode PMF disconnection protection bypass
  (bsc#1150934)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600776000">- Enable SAE support(jsc#SLE-14992).</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1600776001">- Fix spec file for SLE12, use make %{?_smp_mflags} instead of %make_build</changelog>
  <changelog author="sp1ritCS@protonmail.com" date="1601985600">- Add wpa_supplicant-p2p_iname_size.diff -- Limit P2P_DEVICE name to appropriate ifname size
  (https://patchwork.ozlabs.org/project/hostap/patch/20200825062902.124600-1-benjamin@sipsolutions.net/)</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1612440000">- Add CVE-2021-0326.patch -- P2P group information processing vulnerability
  (bsc#1181777)</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1614427200">- Add CVE-2021-27803.patch -- P2P provision discovery processing vulnerability
  (bsc#1182805)</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1614772800">- Fix systemd device ready dependencies in wpa_supplicant@.service file.
  (see: https://forums.opensuse.org/showthread.php/547186-wpa_supplicant-service-fails-on-boot-succeeds-on-restart?p=2982844#post2982844)</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1617710400">- Add CVE-2021-30004.patch -- forging attacks may occur because
  AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c
  (bsc#1184348)</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1644494400">- Add CVE-2022-23303_0001.patch, CVE-2022-23303_0002.patch,
  CVE-2022-23303_0003.patch, CVE-2022-23303_0004.patch
  SAE/EAP-pwd side-channel attack update 2
  (CVE-2022-23303, CVE-2022-23304, bsc#1194732, bsc#1194733)</changelog>
</package>
<package pkgid="18a34230abb66a54dcfce111a510ea0ca320e70f8245f5b0aacecda06bee3d73" name="xen" arch="src">
  <version epoch="0" ver="4.14.5_04" rel="150300.3.32.1"/>
  <changelog author="carnold@suse.com" date="1631016000">- bsc#1189632 - VUL-0: CVE-2021-28701: xen: Another race in
  XENMAPSPACE_grant_table handling (XSA-384)
  xsa384.patch
- Upstream bug fixes (bsc#1027519)
  61001231-x86-work-around-GNU-ld-2-37-issue.patch
  611a7e38-x86-CET-shstk-WARN-manipulation.patch
  611cba4e-VT-d-Tylersburg-errata-more-steppings.patch
  611f844b-AMD-IOMMU-dont-leave-pt-mapped.patch
  6128a856-gnttab-radix-tree-node-init.patch
  61122ac6-credit2-avoid-spuriously-picking-idle.patch (Replaces
    credit2-avoid-picking-a-spurious-idle-unit-when-caps-are-used.patch)
  6126339d-AMD-IOMMU-global-ER-extending.patch (Replaces xsa378-1.patch)
  6126344f-AMD-IOMMU-unity-map-handling.patch (Replaces xsa378-2.patch)
  61263464-IOMMU-pass-access-to-p2m_get_iommu_flags.patch (Replaces xsa378-3.patch)
  6126347d-IOMMU-generalize-VT-d-mapped-RMRR-tracking.patch (Replaces xsa378-4.patch)
  6126349a-AMD-IOMMU-rearrange-reassignment.patch (Replaces xsa378-5.patch)
  612634ae-AMD-IOMMU-rearrange-ER-UM-recording.patch (Replaces xsa378-6.patch)
  612634c3-x86-p2m-introduce-p2m_is_special.patch (Replaces xsa378-7.patch)
  612634dc-x86-p2m-guard-identity-mappings.patch (Replaces xsa378-8.patch)
  612634f4-x86-mm-widen-locked-region-in-xatp1.patch (Replaces xsa379.patch)
  6126350a-gnttab-release-mappings-preemption.patch (Replaces xsa380-1.patch
  6126351f-gnttab-replace-mapkind.patch (Replaces xsa380-2.patch)
  6126353d-gnttab-get-status-frames-array-capacity.patch (Replaces xsa382.patch)
  61263553-Arm-restrict-maxmem-for-dom0less.patch (Replaces xsa383.patch)</changelog>
  <changelog author="carnold@suse.com" date="1631534400">- Update to Xen 4.14.3 bug fix release (bsc#1027519)
  xen-4.14.3-testing-src.tar.bz2
- Drop patches contained in new tarball
  608676f2-VT-d-register-based-invalidation-optional.patch
  60a27288-x86emul-gas-2-36-test-harness-build.patch
  60af933d-x86-gcc11-hypervisor-build.patch
  60afe616-x86-CPUID-rework-HLE-and-RTM-handling.patch
  60afe617-x86-TSX-minor-cleanup-and-improvements.patch
  60afe618-x86-TSX-deprecate-vpmu=rtm-abort.patch
  60be0e24-credit2-pick-runnable-unit.patch
  60be0e42-credit2-per-entity-load-tracking-when-continuing.patch
  60be3097-x86-CPUID-fix-HLE-and-RTM-handling-again.patch
  60bf9e19-Arm-create-dom0less-domUs-earlier.patch
  60bf9e1a-Arm-boot-modules-scrubbing.patch
  60bf9e1b-VT-d-size-qinval-queue-dynamically.patch
  60bf9e1c-AMD-IOMMU-size-command-buffer-dynamically.patch
  60bf9e1d-VT-d-eliminate-flush-related-timeouts.patch
  60bf9e1e-x86-spec-ctrl-protect-against-SCSB.patch
  60bf9e1f-x86-spec-ctrl-mitigate-TAA-after-S3.patch
  60bfa904-AMD-IOMMU-wait-for-command-slot.patch
  60bfa906-AMD-IOMMU-drop-command-completion-timeout.patch
  60c0bf86-x86-TSX-cope-with-deprecation.patch
  60c8a7ac-x86-vpt-fully-init-timers-before-enlisting.patch
  60c8de6e-osdep_xenforeignmemory_map-prototype.patch
  60d49689-VT-d-undo-device-mappings-upon-error.patch
  60d496b9-VT-d-adjust-domid-map-updating-on-unmap.patch
  60d496d6-VT-d-clear_fault_bits-should-clear-all.patch
  60d496ee-VT-d-dont-lose-errors-on-multi-IOMMU-flush.patch
  60d5c6df-IOMMU-PCI-dont-let-domain-cleanup-continue.patch
  61001231-x86-work-around-GNU-ld-2-37-issue.patch
  61122ac6-credit2-avoid-spuriously-picking-idle.patch
  611a7e38-x86-CET-shstk-WARN-manipulation.patch
  611cba4e-VT-d-Tylersburg-errata-more-steppings.patch
  611f844b-AMD-IOMMU-dont-leave-pt-mapped.patch
  6126339d-AMD-IOMMU-global-ER-extending.patch
  6126344f-AMD-IOMMU-unity-map-handling.patch
  61263464-IOMMU-pass-access-to-p2m_get_iommu_flags.patch
  6126347d-IOMMU-generalize-VT-d-mapped-RMRR-tracking.patch
  6126349a-AMD-IOMMU-rearrange-reassignment.patch
  612634ae-AMD-IOMMU-rearrange-ER-UM-recording.patch
  612634c3-x86-p2m-introduce-p2m_is_special.patch
  612634dc-x86-p2m-guard-identity-mappings.patch
  612634f4-x86-mm-widen-locked-region-in-xatp1.patch
  6126350a-gnttab-release-mappings-preemption.patch
  6126351f-gnttab-replace-mapkind.patch
  6126353d-gnttab-get-status-frames-array-capacity.patch
  61263553-Arm-restrict-maxmem-for-dom0less.patch
  6128a856-gnttab-radix-tree-node-init.patch
  xsa384.patch</changelog>
  <changelog author="carnold@suse.com" date="1633521600">- bsc#1191363 - VUL-0: CVE-2021-28702: xen: PCI devices with RMRRs
  not deassigned correctly (XSA-386)
  615c9fd0-VT-d-fix-deassign-of-device-with-RMRR.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1633953600">- Upstream bug fixes (bsc#1027519)
  6138b7a1-x86-spec-ctrl-split-diagnostics-line.patch
  6138b7a2-x86-AMD-enum-speculative-hints.patch
  6138b7a3-x86-AMD-use-newer-SSBD.patch
  6139f1b1-x86-spec-ctrl-print-AMD-features.patch
  6148453b-VT-d-hidden-devices-unmap.patch
  6148455f-VT-d-PCI-segment-numbers-16-bits.patch
  61532102-PCI-bridge-with-subord-bus-0xFF.patch</changelog>
  <changelog author="carnold@suse.com" date="1636545600">- bsc#1192554 - VUL-0: CVE-2021-28706: xen: guests may exceed their
  designated memory limit (XSA-385)
  xsa385.patch
- bsc#1192557 - VUL-0: CVE-2021-28704,CVE-2021-28707,CVE-2021-28708:
  xen: PoD operations on misaligned GFNs (XSA-388)
  xsa388-1.patch
  xsa388-2.patch
- bsc#1192559 - VUL-0: CVE-2021-28705,CVE-2021-28709: xen: issues
  with partially successful P2M updates on x86 (XSA-389)
  xsa389.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1638187200">- Upstream bug fixes (bsc#1027519)
  61655b5a-AMD-IOMMU-hidden-devices-flush.patch
  616d66bd-x86-HVM-cleanup-after-failed-viridian_vcpu_init.patch
  616e7cfe-x86-paging-restrict-paddr-width-reported.patch
  618289da-x86-shstk-fix-with-XPTI-active.patch
  619b7ac9-harden-assign_pages.patch
  619b8cb0-x86-PoD-misaligned-GFNs.patch
  619b8cb1-x86-PoD-intermediate-page-orders.patch
  619b8cb2-x86-P2M-set-partial-success.patch
- Drop xsa patches in favor of upstream versions
  xsa385.patch
  xsa388-1.patch
  xsa388-2.patch
  xsa389.patch</changelog>
  <changelog author="jfehlig@suse.com" date="1641297600">- Collect active VM config files in the supportconfig plugin
  xen-supportconfig</changelog>
  <changelog author="jbeulich@suse.com" date="1641816000">- bsc#1193447 - Slow execution of hvmloader+ovmf when VM contains an sriov device
  61bc429f-revert-hvmloader-PA-range-should-be-UC.patch
- Upstream bug fixes (bsc#1027519)
  61b31d5c-x86-restrict-all-but-self-IPI.patch
  61b88e78-x86-CPUID-TSXLDTRK-definition.patch
  61d5687a-x86-spec-ctrl-opt_srb_lock-default.patch</changelog>
  <changelog author="carnold@suse.com" date="1641988800">- bsc#1191668 - L3: issue around xl and virsh operation - virsh
  list not giving any output (see also bsc#1194267)
  libxl-dont-try-to-free-a-NULL-list-of-vcpus.patch
  libxl-dont-touch-nr_vcpus_out-if-listing-vcpus-and-returning-NULL.patch</changelog>
  <changelog author="carnold@suse.com" date="1642075200">- bsc#1194576 - VUL-0: CVE-2022-23033: xen: arm:
  guest_physmap_remove_page not removing the p2m mappings (XSA-393)
  xsa393.patch
- bsc#1194581 - VUL-0: CVE-2022-23034: xen: a PV guest could DoS
  Xen while unmapping a grant (XSA-394)
  xsa394.patch
- bsc#1194588 - VUL-0: CVE-2022-23035: xen: insufficient cleanup of
  passed-through device IRQs (XSA-395)
  xsa395.patch</changelog>
  <changelog author="carnold@suse.com" date="1643803200">- Update to Xen 4.14.4 bug fix release (bsc#1027519)
  xen-4.14.4-testing-src.tar.bz2
- Drop patches contained in new tarball
  6138b7a1-x86-spec-ctrl-split-diagnostics-line.patch
  6138b7a2-x86-AMD-enum-speculative-hints.patch
  6138b7a3-x86-AMD-use-newer-SSBD.patch
  6139f1b1-x86-spec-ctrl-print-AMD-features.patch
  6148453b-VT-d-hidden-devices-unmap.patch
  6148455f-VT-d-PCI-segment-numbers-16-bits.patch
  61532102-PCI-bridge-with-subord-bus-0xFF.patch
  615c9fd0-VT-d-fix-deassign-of-device-with-RMRR.patch
  61655b5a-AMD-IOMMU-hidden-devices-flush.patch
  616d66bd-x86-HVM-cleanup-after-failed-viridian_vcpu_init.patch
  616e7cfe-x86-paging-restrict-paddr-width-reported.patch
  618289da-x86-shstk-fix-with-XPTI-active.patch
  619b7ac9-harden-assign_pages.patch
  619b8cb0-x86-PoD-misaligned-GFNs.patch
  619b8cb1-x86-PoD-intermediate-page-orders.patch
  619b8cb2-x86-P2M-set-partial-success.patch
  61b31d5c-x86-restrict-all-but-self-IPI.patch
  61b88e78-x86-CPUID-TSXLDTRK-definition.patch
  61bc429f-revert-hvmloader-PA-range-should-be-UC.patch
  61d5687a-x86-spec-ctrl-opt_srb_lock-default.patch
  xsa393.patch
  xsa394.patch
  xsa395.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1644408000">- bsc#1191668 - L3: issue around xl and virsh operation - virsh
  list not giving any output
  Replace
    libxl-dont-try-to-free-a-NULL-list-of-vcpus.patch
    libxl-dont-touch-nr_vcpus_out-if-listing-vcpus-and-returning-NULL.patch
  by upstream backport
    61f7b2af-libxl-dont-touch-nr_vcpus_out-if-listing.patch
- Upstream bug fixes (bsc#1027519)
  60782745-x86-AMD-split-LFENCE-setup.patch
  6081bae4-x86-cpuid-LFENCE-always-serialising.patch
  61f2d886-x86-CPUID-disentangle-new-leaves-logic.patch
  61f2d887-x86-CPUID-leaf-7-1-EBX-infra.patch
  61f2dd76-x86-SPEC_CTRL-migration-compatibility.patch
  61f933a4-x86-cpuid-advertise-SSB_NO.patch
  61f933a5-x86-drop-use_spec_ctrl-boolean.patch
  61f933a6-x86-new-has_spec_ctrl-boolean.patch
  61f933a7-x86-dont-use-spec_ctrl-enter-exit-for-S3.patch
  61f933a8-x86-SPEC_CTRL-record-last-write.patch
  61f933a9-x86-SPEC_CTRL-use-common-logic-for-AMD.patch
  61f933aa-SVM-SPEC_CTRL-entry-exit-logic.patch
  61f933ab-x86-AMD-SPEC_CTRL-infra.patch
  61f933ac-SVM-enable-MSR_SPEC_CTRL-for-guests.patch
  61f946a2-VMX-drop-SPEC_CTRL-load-on-VMEntry.patch
  6202afa3-x86-clean-up-MSR_MCU_OPT_CTRL-handling.patch
  6202afa4-x86-TSX-move-has_rtm_always_abort.patch
  6202afa5-x86-TSX-cope-with-deprecation-on-WHL-R-CFL-R.patch
  6202afa7-x86-CPUID-leaf-7-2-EDX-infra.patch
  6202afa8-x86-Intel-PSFD-for-guests.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1647345600">- bsc#1196915 - VUL-0: CVE-2022-0001, CVE-2022-0002,CVE-2021-26401:
  xen: BHB speculation issues (XSA-398)
  62278667-Arm-introduce-new-processors.patch
  62278668-Arm-move-errata-CSV2-check-earlier.patch
  62278669-Arm-add-ECBHB-and-CLEARBHB-ID-fields.patch
  6227866a-Arm-Spectre-BHB-handling.patch
  6227866b-Arm-allow-SMCCC_ARCH_WORKAROUND_3-use.patch
  6227866c-x86-AMD-cease-using-thunk-lfence.patch</changelog>
  <changelog author="carnold@suse.com" date="1649073600">- bsc#1197423 - VUL-0: CVE-2022-26356: xen: Racy interactions
  between dirty vram tracking and paging log dirty hypercalls
  (XSA-397)
  xsa397.patch
- bsc#1197425 - VUL-0: CVE-2022-26357: xen: race in VT-d domain ID
  cleanup (XSA-399)
  xsa399.patch
- bsc#1197426 - VUL-0: CVE-2022-26358,CVE-2022-26359,
  CVE-2022-26360,CVE-2022-26361: xen: IOMMU: RMRR (VT-d) and unity
  map (AMD-Vi) handling issues (XSA-400)
  xsa400-01.patch
  xsa400-02.patch
  xsa400-03.patch
  xsa400-04.patch
  xsa400-05.patch
  xsa400-06.patch
  xsa400-07.patch
  xsa400-08.patch
  xsa400-09.patch
  xsa400-10.patch
  xsa400-11.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1649419200">- bsc#1197426 - VUL-0: CVE-2022-26358,CVE-2022-26359,
  CVE-2022-26360,CVE-2022-26361: xen: IOMMU: RMRR (VT-d) and unity
  map (AMD-Vi) handling issues (XSA-400)
  624ebcef-VT-d-dont-needlessly-look-up-DID.patch
  624ebd3b-VT-d-avoid-NULL-deref-on-dcmo-error-paths.patch
  624ebd74-VT-d-avoid-infinite-recursion-on-dcmo-error-path.patch</changelog>
  <changelog author="carnold@suse.com" date="1649851200">- Update to Xen 4.14.5 bug fix release (bsc#1027519)
  xen-4.14.5-testing-src.tar.bz2
- Drop patches contained in new tarball
  60782745-x86-AMD-split-LFENCE-setup.patch
  6081bae4-x86-cpuid-LFENCE-always-serialising.patch
  61f2d886-x86-CPUID-disentangle-new-leaves-logic.patch
  61f2d887-x86-CPUID-leaf-7-1-EBX-infra.patch
  61f2dd76-x86-SPEC_CTRL-migration-compatibility.patch
  61f933a4-x86-cpuid-advertise-SSB_NO.patch
  61f933a5-x86-drop-use_spec_ctrl-boolean.patch
  61f933a6-x86-new-has_spec_ctrl-boolean.patch
  61f933a7-x86-dont-use-spec_ctrl-enter-exit-for-S3.patch
  61f933a8-x86-SPEC_CTRL-record-last-write.patch
  61f933a9-x86-SPEC_CTRL-use-common-logic-for-AMD.patch
  61f933aa-SVM-SPEC_CTRL-entry-exit-logic.patch
  61f933ab-x86-AMD-SPEC_CTRL-infra.patch
  61f933ac-SVM-enable-MSR_SPEC_CTRL-for-guests.patch
  61f946a2-VMX-drop-SPEC_CTRL-load-on-VMEntry.patch
  6202afa3-x86-clean-up-MSR_MCU_OPT_CTRL-handling.patch
  6202afa4-x86-TSX-move-has_rtm_always_abort.patch
  6202afa5-x86-TSX-cope-with-deprecation-on-WHL-R-CFL-R.patch
  6202afa7-x86-CPUID-leaf-7-2-EDX-infra.patch
  6202afa8-x86-Intel-PSFD-for-guests.patch
  62278667-Arm-introduce-new-processors.patch
  62278668-Arm-move-errata-CSV2-check-earlier.patch
  62278669-Arm-add-ECBHB-and-CLEARBHB-ID-fields.patch
  6227866a-Arm-Spectre-BHB-handling.patch
  6227866b-Arm-allow-SMCCC_ARCH_WORKAROUND_3-use.patch
  6227866c-x86-AMD-cease-using-thunk-lfence.patch
  624ebcef-VT-d-dont-needlessly-look-up-DID.patch
  624ebd3b-VT-d-avoid-NULL-deref-on-dcmo-error-paths.patch
  624ebd74-VT-d-avoid-infinite-recursion-on-dcmo-error-path.patch
  xsa397.patch
  xsa399.patch
  xsa400-01.patch
  xsa400-02.patch
  xsa400-03.patch
  xsa400-04.patch
  xsa400-05.patch
  xsa400-06.patch
  xsa400-07.patch
  xsa400-08.patch
  xsa400-09.patch
  xsa400-10.patch
  xsa400-11.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1653998400">- Upstream bug fixes (bsc#1027519)
  625fca42-VT-d-reserved-CAP-ND.patch
  627549d6-IO-shutdown-race.patch
- bsc#1199965 - VUL-0: EMBARGOED: CVE-2022-26362: xen: Race condition
  in typeref acquisition
  xsa401-1.patch
  xsa401-2.patch
- bsc#1199966 - VUL-0: EMBARGOED: CVE-2022-26363,CVE-2022-26364: xen:
  Insufficient care with non-coherent mappings
  xsa402-1.patch
  xsa402-2.patch
  xsa402-3.patch
  xsa402-4.patch
  xsa402-5.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1654689600">- bsc#1199966 - VUL-0: EMBARGOED: CVE-2022-26363,CVE-2022-26364: xen:
  Insufficient care with non-coherent mappings
  fix xsa402-5.patch</changelog>
  <changelog author="carnold@suse.com" date="1657627200">- bsc#1201394 - VUL-0: CVE-2022-33745: xen: insufficient TLB flush
  for x86 PV guests in shadow mode (XSA-408)
  xsa408.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1657886400">- bsc#1199965 - VUL-0: CVE-2022-26362: xen: Race condition
  in typeref acquisition
  62a1e594-x86-clean-up-_get_page_type.patch
  62a1e5b0-x86-ABAC-race-in-_get_page_type.patch
- bsc#1199966 - VUL-0: CVE-2022-26363,CVE-2022-26364: xen:
  Insufficient care with non-coherent mappings
  62a1e5d2-x86-introduce-_PAGE_-for-mem-types.patch
  62a1e5f0-x86-dont-change-cacheability-of-directmap.patch
  62a1e60e-x86-split-cache_flush-out-of-cache_writeback.patch
  62a1e62b-x86-AMD-work-around-CLFLUSH-ordering.patch
  62a1e649-x86-track-and-flush-non-coherent.patch
- bsc#1200549 VUL-0: CVE-2022-21123,CVE-2022-21125,CVE-2022-21166:
  xen: x86: MMIO Stale Data vulnerabilities (XSA-404)
  62ab0fab-x86-spec-ctrl-VERW-flushing-runtime-cond.patch
  62ab0fac-x86-spec-ctrl-enum-for-MMIO-Stale-Data.patch
  62ab0fad-x86-spec-ctrl-add-unpriv-mmio.patch
- bsc#1201469 - VUL-0: CVE-2022-23816,CVE-2022-23825,CVE-2022-29900:
  xen: retbleed - arbitrary speculative code execution with return
  instructions (XSA-407)
  62cc31ee-cmdline-extend-parse_boolean.patch
  62cc31ef-x86-spec-ctrl-fine-grained-cmdline-subopts.patch
  62cd91d0-x86-spec-ctrl-rework-context-switching.patch
  62cd91d1-x86-spec-ctrl-rename-SCF_ist_wrmsr.patch
  62cd91d2-x86-spec-ctrl-rename-opt_ibpb.patch
  62cd91d3-x86-spec-ctrl-rework-SPEC_CTRL_ENTRY_FROM_INTR_IST.patch
  62cd91d4-x86-spec-ctrl-IBPB-on-entry.patch
  62cd91d5-x86-cpuid-BTC_NO-enum.patch
  62cd91d6-x86-spec-ctrl-enable-Zen2-chickenbit.patch
  62cd91d7-x86-spec-ctrl-mitigate-Branch-Type-Confusion.patch
- Upstream bug fixes (bsc#1027519)
  62bdd840-x86-spec-ctrl-only-adjust-idle-with-legacy-IBRS.patch
  62bdd841-x86-spec-ctrl-knobs-for-STIBP-and-PSFD.patch
- Drop patches replaced by upstream versions
  xsa401-1.patch
  xsa401-2.patch
  xsa402-1.patch
  xsa402-2.patch
  xsa402-3.patch
  xsa402-4.patch
  xsa402-5.patch</changelog>
</package>
<package pkgid="b409c4bab05bbcf5ec6da0803559bee444491b5b10a1ef1c8c1c62faabc3b82d" name="xen-libs" arch="x86_64">
  <version epoch="0" ver="4.14.5_04" rel="150300.3.32.1"/>
  <changelog author="carnold@suse.com" date="1631016000">- bsc#1189632 - VUL-0: CVE-2021-28701: xen: Another race in
  XENMAPSPACE_grant_table handling (XSA-384)
  xsa384.patch
- Upstream bug fixes (bsc#1027519)
  61001231-x86-work-around-GNU-ld-2-37-issue.patch
  611a7e38-x86-CET-shstk-WARN-manipulation.patch
  611cba4e-VT-d-Tylersburg-errata-more-steppings.patch
  611f844b-AMD-IOMMU-dont-leave-pt-mapped.patch
  6128a856-gnttab-radix-tree-node-init.patch
  61122ac6-credit2-avoid-spuriously-picking-idle.patch (Replaces
    credit2-avoid-picking-a-spurious-idle-unit-when-caps-are-used.patch)
  6126339d-AMD-IOMMU-global-ER-extending.patch (Replaces xsa378-1.patch)
  6126344f-AMD-IOMMU-unity-map-handling.patch (Replaces xsa378-2.patch)
  61263464-IOMMU-pass-access-to-p2m_get_iommu_flags.patch (Replaces xsa378-3.patch)
  6126347d-IOMMU-generalize-VT-d-mapped-RMRR-tracking.patch (Replaces xsa378-4.patch)
  6126349a-AMD-IOMMU-rearrange-reassignment.patch (Replaces xsa378-5.patch)
  612634ae-AMD-IOMMU-rearrange-ER-UM-recording.patch (Replaces xsa378-6.patch)
  612634c3-x86-p2m-introduce-p2m_is_special.patch (Replaces xsa378-7.patch)
  612634dc-x86-p2m-guard-identity-mappings.patch (Replaces xsa378-8.patch)
  612634f4-x86-mm-widen-locked-region-in-xatp1.patch (Replaces xsa379.patch)
  6126350a-gnttab-release-mappings-preemption.patch (Replaces xsa380-1.patch
  6126351f-gnttab-replace-mapkind.patch (Replaces xsa380-2.patch)
  6126353d-gnttab-get-status-frames-array-capacity.patch (Replaces xsa382.patch)
  61263553-Arm-restrict-maxmem-for-dom0less.patch (Replaces xsa383.patch)</changelog>
  <changelog author="carnold@suse.com" date="1631534400">- Update to Xen 4.14.3 bug fix release (bsc#1027519)
  xen-4.14.3-testing-src.tar.bz2
- Drop patches contained in new tarball
  608676f2-VT-d-register-based-invalidation-optional.patch
  60a27288-x86emul-gas-2-36-test-harness-build.patch
  60af933d-x86-gcc11-hypervisor-build.patch
  60afe616-x86-CPUID-rework-HLE-and-RTM-handling.patch
  60afe617-x86-TSX-minor-cleanup-and-improvements.patch
  60afe618-x86-TSX-deprecate-vpmu=rtm-abort.patch
  60be0e24-credit2-pick-runnable-unit.patch
  60be0e42-credit2-per-entity-load-tracking-when-continuing.patch
  60be3097-x86-CPUID-fix-HLE-and-RTM-handling-again.patch
  60bf9e19-Arm-create-dom0less-domUs-earlier.patch
  60bf9e1a-Arm-boot-modules-scrubbing.patch
  60bf9e1b-VT-d-size-qinval-queue-dynamically.patch
  60bf9e1c-AMD-IOMMU-size-command-buffer-dynamically.patch
  60bf9e1d-VT-d-eliminate-flush-related-timeouts.patch
  60bf9e1e-x86-spec-ctrl-protect-against-SCSB.patch
  60bf9e1f-x86-spec-ctrl-mitigate-TAA-after-S3.patch
  60bfa904-AMD-IOMMU-wait-for-command-slot.patch
  60bfa906-AMD-IOMMU-drop-command-completion-timeout.patch
  60c0bf86-x86-TSX-cope-with-deprecation.patch
  60c8a7ac-x86-vpt-fully-init-timers-before-enlisting.patch
  60c8de6e-osdep_xenforeignmemory_map-prototype.patch
  60d49689-VT-d-undo-device-mappings-upon-error.patch
  60d496b9-VT-d-adjust-domid-map-updating-on-unmap.patch
  60d496d6-VT-d-clear_fault_bits-should-clear-all.patch
  60d496ee-VT-d-dont-lose-errors-on-multi-IOMMU-flush.patch
  60d5c6df-IOMMU-PCI-dont-let-domain-cleanup-continue.patch
  61001231-x86-work-around-GNU-ld-2-37-issue.patch
  61122ac6-credit2-avoid-spuriously-picking-idle.patch
  611a7e38-x86-CET-shstk-WARN-manipulation.patch
  611cba4e-VT-d-Tylersburg-errata-more-steppings.patch
  611f844b-AMD-IOMMU-dont-leave-pt-mapped.patch
  6126339d-AMD-IOMMU-global-ER-extending.patch
  6126344f-AMD-IOMMU-unity-map-handling.patch
  61263464-IOMMU-pass-access-to-p2m_get_iommu_flags.patch
  6126347d-IOMMU-generalize-VT-d-mapped-RMRR-tracking.patch
  6126349a-AMD-IOMMU-rearrange-reassignment.patch
  612634ae-AMD-IOMMU-rearrange-ER-UM-recording.patch
  612634c3-x86-p2m-introduce-p2m_is_special.patch
  612634dc-x86-p2m-guard-identity-mappings.patch
  612634f4-x86-mm-widen-locked-region-in-xatp1.patch
  6126350a-gnttab-release-mappings-preemption.patch
  6126351f-gnttab-replace-mapkind.patch
  6126353d-gnttab-get-status-frames-array-capacity.patch
  61263553-Arm-restrict-maxmem-for-dom0less.patch
  6128a856-gnttab-radix-tree-node-init.patch
  xsa384.patch</changelog>
  <changelog author="carnold@suse.com" date="1633521600">- bsc#1191363 - VUL-0: CVE-2021-28702: xen: PCI devices with RMRRs
  not deassigned correctly (XSA-386)
  615c9fd0-VT-d-fix-deassign-of-device-with-RMRR.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1633953600">- Upstream bug fixes (bsc#1027519)
  6138b7a1-x86-spec-ctrl-split-diagnostics-line.patch
  6138b7a2-x86-AMD-enum-speculative-hints.patch
  6138b7a3-x86-AMD-use-newer-SSBD.patch
  6139f1b1-x86-spec-ctrl-print-AMD-features.patch
  6148453b-VT-d-hidden-devices-unmap.patch
  6148455f-VT-d-PCI-segment-numbers-16-bits.patch
  61532102-PCI-bridge-with-subord-bus-0xFF.patch</changelog>
  <changelog author="carnold@suse.com" date="1636545600">- bsc#1192554 - VUL-0: CVE-2021-28706: xen: guests may exceed their
  designated memory limit (XSA-385)
  xsa385.patch
- bsc#1192557 - VUL-0: CVE-2021-28704,CVE-2021-28707,CVE-2021-28708:
  xen: PoD operations on misaligned GFNs (XSA-388)
  xsa388-1.patch
  xsa388-2.patch
- bsc#1192559 - VUL-0: CVE-2021-28705,CVE-2021-28709: xen: issues
  with partially successful P2M updates on x86 (XSA-389)
  xsa389.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1638187200">- Upstream bug fixes (bsc#1027519)
  61655b5a-AMD-IOMMU-hidden-devices-flush.patch
  616d66bd-x86-HVM-cleanup-after-failed-viridian_vcpu_init.patch
  616e7cfe-x86-paging-restrict-paddr-width-reported.patch
  618289da-x86-shstk-fix-with-XPTI-active.patch
  619b7ac9-harden-assign_pages.patch
  619b8cb0-x86-PoD-misaligned-GFNs.patch
  619b8cb1-x86-PoD-intermediate-page-orders.patch
  619b8cb2-x86-P2M-set-partial-success.patch
- Drop xsa patches in favor of upstream versions
  xsa385.patch
  xsa388-1.patch
  xsa388-2.patch
  xsa389.patch</changelog>
  <changelog author="jfehlig@suse.com" date="1641297600">- Collect active VM config files in the supportconfig plugin
  xen-supportconfig</changelog>
  <changelog author="jbeulich@suse.com" date="1641816000">- bsc#1193447 - Slow execution of hvmloader+ovmf when VM contains an sriov device
  61bc429f-revert-hvmloader-PA-range-should-be-UC.patch
- Upstream bug fixes (bsc#1027519)
  61b31d5c-x86-restrict-all-but-self-IPI.patch
  61b88e78-x86-CPUID-TSXLDTRK-definition.patch
  61d5687a-x86-spec-ctrl-opt_srb_lock-default.patch</changelog>
  <changelog author="carnold@suse.com" date="1641988800">- bsc#1191668 - L3: issue around xl and virsh operation - virsh
  list not giving any output (see also bsc#1194267)
  libxl-dont-try-to-free-a-NULL-list-of-vcpus.patch
  libxl-dont-touch-nr_vcpus_out-if-listing-vcpus-and-returning-NULL.patch</changelog>
  <changelog author="carnold@suse.com" date="1642075200">- bsc#1194576 - VUL-0: CVE-2022-23033: xen: arm:
  guest_physmap_remove_page not removing the p2m mappings (XSA-393)
  xsa393.patch
- bsc#1194581 - VUL-0: CVE-2022-23034: xen: a PV guest could DoS
  Xen while unmapping a grant (XSA-394)
  xsa394.patch
- bsc#1194588 - VUL-0: CVE-2022-23035: xen: insufficient cleanup of
  passed-through device IRQs (XSA-395)
  xsa395.patch</changelog>
  <changelog author="carnold@suse.com" date="1643803200">- Update to Xen 4.14.4 bug fix release (bsc#1027519)
  xen-4.14.4-testing-src.tar.bz2
- Drop patches contained in new tarball
  6138b7a1-x86-spec-ctrl-split-diagnostics-line.patch
  6138b7a2-x86-AMD-enum-speculative-hints.patch
  6138b7a3-x86-AMD-use-newer-SSBD.patch
  6139f1b1-x86-spec-ctrl-print-AMD-features.patch
  6148453b-VT-d-hidden-devices-unmap.patch
  6148455f-VT-d-PCI-segment-numbers-16-bits.patch
  61532102-PCI-bridge-with-subord-bus-0xFF.patch
  615c9fd0-VT-d-fix-deassign-of-device-with-RMRR.patch
  61655b5a-AMD-IOMMU-hidden-devices-flush.patch
  616d66bd-x86-HVM-cleanup-after-failed-viridian_vcpu_init.patch
  616e7cfe-x86-paging-restrict-paddr-width-reported.patch
  618289da-x86-shstk-fix-with-XPTI-active.patch
  619b7ac9-harden-assign_pages.patch
  619b8cb0-x86-PoD-misaligned-GFNs.patch
  619b8cb1-x86-PoD-intermediate-page-orders.patch
  619b8cb2-x86-P2M-set-partial-success.patch
  61b31d5c-x86-restrict-all-but-self-IPI.patch
  61b88e78-x86-CPUID-TSXLDTRK-definition.patch
  61bc429f-revert-hvmloader-PA-range-should-be-UC.patch
  61d5687a-x86-spec-ctrl-opt_srb_lock-default.patch
  xsa393.patch
  xsa394.patch
  xsa395.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1644408000">- bsc#1191668 - L3: issue around xl and virsh operation - virsh
  list not giving any output
  Replace
    libxl-dont-try-to-free-a-NULL-list-of-vcpus.patch
    libxl-dont-touch-nr_vcpus_out-if-listing-vcpus-and-returning-NULL.patch
  by upstream backport
    61f7b2af-libxl-dont-touch-nr_vcpus_out-if-listing.patch
- Upstream bug fixes (bsc#1027519)
  60782745-x86-AMD-split-LFENCE-setup.patch
  6081bae4-x86-cpuid-LFENCE-always-serialising.patch
  61f2d886-x86-CPUID-disentangle-new-leaves-logic.patch
  61f2d887-x86-CPUID-leaf-7-1-EBX-infra.patch
  61f2dd76-x86-SPEC_CTRL-migration-compatibility.patch
  61f933a4-x86-cpuid-advertise-SSB_NO.patch
  61f933a5-x86-drop-use_spec_ctrl-boolean.patch
  61f933a6-x86-new-has_spec_ctrl-boolean.patch
  61f933a7-x86-dont-use-spec_ctrl-enter-exit-for-S3.patch
  61f933a8-x86-SPEC_CTRL-record-last-write.patch
  61f933a9-x86-SPEC_CTRL-use-common-logic-for-AMD.patch
  61f933aa-SVM-SPEC_CTRL-entry-exit-logic.patch
  61f933ab-x86-AMD-SPEC_CTRL-infra.patch
  61f933ac-SVM-enable-MSR_SPEC_CTRL-for-guests.patch
  61f946a2-VMX-drop-SPEC_CTRL-load-on-VMEntry.patch
  6202afa3-x86-clean-up-MSR_MCU_OPT_CTRL-handling.patch
  6202afa4-x86-TSX-move-has_rtm_always_abort.patch
  6202afa5-x86-TSX-cope-with-deprecation-on-WHL-R-CFL-R.patch
  6202afa7-x86-CPUID-leaf-7-2-EDX-infra.patch
  6202afa8-x86-Intel-PSFD-for-guests.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1647345600">- bsc#1196915 - VUL-0: CVE-2022-0001, CVE-2022-0002,CVE-2021-26401:
  xen: BHB speculation issues (XSA-398)
  62278667-Arm-introduce-new-processors.patch
  62278668-Arm-move-errata-CSV2-check-earlier.patch
  62278669-Arm-add-ECBHB-and-CLEARBHB-ID-fields.patch
  6227866a-Arm-Spectre-BHB-handling.patch
  6227866b-Arm-allow-SMCCC_ARCH_WORKAROUND_3-use.patch
  6227866c-x86-AMD-cease-using-thunk-lfence.patch</changelog>
  <changelog author="carnold@suse.com" date="1649073600">- bsc#1197423 - VUL-0: CVE-2022-26356: xen: Racy interactions
  between dirty vram tracking and paging log dirty hypercalls
  (XSA-397)
  xsa397.patch
- bsc#1197425 - VUL-0: CVE-2022-26357: xen: race in VT-d domain ID
  cleanup (XSA-399)
  xsa399.patch
- bsc#1197426 - VUL-0: CVE-2022-26358,CVE-2022-26359,
  CVE-2022-26360,CVE-2022-26361: xen: IOMMU: RMRR (VT-d) and unity
  map (AMD-Vi) handling issues (XSA-400)
  xsa400-01.patch
  xsa400-02.patch
  xsa400-03.patch
  xsa400-04.patch
  xsa400-05.patch
  xsa400-06.patch
  xsa400-07.patch
  xsa400-08.patch
  xsa400-09.patch
  xsa400-10.patch
  xsa400-11.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1649419200">- bsc#1197426 - VUL-0: CVE-2022-26358,CVE-2022-26359,
  CVE-2022-26360,CVE-2022-26361: xen: IOMMU: RMRR (VT-d) and unity
  map (AMD-Vi) handling issues (XSA-400)
  624ebcef-VT-d-dont-needlessly-look-up-DID.patch
  624ebd3b-VT-d-avoid-NULL-deref-on-dcmo-error-paths.patch
  624ebd74-VT-d-avoid-infinite-recursion-on-dcmo-error-path.patch</changelog>
  <changelog author="carnold@suse.com" date="1649851200">- Update to Xen 4.14.5 bug fix release (bsc#1027519)
  xen-4.14.5-testing-src.tar.bz2
- Drop patches contained in new tarball
  60782745-x86-AMD-split-LFENCE-setup.patch
  6081bae4-x86-cpuid-LFENCE-always-serialising.patch
  61f2d886-x86-CPUID-disentangle-new-leaves-logic.patch
  61f2d887-x86-CPUID-leaf-7-1-EBX-infra.patch
  61f2dd76-x86-SPEC_CTRL-migration-compatibility.patch
  61f933a4-x86-cpuid-advertise-SSB_NO.patch
  61f933a5-x86-drop-use_spec_ctrl-boolean.patch
  61f933a6-x86-new-has_spec_ctrl-boolean.patch
  61f933a7-x86-dont-use-spec_ctrl-enter-exit-for-S3.patch
  61f933a8-x86-SPEC_CTRL-record-last-write.patch
  61f933a9-x86-SPEC_CTRL-use-common-logic-for-AMD.patch
  61f933aa-SVM-SPEC_CTRL-entry-exit-logic.patch
  61f933ab-x86-AMD-SPEC_CTRL-infra.patch
  61f933ac-SVM-enable-MSR_SPEC_CTRL-for-guests.patch
  61f946a2-VMX-drop-SPEC_CTRL-load-on-VMEntry.patch
  6202afa3-x86-clean-up-MSR_MCU_OPT_CTRL-handling.patch
  6202afa4-x86-TSX-move-has_rtm_always_abort.patch
  6202afa5-x86-TSX-cope-with-deprecation-on-WHL-R-CFL-R.patch
  6202afa7-x86-CPUID-leaf-7-2-EDX-infra.patch
  6202afa8-x86-Intel-PSFD-for-guests.patch
  62278667-Arm-introduce-new-processors.patch
  62278668-Arm-move-errata-CSV2-check-earlier.patch
  62278669-Arm-add-ECBHB-and-CLEARBHB-ID-fields.patch
  6227866a-Arm-Spectre-BHB-handling.patch
  6227866b-Arm-allow-SMCCC_ARCH_WORKAROUND_3-use.patch
  6227866c-x86-AMD-cease-using-thunk-lfence.patch
  624ebcef-VT-d-dont-needlessly-look-up-DID.patch
  624ebd3b-VT-d-avoid-NULL-deref-on-dcmo-error-paths.patch
  624ebd74-VT-d-avoid-infinite-recursion-on-dcmo-error-path.patch
  xsa397.patch
  xsa399.patch
  xsa400-01.patch
  xsa400-02.patch
  xsa400-03.patch
  xsa400-04.patch
  xsa400-05.patch
  xsa400-06.patch
  xsa400-07.patch
  xsa400-08.patch
  xsa400-09.patch
  xsa400-10.patch
  xsa400-11.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1653998400">- Upstream bug fixes (bsc#1027519)
  625fca42-VT-d-reserved-CAP-ND.patch
  627549d6-IO-shutdown-race.patch
- bsc#1199965 - VUL-0: EMBARGOED: CVE-2022-26362: xen: Race condition
  in typeref acquisition
  xsa401-1.patch
  xsa401-2.patch
- bsc#1199966 - VUL-0: EMBARGOED: CVE-2022-26363,CVE-2022-26364: xen:
  Insufficient care with non-coherent mappings
  xsa402-1.patch
  xsa402-2.patch
  xsa402-3.patch
  xsa402-4.patch
  xsa402-5.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1654689600">- bsc#1199966 - VUL-0: EMBARGOED: CVE-2022-26363,CVE-2022-26364: xen:
  Insufficient care with non-coherent mappings
  fix xsa402-5.patch</changelog>
  <changelog author="carnold@suse.com" date="1657627200">- bsc#1201394 - VUL-0: CVE-2022-33745: xen: insufficient TLB flush
  for x86 PV guests in shadow mode (XSA-408)
  xsa408.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1657886400">- bsc#1199965 - VUL-0: CVE-2022-26362: xen: Race condition
  in typeref acquisition
  62a1e594-x86-clean-up-_get_page_type.patch
  62a1e5b0-x86-ABAC-race-in-_get_page_type.patch
- bsc#1199966 - VUL-0: CVE-2022-26363,CVE-2022-26364: xen:
  Insufficient care with non-coherent mappings
  62a1e5d2-x86-introduce-_PAGE_-for-mem-types.patch
  62a1e5f0-x86-dont-change-cacheability-of-directmap.patch
  62a1e60e-x86-split-cache_flush-out-of-cache_writeback.patch
  62a1e62b-x86-AMD-work-around-CLFLUSH-ordering.patch
  62a1e649-x86-track-and-flush-non-coherent.patch
- bsc#1200549 VUL-0: CVE-2022-21123,CVE-2022-21125,CVE-2022-21166:
  xen: x86: MMIO Stale Data vulnerabilities (XSA-404)
  62ab0fab-x86-spec-ctrl-VERW-flushing-runtime-cond.patch
  62ab0fac-x86-spec-ctrl-enum-for-MMIO-Stale-Data.patch
  62ab0fad-x86-spec-ctrl-add-unpriv-mmio.patch
- bsc#1201469 - VUL-0: CVE-2022-23816,CVE-2022-23825,CVE-2022-29900:
  xen: retbleed - arbitrary speculative code execution with return
  instructions (XSA-407)
  62cc31ee-cmdline-extend-parse_boolean.patch
  62cc31ef-x86-spec-ctrl-fine-grained-cmdline-subopts.patch
  62cd91d0-x86-spec-ctrl-rework-context-switching.patch
  62cd91d1-x86-spec-ctrl-rename-SCF_ist_wrmsr.patch
  62cd91d2-x86-spec-ctrl-rename-opt_ibpb.patch
  62cd91d3-x86-spec-ctrl-rework-SPEC_CTRL_ENTRY_FROM_INTR_IST.patch
  62cd91d4-x86-spec-ctrl-IBPB-on-entry.patch
  62cd91d5-x86-cpuid-BTC_NO-enum.patch
  62cd91d6-x86-spec-ctrl-enable-Zen2-chickenbit.patch
  62cd91d7-x86-spec-ctrl-mitigate-Branch-Type-Confusion.patch
- Upstream bug fixes (bsc#1027519)
  62bdd840-x86-spec-ctrl-only-adjust-idle-with-legacy-IBRS.patch
  62bdd841-x86-spec-ctrl-knobs-for-STIBP-and-PSFD.patch
- Drop patches replaced by upstream versions
  xsa401-1.patch
  xsa401-2.patch
  xsa402-1.patch
  xsa402-2.patch
  xsa402-3.patch
  xsa402-4.patch
  xsa402-5.patch</changelog>
</package>
<package pkgid="9f9a414e08c66a1582bf0cec5f626ec1ec72a45a01fb4195dd69fbb22b0a27cf" name="zypper" arch="aarch64">
  <version epoch="0" ver="1.14.52" rel="150200.30.2"/>
  <changelog author="ma@suse.de" date="1574942400">- Introduce purge-kernels command (bsc#1155198)
  Adds a new zypper command to cleanup all obsolete kernels as
  configured by the user.
- Request root privs for zypper addlocale and removelocale.
- Load only target resolvables for removelocale.
- Load only target resolvables for zypper rm (bsc#1157377)
- Fix broken search by filelist (bsc#1135114 )
- zypper-log: Replace python by a bash script (fixes#304,
  fixes#306, bsc#1156158)
- locales: do not sort out requested locales which are not
  available (bsc#1155678)
- list_patches_by_issue: rewrite table output and add xml output
  (bsc#1154805)
  Prevent listing duplicate matches in tables. XML result is
  provided within the new &lt;list-patches-byissue&gt; element.
- list-patches: XML add patch &lt;issue-date&gt; and &lt;issue-list&gt;
  (bsc#1154805)
- Fix zypper lp --cve/bugzilla/issue options (bsc#1155298)
- Always execute commit when adding/removing locales (fixes
  bsc#1155205)
- man page: fix description of --table-style,-s (bsc#1154804)
- Provide reverse search in zypper (fixes #214)
  This patch adds a new set of switches to zypper to support
  searching reverse dependencies for a package or a set of packages.
- BuildRequires:  libzypp-devel &gt;= 17.16.1.
- version 1.14.33</changelog>
  <changelog author="ma@suse.de" date="1582286400">- Do not allow the abbreviation of cli arguments (bsc#1164543)
- accoring to according in all translation files.
- Always show exception history if available.
- Use default package cache location for temporary repos (bsc#1130873)
- version 1.14.34</changelog>
  <changelog author="ma@suse.de" date="1584705600">- Tag 'retracted' patch status in info and list-patches (jsc#SLE-8770)
- Tag 'R'etracted items in search tabes status columns (jsc#SLE-8770)
- Relax 'Do not allow the abbreviation of cli arguments' in
  legacy distibutions (bsc#1164543)
- Correctly detect ambigous switch abbreviations (bsc#1165573)
- zypper-aptitude: don't supplement zypper.
  supplementing zypper means zypper-aptitude gets installed by
  default and pulls in perl. Neither is desired on small systems.
- BuildRequires:  libzypp-devel &gt;= 17.23.2.
- version 1.14.35</changelog>
  <changelog author="ma@suse.de" date="1586779200">- Reformat manpages to workaround asciidoctor shortcomings
  (bsc#1154803, bsc#1167122, bsc#1168990)
- Remove undocumented rug legacy stuff.
- Remove 'using namespace std;' (bsc#1166610)
- patch table: Add 'Since' column if history data are available
  (jsc#SLE-5116)
- version 1.14.36</changelog>
  <changelog author="bzeller@suse.de" date="1592222400">- Print switch abbrev warning to stderr (bsc#1172925)
- Fix typo in man page (bsc#1169947)
- version 1.14.37</changelog>
  <changelog author="ma@suse.de" date="1598616000">- Directly list subcommands in 'zypper help' (bsc#1165424)
- man: enhance description of the global package cache (bsc#1175592)
- Remove extern C block wrapping augeas.h as it breaks the build
  on Arch Linux.
- Point out that plaindir repos do not follow symlinks (bsc#1174561)
- Fix help command for list-patches
- man: Point out that plain rpm packages are not downloaded to the
  global package cache (bsc#1173273)
- version 1.14.38</changelog>
  <changelog author="ma@suse.de" date="1600430400">- Use new testcase API in libzypp.
- BuildRequires:  libzypp-devel &gt;= 17.25.0.
- help: prevent 'whatis' from writing to stderr (bsc#1176712)
- wp: point out that command is aliased to a search command and
  searches case-insensitive (jsc#SLE-16271)
- version 1.14.39</changelog>
  <changelog author="ma@suse.de" date="1601035200">- info: Assume descriptions starting with '&lt;p&gt;' are richtext
  (bsc#935885)
- version 1.14.40</changelog>
  <changelog author="ma@suse.de" date="1606478400">- Avoid translated text in xml attributes ( fixes #361 )
- BuildRequires:  libzypp-devel &gt;= 17.25.3.
  Adapt to new LoadTestcase API.
- version 1.14.41</changelog>
  <changelog author="ma@suse.de" date="1610452800">- Fix source-download commnds help (bsc#1180663)
- man: Recommend to use the --non-interactive global option
  rather than the command option -y (bsc#1179816)
- Extend apt packagemap (fixes #366)
- --quitet: Fix install summary to write nothing if there's
  nothing todo (bsc#1180077)
- Prefer /run over /var/run.
- version 1.14.42</changelog>
  <changelog author="ma@suse.de" date="1614168000">- doc: give more details about creating versioned package locks
  (bsc#1181622)
- man: Document synonymously used patch categories (bsc#1179847)
- version 1.14.43</changelog>
  <changelog author="ma@suse.de" date="1619784000">- Rephrase needs-rebooting help and messages.
  Try to point out that the need to reboot was not necessarily
  triggered by the current transaction.
- man page: Recommend the needs-rebooting command to test whether
  a system reboot is suggested.
- patch: Let a patch's reboot-needed flag overrule included packages
  (bsc#1183268)
- Quickfix setting "openSUSE_Tumbleweed" as default platform for
  "MicroOS" (bsc#1153687)
  This fixes the guessed platform for "obs://&lt;project&gt;/" URLs.
- Protect against strict/relaxed user umask via sudo (bsc#1183589)
- zypper-log: protect against thread name indicators in a log.
- xml summary: add solvables repository alias (bsc#1182372)
- version 1.14.44</changelog>
  <changelog author="ma@suse.de" date="1622635200">- Add hints to 'trust GPG key' prompt.
- Add report when receiving new package signing keys from a
  trusted repo (bsc#1184326)
- Added translation using Weblate (Kabyle)
- version 1.14.45</changelog>
  <changelog author="ma@suse.de" date="1623326400">- Link all executables with -pie (bsc#1186447)
- Tag PTF packages in the status column (bsc#1186503)
  Like retracted packages, a program temporary fix must be
  explicitly selected and will otherwise not be considered in
  dependency resolution.
- BuildRequires:  libzypp-devel &gt;= 17.26.1.
- version 1.14.46</changelog>
  <changelog author="ma@suse.de" date="1625140800">- Quick fix obs:// platform guessing for Leap (bsc#1187425)
- man: point out more clearly that patches update affected
  packages to the latest version (bsc#1187466)
- version 1.14.47</changelog>
  <changelog author="ma@suse.de" date="1627473600">- Support new reports for singletrans rpm commit.
- BuildRequires:  libzypp-devel &gt;= 17.27.1.
  For lock/query comments.
- Prompt: choose exact match if prompt options are not prefix
  free (bsc#1188156)
- Install summary: Show new and removed packages closer to the
  prompt (fixes #403)
  These packages are usually more interesting than the updated
  ones. In case of doubt less scrolling is needed to see them.
- Add need reboot/restart hint to XML install summary
  (bsc#1188435)
- Add comment option for lock command (fixes #388).
- version 1.14.48</changelog>
  <changelog author="ma@suse.de" date="1630670400">- Avoid calling 'su' to detect a too restrictive sudo user umask
  (bsc#1186602)
- Fix typo in German translation (fixes #395)
- BuildRequires:  libzypp-devel &gt;= 17.28.3.
- version 1.14.49</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Fix compiler warning.
- zypper.conf: New option whether to collect subcommands found in
  $PATH (fixes #379)
  +[subcommand] i
  +
  +##  Whether to look for subcommands in $PATH
  +##
  +## If a subcommand is not found in the zypper_execdir, the wrapper
  +## will look in the rest of your $PATH for it. Thus, it's possible
  +## to write local zypper extensions that don't live in system space.
  +## See section SUBCOMMANDS in the zypper manpage.
  +##
  +## Valid values: boolean
  +## Default value: yes
  +##
  +# seachSubcommandInPath = yes.
- help subcommand: show path of command found in $PATH.
- version 1.14.50</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Singletrans: handle fatal and non-fatal script errors properly.
- Add SingleTransReportReceiver.
- Immediately write out additional rpm output.
- BuildRequires:  libzypp-devel &gt;= 17.29.0.
  Need SingleTransReport and immediate rpm script output reports.
- version 1.14.51</changelog>
  <changelog author="ma@suse.de" date="1645704000">- info: print the packages upstream URL if available (fixes #426)
- info: Fix SEGV with not installed PTFs (bsc#1196317)
- Don't prevent less restrictive umasks (bsc#1195999)
- version 1.14.52</changelog>
</package>
<package pkgid="3059952e3e3967edf626754a972cb10d3dd7a3ec7e5426303063b79d95e8c139" name="zypper" arch="src">
  <version epoch="0" ver="1.14.52" rel="150200.30.2"/>
  <changelog author="ma@suse.de" date="1574942400">- Introduce purge-kernels command (bsc#1155198)
  Adds a new zypper command to cleanup all obsolete kernels as
  configured by the user.
- Request root privs for zypper addlocale and removelocale.
- Load only target resolvables for removelocale.
- Load only target resolvables for zypper rm (bsc#1157377)
- Fix broken search by filelist (bsc#1135114 )
- zypper-log: Replace python by a bash script (fixes#304,
  fixes#306, bsc#1156158)
- locales: do not sort out requested locales which are not
  available (bsc#1155678)
- list_patches_by_issue: rewrite table output and add xml output
  (bsc#1154805)
  Prevent listing duplicate matches in tables. XML result is
  provided within the new &lt;list-patches-byissue&gt; element.
- list-patches: XML add patch &lt;issue-date&gt; and &lt;issue-list&gt;
  (bsc#1154805)
- Fix zypper lp --cve/bugzilla/issue options (bsc#1155298)
- Always execute commit when adding/removing locales (fixes
  bsc#1155205)
- man page: fix description of --table-style,-s (bsc#1154804)
- Provide reverse search in zypper (fixes #214)
  This patch adds a new set of switches to zypper to support
  searching reverse dependencies for a package or a set of packages.
- BuildRequires:  libzypp-devel &gt;= 17.16.1.
- version 1.14.33</changelog>
  <changelog author="ma@suse.de" date="1582286400">- Do not allow the abbreviation of cli arguments (bsc#1164543)
- accoring to according in all translation files.
- Always show exception history if available.
- Use default package cache location for temporary repos (bsc#1130873)
- version 1.14.34</changelog>
  <changelog author="ma@suse.de" date="1584705600">- Tag 'retracted' patch status in info and list-patches (jsc#SLE-8770)
- Tag 'R'etracted items in search tabes status columns (jsc#SLE-8770)
- Relax 'Do not allow the abbreviation of cli arguments' in
  legacy distibutions (bsc#1164543)
- Correctly detect ambigous switch abbreviations (bsc#1165573)
- zypper-aptitude: don't supplement zypper.
  supplementing zypper means zypper-aptitude gets installed by
  default and pulls in perl. Neither is desired on small systems.
- BuildRequires:  libzypp-devel &gt;= 17.23.2.
- version 1.14.35</changelog>
  <changelog author="ma@suse.de" date="1586779200">- Reformat manpages to workaround asciidoctor shortcomings
  (bsc#1154803, bsc#1167122, bsc#1168990)
- Remove undocumented rug legacy stuff.
- Remove 'using namespace std;' (bsc#1166610)
- patch table: Add 'Since' column if history data are available
  (jsc#SLE-5116)
- version 1.14.36</changelog>
  <changelog author="bzeller@suse.de" date="1592222400">- Print switch abbrev warning to stderr (bsc#1172925)
- Fix typo in man page (bsc#1169947)
- version 1.14.37</changelog>
  <changelog author="ma@suse.de" date="1598616000">- Directly list subcommands in 'zypper help' (bsc#1165424)
- man: enhance description of the global package cache (bsc#1175592)
- Remove extern C block wrapping augeas.h as it breaks the build
  on Arch Linux.
- Point out that plaindir repos do not follow symlinks (bsc#1174561)
- Fix help command for list-patches
- man: Point out that plain rpm packages are not downloaded to the
  global package cache (bsc#1173273)
- version 1.14.38</changelog>
  <changelog author="ma@suse.de" date="1600430400">- Use new testcase API in libzypp.
- BuildRequires:  libzypp-devel &gt;= 17.25.0.
- help: prevent 'whatis' from writing to stderr (bsc#1176712)
- wp: point out that command is aliased to a search command and
  searches case-insensitive (jsc#SLE-16271)
- version 1.14.39</changelog>
  <changelog author="ma@suse.de" date="1601035200">- info: Assume descriptions starting with '&lt;p&gt;' are richtext
  (bsc#935885)
- version 1.14.40</changelog>
  <changelog author="ma@suse.de" date="1606478400">- Avoid translated text in xml attributes ( fixes #361 )
- BuildRequires:  libzypp-devel &gt;= 17.25.3.
  Adapt to new LoadTestcase API.
- version 1.14.41</changelog>
  <changelog author="ma@suse.de" date="1610452800">- Fix source-download commnds help (bsc#1180663)
- man: Recommend to use the --non-interactive global option
  rather than the command option -y (bsc#1179816)
- Extend apt packagemap (fixes #366)
- --quitet: Fix install summary to write nothing if there's
  nothing todo (bsc#1180077)
- Prefer /run over /var/run.
- version 1.14.42</changelog>
  <changelog author="ma@suse.de" date="1614168000">- doc: give more details about creating versioned package locks
  (bsc#1181622)
- man: Document synonymously used patch categories (bsc#1179847)
- version 1.14.43</changelog>
  <changelog author="ma@suse.de" date="1619784000">- Rephrase needs-rebooting help and messages.
  Try to point out that the need to reboot was not necessarily
  triggered by the current transaction.
- man page: Recommend the needs-rebooting command to test whether
  a system reboot is suggested.
- patch: Let a patch's reboot-needed flag overrule included packages
  (bsc#1183268)
- Quickfix setting "openSUSE_Tumbleweed" as default platform for
  "MicroOS" (bsc#1153687)
  This fixes the guessed platform for "obs://&lt;project&gt;/" URLs.
- Protect against strict/relaxed user umask via sudo (bsc#1183589)
- zypper-log: protect against thread name indicators in a log.
- xml summary: add solvables repository alias (bsc#1182372)
- version 1.14.44</changelog>
  <changelog author="ma@suse.de" date="1622635200">- Add hints to 'trust GPG key' prompt.
- Add report when receiving new package signing keys from a
  trusted repo (bsc#1184326)
- Added translation using Weblate (Kabyle)
- version 1.14.45</changelog>
  <changelog author="ma@suse.de" date="1623326400">- Link all executables with -pie (bsc#1186447)
- Tag PTF packages in the status column (bsc#1186503)
  Like retracted packages, a program temporary fix must be
  explicitly selected and will otherwise not be considered in
  dependency resolution.
- BuildRequires:  libzypp-devel &gt;= 17.26.1.
- version 1.14.46</changelog>
  <changelog author="ma@suse.de" date="1625140800">- Quick fix obs:// platform guessing for Leap (bsc#1187425)
- man: point out more clearly that patches update affected
  packages to the latest version (bsc#1187466)
- version 1.14.47</changelog>
  <changelog author="ma@suse.de" date="1627473600">- Support new reports for singletrans rpm commit.
- BuildRequires:  libzypp-devel &gt;= 17.27.1.
  For lock/query comments.
- Prompt: choose exact match if prompt options are not prefix
  free (bsc#1188156)
- Install summary: Show new and removed packages closer to the
  prompt (fixes #403)
  These packages are usually more interesting than the updated
  ones. In case of doubt less scrolling is needed to see them.
- Add need reboot/restart hint to XML install summary
  (bsc#1188435)
- Add comment option for lock command (fixes #388).
- version 1.14.48</changelog>
  <changelog author="ma@suse.de" date="1630670400">- Avoid calling 'su' to detect a too restrictive sudo user umask
  (bsc#1186602)
- Fix typo in German translation (fixes #395)
- BuildRequires:  libzypp-devel &gt;= 17.28.3.
- version 1.14.49</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Fix compiler warning.
- zypper.conf: New option whether to collect subcommands found in
  $PATH (fixes #379)
  +[subcommand] i
  +
  +##  Whether to look for subcommands in $PATH
  +##
  +## If a subcommand is not found in the zypper_execdir, the wrapper
  +## will look in the rest of your $PATH for it. Thus, it's possible
  +## to write local zypper extensions that don't live in system space.
  +## See section SUBCOMMANDS in the zypper manpage.
  +##
  +## Valid values: boolean
  +## Default value: yes
  +##
  +# seachSubcommandInPath = yes.
- help subcommand: show path of command found in $PATH.
- version 1.14.50</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Singletrans: handle fatal and non-fatal script errors properly.
- Add SingleTransReportReceiver.
- Immediately write out additional rpm output.
- BuildRequires:  libzypp-devel &gt;= 17.29.0.
  Need SingleTransReport and immediate rpm script output reports.
- version 1.14.51</changelog>
  <changelog author="ma@suse.de" date="1645704000">- info: print the packages upstream URL if available (fixes #426)
- info: Fix SEGV with not installed PTFs (bsc#1196317)
- Don't prevent less restrictive umasks (bsc#1195999)
- version 1.14.52</changelog>
</package>
<package pkgid="972c7d7233db73947e54a887164140df4e010430e5e57a7b76240f14c552ead4" name="zypper" arch="x86_64">
  <version epoch="0" ver="1.14.52" rel="150200.30.2"/>
  <changelog author="ma@suse.de" date="1574942400">- Introduce purge-kernels command (bsc#1155198)
  Adds a new zypper command to cleanup all obsolete kernels as
  configured by the user.
- Request root privs for zypper addlocale and removelocale.
- Load only target resolvables for removelocale.
- Load only target resolvables for zypper rm (bsc#1157377)
- Fix broken search by filelist (bsc#1135114 )
- zypper-log: Replace python by a bash script (fixes#304,
  fixes#306, bsc#1156158)
- locales: do not sort out requested locales which are not
  available (bsc#1155678)
- list_patches_by_issue: rewrite table output and add xml output
  (bsc#1154805)
  Prevent listing duplicate matches in tables. XML result is
  provided within the new &lt;list-patches-byissue&gt; element.
- list-patches: XML add patch &lt;issue-date&gt; and &lt;issue-list&gt;
  (bsc#1154805)
- Fix zypper lp --cve/bugzilla/issue options (bsc#1155298)
- Always execute commit when adding/removing locales (fixes
  bsc#1155205)
- man page: fix description of --table-style,-s (bsc#1154804)
- Provide reverse search in zypper (fixes #214)
  This patch adds a new set of switches to zypper to support
  searching reverse dependencies for a package or a set of packages.
- BuildRequires:  libzypp-devel &gt;= 17.16.1.
- version 1.14.33</changelog>
  <changelog author="ma@suse.de" date="1582286400">- Do not allow the abbreviation of cli arguments (bsc#1164543)
- accoring to according in all translation files.
- Always show exception history if available.
- Use default package cache location for temporary repos (bsc#1130873)
- version 1.14.34</changelog>
  <changelog author="ma@suse.de" date="1584705600">- Tag 'retracted' patch status in info and list-patches (jsc#SLE-8770)
- Tag 'R'etracted items in search tabes status columns (jsc#SLE-8770)
- Relax 'Do not allow the abbreviation of cli arguments' in
  legacy distibutions (bsc#1164543)
- Correctly detect ambigous switch abbreviations (bsc#1165573)
- zypper-aptitude: don't supplement zypper.
  supplementing zypper means zypper-aptitude gets installed by
  default and pulls in perl. Neither is desired on small systems.
- BuildRequires:  libzypp-devel &gt;= 17.23.2.
- version 1.14.35</changelog>
  <changelog author="ma@suse.de" date="1586779200">- Reformat manpages to workaround asciidoctor shortcomings
  (bsc#1154803, bsc#1167122, bsc#1168990)
- Remove undocumented rug legacy stuff.
- Remove 'using namespace std;' (bsc#1166610)
- patch table: Add 'Since' column if history data are available
  (jsc#SLE-5116)
- version 1.14.36</changelog>
  <changelog author="bzeller@suse.de" date="1592222400">- Print switch abbrev warning to stderr (bsc#1172925)
- Fix typo in man page (bsc#1169947)
- version 1.14.37</changelog>
  <changelog author="ma@suse.de" date="1598616000">- Directly list subcommands in 'zypper help' (bsc#1165424)
- man: enhance description of the global package cache (bsc#1175592)
- Remove extern C block wrapping augeas.h as it breaks the build
  on Arch Linux.
- Point out that plaindir repos do not follow symlinks (bsc#1174561)
- Fix help command for list-patches
- man: Point out that plain rpm packages are not downloaded to the
  global package cache (bsc#1173273)
- version 1.14.38</changelog>
  <changelog author="ma@suse.de" date="1600430400">- Use new testcase API in libzypp.
- BuildRequires:  libzypp-devel &gt;= 17.25.0.
- help: prevent 'whatis' from writing to stderr (bsc#1176712)
- wp: point out that command is aliased to a search command and
  searches case-insensitive (jsc#SLE-16271)
- version 1.14.39</changelog>
  <changelog author="ma@suse.de" date="1601035200">- info: Assume descriptions starting with '&lt;p&gt;' are richtext
  (bsc#935885)
- version 1.14.40</changelog>
  <changelog author="ma@suse.de" date="1606478400">- Avoid translated text in xml attributes ( fixes #361 )
- BuildRequires:  libzypp-devel &gt;= 17.25.3.
  Adapt to new LoadTestcase API.
- version 1.14.41</changelog>
  <changelog author="ma@suse.de" date="1610452800">- Fix source-download commnds help (bsc#1180663)
- man: Recommend to use the --non-interactive global option
  rather than the command option -y (bsc#1179816)
- Extend apt packagemap (fixes #366)
- --quitet: Fix install summary to write nothing if there's
  nothing todo (bsc#1180077)
- Prefer /run over /var/run.
- version 1.14.42</changelog>
  <changelog author="ma@suse.de" date="1614168000">- doc: give more details about creating versioned package locks
  (bsc#1181622)
- man: Document synonymously used patch categories (bsc#1179847)
- version 1.14.43</changelog>
  <changelog author="ma@suse.de" date="1619784000">- Rephrase needs-rebooting help and messages.
  Try to point out that the need to reboot was not necessarily
  triggered by the current transaction.
- man page: Recommend the needs-rebooting command to test whether
  a system reboot is suggested.
- patch: Let a patch's reboot-needed flag overrule included packages
  (bsc#1183268)
- Quickfix setting "openSUSE_Tumbleweed" as default platform for
  "MicroOS" (bsc#1153687)
  This fixes the guessed platform for "obs://&lt;project&gt;/" URLs.
- Protect against strict/relaxed user umask via sudo (bsc#1183589)
- zypper-log: protect against thread name indicators in a log.
- xml summary: add solvables repository alias (bsc#1182372)
- version 1.14.44</changelog>
  <changelog author="ma@suse.de" date="1622635200">- Add hints to 'trust GPG key' prompt.
- Add report when receiving new package signing keys from a
  trusted repo (bsc#1184326)
- Added translation using Weblate (Kabyle)
- version 1.14.45</changelog>
  <changelog author="ma@suse.de" date="1623326400">- Link all executables with -pie (bsc#1186447)
- Tag PTF packages in the status column (bsc#1186503)
  Like retracted packages, a program temporary fix must be
  explicitly selected and will otherwise not be considered in
  dependency resolution.
- BuildRequires:  libzypp-devel &gt;= 17.26.1.
- version 1.14.46</changelog>
  <changelog author="ma@suse.de" date="1625140800">- Quick fix obs:// platform guessing for Leap (bsc#1187425)
- man: point out more clearly that patches update affected
  packages to the latest version (bsc#1187466)
- version 1.14.47</changelog>
  <changelog author="ma@suse.de" date="1627473600">- Support new reports for singletrans rpm commit.
- BuildRequires:  libzypp-devel &gt;= 17.27.1.
  For lock/query comments.
- Prompt: choose exact match if prompt options are not prefix
  free (bsc#1188156)
- Install summary: Show new and removed packages closer to the
  prompt (fixes #403)
  These packages are usually more interesting than the updated
  ones. In case of doubt less scrolling is needed to see them.
- Add need reboot/restart hint to XML install summary
  (bsc#1188435)
- Add comment option for lock command (fixes #388).
- version 1.14.48</changelog>
  <changelog author="ma@suse.de" date="1630670400">- Avoid calling 'su' to detect a too restrictive sudo user umask
  (bsc#1186602)
- Fix typo in German translation (fixes #395)
- BuildRequires:  libzypp-devel &gt;= 17.28.3.
- version 1.14.49</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Fix compiler warning.
- zypper.conf: New option whether to collect subcommands found in
  $PATH (fixes #379)
  +[subcommand] i
  +
  +##  Whether to look for subcommands in $PATH
  +##
  +## If a subcommand is not found in the zypper_execdir, the wrapper
  +## will look in the rest of your $PATH for it. Thus, it's possible
  +## to write local zypper extensions that don't live in system space.
  +## See section SUBCOMMANDS in the zypper manpage.
  +##
  +## Valid values: boolean
  +## Default value: yes
  +##
  +# seachSubcommandInPath = yes.
- help subcommand: show path of command found in $PATH.
- version 1.14.50</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Singletrans: handle fatal and non-fatal script errors properly.
- Add SingleTransReportReceiver.
- Immediately write out additional rpm output.
- BuildRequires:  libzypp-devel &gt;= 17.29.0.
  Need SingleTransReport and immediate rpm script output reports.
- version 1.14.51</changelog>
  <changelog author="ma@suse.de" date="1645704000">- info: print the packages upstream URL if available (fixes #426)
- info: Fix SEGV with not installed PTFs (bsc#1196317)
- Don't prevent less restrictive umasks (bsc#1195999)
- version 1.14.52</changelog>
</package>
<package pkgid="aafd7f743e08cd0ddb5718f6209f8826dc38a3119d2f875405275d8d256e75cf" name="zypper" arch="aarch64">
  <version epoch="0" ver="1.14.53" rel="150200.33.1"/>
  <changelog author="ma@suse.de" date="1582286400">- Do not allow the abbreviation of cli arguments (bsc#1164543)
- accoring to according in all translation files.
- Always show exception history if available.
- Use default package cache location for temporary repos (bsc#1130873)
- version 1.14.34</changelog>
  <changelog author="ma@suse.de" date="1584705600">- Tag 'retracted' patch status in info and list-patches (jsc#SLE-8770)
- Tag 'R'etracted items in search tabes status columns (jsc#SLE-8770)
- Relax 'Do not allow the abbreviation of cli arguments' in
  legacy distibutions (bsc#1164543)
- Correctly detect ambigous switch abbreviations (bsc#1165573)
- zypper-aptitude: don't supplement zypper.
  supplementing zypper means zypper-aptitude gets installed by
  default and pulls in perl. Neither is desired on small systems.
- BuildRequires:  libzypp-devel &gt;= 17.23.2.
- version 1.14.35</changelog>
  <changelog author="ma@suse.de" date="1586779200">- Reformat manpages to workaround asciidoctor shortcomings
  (bsc#1154803, bsc#1167122, bsc#1168990)
- Remove undocumented rug legacy stuff.
- Remove 'using namespace std;' (bsc#1166610)
- patch table: Add 'Since' column if history data are available
  (jsc#SLE-5116)
- version 1.14.36</changelog>
  <changelog author="bzeller@suse.de" date="1592222400">- Print switch abbrev warning to stderr (bsc#1172925)
- Fix typo in man page (bsc#1169947)
- version 1.14.37</changelog>
  <changelog author="ma@suse.de" date="1598616000">- Directly list subcommands in 'zypper help' (bsc#1165424)
- man: enhance description of the global package cache (bsc#1175592)
- Remove extern C block wrapping augeas.h as it breaks the build
  on Arch Linux.
- Point out that plaindir repos do not follow symlinks (bsc#1174561)
- Fix help command for list-patches
- man: Point out that plain rpm packages are not downloaded to the
  global package cache (bsc#1173273)
- version 1.14.38</changelog>
  <changelog author="ma@suse.de" date="1600430400">- Use new testcase API in libzypp.
- BuildRequires:  libzypp-devel &gt;= 17.25.0.
- help: prevent 'whatis' from writing to stderr (bsc#1176712)
- wp: point out that command is aliased to a search command and
  searches case-insensitive (jsc#SLE-16271)
- version 1.14.39</changelog>
  <changelog author="ma@suse.de" date="1601035200">- info: Assume descriptions starting with '&lt;p&gt;' are richtext
  (bsc#935885)
- version 1.14.40</changelog>
  <changelog author="ma@suse.de" date="1606478400">- Avoid translated text in xml attributes ( fixes #361 )
- BuildRequires:  libzypp-devel &gt;= 17.25.3.
  Adapt to new LoadTestcase API.
- version 1.14.41</changelog>
  <changelog author="ma@suse.de" date="1610452800">- Fix source-download commnds help (bsc#1180663)
- man: Recommend to use the --non-interactive global option
  rather than the command option -y (bsc#1179816)
- Extend apt packagemap (fixes #366)
- --quitet: Fix install summary to write nothing if there's
  nothing todo (bsc#1180077)
- Prefer /run over /var/run.
- version 1.14.42</changelog>
  <changelog author="ma@suse.de" date="1614168000">- doc: give more details about creating versioned package locks
  (bsc#1181622)
- man: Document synonymously used patch categories (bsc#1179847)
- version 1.14.43</changelog>
  <changelog author="ma@suse.de" date="1619784000">- Rephrase needs-rebooting help and messages.
  Try to point out that the need to reboot was not necessarily
  triggered by the current transaction.
- man page: Recommend the needs-rebooting command to test whether
  a system reboot is suggested.
- patch: Let a patch's reboot-needed flag overrule included packages
  (bsc#1183268)
- Quickfix setting "openSUSE_Tumbleweed" as default platform for
  "MicroOS" (bsc#1153687)
  This fixes the guessed platform for "obs://&lt;project&gt;/" URLs.
- Protect against strict/relaxed user umask via sudo (bsc#1183589)
- zypper-log: protect against thread name indicators in a log.
- xml summary: add solvables repository alias (bsc#1182372)
- version 1.14.44</changelog>
  <changelog author="ma@suse.de" date="1622635200">- Add hints to 'trust GPG key' prompt.
- Add report when receiving new package signing keys from a
  trusted repo (bsc#1184326)
- Added translation using Weblate (Kabyle)
- version 1.14.45</changelog>
  <changelog author="ma@suse.de" date="1623326400">- Link all executables with -pie (bsc#1186447)
- Tag PTF packages in the status column (bsc#1186503)
  Like retracted packages, a program temporary fix must be
  explicitly selected and will otherwise not be considered in
  dependency resolution.
- BuildRequires:  libzypp-devel &gt;= 17.26.1.
- version 1.14.46</changelog>
  <changelog author="ma@suse.de" date="1625140800">- Quick fix obs:// platform guessing for Leap (bsc#1187425)
- man: point out more clearly that patches update affected
  packages to the latest version (bsc#1187466)
- version 1.14.47</changelog>
  <changelog author="ma@suse.de" date="1627473600">- Support new reports for singletrans rpm commit.
- BuildRequires:  libzypp-devel &gt;= 17.27.1.
  For lock/query comments.
- Prompt: choose exact match if prompt options are not prefix
  free (bsc#1188156)
- Install summary: Show new and removed packages closer to the
  prompt (fixes #403)
  These packages are usually more interesting than the updated
  ones. In case of doubt less scrolling is needed to see them.
- Add need reboot/restart hint to XML install summary
  (bsc#1188435)
- Add comment option for lock command (fixes #388).
- version 1.14.48</changelog>
  <changelog author="ma@suse.de" date="1630670400">- Avoid calling 'su' to detect a too restrictive sudo user umask
  (bsc#1186602)
- Fix typo in German translation (fixes #395)
- BuildRequires:  libzypp-devel &gt;= 17.28.3.
- version 1.14.49</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Fix compiler warning.
- zypper.conf: New option whether to collect subcommands found in
  $PATH (fixes #379)
  +[subcommand] i
  +
  +##  Whether to look for subcommands in $PATH
  +##
  +## If a subcommand is not found in the zypper_execdir, the wrapper
  +## will look in the rest of your $PATH for it. Thus, it's possible
  +## to write local zypper extensions that don't live in system space.
  +## See section SUBCOMMANDS in the zypper manpage.
  +##
  +## Valid values: boolean
  +## Default value: yes
  +##
  +# seachSubcommandInPath = yes.
- help subcommand: show path of command found in $PATH.
- version 1.14.50</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Singletrans: handle fatal and non-fatal script errors properly.
- Add SingleTransReportReceiver.
- Immediately write out additional rpm output.
- BuildRequires:  libzypp-devel &gt;= 17.29.0.
  Need SingleTransReport and immediate rpm script output reports.
- version 1.14.51</changelog>
  <changelog author="ma@suse.de" date="1645704000">- info: print the packages upstream URL if available (fixes #426)
- info: Fix SEGV with not installed PTFs (bsc#1196317)
- Don't prevent less restrictive umasks (bsc#1195999)
- version 1.14.52</changelog>
  <changelog author="ma@suse.de" date="1655294400">- Basic JobReport for "cmdout/monitor".
- versioncmp: if verbose, also print the edition 'parts' which are
  compared.
- Make sure MediaAccess is closed on exception (bsc#1194550)
- Display plus-content hint conditionally (fixes #433)
- Honor the NO_COLOR environment variable when auto-detecting
  whether to use color (fixes #432)
- Define table columns which should be sorted natural [case
  insensitive] (fixes #391, closes #396, fixes #424)
- lr/ls: Use highlight color on name and alias as well.
- version 1.14.53</changelog>
</package>
<package pkgid="ddcff01d80a0008dac7f866df53de4cc9a32e28e0ee287aa61146a4aa0339ef7" name="zypper" arch="src">
  <version epoch="0" ver="1.14.53" rel="150200.33.1"/>
  <changelog author="ma@suse.de" date="1582286400">- Do not allow the abbreviation of cli arguments (bsc#1164543)
- accoring to according in all translation files.
- Always show exception history if available.
- Use default package cache location for temporary repos (bsc#1130873)
- version 1.14.34</changelog>
  <changelog author="ma@suse.de" date="1584705600">- Tag 'retracted' patch status in info and list-patches (jsc#SLE-8770)
- Tag 'R'etracted items in search tabes status columns (jsc#SLE-8770)
- Relax 'Do not allow the abbreviation of cli arguments' in
  legacy distibutions (bsc#1164543)
- Correctly detect ambigous switch abbreviations (bsc#1165573)
- zypper-aptitude: don't supplement zypper.
  supplementing zypper means zypper-aptitude gets installed by
  default and pulls in perl. Neither is desired on small systems.
- BuildRequires:  libzypp-devel &gt;= 17.23.2.
- version 1.14.35</changelog>
  <changelog author="ma@suse.de" date="1586779200">- Reformat manpages to workaround asciidoctor shortcomings
  (bsc#1154803, bsc#1167122, bsc#1168990)
- Remove undocumented rug legacy stuff.
- Remove 'using namespace std;' (bsc#1166610)
- patch table: Add 'Since' column if history data are available
  (jsc#SLE-5116)
- version 1.14.36</changelog>
  <changelog author="bzeller@suse.de" date="1592222400">- Print switch abbrev warning to stderr (bsc#1172925)
- Fix typo in man page (bsc#1169947)
- version 1.14.37</changelog>
  <changelog author="ma@suse.de" date="1598616000">- Directly list subcommands in 'zypper help' (bsc#1165424)
- man: enhance description of the global package cache (bsc#1175592)
- Remove extern C block wrapping augeas.h as it breaks the build
  on Arch Linux.
- Point out that plaindir repos do not follow symlinks (bsc#1174561)
- Fix help command for list-patches
- man: Point out that plain rpm packages are not downloaded to the
  global package cache (bsc#1173273)
- version 1.14.38</changelog>
  <changelog author="ma@suse.de" date="1600430400">- Use new testcase API in libzypp.
- BuildRequires:  libzypp-devel &gt;= 17.25.0.
- help: prevent 'whatis' from writing to stderr (bsc#1176712)
- wp: point out that command is aliased to a search command and
  searches case-insensitive (jsc#SLE-16271)
- version 1.14.39</changelog>
  <changelog author="ma@suse.de" date="1601035200">- info: Assume descriptions starting with '&lt;p&gt;' are richtext
  (bsc#935885)
- version 1.14.40</changelog>
  <changelog author="ma@suse.de" date="1606478400">- Avoid translated text in xml attributes ( fixes #361 )
- BuildRequires:  libzypp-devel &gt;= 17.25.3.
  Adapt to new LoadTestcase API.
- version 1.14.41</changelog>
  <changelog author="ma@suse.de" date="1610452800">- Fix source-download commnds help (bsc#1180663)
- man: Recommend to use the --non-interactive global option
  rather than the command option -y (bsc#1179816)
- Extend apt packagemap (fixes #366)
- --quitet: Fix install summary to write nothing if there's
  nothing todo (bsc#1180077)
- Prefer /run over /var/run.
- version 1.14.42</changelog>
  <changelog author="ma@suse.de" date="1614168000">- doc: give more details about creating versioned package locks
  (bsc#1181622)
- man: Document synonymously used patch categories (bsc#1179847)
- version 1.14.43</changelog>
  <changelog author="ma@suse.de" date="1619784000">- Rephrase needs-rebooting help and messages.
  Try to point out that the need to reboot was not necessarily
  triggered by the current transaction.
- man page: Recommend the needs-rebooting command to test whether
  a system reboot is suggested.
- patch: Let a patch's reboot-needed flag overrule included packages
  (bsc#1183268)
- Quickfix setting "openSUSE_Tumbleweed" as default platform for
  "MicroOS" (bsc#1153687)
  This fixes the guessed platform for "obs://&lt;project&gt;/" URLs.
- Protect against strict/relaxed user umask via sudo (bsc#1183589)
- zypper-log: protect against thread name indicators in a log.
- xml summary: add solvables repository alias (bsc#1182372)
- version 1.14.44</changelog>
  <changelog author="ma@suse.de" date="1622635200">- Add hints to 'trust GPG key' prompt.
- Add report when receiving new package signing keys from a
  trusted repo (bsc#1184326)
- Added translation using Weblate (Kabyle)
- version 1.14.45</changelog>
  <changelog author="ma@suse.de" date="1623326400">- Link all executables with -pie (bsc#1186447)
- Tag PTF packages in the status column (bsc#1186503)
  Like retracted packages, a program temporary fix must be
  explicitly selected and will otherwise not be considered in
  dependency resolution.
- BuildRequires:  libzypp-devel &gt;= 17.26.1.
- version 1.14.46</changelog>
  <changelog author="ma@suse.de" date="1625140800">- Quick fix obs:// platform guessing for Leap (bsc#1187425)
- man: point out more clearly that patches update affected
  packages to the latest version (bsc#1187466)
- version 1.14.47</changelog>
  <changelog author="ma@suse.de" date="1627473600">- Support new reports for singletrans rpm commit.
- BuildRequires:  libzypp-devel &gt;= 17.27.1.
  For lock/query comments.
- Prompt: choose exact match if prompt options are not prefix
  free (bsc#1188156)
- Install summary: Show new and removed packages closer to the
  prompt (fixes #403)
  These packages are usually more interesting than the updated
  ones. In case of doubt less scrolling is needed to see them.
- Add need reboot/restart hint to XML install summary
  (bsc#1188435)
- Add comment option for lock command (fixes #388).
- version 1.14.48</changelog>
  <changelog author="ma@suse.de" date="1630670400">- Avoid calling 'su' to detect a too restrictive sudo user umask
  (bsc#1186602)
- Fix typo in German translation (fixes #395)
- BuildRequires:  libzypp-devel &gt;= 17.28.3.
- version 1.14.49</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Fix compiler warning.
- zypper.conf: New option whether to collect subcommands found in
  $PATH (fixes #379)
  +[subcommand] i
  +
  +##  Whether to look for subcommands in $PATH
  +##
  +## If a subcommand is not found in the zypper_execdir, the wrapper
  +## will look in the rest of your $PATH for it. Thus, it's possible
  +## to write local zypper extensions that don't live in system space.
  +## See section SUBCOMMANDS in the zypper manpage.
  +##
  +## Valid values: boolean
  +## Default value: yes
  +##
  +# seachSubcommandInPath = yes.
- help subcommand: show path of command found in $PATH.
- version 1.14.50</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Singletrans: handle fatal and non-fatal script errors properly.
- Add SingleTransReportReceiver.
- Immediately write out additional rpm output.
- BuildRequires:  libzypp-devel &gt;= 17.29.0.
  Need SingleTransReport and immediate rpm script output reports.
- version 1.14.51</changelog>
  <changelog author="ma@suse.de" date="1645704000">- info: print the packages upstream URL if available (fixes #426)
- info: Fix SEGV with not installed PTFs (bsc#1196317)
- Don't prevent less restrictive umasks (bsc#1195999)
- version 1.14.52</changelog>
  <changelog author="ma@suse.de" date="1655294400">- Basic JobReport for "cmdout/monitor".
- versioncmp: if verbose, also print the edition 'parts' which are
  compared.
- Make sure MediaAccess is closed on exception (bsc#1194550)
- Display plus-content hint conditionally (fixes #433)
- Honor the NO_COLOR environment variable when auto-detecting
  whether to use color (fixes #432)
- Define table columns which should be sorted natural [case
  insensitive] (fixes #391, closes #396, fixes #424)
- lr/ls: Use highlight color on name and alias as well.
- version 1.14.53</changelog>
</package>
<package pkgid="cd31db4bd83b3506026264c721c985a2ec0eebc3dc3276e4e70990a25f0f3029" name="zypper" arch="x86_64">
  <version epoch="0" ver="1.14.53" rel="150200.33.1"/>
  <changelog author="ma@suse.de" date="1582286400">- Do not allow the abbreviation of cli arguments (bsc#1164543)
- accoring to according in all translation files.
- Always show exception history if available.
- Use default package cache location for temporary repos (bsc#1130873)
- version 1.14.34</changelog>
  <changelog author="ma@suse.de" date="1584705600">- Tag 'retracted' patch status in info and list-patches (jsc#SLE-8770)
- Tag 'R'etracted items in search tabes status columns (jsc#SLE-8770)
- Relax 'Do not allow the abbreviation of cli arguments' in
  legacy distibutions (bsc#1164543)
- Correctly detect ambigous switch abbreviations (bsc#1165573)
- zypper-aptitude: don't supplement zypper.
  supplementing zypper means zypper-aptitude gets installed by
  default and pulls in perl. Neither is desired on small systems.
- BuildRequires:  libzypp-devel &gt;= 17.23.2.
- version 1.14.35</changelog>
  <changelog author="ma@suse.de" date="1586779200">- Reformat manpages to workaround asciidoctor shortcomings
  (bsc#1154803, bsc#1167122, bsc#1168990)
- Remove undocumented rug legacy stuff.
- Remove 'using namespace std;' (bsc#1166610)
- patch table: Add 'Since' column if history data are available
  (jsc#SLE-5116)
- version 1.14.36</changelog>
  <changelog author="bzeller@suse.de" date="1592222400">- Print switch abbrev warning to stderr (bsc#1172925)
- Fix typo in man page (bsc#1169947)
- version 1.14.37</changelog>
  <changelog author="ma@suse.de" date="1598616000">- Directly list subcommands in 'zypper help' (bsc#1165424)
- man: enhance description of the global package cache (bsc#1175592)
- Remove extern C block wrapping augeas.h as it breaks the build
  on Arch Linux.
- Point out that plaindir repos do not follow symlinks (bsc#1174561)
- Fix help command for list-patches
- man: Point out that plain rpm packages are not downloaded to the
  global package cache (bsc#1173273)
- version 1.14.38</changelog>
  <changelog author="ma@suse.de" date="1600430400">- Use new testcase API in libzypp.
- BuildRequires:  libzypp-devel &gt;= 17.25.0.
- help: prevent 'whatis' from writing to stderr (bsc#1176712)
- wp: point out that command is aliased to a search command and
  searches case-insensitive (jsc#SLE-16271)
- version 1.14.39</changelog>
  <changelog author="ma@suse.de" date="1601035200">- info: Assume descriptions starting with '&lt;p&gt;' are richtext
  (bsc#935885)
- version 1.14.40</changelog>
  <changelog author="ma@suse.de" date="1606478400">- Avoid translated text in xml attributes ( fixes #361 )
- BuildRequires:  libzypp-devel &gt;= 17.25.3.
  Adapt to new LoadTestcase API.
- version 1.14.41</changelog>
  <changelog author="ma@suse.de" date="1610452800">- Fix source-download commnds help (bsc#1180663)
- man: Recommend to use the --non-interactive global option
  rather than the command option -y (bsc#1179816)
- Extend apt packagemap (fixes #366)
- --quitet: Fix install summary to write nothing if there's
  nothing todo (bsc#1180077)
- Prefer /run over /var/run.
- version 1.14.42</changelog>
  <changelog author="ma@suse.de" date="1614168000">- doc: give more details about creating versioned package locks
  (bsc#1181622)
- man: Document synonymously used patch categories (bsc#1179847)
- version 1.14.43</changelog>
  <changelog author="ma@suse.de" date="1619784000">- Rephrase needs-rebooting help and messages.
  Try to point out that the need to reboot was not necessarily
  triggered by the current transaction.
- man page: Recommend the needs-rebooting command to test whether
  a system reboot is suggested.
- patch: Let a patch's reboot-needed flag overrule included packages
  (bsc#1183268)
- Quickfix setting "openSUSE_Tumbleweed" as default platform for
  "MicroOS" (bsc#1153687)
  This fixes the guessed platform for "obs://&lt;project&gt;/" URLs.
- Protect against strict/relaxed user umask via sudo (bsc#1183589)
- zypper-log: protect against thread name indicators in a log.
- xml summary: add solvables repository alias (bsc#1182372)
- version 1.14.44</changelog>
  <changelog author="ma@suse.de" date="1622635200">- Add hints to 'trust GPG key' prompt.
- Add report when receiving new package signing keys from a
  trusted repo (bsc#1184326)
- Added translation using Weblate (Kabyle)
- version 1.14.45</changelog>
  <changelog author="ma@suse.de" date="1623326400">- Link all executables with -pie (bsc#1186447)
- Tag PTF packages in the status column (bsc#1186503)
  Like retracted packages, a program temporary fix must be
  explicitly selected and will otherwise not be considered in
  dependency resolution.
- BuildRequires:  libzypp-devel &gt;= 17.26.1.
- version 1.14.46</changelog>
  <changelog author="ma@suse.de" date="1625140800">- Quick fix obs:// platform guessing for Leap (bsc#1187425)
- man: point out more clearly that patches update affected
  packages to the latest version (bsc#1187466)
- version 1.14.47</changelog>
  <changelog author="ma@suse.de" date="1627473600">- Support new reports for singletrans rpm commit.
- BuildRequires:  libzypp-devel &gt;= 17.27.1.
  For lock/query comments.
- Prompt: choose exact match if prompt options are not prefix
  free (bsc#1188156)
- Install summary: Show new and removed packages closer to the
  prompt (fixes #403)
  These packages are usually more interesting than the updated
  ones. In case of doubt less scrolling is needed to see them.
- Add need reboot/restart hint to XML install summary
  (bsc#1188435)
- Add comment option for lock command (fixes #388).
- version 1.14.48</changelog>
  <changelog author="ma@suse.de" date="1630670400">- Avoid calling 'su' to detect a too restrictive sudo user umask
  (bsc#1186602)
- Fix typo in German translation (fixes #395)
- BuildRequires:  libzypp-devel &gt;= 17.28.3.
- version 1.14.49</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Fix compiler warning.
- zypper.conf: New option whether to collect subcommands found in
  $PATH (fixes #379)
  +[subcommand] i
  +
  +##  Whether to look for subcommands in $PATH
  +##
  +## If a subcommand is not found in the zypper_execdir, the wrapper
  +## will look in the rest of your $PATH for it. Thus, it's possible
  +## to write local zypper extensions that don't live in system space.
  +## See section SUBCOMMANDS in the zypper manpage.
  +##
  +## Valid values: boolean
  +## Default value: yes
  +##
  +# seachSubcommandInPath = yes.
- help subcommand: show path of command found in $PATH.
- version 1.14.50</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Singletrans: handle fatal and non-fatal script errors properly.
- Add SingleTransReportReceiver.
- Immediately write out additional rpm output.
- BuildRequires:  libzypp-devel &gt;= 17.29.0.
  Need SingleTransReport and immediate rpm script output reports.
- version 1.14.51</changelog>
  <changelog author="ma@suse.de" date="1645704000">- info: print the packages upstream URL if available (fixes #426)
- info: Fix SEGV with not installed PTFs (bsc#1196317)
- Don't prevent less restrictive umasks (bsc#1195999)
- version 1.14.52</changelog>
  <changelog author="ma@suse.de" date="1655294400">- Basic JobReport for "cmdout/monitor".
- versioncmp: if verbose, also print the edition 'parts' which are
  compared.
- Make sure MediaAccess is closed on exception (bsc#1194550)
- Display plus-content hint conditionally (fixes #433)
- Honor the NO_COLOR environment variable when auto-detecting
  whether to use color (fixes #432)
- Define table columns which should be sorted natural [case
  insensitive] (fixes #391, closes #396, fixes #424)
- lr/ls: Use highlight color on name and alias as well.
- version 1.14.53</changelog>
</package>
<package pkgid="73cec69f509ba0c0a90703c15a9db44ff6cabd5bfc68052a5c912b515b2f2086" name="zypper-needs-restarting" arch="noarch">
  <version epoch="0" ver="1.14.52" rel="150200.30.2"/>
  <changelog author="ma@suse.de" date="1574942400">- Introduce purge-kernels command (bsc#1155198)
  Adds a new zypper command to cleanup all obsolete kernels as
  configured by the user.
- Request root privs for zypper addlocale and removelocale.
- Load only target resolvables for removelocale.
- Load only target resolvables for zypper rm (bsc#1157377)
- Fix broken search by filelist (bsc#1135114 )
- zypper-log: Replace python by a bash script (fixes#304,
  fixes#306, bsc#1156158)
- locales: do not sort out requested locales which are not
  available (bsc#1155678)
- list_patches_by_issue: rewrite table output and add xml output
  (bsc#1154805)
  Prevent listing duplicate matches in tables. XML result is
  provided within the new &lt;list-patches-byissue&gt; element.
- list-patches: XML add patch &lt;issue-date&gt; and &lt;issue-list&gt;
  (bsc#1154805)
- Fix zypper lp --cve/bugzilla/issue options (bsc#1155298)
- Always execute commit when adding/removing locales (fixes
  bsc#1155205)
- man page: fix description of --table-style,-s (bsc#1154804)
- Provide reverse search in zypper (fixes #214)
  This patch adds a new set of switches to zypper to support
  searching reverse dependencies for a package or a set of packages.
- BuildRequires:  libzypp-devel &gt;= 17.16.1.
- version 1.14.33</changelog>
  <changelog author="ma@suse.de" date="1582286400">- Do not allow the abbreviation of cli arguments (bsc#1164543)
- accoring to according in all translation files.
- Always show exception history if available.
- Use default package cache location for temporary repos (bsc#1130873)
- version 1.14.34</changelog>
  <changelog author="ma@suse.de" date="1584705600">- Tag 'retracted' patch status in info and list-patches (jsc#SLE-8770)
- Tag 'R'etracted items in search tabes status columns (jsc#SLE-8770)
- Relax 'Do not allow the abbreviation of cli arguments' in
  legacy distibutions (bsc#1164543)
- Correctly detect ambigous switch abbreviations (bsc#1165573)
- zypper-aptitude: don't supplement zypper.
  supplementing zypper means zypper-aptitude gets installed by
  default and pulls in perl. Neither is desired on small systems.
- BuildRequires:  libzypp-devel &gt;= 17.23.2.
- version 1.14.35</changelog>
  <changelog author="ma@suse.de" date="1586779200">- Reformat manpages to workaround asciidoctor shortcomings
  (bsc#1154803, bsc#1167122, bsc#1168990)
- Remove undocumented rug legacy stuff.
- Remove 'using namespace std;' (bsc#1166610)
- patch table: Add 'Since' column if history data are available
  (jsc#SLE-5116)
- version 1.14.36</changelog>
  <changelog author="bzeller@suse.de" date="1592222400">- Print switch abbrev warning to stderr (bsc#1172925)
- Fix typo in man page (bsc#1169947)
- version 1.14.37</changelog>
  <changelog author="ma@suse.de" date="1598616000">- Directly list subcommands in 'zypper help' (bsc#1165424)
- man: enhance description of the global package cache (bsc#1175592)
- Remove extern C block wrapping augeas.h as it breaks the build
  on Arch Linux.
- Point out that plaindir repos do not follow symlinks (bsc#1174561)
- Fix help command for list-patches
- man: Point out that plain rpm packages are not downloaded to the
  global package cache (bsc#1173273)
- version 1.14.38</changelog>
  <changelog author="ma@suse.de" date="1600430400">- Use new testcase API in libzypp.
- BuildRequires:  libzypp-devel &gt;= 17.25.0.
- help: prevent 'whatis' from writing to stderr (bsc#1176712)
- wp: point out that command is aliased to a search command and
  searches case-insensitive (jsc#SLE-16271)
- version 1.14.39</changelog>
  <changelog author="ma@suse.de" date="1601035200">- info: Assume descriptions starting with '&lt;p&gt;' are richtext
  (bsc#935885)
- version 1.14.40</changelog>
  <changelog author="ma@suse.de" date="1606478400">- Avoid translated text in xml attributes ( fixes #361 )
- BuildRequires:  libzypp-devel &gt;= 17.25.3.
  Adapt to new LoadTestcase API.
- version 1.14.41</changelog>
  <changelog author="ma@suse.de" date="1610452800">- Fix source-download commnds help (bsc#1180663)
- man: Recommend to use the --non-interactive global option
  rather than the command option -y (bsc#1179816)
- Extend apt packagemap (fixes #366)
- --quitet: Fix install summary to write nothing if there's
  nothing todo (bsc#1180077)
- Prefer /run over /var/run.
- version 1.14.42</changelog>
  <changelog author="ma@suse.de" date="1614168000">- doc: give more details about creating versioned package locks
  (bsc#1181622)
- man: Document synonymously used patch categories (bsc#1179847)
- version 1.14.43</changelog>
  <changelog author="ma@suse.de" date="1619784000">- Rephrase needs-rebooting help and messages.
  Try to point out that the need to reboot was not necessarily
  triggered by the current transaction.
- man page: Recommend the needs-rebooting command to test whether
  a system reboot is suggested.
- patch: Let a patch's reboot-needed flag overrule included packages
  (bsc#1183268)
- Quickfix setting "openSUSE_Tumbleweed" as default platform for
  "MicroOS" (bsc#1153687)
  This fixes the guessed platform for "obs://&lt;project&gt;/" URLs.
- Protect against strict/relaxed user umask via sudo (bsc#1183589)
- zypper-log: protect against thread name indicators in a log.
- xml summary: add solvables repository alias (bsc#1182372)
- version 1.14.44</changelog>
  <changelog author="ma@suse.de" date="1622635200">- Add hints to 'trust GPG key' prompt.
- Add report when receiving new package signing keys from a
  trusted repo (bsc#1184326)
- Added translation using Weblate (Kabyle)
- version 1.14.45</changelog>
  <changelog author="ma@suse.de" date="1623326400">- Link all executables with -pie (bsc#1186447)
- Tag PTF packages in the status column (bsc#1186503)
  Like retracted packages, a program temporary fix must be
  explicitly selected and will otherwise not be considered in
  dependency resolution.
- BuildRequires:  libzypp-devel &gt;= 17.26.1.
- version 1.14.46</changelog>
  <changelog author="ma@suse.de" date="1625140800">- Quick fix obs:// platform guessing for Leap (bsc#1187425)
- man: point out more clearly that patches update affected
  packages to the latest version (bsc#1187466)
- version 1.14.47</changelog>
  <changelog author="ma@suse.de" date="1627473600">- Support new reports for singletrans rpm commit.
- BuildRequires:  libzypp-devel &gt;= 17.27.1.
  For lock/query comments.
- Prompt: choose exact match if prompt options are not prefix
  free (bsc#1188156)
- Install summary: Show new and removed packages closer to the
  prompt (fixes #403)
  These packages are usually more interesting than the updated
  ones. In case of doubt less scrolling is needed to see them.
- Add need reboot/restart hint to XML install summary
  (bsc#1188435)
- Add comment option for lock command (fixes #388).
- version 1.14.48</changelog>
  <changelog author="ma@suse.de" date="1630670400">- Avoid calling 'su' to detect a too restrictive sudo user umask
  (bsc#1186602)
- Fix typo in German translation (fixes #395)
- BuildRequires:  libzypp-devel &gt;= 17.28.3.
- version 1.14.49</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Fix compiler warning.
- zypper.conf: New option whether to collect subcommands found in
  $PATH (fixes #379)
  +[subcommand] i
  +
  +##  Whether to look for subcommands in $PATH
  +##
  +## If a subcommand is not found in the zypper_execdir, the wrapper
  +## will look in the rest of your $PATH for it. Thus, it's possible
  +## to write local zypper extensions that don't live in system space.
  +## See section SUBCOMMANDS in the zypper manpage.
  +##
  +## Valid values: boolean
  +## Default value: yes
  +##
  +# seachSubcommandInPath = yes.
- help subcommand: show path of command found in $PATH.
- version 1.14.50</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Singletrans: handle fatal and non-fatal script errors properly.
- Add SingleTransReportReceiver.
- Immediately write out additional rpm output.
- BuildRequires:  libzypp-devel &gt;= 17.29.0.
  Need SingleTransReport and immediate rpm script output reports.
- version 1.14.51</changelog>
  <changelog author="ma@suse.de" date="1645704000">- info: print the packages upstream URL if available (fixes #426)
- info: Fix SEGV with not installed PTFs (bsc#1196317)
- Don't prevent less restrictive umasks (bsc#1195999)
- version 1.14.52</changelog>
</package>
<package pkgid="5b305c27ffee3fd0fb4cd75f6086bc74173e2b9f9d3d16016501e728fa5d4b0a" name="zypper-needs-restarting" arch="noarch">
  <version epoch="0" ver="1.14.53" rel="150200.33.1"/>
  <changelog author="ma@suse.de" date="1582286400">- Do not allow the abbreviation of cli arguments (bsc#1164543)
- accoring to according in all translation files.
- Always show exception history if available.
- Use default package cache location for temporary repos (bsc#1130873)
- version 1.14.34</changelog>
  <changelog author="ma@suse.de" date="1584705600">- Tag 'retracted' patch status in info and list-patches (jsc#SLE-8770)
- Tag 'R'etracted items in search tabes status columns (jsc#SLE-8770)
- Relax 'Do not allow the abbreviation of cli arguments' in
  legacy distibutions (bsc#1164543)
- Correctly detect ambigous switch abbreviations (bsc#1165573)
- zypper-aptitude: don't supplement zypper.
  supplementing zypper means zypper-aptitude gets installed by
  default and pulls in perl. Neither is desired on small systems.
- BuildRequires:  libzypp-devel &gt;= 17.23.2.
- version 1.14.35</changelog>
  <changelog author="ma@suse.de" date="1586779200">- Reformat manpages to workaround asciidoctor shortcomings
  (bsc#1154803, bsc#1167122, bsc#1168990)
- Remove undocumented rug legacy stuff.
- Remove 'using namespace std;' (bsc#1166610)
- patch table: Add 'Since' column if history data are available
  (jsc#SLE-5116)
- version 1.14.36</changelog>
  <changelog author="bzeller@suse.de" date="1592222400">- Print switch abbrev warning to stderr (bsc#1172925)
- Fix typo in man page (bsc#1169947)
- version 1.14.37</changelog>
  <changelog author="ma@suse.de" date="1598616000">- Directly list subcommands in 'zypper help' (bsc#1165424)
- man: enhance description of the global package cache (bsc#1175592)
- Remove extern C block wrapping augeas.h as it breaks the build
  on Arch Linux.
- Point out that plaindir repos do not follow symlinks (bsc#1174561)
- Fix help command for list-patches
- man: Point out that plain rpm packages are not downloaded to the
  global package cache (bsc#1173273)
- version 1.14.38</changelog>
  <changelog author="ma@suse.de" date="1600430400">- Use new testcase API in libzypp.
- BuildRequires:  libzypp-devel &gt;= 17.25.0.
- help: prevent 'whatis' from writing to stderr (bsc#1176712)
- wp: point out that command is aliased to a search command and
  searches case-insensitive (jsc#SLE-16271)
- version 1.14.39</changelog>
  <changelog author="ma@suse.de" date="1601035200">- info: Assume descriptions starting with '&lt;p&gt;' are richtext
  (bsc#935885)
- version 1.14.40</changelog>
  <changelog author="ma@suse.de" date="1606478400">- Avoid translated text in xml attributes ( fixes #361 )
- BuildRequires:  libzypp-devel &gt;= 17.25.3.
  Adapt to new LoadTestcase API.
- version 1.14.41</changelog>
  <changelog author="ma@suse.de" date="1610452800">- Fix source-download commnds help (bsc#1180663)
- man: Recommend to use the --non-interactive global option
  rather than the command option -y (bsc#1179816)
- Extend apt packagemap (fixes #366)
- --quitet: Fix install summary to write nothing if there's
  nothing todo (bsc#1180077)
- Prefer /run over /var/run.
- version 1.14.42</changelog>
  <changelog author="ma@suse.de" date="1614168000">- doc: give more details about creating versioned package locks
  (bsc#1181622)
- man: Document synonymously used patch categories (bsc#1179847)
- version 1.14.43</changelog>
  <changelog author="ma@suse.de" date="1619784000">- Rephrase needs-rebooting help and messages.
  Try to point out that the need to reboot was not necessarily
  triggered by the current transaction.
- man page: Recommend the needs-rebooting command to test whether
  a system reboot is suggested.
- patch: Let a patch's reboot-needed flag overrule included packages
  (bsc#1183268)
- Quickfix setting "openSUSE_Tumbleweed" as default platform for
  "MicroOS" (bsc#1153687)
  This fixes the guessed platform for "obs://&lt;project&gt;/" URLs.
- Protect against strict/relaxed user umask via sudo (bsc#1183589)
- zypper-log: protect against thread name indicators in a log.
- xml summary: add solvables repository alias (bsc#1182372)
- version 1.14.44</changelog>
  <changelog author="ma@suse.de" date="1622635200">- Add hints to 'trust GPG key' prompt.
- Add report when receiving new package signing keys from a
  trusted repo (bsc#1184326)
- Added translation using Weblate (Kabyle)
- version 1.14.45</changelog>
  <changelog author="ma@suse.de" date="1623326400">- Link all executables with -pie (bsc#1186447)
- Tag PTF packages in the status column (bsc#1186503)
  Like retracted packages, a program temporary fix must be
  explicitly selected and will otherwise not be considered in
  dependency resolution.
- BuildRequires:  libzypp-devel &gt;= 17.26.1.
- version 1.14.46</changelog>
  <changelog author="ma@suse.de" date="1625140800">- Quick fix obs:// platform guessing for Leap (bsc#1187425)
- man: point out more clearly that patches update affected
  packages to the latest version (bsc#1187466)
- version 1.14.47</changelog>
  <changelog author="ma@suse.de" date="1627473600">- Support new reports for singletrans rpm commit.
- BuildRequires:  libzypp-devel &gt;= 17.27.1.
  For lock/query comments.
- Prompt: choose exact match if prompt options are not prefix
  free (bsc#1188156)
- Install summary: Show new and removed packages closer to the
  prompt (fixes #403)
  These packages are usually more interesting than the updated
  ones. In case of doubt less scrolling is needed to see them.
- Add need reboot/restart hint to XML install summary
  (bsc#1188435)
- Add comment option for lock command (fixes #388).
- version 1.14.48</changelog>
  <changelog author="ma@suse.de" date="1630670400">- Avoid calling 'su' to detect a too restrictive sudo user umask
  (bsc#1186602)
- Fix typo in German translation (fixes #395)
- BuildRequires:  libzypp-devel &gt;= 17.28.3.
- version 1.14.49</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Fix compiler warning.
- zypper.conf: New option whether to collect subcommands found in
  $PATH (fixes #379)
  +[subcommand] i
  +
  +##  Whether to look for subcommands in $PATH
  +##
  +## If a subcommand is not found in the zypper_execdir, the wrapper
  +## will look in the rest of your $PATH for it. Thus, it's possible
  +## to write local zypper extensions that don't live in system space.
  +## See section SUBCOMMANDS in the zypper manpage.
  +##
  +## Valid values: boolean
  +## Default value: yes
  +##
  +# seachSubcommandInPath = yes.
- help subcommand: show path of command found in $PATH.
- version 1.14.50</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Singletrans: handle fatal and non-fatal script errors properly.
- Add SingleTransReportReceiver.
- Immediately write out additional rpm output.
- BuildRequires:  libzypp-devel &gt;= 17.29.0.
  Need SingleTransReport and immediate rpm script output reports.
- version 1.14.51</changelog>
  <changelog author="ma@suse.de" date="1645704000">- info: print the packages upstream URL if available (fixes #426)
- info: Fix SEGV with not installed PTFs (bsc#1196317)
- Don't prevent less restrictive umasks (bsc#1195999)
- version 1.14.52</changelog>
  <changelog author="ma@suse.de" date="1655294400">- Basic JobReport for "cmdout/monitor".
- versioncmp: if verbose, also print the edition 'parts' which are
  compared.
- Make sure MediaAccess is closed on exception (bsc#1194550)
- Display plus-content hint conditionally (fixes #433)
- Honor the NO_COLOR environment variable when auto-detecting
  whether to use color (fixes #432)
- Define table columns which should be sorted natural [case
  insensitive] (fixes #391, closes #396, fixes #424)
- lr/ls: Use highlight color on name and alias as well.
- version 1.14.53</changelog>
</package>
</otherdata>